diff --git a/CleanSpec.mk b/CleanSpec.mk
index 531e44e..0900eea 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -66,3 +66,6 @@
 $(call add-clean-step, find $(PRODUCT_OUT)/system $(PRODUCT_OUT)/vendor -type f -name "android\.hardware\.configstore\@1\.1*" -print0 | xargs -0 rm -f)
 $(call add-clean-step, find $(PRODUCT_OUT)/system $(PRODUCT_OUT)/vendor -type f -name "android\.hardware\.configstore*" -print0 | xargs -0 rm -f)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/seccomp_policy/configstore@1.0.policy)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/seccomp_policy/configstore@1.1.policy)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.configstore@1.1-service)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.configstore@1.1-service.rc)
diff --git a/audio/4.1/config/audio_policy_configuration.xsd b/audio/4.1/config/audio_policy_configuration.xsd
new file mode 100644
index 0000000..311b9c1
--- /dev/null
+++ b/audio/4.1/config/audio_policy_configuration.xsd
@@ -0,0 +1,595 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+         Licensed under the Apache License, Version 2.0 (the "License");
+         you may not use this file except in compliance with the License.
+         You may obtain a copy of the License at
+
+                    http://www.apache.org/licenses/LICENSE-2.0
+
+         Unless required by applicable law or agreed to in writing, software
+         distributed under the License is distributed on an "AS IS" BASIS,
+         WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+         See the License for the specific language governing permissions and
+         limitations under the License.
+-->
+<!-- TODO: define a targetNamespace. Note that it will break retrocompatibility -->
+<xs:schema version="2.0"
+           elementFormDefault="qualified"
+           attributeFormDefault="unqualified"
+           xmlns:xs="http://www.w3.org/2001/XMLSchema">
+    <!-- List the config versions supported by audio policy. -->
+    <xs:simpleType name="version">
+        <xs:restriction base="xs:decimal">
+            <xs:enumeration value="1.0"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="halVersion">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Version of the interface the hal implements.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:decimal">
+            <!-- List of HAL versions supported by the framework. -->
+            <xs:enumeration value="2.0"/>
+            <xs:enumeration value="3.0"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:element name="audioPolicyConfiguration">
+        <xs:complexType>
+            <xs:sequence>
+                <xs:element name="globalConfiguration" type="globalConfiguration"/>
+                <xs:element name="modules" type="modules" maxOccurs="unbounded"/>
+                <xs:element name="volumes" type="volumes" maxOccurs="unbounded"/>
+                <xs:element name="surroundSound" type="surroundSound" />
+            </xs:sequence>
+            <xs:attribute name="version" type="version"/>
+        </xs:complexType>
+        <xs:key name="moduleNameKey">
+            <xs:selector xpath="modules/module"/>
+            <xs:field xpath="@name"/>
+        </xs:key>
+        <xs:unique name="volumeTargetUniqueness">
+            <xs:selector xpath="volumes/volume"/>
+            <xs:field xpath="@stream"/>
+            <xs:field xpath="@deviceCategory"/>
+        </xs:unique>
+        <xs:key name="volumeCurveNameKey">
+            <xs:selector xpath="volumes/reference"/>
+            <xs:field xpath="@name"/>
+        </xs:key>
+        <xs:keyref name="volumeCurveRef" refer="volumeCurveNameKey">
+            <xs:selector xpath="volumes/volume"/>
+            <xs:field xpath="@ref"/>
+        </xs:keyref>
+    </xs:element>
+    <xs:complexType name="globalConfiguration">
+        <xs:attribute name="speaker_drc_enabled" type="xs:boolean" use="required"/>
+    </xs:complexType>
+    <xs:complexType name="modules">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                There should be one section per audio HW module present on the platform.
+                Each <module/> contains two mandatory tags: “halVersion” and “name”.
+                The module "name" is the same as in previous .conf file.
+                Each module must contain the following sections:
+                 - <devicePorts/>: a list of device descriptors for all
+                   input and output devices accessible via this module.
+                   This contains both permanently attached devices and removable devices.
+                 - <mixPorts/>: listing all output and input streams exposed by the audio HAL
+                 - <routes/>: list of possible connections between input
+                   and output devices or between stream and devices.
+                   A <route/> is defined by a set of 3 attributes:
+                        -"type": mux|mix means all sources are mutual exclusive (mux) or can be mixed (mix)
+                        -"sink": the sink involved in this route
+                        -"sources": all the sources than can be connected to the sink via this route
+                 - <attachedDevices/>: permanently attached devices.
+                   The attachedDevices section is a list of devices names.
+                   Their names correspond to device names defined in "devicePorts" section.
+                 - <defaultOutputDevice/> is the device to be used when no policy rule applies
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="module" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="attachedDevices" type="attachedDevices" minOccurs="0">
+                            <xs:unique name="attachedDevicesUniqueness">
+                                <xs:selector xpath="item"/>
+                                <xs:field xpath="."/>
+                            </xs:unique>
+                        </xs:element>
+                        <xs:element name="defaultOutputDevice" type="xs:token" minOccurs="0"/>
+                        <xs:element name="mixPorts" type="mixPorts" minOccurs="0"/>
+                        <xs:element name="devicePorts" type="devicePorts" minOccurs="0"/>
+                        <xs:element name="routes" type="routes" minOccurs="0"/>
+                    </xs:sequence>
+                    <xs:attribute name="name" type="xs:string" use="required"/>
+                    <xs:attribute name="halVersion" type="halVersion" use="required"/>
+                </xs:complexType>
+                <xs:unique name="mixPortNameUniqueness">
+                    <xs:selector xpath="mixPorts/mixPort"/>
+                    <xs:field xpath="@name"/>
+                </xs:unique>
+                <xs:key name="devicePortNameKey">
+                    <xs:selector xpath="devicePorts/devicePort"/>
+                    <xs:field xpath="@tagName"/>
+                </xs:key>
+                <xs:unique name="devicePortUniqueness">
+                    <xs:selector xpath="devicePorts/devicePort"/>
+                    <xs:field xpath="@type"/>
+                    <xs:field xpath="@address"/>
+                </xs:unique>
+                <xs:keyref name="defaultOutputDeviceRef" refer="devicePortNameKey">
+                    <xs:selector xpath="defaultOutputDevice"/>
+                    <xs:field xpath="."/>
+                </xs:keyref>
+                <xs:keyref name="attachedDeviceRef" refer="devicePortNameKey">
+                    <xs:selector xpath="attachedDevices/item"/>
+                    <xs:field xpath="."/>
+                </xs:keyref>
+                <!-- The following 3 constraints try to make sure each sink port
+                     is reference in one an only one route. -->
+                <xs:key name="routeSinkKey">
+                    <!-- predicate [@type='sink'] does not work in xsd 1.0 -->
+                    <xs:selector xpath="devicePorts/devicePort|mixPorts/mixPort"/>
+                    <xs:field xpath="@tagName|@name"/>
+                </xs:key>
+                <xs:keyref name="routeSinkRef" refer="routeSinkKey">
+                    <xs:selector xpath="routes/route"/>
+                    <xs:field xpath="@sink"/>
+                </xs:keyref>
+                <xs:unique name="routeUniqueness">
+                    <xs:selector xpath="routes/route"/>
+                    <xs:field xpath="@sink"/>
+                </xs:unique>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:complexType name="attachedDevices">
+        <xs:sequence>
+            <xs:element name="item" type="xs:token" minOccurs="0" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+    <!-- TODO: separate values by space for better xsd validations. -->
+    <xs:simpleType name="audioInOutFlags">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                "|" separated list of audio_output_flags_t or audio_input_flags_t.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:pattern value="|[_A-Z]+(\|[_A-Z]+)*"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="role">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="sink"/>
+            <xs:enumeration value="source"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="mixPorts">
+        <xs:sequence>
+            <xs:element name="mixPort" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="profile" type="profile" minOccurs="0" maxOccurs="unbounded"/>
+                        <xs:element name="gains" type="gains" minOccurs="0"/>
+                    </xs:sequence>
+                    <xs:attribute name="name" type="xs:token" use="required"/>
+                    <xs:attribute name="role" type="role" use="required"/>
+                    <xs:attribute name="flags" type="audioInOutFlags"/>
+                    <xs:attribute name="maxOpenCount" type="xs:unsignedInt"/>
+                    <xs:attribute name="maxActiveCount" type="xs:unsignedInt"/>
+                    <xs:attribute name="preferredUsage" type="audioUsageList">
+                        <xs:annotation>
+                            <xs:documentation xml:lang="en">
+                                When choosing the mixPort of an audio track, the audioPolicy
+                                first considers the mixPorts with a preferredUsage including
+                                the track AudioUsage preferred .
+                                If non support the track format, the other mixPorts are considered.
+                                Eg: a <mixPort preferredUsage="AUDIO_USAGE_MEDIA" /> will receive
+                                    the audio of all apps playing with a MEDIA usage.
+                                    It may receive audio from ALARM if there are no audio compatible
+                                    <mixPort preferredUsage="AUDIO_USAGE_ALARM" />.
+                             </xs:documentation>
+                        </xs:annotation>
+                    </xs:attribute>
+                </xs:complexType>
+                <xs:unique name="mixPortProfileUniqueness">
+                    <xs:selector xpath="profile"/>
+                    <xs:field xpath="format"/>
+                    <xs:field xpath="samplingRate"/>
+                    <xs:field xpath="channelMasks"/>
+                </xs:unique>
+                <xs:unique name="mixPortGainUniqueness">
+                    <xs:selector xpath="gains/gain"/>
+                    <xs:field xpath="@name"/>
+                </xs:unique>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <!-- Enum values of audio_device_t in audio.h
+         TODO: generate from hidl to avoid manual sync.
+         TODO: separate source and sink in the xml for better xsd validations. -->
+    <xs:simpleType name="audioDevice">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_DEVICE_NONE"/>
+
+            <xs:enumeration value="AUDIO_DEVICE_OUT_EARPIECE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_SPEAKER"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_WIRED_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_WIRED_HEADPHONE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_AUX_DIGITAL"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HDMI"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_USB_ACCESSORY"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_USB_DEVICE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_REMOTE_SUBMIX"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_TELEPHONY_TX"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_LINE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HDMI_ARC"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_SPDIF"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_FM"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_AUX_LINE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_SPEAKER_SAFE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_IP"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BUS"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_PROXY"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_USB_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HEARING_AID"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_ECHO_CANCELLER"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_DEFAULT"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_STUB"/>
+
+            <!-- Due to the xml format, IN types can not be a separated from OUT types -->
+            <xs:enumeration value="AUDIO_DEVICE_IN_COMMUNICATION"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_AMBIENT"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BUILTIN_MIC"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_WIRED_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_AUX_DIGITAL"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_HDMI"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_VOICE_CALL"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_TELEPHONY_RX"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BACK_MIC"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_REMOTE_SUBMIX"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_ANLG_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_DGTL_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_USB_ACCESSORY"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_USB_DEVICE"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_FM_TUNER"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_TV_TUNER"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_LINE"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_SPDIF"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_A2DP"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_LOOPBACK"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_IP"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BUS"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_PROXY"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_USB_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_BLE"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_DEFAULT"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_STUB"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <!-- Enum values of audio_format_t in audio.h
+         TODO: generate from hidl to avoid manual sync. -->
+    <xs:simpleType name="audioFormat">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_FORMAT_PCM_16_BIT" />
+            <xs:enumeration value="AUDIO_FORMAT_PCM_8_BIT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_32_BIT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_8_24_BIT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_FLOAT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_24_BIT_PACKED"/>
+            <xs:enumeration value="AUDIO_FORMAT_MP3"/>
+            <xs:enumeration value="AUDIO_FORMAT_AMR_NB"/>
+            <xs:enumeration value="AUDIO_FORMAT_AMR_WB"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_MAIN"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_SSR"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LTP"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_HE_V1"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_SCALABLE"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ERLC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_HE_V2"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ELD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_MAIN"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_LC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_SSR"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_LTP"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_HE_V1"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_SCALABLE"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_ERLC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_LD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_HE_V2"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_ELD"/>
+            <xs:enumeration value="AUDIO_FORMAT_VORBIS"/>
+            <xs:enumeration value="AUDIO_FORMAT_HE_AAC_V1"/>
+            <xs:enumeration value="AUDIO_FORMAT_HE_AAC_V2"/>
+            <xs:enumeration value="AUDIO_FORMAT_OPUS"/>
+            <xs:enumeration value="AUDIO_FORMAT_AC3"/>
+            <xs:enumeration value="AUDIO_FORMAT_E_AC3"/>
+            <xs:enumeration value="AUDIO_FORMAT_DTS"/>
+            <xs:enumeration value="AUDIO_FORMAT_DTS_HD"/>
+            <xs:enumeration value="AUDIO_FORMAT_IEC61937"/>
+            <xs:enumeration value="AUDIO_FORMAT_DOLBY_TRUEHD"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRC"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRCB"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRCWB"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRCNW"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADIF"/>
+            <xs:enumeration value="AUDIO_FORMAT_WMA"/>
+            <xs:enumeration value="AUDIO_FORMAT_WMA_PRO"/>
+            <xs:enumeration value="AUDIO_FORMAT_AMR_WB_PLUS"/>
+            <xs:enumeration value="AUDIO_FORMAT_MP2"/>
+            <xs:enumeration value="AUDIO_FORMAT_QCELP"/>
+            <xs:enumeration value="AUDIO_FORMAT_DSD"/>
+            <xs:enumeration value="AUDIO_FORMAT_FLAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_ALAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_APE"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS"/>
+            <xs:enumeration value="AUDIO_FORMAT_SBC"/>
+            <xs:enumeration value="AUDIO_FORMAT_APTX"/>
+            <xs:enumeration value="AUDIO_FORMAT_APTX_HD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AC4"/>
+            <xs:enumeration value="AUDIO_FORMAT_LDAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_E_AC3_JOC"/>
+            <xs:enumeration value="AUDIO_FORMAT_MAT_1_0"/>
+            <xs:enumeration value="AUDIO_FORMAT_MAT_2_0"/>
+            <xs:enumeration value="AUDIO_FORMAT_MAT_2_1"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_XHE"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_XHE"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <!-- Enum values of audio::common::4_0::AudioUsage
+         TODO: generate from HIDL to avoid manual sync. -->
+    <xs:simpleType name="audioUsage">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_USAGE_UNKNOWN" />
+            <xs:enumeration value="AUDIO_USAGE_MEDIA" />
+            <xs:enumeration value="AUDIO_USAGE_VOICE_COMMUNICATION" />
+            <xs:enumeration value="AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING" />
+            <xs:enumeration value="AUDIO_USAGE_ALARM" />
+            <xs:enumeration value="AUDIO_USAGE_NOTIFICATION" />
+            <xs:enumeration value="AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANCE_ACCESSIBILITY" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANCE_SONIFICATION" />
+            <xs:enumeration value="AUDIO_USAGE_GAME" />
+            <xs:enumeration value="AUDIO_USAGE_VIRTUAL_SOURCE" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANT" />
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="audioUsageList">
+        <xs:list itemType="audioUsage"/>
+    </xs:simpleType>
+    <!-- TODO: Change to a space separated list to xsd enforce correctness. -->
+    <xs:simpleType name="samplingRates">
+        <xs:restriction base="xs:string">
+            <xs:pattern value="[0-9]+(,[0-9]+)*"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <!-- TODO: Change to a space separated list to xsd enforce correctness. -->
+    <xs:simpleType name="channelMask">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Comma (",") separated list of channel flags
+                from audio_channel_mask_t.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:pattern value="[_A-Z][_A-Z0-9]*(,[_A-Z][_A-Z0-9]*)*"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="profile">
+        <xs:attribute name="name" type="xs:token" use="optional"/>
+        <xs:attribute name="format" type="audioFormat" use="optional"/>
+        <xs:attribute name="samplingRates" type="samplingRates" use="optional"/>
+        <xs:attribute name="channelMasks" type="channelMask" use="optional"/>
+    </xs:complexType>
+    <xs:simpleType name="gainMode">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_GAIN_MODE_JOINT"/>
+            <xs:enumeration value="AUDIO_GAIN_MODE_CHANNELS"/>
+            <xs:enumeration value="AUDIO_GAIN_MODE_RAMP"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="gains">
+        <xs:sequence>
+            <xs:element name="gain" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:attribute name="name" type="xs:token" use="required"/>
+                    <xs:attribute name="mode" type="gainMode" use="required"/>
+                    <xs:attribute name="channel_mask" type="channelMask" use="optional"/>
+                    <xs:attribute name="minValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="maxValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="defaultValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="stepValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="minRampMs" type="xs:int" use="optional"/>
+                    <xs:attribute name="maxRampMs" type="xs:int" use="optional"/>
+                </xs:complexType>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:complexType name="devicePorts">
+        <xs:sequence>
+            <xs:element name="devicePort" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="profile" type="profile" minOccurs="0" maxOccurs="unbounded"/>
+                        <xs:element name="gains" type="gains" minOccurs="0"/>
+                    </xs:sequence>
+                    <xs:attribute name="tagName" type="xs:token" use="required"/>
+                    <xs:attribute name="type" type="audioDevice" use="required"/>
+                    <xs:attribute name="role" type="role" use="required"/>
+                    <xs:attribute name="address" type="xs:string" use="optional" default=""/>
+                    <!-- Note that XSD 1.0 can not check that a type only has one default. -->
+                    <xs:attribute name="default" type="xs:boolean" use="optional">
+                        <xs:annotation>
+                            <xs:documentation xml:lang="en">
+                                The default device will be used if multiple have the same type
+                                and no explicit route request exists for a specific device of
+                                that type.
+                            </xs:documentation>
+                        </xs:annotation>
+                    </xs:attribute>
+                </xs:complexType>
+                <xs:unique name="devicePortProfileUniqueness">
+                    <xs:selector xpath="profile"/>
+                    <xs:field xpath="format"/>
+                    <xs:field xpath="samplingRate"/>
+                    <xs:field xpath="channelMasks"/>
+                </xs:unique>
+                <xs:unique name="devicePortGainUniqueness">
+                    <xs:selector xpath="gains/gain"/>
+                    <xs:field xpath="@name"/>
+                </xs:unique>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:simpleType name="mixType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="mix"/>
+            <xs:enumeration value="mux"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="routes">
+        <xs:sequence>
+            <xs:element name="route" minOccurs="0" maxOccurs="unbounded">
+                <xs:annotation>
+                    <xs:documentation xml:lang="en">
+                        List all available sources for a given sink.
+                    </xs:documentation>
+                </xs:annotation>
+                <xs:complexType>
+                    <xs:attribute name="type" type="mixType" use="required"/>
+                    <xs:attribute name="sink" type="xs:string" use="required"/>
+                    <xs:attribute name="sources" type="xs:string" use="required"/>
+                </xs:complexType>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:complexType name="volumes">
+        <xs:sequence>
+            <xs:element name="volume" type="volume" minOccurs="0" maxOccurs="unbounded"/>
+            <xs:element name="reference" type="reference" minOccurs="0" maxOccurs="unbounded">
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <!-- TODO: Always require a ref for better xsd validations.
+               Currently a volume could have no points nor ref
+               as it can not be forbidden by xsd 1.0.-->
+    <xs:simpleType name="volumePoint">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Comma separated pair of number.
+                The fist one is the framework level (between 0 and 100).
+                The second one is the volume to send to the HAL.
+                The framework will interpolate volumes not specified.
+                Their MUST be at least 2 points specified.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:pattern value="([0-9]{1,2}|100),-?[0-9]+"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <!-- Enum values of audio_stream_type_t in audio-base.h
+         TODO: generate from hidl to avoid manual sync. -->
+    <xs:simpleType name="stream">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_STREAM_VOICE_CALL"/>
+            <xs:enumeration value="AUDIO_STREAM_SYSTEM"/>
+            <xs:enumeration value="AUDIO_STREAM_RING"/>
+            <xs:enumeration value="AUDIO_STREAM_MUSIC"/>
+            <xs:enumeration value="AUDIO_STREAM_ALARM"/>
+            <xs:enumeration value="AUDIO_STREAM_NOTIFICATION"/>
+            <xs:enumeration value="AUDIO_STREAM_BLUETOOTH_SCO"/>
+            <xs:enumeration value="AUDIO_STREAM_ENFORCED_AUDIBLE"/>
+            <xs:enumeration value="AUDIO_STREAM_DTMF"/>
+            <xs:enumeration value="AUDIO_STREAM_TTS"/>
+            <xs:enumeration value="AUDIO_STREAM_ACCESSIBILITY"/>
+            <xs:enumeration value="AUDIO_STREAM_REROUTING"/>
+            <xs:enumeration value="AUDIO_STREAM_PATCH"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <!-- Enum values of device_category from Volume.h.
+         TODO: generate from hidl to avoid manual sync. -->
+    <xs:simpleType name="deviceCategory">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="DEVICE_CATEGORY_HEADSET"/>
+            <xs:enumeration value="DEVICE_CATEGORY_SPEAKER"/>
+            <xs:enumeration value="DEVICE_CATEGORY_EARPIECE"/>
+            <xs:enumeration value="DEVICE_CATEGORY_EXT_MEDIA"/>
+            <xs:enumeration value="DEVICE_CATEGORY_HEARING_AID"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="volume">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Volume section defines a volume curve for a given use case and device category.
+                It contains a list of points of this curve expressing the attenuation in Millibels
+                for a given volume index from 0 to 100.
+                <volume stream="AUDIO_STREAM_MUSIC" deviceCategory="DEVICE_CATEGORY_SPEAKER">
+                    <point>0,-9600</point>
+                    <point>100,0</point>
+                </volume>
+
+                It may also reference a reference/@name to avoid duplicating curves.
+                <volume stream="AUDIO_STREAM_MUSIC" deviceCategory="DEVICE_CATEGORY_SPEAKER"
+                        ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
+                <reference name="DEFAULT_MEDIA_VOLUME_CURVE">
+                    <point>0,-9600</point>
+                    <point>100,0</point>
+                </reference>
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="point" type="volumePoint" minOccurs="0" maxOccurs="unbounded"/>
+        </xs:sequence>
+        <xs:attribute name="stream" type="stream"/>
+        <xs:attribute name="deviceCategory" type="deviceCategory"/>
+        <xs:attribute name="ref" type="xs:token" use="optional"/>
+    </xs:complexType>
+    <xs:complexType name="reference">
+        <xs:sequence>
+            <xs:element name="point" type="volumePoint" minOccurs="2" maxOccurs="unbounded"/>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:token" use="required"/>
+    </xs:complexType>
+    <xs:complexType name="surroundSound">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Surround Sound section provides configuration related to handling of
+                multi-channel formats.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="formats" type="surroundFormats"/>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:simpleType name="surroundFormatsList">
+        <xs:list itemType="audioFormat" />
+    </xs:simpleType>
+    <xs:complexType name="surroundFormats">
+        <xs:sequence>
+            <xs:element name="format" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:attribute name="name" type="audioFormat" use="required"/>
+                    <xs:attribute name="subformats" type="surroundFormatsList" />
+                </xs:complexType>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+</xs:schema>
diff --git a/audio/common/all-versions/default/include/common/all-versions/default/HidlUtils.impl.h b/audio/common/all-versions/default/include/common/all-versions/default/HidlUtils.impl.h
index 8ab7350..632e816 100644
--- a/audio/common/all-versions/default/include/common/all-versions/default/HidlUtils.impl.h
+++ b/audio/common/all-versions/default/include/common/all-versions/default/HidlUtils.impl.h
@@ -174,9 +174,9 @@
             config->ext.mix.hwModule = halConfig.ext.mix.hw_module;
             config->ext.mix.ioHandle = halConfig.ext.mix.handle;
             if (halConfig.role == AUDIO_PORT_ROLE_SOURCE) {
-                config->ext.mix.useCase.source = AudioSource(halConfig.ext.mix.usecase.source);
-            } else if (halConfig.role == AUDIO_PORT_ROLE_SINK) {
                 config->ext.mix.useCase.stream = AudioStreamType(halConfig.ext.mix.usecase.stream);
+            } else if (halConfig.role == AUDIO_PORT_ROLE_SINK) {
+                config->ext.mix.useCase.source = AudioSource(halConfig.ext.mix.usecase.source);
             }
             break;
         }
@@ -212,11 +212,11 @@
             halConfig->ext.mix.hw_module = config.ext.mix.hwModule;
             halConfig->ext.mix.handle = config.ext.mix.ioHandle;
             if (config.role == AudioPortRole::SOURCE) {
-                halConfig->ext.mix.usecase.source =
-                    static_cast<audio_source_t>(config.ext.mix.useCase.source);
-            } else if (config.role == AudioPortRole::SINK) {
                 halConfig->ext.mix.usecase.stream =
                     static_cast<audio_stream_type_t>(config.ext.mix.useCase.stream);
+            } else if (config.role == AudioPortRole::SINK) {
+                halConfig->ext.mix.usecase.source =
+                    static_cast<audio_source_t>(config.ext.mix.useCase.source);
             }
             break;
         }
diff --git a/audio/common/all-versions/default/service/Android.mk b/audio/common/all-versions/default/service/Android.mk
index 43d7fe1..e6ae03e 100644
--- a/audio/common/all-versions/default/service/Android.mk
+++ b/audio/common/all-versions/default/service/Android.mk
@@ -31,12 +31,14 @@
 LOCAL_CFLAGS := -Wall -Werror
 
 LOCAL_SHARED_LIBRARIES := \
+    libcutils \
     libbinder \
     libhidlbase \
     libhidltransport \
     liblog \
     libutils \
     libhardware \
+    libhwbinder \
     android.hardware.audio@2.0 \
     android.hardware.audio@4.0 \
     android.hardware.audio.common@2.0 \
diff --git a/audio/common/all-versions/default/service/service.cpp b/audio/common/all-versions/default/service/service.cpp
index c7ce638..ff1394e 100644
--- a/audio/common/all-versions/default/service/service.cpp
+++ b/audio/common/all-versions/default/service/service.cpp
@@ -24,16 +24,26 @@
 #include <android/hardware/soundtrigger/2.0/ISoundTriggerHw.h>
 #include <android/hardware/soundtrigger/2.1/ISoundTriggerHw.h>
 #include <binder/ProcessState.h>
+#include <cutils/properties.h>
 #include <hidl/HidlTransportSupport.h>
 #include <hidl/LegacySupport.h>
+#include <hwbinder/ProcessState.h>
 
 using namespace android::hardware;
 using android::OK;
 
 int main(int /* argc */, char* /* argv */ []) {
-    android::ProcessState::initWithDriver("/dev/vndbinder");
+    ::android::ProcessState::initWithDriver("/dev/vndbinder");
     // start a threadpool for vndbinder interactions
-    android::ProcessState::self()->startThreadPool();
+    ::android::ProcessState::self()->startThreadPool();
+
+    const int32_t defaultValue = -1;
+    int32_t value =
+        property_get_int32("persist.vendor.audio.service.hwbinder.size_kbyte", defaultValue);
+    if (value != defaultValue) {
+        ALOGD("Configuring hwbinder with mmap size %d KBytes", value);
+        ProcessState::initWithMmapSize(static_cast<size_t>(value) * 1024);
+    }
     configureRpcThreadpool(16, true /*callerWillJoin*/);
 
     bool fail = registerPassthroughServiceImplementation<audio::V4_0::IDevicesFactory>() != OK &&
diff --git a/audio/core/4.0/vts/functional/AudioPrimaryHidlHalTest.cpp b/audio/core/4.0/vts/functional/AudioPrimaryHidlHalTest.cpp
index 8a8338b..f1e0b21 100644
--- a/audio/core/4.0/vts/functional/AudioPrimaryHidlHalTest.cpp
+++ b/audio/core/4.0/vts/functional/AudioPrimaryHidlHalTest.cpp
@@ -65,8 +65,8 @@
 using ::android::hardware::hidl_handle;
 using ::android::hardware::hidl_string;
 using ::android::hardware::hidl_vec;
-using ::android::hardware::kSynchronizedReadWrite;
 using ::android::hardware::IPCThreadState;
+using ::android::hardware::kSynchronizedReadWrite;
 using ::android::hardware::MessageQueue;
 using ::android::hardware::MQDescriptorSync;
 using ::android::hardware::Return;
diff --git a/audio/core/all-versions/default/include/core/all-versions/default/Device.h b/audio/core/all-versions/default/include/core/all-versions/default/Device.h
index eb53b48..222d3de 100644
--- a/audio/core/all-versions/default/include/core/all-versions/default/Device.h
+++ b/audio/core/all-versions/default/include/core/all-versions/default/Device.h
@@ -124,7 +124,8 @@
     Return<void> debug(const hidl_handle& fd, const hidl_vec<hidl_string>& options) override;
 
     // Utility methods for extending interfaces.
-    Result analyzeStatus(const char* funcName, int status);
+    Result analyzeStatus(const char* funcName, int status,
+                         const std::vector<int>& ignoreErrors = {});
     void closeInputStream(audio_stream_in_t* stream);
     void closeOutputStream(audio_stream_out_t* stream);
     audio_hw_device_t* device() const { return mDevice; }
diff --git a/audio/core/all-versions/default/include/core/all-versions/default/Device.impl.h b/audio/core/all-versions/default/include/core/all-versions/default/Device.impl.h
index 230b8de..52d2186 100644
--- a/audio/core/all-versions/default/include/core/all-versions/default/Device.impl.h
+++ b/audio/core/all-versions/default/include/core/all-versions/default/Device.impl.h
@@ -40,8 +40,9 @@
     mDevice = nullptr;
 }
 
-Result Device::analyzeStatus(const char* funcName, int status) {
-    return util::analyzeStatus("Device", funcName, status);
+Result Device::analyzeStatus(const char* funcName, int status,
+                             const std::vector<int>& ignoreErrors) {
+    return util::analyzeStatus("Device", funcName, status, ignoreErrors);
 }
 
 void Device::closeInputStream(audio_stream_in_t* stream) {
@@ -155,7 +156,8 @@
     }
     AudioConfig suggestedConfig;
     HidlUtils::audioConfigFromHal(halConfig, &suggestedConfig);
-    _hidl_cb(analyzeStatus("open_output_stream", status), streamOut, suggestedConfig);
+    _hidl_cb(analyzeStatus("open_output_stream", status, {EINVAL} /* ignore */), streamOut,
+             suggestedConfig);
     return Void();
 }
 
@@ -183,7 +185,8 @@
     }
     AudioConfig suggestedConfig;
     HidlUtils::audioConfigFromHal(halConfig, &suggestedConfig);
-    _hidl_cb(analyzeStatus("open_input_stream", status), streamIn, suggestedConfig);
+    _hidl_cb(analyzeStatus("open_input_stream", status, {EINVAL} /* ignore */), streamIn,
+             suggestedConfig);
     return Void();
 }
 
diff --git a/audio/core/all-versions/default/include/core/all-versions/default/DevicesFactory.impl.h b/audio/core/all-versions/default/include/core/all-versions/default/DevicesFactory.impl.h
index 43e5d6e..a9f59fb 100644
--- a/audio/core/all-versions/default/include/core/all-versions/default/DevicesFactory.impl.h
+++ b/audio/core/all-versions/default/include/core/all-versions/default/DevicesFactory.impl.h
@@ -106,8 +106,8 @@
     return rc;
 }
 
-IDevicesFactory* HIDL_FETCH_IDevicesFactory(const char* /* name */) {
-    return new DevicesFactory();
+IDevicesFactory* HIDL_FETCH_IDevicesFactory(const char* name) {
+    return strcmp(name, "default") == 0 ? new DevicesFactory() : nullptr;
 }
 
 }  // namespace implementation
diff --git a/audio/effect/all-versions/default/include/effect/all-versions/default/EffectsFactory.impl.h b/audio/effect/all-versions/default/include/effect/all-versions/default/EffectsFactory.impl.h
index b0351c9..f3256f1 100644
--- a/audio/effect/all-versions/default/include/effect/all-versions/default/EffectsFactory.impl.h
+++ b/audio/effect/all-versions/default/include/effect/all-versions/default/EffectsFactory.impl.h
@@ -184,8 +184,8 @@
     return Void();
 }
 
-IEffectsFactory* HIDL_FETCH_IEffectsFactory(const char* /* name */) {
-    return new EffectsFactory();
+IEffectsFactory* HIDL_FETCH_IEffectsFactory(const char* name) {
+    return strcmp(name, "default") == 0 ? new EffectsFactory() : nullptr;
 }
 
 }  // namespace implementation
diff --git a/automotive/vehicle/2.0/Android.bp b/automotive/vehicle/2.0/Android.bp
index 6af774e..f64028c 100644
--- a/automotive/vehicle/2.0/Android.bp
+++ b/automotive/vehicle/2.0/Android.bp
@@ -30,7 +30,6 @@
         "StatusCode",
         "SubscribeFlags",
         "SubscribeOptions",
-        "VehicleApPowerBootupReason",
         "VehicleApPowerStateConfigFlag",
         "VehicleApPowerStateReport",
         "VehicleApPowerStateReq",
diff --git a/automotive/vehicle/2.0/default/Android.bp b/automotive/vehicle/2.0/default/Android.bp
index 22ab079..7802ef0 100644
--- a/automotive/vehicle/2.0/default/Android.bp
+++ b/automotive/vehicle/2.0/default/Android.bp
@@ -58,12 +58,14 @@
     vendor: true,
     defaults: ["vhal_v2_0_defaults"],
     srcs: [
+        "impl/vhal_v2_0/CommConn.cpp",
         "impl/vhal_v2_0/EmulatedVehicleHal.cpp",
         "impl/vhal_v2_0/VehicleEmulator.cpp",
         "impl/vhal_v2_0/PipeComm.cpp",
         "impl/vhal_v2_0/SocketComm.cpp",
         "impl/vhal_v2_0/LinearFakeValueGenerator.cpp",
         "impl/vhal_v2_0/JsonFakeValueGenerator.cpp",
+        "impl/vhal_v2_0/GeneratorHub.cpp",
     ],
     local_include_dirs: ["common/include/vhal_v2_0"],
     export_include_dirs: ["impl"],
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommBase.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommBase.h
deleted file mode 100644
index 6832ad3..0000000
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommBase.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef android_hardware_automotive_vehicle_V2_0_impl_CommBase_H_
-#define android_hardware_automotive_vehicle_V2_0_impl_CommBase_H_
-
-#include <string>
-#include <vector>
-
-namespace android {
-namespace hardware {
-namespace automotive {
-namespace vehicle {
-namespace V2_0 {
-
-namespace impl {
-
-/**
- * This is the communications base class.  It defines the interface used in DefaultVehicleHal to
- * send and receive data to and from the emulator.
- */
-class CommBase {
-public:
-    virtual ~CommBase() = default;
-
-    /**
-     * Closes a connection if it is open.
-     */
-    virtual void stop() {}
-
-    /**
-     * Creates a connection to the other side.
-     *
-     * @return int Returns fd or socket number if connection is successful.
-     *              Otherwise, returns -1 if no connection is availble.
-     */
-    virtual int connect() { return 0; }
-
-    /**
-     * Opens the communications channel.
-     *
-     * @return int Returns 0 if channel is opened, else -errno if failed.
-     */
-    virtual int open() = 0;
-
-    /**
-     * Blocking call to read data from the connection.
-     *
-     * @return std::vector<uint8_t> Serialized protobuf data received from emulator.  This will be
-     *              an empty vector if the connection was closed or some other error occurred.
-     */
-    virtual std::vector<uint8_t> read() = 0;
-
-    /**
-     * Transmits a string of data to the emulator.
-     *
-     * @param data Serialized protobuf data to transmit.
-     *
-     * @return int Number of bytes transmitted, or -1 if failed.
-     */
-    virtual int write(const std::vector<uint8_t>& data) = 0;
-};
-
-}  // impl
-
-}  // namespace V2_0
-}  // namespace vehicle
-}  // namespace automotive
-}  // namespace hardware
-}  // namespace android
-
-
-#endif  // android_hardware_automotive_vehicle_V2_0_impl_CommBase_H_
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommConn.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommConn.cpp
new file mode 100644
index 0000000..bf1de81
--- /dev/null
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommConn.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "CommConn"
+
+#include <thread>
+
+#include <android/hardware/automotive/vehicle/2.0/IVehicle.h>
+#include <log/log.h>
+
+#include "CommConn.h"
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace vehicle {
+namespace V2_0 {
+
+namespace impl {
+
+void CommConn::start() {
+    mReadThread = std::make_unique<std::thread>(std::bind(&CommConn::readThread, this));
+}
+
+void CommConn::stop() {
+    if (mReadThread->joinable()) {
+        mReadThread->join();
+    }
+}
+
+void CommConn::sendMessage(emulator::EmulatorMessage const& msg) {
+    int numBytes = msg.ByteSize();
+    std::vector<uint8_t> buffer(static_cast<size_t>(numBytes));
+    if (!msg.SerializeToArray(buffer.data(), numBytes)) {
+        ALOGE("%s: SerializeToString failed!", __func__);
+        return;
+    }
+
+    write(buffer);
+}
+
+void CommConn::readThread() {
+    std::vector<uint8_t> buffer;
+    while (isOpen()) {
+        buffer = read();
+        if (buffer.size() == 0) {
+            ALOGI("%s: Read returned empty message, exiting read loop.", __func__);
+            break;
+        }
+
+        emulator::EmulatorMessage rxMsg;
+        if (rxMsg.ParseFromArray(buffer.data(), static_cast<int32_t>(buffer.size()))) {
+            emulator::EmulatorMessage respMsg;
+            mMessageProcessor->processMessage(rxMsg, respMsg);
+
+            sendMessage(respMsg);
+        }
+    }
+}
+
+}  // namespace impl
+
+}  // namespace V2_0
+}  // namespace vehicle
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommConn.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommConn.h
new file mode 100644
index 0000000..87b0dfc
--- /dev/null
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/CommConn.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef android_hardware_automotive_vehicle_V2_0_impl_CommBase_H_
+#define android_hardware_automotive_vehicle_V2_0_impl_CommBase_H_
+
+#include <android/hardware/automotive/vehicle/2.0/IVehicle.h>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "VehicleHalProto.pb.h"
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace vehicle {
+namespace V2_0 {
+
+namespace impl {
+
+/**
+ * MessageProcess is an interface implemented by VehicleEmulator to process messages received
+ * over a CommConn.
+ */
+class MessageProcessor {
+   public:
+    virtual ~MessageProcessor() = default;
+
+    /**
+     * Process a single message received over a CommConn. Populate the given respMsg with the reply
+     * message we should send.
+     */
+    virtual void processMessage(emulator::EmulatorMessage const& rxMsg,
+                                emulator::EmulatorMessage& respMsg) = 0;
+};
+
+/**
+ * This is the interface that both PipeComm and SocketComm use to represent a connection. The
+ * connection will listen for commands on a separate 'read' thread.
+ */
+class CommConn {
+   public:
+    CommConn(MessageProcessor* messageProcessor) : mMessageProcessor(messageProcessor) {}
+
+    virtual ~CommConn() {}
+
+    /**
+     * Start the read thread reading messages from this connection.
+     */
+    virtual void start();
+
+    /**
+     * Closes a connection if it is open.
+     */
+    virtual void stop();
+
+    /**
+     * Returns true if the connection is open and available to send/receive.
+     */
+    virtual bool isOpen() = 0;
+
+    /**
+     * Blocking call to read data from the connection.
+     *
+     * @return std::vector<uint8_t> Serialized protobuf data received from emulator.  This will be
+     *              an empty vector if the connection was closed or some other error occurred.
+     */
+    virtual std::vector<uint8_t> read() = 0;
+
+    /**
+     * Transmits a string of data to the emulator.
+     *
+     * @param data Serialized protobuf data to transmit.
+     *
+     * @return int Number of bytes transmitted, or -1 if failed.
+     */
+    virtual int write(const std::vector<uint8_t>& data) = 0;
+
+    /**
+     * Serialized and send the given message to the other side.
+     */
+    void sendMessage(emulator::EmulatorMessage const& msg);
+
+   protected:
+    std::unique_ptr<std::thread> mReadThread;
+    MessageProcessor* mMessageProcessor;
+
+    /**
+     * A thread that reads messages in a loop, and responds. You can stop this thread by calling
+     * stop().
+     */
+    void readThread();
+};
+
+}  // namespace impl
+
+}  // namespace V2_0
+}  // namespace vehicle
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
+
+#endif  // android_hardware_automotive_vehicle_V2_0_impl_CommBase_H_
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
index eb9d660..7909ac1 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
@@ -34,6 +34,13 @@
 constexpr int AP_POWER_STATE_REPORT = (int)VehicleProperty::AP_POWER_STATE_REPORT;
 constexpr int DOOR_1_LEFT = (int)VehicleAreaDoor::ROW_1_LEFT;
 constexpr int DOOR_1_RIGHT = (int)VehicleAreaDoor::ROW_1_RIGHT;
+constexpr int DOOR_2_LEFT = (int)VehicleAreaDoor::ROW_2_LEFT;
+constexpr int DOOR_2_RIGHT = (int)VehicleAreaDoor::ROW_2_RIGHT;
+constexpr int WINDOW_1_LEFT = (int)VehicleAreaWindow::ROW_1_LEFT;
+constexpr int WINDOW_2_LEFT = (int)VehicleAreaWindow::ROW_2_LEFT;
+constexpr int WINDOW_2_RIGHT = (int)VehicleAreaWindow::ROW_2_RIGHT;
+constexpr int FAN_DIRECTION_FACE = (int)VehicleHvacFanDirection::FACE;
+constexpr int FAN_DIRECTION_FLOOR = (int)VehicleHvacFanDirection::FLOOR;
 constexpr int OBD2_LIVE_FRAME = (int)VehicleProperty::OBD2_LIVE_FRAME;
 constexpr int OBD2_FREEZE_FRAME = (int)VehicleProperty::OBD2_FREEZE_FRAME;
 constexpr int OBD2_FREEZE_FRAME_INFO = (int)VehicleProperty::OBD2_FREEZE_FRAME_INFO;
@@ -44,10 +51,28 @@
 constexpr int ALL_WHEELS =
     (int)(VehicleAreaWheel::LEFT_FRONT | VehicleAreaWheel::RIGHT_FRONT |
           VehicleAreaWheel::LEFT_REAR | VehicleAreaWheel::RIGHT_REAR);
+constexpr int SEAT_1_LEFT = (int)(VehicleAreaSeat::ROW_1_LEFT);
+constexpr int SEAT_1_RIGHT = (int)(VehicleAreaSeat::ROW_1_RIGHT);
 constexpr int HVAC_LEFT = (int)(VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_2_LEFT |
                                 VehicleAreaSeat::ROW_2_CENTER);
 constexpr int HVAC_RIGHT = (int)(VehicleAreaSeat::ROW_1_RIGHT | VehicleAreaSeat::ROW_2_RIGHT);
 constexpr int HVAC_ALL = HVAC_LEFT | HVAC_RIGHT;
+constexpr int VENDOR_EXTENSION_BOOLEAN_PROPERTY =
+    (int)(0x101 | VehiclePropertyGroup::VENDOR | VehiclePropertyType::BOOLEAN | VehicleArea::DOOR);
+constexpr int VENDOR_EXTENSION_FLOAT_PROPERTY =
+    (int)(0x102 | VehiclePropertyGroup::VENDOR | VehiclePropertyType::FLOAT | VehicleArea::SEAT);
+constexpr int VENDOR_EXTENSION_INT_PROPERTY =
+    (int)(0x103 | VehiclePropertyGroup::VENDOR | VehiclePropertyType::INT32 | VehicleArea::WINDOW);
+constexpr int VENDOR_EXTENSION_STRING_PROPERTY =
+    (int)(0x104 | VehiclePropertyGroup::VENDOR | VehiclePropertyType::STRING | VehicleArea::GLOBAL);
+constexpr int FUEL_DOOR_REAR_LEFT = (int)PortLocationType::REAR_LEFT;
+constexpr int CHARGE_PORT_FRONT_LEFT = (int)PortLocationType::FRONT_LEFT;
+constexpr int LIGHT_STATE_ON = (int)VehicleLightState::ON;
+constexpr int LIGHT_SWITCH_AUTO = (int)VehicleLightSwitch::AUTOMATIC;
+constexpr int WHEEL_FRONT_LEFT = (int)VehicleAreaWheel::LEFT_FRONT;
+constexpr int WHEEL_FRONT_RIGHT = (int)VehicleAreaWheel::RIGHT_FRONT;
+constexpr int WHEEL_REAR_LEFT = (int)VehicleAreaWheel::LEFT_REAR;
+constexpr int WHEEL_REAR_RIGHT = (int)VehicleAreaWheel::RIGHT_REAR;
 
 /**
  * This property is used for test purpose to generate fake events. Here is the test package that
@@ -70,33 +95,39 @@
 enum class FakeDataCommand : int32_t {
     /**
      * Starts linear fake data generation. Caller must provide additional data:
-     *     int32Values[1] - VehicleProperty to which command applies
+     *     int32Values[1] - vehicle property to which command applies
      *     int64Values[0] - periodic interval in nanoseconds
      *     floatValues[0] - initial value
      *     floatValues[1] - dispersion defines the min/max value relative to initial value, where
      *                      max = initial_value + dispersion, min = initial_value - dispersion.
      *                      Dispersion should be non-negative, otherwise the behavior is undefined.
      *     floatValues[2] - increment, with every timer tick the value will be incremented by this
-     *                      amount. When reaching to max value, the current value will be set to min.
-     *                      It should be non-negative, otherwise the behavior is undefined.
+     *                      amount. When reaching to max value, the current value will be set to
+     *                      min. It should be non-negative, otherwise the behavior is undefined.
      */
     StartLinear = 0,
 
-    /** Stops generating of fake data that was triggered by Start commands.
-     *     int32Values[1] - VehicleProperty to which command applies. VHAL will stop the
+    /** Stops linear fake data generation that was triggered by StartLinear commands.
+     *     int32Values[1] - vehicle property to which command applies. VHAL will stop the
      *                      corresponding linear generation for that property.
      */
     StopLinear = 1,
 
     /**
-     * Starts JSON-based fake data generation. Caller must provide a string value specifying
-     * the path to fake value JSON file:
+     * Starts JSON-based fake data generation. It iterates through JSON-encoded VHAL events from a
+     * file and inject them to VHAL. The iteration can be repeated multiple times or infinitely.
+     * Caller must provide additional data:
+     *     int32Values[1] - number of iterations. If it is not provided or -1. The iteration will be
+     *                      repeated infinite times.
      *     stringValue    - path to the fake values JSON file
      */
     StartJson = 2,
 
     /**
-     * Stops JSON-based fake data generation. No additional arguments needed.
+     * Stops JSON-based fake data generation. As multiple JSON-based generation can happen at the
+     * same time. Caller must provide the path of fake value JSON file to stop the corresponding
+     * generation:
+     *     stringValue    - path to the fake values JSON file
      */
     StopJson = 3,
 
@@ -133,8 +164,9 @@
              .prop = toInt(VehicleProperty::INFO_FUEL_CAPACITY),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::STATIC,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
-     .initialValue = {.floatValues = {15000}}},
+     .initialValue = {.floatValues = {15000.0f}}},
 
     {.config =
          {
@@ -149,8 +181,9 @@
              .prop = toInt(VehicleProperty::INFO_EV_BATTERY_CAPACITY),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::STATIC,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
-     .initialValue = {.floatValues = {150000}}},
+     .initialValue = {.floatValues = {150000.0f}}},
 
     {.config =
          {
@@ -162,6 +195,24 @@
 
     {.config =
          {
+             .prop = toInt(VehicleProperty::INFO_FUEL_DOOR_LOCATION),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::STATIC,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {FUEL_DOOR_REAR_LEFT}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::INFO_EV_PORT_LOCATION),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::STATIC,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {CHARGE_PORT_FRONT_LEFT}}},
+
+    {.config =
+         {
              .prop = toInt(VehicleProperty::INFO_MAKE),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::STATIC,
@@ -179,6 +230,16 @@
 
     {.config =
          {
+             .prop = toInt(VehicleProperty::INFO_DRIVER_SEAT),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::STATIC,
+             // this was a zoned property on an old vhal, but it is meant to be global
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {SEAT_1_LEFT}}},
+
+    {.config =
+         {
              .prop = toInt(VehicleProperty::PERF_ODOMETER),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
@@ -202,14 +263,16 @@
              .prop = toInt(VehicleProperty::FUEL_LEVEL),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
-     .initialValue = {.floatValues = {15000}}},
+     .initialValue = {.floatValues = {15000.0f}}},
 
     {.config =
          {
              .prop = toInt(VehicleProperty::FUEL_DOOR_OPEN),
-             .access = VehiclePropertyAccess::READ,
+             .access = VehiclePropertyAccess::READ_WRITE,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
      .initialValue = {.int32Values = {0}}},
 
@@ -218,14 +281,16 @@
              .prop = toInt(VehicleProperty::EV_BATTERY_LEVEL),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
-     .initialValue = {.floatValues = {150000}}},
+     .initialValue = {.floatValues = {150000.0f}}},
 
     {.config =
          {
              .prop = toInt(VehicleProperty::EV_CHARGE_PORT_OPEN),
-             .access = VehiclePropertyAccess::READ,
+             .access = VehiclePropertyAccess::READ_WRITE,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
      .initialValue = {.int32Values = {0}}},
 
@@ -234,6 +299,7 @@
              .prop = toInt(VehicleProperty::EV_CHARGE_PORT_CONNECTED),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
      .initialValue = {.int32Values = {0}}},
 
@@ -242,8 +308,37 @@
              .prop = toInt(VehicleProperty::EV_BATTERY_INSTANTANEOUS_CHARGE_RATE),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
-     .initialValue = {.floatValues = {0}}},
+     .initialValue = {.floatValues = {0.0f}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::RANGE_REMAINING),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.floatValues = {100.0f}}},  // units in meters
+
+    {.config =
+         {.prop = toInt(VehicleProperty::TIRE_PRESSURE),
+          .access = VehiclePropertyAccess::READ,
+          .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+          .areaConfigs =
+              {VehicleAreaConfig{
+                   .areaId = WHEEL_FRONT_LEFT, .minFloatValue = 100.0f, .maxFloatValue = 300.0f,
+               },
+               VehicleAreaConfig{
+                   .areaId = WHEEL_FRONT_RIGHT, .minFloatValue = 100.0f, .maxFloatValue = 300.0f,
+               },
+               VehicleAreaConfig{
+                   .areaId = WHEEL_REAR_LEFT, .minFloatValue = 100.0f, .maxFloatValue = 300.0f,
+               },
+               VehicleAreaConfig{
+                   .areaId = WHEEL_REAR_RIGHT, .minFloatValue = 100.0f, .maxFloatValue = 300.0f,
+               }}},
+     .initialValue = {.floatValues = {200}}},  // units in kPa
 
     {.config =
          {
@@ -266,6 +361,7 @@
              .prop = toInt(VehicleProperty::FUEL_LEVEL_LOW),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
          },
      .initialValue = {.int32Values = {0}}},
 
@@ -285,8 +381,8 @@
                 // kHvacPowerProperties.
                 .configArray =
                     {
-                        0x12400500,  // HVAC_FAN_SPEED
-                        0x12400501   // HVAC_FAN_DIRECTION
+                        toInt(VehicleProperty::HVAC_FAN_SPEED),
+                        toInt(VehicleProperty::HVAC_FAN_DIRECTION)
                     }},
      .initialValue = {.int32Values = {1}}},
 
@@ -355,6 +451,24 @@
                 .areaConfigs = {VehicleAreaConfig{.areaId = HVAC_ALL}}},
      .initialValue = {.int32Values = {toInt(VehicleHvacFanDirection::FACE)}}},
 
+    {.config = {.prop = toInt(VehicleProperty::HVAC_FAN_DIRECTION_AVAILABLE),
+                .access = VehiclePropertyAccess::READ,
+                .changeMode = VehiclePropertyChangeMode::STATIC,
+                .areaConfigs = {VehicleAreaConfig{.areaId = HVAC_ALL}}},
+     .initialValue = {.int32Values = {FAN_DIRECTION_FACE, FAN_DIRECTION_FLOOR,
+                                      FAN_DIRECTION_FACE | FAN_DIRECTION_FLOOR}}},
+
+    {.config = {.prop = toInt(VehicleProperty::HVAC_SEAT_VENTILATION),
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs = {VehicleAreaConfig{
+                                    .areaId = SEAT_1_LEFT, .minInt32Value = 0, .maxInt32Value = 3,
+                                },
+                                VehicleAreaConfig{
+                                    .areaId = SEAT_1_RIGHT, .minInt32Value = 0, .maxInt32Value = 3,
+                                }}},
+     .initialValue = {.int32Values = {0}}},  // 0 is off and +ve values indicate ventilation level.
+
     {.config = {.prop = toInt(VehicleProperty::HVAC_STEERING_WHEEL_HEAT),
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
@@ -362,14 +476,29 @@
                     .areaId = (0), .minInt32Value = -2, .maxInt32Value = 2}}},
      .initialValue = {.int32Values = {0}}},  // +ve values for heating and -ve for cooling
 
+    {.config = {.prop = toInt(VehicleProperty::HVAC_SEAT_TEMPERATURE),
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs = {VehicleAreaConfig{
+                                    .areaId = SEAT_1_LEFT, .minInt32Value = -2, .maxInt32Value = 2,
+                                },
+                                VehicleAreaConfig{
+                                    .areaId = SEAT_1_RIGHT, .minInt32Value = -2, .maxInt32Value = 2,
+                                }}},
+     .initialValue = {.int32Values = {0}}},  // +ve values for heating and -ve for cooling
+
     {.config = {.prop = toInt(VehicleProperty::HVAC_TEMPERATURE_SET),
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{
-                                    .areaId = HVAC_LEFT, .minFloatValue = 16, .maxFloatValue = 32,
+                                    .areaId = HVAC_LEFT,
+                                    .minFloatValue = 16,
+                                    .maxFloatValue = 32,
                                 },
                                 VehicleAreaConfig{
-                                    .areaId = HVAC_RIGHT, .minFloatValue = 16, .maxFloatValue = 32,
+                                    .areaId = HVAC_RIGHT,
+                                    .minFloatValue = 16,
+                                    .maxFloatValue = 32,
                                 }}},
      .initialAreaValues = {{HVAC_LEFT, {.floatValues = {16}}},
                            {HVAC_RIGHT, {.floatValues = {20}}}}},
@@ -443,13 +572,20 @@
     },
 
     {.config = {.prop = toInt(VehicleProperty::DOOR_LOCK),
-                .access = VehiclePropertyAccess::READ,
+                .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{.areaId = DOOR_1_LEFT},
                                 VehicleAreaConfig{.areaId = DOOR_1_RIGHT}}},
      .initialAreaValues = {{DOOR_1_LEFT, {.int32Values = {1}}},
                            {DOOR_1_RIGHT, {.int32Values = {1}}}}},
 
+    {.config = {.prop = toInt(VehicleProperty::WINDOW_LOCK),
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs = {VehicleAreaConfig{.areaId = WINDOW_1_LEFT | WINDOW_2_LEFT |
+                                                            WINDOW_2_RIGHT}}},
+     .initialAreaValues = {{WINDOW_1_LEFT | WINDOW_2_LEFT | WINDOW_2_RIGHT, {.int32Values = {0}}}}},
+
     {.config =
          {
              .prop = WHEEL_TICK,
@@ -475,12 +611,12 @@
                 .access = VehiclePropertyAccess::READ,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .configArray = {3}},
-     .initialValue = {.int32Values = {toInt(VehicleApPowerStateReq::ON_FULL), 0}}},
+     .initialValue = {.int32Values = {toInt(VehicleApPowerStateReq::ON), 0}}},
 
     {.config = {.prop = toInt(VehicleProperty::AP_POWER_STATE_REPORT),
                 .access = VehiclePropertyAccess::WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE},
-     .initialValue = {.int32Values = {toInt(VehicleApPowerStateReport::BOOT_COMPLETE), 0}}},
+     .initialValue = {.int32Values = {toInt(VehicleApPowerStateReport::WAIT_FOR_VHAL), 0}}},
 
     {.config = {.prop = toInt(VehicleProperty::DISPLAY_BRIGHTNESS),
                 .access = VehiclePropertyAccess::READ_WRITE,
@@ -488,11 +624,6 @@
                 .areaConfigs = {VehicleAreaConfig{.minInt32Value = 0, .maxInt32Value = 100}}},
      .initialValue = {.int32Values = {100}}},
 
-    {.config = {.prop = toInt(VehicleProperty::AP_POWER_BOOTUP_REASON),
-                .access = VehiclePropertyAccess::READ,
-                .changeMode = VehiclePropertyChangeMode::STATIC},
-     .initialValue = {.int32Values = {toInt(VehicleApPowerBootupReason::USER_POWER_ON)}}},
-
     {
         .config = {.prop = OBD2_LIVE_FRAME,
                    .access = VehiclePropertyAccess::READ,
@@ -520,9 +651,126 @@
                    .configArray = {1}},
     },
 
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::HEADLIGHTS_STATE),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_STATE_ON}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::HIGH_BEAM_LIGHTS_STATE),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_STATE_ON}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::FOG_LIGHTS_STATE),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_STATE_ON}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::HAZARD_LIGHTS_STATE),
+             .access = VehiclePropertyAccess::READ,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_STATE_ON}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::HEADLIGHTS_SWITCH),
+             .access = VehiclePropertyAccess::READ_WRITE,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_SWITCH_AUTO}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::HIGH_BEAM_LIGHTS_SWITCH),
+             .access = VehiclePropertyAccess::READ_WRITE,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_SWITCH_AUTO}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::FOG_LIGHTS_SWITCH),
+             .access = VehiclePropertyAccess::READ_WRITE,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_SWITCH_AUTO}}},
+
+    {.config =
+         {
+             .prop = toInt(VehicleProperty::HAZARD_LIGHTS_SWITCH),
+             .access = VehiclePropertyAccess::READ_WRITE,
+             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+             .areaConfigs = {VehicleAreaConfig{.areaId = (0)}},
+         },
+     .initialValue = {.int32Values = {LIGHT_SWITCH_AUTO}}},
+
     {.config = {.prop = VEHICLE_MAP_SERVICE,
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE}},
+
+    // Example Vendor Extension properties for testing
+    {.config = {.prop = VENDOR_EXTENSION_BOOLEAN_PROPERTY,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs = {VehicleAreaConfig{.areaId = DOOR_1_LEFT},
+                                VehicleAreaConfig{.areaId = DOOR_1_RIGHT},
+                                VehicleAreaConfig{.areaId = DOOR_2_LEFT},
+                                VehicleAreaConfig{.areaId = DOOR_2_RIGHT}}},
+     .initialAreaValues = {{DOOR_1_LEFT, {.int32Values = {1}}},
+                           {DOOR_1_RIGHT, {.int32Values = {1}}},
+                           {DOOR_2_LEFT, {.int32Values = {0}}},
+                           {DOOR_2_RIGHT, {.int32Values = {0}}}}},
+
+    {.config = {.prop = VENDOR_EXTENSION_FLOAT_PROPERTY,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs = {VehicleAreaConfig{
+                                    .areaId = HVAC_LEFT, .minFloatValue = -10, .maxFloatValue = 10},
+                                VehicleAreaConfig{.areaId = HVAC_RIGHT,
+                                                  .minFloatValue = -10,
+                                                  .maxFloatValue = 10}}},
+     .initialAreaValues = {{HVAC_LEFT, {.floatValues = {1}}}, {HVAC_RIGHT, {.floatValues = {2}}}}},
+
+    {.config = {.prop = VENDOR_EXTENSION_INT_PROPERTY,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs = {VehicleAreaConfig{
+                                    .areaId = (int)VehicleAreaWindow::FRONT_WINDSHIELD,
+                                    .minInt32Value = -100,
+                                    .maxInt32Value = 100},
+                                VehicleAreaConfig{.areaId = (int)VehicleAreaWindow::REAR_WINDSHIELD,
+                                                  .minInt32Value = -100,
+                                                  .maxInt32Value = 100},
+                                VehicleAreaConfig{.areaId = (int)VehicleAreaWindow::ROOF_TOP_1,
+                                                  .minInt32Value = -100,
+                                                  .maxInt32Value = 100}}},
+     .initialAreaValues = {{(int)VehicleAreaWindow::FRONT_WINDSHIELD, {.int32Values = {1}}},
+                           {(int)VehicleAreaWindow::REAR_WINDSHIELD, {.int32Values = {0}}},
+                           {(int)VehicleAreaWindow::ROOF_TOP_1, {.int32Values = {-1}}}}},
+
+    {.config = {.prop = VENDOR_EXTENSION_STRING_PROPERTY,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE},
+     .initialValue = {.stringValue = "Vendor String Property"}},
 };
 
 }  // impl
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
index 07695bf..ba81a52 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
@@ -92,10 +92,8 @@
       mHvacPowerProps(std::begin(kHvacPowerProperties), std::end(kHvacPowerProperties)),
       mRecurrentTimer(
           std::bind(&EmulatedVehicleHal::onContinuousPropertyTimer, this, std::placeholders::_1)),
-      mLinearFakeValueGenerator(std::make_unique<LinearFakeValueGenerator>(
-          std::bind(&EmulatedVehicleHal::onFakeValueGenerated, this, std::placeholders::_1))),
-      mJsonFakeValueGenerator(std::make_unique<JsonFakeValueGenerator>(
-          std::bind(&EmulatedVehicleHal::onFakeValueGenerated, this, std::placeholders::_1))) {
+      mGeneratorHub(
+          std::bind(&EmulatedVehicleHal::onFakeValueGenerated, this, std::placeholders::_1)) {
     initStaticConfig();
     for (size_t i = 0; i < arraysize(kVehicleProperties); i++) {
         mPropStore->registerProperty(kVehicleProperties[i].config);
@@ -159,12 +157,28 @@
                 // now, just returns OK; otherwise, hal clients crash with property not supported.
                 return StatusCode::OK;
             case AP_POWER_STATE_REPORT:
-                // This property has different behavior between get/set.  When it is set, the value
-                //  goes to the vehicle but is NOT updated in the property store back to Android.
-                // Commented out for now, because it may mess up automated testing that use the
-                //  emulator interface.
-                // getEmulatorOrDie()->doSetValueFromClient(propValue);
-                return StatusCode::OK;
+                switch (propValue.value.int32Values[0]) {
+                    case toInt(VehicleApPowerStateReport::DEEP_SLEEP_EXIT):
+                    case toInt(VehicleApPowerStateReport::SHUTDOWN_CANCELLED):
+                    case toInt(VehicleApPowerStateReport::WAIT_FOR_VHAL):
+                        // CPMS is in WAIT_FOR_VHAL state, simply move to ON
+                        doHalEvent(createApPowerStateReq(VehicleApPowerStateReq::ON, 0));
+                        break;
+                    case toInt(VehicleApPowerStateReport::DEEP_SLEEP_ENTRY):
+                    case toInt(VehicleApPowerStateReport::SHUTDOWN_START):
+                        // CPMS is in WAIT_FOR_FINISH state, send the FINISHED command
+                        doHalEvent(createApPowerStateReq(VehicleApPowerStateReq::FINISHED, 0));
+                        break;
+                    case toInt(VehicleApPowerStateReport::ON):
+                    case toInt(VehicleApPowerStateReport::SHUTDOWN_POSTPONE):
+                    case toInt(VehicleApPowerStateReport::SHUTDOWN_PREPARE):
+                        // Do nothing
+                        break;
+                    default:
+                        // Unknown state
+                        break;
+                }
+                break;
         }
     }
 
@@ -189,6 +203,7 @@
     }
 
     getEmulatorOrDie()->doSetValueFromClient(propValue);
+    doHalEvent(getValuePool()->obtain(propValue));
 
     return StatusCode::OK;
 }
@@ -343,19 +358,54 @@
     switch (command) {
         case FakeDataCommand::StartLinear: {
             ALOGI("%s, FakeDataCommand::StartLinear", __func__);
-            return mLinearFakeValueGenerator->start(request);
+            if (v.int32Values.size() < 2) {
+                ALOGE("%s: expected property ID in int32Values", __func__);
+                return StatusCode::INVALID_ARG;
+            }
+            if (!v.int64Values.size()) {
+                ALOGE("%s: interval is not provided in int64Values", __func__);
+                return StatusCode::INVALID_ARG;
+            }
+            if (v.floatValues.size() < 3) {
+                ALOGE("%s: expected at least 3 elements in floatValues, got: %zu", __func__,
+                      v.floatValues.size());
+                return StatusCode::INVALID_ARG;
+            }
+            int32_t cookie = v.int32Values[1];
+            mGeneratorHub.registerGenerator(cookie,
+                                            std::make_unique<LinearFakeValueGenerator>(request));
+            break;
         }
         case FakeDataCommand::StartJson: {
             ALOGI("%s, FakeDataCommand::StartJson", __func__);
-            return mJsonFakeValueGenerator->start(request);
+            if (v.stringValue.empty()) {
+                ALOGE("%s: path to JSON file is missing", __func__);
+                return StatusCode::INVALID_ARG;
+            }
+            int32_t cookie = std::hash<std::string>()(v.stringValue);
+            mGeneratorHub.registerGenerator(cookie,
+                                            std::make_unique<JsonFakeValueGenerator>(request));
+            break;
         }
         case FakeDataCommand::StopLinear: {
             ALOGI("%s, FakeDataCommand::StopLinear", __func__);
-            return mLinearFakeValueGenerator->stop(request);
+            if (v.int32Values.size() < 2) {
+                ALOGE("%s: expected property ID in int32Values", __func__);
+                return StatusCode::INVALID_ARG;
+            }
+            int32_t cookie = v.int32Values[1];
+            mGeneratorHub.unregisterGenerator(cookie);
+            break;
         }
         case FakeDataCommand::StopJson: {
             ALOGI("%s, FakeDataCommand::StopJson", __func__);
-            return mJsonFakeValueGenerator->stop(request);
+            if (v.stringValue.empty()) {
+                ALOGE("%s: path to JSON file is missing", __func__);
+                return StatusCode::INVALID_ARG;
+            }
+            int32_t cookie = std::hash<std::string>()(v.stringValue);
+            mGeneratorHub.unregisterGenerator(cookie);
+            break;
         }
         case FakeDataCommand::KeyPress: {
             ALOGI("%s, FakeDataCommand::KeyPress", __func__);
@@ -374,6 +424,18 @@
     return StatusCode::OK;
 }
 
+VehicleHal::VehiclePropValuePtr EmulatedVehicleHal::createApPowerStateReq(
+    VehicleApPowerStateReq state, int32_t param) {
+    auto req = getValuePool()->obtain(VehiclePropertyType::INT32_VEC, 2);
+    req->prop = toInt(VehicleProperty::AP_POWER_STATE_REQ);
+    req->areaId = 0;
+    req->timestamp = elapsedRealtimeNano();
+    req->status = VehiclePropertyStatus::AVAILABLE;
+    req->value.int32Values[0] = toInt(state);
+    req->value.int32Values[1] = param;
+    return req;
+}
+
 VehicleHal::VehiclePropValuePtr EmulatedVehicleHal::createHwInputKeyProp(
     VehicleHwKeyInputAction action, int32_t keyCode, int32_t targetDisplay) {
     auto keyEvent = getValuePool()->obtain(VehiclePropertyType::INT32_VEC, 3);
@@ -398,7 +460,7 @@
         mPropStore->writeValue(*updatedPropValue, shouldUpdateStatus);
         auto changeMode = mPropStore->getConfigOrDie(value.prop)->changeMode;
         if (VehiclePropertyChangeMode::ON_CHANGE == changeMode) {
-            doHalEvent(move(updatedPropValue));
+            doHalEvent(std::move(updatedPropValue));
         }
     }
 }
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.h
index c188aef..78895e3 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.h
@@ -30,8 +30,7 @@
 #include "vhal_v2_0/VehiclePropertyStore.h"
 
 #include "DefaultConfig.h"
-#include "FakeValueGenerator.h"
-
+#include "GeneratorHub.h"
 #include "VehicleEmulator.h"
 
 namespace android {
@@ -68,6 +67,7 @@
 
     StatusCode handleGenerateFakeDataRequest(const VehiclePropValue& request);
     void onFakeValueGenerated(const VehiclePropValue& value);
+    VehiclePropValuePtr createApPowerStateReq(VehicleApPowerStateReq req, int32_t param);
     VehiclePropValuePtr createHwInputKeyProp(VehicleHwKeyInputAction action, int32_t keyCode,
                                              int32_t targetDisplay);
 
@@ -85,8 +85,7 @@
     VehiclePropertyStore* mPropStore;
     std::unordered_set<int32_t> mHvacPowerProps;
     RecurrentTimer mRecurrentTimer;
-    std::unique_ptr<FakeValueGenerator> mLinearFakeValueGenerator;
-    std::unique_ptr<FakeValueGenerator> mJsonFakeValueGenerator;
+    GeneratorHub mGeneratorHub;
 };
 
 }  // impl
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/FakeValueGenerator.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/FakeValueGenerator.h
index 1eeb88d..d6ad77d 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/FakeValueGenerator.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/FakeValueGenerator.h
@@ -27,28 +27,22 @@
 
 namespace impl {
 
-using OnHalEvent = std::function<void(const VehiclePropValue& event)>;
-using MuxGuard = std::lock_guard<std::mutex>;
-
 class FakeValueGenerator {
 public:
     virtual ~FakeValueGenerator() = default;
-    /**
-     * Starts generating VHAL events
-     *
-     * @param request in VehiclePropValue with required information to start fake data generation
-     * @return StatusCode of the start request
-     */
-    virtual StatusCode start(const VehiclePropValue& request) = 0;
-    /**
-     * Stops generating VHAL events
-     * @param request in VehiclePropValue with required information to stop fake data generation
-     * @return StatusCode of the stop request
-     */
-    virtual StatusCode stop(const VehiclePropValue& request) = 0;
+
+    virtual VehiclePropValue nextEvent() = 0;
+
+    virtual bool hasNext() = 0;
 };
 
-}  // impl
+using Clock = std::chrono::steady_clock;
+using Nanos = std::chrono::nanoseconds;
+using TimePoint = std::chrono::time_point<Clock, Nanos>;
+
+using FakeValueGeneratorPtr = std::unique_ptr<FakeValueGenerator>;
+
+}  // namespace impl
 
 }  // namespace V2_0
 }  // namespace vehicle
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/GeneratorHub.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/GeneratorHub.cpp
new file mode 100644
index 0000000..548285a
--- /dev/null
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/GeneratorHub.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "GeneratorHub"
+
+#include <log/log.h>
+
+#include "GeneratorHub.h"
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace vehicle {
+namespace V2_0 {
+
+namespace impl {
+
+GeneratorHub::GeneratorHub(const OnHalEvent& onHalEvent)
+    : mOnHalEvent(onHalEvent), mThread(&GeneratorHub::run, this) {}
+
+void GeneratorHub::registerGenerator(int32_t cookie, FakeValueGeneratorPtr generator) {
+    {
+        std::lock_guard<std::mutex> g(mLock);
+        // Register only if the generator can produce event
+        if (generator->hasNext()) {
+            // Push the next event if it is a new generator
+            if (mGenerators.find(cookie) == mGenerators.end()) {
+                ALOGI("%s: Registering new generator, cookie: %d", __func__, cookie);
+                mEventQueue.push({cookie, generator->nextEvent()});
+            }
+            mGenerators[cookie] = std::move(generator);
+            ALOGI("%s: Registered generator, cookie: %d", __func__, cookie);
+        }
+    }
+    mCond.notify_one();
+}
+
+void GeneratorHub::unregisterGenerator(int32_t cookie) {
+    {
+        std::lock_guard<std::mutex> g(mLock);
+        mGenerators.erase(cookie);
+    }
+    mCond.notify_one();
+    ALOGI("%s: Unregistered generator, cookie: %d", __func__, cookie);
+}
+
+void GeneratorHub::run() {
+    while (true) {
+        std::unique_lock<std::mutex> g(mLock);
+        // Pop events whose generator does not exist (may be already unregistered)
+        while (!mEventQueue.empty()
+               && mGenerators.find(mEventQueue.top().cookie) == mGenerators.end()) {
+             mEventQueue.pop();
+        }
+        // Wait until event queue is not empty
+        mCond.wait(g, [this] { return !mEventQueue.empty(); });
+
+        const VhalEvent& curEvent = mEventQueue.top();
+
+        TimePoint eventTime(Nanos(curEvent.val.timestamp));
+        // Wait until the soonest event happen
+        if (mCond.wait_until(g, eventTime) != std::cv_status::timeout) {
+        // It is possible that a new generator is registered and produced a sooner event, or current
+        // generator is unregistered, in this case the thread will re-evaluate the soonest event
+            ALOGI("Something happened while waiting");
+            continue;
+        }
+        // Now it's time to handle current event.
+        mOnHalEvent(curEvent.val);
+        // Update queue by popping current event and producing next event from the same generator
+        int32_t cookie = curEvent.cookie;
+        mEventQueue.pop();
+        if (hasNext(cookie)) {
+            mEventQueue.push({cookie, mGenerators[cookie]->nextEvent()});
+        } else {
+            ALOGI("%s: Generator ended, unregister it, cookie: %d", __func__, cookie);
+            mGenerators.erase(cookie);
+        }
+    }
+}
+
+bool GeneratorHub::hasNext(int32_t cookie) {
+    return mGenerators.find(cookie) != mGenerators.end() && mGenerators[cookie]->hasNext();
+}
+
+}  // namespace impl
+
+}  // namespace V2_0
+}  // namespace vehicle
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/GeneratorHub.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/GeneratorHub.h
new file mode 100644
index 0000000..dcf6a4f
--- /dev/null
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/GeneratorHub.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef android_hardware_automotive_vehicle_V2_0_impl_GeneratorHub_H_
+#define android_hardware_automotive_vehicle_V2_0_impl_GeneratorHub_H_
+
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <iostream>
+#include <queue>
+#include <thread>
+#include <unordered_map>
+
+#include "FakeValueGenerator.h"
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace vehicle {
+namespace V2_0 {
+
+namespace impl {
+
+/**
+ * This is the scheduler for all VHAL event generators. It manages all generators and uses priority
+ * queue to maintain generated events ordered by timestamp. The scheduler uses a single thread to
+ * keep querying and updating the event queue to make sure events from all generators are produced
+ * in order.
+ */
+class GeneratorHub {
+private:
+    struct VhalEvent {
+        int32_t cookie;  // Cookie is used to find the associated generator.
+        VehiclePropValue val;
+    };
+    // Comparator used by priority queue to keep track of soonest event.
+    struct GreaterByTime {
+        bool operator()(const VhalEvent& lhs, const VhalEvent& rhs) const {
+            return lhs.val.timestamp > rhs.val.timestamp;
+        }
+    };
+
+    using OnHalEvent = std::function<void(const VehiclePropValue& event)>;
+
+public:
+    GeneratorHub(const OnHalEvent& onHalEvent);
+    ~GeneratorHub() = default;
+
+    /**
+     * Register a new generator. The generator will be discarded if it could not produce next event.
+     * The existing generator will be overridden if it has the same cookie.
+     */
+    void registerGenerator(int32_t cookie, FakeValueGeneratorPtr generator);
+
+    void unregisterGenerator(int32_t cookie);
+
+private:
+    /**
+     * Main loop of the single thread to producing event and updating event queue.
+     */
+    void run();
+
+    bool hasNext(int32_t cookie);
+
+private:
+    std::priority_queue<VhalEvent, std::vector<VhalEvent>, GreaterByTime> mEventQueue;
+    std::unordered_map<int32_t, FakeValueGeneratorPtr> mGenerators;
+    OnHalEvent mOnHalEvent;
+
+    mutable std::mutex mLock;
+    std::condition_variable mCond;
+    std::thread mThread;
+};
+
+}  // namespace impl
+
+}  // namespace V2_0
+}  // namespace vehicle
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
+
+#endif  // android_hardware_automotive_vehicle_V2_0_impl_GeneratorHub_H_
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.cpp
index 88b8f86..b8fd2ba 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.cpp
@@ -17,6 +17,8 @@
 #define LOG_TAG "JsonFakeValueGenerator"
 
 #include <fstream>
+#include <type_traits>
+#include <typeinfo>
 
 #include <log/log.h>
 #include <vhal_v2_0/VehicleUtils.h>
@@ -31,57 +33,48 @@
 
 namespace impl {
 
-JsonFakeValueGenerator::JsonFakeValueGenerator(const OnHalEvent& onHalEvent)
-    : mOnHalEvent(onHalEvent), mThread(&JsonFakeValueGenerator::loop, this) {}
-
-JsonFakeValueGenerator::~JsonFakeValueGenerator() {
-    mStopRequested = true;
-    {
-        MuxGuard g(mLock);
-        mGenCfg.index = 0;
-        mGenCfg.events.clear();
-    }
-    mCond.notify_one();
-    if (mThread.joinable()) {
-        mThread.join();
-    }
-}
-
-StatusCode JsonFakeValueGenerator::start(const VehiclePropValue& request) {
+JsonFakeValueGenerator::JsonFakeValueGenerator(const VehiclePropValue& request) {
     const auto& v = request.value;
-    if (v.stringValue.empty()) {
-        ALOGE("%s: path to JSON file is missing", __func__);
-        return StatusCode::INVALID_ARG;
-    }
     const char* file = v.stringValue.c_str();
     std::ifstream ifs(file);
     if (!ifs) {
         ALOGE("%s: couldn't open %s for parsing.", __func__, file);
-        return StatusCode::INTERNAL_ERROR;
     }
-    std::vector<VehiclePropValue> fakeVhalEvents = parseFakeValueJson(ifs);
-
-    {
-        MuxGuard g(mLock);
-        mGenCfg = {0, fakeVhalEvents};
-    }
-    mCond.notify_one();
-    return StatusCode::OK;
+    mGenCfg = {
+        .index = 0,
+        .events = parseFakeValueJson(ifs),
+    };
+    // Iterate infinitely if repetition number is not provided
+    mNumOfIterations = v.int32Values.size() < 2 ? -1 : v.int32Values[1];
 }
 
-StatusCode JsonFakeValueGenerator::stop(const VehiclePropValue& request) {
-    const auto& v = request.value;
-    if (!v.stringValue.empty()) {
-        ALOGI("%s: %s", __func__, v.stringValue.c_str());
+VehiclePropValue JsonFakeValueGenerator::nextEvent() {
+    VehiclePropValue generatedValue;
+    if (!hasNext()) {
+        return generatedValue;
     }
+    TimePoint eventTime = Clock::now();
+    if (mGenCfg.index != 0) {
+        // All events (start from 2nd one) are supposed to happen in the future with a delay
+        // equals to the duration between previous and current event.
+        eventTime += Nanos(mGenCfg.events[mGenCfg.index].timestamp -
+                           mGenCfg.events[mGenCfg.index - 1].timestamp);
+    }
+    generatedValue = mGenCfg.events[mGenCfg.index];
+    generatedValue.timestamp = eventTime.time_since_epoch().count();
 
-    {
-        MuxGuard g(mLock);
+    mGenCfg.index++;
+    if (mGenCfg.index == mGenCfg.events.size()) {
         mGenCfg.index = 0;
-        mGenCfg.events.clear();
+        if (mNumOfIterations > 0) {
+            mNumOfIterations--;
+        }
     }
-    mCond.notify_one();
-    return StatusCode::OK;
+    return generatedValue;
+}
+
+bool JsonFakeValueGenerator::hasNext() {
+    return mNumOfIterations != 0 && mGenCfg.events.size() > 0;
 }
 
 std::vector<VehiclePropValue> JsonFakeValueGenerator::parseFakeValueJson(std::istream& is) {
@@ -131,9 +124,14 @@
             case VehiclePropertyType::STRING:
                 value.stringValue = rawEventValue.asString();
                 break;
+            case VehiclePropertyType::MIXED:
+                copyMixedValueJson(value, rawEventValue);
+                if (isDiagnosticProperty(event.prop)) {
+                    value.bytes = generateDiagnosticBytes(value);
+                }
+                break;
             default:
-                ALOGE("%s: unsupported type for property: 0x%x with value: %s", __func__,
-                      event.prop, rawEventValue.asString().c_str());
+                ALOGE("%s: unsupported type for property: 0x%x", __func__, event.prop);
                 continue;
         }
         fakeVhalEvents.push_back(event);
@@ -141,30 +139,60 @@
     return fakeVhalEvents;
 }
 
-void JsonFakeValueGenerator::loop() {
-    static constexpr auto kInvalidTime = TimePoint(Nanos::max());
+void JsonFakeValueGenerator::copyMixedValueJson(VehiclePropValue::RawValue& dest,
+                                                const Json::Value& jsonValue) {
+    copyJsonArray(dest.int32Values, jsonValue["int32Values"]);
+    copyJsonArray(dest.int64Values, jsonValue["int64Values"]);
+    copyJsonArray(dest.floatValues, jsonValue["floatValues"]);
+    dest.stringValue = jsonValue["stringValue"].asString();
+}
 
-    while (!mStopRequested) {
-        auto nextEventTime = kInvalidTime;
-        {
-            MuxGuard g(mLock);
-            if (mGenCfg.index < mGenCfg.events.size()) {
-                mOnHalEvent(mGenCfg.events[mGenCfg.index]);
-            }
-            if (!mGenCfg.events.empty() && mGenCfg.index < mGenCfg.events.size() - 1) {
-                Nanos intervalNano =
-                    static_cast<Nanos>(mGenCfg.events[mGenCfg.index + 1].timestamp -
-                                       mGenCfg.events[mGenCfg.index].timestamp);
-                nextEventTime = Clock::now() + intervalNano;
-            }
-            mGenCfg.index++;
+template <typename T>
+void JsonFakeValueGenerator::copyJsonArray(hidl_vec<T>& dest, const Json::Value& jsonArray) {
+    dest.resize(jsonArray.size());
+    for (Json::Value::ArrayIndex i = 0; i < jsonArray.size(); i++) {
+        if (std::is_same<T, int32_t>::value) {
+            dest[i] = jsonArray[i].asInt();
+        } else if (std::is_same<T, int64_t>::value) {
+            dest[i] = jsonArray[i].asInt64();
+        } else if (std::is_same<T, float>::value) {
+            dest[i] = jsonArray[i].asFloat();
         }
-
-        std::unique_lock<std::mutex> g(mLock);
-        mCond.wait_until(g, nextEventTime);
     }
 }
 
+bool JsonFakeValueGenerator::isDiagnosticProperty(int32_t prop) {
+    return prop == (int32_t)VehicleProperty::OBD2_LIVE_FRAME ||
+           prop == (int32_t)VehicleProperty::OBD2_FREEZE_FRAME;
+}
+
+hidl_vec<uint8_t> JsonFakeValueGenerator::generateDiagnosticBytes(
+    const VehiclePropValue::RawValue& diagnosticValue) {
+    size_t byteSize = ((size_t)DiagnosticIntegerSensorIndex::LAST_SYSTEM_INDEX +
+                       (size_t)DiagnosticFloatSensorIndex::LAST_SYSTEM_INDEX + 2);
+    hidl_vec<uint8_t> bytes(byteSize % 8 == 0 ? byteSize / 8 : byteSize / 8 + 1);
+
+    auto& int32Values = diagnosticValue.int32Values;
+    for (size_t i = 0; i < int32Values.size(); i++) {
+        if (int32Values[i] != 0) {
+            setBit(bytes, i);
+        }
+    }
+
+    auto& floatValues = diagnosticValue.floatValues;
+    for (size_t i = 0; i < floatValues.size(); i++) {
+        if (floatValues[i] != 0.0) {
+            setBit(bytes, i + (size_t)DiagnosticIntegerSensorIndex::LAST_SYSTEM_INDEX + 1);
+        }
+    }
+    return bytes;
+}
+
+void JsonFakeValueGenerator::setBit(hidl_vec<uint8_t>& bytes, size_t idx) {
+    uint8_t mask = 1 << (idx % 8);
+    bytes[idx / 8] |= mask;
+}
+
 }  // namespace impl
 
 }  // namespace V2_0
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.h
index 51da4c5..70575f7 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/JsonFakeValueGenerator.h
@@ -17,11 +17,8 @@
 #ifndef android_hardware_automotive_vehicle_V2_0_impl_JsonFakeValueGenerator_H_
 #define android_hardware_automotive_vehicle_V2_0_impl_JsonFakeValueGenerator_H_
 
-#include <atomic>
 #include <chrono>
-#include <condition_variable>
 #include <iostream>
-#include <thread>
 
 #include <json/json.h>
 
@@ -37,32 +34,33 @@
 
 class JsonFakeValueGenerator : public FakeValueGenerator {
 private:
-    using Nanos = std::chrono::nanoseconds;
-    using Clock = std::chrono::steady_clock;
-    using TimePoint = std::chrono::time_point<Clock, Nanos>;
-
     struct GeneratorCfg {
         size_t index;
         std::vector<VehiclePropValue> events;
     };
 
 public:
-    JsonFakeValueGenerator(const OnHalEvent& onHalEvent);
-    ~JsonFakeValueGenerator();
-    StatusCode start(const VehiclePropValue& request) override;
-    StatusCode stop(const VehiclePropValue& request) override;
+    JsonFakeValueGenerator(const VehiclePropValue& request);
+    ~JsonFakeValueGenerator() = default;
+
+    VehiclePropValue nextEvent();
+
+    bool hasNext();
 
 private:
     std::vector<VehiclePropValue> parseFakeValueJson(std::istream& is);
-    void loop();
+    void copyMixedValueJson(VehiclePropValue::RawValue& dest, const Json::Value& jsonValue);
+
+    template <typename T>
+    void copyJsonArray(hidl_vec<T>& dest, const Json::Value& jsonArray);
+
+    bool isDiagnosticProperty(int32_t prop);
+    hidl_vec<uint8_t> generateDiagnosticBytes(const VehiclePropValue::RawValue& diagnosticValue);
+    void setBit(hidl_vec<uint8_t>& bytes, size_t idx);
 
 private:
-    OnHalEvent mOnHalEvent;
-    std::thread mThread;
-    mutable std::mutex mLock;
-    std::condition_variable mCond;
     GeneratorCfg mGenCfg;
-    std::atomic_bool mStopRequested{false};
+    int32_t mNumOfIterations;
 };
 
 }  // namespace impl
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.cpp
index 8cb9322..7bdc97c 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.cpp
@@ -29,101 +29,48 @@
 
 namespace impl {
 
-LinearFakeValueGenerator::LinearFakeValueGenerator(const OnHalEvent& onHalEvent)
-    : mOnHalEvent(onHalEvent),
-      mRecurrentTimer(std::bind(&LinearFakeValueGenerator::onTimer, this, std::placeholders::_1)) {}
-
-StatusCode LinearFakeValueGenerator::start(const VehiclePropValue& request) {
+LinearFakeValueGenerator::LinearFakeValueGenerator(const VehiclePropValue& request) {
     const auto& v = request.value;
-    if (v.int32Values.size() < 2) {
-        ALOGE("%s: expected property ID in int32Values", __func__);
-        return StatusCode::INVALID_ARG;
-    }
-    int32_t propId = v.int32Values[1];
-
-    if (!v.int64Values.size()) {
-        ALOGE("%s: interval is not provided in int64Values", __func__);
-        return StatusCode::INVALID_ARG;
-    }
-    auto interval = std::chrono::nanoseconds(v.int64Values[0]);
-
-    if (v.floatValues.size() < 3) {
-        ALOGE("%s: expected at least 3 elements in floatValues, got: %zu", __func__,
-              v.floatValues.size());
-        return StatusCode::INVALID_ARG;
-    }
-    float initialValue = v.floatValues[0];
-    float dispersion = v.floatValues[1];
-    float increment = v.floatValues[2];
-
-    MuxGuard g(mLock);
-    removeLocked(propId);
-    mGenCfg.insert({propId, GeneratorCfg{
-                                .initialValue = initialValue,
-                                .currentValue = initialValue,
-                                .dispersion = dispersion,
-                                .increment = increment,}});
-
-    mRecurrentTimer.registerRecurrentEvent(interval, propId);
-    return StatusCode::OK;
+    mGenCfg = GeneratorCfg{
+        .propId = v.int32Values[1],
+        .initialValue = v.floatValues[0],
+        .currentValue = v.floatValues[0],
+        .dispersion = v.floatValues[1],
+        .increment = v.floatValues[2],
+        .interval = Nanos(v.int64Values[0]),
+    };
 }
 
-StatusCode LinearFakeValueGenerator::stop(const VehiclePropValue& request) {
-    const auto& v = request.value;
-    if (v.int32Values.size() < 2) {
-        ALOGE("%s: expected property ID in int32Values", __func__);
-        return StatusCode::INVALID_ARG;
+VehiclePropValue LinearFakeValueGenerator::nextEvent() {
+    mGenCfg.currentValue += mGenCfg.increment;
+    if (mGenCfg.currentValue > mGenCfg.initialValue + mGenCfg.dispersion) {
+        mGenCfg.currentValue = mGenCfg.initialValue - mGenCfg.dispersion;
     }
-    int32_t propId = v.int32Values[1];
-
-    MuxGuard g(mLock);
-    if (propId == 0) {
-        // Remove all.
-        for (auto&& it : mGenCfg) {
-            removeLocked(it.first);
-        }
-    } else {
-        removeLocked(propId);
+    VehiclePropValue event = {.prop = mGenCfg.propId};
+    auto& value = event.value;
+    switch (getPropType(event.prop)) {
+        case VehiclePropertyType::INT32:
+            value.int32Values.resize(1);
+            value.int32Values[0] = static_cast<int32_t>(mGenCfg.currentValue);
+            break;
+        case VehiclePropertyType::INT64:
+            value.int64Values.resize(1);
+            value.int64Values[0] = static_cast<int64_t>(mGenCfg.currentValue);
+            break;
+        case VehiclePropertyType::FLOAT:
+            value.floatValues.resize(1);
+            value.floatValues[0] = mGenCfg.currentValue;
+            break;
+        default:
+            ALOGE("%s: unsupported property type for 0x%x", __func__, event.prop);
     }
-    return StatusCode::OK;
+    TimePoint eventTime = Clock::now() + mGenCfg.interval;
+    event.timestamp = eventTime.time_since_epoch().count();
+    return event;
 }
 
-void LinearFakeValueGenerator::removeLocked(int propId) {
-    if (mGenCfg.erase(propId)) {
-        mRecurrentTimer.unregisterRecurrentEvent(propId);
-    }
-}
-
-void LinearFakeValueGenerator::onTimer(const std::vector<int32_t>& properties) {
-    MuxGuard g(mLock);
-
-    for (int32_t propId : properties) {
-        auto& cfg = mGenCfg[propId];
-        cfg.currentValue += cfg.increment;
-        if (cfg.currentValue > cfg.initialValue + cfg.dispersion) {
-            cfg.currentValue = cfg.initialValue - cfg.dispersion;
-        }
-        VehiclePropValue event = {.prop = propId};
-        auto& value = event.value;
-        switch (getPropType(event.prop)) {
-            case VehiclePropertyType::INT32:
-                value.int32Values.resize(1);
-                value.int32Values[0] = static_cast<int32_t>(cfg.currentValue);
-                break;
-            case VehiclePropertyType::INT64:
-                value.int64Values.resize(1);
-                value.int64Values[0] = static_cast<int64_t>(cfg.currentValue);
-                break;
-            case VehiclePropertyType::FLOAT:
-                value.floatValues.resize(1);
-                value.floatValues[0] = cfg.currentValue;
-                break;
-            default:
-                ALOGE("%s: unsupported property type for 0x%x", __func__, event.prop);
-                continue;
-        }
-        mOnHalEvent(event);
-    }
+bool LinearFakeValueGenerator::hasNext() {
+    return true;
 }
 
 }  // namespace impl
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.h
index fe6d097..d3b666d 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/LinearFakeValueGenerator.h
@@ -17,8 +17,6 @@
 #ifndef android_hardware_automotive_vehicle_V2_0_impl_LinearFakeValueGenerator_H_
 #define android_hardware_automotive_vehicle_V2_0_impl_LinearFakeValueGenerator_H_
 
-#include <vhal_v2_0/RecurrentTimer.h>
-
 #include "FakeValueGenerator.h"
 
 namespace android {
@@ -36,27 +34,24 @@
     // to the client.
 
     struct GeneratorCfg {
-        float initialValue;  //
+        int32_t propId;
+        float initialValue;
         float currentValue;  //  Should be in range (initialValue +/- dispersion).
         float dispersion;    //  Defines minimum and maximum value based on initial value.
         float increment;     //  Value that we will be added to currentValue with each timer tick.
+        Nanos interval;
     };
 
 public:
-    LinearFakeValueGenerator(const OnHalEvent& onHalEvent);
+    LinearFakeValueGenerator(const VehiclePropValue& request);
     ~LinearFakeValueGenerator() = default;
-    StatusCode start(const VehiclePropValue& request) override;
-    StatusCode stop(const VehiclePropValue& request) override;
+
+    VehiclePropValue nextEvent();
+
+    bool hasNext();
 
 private:
-    void removeLocked(int propId);
-    void onTimer(const std::vector<int32_t>& properties);
-
-private:
-    mutable std::mutex mLock;
-    OnHalEvent mOnHalEvent;
-    RecurrentTimer mRecurrentTimer;
-    std::unordered_map<int32_t, GeneratorCfg> mGenCfg;
+    GeneratorCfg mGenCfg;
 };
 
 }  // namespace impl
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
index 5a9b254..f024287 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
@@ -33,23 +33,28 @@
 
 namespace impl {
 
-PipeComm::PipeComm() {
-    // Initialize member vars
-    mPipeFd = -1;
-}
+PipeComm::PipeComm(MessageProcessor* messageProcessor) : CommConn(messageProcessor), mPipeFd(-1) {}
 
-
-int PipeComm::open() {
+void PipeComm::start() {
     int fd = qemu_pipe_open(CAR_SERVICE_NAME);
 
     if (fd < 0) {
         ALOGE("%s: Could not open connection to service: %s %d", __FUNCTION__, strerror(errno), fd);
-        return -errno;
+        return;
     }
 
-    ALOGI("%s: OPENED PIPE, fd=%d", __FUNCTION__, fd);
+    ALOGI("%s: Starting pipe connection, fd=%d", __FUNCTION__, fd);
     mPipeFd = fd;
-    return 0;
+
+    CommConn::start();
+}
+
+void PipeComm::stop() {
+    if (mPipeFd > 0) {
+        ::close(mPipeFd);
+        mPipeFd = -1;
+    }
+    CommConn::stop();
 }
 
 std::vector<uint8_t> PipeComm::read() {
@@ -60,16 +65,13 @@
     numBytes = qemu_pipe_frame_recv(mPipeFd, msg.data(), msg.size());
 
     if (numBytes == MAX_RX_MSG_SZ) {
-        ALOGE("%s:  Received max size = %d", __FUNCTION__, MAX_RX_MSG_SZ);
+        ALOGE("%s: Received max size = %d", __FUNCTION__, MAX_RX_MSG_SZ);
     } else if (numBytes > 0) {
         msg.resize(numBytes);
         return msg;
     } else {
         ALOGD("%s: Connection terminated on pipe %d, numBytes=%d", __FUNCTION__, mPipeFd, numBytes);
-        {
-            std::lock_guard<std::mutex> lock(mMutex);
-            mPipeFd = -1;
-        }
+        mPipeFd = -1;
     }
 
     return std::vector<uint8_t>();
@@ -78,11 +80,8 @@
 int PipeComm::write(const std::vector<uint8_t>& data) {
     int retVal = 0;
 
-    {
-        std::lock_guard<std::mutex> lock(mMutex);
-        if (mPipeFd != -1) {
-            retVal = qemu_pipe_frame_send(mPipeFd, data.data(), data.size());
-        }
+    if (mPipeFd != -1) {
+        retVal = qemu_pipe_frame_send(mPipeFd, data.data(), data.size());
     }
 
     if (retVal < 0) {
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.h
index bcd32d0..c8eabb8 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.h
@@ -19,7 +19,7 @@
 
 #include <mutex>
 #include <vector>
-#include "CommBase.h"
+#include "CommConn.h"
 
 namespace android {
 namespace hardware {
@@ -30,38 +30,25 @@
 namespace impl {
 
 /**
- * PipeComm uses a qemu pipe interface to connect to the Goldfish Emulator.
+ * PipeComm opens a qemu pipe to connect to the emulator, allowing the emulator UI to access the
+ * Vehicle HAL and simulate changing properties.
+ *
+ * Since the pipe is a client, it directly implements CommConn, and only one PipeComm can be open
+ * at a time.
  */
-class PipeComm : public CommBase {
-public:
-    PipeComm();
+class PipeComm : public CommConn {
+   public:
+    PipeComm(MessageProcessor* messageProcessor);
 
-    /**
-     * Opens a pipe and begins listening.
-     *
-     * @return int Returns 0 on success.
-     */
-    int open() override;
+    void start() override;
+    void stop() override;
 
-    /**
-     * Blocking call to read data from the connection.
-     *
-     * @return std::vector<uint8_t> Serialized protobuf data received from emulator.  This will be
-     *              an empty vector if the connection was closed or some other error occurred.
-     */
     std::vector<uint8_t> read() override;
-
-    /**
-     * Transmits a string of data to the emulator.
-     *
-     * @param data Serialized protobuf data to transmit.
-     *
-     * @return int Number of bytes transmitted, or -1 if failed.
-     */
     int write(const std::vector<uint8_t>& data) override;
 
-private:
-    std::mutex mMutex;
+    inline bool isOpen() override { return mPipeFd > 0; }
+
+   private:
     int mPipeFd;
 };
 
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.cpp
index 42c1c78..9eb8894 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.cpp
@@ -18,6 +18,7 @@
 
 #include <android/hardware/automotive/vehicle/2.0/IVehicle.h>
 #include <android/log.h>
+#include <arpa/inet.h>
 #include <log/log.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
@@ -35,45 +36,46 @@
 
 namespace impl {
 
-SocketComm::SocketComm() {
-    // Initialize member vars
-    mCurSockFd = -1;
-    mExit      =  0;
-    mSockFd    = -1;
-}
-
+SocketComm::SocketComm(MessageProcessor* messageProcessor)
+    : mListenFd(-1), mMessageProcessor(messageProcessor) {}
 
 SocketComm::~SocketComm() {
-    stop();
 }
 
-int SocketComm::connect() {
-    sockaddr_in cliAddr;
-    socklen_t cliLen = sizeof(cliAddr);
-    int cSockFd = accept(mSockFd, reinterpret_cast<struct sockaddr*>(&cliAddr), &cliLen);
-
-    if (cSockFd >= 0) {
-        {
-            std::lock_guard<std::mutex> lock(mMutex);
-            mCurSockFd = cSockFd;
-        }
-        ALOGD("%s: Incoming connection received on socket %d", __FUNCTION__, cSockFd);
-    } else {
-        cSockFd = -1;
+void SocketComm::start() {
+    if (!listen()) {
+        return;
     }
 
-    return cSockFd;
+    mListenThread = std::make_unique<std::thread>(std::bind(&SocketComm::listenThread, this));
 }
 
-int SocketComm::open() {
+void SocketComm::stop() {
+    if (mListenFd > 0) {
+        ::close(mListenFd);
+        if (mListenThread->joinable()) {
+            mListenThread->join();
+        }
+        mListenFd = -1;
+    }
+}
+
+void SocketComm::sendMessage(emulator::EmulatorMessage const& msg) {
+    std::lock_guard<std::mutex> lock(mMutex);
+    for (std::unique_ptr<SocketConn> const& conn : mOpenConnections) {
+        conn->sendMessage(msg);
+    }
+}
+
+bool SocketComm::listen() {
     int retVal;
     struct sockaddr_in servAddr;
 
-    mSockFd = socket(AF_INET, SOCK_STREAM, 0);
-    if (mSockFd < 0) {
-        ALOGE("%s: socket() failed, mSockFd=%d, errno=%d", __FUNCTION__, mSockFd, errno);
-        mSockFd = -1;
-        return -errno;
+    mListenFd = socket(AF_INET, SOCK_STREAM, 0);
+    if (mListenFd < 0) {
+        ALOGE("%s: socket() failed, mSockFd=%d, errno=%d", __FUNCTION__, mListenFd, errno);
+        mListenFd = -1;
+        return false;
     }
 
     memset(&servAddr, 0, sizeof(servAddr));
@@ -81,82 +83,114 @@
     servAddr.sin_addr.s_addr = INADDR_ANY;
     servAddr.sin_port = htons(DEBUG_SOCKET);
 
-    retVal = bind(mSockFd, reinterpret_cast<struct sockaddr*>(&servAddr), sizeof(servAddr));
+    retVal = bind(mListenFd, reinterpret_cast<struct sockaddr*>(&servAddr), sizeof(servAddr));
     if(retVal < 0) {
         ALOGE("%s: Error on binding: retVal=%d, errno=%d", __FUNCTION__, retVal, errno);
+        close(mListenFd);
+        mListenFd = -1;
+        return false;
+    }
+
+    ALOGI("%s: Listening for connections on port %d", __FUNCTION__, DEBUG_SOCKET);
+    ::listen(mListenFd, 1);
+    return true;
+}
+
+SocketConn* SocketComm::accept() {
+    sockaddr_in cliAddr;
+    socklen_t cliLen = sizeof(cliAddr);
+    int sfd = ::accept(mListenFd, reinterpret_cast<struct sockaddr*>(&cliAddr), &cliLen);
+
+    if (sfd > 0) {
+        char addr[INET_ADDRSTRLEN];
+        inet_ntop(AF_INET, &cliAddr.sin_addr, addr, INET_ADDRSTRLEN);
+
+        ALOGD("%s: Incoming connection received from %s:%d", __FUNCTION__, addr, cliAddr.sin_port);
+        return new SocketConn(mMessageProcessor, sfd);
+    }
+
+    return nullptr;
+}
+
+void SocketComm::listenThread() {
+    while (true) {
+        SocketConn* conn = accept();
+        if (conn == nullptr) {
+            return;
+        }
+
+        conn->start();
+        {
+            std::lock_guard<std::mutex> lock(mMutex);
+            mOpenConnections.push_back(std::unique_ptr<SocketConn>(conn));
+        }
+    }
+}
+
+/**
+ * Called occasionally to clean up connections that have been closed.
+ */
+void SocketComm::removeClosedConnections() {
+    std::lock_guard<std::mutex> lock(mMutex);
+    std::remove_if(mOpenConnections.begin(), mOpenConnections.end(),
+                   [](std::unique_ptr<SocketConn> const& c) { return !c->isOpen(); });
+}
+
+SocketConn::SocketConn(MessageProcessor* messageProcessor, int sfd)
+    : CommConn(messageProcessor), mSockFd(sfd) {}
+
+/**
+ * Reads, in a loop, exactly numBytes from the given fd. If the connection is closed, returns
+ * an empty buffer, otherwise will return exactly the given number of bytes.
+ */
+std::vector<uint8_t> readExactly(int fd, int numBytes) {
+    std::vector<uint8_t> buffer(numBytes);
+    int totalRead = 0;
+    int offset = 0;
+    while (totalRead < numBytes) {
+        int numRead = ::read(fd, &buffer.data()[offset], numBytes - offset);
+        if (numRead == 0) {
+            buffer.resize(0);
+            return buffer;
+        }
+
+        totalRead += numRead;
+    }
+    return buffer;
+}
+
+/**
+ * Reads an int, guaranteed to be non-zero, from the given fd. If the connection is closed, returns
+ * -1.
+ */
+int32_t readInt(int fd) {
+    std::vector<uint8_t> buffer = readExactly(fd, sizeof(int32_t));
+    if (buffer.size() == 0) {
+        return -1;
+    }
+
+    int32_t value = *reinterpret_cast<int32_t*>(buffer.data());
+    return ntohl(value);
+}
+
+std::vector<uint8_t> SocketConn::read() {
+    int32_t msgSize = readInt(mSockFd);
+    if (msgSize <= 0) {
+        ALOGD("%s: Connection terminated on socket %d", __FUNCTION__, mSockFd);
+        return std::vector<uint8_t>();
+    }
+
+    return readExactly(mSockFd, msgSize);
+}
+
+void SocketConn::stop() {
+    if (mSockFd > 0) {
         close(mSockFd);
         mSockFd = -1;
-        return -errno;
-    }
-
-    listen(mSockFd, 1);
-
-    // Set the socket to be non-blocking so we can poll it continouously
-    fcntl(mSockFd, F_SETFL, O_NONBLOCK);
-
-    return 0;
-}
-
-std::vector<uint8_t> SocketComm::read() {
-    int32_t msgSize;
-    int numBytes = 0;
-
-    // This is a variable length message.
-    // Read the number of bytes to rx over the socket
-    numBytes = ::read(mCurSockFd, &msgSize, sizeof(msgSize));
-    msgSize = ntohl(msgSize);
-
-    if (numBytes != sizeof(msgSize)) {
-        // This happens when connection is closed
-        ALOGD("%s: numBytes=%d, expected=4", __FUNCTION__, numBytes);
-        ALOGD("%s: Connection terminated on socket %d", __FUNCTION__, mCurSockFd);
-        {
-            std::lock_guard<std::mutex> lock(mMutex);
-            mCurSockFd = -1;
-        }
-
-        return std::vector<uint8_t>();
-    }
-
-    std::vector<uint8_t> msg = std::vector<uint8_t>(msgSize);
-
-    numBytes = ::read(mCurSockFd, msg.data(), msgSize);
-
-    if ((numBytes == msgSize) && (msgSize > 0)) {
-        // Received a message.
-        return msg;
-    } else {
-        // This happens when connection is closed
-        ALOGD("%s: numBytes=%d, msgSize=%d", __FUNCTION__, numBytes, msgSize);
-        ALOGD("%s: Connection terminated on socket %d", __FUNCTION__, mCurSockFd);
-        {
-            std::lock_guard<std::mutex> lock(mMutex);
-            mCurSockFd = -1;
-        }
-
-        return std::vector<uint8_t>();
     }
 }
 
-void SocketComm::stop() {
-    if (mExit == 0) {
-        std::lock_guard<std::mutex> lock(mMutex);
-        mExit = 1;
-
-        // Close emulator socket if it is open
-        if (mCurSockFd != -1) {
-            close(mCurSockFd);
-            mCurSockFd = -1;
-        }
-
-        if (mSockFd != -1) {
-            close(mSockFd);
-            mSockFd = -1;
-        }
-    }
-}
-
-int SocketComm::write(const std::vector<uint8_t>& data) {
+int SocketConn::write(const std::vector<uint8_t>& data) {
     static constexpr int MSG_HEADER_LEN = 4;
     int retVal = 0;
     union {
@@ -168,19 +202,17 @@
     msgLen = static_cast<uint32_t>(data.size());
     msgLen = htonl(msgLen);
 
-    std::lock_guard<std::mutex> lock(mMutex);
-    if (mCurSockFd != -1) {
-        retVal = ::write(mCurSockFd, msgLenBytes, MSG_HEADER_LEN);
+    if (mSockFd > 0) {
+        retVal = ::write(mSockFd, msgLenBytes, MSG_HEADER_LEN);
 
         if (retVal == MSG_HEADER_LEN) {
-            retVal = ::write(mCurSockFd, data.data(), data.size());
+            retVal = ::write(mSockFd, data.data(), data.size());
         }
     }
 
     return retVal;
 }
 
-
 }  // impl
 
 }  // namespace V2_0
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.h
index 12cfb29..88b852b 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/SocketComm.h
@@ -18,8 +18,9 @@
 #define android_hardware_automotive_vehicle_V2_0_impl_SocketComm_H_
 
 #include <mutex>
+#include <thread>
 #include <vector>
-#include "CommBase.h"
+#include "CommConn.h"
 
 namespace android {
 namespace hardware {
@@ -29,29 +30,60 @@
 
 namespace impl {
 
+class SocketConn;
+
 /**
- * SocketComm opens a socket via adb's TCP port forwarding to enable a Host PC to connect to
- * the VehicleHAL.
+ * SocketComm opens a socket, and listens for connections from clients. Typically the client will be
+ * adb's TCP port-forwarding to enable a host PC to connect to the VehicleHAL.
  */
-class SocketComm : public CommBase {
-public:
-    SocketComm();
+class SocketComm {
+   public:
+    SocketComm(MessageProcessor* messageProcessor);
     virtual ~SocketComm();
 
+    void start();
+    void stop();
+
     /**
-     * Creates a connection to the other side.
+     * Serialized and send the given message to all connected clients.
+     */
+    void sendMessage(emulator::EmulatorMessage const& msg);
+
+   private:
+    int mListenFd;
+    std::unique_ptr<std::thread> mListenThread;
+    std::vector<std::unique_ptr<SocketConn>> mOpenConnections;
+    MessageProcessor* mMessageProcessor;
+    std::mutex mMutex;
+
+    /**
+     * Opens the socket and begins listening.
+     *
+     * @return bool Returns true on success.
+     */
+    bool listen();
+
+    /**
+     * Blocks and waits for a connection from a client, returns a new SocketConn with the connection
+     * or null, if the connection has been closed.
      *
      * @return int Returns fd or socket number if connection is successful.
      *              Otherwise, returns -1 if no connection is availble.
      */
-    int connect() override;
+    SocketConn* accept();
 
-    /**
-     * Opens a socket and begins listening.
-     *
-     * @return int Returns 0 on success.
-     */
-    int open() override;
+    void listenThread();
+
+    void removeClosedConnections();
+};
+
+/**
+ * SocketConn represents a single connection to a client.
+ */
+class SocketConn : public CommConn {
+   public:
+    SocketConn(MessageProcessor* messageProcessor, int sfd);
+    virtual ~SocketConn() = default;
 
     /**
      * Blocking call to read data from the connection.
@@ -75,10 +107,9 @@
      */
     int write(const std::vector<uint8_t>& data) override;
 
-private:
-    int mCurSockFd;
-    std::atomic<int> mExit;
-    std::mutex mMutex;
+    inline bool isOpen() override { return mSockFd > 0; }
+
+   private:
     int mSockFd;
 };
 
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.cpp
index bf7be09..356a6b9 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.cpp
@@ -16,9 +16,10 @@
 #define LOG_TAG "VehicleEmulator_v2_0"
 #include <android/log.h>
 
-#include <algorithm>
 #include <android-base/properties.h>
+#include <log/log.h>
 #include <utils/SystemClock.h>
+#include <algorithm>
 
 #include <vhal_v2_0/VehicleUtils.h>
 
@@ -35,32 +36,45 @@
 
 namespace impl {
 
-std::unique_ptr<CommBase> CommFactory::create() {
-    bool isEmulator = android::base::GetBoolProperty("ro.kernel.qemu", false);
+VehicleEmulator::VehicleEmulator(EmulatedVehicleHalIface* hal) : mHal{hal} {
+    mHal->registerEmulator(this);
 
-    if (isEmulator) {
-        return std::make_unique<PipeComm>();
-    } else {
-        return std::make_unique<SocketComm>();
+    ALOGI("Starting SocketComm");
+    mSocketComm = std::make_unique<SocketComm>(this);
+    mSocketComm->start();
+
+    if (android::base::GetBoolProperty("ro.kernel.qemu", false)) {
+        ALOGI("Starting PipeComm");
+        mPipeComm = std::make_unique<PipeComm>(this);
+        mPipeComm->start();
     }
 }
 
 VehicleEmulator::~VehicleEmulator() {
-    mExit = true;   // Notify thread to finish and wait for it to terminate.
-    mComm->stop();  // Close emulator socket if it is open.
-    if (mThread.joinable()) mThread.join();
+    mSocketComm->stop();
+    if (mPipeComm) {
+        mPipeComm->stop();
+    }
 }
 
+/**
+ * This is called by the HAL when a property changes. We need to notify our clients that it has
+ * changed.
+ */
 void VehicleEmulator::doSetValueFromClient(const VehiclePropValue& propValue) {
     emulator::EmulatorMessage msg;
     emulator::VehiclePropValue *val = msg.add_value();
     populateProtoVehiclePropValue(val, &propValue);
     msg.set_status(emulator::RESULT_OK);
     msg.set_msg_type(emulator::SET_PROPERTY_ASYNC);
-    txMsg(msg);
+
+    mSocketComm->sendMessage(msg);
+    if (mPipeComm) {
+        mPipeComm->sendMessage(msg);
+    }
 }
 
-void VehicleEmulator::doGetConfig(VehicleEmulator::EmulatorMessage& rxMsg,
+void VehicleEmulator::doGetConfig(VehicleEmulator::EmulatorMessage const& rxMsg,
                                   VehicleEmulator::EmulatorMessage& respMsg) {
     std::vector<VehiclePropConfig> configs = mHal->listProperties();
     emulator::VehiclePropGet getProp = rxMsg.prop(0);
@@ -79,7 +93,7 @@
     }
 }
 
-void VehicleEmulator::doGetConfigAll(VehicleEmulator::EmulatorMessage& /* rxMsg */,
+void VehicleEmulator::doGetConfigAll(VehicleEmulator::EmulatorMessage const& /* rxMsg */,
                                      VehicleEmulator::EmulatorMessage& respMsg) {
     std::vector<VehiclePropConfig> configs = mHal->listProperties();
 
@@ -92,8 +106,8 @@
     }
 }
 
-void VehicleEmulator::doGetProperty(VehicleEmulator::EmulatorMessage& rxMsg,
-                                    VehicleEmulator::EmulatorMessage& respMsg)  {
+void VehicleEmulator::doGetProperty(VehicleEmulator::EmulatorMessage const& rxMsg,
+                                    VehicleEmulator::EmulatorMessage& respMsg) {
     int32_t areaId = 0;
     emulator::VehiclePropGet getProp = rxMsg.prop(0);
     int32_t propId = getProp.prop();
@@ -119,8 +133,8 @@
     respMsg.set_status(status);
 }
 
-void VehicleEmulator::doGetPropertyAll(VehicleEmulator::EmulatorMessage& /* rxMsg */,
-                                       VehicleEmulator::EmulatorMessage& respMsg)  {
+void VehicleEmulator::doGetPropertyAll(VehicleEmulator::EmulatorMessage const& /* rxMsg */,
+                                       VehicleEmulator::EmulatorMessage& respMsg) {
     respMsg.set_msg_type(emulator::GET_PROPERTY_ALL_RESP);
     respMsg.set_status(emulator::RESULT_OK);
 
@@ -132,7 +146,7 @@
     }
 }
 
-void VehicleEmulator::doSetProperty(VehicleEmulator::EmulatorMessage& rxMsg,
+void VehicleEmulator::doSetProperty(VehicleEmulator::EmulatorMessage const& rxMsg,
                                     VehicleEmulator::EmulatorMessage& respMsg) {
     emulator::VehiclePropValue protoVal = rxMsg.value(0);
     VehiclePropValue val = {
@@ -173,58 +187,28 @@
     respMsg.set_status(halRes ? emulator::RESULT_OK : emulator::ERROR_INVALID_PROPERTY);
 }
 
-void VehicleEmulator::txMsg(emulator::EmulatorMessage& txMsg) {
-    int numBytes = txMsg.ByteSize();
-    std::vector<uint8_t> msg(static_cast<size_t>(numBytes));
-
-    if (!txMsg.SerializeToArray(msg.data(), static_cast<int32_t>(msg.size()))) {
-        ALOGE("%s: SerializeToString failed!", __func__);
-        return;
-    }
-
-    if (mExit) {
-        ALOGW("%s: unable to transmit a message, connection closed", __func__);
-        return;
-    }
-
-    // Send the message
-    int retVal = mComm->write(msg);
-    if (retVal < 0) {
-        ALOGE("%s: Failed to tx message: retval=%d, errno=%d", __func__, retVal, errno);
-    }
-}
-
-void VehicleEmulator::parseRxProtoBuf(std::vector<uint8_t>& msg) {
-    emulator::EmulatorMessage rxMsg;
-    emulator::EmulatorMessage respMsg;
-
-    if (rxMsg.ParseFromArray(msg.data(), static_cast<int32_t>(msg.size()))) {
-        switch (rxMsg.msg_type()) {
-            case emulator::GET_CONFIG_CMD:
-                doGetConfig(rxMsg, respMsg);
-                break;
-            case emulator::GET_CONFIG_ALL_CMD:
-                doGetConfigAll(rxMsg, respMsg);
-                break;
-            case emulator::GET_PROPERTY_CMD:
-                doGetProperty(rxMsg, respMsg);
-                break;
-            case emulator::GET_PROPERTY_ALL_CMD:
-                doGetPropertyAll(rxMsg, respMsg);
-                break;
-            case emulator::SET_PROPERTY_CMD:
-                doSetProperty(rxMsg, respMsg);
-                break;
-            default:
-                ALOGW("%s: Unknown message received, type = %d", __func__, rxMsg.msg_type());
-                respMsg.set_status(emulator::ERROR_UNIMPLEMENTED_CMD);
-                break;
-        }
-
-        // Send the reply
-        txMsg(respMsg);
-    } else {
-        ALOGE("%s: ParseFromString() failed. msgSize=%d", __func__, static_cast<int>(msg.size()));
+void VehicleEmulator::processMessage(emulator::EmulatorMessage const& rxMsg,
+                                     emulator::EmulatorMessage& respMsg) {
+    switch (rxMsg.msg_type()) {
+        case emulator::GET_CONFIG_CMD:
+            doGetConfig(rxMsg, respMsg);
+            break;
+        case emulator::GET_CONFIG_ALL_CMD:
+            doGetConfigAll(rxMsg, respMsg);
+            break;
+        case emulator::GET_PROPERTY_CMD:
+            doGetProperty(rxMsg, respMsg);
+            break;
+        case emulator::GET_PROPERTY_ALL_CMD:
+            doGetPropertyAll(rxMsg, respMsg);
+            break;
+        case emulator::SET_PROPERTY_CMD:
+            doSetProperty(rxMsg, respMsg);
+            break;
+        default:
+            ALOGW("%s: Unknown message received, type = %d", __func__, rxMsg.msg_type());
+            respMsg.set_status(emulator::ERROR_UNIMPLEMENTED_CMD);
+            break;
     }
 }
 
@@ -316,40 +300,6 @@
     }
 }
 
-void VehicleEmulator::rxMsg() {
-    while (!mExit) {
-        std::vector<uint8_t> msg = mComm->read();
-
-        if (msg.size() > 0) {
-            // Received a message.
-            parseRxProtoBuf(msg);
-        } else {
-            // This happens when connection is closed
-            ALOGD("%s: msgSize=%zu", __func__, msg.size());
-            break;
-        }
-    }
-}
-
-void VehicleEmulator::rxThread() {
-    if (mExit) return;
-
-    int retVal = mComm->open();
-    if (retVal != 0) mExit = true;
-
-    // Comms are properly opened
-    while (!mExit) {
-        retVal = mComm->connect();
-
-        if (retVal >= 0) {
-            rxMsg();
-        }
-
-        // Check every 100ms for a new connection
-        std::this_thread::sleep_for(std::chrono::milliseconds(100));
-    }
-}
-
 }  // impl
 
 }  // namespace V2_0
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h
index 1a8cfe2..58e387a 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h
@@ -24,7 +24,9 @@
 
 #include "vhal_v2_0/VehicleHal.h"
 
-#include "CommBase.h"
+#include "CommConn.h"
+#include "PipeComm.h"
+#include "SocketComm.h"
 #include "VehicleHalProto.pb.h"
 
 namespace android {
@@ -61,48 +63,36 @@
     VehicleEmulator* mEmulator;
 };
 
-struct CommFactory {
-    static std::unique_ptr<CommBase> create();
-};
-
 /**
  * Emulates vehicle by providing controlling interface from host side either through ADB or Pipe.
  */
-class VehicleEmulator {
-public:
-    VehicleEmulator(EmulatedVehicleHalIface* hal,
-                    std::unique_ptr<CommBase> comm = CommFactory::create())
-            : mHal { hal },
-              mComm(comm.release()),
-              mThread { &VehicleEmulator::rxThread, this} {
-        mHal->registerEmulator(this);
-    }
+class VehicleEmulator : public MessageProcessor {
+   public:
+    VehicleEmulator(EmulatedVehicleHalIface* hal);
     virtual ~VehicleEmulator();
 
     void doSetValueFromClient(const VehiclePropValue& propValue);
+    void processMessage(emulator::EmulatorMessage const& rxMsg,
+                        emulator::EmulatorMessage& respMsg) override;
 
-private:
+   private:
+    friend class ConnectionThread;
     using EmulatorMessage = emulator::EmulatorMessage;
 
-    void doGetConfig(EmulatorMessage& rxMsg, EmulatorMessage& respMsg);
-    void doGetConfigAll(EmulatorMessage& rxMsg, EmulatorMessage& respMsg);
-    void doGetProperty(EmulatorMessage& rxMsg, EmulatorMessage& respMsg);
-    void doGetPropertyAll(EmulatorMessage& rxMsg, EmulatorMessage& respMsg);
-    void doSetProperty(EmulatorMessage& rxMsg, EmulatorMessage& respMsg);
-    void txMsg(emulator::EmulatorMessage& txMsg);
-    void parseRxProtoBuf(std::vector<uint8_t>& msg);
+    void doGetConfig(EmulatorMessage const& rxMsg, EmulatorMessage& respMsg);
+    void doGetConfigAll(EmulatorMessage const& rxMsg, EmulatorMessage& respMsg);
+    void doGetProperty(EmulatorMessage const& rxMsg, EmulatorMessage& respMsg);
+    void doGetPropertyAll(EmulatorMessage const& rxMsg, EmulatorMessage& respMsg);
+    void doSetProperty(EmulatorMessage const& rxMsg, EmulatorMessage& respMsg);
     void populateProtoVehicleConfig(emulator::VehiclePropConfig* protoCfg,
                                     const VehiclePropConfig& cfg);
     void populateProtoVehiclePropValue(emulator::VehiclePropValue* protoVal,
                                        const VehiclePropValue* val);
-    void rxMsg();
-    void rxThread();
 
 private:
-    std::atomic<bool> mExit { false };
     EmulatedVehicleHalIface* mHal;
-    std::unique_ptr<CommBase> mComm;
-    std::thread mThread;
+    std::unique_ptr<SocketComm> mSocketComm;
+    std::unique_ptr<PipeComm> mPipeComm;
 };
 
 }  // impl
diff --git a/automotive/vehicle/2.0/types.hal b/automotive/vehicle/2.0/types.hal
index 57179df..4751a76 100644
--- a/automotive/vehicle/2.0/types.hal
+++ b/automotive/vehicle/2.0/types.hal
@@ -306,6 +306,37 @@
         | VehicleArea:GLOBAL),
 
     /**
+     * Speed of the vehicle for displays
+     *
+     * Some cars display a slightly slower speed than the actual speed.  This is
+     * usually displayed on the speedometer.
+     *
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
+     * @access VehiclePropertyAccess:READ
+     * @unit VehicleUnit:METER_PER_SEC
+     */
+    PERF_VEHICLE_SPEED_DISPLAY = (
+        0x0208
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:FLOAT
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Steering angle of the vehicle
+     *
+     * Angle is in degrees.  Left is negative.
+     *
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
+     * @access VehiclePropertyAccess:READ
+     * @unit VehicleUnit:DEGREES
+     */
+    PERF_STEERING_ANGLE = (
+        0x0209
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:FLOAT
+        | VehicleArea:GLOBAL),
+
+    /**
      * Temperature of engine coolant
      *
      * @change_mode VehiclePropertyChangeMode:CONTINUOUS
@@ -587,7 +618,13 @@
      *
      * This property corresponds to the low fuel warning on the dashboard.
      * Once FUEL_LEVEL_LOW is set, it should not be cleared until more fuel is
-     * added to the vehicle.
+     * added to the vehicle.  This property may take into account all fuel
+     * sources for a vehicle - for example:
+     *
+     *   For a gas powered vehicle, this property is based soley on gas level.
+     *   For a battery powered vehicle, this property is based solely on battery level.
+     *   For a hybrid vehicle, this property may be based on the combination of gas and battery
+     *      levels, at the OEM's discretion.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
@@ -1088,7 +1125,7 @@
     /**
      * Property to control power state of application processor
      *
-     * It is assumed that AP's power state is controller by separate power
+     * It is assumed that AP's power state is controlled by a separate power
      * controller.
      *
      * For configuration information, VehiclePropConfig.configArray can have bit flag combining
@@ -1099,7 +1136,7 @@
      *                    0 if not used.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VEHICLE_PROP_ACCESS_READ
+     * @access VehiclePropertyAccess:READ
      */
     AP_POWER_STATE_REQ = (
         0x0A00
@@ -1118,7 +1155,7 @@
 
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VEHICLE_PROP_ACCESS_WRITE
+     * @access VehiclePropertyAccess:WRITE
      */
     AP_POWER_STATE_REPORT = (
         0x0A01
@@ -2230,17 +2267,8 @@
 };
 
 enum VehicleApPowerStateReq : int32_t {
-    /** vehicle HAL will never publish this state to AP */
-    OFF = 0,
-
-    /** vehicle HAL will never publish this state to AP */
-    DEEP_SLEEP = 1,
-
-    /** AP is on but display must be off. */
-    ON_DISP_OFF = 2,
-
-    /** AP is on with display on. This state allows full user interaction. */
-    ON_FULL = 3,
+    /** Transition Android from WAIT_FOR_VHAL to ON state */
+    ON = 0,
 
     /**
      * The power controller has requested AP to shutdown. AP can either enter
@@ -2250,8 +2278,16 @@
      * system.
      *
      * int32Values[1] : one of enum_vehicle_ap_power_state_shutdown_param_type
+     *
+     * SHUTDOWN_PRPARE may be requested from either WAIT_FOR_VHAL or ON states.
      */
-    SHUTDOWN_PREPARE = 4,
+    SHUTDOWN_PREPARE = 1,
+
+    /** Cancel the shutdown and transition from SHUTDOWN_PREPARE to WAIT_FOR_VHAL state */
+    CANCEL_SHUTDOWN = 2,
+
+    /** VHAL is finished with shutdown procedures and ready for Android to suspend/shutdown */
+    FINISHED = 3,
 };
 
 /**
@@ -2277,26 +2313,30 @@
 
 enum VehicleApPowerStateReport : int32_t {
     /**
-     * AP has finished boot up, and can start shutdown if requested by power
-     * controller.
+     * Device has booted, CarService has initialized and is ready to accept commands from VHAL.
+     * Device starts in WAIT_FOR_VHAL state.  The user is not logged in, and vendor apps/services
+     * are expected to control the display and audio.
      */
-    BOOT_COMPLETE = 0x1,
+    WAIT_FOR_VHAL = 0x1,
 
     /**
-     * AP is entering deep sleep state. How this state is implemented may vary
-     * depending on each H/W, but AP's power must be kept in this state.
+     * AP is ready to suspend and has entered WAIT_FOR_FINISHED state.
+     *
+     * int32Values[1]: Time to turn on AP in secs. Power controller may turn on
+     *                 AP after specified time so that AP can run tasks like
+     *                 update. If it is set to 0, there is no wake up, and power
+     *                 controller may not necessarily support wake-up.
      */
     DEEP_SLEEP_ENTRY = 0x2,
 
     /**
-     * AP is exiting from deep sleep state, and is in
-     * VehicleApPowerState#SHUTDOWN_PREPARE state.
-     * The power controller may change state to other ON states based on the
-     * current state.
+     * AP is exiting from deep sleep state, and is in WAIT_FOR_VHAL state.
      */
     DEEP_SLEEP_EXIT = 0x3,
 
     /**
+     * AP remains in SHUTDOWN_PREPARE state as idle and cleanup tasks execute.
+     *
      * int32Values[1]: Time to postpone shutdown in ms. Maximum value can be
      *                 5000 ms.
      *                 If AP needs more time, it will send another POSTPONE
@@ -2305,63 +2345,31 @@
     SHUTDOWN_POSTPONE = 0x4,
 
     /**
-     * AP is starting shutting down. When system completes shutdown, everything
-     * will stop in AP as kernel will stop all other contexts. It is
-     * responsibility of vehicle HAL or lower level to synchronize that state
-     * with external power controller. As an example, some kind of ping
-     * with timeout in power controller can be a solution.
+     * AP is ready to shutdown and has entered WAIT_FOR_FINISHED state.
      *
      * int32Values[1]: Time to turn on AP in secs. Power controller may turn on
      *                 AP after specified time so that AP can run tasks like
      *                 update. If it is set to 0, there is no wake up, and power
-     *                 controller may not necessarily support wake-up. If power
-     *                 controller turns on AP due to timer, it must start with
-     *                 VehicleApPowerState#ON_DISP_OFF state, and after
-     *                 receiving VehicleApPowerSetState#BOOT_COMPLETE, it shall
-     *                 do state transition to
-     *                 VehicleApPowerState#SHUTDOWN_PREPARE.
+     *                 controller may not necessarily support wake-up.
      */
     SHUTDOWN_START = 0x5,
 
     /**
-     * User has requested to turn off headunit's display, which is detected in
-     * android side.
-     * The power controller may change the power state to
-     * VehicleApPowerState#ON_DISP_OFF.
+     * AP has transitioned from WAIT_FOR_VHAL state to ON.
      */
-    DISPLAY_OFF = 0x6,
+    ON = 0x6,
 
     /**
-     * User has requested to turn on headunit's display, most probably from power
-     * key input which is attached to headunit. The power controller may change
-     * the power state to VehicleApPowerState#ON_FULL.
+     * AP has transitions to SHUTDOWN_PREPARE state.  In this state, Garage Mode will execute idle
+     * tasks, and other services that have registered for this state transition may execute
+     * cleanup activities.
      */
-    DISPLAY_ON = 0x7,
-};
-
-/**
- * Enum to represent bootup reason.
- */
-enum VehicleApPowerBootupReason : int32_t {
-    /**
-     * Power on due to user's pressing of power key or rotating of ignition
-     * switch.
-     */
-    USER_POWER_ON = 0,
+    SHUTDOWN_PREPARE = 0x7,
 
     /**
-     * Automatic power on triggered by door unlock or any other kind of automatic
-     * user detection.
+     * AP has transitioned from SHUTDOWN_PREPARE state to WAIT_FOR_VHAL.
      */
-    USER_UNLOCK = 1,
-
-    /**
-     * Automatic power on triggered by timer. This only happens when AP has asked
-     * wake-up after
-     * certain time through time specified in
-     * VehicleApPowerSetState#SHUTDOWN_START.
-     */
-    TIMER = 2,
+    SHUTDOWN_CANCELLED = 0x8,
 };
 
 enum VehicleHwKeyInputAction : int32_t {
@@ -2399,13 +2407,15 @@
     NANO_SECS      = 0x50,
     SECS           = 0x53,
     YEAR           = 0x59,
-    KILOPASCAL     = 0x70,
 
     // Electrical Units
     WATT_HOUR      = 0x60,
     MILLIAMPERE    = 0x61,
     MILLIVOLT      = 0x62,
     MILLIWATTS     = 0x63,
+
+    KILOPASCAL     = 0x70,
+    DEGREES        = 0x80,
 };
 
 /**
diff --git a/biometrics/face/1.0/Android.bp b/biometrics/face/1.0/Android.bp
new file mode 100644
index 0000000..45dbad9
--- /dev/null
+++ b/biometrics/face/1.0/Android.bp
@@ -0,0 +1,27 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.biometrics.face@1.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IBiometricsFace.hal",
+        "IBiometricsFaceClientCallback.hal",
+    ],
+    interfaces: [
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "FaceAcquiredInfo",
+        "FaceError",
+        "OptionalBool",
+        "OptionalUint64",
+        "Status",
+        "UserHandle",
+    ],
+    gen_java: true,
+}
+
diff --git a/biometrics/face/1.0/IBiometricsFace.hal b/biometrics/face/1.0/IBiometricsFace.hal
new file mode 100644
index 0000000..0ac788e
--- /dev/null
+++ b/biometrics/face/1.0/IBiometricsFace.hal
@@ -0,0 +1,252 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.face@1.0;
+
+import IBiometricsFaceClientCallback;
+
+// TODO(b/78538290): Update comments with state machine transitions when ready.
+// TODO(b/78537981): Update comments with callback interaction contract.
+// TODO(b/79496983): Update comments with status returns fully enumerated.
+/**
+ * The HAL interface for biometric face authentication.
+ */
+interface IBiometricsFace {
+
+    /**
+     * Sets the current client callback.
+     *
+     * Registers a user function that must receive notifications from the HAL.
+     * There is usually only one client (FaceService). This call must block
+     * if the HAL state machine is in busy state until the HAL leaves the
+     * busy state.
+     *
+     * All callback methods pass a deviceId to differentiate callback
+     * invocations in the case where multiple sensors exist.
+     *
+     * @param clientCallback The client defined callback to register.
+     * @return result, with its "value" parameter representing a "deviceId",
+     *     which must be unique for a given sensor.
+     */
+    @callflow(next={"setActiveUser"})
+    @entry
+    setCallback(IBiometricsFaceClientCallback clientCallback)
+        generates (OptionalUint64 result);
+
+    /**
+     * Sets the active user, which all subsequent HAL operations are applied to.
+     *
+     * HAL service implementors must ensure that operations are restricted to
+     * the given user. Clients must not call any part of this interface, except
+     * for setCallback(), without first having set an active user. The
+     * implementation is responsible for cancelling the current operation and
+     * returning to the idle state. Calling this method with the same userId
+     * should have no effect on the state machine.
+     *
+     * @param userId A non-negative user identifier that must be unique and
+     *     persistent for a given user.
+     * @param storePath filesystem path to the template storage directory.
+     */
+    @callflow(next={"authenticate", "generateChallenge", "enumerate", "remove"})
+    setActiveUser(int32_t userId, string storePath) generates (Status status);
+
+    /**
+     * Begins a secure transaction request, e.g. enrollment.
+     *
+     * Generates a unique and cryptographically secure random token used to
+     * indicate the start of a secure transaction. generateChallenge() and
+     * revokeChallenge() specify a pin/pattern/password cleared time window where
+     * the secure transaction is allowed.
+     *
+     * generateChallenge() generates a challenge which must then be wrapped by the
+     * gatekeeper after verifying a successful strong authentication attempt,
+     * which generates a Hardware Authentication Token. The challenge prevents
+     * spoofing and replay attacks and ensures that we only update a user’s face
+     * template if the operation was preceded by some kind of strong credential
+     * confirmation (e.g. device password).
+     *
+     * @param challengeTimeoutSec A timeout in seconds, after which the driver
+     *     must invalidate the challenge. This is to prevent bugs or crashes in
+     *     the system from leaving a challenge enabled indefinitely.
+     * @return result, with its "value" parameter representing a "challenge": a
+     *     unique and cryptographically secure random token.
+     */
+    @callflow(next={"enroll", "revokeChallenge", "setRequireAttention"})
+    generateChallenge(uint32_t challengeTimeoutSec)
+        generates (OptionalUint64 result);
+
+    /**
+     * Enrolls a user's face.
+     *
+     * Note that this interface permits implementations where multiple faces can
+     * be enrolled for a single user. However, allowing multiple faces to be
+     * enrolled can be a severe security vulnerability and hence, most
+     * implementations must ensure that only a single face be enrolled at a
+     * given time. Multi-enrollment must only be used where there is a clear
+     * necessity for a shared use case, e.g. TVs or cars.
+     *
+     * Note that the Hardware Authentication Token must still be valid after
+     * this call, and must be explicitly invalidated by a call to
+     * revokeChallenge(). This allows clients to immediately reattempt
+     * enrollment (for example, if a user wasn’t satisfied with their enrollment)
+     * without having to go through another strong authentication flow.
+     *
+     * This method triggers the IBiometricsFaceClientCallback#onEnrollResult()
+     * method.
+     *
+     * @param hat A valid Hardware Authentication Token, generated as a result
+     *     of a generateChallenge() challenge being wrapped by the gatekeeper
+     *     after a sucessful strong authentication request.
+     * @param timeoutSec A timeout in seconds, after which this enrollment
+     *     attempt is cancelled. Note that the client still needs to
+     *     call revokeChallenge() to terminate the enrollment session.
+     * @param requireAttention When set to true, requires user attention (e.g.
+     *     eyes open and looking at the device) for enrollment to complete, as
+     *     well as subsequent authentication. This is expected to be enabled by
+     *     default to improve security and decrease falsing (unintentional face
+     *     detection). This feature can be disabled at the user's request
+     *     during enrollment, e.g. for accessibility reasons. When enabled,
+     *     the FaceAcquiredInfo#POOR_GAZE message must be sent when the user's
+     *     attention has not been established. The UI should inform the user
+     *     to look at the device.
+     * @return status The status of this method call.
+     */
+    @callflow(next={"cancel", "enroll", "revokeChallenge", "remove"})
+    enroll(vec<uint8_t> hat, uint32_t timeoutSec, bool requireAttention)
+        generates (Status status);
+
+    /**
+     * Finishes the secure transaction by invalidating the challenge generated
+     * by generateChallenge().
+     *
+     * Clients must call this method once enrollment is complete, and the user's
+     * face template no longer needs to be updated.
+     *
+     * @return status The status of this method call.
+     */
+    @callflow(next={"authenticate", "setActiveUser", "enumerate", "remove"})
+    revokeChallenge() generates (Status status);
+
+    /**
+     * Requires that all subsequent authenticate calls to first have the
+     * user's attention. This method does not affect enroll, which has its
+     * own requireAttention parameter.
+     *
+     * Changes the state of previous enrollment setting. Because this may
+     * decrease security, the user must enter their password before this method
+     * is invoked (see @param HAT). The driver must verify the HAT before
+     * changing the requireAttention state.
+     * Note: In some cases it may not be possible to change the state of this
+     * flag without re-enrolling. For example, if the user didn't provide
+     * attention during the original enrollment. This flag reflects the same
+     * persistent state as the one passed to enroll().
+     *
+     * @param requireAttention When set to true, requires user attention for
+     *     authentication to succeed.
+     * @param hat A valid Hardware Authentication Token, generated as a result
+     *     of getChallenge().
+     * @return status The status of this method call.
+     */
+    setRequireAttention(bool requireAttention, vec<uint8_t> hat)
+        generates(Status status);
+
+    /**
+     * Retrieves the current requireAttention state.
+     *
+     * @return result, with its value parameter representing the current
+     *     requireAttention state.
+     */
+    getRequireAttention(vec<uint8_t> hat) generates (OptionalBool result);
+
+    /**
+     * Returns an identifier associated with the current face set.
+     *
+     * The authenticator ID must change whenever a new face is enrolled. The
+     * authenticator ID must not be changed when a face is deleted. The
+     * authenticator ID must be an entropy-encoded random number which all
+     * current templates are tied to. The authenticator ID must be immutable
+     * outside of an active enrollment window to prevent replay attacks.
+     *
+     * @return result, with its value parameter representing an
+     *     "authenticatorId": an identifier associated to the user's current
+     *     face enrollment.
+     */
+    @callflow(next={"authenticate"})
+    getAuthenticatorId() generates (OptionalUint64 result);
+
+    /**
+     * Cancels a pending enrollment or authentication request.
+     *
+     * @return status The status of this method call.
+     */
+    @callflow(next={"authenticate", "enroll", "enumerate", "remove",
+        "setActiveUser"})
+    cancel() generates (Status status);
+
+    /**
+     * Enumerates all face templates associated with the active user.
+     *
+     * The onEnumerate() callback method is invoked once for each face template
+     * found.
+     *
+     * @return status The status of this method call.
+     */
+    @callflow(next={"remove", "enroll", "authenticate", "setActiveUser"})
+    enumerate() generates (Status status);
+
+    /**
+     * Removes a face template or all face templates associated with the active
+     * user.
+     *
+     * This method triggers the IBiometricsFaceClientCallback#onRemoved() method.
+     *
+     * @param faceId The id correpsonding to the face to be removed; or 0 if all
+     *    faces are to be removed.
+     * @return status The status of this method call.
+     */
+    @callflow(next={"enumerate", "authenticate", "cancel", "getAuthenticatorId",
+        "setActiveUser"})
+    remove(uint32_t faceId) generates (Status status);
+
+    /**
+     * Authenticates the active user.
+     *
+     * An optional operationId can be specified as a token from the transaction
+     * being authorized. The hardware may enter a standby state during
+     * authentication, where the device is idle to conserve power while
+     * authenticating, e.g. after 3 seconds without finding a face. See
+     * IBiometricsFace#userActivity() for more info.
+     *
+     * @param operationId A non-zero operation id associated with a crypto
+     * object instance; or 0 if not being used.
+     * @return status The status of this method call.
+     */
+    @callflow(next={"cancel", "generateChallenge", "remove"})
+    authenticate(uint64_t operationId) generates (Status status);
+
+    /**
+     * A hint to the HAL to continue looking for faces.
+     *
+     * This method should only be used when the HAL is in the authenticating
+     * or standby state. Using this method when the HAL is not in one of the
+     * mentioned states must return OPERATION_NOT_SUPPORTED. Calling this
+     * method while the HAL is already authenticating may extend the duration
+     * where it's looking for a face.
+     *
+     * @return status The status of this method call.
+     */
+    userActivity() generates (Status status);
+};
diff --git a/biometrics/face/1.0/IBiometricsFaceClientCallback.hal b/biometrics/face/1.0/IBiometricsFaceClientCallback.hal
new file mode 100644
index 0000000..93848c5
--- /dev/null
+++ b/biometrics/face/1.0/IBiometricsFaceClientCallback.hal
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.face@1.0;
+
+/**
+ * This callback interface is used by clients to recieve updates from the face
+ * HAL.
+ */
+interface IBiometricsFaceClientCallback {
+
+    /**
+     * A callback invoked when one enrollment step has been completed.
+     *
+     * @param deviceId A unique id associated with the HAL implementation
+     *     service that processed this enrollment step.
+     * @param faceId The id of the face template being enrolled.
+     * @param userId The active user id for the template being enrolled.
+     * @param remaining The number of remaining steps before enrolllment is
+     *     complete or 0 if enrollment has completed successfully.
+     */
+    oneway onEnrollResult(uint64_t deviceId, uint32_t faceId, int32_t userId,
+        uint32_t remaining);
+
+    /**
+     * A callback invoked when a face has been successfully authenticated.
+     *
+     * @param deviceId A unique id associated with the HAL implementation
+     *     service that processed this autentication attempt.
+     * @param faceId The id of the face template that passed the authentication
+     *     challenge.
+     * @param userId The active user id for the authenticated face.
+     * @param token The hardware authentication token associated with this
+     *     authenticate operation.
+     */
+    oneway onAuthenticated(uint64_t deviceId, uint32_t faceId, int32_t userId,
+        vec<uint8_t> token);
+
+    /**
+     * A callback invoked when a face is acquired.
+     *
+     * If a non-critical, recoverable error occurs during an enrollment or
+     * authentication attempt, the HAL implementation must invoke this callback
+     * to allow clients to inform the user that some actionable change must be
+     * made.
+     *
+     * @param deviceId A unique id associated with the HAL implementation
+     *     service that acquired a face.
+     * @param userId The id of the active user associated with the attempted
+     *     face acquisition.
+     * @param acquiredInfo A message about the quality of the acquired image.
+     * @param vendorCode An optional vendor-specific message. This is only valid
+     *     when acquiredInfo == FaceAcquiredInfo.VENDOR. This message is opaque
+     *     to the framework, and vendors must provide code to handle it. For
+     *     example this can be used to guide enrollment in Settings or provide
+     *     a message during authentication that is vendor-specific. The vendor
+     *     is expected to provide help strings to cover all known values.
+     */
+     oneway onAcquired(uint64_t deviceId, int32_t userId,
+         FaceAcquiredInfo acquiredInfo, int32_t vendorCode);
+
+    /**
+     * A callback invoked when an error has occured.
+     *
+     * @param deviceId A unique id associated with the HAL implementation
+     *     service where this error occured.
+     * @param userId The id of the active user when the error occured, or
+     *     UserHandle::NONE if an active user had not been set yet.
+     * @param error A message about the error that occurred.
+     * @param vendorCode An optional, vendor-speicifc error message. Only valid
+     *     when error == FaceError.VENDOR. This message is opaque to the
+     *     framework, and vendors must provide code to handle it. For example,
+     *     this scan be used to show the user an error message specific to the
+     *     device. The vendor is expected to provide error strings to cover
+     *     all known values.
+     */
+    oneway onError(uint64_t deviceId, int32_t userId, FaceError error,
+        int32_t vendorCode);
+
+    /**
+     * A callback invoked when a face template has been removed.
+     *
+     * @param deviceId A unique id associated with the HAL implementation
+     *     service that processed this removal.
+     * @param faceId The id of the face template that was removed.
+     * @param userId The active user id for the removed face template.
+     * @param remaining The number of face templates remaining after this
+     *     removal, or 0 if there are no more.
+     */
+    oneway onRemoved(uint64_t deviceId, uint32_t faceId, int32_t userId,
+        uint32_t remaining);
+
+    /**
+     * A callback invoked to enumerate all current face templates.
+     *
+     * @param deviceId A unique id associated with the HAL implementation
+     *     service that processed this enumeration.
+     * @param faceIds A list of ids of all currently enrolled face templates.
+     * @param userId The active user id for the enumerated face template.
+     */
+    oneway onEnumerate(uint64_t deviceId, vec<uint32_t> faceIds,
+        int32_t userId);
+};
diff --git a/biometrics/face/1.0/types.hal b/biometrics/face/1.0/types.hal
new file mode 100644
index 0000000..f6827d5
--- /dev/null
+++ b/biometrics/face/1.0/types.hal
@@ -0,0 +1,296 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.face@1.0;
+
+/*
+ * In the event setActiveUser is not called, all error messages will return
+ * this userId.
+ */
+enum UserHandle : int32_t {
+    NONE = -1
+};
+
+/**
+ * Status codes returned directly by the HIDL method calls upon critical errors
+ * where the callback cannot be invoked. Most errors should sent through the
+ * onError callback using one of the FaceErrors below.
+ */
+enum Status : uint32_t {
+    /**
+     * The method was invoked successfully.
+     */
+    OK = 0,
+
+    /**
+     * One of the arguments to the method call is invalid.
+     */
+    ILLEGAL_ARGUMENT = 1,
+
+    /**
+     * This face HAL does not support this operation.
+     */
+    OPERATION_NOT_SUPPORTED = 2,
+
+    /**
+     * The HAL has encountered an internal error and cannot complete the request.
+     */
+    INTERNAL_ERROR = 3,
+
+    /**
+     * The operation could not be completed because there are no enrolled
+     * templates.
+     */
+    NOT_ENROLLED = 4
+};
+
+/**
+ * Face errors represent events that can't be immediately recovered by user
+ * intervention. These are returned in the onError callback.
+ *
+ * Upon receiving a face error, clients must terminate the current operation and
+ * notify the user where possible.
+ */
+enum FaceError : int32_t {
+
+    /**
+     * A hardware error has occured that cannot be resolved. Try again later.
+     */
+    HW_UNAVAILABLE = 1,
+
+    /**
+     * The current enroll or authenticate operation could not be completed;
+     * the sensor was unable to process the current image.
+     */
+    UNABLE_TO_PROCESS = 2,
+
+    /**
+     * The current operation took too long to complete. This is intended to
+     * prevent programs from blocking the face HAL indefinitely. The timeout is
+     * framework and sensor-specific, but is generally on the order of 30
+     * seconds.
+     */
+    TIMEOUT = 3,
+
+    /**
+     * The current operation could not be completed because there is not enough
+     * storage space remaining to do so.
+     */
+    NO_SPACE = 4,
+
+    /**
+     * The current operation has been cancelled. This may happen if a new
+     * request (authenticate, remove) is initiated while an on-going operation
+     * is in progress, or if cancel() was called.
+     */
+    CANCELED = 5,
+
+    /**
+     * The current remove operation could not be completed; the face template
+     * provided could not be removed.
+     */
+    UNABLE_TO_REMOVE = 6,
+
+    /**
+     * Face authentication is locked out due to too many unsuccessful attempts.
+     */
+    LOCKOUT = 7,
+
+    /**
+     * Used to enable a vendor-specific error message.
+     */
+    VENDOR = 8,
+};
+
+/**
+ * Face acquisition information provides feedback for the current enrollment
+ * or authentication operation.
+ *
+ * This information indicates that the user can take immediate action to resolve
+ * an issue, and clients must ensure that this information is surfaced to the
+ * user.
+ */
+enum FaceAcquiredInfo : int32_t {
+
+    /**
+     * The face acquired was good; no further user interaction is necessary.
+     */
+    GOOD = 0,
+
+    /**
+     * The face data acquired was too noisy or did not have sufficient detail.
+     * This is a catch-all for all acquisition errors not captured by the other
+     * constants.
+     */
+    INSUFFICIENT = 1,
+
+    /**
+     * Because there was too much ambient light, the captured face data was too
+     * bright. It's reasonable to return this after multiple
+     * FaceAcquiredInfo.INSUFFICIENT.
+     *
+     * The user is expected to take action to retry the operation in better
+     * lighting conditions when this is returned.
+     */
+    TOO_BRIGHT = 2,
+
+    /**
+     * Because there was not enough illumination, the captured face data was too
+     * dark. It's reasonable to return this after multiple
+     * FaceAcquiredInfo.INSUFFICIENT.
+     *
+     * The user is expected to take action to retry the operation in better
+     * lighting conditions when this is returned.
+     */
+    TOO_DARK = 3,
+
+    /**
+     * The detected face is too close to the sensor, and the image cannot be
+     * processed.
+     *
+     * The user is expected to be informed to move further from the sensor when
+     * this is returned.
+     */
+    TOO_CLOSE = 4,
+
+    /**
+     * The detected face is too small, as the user might be too far away from
+     * the sensor.
+     *
+     * The user is expected to be informed to move closer to the sensor when
+     * this is returned.
+     */
+    TOO_FAR = 5,
+
+    /**
+     * Only the upper part of the face was detected. The sensor's field of view
+     * is too high.
+     *
+     * The user should be informed to move up with respect to the sensor when
+     * this is returned.
+     */
+    FACE_TOO_HIGH = 6,
+
+    /**
+     * Only the lower part of the face was detected. The sensor's field of view
+     * is too low.
+     *
+     * The user should be informed to move down with respect to the sensor when
+     * this is returned.
+     */
+    FACE_TOO_LOW = 7,
+
+    /**
+     * Only the right part of the face was detected. The sensor's field of view
+     * is too far right.
+     *
+     * The user should be informed to move to the right with respect to the
+     * sensor when this is returned.
+     */
+    FACE_TOO_RIGHT = 8,
+
+    /**
+     * Only the left part of the face was detected. The sensor's field of view
+     * is too far left.
+     *
+     * The user should be informed to move to the left with respect to the
+     * sensor when this is returned.
+     */
+    FACE_TOO_LEFT = 9,
+
+    /**
+     * The user's eyes have strayed away from the sensor. If this message is
+     * sent, the user should be informed to look at the device. If the user
+     * can't be found in the frame, one of the other acquisition messages
+     * must be sent, e.g. NOT_DETECTED.
+     */
+    POOR_GAZE = 10,
+
+    /**
+     * No face was detected within the sensor's field of view.
+     *
+     * The user should be informed to point the sensor to a face when this is
+     * returned.
+     */
+    NOT_DETECTED = 11,
+
+    /**
+     * Too much motion was detected.
+     *
+     * The user should be informed to keep their face steady relative to the
+     * sensor.
+     */
+    TOO_MUCH_MOTION = 12,
+
+    /**
+     * The sensor needs to be re-calibrated. This is an unexpected condition,
+     * and must only be sent if a serious, uncorrectable, and unrecoverable
+     * calibration issue is detected which requires user intervention, e.g.
+     * re-enrolling. The expected response to this message is to direct the
+     * user to re-enroll.
+     */
+    RECALIBRATE = 13,
+
+    /**
+     * The face is too different from a previous acquisition. This condition
+     * only applies to enrollment. This can happen if the user passes the
+     * device to someone else in the middle of enrollment.
+     */
+    TOO_DIFFERENT = 14,
+
+    /**
+     * The face is too similar to a previous acquisition. This condition only
+     * applies to enrollment. The user should change their pose.
+     */
+    TOO_SIMILAR = 15,
+
+    /**
+     * Used to enable a vendor-specific acquisition message.
+     */
+    VENDOR = 16
+};
+
+/**
+ * Result structure with an additional uint64_t field. See documentation in
+ * setCallback(), preEnroll(), and getAuthenticatorId() for usage of the value.
+ */
+struct OptionalUint64 {
+    /**
+     * The return status.
+     */
+    Status status;
+
+    /**
+     * This value is only meaningful if status is OK.
+     */
+    uint64_t value;
+};
+
+/**
+ * Result structure with an addition bool field. See documentation in
+ * getRequireAttention() for usage of the value.
+ */
+struct OptionalBool {
+    /**
+     * The return status.
+     */
+    Status status;
+
+    /**
+     * This value is only meaningful if status is OK.
+     */
+    bool value;
+};
\ No newline at end of file
diff --git a/broadcastradio/2.0/default/Android.bp b/broadcastradio/2.0/default/Android.bp
index 900454e..840c4b8 100644
--- a/broadcastradio/2.0/default/Android.bp
+++ b/broadcastradio/2.0/default/Android.bp
@@ -43,7 +43,6 @@
         "libbase",
         "libhidlbase",
         "libhidltransport",
-        "liblog",
         "libutils",
     ],
 }
diff --git a/broadcastradio/2.0/default/BroadcastRadio.cpp b/broadcastradio/2.0/default/BroadcastRadio.cpp
index 0148fec..28a0dd5 100644
--- a/broadcastradio/2.0/default/BroadcastRadio.cpp
+++ b/broadcastradio/2.0/default/BroadcastRadio.cpp
@@ -13,15 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#define LOG_TAG "BcRadioDef.module"
-#define LOG_NDEBUG 0
-
 #include "BroadcastRadio.h"
 
-#include <log/log.h>
-
 #include "resources.h"
 
+#include <android-base/logging.h>
+
 namespace android {
 namespace hardware {
 namespace broadcastradio {
@@ -66,7 +63,6 @@
       mAmFmConfig(gDefaultAmFmConfig) {}
 
 Return<void> BroadcastRadio::getProperties(getProperties_cb _hidl_cb) {
-    ALOGV("%s", __func__);
     _hidl_cb(mProperties);
     return {};
 }
@@ -77,8 +73,6 @@
 }
 
 Return<void> BroadcastRadio::getAmFmRegionConfig(bool full, getAmFmRegionConfig_cb _hidl_cb) {
-    ALOGV("%s(%d)", __func__, full);
-
     if (full) {
         AmFmRegionConfig config = {};
         config.ranges = hidl_vec<AmFmBandRange>({
@@ -96,8 +90,6 @@
 }
 
 Return<void> BroadcastRadio::getDabRegionConfig(getDabRegionConfig_cb _hidl_cb) {
-    ALOGV("%s", __func__);
-
     hidl_vec<DabTableEntry> config = {
         {"5A", 174928},  {"7D", 194064},  {"8A", 195936},  {"8B", 197648},  {"9A", 202928},
         {"9B", 204640},  {"9C", 206352},  {"10B", 211648}, {"10C", 213360}, {"10D", 215072},
@@ -111,7 +103,7 @@
 
 Return<void> BroadcastRadio::openSession(const sp<ITunerCallback>& callback,
                                          openSession_cb _hidl_cb) {
-    ALOGV("%s", __func__);
+    LOG(DEBUG) << "opening new session...";
 
     /* For the needs of default implementation it's fine to instantiate new session object
      * out of the lock scope. If your implementation needs it, use reentrant lock.
@@ -122,7 +114,7 @@
 
     auto oldSession = mSession.promote();
     if (oldSession != nullptr) {
-        ALOGI("Closing previously opened tuner");
+        LOG(INFO) << "closing previously opened tuner";
         oldSession->close();
         mSession = nullptr;
     }
@@ -134,14 +126,14 @@
 }
 
 Return<void> BroadcastRadio::getImage(uint32_t id, getImage_cb _hidl_cb) {
-    ALOGV("%s(%x)", __func__, id);
+    LOG(DEBUG) << "fetching image " << std::hex << id;
 
     if (id == resources::demoPngId) {
         _hidl_cb(std::vector<uint8_t>(resources::demoPng, std::end(resources::demoPng)));
         return {};
     }
 
-    ALOGI("Image %x doesn't exists", id);
+    LOG(INFO) << "image " << std::hex << id << " doesn't exists";
     _hidl_cb({});
     return {};
 }
@@ -149,7 +141,7 @@
 Return<void> BroadcastRadio::registerAnnouncementListener(
     const hidl_vec<AnnouncementType>& enabled, const sp<IAnnouncementListener>& /* listener */,
     registerAnnouncementListener_cb _hidl_cb) {
-    ALOGV("%s(%s)", __func__, toString(enabled).c_str());
+    LOG(DEBUG) << "registering announcement listener for " << toString(enabled);
 
     _hidl_cb(Result::NOT_SUPPORTED, nullptr);
     return {};
diff --git a/broadcastradio/2.0/default/TunerSession.cpp b/broadcastradio/2.0/default/TunerSession.cpp
index da97562..2ba4d02 100644
--- a/broadcastradio/2.0/default/TunerSession.cpp
+++ b/broadcastradio/2.0/default/TunerSession.cpp
@@ -14,15 +14,12 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BcRadioDef.tuner"
-#define LOG_NDEBUG 0
-
 #include "TunerSession.h"
 
 #include "BroadcastRadio.h"
 
+#include <android-base/logging.h>
 #include <broadcastradio-utils-2x/Utils.h>
-#include <log/log.h>
 
 namespace android {
 namespace hardware {
@@ -68,7 +65,7 @@
 }
 
 void TunerSession::tuneInternalLocked(const ProgramSelector& sel) {
-    ALOGV("%s(%s)", __func__, toString(sel).c_str());
+    LOG(VERBOSE) << "tune (internal) to " << toString(sel);
 
     VirtualProgram virtualProgram;
     ProgramInfo programInfo;
@@ -93,17 +90,18 @@
 }
 
 Return<Result> TunerSession::tune(const ProgramSelector& sel) {
-    ALOGV("%s(%s)", __func__, toString(sel).c_str());
+    LOG(DEBUG) << "tune to " << toString(sel);
+
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return Result::INVALID_STATE;
 
     if (!utils::isSupported(module().mProperties, sel)) {
-        ALOGW("Selector not supported");
+        LOG(WARNING) << "selector not supported: " << toString(sel);
         return Result::NOT_SUPPORTED;
     }
 
     if (!utils::isValid(sel)) {
-        ALOGE("ProgramSelector is not valid");
+        LOG(ERROR) << "selector is not valid: " << toString(sel);
         return Result::INVALID_ARGUMENTS;
     }
 
@@ -119,8 +117,9 @@
     return Result::OK;
 }
 
-Return<Result> TunerSession::scan(bool directionUp, bool /* skipSubChannel */) {
-    ALOGV("%s", __func__);
+Return<Result> TunerSession::scan(bool directionUp, bool skipSubChannel) {
+    LOG(DEBUG) << "seek up=" << directionUp << " skipSubChannel=" << skipSubChannel;
+
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return Result::INVALID_STATE;
 
@@ -130,8 +129,8 @@
 
     if (list.empty()) {
         mIsTuneCompleted = false;
-        auto task = [this, directionUp]() {
-            ALOGI("Performing failed seek up=%d", directionUp);
+        auto task = [this]() {
+            LOG(DEBUG) << "program list is empty, seek couldn't stop";
 
             mCallback->onTuneFailed(Result::TIMEOUT, {});
         };
@@ -162,7 +161,7 @@
 
     mIsTuneCompleted = false;
     auto task = [this, tuneTo, directionUp]() {
-        ALOGI("Performing seek up=%d", directionUp);
+        LOG(VERBOSE) << "executing seek up=" << directionUp;
 
         lock_guard<mutex> lk(mMut);
         tuneInternalLocked(tuneTo);
@@ -173,21 +172,21 @@
 }
 
 Return<Result> TunerSession::step(bool directionUp) {
-    ALOGV("%s", __func__);
+    LOG(DEBUG) << "step up=" << directionUp;
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return Result::INVALID_STATE;
 
     cancelLocked();
 
     if (!utils::hasId(mCurrentProgram, IdentifierType::AMFM_FREQUENCY)) {
-        ALOGE("Can't step in anything else than AM/FM");
+        LOG(WARNING) << "can't step in anything else than AM/FM";
         return Result::NOT_SUPPORTED;
     }
 
     auto stepTo = utils::getId(mCurrentProgram, IdentifierType::AMFM_FREQUENCY);
     auto range = getAmFmRangeLocked();
     if (!range) {
-        ALOGE("Can't find current band");
+        LOG(ERROR) << "can't find current band";
         return Result::INTERNAL_ERROR;
     }
 
@@ -201,7 +200,7 @@
 
     mIsTuneCompleted = false;
     auto task = [this, stepTo]() {
-        ALOGI("Performing step to %s", std::to_string(stepTo).c_str());
+        LOG(VERBOSE) << "executing step to " << stepTo;
 
         lock_guard<mutex> lk(mMut);
 
@@ -213,7 +212,7 @@
 }
 
 void TunerSession::cancelLocked() {
-    ALOGV("%s", __func__);
+    LOG(VERBOSE) << "cancelling current operations...";
 
     mThread.cancelAll();
     if (utils::getType(mCurrentProgram.primaryId) != IdentifierType::INVALID) {
@@ -222,7 +221,6 @@
 }
 
 Return<void> TunerSession::cancel() {
-    ALOGV("%s", __func__);
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return {};
 
@@ -232,7 +230,7 @@
 }
 
 Return<Result> TunerSession::startProgramListUpdates(const ProgramFilter& filter) {
-    ALOGV("%s(%s)", __func__, toString(filter).c_str());
+    LOG(DEBUG) << "requested program list updates, filter=" << toString(filter);
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return Result::INVALID_STATE;
 
@@ -259,41 +257,37 @@
 }
 
 Return<void> TunerSession::stopProgramListUpdates() {
-    ALOGV("%s", __func__);
+    LOG(DEBUG) << "requested program list updates to stop";
     return {};
 }
 
 Return<void> TunerSession::isConfigFlagSet(ConfigFlag flag, isConfigFlagSet_cb _hidl_cb) {
-    ALOGV("%s(%s)", __func__, toString(flag).c_str());
+    LOG(VERBOSE) << __func__ << " " << toString(flag);
 
     _hidl_cb(Result::NOT_SUPPORTED, false);
     return {};
 }
 
 Return<Result> TunerSession::setConfigFlag(ConfigFlag flag, bool value) {
-    ALOGV("%s(%s, %d)", __func__, toString(flag).c_str(), value);
+    LOG(VERBOSE) << __func__ << " " << toString(flag) << " " << value;
 
     return Result::NOT_SUPPORTED;
 }
 
 Return<void> TunerSession::setParameters(const hidl_vec<VendorKeyValue>& /* parameters */,
                                          setParameters_cb _hidl_cb) {
-    ALOGV("%s", __func__);
-
     _hidl_cb({});
     return {};
 }
 
 Return<void> TunerSession::getParameters(const hidl_vec<hidl_string>& /* keys */,
                                          getParameters_cb _hidl_cb) {
-    ALOGV("%s", __func__);
-
     _hidl_cb({});
     return {};
 }
 
 Return<void> TunerSession::close() {
-    ALOGV("%s", __func__);
+    LOG(DEBUG) << "closing session...";
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return {};
 
@@ -304,7 +298,7 @@
 
 std::optional<AmFmBandRange> TunerSession::getAmFmRangeLocked() const {
     if (!mIsTuneCompleted) {
-        ALOGW("tune operation in process");
+        LOG(WARNING) << "tune operation is in process";
         return {};
     }
     if (!utils::hasId(mCurrentProgram, IdentifierType::AMFM_FREQUENCY)) return {};
diff --git a/broadcastradio/2.0/default/VirtualProgram.cpp b/broadcastradio/2.0/default/VirtualProgram.cpp
index acde704..a971927 100644
--- a/broadcastradio/2.0/default/VirtualProgram.cpp
+++ b/broadcastradio/2.0/default/VirtualProgram.cpp
@@ -13,15 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#define LOG_TAG "BcRadioDef.VirtualProgram"
-
 #include "VirtualProgram.h"
 
 #include "resources.h"
 
 #include <android-base/logging.h>
 #include <broadcastradio-utils-2x/Utils.h>
-#include <log/log.h>
 
 namespace android {
 namespace hardware {
@@ -72,7 +69,7 @@
             info.physicallyTunedTo = selectId(IdentifierType::SXM_CHANNEL);
             break;
         default:
-            LOG(FATAL) << "Unsupported program type: " << toString(pType);
+            LOG(FATAL) << "unsupported program type: " << toString(pType);
     }
 
     info.infoFlags |= ProgramInfoFlags::TUNED;
diff --git a/broadcastradio/2.0/default/VirtualRadio.cpp b/broadcastradio/2.0/default/VirtualRadio.cpp
index f601d41..0b65979 100644
--- a/broadcastradio/2.0/default/VirtualRadio.cpp
+++ b/broadcastradio/2.0/default/VirtualRadio.cpp
@@ -13,13 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#define LOG_TAG "BcRadioDef.VirtualRadio"
-//#define LOG_NDEBUG 0
-
 #include "VirtualRadio.h"
 
 #include <broadcastradio-utils-2x/Utils.h>
-#include <log/log.h>
 
 namespace android {
 namespace hardware {
diff --git a/broadcastradio/2.0/default/service.cpp b/broadcastradio/2.0/default/service.cpp
index 7e677a1..af96dad 100644
--- a/broadcastradio/2.0/default/service.cpp
+++ b/broadcastradio/2.0/default/service.cpp
@@ -13,8 +13,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#define LOG_TAG "BcRadioDef.service"
-
 #include <android-base/logging.h>
 #include <hidl/HidlTransportSupport.h>
 
@@ -26,7 +24,9 @@
 using android::hardware::broadcastradio::V2_0::implementation::BroadcastRadio;
 using android::hardware::broadcastradio::V2_0::implementation::gAmFmRadio;
 
-int main(int /* argc */, char** /* argv */) {
+int main() {
+    android::base::SetDefaultTag("BcRadioDef");
+    android::base::SetMinimumLogSeverity(android::base::VERBOSE);
     configureRpcThreadpool(4, true);
 
     BroadcastRadio broadcastRadio(gAmFmRadio);
diff --git a/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp b/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp
index 3d7039d..c523013 100644
--- a/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp
+++ b/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BcRadio.vts"
-#define LOG_NDEBUG 0
 #define EGMOCK_VERBOSE 1
 
 #include <VtsHalHidlTargetTestBase.h>
@@ -446,7 +444,7 @@
     EXPECT_EQ(Result::OK, result);
     EXPECT_TIMEOUT_CALL_WAIT(*mCallback, onCurrentProgramInfoChanged_, timeout::tune);
 
-    ALOGD("current program info: %s", toString(infoCb).c_str());
+    LOG(DEBUG) << "current program info: " << toString(infoCb);
 
     // it should tune exactly to what was requested
     auto freqs = utils::getAllIds(infoCb.selector, IdentifierType::AMFM_FREQUENCY);
@@ -823,11 +821,11 @@
     using android::hardware::broadcastradio::V2_0::vts::gEnv;
     using android::hardware::broadcastradio::V2_0::IBroadcastRadio;
     using android::hardware::broadcastradio::vts::BroadcastRadioHidlEnvironment;
+    android::base::SetDefaultTag("BcRadio.vts");
+    android::base::SetMinimumLogSeverity(android::base::VERBOSE);
     gEnv = new BroadcastRadioHidlEnvironment<IBroadcastRadio>;
     ::testing::AddGlobalTestEnvironment(gEnv);
     ::testing::InitGoogleTest(&argc, argv);
     gEnv->init(&argc, argv);
-    int status = RUN_ALL_TESTS();
-    ALOGI("Test result = %d", status);
-    return status;
+    return RUN_ALL_TESTS();
 }
diff --git a/broadcastradio/common/utils/Android.bp b/broadcastradio/common/utils/Android.bp
index 33ba7da..32e06d7 100644
--- a/broadcastradio/common/utils/Android.bp
+++ b/broadcastradio/common/utils/Android.bp
@@ -29,7 +29,6 @@
     export_include_dirs: ["include"],
     shared_libs: [
         "libbase",
-        "liblog",
         "libutils",
     ],
 }
diff --git a/broadcastradio/common/utils/WorkerThread.cpp b/broadcastradio/common/utils/WorkerThread.cpp
index bfcbb39..31f4d3f 100644
--- a/broadcastradio/common/utils/WorkerThread.cpp
+++ b/broadcastradio/common/utils/WorkerThread.cpp
@@ -14,13 +14,8 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "WorkerThread"
-//#define LOG_NDEBUG 0
-
 #include <broadcastradio-utils/WorkerThread.h>
 
-#include <log/log.h>
-
 namespace android {
 
 using std::chrono::milliseconds;
@@ -39,7 +34,6 @@
 WorkerThread::WorkerThread() : mIsTerminating(false), mThread(&WorkerThread::threadLoop, this) {}
 
 WorkerThread::~WorkerThread() {
-    ALOGV("%s", __func__);
     {
         lock_guard<mutex> lk(mMut);
         mIsTerminating = true;
@@ -49,8 +43,6 @@
 }
 
 void WorkerThread::schedule(function<void()> task, milliseconds delay) {
-    ALOGV("%s", __func__);
-
     auto when = steady_clock::now() + delay;
 
     lock_guard<mutex> lk(mMut);
@@ -59,14 +51,11 @@
 }
 
 void WorkerThread::cancelAll() {
-    ALOGV("%s", __func__);
-
     lock_guard<mutex> lk(mMut);
     priority_queue<Task>().swap(mTasks);  // empty queue
 }
 
 void WorkerThread::threadLoop() {
-    ALOGV("%s", __func__);
     while (!mIsTerminating) {
         unique_lock<mutex> lk(mMut);
         if (mTasks.empty()) {
diff --git a/broadcastradio/common/utils2x/Utils.cpp b/broadcastradio/common/utils2x/Utils.cpp
index f292c08..7892653 100644
--- a/broadcastradio/common/utils2x/Utils.cpp
+++ b/broadcastradio/common/utils2x/Utils.cpp
@@ -14,12 +14,10 @@
  * limitations under the License.
  */
 #define LOG_TAG "BcRadioDef.utils"
-//#define LOG_NDEBUG 0
 
 #include <broadcastradio-utils-2x/Utils.h>
 
 #include <android-base/logging.h>
-#include <log/log.h>
 
 namespace android {
 namespace hardware {
@@ -130,7 +128,7 @@
         case IdentifierType::SXM_SERVICE_ID:
             return haveEqualIds(a, b, IdentifierType::SXM_SERVICE_ID);
         default:  // includes all vendor types
-            ALOGW("Unsupported program type: %s", toString(type).c_str());
+            LOG(WARNING) << "unsupported program type: " << toString(type);
             return false;
     }
 }
@@ -166,7 +164,7 @@
         return val;
     }
 
-    ALOGW("Identifier %s not found", toString(type).c_str());
+    LOG(WARNING) << "identifier not found: " << toString(type);
     return 0;
 }
 
@@ -205,7 +203,7 @@
     auto expect = [&valid](bool condition, std::string message) {
         if (!condition) {
             valid = false;
-            ALOGE("Identifier not valid, expected %s", message.c_str());
+            LOG(ERROR) << "identifier not valid, expected " << message;
         }
     };
 
diff --git a/broadcastradio/common/vts/utils/include/broadcastradio-vts-utils/mock-timeout.h b/broadcastradio/common/vts/utils/include/broadcastradio-vts-utils/mock-timeout.h
index 1f716f1..f6cd6ae 100644
--- a/broadcastradio/common/vts/utils/include/broadcastradio-vts-utils/mock-timeout.h
+++ b/broadcastradio/common/vts/utils/include/broadcastradio-vts-utils/mock-timeout.h
@@ -29,7 +29,7 @@
  * INTERNAL IMPLEMENTATION - don't use in user code.
  */
 #if EGMOCK_VERBOSE
-#define EGMOCK_LOG_(...) ALOGV("egmock: " __VA_ARGS__)
+#define EGMOCK_LOG_(...) LOG(VERBOSE) << "egmock: " << __VA_ARGS__
 #else
 #define EGMOCK_LOG_(...)
 #endif
diff --git a/camera/common/1.0/default/CameraModule.cpp b/camera/common/1.0/default/CameraModule.cpp
index dc4e0f0..9c2b02b 100644
--- a/camera/common/1.0/default/CameraModule.cpp
+++ b/camera/common/1.0/default/CameraModule.cpp
@@ -235,7 +235,7 @@
     chars.update(keyTag, availableKeys);
 }
 
-CameraModule::CameraModule(camera_module_t *module) {
+CameraModule::CameraModule(camera_module_t *module) : mNumberOfCameras(0) {
     if (module == NULL) {
         ALOGE("%s: camera hardware module must not be null", __FUNCTION__);
         assert(0);
@@ -264,7 +264,8 @@
         res = mModule->init();
         ATRACE_END();
     }
-    mCameraInfoMap.setCapacity(getNumberOfCameras());
+    mNumberOfCameras = getNumberOfCameras();
+    mCameraInfoMap.setCapacity(mNumberOfCameras);
     return res;
 }
 
@@ -319,6 +320,45 @@
     return OK;
 }
 
+int CameraModule::getPhysicalCameraInfo(int physicalCameraId, camera_metadata_t **physicalInfo) {
+    ATRACE_CALL();
+    Mutex::Autolock lock(mCameraInfoLock);
+    if (physicalCameraId < mNumberOfCameras) {
+        ALOGE("%s: Invalid physical camera ID %d", __FUNCTION__, physicalCameraId);
+        return -EINVAL;
+    }
+
+    // Only query physical camera info for 2.5 version for newer
+    int apiVersion = mModule->common.module_api_version;
+    if (apiVersion < CAMERA_MODULE_API_VERSION_2_5) {
+        ALOGE("%s: Module version must be at least 2.5 to handle getPhysicalCameraInfo",
+                __FUNCTION__);
+        return -ENODEV;
+    }
+    if (mModule->get_physical_camera_info == nullptr) {
+        ALOGE("%s: get_physical_camera is NULL for module version 2.5", __FUNCTION__);
+        return -EINVAL;
+    }
+
+    ssize_t index = mPhysicalCameraInfoMap.indexOfKey(physicalCameraId);
+    if (index == NAME_NOT_FOUND) {
+        // Get physical camera characteristics, and cache it
+        camera_metadata_t *info = nullptr;
+        ATRACE_BEGIN("camera_module->get_physical_camera_info");
+        int ret = mModule->get_physical_camera_info(physicalCameraId, &info);
+        ATRACE_END();
+        if (ret != 0) {
+            return ret;
+        }
+
+        index = mPhysicalCameraInfoMap.add(physicalCameraId, info);
+    }
+
+    assert(index != NAME_NOT_FOUND);
+    *physicalInfo = mPhysicalCameraInfoMap[index];
+    return OK;
+}
+
 int CameraModule::getDeviceVersion(int cameraId) {
     ssize_t index = mDeviceVersionMap.indexOfKey(cameraId);
     if (index == NAME_NOT_FOUND) {
@@ -426,8 +466,8 @@
 }
 
 void CameraModule::removeCamera(int cameraId) {
-    free_camera_metadata(
-        const_cast<camera_metadata_t*>(mCameraInfoMap[cameraId].static_camera_characteristics));
+    free_camera_metadata(const_cast<camera_metadata_t*>(
+        mCameraInfoMap.valueFor(cameraId).static_camera_characteristics));
     mCameraInfoMap.removeItem(cameraId);
     mDeviceVersionMap.removeItem(cameraId);
 }
diff --git a/camera/common/1.0/default/OWNERS b/camera/common/1.0/default/OWNERS
index 18acfee..369b204 100644
--- a/camera/common/1.0/default/OWNERS
+++ b/camera/common/1.0/default/OWNERS
@@ -1,6 +1,7 @@
 cychen@google.com
 epeev@google.com
 etalvala@google.com
+jchowdhary@google.com
 shuzhenwang@google.com
 yinchiayeh@google.com
 zhijunhe@google.com
diff --git a/camera/common/1.0/default/include/CameraModule.h b/camera/common/1.0/default/include/CameraModule.h
index deebd09..aee9654 100644
--- a/camera/common/1.0/default/include/CameraModule.h
+++ b/camera/common/1.0/default/include/CameraModule.h
@@ -65,6 +65,7 @@
     void *getDso();
     // Only used by CameraProvider
     void removeCamera(int cameraId);
+    int getPhysicalCameraInfo(int physicalCameraId, camera_metadata_t **physicalInfo);
 
 private:
     // Derive camera characteristics keys defined after HAL device version
@@ -74,8 +75,10 @@
             int32_t keyTag, const Vector<int32_t>& appendKeys);
     status_t filterOpenErrorCode(status_t err);
     camera_module_t *mModule;
+    int mNumberOfCameras;
     KeyedVector<int, camera_info> mCameraInfoMap;
     KeyedVector<int, int> mDeviceVersionMap;
+    KeyedVector<int, camera_metadata_t*> mPhysicalCameraInfoMap;
     Mutex mCameraInfoLock;
 };
 
diff --git a/camera/device/1.0/default/OWNERS b/camera/device/1.0/default/OWNERS
index 18acfee..369b204 100644
--- a/camera/device/1.0/default/OWNERS
+++ b/camera/device/1.0/default/OWNERS
@@ -1,6 +1,7 @@
 cychen@google.com
 epeev@google.com
 etalvala@google.com
+jchowdhary@google.com
 shuzhenwang@google.com
 yinchiayeh@google.com
 zhijunhe@google.com
diff --git a/camera/device/3.2/ICameraDevice.hal b/camera/device/3.2/ICameraDevice.hal
index 1f523e4..5236bb1 100644
--- a/camera/device/3.2/ICameraDevice.hal
+++ b/camera/device/3.2/ICameraDevice.hal
@@ -148,7 +148,9 @@
      * session handle for active operations.
      *
      * @param callback Interface to invoke by the HAL for device asynchronous
-     *     events.
+     *     events. For HALs newer than version 3.2, HAL must use castFrom
+     *     method to check the exact version of callback sent by camera service.
+     *
      * @return status Status code for the operation, one of:
      *     OK:
      *         On a successful open of the camera device.
diff --git a/camera/device/3.2/ICameraDeviceSession.hal b/camera/device/3.2/ICameraDeviceSession.hal
index 477a3cc..225e52b 100644
--- a/camera/device/3.2/ICameraDeviceSession.hal
+++ b/camera/device/3.2/ICameraDeviceSession.hal
@@ -149,9 +149,8 @@
      *           - Including too many output streams of a certain format.
      *           - Unsupported rotation configuration
      *           - Stream sizes/formats don't satisfy the
-     *             camera3_stream_configuration_t->operation_mode requirements
-     *             for non-NORMAL mode, or the requested operation_mode is not
-     *             supported by the HAL.
+     *             StreamConfigurationMode requirements for non-NORMAL mode, or
+     *             the requested operation_mode is not supported by the HAL.
      *           - Unsupported usage flag
      *         The camera service cannot filter out all possible illegal stream
      *         configurations, since some devices may support more simultaneous
diff --git a/camera/device/3.2/default/CameraDevice.cpp b/camera/device/3.2/default/CameraDevice.cpp
index dfbb976..2e80ce8 100644
--- a/camera/device/3.2/default/CameraDevice.cpp
+++ b/camera/device/3.2/default/CameraDevice.cpp
@@ -101,7 +101,7 @@
 }
 
 // Methods from ::android::hardware::camera::device::V3_2::ICameraDevice follow.
-Return<void> CameraDevice::getResourceCost(getResourceCost_cb _hidl_cb)  {
+Return<void> CameraDevice::getResourceCost(ICameraDevice::getResourceCost_cb _hidl_cb)  {
     Status status = initStatus();
     CameraResourceCost resCost;
     if (status == Status::OK) {
@@ -141,7 +141,8 @@
     return Void();
 }
 
-Return<void> CameraDevice::getCameraCharacteristics(getCameraCharacteristics_cb _hidl_cb)  {
+Return<void> CameraDevice::getCameraCharacteristics(
+        ICameraDevice::getCameraCharacteristics_cb _hidl_cb)  {
     Status status = initStatus();
     CameraMetadata cameraCharacteristics;
     if (status == Status::OK) {
@@ -172,7 +173,8 @@
     return status;
 }
 
-Return<void> CameraDevice::open(const sp<ICameraDeviceCallback>& callback, open_cb _hidl_cb)  {
+Return<void> CameraDevice::open(const sp<ICameraDeviceCallback>& callback,
+        ICameraDevice::open_cb _hidl_cb)  {
     Status status = initStatus();
     sp<CameraDeviceSession> session = nullptr;
 
diff --git a/camera/device/3.2/default/CameraDevice_3_2.h b/camera/device/3.2/default/CameraDevice_3_2.h
index 9534707..f474533 100644
--- a/camera/device/3.2/default/CameraDevice_3_2.h
+++ b/camera/device/3.2/default/CameraDevice_3_2.h
@@ -51,7 +51,7 @@
 /*
  * The camera device HAL implementation is opened lazily (via the open call)
  */
-struct CameraDevice : public ICameraDevice {
+struct CameraDevice : public virtual RefBase {
     // Called by provider HAL. Provider HAL must ensure the uniqueness of
     // CameraDevice object per cameraId, or there could be multiple CameraDevice
     // trying to access the same physical camera.
@@ -60,7 +60,14 @@
     CameraDevice(sp<CameraModule> module,
                  const std::string& cameraId,
                  const SortedVector<std::pair<std::string, std::string>>& cameraDeviceNames);
-    ~CameraDevice();
+    virtual ~CameraDevice();
+
+    // Retrieve the HIDL interface, split into its own class to avoid inheritance issues when
+    // dealing with minor version revs and simultaneous implementation and interface inheritance
+    virtual sp<ICameraDevice> getInterface() {
+        return new TrampolineDeviceInterface_3_2(this);
+    }
+
     // Caller must use this method to check if CameraDevice ctor failed
     bool isInitFailed() { return mInitFail; }
     // Used by provider HAL to signal external camera disconnected
@@ -68,16 +75,16 @@
 
     /* Methods from ::android::hardware::camera::device::V3_2::ICameraDevice follow. */
     // The following method can be called without opening the actual camera device
-    Return<void> getResourceCost(getResourceCost_cb _hidl_cb) override;
-    Return<void> getCameraCharacteristics(getCameraCharacteristics_cb _hidl_cb) override;
-    Return<Status> setTorchMode(TorchMode mode) override;
+    Return<void> getResourceCost(ICameraDevice::getResourceCost_cb _hidl_cb);
+    Return<void> getCameraCharacteristics(ICameraDevice::getCameraCharacteristics_cb _hidl_cb);
+    Return<Status> setTorchMode(TorchMode mode);
 
     // Open the device HAL and also return a default capture session
-    Return<void> open(const sp<ICameraDeviceCallback>& callback, open_cb _hidl_cb) override;
+    Return<void> open(const sp<ICameraDeviceCallback>& callback, ICameraDevice::open_cb _hidl_cb);
 
 
     // Forward the dump call to the opened session, or do nothing
-    Return<void> dumpState(const ::android::hardware::hidl_handle& fd) override;
+    Return<void> dumpState(const ::android::hardware::hidl_handle& fd);
     /* End of Methods from ::android::hardware::camera::device::V3_2::ICameraDevice */
 
 protected:
@@ -106,6 +113,39 @@
     static Status getHidlStatus(int);
 
     Status initStatus() const;
+
+private:
+    struct TrampolineDeviceInterface_3_2 : public ICameraDevice {
+        TrampolineDeviceInterface_3_2(sp<CameraDevice> parent) :
+            mParent(parent) {}
+
+        virtual Return<void> getResourceCost(V3_2::ICameraDevice::getResourceCost_cb _hidl_cb)
+                override {
+            return mParent->getResourceCost(_hidl_cb);
+        }
+
+        virtual Return<void> getCameraCharacteristics(
+                V3_2::ICameraDevice::getCameraCharacteristics_cb _hidl_cb) override {
+            return mParent->getCameraCharacteristics(_hidl_cb);
+        }
+
+        virtual Return<Status> setTorchMode(TorchMode mode) override {
+            return mParent->setTorchMode(mode);
+        }
+
+        virtual Return<void> open(const sp<V3_2::ICameraDeviceCallback>& callback,
+                V3_2::ICameraDevice::open_cb _hidl_cb) override {
+            return mParent->open(callback, _hidl_cb);
+        }
+
+        virtual Return<void> dumpState(const hidl_handle& fd) override {
+            return mParent->dumpState(fd);
+        }
+
+    private:
+        sp<CameraDevice> mParent;
+    };
+
 };
 
 }  // namespace implementation
diff --git a/camera/device/3.2/default/OWNERS b/camera/device/3.2/default/OWNERS
index 18acfee..369b204 100644
--- a/camera/device/3.2/default/OWNERS
+++ b/camera/device/3.2/default/OWNERS
@@ -1,6 +1,7 @@
 cychen@google.com
 epeev@google.com
 etalvala@google.com
+jchowdhary@google.com
 shuzhenwang@google.com
 yinchiayeh@google.com
 zhijunhe@google.com
diff --git a/camera/device/3.3/default/OWNERS b/camera/device/3.3/default/OWNERS
index 18acfee..369b204 100644
--- a/camera/device/3.3/default/OWNERS
+++ b/camera/device/3.3/default/OWNERS
@@ -1,6 +1,7 @@
 cychen@google.com
 epeev@google.com
 etalvala@google.com
+jchowdhary@google.com
 shuzhenwang@google.com
 yinchiayeh@google.com
 zhijunhe@google.com
diff --git a/camera/device/3.4/ICameraDeviceSession.hal b/camera/device/3.4/ICameraDeviceSession.hal
index c41d90e..e1663e6 100644
--- a/camera/device/3.4/ICameraDeviceSession.hal
+++ b/camera/device/3.4/ICameraDeviceSession.hal
@@ -54,7 +54,7 @@
      *           - Including too many output streams of a certain format.
      *           - Unsupported rotation configuration
      *           - Stream sizes/formats don't satisfy the
-     *             camera3_stream_configuration_t->operation_mode requirements
+     *             StreamConfigurationMode requirements
      *             for non-NORMAL mode, or the requested operation_mode is not
      *             supported by the HAL.
      *           - Unsupported usage flag
diff --git a/camera/device/3.4/default/ExternalCameraDevice.cpp b/camera/device/3.4/default/ExternalCameraDevice.cpp
index e7361dd..b96f574 100644
--- a/camera/device/3.4/default/ExternalCameraDevice.cpp
+++ b/camera/device/3.4/default/ExternalCameraDevice.cpp
@@ -48,24 +48,31 @@
 } // anonymous namespace
 
 ExternalCameraDevice::ExternalCameraDevice(
-            const std::string& cameraId, const ExternalCameraConfig& cfg) :
+        const std::string& cameraId, const ExternalCameraConfig& cfg) :
         mCameraId(cameraId),
-        mCfg(cfg) {
-
-    status_t ret = initCameraCharacteristics();
-    if (ret != OK) {
-        ALOGE("%s: init camera characteristics failed: errorno %d", __FUNCTION__, ret);
-        mInitFailed = true;
-    }
-}
+        mCfg(cfg) {}
 
 ExternalCameraDevice::~ExternalCameraDevice() {}
 
 bool ExternalCameraDevice::isInitFailed() {
+    Mutex::Autolock _l(mLock);
+    return isInitFailedLocked();
+}
+
+bool ExternalCameraDevice::isInitFailedLocked() {
+    if (!mInitialized) {
+        status_t ret = initCameraCharacteristics();
+        if (ret != OK) {
+            ALOGE("%s: init camera characteristics failed: errorno %d", __FUNCTION__, ret);
+            mInitFailed = true;
+        }
+        mInitialized = true;
+    }
     return mInitFailed;
 }
 
-Return<void> ExternalCameraDevice::getResourceCost(getResourceCost_cb _hidl_cb) {
+Return<void> ExternalCameraDevice::getResourceCost(
+        ICameraDevice::getResourceCost_cb _hidl_cb) {
     CameraResourceCost resCost;
     resCost.resourceCost = 100;
     _hidl_cb(Status::OK, resCost);
@@ -73,11 +80,11 @@
 }
 
 Return<void> ExternalCameraDevice::getCameraCharacteristics(
-        getCameraCharacteristics_cb _hidl_cb) {
+        ICameraDevice::getCameraCharacteristics_cb _hidl_cb) {
     Mutex::Autolock _l(mLock);
     V3_2::CameraMetadata hidlChars;
 
-    if (isInitFailed()) {
+    if (isInitFailedLocked()) {
         _hidl_cb(Status::INTERNAL_ERROR, hidlChars);
         return Void();
     }
@@ -94,7 +101,7 @@
 }
 
 Return<void> ExternalCameraDevice::open(
-        const sp<ICameraDeviceCallback>& callback, open_cb _hidl_cb) {
+        const sp<ICameraDeviceCallback>& callback, ICameraDevice::open_cb _hidl_cb) {
     Status status = Status::OK;
     sp<ExternalCameraDeviceSession> session = nullptr;
 
@@ -143,7 +150,7 @@
         }
     }
 
-    session = new ExternalCameraDeviceSession(
+    session = createSession(
             callback, mCfg, mSupportedFormats, mCroppingType,
             mCameraCharacteristics, mCameraId, std::move(fd));
     if (session == nullptr) {
@@ -479,52 +486,9 @@
     UPDATE(ANDROID_REQUEST_AVAILABLE_RESULT_KEYS, availableResultKeys,
            ARRAY_SIZE(availableResultKeys));
 
-    const int32_t availableCharacteristicsKeys[] = {
-        ANDROID_COLOR_CORRECTION_AVAILABLE_ABERRATION_MODES,
-        ANDROID_CONTROL_AE_AVAILABLE_ANTIBANDING_MODES,
-        ANDROID_CONTROL_AE_AVAILABLE_MODES,
-        ANDROID_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES,
-        ANDROID_CONTROL_AE_COMPENSATION_RANGE,
-        ANDROID_CONTROL_AE_COMPENSATION_STEP,
-        ANDROID_CONTROL_AE_LOCK_AVAILABLE,
-        ANDROID_CONTROL_AF_AVAILABLE_MODES,
-        ANDROID_CONTROL_AVAILABLE_EFFECTS,
-        ANDROID_CONTROL_AVAILABLE_MODES,
-        ANDROID_CONTROL_AVAILABLE_SCENE_MODES,
-        ANDROID_CONTROL_AVAILABLE_VIDEO_STABILIZATION_MODES,
-        ANDROID_CONTROL_AWB_AVAILABLE_MODES,
-        ANDROID_CONTROL_AWB_LOCK_AVAILABLE,
-        ANDROID_CONTROL_MAX_REGIONS,
-        ANDROID_FLASH_INFO_AVAILABLE,
-        ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL,
-        ANDROID_JPEG_AVAILABLE_THUMBNAIL_SIZES,
-        ANDROID_LENS_FACING,
-        ANDROID_LENS_INFO_AVAILABLE_OPTICAL_STABILIZATION,
-        ANDROID_LENS_INFO_FOCUS_DISTANCE_CALIBRATION,
-        ANDROID_NOISE_REDUCTION_AVAILABLE_NOISE_REDUCTION_MODES,
-        ANDROID_REQUEST_AVAILABLE_CAPABILITIES,
-        ANDROID_REQUEST_MAX_NUM_INPUT_STREAMS,
-        ANDROID_REQUEST_MAX_NUM_OUTPUT_STREAMS,
-        ANDROID_REQUEST_PARTIAL_RESULT_COUNT,
-        ANDROID_REQUEST_PIPELINE_MAX_DEPTH,
-        ANDROID_SCALER_AVAILABLE_MAX_DIGITAL_ZOOM,
-        ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS,
-        ANDROID_SCALER_CROPPING_TYPE,
-        ANDROID_SENSOR_INFO_ACTIVE_ARRAY_SIZE,
-        ANDROID_SENSOR_INFO_MAX_FRAME_DURATION,
-        ANDROID_SENSOR_INFO_PIXEL_ARRAY_SIZE,
-        ANDROID_SENSOR_INFO_PRE_CORRECTION_ACTIVE_ARRAY_SIZE,
-        ANDROID_SENSOR_INFO_TIMESTAMP_SOURCE,
-        ANDROID_SENSOR_ORIENTATION,
-        ANDROID_SHADING_AVAILABLE_MODES,
-        ANDROID_STATISTICS_INFO_AVAILABLE_FACE_DETECT_MODES,
-        ANDROID_STATISTICS_INFO_AVAILABLE_HOT_PIXEL_MAP_MODES,
-        ANDROID_STATISTICS_INFO_AVAILABLE_LENS_SHADING_MAP_MODES,
-        ANDROID_STATISTICS_INFO_MAX_FACE_COUNT,
-        ANDROID_SYNC_MAX_LATENCY};
     UPDATE(ANDROID_REQUEST_AVAILABLE_CHARACTERISTICS_KEYS,
-           availableCharacteristicsKeys,
-           ARRAY_SIZE(availableCharacteristicsKeys));
+           AVAILABLE_CHARACTERISTICS_KEYS_3_4.data(),
+           AVAILABLE_CHARACTERISTICS_KEYS_3_4.size());
 
     return OK;
 }
@@ -931,6 +895,18 @@
     }
 }
 
+sp<ExternalCameraDeviceSession> ExternalCameraDevice::createSession(
+        const sp<ICameraDeviceCallback>& cb,
+        const ExternalCameraConfig& cfg,
+        const std::vector<SupportedV4L2Format>& sortedFormats,
+        const CroppingType& croppingType,
+        const common::V1_0::helper::CameraMetadata& chars,
+        const std::string& cameraId,
+        unique_fd v4l2Fd) {
+    return new ExternalCameraDeviceSession(
+            cb, cfg, sortedFormats, croppingType, chars, cameraId, std::move(v4l2Fd));
+}
+
 }  // namespace implementation
 }  // namespace V3_4
 }  // namespace device
diff --git a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
index dce40ff..4ef5fc9 100644
--- a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
+++ b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
@@ -81,6 +81,8 @@
     return locked;
 }
 
+buffer_handle_t sEmptyBuffer = nullptr;
+
 } // Anonymous namespace
 
 // Static instances
@@ -103,11 +105,8 @@
         mCroppingType(croppingType),
         mCameraId(cameraId),
         mV4l2Fd(std::move(v4l2Fd)),
-        mOutputThread(new OutputThread(this, mCroppingType)),
         mMaxThumbResolution(getMaxThumbResolution()),
-        mMaxJpegResolution(getMaxJpegResolution()) {
-    mInitFail = initialize();
-}
+        mMaxJpegResolution(getMaxJpegResolution()) {}
 
 bool ExternalCameraDeviceSession::initialize() {
     if (mV4l2Fd.get() < 0) {
@@ -142,6 +141,12 @@
             model = card;
         }
     }
+
+    initOutputThread();
+    if (mOutputThread == nullptr) {
+        ALOGE("%s: init OutputThread failed!", __FUNCTION__);
+        return true;
+    }
     mOutputThread->setExifMakeModel(make, model);
 
     status_t status = initDefaultRequests();
@@ -168,6 +173,32 @@
     return false;
 }
 
+bool ExternalCameraDeviceSession::isInitFailed() {
+    Mutex::Autolock _l(mLock);
+    if (!mInitialized) {
+        mInitFail = initialize();
+        mInitialized = true;
+    }
+    return mInitFail;
+}
+
+void ExternalCameraDeviceSession::initOutputThread() {
+    mOutputThread = new OutputThread(this, mCroppingType);
+}
+
+void ExternalCameraDeviceSession::closeOutputThread() {
+    closeOutputThreadImpl();
+}
+
+void ExternalCameraDeviceSession::closeOutputThreadImpl() {
+    if (mOutputThread) {
+        mOutputThread->flush();
+        mOutputThread->requestExit();
+        mOutputThread->join();
+        mOutputThread.clear();
+    }
+}
+
 Status ExternalCameraDeviceSession::initStatus() const {
     Mutex::Autolock _l(mLock);
     Status status = Status::OK;
@@ -181,7 +212,7 @@
 ExternalCameraDeviceSession::~ExternalCameraDeviceSession() {
     if (!isClosed()) {
         ALOGE("ExternalCameraDeviceSession deleted before close!");
-        close();
+        close(/*callerIsDtor*/true);
     }
 }
 
@@ -344,17 +375,31 @@
         ICameraDeviceSession::configureStreams_3_4_cb _hidl_cb)  {
     V3_2::StreamConfiguration config_v32;
     V3_3::HalStreamConfiguration outStreams_v33;
+    V3_4::HalStreamConfiguration outStreams;
     Mutex::Autolock _il(mInterfaceLock);
 
     config_v32.operationMode = requestedConfiguration.operationMode;
     config_v32.streams.resize(requestedConfiguration.streams.size());
+    uint32_t blobBufferSize = 0;
+    int numStallStream = 0;
     for (size_t i = 0; i < config_v32.streams.size(); i++) {
         config_v32.streams[i] = requestedConfiguration.streams[i].v3_2;
+        if (config_v32.streams[i].format == PixelFormat::BLOB) {
+            blobBufferSize = requestedConfiguration.streams[i].bufferSize;
+            numStallStream++;
+        }
     }
 
-    Status status = configureStreams(config_v32, &outStreams_v33);
+    // Fail early if there are multiple BLOB streams
+    if (numStallStream > kMaxStallStream) {
+        ALOGE("%s: too many stall streams (expect <= %d, got %d)", __FUNCTION__,
+                kMaxStallStream, numStallStream);
+        _hidl_cb(Status::ILLEGAL_ARGUMENT, outStreams);
+        return Void();
+    }
 
-    V3_4::HalStreamConfiguration outStreams;
+    Status status = configureStreams(config_v32, &outStreams_v33, blobBufferSize);
+
     outStreams.streams.resize(outStreams_v33.streams.size());
     for (size_t i = 0; i < outStreams.streams.size(); i++) {
         outStreams.streams[i].v3_3 = outStreams_v33.streams[i];
@@ -428,18 +473,23 @@
     return Status::OK;
 }
 
-Return<void> ExternalCameraDeviceSession::close() {
+Return<void> ExternalCameraDeviceSession::close(bool callerIsDtor) {
     Mutex::Autolock _il(mInterfaceLock);
     bool closed = isClosed();
     if (!closed) {
-        mOutputThread->flush();
-        mOutputThread->requestExit();
-        mOutputThread->join();
+        if (callerIsDtor) {
+            closeOutputThreadImpl();
+        } else {
+            closeOutputThread();
+        }
 
         Mutex::Autolock _l(mLock);
         // free all buffers
-        for(auto pair : mStreamMap) {
-            cleanupBuffersLocked(/*Stream ID*/pair.first);
+        {
+            Mutex::Autolock _l(mCbsLock);
+            for(auto pair : mStreamMap) {
+                cleanupBuffersLocked(/*Stream ID*/pair.first);
+            }
         }
         v4l2StreamOffLocked();
         ALOGV("%s: closing V4L2 camera FD %d", __FUNCTION__, mV4l2Fd.get());
@@ -449,10 +499,61 @@
     return Void();
 }
 
-Status ExternalCameraDeviceSession::importRequest(
+Status ExternalCameraDeviceSession::importRequestLocked(
+    const CaptureRequest& request,
+    hidl_vec<buffer_handle_t*>& allBufPtrs,
+    hidl_vec<int>& allFences) {
+    return importRequestLockedImpl(request, allBufPtrs, allFences);
+}
+
+Status ExternalCameraDeviceSession::importBuffer(int32_t streamId,
+        uint64_t bufId, buffer_handle_t buf,
+        /*out*/buffer_handle_t** outBufPtr,
+        bool allowEmptyBuf) {
+    Mutex::Autolock _l(mCbsLock);
+    return importBufferLocked(streamId, bufId, buf, outBufPtr, allowEmptyBuf);
+}
+
+Status ExternalCameraDeviceSession::importBufferLocked(int32_t streamId,
+        uint64_t bufId, buffer_handle_t buf,
+        /*out*/buffer_handle_t** outBufPtr,
+        bool allowEmptyBuf) {
+
+    if (buf == nullptr && bufId == BUFFER_ID_NO_BUFFER) {
+        if (allowEmptyBuf) {
+            *outBufPtr = &sEmptyBuffer;
+            return Status::OK;
+        } else {
+            ALOGE("%s: bufferId %" PRIu64 " has null buffer handle!", __FUNCTION__, bufId);
+            return Status::ILLEGAL_ARGUMENT;
+        }
+    }
+
+    CirculatingBuffers& cbs = mCirculatingBuffers[streamId];
+    if (cbs.count(bufId) == 0) {
+        if (buf == nullptr) {
+            ALOGE("%s: bufferId %" PRIu64 " has null buffer handle!", __FUNCTION__, bufId);
+            return Status::ILLEGAL_ARGUMENT;
+        }
+        // Register a newly seen buffer
+        buffer_handle_t importedBuf = buf;
+        sHandleImporter.importBuffer(importedBuf);
+        if (importedBuf == nullptr) {
+            ALOGE("%s: output buffer for stream %d is invalid!", __FUNCTION__, streamId);
+            return Status::INTERNAL_ERROR;
+        } else {
+            cbs[bufId] = importedBuf;
+        }
+    }
+    *outBufPtr = &cbs[bufId];
+    return Status::OK;
+}
+
+Status ExternalCameraDeviceSession::importRequestLockedImpl(
         const CaptureRequest& request,
         hidl_vec<buffer_handle_t*>& allBufPtrs,
-        hidl_vec<int>& allFences) {
+        hidl_vec<int>& allFences,
+        bool allowEmptyBuf) {
     size_t numOutputBufs = request.outputBuffers.size();
     size_t numBufs = numOutputBufs;
     // Validate all I/O buffers
@@ -471,26 +572,17 @@
         streamIds[i] = request.outputBuffers[i].streamId;
     }
 
-    for (size_t i = 0; i < numBufs; i++) {
-        buffer_handle_t buf = allBufs[i];
-        uint64_t bufId = allBufIds[i];
-        CirculatingBuffers& cbs = mCirculatingBuffers[streamIds[i]];
-        if (cbs.count(bufId) == 0) {
-            if (buf == nullptr) {
-                ALOGE("%s: bufferId %" PRIu64 " has null buffer handle!", __FUNCTION__, bufId);
-                return Status::ILLEGAL_ARGUMENT;
-            }
-            // Register a newly seen buffer
-            buffer_handle_t importedBuf = buf;
-            sHandleImporter.importBuffer(importedBuf);
-            if (importedBuf == nullptr) {
-                ALOGE("%s: output buffer %zu is invalid!", __FUNCTION__, i);
-                return Status::INTERNAL_ERROR;
-            } else {
-                cbs[bufId] = importedBuf;
+    {
+        Mutex::Autolock _l(mCbsLock);
+        for (size_t i = 0; i < numBufs; i++) {
+            Status st = importBufferLocked(
+                    streamIds[i], allBufIds[i], allBufs[i], &allBufPtrs[i],
+                    allowEmptyBuf);
+            if (st != Status::OK) {
+                // Detailed error logs printed in importBuffer
+                return st;
             }
         }
-        allBufPtrs[i] = &cbs[bufId];
     }
 
     // All buffers are imported. Now validate output buffer acquire fences
@@ -638,7 +730,7 @@
         }
     }
 
-    status = importRequest(request, allBufPtrs, allFences);
+    status = importRequestLocked(request, allBufPtrs, allFences);
     if (status != Status::OK) {
         return status;
     }
@@ -761,9 +853,11 @@
         result.outputBuffers[i].bufferId = req->buffers[i].bufferId;
         if (req->buffers[i].fenceTimeout) {
             result.outputBuffers[i].status = BufferStatus::ERROR;
-            native_handle_t* handle = native_handle_create(/*numFds*/1, /*numInts*/0);
-            handle->data[0] = req->buffers[i].acquireFence;
-            result.outputBuffers[i].releaseFence.setTo(handle, /*shouldOwn*/false);
+            if (req->buffers[i].acquireFence > 0) {
+                native_handle_t* handle = native_handle_create(/*numFds*/1, /*numInts*/0);
+                handle->data[0] = req->buffers[i].acquireFence;
+                result.outputBuffers[i].releaseFence.setTo(handle, /*shouldOwn*/false);
+            }
             notifyError(req->frameNumber, req->buffers[i].streamId, ErrorCode::ERROR_BUFFER);
         } else {
             result.outputBuffers[i].status = BufferStatus::OK;
@@ -1592,8 +1686,9 @@
      * main image needs to hold APP1, headers, and at most a poorly
      * compressed image */
     const ssize_t maxThumbCodeSize = 64 * 1024;
-    const ssize_t maxJpegCodeSize = parent->getJpegBufferSize(jpegSize.width,
-                                                             jpegSize.height);
+    const ssize_t maxJpegCodeSize = mBlobBufferSize == 0 ?
+            parent->getJpegBufferSize(jpegSize.width, jpegSize.height) :
+            mBlobBufferSize;
 
     /* Check that getJpegBufferSize did not return an error */
     if (maxJpegCodeSize < 0) {
@@ -1732,6 +1827,12 @@
                 (req->frameIn->mFourcc >> 24) & 0xFF);
     }
 
+    int res = requestBufferStart(req->buffers);
+    if (res != 0) {
+        ALOGE("%s: send BufferRequest failed! res %d", __FUNCTION__, res);
+        return onDeviceError("%s: failed to send buffer request!", __FUNCTION__);
+    }
+
     std::unique_lock<std::mutex> lk(mBufferLock);
     // Convert input V4L2 frame to YU12 of the same size
     // TODO: see if we can save some computation by converting to YV12 here
@@ -1744,7 +1845,7 @@
 
     // TODO: in some special case maybe we can decode jpg directly to gralloc output?
     ATRACE_BEGIN("MJPGtoI420");
-    int res = libyuv::MJPGToI420(
+    res = libyuv::MJPGToI420(
             inData, inDataSize,
             static_cast<uint8_t*>(mYu12FrameLayout.y),
             mYu12FrameLayout.yStride,
@@ -1768,10 +1869,23 @@
         return true;
     }
 
+    ATRACE_BEGIN("Wait for BufferRequest done");
+    res = waitForBufferRequestDone(&req->buffers);
+    ATRACE_END();
+
+    if (res != 0) {
+        ALOGE("%s: wait for BufferRequest done failed! res %d", __FUNCTION__, res);
+        lk.unlock();
+        return onDeviceError("%s: failed to process buffer request error!", __FUNCTION__);
+    }
+
     ALOGV("%s processing new request", __FUNCTION__);
     const int kSyncWaitTimeoutMs = 500;
     for (auto& halBuf : req->buffers) {
-        if (halBuf.acquireFence != -1) {
+        if (*(halBuf.bufPtr) == nullptr) {
+            ALOGW("%s: buffer for stream %d missing", __FUNCTION__, halBuf.streamId);
+            halBuf.fenceTimeout = true;
+        } else if (halBuf.acquireFence != -1) {
             int ret = sync_wait(halBuf.acquireFence, kSyncWaitTimeoutMs);
             if (ret) {
                 halBuf.fenceTimeout = true;
@@ -1859,7 +1973,8 @@
 
 Status ExternalCameraDeviceSession::OutputThread::allocateIntermediateBuffers(
         const Size& v4lSize, const Size& thumbSize,
-        const hidl_vec<Stream>& streams) {
+        const hidl_vec<Stream>& streams,
+        uint32_t blobBufferSize) {
     std::lock_guard<std::mutex> lk(mBufferLock);
     if (mScaledYu12Frames.size() != 0) {
         ALOGE("%s: intermediate buffer pool has %zu inflight buffers! (expect 0)",
@@ -1928,6 +2043,8 @@
             it = mIntermediateBuffers.erase(it);
         }
     }
+
+    mBlobBufferSize = blobBufferSize;
     return Status::OK;
 }
 
@@ -2027,7 +2144,7 @@
 }
 
 void ExternalCameraDeviceSession::updateBufferCaches(const hidl_vec<BufferCache>& cachesToRemove) {
-    Mutex::Autolock _l(mLock);
+    Mutex::Autolock _l(mCbsLock);
     for (auto& cache : cachesToRemove) {
         auto cbsIt = mCirculatingBuffers.find(cache.streamId);
         if (cbsIt == mCirculatingBuffers.end()) {
@@ -2425,7 +2542,9 @@
 }
 
 Status ExternalCameraDeviceSession::configureStreams(
-        const V3_2::StreamConfiguration& config, V3_3::HalStreamConfiguration* out) {
+        const V3_2::StreamConfiguration& config,
+        V3_3::HalStreamConfiguration* out,
+        uint32_t blobBufferSize) {
     ATRACE_CALL();
     if (config.operationMode != StreamConfigurationMode::NORMAL_MODE) {
         ALOGE("%s: unsupported operation mode: %d", __FUNCTION__, config.operationMode);
@@ -2479,30 +2598,33 @@
     }
 
     Mutex::Autolock _l(mLock);
-    // Add new streams
-    for (const auto& stream : config.streams) {
-        if (mStreamMap.count(stream.id) == 0) {
-            mStreamMap[stream.id] = stream;
-            mCirculatingBuffers.emplace(stream.id, CirculatingBuffers{});
-        }
-    }
-
-    // Cleanup removed streams
-    for(auto it = mStreamMap.begin(); it != mStreamMap.end();) {
-        int id = it->first;
-        bool found = false;
+    {
+        Mutex::Autolock _l(mCbsLock);
+        // Add new streams
         for (const auto& stream : config.streams) {
-            if (id == stream.id) {
-                found = true;
-                break;
+            if (mStreamMap.count(stream.id) == 0) {
+                mStreamMap[stream.id] = stream;
+                mCirculatingBuffers.emplace(stream.id, CirculatingBuffers{});
             }
         }
-        if (!found) {
-            // Unmap all buffers of deleted stream
-            cleanupBuffersLocked(id);
-            it = mStreamMap.erase(it);
-        } else {
-            ++it;
+
+        // Cleanup removed streams
+        for(auto it = mStreamMap.begin(); it != mStreamMap.end();) {
+            int id = it->first;
+            bool found = false;
+            for (const auto& stream : config.streams) {
+                if (id == stream.id) {
+                    found = true;
+                    break;
+                }
+            }
+            if (!found) {
+                // Unmap all buffers of deleted stream
+                cleanupBuffersLocked(id);
+                it = mStreamMap.erase(it);
+            } else {
+                ++it;
+            }
         }
     }
 
@@ -2587,7 +2709,7 @@
     }
 
     status = mOutputThread->allocateIntermediateBuffers(v4lSize,
-                mMaxThumbResolution, config.streams);
+                mMaxThumbResolution, config.streams, blobBufferSize);
     if (status != Status::OK) {
         ALOGE("%s: allocating intermediate buffers failed!", __FUNCTION__);
         return status;
diff --git a/camera/device/3.4/default/OWNERS b/camera/device/3.4/default/OWNERS
index 18acfee..369b204 100644
--- a/camera/device/3.4/default/OWNERS
+++ b/camera/device/3.4/default/OWNERS
@@ -1,6 +1,7 @@
 cychen@google.com
 epeev@google.com
 etalvala@google.com
+jchowdhary@google.com
 shuzhenwang@google.com
 yinchiayeh@google.com
 zhijunhe@google.com
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
index 0b94c11..cabeaa4 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
@@ -97,7 +97,7 @@
     // Call by CameraDevice to dump active device states
     void dumpState(const native_handle_t*);
     // Caller must use this method to check if CameraDeviceSession ctor failed
-    bool isInitFailed() { return mInitFail; }
+    bool isInitFailed();
     bool isClosed();
 
     // Retrieve the HIDL interface, split into its own class to avoid inheritance issues when
@@ -134,7 +134,7 @@
             ICameraDeviceSession::processCaptureRequest_cb);
 
     Return<Status> flush();
-    Return<void> close();
+    Return<void> close(bool callerIsDtor = false);
 
     Return<void> configureStreams_3_3(
             const V3_2::StreamConfiguration&,
@@ -170,14 +170,24 @@
         std::vector<HalStreamBuffer> buffers;
     };
 
+    static const uint64_t BUFFER_ID_NO_BUFFER = 0;
+
     Status constructDefaultRequestSettingsRaw(RequestTemplate type,
             V3_2::CameraMetadata *outMetadata);
 
     bool initialize();
+    // To init/close different version of output thread
+    virtual void initOutputThread();
+    virtual void closeOutputThread();
+    void closeOutputThreadImpl();
+
     Status initStatus() const;
     status_t initDefaultRequests();
     status_t fillCaptureResult(common::V1_0::helper::CameraMetadata& md, nsecs_t timestamp);
-    Status configureStreams(const V3_2::StreamConfiguration&, V3_3::HalStreamConfiguration* out);
+    Status configureStreams(const V3_2::StreamConfiguration&,
+            V3_3::HalStreamConfiguration* out,
+            // Only filled by configureStreams_3_4, and only one blob stream supported
+            uint32_t blobBufferSize = 0);
     // fps = 0.0 means default, which is
     // slowest fps that is at least 30, or fastest fps if 30 is not supported
     int configureV4l2StreamLocked(const SupportedV4L2Format& fmt, double fps = 0.0);
@@ -192,10 +202,28 @@
     bool isSupported(const Stream&);
 
     // Validate and import request's output buffers and acquire fence
-    Status importRequest(
+    virtual Status importRequestLocked(
             const CaptureRequest& request,
             hidl_vec<buffer_handle_t*>& allBufPtrs,
             hidl_vec<int>& allFences);
+
+    Status importRequestLockedImpl(
+            const CaptureRequest& request,
+            hidl_vec<buffer_handle_t*>& allBufPtrs,
+            hidl_vec<int>& allFences,
+            // Optional argument for ICameraDeviceSession@3.5 impl
+            bool allowEmptyBuf = false);
+
+    Status importBuffer(int32_t streamId,
+            uint64_t bufId, buffer_handle_t buf,
+            /*out*/buffer_handle_t** outBufPtr,
+            bool allowEmptyBuf);
+
+    Status importBufferLocked(int32_t streamId,
+            uint64_t bufId, buffer_handle_t buf,
+            /*out*/buffer_handle_t** outBufPtr,
+            bool allowEmptyBuf);
+
     static void cleanupInflightFences(
             hidl_vec<int>& allFences, size_t numFences);
     void cleanupBuffersLocked(int id);
@@ -221,18 +249,26 @@
     class OutputThread : public android::Thread {
     public:
         OutputThread(wp<ExternalCameraDeviceSession> parent, CroppingType);
-        ~OutputThread();
+        virtual ~OutputThread();
 
         Status allocateIntermediateBuffers(
                 const Size& v4lSize, const Size& thumbSize,
-                const hidl_vec<Stream>& streams);
+                const hidl_vec<Stream>& streams,
+                uint32_t blobBufferSize);
         Status submitRequest(const std::shared_ptr<HalRequest>&);
         void flush();
         void dump(int fd);
         virtual bool threadLoop() override;
 
         void setExifMakeModel(const std::string& make, const std::string& model);
-    private:
+
+    protected:
+        // Methods to request output buffer in parallel
+        // No-op for device@3.4. Implemented in device@3.5
+        virtual int requestBufferStart(const std::vector<HalStreamBuffer>&) { return 0; }
+        virtual int waitForBufferRequestDone(
+                /*out*/std::vector<HalStreamBuffer>*) { return 0; }
+
         static const uint32_t FLEX_YUV_GENERIC = static_cast<uint32_t>('F') |
                 static_cast<uint32_t>('L') << 8 | static_cast<uint32_t>('E') << 16 |
                 static_cast<uint32_t>('X') << 24;
@@ -289,6 +325,7 @@
         std::unordered_map<Size, sp<AllocatedFrame>, SizeHasher> mScaledYu12Frames;
         YCbCrLayout mYu12FrameLayout;
         YCbCrLayout mYu12ThumbFrameLayout;
+        uint32_t mBlobBufferSize = 0; // 0 -> HAL derive buffer size, else: use given size
 
         std::string mExifMake;
         std::string mExifModel;
@@ -314,6 +351,7 @@
     //    - init failed
     //    - camera disconnected
     bool mClosed = false;
+    bool mInitialized = false;
     bool mInitFail = false;
     bool mFirstRequest = false;
     common::V1_0::helper::CameraMetadata mLatestReqSetting;
@@ -346,6 +384,8 @@
     typedef std::unordered_map<uint64_t, buffer_handle_t> CirculatingBuffers;
     // Stream ID -> circulating buffers map
     std::map<int, CirculatingBuffers> mCirculatingBuffers;
+    // Protect mCirculatingBuffers, must not lock mLock after acquiring this lock
+    mutable Mutex mCbsLock;
 
     std::mutex mAfTriggerLock; // protect mAfTrigger
     bool mAfTrigger = false;
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h
index ff0cfb3..719a3ed 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h
@@ -25,6 +25,8 @@
 #include <hidl/MQDescriptor.h>
 #include "ExternalCameraDeviceSession.h"
 
+#include <vector>
+
 namespace android {
 namespace hardware {
 namespace camera {
@@ -49,7 +51,7 @@
 /*
  * The camera device HAL implementation is opened lazily (via the open call)
  */
-struct ExternalCameraDevice : public ICameraDevice {
+struct ExternalCameraDevice : public virtual RefBase {
 
     // Called by external camera provider HAL.
     // Provider HAL must ensure the uniqueness of CameraDevice object per cameraId, or there could
@@ -57,33 +59,54 @@
     // to keep track of all CameraDevice objects in order to notify CameraDevice when the underlying
     // camera is detached.
     ExternalCameraDevice(const std::string& cameraId, const ExternalCameraConfig& cfg);
-    ~ExternalCameraDevice();
+    virtual ~ExternalCameraDevice();
+
+    // Retrieve the HIDL interface, split into its own class to avoid inheritance issues when
+    // dealing with minor version revs and simultaneous implementation and interface inheritance
+    virtual sp<ICameraDevice> getInterface() {
+        return new TrampolineDeviceInterface_3_4(this);
+    }
 
     // Caller must use this method to check if CameraDevice ctor failed
     bool isInitFailed();
+    bool isInitFailedLocked();
 
     /* Methods from ::android::hardware::camera::device::V3_2::ICameraDevice follow. */
     // The following method can be called without opening the actual camera device
-    Return<void> getResourceCost(getResourceCost_cb _hidl_cb) override;
+    Return<void> getResourceCost(ICameraDevice::getResourceCost_cb _hidl_cb);
 
-    Return<void> getCameraCharacteristics(getCameraCharacteristics_cb _hidl_cb) override;
+    Return<void> getCameraCharacteristics(
+            ICameraDevice::getCameraCharacteristics_cb _hidl_cb);
 
-    Return<Status> setTorchMode(TorchMode) override;
+    Return<Status> setTorchMode(TorchMode);
 
     // Open the device HAL and also return a default capture session
-    Return<void> open(const sp<ICameraDeviceCallback>&, open_cb) override;
+    Return<void> open(const sp<ICameraDeviceCallback>&, ICameraDevice::open_cb);
 
     // Forward the dump call to the opened session, or do nothing
-    Return<void> dumpState(const ::android::hardware::hidl_handle&) override;
+    Return<void> dumpState(const ::android::hardware::hidl_handle&);
     /* End of Methods from ::android::hardware::camera::device::V3_2::ICameraDevice */
 
 protected:
+    // Overridden by child implementations for returning different versions of
+    // ExternalCameraDeviceSession
+    virtual sp<ExternalCameraDeviceSession> createSession(
+            const sp<ICameraDeviceCallback>&,
+            const ExternalCameraConfig& cfg,
+            const std::vector<SupportedV4L2Format>& sortedFormats,
+            const CroppingType& croppingType,
+            const common::V1_0::helper::CameraMetadata& chars,
+            const std::string& cameraId,
+            unique_fd v4l2Fd);
+
     // Init supported w/h/format/fps in mSupportedFormats. Caller still owns fd
     void initSupportedFormatsLocked(int fd);
 
+    // Calls into virtual member function. Do not use it in constructor
     status_t initCameraCharacteristics();
     // Init non-device dependent keys
-    status_t initDefaultCharsKeys(::android::hardware::camera::common::V1_0::helper::CameraMetadata*);
+    virtual status_t initDefaultCharsKeys(
+            ::android::hardware::camera::common::V1_0::helper::CameraMetadata*);
     // Init camera control chars keys. Caller still owns fd
     status_t initCameraControlsCharsKeys(int fd,
             ::android::hardware::camera::common::V1_0::helper::CameraMetadata*);
@@ -103,6 +126,7 @@
             /*inout*/std::vector<SupportedV4L2Format>* pFmts);
 
     Mutex mLock;
+    bool mInitialized = false;
     bool mInitFailed = false;
     std::string mCameraId;
     const ExternalCameraConfig& mCfg;
@@ -112,6 +136,84 @@
     wp<ExternalCameraDeviceSession> mSession = nullptr;
 
     ::android::hardware::camera::common::V1_0::helper::CameraMetadata mCameraCharacteristics;
+
+    const std::vector<int32_t> AVAILABLE_CHARACTERISTICS_KEYS_3_4 = {
+        ANDROID_COLOR_CORRECTION_AVAILABLE_ABERRATION_MODES,
+        ANDROID_CONTROL_AE_AVAILABLE_ANTIBANDING_MODES,
+        ANDROID_CONTROL_AE_AVAILABLE_MODES,
+        ANDROID_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES,
+        ANDROID_CONTROL_AE_COMPENSATION_RANGE,
+        ANDROID_CONTROL_AE_COMPENSATION_STEP,
+        ANDROID_CONTROL_AE_LOCK_AVAILABLE,
+        ANDROID_CONTROL_AF_AVAILABLE_MODES,
+        ANDROID_CONTROL_AVAILABLE_EFFECTS,
+        ANDROID_CONTROL_AVAILABLE_MODES,
+        ANDROID_CONTROL_AVAILABLE_SCENE_MODES,
+        ANDROID_CONTROL_AVAILABLE_VIDEO_STABILIZATION_MODES,
+        ANDROID_CONTROL_AWB_AVAILABLE_MODES,
+        ANDROID_CONTROL_AWB_LOCK_AVAILABLE,
+        ANDROID_CONTROL_MAX_REGIONS,
+        ANDROID_FLASH_INFO_AVAILABLE,
+        ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL,
+        ANDROID_JPEG_AVAILABLE_THUMBNAIL_SIZES,
+        ANDROID_LENS_FACING,
+        ANDROID_LENS_INFO_AVAILABLE_OPTICAL_STABILIZATION,
+        ANDROID_LENS_INFO_FOCUS_DISTANCE_CALIBRATION,
+        ANDROID_NOISE_REDUCTION_AVAILABLE_NOISE_REDUCTION_MODES,
+        ANDROID_REQUEST_AVAILABLE_CAPABILITIES,
+        ANDROID_REQUEST_MAX_NUM_INPUT_STREAMS,
+        ANDROID_REQUEST_MAX_NUM_OUTPUT_STREAMS,
+        ANDROID_REQUEST_PARTIAL_RESULT_COUNT,
+        ANDROID_REQUEST_PIPELINE_MAX_DEPTH,
+        ANDROID_SCALER_AVAILABLE_MAX_DIGITAL_ZOOM,
+        ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS,
+        ANDROID_SCALER_CROPPING_TYPE,
+        ANDROID_SENSOR_INFO_ACTIVE_ARRAY_SIZE,
+        ANDROID_SENSOR_INFO_MAX_FRAME_DURATION,
+        ANDROID_SENSOR_INFO_PIXEL_ARRAY_SIZE,
+        ANDROID_SENSOR_INFO_PRE_CORRECTION_ACTIVE_ARRAY_SIZE,
+        ANDROID_SENSOR_INFO_TIMESTAMP_SOURCE,
+        ANDROID_SENSOR_ORIENTATION,
+        ANDROID_SHADING_AVAILABLE_MODES,
+        ANDROID_STATISTICS_INFO_AVAILABLE_FACE_DETECT_MODES,
+        ANDROID_STATISTICS_INFO_AVAILABLE_HOT_PIXEL_MAP_MODES,
+        ANDROID_STATISTICS_INFO_AVAILABLE_LENS_SHADING_MAP_MODES,
+        ANDROID_STATISTICS_INFO_MAX_FACE_COUNT,
+        ANDROID_SYNC_MAX_LATENCY};
+
+private:
+
+    struct TrampolineDeviceInterface_3_4 : public ICameraDevice {
+        TrampolineDeviceInterface_3_4(sp<ExternalCameraDevice> parent) :
+            mParent(parent) {}
+
+        virtual Return<void> getResourceCost(V3_2::ICameraDevice::getResourceCost_cb _hidl_cb)
+                override {
+            return mParent->getResourceCost(_hidl_cb);
+        }
+
+        virtual Return<void> getCameraCharacteristics(
+                V3_2::ICameraDevice::getCameraCharacteristics_cb _hidl_cb) override {
+            return mParent->getCameraCharacteristics(_hidl_cb);
+        }
+
+        virtual Return<Status> setTorchMode(TorchMode mode) override {
+            return mParent->setTorchMode(mode);
+        }
+
+        virtual Return<void> open(const sp<V3_2::ICameraDeviceCallback>& callback,
+                V3_2::ICameraDevice::open_cb _hidl_cb) override {
+            return mParent->open(callback, _hidl_cb);
+        }
+
+        virtual Return<void> dumpState(const hidl_handle& fd) override {
+            return mParent->dumpState(fd);
+        }
+
+    private:
+        sp<ExternalCameraDevice> mParent;
+    };
+
 };
 
 }  // namespace implementation
diff --git a/camera/device/3.5/Android.bp b/camera/device/3.5/Android.bp
new file mode 100644
index 0000000..2a9ba05
--- /dev/null
+++ b/camera/device/3.5/Android.bp
@@ -0,0 +1,33 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.camera.device@3.5",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "ICameraDevice.hal",
+        "ICameraDeviceCallback.hal",
+        "ICameraDeviceSession.hal",
+    ],
+    interfaces: [
+        "android.hardware.camera.common@1.0",
+        "android.hardware.camera.device@3.2",
+        "android.hardware.camera.device@3.3",
+        "android.hardware.camera.device@3.4",
+        "android.hardware.graphics.common@1.0",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "BufferRequest",
+        "BufferRequestStatus",
+        "StreamBufferRequestError",
+        "StreamBufferRet",
+        "StreamBuffersVal",
+        "StreamConfiguration",
+    ],
+    gen_java: false,
+}
+
diff --git a/camera/device/3.5/ICameraDevice.hal b/camera/device/3.5/ICameraDevice.hal
new file mode 100644
index 0000000..a77380f
--- /dev/null
+++ b/camera/device/3.5/ICameraDevice.hal
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.camera.device@3.5;
+
+import android.hardware.camera.common@1.0::Status;
+import @3.2::CameraMetadata;
+import @3.2::ICameraDevice;
+
+/**
+ * Camera device interface
+ *
+ * Supports the android.hardware.Camera API, and the android.hardware.camera2
+ * API at LIMITED or better hardware level.
+ *
+ */
+interface ICameraDevice extends @3.2::ICameraDevice {
+
+    /**
+     * getPhysicalCameraCharacteristics:
+     *
+     * Return the static camera information for a physical camera ID backing
+     * this logical camera device. This information may not change between consecutive calls.
+     *
+     * Note that HAL must support this function for physical camera IDs that are
+     * not exposed via ICameraProvider::getCameraIdList(). Calling
+     * getCameraDeviceInterface_V3_x() on these camera IDs must return ILLEGAL_ARGUMENT.
+     *
+     * The characteristics of all cameras returned by
+     * ICameraProvider::getCameraIdList() must be queried via
+     * getCameraCharacteristics(). Calling getPhysicalCameraCharacteristics() on
+     * those cameras must return ILLEGAL_ARGUMENT.
+     *
+     * @param physicalCameraId The physical camera id parsed from the logical
+     *     camera's ANDROID_LOGICAL_MULTI_CAMERA_PHYSICAL_IDS static metadata
+     *     key. The framework assumes that this ID is just the <id> part of fully
+     *     qualified camera device name "device@<major>.<minor>/<type>/<id>". And
+     *     the physical camera must be of the same version and type as the parent
+     *     logical camera device.
+     *
+     * @return status Status code for the operation, one of:
+     *     OK:
+     *         On a successful query of the physical camera device characteristics
+     *     INTERNAL_ERROR:
+     *         The camera device cannot be opened due to an internal
+     *         error.
+     *     CAMERA_DISCONNECTED:
+     *         An external camera device has been disconnected, and is no longer
+     *         available. This camera device interface is now stale, and a new
+     *         instance must be acquired if the device is reconnected. All
+     *         subsequent calls on this interface must return
+     *         CAMERA_DISCONNECTED.
+     *     ILLEGAL_ARGUMENT:
+     *         If the physicalCameraId is not a valid physical camera Id outside
+     *         of ICameraProvider::getCameraIdList().
+     *
+     * @return cameraCharacteristics
+     *     The static metadata for this logical camera device's physical device, or an empty
+     *     metadata structure if status is not OK.
+     *
+     */
+    getPhysicalCameraCharacteristics(string physicalCameraId)
+            generates (Status status, CameraMetadata cameraCharacteristics);
+
+};
diff --git a/camera/device/3.5/ICameraDeviceCallback.hal b/camera/device/3.5/ICameraDeviceCallback.hal
new file mode 100644
index 0000000..aa4ad22
--- /dev/null
+++ b/camera/device/3.5/ICameraDeviceCallback.hal
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.camera.device@3.5;
+
+import @3.2::StreamBuffer;
+import @3.4::ICameraDeviceCallback;
+
+/**
+ * Callback methods for the HAL to call into the framework.
+ */
+interface ICameraDeviceCallback extends @3.4::ICameraDeviceCallback {
+
+    /**
+     * requestStreamBuffers:
+     *
+     * Synchronous callback for HAL to ask for output buffers from camera service.
+     *
+     * This call may be serialized in camera service so it is strongly
+     * recommended to only call this method from one thread.
+     *
+     * When camera device advertises
+     * (CameraMetadataEnumAndroidInfoSupportedBufferManagementVersion ==
+     * ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION_HIDL_DEVICE_3_5), HAL
+     * can use this method to request buffers from camera service.
+     *
+     * @return status Status code for the operation, one of:
+     *     OK: all requested buffers are returned
+     *     FAILED_PARTIAL: some streams failed while some succeeds. Check
+     *             individual StreamBufferRet for details.
+     *     FAILED_CONFIGURING: the request failed because camera servicve is
+     *             performing configureStreams and no buffers are returned.
+     *     FAILED_UNKNOWN: the request failed for unknown reason and no buffers
+     *             are returned.
+     *
+     * Performance requirements:
+     * This is a blocking call that takes more time with more buffers requested.
+     * HAL must not request large amount of buffers on a latency critical code
+     * path. It is highly recommended to use a dedicated thread to perform
+     * all requestStreamBuffers calls, and adjust the thread priority and/or
+     * timing of making the call in order for buffers to arrive before HAL is
+     * ready to fill the buffer.
+     */
+    requestStreamBuffers(vec<BufferRequest> bufReqs)
+            generates (BufferRequestStatus st, vec<StreamBufferRet> buffers);
+
+    /**
+     * returnStreamBuffers:
+     *
+     * Synchronous callback for HAL to return output buffers to camera service.
+     *
+     * If this method is called during a configureStreams call, it must be blocked
+     * until camera service finishes the ongoing configureStreams call.
+     */
+    returnStreamBuffers(vec<StreamBuffer> buffers);
+
+};
diff --git a/camera/device/3.5/ICameraDeviceSession.hal b/camera/device/3.5/ICameraDeviceSession.hal
new file mode 100644
index 0000000..b2b71cd
--- /dev/null
+++ b/camera/device/3.5/ICameraDeviceSession.hal
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.camera.device@3.5;
+
+import android.hardware.camera.common@1.0::Status;
+import @3.4::ICameraDeviceSession;
+import @3.4::HalStreamConfiguration;
+
+/**
+ * Camera device active session interface.
+ *
+ * Obtained via ICameraDevice::open(), this interface contains the methods to
+ * configure and request captures from an active camera device.
+ */
+interface ICameraDeviceSession extends @3.4::ICameraDeviceSession {
+
+    /**
+     * configureStreams_3_5:
+     *
+     * Identical to @3.4::ICameraDeviceSession.configureStreams, except that:
+     *
+     * - a streamConfigCounter counter is provided to check for race condition
+     *   between configureStreams_3_5 and signalStreamFlush call.
+     *
+     * @return status Status code for the operation, one of:
+     *     OK:
+     *         On successful stream configuration.
+     *     INTERNAL_ERROR:
+     *         If there has been a fatal error and the device is no longer
+     *         operational. Only close() can be called successfully by the
+     *         framework after this error is returned.
+     *     ILLEGAL_ARGUMENT:
+     *         If the requested stream configuration is invalid. Some examples
+     *         of invalid stream configurations include:
+     *           - Including more than 1 INPUT stream
+     *           - Not including any OUTPUT streams
+     *           - Including streams with unsupported formats, or an unsupported
+     *             size for that format.
+     *           - Including too many output streams of a certain format.
+     *           - Unsupported rotation configuration
+     *           - Stream sizes/formats don't satisfy the
+     *             StreamConfigurationMode requirements
+     *             for non-NORMAL mode, or the requested operation_mode is not
+     *             supported by the HAL.
+     *           - Unsupported usage flag
+     *         The camera service cannot filter out all possible illegal stream
+     *         configurations, since some devices may support more simultaneous
+     *         streams or larger stream resolutions than the minimum required
+     *         for a given camera device hardware level. The HAL must return an
+     *         ILLEGAL_ARGUMENT for any unsupported stream set, and then be
+     *         ready to accept a future valid stream configuration in a later
+     *         configureStreams call.
+     * @return halConfiguration The stream parameters desired by the HAL for
+     *     each stream, including maximum buffers, the usage flags, and the
+     *     override format.
+     */
+    configureStreams_3_5(@3.5::StreamConfiguration requestedConfiguration)
+            generates (Status status,
+                       @3.4::HalStreamConfiguration halConfiguration);
+
+
+    /**
+     * signalStreamFlush:
+     *
+     * Signaling HAL camera service is about to perform configureStreams_3_5 and
+     * HAL must return all buffers of designated streams. HAL must finish
+     * inflight requests normally and return all buffers that belongs to the
+     * designated streams through processCaptureResult or returnStreamBuffer
+     * API in a timely manner, or camera service will run into a fatal error.
+     *
+     * Note that this call serves as an optional hint and camera service may
+     * skip sending this call if all buffers are already returned.
+     *
+     * @param streamIds The ID of streams camera service need all of its
+     *     buffers returned.
+     *
+     * @param streamConfigCounter Note that due to concurrency nature, it is
+     *     possible the signalStreamFlush call arrives later than the
+     *     corresponding configureStreams_3_5 call, HAL must check
+     *     streamConfigCounter for such race condition. If the counter is less
+     *     than the counter in the last configureStreams_3_5 call HAL last
+     *     received, the call is stale and HAL should just return this call.
+     */
+    oneway signalStreamFlush(
+        vec<int32_t> streamIds,
+        uint32_t streamConfigCounter
+    );
+};
diff --git a/camera/device/3.5/default/Android.bp b/camera/device/3.5/default/Android.bp
new file mode 100644
index 0000000..7a48865
--- /dev/null
+++ b/camera/device/3.5/default/Android.bp
@@ -0,0 +1,102 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_library_headers {
+    name: "camera.device@3.5-impl_headers",
+    vendor: true,
+    export_include_dirs: ["include/device_v3_5_impl"]
+}
+
+cc_library_headers {
+    name: "camera.device@3.5-external-impl_headers",
+    vendor: true,
+    export_include_dirs: ["include/ext_device_v3_5_impl"]
+}
+
+cc_library_shared {
+    name: "camera.device@3.5-impl",
+    defaults: ["hidl_defaults"],
+    proprietary: true,
+    vendor: true,
+    srcs: [
+        "CameraDevice.cpp",
+        "CameraDeviceSession.cpp",
+    ],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libutils",
+        "libcutils",
+        "camera.device@3.2-impl",
+        "camera.device@3.3-impl",
+        "camera.device@3.4-impl",
+        "android.hardware.camera.device@3.2",
+        "android.hardware.camera.device@3.3",
+        "android.hardware.camera.device@3.4",
+        "android.hardware.camera.device@3.5",
+        "android.hardware.camera.provider@2.4",
+        "android.hardware.graphics.mapper@2.0",
+        "liblog",
+        "libhardware",
+        "libcamera_metadata",
+    ],
+    static_libs: [
+        "android.hardware.camera.common@1.0-helper",
+    ],
+    local_include_dirs: ["include/device_v3_5_impl"],
+}
+
+cc_library_shared {
+    name: "camera.device@3.5-external-impl",
+    defaults: ["hidl_defaults"],
+    proprietary: true,
+    vendor: true,
+    srcs: [
+        "ExternalCameraDevice.cpp",
+        "ExternalCameraDeviceSession.cpp",
+    ],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libutils",
+        "libcutils",
+        "camera.device@3.2-impl",
+        "camera.device@3.3-impl",
+        "camera.device@3.4-external-impl",
+        "android.hardware.camera.device@3.2",
+        "android.hardware.camera.device@3.3",
+        "android.hardware.camera.device@3.4",
+        "android.hardware.camera.device@3.5",
+        "android.hardware.camera.provider@2.4",
+        "android.hardware.graphics.mapper@2.0",
+        "liblog",
+        "libhardware",
+        "libcamera_metadata",
+        "libfmq",
+        "libsync",
+        "libyuv",
+        "libjpeg",
+        "libexif",
+        "libtinyxml2"
+    ],
+    static_libs: [
+        "android.hardware.camera.common@1.0-helper",
+    ],
+    local_include_dirs: ["include/ext_device_v3_5_impl"],
+    export_shared_lib_headers: [
+        "libfmq",
+    ],
+}
diff --git a/camera/device/3.5/default/CameraDevice.cpp b/camera/device/3.5/default/CameraDevice.cpp
new file mode 100644
index 0000000..a6969af
--- /dev/null
+++ b/camera/device/3.5/default/CameraDevice.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "CamDev@3.5-impl"
+#include <log/log.h>
+
+#include "CameraModule.h"
+#include "CameraDevice_3_5.h"
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+using namespace ::android::hardware::camera::device;
+using ::android::hardware::camera::common::V1_0::Status;
+using ::android::hardware::camera::device::V3_2::CameraMetadata;
+
+CameraDevice::CameraDevice(sp<CameraModule> module, const std::string& cameraId,
+        const SortedVector<std::pair<std::string, std::string>>& cameraDeviceNames) :
+        V3_4::implementation::CameraDevice(module, cameraId, cameraDeviceNames) {
+}
+
+CameraDevice::~CameraDevice() {
+}
+
+sp<V3_2::implementation::CameraDeviceSession> CameraDevice::createSession(camera3_device_t* device,
+        const camera_metadata_t* deviceInfo,
+        const sp<V3_2::ICameraDeviceCallback>& callback) {
+    sp<CameraDeviceSession> session = new CameraDeviceSession(device, deviceInfo, callback);
+    IF_ALOGV() {
+        session->getInterface()->interfaceChain([](
+            ::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
+                ALOGV("Session interface chain:");
+                for (auto iface : interfaceChain) {
+                    ALOGV("  %s", iface.c_str());
+                }
+            });
+    }
+    return session;
+}
+
+Return<void> CameraDevice::getPhysicalCameraCharacteristics(const hidl_string& physicalCameraId,
+        V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb) {
+    Status status = initStatus();
+    CameraMetadata cameraCharacteristics;
+    if (status == Status::OK) {
+        // Require module 2.5+ version.
+        if (mModule->getModuleApiVersion() < CAMERA_MODULE_API_VERSION_2_5) {
+            ALOGE("%s: get_physical_camera_info must be called on camera module 2.5 or newer",
+                    __FUNCTION__);
+            status = Status::INTERNAL_ERROR;
+        } else {
+            char *end;
+            errno = 0;
+            long id = strtol(physicalCameraId.c_str(), &end, 0);
+            if (id > INT_MAX || (errno == ERANGE && id == LONG_MAX) ||
+                    id < INT_MIN || (errno == ERANGE && id == LONG_MIN) ||
+                    *end != '\0') {
+                ALOGE("%s: Invalid physicalCameraId %s", __FUNCTION__, physicalCameraId.c_str());
+                status = Status::ILLEGAL_ARGUMENT;
+            } else {
+                camera_metadata_t *physicalInfo = nullptr;
+                int ret = mModule->getPhysicalCameraInfo((int)id, &physicalInfo);
+                if (ret == OK) {
+                    V3_2::implementation::convertToHidl(physicalInfo, &cameraCharacteristics);
+                } else if (ret == -EINVAL) {
+                    ALOGE("%s: %s is not a valid physical camera Id outside of getCameraIdList()",
+                            __FUNCTION__, physicalCameraId.c_str());
+                    status = Status::ILLEGAL_ARGUMENT;
+                } else {
+                    ALOGE("%s: Failed to get physical camera %s info: %s (%d)!", __FUNCTION__,
+                            physicalCameraId.c_str(), strerror(-ret), ret);
+                    status = Status::INTERNAL_ERROR;
+                }
+            }
+        }
+    }
+    _hidl_cb(status, cameraCharacteristics);
+    return Void();
+}
+
+// End of methods from ::android::hardware::camera::device::V3_2::ICameraDevice.
+
+} // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
+
diff --git a/camera/device/3.5/default/CameraDeviceSession.cpp b/camera/device/3.5/default/CameraDeviceSession.cpp
new file mode 100644
index 0000000..963893a
--- /dev/null
+++ b/camera/device/3.5/default/CameraDeviceSession.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "CamDevSession@3.5-impl"
+#include <android/log.h>
+
+#include <utils/Trace.h>
+#include "CameraDeviceSession.h"
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+CameraDeviceSession::CameraDeviceSession(
+    camera3_device_t* device,
+    const camera_metadata_t* deviceInfo,
+    const sp<V3_2::ICameraDeviceCallback>& callback) :
+        V3_4::implementation::CameraDeviceSession(device, deviceInfo, callback) {
+
+    mHasCallback_3_5 = false;
+
+    auto castResult = ICameraDeviceCallback::castFrom(callback);
+    if (castResult.isOk()) {
+        sp<ICameraDeviceCallback> callback3_5 = castResult;
+        if (callback3_5 != nullptr) {
+            mHasCallback_3_5 = true;
+        }
+    }
+}
+
+CameraDeviceSession::~CameraDeviceSession() {
+}
+
+Return<void> CameraDeviceSession::configureStreams_3_5(
+        const StreamConfiguration& requestedConfiguration,
+        ICameraDeviceSession::configureStreams_3_5_cb _hidl_cb)  {
+    return configureStreams_3_4(requestedConfiguration.v3_4, _hidl_cb);
+}
+
+Return<void> CameraDeviceSession::signalStreamFlush(
+        const hidl_vec<int32_t>& /*requests*/, uint32_t /*streamConfigCounter*/) {
+    return Void();
+}
+
+} // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
diff --git a/camera/device/3.5/default/ExternalCameraDevice.cpp b/camera/device/3.5/default/ExternalCameraDevice.cpp
new file mode 100644
index 0000000..e8d14b5
--- /dev/null
+++ b/camera/device/3.5/default/ExternalCameraDevice.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "ExtCamDev@3.5"
+//#define LOG_NDEBUG 0
+#include <log/log.h>
+
+#include "ExternalCameraDevice_3_5.h"
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+ExternalCameraDevice::ExternalCameraDevice(
+        const std::string& cameraId, const ExternalCameraConfig& cfg) :
+        V3_4::implementation::ExternalCameraDevice(cameraId, cfg) {}
+
+ExternalCameraDevice::~ExternalCameraDevice() {}
+
+Return<void> ExternalCameraDevice::getPhysicalCameraCharacteristics(const hidl_string&,
+        V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb) {
+    CameraMetadata cameraCharacteristics;
+    // External camera HAL doesn't support physical camera functions
+    _hidl_cb(Status::ILLEGAL_ARGUMENT, cameraCharacteristics);
+    return Void();
+}
+
+sp<V3_4::implementation::ExternalCameraDeviceSession> ExternalCameraDevice::createSession(
+        const sp<V3_2::ICameraDeviceCallback>& cb,
+        const ExternalCameraConfig& cfg,
+        const std::vector<SupportedV4L2Format>& sortedFormats,
+        const CroppingType& croppingType,
+        const common::V1_0::helper::CameraMetadata& chars,
+        const std::string& cameraId,
+        unique_fd v4l2Fd) {
+    return new ExternalCameraDeviceSession(
+            cb, cfg, sortedFormats, croppingType, chars, cameraId, std::move(v4l2Fd));
+}
+
+#define UPDATE(tag, data, size)                    \
+do {                                               \
+  if (metadata->update((tag), (data), (size))) {   \
+    ALOGE("Update " #tag " failed!");              \
+    return -EINVAL;                                \
+  }                                                \
+} while (0)
+
+status_t ExternalCameraDevice::initDefaultCharsKeys(
+        ::android::hardware::camera::common::V1_0::helper::CameraMetadata* metadata) {
+    status_t res =
+            V3_4::implementation::ExternalCameraDevice::initDefaultCharsKeys(metadata);
+
+    if (res != OK) {
+        return res;
+    }
+
+    const uint8_t bufMgrVer = ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION_HIDL_DEVICE_3_5;
+    UPDATE(ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION, &bufMgrVer, 1);
+
+    std::vector<int> availableCharacteristicsKeys = AVAILABLE_CHARACTERISTICS_KEYS_3_4;
+    availableCharacteristicsKeys.reserve(availableCharacteristicsKeys.size() +
+            EXTRA_CHARACTERISTICS_KEYS_3_5.size());
+    for (const auto& key : EXTRA_CHARACTERISTICS_KEYS_3_5) {
+        availableCharacteristicsKeys.push_back(key);
+    }
+    UPDATE(ANDROID_REQUEST_AVAILABLE_CHARACTERISTICS_KEYS,
+           availableCharacteristicsKeys.data(),
+           availableCharacteristicsKeys.size());
+
+    return OK;
+}
+
+#undef UPDATE
+
+}  // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
+
diff --git a/camera/device/3.5/default/ExternalCameraDeviceSession.cpp b/camera/device/3.5/default/ExternalCameraDeviceSession.cpp
new file mode 100644
index 0000000..ae7c45e
--- /dev/null
+++ b/camera/device/3.5/default/ExternalCameraDeviceSession.cpp
@@ -0,0 +1,303 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "ExtCamDevSsn@3.5"
+#include <android/log.h>
+
+#include <utils/Trace.h>
+#include "ExternalCameraDeviceSession.h"
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+ExternalCameraDeviceSession::ExternalCameraDeviceSession(
+        const sp<V3_2::ICameraDeviceCallback>& callback,
+        const ExternalCameraConfig& cfg,
+        const std::vector<SupportedV4L2Format>& sortedFormats,
+        const CroppingType& croppingType,
+        const common::V1_0::helper::CameraMetadata& chars,
+        const std::string& cameraId,
+        unique_fd v4l2Fd) :
+        V3_4::implementation::ExternalCameraDeviceSession(
+                callback, cfg, sortedFormats, croppingType, chars, cameraId, std::move(v4l2Fd)) {
+
+    mCallback_3_5 = nullptr;
+
+    auto castResult = V3_5::ICameraDeviceCallback::castFrom(callback);
+    if (castResult.isOk()) {
+        sp<V3_5::ICameraDeviceCallback> callback3_5 = castResult;
+        if (callback3_5 != nullptr) {
+            mCallback_3_5 = callback3_5;
+        }
+    }
+
+    if (mCallback_3_5 != nullptr) {
+        mSupportBufMgr = true;
+    }
+}
+
+ExternalCameraDeviceSession::~ExternalCameraDeviceSession() {
+    closeOutputThreadImpl();
+}
+
+Return<void> ExternalCameraDeviceSession::configureStreams_3_5(
+        const StreamConfiguration& requestedConfiguration,
+        ICameraDeviceSession::configureStreams_3_5_cb _hidl_cb)  {
+    return configureStreams_3_4(requestedConfiguration.v3_4, _hidl_cb);
+}
+
+Return<void> ExternalCameraDeviceSession::signalStreamFlush(
+        const hidl_vec<int32_t>& /*streamIds*/, uint32_t /*streamConfigCounter*/) {
+    return Void();
+}
+
+Status ExternalCameraDeviceSession::importRequestLocked(
+        const CaptureRequest& request,
+        hidl_vec<buffer_handle_t*>& allBufPtrs,
+        hidl_vec<int>& allFences) {
+    if (mSupportBufMgr) {
+        return importRequestLockedImpl(request, allBufPtrs, allFences, /*allowEmptyBuf*/ true);
+    }
+    return importRequestLockedImpl(request, allBufPtrs, allFences, /*allowEmptyBuf*/ false);
+}
+
+
+ExternalCameraDeviceSession::BufferRequestThread::BufferRequestThread(
+        wp<ExternalCameraDeviceSession> parent,
+        sp<V3_5::ICameraDeviceCallback> callbacks) :
+        mParent(parent),
+        mCallbacks(callbacks) {}
+
+int ExternalCameraDeviceSession::BufferRequestThread::requestBufferStart(
+        const std::vector<HalStreamBuffer>& bufReqs) {
+    if (bufReqs.empty()) {
+        ALOGE("%s: bufReqs is empty!", __FUNCTION__);
+        return -1;
+    }
+
+    {
+        std::lock_guard<std::mutex> lk(mLock);
+        if (mRequestingBuffer) {
+            ALOGE("%s: BufferRequestThread does not support more than one concurrent request!",
+                    __FUNCTION__);
+            return -1;
+        }
+
+        mBufferReqs = bufReqs;
+        mRequestingBuffer = true;
+    }
+    mRequestCond.notify_one();
+    return 0;
+}
+
+int ExternalCameraDeviceSession::BufferRequestThread::waitForBufferRequestDone(
+        std::vector<HalStreamBuffer>* outBufReq) {
+    std::unique_lock<std::mutex> lk(mLock);
+    if (!mRequestingBuffer) {
+        ALOGE("%s: no pending buffer request!", __FUNCTION__);
+        return -1;
+    }
+
+    if (mPendingReturnBufferReqs.empty()) {
+        std::chrono::milliseconds timeout = std::chrono::milliseconds(kReqProcTimeoutMs);
+        auto st = mRequestDoneCond.wait_for(lk, timeout);
+        if (st == std::cv_status::timeout) {
+            ALOGE("%s: wait for buffer request finish timeout!", __FUNCTION__);
+            return -1;
+        }
+    }
+    mRequestingBuffer = false;
+    *outBufReq = std::move(mPendingReturnBufferReqs);
+    mPendingReturnBufferReqs.clear();
+    return 0;
+}
+
+void ExternalCameraDeviceSession::BufferRequestThread::waitForNextRequest() {
+    ATRACE_CALL();
+    std::unique_lock<std::mutex> lk(mLock);
+    int waitTimes = 0;
+    while (mBufferReqs.empty()) {
+        if (exitPending()) {
+            return;
+        }
+        std::chrono::milliseconds timeout = std::chrono::milliseconds(kReqWaitTimeoutMs);
+        auto st = mRequestCond.wait_for(lk, timeout);
+        if (st == std::cv_status::timeout) {
+            waitTimes++;
+            if (waitTimes == kReqWaitTimesWarn) {
+                // BufferRequestThread just wait forever for new buffer request
+                // But it will print some periodic warning indicating it's waiting
+                ALOGV("%s: still waiting for new buffer request", __FUNCTION__);
+                waitTimes = 0;
+            }
+        }
+    }
+
+    // Fill in hidl BufferRequest
+    mHalBufferReqs.resize(mBufferReqs.size());
+    for (size_t i = 0; i < mHalBufferReqs.size(); i++) {
+        mHalBufferReqs[i].streamId = mBufferReqs[i].streamId;
+        mHalBufferReqs[i].numBuffersRequested = 1;
+    }
+}
+
+bool ExternalCameraDeviceSession::BufferRequestThread::threadLoop() {
+    waitForNextRequest();
+    if (exitPending()) {
+        return false;
+    }
+
+    ATRACE_BEGIN("HIDL requestStreamBuffers");
+    BufferRequestStatus status;
+    hidl_vec<StreamBufferRet> bufRets;
+    auto err = mCallbacks->requestStreamBuffers(mHalBufferReqs,
+            [&status, &bufRets]
+            (BufferRequestStatus s, const hidl_vec<StreamBufferRet>& rets) {
+                status = s;
+                bufRets = std::move(rets);
+            });
+    ATRACE_END();
+    if (!err.isOk()) {
+        ALOGE("%s: Transaction error: %s", __FUNCTION__, err.description().c_str());
+        return false;
+    }
+
+    std::unique_lock<std::mutex> lk(mLock);
+    if (status == BufferRequestStatus::OK || status == BufferRequestStatus::FAILED_PARTIAL) {
+        if (bufRets.size() != mHalBufferReqs.size()) {
+            ALOGE("%s: expect %zu buffer requests returned, only got %zu",
+                    __FUNCTION__, mHalBufferReqs.size(), bufRets.size());
+            return false;
+        }
+
+        auto parent = mParent.promote();
+        if (parent == nullptr) {
+            ALOGE("%s: session has been disconnected!", __FUNCTION__);
+            return false;
+        }
+
+        hidl_vec<int> importedFences;
+        importedFences.resize(bufRets.size());
+        for (size_t i = 0; i < bufRets.size(); i++) {
+            int streamId = bufRets[i].streamId;
+            switch (bufRets[i].val.getDiscriminator()) {
+                case StreamBuffersVal::hidl_discriminator::error:
+                    continue;
+                case StreamBuffersVal::hidl_discriminator::buffers: {
+                    const hidl_vec<V3_2::StreamBuffer>& hBufs = bufRets[i].val.buffers();
+                    if (hBufs.size() != 1) {
+                        ALOGE("%s: expect 1 buffer returned, got %zu!", __FUNCTION__, hBufs.size());
+                        return false;
+                    }
+                    const V3_2::StreamBuffer& hBuf = hBufs[0];
+
+                    mBufferReqs[i].bufferId = hBuf.bufferId;
+                    // TODO: create a batch import API so we don't need to lock/unlock mCbsLock
+                    // repeatedly?
+                    lk.unlock();
+                    Status s = parent->importBuffer(streamId,
+                            hBuf.bufferId, hBuf.buffer.getNativeHandle(),
+                            /*out*/&mBufferReqs[i].bufPtr,
+                            /*allowEmptyBuf*/false);
+                    lk.lock();
+
+                    if (s != Status::OK) {
+                        ALOGE("%s: stream %d import buffer failed!", __FUNCTION__, streamId);
+                        cleanupInflightFences(importedFences, i - 1);
+                        return false;
+                    }
+                    if (!sHandleImporter.importFence(hBuf.acquireFence,
+                            mBufferReqs[i].acquireFence)) {
+                        ALOGE("%s: stream %d import fence failed!", __FUNCTION__, streamId);
+                        cleanupInflightFences(importedFences, i - 1);
+                        return false;
+                    }
+                    importedFences[i] = mBufferReqs[i].acquireFence;
+                }
+                break;
+                default:
+                    ALOGE("%s: unkown StreamBuffersVal discrimator!", __FUNCTION__);
+                    return false;
+            }
+        }
+    } else {
+        ALOGE("%s: requestStreamBuffers call failed!", __FUNCTION__);
+    }
+
+    mPendingReturnBufferReqs = std::move(mBufferReqs);
+    mBufferReqs.clear();
+
+    lk.unlock();
+    mRequestDoneCond.notify_one();
+    return true;
+}
+
+void ExternalCameraDeviceSession::initOutputThread() {
+    if (mSupportBufMgr) {
+        mBufferRequestThread = new BufferRequestThread(this, mCallback_3_5);
+        mBufferRequestThread->run("ExtCamBufReq", PRIORITY_DISPLAY);
+    }
+    mOutputThread = new OutputThread(this, mCroppingType, mBufferRequestThread);
+}
+
+void ExternalCameraDeviceSession::closeOutputThreadImpl() {
+    if (mBufferRequestThread) {
+        mBufferRequestThread->requestExit();
+        mBufferRequestThread->join();
+        mBufferRequestThread.clear();
+    }
+}
+
+void ExternalCameraDeviceSession::closeOutputThread() {
+    closeOutputThreadImpl();
+    V3_4::implementation::ExternalCameraDeviceSession::closeOutputThread();
+}
+
+ExternalCameraDeviceSession::OutputThread::OutputThread(
+        wp<ExternalCameraDeviceSession> parent,
+        CroppingType ct,
+        sp<BufferRequestThread> bufReqThread) :
+        V3_4::implementation::ExternalCameraDeviceSession::OutputThread(parent, ct),
+        mBufferRequestThread(bufReqThread) {}
+
+ExternalCameraDeviceSession::OutputThread::~OutputThread() {}
+
+int ExternalCameraDeviceSession::OutputThread::requestBufferStart(
+        const std::vector<HalStreamBuffer>& bufs) {
+    if (mBufferRequestThread != nullptr) {
+        return mBufferRequestThread->requestBufferStart(bufs);
+    }
+    return 0;
+}
+
+int ExternalCameraDeviceSession::OutputThread::waitForBufferRequestDone(
+        /*out*/std::vector<HalStreamBuffer>* outBufs) {
+    if (mBufferRequestThread != nullptr) {
+        return mBufferRequestThread->waitForBufferRequestDone(outBufs);
+    }
+    return 0;
+}
+
+} // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
diff --git a/camera/device/3.5/default/OWNERS b/camera/device/3.5/default/OWNERS
new file mode 100644
index 0000000..369b204
--- /dev/null
+++ b/camera/device/3.5/default/OWNERS
@@ -0,0 +1,7 @@
+cychen@google.com
+epeev@google.com
+etalvala@google.com
+jchowdhary@google.com
+shuzhenwang@google.com
+yinchiayeh@google.com
+zhijunhe@google.com
diff --git a/camera/device/3.5/default/include/device_v3_5_impl/CameraDeviceSession.h b/camera/device/3.5/default/include/device_v3_5_impl/CameraDeviceSession.h
new file mode 100644
index 0000000..ec34769
--- /dev/null
+++ b/camera/device/3.5/default/include/device_v3_5_impl/CameraDeviceSession.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE3SESSION_H
+#define ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE3SESSION_H
+
+#include <android/hardware/camera/device/3.5/ICameraDevice.h>
+#include <android/hardware/camera/device/3.5/ICameraDeviceSession.h>
+#include <android/hardware/camera/device/3.5/ICameraDeviceCallback.h>
+#include <../../3.4/default/include/device_v3_4_impl/CameraDeviceSession.h>
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+using namespace ::android::hardware::camera::device;
+using ::android::hardware::camera::device::V3_2::CaptureRequest;
+using ::android::hardware::camera::device::V3_5::StreamConfiguration;
+using ::android::hardware::camera::device::V3_4::HalStreamConfiguration;
+using ::android::hardware::camera::device::V3_5::ICameraDeviceSession;
+using ::android::hardware::camera::device::V3_5::ICameraDeviceCallback;
+using ::android::hardware::camera::common::V1_0::Status;
+using ::android::hardware::camera::common::V1_0::helper::HandleImporter;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::hidl_string;
+using ::android::sp;
+using ::android::Mutex;
+
+struct CameraDeviceSession : public V3_4::implementation::CameraDeviceSession {
+
+    CameraDeviceSession(camera3_device_t*,
+            const camera_metadata_t* deviceInfo,
+            const sp<V3_2::ICameraDeviceCallback>&);
+    virtual ~CameraDeviceSession();
+
+    virtual sp<V3_2::ICameraDeviceSession> getInterface() override {
+        return new TrampolineSessionInterface_3_5(this);
+    }
+
+protected:
+    // Methods from v3.4 and earlier will trampoline to inherited implementation
+    Return<void> configureStreams_3_5(
+            const StreamConfiguration& requestedConfiguration,
+            ICameraDeviceSession::configureStreams_3_5_cb _hidl_cb);
+
+    Return<void> signalStreamFlush(
+            const hidl_vec<int32_t>& requests,
+            uint32_t streamConfigCounter);
+
+
+    // Whether this camera device session is created with version 3.5 callback.
+    bool mHasCallback_3_5;
+
+private:
+
+    struct TrampolineSessionInterface_3_5 : public ICameraDeviceSession {
+        TrampolineSessionInterface_3_5(sp<CameraDeviceSession> parent) :
+                mParent(parent) {}
+
+        virtual Return<void> constructDefaultRequestSettings(
+                V3_2::RequestTemplate type,
+                V3_3::ICameraDeviceSession::constructDefaultRequestSettings_cb _hidl_cb) override {
+            return mParent->constructDefaultRequestSettings(type, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams(
+                const V3_2::StreamConfiguration& requestedConfiguration,
+                V3_3::ICameraDeviceSession::configureStreams_cb _hidl_cb) override {
+            return mParent->configureStreams(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> processCaptureRequest_3_4(
+                const hidl_vec<V3_4::CaptureRequest>& requests,
+                const hidl_vec<V3_2::BufferCache>& cachesToRemove,
+                ICameraDeviceSession::processCaptureRequest_3_4_cb _hidl_cb) override {
+            return mParent->processCaptureRequest_3_4(requests, cachesToRemove, _hidl_cb);
+        }
+
+        virtual Return<void> processCaptureRequest(const hidl_vec<V3_2::CaptureRequest>& requests,
+                const hidl_vec<V3_2::BufferCache>& cachesToRemove,
+                V3_3::ICameraDeviceSession::processCaptureRequest_cb _hidl_cb) override {
+            return mParent->processCaptureRequest(requests, cachesToRemove, _hidl_cb);
+        }
+
+        virtual Return<void> getCaptureRequestMetadataQueue(
+                V3_3::ICameraDeviceSession::getCaptureRequestMetadataQueue_cb _hidl_cb) override  {
+            return mParent->getCaptureRequestMetadataQueue(_hidl_cb);
+        }
+
+        virtual Return<void> getCaptureResultMetadataQueue(
+                V3_3::ICameraDeviceSession::getCaptureResultMetadataQueue_cb _hidl_cb) override  {
+            return mParent->getCaptureResultMetadataQueue(_hidl_cb);
+        }
+
+        virtual Return<Status> flush() override {
+            return mParent->flush();
+        }
+
+        virtual Return<void> close() override {
+            return mParent->close();
+        }
+
+        virtual Return<void> configureStreams_3_3(
+                const V3_2::StreamConfiguration& requestedConfiguration,
+                configureStreams_3_3_cb _hidl_cb) override {
+            return mParent->configureStreams_3_3(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams_3_4(
+                const V3_4::StreamConfiguration& requestedConfiguration,
+                configureStreams_3_4_cb _hidl_cb) override {
+            return mParent->configureStreams_3_4(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams_3_5(
+                const StreamConfiguration& requestedConfiguration,
+                configureStreams_3_5_cb _hidl_cb) override {
+            return mParent->configureStreams_3_5(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> signalStreamFlush(
+                const hidl_vec<int32_t>& requests,
+                uint32_t streamConfigCounter) override {
+            return mParent->signalStreamFlush(requests, streamConfigCounter);
+        }
+
+    private:
+        sp<CameraDeviceSession> mParent;
+    };
+};
+
+}  // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE3SESSION_H
diff --git a/camera/device/3.5/default/include/device_v3_5_impl/CameraDevice_3_5.h b/camera/device/3.5/default/include/device_v3_5_impl/CameraDevice_3_5.h
new file mode 100644
index 0000000..6bdc60f
--- /dev/null
+++ b/camera/device/3.5/default/include/device_v3_5_impl/CameraDevice_3_5.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE_H
+#define ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE_H
+
+#include "CameraDeviceSession.h"
+#include <../../../../3.4/default/include/device_v3_4_impl/CameraDevice_3_4.h>
+
+#include <android/hardware/camera/device/3.5/ICameraDevice.h>
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+using namespace ::android::hardware::camera::device;
+
+using ::android::hardware::camera::common::V1_0::helper::CameraModule;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::hidl_string;
+using ::android::hardware::camera::common::V1_0::TorchMode;
+using ::android::hardware::camera::common::V1_0::helper::CameraModule;
+using ::android::hardware::camera::common::V1_0::Status;
+using ::android::sp;
+
+struct CameraDevice : public V3_4::implementation::CameraDevice {
+    // Called by provider HAL.
+    // Provider HAL must ensure the uniqueness of CameraDevice object per cameraId, or there could
+    // be multiple CameraDevice trying to access the same physical camera.  Also, provider will have
+    // to keep track of all CameraDevice objects in order to notify CameraDevice when the underlying
+    // camera is detached.
+    // Delegates nearly all work to CameraDevice_3_4
+    CameraDevice(sp<CameraModule> module,
+                 const std::string& cameraId,
+                 const SortedVector<std::pair<std::string, std::string>>& cameraDeviceNames);
+    virtual ~CameraDevice();
+
+    virtual sp<V3_2::ICameraDevice> getInterface() override {
+        return new TrampolineDeviceInterface_3_5(this);
+    }
+
+protected:
+    virtual sp<V3_2::implementation::CameraDeviceSession> createSession(camera3_device_t*,
+            const camera_metadata_t* deviceInfo,
+            const sp<V3_2::ICameraDeviceCallback>&) override;
+
+    Return<void> getPhysicalCameraCharacteristics(const hidl_string& physicalCameraId,
+            V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb);
+
+private:
+    struct TrampolineDeviceInterface_3_5 : public ICameraDevice {
+        TrampolineDeviceInterface_3_5(sp<CameraDevice> parent) :
+            mParent(parent) {}
+
+        virtual Return<void> getResourceCost(V3_2::ICameraDevice::getResourceCost_cb _hidl_cb)
+                override {
+            return mParent->getResourceCost(_hidl_cb);
+        }
+
+        virtual Return<void> getCameraCharacteristics(
+                V3_2::ICameraDevice::getCameraCharacteristics_cb _hidl_cb) override {
+            return mParent->getCameraCharacteristics(_hidl_cb);
+        }
+
+        virtual Return<Status> setTorchMode(TorchMode mode) override {
+            return mParent->setTorchMode(mode);
+        }
+
+        virtual Return<void> open(const sp<V3_2::ICameraDeviceCallback>& callback,
+                V3_2::ICameraDevice::open_cb _hidl_cb) override {
+            return mParent->open(callback, _hidl_cb);
+        }
+
+        virtual Return<void> dumpState(const hidl_handle& fd) override {
+            return mParent->dumpState(fd);
+        }
+
+        virtual Return<void> getPhysicalCameraCharacteristics(const hidl_string& physicalCameraId,
+                V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb) override {
+            return mParent->getPhysicalCameraCharacteristics(physicalCameraId, _hidl_cb);
+        }
+    private:
+        sp<CameraDevice> mParent;
+    };
+};
+
+}  // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
+
+#endif // ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE_H
diff --git a/camera/device/3.5/default/include/ext_device_v3_5_impl/ExternalCameraDeviceSession.h b/camera/device/3.5/default/include/ext_device_v3_5_impl/ExternalCameraDeviceSession.h
new file mode 100644
index 0000000..4d2d6b7
--- /dev/null
+++ b/camera/device/3.5/default/include/ext_device_v3_5_impl/ExternalCameraDeviceSession.h
@@ -0,0 +1,256 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_EXTCAMERADEVICE3SESSION_H
+#define ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_EXTCAMERADEVICE3SESSION_H
+
+#include <android/hardware/camera/device/3.5/ICameraDeviceCallback.h>
+#include <android/hardware/camera/device/3.5/ICameraDeviceSession.h>
+#include <../../3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h>
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+using ::android::hardware::camera::device::V3_2::BufferCache;
+using ::android::hardware::camera::device::V3_5::BufferRequest;
+using ::android::hardware::camera::device::V3_5::BufferRequestStatus;
+using ::android::hardware::camera::device::V3_2::BufferStatus;
+using ::android::hardware::camera::device::V3_2::CameraMetadata;
+using ::android::hardware::camera::device::V3_2::CaptureRequest;
+using ::android::hardware::camera::device::V3_2::CaptureResult;
+using ::android::hardware::camera::device::V3_2::ErrorCode;
+using ::android::hardware::camera::device::V3_5::ICameraDeviceCallback;
+using ::android::hardware::camera::device::V3_2::MsgType;
+using ::android::hardware::camera::device::V3_2::NotifyMsg;
+using ::android::hardware::camera::device::V3_2::RequestTemplate;
+using ::android::hardware::camera::device::V3_2::Stream;
+using ::android::hardware::camera::device::V3_5::StreamConfiguration;
+using ::android::hardware::camera::device::V3_2::StreamConfigurationMode;
+using ::android::hardware::camera::device::V3_2::StreamRotation;
+using ::android::hardware::camera::device::V3_2::StreamType;
+using ::android::hardware::camera::device::V3_2::DataspaceFlags;
+using ::android::hardware::camera::device::V3_2::CameraBlob;
+using ::android::hardware::camera::device::V3_2::CameraBlobId;
+using ::android::hardware::camera::device::V3_4::HalStreamConfiguration;
+using ::android::hardware::camera::device::V3_5::ICameraDeviceSession;
+using ::android::hardware::camera::common::V1_0::Status;
+using ::android::hardware::camera::common::V1_0::helper::HandleImporter;
+using ::android::hardware::camera::common::V1_0::helper::ExifUtils;
+using ::android::hardware::camera::external::common::ExternalCameraConfig;
+using ::android::hardware::camera::external::common::Size;
+using ::android::hardware::camera::external::common::SizeHasher;
+using ::android::hardware::graphics::common::V1_0::BufferUsage;
+using ::android::hardware::graphics::common::V1_0::Dataspace;
+using ::android::hardware::graphics::common::V1_0::PixelFormat;
+using ::android::hardware::kSynchronizedReadWrite;
+using ::android::hardware::MessageQueue;
+using ::android::hardware::MQDescriptorSync;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::hidl_string;
+using ::android::sp;
+using ::android::Mutex;
+using ::android::base::unique_fd;
+
+using ::android::hardware::camera::device::V3_4::implementation::SupportedV4L2Format;
+using ::android::hardware::camera::device::V3_4::implementation::CroppingType;
+
+struct ExternalCameraDeviceSession : public V3_4::implementation::ExternalCameraDeviceSession {
+
+    ExternalCameraDeviceSession(const sp<V3_2::ICameraDeviceCallback>&,
+            const ExternalCameraConfig& cfg,
+            const std::vector<SupportedV4L2Format>& sortedFormats,
+            const CroppingType& croppingType,
+            const common::V1_0::helper::CameraMetadata& chars,
+            const std::string& cameraId,
+            unique_fd v4l2Fd);
+    virtual ~ExternalCameraDeviceSession();
+
+    // Retrieve the HIDL interface, split into its own class to avoid inheritance issues when
+    // dealing with minor version revs and simultaneous implementation and interface inheritance
+    virtual sp<V3_4::ICameraDeviceSession> getInterface() override {
+        return new TrampolineSessionInterface_3_5(this);
+    }
+
+protected:
+    // Methods from v3.4 and earlier will trampoline to inherited implementation
+    Return<void> configureStreams_3_5(
+            const StreamConfiguration& requestedConfiguration,
+            ICameraDeviceSession::configureStreams_3_5_cb _hidl_cb);
+
+    Return<void> signalStreamFlush(
+            const hidl_vec<int32_t>& requests,
+            uint32_t streamConfigCounter);
+
+    virtual void initOutputThread() override;
+    virtual void closeOutputThread() override;
+    void closeOutputThreadImpl();
+
+    virtual Status importRequestLocked(
+            const CaptureRequest& request,
+            hidl_vec<buffer_handle_t*>& allBufPtrs,
+            hidl_vec<int>& allFences) override;
+
+    class BufferRequestThread : public android::Thread {
+    public:
+        BufferRequestThread(
+                wp<ExternalCameraDeviceSession> parent,
+                sp<V3_5::ICameraDeviceCallback> callbacks);
+
+        int requestBufferStart(const std::vector<HalStreamBuffer>&);
+        int waitForBufferRequestDone(
+                /*out*/std::vector<HalStreamBuffer>*);
+
+        virtual bool threadLoop() override;
+
+    private:
+        void waitForNextRequest();
+
+        const wp<ExternalCameraDeviceSession> mParent;
+        const sp<V3_5::ICameraDeviceCallback> mCallbacks;
+
+        std::mutex mLock;
+        bool mRequestingBuffer = false;
+
+        std::vector<HalStreamBuffer> mBufferReqs;
+        std::vector<HalStreamBuffer> mPendingReturnBufferReqs;
+        // mHalBufferReqs is not under mLock protection during the HIDL transaction
+        hidl_vec<BufferRequest>      mHalBufferReqs;
+
+        // request buffers takes much less time in steady state, but can take much longer
+        // when requesting 1st buffer from a stream.
+        // TODO: consider a separate timeout for new vs. steady state?
+        // TODO: or make sure framework is warming up the pipeline during configure new stream?
+        static const int kReqProcTimeoutMs = 66;
+
+        static const int kReqWaitTimeoutMs = 33;
+        static const int kReqWaitTimesWarn = 90;  // 33ms * 90 ~= 3 sec
+        std::condition_variable mRequestCond;     // signaled when a new buffer request incoming
+        std::condition_variable mRequestDoneCond; // signaled when a request is done
+    };
+
+    sp<BufferRequestThread> mBufferRequestThread;
+
+    class OutputThread :
+            public V3_4::implementation::ExternalCameraDeviceSession::OutputThread {
+    public:
+        // TODO: pass buffer request thread to OutputThread ctor
+        OutputThread(wp<ExternalCameraDeviceSession> parent, CroppingType,
+                sp<BufferRequestThread> bufReqThread);
+        virtual ~OutputThread();
+
+    protected:
+        // Methods to request output buffer in parallel
+        virtual int requestBufferStart(const std::vector<HalStreamBuffer>&) override;
+        virtual int waitForBufferRequestDone(
+                /*out*/std::vector<HalStreamBuffer>*) override;
+
+        const sp<BufferRequestThread> mBufferRequestThread;
+    };
+
+    sp<V3_5::ICameraDeviceCallback> mCallback_3_5;
+    bool mSupportBufMgr;
+
+private:
+
+    struct TrampolineSessionInterface_3_5 : public ICameraDeviceSession {
+        TrampolineSessionInterface_3_5(sp<ExternalCameraDeviceSession> parent) :
+                mParent(parent) {}
+
+        virtual Return<void> constructDefaultRequestSettings(
+                RequestTemplate type,
+                V3_3::ICameraDeviceSession::constructDefaultRequestSettings_cb _hidl_cb) override {
+            return mParent->constructDefaultRequestSettings(type, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams(
+                const V3_2::StreamConfiguration& requestedConfiguration,
+                V3_3::ICameraDeviceSession::configureStreams_cb _hidl_cb) override {
+            return mParent->configureStreams(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> processCaptureRequest(const hidl_vec<V3_2::CaptureRequest>& requests,
+                const hidl_vec<V3_2::BufferCache>& cachesToRemove,
+                V3_3::ICameraDeviceSession::processCaptureRequest_cb _hidl_cb) override {
+            return mParent->processCaptureRequest(requests, cachesToRemove, _hidl_cb);
+        }
+
+        virtual Return<void> getCaptureRequestMetadataQueue(
+                V3_3::ICameraDeviceSession::getCaptureRequestMetadataQueue_cb _hidl_cb) override  {
+            return mParent->getCaptureRequestMetadataQueue(_hidl_cb);
+        }
+
+        virtual Return<void> getCaptureResultMetadataQueue(
+                V3_3::ICameraDeviceSession::getCaptureResultMetadataQueue_cb _hidl_cb) override  {
+            return mParent->getCaptureResultMetadataQueue(_hidl_cb);
+        }
+
+        virtual Return<Status> flush() override {
+            return mParent->flush();
+        }
+
+        virtual Return<void> close() override {
+            return mParent->close();
+        }
+
+        virtual Return<void> configureStreams_3_3(
+                const V3_2::StreamConfiguration& requestedConfiguration,
+                configureStreams_3_3_cb _hidl_cb) override {
+            return mParent->configureStreams_3_3(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams_3_4(
+                const V3_4::StreamConfiguration& requestedConfiguration,
+                configureStreams_3_4_cb _hidl_cb) override {
+            return mParent->configureStreams_3_4(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> processCaptureRequest_3_4(const hidl_vec<V3_4::CaptureRequest>& requests,
+                const hidl_vec<V3_2::BufferCache>& cachesToRemove,
+                ICameraDeviceSession::processCaptureRequest_3_4_cb _hidl_cb) override {
+            return mParent->processCaptureRequest_3_4(requests, cachesToRemove, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams_3_5(
+                const StreamConfiguration& requestedConfiguration,
+                configureStreams_3_5_cb _hidl_cb) override {
+            return mParent->configureStreams_3_5(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> signalStreamFlush(
+                const hidl_vec<int32_t>& requests,
+                uint32_t streamConfigCounter) override {
+            return mParent->signalStreamFlush(requests, streamConfigCounter);
+        }
+
+    private:
+        sp<ExternalCameraDeviceSession> mParent;
+    };
+};
+
+}  // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_EXTCAMERADEVICE3SESSION_H
diff --git a/camera/device/3.5/default/include/ext_device_v3_5_impl/ExternalCameraDevice_3_5.h b/camera/device/3.5/default/include/ext_device_v3_5_impl/ExternalCameraDevice_3_5.h
new file mode 100644
index 0000000..7db86dc
--- /dev/null
+++ b/camera/device/3.5/default/include/ext_device_v3_5_impl/ExternalCameraDevice_3_5.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_EXTCAMERADEVICE_H
+#define ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_EXTCAMERADEVICE_H
+
+#include "utils/Mutex.h"
+#include "CameraMetadata.h"
+
+#include <android/hardware/camera/device/3.5/ICameraDevice.h>
+#include <android/hardware/camera/device/3.5/ICameraDeviceCallback.h>
+#include <hidl/Status.h>
+#include <hidl/MQDescriptor.h>
+#include "ExternalCameraDeviceSession.h"
+#include <../../../../3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h>
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+using namespace ::android::hardware::camera::device;
+using ::android::hardware::camera::device::V3_5::ICameraDevice;
+using ::android::hardware::camera::common::V1_0::CameraResourceCost;
+using ::android::hardware::camera::common::V1_0::TorchMode;
+using ::android::hardware::camera::common::V1_0::Status;
+using ::android::hardware::camera::external::common::ExternalCameraConfig;
+using ::android::hardware::camera::external::common::Size;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::hidl_string;
+using ::android::sp;
+
+/*
+ * The camera device HAL implementation is opened lazily (via the open call)
+ */
+struct ExternalCameraDevice : public V3_4::implementation::ExternalCameraDevice {
+
+    // Called by external camera provider HAL.
+    // Provider HAL must ensure the uniqueness of CameraDevice object per cameraId, or there could
+    // be multiple CameraDevice trying to access the same physical camera.  Also, provider will have
+    // to keep track of all CameraDevice objects in order to notify CameraDevice when the underlying
+    // camera is detached.
+    ExternalCameraDevice(const std::string& cameraId, const ExternalCameraConfig& cfg);
+    virtual ~ExternalCameraDevice();
+
+    virtual sp<V3_2::ICameraDevice> getInterface() override {
+        return new TrampolineDeviceInterface_3_5(this);
+    }
+
+    Return<void> getPhysicalCameraCharacteristics(const hidl_string& physicalCameraId,
+            V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb);
+
+protected:
+    virtual sp<V3_4::implementation::ExternalCameraDeviceSession> createSession(
+            const sp<V3_2::ICameraDeviceCallback>&,
+            const ExternalCameraConfig& cfg,
+            const std::vector<SupportedV4L2Format>& sortedFormats,
+            const CroppingType& croppingType,
+            const common::V1_0::helper::CameraMetadata& chars,
+            const std::string& cameraId,
+            unique_fd v4l2Fd) override;
+
+    virtual status_t initDefaultCharsKeys(
+            ::android::hardware::camera::common::V1_0::helper::CameraMetadata*) override;
+
+    const std::vector<int32_t> EXTRA_CHARACTERISTICS_KEYS_3_5 = {
+        ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION
+    };
+
+private:
+    struct TrampolineDeviceInterface_3_5 : public ICameraDevice {
+        TrampolineDeviceInterface_3_5(sp<ExternalCameraDevice> parent) :
+            mParent(parent) {}
+
+        virtual Return<void> getResourceCost(V3_2::ICameraDevice::getResourceCost_cb _hidl_cb)
+                override {
+            return mParent->getResourceCost(_hidl_cb);
+        }
+
+        virtual Return<void> getCameraCharacteristics(
+                V3_2::ICameraDevice::getCameraCharacteristics_cb _hidl_cb) override {
+            return mParent->getCameraCharacteristics(_hidl_cb);
+        }
+
+        virtual Return<Status> setTorchMode(TorchMode mode) override {
+            return mParent->setTorchMode(mode);
+        }
+
+        virtual Return<void> open(const sp<V3_2::ICameraDeviceCallback>& callback,
+                V3_2::ICameraDevice::open_cb _hidl_cb) override {
+            return mParent->open(callback, _hidl_cb);
+        }
+
+        virtual Return<void> dumpState(const hidl_handle& fd) override {
+            return mParent->dumpState(fd);
+        }
+
+        virtual Return<void> getPhysicalCameraCharacteristics(const hidl_string& physicalCameraId,
+                V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb) override {
+            return mParent->getPhysicalCameraCharacteristics(physicalCameraId, _hidl_cb);
+        }
+    private:
+        sp<ExternalCameraDevice> mParent;
+    };
+};
+
+}  // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_EXTCAMERADEVICE_H
diff --git a/camera/device/3.5/types.hal b/camera/device/3.5/types.hal
new file mode 100644
index 0000000..613187d
--- /dev/null
+++ b/camera/device/3.5/types.hal
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.camera.device@3.5;
+
+import @3.2::StreamBuffer;
+import @3.4::StreamConfiguration;
+
+/**
+ * StreamConfiguration:
+ *
+ * Identical to @3.4::StreamConfiguration, except that it contains streamConfigCounter
+ */
+struct StreamConfiguration {
+    @3.4::StreamConfiguration v3_4;
+
+    /**
+     * An incrementing counter used for HAL to keep track of the stream
+     * configuration and the paired oneway signalStreamFlush call. When the
+     * counter in signalStreamFlush call is less than the counter here, that
+     * signalStreamFlush call is stale.
+     */
+    uint32_t streamConfigCounter;
+};
+
+enum StreamBufferRequestError : uint32_t {
+    /**
+     * Get buffer failed due to timeout waiting for an available buffer. This is
+     * likely due to the client application holding too many buffers, or the
+     * system is under memory pressure.
+     * This is not a fatal error. HAL may try to request buffer for this stream
+     * later. If HAL cannot get a buffer for certain capture request in time
+     * due to this error, HAL can send an ERROR_REQUEST to camera service and
+     * drop processing that request.
+     */
+    NO_BUFFER_AVAILABLE = 1,
+
+    /**
+     * Get buffer failed due to HAL has reached its maxBuffer count. This is not
+     * a fatal error. HAL may try to request buffer for this stream again after
+     * it returns at least one buffer of that stream to camera service.
+     */
+    MAX_BUFFER_EXCEEDED = 2,
+
+    /**
+     * Get buffer failed due to the stream is disconnected by client
+     * application, has been removed, or not recognized by camera service.
+     * This means application is no longer interested in this stream.
+     * Requesting buffer for this stream must never succeed after this error is
+     * returned. HAL must safely return all buffers of this stream after
+     * getting this error. If HAL gets another capture request later targeting
+     * a disconnected stream, HAL must send an ERROR_REQUEST to camera service
+     * and drop processing that request.
+     */
+    STREAM_DISCONNECTED = 3,
+
+    /**
+     * Get buffer failed for unknown reasons. This is a fatal error and HAL must
+     * send ERROR_DEVICE to camera service and be ready to be closed.
+     */
+    UNKNOWN_ERROR = 4
+};
+
+/**
+ * Per-stream return value for requestStreamBuffers.
+ * For each stream, either an StreamBufferRequestError error code, or all
+ * requested buffers for this stream is returned, so buffers.size() must be
+ * equal to BufferRequest::numBuffersRequested of corresponding stream.
+ */
+safe_union StreamBuffersVal {
+    StreamBufferRequestError error;
+    vec<@3.2::StreamBuffer> buffers;
+};
+
+struct StreamBufferRet {
+    int32_t streamId;
+    StreamBuffersVal val;
+};
+
+enum BufferRequestStatus : uint32_t {
+    /**
+     * Method call succeeded and all requested buffers are returned.
+     */
+    OK = 0,
+
+    /**
+     * Method call failed for some streams. Check per stream status for each
+     * returned StreamBufferRet.
+     */
+    FAILED_PARTIAL = 1,
+
+    /**
+     * Method call failed for all streams and no buffers are returned at all.
+     * Camera service is about to or is performing configureStreams. HAL must
+     * wait until next configureStreams call is finished before requesting
+     * buffers again.
+     */
+    FAILED_CONFIGURING = 2,
+
+    /**
+     * Method call failed for all streams and no buffers are returned at all.
+     * Failure due to bad BufferRequest input, eg: unknown streamId or repeated
+     * streamId.
+     */
+    FAILED_ILLEGAL_ARGUMENTS = 3,
+
+    /**
+     * Method call failed for all streams and no buffers are returned at all.
+     * Failure due to unknown reason.
+     */
+    FAILED_UNKNOWN = 4,
+};
+
+struct BufferRequest {
+    int32_t streamId;
+    uint32_t numBuffersRequested;
+};
+
diff --git a/camera/metadata/3.2/types.hal b/camera/metadata/3.2/types.hal
index 67b4e44..cef0397 100644
--- a/camera/metadata/3.2/types.hal
+++ b/camera/metadata/3.2/types.hal
@@ -1396,7 +1396,8 @@
      *
      * <p>The arrangement of color filters on sensor;
      * represents the colors in the top-left 2x2 section of
-     * the sensor, in reading order.</p>
+     * the sensor, in reading order, for a Bayer camera, or the
+     * light spectrum it captures for MONOCHROME camera.</p>
      */
     ANDROID_SENSOR_INFO_COLOR_FILTER_ARRANGEMENT,
 
diff --git a/camera/metadata/3.3/types.hal b/camera/metadata/3.3/types.hal
index 04edfe9..d21bb7c 100644
--- a/camera/metadata/3.3/types.hal
+++ b/camera/metadata/3.3/types.hal
@@ -100,7 +100,7 @@
 
     /** android.request.availablePhysicalCameraRequestKeys [static, int32[], hidden]
      *
-     * <p>A subset of the available request keys that can be overriden for
+     * <p>A subset of the available request keys that can be overridden for
      * physical devices backing a logical multi-camera.</p>
      */
     ANDROID_REQUEST_AVAILABLE_PHYSICAL_CAMERA_REQUEST_KEYS,
@@ -109,8 +109,8 @@
 
     /** android.statistics.oisDataMode [dynamic, enum, public]
      *
-     * <p>A control for selecting whether OIS position information is included in output
-     * result metadata.</p>
+     * <p>A control for selecting whether optical stabilization (OIS) position
+     * information is included in output result metadata.</p>
      */
     ANDROID_STATISTICS_OIS_DATA_MODE = android.hardware.camera.metadata@3.2::CameraMetadataTag:ANDROID_STATISTICS_END,
 
diff --git a/camera/metadata/3.4/Android.bp b/camera/metadata/3.4/Android.bp
new file mode 100644
index 0000000..388df68
--- /dev/null
+++ b/camera/metadata/3.4/Android.bp
@@ -0,0 +1,22 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.camera.metadata@3.4",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+    ],
+    interfaces: [
+        "android.hardware.camera.metadata@3.2",
+        "android.hardware.camera.metadata@3.3",
+    ],
+    types: [
+        "CameraMetadataEnumAndroidInfoSupportedBufferManagementVersion",
+        "CameraMetadataTag",
+    ],
+    gen_java: true,
+}
+
diff --git a/camera/metadata/3.4/types.hal b/camera/metadata/3.4/types.hal
new file mode 100644
index 0000000..4eb6929
--- /dev/null
+++ b/camera/metadata/3.4/types.hal
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * Autogenerated from camera metadata definitions in
+ * /system/media/camera/docs/metadata_definitions.xml
+ * *** DO NOT EDIT BY HAND ***
+ */
+
+package android.hardware.camera.metadata@3.4;
+
+/* Include definitions from all prior minor HAL metadata revisions */
+import android.hardware.camera.metadata@3.2;
+import android.hardware.camera.metadata@3.3;
+
+// No new metadata sections added in this revision
+
+/**
+ * Main enumeration for defining camera metadata tags added in this revision
+ *
+ * <p>Partial documentation is included for each tag; for complete documentation, reference
+ * '/system/media/camera/docs/docs.html' in the corresponding Android source tree.</p>
+ */
+enum CameraMetadataTag : @3.3::CameraMetadataTag {
+    /** android.request.characteristicKeysNeedingPermission [static, int32[], hidden]
+     *
+     * <p>A list of camera characteristics keys that are only available
+     * in case the camera client has camera permission.</p>
+     */
+    ANDROID_REQUEST_CHARACTERISTIC_KEYS_NEEDING_PERMISSION = android.hardware.camera.metadata@3.3::CameraMetadataTag:ANDROID_REQUEST_END_3_3,
+
+    ANDROID_REQUEST_END_3_4,
+
+    /** android.scaler.availableRecommendedStreamConfigurations [static, enum[], ndk_public]
+     *
+     * <p>Recommended stream configurations for common client use cases.</p>
+     */
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS = android.hardware.camera.metadata@3.2::CameraMetadataTag:ANDROID_SCALER_END,
+
+    /** android.scaler.availableRecommendedInputOutputFormatsMap [static, int32, ndk_public]
+     *
+     * <p>Recommended mappings of image formats that are supported by this
+     * camera device for input streams, to their corresponding output formats.</p>
+     */
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_INPUT_OUTPUT_FORMATS_MAP,
+
+    ANDROID_SCALER_END_3_4,
+
+    /** android.info.supportedBufferManagementVersion [static, enum, system]
+     *
+     * <p>The version of buffer management API this camera device supports and opts into.</p>
+     */
+    ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION = android.hardware.camera.metadata@3.3::CameraMetadataTag:ANDROID_INFO_END_3_3,
+
+    ANDROID_INFO_END_3_4,
+
+    /** android.depth.availableRecommendedDepthStreamConfigurations [static, int32[], ndk_public]
+     *
+     * <p>Recommended depth stream configurations for common client use cases.</p>
+     */
+    ANDROID_DEPTH_AVAILABLE_RECOMMENDED_DEPTH_STREAM_CONFIGURATIONS = android.hardware.camera.metadata@3.2::CameraMetadataTag:ANDROID_DEPTH_END,
+
+    ANDROID_DEPTH_END_3_4,
+
+};
+
+/*
+ * Enumeration definitions for the various entries that need them
+ */
+
+/** android.scaler.availableFormats enumeration values added since v3.2
+ * @see ANDROID_SCALER_AVAILABLE_FORMATS
+ */
+enum CameraMetadataEnumAndroidScalerAvailableFormats :
+        @3.2::CameraMetadataEnumAndroidScalerAvailableFormats {
+    ANDROID_SCALER_AVAILABLE_FORMATS_RAW10                      = 0x25,
+    ANDROID_SCALER_AVAILABLE_FORMATS_RAW12                      = 0x26,
+    ANDROID_SCALER_AVAILABLE_FORMATS_Y8                         = 0x20203859,
+};
+
+/** android.scaler.availableRecommendedStreamConfigurations enumeration values
+ * @see ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS
+ */
+enum CameraMetadataEnumAndroidScalerAvailableRecommendedStreamConfigurations : uint32_t {
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_PREVIEW
+                                                                 = 0x0,
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_RECORD
+                                                                 = 0x1,
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_VIDEO_SNAPSHOT
+                                                                 = 0x2,
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_SNAPSHOT
+                                                                 = 0x3,
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_ZSL
+                                                                 = 0x4,
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_RAW
+                                                                 = 0x5,
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_PUBLIC_END
+                                                                 = 0x6,
+    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_VENDOR_START
+                                                                 = 0x18,
+};
+
+/** android.info.supportedBufferManagementVersion enumeration values
+ * @see ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION
+ */
+enum CameraMetadataEnumAndroidInfoSupportedBufferManagementVersion : uint32_t {
+    ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION_HIDL_DEVICE_3_5,
+};
diff --git a/camera/provider/2.4/default/Android.bp b/camera/provider/2.4/default/Android.bp
index ae24d78..167954c 100644
--- a/camera/provider/2.4/default/Android.bp
+++ b/camera/provider/2.4/default/Android.bp
@@ -14,11 +14,14 @@
         "android.hardware.camera.device@3.2",
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
+        "android.hardware.camera.device@3.5",
         "camera.device@1.0-impl",
         "camera.device@3.2-impl",
         "camera.device@3.3-impl",
         "camera.device@3.4-impl",
+        "camera.device@3.5-impl",
         "camera.device@3.4-external-impl",
+        "camera.device@3.5-external-impl",
         "android.hardware.camera.provider@2.4",
         "android.hardware.camera.common@1.0",
         "android.hardware.graphics.mapper@2.0",
@@ -31,7 +34,9 @@
     ],
     header_libs: [
         "camera.device@3.4-impl_headers",
-        "camera.device@3.4-external-impl_headers"
+        "camera.device@3.5-impl_headers",
+        "camera.device@3.4-external-impl_headers",
+        "camera.device@3.5-external-impl_headers"
     ],
     static_libs: [
         "android.hardware.camera.common@1.0-helper",
@@ -56,6 +61,7 @@
         "android.hardware.camera.device@3.2",
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
+        "android.hardware.camera.device@3.5",
         "android.hardware.camera.provider@2.4",
         "android.hardware.camera.common@1.0",
     ],
@@ -80,6 +86,7 @@
         "android.hardware.camera.device@3.2",
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
+        "android.hardware.camera.device@3.5",
         "android.hardware.camera.provider@2.4",
         "android.hardware.camera.common@1.0",
     ],
@@ -102,6 +109,8 @@
         "android.hardware.camera.device@1.0",
         "android.hardware.camera.device@3.2",
         "android.hardware.camera.device@3.3",
+        "android.hardware.camera.device@3.4",
+        "android.hardware.camera.device@3.5",
         "android.hardware.camera.provider@2.4",
         "android.hardware.camera.common@1.0",
     ],
diff --git a/camera/provider/2.4/default/CameraProvider.cpp b/camera/provider/2.4/default/CameraProvider.cpp
index 6313939..488b9af 100644
--- a/camera/provider/2.4/default/CameraProvider.cpp
+++ b/camera/provider/2.4/default/CameraProvider.cpp
@@ -23,6 +23,7 @@
 #include "CameraDevice_1_0.h"
 #include "CameraDevice_3_3.h"
 #include "CameraDevice_3_4.h"
+#include "CameraDevice_3_5.h"
 #include <cutils/properties.h>
 #include <string.h>
 #include <utils/Trace.h>
@@ -43,6 +44,7 @@
 const char *kHAL3_2 = "3.2";
 const char *kHAL3_3 = "3.3";
 const char *kHAL3_4 = "3.4";
+const char *kHAL3_5 = "3.5";
 const char *kHAL1_0 = "1.0";
 const int kMaxCameraDeviceNameLen = 128;
 const int kMaxCameraIdLen = 16;
@@ -250,7 +252,11 @@
     int versionMajor = isV1 ? 1 : 3;
     int versionMinor = isV1 ? 0 : mPreferredHal3MinorVersion;
     if (deviceVersion == CAMERA_DEVICE_API_VERSION_3_5) {
-        versionMinor = 4;
+        if (mModule->getModuleApiVersion() == CAMERA_MODULE_API_VERSION_2_5) {
+            versionMinor = 5;
+        } else {
+            versionMinor = 4;
+        }
     }
     char deviceName[kMaxCameraDeviceNameLen];
     snprintf(deviceName, sizeof(deviceName), "device@%d.%d/legacy/%s",
@@ -546,63 +552,69 @@
         return Void();
     }
 
-    sp<android::hardware::camera::device::V3_2::ICameraDevice> device;
-    if (deviceVersion == kHAL3_4) {
+    // ICameraDevice 3.4 or upper
+    sp<android::hardware::camera::device::V3_2::implementation::CameraDevice> deviceImpl;
+    if (deviceVersion >= kHAL3_4) {
         ALOGV("Constructing v3.4 camera device");
-        sp<android::hardware::camera::device::V3_2::implementation::CameraDevice> deviceImpl =
-            new android::hardware::camera::device::V3_4::implementation::CameraDevice(
+        if (deviceVersion == kHAL3_4) {
+            deviceImpl = new android::hardware::camera::device::V3_4::implementation::CameraDevice(
                     mModule, cameraId, mCameraDeviceNames);
+        } else if (deviceVersion == kHAL3_5) {
+            deviceImpl = new android::hardware::camera::device::V3_5::implementation::CameraDevice(
+                    mModule, cameraId, mCameraDeviceNames);
+        }
         if (deviceImpl == nullptr || deviceImpl->isInitFailed()) {
             ALOGE("%s: camera device %s init failed!", __FUNCTION__, cameraId.c_str());
-            device = nullptr;
             _hidl_cb(Status::INTERNAL_ERROR, nullptr);
             return Void();
         }
-
-        device = deviceImpl;
-        _hidl_cb (Status::OK, device);
+        IF_ALOGV() {
+            deviceImpl->getInterface()->interfaceChain([](
+                ::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
+                    ALOGV("Device interface chain:");
+                    for (auto iface : interfaceChain) {
+                        ALOGV("  %s", iface.c_str());
+                    }
+                });
+        }
+        _hidl_cb (Status::OK, deviceImpl->getInterface());
         return Void();
     }
 
+    // ICameraDevice 3.2 and 3.3
     // Since some Treble HAL revisions can map to the same legacy HAL version(s), we default
     // to the newest possible Treble HAL revision, but allow for override if needed via
     // system property.
     switch (mPreferredHal3MinorVersion) {
         case 2: { // Map legacy camera device v3 HAL to Treble camera device HAL v3.2
             ALOGV("Constructing v3.2 camera device");
-            sp<android::hardware::camera::device::V3_2::implementation::CameraDevice> deviceImpl =
-                    new android::hardware::camera::device::V3_2::implementation::CameraDevice(
+            deviceImpl = new android::hardware::camera::device::V3_2::implementation::CameraDevice(
                     mModule, cameraId, mCameraDeviceNames);
             if (deviceImpl == nullptr || deviceImpl->isInitFailed()) {
                 ALOGE("%s: camera device %s init failed!", __FUNCTION__, cameraId.c_str());
-                device = nullptr;
                 _hidl_cb(Status::INTERNAL_ERROR, nullptr);
                 return Void();
             }
-            device = deviceImpl;
             break;
         }
         case 3: { // Map legacy camera device v3 HAL to Treble camera device HAL v3.3
             ALOGV("Constructing v3.3 camera device");
-            sp<android::hardware::camera::device::V3_2::implementation::CameraDevice> deviceImpl =
-                    new android::hardware::camera::device::V3_3::implementation::CameraDevice(
+            deviceImpl = new android::hardware::camera::device::V3_3::implementation::CameraDevice(
                     mModule, cameraId, mCameraDeviceNames);
             if (deviceImpl == nullptr || deviceImpl->isInitFailed()) {
                 ALOGE("%s: camera device %s init failed!", __FUNCTION__, cameraId.c_str());
-                device = nullptr;
                 _hidl_cb(Status::INTERNAL_ERROR, nullptr);
                 return Void();
             }
-            device = deviceImpl;
             break;
         }
         default:
             ALOGE("%s: Unknown HAL minor version %d!", __FUNCTION__, mPreferredHal3MinorVersion);
-            device = nullptr;
             _hidl_cb(Status::INTERNAL_ERROR, nullptr);
             return Void();
     }
-    _hidl_cb (Status::OK, device);
+
+    _hidl_cb (Status::OK, deviceImpl->getInterface());
     return Void();
 }
 
diff --git a/camera/provider/2.4/default/ExternalCameraProvider.cpp b/camera/provider/2.4/default/ExternalCameraProvider.cpp
index 1cec0e5..604df5c 100644
--- a/camera/provider/2.4/default/ExternalCameraProvider.cpp
+++ b/camera/provider/2.4/default/ExternalCameraProvider.cpp
@@ -24,6 +24,8 @@
 #include <linux/videodev2.h>
 #include "ExternalCameraProvider.h"
 #include "ExternalCameraDevice_3_4.h"
+#include "ExternalCameraDevice_3_5.h"
+#include <cutils/properties.h>
 
 namespace android {
 namespace hardware {
@@ -62,6 +64,21 @@
         mCfg(ExternalCameraConfig::loadFromCfg()),
         mHotPlugThread(this) {
     mHotPlugThread.run("ExtCamHotPlug", PRIORITY_BACKGROUND);
+
+    mPreferredHal3MinorVersion =
+        property_get_int32("ro.vendor.camera.external.hal3TrebleMinorVersion", 4);
+    ALOGV("Preferred HAL 3 minor version is %d", mPreferredHal3MinorVersion);
+    switch(mPreferredHal3MinorVersion) {
+        case 4:
+        case 5:
+            // OK
+            break;
+        default:
+            ALOGW("Unknown minor camera device HAL version %d in property "
+                    "'camera.external.hal3TrebleMinorVersion', defaulting to 4",
+                    mPreferredHal3MinorVersion);
+            mPreferredHal3MinorVersion = 4;
+    }
 }
 
 ExternalCameraProvider::~ExternalCameraProvider() {
@@ -136,20 +153,43 @@
         return Void();
     }
 
-    ALOGV("Constructing v3.4 external camera device");
-    sp<device::V3_2::ICameraDevice> device;
-    sp<device::V3_4::implementation::ExternalCameraDevice> deviceImpl =
-            new device::V3_4::implementation::ExternalCameraDevice(
+    sp<device::V3_4::implementation::ExternalCameraDevice> deviceImpl;
+    switch (mPreferredHal3MinorVersion) {
+        case 4: {
+            ALOGV("Constructing v3.4 external camera device");
+            deviceImpl = new device::V3_4::implementation::ExternalCameraDevice(
                     cameraId, mCfg);
+            break;
+        }
+        case 5: {
+            ALOGV("Constructing v3.5 external camera device");
+            deviceImpl = new device::V3_5::implementation::ExternalCameraDevice(
+                    cameraId, mCfg);
+            break;
+        }
+        default:
+            ALOGE("%s: Unknown HAL minor version %d!", __FUNCTION__, mPreferredHal3MinorVersion);
+            _hidl_cb(Status::INTERNAL_ERROR, nullptr);
+            return Void();
+    }
+
     if (deviceImpl == nullptr || deviceImpl->isInitFailed()) {
         ALOGE("%s: camera device %s init failed!", __FUNCTION__, cameraId.c_str());
-        device = nullptr;
         _hidl_cb(Status::INTERNAL_ERROR, nullptr);
         return Void();
     }
-    device = deviceImpl;
 
-    _hidl_cb (Status::OK, device);
+    IF_ALOGV() {
+        deviceImpl->getInterface()->interfaceChain([](
+            ::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
+                ALOGV("Device interface chain:");
+                for (auto iface : interfaceChain) {
+                    ALOGV("  %s", iface.c_str());
+                }
+            });
+    }
+
+    _hidl_cb (Status::OK, deviceImpl->getInterface());
 
     return Void();
 }
@@ -157,7 +197,12 @@
 void ExternalCameraProvider::addExternalCamera(const char* devName) {
     ALOGI("ExtCam: adding %s to External Camera HAL!", devName);
     Mutex::Autolock _l(mLock);
-    std::string deviceName = std::string("device@3.4/external/") + devName;
+    std::string deviceName;
+    if (mPreferredHal3MinorVersion == 5) {
+        deviceName = std::string("device@3.5/external/") + devName;
+    } else {
+        deviceName = std::string("device@3.4/external/") + devName;
+    }
     mCameraStatusMap[deviceName] = CameraDeviceStatus::PRESENT;
     if (mCallbacks != nullptr) {
         mCallbacks->cameraDeviceStatusChange(deviceName, CameraDeviceStatus::PRESENT);
@@ -199,7 +244,12 @@
 
 void ExternalCameraProvider::deviceRemoved(const char* devName) {
     Mutex::Autolock _l(mLock);
-    std::string deviceName = std::string("device@3.4/external/") + devName;
+    std::string deviceName;
+    if (mPreferredHal3MinorVersion == 5) {
+        deviceName = std::string("device@3.5/external/") + devName;
+    } else {
+        deviceName = std::string("device@3.4/external/") + devName;
+    }
     if (mCameraStatusMap.find(deviceName) != mCameraStatusMap.end()) {
         mCameraStatusMap.erase(deviceName);
         if (mCallbacks != nullptr) {
diff --git a/camera/provider/2.4/default/ExternalCameraProvider.h b/camera/provider/2.4/default/ExternalCameraProvider.h
index c83cc70..a69cf8b 100644
--- a/camera/provider/2.4/default/ExternalCameraProvider.h
+++ b/camera/provider/2.4/default/ExternalCameraProvider.h
@@ -95,6 +95,7 @@
     std::unordered_map<std::string, CameraDeviceStatus> mCameraStatusMap; // camera id -> status
     const ExternalCameraConfig mCfg;
     HotplugThread mHotPlugThread;
+    int mPreferredHal3MinorVersion;
 };
 
 
diff --git a/camera/provider/2.4/default/OWNERS b/camera/provider/2.4/default/OWNERS
index 18acfee..369b204 100644
--- a/camera/provider/2.4/default/OWNERS
+++ b/camera/provider/2.4/default/OWNERS
@@ -1,6 +1,7 @@
 cychen@google.com
 epeev@google.com
 etalvala@google.com
+jchowdhary@google.com
 shuzhenwang@google.com
 yinchiayeh@google.com
 zhijunhe@google.com
diff --git a/camera/provider/2.4/vts/functional/Android.bp b/camera/provider/2.4/vts/functional/Android.bp
index ead4083..eb8d43e 100644
--- a/camera/provider/2.4/vts/functional/Android.bp
+++ b/camera/provider/2.4/vts/functional/Android.bp
@@ -37,6 +37,7 @@
         "android.hardware.camera.device@3.2",
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
+        "android.hardware.camera.device@3.5",
         "android.hardware.camera.provider@2.4",
         "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.common@1.0",
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index 71b78f4..c324d59 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -28,6 +28,7 @@
 
 #include <android/hardware/camera/device/1.0/ICameraDevice.h>
 #include <android/hardware/camera/device/3.2/ICameraDevice.h>
+#include <android/hardware/camera/device/3.5/ICameraDevice.h>
 #include <android/hardware/camera/device/3.3/ICameraDeviceSession.h>
 #include <android/hardware/camera/device/3.4/ICameraDeviceSession.h>
 #include <android/hardware/camera/device/3.4/ICameraDeviceCallback.h>
@@ -141,13 +142,20 @@
     int32_t outputFormat;
 };
 
+enum ReprocessType {
+    PRIV_REPROCESS,
+    YUV_REPROCESS,
+};
+
 namespace {
     // "device@<version>/legacy/<id>"
     const char *kDeviceNameRE = "device@([0-9]+\\.[0-9]+)/%s/(.+)";
+    const int CAMERA_DEVICE_API_VERSION_3_5 = 0x305;
     const int CAMERA_DEVICE_API_VERSION_3_4 = 0x304;
     const int CAMERA_DEVICE_API_VERSION_3_3 = 0x303;
     const int CAMERA_DEVICE_API_VERSION_3_2 = 0x302;
     const int CAMERA_DEVICE_API_VERSION_1_0 = 0x100;
+    const char *kHAL3_5 = "3.5";
     const char *kHAL3_4 = "3.4";
     const char *kHAL3_3 = "3.3";
     const char *kHAL3_2 = "3.2";
@@ -182,7 +190,9 @@
             return -1;
         }
 
-        if (version.compare(kHAL3_4) == 0) {
+        if (version.compare(kHAL3_5) == 0) {
+            return CAMERA_DEVICE_API_VERSION_3_5;
+        } else if (version.compare(kHAL3_4) == 0) {
             return CAMERA_DEVICE_API_VERSION_3_4;
         } else if (version.compare(kHAL3_3) == 0) {
             return CAMERA_DEVICE_API_VERSION_3_3;
@@ -554,7 +564,8 @@
     };
 
     struct DeviceCb : public V3_4::ICameraDeviceCallback {
-        DeviceCb(CameraHidlTest *parent) : mParent(parent) {}
+        DeviceCb(CameraHidlTest *parent, bool checkMonochromeResult) : mParent(parent),
+                mCheckMonochromeResult(checkMonochromeResult) {}
         Return<void> processCaptureResult_3_4(
                 const hidl_vec<V3_4::CaptureResult>& results) override;
         Return<void> processCaptureResult(const hidl_vec<CaptureResult>& results) override;
@@ -564,6 +575,7 @@
         bool processCaptureResultLocked(const CaptureResult& results);
 
         CameraHidlTest *mParent;               // Parent object
+        bool mCheckMonochromeResult;
     };
 
     struct TorchProviderCb : public ICameraProviderCallback {
@@ -670,12 +682,23 @@
             HalStreamConfiguration *halStreamConfig /*out*/,
             bool *supportsPartialResults /*out*/,
             uint32_t *partialResultCount /*out*/);
+
+    void verifyLogicalCameraMetadata(const std::string& cameraName,
+            const ::android::sp<::android::hardware::camera::device::V3_2::ICameraDevice>& device,
+            const CameraMetadata& chars, int deviceVersion,
+            const hidl_vec<hidl_string>& deviceNames);
+    void verifyCameraCharacteristics(Status status, const CameraMetadata& chars);
+    void verifyRecommendedConfigs(const CameraMetadata& metadata);
+    void verifyMonochromeCharacteristics(const CameraMetadata& chars, int deviceVersion);
+    void verifyMonochromeCameraResult(
+            const ::android::hardware::camera::common::V1_0::helper::CameraMetadata& metadata);
+
     static Status getAvailableOutputStreams(camera_metadata_t *staticMeta,
             std::vector<AvailableStream> &outputStreams,
             const AvailableStream *threshold = nullptr);
     static Status isConstrainedModeAvailable(camera_metadata_t *staticMeta);
-    static Status isLogicalMultiCamera(camera_metadata_t *staticMeta);
-    static Status getPhysicalCameraIds(camera_metadata_t *staticMeta,
+    static Status isLogicalMultiCamera(const camera_metadata_t *staticMeta);
+    static Status getPhysicalCameraIds(const camera_metadata_t *staticMeta,
             std::unordered_set<std::string> *physicalIds/*out*/);
     static Status getSupportedKeys(camera_metadata_t *staticMeta,
             uint32_t tagId, std::unordered_set<int32_t> *requestIDs/*out*/);
@@ -686,7 +709,8 @@
             /*out*/);
     static Status pickConstrainedModeSize(camera_metadata_t *staticMeta,
             AvailableStream &hfrStream);
-    static Status isZSLModeAvailable(camera_metadata_t *staticMeta);
+    static Status isZSLModeAvailable(const camera_metadata_t *staticMeta);
+    static Status isZSLModeAvailable(const camera_metadata_t *staticMeta, ReprocessType reprocType);
     static Status getZSLInputOutputMap(camera_metadata_t *staticMeta,
             std::vector<AvailableZSLInputOutput> &inputOutputMap);
     static Status findLargestSize(
@@ -694,6 +718,7 @@
             int32_t format, AvailableStream &result);
     static Status isAutoFocusModeAvailable(
             CameraParameters &cameraParams, const char *mode) ;
+    static Status isMonochromeCamera(const camera_metadata_t *staticMeta);
 
 protected:
 
@@ -1037,6 +1062,11 @@
         }
         request->haveResultMetadata = true;
         request->collectedResult.sort();
+
+        // Verify final result metadata
+        if (mCheckMonochromeResult) {
+            mParent->verifyMonochromeCameraResult(request->collectedResult);
+        }
     }
 
     uint32_t numBuffersReturned = results.outputBuffers.size();
@@ -1266,6 +1296,7 @@
     for (const auto& name : cameraDeviceNames) {
         int deviceVersion = getCameraDeviceVersion(name, mProviderType);
         switch (deviceVersion) {
+            case CAMERA_DEVICE_API_VERSION_3_5:
             case CAMERA_DEVICE_API_VERSION_3_4:
             case CAMERA_DEVICE_API_VERSION_3_3:
             case CAMERA_DEVICE_API_VERSION_3_2: {
@@ -1307,6 +1338,7 @@
     for (const auto& name : cameraDeviceNames) {
         int deviceVersion = getCameraDeviceVersion(name, mProviderType);
         switch (deviceVersion) {
+            case CAMERA_DEVICE_API_VERSION_3_5:
             case CAMERA_DEVICE_API_VERSION_3_4:
             case CAMERA_DEVICE_API_VERSION_3_3:
             case CAMERA_DEVICE_API_VERSION_3_2: {
@@ -2047,6 +2079,7 @@
     for (const auto& name : cameraDeviceNames) {
         int deviceVersion = getCameraDeviceVersion(name, mProviderType);
         switch (deviceVersion) {
+            case CAMERA_DEVICE_API_VERSION_3_5:
             case CAMERA_DEVICE_API_VERSION_3_4:
             case CAMERA_DEVICE_API_VERSION_3_3:
             case CAMERA_DEVICE_API_VERSION_3_2: {
@@ -2063,33 +2096,32 @@
                 ASSERT_TRUE(ret.isOk());
 
                 ret = device3_x->getCameraCharacteristics([&](auto status, const auto& chars) {
-                    ALOGI("getCameraCharacteristics returns status:%d", (int)status);
-                    ASSERT_EQ(Status::OK, status);
-                    const camera_metadata_t* metadata = (camera_metadata_t*)chars.data();
-                    size_t expectedSize = chars.size();
-                    int result = validate_camera_metadata_structure(metadata, &expectedSize);
-                    ASSERT_TRUE((result == 0) || (result == CAMERA_METADATA_VALIDATION_SHIFTED));
-                    size_t entryCount = get_camera_metadata_entry_count(metadata);
-                    // TODO: we can do better than 0 here. Need to check how many required
-                    // characteristics keys we've defined.
-                    ASSERT_GT(entryCount, 0u);
-                    ALOGI("getCameraCharacteristics metadata entry count is %zu", entryCount);
-
-                    camera_metadata_ro_entry entry;
-                    int retcode = find_camera_metadata_ro_entry(metadata,
-                            ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL, &entry);
-                    if ((0 == retcode) && (entry.count > 0)) {
-                        uint8_t hardwareLevel = entry.data.u8[0];
-                        ASSERT_TRUE(
-                                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_LIMITED ||
-                                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_FULL ||
-                                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_3 ||
-                                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_EXTERNAL);
-                    } else {
-                        ADD_FAILURE() << "Get camera hardware level failed!";
-                    }
+                    verifyCameraCharacteristics(status, chars);
+                    verifyMonochromeCharacteristics(chars, deviceVersion);
+                    verifyRecommendedConfigs(chars);
+                    verifyLogicalCameraMetadata(name, device3_x, chars, deviceVersion,
+                            cameraDeviceNames);
                 });
                 ASSERT_TRUE(ret.isOk());
+
+                //getPhysicalCameraCharacteristics will fail for publicly
+                //advertised camera IDs.
+                if (deviceVersion >= CAMERA_DEVICE_API_VERSION_3_5) {
+                    auto castResult = device::V3_5::ICameraDevice::castFrom(device3_x);
+                    ASSERT_TRUE(castResult.isOk());
+                    ::android::sp<::android::hardware::camera::device::V3_5::ICameraDevice>
+                            device3_5 = castResult;
+                    ASSERT_NE(device3_5, nullptr);
+
+                    std::string version, cameraId;
+                    ASSERT_TRUE(::matchDeviceName(name, mProviderType, &version, &cameraId));
+                    Return<void> ret = device3_5->getPhysicalCameraCharacteristics(cameraId,
+                            [&](auto status, const auto& chars) {
+                        ASSERT_TRUE(Status::ILLEGAL_ARGUMENT == status);
+                        ASSERT_EQ(0, chars.size());
+                    });
+                    ASSERT_TRUE(ret.isOk());
+                }
             }
             break;
             case CAMERA_DEVICE_API_VERSION_1_0: {
@@ -2126,6 +2158,7 @@
     for (const auto& name : cameraDeviceNames) {
         int deviceVersion = getCameraDeviceVersion(name, mProviderType);
         switch (deviceVersion) {
+            case CAMERA_DEVICE_API_VERSION_3_5:
             case CAMERA_DEVICE_API_VERSION_3_4:
             case CAMERA_DEVICE_API_VERSION_3_3:
             case CAMERA_DEVICE_API_VERSION_3_2: {
@@ -2251,6 +2284,7 @@
     for (const auto& name : cameraDeviceNames) {
         int deviceVersion = getCameraDeviceVersion(name, mProviderType);
         switch (deviceVersion) {
+            case CAMERA_DEVICE_API_VERSION_3_5:
             case CAMERA_DEVICE_API_VERSION_3_4:
             case CAMERA_DEVICE_API_VERSION_3_3:
             case CAMERA_DEVICE_API_VERSION_3_2: {
@@ -2315,6 +2349,7 @@
     for (const auto& name : cameraDeviceNames) {
         int deviceVersion = getCameraDeviceVersion(name, mProviderType);
         switch (deviceVersion) {
+            case CAMERA_DEVICE_API_VERSION_3_5:
             case CAMERA_DEVICE_API_VERSION_3_4:
             case CAMERA_DEVICE_API_VERSION_3_3:
             case CAMERA_DEVICE_API_VERSION_3_2: {
@@ -2343,7 +2378,8 @@
                 sp<device::V3_3::ICameraDeviceSession> sessionV3_3;
                 sp<device::V3_4::ICameraDeviceSession> sessionV3_4;
                 castSession(session, deviceVersion, &sessionV3_3, &sessionV3_4);
-                if (deviceVersion == CAMERA_DEVICE_API_VERSION_3_4) {
+                if (deviceVersion == CAMERA_DEVICE_API_VERSION_3_4 ||
+                        deviceVersion == CAMERA_DEVICE_API_VERSION_3_5) {
                     ASSERT_TRUE(sessionV3_4.get() != nullptr);
                 } else if (deviceVersion == CAMERA_DEVICE_API_VERSION_3_3) {
                     ASSERT_TRUE(sessionV3_3.get() != nullptr);
@@ -2401,6 +2437,7 @@
     for (const auto& name : cameraDeviceNames) {
         int deviceVersion = getCameraDeviceVersion(name, mProviderType);
         switch (deviceVersion) {
+            case CAMERA_DEVICE_API_VERSION_3_5:
             case CAMERA_DEVICE_API_VERSION_3_4:
             case CAMERA_DEVICE_API_VERSION_3_3:
             case CAMERA_DEVICE_API_VERSION_3_2: {
@@ -2758,13 +2795,34 @@
         ASSERT_EQ(Status::OK, getZSLInputOutputMap(staticMeta, inputOutputMap));
         ASSERT_NE(0u, inputOutputMap.size());
 
+        bool supportMonoY8 = false;
+        if (Status::OK == isMonochromeCamera(staticMeta)) {
+            for (auto& it : inputStreams) {
+                if (it.format == static_cast<uint32_t>(PixelFormat::Y8)) {
+                    supportMonoY8 = true;
+                    break;
+                }
+            }
+        }
+
         int32_t streamId = 0;
+        bool hasPrivToY8 = false, hasY8ToY8 = false, hasY8ToBlob = false;
         for (auto& inputIter : inputOutputMap) {
             AvailableStream input;
             ASSERT_EQ(Status::OK, findLargestSize(inputStreams, inputIter.inputFormat,
                     input));
             ASSERT_NE(0u, inputStreams.size());
 
+            if (inputIter.inputFormat == static_cast<uint32_t>(PixelFormat::IMPLEMENTATION_DEFINED)
+                    && inputIter.outputFormat == static_cast<uint32_t>(PixelFormat::Y8)) {
+                hasPrivToY8 = true;
+            } else if (inputIter.inputFormat == static_cast<uint32_t>(PixelFormat::Y8)) {
+                if (inputIter.outputFormat == static_cast<uint32_t>(PixelFormat::BLOB)) {
+                    hasY8ToBlob = true;
+                } else if (inputIter.outputFormat == static_cast<uint32_t>(PixelFormat::Y8)) {
+                    hasY8ToY8 = true;
+                }
+            }
             AvailableStream outputThreshold = {INT32_MAX, INT32_MAX,
                                                inputIter.outputFormat};
             std::vector<AvailableStream> outputStreams;
@@ -2826,6 +2884,16 @@
             }
         }
 
+        if (supportMonoY8) {
+            if (Status::OK == isZSLModeAvailable(staticMeta, PRIV_REPROCESS)) {
+                ASSERT_TRUE(hasPrivToY8);
+            }
+            if (Status::OK == isZSLModeAvailable(staticMeta, YUV_REPROCESS)) {
+                ASSERT_TRUE(hasY8ToY8);
+                ASSERT_TRUE(hasY8ToBlob);
+            }
+        }
+
         free_camera_metadata(staticMeta);
         ret = session->close();
         ASSERT_TRUE(ret.isOk());
@@ -4144,7 +4212,7 @@
 }
 
 // Check if the camera device has logical multi-camera capability.
-Status CameraHidlTest::isLogicalMultiCamera(camera_metadata_t *staticMeta) {
+Status CameraHidlTest::isLogicalMultiCamera(const camera_metadata_t *staticMeta) {
     Status ret = Status::METHOD_NOT_SUPPORTED;
     if (nullptr == staticMeta) {
         return Status::ILLEGAL_ARGUMENT;
@@ -4168,7 +4236,7 @@
 }
 
 // Generate a list of physical camera ids backing a logical multi-camera.
-Status CameraHidlTest::getPhysicalCameraIds(camera_metadata_t *staticMeta,
+Status CameraHidlTest::getPhysicalCameraIds(const camera_metadata_t *staticMeta,
         std::unordered_set<std::string> *physicalIds) {
     if ((nullptr == staticMeta) || (nullptr == physicalIds)) {
         return Status::ILLEGAL_ARGUMENT;
@@ -4305,7 +4373,17 @@
 
 // Check whether ZSL is available using the static camera
 // characteristics.
-Status CameraHidlTest::isZSLModeAvailable(camera_metadata_t *staticMeta) {
+Status CameraHidlTest::isZSLModeAvailable(const camera_metadata_t *staticMeta) {
+    if (Status::OK == isZSLModeAvailable(staticMeta, PRIV_REPROCESS)) {
+        return Status::OK;
+    } else {
+        return isZSLModeAvailable(staticMeta, YUV_REPROCESS);
+    }
+}
+
+Status CameraHidlTest::isZSLModeAvailable(const camera_metadata_t *staticMeta,
+        ReprocessType reprocType) {
+
     Status ret = Status::METHOD_NOT_SUPPORTED;
     if (nullptr == staticMeta) {
         return Status::ILLEGAL_ARGUMENT;
@@ -4319,10 +4397,34 @@
     }
 
     for (size_t i = 0; i < entry.count; i++) {
-        if ((ANDROID_REQUEST_AVAILABLE_CAPABILITIES_PRIVATE_REPROCESSING ==
-                entry.data.u8[i]) ||
-                (ANDROID_REQUEST_AVAILABLE_CAPABILITIES_YUV_REPROCESSING ==
-                        entry.data.u8[i]) ){
+        if ((reprocType == PRIV_REPROCESS &&
+                ANDROID_REQUEST_AVAILABLE_CAPABILITIES_PRIVATE_REPROCESSING == entry.data.u8[i]) ||
+                (reprocType == YUV_REPROCESS &&
+                ANDROID_REQUEST_AVAILABLE_CAPABILITIES_YUV_REPROCESSING == entry.data.u8[i])) {
+            ret = Status::OK;
+            break;
+        }
+    }
+
+    return ret;
+}
+
+// Check whether this is a monochrome camera using the static camera characteristics.
+Status CameraHidlTest::isMonochromeCamera(const camera_metadata_t *staticMeta) {
+    Status ret = Status::METHOD_NOT_SUPPORTED;
+    if (nullptr == staticMeta) {
+        return Status::ILLEGAL_ARGUMENT;
+    }
+
+    camera_metadata_ro_entry entry;
+    int rc = find_camera_metadata_ro_entry(staticMeta,
+            ANDROID_REQUEST_AVAILABLE_CAPABILITIES, &entry);
+    if (0 != rc) {
+        return Status::ILLEGAL_ARGUMENT;
+    }
+
+    for (size_t i = 0; i < entry.count; i++) {
+        if (ANDROID_REQUEST_AVAILABLE_CAPABILITIES_MONOCHROME == entry.data.u8[i]) {
             ret = Status::OK;
             break;
         }
@@ -4441,22 +4543,6 @@
         });
     ASSERT_TRUE(ret.isOk());
 
-    sp<DeviceCb> cb = new DeviceCb(this);
-    sp<ICameraDeviceSession> session;
-    ret = device3_x->open(
-        cb,
-        [&session](auto status, const auto& newSession) {
-            ALOGI("device::open returns status:%d", (int)status);
-            ASSERT_EQ(Status::OK, status);
-            ASSERT_NE(newSession, nullptr);
-            session = newSession;
-        });
-    ASSERT_TRUE(ret.isOk());
-
-    sp<device::V3_3::ICameraDeviceSession> session3_3;
-    castSession(session, deviceVersion, &session3_3, session3_4);
-    ASSERT_NE(nullptr, session3_4);
-
     camera_metadata_t *staticMeta;
     ret = device3_x->getCameraCharacteristics([&] (Status s,
             CameraMetadata metadata) {
@@ -4475,6 +4561,24 @@
         *supportsPartialResults = (*partialResultCount > 1);
     }
 
+    bool checkMonochromeResultTags = Status::OK == isMonochromeCamera(staticMeta) &&
+            deviceVersion >= CAMERA_DEVICE_API_VERSION_3_5;
+    sp<DeviceCb> cb = new DeviceCb(this, checkMonochromeResultTags);
+    sp<ICameraDeviceSession> session;
+    ret = device3_x->open(
+        cb,
+        [&session](auto status, const auto& newSession) {
+            ALOGI("device::open returns status:%d", (int)status);
+            ASSERT_EQ(Status::OK, status);
+            ASSERT_NE(newSession, nullptr);
+            session = newSession;
+        });
+    ASSERT_TRUE(ret.isOk());
+
+    sp<device::V3_3::ICameraDeviceSession> session3_3;
+    castSession(session, deviceVersion, &session3_3, session3_4);
+    ASSERT_NE(nullptr, session3_4);
+
     outputPreviewStreams.clear();
     auto rc = getAvailableOutputStreams(staticMeta,
             outputPreviewStreams, previewThreshold);
@@ -4544,21 +4648,6 @@
         });
     ASSERT_TRUE(ret.isOk());
 
-    sp<DeviceCb> cb = new DeviceCb(this);
-    ret = device3_x->open(
-        cb,
-        [&](auto status, const auto& newSession) {
-            ALOGI("device::open returns status:%d", (int)status);
-            ASSERT_EQ(Status::OK, status);
-            ASSERT_NE(newSession, nullptr);
-            *session = newSession;
-        });
-    ASSERT_TRUE(ret.isOk());
-
-    sp<device::V3_3::ICameraDeviceSession> session3_3;
-    sp<device::V3_4::ICameraDeviceSession> session3_4;
-    castSession(*session, deviceVersion, &session3_3, &session3_4);
-
     camera_metadata_t *staticMeta;
     ret = device3_x->getCameraCharacteristics([&] (Status s,
             CameraMetadata metadata) {
@@ -4577,6 +4666,23 @@
         *supportsPartialResults = (*partialResultCount > 1);
     }
 
+    bool checkMonochromeResultTags = Status::OK == isMonochromeCamera(staticMeta) &&
+            deviceVersion >= CAMERA_DEVICE_API_VERSION_3_5;
+    sp<DeviceCb> cb = new DeviceCb(this, checkMonochromeResultTags);
+    ret = device3_x->open(
+        cb,
+        [&](auto status, const auto& newSession) {
+            ALOGI("device::open returns status:%d", (int)status);
+            ASSERT_EQ(Status::OK, status);
+            ASSERT_NE(newSession, nullptr);
+            *session = newSession;
+        });
+    ASSERT_TRUE(ret.isOk());
+
+    sp<device::V3_3::ICameraDeviceSession> session3_3;
+    sp<device::V3_4::ICameraDeviceSession> session3_4;
+    castSession(*session, deviceVersion, &session3_3, &session3_4);
+
     outputPreviewStreams.clear();
     auto rc = getAvailableOutputStreams(staticMeta,
             outputPreviewStreams, previewThreshold);
@@ -4641,6 +4747,7 @@
     ASSERT_NE(nullptr, session3_4);
 
     switch (deviceVersion) {
+        case CAMERA_DEVICE_API_VERSION_3_5:
         case CAMERA_DEVICE_API_VERSION_3_4: {
             auto castResult = device::V3_4::ICameraDeviceSession::castFrom(session);
             ASSERT_TRUE(castResult.isOk());
@@ -4659,6 +4766,245 @@
     }
 }
 
+// Verify logical camera static metadata
+void CameraHidlTest::verifyLogicalCameraMetadata(const std::string& cameraName,
+        const ::android::sp<::android::hardware::camera::device::V3_2::ICameraDevice>& device,
+        const CameraMetadata &chars, int deviceVersion,
+        const hidl_vec<hidl_string>& deviceNames) {
+    const camera_metadata_t* metadata = (camera_metadata_t*)chars.data();
+    ASSERT_NE(nullptr, metadata);
+
+    Status rc = isLogicalMultiCamera(metadata);
+    ASSERT_TRUE(Status::OK == rc || Status::METHOD_NOT_SUPPORTED == rc);
+    if (Status::METHOD_NOT_SUPPORTED == rc) {
+        return;
+    }
+
+    std::string version, cameraId;
+    ASSERT_TRUE(::matchDeviceName(cameraName, mProviderType, &version, &cameraId));
+    std::unordered_set<std::string> physicalIds;
+    ASSERT_TRUE(Status::OK == getPhysicalCameraIds(metadata, &physicalIds));
+    for (auto physicalId : physicalIds) {
+        ASSERT_NE(physicalId, cameraId);
+        bool isPublicId = false;
+        for (auto& deviceName : deviceNames) {
+            std::string publicVersion, publicId;
+            ASSERT_TRUE(::matchDeviceName(deviceName, mProviderType, &publicVersion, &publicId));
+            if (physicalId == publicId) {
+                isPublicId = true;
+                break;
+            }
+        }
+        if (isPublicId) {
+            continue;
+        }
+
+        ASSERT_TRUE(deviceVersion >= CAMERA_DEVICE_API_VERSION_3_5);
+        auto castResult = device::V3_5::ICameraDevice::castFrom(device);
+        ASSERT_TRUE(castResult.isOk());
+        ::android::sp<::android::hardware::camera::device::V3_5::ICameraDevice> device3_5 =
+                castResult;
+        ASSERT_NE(device3_5, nullptr);
+
+        // Check camera characteristics for hidden camera id
+        Return<void> ret = device3_5->getPhysicalCameraCharacteristics(physicalId,
+                [&](auto status, const auto& chars) {
+            verifyCameraCharacteristics(status, chars);
+            verifyMonochromeCharacteristics(chars, deviceVersion);
+        });
+        ASSERT_TRUE(ret.isOk());
+
+        // Check calling getCameraDeviceInterface_V3_x() on hidden camera id returns
+        // ILLEGAL_ARGUMENT.
+        std::stringstream s;
+        s << "device@" << version << "/" << mProviderType << "/" << physicalId;
+        hidl_string fullPhysicalId(s.str());
+        ret = mProvider->getCameraDeviceInterface_V3_x(fullPhysicalId,
+                [&](auto status, const auto& device3_x) {
+            ASSERT_EQ(Status::ILLEGAL_ARGUMENT, status);
+            ASSERT_EQ(device3_x, nullptr);
+        });
+        ASSERT_TRUE(ret.isOk());
+    }
+}
+
+void CameraHidlTest::verifyCameraCharacteristics(Status status, const CameraMetadata& chars) {
+    ASSERT_EQ(Status::OK, status);
+    const camera_metadata_t* metadata = (camera_metadata_t*)chars.data();
+    size_t expectedSize = chars.size();
+    int result = validate_camera_metadata_structure(metadata, &expectedSize);
+    ASSERT_TRUE((result == 0) || (result == CAMERA_METADATA_VALIDATION_SHIFTED));
+    size_t entryCount = get_camera_metadata_entry_count(metadata);
+    // TODO: we can do better than 0 here. Need to check how many required
+    // characteristics keys we've defined.
+    ASSERT_GT(entryCount, 0u);
+
+    camera_metadata_ro_entry entry;
+    int retcode = find_camera_metadata_ro_entry(metadata,
+            ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL, &entry);
+    if ((0 == retcode) && (entry.count > 0)) {
+        uint8_t hardwareLevel = entry.data.u8[0];
+        ASSERT_TRUE(
+                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_LIMITED ||
+                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_FULL ||
+                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_3 ||
+                hardwareLevel == ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL_EXTERNAL);
+    } else {
+        ADD_FAILURE() << "Get camera hardware level failed!";
+    }
+
+    entry.count = 0;
+    retcode = find_camera_metadata_ro_entry(metadata,
+            ANDROID_REQUEST_CHARACTERISTIC_KEYS_NEEDING_PERMISSION, &entry);
+    if ((0 == retcode) || (entry.count > 0)) {
+        ADD_FAILURE() << "ANDROID_REQUEST_CHARACTERISTIC_KEYS_NEEDING_PERMISSION "
+            << " per API contract should never be set by Hal!";
+    }
+}
+
+void CameraHidlTest::verifyMonochromeCharacteristics(const CameraMetadata& chars,
+        int deviceVersion) {
+    const camera_metadata_t* metadata = (camera_metadata_t*)chars.data();
+    Status rc = isMonochromeCamera(metadata);
+    if (Status::METHOD_NOT_SUPPORTED == rc) {
+        return;
+    }
+    ASSERT_EQ(Status::OK, rc);
+
+    camera_metadata_ro_entry entry;
+    // Check capabilities
+    int retcode = find_camera_metadata_ro_entry(metadata,
+                ANDROID_REQUEST_AVAILABLE_CAPABILITIES, &entry);
+    if ((0 == retcode) && (entry.count > 0)) {
+        ASSERT_EQ(std::find(entry.data.u8, entry.data.u8 + entry.count,
+                ANDROID_REQUEST_AVAILABLE_CAPABILITIES_MANUAL_POST_PROCESSING),
+                entry.data.u8 + entry.count);
+        if (deviceVersion < CAMERA_DEVICE_API_VERSION_3_5) {
+            ASSERT_EQ(std::find(entry.data.u8, entry.data.u8 + entry.count,
+                    ANDROID_REQUEST_AVAILABLE_CAPABILITIES_RAW),
+                    entry.data.u8 + entry.count);
+        }
+    }
+
+    if (deviceVersion >= CAMERA_DEVICE_API_VERSION_3_5) {
+        // Check Cfa
+        retcode = find_camera_metadata_ro_entry(metadata,
+                ANDROID_SENSOR_INFO_COLOR_FILTER_ARRANGEMENT, &entry);
+        if ((0 == retcode) && (entry.count == 1)) {
+            ASSERT_TRUE(entry.data.i32[0] == ANDROID_SENSOR_INFO_COLOR_FILTER_ARRANGEMENT_MONO
+                    || entry.data.i32[0] == ANDROID_SENSOR_INFO_COLOR_FILTER_ARRANGEMENT_NIR);
+        }
+
+        // Check availableRequestKeys
+        retcode = find_camera_metadata_ro_entry(metadata,
+                ANDROID_REQUEST_AVAILABLE_REQUEST_KEYS, &entry);
+        if ((0 == retcode) && (entry.count > 0)) {
+            for (size_t i = 0; i < entry.count; i++) {
+                ASSERT_NE(entry.data.i32[i], ANDROID_COLOR_CORRECTION_MODE);
+                ASSERT_NE(entry.data.i32[i], ANDROID_COLOR_CORRECTION_TRANSFORM);
+                ASSERT_NE(entry.data.i32[i], ANDROID_COLOR_CORRECTION_GAINS);
+            }
+        } else {
+            ADD_FAILURE() << "Get camera availableRequestKeys failed!";
+        }
+
+        // Check availableResultKeys
+        retcode = find_camera_metadata_ro_entry(metadata,
+                ANDROID_REQUEST_AVAILABLE_RESULT_KEYS, &entry);
+        if ((0 == retcode) && (entry.count > 0)) {
+            for (size_t i = 0; i < entry.count; i++) {
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_GREEN_SPLIT);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_NEUTRAL_COLOR_POINT);
+                ASSERT_NE(entry.data.i32[i], ANDROID_COLOR_CORRECTION_MODE);
+                ASSERT_NE(entry.data.i32[i], ANDROID_COLOR_CORRECTION_TRANSFORM);
+                ASSERT_NE(entry.data.i32[i], ANDROID_COLOR_CORRECTION_GAINS);
+            }
+        } else {
+            ADD_FAILURE() << "Get camera availableResultKeys failed!";
+        }
+
+        // Check availableCharacteristicKeys
+        retcode = find_camera_metadata_ro_entry(metadata,
+                ANDROID_REQUEST_AVAILABLE_CHARACTERISTICS_KEYS, &entry);
+        if ((0 == retcode) && (entry.count > 0)) {
+            for (size_t i = 0; i < entry.count; i++) {
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_REFERENCE_ILLUMINANT1);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_REFERENCE_ILLUMINANT2);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_CALIBRATION_TRANSFORM1);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_CALIBRATION_TRANSFORM2);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_COLOR_TRANSFORM1);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_COLOR_TRANSFORM2);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_FORWARD_MATRIX1);
+                ASSERT_NE(entry.data.i32[i], ANDROID_SENSOR_FORWARD_MATRIX2);
+            }
+        } else {
+            ADD_FAILURE() << "Get camera availableResultKeys failed!";
+        }
+
+        // Check blackLevelPattern
+        retcode = find_camera_metadata_ro_entry(metadata,
+                ANDROID_SENSOR_BLACK_LEVEL_PATTERN, &entry);
+        if ((0 == retcode) && (entry.count > 0)) {
+            ASSERT_EQ(entry.count, 4);
+            for (size_t i = 1; i < entry.count; i++) {
+                ASSERT_EQ(entry.data.i32[i], entry.data.i32[0]);
+            }
+        }
+    }
+}
+
+void CameraHidlTest::verifyMonochromeCameraResult(
+        const ::android::hardware::camera::common::V1_0::helper::CameraMetadata& metadata) {
+    camera_metadata_ro_entry entry;
+
+    // Check tags that are not applicable for monochrome camera
+    ASSERT_FALSE(metadata.exists(ANDROID_SENSOR_GREEN_SPLIT));
+    ASSERT_FALSE(metadata.exists(ANDROID_SENSOR_NEUTRAL_COLOR_POINT));
+    ASSERT_FALSE(metadata.exists(ANDROID_COLOR_CORRECTION_MODE));
+    ASSERT_FALSE(metadata.exists(ANDROID_COLOR_CORRECTION_TRANSFORM));
+    ASSERT_FALSE(metadata.exists(ANDROID_COLOR_CORRECTION_GAINS));
+
+    // Check dynamicBlackLevel
+    entry = metadata.find(ANDROID_SENSOR_DYNAMIC_BLACK_LEVEL);
+    if (entry.count > 0) {
+        ASSERT_EQ(entry.count, 4);
+        for (size_t i = 1; i < entry.count; i++) {
+            ASSERT_FLOAT_EQ(entry.data.f[i], entry.data.f[0]);
+        }
+    }
+
+    // Check noiseProfile
+    entry = metadata.find(ANDROID_SENSOR_NOISE_PROFILE);
+    if (entry.count > 0) {
+        ASSERT_EQ(entry.count, 2);
+    }
+
+    // Check lensShadingMap
+    entry = metadata.find(ANDROID_STATISTICS_LENS_SHADING_MAP);
+    if (entry.count > 0) {
+        ASSERT_EQ(entry.count % 4, 0);
+        for (size_t i = 0; i < entry.count/4; i++) {
+            ASSERT_FLOAT_EQ(entry.data.f[i*4+1], entry.data.f[i*4]);
+            ASSERT_FLOAT_EQ(entry.data.f[i*4+2], entry.data.f[i*4]);
+            ASSERT_FLOAT_EQ(entry.data.f[i*4+3], entry.data.f[i*4]);
+        }
+    }
+
+    // Check tonemapCurve
+    camera_metadata_ro_entry curveRed = metadata.find(ANDROID_TONEMAP_CURVE_RED);
+    camera_metadata_ro_entry curveGreen = metadata.find(ANDROID_TONEMAP_CURVE_GREEN);
+    camera_metadata_ro_entry curveBlue = metadata.find(ANDROID_TONEMAP_CURVE_BLUE);
+    if (curveRed.count > 0 && curveGreen.count > 0 && curveBlue.count > 0) {
+        ASSERT_EQ(curveRed.count, curveGreen.count);
+        ASSERT_EQ(curveRed.count, curveBlue.count);
+        for (size_t i = 0; i < curveRed.count; i++) {
+            ASSERT_FLOAT_EQ(curveGreen.data.f[i], curveRed.data.f[i]);
+            ASSERT_FLOAT_EQ(curveBlue.data.f[i], curveRed.data.f[i]);
+        }
+    }
+}
+
+
 // Open a device session with empty callbacks and return static metadata.
 void CameraHidlTest::openEmptyDeviceSession(const std::string &name,
         sp<ICameraProvider> provider,
@@ -4864,6 +5210,94 @@
     ASSERT_TRUE(ret.isOk());
 }
 
+void CameraHidlTest::verifyRecommendedConfigs(const CameraMetadata& chars) {
+    size_t CONFIG_ENTRY_SIZE = 5;
+    size_t CONFIG_ENTRY_TYPE_OFFSET = 3;
+    size_t CONFIG_ENTRY_BITFIELD_OFFSET = 4;
+    uint32_t maxPublicUsecase =
+            ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_PUBLIC_END;
+    uint32_t vendorUsecaseStart =
+            ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS_VENDOR_START;
+    uint32_t usecaseMask = (1 << vendorUsecaseStart) - 1;
+    usecaseMask &= ~((1 << maxPublicUsecase) - 1);
+
+    const camera_metadata_t* metadata = reinterpret_cast<const camera_metadata_t*> (chars.data());
+
+    camera_metadata_ro_entry recommendedConfigsEntry, recommendedDepthConfigsEntry, ioMapEntry;
+    recommendedConfigsEntry.count = recommendedDepthConfigsEntry.count = ioMapEntry.count = 0;
+    int retCode = find_camera_metadata_ro_entry(metadata,
+            ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS, &recommendedConfigsEntry);
+    int depthRetCode = find_camera_metadata_ro_entry(metadata,
+            ANDROID_DEPTH_AVAILABLE_RECOMMENDED_DEPTH_STREAM_CONFIGURATIONS,
+            &recommendedDepthConfigsEntry);
+    int ioRetCode = find_camera_metadata_ro_entry(metadata,
+            ANDROID_SCALER_AVAILABLE_RECOMMENDED_INPUT_OUTPUT_FORMATS_MAP, &ioMapEntry);
+    if ((0 != retCode) && (0 != depthRetCode)) {
+        //In case both regular and depth recommended configurations are absent,
+        //I/O should be absent as well.
+        ASSERT_NE(ioRetCode, 0);
+        return;
+    }
+
+    camera_metadata_ro_entry availableKeysEntry;
+    retCode = find_camera_metadata_ro_entry(metadata,
+            ANDROID_REQUEST_AVAILABLE_CHARACTERISTICS_KEYS, &availableKeysEntry);
+    ASSERT_TRUE((0 == retCode) && (availableKeysEntry.count > 0));
+    std::vector<int32_t> availableKeys;
+    availableKeys.reserve(availableKeysEntry.count);
+    availableKeys.insert(availableKeys.end(), availableKeysEntry.data.i32,
+            availableKeysEntry.data.i32 + availableKeysEntry.count);
+
+    if (recommendedConfigsEntry.count > 0) {
+        ASSERT_NE(std::find(availableKeys.begin(), availableKeys.end(),
+                    ANDROID_SCALER_AVAILABLE_RECOMMENDED_STREAM_CONFIGURATIONS),
+                availableKeys.end());
+        ASSERT_EQ((recommendedConfigsEntry.count % CONFIG_ENTRY_SIZE), 0);
+        for (size_t i = 0; i < recommendedConfigsEntry.count; i += CONFIG_ENTRY_SIZE) {
+            int32_t entryType =
+                recommendedConfigsEntry.data.i32[i + CONFIG_ENTRY_TYPE_OFFSET];
+            uint32_t bitfield =
+                recommendedConfigsEntry.data.i32[i + CONFIG_ENTRY_BITFIELD_OFFSET];
+            ASSERT_TRUE((entryType ==
+                     ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_OUTPUT) ||
+                    (entryType ==
+                     ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_INPUT));
+            ASSERT_TRUE((bitfield & usecaseMask) == 0);
+        }
+    }
+
+    if (recommendedDepthConfigsEntry.count > 0) {
+        ASSERT_NE(std::find(availableKeys.begin(), availableKeys.end(),
+                    ANDROID_DEPTH_AVAILABLE_RECOMMENDED_DEPTH_STREAM_CONFIGURATIONS),
+                availableKeys.end());
+        ASSERT_EQ((recommendedDepthConfigsEntry.count % CONFIG_ENTRY_SIZE), 0);
+        for (size_t i = 0; i < recommendedDepthConfigsEntry.count; i += CONFIG_ENTRY_SIZE) {
+            int32_t entryType =
+                recommendedDepthConfigsEntry.data.i32[i + CONFIG_ENTRY_TYPE_OFFSET];
+            uint32_t bitfield =
+                recommendedDepthConfigsEntry.data.i32[i + CONFIG_ENTRY_BITFIELD_OFFSET];
+            ASSERT_TRUE((entryType ==
+                     ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_OUTPUT) ||
+                    (entryType ==
+                     ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_INPUT));
+            ASSERT_TRUE((bitfield & usecaseMask) == 0);
+        }
+
+        if (recommendedConfigsEntry.count == 0) {
+            //In case regular recommended configurations are absent but suggested depth
+            //configurations are present, I/O should be absent.
+            ASSERT_NE(ioRetCode, 0);
+        }
+    }
+
+    if ((ioRetCode == 0) && (ioMapEntry.count > 0)) {
+        ASSERT_NE(std::find(availableKeys.begin(), availableKeys.end(),
+                    ANDROID_SCALER_AVAILABLE_RECOMMENDED_INPUT_OUTPUT_FORMATS_MAP),
+                availableKeys.end());
+        ASSERT_EQ(isZSLModeAvailable(metadata), Status::OK);
+    }
+}
+
 int main(int argc, char **argv) {
   ::testing::AddGlobalTestEnvironment(CameraHidlEnvironment::Instance());
   ::testing::InitGoogleTest(&argc, argv);
diff --git a/compatibility_matrices/compatibility_matrix.3.xml b/compatibility_matrices/compatibility_matrix.3.xml
index e13d293..4cb3776 100644
--- a/compatibility_matrices/compatibility_matrix.3.xml
+++ b/compatibility_matrices/compatibility_matrix.3.xml
@@ -193,7 +193,7 @@
     </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.graphics.composer</name>
-        <version>2.1-2</version>
+        <version>2.1-3</version>
         <interface>
             <name>IComposer</name>
             <instance>default</instance>
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 6858819..fd996fb 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -56,6 +56,14 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.biometrics.face</name>
+        <version>1.0</version>
+        <interface>
+            <name>IBiometricsFace</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.biometrics.fingerprint</name>
         <version>2.1</version>
         <interface>
@@ -113,7 +121,7 @@
     </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.configstore</name>
-        <version>1.1</version>
+        <version>1.2</version>
         <interface>
             <name>ISurfaceFlingerConfigs</name>
             <instance>default</instance>
@@ -137,7 +145,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.drm</name>
-        <version>1.0</version>
+        <version>1.0-1</version>
         <interface>
             <name>ICryptoFactory</name>
             <regex-instance>.*</regex-instance>
@@ -149,7 +157,7 @@
     </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.drm</name>
-        <version>1.1</version>
+        <version>1.2</version>
         <interface>
             <name>ICryptoFactory</name>
             <regex-instance>.*</regex-instance>
@@ -216,16 +224,20 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
-        <name>android.hardware.health.filesystem</name>
+        <name>android.hardware.health.storage</name>
         <version>1.0</version>
         <interface>
-            <name>IFileSystem</name>
+            <name>IStorage</name>
             <instance>default</instance>
         </interface>
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.ir</name>
         <version>1.0</version>
+        <interface>
+            <name>IConsumerIr</name>
+            <instance>default</instance>
+        </interface>
     </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.keymaster</name>
@@ -305,6 +317,14 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.power.stats</name>
+        <version>1.0</version>
+        <interface>
+            <name>IPowerStats</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.radio</name>
         <version>1.0-2</version>
         <interface>
@@ -378,6 +398,7 @@
     <hal format="hidl" optional="true">
         <name>android.hardware.thermal</name>
         <version>1.0-1</version>
+        <version>2.0</version>
         <interface>
             <name>IThermal</name>
             <instance>default</instance>
@@ -441,7 +462,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.wifi</name>
-        <version>1.0-2</version>
+        <version>1.0-3</version>
         <interface>
             <name>IWifi</name>
             <instance>default</instance>
@@ -449,7 +470,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.wifi.hostapd</name>
-        <version>1.0</version>
+        <version>1.0-1</version>
         <interface>
             <name>IHostapd</name>
             <instance>default</instance>
diff --git a/configstore/1.0/vts/functional/VtsHalConfigstoreV1_0TargetTest.cpp b/configstore/1.0/vts/functional/VtsHalConfigstoreV1_0TargetTest.cpp
index a1676be..70b5830 100644
--- a/configstore/1.0/vts/functional/VtsHalConfigstoreV1_0TargetTest.cpp
+++ b/configstore/1.0/vts/functional/VtsHalConfigstoreV1_0TargetTest.cpp
@@ -131,6 +131,27 @@
     }
 }
 
+/**
+ * Make sure the constrains of hasWideColorDisplay, hasHDRDisplay
+ * are enforced.
+ */
+TEST_F(ConfigstoreHidlTest, TestColorConstrainsBasic) {
+    bool hasWideColorDisplay;
+    bool hasHDRDisplay;
+
+    Return<void> status = sfConfigs->hasWideColorDisplay(
+        [&](OptionalBool arg) { hasWideColorDisplay = arg.specified; });
+    EXPECT_OK(status);
+
+    status = sfConfigs->hasHDRDisplay([&](OptionalBool arg) { hasHDRDisplay = arg.specified; });
+    EXPECT_OK(status);
+
+    // When hasHDRDisplay returns true, hasWideColorDisplay must also return true.
+    if (hasHDRDisplay) {
+        ASSERT_TRUE(hasWideColorDisplay);
+    }
+}
+
 int main(int argc, char** argv) {
     ::testing::AddGlobalTestEnvironment(ConfigstoreHidlEnvironment::Instance());
     ::testing::InitGoogleTest(&argc, argv);
diff --git a/configstore/1.1/default/SurfaceFlingerConfigs.h b/configstore/1.1/default/SurfaceFlingerConfigs.h
deleted file mode 100644
index 3714e81..0000000
--- a/configstore/1.1/default/SurfaceFlingerConfigs.h
+++ /dev/null
@@ -1,48 +0,0 @@
-#ifndef ANDROID_HARDWARE_CONFIGSTORE_V1_1_SURFACEFLINGERCONFIGS_H
-#define ANDROID_HARDWARE_CONFIGSTORE_V1_1_SURFACEFLINGERCONFIGS_H
-
-#include <android/hardware/configstore/1.1/ISurfaceFlingerConfigs.h>
-#include <hidl/MQDescriptor.h>
-#include <hidl/Status.h>
-
-namespace android {
-namespace hardware {
-namespace configstore {
-namespace V1_1 {
-namespace implementation {
-
-using ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs;
-using ::android::hardware::Return;
-using ::android::hardware::Void;
-using ::android::sp;
-
-struct SurfaceFlingerConfigs : public ISurfaceFlingerConfigs {
-    // Methods from
-    // ::android::hardware::configstore::V1_0::ISurfaceFlingerConfigs follow.
-    Return<void> vsyncEventPhaseOffsetNs(vsyncEventPhaseOffsetNs_cb _hidl_cb) override;
-    Return<void> vsyncSfEventPhaseOffsetNs(vsyncSfEventPhaseOffsetNs_cb _hidl_cb) override;
-    Return<void> useContextPriority(useContextPriority_cb _hidl_cb) override;
-    Return<void> hasWideColorDisplay(hasWideColorDisplay_cb _hidl_cb) override;
-    Return<void> hasHDRDisplay(hasHDRDisplay_cb _hidl_cb) override;
-    Return<void> presentTimeOffsetFromVSyncNs(presentTimeOffsetFromVSyncNs_cb _hidl_cb) override;
-    Return<void> useHwcForRGBtoYUV(useHwcForRGBtoYUV_cb _hidl_cb) override;
-    Return<void> maxVirtualDisplaySize(maxVirtualDisplaySize_cb _hidl_cb) override;
-    Return<void> hasSyncFramework(hasSyncFramework_cb _hidl_cb) override;
-    Return<void> useVrFlinger(useVrFlinger_cb _hidl_cb) override;
-    Return<void> maxFrameBufferAcquiredBuffers(maxFrameBufferAcquiredBuffers_cb _hidl_cb) override;
-    Return<void> startGraphicsAllocatorService(startGraphicsAllocatorService_cb _hidl_cb) override;
-
-    // Methods from
-    // ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs follow.
-    Return<void> primaryDisplayOrientation(primaryDisplayOrientation_cb _hidl_cb) override;
-
-    // Methods from ::android::hidl::base::V1_0::IBase follow.
-};
-
-}  // namespace implementation
-}  // namespace V1_1
-}  // namespace configstore
-}  // namespace hardware
-}  // namespace android
-
-#endif  // ANDROID_HARDWARE_CONFIGSTORE_V1_1_SURFACEFLINGERCONFIGS_H
diff --git a/configstore/1.2/Android.bp b/configstore/1.2/Android.bp
new file mode 100644
index 0000000..bb4dd4a
--- /dev/null
+++ b/configstore/1.2/Android.bp
@@ -0,0 +1,22 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.configstore@1.2",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "ISurfaceFlingerConfigs.hal",
+    ],
+    interfaces: [
+        "android.hardware.configstore@1.0",
+        "android.hardware.configstore@1.1",
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
+        "android.hardware.graphics.common@1.2",
+        "android.hidl.base@1.0",
+    ],
+    gen_java: true,
+}
+
diff --git a/configstore/1.2/ISurfaceFlingerConfigs.hal b/configstore/1.2/ISurfaceFlingerConfigs.hal
new file mode 100644
index 0000000..e91b2c7
--- /dev/null
+++ b/configstore/1.2/ISurfaceFlingerConfigs.hal
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.1 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.1
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.configstore@1.2;
+
+import android.hardware.graphics.common@1.1::PixelFormat;
+import android.hardware.graphics.common@1.2::Dataspace;
+import @1.1::ISurfaceFlingerConfigs;
+import @1.0::OptionalBool;
+
+/**
+ * New revision of ISurfaceFlingerConfigs
+ */
+interface ISurfaceFlingerConfigs extends @1.1::ISurfaceFlingerConfigs {
+    /**
+     * useColorManagement indicates whether SurfaceFlinger should manage color
+     * by switching to appropriate color mode automatically depending on the
+     * Dataspace of the surfaces on screen.
+     * This function must return true when hasWideColorDisplay or hasHDRDisplay
+     * return true.
+     */
+    useColorManagement() generates (OptionalBool value);
+
+    /**
+     * Returns the default data space and pixel format that SurfaceFlinger
+     * expects to receive and output as well as the wide color gamut data space
+     * and pixel format for wide color gamut surfaces.
+     * To determine the data space and pixel format, there are a few things
+     * we recommend to consider:
+     *
+     *   1. Hardware composer's capability to composite contents with the chosen
+     *      data space and pixel format efficiently;
+     *   2. Hardware composer's ability to composite contents when sRGB contents
+     *      and the chosen wide color gamut data space contents coexist;
+     *   3. For better blending, consider using pixel format where the alpha
+     *      channel has as many bits as the RGB color channel.
+     *   4. Memory consumption and efficient buffer compression when considering
+     *      more bits in pixel format.
+     *
+     * @return dataspace is the default data space that SurfaceFlinger expects.
+     *         The data space must not be Dataspace::UNKNOWN, if unspecified,
+     *         the default data space is Dataspace::V0_SRGB;
+     * @return pixelFormat is the default pixel format that SurfaceFlinger
+     *         expects. If unspecified, the default pixel format is
+     *         PixelFormat::RGBA_8888.
+     * @return wcgDataspace is the data space that SurfaceFlinger expects for
+     *         wide color gamut surfaces.
+     *         When hasWideColorDisplay returns true, this API must return a
+     *         valid wide color gamut data space.
+     *         The data space must not be UNKNOWN, if unspecified, the data space
+     *         is V0_SRGB by default, which essentially indicates there's no wide
+     *         color gamut, meaning hasWideColorDisplay returns false.
+     * @return wcgPixelFormat is the pixel format that SurfaceFlinger expects for
+     *         wide color gamut surfaces. If unspecified, the pixel format is
+     *         PixelFormat::RGBA_8888 by default.
+     */
+    getCompositionPreference()
+        generates (Dataspace dataspace, PixelFormat pixelFormat,
+                   Dataspace wcgDataspace, PixelFormat wcgPixelFormat);
+};
diff --git a/configstore/1.1/default/Android.mk b/configstore/1.2/default/Android.mk
similarity index 67%
rename from configstore/1.1/default/Android.mk
rename to configstore/1.2/default/Android.mk
index 40f621b..b807357 100644
--- a/configstore/1.1/default/Android.mk
+++ b/configstore/1.2/default/Android.mk
@@ -2,15 +2,15 @@
 
 ################################################################################
 include $(CLEAR_VARS)
-LOCAL_MODULE := android.hardware.configstore@1.1-service
+LOCAL_MODULE := android.hardware.configstore@1.2-service
 # seccomp is not required for coverage build.
 ifneq ($(NATIVE_COVERAGE),true)
-LOCAL_REQUIRED_MODULES_arm64 := configstore@1.1.policy
+LOCAL_REQUIRED_MODULES_arm64 := configstore.policy
 endif
-LOCAL_PROPRIETARY_MODULE := true
+LOCAL_VENDOR_MODULE := true
 LOCAL_MODULE_CLASS := EXECUTABLES
 LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_INIT_RC := android.hardware.configstore@1.1-service.rc
+LOCAL_INIT_RC := android.hardware.configstore@1.2-service.rc
 LOCAL_SRC_FILES:= service.cpp
 
 include $(LOCAL_PATH)/surfaceflinger.mk
@@ -23,16 +23,17 @@
     liblog \
     libutils \
     android.hardware.configstore@1.0 \
-    android.hardware.configstore@1.1
+    android.hardware.configstore@1.1 \
+    android.hardware.configstore@1.2
 
 include $(BUILD_EXECUTABLE)
 
 # seccomp filter for configstore
 ifeq ($(TARGET_ARCH), $(filter $(TARGET_ARCH), arm64))
 include $(CLEAR_VARS)
-LOCAL_MODULE := configstore@1.1.policy
+LOCAL_MODULE := configstore.policy
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/seccomp_policy
-LOCAL_SRC_FILES := seccomp_policy/configstore@1.1-$(TARGET_ARCH).policy
+LOCAL_SRC_FILES := seccomp_policy/configstore-$(TARGET_ARCH).policy
 include $(BUILD_PREBUILT)
 endif
diff --git a/configstore/1.1/default/SurfaceFlingerConfigs.cpp b/configstore/1.2/default/SurfaceFlingerConfigs.cpp
similarity index 71%
rename from configstore/1.1/default/SurfaceFlingerConfigs.cpp
rename to configstore/1.2/default/SurfaceFlingerConfigs.cpp
index da3081c..c2cf374 100644
--- a/configstore/1.1/default/SurfaceFlingerConfigs.cpp
+++ b/configstore/1.2/default/SurfaceFlingerConfigs.cpp
@@ -17,16 +17,19 @@
 #include "SurfaceFlingerConfigs.h"
 
 #include <android/hardware/configstore/1.1/types.h>
+#include <android/hardware/graphics/common/1.1/types.h>
 #include <log/log.h>
 
 namespace android {
 namespace hardware {
 namespace configstore {
-namespace V1_1 {
+namespace V1_2 {
 namespace implementation {
 
-// Methods from ::android::hardware::configstore::V1_0::ISurfaceFlingerConfigs
-// follow.
+using ::android::hardware::graphics::common::V1_1::PixelFormat;
+using ::android::hardware::graphics::common::V1_2::Dataspace;
+
+// ::android::hardware::configstore::V1_0::ISurfaceFlingerConfigs implementation.
 Return<void> SurfaceFlingerConfigs::vsyncEventPhaseOffsetNs(vsyncEventPhaseOffsetNs_cb _hidl_cb) {
 #ifdef VSYNC_EVENT_PHASE_OFFSET_NS
     _hidl_cb({true, VSYNC_EVENT_PHASE_OFFSET_NS});
@@ -142,8 +145,7 @@
     return Void();
 }
 
-// Methods from ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs
-// follow.
+// ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs implementation.
 
 #ifdef PRIMARY_DISPLAY_ORIENTATION
 static_assert(PRIMARY_DISPLAY_ORIENTATION == 0 || PRIMARY_DISPLAY_ORIENTATION == 90 ||
@@ -191,10 +193,56 @@
     return Void();
 }
 
-// Methods from ::android::hidl::base::V1_0::IBase follow.
+// ::android::hardware::configstore::V1_2::ISurfaceFlingerConfigs implementation.
+Return<void> SurfaceFlingerConfigs::useColorManagement(useColorManagement_cb _hidl_cb) {
+#if defined(USE_COLOR_MANAGEMENT) || defined(HAS_WIDE_COLOR_DISPLAY) || defined(HAS_HDR_DISPLAY)
+    _hidl_cb({true, true});
+#else
+    _hidl_cb({true, false});
+#endif
+    return Void();
+}
+
+#ifdef DEFAULT_COMPOSITION_DATA_SPACE
+static_assert(DEFAULT_COMPOSITION_DATA_SPACE != 0,
+              "Default composition data space must not be UNKNOWN");
+#endif
+
+#ifdef WCG_COMPOSITION_DATA_SPACE
+static_assert(WCG_COMPOSITION_DATA_SPACE != 0,
+              "Wide color gamut composition data space must not be UNKNOWN");
+#endif
+
+Return<void> SurfaceFlingerConfigs::getCompositionPreference(getCompositionPreference_cb _hidl_cb) {
+    Dataspace defaultDataspace = Dataspace::V0_SRGB;
+    PixelFormat defaultPixelFormat = PixelFormat::RGBA_8888;
+
+#ifdef DEFAULT_COMPOSITION_DATA_SPACE
+    defaultDataspace = static_cast<Dataspace>(DEFAULT_COMPOSITION_DATA_SPACE);
+#endif
+
+#ifdef DEFAULT_COMPOSITION_PIXEL_FORMAT
+    defaultPixelFormat = static_cast<PixelFormat>(DEFAULT_COMPOSITION_PIXEL_FORMAT);
+#endif
+
+    Dataspace wideColorGamutDataspace = Dataspace::V0_SRGB;
+    PixelFormat wideColorGamutPixelFormat = PixelFormat::RGBA_8888;
+
+#ifdef WCG_COMPOSITION_DATA_SPACE
+    wideColorGamutDataspace = static_cast<Dataspace>(WCG_COMPOSITION_DATA_SPACE);
+#endif
+
+#ifdef WCG_COMPOSITION_PIXEL_FORMAT
+    wideColorGamutPixelFormat = static_cast<PixelFormat>(WCG_COMPOSITION_PIXEL_FORMAT);
+#endif
+
+    _hidl_cb(defaultDataspace, defaultPixelFormat, wideColorGamutDataspace,
+             wideColorGamutPixelFormat);
+    return Void();
+}
 
 }  // namespace implementation
-}  // namespace V1_1
+}  // namespace V1_2
 }  // namespace configstore
 }  // namespace hardware
 }  // namespace android
diff --git a/configstore/1.2/default/SurfaceFlingerConfigs.h b/configstore/1.2/default/SurfaceFlingerConfigs.h
new file mode 100644
index 0000000..7dd8f6d
--- /dev/null
+++ b/configstore/1.2/default/SurfaceFlingerConfigs.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.1 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.1
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CONFIGSTORE_V1_2_SURFACEFLINGERCONFIGS_H
+#define ANDROID_HARDWARE_CONFIGSTORE_V1_2_SURFACEFLINGERCONFIGS_H
+
+#include <android/hardware/configstore/1.2/ISurfaceFlingerConfigs.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace configstore {
+namespace V1_2 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::configstore::V1_2::ISurfaceFlingerConfigs;
+
+struct SurfaceFlingerConfigs : public ISurfaceFlingerConfigs {
+    // ::android::hardware::configstore::V1_0::ISurfaceFlingerConfigs implementation.
+    Return<void> vsyncEventPhaseOffsetNs(vsyncEventPhaseOffsetNs_cb _hidl_cb) override;
+    Return<void> vsyncSfEventPhaseOffsetNs(vsyncSfEventPhaseOffsetNs_cb _hidl_cb) override;
+    Return<void> useContextPriority(useContextPriority_cb _hidl_cb) override;
+    Return<void> hasWideColorDisplay(hasWideColorDisplay_cb _hidl_cb) override;
+    Return<void> hasHDRDisplay(hasHDRDisplay_cb _hidl_cb) override;
+    Return<void> presentTimeOffsetFromVSyncNs(presentTimeOffsetFromVSyncNs_cb _hidl_cb) override;
+    Return<void> useHwcForRGBtoYUV(useHwcForRGBtoYUV_cb _hidl_cb) override;
+    Return<void> maxVirtualDisplaySize(maxVirtualDisplaySize_cb _hidl_cb) override;
+    Return<void> hasSyncFramework(hasSyncFramework_cb _hidl_cb) override;
+    Return<void> useVrFlinger(useVrFlinger_cb _hidl_cb) override;
+    Return<void> maxFrameBufferAcquiredBuffers(maxFrameBufferAcquiredBuffers_cb _hidl_cb) override;
+    Return<void> startGraphicsAllocatorService(startGraphicsAllocatorService_cb _hidl_cb) override;
+
+    // ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs follow implementation.
+    Return<void> primaryDisplayOrientation(primaryDisplayOrientation_cb _hidl_cb) override;
+
+    // ::android::hardware::configstore::V1_2::ISurfaceFlingerConfigs follow implementation.
+    Return<void> useColorManagement(useColorManagement_cb _hidl_cb) override;
+    Return<void> getCompositionPreference(getCompositionPreference_cb _hidl_cb) override;
+};
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace configstore
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_CONFIGSTORE_V1_2_SURFACEFLINGERCONFIGS_H
diff --git a/configstore/1.1/default/android.hardware.configstore@1.1-service.rc b/configstore/1.2/default/android.hardware.configstore@1.2-service.rc
similarity index 83%
rename from configstore/1.1/default/android.hardware.configstore@1.1-service.rc
rename to configstore/1.2/default/android.hardware.configstore@1.2-service.rc
index 105678a..d6c5d10 100644
--- a/configstore/1.1/default/android.hardware.configstore@1.1-service.rc
+++ b/configstore/1.2/default/android.hardware.configstore@1.2-service.rc
@@ -1,4 +1,4 @@
-service vendor.configstore-hal /vendor/bin/hw/android.hardware.configstore@1.1-service
+service vendor.configstore-hal /vendor/bin/hw/android.hardware.configstore@1.2-service
     class hal animation
     user system
     group system
diff --git a/configstore/1.1/default/seccomp_policy/configstore@1.1-arm64.policy b/configstore/1.2/default/seccomp_policy/configstore-arm64.policy
similarity index 100%
rename from configstore/1.1/default/seccomp_policy/configstore@1.1-arm64.policy
rename to configstore/1.2/default/seccomp_policy/configstore-arm64.policy
diff --git a/configstore/1.1/default/service.cpp b/configstore/1.2/default/service.cpp
similarity index 80%
rename from configstore/1.1/default/service.cpp
rename to configstore/1.2/default/service.cpp
index 3b4e774..65a42f5 100644
--- a/configstore/1.1/default/service.cpp
+++ b/configstore/1.2/default/service.cpp
@@ -14,27 +14,27 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.configstore@1.1-service"
+#define LOG_TAG "android.hardware.configstore@1.2-service"
 
-#include <android/hardware/configstore/1.1/ISurfaceFlingerConfigs.h>
+#include <android/hardware/configstore/1.2/ISurfaceFlingerConfigs.h>
 #include <hidl/HidlTransportSupport.h>
 #include <hwminijail/HardwareMinijail.h>
 
 #include "SurfaceFlingerConfigs.h"
 
-using android::hardware::configureRpcThreadpool;
-using android::hardware::joinRpcThreadpool;
-using android::hardware::configstore::V1_1::ISurfaceFlingerConfigs;
-using android::hardware::configstore::V1_1::implementation::SurfaceFlingerConfigs;
-using android::hardware::SetupMinijail;
+using android::OK;
 using android::sp;
 using android::status_t;
-using android::OK;
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
+using android::hardware::SetupMinijail;
+using android::hardware::configstore::V1_2::ISurfaceFlingerConfigs;
+using android::hardware::configstore::V1_2::implementation::SurfaceFlingerConfigs;
 
 int main() {
     configureRpcThreadpool(10, true);
 
-    SetupMinijail("/vendor/etc/seccomp_policy/configstore@1.1.policy");
+    SetupMinijail("/vendor/etc/seccomp_policy/configstore.policy");
 
     sp<ISurfaceFlingerConfigs> surfaceFlingerConfigs = new SurfaceFlingerConfigs;
     status_t status = surfaceFlingerConfigs->registerAsService();
diff --git a/configstore/1.1/default/surfaceflinger.mk b/configstore/1.2/default/surfaceflinger.mk
similarity index 71%
rename from configstore/1.1/default/surfaceflinger.mk
rename to configstore/1.2/default/surfaceflinger.mk
index 35922eb..dab6aa5 100644
--- a/configstore/1.1/default/surfaceflinger.mk
+++ b/configstore/1.2/default/surfaceflinger.mk
@@ -54,3 +54,23 @@
 ifneq ($(SF_PRIMARY_DISPLAY_ORIENTATION),)
     LOCAL_CFLAGS += -DPRIMARY_DISPLAY_ORIENTATION=$(SF_PRIMARY_DISPLAY_ORIENTATION)
 endif
+
+ifeq ($(TARGET_USE_COLOR_MANAGEMENT),true)
+    LOCAL_CFLAGS += -DUSE_COLOR_MANAGEMENT
+endif
+
+ifneq ($(SF_DEFAULT_COMPOSITION_DATA_SPACE),)
+    LOCAL_CFLAGS += -DDEFAULT_COMPOSITION_DATA_SPACE=$(SF_DEFAULT_COMPOSITION_DATA_SPACE)
+endif
+
+ifneq ($(SF_DEFAULT_COMPOSITION_PIXEL_FORMAT),)
+    LOCAL_CFLAGS += -DDEFAULT_COMPOSITION_PIXEL_FORMAT=$(SF_DEFAULT_COMPOSITION_PIXEL_FORMAT)
+endif
+
+ifneq ($(SF_WCG_COMPOSITION_DATA_SPACE),)
+    LOCAL_CFLAGS += -DWCG_COMPOSITION_DATA_SPACE=$(SF_WCG_COMPOSITION_DATA_SPACE)
+endif
+
+ifneq ($(SF_WCG_COMPOSITION_PIXEL_FORMAT),)
+    LOCAL_CFLAGS += -DWCG_COMPOSITION_PIXEL_FORMAT=$(SF_WCG_COMPOSITION_PIXEL_FORMAT)
+endif
diff --git a/configstore/1.2/vts/functional/Android.bp b/configstore/1.2/vts/functional/Android.bp
new file mode 100644
index 0000000..5f1eca6
--- /dev/null
+++ b/configstore/1.2/vts/functional/Android.bp
@@ -0,0 +1,27 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalConfigstoreV1_2TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: ["VtsHalConfigstoreV1_2TargetTest.cpp"],
+    static_libs: [
+        "android.hardware.configstore@1.0",
+        "android.hardware.configstore@1.1",
+        "android.hardware.configstore@1.2",
+    ],
+}
+
diff --git a/configstore/1.2/vts/functional/OWNERS b/configstore/1.2/vts/functional/OWNERS
new file mode 100644
index 0000000..2b4fb8c
--- /dev/null
+++ b/configstore/1.2/vts/functional/OWNERS
@@ -0,0 +1,7 @@
+# Graphics team
+lpy@google.com
+olv@google.com
+stoza@google.com
+
+# VTS team
+yim@google.com
diff --git a/configstore/1.2/vts/functional/VtsHalConfigstoreV1_2TargetTest.cpp b/configstore/1.2/vts/functional/VtsHalConfigstoreV1_2TargetTest.cpp
new file mode 100644
index 0000000..dc5fec5
--- /dev/null
+++ b/configstore/1.2/vts/functional/VtsHalConfigstoreV1_2TargetTest.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "ConfigstoreHidlHalTest"
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+#include <android-base/logging.h>
+#include <android/hardware/configstore/1.0/types.h>
+#include <android/hardware/configstore/1.2/ISurfaceFlingerConfigs.h>
+#include <unistd.h>
+
+using ::android::sp;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::configstore::V1_0::OptionalBool;
+using ::android::hardware::configstore::V1_0::OptionalInt64;
+using ::android::hardware::configstore::V1_0::OptionalUInt64;
+using ::android::hardware::configstore::V1_2::ISurfaceFlingerConfigs;
+using ::android::hardware::graphics::common::V1_1::PixelFormat;
+using ::android::hardware::graphics::common::V1_2::Dataspace;
+
+#define ASSERT_OK(ret) ASSERT_TRUE(ret.isOk())
+#define EXPECT_OK(ret) EXPECT_TRUE(ret.isOk())
+
+// Test environment for Configstore HIDL HAL.
+class ConfigstoreHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static ConfigstoreHidlEnvironment* Instance() {
+        static ConfigstoreHidlEnvironment* instance = new ConfigstoreHidlEnvironment;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<ISurfaceFlingerConfigs>(); }
+};
+
+class ConfigstoreHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    sp<ISurfaceFlingerConfigs> sfConfigs;
+
+    virtual void SetUp() override {
+        sfConfigs = ::testing::VtsHalHidlTargetTestBase::getService<ISurfaceFlingerConfigs>(
+            ConfigstoreHidlEnvironment::Instance()->getServiceName<ISurfaceFlingerConfigs>());
+        ASSERT_NE(sfConfigs, nullptr);
+    }
+
+    virtual void TearDown() override {}
+
+    bool isSupportedWideColorGamut(Dataspace dataspace) {
+        Dataspace standard = static_cast<Dataspace>(dataspace & Dataspace::STANDARD_MASK);
+        return standard == Dataspace::STANDARD_DCI_P3 || standard == Dataspace::STANDARD_BT2020;
+    }
+};
+
+/**
+ * Make sure the constrains of hasWideColorDisplay, hasHDRDisplay
+ * and useColorManagement are enforced.
+ */
+TEST_F(ConfigstoreHidlTest, TestColorConstrainsWithColorManagement) {
+    bool hasWideColorDisplay;
+    bool hasHDRDisplay;
+    bool useColorManagement;
+
+    Return<void> status = sfConfigs->hasWideColorDisplay(
+        [&](OptionalBool arg) { hasWideColorDisplay = arg.specified; });
+    EXPECT_OK(status);
+
+    status = sfConfigs->hasHDRDisplay([&](OptionalBool arg) { hasHDRDisplay = arg.specified; });
+    EXPECT_OK(status);
+
+    status = sfConfigs->useColorManagement(
+        [&](OptionalBool arg) { useColorManagement = arg.specified; });
+    EXPECT_OK(status);
+
+    // When hasHDRDisplay returns true, hasWideColorDisplay must also return true.
+    if (hasHDRDisplay) {
+        ASSERT_TRUE(hasWideColorDisplay);
+    }
+
+    // When hasWideColorDisplay returns true, useColorManagement
+    // must also return true.
+    if (hasWideColorDisplay) {
+        ASSERT_TRUE(useColorManagement);
+    }
+}
+
+TEST_F(ConfigstoreHidlTest, TestGetCompositionPreference) {
+    bool hasWideColorDisplay;
+
+    Return<void> status = sfConfigs->hasWideColorDisplay(
+        [&](OptionalBool arg) { hasWideColorDisplay = arg.specified; });
+    EXPECT_OK(status);
+
+    Dataspace defaultDataspace, wcgDataspace;
+
+    status = sfConfigs->getCompositionPreference(
+        [&](auto tmpDefaultDataspace, PixelFormat, auto tmpWcgDataspace, PixelFormat) {
+            defaultDataspace = tmpDefaultDataspace;
+            wcgDataspace = tmpWcgDataspace;
+        });
+    EXPECT_OK(status);
+
+    // Default data space and wide color gamut data space must not be UNKNOWN.
+    ASSERT_TRUE(defaultDataspace != Dataspace::UNKNOWN && wcgDataspace != Dataspace::UNKNOWN);
+
+    // If hasWideColorDisplay returns true, the wide color gamut data space must be a valid wide
+    // color gamut.
+    if (hasWideColorDisplay) {
+        ASSERT_TRUE(isSupportedWideColorGamut(wcgDataspace));
+    }
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(ConfigstoreHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    ConfigstoreHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    return status;
+}
diff --git a/configstore/utils/Android.bp b/configstore/utils/Android.bp
index 178f245..e0d4aa8 100644
--- a/configstore/utils/Android.bp
+++ b/configstore/utils/Android.bp
@@ -30,12 +30,14 @@
     shared_libs: [
         "android.hardware.configstore@1.0",
         "android.hardware.configstore@1.1",
+        "android.hardware.configstore@1.2",
         "libbase",
         "libhidlbase"
     ],
     export_shared_lib_headers: [
         "android.hardware.configstore@1.0",
         "android.hardware.configstore@1.1",
+        "android.hardware.configstore@1.2",
         "libbase",
         "libhidlbase"
     ],
diff --git a/contexthub/1.0/default/OWNERS b/contexthub/1.0/default/OWNERS
index 49a3204..5373073 100644
--- a/contexthub/1.0/default/OWNERS
+++ b/contexthub/1.0/default/OWNERS
@@ -1,2 +1,4 @@
-ashutoshj@google.com
+aarossig@google.com
+arthuri@google.com
 bduddie@google.com
+bstack@google.com
diff --git a/contexthub/1.0/vts/functional/OWNERS b/contexthub/1.0/vts/functional/OWNERS
index ad036b4..ee01441 100644
--- a/contexthub/1.0/vts/functional/OWNERS
+++ b/contexthub/1.0/vts/functional/OWNERS
@@ -1,6 +1,8 @@
 #Context Hub team
-ashutoshj@google.com
+aarossig@google.com
+arthuri@google.com
 bduddie@google.com
+bstack@google.com
 
 #VTS team
 yim@google.com
diff --git a/current.txt b/current.txt
index f0082a3..e19fb63 100644
--- a/current.txt
+++ b/current.txt
@@ -385,6 +385,11 @@
 10ff2fae516346b86121368ce5790d5accdfcb73983246b813f3d488b66db45a android.hardware.wifi.supplicant@1.1::ISupplicantStaNetwork
 
 # ABI preserving changes to HALs during Android Q
+2a55e224aa9bc62c0387cd85ad3c97e33f0c33a4e1489cbae86b2523e6f9df35 android.hardware.camera.device@3.2::ICameraDevice
+f61b616732d8f374e030f90575d7eba3ecc99d209a05b945949ba892bcb81e1d android.hardware.camera.device@3.2::ICameraDeviceSession
+684702a60deef03a1e8093961dc0a18c555c857ad5a77ba7340b0635ae01eb70 android.hardware.camera.device@3.4::ICameraDeviceSession
+291638a1b6d4e63283e9e722ab5049d9351717ffa2b66162124f84d1aa7c2835 android.hardware.camera.metadata@3.2::types
+dd2436f251a90f3e5e7ed773b1aeae21e381b00ae26b10ebe3a1001c894e5980 android.hardware.camera.metadata@3.3::types
 da33234403ff5d60f3473711917b9948e6484a4260b5247acdafb111193a9de2 android.hardware.configstore@1.0::ISurfaceFlingerConfigs
 21165b8e30c4b2d52980e4728f661420adc16e38bbe73476c06b2085be908f4c android.hardware.gnss@1.0::IGnssCallback
 d702fb01dc2a0733aa820b7eb65435ee3334f75632ef880bafd2fb8803a20a58 android.hardware.gnss@1.0::IGnssMeasurementCallback
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index f9c868d..666653b 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -52,7 +52,6 @@
     Return<void> CryptoPlugin::setSharedBufferBase(const hidl_memory& base,
             uint32_t bufferId) {
         sp<IMemory> hidlMemory = mapMemory(base);
-        ALOGE_IF(hidlMemory == nullptr, "mapMemory returns nullptr");
 
         // allow mapMemory to return nullptr
         mSharedBufferMap[bufferId] = hidlMemory;
diff --git a/drm/1.2/Android.bp b/drm/1.2/Android.bp
new file mode 100644
index 0000000..66a1bd8
--- /dev/null
+++ b/drm/1.2/Android.bp
@@ -0,0 +1,26 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.drm@1.2",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "ICryptoFactory.hal",
+        "IDrmFactory.hal",
+        "IDrmPlugin.hal",
+    ],
+    interfaces: [
+        "android.hardware.drm@1.0",
+        "android.hardware.drm@1.1",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "KeySetId",
+        "OfflineLicenseState",
+    ],
+    gen_java: false,
+}
+
diff --git a/drm/1.2/ICryptoFactory.hal b/drm/1.2/ICryptoFactory.hal
new file mode 100644
index 0000000..c4a9b4b
--- /dev/null
+++ b/drm/1.2/ICryptoFactory.hal
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.drm@1.2;
+
+import @1.1::ICryptoFactory;
+
+/**
+ * ICryptoFactory is the main entry point for interacting with a vendor's
+ * crypto HAL to create crypto plugins. Crypto plugins create crypto sessions
+ * which are used by a codec to decrypt protected video content.
+ *
+ * The 1.2 factory must always create 1.2 ICryptoPlugin interfaces, which are
+ * returned via the 1.0 createPlugin method.
+ *
+ * To use 1.2 features the caller must cast the returned interface to a
+ * 1.2 HAL, using V1_2::IDrmPlugin::castFrom().
+ *
+ * The ICryptoFactory hal is required because all top-level interfaces
+ * have to be updated in a minor uprev.
+ */
+interface ICryptoFactory extends @1.1::ICryptoFactory {
+};
diff --git a/drm/1.2/IDrmFactory.hal b/drm/1.2/IDrmFactory.hal
new file mode 100644
index 0000000..c94e4bb
--- /dev/null
+++ b/drm/1.2/IDrmFactory.hal
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.drm@1.2;
+
+import @1.1::IDrmFactory;
+import @1.1::IDrmPlugin;
+
+/**
+ * IDrmFactory is the main entry point for interacting with a vendor's
+ * drm HAL to create drm plugin instances. A drm plugin instance
+ * creates drm sessions which are used to obtain keys for a crypto
+ * session so it can decrypt protected video content.
+ *
+ * The 1.2 factory must always create 1.2 IDrmPlugin interfaces, which are
+ * returned via the 1.0 createPlugin method.
+ *
+ * To use 1.2 features the caller must cast the returned interface to a
+ * 1.2 HAL, using V1_2::IDrmPlugin::castFrom().
+ *
+ * The IDrmFactory hal is required because all top-level interfaces
+ * have to be updated in a minor uprev.
+ */
+
+interface IDrmFactory extends @1.1::IDrmFactory {
+};
diff --git a/drm/1.2/IDrmPlugin.hal b/drm/1.2/IDrmPlugin.hal
new file mode 100644
index 0000000..88338d6
--- /dev/null
+++ b/drm/1.2/IDrmPlugin.hal
@@ -0,0 +1,94 @@
+/**
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.drm@1.2;
+
+import @1.1::IDrmPlugin;
+import @1.0::Status;
+
+/**
+ * IDrmPlugin is used to interact with a specific drm plugin that was created by
+ * IDrm::createPlugin. A drm plugin provides methods for obtaining drm keys that
+ * may be used by a codec to decrypt protected video content.
+ */
+interface IDrmPlugin extends @1.1::IDrmPlugin {
+
+    /**
+     * The keys in an offline license allow protected content to be
+     * played even if the device is not connected to a network.
+     * Offline licenses are stored on the device after a key
+     * request/response exchange when the key request KeyType is
+     * OFFLINE. Normally each app is responsible for keeping track of
+     * the KeySetIds it has created. In some situations however, it
+     * may be necessary to request the list of stored offline license
+     * KeySetIds. If an app loses the KeySetId for any stored licenses
+     * that it created, for example, it must be able to recover the
+     * stored KeySetIds so those licenses can be removed when they
+     * expire or when the app is uninstalled.
+     * <p>
+     * This method returns a list of the KeySetIds for all offline
+     * licenses. The offline license KeySetId may be used to query
+     * the status of an offline license or remove it.
+     *
+     * @return status the status of the call. May be OK or
+     *     ERROR_DRM_INVALID_STATE if the HAL is in a state where the
+     *     KeySetIds can't be returned.
+     * @return a list of offline license keySetIds. If there are no offline
+     *     licenses, the list must be empty and OK must be returned as the
+     *     status.
+     */
+    getOfflineLicenseKeySetIds() generates (Status status, vec<KeySetId> keySetIds);
+
+    /**
+     * Normally offline licenses are released using a key
+     * request/response exchange using getKeyRequest where the KeyType
+     * is RELEASE, followed by provideKeyResponse. This allows the
+     * server to cryptographically confirm that the license has been
+     * removed and then adjust the count of offline licenses allocated
+     * to the device.
+     * <p>
+     * In some exceptional situations it may be necessary to directly
+     * remove offline licenses without notifying the server, which may
+     * be performed using this method.
+     *
+     * @param keySetId the id of the offline license to remove
+     * @return status the status of the call. May be one of OK on
+     *     success, BAD_VALUE if the license is not found or
+     *     ERROR_DRM_INVALID_STATE if the HAL is in a state where the
+     *     KeySetIds can't be returned.
+     */
+    removeOfflineLicense(KeySetId keySetId) generates (Status status);
+
+    /**
+     * Request the state of an offline license. An offline license may
+     * be usable or inactive. The keys in a usable offline license are
+     * available for decryption. When the offline license state is
+     * inactive, the keys have been marked for release using
+     * getKeyRequest with KeyType RELEASE but the key response has not
+     * been received. The keys in an inactive offline license are not
+     * usable for decryption.
+     *
+     * @param keySetId the id of the offline license
+     * @return status the status of the call. May be one of OK on
+     *     success, BAD_VALUE if the license is not found or
+     *     ERROR_DRM_INVALID_STATE if the HAL is in a state where the
+     *     offline license state can't be queried.
+     * @return the offline license state, one of USABLE or INACTIVE.
+     *     If the return status is not OK then state must be set to
+     *     UNKNOWN.
+     */
+    getOfflineLicenseState(KeySetId keySetId) generates (Status status,
+            OfflineLicenseState state);
+};
diff --git a/drm/1.2/types.hal b/drm/1.2/types.hal
new file mode 100644
index 0000000..8770c79
--- /dev/null
+++ b/drm/1.2/types.hal
@@ -0,0 +1,45 @@
+/**
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.drm@1.2;
+
+enum OfflineLicenseState : uint32_t {
+    /**
+     * Offline license state is unknown
+     */
+    UNKNOWN,
+
+    /**
+     * Offline license state is usable, the keys may be used for decryption.
+     */
+    USABLE,
+
+    /**
+     * Offline license state is inactive, the keys have been marked for
+     * release using {@link #getKeyRequest} with KEY_TYPE_RELEASE but the
+     * key response has not been received.
+     */
+    INACTIVE
+};
+
+/**
+ * KeySetId is an identifier that references a set of keys in an
+ * offline license. The keySetId is created by the HAL implementation
+ * and returned from provideKeyResponse and getOfflineLicenseIds. The
+ * framework passes KeySetId back to the HAL when referring to the key
+ * set in methods that take a KeySetId as an input parameter.
+ */
+typedef vec<uint8_t> KeySetId;
diff --git a/graphics/bufferqueue/2.0/Android.bp b/graphics/bufferqueue/2.0/Android.bp
new file mode 100644
index 0000000..5385f28
--- /dev/null
+++ b/graphics/bufferqueue/2.0/Android.bp
@@ -0,0 +1,27 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.graphics.bufferqueue@2.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IGraphicBufferProducer.hal",
+        "IProducerListener.hal",
+    ],
+    interfaces: [
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
+        "android.hardware.graphics.common@1.2",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "ConnectionType",
+        "SlotIndex",
+        "Status",
+    ],
+    gen_java: true,
+}
+
diff --git a/graphics/bufferqueue/2.0/IGraphicBufferProducer.hal b/graphics/bufferqueue/2.0/IGraphicBufferProducer.hal
new file mode 100644
index 0000000..734c0b4
--- /dev/null
+++ b/graphics/bufferqueue/2.0/IGraphicBufferProducer.hal
@@ -0,0 +1,648 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.bufferqueue@2.0;
+
+import android.hardware.graphics.common@1.2::HardwareBuffer;
+import android.hardware.graphics.common@1.2::HardwareBufferDescription;
+import android.hardware.graphics.common@1.2::Rect;
+
+import IProducerListener;
+
+/**
+ * Ref: frameworks/native/include/gui/IGraphicBufferProducer.h:
+ *      IGraphicBufferProducer
+ * This is a wrapper/wrapped HAL interface for the actual binder interface.
+ */
+interface IGraphicBufferProducer {
+    /**
+     * Sets the maximum number of buffers that can be dequeued at one time. If
+     * this method succeeds, any new buffer slots shall be both unallocated and
+     * owned by the buffer queue, i.e., they are not owned by the producer or
+     * the consumer. Calling this may cause some buffer slots to be emptied. If
+     * the caller is caching the contents of the buffer slots, it must empty
+     * that cache after calling this method.
+     *
+     * @p maxDequeuedBuffers must not be less than the number of currently
+     * dequeued buffer slots; otherwise, the returned @p status shall be
+     * `BAD_VALUE`.
+     *
+     * @p maxDequeuedBuffers must be at least 1 (inclusive), but at most
+     * (`NUM_BUFFER_SLOTS` - the minimum undequeued buffer count) (exclusive).
+     * The minimum undequeued buffer count can be obtained by calling
+     * `query(ANATIVEWINDOW_QUERY_MIN_UNDEQUEUED_BUFFERS)`.
+     *
+     * Before calling setMaxDequeuedBufferCount(), the caller must make sure
+     * that
+     *   - @p maxDequeuedBuffers is greater than or equal to 1.
+     *   - @p maxDequeuedBuffers is greater than or equal to the number of
+     *     currently dequeued buffer slots.
+     * If any of these conditions do not hold, or if the request to set the new
+     * maximum number of dequeued buffers cannot be accomplished for any other
+     * reasons, `BAD_VALUE` shall be returned in @p status.
+     *
+     * @param maxDequeuedBuffers The desired number of buffers that can be
+     *     dequeued at one time.
+     * @return status Status of the call.
+     */
+    setMaxDequeuedBufferCount(
+            int32_t maxDequeuedBuffers
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Assigns a newly created buffer to the given slot index. The client is
+     * expected to mirror the slot-to-buffer mapping so that it is not necessary
+     * to transfer a `HardwareBuffer` object for every dequeue operation.
+     *
+     * If @p slot is not a valid slot index corresponding to a dequeued buffer,
+     * the call shall fail with @p status set to `BAD_VALUE`.
+     *
+     * @param slot Slot index.
+     * @return status Status of the call.
+     * @return buffer New buffer associated to the given slot index.
+     */
+    requestBuffer(
+            int32_t slot
+        ) generates (
+            Status status,
+            HardwareBuffer buffer
+        );
+
+    /**
+     * Sets the async flag: whether the producer intends to asynchronously queue
+     * buffers without blocking. Typically this is used for triple-buffering
+     * and/or when the swap interval is set to zero.
+     *
+     * Enabling async mode may internally allocate an additional buffer to allow
+     * for the asynchronous behavior. If it is not enabled, queue/dequeue calls
+     * may block.
+     *
+     * Changing the async flag may affect the number of available slots. If the
+     * adjustment to the number of slots cannot be made, @p status shall be set
+     * to `BAD_VALUE`.
+     *
+     * @param async True if the asynchronous operation is desired; false
+     *     otherwise.
+     * @return status Status of the call.
+     */
+    setAsyncMode(
+            bool async
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Input data for dequeueBuffer() specifying desired attributes of a buffer
+     * to dequeue.
+     *
+     * This structure contains 4 fields from
+     * +llndk libnativewindow#AHardwareBuffer_Desc.
+     *
+     * The `width` and `height` parameters must be no greater than the minimum
+     * of `GL_MAX_VIEWPORT_DIMS` and `GL_MAX_TEXTURE_SIZE` (see:
+     * glGetIntegerv()). An error due to invalid dimensions may not be reported
+     * until updateTexImage() is called.
+     *
+     * If `width` and `height` are both zero, the default dimensions shall be
+     * used. If only one of `width` and `height` is zero, dequeueBuffer() shall
+     * return `BAD_VALUE` in `status`.
+     *
+     * If `format` is zero, the default format shall be used.
+     *
+     * `usage` shall be merged with the usage flags set from the consumer side.
+     *
+     * @sa +llndk libnativewindow#AHardwareBuffer_Desc.
+     */
+    struct DequeueBufferInput {
+        uint32_t width;
+        uint32_t height;
+        uint32_t format;
+        uint64_t usage;
+    };
+
+    /**
+     * Output data for dequeueBuffer().
+     *
+     * A `DequeueBufferOutput` object returned from dequeueBuffer() shall be
+     * valid if and only if `status` returned from the same call is `OK`.
+     */
+    struct DequeueBufferOutput {
+        /**
+         * The number of frames that have elapsed since the buffer was last
+         * queued.
+         */
+        uint64_t bufferAge;
+        /**
+         * Whether the client must call requestBuffer().
+         */
+        bool bufferNeedsReallocation;
+        /**
+         * Whether the client must discard the mirrored slot-to-buffer
+         * mapping.
+         */
+        bool releaseAllBuffers;
+        /**
+         * Fence associated with the buffer.
+         *
+         * If this is an empty fence, the buffer may be written immediately;
+         * otherwise, the buffer must not be written to until the fence signals.
+         */
+        Fence fence;
+    };
+
+    /**
+     * Requests a new buffer slot for the client to use. Ownership of the slot
+     * is transfered to the client, meaning that the server shall not use the
+     * contents of the buffer associated with that slot.
+     *
+     * On success, @p status shall be `OK`, and @p output shall contain valid
+     * information of the call. Otherwise, the contents of @p output are
+     * meaningless.
+     *
+     * The slot index returned in @p slot may or may not contain a buffer
+     * (client-side). If the slot is empty, the client must call
+     * requestBuffer() to assign a new buffer to that slot.
+     *
+     * Once the client is done filling this buffer, it is expected to transfer
+     * buffer ownership back to the server with either cancelBuffer() on
+     * the dequeued slot or to fill in the contents of its associated buffer
+     * contents and call queueBuffer().
+     *
+     * If dequeueBuffer() returns with `output.releaseAllBuffers` set to `true`,
+     * the client is expected to release all of the mirrored slot-to-buffer
+     * mappings.
+     *
+     * If dequeueBuffer() returns with `output.bufferNeedsReallocation` set to
+     * `true`, the client is expected to call requestBuffer() immediately.
+     *
+     * The returned `output.fence` shall be updated to hold the fence associated
+     * with the buffer. The contents of the buffer must not be overwritten until
+     * the fence signals. If the fence is an empty fence, the buffer may be
+     * written immediately.
+     *
+     * This call shall block until a buffer is available to be dequeued. If
+     * both the producer and consumer are controlled by the app, then this call
+     * can never block and shall return `WOULD_BLOCK` in @p status if no buffer
+     * is available.
+     *
+     * If a dequeue operation shall cause certain conditions on the number of
+     * buffers to be violated (such as the maximum number of dequeued buffers),
+     * @p status shall be set to `INVALID_OPERATION` to indicate failure.
+     *
+     * If a dequeue operation cannot be completed within the time period
+     * previously set by setDequeueTimeout(), the return @p status shall
+     * `TIMED_OUT`.
+     *
+     * See @ref DequeueBufferInput for more information on the @p input
+     * parameter.
+     *
+     * @param input See #DequeueBufferInput for more information.
+     * @param status Status of the call.
+     * @param slot Slot index.
+     * @param output See #DequeueBufferOutput for more information.
+     *
+     * @sa queueBuffer(), requestBuffer().
+     */
+    dequeueBuffer(
+            DequeueBufferInput input
+        ) generates (
+            Status status,
+            int32_t slot,
+            DequeueBufferOutput output
+        );
+
+    /**
+     * Attempts to remove all ownership of the buffer in the given slot from the
+     * buffer queue.
+     *
+     * If this call succeeds, the slot shall be freed, and there shall be no way
+     * to obtain the buffer from this interface. The freed slot shall remain
+     * unallocated until either it is selected to hold a freshly allocated
+     * buffer in dequeueBuffer() or a buffer is attached to the slot. The buffer
+     * must have already been dequeued, and the caller must already possesses
+     * the buffer (i.e., must have called requestBuffer()).
+     *
+     * @param slot Slot index.
+     * @return status Status of the call.
+     */
+    detachBuffer(
+            int32_t slot
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Dequeues a buffer slot, requests the buffer associated to the slot, and
+     * detaches it from the buffer queue. This is equivalent to calling
+     * dequeueBuffer(), requestBuffer(), and detachBuffer() in succession except
+     * for two things:
+     *   1. It is unnecessary to provide a #DequeueBufferInput object.
+     *   2. The call shall not block, since if it cannot find an appropriate
+     *      buffer to return, it shall return an error instead.
+     *
+     * Only slots that are free but still contain a buffer shall be considered,
+     * and the oldest of those shall be returned. @p buffer is equivalent to the
+     * buffer that would be returned from requestBuffer(), and @p fence is
+     * equivalent to the fence that would be returned from dequeueBuffer().
+     *
+     * @return status Status of the call.
+     * @return buffer Buffer just released from the buffer queue.
+     * @return fence Fence associated to @p buffer.
+     *
+     * @sa dequeueBuffer(), requestBuffer(), detachBuffer().
+     */
+    detachNextBuffer(
+        ) generates (
+            Status status,
+            HardwareBuffer buffer,
+            Fence fence
+        );
+
+    /**
+     * Attempts to transfer ownership of a buffer to the buffer queue.
+     *
+     * If this call succeeds, it shall be as if this buffer was dequeued from the
+     * returned slot index. As such, this call shall fail if attaching this
+     * buffer would cause too many buffers to be simultaneously dequeued.
+     *
+     * If the returned @p releaseAllBuffers is `true`, the caller is expected to
+     * release all of the mirrored slot-to-buffer mappings.
+     *
+     * See dequeueBuffer() for conditions that may cause the call to fail.
+     *
+     * @param buffer Buffer to attach to the buffer queue.
+     * @return status Status of the call.
+     * @return slot Slot index assigned to @p buffer.
+     * @return releaseAllBuffers Whether the caller is expected to release all
+     *     of the mirrored slot-to-buffer mappings.
+     *
+     * @sa dequeueBuffer().
+     */
+    attachBuffer(
+            HardwareBuffer buffer
+        ) generates (
+            Status status,
+            int32_t slot,
+            bool releaseAllBuffers
+        );
+
+    struct QueueBufferInput {
+        /**
+         * Timestamp in nanoseconds.
+         */
+        int64_t timestamp;
+        /**
+         * Whether the timestamp was synthesized at queue time.
+         */
+        bool isAutoTimestamp;
+        /**
+         * Dataspace of the contents.
+         *
+         * @sa +ndk libnativewindow#ADataSpace.
+         */
+        int32_t dataSpace;
+        /**
+         * Crop rectangle that is used as a hint to the consumer.
+         */
+        Rect crop;
+        /**
+         * Transformation flags.
+         *
+         * @sa +ndk libnativewindow#ANativeWindowTransform.
+         */
+        int32_t transform;
+        /**
+         * The sticky transform set in Surface (only used by the LEGACY camera
+         * mode).
+         *
+         * @sa +ndk libnativewindow#ANativeWindowTransform.
+         */
+        int32_t stickyTransform;
+        /**
+         * Fence that the consumer must wait on before reading the buffer. An
+         * empty fence indicates that the buffer is ready immediately.
+         */
+        Fence fence;
+        /**
+         * List of rectangular pieces covering the damage region.
+         */
+        vec<Rect> surfaceDamage;
+    };
+
+    /**
+     * Information about the queued buffer. `QueueBufferOutput` is used in both
+     * queueBuffer() and connect().
+     */
+    struct QueueBufferOutput {
+        /**
+         * Default width of a buffer in the buffer queue.
+         */
+        uint32_t width;
+        /**
+         * Default height of a buffer in the buffer queue.
+         */
+        uint32_t height;
+        /**
+         * The transform hint of the buffer queue.
+         *
+         * @sa +ndk libnativewindow#ANativeWindowTransform.
+         */
+        int32_t transformHint;
+        /**
+         * The number of pending buffers in the buffer queue. If this is
+         * returned from queueBuffer(), the number shall include the buffer that
+         * has just been queued.
+         */
+        uint32_t numPendingBuffers;
+        /**
+         * The frame number of the next frame. The buffer queue maintains this
+         * number and makes sure that it is increasing for every successful
+         * queueBuffer() call.
+         */
+        uint64_t nextFrameNumber;
+        /**
+         * After a successful queueBuffer() call, #bufferReplaced shall be set to
+         * true if the queued buffer replaced a previously queued buffer that
+         * has not been consumed.
+         */
+        bool bufferReplaced;
+    };
+
+    /**
+     * Indicates that the client has finished filling in the contents of the
+     * buffer associated with slot and transfers ownership of that slot back to
+     * the buffer queue.
+     *
+     * @p status may be set to `BAD_VALUE` if any of the following conditions
+     * hold:
+     *   - The buffer queue is operating in the asynchronous mode, and the
+     *     buffer count was smaller than the maximum number of buffers that can
+     *     be allocated at once.
+     *   - @p slot is an invalid slot index, i.e., the slot is not owned by the
+     *     client by previously calling dequeueBuffer(), requestBuffer() or
+     *     attachBuffer().
+     *   - The crop rectangle is not contained in the buffer.
+     *
+     * Upon success, the output shall be filled with meaningful values
+     * (refer to the documentation of @ref QueueBufferOutput).
+     *
+     * @param slot Slot index.
+     * @param input See @ref QueueBufferInput.
+     * @return status Status of the call.
+     * @return output See @ref QueueBufferOutput.
+     *
+     * @sa #QueueBufferInput, #QueueBufferOutput, dequeueBuffer().
+     */
+    queueBuffer(
+            int32_t slot,
+            QueueBufferInput input
+        ) generates (
+            Status status,
+            QueueBufferOutput output
+        );
+
+    /**
+     * Indicates that the client does not wish to fill in the buffer associated
+     * with the slot and transfers ownership of the slot back to the server. The
+     * buffer is not queued for use by the consumer.
+     *
+     * If @p fence is not an empty fence, the buffer shall not be overwritten
+     * until the fence signals. @p fence is usually obtained from
+     * dequeueBuffer().
+     *
+     * @param slot Slot index.
+     * @param fence Fence for the canceled buffer.
+     * @return status Status of the call.
+     */
+    cancelBuffer(
+            int32_t slot,
+            Fence fence
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Retrieves information for this surface.
+     *
+     * @param what What to query. @p what must be one of the values in
+     *     +llndk libnativewindow#ANativeWindowQuery.
+     * @return status Status of the call.
+     * @return value The value queried. The set of possible values depends on
+     *     the value of @p what.
+     *
+     * @sa +llndk libnativewindow#ANativeWindowQuery.
+     */
+    query(
+            int32_t what
+        ) generates (
+            int32_t result,
+            int32_t value
+        );
+
+    /**
+     * Attempts to connect the client as a producer of the buffer queue.
+     * This method must be called before any other methods in this interface.
+     *
+     * If the buffer queue does not have a consumer ready (connected), the
+     * return @p status shall be `NO_INIT`.
+     *
+     * If any of the following conditions hold, the error code `BAD_VALUE` shall
+     * be reported in @p status:
+     *   - The producer is already connected.
+     *   - The number of available slots cannot be adjusted to accommodate the
+     *     supplied value of @p producerControlledByApp.
+     *
+     * @param listener An optional callback object that can be provided if the
+     *     client wants to be notified when the consumer releases a buffer back
+     *     to the buffer queue.
+     * @param api How the client shall write to buffers.
+     * @param producerControlledByApp `true` if the producer is hosted by an
+     *     untrusted process (typically application-forked processes). If both
+     *     the producer and the consumer are controlled by app, the buffer queue
+     *     shall operate in the asynchronous mode regardless of the async flag
+     *     set by setAsyncMode().
+     * @return status Status of the call.
+     * @return output See #QueueBufferOutput for more information.
+     *
+     * @sa #QueueBufferOutput, disconnect(), setAsyncMode().
+     */
+    connect(
+            IProducerListener listener,
+            ConnectionType api,
+            bool producerControlledByApp
+        ) generates (
+            Status status,
+            QueueBufferOutput output
+        );
+
+    /**
+     * Attempts to disconnect the client from the producer end of the buffer
+     * queue.
+     *
+     * Calling this method shall cause any subsequent calls to other
+     * @ref IGraphicBufferProducer methods apart from connect() to fail.
+     * A successful connect() call afterwards may allow other methods to succeed
+     * again.
+     *
+     * Disconnecting from an abandoned buffer queue is legal and is considered a
+     * no-op.
+     *
+     * @param api The type of connection to disconnect. Supplying the value of
+     *     `CURRENTLY_CONNECTED` to @p api has the same effect as supplying the
+     *     current connection type. If the producer end is not connected,
+     *     supplying `CURRENTLY_CONNECTED` shall result in a successful no-op
+     *     call.
+     * @return status Status of the call.
+     *
+     * @sa connect().
+     */
+    disconnect(
+            ConnectionType api
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Allocates buffers based on the given dimensions, format and usage.
+     *
+     * This function shall allocate up to the maximum number of buffers
+     * permitted by the current buffer queue configuration. It shall use the
+     * given format, dimensions, and usage bits, which are interpreted in the
+     * same way as for dequeueBuffer(), and the async flag must be set the same
+     * way as for dequeueBuffer() to ensure that the correct number of buffers
+     * are allocated. This is most useful to avoid an allocation delay during
+     * dequeueBuffer(). If there are already the maximum number of buffers
+     * allocated, this function has no effect.
+     *
+     * A value of 0 in @p width, @p height or @p format indicates that the
+     * buffer queue can pick the default value.
+     *
+     * @param width Width of buffers to allocate.
+     * @param height Height of buffers to allocate.
+     * @param format Format of buffers to allocate.
+     * @param usage Usage of bufferes to allocate.
+     * @return status Status of the call.
+     */
+    allocateBuffers(
+            uint32_t width,
+            uint32_t height,
+            uint32_t format,
+            uint64_t usage
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Sets whether dequeueBuffer() is allowed to allocate new buffers.
+     *
+     * Normally dequeueBuffer() does not discriminate between free slots which
+     * already have an allocated buffer and those which do not, and shall
+     * allocate a new buffer if the slot doesn't have a buffer or if the slot's
+     * buffer doesn't match the requested size, format, or usage. This method
+     * allows the producer to restrict the eligible slots to those which already
+     * have an allocated buffer of the correct size, format, and usage. If no
+     * eligible slot is available, dequeueBuffer() shall block or return an
+     * error.
+     *
+     * @param allow Whether to allow new buffers to be allocated in
+     *     dequeueBuffer().
+     * @return status Status of the call.
+     */
+    allowAllocation(
+            bool allow
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Sets the current generation number of the buffer queue.
+     *
+     * This generation number shall be inserted into any buffers allocated by the
+     * buffer queue, and any attempts to attach a buffer with a different
+     * generation number shall fail. Buffers already in the queue are not
+     * affected and shall retain their current generation number. The generation
+     * number defaults to 0, i.e., buffers allocated before the first call to
+     * setGenerationNumber() shall be given 0 as their generation numbers.
+     *
+     * @param generationNumber New generation number. The client must make sure
+     *     that @p generationNumber is different from the previous generation
+     *     number if it wants to deprecate old buffers.
+     * @return status Status of the call.
+     */
+    setGenerationNumber(
+            uint32_t generationNumber
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Sets how long dequeueBuffer() shall wait for a buffer to become available
+     * before returning an error `TIMED_OUT`.
+     *
+     * This timeout also affects the attachBuffer() call, which shall block if
+     * there is not a free slot available into which the attached buffer can be
+     * placed.
+     *
+     * By default, the buffer queue shall wait forever, which is equivalent to
+     * setting @p timeoutNs equal to any negative number (such as `-1`). If
+     * @p timeoutNs is non-negative, setDequeueTimeout() shall disable
+     * non-blocking mode and its corresponding spare buffer (which is used to
+     * ensure a buffer is always available).
+     *
+     * Changing the dequeue timeout may affect the number of buffers. (See
+     * setAsyncMode().) If the adjustment to the number of buffers inside the
+     * buffer queue is not feasible, @p status shall be set to `BAD_VALUE`.
+     *
+     * @param timeoutNs Amount of time dequeueBuffer() is allowed to block
+     *     before returning `TIMED_OUT`. If @p timeoutNs is negative,
+     *     dequeueBuffer() shall not be able to return `TIMED_OUT`. Instead, it
+     *     may block forever or return `WOULD_BLOCK`.
+     * @return status Status of the call.
+     *
+     * @sa dequeueBuffer(), setAsyncMode(), query().
+     */
+    setDequeueTimeout(
+            int64_t timeoutNs
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Returns a unique id for this buffer queue.
+     *
+     * @return id System-wide unique id of the buffer queue.
+     */
+    getUniqueId(
+        ) generates (
+            uint64_t id
+        );
+
+    /**
+     * Returns the name of the connected consumer.
+     *
+     * \note This is used for debugging only.
+     *
+     * @return name Name of the consumer.
+     */
+    getConsumerName(
+        ) generates (
+            string name
+        );
+
+};
+
diff --git a/graphics/bufferqueue/2.0/IProducerListener.hal b/graphics/bufferqueue/2.0/IProducerListener.hal
new file mode 100644
index 0000000..bc478ed
--- /dev/null
+++ b/graphics/bufferqueue/2.0/IProducerListener.hal
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.bufferqueue@2.0;
+
+/**
+ * Listener interface.
+ */
+interface IProducerListener {
+    /**
+     * Notifies the listener when buffers are released.
+     *
+     * This function is usually called by the consumer.
+     *
+     * @param count The number of buffers released (since the last call to
+     *     onBufferReleased()).
+     */
+    oneway onBuffersReleased(uint32_t count);
+};
+
diff --git a/graphics/bufferqueue/2.0/types.hal b/graphics/bufferqueue/2.0/types.hal
new file mode 100644
index 0000000..f6bc2d9
--- /dev/null
+++ b/graphics/bufferqueue/2.0/types.hal
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.bufferqueue@2.0;
+
+/**
+ * Possible return values from a function call.
+ */
+enum Status : int32_t {
+    /**
+     * The call succeeds.
+     */
+    OK = 0,
+    /**
+     * The function fails allocate memory.
+     */
+    NO_MEMORY = -12,
+    /**
+     * The buffer queue has been abandoned, no consumer is connected, or no
+     * producer is connected at the time of the call.
+     */
+    NO_INIT = -19,
+    /**
+     * Some of the provided input arguments are invalid.
+     */
+    BAD_VALUE = -22,
+    /**
+     * An unexpected death of some object prevents the operation from
+     * continuing.
+     *
+     * @note This status value is different from a transaction failure, which
+     * should be detected by isOk().
+     */
+    DEAD_OBJECT = -32,
+    /**
+     * The internal state of the buffer queue does not permit the operation.
+     */
+    INVALID_OPERATION = -38,
+    /**
+     * The call fails to finish within the specified time limit.
+     */
+    TIMED_OUT = -110,
+    /**
+     * The buffer queue is operating in a non-blocking mode, but the call cannot
+     * be completed without blocking.
+     */
+    WOULD_BLOCK = 0xfffffffb,
+    /**
+     * The call fails because of a reason not listed above.
+     */
+    UNKNOWN_ERROR = 0xffffffff,
+};
+
+/**
+ * Special values for a slot index.
+ */
+enum SlotIndex : int32_t {
+    /**
+     * Invalid/unspecified slot index. This may be returned from a function that
+     * returns a slot index if the call is unsuccessful.
+     */
+    INVALID = -1,
+    UNSPECIFIED = -1,
+};
+
+/**
+ * An "empty" fence can be an empty handle (containing no fds and no ints) or a
+ * fence with one fd that is equal to -1 and no ints.
+ *
+ * A valid fence is an empty fence or a native handle with exactly one fd and no
+ * ints.
+ */
+typedef handle Fence;
+
+/**
+ * How buffers shall be produced. One of these values must be provided in a call
+ * to IGraphicBufferProducer::connect() and
+ * IGraphicBufferProducer::disconnect().
+ */
+enum ConnectionType : int32_t {
+    /**
+     * This value can be used only as an input to
+     * IGraphicBufferProducer::disconnect().
+     */
+    CURRENTLY_CONNECTED = -1,
+    /**
+     * Buffers shall be queued by EGL via `eglSwapBuffers()` after being filled
+     * using OpenGL ES.
+     */
+    EGL = 1,
+    /**
+     * Buffers shall be queued after being filled using the CPU.
+     */
+    CPU = 2,
+    /**
+     * Buffers shall be queued by Stagefright after being filled by a video
+     * decoder. The video decoder can either be a software or hardware decoder.
+     */
+    MEDIA = 3,
+    /**
+     * Buffers shall be queued by the camera HAL.
+     */
+    CAMERA = 4,
+};
+
+
diff --git a/graphics/common/1.2/Android.bp b/graphics/common/1.2/Android.bp
new file mode 100644
index 0000000..a3ebdbf
--- /dev/null
+++ b/graphics/common/1.2/Android.bp
@@ -0,0 +1,25 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.graphics.common@1.2",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+        support_system_process: true,
+    },
+    srcs: [
+        "types.hal",
+    ],
+    interfaces: [
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
+    ],
+    types: [
+        "ColorMode",
+        "Dataspace",
+        "HardwareBuffer",
+    ],
+    gen_java: true,
+    gen_java_constants: true,
+}
+
diff --git a/graphics/common/1.2/types.hal b/graphics/common/1.2/types.hal
new file mode 100644
index 0000000..15f2c14
--- /dev/null
+++ b/graphics/common/1.2/types.hal
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.common@1.2;
+
+import @1.1::BufferUsage;
+import @1.1::ColorMode;
+import @1.1::Dataspace;
+import @1.1::PixelFormat;
+
+@export(name="android_dataspace_v1_2_t", value_prefix="HAL_DATASPACE_",
+        export_parent="false")
+enum Dataspace : @1.1::Dataspace {
+    /**
+     * ITU-R Recommendation 2020 (BT.2020)
+     *
+     * Ultra High-definition television
+     *
+     * Use full range, sRGB transfer and BT2020 standard
+     */
+    DISPLAY_BT2020 = STANDARD_BT2020 | TRANSFER_SRGB | RANGE_FULL,
+};
+
+enum ColorMode : @1.1::ColorMode {
+    /**
+     * DISPLAY_BT2020 corresponds with display settings that implement the ITU-R
+     * Recommendation BT.2020 / Rec. 2020 for UHDTV, but specifies an SRGB
+     * transfer function.
+     *
+     * Primaries:
+     *                  x       y
+     *  green           0.170   0.797
+     *  blue            0.131   0.046
+     *  red             0.708   0.292
+     *  white (D65)     0.3127  0.3290
+     *
+     * Transfer Function is sRGB
+     */
+    DISPLAY_BT2020 = 13,
+};
+
+/**
+ * HIDL counterpart of `AHardwareBuffer_Desc`.
+ *
+ * An `AHardwareBuffer_Desc` object can be converted to and from a
+ * `HardwareBufferDescription` object by `memcpy()`.
+ *
+ * @sa +ndk libnativewindow#AHardwareBuffer_Desc.
+ */
+typedef uint32_t[10] HardwareBufferDescription;
+
+/**
+ * HIDL counterpart of `AHardwareBuffer`.
+ *
+ * AHardwareBuffer_createFromHandle() can be used to convert a `HardwareBuffer`
+ * object to an `AHardwareBuffer` object.
+ *
+ * Conversely, AHardwareBuffer_getNativeHandle() can be used to extract a native
+ * handle from an `AHardwareBuffer` object. Paired with `AHardwareBuffer_Desc`,
+ * AHardwareBuffer_getNativeHandle() can be used to convert between
+ * `HardwareBuffer` and `AHardwareBuffer`.
+ *
+ * @sa +ndk libnativewindow#AHardwareBuffer".
+ */
+struct HardwareBuffer {
+    HardwareBufferDescription description;
+    handle nativeHandle;
+};
+
+/**
+ * HIDL counterpart of `ARect`.
+ *
+ * @sa +ndk libarect_headers#ARect.
+ */
+typedef int32_t[4] Rect;
+
diff --git a/graphics/composer/2.1/utils/hal/include/composer-hal/2.1/ComposerResources.h b/graphics/composer/2.1/utils/hal/include/composer-hal/2.1/ComposerResources.h
index 2cbf044..f249f1a 100644
--- a/graphics/composer/2.1/utils/hal/include/composer-hal/2.1/ComposerResources.h
+++ b/graphics/composer/2.1/utils/hal/include/composer-hal/2.1/ComposerResources.h
@@ -186,6 +186,8 @@
         : mBufferCache(importer, ComposerHandleCache::HandleType::BUFFER, bufferCacheSize),
           mSidebandStreamCache(importer, ComposerHandleCache::HandleType::STREAM, 1) {}
 
+    virtual ~ComposerLayerResource() = default;
+
     Error getBuffer(uint32_t slot, bool fromCache, const native_handle_t* inHandle,
                     const native_handle_t** outHandle, const native_handle** outReplacedHandle) {
         return mBufferCache.getHandle(slot, fromCache, inHandle, outHandle, outReplacedHandle);
@@ -211,6 +213,8 @@
         VIRTUAL,
     };
 
+    virtual ~ComposerDisplayResource() = default;
+
     ComposerDisplayResource(DisplayType type, ComposerHandleImporter& importer,
                             uint32_t outputBufferCacheSize)
         : mType(type),
diff --git a/graphics/composer/2.1/utils/vts/ComposerVts.cpp b/graphics/composer/2.1/utils/vts/ComposerVts.cpp
index 2f531b4..250c392 100644
--- a/graphics/composer/2.1/utils/vts/ComposerVts.cpp
+++ b/graphics/composer/2.1/utils/vts/ComposerVts.cpp
@@ -25,21 +25,19 @@
 namespace V2_1 {
 namespace vts {
 
-Composer::Composer() {
-    mComposer = ::testing::VtsHalHidlTargetTestBase::getService<IComposer>();
-    init();
-}
+Composer::Composer() : Composer(::testing::VtsHalHidlTargetTestBase::getService<IComposer>()) {}
 
-Composer::Composer(const std::string& name) {
-    mComposer = ::testing::VtsHalHidlTargetTestBase::getService<IComposer>(name);
-    init();
-}
+Composer::Composer(const std::string& name)
+    : Composer(::testing::VtsHalHidlTargetTestBase::getService<IComposer>(name)) {}
 
-void Composer::init() {
-    ASSERT_NE(nullptr, mComposer.get()) << "failed to get composer service";
+Composer::Composer(const sp<IComposer>& composer) : mComposer(composer) {
+    // ASSERT_* can only be used in functions returning void.
+    [this] {
+        ASSERT_NE(nullptr, mComposer.get()) << "failed to get composer service";
 
-    std::vector<IComposer::Capability> capabilities = getCapabilities();
-    mCapabilities.insert(capabilities.begin(), capabilities.end());
+        std::vector<IComposer::Capability> capabilities = getCapabilities();
+        mCapabilities.insert(capabilities.begin(), capabilities.end());
+    }();
 }
 
 sp<IComposer> Composer::getRaw() const {
@@ -295,7 +293,6 @@
     if (queueChanged) {
         auto ret = mClient->setInputCommandQueue(*writer->getMQDescriptor());
         ASSERT_EQ(Error::NONE, static_cast<Error>(ret));
-        return;
     }
 
     mClient->executeCommands(commandLength, commandHandles,
@@ -314,6 +311,8 @@
                                  ASSERT_TRUE(reader->readQueue(tmpOutLength, tmpOutHandles));
                                  reader->parse();
                              });
+    reader->reset();
+    writer->reset();
 }
 
 }  // namespace vts
diff --git a/graphics/composer/2.1/utils/vts/TestCommandReader.cpp b/graphics/composer/2.1/utils/vts/TestCommandReader.cpp
index 6f8f1ad..454a89c 100644
--- a/graphics/composer/2.1/utils/vts/TestCommandReader.cpp
+++ b/graphics/composer/2.1/utils/vts/TestCommandReader.cpp
@@ -26,23 +26,55 @@
 namespace vts {
 
 void TestCommandReader::parse() {
+    mErrors.clear();
+    mCompositionChanges.clear();
     while (!isEmpty()) {
         IComposerClient::Command command;
         uint16_t length;
         ASSERT_TRUE(beginCommand(&command, &length));
 
         switch (command) {
+            case IComposerClient::Command::SELECT_DISPLAY:
+                ASSERT_EQ(2, length);
+                read64();  // display
+                break;
             case IComposerClient::Command::SET_ERROR: {
                 ASSERT_EQ(2, length);
                 auto loc = read();
                 auto err = readSigned();
-                GTEST_FAIL() << "unexpected error " << err << " at location " << loc;
+                std::pair<uint32_t, uint32_t> error(loc, err);
+                mErrors.push_back(error);
             } break;
-            case IComposerClient::Command::SELECT_DISPLAY:
             case IComposerClient::Command::SET_CHANGED_COMPOSITION_TYPES:
+                ASSERT_EQ(0, length % 3);
+                for (uint16_t count = 0; count < length / 3; ++count) {
+                    uint64_t layerId = read64();
+                    uint32_t composition = read();
+
+                    std::pair<uint64_t, uint32_t> compositionChange(layerId, composition);
+                    mCompositionChanges.push_back(compositionChange);
+                }
+                break;
             case IComposerClient::Command::SET_DISPLAY_REQUESTS:
+                ASSERT_EQ(1, length % 3);
+                read();  // displayRequests, ignored for now
+                for (uint16_t count = 0; count < (length - 1) / 3; ++count) {
+                    read64();  // layer
+                    // silently eat requests to clear the client target, since we won't be testing
+                    // client composition anyway
+                    ASSERT_EQ(1u, read());
+                }
+                break;
             case IComposerClient::Command::SET_PRESENT_FENCE:
+                ASSERT_EQ(1, length);
+                close(readFence());
+                break;
             case IComposerClient::Command::SET_RELEASE_FENCES:
+                ASSERT_EQ(0, length % 3);
+                for (uint16_t count = 0; count < length / 3; ++count) {
+                    read64();
+                    close(readFence());
+                }
                 break;
             default:
                 GTEST_FAIL() << "unexpected return command " << std::hex
diff --git a/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h b/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h
index 8d5493e..c97be76 100644
--- a/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h
+++ b/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h
@@ -57,10 +57,10 @@
     std::unique_ptr<ComposerClient> createClient();
 
    protected:
-    sp<IComposer> mComposer;
+    explicit Composer(const sp<IComposer>& composer);
 
    private:
-    void init();
+    const sp<IComposer> mComposer;
 
     std::unordered_set<IComposer::Capability> mCapabilities;
 };
@@ -68,7 +68,7 @@
 // A wrapper to IComposerClient.
 class ComposerClient {
    public:
-    ComposerClient(const sp<IComposerClient>& client);
+    explicit ComposerClient(const sp<IComposerClient>& client);
     ~ComposerClient();
 
     sp<IComposerClient> getRaw() const;
@@ -116,7 +116,7 @@
     std::unordered_map<Display, DisplayResource> mDisplayResources;
 
    private:
-    sp<IComposerClient> mClient;
+    const sp<IComposerClient> mClient;
 };
 
 }  // namespace vts
diff --git a/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/TestCommandReader.h b/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/TestCommandReader.h
index 3888eeb..c12debe 100644
--- a/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/TestCommandReader.h
+++ b/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/TestCommandReader.h
@@ -32,6 +32,9 @@
     // Parse all commands in the return command queue.  Call GTEST_FAIL() for
     // unexpected errors or commands.
     void parse();
+
+    std::vector<std::pair<uint32_t, uint32_t>> mErrors;
+    std::vector<std::pair<uint64_t, uint32_t>> mCompositionChanges;
 };
 
 }  // namespace vts
diff --git a/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp b/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp
index 72f3f1b..0a3e88b 100644
--- a/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp
+++ b/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp
@@ -71,6 +71,7 @@
 class GraphicsComposerHidlTest : public ::testing::VtsHalHidlTargetTestBase {
    protected:
     void SetUp() override {
+        VtsHalHidlTargetTestBase::SetUp();
         ASSERT_NO_FATAL_FAILURE(
             mComposer = std::make_unique<Composer>(
                 GraphicsComposerHidlEnvironment::Instance()->getServiceName<IComposer>()));
@@ -85,6 +86,13 @@
         // explicitly disable vsync
         mComposerClient->setVsyncEnabled(mPrimaryDisplay, false);
         mComposerCallback->setVsyncAllowed(false);
+
+        mInvalidDisplayId = GetInvalidDisplayId();
+
+        // Although 0 could be an invalid display, a return value of 0
+        // from GetInvalidDisplayId means all other ids are in use, a condition which
+        // we are assuming a device will never have
+        ASSERT_NE(0, mInvalidDisplayId);
     }
 
     void TearDown() override {
@@ -93,6 +101,24 @@
             EXPECT_EQ(0, mComposerCallback->getInvalidRefreshCount());
             EXPECT_EQ(0, mComposerCallback->getInvalidVsyncCount());
         }
+        VtsHalHidlTargetTestBase::TearDown();
+    }
+
+    // returns an invalid display id (one that has not been registered to a
+    // display.  Currently assuming that a device will never have close to
+    // std::numeric_limit<uint64_t>::max() displays registered while running tests
+    Display GetInvalidDisplayId() {
+        std::vector<Display> validDisplays = mComposerCallback->getDisplays();
+
+        uint64_t id = std::numeric_limits<uint64_t>::max();
+        while (id > 0) {
+            if (std::find(validDisplays.begin(), validDisplays.end(), id) == validDisplays.end()) {
+                return id;
+            }
+            id--;
+        }
+
+        return 0;
     }
 
     // use the slot count usually set by SF
@@ -103,6 +129,7 @@
     sp<GraphicsComposerCallback> mComposerCallback;
     // the first display and is assumed never to be removed
     Display mPrimaryDisplay;
+    Display mInvalidDisplayId;
 
    private:
     Display waitForFirstDisplay() {
@@ -172,6 +199,22 @@
 }
 
 /**
+ * Test IComposerClient::destroyVirtualDisplay
+ *
+ * Test that passing a bad display handle to destroyVirtualDisplay
+ * returns a BAD_DISPLAY error
+ */
+TEST_F(GraphicsComposerHidlTest, DestroyVirtualDisplayBadDisplay) {
+    if (mComposerClient->getMaxVirtualDisplayCount() == 0) {
+        GTEST_SUCCEED() << "no virtual display support";
+        return;
+    }
+
+    Error error = mComposerClient->getRaw()->destroyVirtualDisplay(mInvalidDisplayId);
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
  * Test IComposerClient::createLayer and IComposerClient::destroyLayer.
  *
  * Test that layers can be created and destroyed.
@@ -185,6 +228,89 @@
 }
 
 /**
+ * Test IComposerClient::createLayer
+ *
+ * Test that passing in an invalid display handle to createLayer returns
+ * BAD_DISPLAY.
+ */
+TEST_F(GraphicsComposerHidlTest, CreateLayerBadDisplay) {
+    Error error;
+    mComposerClient->getRaw()->createLayer(
+        mInvalidDisplayId, kBufferSlotCount,
+        [&](const auto& tmpOutError, const auto&) { error = tmpOutError; });
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
+ * Test IComposerClient::destroyLayer
+ *
+ * Test that passing in an invalid display handle to destroyLayer returns
+ * BAD_DISPLAY
+ */
+TEST_F(GraphicsComposerHidlTest, DestroyLayerBadDisplay) {
+    Error error;
+    Layer layer;
+    ASSERT_NO_FATAL_FAILURE(layer =
+                                mComposerClient->createLayer(mPrimaryDisplay, kBufferSlotCount));
+
+    error = mComposerClient->getRaw()->destroyLayer(mInvalidDisplayId, layer);
+
+    EXPECT_EQ(Error::BAD_DISPLAY, error);
+
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->destroyLayer(mPrimaryDisplay, layer));
+}
+
+/**
+ * Test IComposerClient::destroyLayer
+ *
+ * Test that passing in an invalid layer handle to destroyLayer returns
+ * BAD_LAYER
+ */
+TEST_F(GraphicsComposerHidlTest, DestroyLayerBadLayerError) {
+    // We haven't created any layers yet, so any id should be invalid
+    Error error = mComposerClient->getRaw()->destroyLayer(mPrimaryDisplay, 1);
+
+    EXPECT_EQ(Error::BAD_LAYER, error);
+}
+
+/**
+ * Test IComposerClient::getActiveConfig
+ *
+ * Test that passing in a bad display handle to getActiveConfig generates a
+ * BAD_DISPLAY error
+ */
+TEST_F(GraphicsComposerHidlTest, GetActiveConfigBadDisplay) {
+    Error error;
+    mComposerClient->getRaw()->getActiveConfig(
+        mInvalidDisplayId, [&](const auto& tmpOutError, const auto&) { error = tmpOutError; });
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
+ * Test IComposerClient::getDisplayConfigs
+ *
+ * Test IComposerClient::getDisplayConfigs returns no error
+ * when passed in a valid display
+ */
+TEST_F(GraphicsComposerHidlTest, GetDisplayConfig) {
+    std::vector<Config> configs;
+    ASSERT_NO_FATAL_FAILURE(configs = mComposerClient->getDisplayConfigs(mPrimaryDisplay));
+}
+
+/**
+ * Test IComposerClient::getDisplayConfigs
+ *
+ * Test IComposerClient::getDisplayConfigs returns BAD_DISPLAY
+ * when passed in an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, GetDisplayConfigBadDisplay) {
+    Error error;
+    mComposerClient->getRaw()->getDisplayConfigs(
+        mInvalidDisplayId, [&](const auto& tmpOutError, const auto&) { error = tmpOutError; });
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
  * Test IComposerClient::getDisplayName.
  */
 TEST_F(GraphicsComposerHidlTest, GetDisplayName) {
@@ -226,6 +352,30 @@
 }
 
 /**
+ * Test IComposerClient::getClientTargetSupport
+ *
+ * Test that IComposerClient::getClientTargetSupport returns BAD_DISPLAY when
+ * passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, GetClientTargetSupportBadDisplay) {
+    std::vector<Config> configs = mComposerClient->getDisplayConfigs(mPrimaryDisplay);
+    for (auto config : configs) {
+        int32_t width = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                             IComposerClient::Attribute::WIDTH);
+        int32_t height = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                              IComposerClient::Attribute::HEIGHT);
+        ASSERT_LT(0, width);
+        ASSERT_LT(0, height);
+
+        mComposerClient->setActiveConfig(mPrimaryDisplay, config);
+
+        Error error = mComposerClient->getRaw()->getClientTargetSupport(
+            mInvalidDisplayId, width, height, PixelFormat::RGBA_8888, Dataspace::UNKNOWN);
+        EXPECT_EQ(Error::BAD_DISPLAY, error);
+    }
+}
+
+/**
  * Test IComposerClient::getDisplayAttribute.
  *
  * Test that IComposerClient::getDisplayAttribute succeeds for the required
@@ -287,6 +437,43 @@
 }
 
 /**
+ * Test IComposerClient::setActiveConfig
+ *
+ * Test that config set during IComposerClient::setActiveConfig is maintained
+ * during a display on/off power cycle
+ */
+TEST_F(GraphicsComposerHidlTest, SetActiveConfigPowerCycle) {
+    ASSERT_NO_FATAL_FAILURE(
+        mComposerClient->setPowerMode(mPrimaryDisplay, IComposerClient::PowerMode::OFF));
+    ASSERT_NO_FATAL_FAILURE(
+        mComposerClient->setPowerMode(mPrimaryDisplay, IComposerClient::PowerMode::ON));
+
+    std::vector<Config> configs = mComposerClient->getDisplayConfigs(mPrimaryDisplay);
+    for (auto config : configs) {
+        mComposerClient->setActiveConfig(mPrimaryDisplay, config);
+        ASSERT_EQ(config, mComposerClient->getActiveConfig(mPrimaryDisplay));
+
+        ASSERT_NO_FATAL_FAILURE(
+            mComposerClient->setPowerMode(mPrimaryDisplay, IComposerClient::PowerMode::OFF));
+        ASSERT_NO_FATAL_FAILURE(
+            mComposerClient->setPowerMode(mPrimaryDisplay, IComposerClient::PowerMode::ON));
+        ASSERT_EQ(config, mComposerClient->getActiveConfig(mPrimaryDisplay));
+    }
+}
+
+/**
+ * Test IComposerClient::getColorMode
+ *
+ * Test that IComposerClient::getColorMode always returns ColorMode::NATIVE
+ */
+TEST_F(GraphicsComposerHidlTest, GetColorModes) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes(mPrimaryDisplay);
+    auto nativeModeLocation = std::find(modes.begin(), modes.end(), ColorMode::NATIVE);
+
+    ASSERT_NE(modes.end(), nativeModeLocation);
+}
+
+/**
  * Test IComposerClient::setColorMode.
  *
  * Test that IComposerClient::setColorMode succeeds for all color modes.
@@ -306,6 +493,45 @@
 }
 
 /**
+ * Test IComposerClient::setColorMode
+ *
+ * Test that IComposerClient::setColorMode returns BAD_DISPLAY for
+ * an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorModeBadDisplay) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes(mPrimaryDisplay);
+    for (auto mode : modes) {
+        Error error = mComposerClient->getRaw()->setColorMode(mInvalidDisplayId, mode);
+        EXPECT_EQ(Error::BAD_DISPLAY, error);
+    }
+}
+
+/**
+ * Test IComposerClient::setColorMode
+ *
+ * Test that IComposerClient::setColorMode returns BAD_PARAMETER when passed in
+ * an invalid color mode
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorModeBadParameter) {
+    Error error =
+        mComposerClient->getRaw()->setColorMode(mPrimaryDisplay, static_cast<ColorMode>(-1));
+    ASSERT_EQ(Error::BAD_PARAMETER, error);
+}
+
+/**
+ * Test IComposerClient::getDozeSupport
+ *
+ * Test that IComposerClient::getDozeSupport returns
+ * BAD_DISPLAY when passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, GetDozeSupportBadDisplay) {
+    Error error;
+    mComposerClient->getRaw()->getDozeSupport(
+        mInvalidDisplayId, [&](const auto& tmpOutError, const auto&) { error = tmpOutError; });
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
  * Test IComposerClient::setPowerMode.
  *
  * Test that IComposerClient::setPowerMode succeeds for all power modes.
@@ -328,6 +554,99 @@
 }
 
 /**
+ * Test IComposerClient::setPowerMode
+ *
+ * Test IComposerClient::setPowerMode succeeds with different
+ * orderings of power modes
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerModeVariations) {
+    std::vector<IComposerClient::PowerMode> modes;
+    modes.push_back(IComposerClient::PowerMode::OFF);
+    modes.push_back(IComposerClient::PowerMode::ON);
+    modes.push_back(IComposerClient::PowerMode::OFF);
+    for (auto mode : modes) {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode(mPrimaryDisplay, mode));
+    }
+
+    modes.clear();
+
+    modes.push_back(IComposerClient::PowerMode::OFF);
+    modes.push_back(IComposerClient::PowerMode::OFF);
+    for (auto mode : modes) {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode(mPrimaryDisplay, mode));
+    }
+
+    modes.clear();
+
+    modes.push_back(IComposerClient::PowerMode::ON);
+    modes.push_back(IComposerClient::PowerMode::ON);
+    for (auto mode : modes) {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode(mPrimaryDisplay, mode));
+    }
+
+    modes.clear();
+    if (mComposerClient->getDozeSupport(mPrimaryDisplay)) {
+        modes.push_back(IComposerClient::PowerMode::DOZE);
+        modes.push_back(IComposerClient::PowerMode::DOZE);
+
+        for (auto mode : modes) {
+            ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode(mPrimaryDisplay, mode));
+        }
+
+        modes.clear();
+
+        modes.push_back(IComposerClient::PowerMode::DOZE_SUSPEND);
+        modes.push_back(IComposerClient::PowerMode::DOZE_SUSPEND);
+
+        for (auto mode : modes) {
+            ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode(mPrimaryDisplay, mode));
+        }
+    }
+}
+
+/**
+ * Test IComposerClient::setPowerMode
+ *
+ * Test IComposerClient::setPowerMode returns BAD_DISPLAY when passed an invalid
+ * display handle
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerModeBadDisplay) {
+    Error error =
+        mComposerClient->getRaw()->setPowerMode(mInvalidDisplayId, IComposerClient::PowerMode::ON);
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
+ * Test IComposerClient::setPowerMode
+ *
+ * Test that IComposerClient::setPowerMode returns UNSUPPORTED when passed DOZE
+ * or DOZE_SUSPEND on devices that do not support DOZE/DOZE_SUSPEND
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerModeUnsupported) {
+    if (!mComposerClient->getDozeSupport(mPrimaryDisplay)) {
+        Error error = mComposerClient->getRaw()->setPowerMode(mPrimaryDisplay,
+                                                              IComposerClient::PowerMode::DOZE);
+        EXPECT_EQ(Error::UNSUPPORTED, error);
+
+        error = mComposerClient->getRaw()->setPowerMode(mPrimaryDisplay,
+                                                        IComposerClient::PowerMode::DOZE_SUSPEND);
+        EXPECT_EQ(Error::UNSUPPORTED, error);
+    }
+}
+
+/**
+ * Test IComposerClient::setPowerMode
+ *
+ * Tests that IComposerClient::setPowerMode returns BAD_PARAMETER when passed an invalid
+ * PowerMode
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerModeBadParameter) {
+    Error error = mComposerClient->getRaw()->setPowerMode(
+        mPrimaryDisplay, static_cast<IComposerClient::PowerMode>(-1));
+    ASSERT_EQ(Error::BAD_PARAMETER, error);
+}
+
+/**
  * Test IComposerClient::setVsyncEnabled.
  *
  * Test that IComposerClient::setVsyncEnabled succeeds and there is no
@@ -351,20 +670,29 @@
 
         ASSERT_NO_FATAL_FAILURE(mGralloc = std::make_unique<Gralloc>());
 
+        Config activeConfig = mComposerClient->getActiveConfig(mPrimaryDisplay);
+        mDisplayWidth = mComposerClient->getDisplayAttribute(mPrimaryDisplay, activeConfig,
+                                                             IComposerClient::Attribute::WIDTH);
+        mDisplayHeight = mComposerClient->getDisplayAttribute(mPrimaryDisplay, activeConfig,
+                                                              IComposerClient::Attribute::HEIGHT);
         mWriter = std::make_unique<CommandWriterBase>(1024);
         mReader = std::make_unique<TestCommandReader>();
     }
 
-    void TearDown() override { ASSERT_NO_FATAL_FAILURE(GraphicsComposerHidlTest::TearDown()); }
+    void TearDown() override {
+        ASSERT_EQ(0, mReader->mErrors.size());
+        ASSERT_NO_FATAL_FAILURE(GraphicsComposerHidlTest::TearDown());
+    }
 
     const native_handle_t* allocate() {
         IMapper::BufferDescriptorInfo info{};
-        info.width = 64;
-        info.height = 64;
+        info.width = mDisplayWidth;
+        info.height = mDisplayHeight;
         info.layerCount = 1;
         info.format = PixelFormat::RGBA_8888;
         info.usage =
-            static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN);
+            static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN |
+                                  BufferUsage::COMPOSER_OVERLAY);
 
         return mGralloc->allocate(info);
     }
@@ -373,6 +701,8 @@
 
     std::unique_ptr<CommandWriterBase> mWriter;
     std::unique_ptr<TestCommandReader> mReader;
+    int32_t mDisplayWidth;
+    int32_t mDisplayHeight;
 
    private:
     std::unique_ptr<Gralloc> mGralloc;
@@ -459,6 +789,60 @@
 }
 
 /**
+ * Test IComposerClient::Command::PRESENT_DISPLAY
+ *
+ * Test that IComposerClient::Command::PRESENT_DISPLAY works without
+ * additional call to validateDisplay when only the layer buffer handle and
+ * surface damage have been set
+ */
+TEST_F(GraphicsComposerHidlCommandTest, PRESENT_DISPLAY_NO_LAYER_STATE_CHANGES) {
+    mWriter->selectDisplay(mPrimaryDisplay);
+    mComposerClient->setPowerMode(mPrimaryDisplay, IComposerClient::PowerMode::ON);
+    mComposerClient->setColorMode(mPrimaryDisplay, ColorMode::SRGB);
+
+    auto handle = allocate();
+    ASSERT_NE(nullptr, handle);
+
+    IComposerClient::Rect displayFrame{0, 0, mDisplayWidth, mDisplayHeight};
+
+    Layer layer;
+    ASSERT_NO_FATAL_FAILURE(layer =
+                                mComposerClient->createLayer(mPrimaryDisplay, kBufferSlotCount));
+    mWriter->selectLayer(layer);
+    mWriter->setLayerCompositionType(IComposerClient::Composition::DEVICE);
+    mWriter->setLayerDisplayFrame(displayFrame);
+    mWriter->setLayerPlaneAlpha(1);
+    mWriter->setLayerSourceCrop({0, 0, (float)mDisplayWidth, (float)mDisplayHeight});
+    mWriter->setLayerTransform(static_cast<Transform>(0));
+    mWriter->setLayerVisibleRegion(std::vector<IComposerClient::Rect>(1, displayFrame));
+    mWriter->setLayerZOrder(10);
+    mWriter->setLayerBlendMode(IComposerClient::BlendMode::NONE);
+    mWriter->setLayerSurfaceDamage(std::vector<IComposerClient::Rect>(1, displayFrame));
+    mWriter->setLayerBuffer(0, handle, -1);
+    mWriter->setLayerDataspace(Dataspace::UNKNOWN);
+
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        GTEST_SUCCEED() << "Composition change requested, skipping test";
+        return;
+    }
+
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    mWriter->selectLayer(layer);
+    auto handle2 = allocate();
+    ASSERT_NE(nullptr, handle2);
+    mWriter->setLayerBuffer(0, handle2, -1);
+    mWriter->setLayerSurfaceDamage(std::vector<IComposerClient::Rect>(1, {0, 0, 10, 10}));
+    mWriter->presentDisplay();
+    execute();
+}
+
+/**
  * Test IComposerClient::Command::SET_LAYER_CURSOR_POSITION.
  */
 TEST_F(GraphicsComposerHidlCommandTest, SET_LAYER_CURSOR_POSITION) {
diff --git a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h
index a6871fb..c760d0a 100644
--- a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h
+++ b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h
@@ -132,24 +132,13 @@
 
     Return<void> getRenderIntents(Display display, ColorMode mode,
                                   IComposerClient::getRenderIntents_cb hidl_cb) override {
-#ifdef USES_DISPLAY_RENDER_INTENTS
         std::vector<RenderIntent> intents;
         Error err = mHal->getRenderIntents(display, mode, &intents);
         hidl_cb(err, intents);
-#else
-        (void)display;
-        (void)mode;
-        hidl_cb(Error::NONE, hidl_vec<RenderIntent>({RenderIntent::COLORIMETRIC}));
-#endif
         return Void();
     }
 
     Return<Error> setColorMode_2_2(Display display, ColorMode mode, RenderIntent intent) override {
-#ifndef USES_DISPLAY_RENDER_INTENTS
-        if (intent != RenderIntent::COLORIMETRIC) {
-            return Error::BAD_PARAMETER;
-        }
-#endif
         return mHal->setColorMode_2_2(display, mode, intent);
     }
 
diff --git a/graphics/composer/2.2/utils/vts/ComposerVts.cpp b/graphics/composer/2.2/utils/vts/ComposerVts.cpp
index 6a32071..da99460 100644
--- a/graphics/composer/2.2/utils/vts/ComposerVts.cpp
+++ b/graphics/composer/2.2/utils/vts/ComposerVts.cpp
@@ -27,32 +27,31 @@
 namespace V2_2 {
 namespace vts {
 
-using android::hardware::details::canCastInterface;
-using android::hardware::details::getDescriptor;
-using android::hardware::graphics::composer::V2_2::IComposerClient;
+using details::canCastInterface;
+using details::getDescriptor;
 
-std::unique_ptr<ComposerClient_v2_2> Composer_v2_2::createClient_v2_2() {
-    std::unique_ptr<ComposerClient_v2_2> client;
-    mComposer->createClient([&](const auto& tmpError, const auto& tmpClient) {
+std::unique_ptr<ComposerClient> Composer::createClient() {
+    std::unique_ptr<ComposerClient> client;
+    getRaw()->createClient([&](const auto& tmpError, const auto& tmpClient) {
         ASSERT_EQ(Error::NONE, tmpError) << "failed to create client";
         ALOGV("tmpClient is a %s", getDescriptor(&(*tmpClient)).c_str());
         ASSERT_TRUE(canCastInterface(
             &(*tmpClient), "android.hardware.graphics.composer@2.2::IComposerClient", false))
             << "Cannot create 2.2 IComposerClient";
-        client = std::make_unique<ComposerClient_v2_2>(IComposerClient::castFrom(tmpClient, true));
+        client = std::make_unique<ComposerClient>(IComposerClient::castFrom(tmpClient, true));
     });
 
     return client;
 }
 
-sp<V2_2::IComposerClient> ComposerClient_v2_2::getRaw() const {
-    return mClient_v2_2;
+sp<IComposerClient> ComposerClient::getRaw() const {
+    return mClient;
 }
 
-std::vector<IComposerClient::PerFrameMetadataKey> ComposerClient_v2_2::getPerFrameMetadataKeys(
+std::vector<IComposerClient::PerFrameMetadataKey> ComposerClient::getPerFrameMetadataKeys(
     Display display) {
     std::vector<IComposerClient::PerFrameMetadataKey> keys;
-    mClient_v2_2->getPerFrameMetadataKeys(display, [&](const auto& tmpError, const auto& tmpKeys) {
+    mClient->getPerFrameMetadataKeys(display, [&](const auto& tmpError, const auto& tmpKeys) {
         ASSERT_EQ(Error::NONE, tmpError) << "failed to get HDR metadata keys";
         keys = tmpKeys;
     });
@@ -60,43 +59,43 @@
     return keys;
 }
 
-void ComposerClient_v2_2::execute_v2_2(V2_1::vts::TestCommandReader* reader,
-                                       V2_2::CommandWriterBase* writer) {
+void ComposerClient::execute(V2_1::vts::TestCommandReader* reader, CommandWriterBase* writer) {
     bool queueChanged = false;
     uint32_t commandLength = 0;
     hidl_vec<hidl_handle> commandHandles;
     ASSERT_TRUE(writer->writeQueue(&queueChanged, &commandLength, &commandHandles));
 
     if (queueChanged) {
-        auto ret = mClient_v2_2->setInputCommandQueue(*writer->getMQDescriptor());
+        auto ret = mClient->setInputCommandQueue(*writer->getMQDescriptor());
         ASSERT_EQ(Error::NONE, static_cast<Error>(ret));
-        return;
     }
 
-    mClient_v2_2->executeCommands(commandLength, commandHandles,
-                                  [&](const auto& tmpError, const auto& tmpOutQueueChanged,
-                                      const auto& tmpOutLength, const auto& tmpOutHandles) {
-                                      ASSERT_EQ(Error::NONE, tmpError);
+    mClient->executeCommands(commandLength, commandHandles,
+                             [&](const auto& tmpError, const auto& tmpOutQueueChanged,
+                                 const auto& tmpOutLength, const auto& tmpOutHandles) {
+                                 ASSERT_EQ(Error::NONE, tmpError);
 
-                                      if (tmpOutQueueChanged) {
-                                          mClient_v2_2->getOutputCommandQueue(
-                                              [&](const auto& tmpError, const auto& tmpDescriptor) {
-                                                  ASSERT_EQ(Error::NONE, tmpError);
-                                                  reader->setMQDescriptor(tmpDescriptor);
-                                              });
-                                      }
+                                 if (tmpOutQueueChanged) {
+                                     mClient->getOutputCommandQueue(
+                                         [&](const auto& tmpError, const auto& tmpDescriptor) {
+                                             ASSERT_EQ(Error::NONE, tmpError);
+                                             reader->setMQDescriptor(tmpDescriptor);
+                                         });
+                                 }
 
-                                      ASSERT_TRUE(reader->readQueue(tmpOutLength, tmpOutHandles));
-                                      reader->parse();
-                                  });
+                                 ASSERT_TRUE(reader->readQueue(tmpOutLength, tmpOutHandles));
+                                 reader->parse();
+                             });
+    reader->reset();
+    writer->reset();
 }
 
-Display ComposerClient_v2_2::createVirtualDisplay_2_2(uint32_t width, uint32_t height,
-                                                      PixelFormat formatHint,
-                                                      uint32_t outputBufferSlotCount,
-                                                      PixelFormat* outFormat) {
+Display ComposerClient::createVirtualDisplay_2_2(uint32_t width, uint32_t height,
+                                                 PixelFormat formatHint,
+                                                 uint32_t outputBufferSlotCount,
+                                                 PixelFormat* outFormat) {
     Display display = 0;
-    mClient_v2_2->createVirtualDisplay_2_2(
+    mClient->createVirtualDisplay_2_2(
         width, height, formatHint, outputBufferSlotCount,
         [&](const auto& tmpError, const auto& tmpDisplay, const auto& tmpFormat) {
             ASSERT_EQ(Error::NONE, tmpError) << "failed to create virtual display";
@@ -110,29 +109,27 @@
     return display;
 }
 
-bool ComposerClient_v2_2::getClientTargetSupport_2_2(Display display, uint32_t width,
-                                                     uint32_t height, PixelFormat format,
-                                                     Dataspace dataspace) {
-    Error error =
-        mClient_v2_2->getClientTargetSupport_2_2(display, width, height, format, dataspace);
+bool ComposerClient::getClientTargetSupport_2_2(Display display, uint32_t width, uint32_t height,
+                                                PixelFormat format, Dataspace dataspace) {
+    Error error = mClient->getClientTargetSupport_2_2(display, width, height, format, dataspace);
     return error == Error::NONE;
 }
 
-void ComposerClient_v2_2::setPowerMode_2_2(Display display, V2_2::IComposerClient::PowerMode mode) {
-    Error error = mClient_v2_2->setPowerMode_2_2(display, mode);
+void ComposerClient::setPowerMode_2_2(Display display, IComposerClient::PowerMode mode) {
+    Error error = mClient->setPowerMode_2_2(display, mode);
     ASSERT_TRUE(error == Error::NONE || error == Error::UNSUPPORTED) << "failed to set power mode";
 }
 
-void ComposerClient_v2_2::setReadbackBuffer(Display display, const native_handle_t* buffer,
-                                            int32_t /* releaseFence */) {
+void ComposerClient::setReadbackBuffer(Display display, const native_handle_t* buffer,
+                                       int32_t /* releaseFence */) {
     // Ignoring fence, HIDL doesn't care
-    Error error = mClient_v2_2->setReadbackBuffer(display, buffer, nullptr);
+    Error error = mClient->setReadbackBuffer(display, buffer, nullptr);
     ASSERT_EQ(Error::NONE, error) << "failed to setReadbackBuffer";
 }
 
-void ComposerClient_v2_2::getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
-                                                      Dataspace* outDataspace) {
-    mClient_v2_2->getReadbackBufferAttributes(
+void ComposerClient::getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
+                                                 Dataspace* outDataspace) {
+    mClient->getReadbackBufferAttributes(
         display,
         [&](const auto& tmpError, const auto& tmpOutPixelFormat, const auto& tmpOutDataspace) {
             ASSERT_EQ(Error::NONE, tmpError) << "failed to get readback buffer attributes";
@@ -141,42 +138,40 @@
         });
 }
 
-void ComposerClient_v2_2::getReadbackBufferFence(Display display, int32_t* outFence) {
-    hidl_handle handle;
-    mClient_v2_2->getReadbackBufferFence(display, [&](const auto& tmpError, const auto& tmpHandle) {
+void ComposerClient::getReadbackBufferFence(Display display, int32_t* outFence) {
+    mClient->getReadbackBufferFence(display, [&](const auto& tmpError, const auto& tmpHandle) {
         ASSERT_EQ(Error::NONE, tmpError) << "failed to get readback fence";
-        handle = tmpHandle;
+        const native_handle_t* nativeFenceHandle = tmpHandle.getNativeHandle();
+        *outFence = dup(nativeFenceHandle->data[0]);
     });
-    *outFence = 0;
 }
 
-std::vector<ColorMode> ComposerClient_v2_2::getColorModes(Display display) {
+std::vector<ColorMode> ComposerClient::getColorModes(Display display) {
     std::vector<ColorMode> modes;
-    mClient_v2_2->getColorModes_2_2(display, [&](const auto& tmpError, const auto& tmpModes) {
+    mClient->getColorModes_2_2(display, [&](const auto& tmpError, const auto& tmpModes) {
         ASSERT_EQ(Error::NONE, tmpError) << "failed to get color modes";
         modes = tmpModes;
     });
     return modes;
 }
 
-std::vector<RenderIntent> ComposerClient_v2_2::getRenderIntents(Display display, ColorMode mode) {
+std::vector<RenderIntent> ComposerClient::getRenderIntents(Display display, ColorMode mode) {
     std::vector<RenderIntent> intents;
-    mClient_v2_2->getRenderIntents(
-        display, mode, [&](const auto& tmpError, const auto& tmpIntents) {
-            ASSERT_EQ(Error::NONE, tmpError) << "failed to get render intents";
-            intents = tmpIntents;
-        });
+    mClient->getRenderIntents(display, mode, [&](const auto& tmpError, const auto& tmpIntents) {
+        ASSERT_EQ(Error::NONE, tmpError) << "failed to get render intents";
+        intents = tmpIntents;
+    });
     return intents;
 }
 
-void ComposerClient_v2_2::setColorMode(Display display, ColorMode mode, RenderIntent intent) {
-    Error error = mClient_v2_2->setColorMode_2_2(display, mode, intent);
+void ComposerClient::setColorMode(Display display, ColorMode mode, RenderIntent intent) {
+    Error error = mClient->setColorMode_2_2(display, mode, intent);
     ASSERT_TRUE(error == Error::NONE || error == Error::UNSUPPORTED) << "failed to set color mode";
 }
 
-std::array<float, 16> ComposerClient_v2_2::getDataspaceSaturationMatrix(Dataspace dataspace) {
+std::array<float, 16> ComposerClient::getDataspaceSaturationMatrix(Dataspace dataspace) {
     std::array<float, 16> matrix;
-    mClient_v2_2->getDataspaceSaturationMatrix(
+    mClient->getDataspaceSaturationMatrix(
         dataspace, [&](const auto& tmpError, const auto& tmpMatrix) {
             ASSERT_EQ(Error::NONE, tmpError) << "failed to get datasapce saturation matrix";
             std::copy_n(tmpMatrix.data(), matrix.size(), matrix.begin());
diff --git a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
index 1c6d7ae..2633021 100644
--- a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
+++ b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
@@ -36,36 +36,31 @@
 namespace V2_2 {
 namespace vts {
 
-using android::hardware::graphics::common::V1_0::Hdr;
-using android::hardware::graphics::common::V1_1::ColorMode;
-using android::hardware::graphics::common::V1_1::Dataspace;
-using android::hardware::graphics::common::V1_1::PixelFormat;
-using android::hardware::graphics::common::V1_1::RenderIntent;
-using android::hardware::graphics::composer::V2_2::IComposer;
-using android::hardware::graphics::composer::V2_2::IComposerClient;
+using common::V1_0::Hdr;
+using common::V1_1::ColorMode;
+using common::V1_1::Dataspace;
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
 
-class ComposerClient_v2_2;
+class ComposerClient;
 
-// Only thing I need for Composer_v2_2 is to create a v2_2 ComposerClient
-// Everything else is the same
-class Composer_v2_2 : public V2_1::vts::Composer {
+// A wrapper to IComposer.
+class Composer : public V2_1::vts::Composer {
    public:
-    Composer_v2_2() : V2_1::vts::Composer(){};
-    explicit Composer_v2_2(const std::string& name) : V2_1::vts::Composer(name){};
+    using V2_1::vts::Composer::Composer;
 
-    std::unique_ptr<ComposerClient_v2_2> createClient_v2_2();
+    std::unique_ptr<ComposerClient> createClient();
 };
 
 // A wrapper to IComposerClient.
-class ComposerClient_v2_2
-    : public android::hardware::graphics::composer::V2_1::vts::ComposerClient {
+class ComposerClient : public V2_1::vts::ComposerClient {
    public:
-    ComposerClient_v2_2(const sp<IComposerClient>& client)
-        : V2_1::vts::ComposerClient(client), mClient_v2_2(client){};
+    explicit ComposerClient(const sp<IComposerClient>& client)
+        : V2_1::vts::ComposerClient(client), mClient(client) {}
 
-    sp<V2_2::IComposerClient> getRaw() const;
+    sp<IComposerClient> getRaw() const;
 
-    void execute_v2_2(V2_1::vts::TestCommandReader* reader, V2_2::CommandWriterBase* writer);
+    void execute(V2_1::vts::TestCommandReader* reader, CommandWriterBase* writer);
 
     std::vector<IComposerClient::PerFrameMetadataKey> getPerFrameMetadataKeys(Display display);
 
@@ -73,7 +68,7 @@
                                      uint32_t outputBufferSlotCount, PixelFormat* outFormat);
     bool getClientTargetSupport_2_2(Display display, uint32_t width, uint32_t height,
                                     PixelFormat format, Dataspace dataspace);
-    void setPowerMode_2_2(Display display, V2_2::IComposerClient::PowerMode mode);
+    void setPowerMode_2_2(Display display, IComposerClient::PowerMode mode);
     void setReadbackBuffer(Display display, const native_handle_t* buffer, int32_t releaseFence);
     void getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
                                      Dataspace* outDataspace);
@@ -86,7 +81,7 @@
     std::array<float, 16> getDataspaceSaturationMatrix(Dataspace dataspace);
 
    private:
-    sp<V2_2::IComposerClient> mClient_v2_2;
+    const sp<IComposerClient> mClient;
 };
 
 }  // namespace vts
diff --git a/graphics/composer/2.2/vts/functional/Android.bp b/graphics/composer/2.2/vts/functional/Android.bp
index 669fbae..acc9245 100644
--- a/graphics/composer/2.2/vts/functional/Android.bp
+++ b/graphics/composer/2.2/vts/functional/Android.bp
@@ -17,12 +17,15 @@
 cc_test {
     name: "VtsHalGraphicsComposerV2_2TargetTest",
     defaults: ["VtsHalTargetTestDefaults"],
-    srcs: ["VtsHalGraphicsComposerV2_2TargetTest.cpp"],
+    srcs: [
+        "VtsHalGraphicsComposerV2_2ReadbackTest.cpp",
+        "VtsHalGraphicsComposerV2_2TargetTest.cpp",
+    ],
 
     // TODO(b/64437680): Assume these libs are always available on the device.
     shared_libs: [
         "libfmq",
-	"libhidltransport",
+        "libhidltransport",
         "libsync",
     ],
     static_libs: [
diff --git a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2ReadbackTest.cpp b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2ReadbackTest.cpp
new file mode 100644
index 0000000..da8858e
--- /dev/null
+++ b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2ReadbackTest.cpp
@@ -0,0 +1,1336 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "graphics_composer_hidl_hal_readback_tests@2.2"
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+#include <android-base/unique_fd.h>
+#include <android/hardware/graphics/composer/2.2/IComposerClient.h>
+#include <composer-command-buffer/2.2/ComposerCommandBuffer.h>
+#include <composer-vts/2.1/GraphicsComposerCallback.h>
+#include <composer-vts/2.1/TestCommandReader.h>
+#include <composer-vts/2.2/ComposerVts.h>
+#include <mapper-vts/2.1/MapperVts.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_2 {
+namespace vts {
+namespace {
+
+using android::hardware::hidl_handle;
+using common::V1_1::BufferUsage;
+using common::V1_1::Dataspace;
+using common::V1_1::PixelFormat;
+using mapper::V2_1::IMapper;
+using mapper::V2_1::vts::Gralloc;
+using V2_1::Display;
+using V2_1::Layer;
+using V2_1::vts::TestCommandReader;
+
+static const IComposerClient::Color BLACK = {0, 0, 0, 0xff};
+static const IComposerClient::Color RED = {0xff, 0, 0, 0xff};
+static const IComposerClient::Color TRANSLUCENT_RED = {0xff, 0, 0, 0x33};
+static const IComposerClient::Color GREEN = {0, 0xff, 0, 0xff};
+static const IComposerClient::Color BLUE = {0, 0, 0xff, 0xff};
+
+// Test environment for graphics.composer
+class GraphicsComposerHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static GraphicsComposerHidlEnvironment* Instance() {
+        static GraphicsComposerHidlEnvironment* instance = new GraphicsComposerHidlEnvironment;
+        return instance;
+    }
+    virtual void registerTestServices() override { registerTestService<IComposer>(); }
+
+   private:
+    GraphicsComposerHidlEnvironment() {}
+    GTEST_DISALLOW_COPY_AND_ASSIGN_(GraphicsComposerHidlEnvironment);
+};
+
+class TestLayer {
+   public:
+    TestLayer(const std::shared_ptr<ComposerClient>& client, Display display)
+        : mLayer(client->createLayer(display, kBufferSlotCount)), mComposerClient(client) {}
+
+    // ComposerClient will take care of destroying layers, no need to explicitly
+    // call destroyLayers here
+    virtual ~TestLayer(){};
+
+    virtual void write(const std::shared_ptr<CommandWriterBase>& writer) {
+        writer->selectLayer(mLayer);
+        writer->setLayerDisplayFrame(mDisplayFrame);
+        writer->setLayerSourceCrop(mSourceCrop);
+        writer->setLayerZOrder(mZOrder);
+        writer->setLayerSurfaceDamage(mSurfaceDamage);
+        writer->setLayerTransform(mTransform);
+        writer->setLayerPlaneAlpha(mAlpha);
+        writer->setLayerBlendMode(mBlendMode);
+    }
+
+    void setDisplayFrame(IComposerClient::Rect frame) { mDisplayFrame = frame; }
+    void setSourceCrop(IComposerClient::FRect crop) { mSourceCrop = crop; }
+    void setZOrder(uint32_t z) { mZOrder = z; }
+
+    void setSurfaceDamage(std::vector<IComposerClient::Rect> surfaceDamage) {
+        mSurfaceDamage = surfaceDamage;
+    }
+
+    void setTransform(Transform transform) { mTransform = transform; }
+    void setAlpha(float alpha) { mAlpha = alpha; }
+    void setBlendMode(IComposerClient::BlendMode blendMode) { mBlendMode = blendMode; }
+
+    static constexpr uint32_t kBufferSlotCount = 64;
+
+    IComposerClient::Rect mDisplayFrame = {0, 0, 0, 0};
+    uint32_t mZOrder = 0;
+    std::vector<IComposerClient::Rect> mSurfaceDamage;
+    Transform mTransform = static_cast<Transform>(0);
+    IComposerClient::FRect mSourceCrop = {0, 0, 0, 0};
+    float mAlpha = 1.0;
+    IComposerClient::BlendMode mBlendMode = IComposerClient::BlendMode::NONE;
+
+   protected:
+    Layer mLayer;
+
+   private:
+    std::shared_ptr<ComposerClient> const mComposerClient;
+};
+
+class GraphicsComposerReadbackTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    static int32_t GetBytesPerPixel(PixelFormat pixelFormat) {
+        switch (pixelFormat) {
+            case PixelFormat::RGBA_8888:
+                return 4;
+            case PixelFormat::RGB_888:
+                return 3;
+            default:
+                return -1;
+        }
+    }
+
+    static void fillBuffer(int32_t width, int32_t height, uint32_t stride, void* bufferData,
+                           PixelFormat pixelFormat,
+                           std::vector<IComposerClient::Color> desiredPixelColors) {
+        ASSERT_TRUE(pixelFormat == PixelFormat::RGB_888 || pixelFormat == PixelFormat::RGBA_8888);
+        int32_t bytesPerPixel = GetBytesPerPixel(pixelFormat);
+        ASSERT_NE(-1, bytesPerPixel);
+        for (int row = 0; row < height; row++) {
+            for (int col = 0; col < width; col++) {
+                int pixel = row * width + col;
+                IComposerClient::Color srcColor = desiredPixelColors[pixel];
+
+                int offset = (row * stride + col) * bytesPerPixel;
+                uint8_t* pixelColor = (uint8_t*)bufferData + offset;
+                pixelColor[0] = srcColor.r;
+                pixelColor[1] = srcColor.g;
+                pixelColor[2] = srcColor.b;
+
+                if (bytesPerPixel == 4) {
+                    pixelColor[3] = srcColor.a;
+                }
+            }
+        }
+    }
+
+   protected:
+    using PowerMode = V2_1::IComposerClient::PowerMode;
+    void SetUp() override {
+        VtsHalHidlTargetTestBase::SetUp();
+        ASSERT_NO_FATAL_FAILURE(
+            mComposer = std::make_unique<Composer>(
+                GraphicsComposerHidlEnvironment::Instance()->getServiceName<IComposer>()));
+        ASSERT_NO_FATAL_FAILURE(mComposerClient = mComposer->createClient());
+        mComposerCallback = new V2_1::vts::GraphicsComposerCallback;
+        mComposerClient->registerCallback(mComposerCallback);
+
+        // assume the first display is primary and is never removed
+        mPrimaryDisplay = waitForFirstDisplay();
+        Config activeConfig;
+        ASSERT_NO_FATAL_FAILURE(activeConfig = mComposerClient->getActiveConfig(mPrimaryDisplay));
+        ASSERT_NO_FATAL_FAILURE(
+            mDisplayWidth = mComposerClient->getDisplayAttribute(
+                mPrimaryDisplay, activeConfig, IComposerClient::Attribute::WIDTH));
+        ASSERT_NO_FATAL_FAILURE(
+            mDisplayHeight = mComposerClient->getDisplayAttribute(
+                mPrimaryDisplay, activeConfig, IComposerClient::Attribute::HEIGHT));
+
+        // explicitly disable vsync
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setVsyncEnabled(mPrimaryDisplay, false));
+        mComposerCallback->setVsyncAllowed(false);
+
+        // set up command writer/reader and gralloc
+        mWriter = std::make_shared<CommandWriterBase>(1024);
+        mReader = std::make_unique<TestCommandReader>();
+        mGralloc = std::make_shared<Gralloc>();
+
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+            mPrimaryDisplay,
+            [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                mHasReadbackBuffer = readbackSupported(tmpPixelFormat, tmpDataspace, tmpError);
+                mPixelFormat = tmpPixelFormat;
+                mDataspace = tmpDataspace;
+            });
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode(mPrimaryDisplay, PowerMode::ON));
+    }
+
+    void TearDown() override {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode(mPrimaryDisplay, PowerMode::OFF));
+        EXPECT_EQ(0, mReader->mErrors.size());
+        EXPECT_EQ(0, mReader->mCompositionChanges.size());
+        if (mComposerCallback != nullptr) {
+            EXPECT_EQ(0, mComposerCallback->getInvalidHotplugCount());
+            EXPECT_EQ(0, mComposerCallback->getInvalidRefreshCount());
+            EXPECT_EQ(0, mComposerCallback->getInvalidVsyncCount());
+        }
+        VtsHalHidlTargetTestBase::TearDown();
+    }
+
+    void clearCommandReaderState() {
+        mReader->mCompositionChanges.clear();
+        mReader->mErrors.clear();
+    }
+
+    void execute() {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->execute(mReader.get(), mWriter.get()));
+    }
+
+    void writeLayers(const std::vector<std::shared_ptr<TestLayer>>& layers) {
+        for (auto layer : layers) {
+            layer->write(mWriter);
+        }
+        execute();
+    }
+
+    void clearColors(std::vector<IComposerClient::Color>& expectedColors, int32_t width,
+                     int32_t height) {
+        for (int row = 0; row < height; row++) {
+            for (int col = 0; col < width; col++) {
+                int pixel = row * mDisplayWidth + col;
+                expectedColors[pixel] = BLACK;
+            }
+        }
+    }
+
+    void fillColorsArea(std::vector<IComposerClient::Color>& expectedColors, int32_t stride,
+                        IComposerClient::Rect area, IComposerClient::Color color) {
+        for (int row = area.top; row < area.bottom; row++) {
+            for (int col = area.left; col < area.right; col++) {
+                int pixel = row * stride + col;
+                expectedColors[pixel] = color;
+            }
+        }
+    }
+
+    bool readbackSupported(const PixelFormat& pixelFormat, const Dataspace& dataspace,
+                           const Error error) {
+        if (error != Error::NONE) {
+            return false;
+        }
+        // TODO: add support for RGBA_1010102
+        if (pixelFormat != PixelFormat::RGB_888 && pixelFormat != PixelFormat::RGBA_8888) {
+            return false;
+        }
+        if (dataspace != Dataspace::V0_SRGB) {
+            return false;
+        }
+        return true;
+    }
+
+
+    std::unique_ptr<Composer> mComposer;
+    std::shared_ptr<ComposerClient> mComposerClient;
+
+    sp<V2_1::vts::GraphicsComposerCallback> mComposerCallback;
+    // the first display and is assumed never to be removed
+    Display mPrimaryDisplay;
+    int32_t mDisplayWidth;
+    int32_t mDisplayHeight;
+    std::shared_ptr<CommandWriterBase> mWriter;
+    std::unique_ptr<TestCommandReader> mReader;
+    std::shared_ptr<Gralloc> mGralloc;
+
+    bool mHasReadbackBuffer;
+    PixelFormat mPixelFormat;
+    Dataspace mDataspace;
+
+    static constexpr uint32_t kClientTargetSlotCount = 64;
+
+   private:
+    Display waitForFirstDisplay() {
+        while (true) {
+            std::vector<Display> displays = mComposerCallback->getDisplays();
+            if (displays.empty()) {
+                usleep(5 * 1000);
+                continue;
+            }
+            return displays[0];
+        }
+    }
+};
+class ReadbackBuffer {
+   public:
+    ReadbackBuffer(Display display, const std::shared_ptr<ComposerClient>& client,
+                   const std::shared_ptr<Gralloc>& gralloc, uint32_t width, uint32_t height,
+                   PixelFormat pixelFormat, Dataspace dataspace) {
+        mDisplay = display;
+
+        mComposerClient = client;
+        mGralloc = gralloc;
+
+        mPixelFormat = pixelFormat;
+        mDataspace = dataspace;
+
+        mInfo.width = width;
+        mInfo.height = height;
+        mInfo.layerCount = 1;
+        mInfo.format = mPixelFormat;
+        mInfo.usage = static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::GPU_TEXTURE);
+
+        mAccessRegion.top = 0;
+        mAccessRegion.left = 0;
+        mAccessRegion.width = width;
+        mAccessRegion.height = height;
+    };
+
+    ~ReadbackBuffer() {
+        if (mBufferHandle != nullptr) {
+            mGralloc->freeBuffer(mBufferHandle);
+        }
+    }
+
+    void setReadbackBuffer() {
+        if (mBufferHandle != nullptr) {
+            mGralloc->freeBuffer(mBufferHandle);
+            mBufferHandle = nullptr;
+        }
+        mBufferHandle = mGralloc->allocate(mInfo, /*import*/ true, &mStride);
+        ASSERT_NE(false, mGralloc->validateBufferSize(mBufferHandle, mInfo, mStride));
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setReadbackBuffer(mDisplay, mBufferHandle, -1));
+    }
+
+    void checkReadbackBuffer(std::vector<IComposerClient::Color> expectedColors) {
+        // lock buffer for reading
+        int32_t fenceHandle;
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferFence(mDisplay, &fenceHandle));
+
+        void* bufData = mGralloc->lock(mBufferHandle, mInfo.usage, mAccessRegion, fenceHandle);
+        ASSERT_TRUE(mPixelFormat == PixelFormat::RGB_888 || mPixelFormat == PixelFormat::RGBA_8888);
+        int32_t bytesPerPixel = GraphicsComposerReadbackTest::GetBytesPerPixel(mPixelFormat);
+        ASSERT_NE(-1, bytesPerPixel);
+        for (int row = 0; row < mInfo.height; row++) {
+            for (int col = 0; col < mInfo.width; col++) {
+                int pixel = row * mInfo.width + col;
+                int offset = (row * mStride + col) * bytesPerPixel;
+                uint8_t* pixelColor = (uint8_t*)bufData + offset;
+
+                ASSERT_EQ(expectedColors[pixel].r, pixelColor[0]);
+                ASSERT_EQ(expectedColors[pixel].g, pixelColor[1]);
+                ASSERT_EQ(expectedColors[pixel].b, pixelColor[2]);
+            }
+        }
+        int32_t unlockFence = mGralloc->unlock(mBufferHandle);
+        if (unlockFence != -1) {
+            sync_wait(unlockFence, -1);
+            close(unlockFence);
+        }
+    }
+
+   protected:
+    IMapper::BufferDescriptorInfo mInfo;
+    IMapper::Rect mAccessRegion;
+    uint32_t mStride;
+    const native_handle_t* mBufferHandle = nullptr;
+    PixelFormat mPixelFormat;
+    Dataspace mDataspace;
+    Display mDisplay;
+    std::shared_ptr<Gralloc> mGralloc;
+    std::shared_ptr<ComposerClient> mComposerClient;
+};
+
+class TestColorLayer : public TestLayer {
+   public:
+    TestColorLayer(const std::shared_ptr<ComposerClient>& client, Display display)
+        : TestLayer{client, display} {}
+
+    void write(const std::shared_ptr<CommandWriterBase>& writer) override {
+        TestLayer::write(writer);
+        writer->setLayerCompositionType(IComposerClient::Composition::SOLID_COLOR);
+        writer->setLayerColor(mColor);
+    }
+
+    void setColor(IComposerClient::Color color) { mColor = color; }
+
+   private:
+    IComposerClient::Color mColor = {0xff, 0xff, 0xff, 0xff};
+};
+
+class TestBufferLayer : public TestLayer {
+   public:
+    TestBufferLayer(const std::shared_ptr<ComposerClient>& client,
+                    const std::shared_ptr<Gralloc>& gralloc, Display display, int32_t width,
+                    int32_t height, PixelFormat format,
+                    IComposerClient::Composition composition = IComposerClient::Composition::DEVICE)
+        : TestLayer{client, display} {
+        mGralloc = gralloc;
+        mComposition = composition;
+        mInfo.width = width;
+        mInfo.height = height;
+        mInfo.layerCount = 1;
+        mInfo.format = format;
+        mInfo.usage =
+            static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN |
+                                  BufferUsage::COMPOSER_OVERLAY);
+
+        mAccessRegion.top = 0;
+        mAccessRegion.left = 0;
+        mAccessRegion.width = width;
+        mAccessRegion.height = height;
+
+        setSourceCrop({0, 0, (float)width, (float)height});
+    }
+
+    ~TestBufferLayer() {
+        if (mBufferHandle != nullptr) {
+            mGralloc->freeBuffer(mBufferHandle);
+        }
+    }
+
+    void write(const std::shared_ptr<CommandWriterBase>& writer) override {
+        TestLayer::write(writer);
+        writer->setLayerCompositionType(mComposition);
+        writer->setLayerDataspace(Dataspace::UNKNOWN);
+        writer->setLayerVisibleRegion(std::vector<IComposerClient::Rect>(1, mDisplayFrame));
+        if (mBufferHandle != nullptr) writer->setLayerBuffer(0, mBufferHandle, mFillFence);
+    }
+
+    void fillBuffer(std::vector<IComposerClient::Color> expectedColors) {
+        void* bufData = mGralloc->lock(mBufferHandle, mInfo.usage, mAccessRegion, -1);
+        ASSERT_NO_FATAL_FAILURE(GraphicsComposerReadbackTest::fillBuffer(
+            mInfo.width, mInfo.height, mStride, bufData, mInfo.format, expectedColors));
+        mFillFence = mGralloc->unlock(mBufferHandle);
+        if (mFillFence != -1) {
+            sync_wait(mFillFence, -1);
+            close(mFillFence);
+        }
+    }
+    void setBuffer(std::vector<IComposerClient::Color> colors) {
+        if (mBufferHandle != nullptr) {
+            mGralloc->freeBuffer(mBufferHandle);
+            mBufferHandle = nullptr;
+        }
+        mBufferHandle = mGralloc->allocate(mInfo, /*import*/ true, &mStride);
+        ASSERT_NE(nullptr, mBufferHandle);
+        ASSERT_NO_FATAL_FAILURE(fillBuffer(colors));
+        ASSERT_NE(false, mGralloc->validateBufferSize(mBufferHandle, mInfo, mStride));
+    }
+
+    void setToClientComposition(const std::shared_ptr<CommandWriterBase>& writer) {
+        writer->selectLayer(mLayer);
+        writer->setLayerCompositionType(IComposerClient::Composition::CLIENT);
+    }
+
+    IMapper::BufferDescriptorInfo mInfo;
+    IMapper::Rect mAccessRegion;
+    uint32_t mStride;
+
+   protected:
+    IComposerClient::Composition mComposition;
+    std::shared_ptr<Gralloc> mGralloc;
+    int32_t mFillFence;
+    const native_handle_t* mBufferHandle = nullptr;
+};
+
+TEST_F(GraphicsComposerReadbackTest, SingleSolidColorLayer) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+    mWriter->selectDisplay(mPrimaryDisplay);
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->setColorMode(mPrimaryDisplay, ColorMode::SRGB,
+                                                          RenderIntent::COLORIMETRIC));
+
+    auto layer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+    IComposerClient::Rect coloredSquare({0, 0, mDisplayWidth, mDisplayHeight});
+    layer->setColor(BLUE);
+    layer->setDisplayFrame(coloredSquare);
+    layer->setZOrder(10);
+
+    std::vector<std::shared_ptr<TestLayer>> layers = {layer};
+
+    // expected color for each pixel
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    // if hwc cannot handle and asks for composition change,
+    // just succeed the test
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, SetLayerBuffer) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, {0, 0, mDisplayWidth, mDisplayHeight / 4}, RED);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mDisplayHeight / 4, mDisplayWidth, mDisplayHeight / 2}, GREEN);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight}, BLUE);
+
+    auto layer =
+        std::make_shared<TestBufferLayer>(mComposerClient, mGralloc, mPrimaryDisplay, mDisplayWidth,
+                                          mDisplayHeight, PixelFormat::RGBA_8888);
+    layer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+    layer->setZOrder(10);
+    ASSERT_NO_FATAL_FAILURE(layer->setBuffer(expectedColors));
+
+    std::vector<std::shared_ptr<TestLayer>> layers = {layer};
+
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    mWriter->presentDisplay();
+    execute();
+
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, SetLayerBufferNoEffect) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->setColorMode(mPrimaryDisplay, ColorMode::SRGB,
+                                                          RenderIntent::COLORIMETRIC));
+
+    auto layer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+    IComposerClient::Rect coloredSquare({0, 0, mDisplayWidth, mDisplayHeight});
+    layer->setColor(BLUE);
+    layer->setDisplayFrame(coloredSquare);
+    layer->setZOrder(10);
+    layer->write(mWriter);
+
+    // This following buffer call should have no effect
+    IMapper::BufferDescriptorInfo bufferInfo{};
+    bufferInfo.width = mDisplayWidth;
+    bufferInfo.height = mDisplayHeight;
+    bufferInfo.layerCount = 1;
+    bufferInfo.format = PixelFormat::RGBA_8888;
+    bufferInfo.usage =
+        static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN);
+    const native_handle_t* bufferHandle = mGralloc->allocate(bufferInfo);
+    mWriter->setLayerBuffer(0, bufferHandle, -1);
+
+    // expected color for each pixel
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    mWriter->validateDisplay();
+    execute();
+
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, ClientComposition) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, {0, 0, mDisplayWidth, mDisplayHeight / 4}, RED);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mDisplayHeight / 4, mDisplayWidth, mDisplayHeight / 2}, GREEN);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight}, BLUE);
+
+    auto layer =
+        std::make_shared<TestBufferLayer>(mComposerClient, mGralloc, mPrimaryDisplay, mDisplayWidth,
+                                          mDisplayHeight, PixelFormat::RGBA_FP16);
+    layer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+    layer->setZOrder(10);
+
+    std::vector<std::shared_ptr<TestLayer>> layers = {layer};
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+
+    if (mReader->mCompositionChanges.size() != 0) {
+        ASSERT_EQ(1, mReader->mCompositionChanges.size());
+        ASSERT_EQ(1, mReader->mCompositionChanges[0].second);
+
+        ASSERT_NO_FATAL_FAILURE(
+            mComposerClient->setClientTargetSlotCount(mPrimaryDisplay, kClientTargetSlotCount));
+
+        // create client target buffer
+        uint32_t clientStride;
+        IMapper::BufferDescriptorInfo clientInfo;
+        clientInfo.width = layer->mInfo.width;
+        clientInfo.height = layer->mInfo.height;
+        clientInfo.layerCount = layer->mInfo.layerCount;
+        clientInfo.format = PixelFormat::RGBA_8888;
+        clientInfo.usage =
+            static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN |
+                                  BufferUsage::COMPOSER_CLIENT_TARGET);
+        const native_handle_t* clientBufferHandle =
+            mGralloc->allocate(clientInfo, /*import*/ true, &clientStride);
+        ASSERT_NE(nullptr, clientBufferHandle);
+
+        void* clientBufData =
+            mGralloc->lock(clientBufferHandle, clientInfo.usage, layer->mAccessRegion, -1);
+
+        ASSERT_NO_FATAL_FAILURE(fillBuffer(clientInfo.width, clientInfo.height, clientStride,
+                                           clientBufData, clientInfo.format, expectedColors));
+        int clientFence = mGralloc->unlock(clientBufferHandle);
+        if (clientFence != -1) {
+            sync_wait(clientFence, -1);
+            close(clientFence);
+        }
+
+        IComposerClient::Rect damage{0, 0, mDisplayWidth, mDisplayHeight};
+        mWriter->setClientTarget(0, clientBufferHandle, clientFence, Dataspace::UNKNOWN,
+                                 std::vector<IComposerClient::Rect>(1, damage));
+
+        layer->setToClientComposition(mWriter);
+        mWriter->validateDisplay();
+        execute();
+        ASSERT_EQ(0, mReader->mCompositionChanges.size());
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    mWriter->presentDisplay();
+    execute();
+
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, DeviceAndClientComposition) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+    ASSERT_NO_FATAL_FAILURE(
+        mComposerClient->setClientTargetSlotCount(mPrimaryDisplay, kClientTargetSlotCount));
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, {0, 0, mDisplayWidth, mDisplayHeight / 2}, GREEN);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight}, RED);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    auto deviceLayer =
+        std::make_shared<TestBufferLayer>(mComposerClient, mGralloc, mPrimaryDisplay, mDisplayWidth,
+                                          mDisplayHeight / 2, PixelFormat::RGBA_8888);
+    std::vector<IComposerClient::Color> deviceColors(deviceLayer->mInfo.width *
+                                                     deviceLayer->mInfo.height);
+    fillColorsArea(deviceColors, deviceLayer->mInfo.width,
+                   {0, 0, static_cast<int32_t>(deviceLayer->mInfo.width),
+                    static_cast<int32_t>(deviceLayer->mInfo.height)},
+                   GREEN);
+    deviceLayer->setDisplayFrame({0, 0, static_cast<int32_t>(deviceLayer->mInfo.width),
+                                  static_cast<int32_t>(deviceLayer->mInfo.height)});
+    deviceLayer->setZOrder(10);
+    ASSERT_NO_FATAL_FAILURE(deviceLayer->setBuffer(deviceColors));
+    deviceLayer->write(mWriter);
+
+    auto clientLayer = std::make_shared<TestBufferLayer>(
+        mComposerClient, mGralloc, mPrimaryDisplay, mDisplayWidth, mDisplayHeight / 2,
+        PixelFormat::RGBA_8888, IComposerClient::Composition::CLIENT);
+    IComposerClient::Rect clientFrame = {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight};
+    clientLayer->setDisplayFrame(clientFrame);
+    clientLayer->setZOrder(0);
+    clientLayer->write(mWriter);
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    IMapper::BufferDescriptorInfo clientInfo;
+    clientInfo.width = mDisplayWidth;
+    clientInfo.height = mDisplayHeight;
+    clientInfo.layerCount = 1;
+    clientInfo.format = PixelFormat::RGBA_8888;
+    clientInfo.usage =
+        static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN |
+                              BufferUsage::COMPOSER_CLIENT_TARGET);
+
+    uint32_t clientStride;
+    const native_handle_t* clientBufferHandle =
+        mGralloc->allocate(clientInfo, /*import*/ true, &clientStride);
+    ASSERT_NE(nullptr, clientBufferHandle);
+
+    IMapper::Rect clientAccessRegion;
+    clientAccessRegion.left = 0;
+    clientAccessRegion.top = 0;
+    clientAccessRegion.width = mDisplayWidth;
+    clientAccessRegion.height = mDisplayHeight;
+    void* clientData = mGralloc->lock(clientBufferHandle, clientInfo.usage, clientAccessRegion, -1);
+    std::vector<IComposerClient::Color> clientColors(clientInfo.width * clientInfo.height);
+    fillColorsArea(clientColors, clientInfo.width, clientFrame, RED);
+    ASSERT_NO_FATAL_FAILURE(fillBuffer(clientInfo.width, clientInfo.height, clientStride,
+                                       clientData, clientInfo.format, clientColors));
+    int clientFence = mGralloc->unlock(clientBufferHandle);
+    if (clientFence != -1) {
+        sync_wait(clientFence, -1);
+        close(clientFence);
+    }
+
+    mWriter->setClientTarget(0, clientBufferHandle, clientFence, Dataspace::UNKNOWN,
+                             std::vector<IComposerClient::Rect>(1, clientFrame));
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, SetLayerDamage) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelformat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+
+    IComposerClient::Rect redRect = {0, 0, mDisplayWidth / 4, mDisplayHeight / 4};
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
+
+    auto layer =
+        std::make_shared<TestBufferLayer>(mComposerClient, mGralloc, mPrimaryDisplay, mDisplayWidth,
+                                          mDisplayHeight, PixelFormat::RGBA_8888);
+    layer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+    layer->setZOrder(10);
+    ASSERT_NO_FATAL_FAILURE(layer->setBuffer(expectedColors));
+
+    std::vector<std::shared_ptr<TestLayer>> layers = {layer};
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+
+    // update surface damage and recheck
+    redRect = {mDisplayWidth / 4, mDisplayHeight / 4, mDisplayWidth / 2, mDisplayHeight / 2};
+    clearColors(expectedColors, mDisplayWidth, mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
+
+    ASSERT_NO_FATAL_FAILURE(layer->fillBuffer(expectedColors));
+    layer->setSurfaceDamage(
+        std::vector<IComposerClient::Rect>(1, {0, 0, mDisplayWidth / 2, mDisplayWidth / 2}));
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    ASSERT_EQ(0, mReader->mCompositionChanges.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, SetLayerPlaneAlpha) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->setColorMode(mPrimaryDisplay, ColorMode::SRGB,
+                                                          RenderIntent::COLORIMETRIC));
+
+    auto layer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+    layer->setColor(RED);
+    layer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+    layer->setZOrder(10);
+    layer->setAlpha(0);
+    layer->setBlendMode(IComposerClient::BlendMode::PREMULTIPLIED);
+
+    std::vector<std::shared_ptr<TestLayer>> layers = {layer};
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, SetLayerSourceCrop) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, {0, 0, mDisplayWidth, mDisplayHeight / 4}, RED);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight}, BLUE);
+
+    auto layer =
+        std::make_shared<TestBufferLayer>(mComposerClient, mGralloc, mPrimaryDisplay, mDisplayWidth,
+                                          mDisplayHeight, PixelFormat::RGBA_8888);
+    layer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+    layer->setZOrder(10);
+    layer->setSourceCrop({0, static_cast<float>(mDisplayHeight / 2),
+                          static_cast<float>(mDisplayWidth), static_cast<float>(mDisplayHeight)});
+    ASSERT_NO_FATAL_FAILURE(layer->setBuffer(expectedColors));
+
+    std::vector<std::shared_ptr<TestLayer>> layers = {layer};
+
+    // update expected colors to match crop
+    fillColorsArea(expectedColors, mDisplayWidth, {0, 0, mDisplayWidth, mDisplayHeight}, BLUE);
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerReadbackTest, SetLayerZOrder) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->setColorMode(mPrimaryDisplay, ColorMode::SRGB,
+                                                          RenderIntent::COLORIMETRIC));
+
+    IComposerClient::Rect redRect = {0, 0, mDisplayWidth, mDisplayHeight / 2};
+    IComposerClient::Rect blueRect = {0, mDisplayHeight / 4, mDisplayWidth, mDisplayHeight};
+    auto redLayer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+    redLayer->setColor(RED);
+    redLayer->setDisplayFrame(redRect);
+
+    auto blueLayer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+    blueLayer->setColor(BLUE);
+    blueLayer->setDisplayFrame(blueRect);
+    blueLayer->setZOrder(5);
+
+    std::vector<std::shared_ptr<TestLayer>> layers = {redLayer, blueLayer};
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+
+    // red in front of blue
+    redLayer->setZOrder(10);
+
+    // fill blue first so that red will overwrite on overlap
+    fillColorsArea(expectedColors, mDisplayWidth, blueRect, BLUE);
+    fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+
+    redLayer->setZOrder(1);
+    clearColors(expectedColors, mDisplayWidth, mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
+    fillColorsArea(expectedColors, mDisplayWidth, blueRect, BLUE);
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    writeLayers(layers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mCompositionChanges.size());
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+class GraphicsComposerBlendModeReadbackTest : public GraphicsComposerReadbackTest,
+                                              public ::testing::WithParamInterface<float> {
+   public:
+    void SetUp() override {
+        GraphicsComposerReadbackTest::SetUp();
+        mBackgroundColor = BLACK;
+        mTopLayerColor = RED;
+    }
+
+    void TearDown() override { GraphicsComposerReadbackTest::TearDown(); }
+
+    void setBackgroundColor(IComposerClient::Color color) { mBackgroundColor = color; }
+
+    void setTopLayerColor(IComposerClient::Color color) { mTopLayerColor = color; }
+
+    void setUpLayers(IComposerClient::BlendMode blendMode) {
+        mLayers.clear();
+        std::vector<IComposerClient::Color> topLayerPixelColors(mDisplayWidth * mDisplayHeight);
+        fillColorsArea(topLayerPixelColors, mDisplayWidth, {0, 0, mDisplayWidth, mDisplayHeight},
+                       mTopLayerColor);
+
+        auto backgroundLayer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+        backgroundLayer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+        backgroundLayer->setZOrder(0);
+        backgroundLayer->setColor(mBackgroundColor);
+
+        auto layer = std::make_shared<TestBufferLayer>(mComposerClient, mGralloc, mPrimaryDisplay,
+                                                       mDisplayWidth, mDisplayHeight,
+                                                       PixelFormat::RGBA_8888);
+        layer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+        layer->setZOrder(10);
+        ASSERT_NO_FATAL_FAILURE(layer->setBuffer(topLayerPixelColors));
+
+        layer->setBlendMode(blendMode);
+        layer->setAlpha(GetParam());
+
+        mLayers.push_back(backgroundLayer);
+        mLayers.push_back(layer);
+    }
+
+    void setExpectedColors(std::vector<IComposerClient::Color>& expectedColors) {
+        ASSERT_EQ(2, mLayers.size());
+        clearColors(expectedColors, mDisplayWidth, mDisplayHeight);
+
+        auto layer = mLayers[1];
+        IComposerClient::BlendMode blendMode = layer->mBlendMode;
+        float alpha = mTopLayerColor.a / 255.0 * layer->mAlpha;
+        if (blendMode == IComposerClient::BlendMode::NONE) {
+            for (int i = 0; i < expectedColors.size(); i++) {
+                expectedColors[i].r = mTopLayerColor.r * layer->mAlpha;
+                expectedColors[i].g = mTopLayerColor.g * layer->mAlpha;
+                expectedColors[i].b = mTopLayerColor.b * layer->mAlpha;
+                expectedColors[i].a = alpha * 255.0;
+            }
+        } else if (blendMode == IComposerClient::BlendMode::PREMULTIPLIED) {
+            for (int i = 0; i < expectedColors.size(); i++) {
+                expectedColors[i].r =
+                    mTopLayerColor.r * layer->mAlpha + mBackgroundColor.r * (1.0 - alpha);
+                expectedColors[i].g =
+                    mTopLayerColor.g * layer->mAlpha + mBackgroundColor.g * (1.0 - alpha);
+                expectedColors[i].b =
+                    mTopLayerColor.b * layer->mAlpha + mBackgroundColor.b * (1.0 - alpha);
+                expectedColors[i].a = alpha + mBackgroundColor.a * (1.0 - alpha);
+            }
+        } else if (blendMode == IComposerClient::BlendMode::COVERAGE) {
+            for (int i = 0; i < expectedColors.size(); i++) {
+                expectedColors[i].r = mTopLayerColor.r * alpha + mBackgroundColor.r * (1.0 - alpha);
+                expectedColors[i].g = mTopLayerColor.g * alpha + mBackgroundColor.g * (1.0 - alpha);
+                expectedColors[i].b = mTopLayerColor.b * alpha + mBackgroundColor.b * (1.0 - alpha);
+                expectedColors[i].a = mTopLayerColor.a * alpha + mBackgroundColor.a * (1.0 - alpha);
+            }
+        }
+    }
+
+   protected:
+    std::vector<std::shared_ptr<TestLayer>> mLayers;
+    IComposerClient::Color mBackgroundColor;
+    IComposerClient::Color mTopLayerColor;
+};
+
+TEST_P(GraphicsComposerBlendModeReadbackTest, None) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+
+    setBackgroundColor(BLACK);
+    setTopLayerColor(TRANSLUCENT_RED);
+    setUpLayers(IComposerClient::BlendMode::NONE);
+    setExpectedColors(expectedColors);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+    writeLayers(mLayers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+// TODO: bug 116865056: Readback returns (245, 0, 0) for layer plane
+// alpha of .2, expected 10.2
+TEST_P(GraphicsComposerBlendModeReadbackTest, DISABLED_Coverage) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+
+    setBackgroundColor(BLACK);
+    setTopLayerColor(TRANSLUCENT_RED);
+
+    setUpLayers(IComposerClient::BlendMode::COVERAGE);
+    setExpectedColors(expectedColors);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+    writeLayers(mLayers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_P(GraphicsComposerBlendModeReadbackTest, Premultiplied) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+
+    mWriter->selectDisplay(mPrimaryDisplay);
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+
+    setBackgroundColor(BLACK);
+    setTopLayerColor(TRANSLUCENT_RED);
+    setUpLayers(IComposerClient::BlendMode::PREMULTIPLIED);
+    setExpectedColors(expectedColors);
+
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+    writeLayers(mLayers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+INSTANTIATE_TEST_CASE_P(BlendModeTest, GraphicsComposerBlendModeReadbackTest,
+                        ::testing::Values(.2, 1.0));
+
+class GraphicsComposerTransformReadbackTest : public GraphicsComposerReadbackTest {
+   protected:
+    void SetUp() override {
+        GraphicsComposerReadbackTest::SetUp();
+
+        mWriter->selectDisplay(mPrimaryDisplay);
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setColorMode(mPrimaryDisplay, ColorMode::SRGB,
+                                                              RenderIntent::COLORIMETRIC));
+
+        auto backgroundLayer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+        backgroundLayer->setColor({0, 0, 0, 0});
+        backgroundLayer->setDisplayFrame({0, 0, mDisplayWidth, mDisplayHeight});
+        backgroundLayer->setZOrder(0);
+
+        mSideLength = mDisplayWidth < mDisplayHeight ? mDisplayWidth : mDisplayHeight;
+        IComposerClient::Rect redRect = {0, 0, mSideLength / 2, mSideLength / 2};
+        IComposerClient::Rect blueRect = {mSideLength / 2, mSideLength / 2, mSideLength,
+                                          mSideLength};
+
+        mLayer =
+            std::make_shared<TestBufferLayer>(mComposerClient, mGralloc, mPrimaryDisplay,
+                                              mSideLength, mSideLength, PixelFormat::RGBA_8888);
+        mLayer->setDisplayFrame({0, 0, mSideLength, mSideLength});
+        mLayer->setZOrder(10);
+
+        std::vector<IComposerClient::Color> baseColors(mSideLength * mSideLength);
+        fillColorsArea(baseColors, mSideLength, redRect, RED);
+        fillColorsArea(baseColors, mSideLength, blueRect, BLUE);
+        ASSERT_NO_FATAL_FAILURE(mLayer->setBuffer(baseColors));
+
+        mLayers = {backgroundLayer, mLayer};
+    }
+
+   protected:
+    std::shared_ptr<TestBufferLayer> mLayer;
+    std::vector<IComposerClient::Color> baseColors;
+    std::vector<std::shared_ptr<TestLayer>> mLayers;
+    int mSideLength;
+};
+
+TEST_F(GraphicsComposerTransformReadbackTest, FLIP_H) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+    mLayer->setTransform(Transform::FLIP_H);
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {mSideLength / 2, 0, mSideLength, mSideLength / 2}, RED);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mSideLength / 2, mSideLength / 2, mSideLength}, BLUE);
+
+    writeLayers(mLayers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerTransformReadbackTest, FLIP_V) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    mLayer->setTransform(Transform::FLIP_V);
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {0, mSideLength / 2, mSideLength / 2, mSideLength}, RED);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {mSideLength / 2, 0, mSideLength, mSideLength / 2}, BLUE);
+
+    writeLayers(mLayers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+TEST_F(GraphicsComposerTransformReadbackTest, ROT_180) {
+    if (!mHasReadbackBuffer) {
+        GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
+        return;
+    }
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+    mLayer->setTransform(Transform::ROT_180);
+
+    std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
+    fillColorsArea(expectedColors, mDisplayWidth,
+                   {mSideLength / 2, mSideLength / 2, mSideLength, mSideLength}, RED);
+    fillColorsArea(expectedColors, mDisplayWidth, {0, 0, mSideLength / 2, mSideLength / 2}, BLUE);
+
+    writeLayers(mLayers);
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->validateDisplay();
+    execute();
+    if (mReader->mCompositionChanges.size() != 0) {
+        clearCommandReaderState();
+        GTEST_SUCCEED();
+        return;
+    }
+    ASSERT_EQ(0, mReader->mErrors.size());
+    mWriter->presentDisplay();
+    execute();
+    ASSERT_EQ(0, mReader->mErrors.size());
+    ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+}
+
+}  // anonymous namespace
+}  // namespace vts
+}  // namespace V2_2
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
index 951e874..7834b94 100644
--- a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
+++ b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
@@ -32,17 +32,15 @@
 namespace vts {
 namespace {
 
-using android::hardware::graphics::common::V1_0::BufferUsage;
-using android::hardware::graphics::common::V1_0::ColorTransform;
-using android::hardware::graphics::common::V1_0::Transform;
-using android::hardware::graphics::common::V1_1::ColorMode;
-using android::hardware::graphics::common::V1_1::Dataspace;
-using android::hardware::graphics::common::V1_1::PixelFormat;
-using android::hardware::graphics::common::V1_1::RenderIntent;
-using android::hardware::graphics::composer::V2_2::IComposerClient;
-using android::hardware::graphics::mapper::V2_0::IMapper;
-using android::hardware::graphics::mapper::V2_0::vts::Gralloc;
-using GrallocError = android::hardware::graphics::mapper::V2_0::Error;
+using common::V1_0::BufferUsage;
+using common::V1_0::ColorTransform;
+using common::V1_0::Transform;
+using common::V1_1::ColorMode;
+using common::V1_1::Dataspace;
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
+using mapper::V2_0::IMapper;
+using mapper::V2_0::vts::Gralloc;
 
 // Test environment for graphics.composer
 class GraphicsComposerHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
@@ -65,9 +63,9 @@
    protected:
     void SetUp() override {
         ASSERT_NO_FATAL_FAILURE(
-            mComposer = std::make_unique<Composer_v2_2>(
+            mComposer = std::make_unique<Composer>(
                 GraphicsComposerHidlEnvironment::Instance()->getServiceName<IComposer>()));
-        ASSERT_NO_FATAL_FAILURE(mComposerClient = mComposer->createClient_v2_2());
+        ASSERT_NO_FATAL_FAILURE(mComposerClient = mComposer->createClient());
 
         mComposerCallback = new V2_1::vts::GraphicsComposerCallback;
         mComposerClient->registerCallback(mComposerCallback);
@@ -75,14 +73,29 @@
         // assume the first display is primary and is never removed
         mPrimaryDisplay = waitForFirstDisplay();
 
+        Config config = mComposerClient->getActiveConfig(mPrimaryDisplay);
+        mDisplayWidth = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                             IComposerClient::Attribute::WIDTH);
+        mDisplayHeight = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                              IComposerClient::Attribute::HEIGHT);
+
         // explicitly disable vsync
         mComposerClient->setVsyncEnabled(mPrimaryDisplay, false);
         mComposerCallback->setVsyncAllowed(false);
 
         mComposerClient->getRaw()->getReadbackBufferAttributes(
-            mPrimaryDisplay, [&](const auto& tmpError, const auto&, const auto&) {
+            mPrimaryDisplay,
+            [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
                 mHasReadbackBuffer = tmpError == Error::NONE;
+                if (mHasReadbackBuffer) {
+                    mReadbackPixelFormat = tmpPixelFormat;
+                    mReadbackDataspace = tmpDataspace;
+                    ASSERT_LT(static_cast<PixelFormat>(0), mReadbackPixelFormat);
+                    ASSERT_NE(Dataspace::UNKNOWN, mReadbackDataspace);
+                }
             });
+
+        mInvalidDisplayId = GetInvalidDisplayId();
     }
 
     void TearDown() override {
@@ -93,16 +106,39 @@
         }
     }
 
+    // returns an invalid display id (one that has not been registered to a
+    // display.  Currently assuming that a device will never have close to
+    // std::numeric_limit<uint64_t>::max() displays registered while running tests
+    Display GetInvalidDisplayId() {
+        std::vector<Display> validDisplays = mComposerCallback->getDisplays();
+        uint64_t id = std::numeric_limits<uint64_t>::max();
+        while (id > 0) {
+            if (std::find(validDisplays.begin(), validDisplays.end(), id) == validDisplays.end()) {
+                return id;
+            }
+            id--;
+        }
+
+        return 0;
+    }
+
     // use the slot count usually set by SF
     static constexpr uint32_t kBufferSlotCount = 64;
 
-    std::unique_ptr<Composer_v2_2> mComposer;
-    std::unique_ptr<ComposerClient_v2_2> mComposerClient;
+    std::unique_ptr<Composer> mComposer;
+    std::unique_ptr<ComposerClient> mComposerClient;
     sp<V2_1::vts::GraphicsComposerCallback> mComposerCallback;
     // the first display and is assumed never to be removed
     Display mPrimaryDisplay;
+    int32_t mDisplayWidth;
+    int32_t mDisplayHeight;
+
     bool mHasReadbackBuffer;
 
+    uint64_t mInvalidDisplayId;
+    PixelFormat mReadbackPixelFormat;
+    Dataspace mReadbackDataspace;
+
    private:
     Display waitForFirstDisplay() {
         while (true) {
@@ -125,11 +161,14 @@
 
         ASSERT_NO_FATAL_FAILURE(mGralloc = std::make_unique<Gralloc>());
 
-        mWriter = std::make_unique<V2_2::CommandWriterBase>(1024);
+        mWriter = std::make_unique<CommandWriterBase>(1024);
         mReader = std::make_unique<V2_1::vts::TestCommandReader>();
     }
 
-    void TearDown() override { ASSERT_NO_FATAL_FAILURE(GraphicsComposerHidlTest::TearDown()); }
+    void TearDown() override {
+        ASSERT_EQ(0, mReader->mErrors.size());
+        ASSERT_NO_FATAL_FAILURE(GraphicsComposerHidlTest::TearDown());
+    }
 
     const native_handle_t* allocate() {
         IMapper::BufferDescriptorInfo info{};
@@ -143,9 +182,9 @@
         return mGralloc->allocate(info);
     }
 
-    void execute() { mComposerClient->execute_v2_2(mReader.get(), mWriter.get()); }
+    void execute() { mComposerClient->execute(mReader.get(), mWriter.get()); }
 
-    std::unique_ptr<V2_2::CommandWriterBase> mWriter;
+    std::unique_ptr<CommandWriterBase> mWriter;
     std::unique_ptr<V2_1::vts::TestCommandReader> mReader;
 
    private:
@@ -191,6 +230,16 @@
         {IComposerClient::PerFrameMetadataKey::MAX_FRAME_AVERAGE_LIGHT_LEVEL, 62.0});
     mWriter->setLayerPerFrameMetadata(hidlMetadata);
     execute();
+
+    if (mReader->mErrors.size() == 1 &&
+        static_cast<Error>(mReader->mErrors[0].second) == Error::UNSUPPORTED) {
+        mReader->mErrors.clear();
+        GTEST_SUCCEED() << "SetLayerPerFrameMetadata is not supported";
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->destroyLayer(mPrimaryDisplay, layer));
+        return;
+    }
+
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->destroyLayer(mPrimaryDisplay, layer));
 }
 
 /**
@@ -249,9 +298,35 @@
 }
 
 /**
+ * Test IComposerClient::getClientTargetSupport_2_2
+ *
+ * Test that IComposerClient::getClientTargetSupport_2_2 returns
+ * Error::BAD_DISPLAY when passed in an invalid display handle
+ */
+
+TEST_F(GraphicsComposerHidlTest, GetClientTargetSupport_2_2BadDisplay) {
+    std::vector<Config> configs = mComposerClient->getDisplayConfigs(mPrimaryDisplay);
+    for (auto config : configs) {
+        int32_t width = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                             IComposerClient::Attribute::WIDTH);
+        int32_t height = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                              IComposerClient::Attribute::HEIGHT);
+        ASSERT_LT(0, width);
+        ASSERT_LT(0, height);
+
+        mComposerClient->setActiveConfig(mPrimaryDisplay, config);
+
+        Error error = mComposerClient->getRaw()->getClientTargetSupport_2_2(
+            mInvalidDisplayId, width, height, PixelFormat::RGBA_8888, Dataspace::UNKNOWN);
+
+        EXPECT_EQ(Error::BAD_DISPLAY, error);
+    }
+}
+
+/**
  * Test IComposerClient::setPowerMode_2_2.
  */
-TEST_F(GraphicsComposerHidlTest, setPowerMode_2_2) {
+TEST_F(GraphicsComposerHidlTest, SetPowerMode_2_2) {
     std::vector<IComposerClient::PowerMode> modes;
     modes.push_back(IComposerClient::PowerMode::OFF);
     modes.push_back(IComposerClient::PowerMode::ON_SUSPEND);
@@ -262,25 +337,118 @@
     }
 }
 
-TEST_F(GraphicsComposerHidlTest, setReadbackBuffer) {
+/**
+ * Test IComposerClient::setPowerMode_2_2
+ *
+ * Test that IComposerClient::setPowerMode_2_2 succeeds for different varations
+ * of PowerMode
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerMode_2_2Variations) {
+    std::vector<IComposerClient::PowerMode> modes;
+
+    modes.push_back(IComposerClient::PowerMode::OFF);
+    modes.push_back(IComposerClient::PowerMode::OFF);
+
+    for (auto mode : modes) {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode_2_2(mPrimaryDisplay, mode));
+    }
+
+    modes.clear();
+
+    modes.push_back(IComposerClient::PowerMode::ON);
+    modes.push_back(IComposerClient::PowerMode::ON);
+
+    for (auto mode : modes) {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode_2_2(mPrimaryDisplay, mode));
+    }
+
+    modes.clear();
+
+    modes.push_back(IComposerClient::PowerMode::ON_SUSPEND);
+    modes.push_back(IComposerClient::PowerMode::ON_SUSPEND);
+
+    for (auto mode : modes) {
+        ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode_2_2(mPrimaryDisplay, mode));
+    }
+
+    if (mComposerClient->getDozeSupport(mPrimaryDisplay)) {
+        modes.clear();
+
+        modes.push_back(IComposerClient::PowerMode::DOZE);
+        modes.push_back(IComposerClient::PowerMode::DOZE);
+
+        for (auto mode : modes) {
+            ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode_2_2(mPrimaryDisplay, mode));
+        }
+
+        modes.clear();
+
+        modes.push_back(IComposerClient::PowerMode::DOZE_SUSPEND);
+        modes.push_back(IComposerClient::PowerMode::DOZE_SUSPEND);
+
+        for (auto mode : modes) {
+            ASSERT_NO_FATAL_FAILURE(mComposerClient->setPowerMode_2_2(mPrimaryDisplay, mode));
+        }
+    }
+}
+
+/**
+ * Test IComposerClient::setPowerMode_2_2
+ *
+ * Tests that IComposerClient::setPowerMode_2_2 returns BAD_DISPLAY when passed an
+ * invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerMode_2_2BadDisplay) {
+    Error error = mComposerClient->getRaw()->setPowerMode_2_2(mInvalidDisplayId,
+                                                              IComposerClient::PowerMode::ON);
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
+ * Test IComposerClient::setPowerMode_2_2
+ *
+ * Test that IComposerClient::setPowerMode_2_2 returns BAD_PARAMETER when passed
+ * an invalid PowerMode
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerMode_2_2BadParameter) {
+    Error error = mComposerClient->getRaw()->setPowerMode_2_2(
+        mPrimaryDisplay, static_cast<IComposerClient::PowerMode>(-1));
+    ASSERT_EQ(Error::BAD_PARAMETER, error);
+}
+
+/**
+ * Test IComposerClient::setPowerMode_2_2
+ *
+ * Test that IComposerClient::setPowerMode_2_2 returns UNSUPPORTED when passed
+ * DOZE or DOZE_SUPPORT on a device that does not support these modes
+ */
+TEST_F(GraphicsComposerHidlTest, SetPowerMode_2_2Unsupported) {
+    if (!mComposerClient->getDozeSupport(mPrimaryDisplay)) {
+        Error error = mComposerClient->getRaw()->setPowerMode_2_2(mPrimaryDisplay,
+                                                                  IComposerClient::PowerMode::DOZE);
+        EXPECT_EQ(Error::UNSUPPORTED, error);
+
+        error = mComposerClient->getRaw()->setPowerMode_2_2(
+            mPrimaryDisplay, IComposerClient::PowerMode::DOZE_SUSPEND);
+        EXPECT_EQ(Error::UNSUPPORTED, error);
+    }
+}
+
+/**
+ * Test IComposerClient::setReadbackBuffer
+ *
+ * Test IComposerClient::setReadbackBuffer
+ */
+TEST_F(GraphicsComposerHidlTest, SetReadbackBuffer) {
     if (!mHasReadbackBuffer) {
         return;
     }
 
-    PixelFormat pixelFormat;
-    Dataspace dataspace;
-    mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &pixelFormat, &dataspace);
-    ASSERT_LT(static_cast<PixelFormat>(0), pixelFormat);
-    ASSERT_NE(Dataspace::UNKNOWN, dataspace);
-
     IMapper::BufferDescriptorInfo info{};
-    Config config = mComposerClient->getActiveConfig(mPrimaryDisplay);
-    info.width = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
-                                                      IComposerClient::Attribute::WIDTH);
-    info.height = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
-                                                       IComposerClient::Attribute::HEIGHT);
+    info.width = mDisplayWidth;
+    info.height = mDisplayHeight;
     info.layerCount = 1;
-    info.format = static_cast<common::V1_0::PixelFormat>(pixelFormat);
+    info.format = static_cast<common::V1_0::PixelFormat>(mReadbackPixelFormat);
     // BufferUsage::COMPOSER_OUTPUT is missing
     info.usage = static_cast<uint64_t>(BufferUsage::COMPOSER_OVERLAY | BufferUsage::CPU_READ_OFTEN);
 
@@ -292,7 +460,49 @@
     mComposerClient->setReadbackBuffer(mPrimaryDisplay, buffer, -1);
 }
 
-TEST_F(GraphicsComposerHidlTest, getReadbackBufferFenceInactive) {
+/**
+ * Test IComposerClient::setReadbackBuffer
+ *
+ * Test that IComposerClient::setReadbackBuffer returns an Error::BAD_DISPLAY
+ * when passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, SetReadbackBufferBadDisplay) {
+    if (!mHasReadbackBuffer) {
+        return;
+    }
+
+    IMapper::BufferDescriptorInfo info{};
+    info.width = mDisplayWidth;
+    info.height = mDisplayHeight;
+    info.layerCount = 1;
+    info.format = static_cast<common::V1_0::PixelFormat>(mReadbackPixelFormat);
+    info.usage = static_cast<uint64_t>(BufferUsage::COMPOSER_OVERLAY | BufferUsage::CPU_READ_OFTEN);
+
+    std::unique_ptr<Gralloc> gralloc;
+    const native_handle_t* buffer;
+    ASSERT_NO_FATAL_FAILURE(gralloc = std::make_unique<Gralloc>());
+    ASSERT_NO_FATAL_FAILURE(buffer = gralloc->allocate(info));
+
+    Error error = mComposerClient->getRaw()->setReadbackBuffer(mInvalidDisplayId, buffer, nullptr);
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/**
+ * Test IComposerClient::setReadbackBuffer
+ *
+ * Test that IComposerClient::setReadbackBuffer returns Error::BAD_PARAMETER
+ * when passed an invalid buffer handle
+ */
+TEST_F(GraphicsComposerHidlTest, SetReadbackBufferBadParameter) {
+    if (!mHasReadbackBuffer) {
+        return;
+    }
+
+    Error error = mComposerClient->getRaw()->setReadbackBuffer(mPrimaryDisplay, nullptr, nullptr);
+    ASSERT_EQ(Error::BAD_PARAMETER, error);
+}
+
+TEST_F(GraphicsComposerHidlTest, GetReadbackBufferFenceInactive) {
     if (!mHasReadbackBuffer) {
         return;
     }
@@ -313,14 +523,38 @@
 
     mWriter->selectDisplay(mPrimaryDisplay);
     mWriter->selectLayer(layer);
+    mWriter->setLayerCompositionType(IComposerClient::Composition::SOLID_COLOR);
     mWriter->setLayerFloatColor(IComposerClient::FloatColor{1.0, 1.0, 1.0, 1.0});
     mWriter->setLayerFloatColor(IComposerClient::FloatColor{0.0, 0.0, 0.0, 0.0});
+    execute();
+
+    if (mReader->mErrors.size() == 2 &&
+        static_cast<Error>(mReader->mErrors[0].second) == Error::UNSUPPORTED &&
+        static_cast<Error>(mReader->mErrors[1].second) == Error::UNSUPPORTED) {
+        mReader->mErrors.clear();
+        GTEST_SUCCEED() << "SetLayerFloatColor is not supported";
+        return;
+    }
+
+    // ensure setting float color on layer with composition type that is not
+    // SOLID_COLOR does not fail
+    V2_1::Layer clientLayer;
+    ASSERT_NO_FATAL_FAILURE(clientLayer =
+                                mComposerClient->createLayer(mPrimaryDisplay, kBufferSlotCount));
+    mWriter->selectDisplay(mPrimaryDisplay);
+    mWriter->selectLayer(clientLayer);
+    mWriter->setLayerCompositionType(IComposerClient::Composition::CLIENT);
+    mWriter->setLayerFloatColor(IComposerClient::FloatColor{1.0, 1.0, 1.0, 1.0});
+    execute();
+
+    // At this point we know that this function is supported so there should be
+    // no errors (checked upon TearDown)
 }
 
 /**
  * Test IComposerClient::getDataspaceSaturationMatrix.
  */
-TEST_F(GraphicsComposerHidlTest, getDataspaceSaturationMatrix) {
+TEST_F(GraphicsComposerHidlTest, GetDataspaceSaturationMatrix) {
     auto matrix = mComposerClient->getDataspaceSaturationMatrix(Dataspace::SRGB_LINEAR);
     // the last row is known
     ASSERT_EQ(0.0f, matrix[12]);
@@ -329,6 +563,19 @@
     ASSERT_EQ(1.0f, matrix[15]);
 }
 
+/*
+ * Test IComposerClient::getDataspaceSaturationMatrix
+ *
+ * Test that IComposerClient::getDataspaceSaturationMatrix returns
+ * Error::BAD_PARAMETER when passed a dataspace other than
+ * Dataspace::SRGB_LINEAR
+ */
+TEST_F(GraphicsComposerHidlTest, GetDataspaceSaturationMatrixBadParameter) {
+    mComposerClient->getRaw()->getDataspaceSaturationMatrix(
+        Dataspace::UNKNOWN,
+        [&](const auto& tmpError, const auto&) { ASSERT_EQ(Error::BAD_PARAMETER, tmpError); });
+}
+
 /**
  * Test IComposerClient::getColorMode_2_2.
  */
@@ -339,10 +586,22 @@
     EXPECT_NE(modes.cend(), nativeMode);
 }
 
-/**
- * Test IComposerClient::getRenderIntent.
+/*
+ * Test IComposerClient::getColorMode_2_2
+ *
+ * Test that IComposerClient::getColorMode returns Error::BAD_DISPLAY when
+ * passed an invalid display handle
  */
-TEST_F(GraphicsComposerHidlTest, GetRenderIntent) {
+TEST_F(GraphicsComposerHidlTest, GetColorMode_2_2BadDisplay) {
+    mComposerClient->getRaw()->getColorModes_2_2(
+        mInvalidDisplayId,
+        [&](const auto& tmpError, const auto&) { ASSERT_EQ(Error::BAD_DISPLAY, tmpError); });
+}
+
+/**
+ * Test IComposerClient::getRenderIntents.
+ */
+TEST_F(GraphicsComposerHidlTest, GetRenderIntents) {
     std::vector<ColorMode> modes = mComposerClient->getColorModes(mPrimaryDisplay);
     for (auto mode : modes) {
         std::vector<RenderIntent> intents =
@@ -366,6 +625,33 @@
     }
 }
 
+/*
+ * Test IComposerClient::getRenderIntents
+ *
+ * Test that IComposerClient::getRenderIntent returns Error::BAD_DISPLAY when
+ * passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, GetRenderIntentsBadDisplay) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes(mPrimaryDisplay);
+    for (auto mode : modes) {
+        mComposerClient->getRaw()->getRenderIntents(
+            mInvalidDisplayId, mode,
+            [&](const auto& tmpError, const auto&) { EXPECT_EQ(Error::BAD_DISPLAY, tmpError); });
+    }
+}
+
+/*
+ * Test IComposerClient::getRenderIntents
+ *
+ * Test that IComposerClient::getRenderIntents returns Error::BAD_PARAMETER when
+ * pased either an invalid Color mode or an invalid Render Intent
+ */
+TEST_F(GraphicsComposerHidlTest, GetRenderIntentsBadParameter) {
+    mComposerClient->getRaw()->getRenderIntents(
+        mPrimaryDisplay, static_cast<ColorMode>(-1),
+        [&](const auto& tmpError, const auto&) { EXPECT_EQ(Error::BAD_PARAMETER, tmpError); });
+}
+
 /**
  * Test IComposerClient::setColorMode_2_2.
  */
@@ -378,6 +664,37 @@
             mComposerClient->setColorMode(mPrimaryDisplay, mode, intent);
         }
     }
+
+    mComposerClient->setColorMode(mPrimaryDisplay, ColorMode::NATIVE, RenderIntent::COLORIMETRIC);
+}
+
+/*
+ * Test IComposerClient::setColorMode_2_2
+ *
+ * Test that IComposerClient::setColorMode_2_2 returns an Error::BAD_DISPLAY
+ * when passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorMode_2_2BadDisplay) {
+    Error error = mComposerClient->getRaw()->setColorMode_2_2(mInvalidDisplayId, ColorMode::NATIVE,
+                                                              RenderIntent::COLORIMETRIC);
+
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/*
+ * Test IComposerClient::setColorMode_2_2
+ *
+ * Test that IComposerClient::setColorMode_2_2 returns Error::BAD_PARAMETER when
+ * passed an invalid Color mode or an invalid render intent
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorMode_2_2BadParameter) {
+    Error colorModeError = mComposerClient->getRaw()->setColorMode_2_2(
+        mPrimaryDisplay, static_cast<ColorMode>(-1), RenderIntent::COLORIMETRIC);
+    EXPECT_EQ(Error::BAD_PARAMETER, colorModeError);
+
+    Error renderIntentError = mComposerClient->getRaw()->setColorMode_2_2(
+        mPrimaryDisplay, ColorMode::NATIVE, static_cast<RenderIntent>(-1));
+    EXPECT_EQ(Error::BAD_PARAMETER, renderIntentError);
 }
 
 }  // namespace
diff --git a/graphics/composer/2.3/Android.bp b/graphics/composer/2.3/Android.bp
new file mode 100644
index 0000000..6d29348
--- /dev/null
+++ b/graphics/composer/2.3/Android.bp
@@ -0,0 +1,23 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.graphics.composer@2.3",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "IComposer.hal",
+        "IComposerClient.hal",
+    ],
+    interfaces: [
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
+        "android.hardware.graphics.common@1.2",
+        "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.composer@2.2",
+        "android.hidl.base@1.0",
+    ],
+    gen_java: false,
+}
+
diff --git a/graphics/composer/2.3/IComposer.hal b/graphics/composer/2.3/IComposer.hal
new file mode 100644
index 0000000..90b2427
--- /dev/null
+++ b/graphics/composer/2.3/IComposer.hal
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.composer@2.3;
+
+import IComposerClient;
+
+import @2.1::Error;
+import @2.2::IComposer;
+
+interface IComposer extends @2.2::IComposer {
+
+    /**
+     * Creates a v2.3 client of the composer. Supersedes @2.1::createClient.
+     *
+     * @return error is NONE upon success. Otherwise,
+     *         NO_RESOURCES when the client could not be created.
+     * @return client is the newly created client.
+     */
+    @entry
+    @callflow(next="*")
+    createClient_2_3() generates (Error error, IComposerClient client);
+
+};
diff --git a/graphics/composer/2.3/IComposerClient.hal b/graphics/composer/2.3/IComposerClient.hal
new file mode 100644
index 0000000..7856658
--- /dev/null
+++ b/graphics/composer/2.3/IComposerClient.hal
@@ -0,0 +1,353 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.composer@2.3;
+
+import android.hardware.graphics.common@1.1::RenderIntent;
+import android.hardware.graphics.common@1.1::PixelFormat;
+import android.hardware.graphics.common@1.2::ColorMode;
+import android.hardware.graphics.common@1.2::Dataspace;
+import android.hardware.graphics.composer@2.1::IComposerClient.Command;
+import @2.2::IComposerClient;
+import @2.1::Display;
+import @2.1::Error;
+
+interface IComposerClient extends @2.2::IComposerClient {
+
+    enum Command : @2.2::IComposerClient.Command {
+        /**
+         * SET_LAYER_COLOR_TRANSFORM has this pseudo prototype
+         *
+         *   setLayerColorTransform(float[16] matrix);
+         *
+         * This command has the following binary layout in bytes:
+         *
+         *     0 - 16 * 4: matrix
+         *
+         * Sets a matrix for color transform which will be applied on this layer
+         * before composition.
+         *
+         * If the device is not capable of apply the matrix on this layer, it must force
+         * this layer to client composition during VALIDATE_DISPLAY.
+         *
+         * The matrix provided is an affine color transformation of the following
+         * form:
+         *
+         * |r.r r.g r.b 0|
+         * |g.r g.g g.b 0|
+         * |b.r b.g b.b 0|
+         * |Tr  Tg  Tb  1|
+         *
+         * This matrix must be provided in row-major form:
+         *
+         * {r.r, r.g, r.b, 0, g.r, ...}.
+         *
+         * Given a matrix of this form and an input color [R_in, G_in, B_in],
+         * the input color must first be converted to linear space
+         * [R_linear, G_linear, B_linear], then the output linear color
+         * [R_out_linear, G_out_linear, B_out_linear] will be:
+         *
+         * R_out_linear = R_linear * r.r + G_linear * g.r + B_linear * b.r + Tr
+         * G_out_linear = R_linear * r.g + G_linear * g.g + B_linear * b.g + Tg
+         * B_out_linear = R_linear * r.b + G_linear * g.b + B_linear * b.b + Tb
+         *
+         * [R_out_linear, G_out_linear, B_out_linear] must then be converted to
+         * gamma space: [R_out, G_out, B_out] before blending.
+         *
+         * @param matrix is a 4x4 transform matrix (16 floats) as described above.
+         */
+        SET_LAYER_COLOR_TRANSFORM = 0x40d << @2.1::IComposerClient.Command:OPCODE_SHIFT,
+    };
+
+    /**
+     * Returns the port and data that describe a physical display. The port is
+     * a unique number that identifies a physical connector (e.g. eDP, HDMI)
+     * for display output. The data blob is parsed to determine its format,
+     * typically EDID 1.3 as specified in VESA E-EDID Standard Release A
+     * Revision 1.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         UNSUPPORTED when identification data is unavailable.
+     * @return port is the connector to which the display is connected.
+     * @return data is the EDID 1.3 blob identifying the display.
+     */
+    @callflow(next="*")
+    getDisplayIdentificationData(Display display)
+               generates (Error error,
+                          uint8_t port,
+                          vec<uint8_t> data);
+    /**
+     * getReadbackBufferAttributes_2_3
+     * Returns the format which should be used when allocating a buffer for use by
+     * device readback as well as the dataspace in which its contents must be
+     * interpreted.
+     *
+     * The width and height of this buffer must be those of the currently-active
+     * display configuration, and the usage flags must consist of the following:
+     *   BufferUsage::CPU_READ | BufferUsage::GPU_TEXTURE |
+     *   BufferUsage::COMPOSER_OUTPUT
+     *
+     * The format and dataspace provided must be sufficient such that if a
+     * correctly-configured buffer is passed into setReadbackBuffer, filled by
+     * the device, and then displayed by the client as a full-screen buffer, the
+     * output of the display remains the same (subject to the note about protected
+     * content in the description of setReadbackBuffer).
+     *
+     * If the active configuration or color mode of this display has changed
+     * since a previous call to this function, it must be called again prior to
+     * setting a readback buffer such that the returned format and dataspace will
+     * be updated accordingly.
+     *
+     * Parameters:
+     * @param display - the display on which to create the layer.
+     *
+     * @return format - the format the client should use when allocating a device
+     *     readback buffer
+     * @return dataspace - the dataspace to use when interpreting the
+     *     contents of a device readback buffer
+     * @return error is NONE upon success. Otherwise,
+     *     BAD_DISPLAY when an invalid display handle was passed in.
+     *     UNSUPPORTED if not supported on underlying HAL
+     *
+     * See also:
+     *   setReadbackBuffer
+     *   getReadbackBufferFence
+     */
+    getReadbackBufferAttributes_2_3(Display display)
+        generates (Error error,
+                   PixelFormat format,
+                   Dataspace dataspace);
+
+    /**
+     * getClientTargetSupport_2_3
+     * Returns whether a client target with the given properties can be
+     * handled by the device.
+     *
+     * This function must return true for a client target with width and
+     * height equal to the active display configuration dimensions,
+     * PixelFormat::RGBA_8888, and Dataspace::UNKNOWN. It is not required to
+     * return true for any other configuration.
+     *
+     * @param display is the display to query.
+     * @param width is the client target width in pixels.
+     * @param height is the client target height in pixels.
+     * @param format is the client target format.
+     * @param dataspace is the client target dataspace, as described in
+     *     setLayerDataspace.
+     * @return error is NONE upon success. Otherwise,
+     *     BAD_DISPLAY when an invalid display handle was passed in.
+     *     UNSUPPORTED when the given configuration is not supported.
+     */
+    @callflow(next="*")
+    getClientTargetSupport_2_3(Display display,
+                               uint32_t width,
+                               uint32_t height,
+                               PixelFormat format,
+                               Dataspace dataspace)
+                    generates (Error error);
+
+    enum FormatColorComponent : uint8_t {
+        /* The first component  (eg, for RGBA_8888, this is R) */
+        FORMAT_COMPONENT_0 = 1 << 0,
+        /* The second component (eg, for RGBA_8888, this is G) */
+        FORMAT_COMPONENT_1 = 1 << 1,
+        /* The third component  (eg, for RGBA_8888, this is B) */
+        FORMAT_COMPONENT_2 = 1 << 2,
+        /* The fourth component (eg, for RGBA_8888, this is A) */
+        FORMAT_COMPONENT_3 = 1 << 3,
+    };
+
+    /**
+     * Query for what types of color sampling the hardware supports.
+     *
+     * @param  display        is the display where the samples are collected.
+     * @return error          is NONE upon success. Otherwise,
+     *                        BAD_DISPLAY when an invalid display was passed in, or
+     *                        UNSUPPORTED when there is no efficient way to sample.
+     * @return format         The format of the sampled pixels.
+     * @return dataspace      The dataspace of the sampled pixels.
+     * @return componentMask  The mask of which components can be sampled.
+     */
+    getDisplayedContentSamplingAttributes(Display display)
+               generates (Error error,
+                          PixelFormat format,
+                          Dataspace dataspace,
+                          bitfield<FormatColorComponent> componentMask);
+
+    /** DisplayedContentSampling values passed to setDisplayedContentSamplingEnabled. */
+    enum DisplayedContentSampling : int32_t {
+        INVALID = 0,
+
+        /** Enable content sampling. */
+        ENABLE = 1,
+
+        /** Disable content sampling. */
+        DISABLE = 2,
+    };
+
+    /**
+     * Enables or disables the collection of color content statistics
+     * on this display.
+     *
+     * Sampling occurs on the contents of the final composition on this display
+     * (i.e., the contents presented on screen). Samples should be collected after all
+     * color transforms have been applied.
+     *
+     * Sampling support is optional, and is set to DISABLE by default.
+     * On each call to ENABLE, all collected statistics must be reset.
+     *
+     * Sample data can be queried via getDisplayedContentSample().
+     *
+     * @param display        is the display to which the sampling mode is set.
+     * @param enabled        indicates whether to enable or disable sampling.
+     * @param componentMask  The mask of which components should be sampled. If zero, all supported
+     *                       components are to be enabled.
+     * @param maxFrames      is the maximum number of frames that should be stored before discard.
+     *                       The sample represents the most-recently posted frames.
+     * @return error      is NONE upon success. Otherwise,
+     *                    BAD_DISPLAY when an invalid display handle was passed in,
+     *                    BAD_PARAMETER when enabled was an invalid value, or
+     *                    NO_RESOURCES when the requested ringbuffer size via maxFrames was
+     *                                 not available.
+     *                    UNSUPPORTED when there is no efficient way to sample.
+     */
+    setDisplayedContentSamplingEnabled(
+        Display display, DisplayedContentSampling enable,
+        bitfield<FormatColorComponent> componentMask, uint64_t maxFrames)
+        generates (Error error);
+
+    /**
+     * Collects the results of display content color sampling for display.
+     *
+     * Collection of data can occur whether the sampling is in ENABLE or
+     * DISABLE state.
+     *
+     * @param  display     is the display to which the sampling is collected.
+     * @param  maxFrames   is the maximum number of frames that should be represented in the sample.
+     *                     The sample represents the most-recently posted frames.
+     *                     If maxFrames is 0, all frames are to be represented by the sample.
+     * @param  timestamp   is the timestamp after which any frames were posted that should be
+     *                     included in the sample. Timestamp is CLOCK_MONOTONIC.
+     *                     If timestamp is 0, do not filter from the sample by time.
+     * @return error       is NONE upon success. Otherwise,
+     *                     BAD_DISPLAY   when an invalid display was passed in, or
+     *                     UNSUPPORTED   when there is no efficient way to sample, or
+     *                     BAD_PARAMETER when the component is not supported by the hardware.
+     * @return frameCount  The number of frames represented by this sample.
+     * @return sampleComponent0 is a histogram counting how many times a pixel of a given value
+     *                     was displayed onscreen for FORMAT_COMPONENT_0.
+     *                     The buckets of the histogram are evenly weighted, the number of buckets
+     *                     is device specific.
+     *                     eg, for RGBA_8888, if sampleComponent0 is {10, 6, 4, 1} this means that
+     *                     10 red pixels were displayed onscreen in range 0x00->0x3F, 6 red pixels
+     *                     were displayed onscreen in range 0x40->0x7F, etc.
+     * @return sampleComponent1 is the same sample definition as sampleComponent0,
+     *                     but for FORMAT_COMPONENT_1.
+     * @return sampleComponent2 is the same sample definition as sampleComponent0,
+     *                     but for FORMAT_COMPONENT_2.
+     * @return sampleComponent3 is the same sample definition as sampleComponent0,
+     *                     but for FORMAT_COMPONENT_3.
+     */
+    getDisplayedContentSample(Display display, uint64_t maxFrames, uint64_t timestamp)
+               generates (Error error,
+                          uint64_t frameCount,
+                          vec<uint64_t> sampleComponent0,
+                          vec<uint64_t> sampleComponent1,
+                          vec<uint64_t> sampleComponent2,
+                          vec<uint64_t> sampleComponent3);
+
+    /**
+     * Executes commands from the input command message queue. Return values
+     * generated by the input commands are written to the output command
+     * message queue in the form of value commands.
+     *
+     * @param inLength is the length of input commands.
+     * @param inHandles is an array of handles referenced by the input
+     *        commands.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_PARAMETER when inLength is not equal to the length of
+     *                       commands in the input command message queue.
+     *         NO_RESOURCES when the output command message queue was not
+     *                      properly drained.
+     * @param outQueueChanged indicates whether the output command message
+     *        queue has changed.
+     * @param outLength is the length of output commands.
+     * @param outHandles is an array of handles referenced by the output
+     *        commands.
+     */
+    executeCommands_2_3(uint32_t inLength,
+                        vec<handle> inHandles)
+             generates (Error error,
+                        bool outQueueChanged,
+                        uint32_t outLength,
+                        vec<handle> outHandles);
+
+    /**
+     * Returns the render intents supported by the specified display and color
+     * mode.
+     *
+     * For SDR color modes, RenderIntent::COLORIMETRIC must be supported. For
+     * HDR color modes, RenderIntent::TONE_MAP_COLORIMETRIC must be supported.
+     *
+     * @param display is the display to query.
+     * @param mode is the color mode to query.
+     * @return error is NONE upon success. Otherwise,
+     *     BAD_DISPLAY when an invalid display handle was passed in.
+     *     BAD_PARAMETER when an invalid color mode was passed in.
+     * @return intents is an array of render intents.
+     */
+    getRenderIntents_2_3(Display display, ColorMode mode)
+          generates (Error error,
+                     vec<RenderIntent> intents);
+
+    /**
+     * Returns the color modes supported on this display.
+     *
+     * All devices must support at least ColorMode::NATIVE.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *     BAD_DISPLAY when an invalid display handle was passed in.
+     * @return modes is an array of color modes.
+     */
+    getColorModes_2_3(Display display)
+           generates (Error error,
+                      vec<ColorMode> modes);
+
+    /**
+     * Sets the color mode and render intent of the given display.
+     *
+     * The color mode and render intent change must take effect on next
+     * presentDisplay.
+     *
+     * All devices must support at least ColorMode::NATIVE and
+     * RenderIntent::COLORIMETRIC, and displays are assumed to be in this mode
+     * upon hotplug.
+     *
+     * @param display is the display to which the color mode is set.
+     * @param mode is the color mode to set to.
+     * @param intent is the render intent to set to.
+     * @return error is NONE upon success. Otherwise,
+     *     BAD_DISPLAY when an invalid display handle was passed in.
+     *     BAD_PARAMETER when mode or intent is invalid
+     *     UNSUPPORTED when mode or intent is not supported on this
+     *         display.
+     */
+    setColorMode_2_3(Display display, ColorMode mode, RenderIntent intent)
+          generates (Error error);
+};
diff --git a/graphics/composer/2.3/default/Android.bp b/graphics/composer/2.3/default/Android.bp
new file mode 100644
index 0000000..ad49ec3
--- /dev/null
+++ b/graphics/composer/2.3/default/Android.bp
@@ -0,0 +1,45 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_binary {
+    name: "android.hardware.graphics.composer@2.3-service",
+    defaults: ["hidl_defaults"],
+    vendor: true,
+    relative_install_path: "hw",
+    srcs: ["service.cpp"],
+    init_rc: ["android.hardware.graphics.composer@2.3-service.rc"],
+    header_libs: [
+        "android.hardware.graphics.composer@2.3-passthrough",
+    ],
+    shared_libs: [
+        "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.composer@2.2",
+        "android.hardware.graphics.composer@2.3",
+        "android.hardware.graphics.mapper@2.0",
+        "libbase",
+        "libbinder",
+        "libcutils",
+        "libfmq",
+        "libhardware",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwc2on1adapter",
+        "libhwc2onfbadapter",
+        "liblog",
+        "libsync",
+        "libutils",
+    ],
+}
diff --git a/graphics/composer/2.3/default/OWNERS b/graphics/composer/2.3/default/OWNERS
new file mode 100644
index 0000000..3aa5fa1
--- /dev/null
+++ b/graphics/composer/2.3/default/OWNERS
@@ -0,0 +1,4 @@
+# Graphics team
+jessehall@google.com
+olv@google.com
+stoza@google.com
diff --git a/graphics/composer/2.3/default/android.hardware.graphics.composer@2.3-service.rc b/graphics/composer/2.3/default/android.hardware.graphics.composer@2.3-service.rc
new file mode 100644
index 0000000..08e32d8
--- /dev/null
+++ b/graphics/composer/2.3/default/android.hardware.graphics.composer@2.3-service.rc
@@ -0,0 +1,6 @@
+service vendor.hwcomposer-2-3 /vendor/bin/hw/android.hardware.graphics.composer@2.3-service
+    class hal animation
+    user system
+    group graphics drmrpc
+    capabilities SYS_NICE
+    onrestart restart surfaceflinger
diff --git a/graphics/composer/2.3/default/service.cpp b/graphics/composer/2.3/default/service.cpp
new file mode 100644
index 0000000..347d8be
--- /dev/null
+++ b/graphics/composer/2.3/default/service.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <sched.h>
+
+#include <android/hardware/graphics/composer/2.3/IComposer.h>
+#include <binder/ProcessState.h>
+#include <composer-passthrough/2.3/HwcLoader.h>
+#include <hidl/HidlTransportSupport.h>
+
+using android::hardware::graphics::composer::V2_3::IComposer;
+using android::hardware::graphics::composer::V2_3::passthrough::HwcLoader;
+
+int main() {
+    // the conventional HAL might start binder services
+    android::ProcessState::initWithDriver("/dev/vndbinder");
+    android::ProcessState::self()->setThreadPoolMaxThreadCount(4);
+    android::ProcessState::self()->startThreadPool();
+
+    // same as SF main thread
+    struct sched_param param = {0};
+    param.sched_priority = 2;
+    if (sched_setscheduler(0, SCHED_FIFO | SCHED_RESET_ON_FORK, &param) != 0) {
+        ALOGE("Couldn't set SCHED_FIFO: %d", errno);
+    }
+
+    android::hardware::configureRpcThreadpool(4, true /* will join */);
+
+    android::sp<IComposer> composer = HwcLoader::load();
+    if (composer == nullptr) {
+        return 1;
+    }
+    if (composer->registerAsService() != android::NO_ERROR) {
+        ALOGE("failed to register service");
+        return 1;
+    }
+
+    android::hardware::joinRpcThreadpool();
+
+    ALOGE("service is terminating");
+    return 1;
+}
diff --git a/graphics/composer/2.3/utils/OWNERS b/graphics/composer/2.3/utils/OWNERS
new file mode 100644
index 0000000..234bc75
--- /dev/null
+++ b/graphics/composer/2.3/utils/OWNERS
@@ -0,0 +1,7 @@
+# Graphics team
+olv@google.com
+stoza@google.com
+
+# VTS team
+yim@google.com
+zhuoyao@google.com
diff --git a/graphics/composer/2.3/utils/command-buffer/Android.bp b/graphics/composer/2.3/utils/command-buffer/Android.bp
new file mode 100644
index 0000000..c48fe7a
--- /dev/null
+++ b/graphics/composer/2.3/utils/command-buffer/Android.bp
@@ -0,0 +1,15 @@
+cc_library_headers {
+    name: "android.hardware.graphics.composer@2.3-command-buffer",
+    defaults: ["hidl_defaults"],
+    vendor_available: true,
+    shared_libs: [
+        "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.composer@2.2",
+        "android.hardware.graphics.composer@2.3",
+    ],
+    header_libs: [
+        "android.hardware.graphics.composer@2.1-command-buffer",
+        "android.hardware.graphics.composer@2.2-command-buffer",
+    ],
+    export_include_dirs: ["include"],
+}
diff --git a/graphics/composer/2.3/utils/command-buffer/include/composer-command-buffer/2.3/ComposerCommandBuffer.h b/graphics/composer/2.3/utils/command-buffer/include/composer-command-buffer/2.3/ComposerCommandBuffer.h
new file mode 100644
index 0000000..6c95a1f
--- /dev/null
+++ b/graphics/composer/2.3/utils/command-buffer/include/composer-command-buffer/2.3/ComposerCommandBuffer.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#ifndef LOG_TAG
+#warn "ComposerCommandBuffer.h included without LOG_TAG"
+#endif
+
+#undef LOG_NDEBUG
+#define LOG_NDEBUG 0
+
+#include <android/hardware/graphics/composer/2.3/IComposer.h>
+#include <android/hardware/graphics/composer/2.3/IComposerClient.h>
+#include <composer-command-buffer/2.2/ComposerCommandBuffer.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+
+using android::hardware::MessageQueue;
+using android::hardware::graphics::common::V1_2::Dataspace;
+using android::hardware::graphics::composer::V2_1::Error;
+using android::hardware::graphics::composer::V2_1::IComposerCallback;
+using android::hardware::graphics::composer::V2_1::Layer;
+using android::hardware::graphics::composer::V2_3::IComposerClient;
+
+// This class helps build a command queue.  Note that all sizes/lengths are in
+// units of uint32_t's.
+class CommandWriterBase : public V2_2::CommandWriterBase {
+   public:
+    void setLayerDataspace(Dataspace dataspace) {
+        setLayerDataspaceInternal(static_cast<int32_t>(dataspace));
+    }
+
+    void setClientTarget(uint32_t slot, const native_handle_t* target, int acquireFence,
+                         Dataspace dataspace, const std::vector<IComposerClient::Rect>& damage) {
+        setClientTargetInternal(slot, target, acquireFence, static_cast<int32_t>(dataspace),
+                                damage);
+    }
+
+    CommandWriterBase(uint32_t initialMaxSize) : V2_2::CommandWriterBase(initialMaxSize) {}
+
+    static constexpr uint16_t kSetLayerColorTransformLength = 16;
+    void setLayerColorTransform(const float* matrix) {
+        beginCommand_2_3(IComposerClient::Command::SET_LAYER_COLOR_TRANSFORM,
+                         kSetLayerColorTransformLength);
+        for (int i = 0; i < 16; i++) {
+            writeFloat(matrix[i]);
+        }
+        endCommand();
+    }
+
+   protected:
+    void beginCommand_2_3(IComposerClient::Command command, uint16_t length) {
+        V2_2::CommandWriterBase::beginCommand_2_2(
+            static_cast<V2_2::IComposerClient::Command>(static_cast<int32_t>(command)), length);
+    }
+};
+
+// This class helps parse a command queue.  Note that all sizes/lengths are in
+// units of uint32_t's.
+class CommandReaderBase : public V2_2::CommandReaderBase {
+   public:
+    CommandReaderBase() : V2_2::CommandReaderBase(){};
+};
+
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/hal/Android.bp b/graphics/composer/2.3/utils/hal/Android.bp
new file mode 100644
index 0000000..3ee9300
--- /dev/null
+++ b/graphics/composer/2.3/utils/hal/Android.bp
@@ -0,0 +1,36 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_library_headers {
+    name: "android.hardware.graphics.composer@2.3-hal",
+    defaults: ["hidl_defaults"],
+    vendor_available: true,
+    shared_libs: [
+        "android.hardware.graphics.composer@2.3",
+    ],
+    export_shared_lib_headers: [
+        "android.hardware.graphics.composer@2.3",
+    ],
+    header_libs: [
+        "android.hardware.graphics.composer@2.2-hal",
+        "android.hardware.graphics.composer@2.3-command-buffer",
+    ],
+    export_header_lib_headers: [
+        "android.hardware.graphics.composer@2.2-hal",
+        "android.hardware.graphics.composer@2.3-command-buffer",
+    ],
+    export_include_dirs: ["include"],
+}
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/Composer.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/Composer.h
new file mode 100644
index 0000000..8e11a5a
--- /dev/null
+++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/Composer.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#ifndef LOG_TAG
+#warning "Composer.h included without LOG_TAG"
+#endif
+
+#include <android/hardware/graphics/composer/2.3/IComposer.h>
+#include <composer-hal/2.2/Composer.h>
+#include <composer-hal/2.3/ComposerClient.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace hal {
+
+namespace detail {
+
+// ComposerImpl implements V2_*::IComposer on top of V2_*::ComposerHal
+template <typename Interface, typename Hal>
+class ComposerImpl : public V2_2::hal::detail::ComposerImpl<Interface, Hal> {
+   public:
+    static std::unique_ptr<ComposerImpl> create(std::unique_ptr<Hal> hal) {
+        return std::make_unique<ComposerImpl>(std::move(hal));
+    }
+
+    explicit ComposerImpl(std::unique_ptr<Hal> hal) : BaseType2_2(std::move(hal)) {}
+
+    // IComposer 2.3 interface
+
+    Return<void> createClient_2_3(IComposer::createClient_2_3_cb hidl_cb) override {
+        std::unique_lock<std::mutex> lock(mClientMutex);
+        if (!waitForClientDestroyedLocked(lock)) {
+            hidl_cb(Error::NO_RESOURCES, nullptr);
+            return Void();
+        }
+
+        sp<ComposerClient> client = ComposerClient::create(mHal.get()).release();
+        if (!client) {
+            hidl_cb(Error::NO_RESOURCES, nullptr);
+            return Void();
+        }
+
+        auto clientDestroyed = [this]() { onClientDestroyed(); };
+        client->setOnClientDestroyed(clientDestroyed);
+
+        mClient = client;
+        hidl_cb(Error::NONE, client);
+        return Void();
+    }
+
+   private:
+    using BaseType2_2 = V2_2::hal::detail::ComposerImpl<Interface, Hal>;
+    using BaseType2_1 = V2_1::hal::detail::ComposerImpl<Interface, Hal>;
+
+    using BaseType2_1::mClient;
+    using BaseType2_1::mClientMutex;
+    using BaseType2_1::mHal;
+    using BaseType2_1::onClientDestroyed;
+    using BaseType2_1::waitForClientDestroyedLocked;
+};
+
+}  // namespace detail
+
+using Composer = detail::ComposerImpl<IComposer, ComposerHal>;
+
+}  // namespace hal
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerClient.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerClient.h
new file mode 100644
index 0000000..be0ef4c
--- /dev/null
+++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerClient.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#ifndef LOG_TAG
+#warning "ComposerClient.h included without LOG_TAG"
+#endif
+
+#include <android/hardware/graphics/composer/2.3/IComposerClient.h>
+#include <composer-hal/2.3/ComposerClient.h>
+#include <composer-hal/2.3/ComposerCommandEngine.h>
+#include <composer-hal/2.3/ComposerHal.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace hal {
+
+namespace detail {
+
+// ComposerClientImpl implements V2_*::IComposerClient on top of V2_*::ComposerHal
+template <typename Interface, typename Hal>
+class ComposerClientImpl : public V2_2::hal::detail::ComposerClientImpl<Interface, Hal> {
+   public:
+    Return<Error> setColorMode_2_3(Display display, ColorMode mode, RenderIntent intent) override {
+        return mHal->setColorMode_2_3(display, mode, intent);
+    }
+
+    Return<void> getRenderIntents_2_3(Display display, ColorMode mode,
+                                      IComposerClient::getRenderIntents_2_3_cb hidl_cb) override {
+        std::vector<RenderIntent> intents;
+        Error err = mHal->getRenderIntents_2_3(display, mode, &intents);
+        hidl_cb(err, intents);
+        return Void();
+    }
+
+    Return<void> getColorModes_2_3(Display display,
+                                   IComposerClient::getColorModes_2_3_cb hidl_cb) override {
+        hidl_vec<ColorMode> modes;
+        Error err = mHal->getColorModes_2_3(display, &modes);
+        hidl_cb(err, modes);
+        return Void();
+    }
+
+    Return<void> getReadbackBufferAttributes_2_3(
+        Display display, IComposerClient::getReadbackBufferAttributes_2_3_cb hidl_cb) override {
+        PixelFormat format = PixelFormat::RGB_888;
+        Dataspace dataspace = Dataspace::UNKNOWN;
+        Error error = mHal->getReadbackBufferAttributes_2_3(display, &format, &dataspace);
+        hidl_cb(error, format, dataspace);
+        return Void();
+    }
+
+    Return<Error> getClientTargetSupport_2_3(Display display, uint32_t width, uint32_t height,
+                                             PixelFormat format, Dataspace dataspace) override {
+        Error err = mHal->getClientTargetSupport_2_3(display, width, height, format, dataspace);
+        return err;
+    }
+
+    static std::unique_ptr<ComposerClientImpl> create(Hal* hal) {
+        auto client = std::make_unique<ComposerClientImpl>(hal);
+        return client->init() ? std::move(client) : nullptr;
+    }
+
+    ComposerClientImpl(Hal* hal) : BaseType2_2(hal) {}
+
+    // IComposerClient 2.3 interface
+
+    Return<void> getDisplayIdentificationData(
+        Display display, IComposerClient::getDisplayIdentificationData_cb hidl_cb) override {
+        uint8_t port = 0;
+        std::vector<uint8_t> data;
+        Error error = mHal->getDisplayIdentificationData(display, &port, &data);
+        hidl_cb(error, port, data);
+        return Void();
+    }
+
+    Return<void> getDisplayedContentSamplingAttributes(
+        uint64_t display,
+        IComposerClient::getDisplayedContentSamplingAttributes_cb hidl_cb) override {
+        common::V1_1::PixelFormat format;
+        common::V1_2::Dataspace dataspace;
+        hidl_bitfield<IComposerClient::FormatColorComponent> componentMask;
+        Error error =
+            mHal->getDisplayedContentSamplingAttributes(display, format, dataspace, componentMask);
+        hidl_cb(error, format, dataspace, componentMask);
+        return Void();
+    }
+
+    Return<Error> setDisplayedContentSamplingEnabled(
+        uint64_t display, IComposerClient::DisplayedContentSampling enable,
+        hidl_bitfield<IComposerClient::FormatColorComponent> componentMask,
+        uint64_t maxFrames) override {
+        return mHal->setDisplayedContentSamplingEnabled(display, enable, componentMask, maxFrames);
+    }
+
+    Return<void> getDisplayedContentSample(
+        uint64_t display, uint64_t maxFrames, uint64_t timestamp,
+        IComposerClient::getDisplayedContentSample_cb hidl_cb) override {
+        uint64_t frameCount;
+        hidl_vec<uint64_t> sampleComponent0;
+        hidl_vec<uint64_t> sampleComponent1;
+        hidl_vec<uint64_t> sampleComponent2;
+        hidl_vec<uint64_t> sampleComponent3;
+
+        Error error = mHal->getDisplayedContentSample(display, maxFrames, timestamp, frameCount,
+                                                      sampleComponent0, sampleComponent1,
+                                                      sampleComponent2, sampleComponent3);
+        hidl_cb(error, frameCount, sampleComponent0, sampleComponent1, sampleComponent2,
+                sampleComponent3);
+        return Void();
+    }
+
+    Return<void> executeCommands_2_3(uint32_t inLength, const hidl_vec<hidl_handle>& inHandles,
+                                     IComposerClient::executeCommands_2_2_cb hidl_cb) override {
+        std::lock_guard<std::mutex> lock(mCommandEngineMutex);
+        bool outChanged = false;
+        uint32_t outLength = 0;
+        hidl_vec<hidl_handle> outHandles;
+        Error error =
+            mCommandEngine->execute(inLength, inHandles, &outChanged, &outLength, &outHandles);
+
+        hidl_cb(error, outChanged, outLength, outHandles);
+
+        mCommandEngine->reset();
+
+        return Void();
+    }
+
+   private:
+    using BaseType2_2 = V2_2::hal::detail::ComposerClientImpl<Interface, Hal>;
+    using BaseType2_1 = V2_1::hal::detail::ComposerClientImpl<Interface, Hal>;
+    using BaseType2_1::mCommandEngine;
+    using BaseType2_1::mCommandEngineMutex;
+    using BaseType2_1::mHal;
+};
+
+}  // namespace detail
+
+using ComposerClient = detail::ComposerClientImpl<IComposerClient, ComposerHal>;
+
+}  // namespace hal
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
new file mode 100644
index 0000000..c3dcbcd
--- /dev/null
+++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#ifndef LOG_TAG
+#warning "ComposerCommandEngine.h included without LOG_TAG"
+#endif
+
+#include <composer-command-buffer/2.3/ComposerCommandBuffer.h>
+#include <composer-hal/2.1/ComposerCommandEngine.h>
+#include <composer-hal/2.2/ComposerCommandEngine.h>
+#include <composer-hal/2.2/ComposerResources.h>
+#include <composer-hal/2.3/ComposerHal.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace hal {
+
+class ComposerCommandEngine : public V2_2::hal::ComposerCommandEngine {
+   public:
+    ComposerCommandEngine(ComposerHal* hal, V2_2::hal::ComposerResources* resources)
+        : BaseType2_2(hal, resources), mHal(hal) {}
+
+   protected:
+    bool executeCommand(V2_1::IComposerClient::Command command, uint16_t length) override {
+        switch (static_cast<IComposerClient::Command>(command)) {
+            case IComposerClient::Command::SET_LAYER_COLOR_TRANSFORM:
+                return executeSetLayerColorTransform(length);
+            default:
+                return BaseType2_2::executeCommand(command, length);
+        }
+    }
+
+    bool executeSetLayerColorTransform(uint16_t length) {
+        if (length != CommandWriterBase::kSetLayerColorTransformLength) {
+            return false;
+        }
+
+        float matrix[16];
+        for (int i = 0; i < 16; i++) {
+            matrix[i] = readFloat();
+        }
+        auto err = mHal->setLayerColorTransform(mCurrentDisplay, mCurrentLayer, matrix);
+        if (err != Error::NONE) {
+            mWriter.setError(getCommandLoc(), err);
+        }
+
+        return true;
+    }
+
+   private:
+    using BaseType2_1 = V2_1::hal::ComposerCommandEngine;
+    using BaseType2_1::mWriter;
+    using BaseType2_2 = V2_2::hal::ComposerCommandEngine;
+
+    ComposerHal* mHal;
+};
+
+}  // namespace hal
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerHal.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerHal.h
new file mode 100644
index 0000000..8ca5d75
--- /dev/null
+++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerHal.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <composer-hal/2.2/ComposerHal.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace hal {
+
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
+using common::V1_2::ColorMode;
+using common::V1_2::Dataspace;
+using V2_1::Display;
+using V2_1::Error;
+using V2_1::Layer;
+
+class ComposerHal : public V2_2::hal::ComposerHal {
+   public:
+    Error setColorMode_2_2(Display display, common::V1_1::ColorMode mode,
+                           RenderIntent intent) override {
+        return setColorMode_2_3(display, static_cast<ColorMode>(mode), intent);
+    }
+
+    Error getColorModes_2_2(Display display, hidl_vec<common::V1_1::ColorMode>* outModes) override {
+        return getColorModes_2_3(display, reinterpret_cast<hidl_vec<ColorMode>*>(outModes));
+    }
+
+    Error getClientTargetSupport_2_2(Display display, uint32_t width, uint32_t height,
+                                     common::V1_1::PixelFormat format,
+                                     common::V1_1::Dataspace dataspace) override {
+        return getClientTargetSupport_2_3(display, width, height, static_cast<PixelFormat>(format),
+                                          static_cast<Dataspace>(dataspace));
+    }
+
+    Error getReadbackBufferAttributes(Display display, common::V1_1::PixelFormat* outFormat,
+                                      common::V1_1::Dataspace* outDataspace) override {
+        return getReadbackBufferAttributes_2_3(display, reinterpret_cast<PixelFormat*>(outFormat),
+                                               reinterpret_cast<Dataspace*>(outDataspace));
+    }
+
+    virtual Error setColorMode_2_3(Display display, ColorMode mode, RenderIntent intent) = 0;
+
+    virtual Error getRenderIntents_2_3(Display display, ColorMode mode,
+                                       std::vector<RenderIntent>* outIntents) = 0;
+
+    virtual Error getColorModes_2_3(Display display, hidl_vec<ColorMode>* outModes) = 0;
+
+    virtual Error getClientTargetSupport_2_3(Display display, uint32_t width, uint32_t height,
+                                             PixelFormat format, Dataspace dataspace) = 0;
+    virtual Error getReadbackBufferAttributes_2_3(Display display, PixelFormat* outFormat,
+                                                  Dataspace* outDataspace) = 0;
+
+    virtual Error getDisplayIdentificationData(Display display, uint8_t* outPort,
+                                               std::vector<uint8_t>* outData) = 0;
+    virtual Error setLayerColorTransform(Display display, Layer layer, const float* matrix) = 0;
+    virtual Error getDisplayedContentSamplingAttributes(
+        uint64_t display, PixelFormat& format, Dataspace& dataspace,
+        hidl_bitfield<IComposerClient::FormatColorComponent>& componentMask) = 0;
+    virtual Error setDisplayedContentSamplingEnabled(
+        uint64_t display, IComposerClient::DisplayedContentSampling enable,
+        hidl_bitfield<IComposerClient::FormatColorComponent> componentMask, uint64_t maxFrames) = 0;
+    virtual Error getDisplayedContentSample(uint64_t display, uint64_t maxFrames,
+                                            uint64_t timestamp, uint64_t& frameCount,
+                                            hidl_vec<uint64_t>& sampleComponent0,
+                                            hidl_vec<uint64_t>& sampleComponent1,
+                                            hidl_vec<uint64_t>& sampleComponent2,
+                                            hidl_vec<uint64_t>& sampleComponent3) = 0;
+};
+
+}  // namespace hal
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/passthrough/Android.bp b/graphics/composer/2.3/utils/passthrough/Android.bp
new file mode 100644
index 0000000..3ae6b16
--- /dev/null
+++ b/graphics/composer/2.3/utils/passthrough/Android.bp
@@ -0,0 +1,30 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_library_headers {
+    name: "android.hardware.graphics.composer@2.3-passthrough",
+    defaults: ["hidl_defaults"],
+    vendor: true,
+    header_libs: [
+        "android.hardware.graphics.composer@2.2-passthrough",
+        "android.hardware.graphics.composer@2.3-hal",
+    ],
+    export_header_lib_headers: [
+        "android.hardware.graphics.composer@2.2-passthrough",
+        "android.hardware.graphics.composer@2.3-hal",
+    ],
+    export_include_dirs: ["include"],
+}
diff --git a/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcHal.h b/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcHal.h
new file mode 100644
index 0000000..8d444c8
--- /dev/null
+++ b/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcHal.h
@@ -0,0 +1,213 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#ifndef LOG_TAG
+#warning "HwcHal.h included without LOG_TAG"
+#endif
+
+#include <type_traits>
+
+#include <composer-hal/2.3/ComposerHal.h>
+#include <composer-passthrough/2.2/HwcHal.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace passthrough {
+
+namespace detail {
+
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
+using common::V1_2::ColorMode;
+using common::V1_2::Dataspace;
+using V2_1::Display;
+using V2_1::Error;
+
+// HwcHalImpl implements V2_*::hal::ComposerHal on top of hwcomposer2
+template <typename Hal>
+class HwcHalImpl : public V2_2::passthrough::detail::HwcHalImpl<Hal> {
+   public:
+    Error setColorMode_2_3(Display display, ColorMode mode, RenderIntent intent) override {
+        return setColorMode_2_2(display, static_cast<common::V1_1::ColorMode>(mode), intent);
+    }
+
+    Error getRenderIntents_2_3(Display display, ColorMode mode,
+                               std::vector<RenderIntent>* outIntents) override {
+        return getRenderIntents(display, static_cast<common::V1_1::ColorMode>(mode), outIntents);
+    }
+
+    Error getColorModes_2_3(Display display, hidl_vec<ColorMode>* outModes) override {
+        return getColorModes_2_2(display,
+                                 reinterpret_cast<hidl_vec<common::V1_1::ColorMode>*>(outModes));
+    }
+
+    Error getClientTargetSupport_2_3(Display display, uint32_t width, uint32_t height,
+                                     PixelFormat format, Dataspace dataspace) override {
+        return getClientTargetSupport_2_2(display, width, height, format,
+                                          static_cast<common::V1_1::Dataspace>(dataspace));
+    }
+
+    Error getReadbackBufferAttributes_2_3(Display display, PixelFormat* outFormat,
+                                          Dataspace* outDataspace) override {
+        return getReadbackBufferAttributes(
+            display, outFormat, reinterpret_cast<common::V1_1::Dataspace*>(outDataspace));
+    }
+
+    Error getDisplayIdentificationData(Display display, uint8_t* outPort,
+                                       std::vector<uint8_t>* outData) override {
+        if (!mDispatch.getDisplayIdentificationData) {
+            return Error::UNSUPPORTED;
+        }
+
+        uint32_t size = 0;
+        int32_t error =
+            mDispatch.getDisplayIdentificationData(mDevice, display, outPort, &size, nullptr);
+        if (error != HWC2_ERROR_NONE) {
+            return static_cast<Error>(error);
+        }
+
+        std::vector<uint8_t> data(size);
+        error =
+            mDispatch.getDisplayIdentificationData(mDevice, display, outPort, &size, data.data());
+        if (error != HWC2_ERROR_NONE) {
+            return static_cast<Error>(error);
+        }
+
+        data.resize(size);
+        *outData = std::move(data);
+        return Error::NONE;
+    }
+
+    Error setLayerColorTransform(Display display, Layer layer, const float* matrix) override {
+        if (!mDispatch.setLayerColorTransform) {
+            return Error::UNSUPPORTED;
+        }
+        int32_t err = mDispatch.setLayerColorTransform(mDevice, display, layer, matrix);
+        return static_cast<Error>(err);
+    }
+
+    Error getDisplayedContentSamplingAttributes(
+        uint64_t display, PixelFormat& format, Dataspace& dataspace,
+        hidl_bitfield<IComposerClient::FormatColorComponent>& componentMask) override {
+        if (!mDispatch.getDisplayedContentSamplingAttributes) {
+            return Error::UNSUPPORTED;
+        }
+        int32_t formatRaw = 0;
+        int32_t dataspaceRaw = 0;
+        uint8_t componentMaskRaw = 0;
+        int32_t errorRaw = mDispatch.getDisplayedContentSamplingAttributes(
+            mDevice, display, &formatRaw, &dataspaceRaw, &componentMaskRaw);
+        auto error = static_cast<Error>(errorRaw);
+        if (error == Error::NONE) {
+            format = static_cast<PixelFormat>(formatRaw);
+            dataspace = static_cast<Dataspace>(dataspaceRaw);
+            componentMask =
+                static_cast<hidl_bitfield<IComposerClient::FormatColorComponent>>(componentMaskRaw);
+        }
+        return error;
+    };
+
+    Error setDisplayedContentSamplingEnabled(
+        uint64_t display, IComposerClient::DisplayedContentSampling enable,
+        hidl_bitfield<IComposerClient::FormatColorComponent> componentMask,
+        uint64_t maxFrames) override {
+        if (!mDispatch.setDisplayedContentSamplingEnabled) {
+            return Error::UNSUPPORTED;
+        }
+        return static_cast<Error>(mDispatch.setDisplayedContentSamplingEnabled(
+            mDevice, display, static_cast<int32_t>(enable), componentMask, maxFrames));
+    }
+
+    Error getDisplayedContentSample(uint64_t display, uint64_t maxFrames, uint64_t timestamp,
+                                    uint64_t& frameCount, hidl_vec<uint64_t>& sampleComponent0,
+                                    hidl_vec<uint64_t>& sampleComponent1,
+                                    hidl_vec<uint64_t>& sampleComponent2,
+                                    hidl_vec<uint64_t>& sampleComponent3) override {
+        if (!mDispatch.getDisplayedContentSample) {
+            return Error::UNSUPPORTED;
+        }
+
+        int32_t size[4] = {0};
+        auto errorRaw = mDispatch.getDisplayedContentSample(mDevice, display, maxFrames, timestamp,
+                                                            &frameCount, size, nullptr);
+        if (errorRaw != HWC2_ERROR_NONE) {
+            return static_cast<Error>(errorRaw);
+        }
+
+        sampleComponent0.resize(size[0]);
+        sampleComponent1.resize(size[1]);
+        sampleComponent2.resize(size[2]);
+        sampleComponent3.resize(size[3]);
+        uint64_t* samples[] = {sampleComponent0.data(), sampleComponent1.data(),
+                               sampleComponent2.data(), sampleComponent3.data()};
+        errorRaw = mDispatch.getDisplayedContentSample(mDevice, display, maxFrames, timestamp,
+                                                       &frameCount, size, samples);
+        return static_cast<Error>(errorRaw);
+    }
+
+   protected:
+    bool initDispatch() override {
+        if (!BaseType2_2::initDispatch()) {
+            return false;
+        }
+
+        this->initOptionalDispatch(HWC2_FUNCTION_GET_DISPLAY_IDENTIFICATION_DATA,
+                                   &mDispatch.getDisplayIdentificationData);
+        this->initOptionalDispatch(HWC2_FUNCTION_SET_LAYER_COLOR_TRANSFORM,
+                                   &mDispatch.setLayerColorTransform);
+        this->initOptionalDispatch(HWC2_FUNCTION_GET_DISPLAYED_CONTENT_SAMPLING_ATTRIBUTES,
+                                   &mDispatch.getDisplayedContentSamplingAttributes);
+        this->initOptionalDispatch(HWC2_FUNCTION_SET_DISPLAYED_CONTENT_SAMPLING_ENABLED,
+                                   &mDispatch.setDisplayedContentSamplingEnabled);
+        this->initOptionalDispatch(HWC2_FUNCTION_GET_DISPLAYED_CONTENT_SAMPLE,
+                                   &mDispatch.getDisplayedContentSample);
+        return true;
+    }
+
+   private:
+    struct {
+        HWC2_PFN_GET_DISPLAY_IDENTIFICATION_DATA getDisplayIdentificationData;
+        HWC2_PFN_SET_LAYER_COLOR_TRANSFORM setLayerColorTransform;
+        HWC2_PFN_GET_DISPLAYED_CONTENT_SAMPLING_ATTRIBUTES getDisplayedContentSamplingAttributes;
+        HWC2_PFN_SET_DISPLAYED_CONTENT_SAMPLING_ENABLED setDisplayedContentSamplingEnabled;
+        HWC2_PFN_GET_DISPLAYED_CONTENT_SAMPLE getDisplayedContentSample;
+    } mDispatch = {};
+
+    using BaseType2_2 = V2_2::passthrough::detail::HwcHalImpl<Hal>;
+    using BaseType2_1 = V2_1::passthrough::detail::HwcHalImpl<Hal>;
+    using BaseType2_1::mDevice;
+    using BaseType2_2::getClientTargetSupport_2_2;
+    using BaseType2_2::getColorModes_2_2;
+    using BaseType2_2::getReadbackBufferAttributes;
+    using BaseType2_2::getRenderIntents;
+    using BaseType2_2::setColorMode_2_2;
+};
+
+}  // namespace detail
+
+using HwcHal = detail::HwcHalImpl<hal::ComposerHal>;
+
+}  // namespace passthrough
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcLoader.h b/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcLoader.h
new file mode 100644
index 0000000..afef475
--- /dev/null
+++ b/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcLoader.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#ifndef LOG_TAG
+#warning "HwcLoader.h included without LOG_TAG"
+#endif
+
+#include <composer-hal/2.3/Composer.h>
+#include <composer-hal/2.3/ComposerHal.h>
+#include <composer-passthrough/2.2/HwcLoader.h>
+#include <composer-passthrough/2.3/HwcHal.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace passthrough {
+
+class HwcLoader : public V2_2::passthrough::HwcLoader {
+   public:
+    static IComposer* load() {
+        const hw_module_t* module = loadModule();
+        if (!module) {
+            return nullptr;
+        }
+
+        auto hal = createHalWithAdapter(module);
+        if (!hal) {
+            return nullptr;
+        }
+
+        return createComposer(std::move(hal)).release();
+    }
+
+    // create a ComposerHal instance
+    static std::unique_ptr<hal::ComposerHal> createHal(const hw_module_t* module) {
+        auto hal = std::make_unique<HwcHal>();
+        return hal->initWithModule(module) ? std::move(hal) : nullptr;
+    }
+
+    // create a ComposerHal instance, insert an adapter if necessary
+    static std::unique_ptr<hal::ComposerHal> createHalWithAdapter(const hw_module_t* module) {
+        bool adapted;
+        hwc2_device_t* device = openDeviceWithAdapter(module, &adapted);
+        if (!device) {
+            return nullptr;
+        }
+        auto hal = std::make_unique<HwcHal>();
+        return hal->initWithDevice(std::move(device), !adapted) ? std::move(hal) : nullptr;
+    }
+
+    // create an IComposer instance
+    static std::unique_ptr<IComposer> createComposer(std::unique_ptr<hal::ComposerHal> hal) {
+        return hal::Composer::create(std::move(hal));
+    }
+};
+
+}  // namespace passthrough
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/vts/Android.bp b/graphics/composer/2.3/utils/vts/Android.bp
new file mode 100644
index 0000000..19438cb
--- /dev/null
+++ b/graphics/composer/2.3/utils/vts/Android.bp
@@ -0,0 +1,42 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_library_static {
+    name: "android.hardware.graphics.composer@2.3-vts",
+    defaults: ["hidl_defaults"],
+    srcs: [
+        "ComposerVts.cpp",
+    ],
+    static_libs: [
+        "VtsHalHidlTargetTestBase",
+        "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.composer@2.1-vts",
+        "android.hardware.graphics.composer@2.2",
+        "android.hardware.graphics.composer@2.2-vts",
+        "android.hardware.graphics.composer@2.3",
+    ],
+    header_libs: [
+        "android.hardware.graphics.composer@2.1-command-buffer",
+        "android.hardware.graphics.composer@2.2-command-buffer",
+        "android.hardware.graphics.composer@2.3-command-buffer",
+    ],
+    cflags: [
+        "-O0",
+        "-g",
+        "-DLOG_TAG=\"ComposerVts\"",
+    ],
+    export_include_dirs: ["include"],
+}
diff --git a/graphics/composer/2.3/utils/vts/ComposerVts.cpp b/graphics/composer/2.3/utils/vts/ComposerVts.cpp
new file mode 100644
index 0000000..9304992
--- /dev/null
+++ b/graphics/composer/2.3/utils/vts/ComposerVts.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <composer-vts/2.3/ComposerVts.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace vts {
+
+using V2_1::Error;
+
+Composer::Composer() : Composer(::testing::VtsHalHidlTargetTestBase::getService<IComposer>()) {}
+
+Composer::Composer(const std::string& name)
+    : Composer(::testing::VtsHalHidlTargetTestBase::getService<IComposer>(name)) {}
+
+Composer::Composer(const sp<IComposer>& composer)
+    : V2_2::vts::Composer(composer), mComposer(composer) {}
+
+std::unique_ptr<ComposerClient> Composer::createClient() {
+    std::unique_ptr<ComposerClient> client;
+    mComposer->createClient_2_3([&client](const auto& tmpError, const auto& tmpClient) {
+        ASSERT_EQ(Error::NONE, tmpError) << "failed to create client";
+        client = std::make_unique<ComposerClient>(tmpClient);
+    });
+
+    return client;
+}
+
+sp<IComposerClient> ComposerClient::getRaw() const {
+    return mClient;
+}
+
+bool ComposerClient::getDisplayIdentificationData(Display display, uint8_t* outPort,
+                                                  std::vector<uint8_t>* outData) {
+    bool supported = true;
+    mClient->getDisplayIdentificationData(
+        display, [&](const auto& tmpError, const auto& tmpPort, const auto& tmpData) {
+            if (tmpError == Error::UNSUPPORTED) {
+                supported = false;
+                return;
+            }
+            ASSERT_EQ(Error::NONE, tmpError) << "failed to get display identification data";
+
+            *outPort = tmpPort;
+            *outData = tmpData;
+            ASSERT_FALSE(outData->empty()) << "data is empty";
+        });
+
+    return supported;
+}
+
+std::vector<ColorMode> ComposerClient::getColorModes_2_3(Display display) {
+    std::vector<ColorMode> modes;
+    mClient->getColorModes_2_3(display, [&](const auto& tmpError, const auto& tmpModes) {
+        ASSERT_EQ(Error::NONE, tmpError) << "failed to get color modes";
+        modes = tmpModes;
+    });
+    return modes;
+}
+
+void ComposerClient::setColorMode_2_3(Display display, ColorMode mode, RenderIntent intent) {
+    Error error = mClient->setColorMode_2_3(display, mode, intent);
+    ASSERT_TRUE(error == Error::NONE || error == Error::UNSUPPORTED) << "failed to set color mode";
+}
+
+std::vector<RenderIntent> ComposerClient::getRenderIntents_2_3(Display display, ColorMode mode) {
+    std::vector<RenderIntent> intents;
+    mClient->getRenderIntents_2_3(display, mode, [&](const auto& tmpError, const auto& tmpIntents) {
+        ASSERT_EQ(Error::NONE, tmpError) << "failed to get render intents";
+        intents = tmpIntents;
+    });
+    return intents;
+}
+
+void ComposerClient::getReadbackBufferAttributes_2_3(Display display, PixelFormat* outPixelFormat,
+                                                     Dataspace* outDataspace) {
+    mClient->getReadbackBufferAttributes_2_3(
+        display,
+        [&](const auto& tmpError, const auto& tmpOutPixelFormat, const auto& tmpOutDataspace) {
+            ASSERT_EQ(Error::NONE, tmpError) << "failed to get readback buffer attributes";
+            *outPixelFormat = tmpOutPixelFormat;
+            *outDataspace = tmpOutDataspace;
+        });
+}
+
+bool ComposerClient::getClientTargetSupport_2_3(Display display, uint32_t width, uint32_t height,
+                                                PixelFormat format, Dataspace dataspace) {
+    Error error = mClient->getClientTargetSupport_2_3(display, width, height, format, dataspace);
+    return error == Error::NONE;
+}
+
+Error ComposerClient::getDisplayedContentSamplingAttributes(
+    uint64_t display, PixelFormat& format, Dataspace& dataspace,
+    hidl_bitfield<IComposerClient::FormatColorComponent>& componentMask) {
+    auto error = Error::BAD_PARAMETER;
+    mClient->getDisplayedContentSamplingAttributes(
+        display, [&](const auto& tmpError, const auto& tmpFormat, const auto& tmpDataspace,
+                     const auto& tmpComponentMask) {
+            error = tmpError;
+            format = tmpFormat;
+            dataspace = tmpDataspace;
+            componentMask = tmpComponentMask;
+        });
+    return error;
+}
+
+Error ComposerClient::setDisplayedContentSamplingEnabled(
+    uint64_t display, IComposerClient::DisplayedContentSampling enable,
+    hidl_bitfield<IComposerClient::FormatColorComponent> componentMask, uint64_t maxFrames) {
+    return mClient->setDisplayedContentSamplingEnabled(display, enable, componentMask, maxFrames);
+}
+
+Error ComposerClient::getDisplayedContentSample(uint64_t display, uint64_t maxFrames,
+                                                uint64_t timestamp, uint64_t& frameCount,
+                                                hidl_vec<uint64_t>& sampleComponent0,
+                                                hidl_vec<uint64_t>& sampleComponent1,
+                                                hidl_vec<uint64_t>& sampleComponent2,
+                                                hidl_vec<uint64_t>& sampleComponent3) {
+    auto error = Error::BAD_PARAMETER;
+    mClient->getDisplayedContentSample(
+        display, maxFrames, timestamp,
+        [&](const auto& tmpError, const auto& tmpFrameCount, const auto& tmpSamples0,
+            const auto& tmpSamples1, const auto& tmpSamples2, const auto& tmpSamples3) {
+            error = tmpError;
+            frameCount = tmpFrameCount;
+            sampleComponent0 = tmpSamples0;
+            sampleComponent1 = tmpSamples1;
+            sampleComponent2 = tmpSamples2;
+            sampleComponent3 = tmpSamples3;
+        });
+    return error;
+}
+
+}  // namespace vts
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/utils/vts/include/composer-vts/2.3/ComposerVts.h b/graphics/composer/2.3/utils/vts/include/composer-vts/2.3/ComposerVts.h
new file mode 100644
index 0000000..4b9c955
--- /dev/null
+++ b/graphics/composer/2.3/utils/vts/include/composer-vts/2.3/ComposerVts.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+#include <vector>
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <android/hardware/graphics/composer/2.3/IComposer.h>
+#include <android/hardware/graphics/composer/2.3/IComposerClient.h>
+#include <composer-vts/2.2/ComposerVts.h>
+#include <utils/StrongPointer.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace vts {
+
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
+using common::V1_2::ColorMode;
+using common::V1_2::Dataspace;
+using V2_1::Display;
+using V2_1::Error;
+using V2_3::IComposer;
+using V2_3::IComposerClient;
+
+class ComposerClient;
+
+// A wrapper to IComposer.
+class Composer : public V2_2::vts::Composer {
+   public:
+    Composer();
+    explicit Composer(const std::string& name);
+
+    std::unique_ptr<ComposerClient> createClient();
+
+   protected:
+    explicit Composer(const sp<IComposer>& composer);
+
+   private:
+    const sp<IComposer> mComposer;
+};
+
+// A wrapper to IComposerClient.
+class ComposerClient : public V2_2::vts::ComposerClient {
+   public:
+    explicit ComposerClient(const sp<IComposerClient>& client)
+        : V2_2::vts::ComposerClient(client), mClient(client) {}
+
+    sp<IComposerClient> getRaw() const;
+
+    bool getDisplayIdentificationData(Display display, uint8_t* outPort,
+                                      std::vector<uint8_t>* outData);
+    Error getDisplayedContentSamplingAttributes(
+        uint64_t display, PixelFormat& format, Dataspace& dataspace,
+        hidl_bitfield<IComposerClient::FormatColorComponent>& componentMask);
+    Error setDisplayedContentSamplingEnabled(
+        uint64_t display, IComposerClient::DisplayedContentSampling enable,
+        hidl_bitfield<IComposerClient::FormatColorComponent> componentMask, uint64_t maxFrames);
+    Error getDisplayedContentSample(uint64_t display, uint64_t maxFrames, uint64_t timestamp,
+                                    uint64_t& frameCount, hidl_vec<uint64_t>& sampleComponent0,
+                                    hidl_vec<uint64_t>& sampleComponent1,
+                                    hidl_vec<uint64_t>& sampleComponent2,
+                                    hidl_vec<uint64_t>& sampleComponent3);
+
+    std::vector<ColorMode> getColorModes_2_3(Display display);
+
+    void setColorMode_2_3(Display display, ColorMode mode, RenderIntent intent);
+
+    std::vector<RenderIntent> getRenderIntents_2_3(Display display, ColorMode mode);
+
+    void getReadbackBufferAttributes_2_3(Display display, PixelFormat* outPixelFormat,
+                                         Dataspace* outDataspace);
+
+    bool getClientTargetSupport_2_3(Display display, uint32_t width, uint32_t height,
+                                    PixelFormat format, Dataspace dataspace);
+
+   private:
+    const sp<IComposerClient> mClient;
+};
+
+}  // namespace vts
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
diff --git a/graphics/composer/2.3/vts/functional/Android.bp b/graphics/composer/2.3/vts/functional/Android.bp
new file mode 100644
index 0000000..7548cb5
--- /dev/null
+++ b/graphics/composer/2.3/vts/functional/Android.bp
@@ -0,0 +1,45 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalGraphicsComposerV2_3TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: ["VtsHalGraphicsComposerV2_3TargetTest.cpp"],
+
+    // TODO(b/64437680): Assume these libs are always available on the device.
+    shared_libs: [
+        "libfmq",
+        "libhidltransport",
+        "libsync",
+    ],
+    static_libs: [
+        "android.hardware.graphics.allocator@2.0",
+        "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.composer@2.1-vts",
+        "android.hardware.graphics.composer@2.2",
+        "android.hardware.graphics.composer@2.2-vts",
+        "android.hardware.graphics.composer@2.3",
+        "android.hardware.graphics.composer@2.3-vts",
+        "android.hardware.graphics.mapper@2.0",
+        "android.hardware.graphics.mapper@2.0-vts",
+        "android.hardware.graphics.mapper@2.1",
+    ],
+    header_libs: [
+        "android.hardware.graphics.composer@2.1-command-buffer",
+        "android.hardware.graphics.composer@2.2-command-buffer",
+        "android.hardware.graphics.composer@2.3-command-buffer",
+    ],
+}
diff --git a/graphics/composer/2.3/vts/functional/OWNERS b/graphics/composer/2.3/vts/functional/OWNERS
new file mode 100644
index 0000000..234bc75
--- /dev/null
+++ b/graphics/composer/2.3/vts/functional/OWNERS
@@ -0,0 +1,7 @@
+# Graphics team
+olv@google.com
+stoza@google.com
+
+# VTS team
+yim@google.com
+zhuoyao@google.com
diff --git a/graphics/composer/2.3/vts/functional/VtsHalGraphicsComposerV2_3TargetTest.cpp b/graphics/composer/2.3/vts/functional/VtsHalGraphicsComposerV2_3TargetTest.cpp
new file mode 100644
index 0000000..a294825
--- /dev/null
+++ b/graphics/composer/2.3/vts/functional/VtsHalGraphicsComposerV2_3TargetTest.cpp
@@ -0,0 +1,445 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "graphics_composer_hidl_hal_test@2.3"
+
+#include <algorithm>
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <android-base/logging.h>
+#include <composer-command-buffer/2.3/ComposerCommandBuffer.h>
+#include <composer-vts/2.1/GraphicsComposerCallback.h>
+#include <composer-vts/2.1/TestCommandReader.h>
+#include <composer-vts/2.3/ComposerVts.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_3 {
+namespace vts {
+namespace {
+
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
+using common::V1_2::ColorMode;
+using common::V1_2::Dataspace;
+
+// Test environment for graphics.composer
+class GraphicsComposerHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static GraphicsComposerHidlEnvironment* Instance() {
+        static GraphicsComposerHidlEnvironment* instance = new GraphicsComposerHidlEnvironment;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<IComposer>(); }
+
+   private:
+    GraphicsComposerHidlEnvironment() {}
+
+    GTEST_DISALLOW_COPY_AND_ASSIGN_(GraphicsComposerHidlEnvironment);
+};
+
+class GraphicsComposerHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   protected:
+    void SetUp() override {
+        ASSERT_NO_FATAL_FAILURE(
+            mComposer = std::make_unique<Composer>(
+                GraphicsComposerHidlEnvironment::Instance()->getServiceName<IComposer>()));
+        ASSERT_NO_FATAL_FAILURE(mComposerClient = mComposer->createClient());
+
+        mComposerCallback = new V2_1::vts::GraphicsComposerCallback;
+        mComposerClient->registerCallback(mComposerCallback);
+
+        // assume the first display is primary and is never removed
+        mPrimaryDisplay = waitForFirstDisplay();
+
+        mInvalidDisplayId = GetInvalidDisplayId();
+
+        // explicitly disable vsync
+        mComposerClient->setVsyncEnabled(mPrimaryDisplay, false);
+        mComposerCallback->setVsyncAllowed(false);
+
+        mWriter = std::make_unique<CommandWriterBase>(1024);
+        mReader = std::make_unique<V2_1::vts::TestCommandReader>();
+    }
+
+    void TearDown() override {
+        if (mComposerCallback != nullptr) {
+            EXPECT_EQ(0, mComposerCallback->getInvalidHotplugCount());
+            EXPECT_EQ(0, mComposerCallback->getInvalidRefreshCount());
+            EXPECT_EQ(0, mComposerCallback->getInvalidVsyncCount());
+        }
+    }
+
+    // returns an invalid display id (one that has not been registered to a
+    // display.  Currently assuming that a device will never have close to
+    // std::numeric_limit<uint64_t>::max() displays registered while running tests
+    Display GetInvalidDisplayId() {
+        std::vector<Display> validDisplays = mComposerCallback->getDisplays();
+        uint64_t id = std::numeric_limits<uint64_t>::max();
+        while (id > 0) {
+            if (std::find(validDisplays.begin(), validDisplays.end(), id) == validDisplays.end()) {
+                return id;
+            }
+            id--;
+        }
+
+        return 0;
+    }
+
+    void execute() { mComposerClient->execute(mReader.get(), mWriter.get()); }
+
+    // use the slot count usually set by SF
+    static constexpr uint32_t kBufferSlotCount = 64;
+
+    std::unique_ptr<Composer> mComposer;
+    std::unique_ptr<ComposerClient> mComposerClient;
+    sp<V2_1::vts::GraphicsComposerCallback> mComposerCallback;
+    // the first display and is assumed never to be removed
+    Display mPrimaryDisplay;
+    Display mInvalidDisplayId;
+    std::unique_ptr<CommandWriterBase> mWriter;
+    std::unique_ptr<V2_1::vts::TestCommandReader> mReader;
+
+   private:
+    Display waitForFirstDisplay() {
+        while (true) {
+            std::vector<Display> displays = mComposerCallback->getDisplays();
+            if (displays.empty()) {
+                usleep(5 * 1000);
+                continue;
+            }
+
+            return displays[0];
+        }
+    }
+};
+
+/**
+ * Test IComposerClient::getDisplayIdentificationData.
+ *
+ * TODO: Check that ports are unique for multiple displays.
+ */
+TEST_F(GraphicsComposerHidlTest, GetDisplayIdentificationData) {
+    uint8_t port0;
+    std::vector<uint8_t> data0;
+    if (mComposerClient->getDisplayIdentificationData(mPrimaryDisplay, &port0, &data0)) {
+        uint8_t port1;
+        std::vector<uint8_t> data1;
+        ASSERT_TRUE(mComposerClient->getDisplayIdentificationData(mPrimaryDisplay, &port1, &data1));
+
+        ASSERT_EQ(port0, port1) << "ports are not stable";
+        ASSERT_TRUE(data0.size() == data1.size() &&
+                    std::equal(data0.begin(), data0.end(), data1.begin()))
+            << "data is not stable";
+    }
+}
+
+/**
+ * TestIComposerClient::getReadbackBufferAttributes_2_3
+ */
+TEST_F(GraphicsComposerHidlTest, GetReadbackBufferAttributes_2_3) {
+    Dataspace dataspace;
+    PixelFormat pixelFormat;
+
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferAttributes_2_3(
+        mPrimaryDisplay, &pixelFormat, &dataspace));
+}
+
+/**
+ * Test IComposerClient::getClientTargetSupport_2_3
+ */
+TEST_F(GraphicsComposerHidlTest, GetClientTargetSupport_2_3) {
+    std::vector<V2_1::Config> configs = mComposerClient->getDisplayConfigs(mPrimaryDisplay);
+    for (auto config : configs) {
+        int32_t width = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                             IComposerClient::Attribute::WIDTH);
+        int32_t height = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                              IComposerClient::Attribute::HEIGHT);
+        ASSERT_LT(0, width);
+        ASSERT_LT(0, height);
+
+        mComposerClient->setActiveConfig(mPrimaryDisplay, config);
+
+        ASSERT_TRUE(mComposerClient->getClientTargetSupport_2_3(
+            mPrimaryDisplay, width, height, PixelFormat::RGBA_8888, Dataspace::UNKNOWN));
+    }
+}
+/**
+ * Test IComposerClient::getClientTargetSupport_2_3
+ *
+ * Test that IComposerClient::getClientTargetSupport_2_3 returns
+ * Error::BAD_DISPLAY when passed in an invalid display handle
+ */
+
+TEST_F(GraphicsComposerHidlTest, GetClientTargetSupport_2_3BadDisplay) {
+    std::vector<V2_1::Config> configs = mComposerClient->getDisplayConfigs(mPrimaryDisplay);
+    for (auto config : configs) {
+        int32_t width = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                             IComposerClient::Attribute::WIDTH);
+        int32_t height = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                              IComposerClient::Attribute::HEIGHT);
+        ASSERT_LT(0, width);
+        ASSERT_LT(0, height);
+
+        mComposerClient->setActiveConfig(mPrimaryDisplay, config);
+
+        Error error = mComposerClient->getRaw()->getClientTargetSupport_2_3(
+            mInvalidDisplayId, width, height, PixelFormat::RGBA_8888, Dataspace::UNKNOWN);
+
+        EXPECT_EQ(Error::BAD_DISPLAY, error);
+    }
+}
+
+/**
+ * Test IComposerClient::getRenderIntents_2_3
+ */
+TEST_F(GraphicsComposerHidlTest, GetRenderIntents_2_3) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes_2_3(mPrimaryDisplay);
+    for (auto mode : modes) {
+        std::vector<RenderIntent> intents =
+            mComposerClient->getRenderIntents_2_3(mPrimaryDisplay, mode);
+
+        bool isHdr;
+        switch (mode) {
+            case ColorMode::BT2100_PQ:
+            case ColorMode::BT2100_HLG:
+                isHdr = true;
+                break;
+            default:
+                isHdr = false;
+                break;
+        }
+        RenderIntent requiredIntent =
+            isHdr ? RenderIntent::TONE_MAP_COLORIMETRIC : RenderIntent::COLORIMETRIC;
+
+        auto iter = std::find(intents.cbegin(), intents.cend(), requiredIntent);
+        EXPECT_NE(intents.cend(), iter);
+    }
+}
+
+/*
+ * Test IComposerClient::getRenderIntents_2_3
+ *
+ * Test that IComposerClient::getRenderIntents_2_3 returns Error::BAD_DISPLAY when
+ * passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, GetRenderIntents_2_3BadDisplay) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes_2_3(mPrimaryDisplay);
+    for (auto mode : modes) {
+        mComposerClient->getRaw()->getRenderIntents_2_3(
+            mInvalidDisplayId, mode,
+            [&](const auto& tmpError, const auto&) { EXPECT_EQ(Error::BAD_DISPLAY, tmpError); });
+    }
+}
+
+/*
+ * Test IComposerClient::getRenderIntents_2_3
+ *
+ * Test that IComposerClient::getRenderIntents_2_3 returns Error::BAD_PARAMETER when
+ * pased either an invalid Color mode or an invalid Render Intent
+ */
+TEST_F(GraphicsComposerHidlTest, GetRenderIntents_2_3BadParameter) {
+    mComposerClient->getRaw()->getRenderIntents_2_3(
+        mPrimaryDisplay, static_cast<ColorMode>(-1),
+        [&](const auto& tmpError, const auto&) { EXPECT_EQ(Error::BAD_PARAMETER, tmpError); });
+}
+
+/**
+ * IComposerClient::getColorModes_2_3
+ */
+TEST_F(GraphicsComposerHidlTest, GetColorModes_2_3) {
+    std::vector<ColorMode> colorModes = mComposerClient->getColorModes_2_3(mPrimaryDisplay);
+
+    auto native = std::find(colorModes.cbegin(), colorModes.cend(), ColorMode::NATIVE);
+    ASSERT_NE(colorModes.cend(), native);
+}
+
+/*
+ * Test IComposerClient::getColorModes_2_3
+ *
+ * Test that IComposerClient::getColorModes_2_3 returns Error::BAD_DISPLAY when
+ * passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, GetColorMode_2_3BadDisplay) {
+    mComposerClient->getRaw()->getColorModes_2_3(
+        mInvalidDisplayId,
+        [&](const auto& tmpError, const auto&) { ASSERT_EQ(Error::BAD_DISPLAY, tmpError); });
+}
+
+/**
+ * IComposerClient::setColorMode_2_3
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorMode_2_3) {
+    std::vector<ColorMode> colorModes = mComposerClient->getColorModes_2_3(mPrimaryDisplay);
+    for (auto mode : colorModes) {
+        std::vector<RenderIntent> intents =
+            mComposerClient->getRenderIntents_2_3(mPrimaryDisplay, mode);
+        for (auto intent : intents) {
+            ASSERT_NO_FATAL_FAILURE(
+                mComposerClient->setColorMode_2_3(mPrimaryDisplay, mode, intent));
+        }
+    }
+
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->setColorMode_2_3(mPrimaryDisplay, ColorMode::NATIVE,
+                                                              RenderIntent::COLORIMETRIC));
+}
+
+/*
+ * Test IComposerClient::setColorMode_2_3
+ *
+ * Test that IComposerClient::setColorMode_2_3 returns an Error::BAD_DISPLAY
+ * when passed an invalid display handle
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorMode_2_3BadDisplay) {
+    Error error = mComposerClient->getRaw()->setColorMode_2_3(mInvalidDisplayId, ColorMode::NATIVE,
+                                                              RenderIntent::COLORIMETRIC);
+
+    ASSERT_EQ(Error::BAD_DISPLAY, error);
+}
+
+/*
+ * Test IComposerClient::setColorMode_2_3
+ *
+ * Test that IComposerClient::setColorMode_2_3 returns Error::BAD_PARAMETER when
+ * passed an invalid Color mode or an invalid render intent
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorMode_2_3BadParameter) {
+    Error colorModeError = mComposerClient->getRaw()->setColorMode_2_3(
+        mPrimaryDisplay, static_cast<ColorMode>(-1), RenderIntent::COLORIMETRIC);
+    EXPECT_EQ(Error::BAD_PARAMETER, colorModeError);
+
+    Error renderIntentError = mComposerClient->getRaw()->setColorMode_2_3(
+        mPrimaryDisplay, ColorMode::NATIVE, static_cast<RenderIntent>(-1));
+    EXPECT_EQ(Error::BAD_PARAMETER, renderIntentError);
+}
+
+/**
+ * Test IComposerClient::Command::SET_LAYER_COLOR_TRANSFORM.
+ * TODO Add color to the layer, use matrix to keep only red component,
+ * and check.
+ */
+TEST_F(GraphicsComposerHidlTest, SetLayerColorTransform) {
+    Layer layer;
+    ASSERT_NO_FATAL_FAILURE(layer =
+                                mComposerClient->createLayer(mPrimaryDisplay, kBufferSlotCount));
+    mWriter->selectDisplay(mPrimaryDisplay);
+    mWriter->selectLayer(layer);
+
+    // clang-format off
+    const std::array<float, 16> matrix = {{
+        1.0f, 0.0f, 0.0f, 0.0f,
+        0.0f, 1.0f, 0.0f, 0.0f,
+        0.0f, 0.0f, 1.0f, 0.0f,
+        0.0f, 0.0f, 0.0f, 1.0f,
+    }};
+    // clang-format on
+
+    mWriter->setLayerColorTransform(matrix.data());
+    execute();
+}
+
+TEST_F(GraphicsComposerHidlTest, GetDisplayedContentSamplingAttributes) {
+    using common::V1_1::PixelFormat;
+    using common::V1_2::Dataspace;
+
+    int constexpr invalid = -1;
+    auto format = static_cast<PixelFormat>(invalid);
+    auto dataspace = static_cast<Dataspace>(invalid);
+    auto componentMask = static_cast<hidl_bitfield<IComposerClient::FormatColorComponent>>(invalid);
+    auto error = mComposerClient->getDisplayedContentSamplingAttributes(mPrimaryDisplay, format,
+                                                                        dataspace, componentMask);
+
+    if (error == Error::UNSUPPORTED) {
+        SUCCEED() << "Device does not support optional extension. Test skipped";
+        return;
+    }
+
+    EXPECT_EQ(error, Error::NONE);
+    EXPECT_NE(format, static_cast<PixelFormat>(invalid));
+    EXPECT_NE(dataspace, static_cast<Dataspace>(invalid));
+    EXPECT_NE(componentMask,
+              static_cast<hidl_bitfield<IComposerClient::FormatColorComponent>>(invalid));
+};
+
+TEST_F(GraphicsComposerHidlTest, SetDisplayedContentSamplingEnabled) {
+    auto const maxFrames = 10;
+    auto const enableAllComponents = 0;
+    auto error = mComposerClient->setDisplayedContentSamplingEnabled(
+        mPrimaryDisplay, IComposerClient::DisplayedContentSampling::ENABLE, enableAllComponents,
+        maxFrames);
+    if (error == Error::UNSUPPORTED) {
+        SUCCEED() << "Device does not support optional extension. Test skipped";
+        return;
+    }
+    EXPECT_EQ(error, Error::NONE);
+
+    error = mComposerClient->setDisplayedContentSamplingEnabled(
+        mPrimaryDisplay, IComposerClient::DisplayedContentSampling::DISABLE, enableAllComponents,
+        maxFrames);
+    EXPECT_EQ(error, Error::NONE);
+}
+
+TEST_F(GraphicsComposerHidlTest, GetDisplayedContentSample) {
+    int constexpr invalid = -1;
+    auto format = static_cast<PixelFormat>(invalid);
+    auto dataspace = static_cast<Dataspace>(invalid);
+    auto componentMask = static_cast<hidl_bitfield<IComposerClient::FormatColorComponent>>(invalid);
+    auto error = mComposerClient->getDisplayedContentSamplingAttributes(mPrimaryDisplay, format,
+                                                                        dataspace, componentMask);
+
+    uint64_t maxFrames = 10;
+    uint64_t timestamp = 0;
+    uint64_t frameCount = 0;
+    hidl_array<hidl_vec<uint64_t>, 4> histogram;
+    error = mComposerClient->getDisplayedContentSample(mPrimaryDisplay, maxFrames, timestamp,
+                                                       frameCount, histogram[0], histogram[1],
+                                                       histogram[2], histogram[3]);
+    if (error == Error::UNSUPPORTED) {
+        SUCCEED() << "Device does not support optional extension. Test skipped";
+        return;
+    }
+
+    EXPECT_EQ(error, Error::NONE);
+    EXPECT_LE(frameCount, maxFrames);
+    for (auto i = 0; i < histogram.size(); i++) {
+        if (componentMask & (1 << i)) {
+            EXPECT_NE(histogram[i].size(), 0);
+        } else {
+            EXPECT_EQ(histogram[i].size(), 0);
+        }
+    }
+}
+
+}  // namespace
+}  // namespace vts
+}  // namespace V2_3
+}  // namespace composer
+}  // namespace graphics
+}  // namespace hardware
+}  // namespace android
+
+int main(int argc, char** argv) {
+    using android::hardware::graphics::composer::V2_3::vts::GraphicsComposerHidlEnvironment;
+    ::testing::AddGlobalTestEnvironment(GraphicsComposerHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    GraphicsComposerHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    return status;
+}
diff --git a/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp b/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp
index aa9beff..5ec0af2 100644
--- a/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp
+++ b/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp
@@ -16,6 +16,10 @@
 
 #define LOG_TAG "VtsHalGraphicsMapperV2_0TargetTest"
 
+#include <chrono>
+#include <thread>
+#include <vector>
+
 #include <VtsHalHidlTargetTestBase.h>
 #include <android-base/logging.h>
 #include <mapper-vts/2.0/MapperVts.h>
@@ -125,6 +129,36 @@
 }
 
 /**
+ * Test that IAllocator::allocate is thread-safe.
+ */
+TEST_F(GraphicsMapperHidlTest, AllocatorAllocateThreaded) {
+    BufferDescriptor descriptor;
+    ASSERT_NO_FATAL_FAILURE(descriptor = mGralloc->createDescriptor(mDummyDescriptorInfo));
+
+    std::atomic<bool> timeUp(false);
+    std::atomic<uint64_t> allocationCount(0);
+    auto threadLoop = [&]() {
+        while (!timeUp) {
+            mGralloc->getAllocator()->allocate(
+                descriptor, 1, [&](const auto&, const auto&, const auto&) { allocationCount++; });
+        }
+    };
+
+    std::vector<std::thread> threads;
+    for (int i = 0; i < 8; i++) {
+        threads.push_back(std::thread(threadLoop));
+    }
+
+    std::this_thread::sleep_for(std::chrono::seconds(3));
+    timeUp = true;
+    LOG(VERBOSE) << "Made " << allocationCount << " threaded allocations";
+
+    for (auto& thread : threads) {
+        thread.join();
+    }
+}
+
+/**
  * Test IMapper::createDescriptor with valid descriptor info.
  */
 TEST_F(GraphicsMapperHidlTest, CreateDescriptorBasic) {
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index 784ae30..a9c6f6c 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -181,7 +181,35 @@
     return d2i_X509(nullptr, &p, blob.size());
 }
 
-bool verify_chain(const hidl_vec<hidl_vec<uint8_t>>& chain) {
+bool verify_chain(const hidl_vec<hidl_vec<uint8_t>>& chain, const std::string& msg,
+                  const std::string& signature) {
+    {
+        EVP_MD_CTX md_ctx_verify;
+        X509_Ptr signing_cert(parse_cert_blob(chain[0]));
+        EVP_PKEY_Ptr signing_pubkey(X509_get_pubkey(signing_cert.get()));
+        EXPECT_TRUE(signing_pubkey);
+        ERR_print_errors_cb(
+            [](const char* str, size_t len, void* ctx) -> int {
+                (void)ctx;
+                std::cerr << std::string(str, len) << std::endl;
+                return 1;
+            },
+            nullptr);
+
+        EVP_MD_CTX_init(&md_ctx_verify);
+
+        bool result = false;
+        EXPECT_TRUE((result = EVP_DigestVerifyInit(&md_ctx_verify, NULL, EVP_sha256(), NULL,
+                                                   signing_pubkey.get())));
+        EXPECT_TRUE(
+            (result = result && EVP_DigestVerifyUpdate(&md_ctx_verify, msg.c_str(), msg.size())));
+        EXPECT_TRUE((result = result && EVP_DigestVerifyFinal(
+                                            &md_ctx_verify,
+                                            reinterpret_cast<const uint8_t*>(signature.c_str()),
+                                            signature.size())));
+        EVP_MD_CTX_cleanup(&md_ctx_verify);
+        if (!result) return false;
+    }
     for (size_t i = 0; i < chain.size(); ++i) {
         X509_Ptr key_cert(parse_cert_blob(chain[i]));
         X509_Ptr signing_cert;
@@ -3833,8 +3861,8 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .RsaSigningKey(2048, 65537)
-                                             .Digest(Digest::NONE)
-                                             .Padding(PaddingMode::NONE)
+                                             .Digest(Digest::SHA_2_256)
+                                             .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)
                                              .Authorization(TAG_INCLUDE_UNIQUE_ID)));
 
     hidl_vec<hidl_vec<uint8_t>> cert_chain;
@@ -3844,7 +3872,13 @@
                             .Authorization(TAG_ATTESTATION_APPLICATION_ID, HidlBuf("foo")),
                         &cert_chain));
     EXPECT_GE(cert_chain.size(), 2U);
-    EXPECT_TRUE(verify_chain(cert_chain));
+
+    string message = "12345678901234567890123456789012";
+    string signature = SignMessage(message, AuthorizationSetBuilder()
+                                                .Digest(Digest::SHA_2_256)
+                                                .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN));
+
+    EXPECT_TRUE(verify_chain(cert_chain, message, signature));
     EXPECT_TRUE(verify_attestation_record("challenge", "foo",                     //
                                           key_characteristics_.softwareEnforced,  //
                                           key_characteristics_.hardwareEnforced,  //
@@ -3890,7 +3924,11 @@
                             .Authorization(TAG_ATTESTATION_APPLICATION_ID, HidlBuf("foo")),
                         &cert_chain));
     EXPECT_GE(cert_chain.size(), 2U);
-    EXPECT_TRUE(verify_chain(cert_chain));
+
+    string message(1024, 'a');
+    string signature = SignMessage(message, AuthorizationSetBuilder().Digest(Digest::SHA_2_256));
+
+    EXPECT_TRUE(verify_chain(cert_chain, message, signature));
 
     EXPECT_TRUE(verify_attestation_record("challenge", "foo",                     //
                                           key_characteristics_.softwareEnforced,  //
diff --git a/media/bufferpool/2.0/Android.bp b/media/bufferpool/2.0/Android.bp
new file mode 100644
index 0000000..1f8bbdb
--- /dev/null
+++ b/media/bufferpool/2.0/Android.bp
@@ -0,0 +1,28 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.media.bufferpool@2.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IAccessor.hal",
+        "IClientManager.hal",
+        "IConnection.hal",
+        "IObserver.hal",
+    ],
+    interfaces: [
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "Buffer",
+        "BufferInvalidationMessage",
+        "BufferStatus",
+        "BufferStatusMessage",
+        "ResultStatus",
+    ],
+    gen_java: false,
+}
+
diff --git a/media/bufferpool/2.0/IAccessor.hal b/media/bufferpool/2.0/IAccessor.hal
new file mode 100644
index 0000000..b889518
--- /dev/null
+++ b/media/bufferpool/2.0/IAccessor.hal
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.bufferpool@2.0;
+
+import IConnection;
+import IObserver;
+/**
+ * IAccessor creates IConnection which is used from IClientManager in order to
+ * use functionality of the specified buffer pool.
+ */
+interface IAccessor {
+
+    /**
+     * Registers a new client and creates IConnection to the buffer pool for
+     * the client. IConnection and FMQ are used by IClientManager in order to
+     * communicate with the buffer pool. Via FMQ IClientManager sends
+     * BufferStatusMesage(s) to the buffer pool.
+     *
+     * FMQ is used to send buffer ownership status changes to a buffer pool
+     * from a buffer pool client. A buffer pool synchronizes FMQ messages when
+     * there is a hidl request from the clients. Every client has its own
+     * connection and FMQ to communicate with the buffer pool. So sending an
+     * FMQ message on behalf of other clients is not possible.
+     *
+     * FMQ messages are sent when a buffer is acquired or released. Also, FMQ
+     * messages are sent when a buffer is transferred from a client to another
+     * client. FMQ has its own ID from a buffer pool. A client is specified
+     * with the ID.
+     *
+     * To transfer a buffer, a sender must send an FMQ message. The message
+     * must include a receiver's ID and a transaction ID. A receiver must send
+     * the transaction ID to fetch a buffer from a buffer pool. Since the
+     * sender already registered the receiver via an FMQ message, The buffer
+     * pool must verify the receiver with the transaction ID. In order to
+     * prevent faking a receiver, a connection to a buffer pool from client is
+     * made and kept private. Also part of transaction ID is a sender ID in
+     * order to prevent fake transactions from other clients. This must be
+     * verified with an FMQ message from a buffer pool.
+
+     * @param observer The buffer pool event observer from the client.
+     *     Observer is provided to ensure FMQ messages are processed even when
+     *     client processes are idle. Buffer invalidation caused by
+     *     reconfiguration does not call observer. Buffer invalidation caused
+     *     by termination of pipeline call observer in order to ensure
+     *     invalidation is done after pipeline completion.
+     *
+     * @return status The status of the call.
+     *     OK               - A connection is made successfully.
+     *     NO_MEMORY        - Memory allocation failure occurred.
+     *     ALREADY_EXISTS   - A connection was already made.
+     *     CRITICAL_ERROR   - Other errors.
+     * @return connection The IConnection have interfaces
+     *     to get shared buffers from the buffer pool.
+     * @return connectionId Id of IConnection. The Id identifies
+     *     sender and receiver in FMQ messages during buffer transfer.
+     * @return msgId Id of the most recent message from buffer pool.
+     * @return toFmqDesc FMQ descriptor. The descriptor is used to
+     *     post buffer status messages.
+     * @return fromFmqDesc FMQ descriptor. The descriptor is used to
+     *     receive buffer invalidation messages from the buffer pool.
+     */
+    connect(IObserver observer)
+        generates (ResultStatus status, IConnection connection,
+                   int64_t connectionId,
+                   uint32_t msgId,
+                   fmq_sync<BufferStatusMessage> toFmqDesc,
+                   fmq_unsync<BufferInvalidationMessage> fromFmqDesc);
+};
diff --git a/media/bufferpool/2.0/IClientManager.hal b/media/bufferpool/2.0/IClientManager.hal
new file mode 100644
index 0000000..9253bda
--- /dev/null
+++ b/media/bufferpool/2.0/IClientManager.hal
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.bufferpool@2.0;
+
+import IAccessor;
+
+/**
+ * IClientManager manages IConnection(s) inside a process. A locally
+ * created IConnection represents a communication node(receiver) with the
+ * specified buffer pool(IAccessor).
+ * IConnection(s) are not exposed to other processes(IClientManager).
+ * IClientManager instance must be unique within a process.
+ */
+interface IClientManager {
+
+    /**
+     * Sets up a buffer receiving communication node for the specified
+     * buffer pool. A manager must create a IConnection to the buffer
+     * pool if it does not already have a connection.
+     *
+     * @param bufferPool a buffer pool which is specified with the IAccessor.
+     *     The specified buffer pool is the owner of received buffers.
+     * @return status The status of the call.
+     *     OK               - A sender was set successfully.
+     *     NO_MEMORY        - Memory allocation failure occurred.
+     *     ALREADY_EXISTS   - A sender was registered already.
+     *     CRITICAL_ERROR   - Other errors.
+     * @return connectionId the Id of the communication node to the buffer pool.
+     *     This id is used in FMQ to notify IAccessor that a buffer has been
+     *     sent to that connection during transfers.
+     */
+    registerSender(IAccessor bufferPool) generates
+        (ResultStatus status, int64_t connectionId);
+};
diff --git a/media/bufferpool/2.0/IConnection.hal b/media/bufferpool/2.0/IConnection.hal
new file mode 100644
index 0000000..629f83c
--- /dev/null
+++ b/media/bufferpool/2.0/IConnection.hal
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.bufferpool@2.0;
+
+/**
+ * A connection to a buffer pool which handles requests from a buffer pool
+ * client. The connection must be made in order to receive buffers from
+ * other buffer pool clients.
+ */
+interface IConnection {
+
+    /**
+     * Retrieves a buffer using bufferId. The method must be called from
+     * receiving side of buffer during transferring only when the specified
+     * buffer is neither cached nor used. This fails if the specified
+     * transaction is not valid.
+     *
+     * @param transactionId Unique transaction id for buffer transferring.
+     * @param bufferId Id of the buffer to be fetched.
+     * @return status The status of the call.
+     *     OK               - A buffer was fetched successfully.
+     *     NO_MEMORY        - Memory allocation failure occurred.
+     *     NOT_FOUND        - A buffer was not found due to invalidation.
+     *     CRITICAL_ERROR   - Other errors.
+     * @return buffer The actual buffer which is specified with bufferId.
+     */
+    fetch(uint64_t transactionId, uint32_t bufferId) generates
+        (ResultStatus status, Buffer buffer);
+};
diff --git a/media/bufferpool/2.0/IObserver.hal b/media/bufferpool/2.0/IObserver.hal
new file mode 100644
index 0000000..62f247e
--- /dev/null
+++ b/media/bufferpool/2.0/IObserver.hal
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.bufferpool@2.0;
+
+/**
+ * IObserver listens on notifications from the buffer pool. On receiving
+ * notifications, FMQ messages from the specific buffer pool which are already
+ * in the FMQ are processed.
+ */
+interface IObserver {
+
+    /**
+     * The specific buffer pool sent a message to the client. Calling this
+     * method from the buffer pool enforces a buffer pool client process the
+     * message.
+     *
+     * @param connectionId the connection Id of the specific buffer pool client
+     * @param msgId Id of the most recent message
+     */
+    oneway onMessage(int64_t connectionId, uint32_t msgId);
+};
diff --git a/media/bufferpool/2.0/README.md b/media/bufferpool/2.0/README.md
new file mode 100644
index 0000000..ed985d8
--- /dev/null
+++ b/media/bufferpool/2.0/README.md
@@ -0,0 +1,54 @@
+1. Overview
+
+A buffer pool enables processes to transfer buffers asynchronously.
+Without a buffer pool, a process calls a synchronous method of the other
+process and waits until the call finishes transferring a buffer. This adds
+unwanted latency due to context switching. With help from a buffer pool, a
+process can pass buffers asynchronously and reduce context switching latency.
+
+Passing an interface and a handle adds extra latency also. To mitigate the
+latency, passing IDs with local cache is used. For security concerns about
+rogue clients, FMQ is used to communicate between a buffer pool and a client
+process. FMQ is used to send buffer ownership change status from a client
+process to a buffer pool. Except FMQ, a buffer pool does not use any shared
+memory.
+
+2. FMQ
+
+FMQ is used to send buffer ownership status changes to a buffer pool from a
+buffer pool client. A buffer pool synchronizes FMQ messages when there is a
+hidl request from the clients. Every client has its own connection and FMQ
+to communicate with the buffer pool. So sending an FMQ message on behalf of
+other clients is not possible.
+
+FMQ messages are sent when a buffer is acquired or released. Also, FMQ messages
+are sent when a buffer is transferred from a client to another client. FMQ has
+its own ID from a buffer pool. A client is specified with the ID.
+
+To transfer a buffer, a sender must send an FMQ message. The message must
+include a receiver's ID and a transaction ID. A receiver must send the
+transaction ID to fetch a buffer from a buffer pool. Since the sender already
+registered the receiver via an FMQ message, The buffer pool must verify the
+receiver with the transaction ID. In order to prevent faking a receiver, a
+connection to a buffer pool from client is made and kept privately. Also part of
+transaction ID is a sender ID in order to prevent fake transactions from other
+clients. This must be verified with an FMQ message from a buffer pool.
+
+FMQ messages are defined in BufferStatus and BufferStatusMessage of 'types.hal'.
+
+3. Interfaces
+
+IConnection
+A connection to a buffer pool from a buffer pool client. The connection
+provides the functionalities to share buffers between buffer pool clients.
+The connection must be unique for each client.
+
+IAccessor
+An accessor to a buffer pool which makes a connection to the buffer pool.
+IAccesssor#connect creates an IConnection.
+
+IClientManager
+A manager of buffer pool clients and clients' connections to buffer pools. It
+sets up a process to be a receiver of buffers from a buffer pool. The manager
+is unique in a process.
+
diff --git a/media/bufferpool/2.0/types.hal b/media/bufferpool/2.0/types.hal
new file mode 100644
index 0000000..597e7b3
--- /dev/null
+++ b/media/bufferpool/2.0/types.hal
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.bufferpool@2.0;
+
+enum ResultStatus : int32_t {
+    OK                  = 0,
+
+    NO_MEMORY           = 1,
+    ALREADY_EXISTS      = 2,
+    NOT_FOUND           = 3,
+    CRITICAL_ERROR      = 4,
+};
+
+/**
+ * Generic buffer for fast recycling for media/stagefright.
+ *
+ * During media pipeline buffer references are created, shared and
+ * destroyed frequently. The underlying buffers are allocated on demand
+ * by a buffer pool, and are recycled to the buffer pool when they are
+ * no longer referenced by the clients.
+ *
+ * E.g. ion or gralloc buffer
+ */
+struct Buffer {
+    uint32_t id;
+    handle buffer;
+};
+
+/**
+ * Buffer ownership status for the specified client.
+ * Buffer transfer status for the specified buffer transafer transaction.
+ * BufferStatus is posted along with BufferStatusMessage from a client to
+ * the buffer pool for synchronization after status change.
+ */
+enum BufferStatus : int32_t {
+    /** No longer used by the specified client. */
+    NOT_USED            = 0,
+    /** Buffer is acquired by the specified client. */
+    USED                = 1,
+    /** Buffer is sent by the specified client. */
+    TRANSFER_TO         = 2,
+    /** Buffer transfer is acked by the receiver client. */
+    TRANSFER_FROM       = 3,
+    /** Buffer transfer is timed out by receiver client. */
+    TRANSFER_TIMEOUT    = 4,
+    /** Buffer transfer is not acked by the receiver. */
+    TRANSFER_LOST       = 5,
+    /** Buffer fetch request from the client. */
+    TRANSFER_FETCH      = 6,
+    /** Buffer transaction succeeded. */
+    TRANSFER_OK         = 7,
+    /** Buffer transaction failure. */
+    TRANSFER_ERROR      = 8,
+    /** Buffer invalidation ack. */
+    INVALIDATION_ACK    = 9,
+};
+
+/**
+ * Buffer ownership status change message. This message is
+ * sent via fmq to the buffer pool from client processes.
+ */
+struct BufferStatusMessage {
+    /**
+     * Transaction Id = (SenderId : sender local transaction Id)
+     * Transaction Id is created from sender and posted via fmq within
+     * TRANSFER_TO message.
+     */
+    uint64_t transactionId;
+    uint32_t bufferId;
+    BufferStatus newStatus;
+    /** Used by the buffer pool. not by client. */
+    int64_t connectionId;
+    /** Valid only when TRANSFER_TO is posted. */
+    int64_t targetConnectionId;
+    /**
+     * Used by the buffer pool, not by client.
+     * Monotonic timestamp in Us since fixed point in time as decided
+     * by the sender of the message
+     */
+    int64_t timestampUs;
+};
+
+/*
+ * Buffer pool sends a buffer invalidation message to clients in order to
+ * ensure fast reclamation of the buffers. Clients must free the invalidated
+ * buffers as soon as possible upon receiving the message.
+ */
+struct BufferInvalidationMessage {
+    uint32_t messageId;
+    /**
+     * Buffers from fromBufferId to toBufferId must be invalidated.
+     * fromBufferId is inclusive, but toBufferId is not inclusive.
+     * If fromBufferId > toBufferID, wrap happens. In that case
+     * the wrap is based on UINT32_MAX.
+     */
+    uint32_t fromBufferId;
+    uint32_t toBufferId;
+};
diff --git a/media/c2/1.0/Android.bp b/media/c2/1.0/Android.bp
new file mode 100644
index 0000000..28829d2
--- /dev/null
+++ b/media/c2/1.0/Android.bp
@@ -0,0 +1,51 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.media.c2@1.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IComponent.hal",
+        "IComponentInterface.hal",
+        "IComponentListener.hal",
+        "IComponentStore.hal",
+        "IConfigurable.hal",
+        "IInputSurface.hal",
+        "IInputSurfaceConnection.hal",
+    ],
+    interfaces: [
+        "android.hardware.graphics.bufferqueue@1.0",
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.media.bufferpool@1.0",
+        "android.hardware.media.omx@1.0",
+        "android.hardware.media@1.0",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "BaseBlock",
+        "Block",
+        "Buffer",
+        "FieldDescriptor",
+        "FieldId",
+        "FieldSupportedValues",
+        "FieldSupportedValuesQuery",
+        "FieldSupportedValuesQueryResult",
+        "FrameData",
+        "InfoBuffer",
+        "ParamDescriptor",
+        "ParamField",
+        "ParamFieldValues",
+        "SettingResult",
+        "Status",
+        "StructDescriptor",
+        "Work",
+        "WorkBundle",
+        "WorkOrdinal",
+        "Worklet",
+    ],
+    gen_java: false,
+}
+
diff --git a/media/c2/1.0/IComponent.hal b/media/c2/1.0/IComponent.hal
new file mode 100644
index 0000000..deb9255
--- /dev/null
+++ b/media/c2/1.0/IComponent.hal
@@ -0,0 +1,329 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+import android.hardware.graphics.bufferqueue@1.0::IGraphicBufferProducer;
+import android.hardware.media.omx@1.0::IGraphicBufferSource;
+
+import IConfigurable;
+import IComponentInterface;
+import IComponentListener;
+
+/**
+ * Interface for a Codec 2.0 component corresponding to API level 1.0 or
+ * below. Components have two states: stopped and running. The running
+ * state has three sub-states: executing, tripped and error.
+ */
+interface IComponent extends IComponentInterface {
+
+    // METHODS AVAILABLE WHEN RUNNING
+    // =========================================================================
+
+    /**
+     * Queues up work for the component.
+     *
+     * This method must be supported in running (including tripped) states.
+     *
+     * This method must return within 1ms
+     *
+     * It is acceptable for this method to return OK and return an error value
+     * using the onWorkDone() callback.
+     *
+     * @param workBundle WorkBundle object containing Works to queue to the
+     * component.
+     * @return status Status of the call, which may be
+     *   - OK        - Works in \p workBundle were successfully queued.
+     *   - BAD_INDEX - Some component(s) in some Work do(es) not exist.
+     *   - CANNOT_DO - The components are not tunneled.
+     *   - NO_MEMORY - Not enough memory to queue \p workBundle.
+     *   - CORRUPTED - Some unknown error prevented queuing the Works.
+     *                 (unexpected).
+     */
+    queue(WorkBundle workBundle) generates (Status status);
+
+    /**
+     * Discards and abandons any pending work for the component.
+     *
+     * This method must be supported in running (including tripped) states.
+     *
+     * This method must return within 5ms.
+     *
+     * Work that could be immediately abandoned/discarded must be returned in
+     * \p flushedWorks; this can be done in an arbitrary order.
+     *
+     * Work that could not be abandoned or discarded immediately must be marked
+     * to be discarded at the earliest opportunity, and must be returned via
+     * the onWorkDone() callback. This must be completed within 500ms.
+     *
+     * @return status Status of the call, which may be
+     *   - OK        - The component has been successfully flushed.
+     *   - TIMED_OUT - The flush could not be completed within the time limit.
+     *                 (unexpected)
+     *   - CORRUPTED - Some unknown error prevented flushing from
+     *                 completion. (unexpected)
+     * @return flushedWorkBundle WorkBundle object containing flushed Works.
+     */
+    flush(
+        ) generates (
+            Status status,
+            WorkBundle flushedWorkBundle
+        );
+
+    /**
+     * Drains the component, and optionally downstream components. This is a
+     * signalling method; as such it does not wait for any work completion.
+     *
+     * Marks last work item as "drain-till-here", so component is notified not
+     * to wait for further work before it processes work already queued. This
+     * method can also be used to set the end-of-stream flag after work has been
+     * queued. Client can continue to queue further work immediately after this
+     * method returns.
+     *
+     * This method must be supported in running (including tripped) states.
+     *
+     * This method must return within 1ms.
+     *
+     * Work that is completed must be returned via the onWorkDone() callback.
+     *
+     * @param withEos Whether to drain the component with marking end-of-stream.
+     * @return status Status of the call, which may be
+     *   - OK        - The drain request has been successfully recorded.
+     *   - TIMED_OUT - The flush could not be completed within the time limit.
+     *                 (unexpected)
+     *   - CORRUPTED - Some unknown error prevented flushing from completion.
+     *                 (unexpected)
+     */
+    drain(bool withEos) generates (Status status);
+
+    /**
+     * Starts using a surface for output.
+     *
+     * @param blockPoolId The id of the BlockPool to be associated with the
+     * output surface.
+     * @param surface A surface to use for codec output.
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - CANNOT_DO - The component does not support an output surface.
+     *   - REFUSED   - The output surface cannot be accessed.
+     *   - TIMED_OUT - The component could not be connected within the time
+     *                 limit. (unexpected)
+     *   - CORRUPTED - Some unknown error prevented connecting the component.
+     *                 (unexpected)
+     */
+    setOutputSurface(
+            uint64_t blockPoolId,
+            IGraphicBufferProducer surface
+        ) generates (
+            Status status
+        );
+
+    /**
+     * Starts using a persistent OMX input surface for a component.
+     *
+     * The component must be in running state.
+     *
+     * @param producer Producer component of an OMX persistent input surface.
+     * @param source Source component of an OMX persistent input surface.
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - CANNOT_DO - The component does not support an input surface.
+     *   - BAD_STATE - Component is not in running state.
+     *   - DUPLICATE - The component is already connected to an input surface.
+     *   - REFUSED   - The input surface is already in use.
+     *   - NO_MEMORY - Not enough memory to start the component.
+     *   - TIMED_OUT - The component could not be connected within the time
+     *                 limit. (unexpected)
+     *   - CORRUPTED - Some unknown error prevented connecting the component.
+     *                 (unexpected)
+     */
+    connectToOmxInputSurface(
+            IGraphicBufferProducer producer,
+            IGraphicBufferSource source
+        ) generates (Status status);
+
+    /**
+     * Stops using an input surface.
+     *
+     * This call is used for both Codec 2.0 and OMX input surfaces.
+     *
+     * The component must be in running state.
+     *
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - CANNOT_DO - The component does not support an input surface.
+     *   - BAD_STATE - Component is not in running state.
+     *   - NOT_FOUND - The component is not connected to an input surface.
+     *   - TIMED_OUT - The component could not be connected within the time
+     *                 limit. (unexpected)
+     *   - CORRUPTED - Some unknown error prevented connecting the component.
+     *                 (unexpected)
+     */
+    disconnectFromInputSurface() generates (Status Status);
+
+    /**
+     * Creates a local block pool backed by the given allocator and returns its
+     * identifier.
+     *
+     * This call must return within 100 msec.
+     *
+     * @param allocatorId The Codec 2.0 allocator ID
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - NO_MEMORY - Not enough memory to create the pool.
+     *   - BAD_VALUE - Invalid allocator.
+     *   - TIMED_OUT - The pool could not be created within the time
+     *                 limit. (unexpected)
+     *   - CORRUPTED - Some unknown error prevented creating the pool.
+     *                 (unexpected)
+     * @return blockPoolId The Codec 2.0 blockpool ID for the created pool.
+     * @return configurable Configuration interface for the created pool.
+     */
+    createBlockPool(uint32_t allocatorId) generates (
+        Status status,
+        uint64_t blockPoolId,
+        IConfigurable configurable
+    );
+
+    /**
+     * Destroys a local block pool previously created by createBlockPool().
+     *
+     * This call must return within 100 msec.
+     *
+     * @param blockPoolId The block pool id previously returned by
+     *      createBlockPool().
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - NOT_FOUND - The supplied blockPoolId is not valid.
+     *   - TIMED_OUT - The pool could not be destroyedwithin the time limit.
+     *                 (unexpected)
+     *   - CORRUPTED - Some unknown error prevented destruction of the pool.
+     *                 (unexpected)
+     */
+    destroyBlockPool(uint64_t blockPoolId) generates (Status status);
+
+    // STATE CHANGE METHODS
+    // =========================================================================
+
+    /**
+     * Starts the component.
+     *
+     * This method must be supported in stopped state as well as tripped state.
+     *
+     * If the return value is OK, the component must be in the running state.
+     * If the return value is BAD_STATE or DUPLICATE, no state change is
+     * expected as a response to this call.
+     * Otherwise, the component must be in the stopped state.
+     *
+     * If a component is in the tripped state and start() is called while the
+     * component configuration still results in a trip, start must succeed and
+     * a new onTripped callback must be used to communicate the configuration
+     * conflict that results in the new trip.
+     *
+     * This method must return within 500ms.
+     *
+     * @return status Status of the call, which may be
+     *   - OK        - The component has started successfully.
+     *   - BAD_STATE - Component is not in stopped or tripped state.
+     *   - DUPLICATE - When called during another start call from another
+     *                 thread.
+     *   - NO_MEMORY - Not enough memory to start the component.
+     *   - TIMED_OUT - The component could not be started within the time limit.
+     *                 (unexpected)
+     *   - CORRUPTED - Some unknown error prevented starting the component.
+     *                 (unexpected)
+     */
+    start() generates (Status status);
+
+    /**
+     * Stops the component.
+     *
+     * This method must be supported in running (including tripped) state.
+     *
+     * This method must return withing 500ms.
+     *
+     * Upon this call, all pending work must be abandoned.
+     * If the return value is BAD_STATE or DUPLICATE, no state change is
+     * expected as a response to this call.
+     * For all other return values, the component must be in the stopped state.
+     *
+     * This does not alter any settings and tunings that may have resulted in a
+     * tripped state.
+     *
+     * @return status Status of the call, which may be
+     *   - OK        - The component has stopped successfully.
+     *   - BAD_STATE - Component is not in running state.
+     *   - DUPLICATE - When called during another stop call from another thread.
+     *   - TIMED_OUT - The component could not be stopped within the time limit.
+     *                 (unexpected)
+     *   - CORRUPTED - Some unknown error prevented starting the component.
+     *                 (unexpected)
+     */
+    stop() generates (Status status);
+
+    /**
+     * Resets the component.
+     *
+     * This method must be supported in all (including tripped) states other
+     * than released.
+     *
+     * This method must be supported during any other blocking call.
+     *
+     * This method must return withing 500ms.
+     *
+     * After this call returns all work must have been abandoned, all references
+     * must have been released.
+     *
+     * If the return value is BAD_STATE or DUPLICATE, no state change is
+     * expected as a response to this call.
+     * For all other return values, the component shall be in the stopped state.
+     *
+     * This brings settings back to their default - "guaranteeing" no tripped
+     * state.
+     *
+     * @return status Status of the call, which may be
+     *   - OK        - The component has been reset.
+     *   - BAD_STATE - Component is in released state.
+     *   - DUPLICATE - When called during another reset call from another
+     *                 thread.
+     *   - TIMED_OUT - The component could not be reset within the time limit.
+     *                 (unexpected)
+     *   - CORRUPTED - Some unknown error prevented resetting the component.
+     *                 (unexpected)
+     */
+    reset() generates (Status status);
+
+    /**
+     * Releases the component.
+     *
+     * This method must be supported in stopped state.
+     *
+     * This method must return withing 500ms. Upon return all references must
+     * be abandoned.
+     *
+     * @return status Status of the call, which may be
+     *   - OK        - The component has been released.
+     *   - BAD_STATE - The component is running.
+     *   - DUPLICATE - The component is already released.
+     *   - TIMED_OUT - The component could not be released within the time
+     *                 limit. (unexpected)
+     *   - CORRUPTED - Some unknown error prevented releasing the component.
+     *                 (unexpected)
+     */
+    release() generates (Status status);
+
+};
+
diff --git a/media/c2/1.0/IComponentInterface.hal b/media/c2/1.0/IComponentInterface.hal
new file mode 100644
index 0000000..d4b30b1
--- /dev/null
+++ b/media/c2/1.0/IComponentInterface.hal
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+import IConfigurable;
+
+/**
+ * Component interface object. This object contains all of the configuration of
+ * a potential or actual component. It can be created and used independently of
+ * an actual Codec 2.0 component instance to query support and parameters for
+ * various component settings and configurations for a potential component.
+ * Actual components also expose this interface.
+ */
+interface IComponentInterface extends IConfigurable {
+    /*
+     * There are no additional methods to IConfigurable interface.
+     *
+     * Component interfaces have no states.
+     *
+     * The name of the component or component interface object is a unique name
+     * for that component or component interface 'class'; however, multiple
+     * instances of that component must have the same name.
+     */
+};
+
diff --git a/media/c2/1.0/IComponentListener.hal b/media/c2/1.0/IComponentListener.hal
new file mode 100644
index 0000000..eb71ecb
--- /dev/null
+++ b/media/c2/1.0/IComponentListener.hal
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+/**
+ * This callback interface is used for handling notifications from IComponent.
+ */
+interface IComponentListener {
+
+    /**
+     * Notify the listener that some works have been completed.
+     */
+    oneway onWorkDone(WorkBundle workBundle);
+
+    /**
+     * Notify the listener that the component is tripped.
+     */
+    oneway onTripped(vec<SettingResult> settingResults);
+
+    /**
+     * Notify the listener of an error.
+     *
+     * @param status Error type. \p status may be `OK`, which means that an
+     *     error has occurred, but the error type is unknown.
+     * @param errorCode Additional error code. The framework may not recognize
+     *     this.
+     */
+    oneway onError(Status status, uint32_t errorCode);
+
+    /**
+     * Information about rendering of a frame.
+     */
+    struct RenderedFrame {
+        /**
+         * Id of the buffer queue containing the rendered buffer.
+         */
+        uint64_t bufferQueueId;
+        /**
+         * Id of the slot of the rendered buffer.
+         */
+        int32_t slotId;
+        /**
+         * Timestamp of the rendering (consistent with timestamps in
+         * the associated BufferQueue).
+         */
+        int64_t timestampNs;
+    };
+
+    /**
+     * Notify the listener that frames are rendered.
+     *
+     * @param renderedFrames List of information about renderings of frames.
+     */
+    oneway onFramesRendered(vec<RenderedFrame> renderedFrames);
+};
+
diff --git a/media/c2/1.0/IComponentStore.hal b/media/c2/1.0/IComponentStore.hal
new file mode 100644
index 0000000..d2474cc
--- /dev/null
+++ b/media/c2/1.0/IComponentStore.hal
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+import android.hardware.media.bufferpool@1.0::IClientManager;
+import IComponentInterface;
+import IComponentListener;
+import IComponent;
+import IConfigurable;
+import IInputSurface;
+
+interface IComponentStore extends IConfigurable {
+
+    /**
+     * Creates a component by name.
+     *
+     * This method must return within 100ms.
+     *
+     * @param name Name of the component to create. This should match one of the
+     *     names returned by listComponents().
+     * @param listener The component listener to use for the component.
+     * @param pool The buffer pool client manager of the component listener.
+     *     This must be null if the listener process does not own a buffer pool.
+     * @return status Status of the call, which may be
+     *   - OK        - The component was created successfully.
+     *   - NOT_FOUND - There is no component with the given name.
+     *   - NO_MEMORY - Not enough memory to create the component.
+     *   - TIMED_OUT - The component could not be created within the time limit.
+     *                 (unexpected)
+     *   - CORRUPTED - Some unknown error prevented the creation of the
+     *                 component. (unexpected)
+     * @return comp The created component if `Status = OK`.
+     */
+    createComponent(
+            string name,
+            IComponentListener listener,
+            IClientManager pool
+        ) generates (
+            Status status,
+            IComponent comp
+        );
+
+    /**
+     * Creates a component interface by name.
+     *
+     * This method must return within 100ms.
+     *
+     * @param name Name of the component interface to create. This should match
+     *     one of the names returned by listComponents().
+     * @return status Status of the call, which may be
+     *   - OK        - The component interface was created successfully.
+     *   - NOT_FOUND - There is no component interface with the given name.
+     *   - NO_MEMORY - Not enough memory to create the component interface.
+     *   - TIMED_OUT - The component interface could not be created within the
+     *                 time limit. (unexpected)
+     *   - CORRUPTED - Some unknown error prevented the creation of the
+     *                 component interface. (unexpected)
+     * @return compIntf The created component interface if `Status = OK`.
+     */
+    createInterface(
+            string name
+        ) generates (
+            Status status,
+            IComponentInterface compIntf
+        );
+
+    /**
+     * Component traits.
+     */
+    struct ComponentTraits {
+        /**
+         * Name of the component.
+         */
+        string name;
+
+        enum Domain : uint32_t {
+            AUDIO,
+            VIDEO,
+            OTHER = 0xffffffff,
+        };
+        /**
+         * Component domain. The framework may not recognize `OTHER`.
+         */
+        Domain domain;
+        /**
+         * If #domain is `OTHER`, #domainOther can be used to provide additional
+         * information. Otherwise, #domainOther is ignored. The framework may
+         * not inspect this value.
+         */
+        uint32_t domainOther;
+
+        enum Kind : uint32_t {
+            DECODER,
+            ENCODER,
+            OTHER = 0xffffffff,
+        };
+        /**
+         * Component kind. The framework may not recognize `OTHER`.
+         */
+        Kind kind;
+        /**
+         * If #kind is `OTHER`, #kindOther can be used to provide additional
+         * information. Otherwise, #kindOther is ignored. The framework may not
+         * inspect this value.
+         */
+        uint32_t kindOther;
+
+        /**
+         * Rank used by MediaCodecList to determine component ordering. Lower
+         * value means higher priority.
+         */
+        uint32_t rank;
+
+        /**
+         * Media type.
+         */
+        string mediaType;
+
+        /**
+         * Aliases for component name for backward compatibility.
+         *
+         * \note Multiple components can have the same alias (but not the same
+         * component name) as long as their media types differ.
+         */
+        vec<string> aliases;
+    };
+
+    /**
+     * Returns the list of components supported by this component store.
+     *
+     * This method must return within 500ms.
+     *
+     * @return traits List of component traits for all components supported by this store in no
+     * particular order.
+     */
+    listComponents() generates (vec<ComponentTraits> traits);
+
+    /**
+     * Creates a persistent input surface that can be used as an input surface
+     * for any IComponent instance
+     *
+     * This method must return within 100ms.
+     *
+     * @return surface A persistent input surface
+     */
+    createInputSurface() generates (IInputSurface surface);
+
+    /**
+     * Returns a list of StructDescriptor object for a set of requested
+     * structures that this store is aware of.
+     *
+     * This operation must be performed at best effort, e.g. the component
+     * store must simply ignore all struct indices that it is not aware of.
+     *
+     * @param indices struct indices to return des
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - NOT_FOUND - Some indices were not known.
+     *   - NO_MEMORY - Not enough memory to complete this method.
+     * @return structs List of StructDescriptor objects.
+     */
+    getStructDescriptors(
+            vec<ParamIndex> indices
+        ) generates (
+            Status status,
+            vec<StructDescriptor> structs
+        );
+
+    /**
+     * Returns information required for using BufferPool API in buffer passing.
+     * If the returned pool is not null, the client can call registerSender() to
+     * register its IAccessor instance, hence allowing the client to send
+     * buffers to components hosted by this process.
+     *
+     * @return pool If the component store supports receiving buffers via
+     *     BufferPool API, \p pool must be a valid `IClientManager` instance.
+     *     Otherwise, \p pool must be null.
+     */
+    getPoolClientManager(
+        ) generates (
+            IClientManager pool
+        );
+
+    /**
+     * The store must copy the contents of \p src into \p dst without changing
+     * the format of \p dst.
+     *
+     * @param src Source buffer.
+     * @param dst Destination buffer.
+     * @return status Status of the call, which may be
+     *   - OK        - The copy is successful.
+     *   - CANNOT_DO - \p src and \p dst are not compatible.
+     *   - REFUSED   - No permission to copy.
+     *   - CORRUPTED - The copy cannot be done. (unexpected)
+     */
+    copyBuffer(Buffer src, Buffer dst) generates (Status status);
+
+};
+
diff --git a/media/c2/1.0/IConfigurable.hal b/media/c2/1.0/IConfigurable.hal
new file mode 100644
index 0000000..cd4dd10
--- /dev/null
+++ b/media/c2/1.0/IConfigurable.hal
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+/**
+ * Generic configuration interface used by all configurable Codec 2.0
+ * components.
+ *
+ * This interface must be supported in all states of the inheriting
+ * object, and must not change the state of the inheriting object.
+ */
+interface IConfigurable {
+    /**
+     * Returns the name of this object. This must match the name that was
+     * supplied during the creation of the object.
+     *
+     * @return name Name of this object.
+     */
+    getName() generates (string name);
+
+    /**
+     * Queries a set of parameters from the object. Querying is performed at
+     * best effort: the object must query all supported parameters and skip
+     * unsupported ones, or parameters that could not be allocated. Any errors
+     * are communicated in the return value.
+     *
+     * \note Parameter values do not depend on the order of query.
+     *
+     * This method must return within 1ms if \p mayBlock is DONT_BLOCK, and
+     * within 5ms otherwise.
+     *
+     * @param indices List of param indices for params to be queried.
+     * @param mayBlock Whether this call may block or not.
+     * @return status Status of the call, which may be
+     *   - OK        - All parameters could be queried.
+     *   - BAD_INDEX - All supported parameters could be queried, but some
+     *                 parameters were not supported.
+     *   - NO_MEMORY - Could not allocate memory for a supported parameter.
+     *   - BLOCKING  - Querying some parameters requires blocking.
+     *   - CORRUPTED - Some unknown error prevented the querying of the
+     *                 parameters. (unexpected)
+     * @return params List of params queried corresponding to \p indices.
+     */
+    query(
+            vec<ParamIndex> indices,
+            bool mayBlock
+        ) generates (
+            Status status,
+            Params params
+        );
+
+    /**
+     * Sets a set of parameters for the object. Tuning is performed at best
+     * effort: the object must update all supported configuration at best
+     * effort and skip unsupported parameters. Any errors are communicated in
+     * the return value and in \p failures.
+     *
+     * \note Parameter tuning DOES depend on the order of the tuning parameters.
+     * E.g. some parameter update may allow some subsequent parameter update.
+     *
+     * This method must return within 1ms if \p mayBlock is false, and within
+     * 5ms otherwise.
+     *
+     * @param inParams Requested parameter updates.
+     * @param mayBlock Whether this call may block or not.
+     * @return status Status of the call, which may be
+     *   - OK        - All parameters could be updated successfully.
+     *   - BAD_INDEX - All supported parameters could be updated successfully,
+     *                 but some parameters were not supported.
+     *   - NO_MEMORY - Some supported parameters could not be updated
+     *                 successfully because they contained unsupported values.
+     *                 These are returned in \p failures.
+     *   - BLOCKING  - Setting some parameters requires blocking.
+     *   - CORRUPTED - Some unknown error prevented the update of the
+     *                 parameters. (unexpected)
+     * @return failures List of parameter failures.
+     * @return outParams Resulting values for the configured parameters.
+     */
+    config(
+            Params inParams,
+            bool mayBlock
+        ) generates (
+            Status status,
+            vec<SettingResult> failures,
+            Params outParams
+        );
+
+    // REFLECTION MECHANISM
+    // =========================================================================
+
+    /**
+     * Returns a selected range of the set of supported parameters.
+     *
+     * The set of supported parameters are represented in a vector with a
+     * start index of 0, and the selected range are indices into this vector.
+     * Fewer than \p count parameters are returned if the selected range is
+     * not fully/not at all part of the available vector indices.
+     *
+     * This method must return within 1ms.
+     *
+     * @param start start index of selected range
+     * @param count size of the selected
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - NO_MEMORY - Not enough memory to complete this method.
+     * @return params Vector containing the selected range of supported
+     *     parameters.
+     */
+    querySupportedParams(
+            uint32_t start,
+            uint32_t count
+        ) generates (
+            Status status,
+            vec<ParamDescriptor> params
+        );
+
+    /**
+     * Retrieves the supported values for the queried fields.
+     *
+     * Upon return the object must fill in the supported
+     * values for the fields listed as well as a status for each field.
+     * Object shall process all fields queried even if some queries fail.
+     *
+     * This method must return within 1ms if \p mayBlock is false, and within
+     * 5ms otherwise.
+     *
+     * @param inFields Vector of field queries.
+     * @param mayBlock Whether this call may block or not.
+     * @return status Status of the call, which may be
+     *   - OK        - The operation completed successfully.
+     *   - BLOCKING  - Querying some parameters requires blocking.
+     *   - NO_MEMORY - Not enough memory to complete this method.
+     *   - BAD_INDEX - At least one field was not recognized as a component
+     *                 field.
+     * @return outFields Vector containing supported values and query result
+     *     for the selected fields.
+     */
+    querySupportedValues(
+            vec<FieldSupportedValuesQuery> inFields,
+            bool mayBlock
+        ) generates (
+            Status status,
+            vec<FieldSupportedValuesQueryResult> outFields
+        );
+
+};
+
diff --git a/media/c2/1.0/IInputSurface.hal b/media/c2/1.0/IInputSurface.hal
new file mode 100644
index 0000000..c083a21
--- /dev/null
+++ b/media/c2/1.0/IInputSurface.hal
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+import android.hardware.graphics.bufferqueue@1.0::IGraphicBufferProducer;
+
+import IConfigurable;
+import IComponent;
+import IInputSurfaceConnection;
+
+/**
+ * Input surface that can be configured for the IComponent.
+ */
+interface IInputSurface extends IGraphicBufferProducer {
+
+    /**
+     * Connects this input surface to a component.
+     *
+     * This call must return within 100 ms.
+     *
+     * @param component The component to connect to. This must have type
+     *     IComponent.
+     * @return status Status of the call, which may be
+     *   - OK        - The operation succeeded.
+     *   - BAD_STATE - The component is in running state.
+     *   - DUPLICATE - The surface is already connected to a component.
+     *   - NO_MEMORY - Could not allocate memory to connect to the component.
+     *   - CORRUPTED - Some unknown error prevented the connection. (unexpected)
+     * @return connection Connection object that is used to disconnect
+     *     from the component.
+     */
+    connectToComponent(
+            IComponent component
+        ) generates (
+            Status status,
+            IInputSurfaceConnection connection
+        );
+
+    /**
+     * Returns the Codec 2.0 configuration object for this surface.
+     *
+     * @return configurable The configuration object for this surface.
+     */
+    getConfigurable() generates (IConfigurable configurable);
+
+};
+
diff --git a/media/c2/1.0/IInputSurfaceConnection.hal b/media/c2/1.0/IInputSurfaceConnection.hal
new file mode 100644
index 0000000..500091d
--- /dev/null
+++ b/media/c2/1.0/IInputSurfaceConnection.hal
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+interface IInputSurfaceConnection {
+
+    /**
+     * Disconnects this input surface from the component.
+     *
+     * This call must return within 100 ms.
+     *
+     * @return status Status of the call, which may be
+     *   - OK        - The operation succeeded.
+     *   - BAD_STATE - The component is not in running state.
+     *   - NOT_FOUND - The surface is not connected to a component.
+     *   - CORRUPTED - Some unknown error prevented the connection. (unexpected)
+     */
+    disconnect() generates (Status status);
+
+};
+
diff --git a/media/c2/1.0/types.hal b/media/c2/1.0/types.hal
new file mode 100644
index 0000000..c06b415
--- /dev/null
+++ b/media/c2/1.0/types.hal
@@ -0,0 +1,607 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.media.c2@1.0;
+
+import android.hardware.media.bufferpool@1.0::BufferStatusMessage;
+
+enum Status : int32_t {
+    /** operation completed successfully */
+    OK        = 0,
+
+    // bad input
+
+    /** argument has invalid value (user error) */
+    BAD_VALUE = -22,
+    /** argument uses invalid index (user error) */
+    BAD_INDEX = -75,
+    /** argument/index is valid but not possible */
+    CANNOT_DO = -2147483646,
+
+    // bad sequencing of events
+
+    /** object already exists */
+    DUPLICATE = -17,
+    /** object not found */
+    NOT_FOUND = -2,
+    /** operation is not permitted in the current state */
+    BAD_STATE = -38,
+    /** operation would block but blocking is not permitted */
+    BLOCKING  = -9930,
+
+    // bad environment
+
+    /** not enough memory to complete operation */
+    NO_MEMORY = -12,
+    /** missing permission to complete operation */
+    REFUSED   = -1,
+
+    /** operation did not complete within timeout */
+    TIMED_OUT = -110,
+
+    // missing functionality
+
+    /** operation is not implemented/supported (optional only) */
+    OMITTED   = -74,
+
+    // unknown fatal
+
+    /** some unexpected error prevented the operation */
+    CORRUPTED = -2147483648,
+
+    // uninitialized
+
+    /** status has not been initialized */
+    NO_INIT   = -19,
+};
+
+/**
+ * Codec 2.0 parameter index
+ */
+typedef uint32_t ParamIndex;
+
+/**
+ * Codec 2.0 parameter structure
+ *
+ * The description of a Params is provided by supplying a ParamIndex to
+ * IComponentStore::getStructDescriptors().
+ */
+typedef vec<uint8_t> Params;
+
+/**
+ * Struct uniquely specifying a field in an arbitrary parameter structure.
+ */
+struct FieldId {
+    /** Offset of the field in bytes */
+    uint32_t offset;
+    /** Size of the field in bytes */
+    uint32_t size;
+};
+
+/**
+ * Struct representing a location of a field in a parameter with a given index.
+ */
+struct ParamField {
+    /** Index of the parameter */
+    ParamIndex index;
+    /** Field identifier */
+    FieldId fieldId;
+};
+
+/**
+ * Struct describing basic properties of a parameter with a given index.
+ */
+struct ParamDescriptor {
+    /** Parameter index */
+    ParamIndex index;
+
+    enum Attrib : uint32_t {
+        /**
+         * Parameter is required to be specified.
+         */
+        REQUIRED   = 1u << 0,
+        /**
+         * Parameter retains its value.
+         */
+        PERSISTENT = 1u << 1,
+        /**
+         * Parameter is strict.
+         */
+        STRICT     = 1u << 2,
+        /**
+         * Parameter is publicly read-only.
+         */
+        READ_ONLY  = 1u << 3,
+        /**
+         * Parameter must not be visible to clients.
+         */
+        HIDDEN     = 1u << 4,
+        /**
+         * Parameter must not be used by framework (other than testing).
+         */
+        INTERNAL   = 1u << 5,
+        /**
+         * Parameter is publicly constant (hence read-only).
+         */
+        CONST      = 1u << 6,
+    };
+    /** Parameter attributes */
+    bitfield<Attrib> attrib;
+
+    /** Parameter name */
+    string name;
+
+    /** index of other parameters that this parameter depends on */
+    vec<ParamIndex> dependencies;
+};
+
+// Generic way to describe supported numeric values for Codec 2.0 interfaces.
+
+/**
+ * An untyped value that can fit on 64 bits - the type of which is communicated
+ * via a separate channel (FieldType).
+ */
+typedef uint64_t PrimitiveValue;
+
+/*
+ * Generic supported values for a field.
+ *
+ * This can be either a range or a set of values. The range can be linear or
+ * geometric with clear minimum and maximum values, and can have an optional
+ * step size or geometric ratio. Values can optionally represent flags.
+ */
+struct FieldSupportedValues {
+    struct Range {
+        PrimitiveValue min;
+        PrimitiveValue max;
+        PrimitiveValue step;
+        PrimitiveValue num;
+        PrimitiveValue denom;
+    };
+
+    enum Type : int32_t {
+        /** No supported values */
+        EMPTY,
+        /** Numeric range that can be continuous or discrete */
+        RANGE,
+        /** List of values */
+        VALUES,
+        /** List of flags that can be OR-ed */
+        FLAGS,
+        /** Other representations */
+        OTHER = 0xffffffff,
+    };
+    /**
+     * Type of the supported values. The framework may not recognize `OTHER`.
+     */
+    Type type;
+    /**
+     * Codec2.0 type code of the supported values.
+     *   * If #type is `OTHER`, #typeOther can be used to give more information.
+     *     In this case, the interpretation of this structure is
+     *     implementation-defined.
+     *   * For all other values of #type, #typeOther is not used.
+     * The framework may not inspect this value.
+     */
+    int32_t typeOther;
+
+    /*
+     * If #type = EMPTY, #range and #value are unused.
+     */
+
+    /**
+     * If #type = RANGE, #range will specify the range of possible values.
+     *
+     * The intended type of members of #range will be clear in the context where
+     * FieldSupportedValues is used.
+     */
+    Range range;
+
+    /**
+     * If #type is `VALUES` or `FLAGS`, #value will list supported values.
+     *
+     * The intended type of components of #value will be clear in the context
+     * where FieldSupportedValues is used.
+     */
+    vec<PrimitiveValue> values;
+};
+
+/**
+ * Supported values for a specific field.
+ *
+ * This is a pair of the field specifier together with an optional supported
+ * values object. This structure is used when reporting parameter configuration
+ * failures and conflicts.
+ */
+struct ParamFieldValues {
+    /** the field or parameter */
+    ParamField paramOrField;
+
+    /**
+     * optional supported values for the field if paramOrField specifies an
+     * actual field that is numeric (non struct, blob or string). Supported
+     * values for arrays (including string and blobs) describe the supported
+     * values for each element (character for string, and bytes for blobs). It
+     * is optional for read-only strings and blobs.
+     */
+    vec<FieldSupportedValues> values;
+};
+
+/**
+ * Field descriptor.
+ */
+struct FieldDescriptor {
+
+    /** Field id */
+    FieldId fieldId;
+
+    /**
+     * Possible types of a field.
+     */
+    enum Type : uint32_t {
+        NO_INIT,
+        INT32,
+        UINT32,
+        CNTR32,
+        INT64,
+        UINT64,
+        CNTR64,
+        FLOAT,
+        /**
+         * Fixed-size string (POD)
+         */
+        STRING = 0x100,
+        /**
+         * blobs have no sub-elements and can be thought of as byte arrays.
+         * However, bytes cannot be individually addressed by clients.
+         */
+        BLOB,
+        /**
+         * Structs. Marked with this flag in addition to their coreIndex.
+         */
+        STRUCT_FLAG = 0x20000,
+    };
+    /**
+     * Type of the field.
+     */
+    bitfield<Type> type;
+
+    /** Extent of the field */
+    uint32_t length;
+    /*
+     * Note: the last member of a param struct can be of arbitrary length (e.g.
+     * if it is T[] array, which extends to the last byte of the parameter.)
+     * This is marked with extent 0.
+     */
+
+    /** Name of the field */
+    string name;
+    /** Named value type */
+    struct NamedValue {
+        string name;
+        PrimitiveValue value;
+    };
+    /** Named values for the field */
+    vec<NamedValue> namedValues;
+};
+
+/**
+ * Struct descriptor.
+ */
+struct StructDescriptor {
+    /** Struct type */
+    ParamIndex type;
+    /** Field descriptors for each field */
+    vec<FieldDescriptor> fields;
+};
+
+/**
+ * Information describing the reason a parameter settings may fail, or
+ * may be overriden.
+ */
+struct SettingResult {
+    /** Failure code (of Codec 2.0 SettingResult failure type) */
+    enum Failure : uint32_t {
+        /** Parameter is read-only and cannot be set. */
+        READ_ONLY,
+        /** Parameter mismatches input data. */
+        MISMATCH,
+        /** Parameter does not accept value. */
+        BAD_VALUE,
+        /** Parameter is not supported. */
+        BAD_TYPE,
+        /** Parameter is not supported on the specific port. */
+        BAD_PORT,
+        /** Parameter is not supported on the specific stream. */
+        BAD_INDEX,
+        /** Parameter is in conflict with an/other setting(s). */
+        CONFLICT,
+        /**
+         * Parameter is out of range due to other settings. (This failure mode
+         * can only be used for strict parameters.)
+         */
+        UNSUPPORTED,
+        /**
+         * Requested parameter value is in conflict with an/other setting(s)
+         * and has been corrected to the closest supported value. This failure
+         * mode is given to provide suggestion to the client as to how to enable
+         * the requested parameter value. */
+        INFO_CONFLICT,
+        /**
+         * This failure mode is reported when all the above failure modes do not
+         * apply.
+         */
+        OTHER = 0xffffffff,
+    };
+    /**
+     * The failure type. The framework might not recognize `OTHER`.
+     */
+    Failure failure;
+    /**
+     * The failure code.
+     *   * If #failure is `OTHER`, #failureOther can be used to give more
+     *     information.
+     *   * For all other values of #failure, #failureOther is not used.
+     * The framework may not inspect this value.
+     */
+    uint32_t failureOther;
+
+    /**
+     * Failing (or corrected) field. Currently supported values for the field.
+     * This is set if different from the globally supported values (e.g. due to
+     * restrictions by another param or input data)
+     */
+    ParamFieldValues field;
+
+    /**
+     * Conflicting parameters or fields with
+     * (optional) suggested values for any conflicting fields to avoid the conflict.
+     */
+    vec<ParamFieldValues> conflicts;
+};
+
+/**
+ * Data structure for ordering Work objects. Each member is used for comparing
+ * urgency in the same fashion: a smaller value indicates that the associated
+ * Work object is more urgent.
+ */
+struct WorkOrdinal {
+    /**
+     * Timestamp in microseconds - can wrap around.
+     */
+    uint64_t timestampUs;
+    /**
+     * Frame index - can wrap around.
+     */
+    uint64_t frameIndex;
+    /**
+     * Component specific frame ordinal - can wrap around.
+     */
+    uint64_t customOrdinal;
+};
+
+/**
+ * A structure that holds information of a Block. There are two types of Blocks:
+ * NATIVE and POOLED. Each type has its own way of identifying blocks.
+ */
+struct BaseBlock {
+    enum Type : int32_t {
+        NATIVE,
+        POOLED,
+    };
+    /**
+     * There are two types of blocks: NATIVE and POOLED.
+     */
+    Type type;
+
+    /**
+     * A "NATIVE" block is represented by a native handle.
+     */
+    handle nativeBlock;
+
+    /*
+     * A "POOLED" block is represented by `BufferStatusMessage`.
+     */
+    BufferStatusMessage pooledBlock;
+};
+
+/**
+ * A Block in transfer consists of an index into an array of BaseBlock plus some
+ * extra information. One BaseBlock may occur in multiple blocks in one
+ * `WorkBundle`.
+ */
+struct Block {
+    /**
+     * Identity of the BaseBlock within a WorkBundle. This is an index into the
+     * `baseBlocks` array of a `WorkBundle` object.
+     */
+    uint32_t index;
+    /**
+     * Metadata associated with the block.
+     */
+    Params meta;
+    /**
+     * Fence for synchronizing block access.
+     */
+    handle fence;
+};
+
+/**
+ * Type of buffers processed by a component.
+ */
+struct Buffer {
+    /**
+     * Metadata associated with the buffer.
+     */
+    Params info;
+    /**
+     * Blocks contained in the buffer.
+     */
+    vec<Block> blocks;
+};
+
+/**
+ * An extension of Buffer that also contains an index.
+ */
+struct InfoBuffer {
+    ParamIndex index;
+    Buffer buffer;
+};
+
+/**
+ * This structure represents a frame with its metadata. A frame consists of an
+ * ordered set of buffers, configuration changes, and info buffers along with
+ * some non-configuration metadata.
+ */
+struct FrameData {
+    enum Flags : uint32_t {
+        /**
+         * For input frames: no output frame will be generated when processing
+         * this frame, but metadata must still be processed.
+         * For output frames: this frame must be discarded but metadata is still
+         * valid.
+         */
+        DROP_FRAME    = (1 << 0),
+        /**
+         * This frame is the last frame of the current stream. Further frames
+         * are part of a new stream.
+         */
+        END_OF_STREAM = (1 << 1),
+        /**
+         * This frame must be discarded with its metadata.
+         * This flag is only set by components - e.g. as a response to the flush
+         * command.
+         */
+        DISCARD_FRAME = (1 << 2),
+        /**
+         * This frame contains only codec-specific configuration data, and no
+         * actual access unit.
+         *
+         * \deprecated Pass codec configuration with the codec-specific
+         * configuration info together with the access unit.
+         */
+        CODEC_CONFIG  = (1u << 31),
+    };
+
+    /**
+     * Frame flags.
+     */
+    bitfield<Flags> flags;
+
+    /**
+     * Ordinal of the frame.
+     */
+    WorkOrdinal ordinal;
+
+    /**
+     * Frame buffers.
+     */
+    vec<Buffer> buffers;
+
+    /**
+     * Params determining a configuration update.
+     */
+    Params configUpdate;
+
+    /**
+     * Info buffers.
+     */
+    vec<InfoBuffer> infoBuffers;
+};
+
+/**
+ * Struct for
+ */
+struct Worklet {
+    /**
+     * List of Params describing tunings.
+     */
+    vec<Params> tunings;
+
+    /**
+     * List of failures.
+     */
+    vec<SettingResult> failures;
+
+    /**
+     * Output frame data.
+     */
+    FrameData output;
+
+    /* Note: Component id is not necessary as tunneling is not supported. */
+};
+
+/**
+ * This structure holds information about a single work item. It must be passed
+ * by the client to the component.
+ */
+struct Work {
+    /**
+     * FrameData for the input. Indices of Blocks inside #input refer to
+     * BaseBlocks in the member `blocks` of the containing `WorkBundle`.
+     */
+    FrameData input;
+    /**
+     * Worklet. Indices of Blocks inside `worklet.output` refer to
+     * BaseBlocks in the member `blocks` of the containing `WorkBundle`.
+     */
+    Worklet worklet;
+    /**
+     * Whether the worklet was processed or not.
+     */
+    bool workletProcessed;
+    Status result;
+};
+
+/**
+ * This structure holds a list of Work objects and a list of BaseBlocks.
+ */
+struct WorkBundle {
+    /**
+     * A list of Work items.
+     */
+    vec<Work> works;
+    /**
+     * A list of blocks indexed by elements of #works.
+     */
+    vec<BaseBlock> baseBlocks;
+};
+
+/**
+ * This structure describes a query for supported values of a field. This is
+ * used as input to IConfigurable::queryFieldSupportedValues().
+ */
+struct FieldSupportedValuesQuery {
+    enum Type : uint32_t {
+        /** Query all possible values regardless of other settings */
+        POSSIBLE,
+        /** Query currently possible values given dependent settings */
+        CURRENT,
+    };
+
+    ParamField field;
+    Type type;
+};
+
+/**
+ * This structure is used to hold the result from
+ * IConfigurable::queryFieldSupportedValues().
+ */
+struct FieldSupportedValuesQueryResult {
+    Status status;
+    FieldSupportedValues values;
+};
+
diff --git a/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp b/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp
index 34a96a0..88a9e26 100644
--- a/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp
+++ b/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp
@@ -470,7 +470,7 @@
     status = omxNode->sendCommand(toRawCommandType(OMX_CommandStateSet),
                                   OMX_StateExecuting);
     ASSERT_EQ(status, android::hardware::media::omx::V1_0::Status::OK);
-    status = observer->dequeueMessage(&msg, DEFAULT_TIMEOUT);
+    status = observer->dequeueMessage(&msg, RELAXED_TIMEOUT);
     ASSERT_EQ(status, android::hardware::media::omx::V1_0::Status::OK);
     ASSERT_EQ(msg.type, Message::Type::EVENT);
     ASSERT_EQ(msg.data.eventData.event, OMX_EventCmdComplete);
diff --git a/media/omx/1.0/vts/functional/common/media_hidl_test_common.h b/media/omx/1.0/vts/functional/common/media_hidl_test_common.h
index c1863d5..1575ba2 100644
--- a/media/omx/1.0/vts/functional/common/media_hidl_test_common.h
+++ b/media/omx/1.0/vts/functional/common/media_hidl_test_common.h
@@ -41,6 +41,8 @@
 /* As component is switching states (loaded<->idle<->execute), dequeueMessage()
  * expects the events to be received within this duration */
 #define DEFAULT_TIMEOUT 100000
+// b/70933963
+#define RELAXED_TIMEOUT 400000
 /* Time interval between successive Input/Output enqueues */
 #define DEFAULT_TIMEOUT_Q 2000
 /* While the component is amidst a process call, asynchronous commands like
diff --git a/media/omx/1.0/vts/functional/component/VtsHalMediaOmxV1_0TargetComponentTest.cpp b/media/omx/1.0/vts/functional/component/VtsHalMediaOmxV1_0TargetComponentTest.cpp
index 7750a12..4ddc833 100644
--- a/media/omx/1.0/vts/functional/component/VtsHalMediaOmxV1_0TargetComponentTest.cpp
+++ b/media/omx/1.0/vts/functional/component/VtsHalMediaOmxV1_0TargetComponentTest.cpp
@@ -1149,15 +1149,13 @@
             ASSERT_EQ(status, android::hardware::media::omx::V1_0::Status::OK);
 
             // do not enable the port until all the buffers are supplied
-            status = observer->dequeueMessage(&msg, DEFAULT_TIMEOUT,
-                                              &pBuffer[0], &pBuffer[1]);
+            status = observer->dequeueMessage(&msg, RELAXED_TIMEOUT, &pBuffer[0], &pBuffer[1]);
             ASSERT_EQ(status,
                       android::hardware::media::omx::V1_0::Status::TIMED_OUT);
 
             ASSERT_NO_FATAL_FAILURE(allocatePortBuffers(
                 omxNode, &pBuffer[i - portBase], i, portMode[i - portBase]));
-            status = observer->dequeueMessage(&msg, DEFAULT_TIMEOUT,
-                                              &pBuffer[0], &pBuffer[1]);
+            status = observer->dequeueMessage(&msg, RELAXED_TIMEOUT, &pBuffer[0], &pBuffer[1]);
             ASSERT_EQ(status, android::hardware::media::omx::V1_0::Status::OK);
             ASSERT_EQ(msg.type, Message::Type::EVENT);
             ASSERT_EQ(msg.data.eventData.data1, OMX_CommandPortEnable);
diff --git a/neuralnetworks/1.0/vts/functional/Android.bp b/neuralnetworks/1.0/vts/functional/Android.bp
index ffba45c..234527a 100644
--- a/neuralnetworks/1.0/vts/functional/Android.bp
+++ b/neuralnetworks/1.0/vts/functional/Android.bp
@@ -39,17 +39,14 @@
     ],
 }
 
-cc_test {
-    name: "VtsHalNeuralnetworksV1_0TargetTest",
+cc_defaults {
+    name: "VtsHalNeuralNetworksTargetTestDefaults",
+    defaults: ["VtsHalTargetTestDefaults"],
     srcs: [
-        "BasicTests.cpp",
-        "GeneratedTests.cpp",
         "ValidateModel.cpp",
         "ValidateRequest.cpp",
-        "ValidationTests.cpp",
         "VtsHalNeuralnetworks.cpp",
     ],
-    defaults: ["VtsHalTargetTestDefaults"],
     static_libs: [
         "android.hardware.neuralnetworks@1.0",
         "android.hardware.neuralnetworks@1.1",
@@ -66,4 +63,22 @@
         "libneuralnetworks_generated_test_harness_headers",
         "libneuralnetworks_generated_tests",
     ],
+    // Bug: http://b/74200014 - Disable arm32 asan since it triggers internal
+    // error in ld.gold.
+    arch: {
+        arm: {
+            sanitize: {
+                never: true,
+            },
+        },
+    },
+}
+
+cc_test {
+    name: "VtsHalNeuralnetworksV1_0TargetTest",
+    defaults: ["VtsHalNeuralNetworksTargetTestDefaults"],
+    srcs: [
+        "BasicTests.cpp",
+        "GeneratedTests.cpp",
+    ],
 }
diff --git a/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp b/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp
index 1f66c43..802d018 100644
--- a/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp
+++ b/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp
@@ -45,6 +45,7 @@
 using ::test_helper::Int32Operands;
 using ::test_helper::MixedTyped;
 using ::test_helper::MixedTypedExample;
+using ::test_helper::MixedTypedIndex;
 using ::test_helper::Quant8Operands;
 using ::test_helper::resize_accordingly;
 
@@ -63,14 +64,16 @@
     copy_back_<int32_t>(dst, ra, src);
     copy_back_<uint8_t>(dst, ra, src);
     copy_back_<int16_t>(dst, ra, src);
-    static_assert(4 == std::tuple_size<MixedTyped>::value,
+    copy_back_<_Float16>(dst, ra, src);
+    static_assert(5 == std::tuple_size<MixedTyped>::value,
                   "Number of types in MixedTyped changed, but copy_back function wasn't updated");
 }
 
 // Top level driver for models and examples generated by test_generator.py
 // Test driver for those generated from ml/nn/runtime/test/spec
 void EvaluatePreparedModel(sp<IPreparedModel>& preparedModel, std::function<bool(int)> is_ignored,
-                           const std::vector<MixedTypedExample>& examples, float fpAtol = 1e-5f,
+                           const std::vector<MixedTypedExample>& examples,
+                           bool hasRelaxedFloat32Model = false, float fpAtol = 1e-5f,
                            float fpRtol = 1e-5f) {
     const uint32_t INPUT = 0;
     const uint32_t OUTPUT = 1;
@@ -78,13 +81,20 @@
     int example_no = 1;
     for (auto& example : examples) {
         SCOPED_TRACE(example_no++);
-
         const MixedTyped& inputs = example.operands.first;
         const MixedTyped& golden = example.operands.second;
 
+        const bool hasFloat16Inputs = !std::get<MixedTypedIndex<_Float16>::index>(inputs).empty();
+        if (hasRelaxedFloat32Model || hasFloat16Inputs) {
+            // TODO: Adjust the error limit based on testing.
+            // If in relaxed mode, set the absolute tolerance to be 5ULP of FP16.
+            fpAtol = 5.0f * 0.0009765625f;
+            // Set the relative tolerance to be 5ULP of the corresponding FP precision.
+            fpRtol = 5.0f * 0.0009765625f;
+        }
+
         std::vector<RequestArgument> inputs_info, outputs_info;
         uint32_t inputSize = 0, outputSize = 0;
-
         // This function only partially specifies the metadata (vector of RequestArguments).
         // The contents are copied over below.
         for_all(inputs, [&inputs_info, &inputSize](int index, auto, auto s) {
@@ -228,7 +238,8 @@
     ASSERT_NE(nullptr, preparedModel.get());
 
     float fpAtol = 1e-5f, fpRtol = 5.0f * 1.1920928955078125e-7f;
-    EvaluatePreparedModel(preparedModel, is_ignored, examples, fpAtol, fpRtol);
+    EvaluatePreparedModel(preparedModel, is_ignored, examples,
+                          /*hasRelaxedFloat32Model=*/false, fpAtol, fpRtol);
 }
 
 void Execute(const sp<V1_1::IDevice>& device, std::function<V1_1::Model(void)> create_model,
@@ -272,13 +283,8 @@
     EXPECT_EQ(ErrorStatus::NONE, prepareReturnStatus);
     ASSERT_NE(nullptr, preparedModel.get());
 
-    // TODO: Adjust the error limit based on testing.
-    // If in relaxed mode, set the absolute tolerance to be 5ULP of FP16.
-    float fpAtol = !model.relaxComputationFloat32toFloat16 ? 1e-5f : 5.0f * 0.0009765625f;
-    // Set the relative tolerance to be 5ULP of the corresponding FP precision.
-    float fpRtol = !model.relaxComputationFloat32toFloat16 ? 5.0f * 1.1920928955078125e-7f
-                                                           : 5.0f * 0.0009765625f;
-    EvaluatePreparedModel(preparedModel, is_ignored, examples, fpAtol, fpRtol);
+    EvaluatePreparedModel(preparedModel, is_ignored, examples,
+                          model.relaxComputationFloat32toFloat16);
 }
 
 // TODO: Reduce code duplication.
@@ -323,13 +329,8 @@
     EXPECT_EQ(ErrorStatus::NONE, prepareReturnStatus);
     ASSERT_NE(nullptr, preparedModel.get());
 
-    // TODO: Adjust the error limit based on testing.
-    // If in relaxed mode, set the absolute tolerance to be 5ULP of FP16.
-    float fpAtol = !model.relaxComputationFloat32toFloat16 ? 1e-5f : 5.0f * 0.0009765625f;
-    // Set the relative tolerance to be 5ULP of the corresponding FP precision.
-    float fpRtol = !model.relaxComputationFloat32toFloat16 ? 5.0f * 1.1920928955078125e-7f
-                                                           : 5.0f * 0.0009765625f;
-    EvaluatePreparedModel(preparedModel, is_ignored, examples, fpAtol, fpRtol);
+    EvaluatePreparedModel(preparedModel, is_ignored, examples,
+                          model.relaxComputationFloat32toFloat16);
 }
 
 }  // namespace generated_tests
diff --git a/neuralnetworks/1.0/vts/functional/GeneratedTests.cpp b/neuralnetworks/1.0/vts/functional/GeneratedTests.cpp
index ac1ae60..26b4d8b 100644
--- a/neuralnetworks/1.0/vts/functional/GeneratedTests.cpp
+++ b/neuralnetworks/1.0/vts/functional/GeneratedTests.cpp
@@ -45,6 +45,8 @@
 using ::android::nn::allocateSharedMemory;
 using ::test_helper::MixedTypedExample;
 
+std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
+
 // in frameworks/ml/nn/runtime/tests/generated/
 #include "all_generated_V1_0_vts_tests.cpp"
 
diff --git a/neuralnetworks/1.0/vts/functional/Models.h b/neuralnetworks/1.0/vts/functional/Models.h
deleted file mode 100644
index 268e671..0000000
--- a/neuralnetworks/1.0/vts/functional/Models.h
+++ /dev/null
@@ -1,200 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef VTS_HAL_NEURALNETWORKS_V1_0_VTS_FUNCTIONAL_MODELS_H
-#define VTS_HAL_NEURALNETWORKS_V1_0_VTS_FUNCTIONAL_MODELS_H
-
-#define LOG_TAG "neuralnetworks_hidl_hal_test"
-
-#include "TestHarness.h"
-
-#include <android/hardware/neuralnetworks/1.0/types.h>
-
-namespace android {
-namespace hardware {
-namespace neuralnetworks {
-namespace V1_0 {
-namespace vts {
-namespace functional {
-
-using MixedTypedExample = test_helper::MixedTypedExample;
-
-#define FOR_EACH_TEST_MODEL(FN)                          \
-    FN(add_broadcast_quant8)                             \
-    FN(add)                                              \
-    FN(add_quant8)                                       \
-    FN(avg_pool_float_1)                                 \
-    FN(avg_pool_float_2)                                 \
-    FN(avg_pool_float_3)                                 \
-    FN(avg_pool_float_4)                                 \
-    FN(avg_pool_float_5)                                 \
-    FN(avg_pool_quant8_1)                                \
-    FN(avg_pool_quant8_2)                                \
-    FN(avg_pool_quant8_3)                                \
-    FN(avg_pool_quant8_4)                                \
-    FN(avg_pool_quant8_5)                                \
-    FN(concat_float_1)                                   \
-    FN(concat_float_2)                                   \
-    FN(concat_float_3)                                   \
-    FN(concat_quant8_1)                                  \
-    FN(concat_quant8_2)                                  \
-    FN(concat_quant8_3)                                  \
-    FN(conv_1_h3_w2_SAME)                                \
-    FN(conv_1_h3_w2_VALID)                               \
-    FN(conv_3_h3_w2_SAME)                                \
-    FN(conv_3_h3_w2_VALID)                               \
-    FN(conv_float_2)                                     \
-    FN(conv_float_channels)                              \
-    FN(conv_float_channels_weights_as_inputs)            \
-    FN(conv_float_large)                                 \
-    FN(conv_float_large_weights_as_inputs)               \
-    FN(conv_float)                                       \
-    FN(conv_float_weights_as_inputs)                     \
-    FN(conv_quant8_2)                                    \
-    FN(conv_quant8_channels)                             \
-    FN(conv_quant8_channels_weights_as_inputs)           \
-    FN(conv_quant8_large)                                \
-    FN(conv_quant8_large_weights_as_inputs)              \
-    FN(conv_quant8)                                      \
-    FN(conv_quant8_overflow)                             \
-    FN(conv_quant8_overflow_weights_as_inputs)           \
-    FN(conv_quant8_weights_as_inputs)                    \
-    FN(depth_to_space_float_1)                           \
-    FN(depth_to_space_float_2)                           \
-    FN(depth_to_space_float_3)                           \
-    FN(depth_to_space_quant8_1)                          \
-    FN(depth_to_space_quant8_2)                          \
-    FN(depthwise_conv2d_float_2)                         \
-    FN(depthwise_conv2d_float_large_2)                   \
-    FN(depthwise_conv2d_float_large_2_weights_as_inputs) \
-    FN(depthwise_conv2d_float_large)                     \
-    FN(depthwise_conv2d_float_large_weights_as_inputs)   \
-    FN(depthwise_conv2d_float)                           \
-    FN(depthwise_conv2d_float_weights_as_inputs)         \
-    FN(depthwise_conv2d_quant8_2)                        \
-    FN(depthwise_conv2d_quant8_large)                    \
-    FN(depthwise_conv2d_quant8_large_weights_as_inputs)  \
-    FN(depthwise_conv2d_quant8)                          \
-    FN(depthwise_conv2d_quant8_weights_as_inputs)        \
-    FN(depthwise_conv)                                   \
-    FN(dequantize)                                       \
-    FN(embedding_lookup)                                 \
-    FN(floor)                                            \
-    FN(fully_connected_float_2)                          \
-    FN(fully_connected_float_large)                      \
-    FN(fully_connected_float_large_weights_as_inputs)    \
-    FN(fully_connected_float)                            \
-    FN(fully_connected_float_weights_as_inputs)          \
-    FN(fully_connected_quant8_2)                         \
-    FN(fully_connected_quant8_large)                     \
-    FN(fully_connected_quant8_large_weights_as_inputs)   \
-    FN(fully_connected_quant8)                           \
-    FN(fully_connected_quant8_weights_as_inputs)         \
-    FN(hashtable_lookup_float)                           \
-    FN(hashtable_lookup_quant8)                          \
-    FN(l2_normalization_2)                               \
-    FN(l2_normalization_large)                           \
-    FN(l2_normalization)                                 \
-    FN(l2_pool_float_2)                                  \
-    FN(l2_pool_float_large)                              \
-    FN(l2_pool_float)                                    \
-    FN(local_response_norm_float_1)                      \
-    FN(local_response_norm_float_2)                      \
-    FN(local_response_norm_float_3)                      \
-    FN(local_response_norm_float_4)                      \
-    FN(logistic_float_1)                                 \
-    FN(logistic_float_2)                                 \
-    FN(logistic_quant8_1)                                \
-    FN(logistic_quant8_2)                                \
-    FN(lsh_projection_2)                                 \
-    FN(lsh_projection)                                   \
-    FN(lsh_projection_weights_as_inputs)                 \
-    FN(lstm2)                                            \
-    FN(lstm2_state2)                                     \
-    FN(lstm2_state)                                      \
-    FN(lstm3)                                            \
-    FN(lstm3_state2)                                     \
-    FN(lstm3_state3)                                     \
-    FN(lstm3_state)                                      \
-    FN(lstm)                                             \
-    FN(lstm_state2)                                      \
-    FN(lstm_state)                                       \
-    FN(max_pool_float_1)                                 \
-    FN(max_pool_float_2)                                 \
-    FN(max_pool_float_3)                                 \
-    FN(max_pool_float_4)                                 \
-    FN(max_pool_quant8_1)                                \
-    FN(max_pool_quant8_2)                                \
-    FN(max_pool_quant8_3)                                \
-    FN(max_pool_quant8_4)                                \
-    FN(mobilenet_224_gender_basic_fixed)                 \
-    FN(mobilenet_quantized)                              \
-    FN(mul_broadcast_quant8)                             \
-    FN(mul)                                              \
-    FN(mul_quant8)                                       \
-    FN(mul_relu)                                         \
-    FN(relu1_float_1)                                    \
-    FN(relu1_float_2)                                    \
-    FN(relu1_quant8_1)                                   \
-    FN(relu1_quant8_2)                                   \
-    FN(relu6_float_1)                                    \
-    FN(relu6_float_2)                                    \
-    FN(relu6_quant8_1)                                   \
-    FN(relu6_quant8_2)                                   \
-    FN(relu_float_1)                                     \
-    FN(relu_float_2)                                     \
-    FN(relu_quant8_1)                                    \
-    FN(relu_quant8_2)                                    \
-    FN(reshape)                                          \
-    FN(reshape_quant8)                                   \
-    FN(reshape_quant8_weights_as_inputs)                 \
-    FN(reshape_weights_as_inputs)                        \
-    FN(resize_bilinear_2)                                \
-    FN(resize_bilinear)                                  \
-    FN(rnn)                                              \
-    FN(rnn_state)                                        \
-    FN(softmax_float_1)                                  \
-    FN(softmax_float_2)                                  \
-    FN(softmax_quant8_1)                                 \
-    FN(softmax_quant8_2)                                 \
-    FN(space_to_depth_float_1)                           \
-    FN(space_to_depth_float_2)                           \
-    FN(space_to_depth_float_3)                           \
-    FN(space_to_depth_quant8_1)                          \
-    FN(space_to_depth_quant8_2)                          \
-    FN(svdf2)                                            \
-    FN(svdf)                                             \
-    FN(svdf_state)                                       \
-    FN(tanh)
-
-#define FORWARD_DECLARE_GENERATED_OBJECTS(function) \
-    namespace function {                            \
-    extern std::vector<MixedTypedExample> examples; \
-    Model createTestModel();                        \
-    }
-
-FOR_EACH_TEST_MODEL(FORWARD_DECLARE_GENERATED_OBJECTS)
-
-#undef FORWARD_DECLARE_GENERATED_OBJECTS
-
-}  // namespace functional
-}  // namespace vts
-}  // namespace V1_0
-}  // namespace neuralnetworks
-}  // namespace hardware
-}  // namespace android
-
-#endif  // VTS_HAL_NEURALNETWORKS_V1_0_VTS_FUNCTIONAL_MODELS_H
diff --git a/neuralnetworks/1.0/vts/functional/ValidationTests.cpp b/neuralnetworks/1.0/vts/functional/ValidationTests.cpp
deleted file mode 100644
index d3cbcff..0000000
--- a/neuralnetworks/1.0/vts/functional/ValidationTests.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "neuralnetworks_hidl_hal_test"
-
-#include "Models.h"
-#include "VtsHalNeuralnetworks.h"
-
-namespace android {
-namespace hardware {
-namespace neuralnetworks {
-namespace V1_0 {
-namespace vts {
-namespace functional {
-
-// forward declarations
-std::vector<Request> createRequests(const std::vector<::test_helper::MixedTypedExample>& examples);
-
-// generate validation tests
-#define VTS_CURRENT_TEST_CASE(TestName)                                           \
-    TEST_F(ValidationTest, TestName) {                                            \
-        const Model model = TestName::createTestModel();                          \
-        const std::vector<Request> requests = createRequests(TestName::examples); \
-        validateModel(model);                                                     \
-        validateRequests(model, requests);                                        \
-    }
-
-FOR_EACH_TEST_MODEL(VTS_CURRENT_TEST_CASE)
-
-#undef VTS_CURRENT_TEST_CASE
-
-}  // namespace functional
-}  // namespace vts
-}  // namespace V1_0
-}  // namespace neuralnetworks
-}  // namespace hardware
-}  // namespace android
diff --git a/neuralnetworks/1.1/vts/functional/Android.bp b/neuralnetworks/1.1/vts/functional/Android.bp
index a1c0f1f..07c9b6e 100644
--- a/neuralnetworks/1.1/vts/functional/Android.bp
+++ b/neuralnetworks/1.1/vts/functional/Android.bp
@@ -14,40 +14,21 @@
 // limitations under the License.
 //
 
+// Tests for V1_0 models using the V1_1 HAL.
+cc_test {
+    name: "VtsHalNeuralnetworksV1_1CompatV1_0TargetTest",
+    defaults: ["VtsHalNeuralNetworksTargetTestDefaults"],
+    srcs: [
+        "GeneratedTestsV1_0.cpp",
+    ],
+}
+
+// Tests for V1_1 models.
 cc_test {
     name: "VtsHalNeuralnetworksV1_1TargetTest",
+    defaults: ["VtsHalNeuralNetworksTargetTestDefaults"],
     srcs: [
         "BasicTests.cpp",
         "GeneratedTests.cpp",
-        "ValidateModel.cpp",
-        "ValidateRequest.cpp",
-        "ValidationTests.cpp",
-        "VtsHalNeuralnetworks.cpp",
     ],
-    defaults: ["VtsHalTargetTestDefaults"],
-    static_libs: [
-        "android.hardware.neuralnetworks@1.0",
-        "android.hardware.neuralnetworks@1.1",
-        "android.hardware.neuralnetworks@1.2",
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
-        "libgmock",
-        "libhidlmemory",
-        "libneuralnetworks_utils",
-        "VtsHalNeuralnetworksTest_utils",
-    ],
-    header_libs: [
-        "libneuralnetworks_headers",
-        "libneuralnetworks_generated_test_harness_headers",
-        "libneuralnetworks_generated_tests",
-    ],
-    // Bug: http://b/74200014 - Disable arm32 asan since it triggers internal
-    // error in ld.gold.
-    arch: {
-        arm: {
-            sanitize: {
-                never: true,
-            },
-        },
-    },
 }
diff --git a/neuralnetworks/1.1/vts/functional/GeneratedTests.cpp b/neuralnetworks/1.1/vts/functional/GeneratedTests.cpp
index 1f49904..290a9d3 100644
--- a/neuralnetworks/1.1/vts/functional/GeneratedTests.cpp
+++ b/neuralnetworks/1.1/vts/functional/GeneratedTests.cpp
@@ -45,8 +45,9 @@
 using ::android::nn::allocateSharedMemory;
 using ::test_helper::MixedTypedExample;
 
+std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
+
 // in frameworks/ml/nn/runtime/tests/generated/
-#include "all_generated_V1_0_vts_tests.cpp"
 #include "all_generated_V1_1_vts_tests.cpp"
 
 }  // namespace functional
diff --git a/neuralnetworks/1.1/vts/functional/GeneratedTestsV1_0.cpp b/neuralnetworks/1.1/vts/functional/GeneratedTestsV1_0.cpp
new file mode 100644
index 0000000..a36b24c
--- /dev/null
+++ b/neuralnetworks/1.1/vts/functional/GeneratedTestsV1_0.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "neuralnetworks_hidl_hal_test"
+
+#include "VtsHalNeuralnetworks.h"
+
+#include "Callbacks.h"
+#include "TestHarness.h"
+#include "Utils.h"
+
+#include <android-base/logging.h>
+#include <android/hidl/memory/1.0/IMemory.h>
+#include <hidlmemory/mapping.h>
+
+namespace android {
+namespace hardware {
+namespace neuralnetworks {
+
+namespace generated_tests {
+using ::test_helper::MixedTypedExample;
+extern void Execute(const sp<V1_1::IDevice>&, std::function<V1_1::Model(void)>,
+                    std::function<bool(int)>, const std::vector<MixedTypedExample>&);
+}  // namespace generated_tests
+
+namespace V1_1 {
+namespace vts {
+namespace functional {
+
+using ::android::hardware::neuralnetworks::V1_0::implementation::ExecutionCallback;
+using ::android::hardware::neuralnetworks::V1_0::implementation::PreparedModelCallback;
+using ::android::nn::allocateSharedMemory;
+using ::test_helper::MixedTypedExample;
+
+std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
+
+// in frameworks/ml/nn/runtime/tests/generated/
+#include "all_generated_V1_0_vts_tests.cpp"
+
+}  // namespace functional
+}  // namespace vts
+}  // namespace V1_1
+}  // namespace neuralnetworks
+}  // namespace hardware
+}  // namespace android
diff --git a/neuralnetworks/1.1/vts/functional/Models.h b/neuralnetworks/1.1/vts/functional/Models.h
deleted file mode 100644
index 62bc95e..0000000
--- a/neuralnetworks/1.1/vts/functional/Models.h
+++ /dev/null
@@ -1,377 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef VTS_HAL_NEURALNETWORKS_V1_1_VTS_FUNCTIONAL_MODELS_H
-#define VTS_HAL_NEURALNETWORKS_V1_1_VTS_FUNCTIONAL_MODELS_H
-
-#define LOG_TAG "neuralnetworks_hidl_hal_test"
-
-#include "TestHarness.h"
-
-#include <android/hardware/neuralnetworks/1.0/types.h>
-#include <android/hardware/neuralnetworks/1.1/types.h>
-
-namespace android {
-namespace hardware {
-namespace neuralnetworks {
-namespace V1_1 {
-namespace vts {
-namespace functional {
-
-using MixedTypedExample = test_helper::MixedTypedExample;
-
-#define FOR_EACH_TEST_MODEL(FN)                                  \
-    FN(add)                                                      \
-    FN(add_broadcast_quant8)                                     \
-    FN(add_quant8)                                               \
-    FN(add_relaxed)                                              \
-    FN(avg_pool_float_1)                                         \
-    FN(avg_pool_float_1_relaxed)                                 \
-    FN(avg_pool_float_2)                                         \
-    FN(avg_pool_float_2_relaxed)                                 \
-    FN(avg_pool_float_3)                                         \
-    FN(avg_pool_float_3_relaxed)                                 \
-    FN(avg_pool_float_4)                                         \
-    FN(avg_pool_float_4_relaxed)                                 \
-    FN(avg_pool_float_5)                                         \
-    FN(avg_pool_float_5_relaxed)                                 \
-    FN(avg_pool_quant8_1)                                        \
-    FN(avg_pool_quant8_2)                                        \
-    FN(avg_pool_quant8_3)                                        \
-    FN(avg_pool_quant8_4)                                        \
-    FN(avg_pool_quant8_5)                                        \
-    FN(batch_to_space)                                           \
-    FN(batch_to_space_float_1)                                   \
-    FN(batch_to_space_float_1_relaxed)                           \
-    FN(batch_to_space_quant8_1)                                  \
-    FN(batch_to_space_relaxed)                                   \
-    FN(concat_float_1)                                           \
-    FN(concat_float_1_relaxed)                                   \
-    FN(concat_float_2)                                           \
-    FN(concat_float_2_relaxed)                                   \
-    FN(concat_float_3)                                           \
-    FN(concat_float_3_relaxed)                                   \
-    FN(concat_quant8_1)                                          \
-    FN(concat_quant8_2)                                          \
-    FN(concat_quant8_3)                                          \
-    FN(conv_1_h3_w2_SAME)                                        \
-    FN(conv_1_h3_w2_SAME_relaxed)                                \
-    FN(conv_1_h3_w2_VALID)                                       \
-    FN(conv_1_h3_w2_VALID_relaxed)                               \
-    FN(conv_3_h3_w2_SAME)                                        \
-    FN(conv_3_h3_w2_SAME_relaxed)                                \
-    FN(conv_3_h3_w2_VALID)                                       \
-    FN(conv_3_h3_w2_VALID_relaxed)                               \
-    FN(conv_float)                                               \
-    FN(conv_float_2)                                             \
-    FN(conv_float_2_relaxed)                                     \
-    FN(conv_float_channels)                                      \
-    FN(conv_float_channels_relaxed)                              \
-    FN(conv_float_channels_weights_as_inputs)                    \
-    FN(conv_float_channels_weights_as_inputs_relaxed)            \
-    FN(conv_float_large)                                         \
-    FN(conv_float_large_relaxed)                                 \
-    FN(conv_float_large_weights_as_inputs)                       \
-    FN(conv_float_large_weights_as_inputs_relaxed)               \
-    FN(conv_float_relaxed)                                       \
-    FN(conv_float_weights_as_inputs)                             \
-    FN(conv_float_weights_as_inputs_relaxed)                     \
-    FN(conv_quant8)                                              \
-    FN(conv_quant8_2)                                            \
-    FN(conv_quant8_channels)                                     \
-    FN(conv_quant8_channels_weights_as_inputs)                   \
-    FN(conv_quant8_large)                                        \
-    FN(conv_quant8_large_weights_as_inputs)                      \
-    FN(conv_quant8_overflow)                                     \
-    FN(conv_quant8_overflow_weights_as_inputs)                   \
-    FN(conv_quant8_weights_as_inputs)                            \
-    FN(depth_to_space_float_1)                                   \
-    FN(depth_to_space_float_1_relaxed)                           \
-    FN(depth_to_space_float_2)                                   \
-    FN(depth_to_space_float_2_relaxed)                           \
-    FN(depth_to_space_float_3)                                   \
-    FN(depth_to_space_float_3_relaxed)                           \
-    FN(depth_to_space_quant8_1)                                  \
-    FN(depth_to_space_quant8_2)                                  \
-    FN(depthwise_conv)                                           \
-    FN(depthwise_conv2d_float)                                   \
-    FN(depthwise_conv2d_float_2)                                 \
-    FN(depthwise_conv2d_float_2_relaxed)                         \
-    FN(depthwise_conv2d_float_large)                             \
-    FN(depthwise_conv2d_float_large_2)                           \
-    FN(depthwise_conv2d_float_large_2_relaxed)                   \
-    FN(depthwise_conv2d_float_large_2_weights_as_inputs)         \
-    FN(depthwise_conv2d_float_large_2_weights_as_inputs_relaxed) \
-    FN(depthwise_conv2d_float_large_relaxed)                     \
-    FN(depthwise_conv2d_float_large_weights_as_inputs)           \
-    FN(depthwise_conv2d_float_large_weights_as_inputs_relaxed)   \
-    FN(depthwise_conv2d_float_relaxed)                           \
-    FN(depthwise_conv2d_float_weights_as_inputs)                 \
-    FN(depthwise_conv2d_float_weights_as_inputs_relaxed)         \
-    FN(depthwise_conv2d_quant8)                                  \
-    FN(depthwise_conv2d_quant8_2)                                \
-    FN(depthwise_conv2d_quant8_large)                            \
-    FN(depthwise_conv2d_quant8_large_weights_as_inputs)          \
-    FN(depthwise_conv2d_quant8_weights_as_inputs)                \
-    FN(depthwise_conv_relaxed)                                   \
-    FN(dequantize)                                               \
-    FN(dequantize_relaxed)                                       \
-    FN(div)                                                      \
-    FN(div_broadcast_float)                                      \
-    FN(div_broadcast_float_relaxed)                              \
-    FN(div_relaxed)                                              \
-    FN(embedding_lookup)                                         \
-    FN(embedding_lookup_relaxed)                                 \
-    FN(floor)                                                    \
-    FN(floor_relaxed)                                            \
-    FN(fully_connected_float)                                    \
-    FN(fully_connected_float_2)                                  \
-    FN(fully_connected_float_2_relaxed)                          \
-    FN(fully_connected_float_4d_simple)                          \
-    FN(fully_connected_float_4d_simple_relaxed)                  \
-    FN(fully_connected_float_large)                              \
-    FN(fully_connected_float_large_relaxed)                      \
-    FN(fully_connected_float_large_weights_as_inputs)            \
-    FN(fully_connected_float_large_weights_as_inputs_relaxed)    \
-    FN(fully_connected_float_relaxed)                            \
-    FN(fully_connected_float_weights_as_inputs)                  \
-    FN(fully_connected_float_weights_as_inputs_relaxed)          \
-    FN(fully_connected_quant8)                                   \
-    FN(fully_connected_quant8_2)                                 \
-    FN(fully_connected_quant8_large)                             \
-    FN(fully_connected_quant8_large_weights_as_inputs)           \
-    FN(fully_connected_quant8_weights_as_inputs)                 \
-    FN(hashtable_lookup_float)                                   \
-    FN(hashtable_lookup_float_relaxed)                           \
-    FN(hashtable_lookup_quant8)                                  \
-    FN(l2_normalization)                                         \
-    FN(l2_normalization_2)                                       \
-    FN(l2_normalization_2_relaxed)                               \
-    FN(l2_normalization_large)                                   \
-    FN(l2_normalization_large_relaxed)                           \
-    FN(l2_normalization_relaxed)                                 \
-    FN(l2_pool_float)                                            \
-    FN(l2_pool_float_2)                                          \
-    FN(l2_pool_float_2_relaxed)                                  \
-    FN(l2_pool_float_large)                                      \
-    FN(l2_pool_float_large_relaxed)                              \
-    FN(l2_pool_float_relaxed)                                    \
-    FN(local_response_norm_float_1)                              \
-    FN(local_response_norm_float_1_relaxed)                      \
-    FN(local_response_norm_float_2)                              \
-    FN(local_response_norm_float_2_relaxed)                      \
-    FN(local_response_norm_float_3)                              \
-    FN(local_response_norm_float_3_relaxed)                      \
-    FN(local_response_norm_float_4)                              \
-    FN(local_response_norm_float_4_relaxed)                      \
-    FN(logistic_float_1)                                         \
-    FN(logistic_float_1_relaxed)                                 \
-    FN(logistic_float_2)                                         \
-    FN(logistic_float_2_relaxed)                                 \
-    FN(logistic_quant8_1)                                        \
-    FN(logistic_quant8_2)                                        \
-    FN(lsh_projection)                                           \
-    FN(lsh_projection_2)                                         \
-    FN(lsh_projection_2_relaxed)                                 \
-    FN(lsh_projection_relaxed)                                   \
-    FN(lsh_projection_weights_as_inputs)                         \
-    FN(lsh_projection_weights_as_inputs_relaxed)                 \
-    FN(lstm)                                                     \
-    FN(lstm2)                                                    \
-    FN(lstm2_relaxed)                                            \
-    FN(lstm2_state)                                              \
-    FN(lstm2_state2)                                             \
-    FN(lstm2_state2_relaxed)                                     \
-    FN(lstm2_state_relaxed)                                      \
-    FN(lstm3)                                                    \
-    FN(lstm3_relaxed)                                            \
-    FN(lstm3_state)                                              \
-    FN(lstm3_state2)                                             \
-    FN(lstm3_state2_relaxed)                                     \
-    FN(lstm3_state3)                                             \
-    FN(lstm3_state3_relaxed)                                     \
-    FN(lstm3_state_relaxed)                                      \
-    FN(lstm_relaxed)                                             \
-    FN(lstm_state)                                               \
-    FN(lstm_state2)                                              \
-    FN(lstm_state2_relaxed)                                      \
-    FN(lstm_state_relaxed)                                       \
-    FN(max_pool_float_1)                                         \
-    FN(max_pool_float_1_relaxed)                                 \
-    FN(max_pool_float_2)                                         \
-    FN(max_pool_float_2_relaxed)                                 \
-    FN(max_pool_float_3)                                         \
-    FN(max_pool_float_3_relaxed)                                 \
-    FN(max_pool_float_4)                                         \
-    FN(max_pool_float_4_relaxed)                                 \
-    FN(max_pool_quant8_1)                                        \
-    FN(max_pool_quant8_2)                                        \
-    FN(max_pool_quant8_3)                                        \
-    FN(max_pool_quant8_4)                                        \
-    FN(mean)                                                     \
-    FN(mean_float_1)                                             \
-    FN(mean_float_1_relaxed)                                     \
-    FN(mean_float_2)                                             \
-    FN(mean_float_2_relaxed)                                     \
-    FN(mean_quant8_1)                                            \
-    FN(mean_quant8_2)                                            \
-    FN(mean_relaxed)                                             \
-    FN(mobilenet_224_gender_basic_fixed)                         \
-    FN(mobilenet_224_gender_basic_fixed_relaxed)                 \
-    FN(mobilenet_quantized)                                      \
-    FN(mul)                                                      \
-    FN(mul_broadcast_quant8)                                     \
-    FN(mul_quant8)                                               \
-    FN(mul_relaxed)                                              \
-    FN(mul_relu)                                                 \
-    FN(mul_relu_relaxed)                                         \
-    FN(pad)                                                      \
-    FN(pad_float_1)                                              \
-    FN(pad_float_1_relaxed)                                      \
-    FN(pad_relaxed)                                              \
-    FN(relu1_float_1)                                            \
-    FN(relu1_float_1_relaxed)                                    \
-    FN(relu1_float_2)                                            \
-    FN(relu1_float_2_relaxed)                                    \
-    FN(relu1_quant8_1)                                           \
-    FN(relu1_quant8_2)                                           \
-    FN(relu6_float_1)                                            \
-    FN(relu6_float_1_relaxed)                                    \
-    FN(relu6_float_2)                                            \
-    FN(relu6_float_2_relaxed)                                    \
-    FN(relu6_quant8_1)                                           \
-    FN(relu6_quant8_2)                                           \
-    FN(relu_float_1)                                             \
-    FN(relu_float_1_relaxed)                                     \
-    FN(relu_float_2)                                             \
-    FN(relu_float_2_relaxed)                                     \
-    FN(relu_quant8_1)                                            \
-    FN(relu_quant8_2)                                            \
-    FN(reshape)                                                  \
-    FN(reshape_quant8)                                           \
-    FN(reshape_quant8_weights_as_inputs)                         \
-    FN(reshape_relaxed)                                          \
-    FN(reshape_weights_as_inputs)                                \
-    FN(reshape_weights_as_inputs_relaxed)                        \
-    FN(resize_bilinear)                                          \
-    FN(resize_bilinear_2)                                        \
-    FN(resize_bilinear_2_relaxed)                                \
-    FN(resize_bilinear_relaxed)                                  \
-    FN(rnn)                                                      \
-    FN(rnn_relaxed)                                              \
-    FN(rnn_state)                                                \
-    FN(rnn_state_relaxed)                                        \
-    FN(softmax_float_1)                                          \
-    FN(softmax_float_1_relaxed)                                  \
-    FN(softmax_float_2)                                          \
-    FN(softmax_float_2_relaxed)                                  \
-    FN(softmax_quant8_1)                                         \
-    FN(softmax_quant8_2)                                         \
-    FN(space_to_batch)                                           \
-    FN(space_to_batch_float_1)                                   \
-    FN(space_to_batch_float_1_relaxed)                           \
-    FN(space_to_batch_float_2)                                   \
-    FN(space_to_batch_float_2_relaxed)                           \
-    FN(space_to_batch_float_3)                                   \
-    FN(space_to_batch_float_3_relaxed)                           \
-    FN(space_to_batch_quant8_1)                                  \
-    FN(space_to_batch_quant8_2)                                  \
-    FN(space_to_batch_quant8_3)                                  \
-    FN(space_to_batch_relaxed)                                   \
-    FN(space_to_depth_float_1)                                   \
-    FN(space_to_depth_float_1_relaxed)                           \
-    FN(space_to_depth_float_2)                                   \
-    FN(space_to_depth_float_2_relaxed)                           \
-    FN(space_to_depth_float_3)                                   \
-    FN(space_to_depth_float_3_relaxed)                           \
-    FN(space_to_depth_quant8_1)                                  \
-    FN(space_to_depth_quant8_2)                                  \
-    FN(squeeze)                                                  \
-    FN(squeeze_float_1)                                          \
-    FN(squeeze_float_1_relaxed)                                  \
-    FN(squeeze_quant8_1)                                         \
-    FN(squeeze_relaxed)                                          \
-    FN(strided_slice)                                            \
-    FN(strided_slice_float_1)                                    \
-    FN(strided_slice_float_10)                                   \
-    FN(strided_slice_float_10_relaxed)                           \
-    FN(strided_slice_float_11)                                   \
-    FN(strided_slice_float_11_relaxed)                           \
-    FN(strided_slice_float_1_relaxed)                            \
-    FN(strided_slice_float_2)                                    \
-    FN(strided_slice_float_2_relaxed)                            \
-    FN(strided_slice_float_3)                                    \
-    FN(strided_slice_float_3_relaxed)                            \
-    FN(strided_slice_float_4)                                    \
-    FN(strided_slice_float_4_relaxed)                            \
-    FN(strided_slice_float_5)                                    \
-    FN(strided_slice_float_5_relaxed)                            \
-    FN(strided_slice_float_6)                                    \
-    FN(strided_slice_float_6_relaxed)                            \
-    FN(strided_slice_float_7)                                    \
-    FN(strided_slice_float_7_relaxed)                            \
-    FN(strided_slice_float_8)                                    \
-    FN(strided_slice_float_8_relaxed)                            \
-    FN(strided_slice_float_9)                                    \
-    FN(strided_slice_float_9_relaxed)                            \
-    FN(strided_slice_qaunt8_10)                                  \
-    FN(strided_slice_qaunt8_11)                                  \
-    FN(strided_slice_quant8_1)                                   \
-    FN(strided_slice_quant8_2)                                   \
-    FN(strided_slice_quant8_3)                                   \
-    FN(strided_slice_quant8_4)                                   \
-    FN(strided_slice_quant8_5)                                   \
-    FN(strided_slice_quant8_6)                                   \
-    FN(strided_slice_quant8_7)                                   \
-    FN(strided_slice_quant8_8)                                   \
-    FN(strided_slice_quant8_9)                                   \
-    FN(strided_slice_relaxed)                                    \
-    FN(sub)                                                      \
-    FN(sub_broadcast_float)                                      \
-    FN(sub_broadcast_float_relaxed)                              \
-    FN(sub_relaxed)                                              \
-    FN(svdf)                                                     \
-    FN(svdf2)                                                    \
-    FN(svdf2_relaxed)                                            \
-    FN(svdf_relaxed)                                             \
-    FN(svdf_state)                                               \
-    FN(svdf_state_relaxed)                                       \
-    FN(tanh)                                                     \
-    FN(tanh_relaxed)                                             \
-    FN(transpose)                                                \
-    FN(transpose_float_1)                                        \
-    FN(transpose_float_1_relaxed)                                \
-    FN(transpose_quant8_1)                                       \
-    FN(transpose_relaxed)
-
-#define FORWARD_DECLARE_GENERATED_OBJECTS(function) \
-    namespace function {                            \
-    extern std::vector<MixedTypedExample> examples; \
-    Model createTestModel();                        \
-    }
-
-FOR_EACH_TEST_MODEL(FORWARD_DECLARE_GENERATED_OBJECTS)
-
-#undef FORWARD_DECLARE_GENERATED_OBJECTS
-
-}  // namespace functional
-}  // namespace vts
-}  // namespace V1_1
-}  // namespace neuralnetworks
-}  // namespace hardware
-}  // namespace android
-
-#endif  // VTS_HAL_NEURALNETWORKS_V1_1_VTS_FUNCTIONAL_MODELS_H
diff --git a/neuralnetworks/1.1/vts/functional/ValidationTests.cpp b/neuralnetworks/1.1/vts/functional/ValidationTests.cpp
deleted file mode 100644
index 1c35ba8..0000000
--- a/neuralnetworks/1.1/vts/functional/ValidationTests.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "neuralnetworks_hidl_hal_test"
-
-#include "Models.h"
-#include "VtsHalNeuralnetworks.h"
-
-namespace android {
-namespace hardware {
-namespace neuralnetworks {
-namespace V1_1 {
-namespace vts {
-namespace functional {
-
-// forward declarations
-std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
-
-// generate validation tests
-#define VTS_CURRENT_TEST_CASE(TestName)                                           \
-    TEST_F(ValidationTest, TestName) {                                            \
-        const Model model = TestName::createTestModel();                          \
-        const std::vector<Request> requests = createRequests(TestName::examples); \
-        validateModel(model);                                                     \
-        validateRequests(model, requests);                                        \
-    }
-
-FOR_EACH_TEST_MODEL(VTS_CURRENT_TEST_CASE)
-
-#undef VTS_CURRENT_TEST_CASE
-
-}  // namespace functional
-}  // namespace vts
-}  // namespace V1_1
-}  // namespace neuralnetworks
-}  // namespace hardware
-}  // namespace android
diff --git a/neuralnetworks/1.2/types.hal b/neuralnetworks/1.2/types.hal
index 366e626..fe9b312 100644
--- a/neuralnetworks/1.2/types.hal
+++ b/neuralnetworks/1.2/types.hal
@@ -33,15 +33,13 @@
     /**
      * A tensor of 16 bit signed integers that represent real numbers.
      *
-     * Attached to this tensor are two numbers that are used to convert the 16
-     * bit integer to the real value and vice versa. These two numbers are:
-     * - scale: a 32 bit floating point value greater than zero.
-     * - zeroPoint: a 32 bit integer, in range [-32768, 32767].
+     * Attached to this tensor is a number representing real value scale that is
+     * used to convert the 16 bit number to a real value in the following way:
+     * realValue = integerValue * scale.
      *
-     * The formula is:
-     * realValue = (integerValue - zeroPoint) * scale.
+     * scale is a 32 bit floating point with value greater then zero.
      */
-    TENSOR_QUANT16_ASYMM = 7,
+    TENSOR_QUANT16_SYMM = 7,
     /** A tensor of 16 bit floating point values. */
     TENSOR_FLOAT16 = 8,
 };
diff --git a/neuralnetworks/1.2/vts/functional/Android.bp b/neuralnetworks/1.2/vts/functional/Android.bp
index 09d0dc3..085d5db 100644
--- a/neuralnetworks/1.2/vts/functional/Android.bp
+++ b/neuralnetworks/1.2/vts/functional/Android.bp
@@ -14,40 +14,30 @@
 // limitations under the License.
 //
 
+// Tests for V1_0 models using the V1_2 HAL.
+cc_test {
+    name: "VtsHalNeuralnetworksV1_2CompatV1_0TargetTest",
+    defaults: ["VtsHalNeuralNetworksTargetTestDefaults"],
+    srcs: [
+        "GeneratedTestsV1_0.cpp",
+    ]
+}
+
+// Tests for V1_1 models using the V1_2 HAL.
+cc_test {
+    name: "VtsHalNeuralnetworksV1_2CompatV1_1TargetTest",
+    defaults: ["VtsHalNeuralNetworksTargetTestDefaults"],
+    srcs: [
+        "GeneratedTestsV1_1.cpp",
+    ],
+}
+
+// Tests for V1_2 models.
 cc_test {
     name: "VtsHalNeuralnetworksV1_2TargetTest",
+    defaults: ["VtsHalNeuralNetworksTargetTestDefaults"],
     srcs: [
         "BasicTests.cpp",
         "GeneratedTests.cpp",
-        "ValidateModel.cpp",
-        "ValidateRequest.cpp",
-        "ValidationTests.cpp",
-        "VtsHalNeuralnetworks.cpp",
     ],
-    defaults: ["VtsHalTargetTestDefaults"],
-    static_libs: [
-        "android.hardware.neuralnetworks@1.0",
-        "android.hardware.neuralnetworks@1.1",
-        "android.hardware.neuralnetworks@1.2",
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
-        "libgmock",
-        "libhidlmemory",
-        "libneuralnetworks_utils",
-        "VtsHalNeuralnetworksTest_utils",
-    ],
-    header_libs: [
-        "libneuralnetworks_headers",
-        "libneuralnetworks_generated_test_harness_headers",
-        "libneuralnetworks_generated_tests",
-    ],
-    // Bug: http://b/74200014 - Disable arm32 asan since it triggers internal
-    // error in ld.gold.
-    arch: {
-        arm: {
-            sanitize: {
-                never: true,
-            },
-        },
-    },
 }
diff --git a/neuralnetworks/1.2/vts/functional/GeneratedTests.cpp b/neuralnetworks/1.2/vts/functional/GeneratedTests.cpp
index e87fa6b..79d5a60 100644
--- a/neuralnetworks/1.2/vts/functional/GeneratedTests.cpp
+++ b/neuralnetworks/1.2/vts/functional/GeneratedTests.cpp
@@ -45,9 +45,9 @@
 using ::android::nn::allocateSharedMemory;
 using ::test_helper::MixedTypedExample;
 
+std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
+
 // in frameworks/ml/nn/runtime/tests/generated/
-#include "all_generated_V1_0_vts_tests.cpp"
-#include "all_generated_V1_1_vts_tests.cpp"
 #include "all_generated_V1_2_vts_tests.cpp"
 
 }  // namespace functional
diff --git a/neuralnetworks/1.2/vts/functional/GeneratedTestsV1_0.cpp b/neuralnetworks/1.2/vts/functional/GeneratedTestsV1_0.cpp
new file mode 100644
index 0000000..42e22b0
--- /dev/null
+++ b/neuralnetworks/1.2/vts/functional/GeneratedTestsV1_0.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "neuralnetworks_hidl_hal_test"
+
+#include "VtsHalNeuralnetworks.h"
+
+#include "Callbacks.h"
+#include "TestHarness.h"
+#include "Utils.h"
+
+#include <android-base/logging.h>
+#include <android/hidl/memory/1.0/IMemory.h>
+#include <hidlmemory/mapping.h>
+
+namespace android {
+namespace hardware {
+namespace neuralnetworks {
+
+namespace generated_tests {
+using ::test_helper::MixedTypedExample;
+extern void Execute(const sp<V1_2::IDevice>&, std::function<V1_2::Model(void)>,
+                    std::function<bool(int)>, const std::vector<MixedTypedExample>&);
+}  // namespace generated_tests
+
+namespace V1_2 {
+namespace vts {
+namespace functional {
+
+using ::android::hardware::neuralnetworks::V1_0::implementation::ExecutionCallback;
+using ::android::hardware::neuralnetworks::V1_0::implementation::PreparedModelCallback;
+using ::android::nn::allocateSharedMemory;
+using ::test_helper::MixedTypedExample;
+
+std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
+
+// in frameworks/ml/nn/runtime/tests/generated/
+#include "all_generated_V1_0_vts_tests.cpp"
+
+}  // namespace functional
+}  // namespace vts
+}  // namespace V1_2
+}  // namespace neuralnetworks
+}  // namespace hardware
+}  // namespace android
diff --git a/neuralnetworks/1.2/vts/functional/GeneratedTestsV1_1.cpp b/neuralnetworks/1.2/vts/functional/GeneratedTestsV1_1.cpp
new file mode 100644
index 0000000..aab5cb6
--- /dev/null
+++ b/neuralnetworks/1.2/vts/functional/GeneratedTestsV1_1.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "neuralnetworks_hidl_hal_test"
+
+#include "VtsHalNeuralnetworks.h"
+
+#include "Callbacks.h"
+#include "TestHarness.h"
+#include "Utils.h"
+
+#include <android-base/logging.h>
+#include <android/hidl/memory/1.0/IMemory.h>
+#include <hidlmemory/mapping.h>
+
+namespace android {
+namespace hardware {
+namespace neuralnetworks {
+
+namespace generated_tests {
+using ::test_helper::MixedTypedExample;
+extern void Execute(const sp<V1_2::IDevice>&, std::function<V1_2::Model(void)>,
+                    std::function<bool(int)>, const std::vector<MixedTypedExample>&);
+}  // namespace generated_tests
+
+namespace V1_2 {
+namespace vts {
+namespace functional {
+
+using ::android::hardware::neuralnetworks::V1_0::implementation::ExecutionCallback;
+using ::android::hardware::neuralnetworks::V1_0::implementation::PreparedModelCallback;
+using ::android::nn::allocateSharedMemory;
+using ::test_helper::MixedTypedExample;
+
+std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
+
+// in frameworks/ml/nn/runtime/tests/generated/
+#include "all_generated_V1_1_vts_tests.cpp"
+
+}  // namespace functional
+}  // namespace vts
+}  // namespace V1_2
+}  // namespace neuralnetworks
+}  // namespace hardware
+}  // namespace android
diff --git a/neuralnetworks/1.2/vts/functional/Models.h b/neuralnetworks/1.2/vts/functional/Models.h
deleted file mode 100644
index 2d512fe..0000000
--- a/neuralnetworks/1.2/vts/functional/Models.h
+++ /dev/null
@@ -1,379 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef VTS_HAL_NEURALNETWORKS_V1_2_VTS_FUNCTIONAL_MODELS_H
-#define VTS_HAL_NEURALNETWORKS_V1_2_VTS_FUNCTIONAL_MODELS_H
-
-#define LOG_TAG "neuralnetworks_hidl_hal_test"
-
-#include "TestHarness.h"
-
-#include <android/hardware/neuralnetworks/1.0/types.h>
-#include <android/hardware/neuralnetworks/1.1/types.h>
-#include <android/hardware/neuralnetworks/1.2/types.h>
-
-namespace android {
-namespace hardware {
-namespace neuralnetworks {
-namespace V1_2 {
-namespace vts {
-namespace functional {
-
-using MixedTypedExample = test_helper::MixedTypedExample;
-
-#define FOR_EACH_TEST_MODEL(FN)                                  \
-    FN(add)                                                      \
-    FN(add_broadcast_quant8)                                     \
-    FN(add_quant8)                                               \
-    FN(add_relaxed)                                              \
-    FN(avg_pool_float_1)                                         \
-    FN(avg_pool_float_1_relaxed)                                 \
-    FN(avg_pool_float_2)                                         \
-    FN(avg_pool_float_2_relaxed)                                 \
-    FN(avg_pool_float_3)                                         \
-    FN(avg_pool_float_3_relaxed)                                 \
-    FN(avg_pool_float_4)                                         \
-    FN(avg_pool_float_4_relaxed)                                 \
-    FN(avg_pool_float_5)                                         \
-    FN(avg_pool_float_5_relaxed)                                 \
-    FN(avg_pool_quant8_1)                                        \
-    FN(avg_pool_quant8_2)                                        \
-    FN(avg_pool_quant8_3)                                        \
-    FN(avg_pool_quant8_4)                                        \
-    FN(avg_pool_quant8_5)                                        \
-    FN(batch_to_space)                                           \
-    FN(batch_to_space_float_1)                                   \
-    FN(batch_to_space_float_1_relaxed)                           \
-    FN(batch_to_space_quant8_1)                                  \
-    FN(batch_to_space_relaxed)                                   \
-    FN(concat_float_1)                                           \
-    FN(concat_float_1_relaxed)                                   \
-    FN(concat_float_2)                                           \
-    FN(concat_float_2_relaxed)                                   \
-    FN(concat_float_3)                                           \
-    FN(concat_float_3_relaxed)                                   \
-    FN(concat_quant8_1)                                          \
-    FN(concat_quant8_2)                                          \
-    FN(concat_quant8_3)                                          \
-    FN(conv_1_h3_w2_SAME)                                        \
-    FN(conv_1_h3_w2_SAME_relaxed)                                \
-    FN(conv_1_h3_w2_VALID)                                       \
-    FN(conv_1_h3_w2_VALID_relaxed)                               \
-    FN(conv_3_h3_w2_SAME)                                        \
-    FN(conv_3_h3_w2_SAME_relaxed)                                \
-    FN(conv_3_h3_w2_VALID)                                       \
-    FN(conv_3_h3_w2_VALID_relaxed)                               \
-    FN(conv_float)                                               \
-    FN(conv_float_2)                                             \
-    FN(conv_float_2_relaxed)                                     \
-    FN(conv_float_channels)                                      \
-    FN(conv_float_channels_relaxed)                              \
-    FN(conv_float_channels_weights_as_inputs)                    \
-    FN(conv_float_channels_weights_as_inputs_relaxed)            \
-    FN(conv_float_large)                                         \
-    FN(conv_float_large_relaxed)                                 \
-    FN(conv_float_large_weights_as_inputs)                       \
-    FN(conv_float_large_weights_as_inputs_relaxed)               \
-    FN(conv_float_relaxed)                                       \
-    FN(conv_float_weights_as_inputs)                             \
-    FN(conv_float_weights_as_inputs_relaxed)                     \
-    FN(conv_quant8)                                              \
-    FN(conv_quant8_2)                                            \
-    FN(conv_quant8_channels)                                     \
-    FN(conv_quant8_channels_weights_as_inputs)                   \
-    FN(conv_quant8_large)                                        \
-    FN(conv_quant8_large_weights_as_inputs)                      \
-    FN(conv_quant8_overflow)                                     \
-    FN(conv_quant8_overflow_weights_as_inputs)                   \
-    FN(conv_quant8_weights_as_inputs)                            \
-    FN(depth_to_space_float_1)                                   \
-    FN(depth_to_space_float_1_relaxed)                           \
-    FN(depth_to_space_float_2)                                   \
-    FN(depth_to_space_float_2_relaxed)                           \
-    FN(depth_to_space_float_3)                                   \
-    FN(depth_to_space_float_3_relaxed)                           \
-    FN(depth_to_space_quant8_1)                                  \
-    FN(depth_to_space_quant8_2)                                  \
-    FN(depthwise_conv)                                           \
-    FN(depthwise_conv2d_float)                                   \
-    FN(depthwise_conv2d_float_2)                                 \
-    FN(depthwise_conv2d_float_2_relaxed)                         \
-    FN(depthwise_conv2d_float_large)                             \
-    FN(depthwise_conv2d_float_large_2)                           \
-    FN(depthwise_conv2d_float_large_2_relaxed)                   \
-    FN(depthwise_conv2d_float_large_2_weights_as_inputs)         \
-    FN(depthwise_conv2d_float_large_2_weights_as_inputs_relaxed) \
-    FN(depthwise_conv2d_float_large_relaxed)                     \
-    FN(depthwise_conv2d_float_large_weights_as_inputs)           \
-    FN(depthwise_conv2d_float_large_weights_as_inputs_relaxed)   \
-    FN(depthwise_conv2d_float_relaxed)                           \
-    FN(depthwise_conv2d_float_weights_as_inputs)                 \
-    FN(depthwise_conv2d_float_weights_as_inputs_relaxed)         \
-    FN(depthwise_conv2d_quant8)                                  \
-    FN(depthwise_conv2d_quant8_2)                                \
-    FN(depthwise_conv2d_quant8_large)                            \
-    FN(depthwise_conv2d_quant8_large_weights_as_inputs)          \
-    FN(depthwise_conv2d_quant8_weights_as_inputs)                \
-    FN(depthwise_conv_relaxed)                                   \
-    FN(dequantize)                                               \
-    FN(dequantize_relaxed)                                       \
-    FN(div)                                                      \
-    FN(div_broadcast_float)                                      \
-    FN(div_broadcast_float_relaxed)                              \
-    FN(div_relaxed)                                              \
-    FN(embedding_lookup)                                         \
-    FN(embedding_lookup_relaxed)                                 \
-    FN(floor)                                                    \
-    FN(floor_relaxed)                                            \
-    FN(fully_connected_float)                                    \
-    FN(fully_connected_float_2)                                  \
-    FN(fully_connected_float_2_relaxed)                          \
-    FN(fully_connected_float_4d_simple)                          \
-    FN(fully_connected_float_4d_simple_relaxed)                  \
-    FN(fully_connected_float_large)                              \
-    FN(fully_connected_float_large_relaxed)                      \
-    FN(fully_connected_float_large_weights_as_inputs)            \
-    FN(fully_connected_float_large_weights_as_inputs_relaxed)    \
-    FN(fully_connected_float_relaxed)                            \
-    FN(fully_connected_float_weights_as_inputs)                  \
-    FN(fully_connected_float_weights_as_inputs_relaxed)          \
-    FN(fully_connected_quant8)                                   \
-    FN(fully_connected_quant8_2)                                 \
-    FN(fully_connected_quant8_large)                             \
-    FN(fully_connected_quant8_large_weights_as_inputs)           \
-    FN(fully_connected_quant8_weights_as_inputs)                 \
-    FN(hashtable_lookup_float)                                   \
-    FN(hashtable_lookup_float_relaxed)                           \
-    FN(hashtable_lookup_quant8)                                  \
-    FN(l2_normalization)                                         \
-    FN(l2_normalization_2)                                       \
-    FN(l2_normalization_2_relaxed)                               \
-    FN(l2_normalization_large)                                   \
-    FN(l2_normalization_large_relaxed)                           \
-    FN(l2_normalization_relaxed)                                 \
-    FN(l2_pool_float)                                            \
-    FN(l2_pool_float_2)                                          \
-    FN(l2_pool_float_2_relaxed)                                  \
-    FN(l2_pool_float_large)                                      \
-    FN(l2_pool_float_large_relaxed)                              \
-    FN(l2_pool_float_relaxed)                                    \
-    FN(local_response_norm_float_1)                              \
-    FN(local_response_norm_float_1_relaxed)                      \
-    FN(local_response_norm_float_2)                              \
-    FN(local_response_norm_float_2_relaxed)                      \
-    FN(local_response_norm_float_3)                              \
-    FN(local_response_norm_float_3_relaxed)                      \
-    FN(local_response_norm_float_4)                              \
-    FN(local_response_norm_float_4_relaxed)                      \
-    FN(logistic_float_1)                                         \
-    FN(logistic_float_1_relaxed)                                 \
-    FN(logistic_float_2)                                         \
-    FN(logistic_float_2_relaxed)                                 \
-    FN(logistic_quant8_1)                                        \
-    FN(logistic_quant8_2)                                        \
-    FN(lsh_projection)                                           \
-    FN(lsh_projection_2)                                         \
-    FN(lsh_projection_2_relaxed)                                 \
-    FN(lsh_projection_relaxed)                                   \
-    FN(lsh_projection_weights_as_inputs)                         \
-    FN(lsh_projection_weights_as_inputs_relaxed)                 \
-    FN(lstm)                                                     \
-    FN(lstm2)                                                    \
-    FN(lstm2_relaxed)                                            \
-    FN(lstm2_state)                                              \
-    FN(lstm2_state2)                                             \
-    FN(lstm2_state2_relaxed)                                     \
-    FN(lstm2_state_relaxed)                                      \
-    FN(lstm3)                                                    \
-    FN(lstm3_relaxed)                                            \
-    FN(lstm3_state)                                              \
-    FN(lstm3_state2)                                             \
-    FN(lstm3_state2_relaxed)                                     \
-    FN(lstm3_state3)                                             \
-    FN(lstm3_state3_relaxed)                                     \
-    FN(lstm3_state_relaxed)                                      \
-    FN(lstm_relaxed)                                             \
-    FN(lstm_state)                                               \
-    FN(lstm_state2)                                              \
-    FN(lstm_state2_relaxed)                                      \
-    FN(lstm_state_relaxed)                                       \
-    FN(max_pool_float_1)                                         \
-    FN(max_pool_float_1_relaxed)                                 \
-    FN(max_pool_float_2)                                         \
-    FN(max_pool_float_2_relaxed)                                 \
-    FN(max_pool_float_3)                                         \
-    FN(max_pool_float_3_relaxed)                                 \
-    FN(max_pool_float_4)                                         \
-    FN(max_pool_float_4_relaxed)                                 \
-    FN(max_pool_quant8_1)                                        \
-    FN(max_pool_quant8_2)                                        \
-    FN(max_pool_quant8_3)                                        \
-    FN(max_pool_quant8_4)                                        \
-    FN(mean)                                                     \
-    FN(mean_float_1)                                             \
-    FN(mean_float_1_relaxed)                                     \
-    FN(mean_float_2)                                             \
-    FN(mean_float_2_relaxed)                                     \
-    FN(mean_quant8_1)                                            \
-    FN(mean_quant8_2)                                            \
-    FN(mean_relaxed)                                             \
-    FN(mobilenet_224_gender_basic_fixed)                         \
-    FN(mobilenet_224_gender_basic_fixed_relaxed)                 \
-    FN(mobilenet_quantized)                                      \
-    FN(mul)                                                      \
-    FN(mul_broadcast_quant8)                                     \
-    FN(mul_quant8)                                               \
-    FN(mul_relaxed)                                              \
-    FN(mul_relu)                                                 \
-    FN(mul_relu_relaxed)                                         \
-    FN(pad)                                                      \
-    FN(pad_float_1)                                              \
-    FN(pad_float_1_relaxed)                                      \
-    FN(pad_relaxed)                                              \
-    FN(random_multinomial)                                       \
-    FN(relu1_float_1)                                            \
-    FN(relu1_float_1_relaxed)                                    \
-    FN(relu1_float_2)                                            \
-    FN(relu1_float_2_relaxed)                                    \
-    FN(relu1_quant8_1)                                           \
-    FN(relu1_quant8_2)                                           \
-    FN(relu6_float_1)                                            \
-    FN(relu6_float_1_relaxed)                                    \
-    FN(relu6_float_2)                                            \
-    FN(relu6_float_2_relaxed)                                    \
-    FN(relu6_quant8_1)                                           \
-    FN(relu6_quant8_2)                                           \
-    FN(relu_float_1)                                             \
-    FN(relu_float_1_relaxed)                                     \
-    FN(relu_float_2)                                             \
-    FN(relu_float_2_relaxed)                                     \
-    FN(relu_quant8_1)                                            \
-    FN(relu_quant8_2)                                            \
-    FN(reshape)                                                  \
-    FN(reshape_quant8)                                           \
-    FN(reshape_quant8_weights_as_inputs)                         \
-    FN(reshape_relaxed)                                          \
-    FN(reshape_weights_as_inputs)                                \
-    FN(reshape_weights_as_inputs_relaxed)                        \
-    FN(resize_bilinear)                                          \
-    FN(resize_bilinear_2)                                        \
-    FN(resize_bilinear_2_relaxed)                                \
-    FN(resize_bilinear_relaxed)                                  \
-    FN(rnn)                                                      \
-    FN(rnn_relaxed)                                              \
-    FN(rnn_state)                                                \
-    FN(rnn_state_relaxed)                                        \
-    FN(softmax_float_1)                                          \
-    FN(softmax_float_1_relaxed)                                  \
-    FN(softmax_float_2)                                          \
-    FN(softmax_float_2_relaxed)                                  \
-    FN(softmax_quant8_1)                                         \
-    FN(softmax_quant8_2)                                         \
-    FN(space_to_batch)                                           \
-    FN(space_to_batch_float_1)                                   \
-    FN(space_to_batch_float_1_relaxed)                           \
-    FN(space_to_batch_float_2)                                   \
-    FN(space_to_batch_float_2_relaxed)                           \
-    FN(space_to_batch_float_3)                                   \
-    FN(space_to_batch_float_3_relaxed)                           \
-    FN(space_to_batch_quant8_1)                                  \
-    FN(space_to_batch_quant8_2)                                  \
-    FN(space_to_batch_quant8_3)                                  \
-    FN(space_to_batch_relaxed)                                   \
-    FN(space_to_depth_float_1)                                   \
-    FN(space_to_depth_float_1_relaxed)                           \
-    FN(space_to_depth_float_2)                                   \
-    FN(space_to_depth_float_2_relaxed)                           \
-    FN(space_to_depth_float_3)                                   \
-    FN(space_to_depth_float_3_relaxed)                           \
-    FN(space_to_depth_quant8_1)                                  \
-    FN(space_to_depth_quant8_2)                                  \
-    FN(squeeze)                                                  \
-    FN(squeeze_float_1)                                          \
-    FN(squeeze_float_1_relaxed)                                  \
-    FN(squeeze_quant8_1)                                         \
-    FN(squeeze_relaxed)                                          \
-    FN(strided_slice)                                            \
-    FN(strided_slice_float_1)                                    \
-    FN(strided_slice_float_10)                                   \
-    FN(strided_slice_float_10_relaxed)                           \
-    FN(strided_slice_float_11)                                   \
-    FN(strided_slice_float_11_relaxed)                           \
-    FN(strided_slice_float_1_relaxed)                            \
-    FN(strided_slice_float_2)                                    \
-    FN(strided_slice_float_2_relaxed)                            \
-    FN(strided_slice_float_3)                                    \
-    FN(strided_slice_float_3_relaxed)                            \
-    FN(strided_slice_float_4)                                    \
-    FN(strided_slice_float_4_relaxed)                            \
-    FN(strided_slice_float_5)                                    \
-    FN(strided_slice_float_5_relaxed)                            \
-    FN(strided_slice_float_6)                                    \
-    FN(strided_slice_float_6_relaxed)                            \
-    FN(strided_slice_float_7)                                    \
-    FN(strided_slice_float_7_relaxed)                            \
-    FN(strided_slice_float_8)                                    \
-    FN(strided_slice_float_8_relaxed)                            \
-    FN(strided_slice_float_9)                                    \
-    FN(strided_slice_float_9_relaxed)                            \
-    FN(strided_slice_qaunt8_10)                                  \
-    FN(strided_slice_qaunt8_11)                                  \
-    FN(strided_slice_quant8_1)                                   \
-    FN(strided_slice_quant8_2)                                   \
-    FN(strided_slice_quant8_3)                                   \
-    FN(strided_slice_quant8_4)                                   \
-    FN(strided_slice_quant8_5)                                   \
-    FN(strided_slice_quant8_6)                                   \
-    FN(strided_slice_quant8_7)                                   \
-    FN(strided_slice_quant8_8)                                   \
-    FN(strided_slice_quant8_9)                                   \
-    FN(strided_slice_relaxed)                                    \
-    FN(sub)                                                      \
-    FN(sub_broadcast_float)                                      \
-    FN(sub_broadcast_float_relaxed)                              \
-    FN(sub_relaxed)                                              \
-    FN(svdf)                                                     \
-    FN(svdf2)                                                    \
-    FN(svdf2_relaxed)                                            \
-    FN(svdf_relaxed)                                             \
-    FN(svdf_state)                                               \
-    FN(svdf_state_relaxed)                                       \
-    FN(tanh)                                                     \
-    FN(tanh_relaxed)                                             \
-    FN(transpose)                                                \
-    FN(transpose_float_1)                                        \
-    FN(transpose_float_1_relaxed)                                \
-    FN(transpose_quant8_1)                                       \
-    FN(transpose_relaxed)
-
-#define FORWARD_DECLARE_GENERATED_OBJECTS(function) \
-    namespace function {                            \
-    extern std::vector<MixedTypedExample> examples; \
-    Model createTestModel();                        \
-    }
-
-FOR_EACH_TEST_MODEL(FORWARD_DECLARE_GENERATED_OBJECTS)
-
-#undef FORWARD_DECLARE_GENERATED_OBJECTS
-
-}  // namespace functional
-}  // namespace vts
-}  // namespace V1_2
-}  // namespace neuralnetworks
-}  // namespace hardware
-}  // namespace android
-
-#endif  // VTS_HAL_NEURALNETWORKS_V1_2_VTS_FUNCTIONAL_MODELS_H
diff --git a/neuralnetworks/1.2/vts/functional/ValidateModel.cpp b/neuralnetworks/1.2/vts/functional/ValidateModel.cpp
index 3096028..c4f1b5e 100644
--- a/neuralnetworks/1.2/vts/functional/ValidateModel.cpp
+++ b/neuralnetworks/1.2/vts/functional/ValidateModel.cpp
@@ -161,7 +161,7 @@
         case OperandType::TENSOR_FLOAT32:
         case OperandType::TENSOR_INT32:
         case OperandType::TENSOR_QUANT8_ASYMM:
-        case OperandType::TENSOR_QUANT16_ASYMM:
+        case OperandType::TENSOR_QUANT16_SYMM:
             return 0;
         default:
             return 0;
@@ -193,7 +193,7 @@
         case OperandType::TENSOR_INT32:
             return -1.0f;
         case OperandType::TENSOR_QUANT8_ASYMM:
-        case OperandType::TENSOR_QUANT16_ASYMM:
+        case OperandType::TENSOR_QUANT16_SYMM:
             return 0.0f;
         default:
             return 0.0f;
@@ -224,8 +224,9 @@
         case OperandType::TENSOR_INT32:
             return {1};
         case OperandType::TENSOR_QUANT8_ASYMM:
-        case OperandType::TENSOR_QUANT16_ASYMM:
             return {-1, 256};
+        case OperandType::TENSOR_QUANT16_SYMM:
+            return {-32769, -1, 1, 32768};
         default:
             return {};
     }
@@ -278,7 +279,7 @@
             newOperand.zeroPoint = 0;
             break;
         case OperandType::TENSOR_QUANT8_ASYMM:
-        case OperandType::TENSOR_QUANT16_ASYMM:
+        case OperandType::TENSOR_QUANT16_SYMM:
             newOperand.dimensions =
                 operand->dimensions.size() > 0 ? operand->dimensions : hidl_vec<uint32_t>({1});
             newOperand.scale = operand->scale != 0.0f ? operand->scale : 1.0f;
@@ -291,15 +292,33 @@
     *operand = newOperand;
 }
 
-static bool mutateOperationOperandTypeSkip(size_t operand, const Model& model) {
-    // LSH_PROJECTION's second argument is allowed to have any type. This is the
-    // only operation that currently has a type that can be anything independent
-    // from any other type. Changing the operand type to any other type will
-    // result in a valid model for LSH_PROJECTION. If this is the case, skip the
-    // test.
+static bool mutateOperationOperandTypeSkip(size_t operand, OperandType type, const Model& model) {
+    // Do not test OEM types
+    if (type == model.operands[operand].type || type == OperandType::OEM ||
+        type == OperandType::TENSOR_OEM_BYTE) {
+        return true;
+    }
     for (const Operation& operation : model.operations) {
-        if (operation.type == OperationType::LSH_PROJECTION && operand == operation.inputs[1]) {
-            return true;
+        // Skip mutateOperationOperandTypeTest for the following operations.
+        // - LSH_PROJECTION's second argument is allowed to have any type.
+        // - ARGMIN and ARGMAX's first argument can be any of TENSOR_(FLOAT32|INT32|QUANT8_ASYMM).
+        // - CAST's argument can be any of TENSOR_(FLOAT32|INT32|QUANT8_ASYMM).
+        switch (operation.type) {
+            case OperationType::LSH_PROJECTION: {
+                if (operand == operation.inputs[1]) {
+                    return true;
+                }
+            } break;
+            case OperationType::CAST:
+            case OperationType::ARGMAX:
+            case OperationType::ARGMIN: {
+                if (type == OperandType::TENSOR_FLOAT32 || type == OperandType::TENSOR_INT32 ||
+                    type == OperandType::TENSOR_QUANT8_ASYMM) {
+                    return true;
+                }
+            } break;
+            default:
+                break;
         }
     }
     return false;
@@ -307,14 +326,8 @@
 
 static void mutateOperationOperandTypeTest(const sp<IDevice>& device, const Model& model) {
     for (size_t operand = 0; operand < model.operands.size(); ++operand) {
-        if (mutateOperationOperandTypeSkip(operand, model)) {
-            continue;
-        }
         for (OperandType invalidOperandType : hidl_enum_range<OperandType>{}) {
-            // Do not test OEM types
-            if (invalidOperandType == model.operands[operand].type ||
-                invalidOperandType == OperandType::OEM ||
-                invalidOperandType == OperandType::TENSOR_OEM_BYTE) {
+            if (mutateOperationOperandTypeSkip(operand, invalidOperandType, model)) {
                 continue;
             }
             const std::string message = "mutateOperationOperandTypeTest: operand " +
@@ -406,8 +419,26 @@
     removeValueAndDecrementGreaterValues(&model->outputIndexes, index);
 }
 
+static bool removeOperandSkip(size_t operand, const Model& model) {
+    for (const Operation& operation : model.operations) {
+        // Skip removeOperandTest for the following operations.
+        // - SPLIT's outputs are not checked during prepareModel.
+        if (operation.type == OperationType::SPLIT) {
+            for (const size_t outOprand : operation.outputs) {
+                if (operand == outOprand) {
+                    return true;
+                }
+            }
+        }
+    }
+    return false;
+}
+
 static void removeOperandTest(const sp<IDevice>& device, const Model& model) {
     for (size_t operand = 0; operand < model.operands.size(); ++operand) {
+        if (removeOperandSkip(operand, model)) {
+            continue;
+        }
         const std::string message = "removeOperandTest: operand " + std::to_string(operand);
         validate(device, message, model,
                  [operand](Model* model) { removeOperand(model, operand); });
@@ -433,15 +464,76 @@
 
 ///////////////////////// REMOVE OPERATION INPUT /////////////////////////
 
+static bool removeOperationInputSkip(const Operation& op, size_t input) {
+    // Skip removeOperationInputTest for the following operations.
+    // - CONCATENATION has at least 2 inputs, with the last element being INT32.
+    // - CONV_2D, DEPTHWISE_CONV_2D, MAX_POOL_2D, AVERAGE_POOL_2D, L2_POOL_2D, RESIZE_BILINEAR,
+    //   SPACE_TO_DEPTH, SPACE_TO_DEPTH, SPACE_TO_BATCH_ND, BATCH_TO_SPACE_ND can have an optional
+    //   layout parameter.
+    // - L2_NORMALIZATION, LOCAL_RESPONSE_NORMALIZATION, SOFTMAX can have an optional axis
+    //   parameter.
+    switch (op.type) {
+        case OperationType::CONCATENATION: {
+            if (op.inputs.size() > 2 && input != op.inputs.size() - 1) {
+                return true;
+            }
+        } break;
+        case OperationType::DEPTHWISE_CONV_2D: {
+            if ((op.inputs.size() == 12 && input == 11) || (op.inputs.size() == 9 && input == 8)) {
+                return true;
+            }
+        } break;
+        case OperationType::CONV_2D:
+        case OperationType::AVERAGE_POOL_2D:
+        case OperationType::MAX_POOL_2D:
+        case OperationType::L2_POOL_2D: {
+            if ((op.inputs.size() == 11 && input == 10) || (op.inputs.size() == 8 && input == 7)) {
+                return true;
+            }
+        } break;
+        case OperationType::RESIZE_BILINEAR: {
+            if (op.inputs.size() == 4 && input == 3) {
+                return true;
+            }
+        } break;
+        case OperationType::SPACE_TO_DEPTH:
+        case OperationType::DEPTH_TO_SPACE:
+        case OperationType::BATCH_TO_SPACE_ND: {
+            if (op.inputs.size() == 3 && input == 2) {
+                return true;
+            }
+        } break;
+        case OperationType::SPACE_TO_BATCH_ND: {
+            if (op.inputs.size() == 4 && input == 3) {
+                return true;
+            }
+        } break;
+        case OperationType::L2_NORMALIZATION: {
+            if (op.inputs.size() == 2 && input == 1) {
+                return true;
+            }
+        } break;
+        case OperationType::LOCAL_RESPONSE_NORMALIZATION: {
+            if (op.inputs.size() == 6 && input == 5) {
+                return true;
+            }
+        } break;
+        case OperationType::SOFTMAX: {
+            if (op.inputs.size() == 3 && input == 2) {
+                return true;
+            }
+        } break;
+        default:
+            break;
+    }
+    return false;
+}
+
 static void removeOperationInputTest(const sp<IDevice>& device, const Model& model) {
     for (size_t operation = 0; operation < model.operations.size(); ++operation) {
         for (size_t input = 0; input < model.operations[operation].inputs.size(); ++input) {
             const Operation& op = model.operations[operation];
-            // CONCATENATION has at least 2 inputs, with the last element being
-            // INT32. Skip this test if removing one of CONCATENATION's
-            // inputs still produces a valid model.
-            if (op.type == OperationType::CONCATENATION && op.inputs.size() > 2 &&
-                input != op.inputs.size() - 1) {
+            if (removeOperationInputSkip(op, input)) {
                 continue;
             }
             const std::string message = "removeOperationInputTest: operation " +
@@ -479,8 +571,23 @@
 
 ///////////////////////// ADD OPERATION INPUT /////////////////////////
 
+static bool addOperationInputSkip(const Operation& op) {
+    // Skip addOperationInputTest for the following operations.
+    // - L2_NORMALIZATION, LOCAL_RESPONSE_NORMALIZATION, SOFTMAX can have an optional INT32 axis
+    //   parameter.
+    if ((op.type == OperationType::L2_NORMALIZATION && op.inputs.size() == 1) ||
+        (op.type == OperationType::LOCAL_RESPONSE_NORMALIZATION && op.inputs.size() == 5) ||
+        (op.type == OperationType::SOFTMAX && op.inputs.size() == 2)) {
+        return true;
+    }
+    return false;
+}
+
 static void addOperationInputTest(const sp<IDevice>& device, const Model& model) {
     for (size_t operation = 0; operation < model.operations.size(); ++operation) {
+        if (addOperationInputSkip(model.operations[operation])) {
+            continue;
+        }
         const std::string message = "addOperationInputTest: operation " + std::to_string(operation);
         validate(device, message, model, [operation](Model* model) {
             uint32_t index = addOperand(model, OperandLifeTime::MODEL_INPUT);
diff --git a/neuralnetworks/1.2/vts/functional/ValidationTests.cpp b/neuralnetworks/1.2/vts/functional/ValidationTests.cpp
deleted file mode 100644
index 3bdc5cd..0000000
--- a/neuralnetworks/1.2/vts/functional/ValidationTests.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "neuralnetworks_hidl_hal_test"
-
-#include "Models.h"
-#include "VtsHalNeuralnetworks.h"
-
-namespace android {
-namespace hardware {
-namespace neuralnetworks {
-namespace V1_2 {
-namespace vts {
-namespace functional {
-
-// forward declarations
-std::vector<Request> createRequests(const std::vector<MixedTypedExample>& examples);
-
-// generate validation tests
-#define VTS_CURRENT_TEST_CASE(TestName)                                           \
-    TEST_F(ValidationTest, TestName) {                                            \
-        const Model model = TestName::createTestModel();                          \
-        const std::vector<Request> requests = createRequests(TestName::examples); \
-        validateModel(model);                                                     \
-        validateRequests(model, requests);                                        \
-    }
-
-FOR_EACH_TEST_MODEL(VTS_CURRENT_TEST_CASE)
-
-#undef VTS_CURRENT_TEST_CASE
-
-}  // namespace functional
-}  // namespace vts
-}  // namespace V1_2
-}  // namespace neuralnetworks
-}  // namespace hardware
-}  // namespace android
diff --git a/power/stats/1.0/Android.bp b/power/stats/1.0/Android.bp
new file mode 100644
index 0000000..9a956e4
--- /dev/null
+++ b/power/stats/1.0/Android.bp
@@ -0,0 +1,29 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.power.stats@1.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IPowerStats.hal",
+    ],
+    interfaces: [
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "EnergyData",
+        "PowerEntityInfo",
+        "PowerEntityStateInfo",
+        "PowerEntityStateResidencyData",
+        "PowerEntityStateResidencyResult",
+        "PowerEntityStateSpace",
+        "PowerEntityType",
+        "RailInfo",
+        "Status",
+    ],
+    gen_java: false,
+}
+
diff --git a/power/stats/1.0/IPowerStats.hal b/power/stats/1.0/IPowerStats.hal
new file mode 100644
index 0000000..75c6a72
--- /dev/null
+++ b/power/stats/1.0/IPowerStats.hal
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.power.stats@1.0;
+
+interface IPowerStats {
+
+    /**
+     * Rail information:
+     * Reports information related to the rails being monitored.
+     *
+     * @return rails Information about monitored rails.
+     * @return status SUCCESS on success or NOT_SUPPORTED if
+     *     feature is not enabled or FILESYSTEM_ERROR on filesystem nodes
+     *     access error.
+     */
+    getRailInfo()
+        generates(vec<RailInfo> rails, Status status);
+
+    /**
+     * Rail level energy measurements for low frequency clients:
+     * Reports accumulated energy since boot on each rail.
+     *
+     * @param railIndices Indices of rails for which data is required.
+     *     To get data for all rails pass an empty vector. Rail name to
+     *     index mapping can be queried from getRailInfo() API.
+     * @return data Energy values since boot for all requested rails.
+     * @return status SUCCESS on success or NOT_SUPPORTED if
+     *     feature is not enabled or FILESYSTEM_ERROR on filesystem nodes
+     *     access error.
+     */
+    getEnergyData(vec<uint32_t> railIndices)
+        generates(vec<EnergyData> data, Status status);
+
+    /**
+     * Stream rail level power measurements for high frequency clients:
+     * Streams accumulated energy since boot on each rail. This API is
+     * asynchronous.
+     *
+     * @param timeMs Time(in ms) for which energyData should be streamed
+     * @param samplingRate Frequency(in Hz) at which samples should be
+     *     captured. If the requested sampling rate is not supported then
+     *     SUCCESS is returned and numSamples are reported back according
+     *     to the supported sampling rate.
+     * @return mqDesc Blocking Synchronous Fast Message Queue descriptor - One
+     *     writer(power.stats HAL) and one reader are supported. Data is
+     *     present in the following format in the queue:
+     *     +-----------------------+       <--
+     *     | EnergyData for rail 1 |         |
+     *     +-----------------------+         |
+     *     | EnergyData for rail 2 |         |
+     *     +-----------------------+         |
+     *     |          .            |         |-- 1st Sample
+     *     |          .            |         |
+     *     |          .            |         |
+     *     +-----------------------+         |
+     *     | EnergyData for rail n |         |
+     *     +-----------------------+       <--
+     *     |          .            |
+     *     |          .            |
+     *     |          .            |
+     *     +-----------------------+       <--
+     *     | EnergyData for rail 1 |         |
+     *     +-----------------------+         |
+     *     | EnergyData for rail 2 |         |
+     *     +-----------------------+         |
+     *     |          .            |         |-- kth Sample
+     *     |          .            |         |
+     *     |          .            |         |
+     *     +-----------------------+         |
+     *     | EnergyData for rail n |         |
+     *     +-----------------------+       <--
+     *
+     *     where,
+     *     n = railsPerSample
+     *     k = numSamples
+     *
+     * @return numSamples Number of samples which will be generated in timeMs.
+     * @return railsPerSample Number of rails measured per sample.
+     * @return status SUCCESS on success or FILESYSTEM_ERROR on filesystem
+     *     nodes access or NOT_SUPPORTED if feature is not enabled or
+     *     INSUFFICIENT_RESOURCES if there are not enough resources.
+     */
+    streamEnergyData(uint32_t timeMs, uint32_t samplingRate)
+        generates(fmq_sync<EnergyData> mqDesc, uint32_t numSamples,
+                uint32_t railsPerSample, Status status);
+
+    /**
+     * PowerEntity information:
+     * Reports information related to all supported PowerEntity(s) for which
+     * data is available. A PowerEntity is defined as a platform subsystem,
+     * peripheral, or power domain that impacts the total device power
+     * consumption.
+     *
+     * @return powerEntityInfos List of information on each PowerEntity
+     * @return status SUCCESS on success or NOT_SUPPORTED if
+     *     feature is not enabled or FILESYSTEM_ERROR on filesystem nodes
+     *     access error.
+     */
+    getPowerEntityInfo()
+        generates(vec<PowerEntityInfo> powerEntityInfos, Status status);
+
+    /**
+     * PowerEntity state information:
+     * Reports the set of power states for which the specified
+     * PowerEntity(s) provide residency data.
+     *
+     * @param powerEntityIds collection of IDs of PowerEntity(s) for which
+     *     state information is requested. PowerEntity name to ID mapping may
+     *     be queried from getPowerEntityInfo(). To get state space
+     *     information for all PowerEntity(s) pass an empty vector.
+     *
+     * @return powerEntityStateSpaces PowerEntity state space information for
+     *     each specified PowerEntity.
+     * @return status SUCCESS if powerEntityStateInfos contains state space
+     *     information for at least one PowerEntity, NOT_SUPPORTED if feature
+     *     is not enabled, INVALID_INPUT if no requested PowerEntity(s)
+     *     provide state space information, FILESYSTEM_ERROR if no state space
+     *     information is returned due to filesystem errors.
+     */
+    getPowerEntityStateInfo(vec<uint32_t> powerEntityIds)
+        generates(vec<PowerEntityStateSpace> powerEntityStateSpaces,
+                  Status status);
+
+    /**
+     * PowerEntity residencies for low frequency clients:
+     * Reports accumulated residency data for each specified PowerEntity.
+     * Each PowerEntity may reside in one of multiple states. It may also
+     * transition to another state. Residency data is an accumulation of time
+     * that a specified PowerEntity resided in each of its possible states,
+     * the number of times that each state was entered, and a timestamp
+     * corresponding to the last time that state was entered. Data is
+     * accumulated starting from the last time the PowerEntity was reset.
+     *
+     * @param powerEntityId collection of IDs of PowerEntity(s) for which
+     *     residency data is requested. PowerEntity name to ID mapping may
+     *     be queried from getPowerEntityInfo(). To get state residency
+     *     data for all PowerEntity(s) pass an empty vector.
+     * @return stateResidencyResults state residency data for the
+     *     specified powerEntity(s)
+     * @return status SUCCESS if stateResidencyResults contains residency
+     *     data for at least one PowerEntity, NOT_SUPPORTED if
+     *     feature is not enabled, INVALID_INPUT if no requested
+     *     PowerEntity(s) provide state residency data, FILESYSTEM_ERROR
+     *     if no data is returned due to filesystem errors.
+     */
+    getPowerEntityStateResidencyData(vec<uint32_t> powerEntityIds)
+        generates(vec<PowerEntityStateResidencyResult> stateResidencyResults,
+                  Status status);
+};
diff --git a/power/stats/1.0/default/Android.bp b/power/stats/1.0/default/Android.bp
new file mode 100644
index 0000000..04270c1
--- /dev/null
+++ b/power/stats/1.0/default/Android.bp
@@ -0,0 +1,34 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+
+cc_library_shared {
+    name: "android.hardware.power.stats@1.0-service",
+    relative_install_path: "hw",
+    init_rc: ["android.hardware.power.stats@1.0-service.rc"],
+    srcs: ["service.cpp", "PowerStats.cpp"],
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libcutils",
+        "libfmq",
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libutils",
+        "android.hardware.power.stats@1.0",
+    ],
+    vendor: true,
+}
diff --git a/power/stats/1.0/default/PowerStats.cpp b/power/stats/1.0/default/PowerStats.cpp
new file mode 100644
index 0000000..810c575
--- /dev/null
+++ b/power/stats/1.0/default/PowerStats.cpp
@@ -0,0 +1,317 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "PowerStats.h"
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/properties.h>
+#include <android-base/stringprintf.h>
+#include <android-base/strings.h>
+#include <inttypes.h>
+#include <stdlib.h>
+#include <algorithm>
+#include <exception>
+#include <thread>
+
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+namespace V1_0 {
+namespace implementation {
+
+#define MAX_FILE_PATH_LEN 128
+#define MAX_DEVICE_NAME_LEN 64
+#define MAX_QUEUE_SIZE 8192
+
+constexpr char kIioDirRoot[] = "/sys/bus/iio/devices/";
+constexpr char kDeviceName[] = "pm_device_name";
+constexpr char kDeviceType[] = "iio:device";
+constexpr uint32_t MAX_SAMPLING_RATE = 10;
+constexpr uint64_t WRITE_TIMEOUT_NS = 1000000000;
+
+void PowerStats::findIioPowerMonitorNodes() {
+    struct dirent* ent;
+    int fd;
+    char devName[MAX_DEVICE_NAME_LEN];
+    char filePath[MAX_FILE_PATH_LEN];
+    DIR* iioDir = opendir(kIioDirRoot);
+    if (!iioDir) {
+        ALOGE("Error opening directory: %s", kIioDirRoot);
+        return;
+    }
+    while (ent = readdir(iioDir), ent) {
+        if (strcmp(ent->d_name, ".") != 0 && strcmp(ent->d_name, "..") != 0 &&
+            strlen(ent->d_name) > strlen(kDeviceType) &&
+            strncmp(ent->d_name, kDeviceType, strlen(kDeviceType)) == 0) {
+            snprintf(filePath, MAX_FILE_PATH_LEN, "%s/%s", ent->d_name, "name");
+            fd = openat(dirfd(iioDir), filePath, O_RDONLY);
+            if (fd < 0) {
+                ALOGW("Failed to open directory: %s", filePath);
+                continue;
+            }
+            if (read(fd, devName, MAX_DEVICE_NAME_LEN) < 0) {
+                ALOGW("Failed to read device name from file: %s(%d)", filePath, fd);
+                close(fd);
+                continue;
+            }
+
+            if (strncmp(devName, kDeviceName, strlen(kDeviceName)) == 0) {
+                snprintf(filePath, MAX_FILE_PATH_LEN, "%s/%s", kIioDirRoot, ent->d_name);
+                mPm.devicePaths.push_back(filePath);
+            }
+            close(fd);
+        }
+    }
+    closedir(iioDir);
+    return;
+}
+
+size_t PowerStats::parsePowerRails() {
+    std::string data;
+    std::string railFileName;
+    std::string spsFileName;
+    uint32_t index = 0;
+    uint32_t samplingRate;
+    for (const auto& path : mPm.devicePaths) {
+        railFileName = path + "/enabled_rails";
+        spsFileName = path + "/sampling_rate";
+        if (!android::base::ReadFileToString(spsFileName, &data)) {
+            ALOGW("Error reading file: %s", spsFileName.c_str());
+            continue;
+        }
+        samplingRate = strtoul(data.c_str(), NULL, 10);
+        if (!samplingRate || samplingRate == ULONG_MAX) {
+            ALOGE("Error parsing: %s", spsFileName.c_str());
+            break;
+        }
+        if (!android::base::ReadFileToString(railFileName, &data)) {
+            ALOGW("Error reading file: %s", railFileName.c_str());
+            continue;
+        }
+        std::istringstream railNames(data);
+        std::string line;
+        while (std::getline(railNames, line)) {
+            std::vector<std::string> words = android::base::Split(line, ":");
+            if (words.size() == 2) {
+                mPm.railsInfo.emplace(words[0], RailData{.devicePath = path,
+                                                         .index = index,
+                                                         .subsysName = words[1],
+                                                         .samplingRate = samplingRate});
+                index++;
+            } else {
+                ALOGW("Unexpected format in file: %s", railFileName.c_str());
+            }
+        }
+    }
+    return index;
+}
+
+int PowerStats::parseIioEnergyNode(std::string devName) {
+    int ret = 0;
+    std::string data;
+    std::string fileName = devName + "/energy_value";
+    if (!android::base::ReadFileToString(fileName, &data)) {
+        ALOGE("Error reading file: %s", fileName.c_str());
+        return -1;
+    }
+
+    std::istringstream energyData(data);
+    std::string line;
+    uint64_t timestamp = 0;
+    bool timestampRead = false;
+    while (std::getline(energyData, line)) {
+        std::vector<std::string> words = android::base::Split(line, ",");
+        if (timestampRead == false) {
+            if (words.size() == 1) {
+                timestamp = strtoull(words[0].c_str(), NULL, 10);
+                if (timestamp == 0 || timestamp == ULLONG_MAX) {
+                    ALOGW("Potentially wrong timestamp: %" PRIu64, timestamp);
+                }
+                timestampRead = true;
+            }
+        } else if (words.size() == 2) {
+            std::string railName = words[0];
+            if (mPm.railsInfo.count(railName) != 0) {
+                size_t index = mPm.railsInfo[railName].index;
+                mPm.reading[index].index = index;
+                mPm.reading[index].timestamp = timestamp;
+                mPm.reading[index].energy = strtoull(words[1].c_str(), NULL, 10);
+                if (mPm.reading[index].energy == ULLONG_MAX) {
+                    ALOGW("Potentially wrong energy value: %" PRIu64, mPm.reading[index].energy);
+                }
+            }
+        } else {
+            ALOGW("Unexpected format in file: %s", fileName.c_str());
+            ret = -1;
+            break;
+        }
+    }
+    return ret;
+}
+
+Status PowerStats::parseIioEnergyNodes() {
+    Status ret = Status::SUCCESS;
+    if (mPm.hwEnabled == false) {
+        return Status::NOT_SUPPORTED;
+    }
+
+    for (const auto& devicePath : mPm.devicePaths) {
+        if (parseIioEnergyNode(devicePath) < 0) {
+            ALOGE("Error in parsing power stats");
+            ret = Status::FILESYSTEM_ERROR;
+            break;
+        }
+    }
+    return ret;
+}
+
+PowerStats::PowerStats() {
+    findIioPowerMonitorNodes();
+    size_t numRails = parsePowerRails();
+    if (mPm.devicePaths.empty() || numRails == 0) {
+        mPm.hwEnabled = false;
+    } else {
+        mPm.hwEnabled = true;
+        mPm.reading.resize(numRails);
+    }
+}
+
+Return<void> PowerStats::getRailInfo(getRailInfo_cb _hidl_cb) {
+    hidl_vec<RailInfo> rInfo;
+    Status ret = Status::SUCCESS;
+    size_t index;
+    std::lock_guard<std::mutex> _lock(mPm.mLock);
+    if (mPm.hwEnabled == false) {
+        _hidl_cb(rInfo, Status::NOT_SUPPORTED);
+        return Void();
+    }
+    rInfo.resize(mPm.railsInfo.size());
+    for (const auto& railData : mPm.railsInfo) {
+        index = railData.second.index;
+        rInfo[index].railName = railData.first;
+        rInfo[index].subsysName = railData.second.subsysName;
+        rInfo[index].index = index;
+        rInfo[index].samplingRate = railData.second.samplingRate;
+    }
+    _hidl_cb(rInfo, ret);
+    return Void();
+}
+
+Return<void> PowerStats::getEnergyData(const hidl_vec<uint32_t>& railIndices,
+                                       getEnergyData_cb _hidl_cb) {
+    hidl_vec<EnergyData> eVal;
+    std::lock_guard<std::mutex> _lock(mPm.mLock);
+    Status ret = parseIioEnergyNodes();
+
+    if (ret != Status::SUCCESS) {
+        ALOGE("Failed to getEnergyData");
+        _hidl_cb(eVal, ret);
+        return Void();
+    }
+
+    if (railIndices.size() == 0) {
+        eVal.resize(mPm.railsInfo.size());
+        memcpy(&eVal[0], &mPm.reading[0], mPm.reading.size() * sizeof(EnergyData));
+    } else {
+        eVal.resize(railIndices.size());
+        int i = 0;
+        for (const auto& railIndex : railIndices) {
+            if (railIndex >= mPm.reading.size()) {
+                ret = Status::INVALID_INPUT;
+                eVal.resize(0);
+                break;
+            }
+            memcpy(&eVal[i], &mPm.reading[railIndex], sizeof(EnergyData));
+            i++;
+        }
+    }
+    _hidl_cb(eVal, ret);
+    return Void();
+}
+
+Return<void> PowerStats::streamEnergyData(uint32_t timeMs, uint32_t samplingRate,
+                                          streamEnergyData_cb _hidl_cb) {
+    std::lock_guard<std::mutex> _lock(mPm.mLock);
+    if (mPm.fmqSynchronized != nullptr) {
+        _hidl_cb(MessageQueueSync::Descriptor(), 0, 0, Status::INSUFFICIENT_RESOURCES);
+        return Void();
+    }
+    uint32_t sps = std::min(samplingRate, MAX_SAMPLING_RATE);
+    uint32_t numSamples = timeMs * sps / 1000;
+    mPm.fmqSynchronized.reset(new (std::nothrow) MessageQueueSync(MAX_QUEUE_SIZE, true));
+    if (mPm.fmqSynchronized == nullptr || mPm.fmqSynchronized->isValid() == false) {
+        mPm.fmqSynchronized = nullptr;
+        _hidl_cb(MessageQueueSync::Descriptor(), 0, 0, Status::INSUFFICIENT_RESOURCES);
+        return Void();
+    }
+    std::thread pollThread = std::thread([this, sps, numSamples]() {
+        uint64_t sleepTimeUs = 1000000 / sps;
+        uint32_t currSamples = 0;
+        while (currSamples < numSamples) {
+            mPm.mLock.lock();
+            if (parseIioEnergyNodes() == Status::SUCCESS) {
+                mPm.fmqSynchronized->writeBlocking(&mPm.reading[0], mPm.reading.size(),
+                                                   WRITE_TIMEOUT_NS);
+                mPm.mLock.unlock();
+                currSamples++;
+                if (usleep(sleepTimeUs) < 0) {
+                    ALOGW("Sleep interrupted");
+                    break;
+                }
+            } else {
+                mPm.mLock.unlock();
+                break;
+            }
+        }
+        mPm.mLock.lock();
+        mPm.fmqSynchronized = nullptr;
+        mPm.mLock.unlock();
+        return;
+    });
+    pollThread.detach();
+    _hidl_cb(*(mPm.fmqSynchronized)->getDesc(), numSamples, mPm.reading.size(), Status::SUCCESS);
+    return Void();
+}
+
+Return<void> PowerStats::getPowerEntityInfo(getPowerEntityInfo_cb _hidl_cb) {
+    hidl_vec<PowerEntityInfo> eInfo;
+    _hidl_cb(eInfo, Status::NOT_SUPPORTED);
+    return Void();
+}
+
+Return<void> PowerStats::getPowerEntityStateInfo(const hidl_vec<uint32_t>& powerEntityIds,
+                                                 getPowerEntityStateInfo_cb _hidl_cb) {
+    (void)powerEntityIds;
+    hidl_vec<PowerEntityStateSpace> powerEntityStateSpaces;
+    _hidl_cb(powerEntityStateSpaces, Status::NOT_SUPPORTED);
+    return Void();
+}
+
+Return<void> PowerStats::getPowerEntityStateResidencyData(
+    const hidl_vec<uint32_t>& powerEntityIds, getPowerEntityStateResidencyData_cb _hidl_cb) {
+    (void)powerEntityIds;
+    hidl_vec<PowerEntityStateResidencyResult> results;
+    _hidl_cb(results, Status::NOT_SUPPORTED);
+    return Void();
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
diff --git a/power/stats/1.0/default/PowerStats.h b/power/stats/1.0/default/PowerStats.h
new file mode 100644
index 0000000..fb2c6a8
--- /dev/null
+++ b/power/stats/1.0/default/PowerStats.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_POWERSTATS_V1_0_POWERSTATS_H
+#define ANDROID_HARDWARE_POWERSTATS_V1_0_POWERSTATS_H
+
+#include <android/hardware/power/stats/1.0/IPowerStats.h>
+#include <fmq/MessageQueue.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+namespace V1_0 {
+namespace implementation {
+
+using ::android::hardware::hidl_vec;
+using ::android::hardware::kSynchronizedReadWrite;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::power::stats::V1_0::EnergyData;
+using ::android::hardware::power::stats::V1_0::PowerEntityInfo;
+using ::android::hardware::power::stats::V1_0::PowerEntityStateInfo;
+using ::android::hardware::power::stats::V1_0::PowerEntityStateResidencyData;
+using ::android::hardware::power::stats::V1_0::PowerEntityStateResidencyResult;
+using ::android::hardware::power::stats::V1_0::PowerEntityStateSpace;
+using ::android::hardware::power::stats::V1_0::PowerEntityType;
+using ::android::hardware::power::stats::V1_0::RailInfo;
+using ::android::hardware::power::stats::V1_0::Status;
+
+typedef MessageQueue<EnergyData, kSynchronizedReadWrite> MessageQueueSync;
+struct RailData {
+    std::string devicePath;
+    uint32_t index;
+    std::string subsysName;
+    uint32_t samplingRate;
+};
+
+struct OnDeviceMmt {
+    std::mutex mLock;
+    bool hwEnabled;
+    std::vector<std::string> devicePaths;
+    std::map<std::string, RailData> railsInfo;
+    std::vector<EnergyData> reading;
+    std::unique_ptr<MessageQueueSync> fmqSynchronized;
+};
+
+struct PowerStats : public IPowerStats {
+    PowerStats();
+    // Methods from ::android::hardware::power::stats::V1_0::IPowerStats follow.
+    Return<void> getRailInfo(getRailInfo_cb _hidl_cb) override;
+    Return<void> getEnergyData(const hidl_vec<uint32_t>& railIndices,
+                               getEnergyData_cb _hidl_cb) override;
+    Return<void> streamEnergyData(uint32_t timeMs, uint32_t samplingRate,
+                                  streamEnergyData_cb _hidl_cb) override;
+    Return<void> getPowerEntityInfo(getPowerEntityInfo_cb _hidl_cb) override;
+    Return<void> getPowerEntityStateInfo(const hidl_vec<uint32_t>& powerEntityIds,
+                                         getPowerEntityStateInfo_cb _hidl_cb) override;
+    Return<void> getPowerEntityStateResidencyData(
+        const hidl_vec<uint32_t>& powerEntityIds,
+        getPowerEntityStateResidencyData_cb _hidl_cb) override;
+
+   private:
+    OnDeviceMmt mPm;
+    void findIioPowerMonitorNodes();
+    size_t parsePowerRails();
+    int parseIioEnergyNode(std::string devName);
+    Status parseIioEnergyNodes();
+};
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_POWERSTATS_V1_0_POWERSTATS_H
diff --git a/power/stats/1.0/default/android.hardware.power.stats@1.0-service.rc b/power/stats/1.0/default/android.hardware.power.stats@1.0-service.rc
new file mode 100644
index 0000000..d7e546b
--- /dev/null
+++ b/power/stats/1.0/default/android.hardware.power.stats@1.0-service.rc
@@ -0,0 +1,4 @@
+service vendor.power.stats-hal-1-0 /vendor/bin/hw/android.hardware.power.stats@1.0-service
+    class hal
+    user system
+    group system
diff --git a/power/stats/1.0/default/service.cpp b/power/stats/1.0/default/service.cpp
new file mode 100644
index 0000000..80649f5
--- /dev/null
+++ b/power/stats/1.0/default/service.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.power.stats@1.0-service"
+
+#include <android/log.h>
+#include <hidl/HidlTransportSupport.h>
+
+#include "PowerStats.h"
+
+using android::OK;
+using android::sp;
+using android::status_t;
+
+// libhwbinder:
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
+
+// Generated HIDL files
+using android::hardware::power::stats::V1_0::IPowerStats;
+using android::hardware::power::stats::V1_0::implementation::PowerStats;
+
+int main(int /* argc */, char** /* argv */) {
+    ALOGI("power.stats service 1.0 is starting.");
+
+    android::sp<IPowerStats> service = new PowerStats();
+    if (service == nullptr) {
+        ALOGE("Can not create an instance of power.stats HAL Iface, exiting.");
+        return 1;
+    }
+
+    configureRpcThreadpool(1, true /*callerWillJoin*/);
+
+    status_t status = service->registerAsService();
+    if (status != OK) {
+        ALOGE("Could not register service for power.stats HAL Iface (%d), exiting.", status);
+        return 1;
+    }
+
+    ALOGI("power.stats service is ready");
+    joinRpcThreadpool();
+
+    // In normal operation, we don't expect the thread pool to exit
+    ALOGE("power.stats service is shutting down");
+    return 1;
+}
diff --git a/power/stats/1.0/types.hal b/power/stats/1.0/types.hal
new file mode 100644
index 0000000..986a6bb
--- /dev/null
+++ b/power/stats/1.0/types.hal
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.power.stats@1.0;
+
+enum Status : uint32_t {
+    SUCCESS = 0,
+    NOT_SUPPORTED = 1,
+    INVALID_INPUT = 2,
+    FILESYSTEM_ERROR = 3,
+    INSUFFICIENT_RESOURCES = 4,
+};
+
+struct RailInfo {
+    /** Index corresponding to the rail */
+    uint32_t index;
+    /** Name of the rail */
+    string railName;
+    /** Name of the subsystem to which this rail belongs */
+    string subsysName;
+    /** Hardware sampling rate */
+    uint32_t samplingRate;
+};
+
+struct EnergyData {
+    /**
+     * Index corresponding to the rail. This index matches
+     * the index returned in RailInfo
+     */
+    uint32_t index;
+    /** Time since device boot(CLOCK_BOOTTIME) in milli-seconds */
+    uint64_t timestamp;
+    /** Accumulated energy since device boot in microwatt-seconds (uWs) */
+    uint64_t energy;
+};
+
+enum PowerEntityType : uint32_t {
+    /**
+     * A subsystem is a self-contained compute unit. Some examples include
+     * application processor, DSP, GPU.
+     */
+    SUBSYSTEM = 0,
+    /**
+     * A peripheral is an auxiliary device that connects to and works with a
+     * compute unit. Some examples include simple sensors, camera, display.
+     */
+    PERIPHERAL = 1,
+    /**
+     * A power domain is a single subsystem or a collection of subsystems
+     * that is controlled by a single voltage rail.
+     */
+    POWER_DOMAIN = 2,
+};
+
+/**
+ * PowerEntityInfo contains information, such as the ID, name, and type of a
+ * given PowerEntity.
+ */
+struct PowerEntityInfo {
+    /** ID corresponding to the PowerEntity */
+    uint32_t powerEntityId;
+    /**
+     * Name of the PowerEntity. This is unique and opaque to the
+     * Android framework
+     */
+    string powerEntityName;
+    /** Type of the PowerEntity */
+    PowerEntityType type;
+};
+
+struct PowerEntityStateInfo {
+    /** ID corresponding to the state */
+    uint32_t powerEntityStateId;
+    /** Name of the state */
+    string powerEntityStateName;
+};
+
+/**
+ * PowerEntityStateSpace contains the state space information of a given
+ * PowerEntity. The state space, is the set of possible states that a given
+ * PowerEntity provides residency data for.
+ */
+struct PowerEntityStateSpace {
+    /** ID of the corresponding PowerEntity */
+    uint32_t powerEntityId;
+
+    /** List of states that the PowerEntity may reside in */
+    vec<PowerEntityStateInfo> states;
+};
+
+/** Contains residency data for a single state */
+struct PowerEntityStateResidencyData {
+    /** ID of the corresponding PowerEntityStateInfo */
+    uint32_t powerEntityStateId;
+    /**
+     * Total time in milliseconds that the corresponding PowerEntity resided
+     * in this state since the PowerEntity was reset
+     */
+    uint64_t totalTimeInStateMs;
+    /**
+     * Total number of times that the state was entered since the corresponding
+     * PowerEntity was reset
+     */
+    uint64_t totalStateEntryCount;
+    /**
+     * Last time this state was entered. Time in milliseconds since the
+     * corresponding PowerEntity was reset
+     */
+    uint64_t lastEntryTimestampMs;
+};
+
+struct PowerEntityStateResidencyResult {
+    /** ID of the corresponding PowerEntity */
+    uint32_t powerEntityId;
+    /** Residency data for each state the PowerEntity's state space */
+    vec<PowerEntityStateResidencyData> stateResidencyData;
+};
diff --git a/power/stats/1.0/vts/functional/Android.bp b/power/stats/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..4f0b325
--- /dev/null
+++ b/power/stats/1.0/vts/functional/Android.bp
@@ -0,0 +1,38 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalPowerStatsV1_0TargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults"
+    ],
+    srcs: [
+        "VtsHalPowerStatsV1_0TargetTest.cpp"
+    ],
+    static_libs: [
+        "android.hardware.power.stats@1.0"
+    ],
+    shared_libs: [
+        "libbase",
+        "libcutils",
+        "liblog",
+        "libhidlbase",
+        "libfmq",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+    ],
+}
diff --git a/power/stats/1.0/vts/functional/VtsHalPowerStatsV1_0TargetTest.cpp b/power/stats/1.0/vts/functional/VtsHalPowerStatsV1_0TargetTest.cpp
new file mode 100644
index 0000000..1a1230b
--- /dev/null
+++ b/power/stats/1.0/vts/functional/VtsHalPowerStatsV1_0TargetTest.cpp
@@ -0,0 +1,306 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.power.stats.vts"
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+#include <android-base/logging.h>
+#include <android/hardware/power/stats/1.0/IPowerStats.h>
+#include <fmq/MessageQueue.h>
+#include <hidl/MQDescriptor.h>
+#include <inttypes.h>
+#include <algorithm>
+#include <random>
+#include <thread>
+
+namespace android {
+namespace power {
+namespace stats {
+namespace vts {
+namespace {
+
+using android::sp;
+using android::hardware::hidl_vec;
+using android::hardware::kSynchronizedReadWrite;
+using android::hardware::Return;
+using android::hardware::Void;
+using android::hardware::power::stats::V1_0::EnergyData;
+using android::hardware::power::stats::V1_0::IPowerStats;
+using android::hardware::power::stats::V1_0::RailInfo;
+using android::hardware::power::stats::V1_0::Status;
+
+}  // namespace
+
+typedef hardware::MessageQueue<EnergyData, kSynchronizedReadWrite> MessageQueueSync;
+// Test environment for Power HIDL HAL.
+class PowerStatsHidlEnv : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static PowerStatsHidlEnv* Instance() {
+        static PowerStatsHidlEnv* instance = new PowerStatsHidlEnv;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<IPowerStats>(); }
+};
+
+class PowerStatsHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        service_ = ::testing::VtsHalHidlTargetTestBase::getService<IPowerStats>(
+            PowerStatsHidlEnv::Instance()->getServiceName<IPowerStats>());
+        ASSERT_NE(service_, nullptr);
+    }
+
+    virtual void TearDown() override {}
+
+    sp<IPowerStats> service_;
+};
+
+TEST_F(PowerStatsHidlTest, ValidateRailInfo) {
+    hidl_vec<RailInfo> rails[2];
+    Status s;
+    auto cb = [&rails, &s](hidl_vec<RailInfo> rail_subsys, Status status) {
+        rails[0] = rail_subsys;
+        s = status;
+    };
+    Return<void> ret = service_->getRailInfo(cb);
+    EXPECT_TRUE(ret.isOk());
+    if (s == Status::SUCCESS) {
+        /* Rails size should be non-zero on SUCCESS*/
+        ASSERT_NE(rails[0].size(), 0);
+        /* check if indices returned are unique*/
+        set<uint32_t> ids;
+        for (auto rail : rails[0]) {
+            ASSERT_TRUE(ids.insert(rail.index).second);
+        }
+        auto cb = [&rails, &s](hidl_vec<RailInfo> rail_subsys, Status status) {
+            rails[1] = rail_subsys;
+            s = status;
+        };
+        Return<void> ret = service_->getRailInfo(cb);
+        EXPECT_TRUE(ret.isOk());
+        ASSERT_EQ(s, Status::SUCCESS);
+        ASSERT_EQ(rails[0].size(), rails[1].size());
+        /* check if data returned by two calls to getRailInfo is same*/
+        for (int i = 0; i < rails[0].size(); i++) {
+            ASSERT_NE(rails[0][i].railName, "");
+            ASSERT_NE(rails[0][i].subsysName, "");
+            int j = 0;
+            bool match = false;
+            for (j = 0; j < rails[1].size(); j++) {
+                if (rails[0][i].index == rails[1][j].index) {
+                    ASSERT_EQ(rails[0][i].railName, rails[1][i].railName);
+                    ASSERT_EQ(rails[0][i].subsysName, rails[1][i].subsysName);
+                    match = true;
+                    break;
+                }
+            }
+            ASSERT_TRUE(match);
+        }
+    } else if (s == Status::FILESYSTEM_ERROR) {
+        ALOGI("ValidateRailInfo returned FILESYSTEM_ERROR");
+        ASSERT_EQ(rails[0].size(), 0);
+    } else if (s == Status::NOT_SUPPORTED) {
+        ALOGI("ValidateRailInfo returned NOT_SUPPORTED");
+        ASSERT_EQ(rails[0].size(), 0);
+    } else if (s == Status::INVALID_INPUT) {
+        ALOGI("ValidateRailInfo returned INVALID_INPUT");
+        ASSERT_EQ(rails[0].size(), 0);
+    } else if (s == Status::INSUFFICIENT_RESOURCES) {
+        ALOGI("ValidateRailInfo returned INSUFFICIENT_RESOURCES");
+        ASSERT_EQ(rails[0].size(), 0);
+    }
+}
+
+TEST_F(PowerStatsHidlTest, ValidateAllPowerData) {
+    hidl_vec<EnergyData> measurements[2];
+    Status s;
+    auto cb = [&measurements, &s](hidl_vec<EnergyData> measure, Status status) {
+        measurements[0] = measure;
+        s = status;
+    };
+    Return<void> ret = service_->getEnergyData(hidl_vec<uint32_t>(), cb);
+    EXPECT_TRUE(ret.isOk());
+    if (s == Status::SUCCESS) {
+        /*measurements size should be non-zero on SUCCESS*/
+        ASSERT_NE(measurements[0].size(), 0);
+        auto cb = [&measurements, &s](hidl_vec<EnergyData> measure, Status status) {
+            measurements[1] = measure;
+            s = status;
+        };
+        Return<void> ret = service_->getEnergyData(hidl_vec<uint32_t>(), cb);
+        EXPECT_TRUE(ret.isOk());
+        ASSERT_EQ(s, Status::SUCCESS);
+        /*Both calls should returns same amount of data*/
+        ASSERT_EQ(measurements[0].size(), measurements[1].size());
+        /*Check is energy and timestamp are monotonically increasing*/
+        for (int i = 0; i < measurements[0].size(); i++) {
+            int j;
+            for (j = 0; j < measurements[1].size(); j++) {
+                if (measurements[0][i].index == measurements[1][j].index) {
+                    EXPECT_GE(measurements[1][j].timestamp, measurements[0][i].timestamp);
+                    EXPECT_GE(measurements[1][j].energy, measurements[0][i].energy);
+                    break;
+                }
+            }
+            /*Check is indices for two call match*/
+            ASSERT_NE(j, measurements[1].size());
+        }
+    } else if (s == Status::FILESYSTEM_ERROR) {
+        ALOGI("ValidateAllPowerData returned FILESYSTEM_ERROR");
+        ASSERT_EQ(measurements[0].size(), 0);
+    } else if (s == Status::NOT_SUPPORTED) {
+        ALOGI("ValidateAllPowerData returned NOT_SUPPORTED");
+        ASSERT_EQ(measurements[0].size(), 0);
+    } else if (s == Status::INVALID_INPUT) {
+        ALOGI("ValidateAllPowerData returned INVALID_INPUT");
+        ASSERT_EQ(measurements[0].size(), 0);
+    } else if (s == Status::INSUFFICIENT_RESOURCES) {
+        ALOGI("ValidateAllPowerData returned INSUFFICIENT_RESOURCES");
+        ASSERT_EQ(measurements[0].size(), 0);
+    }
+}
+
+TEST_F(PowerStatsHidlTest, ValidateFilteredPowerData) {
+    hidl_vec<RailInfo> rails;
+    hidl_vec<EnergyData> measurements;
+    hidl_vec<uint32_t> indices;
+    std::string debugString;
+    Status s;
+    auto cb = [&rails, &s](hidl_vec<RailInfo> rail_subsys, Status status) {
+        rails = rail_subsys;
+        s = status;
+    };
+    Return<void> ret = service_->getRailInfo(cb);
+    EXPECT_TRUE(ret.isOk());
+    std::time_t seed = std::time(nullptr);
+    std::srand(seed);
+    if (s == Status::SUCCESS) {
+        size_t sz = std::max(1, (int)(std::rand() % rails.size()));
+        indices.resize(sz);
+        for (int i = 0; i < sz; i++) {
+            int j = std::rand() % rails.size();
+            indices[i] = rails[j].index;
+            debugString += std::to_string(indices[i]) + ", ";
+        }
+        debugString += "\n";
+        ALOGI("ValidateFilteredPowerData for indices: %s", debugString.c_str());
+        auto cb = [&measurements, &s](hidl_vec<EnergyData> measure, Status status) {
+            measurements = measure;
+            s = status;
+        };
+        Return<void> ret = service_->getEnergyData(indices, cb);
+        EXPECT_TRUE(ret.isOk());
+        if (s == Status::SUCCESS) {
+            /* Make sure that all the measurements are returned */
+            ASSERT_EQ(sz, measurements.size());
+            for (int i = 0; i < measurements.size(); i++) {
+                int j;
+                bool match = false;
+                /* Check that the measurement belongs to the requested index */
+                for (j = 0; j < indices.size(); j++) {
+                    if (indices[j] == measurements[i].index) {
+                        match = true;
+                        break;
+                    }
+                }
+                ASSERT_TRUE(match);
+            }
+        }
+    } else {
+        /* size should be zero is stats is NOT SUCCESS */
+        ASSERT_EQ(rails.size(), 0);
+    }
+}
+
+void readEnergy(sp<IPowerStats> service_, uint32_t timeMs) {
+    std::unique_ptr<MessageQueueSync> mQueue;
+    Status s;
+    uint32_t railsInSample;
+    uint32_t totalSamples;
+    auto cb = [&s, &mQueue, &totalSamples, &railsInSample](
+                  const hardware::MQDescriptorSync<EnergyData>& in, uint32_t numSamples,
+                  uint32_t railsPerSample, Status status) {
+        mQueue.reset(new (std::nothrow) MessageQueueSync(in));
+        s = status;
+        totalSamples = numSamples;
+        railsInSample = railsPerSample;
+    };
+    service_->streamEnergyData(timeMs, 10, cb);
+    if (s == Status::SUCCESS) {
+        ASSERT_NE(nullptr, mQueue);
+        ASSERT_TRUE(mQueue->isValid());
+        bool rc;
+        int sampleCount = 0;
+        uint32_t totalQuants = railsInSample * totalSamples;
+        uint64_t timeout_ns = 10000000000;
+        if (totalSamples > 0) {
+            uint32_t batch = std::max(1, (int)((std::rand() % totalSamples) * railsInSample));
+            ALOGI("Read energy, timsMs: %u, batch: %u", timeMs, batch);
+            std::vector<EnergyData> data(batch);
+            while (sampleCount < totalQuants) {
+                rc = mQueue->readBlocking(&data[0], batch, timeout_ns);
+                if (rc == false) {
+                    break;
+                }
+                sampleCount = sampleCount + batch;
+                if (batch > totalQuants - sampleCount) {
+                    batch = 1;
+                }
+            }
+            ASSERT_EQ(totalQuants, sampleCount);
+        }
+    } else if (s == Status::FILESYSTEM_ERROR) {
+        ASSERT_FALSE(mQueue->isValid());
+        ASSERT_EQ(totalSamples, 0);
+        ASSERT_EQ(railsInSample, 0);
+    } else if (s == Status::NOT_SUPPORTED) {
+        ASSERT_FALSE(mQueue->isValid());
+        ASSERT_EQ(totalSamples, 0);
+        ASSERT_EQ(railsInSample, 0);
+    } else if (s == Status::INVALID_INPUT) {
+        ASSERT_FALSE(mQueue->isValid());
+        ASSERT_EQ(totalSamples, 0);
+        ASSERT_EQ(railsInSample, 0);
+    } else if (s == Status::INSUFFICIENT_RESOURCES) {
+        ASSERT_FALSE(mQueue->isValid());
+        ASSERT_EQ(totalSamples, 0);
+        ASSERT_EQ(railsInSample, 0);
+    }
+}
+
+TEST_F(PowerStatsHidlTest, StreamEnergyData) {
+    std::time_t seed = std::time(nullptr);
+    std::srand(seed);
+    std::thread thread1 = std::thread(readEnergy, service_, std::rand() % 5000);
+    thread1.join();
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(PowerStatsHidlEnv::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    PowerStatsHidlEnv::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    return status;
+}
+
+}  // namespace vts
+}  // namespace stats
+}  // namespace power
+}  // namespace android
diff --git a/sensors/1.0/default/OWNERS b/sensors/1.0/default/OWNERS
index 6a38a1f..2031d84 100644
--- a/sensors/1.0/default/OWNERS
+++ b/sensors/1.0/default/OWNERS
@@ -1,2 +1,2 @@
-ashutoshj@google.com
-pengxu@google.com
+bduddie@google.com
+bstack@google.com
diff --git a/sensors/1.0/vts/functional/Android.bp b/sensors/1.0/vts/functional/Android.bp
index 0ea400e..6563e3c 100644
--- a/sensors/1.0/vts/functional/Android.bp
+++ b/sensors/1.0/vts/functional/Android.bp
@@ -18,13 +18,14 @@
     name: "VtsHalSensorsV1_0TargetTest",
     defaults: ["VtsHalTargetTestDefaults"],
     srcs: [
-        "GrallocWrapper.cpp",
+        "SensorsHidlEnvironmentV1_0.cpp",
         "VtsHalSensorsV1_0TargetTest.cpp"
     ],
     static_libs: [
         "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.mapper@2.0",
         "android.hardware.sensors@1.0",
+        "VtsHalSensorsTargetTestUtils",
     ],
 }
 
diff --git a/sensors/1.0/vts/functional/GrallocWrapper.cpp b/sensors/1.0/vts/functional/GrallocWrapper.cpp
deleted file mode 100644
index e422d62..0000000
--- a/sensors/1.0/vts/functional/GrallocWrapper.cpp
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "GrallocWrapper"
-
-#include "GrallocWrapper.h"
-
-#include <utils/Log.h>
-
-namespace android {
-
-GrallocWrapper::GrallocWrapper() { init(); }
-
-void GrallocWrapper::init() {
-  mAllocator = allocator2::IAllocator::getService();
-  if (mAllocator == nullptr) {
-    ALOGE("Failed to get allocator service");
-  }
-
-  mMapper = mapper2::IMapper::getService();
-  if (mMapper == nullptr) {
-    ALOGE("Failed to get mapper service");
-  }
-  if (mMapper->isRemote()) {
-    ALOGE("Mapper is not in passthrough mode");
-  }
-}
-
-GrallocWrapper::~GrallocWrapper() {
-  for (auto bufferHandle : mClonedBuffers) {
-    auto buffer = const_cast<native_handle_t*>(bufferHandle);
-    native_handle_close(buffer);
-    native_handle_delete(buffer);
-  }
-  mClonedBuffers.clear();
-
-  for (auto bufferHandle : mImportedBuffers) {
-    auto buffer = const_cast<native_handle_t*>(bufferHandle);
-    if (mMapper->freeBuffer(buffer) != mapper2::Error::NONE) {
-      ALOGE("Failed to free buffer %p", buffer);
-    }
-  }
-  mImportedBuffers.clear();
-}
-
-sp<allocator2::IAllocator> GrallocWrapper::getAllocator() const {
-  return mAllocator;
-}
-
-std::string GrallocWrapper::dumpDebugInfo() {
-  std::string debugInfo;
-  mAllocator->dumpDebugInfo(
-      [&](const auto& tmpDebugInfo) { debugInfo = tmpDebugInfo.c_str(); });
-
-  return debugInfo;
-}
-
-const native_handle_t* GrallocWrapper::cloneBuffer(
-    const hardware::hidl_handle& rawHandle) {
-  const native_handle_t* bufferHandle =
-      native_handle_clone(rawHandle.getNativeHandle());
-
-  if (bufferHandle) {
-    mClonedBuffers.insert(bufferHandle);
-  }
-  return bufferHandle;
-}
-
-std::vector<const native_handle_t*> GrallocWrapper::allocate(
-    const mapper2::BufferDescriptor& descriptor, uint32_t count, bool import,
-    uint32_t* outStride) {
-  std::vector<const native_handle_t*> bufferHandles;
-  bufferHandles.reserve(count);
-  mAllocator->allocate(
-      descriptor, count,
-      [&](const auto& tmpError, const auto& tmpStride, const auto& tmpBuffers) {
-        if (mapper2::Error::NONE != tmpError) {
-          ALOGE("Failed to allocate buffers");
-        }
-        if (count != tmpBuffers.size()) {
-          ALOGE("Invalid buffer array");
-        }
-
-        for (uint32_t i = 0; i < count; i++) {
-          if (import) {
-            bufferHandles.push_back(importBuffer(tmpBuffers[i]));
-          } else {
-            bufferHandles.push_back(cloneBuffer(tmpBuffers[i]));
-          }
-        }
-
-        if (outStride) {
-          *outStride = tmpStride;
-        }
-      });
-
-  return bufferHandles;
-}
-
-const native_handle_t* GrallocWrapper::allocate(
-    const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo, bool import,
-    uint32_t* outStride) {
-  mapper2::BufferDescriptor descriptor = createDescriptor(descriptorInfo);
-  ALOGE("QQ");
-  auto buffers = allocate(descriptor, 1, import, outStride);
-  return buffers[0];
-}
-
-sp<mapper2::IMapper> GrallocWrapper::getMapper() const { return mMapper; }
-
-mapper2::BufferDescriptor GrallocWrapper::createDescriptor(
-    const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo) {
-  mapper2::BufferDescriptor descriptor;
-  mMapper->createDescriptor(
-      descriptorInfo, [&](const auto& tmpError, const auto& tmpDescriptor) {
-        if (tmpError != mapper2::Error::NONE) {
-          ALOGE("Failed to create descriptor");
-        }
-        descriptor = tmpDescriptor;
-      });
-
-  return descriptor;
-}
-
-const native_handle_t* GrallocWrapper::importBuffer(
-    const hardware::hidl_handle& rawHandle) {
-  const native_handle_t* bufferHandle = nullptr;
-  mMapper->importBuffer(
-      rawHandle, [&](const auto& tmpError, const auto& tmpBuffer) {
-        if (tmpError != mapper2::Error::NONE) {
-          ALOGE("Failed to import buffer %p", rawHandle.getNativeHandle());
-        }
-        bufferHandle = static_cast<const native_handle_t*>(tmpBuffer);
-      });
-
-  if (bufferHandle) {
-    mImportedBuffers.insert(bufferHandle);
-  }
-
-  return bufferHandle;
-}
-
-void GrallocWrapper::freeBuffer(const native_handle_t* bufferHandle) {
-  auto buffer = const_cast<native_handle_t*>(bufferHandle);
-
-  if (mImportedBuffers.erase(bufferHandle)) {
-    mapper2::Error error = mMapper->freeBuffer(buffer);
-    if (error != mapper2::Error::NONE) {
-      ALOGE("Failed to free %p", buffer);
-    }
-  } else {
-    mClonedBuffers.erase(bufferHandle);
-    native_handle_close(buffer);
-    native_handle_delete(buffer);
-  }
-}
-
-void* GrallocWrapper::lock(const native_handle_t* bufferHandle,
-                           uint64_t cpuUsage,
-                           const mapper2::IMapper::Rect& accessRegion,
-                           int acquireFence) {
-  auto buffer = const_cast<native_handle_t*>(bufferHandle);
-
-  NATIVE_HANDLE_DECLARE_STORAGE(acquireFenceStorage, 1, 0);
-  hardware::hidl_handle acquireFenceHandle;
-  if (acquireFence >= 0) {
-    auto h = native_handle_init(acquireFenceStorage, 1, 0);
-    h->data[0] = acquireFence;
-    acquireFenceHandle = h;
-  }
-
-  void* data = nullptr;
-  mMapper->lock(buffer, cpuUsage, accessRegion, acquireFenceHandle,
-                [&](const auto& tmpError, const auto& tmpData) {
-                  if (tmpError != mapper2::Error::NONE) {
-                    ALOGE("Failed to lock buffer %p", buffer);
-                  }
-                  data = tmpData;
-                });
-
-  if (acquireFence >= 0) {
-    close(acquireFence);
-  }
-
-  return data;
-}
-
-int GrallocWrapper::unlock(const native_handle_t* bufferHandle) {
-  auto buffer = const_cast<native_handle_t*>(bufferHandle);
-
-  int releaseFence = -1;
-  mMapper->unlock(buffer, [&](const auto& tmpError,
-                              const auto& tmpReleaseFence) {
-    if (tmpError != mapper2::Error::NONE) {
-      ALOGE("Failed to unlock buffer %p", buffer);
-    }
-
-    auto fenceHandle = tmpReleaseFence.getNativeHandle();
-    if (fenceHandle) {
-      if (fenceHandle->numInts != 0) {
-        ALOGE("Invalid fence handle %p", fenceHandle);
-      }
-      if (fenceHandle->numFds == 1) {
-        releaseFence = dup(fenceHandle->data[0]);
-        if (releaseFence < 0){
-          ALOGE("Failed to dup fence fd");
-        }
-      } else {
-        if (fenceHandle->numFds != 0) {
-          ALOGE("Invalid fence handle %p", fenceHandle);
-        }
-      }
-    }
-  });
-
-  return releaseFence;
-}
-
-}  // namespace android
diff --git a/sensors/1.0/vts/functional/GrallocWrapper.h b/sensors/1.0/vts/functional/GrallocWrapper.h
deleted file mode 100644
index e506fe1..0000000
--- a/sensors/1.0/vts/functional/GrallocWrapper.h
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef GRALLO_WRAPPER_H_
-#define GRALLO_WRAPPER_H_
-
-#include <unordered_set>
-
-#include <android/hardware/graphics/allocator/2.0/IAllocator.h>
-#include <android/hardware/graphics/mapper/2.0/IMapper.h>
-
-namespace allocator2 = ::android::hardware::graphics::allocator::V2_0;
-namespace mapper2 = ::android::hardware::graphics::mapper::V2_0;
-
-namespace android {
-
-// Modified from hardware/interfaces/graphics/mapper/2.0/vts/functional/
-class GrallocWrapper {
- public:
-  GrallocWrapper();
-  ~GrallocWrapper();
-
-  sp<allocator2::IAllocator> getAllocator() const;
-  sp<mapper2::IMapper> getMapper() const;
-
-  std::string dumpDebugInfo();
-
-  // When import is false, this simply calls IAllocator::allocate. When import
-  // is true, the returned buffers are also imported into the mapper.
-  //
-  // Either case, the returned buffers must be freed with freeBuffer.
-  std::vector<const native_handle_t*> allocate(
-      const mapper2::BufferDescriptor& descriptor, uint32_t count, bool import = true,
-      uint32_t* outStride = nullptr);
-  const native_handle_t* allocate(
-      const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo, bool import = true,
-      uint32_t* outStride = nullptr);
-
-  mapper2::BufferDescriptor createDescriptor(
-      const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo);
-
-  const native_handle_t* importBuffer(const hardware::hidl_handle& rawHandle);
-  void freeBuffer(const native_handle_t* bufferHandle);
-
-  // We use fd instead of hardware::hidl_handle in these functions to pass fences
-  // in and out of the mapper.  The ownership of the fd is always transferred
-  // with each of these functions.
-  void* lock(const native_handle_t* bufferHandle, uint64_t cpuUsage,
-             const mapper2::IMapper::Rect& accessRegion, int acquireFence);
-
-  int unlock(const native_handle_t* bufferHandle);
-
- private:
-  void init();
-  const native_handle_t* cloneBuffer(const hardware::hidl_handle& rawHandle);
-
-  sp<allocator2::IAllocator> mAllocator;
-  sp<mapper2::IMapper> mMapper;
-
-  // Keep track of all cloned and imported handles.  When a test fails with
-  // ASSERT_*, the destructor will free the handles for the test.
-  std::unordered_set<const native_handle_t*> mClonedBuffers;
-  std::unordered_set<const native_handle_t*> mImportedBuffers;
-};
-
-}  // namespace android
-#endif  // GRALLO_WRAPPER_H_
diff --git a/sensors/1.0/vts/functional/OWNERS b/sensors/1.0/vts/functional/OWNERS
index 8715e5d..759d87b 100644
--- a/sensors/1.0/vts/functional/OWNERS
+++ b/sensors/1.0/vts/functional/OWNERS
@@ -1,6 +1,6 @@
 # Sensors team
-ashutoshj@google.com
-pengxu@google.com
+bduddie@google.com
+bstack@google.com
 
 # VTS team
 trong@google.com
diff --git a/sensors/1.0/vts/functional/SensorsHidlEnvironmentV1_0.cpp b/sensors/1.0/vts/functional/SensorsHidlEnvironmentV1_0.cpp
new file mode 100644
index 0000000..00207b1
--- /dev/null
+++ b/sensors/1.0/vts/functional/SensorsHidlEnvironmentV1_0.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SensorsHidlEnvironmentV1_0.h"
+
+#include <log/log.h>
+
+#include <vector>
+
+using ::android::hardware::hidl_vec;
+using ::android::hardware::sensors::V1_0::ISensors;
+using ::android::hardware::sensors::V1_0::Result;
+using ::android::hardware::sensors::V1_0::SensorInfo;
+
+bool SensorsHidlEnvironmentV1_0::resetHal() {
+    // wait upto 100ms * 10 = 1s for hidl service.
+    constexpr auto RETRY_DELAY = std::chrono::milliseconds(100);
+
+    std::string step;
+    bool succeed = false;
+    for (size_t retry = 10; retry > 0; --retry) {
+        // this do ... while is for easy error handling
+        do {
+            step = "getService()";
+            sensors = ISensors::getService(
+                SensorsHidlEnvironmentV1_0::Instance()->getServiceName<ISensors>());
+            if (sensors == nullptr) {
+                break;
+            }
+
+            step = "poll() check";
+            // Poke ISensor service. If it has lingering connection from previous generation of
+            // system server, it will kill itself. There is no intention to handle the poll result,
+            // which will be done since the size is 0.
+            if (!sensors->poll(0, [](auto, const auto&, const auto&) {}).isOk()) {
+                break;
+            }
+
+            step = "getSensorList";
+            std::vector<SensorInfo> sensorList;
+            if (!sensors
+                     ->getSensorsList([&](const hidl_vec<SensorInfo>& list) {
+                         sensorList.reserve(list.size());
+                         for (size_t i = 0; i < list.size(); ++i) {
+                             sensorList.push_back(list[i]);
+                         }
+                     })
+                     .isOk()) {
+                break;
+            }
+
+            // stop each sensor individually
+            step = "stop each sensor";
+            bool ok = true;
+            for (const auto& i : sensorList) {
+                if (!sensors->activate(i.sensorHandle, false).isOk()) {
+                    ok = false;
+                    break;
+                }
+            }
+            if (!ok) {
+                break;
+            }
+
+            // mark it done
+            step = "done";
+            succeed = true;
+        } while (0);
+
+        if (succeed) {
+            return true;
+        }
+
+        // Delay 100ms before retry, hidl service is expected to come up in short time after crash.
+        ALOGI("%s unsuccessful, try again soon (remaining retry %zu).", step.c_str(), retry - 1);
+        std::this_thread::sleep_for(RETRY_DELAY);
+    }
+
+    sensors = nullptr;
+    return false;
+}
+
+void SensorsHidlEnvironmentV1_0::startPollingThread() {
+    mStopThread = false;
+    mPollThread = std::thread(pollingThread, this, std::ref(mStopThread));
+    mEvents.reserve(128);
+}
+
+void SensorsHidlEnvironmentV1_0::pollingThread(SensorsHidlEnvironmentV1_0* env,
+                                               std::atomic_bool& stop) {
+    ALOGD("polling thread start");
+
+    while (!stop) {
+        env->sensors->poll(
+            64, [&](auto result, const auto& events, const auto& dynamicSensorsAdded) {
+                if (result != Result::OK ||
+                    (events.size() == 0 && dynamicSensorsAdded.size() == 0) || stop) {
+                    stop = true;
+                    return;
+                }
+
+                for (const auto& e : events) {
+                    env->addEvent(e);
+                }
+            });
+    }
+    ALOGD("polling thread end");
+}
\ No newline at end of file
diff --git a/sensors/1.0/vts/functional/SensorsHidlEnvironmentV1_0.h b/sensors/1.0/vts/functional/SensorsHidlEnvironmentV1_0.h
new file mode 100644
index 0000000..0a9e59f
--- /dev/null
+++ b/sensors/1.0/vts/functional/SensorsHidlEnvironmentV1_0.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SENSORS_HIDL_ENVIRONMENT_V1_0_H
+#define ANDROID_SENSORS_HIDL_ENVIRONMENT_V1_0_H
+
+#include "sensors-vts-utils/SensorsHidlEnvironmentBase.h"
+
+#include <android/hardware/sensors/1.0/ISensors.h>
+#include <android/hardware/sensors/1.0/types.h>
+#include <utils/StrongPointer.h>
+
+#include <atomic>
+#include <memory>
+
+using ::android::sp;
+
+class SensorsHidlTest;
+class SensorsHidlEnvironmentV1_0 : public SensorsHidlEnvironmentBase {
+   public:
+    using Event = ::android::hardware::sensors::V1_0::Event;
+    // get the test environment singleton
+    static SensorsHidlEnvironmentV1_0* Instance() {
+        static SensorsHidlEnvironmentV1_0* instance = new SensorsHidlEnvironmentV1_0();
+        return instance;
+    }
+
+    virtual void registerTestServices() override {
+        registerTestService<android::hardware::sensors::V1_0::ISensors>();
+    }
+
+   private:
+    friend SensorsHidlTest;
+    // sensors hidl service
+    sp<android::hardware::sensors::V1_0::ISensors> sensors;
+
+    SensorsHidlEnvironmentV1_0() {}
+
+    bool resetHal() override;
+    void startPollingThread() override;
+    static void pollingThread(SensorsHidlEnvironmentV1_0* env, std::atomic_bool& stop);
+
+    GTEST_DISALLOW_COPY_AND_ASSIGN_(SensorsHidlEnvironmentV1_0);
+};
+
+#endif  // ANDROID_SENSORS_HIDL_ENVIRONMENT_V1_0_H
\ No newline at end of file
diff --git a/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp b/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
index c18eedd..47308e1 100644
--- a/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
+++ b/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
@@ -15,583 +15,66 @@
  */
 
 #define LOG_TAG "sensors_hidl_hal_test"
-#include <VtsHalHidlTargetTestBase.h>
-#include <VtsHalHidlTargetTestEnvBase.h>
-#include <android-base/logging.h>
+
+#include "SensorsHidlEnvironmentV1_0.h"
+#include "sensors-vts-utils/SensorsHidlTestBase.h"
+
 #include <android/hardware/sensors/1.0/ISensors.h>
 #include <android/hardware/sensors/1.0/types.h>
-#include <cutils/ashmem.h>
-#include <hardware/sensors.h>  // for sensor type strings
 #include <log/log.h>
 #include <utils/SystemClock.h>
-#include "GrallocWrapper.h"
 
-#include <algorithm>
 #include <cinttypes>
-#include <cmath>
-#include <memory>
-#include <mutex>
-#include <thread>
-#include <unordered_set>
 #include <vector>
 
-#include <sys/mman.h>
-#include <unistd.h>
-
-using ::android::GrallocWrapper;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using ::android::hardware::hidl_string;
 using ::android::sp;
 using namespace ::android::hardware::sensors::V1_0;
 
-// Test environment for sensors
-class SensorsHidlTest;
-class SensorsHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
-   public:
-    // get the test environment singleton
-    static SensorsHidlEnvironment* Instance() {
-        static SensorsHidlEnvironment* instance = new SensorsHidlEnvironment;
-        return instance;
-    }
-
-    virtual void HidlSetUp() override;
-    virtual void HidlTearDown() override;
-
-    virtual void registerTestServices() override { registerTestService<ISensors>(); }
-
-    // Get and clear all events collected so far (like "cat" shell command).
-    // If output is nullptr, it clears all collected events.
-    void catEvents(std::vector<Event>* output);
-
-    // set sensor event collection status
-    void setCollection(bool enable);
-
-   private:
-    friend SensorsHidlTest;
-    // sensors hidl service
-    sp<ISensors> sensors;
-
-    SensorsHidlEnvironment() {}
-
-    void addEvent(const Event& ev);
-    void startPollingThread();
-    void resetHal();
-    static void pollingThread(SensorsHidlEnvironment* env, std::shared_ptr<bool> stop);
-
-    bool collectionEnabled;
-    std::shared_ptr<bool> stopThread;
-    std::thread pollThread;
-    std::vector<Event> events;
-    std::mutex events_mutex;
-
-    GTEST_DISALLOW_COPY_AND_ASSIGN_(SensorsHidlEnvironment);
-};
-
-void SensorsHidlEnvironment::HidlSetUp() {
-    resetHal();
-
-    ASSERT_NE(sensors, nullptr) << "sensors is nullptr, cannot get hidl service";
-
-    collectionEnabled = false;
-    startPollingThread();
-
-    // In case framework just stopped for test and there is sensor events in the pipe,
-    // wait some time for those events to be cleared to avoid them messing up the test.
-    std::this_thread::sleep_for(std::chrono::seconds(3));
-}
-
-void SensorsHidlEnvironment::HidlTearDown() {
-    if (stopThread) {
-        *stopThread = true;
-    }
-    pollThread.detach();
-}
-
-void SensorsHidlEnvironment::resetHal() {
-  // wait upto 100ms * 10 = 1s for hidl service.
-  constexpr auto RETRY_DELAY = std::chrono::milliseconds(100);
-
-  std::string step;
-  bool succeed = false;
-  for (size_t retry = 10; retry > 0; --retry) {
-    // this do ... while is for easy error handling
-    do {
-      step = "getService()";
-      sensors = ISensors::getService(
-          SensorsHidlEnvironment::Instance()->getServiceName<ISensors>());
-      if (sensors == nullptr) {
-        break;
-      }
-
-      step = "poll() check";
-      // Poke ISensor service. If it has lingering connection from previous generation of
-      // system server, it will kill itself. There is no intention to handle the poll result,
-      // which will be done since the size is 0.
-      if(!sensors->poll(0, [](auto, const auto &, const auto &) {}).isOk()) {
-        break;
-      }
-
-      step = "getSensorList";
-      std::vector<SensorInfo> sensorList;
-      if (!sensors->getSensorsList(
-          [&] (const ::android::hardware::hidl_vec<SensorInfo> &list) {
-            sensorList.reserve(list.size());
-            for (size_t i = 0; i < list.size(); ++i) {
-              sensorList.push_back(list[i]);
-            }
-          }).isOk()) {
-        break;
-      }
-
-      // stop each sensor individually
-      step = "stop each sensor";
-      bool ok = true;
-      for (const auto &i : sensorList) {
-        if (!sensors->activate(i.sensorHandle, false).isOk()) {
-          ok = false;
-          break;
-        }
-      }
-      if (!ok) {
-        break;
-      }
-
-      // mark it done
-      step = "done";
-      succeed = true;
-    } while(0);
-
-    if (succeed) {
-      return;
-    }
-
-    // Delay 100ms before retry, hidl service is expected to come up in short time after crash.
-    ALOGI("%s unsuccessful, try again soon (remaining retry %zu).", step.c_str(), retry - 1);
-    std::this_thread::sleep_for(RETRY_DELAY);
-  }
-
-  sensors = nullptr;
-}
-
-void SensorsHidlEnvironment::catEvents(std::vector<Event>* output) {
-  std::lock_guard<std::mutex> lock(events_mutex);
-  if (output) {
-    output->insert(output->end(), events.begin(), events.end());
-  }
-  events.clear();
-}
-
-void SensorsHidlEnvironment::setCollection(bool enable) {
-  std::lock_guard<std::mutex> lock(events_mutex);
-  collectionEnabled = enable;
-}
-
-void SensorsHidlEnvironment::addEvent(const Event& ev) {
-  std::lock_guard<std::mutex> lock(events_mutex);
-  if (collectionEnabled) {
-    events.push_back(ev);
-  }
-}
-
-void SensorsHidlEnvironment::startPollingThread() {
-  stopThread = std::shared_ptr<bool>(new bool(false));
-  pollThread = std::thread(pollingThread, this, stopThread);
-  events.reserve(128);
-}
-
-void SensorsHidlEnvironment::pollingThread(
-    SensorsHidlEnvironment* env, std::shared_ptr<bool> stop) {
-  ALOGD("polling thread start");
-  bool needExit = *stop;
-
-  while(!needExit) {
-      env->sensors->poll(64, [&](auto result, const auto& events, const auto& dynamicSensorsAdded) {
-          if (result != Result::OK
-              || (events.size() == 0 && dynamicSensorsAdded.size() == 0)
-              || *stop) {
-              needExit = true;
-              return;
-          }
-
-          for (const auto& e : events) {
-              env->addEvent(e);
-          }
-      });
-  }
-  ALOGD("polling thread end");
-}
-
-class SensorsTestSharedMemory {
- public:
-  static SensorsTestSharedMemory* create(SharedMemType type, size_t size);
-  SharedMemInfo getSharedMemInfo() const;
-  char * getBuffer() const;
-  std::vector<Event> parseEvents(int64_t lastCounter = -1, size_t offset = 0) const;
-  virtual ~SensorsTestSharedMemory();
- private:
-  SensorsTestSharedMemory(SharedMemType type, size_t size);
-
-  SharedMemType mType;
-  native_handle_t* mNativeHandle;
-  size_t mSize;
-  char* mBuffer;
-  std::unique_ptr<GrallocWrapper> mGrallocWrapper;
-
-  DISALLOW_COPY_AND_ASSIGN(SensorsTestSharedMemory);
-};
-
-SharedMemInfo SensorsTestSharedMemory::getSharedMemInfo() const {
-  SharedMemInfo mem = {
-    .type = mType,
-    .format = SharedMemFormat::SENSORS_EVENT,
-    .size = static_cast<uint32_t>(mSize),
-    .memoryHandle = mNativeHandle
-  };
-  return mem;
-}
-
-char * SensorsTestSharedMemory::getBuffer() const {
-  return mBuffer;
-}
-
-std::vector<Event> SensorsTestSharedMemory::parseEvents(int64_t lastCounter, size_t offset) const {
-
-  constexpr size_t kEventSize = static_cast<size_t>(SensorsEventFormatOffset::TOTAL_LENGTH);
-  constexpr size_t kOffsetSize = static_cast<size_t>(SensorsEventFormatOffset::SIZE_FIELD);
-  constexpr size_t kOffsetToken = static_cast<size_t>(SensorsEventFormatOffset::REPORT_TOKEN);
-  constexpr size_t kOffsetType = static_cast<size_t>(SensorsEventFormatOffset::SENSOR_TYPE);
-  constexpr size_t kOffsetAtomicCounter =
-      static_cast<size_t>(SensorsEventFormatOffset::ATOMIC_COUNTER);
-  constexpr size_t kOffsetTimestamp = static_cast<size_t>(SensorsEventFormatOffset::TIMESTAMP);
-  constexpr size_t kOffsetData = static_cast<size_t>(SensorsEventFormatOffset::DATA);
-
-  std::vector<Event> events;
-  std::vector<float> data(16);
-
-  while (offset + kEventSize <= mSize) {
-    int64_t atomicCounter = *reinterpret_cast<uint32_t *>(mBuffer + offset + kOffsetAtomicCounter);
-    if (atomicCounter <= lastCounter) {
-      ALOGV("atomicCounter = %" PRId64 ", lastCounter = %" PRId64, atomicCounter, lastCounter);
-      break;
-    }
-
-    int32_t size = *reinterpret_cast<int32_t *>(mBuffer + offset + kOffsetSize);
-    if (size != kEventSize) {
-      // unknown error, events parsed may be wrong, remove all
-      events.clear();
-      break;
-    }
-
-    int32_t token = *reinterpret_cast<int32_t *>(mBuffer + offset + kOffsetToken);
-    int32_t type = *reinterpret_cast<int32_t *>(mBuffer + offset + kOffsetType);
-    int64_t timestamp = *reinterpret_cast<int64_t *>(mBuffer + offset + kOffsetTimestamp);
-
-    ALOGV("offset = %zu, cnt %" PRId64 ", token %" PRId32 ", type %" PRId32 ", timestamp %" PRId64,
-        offset, atomicCounter, token, type, timestamp);
-
-    Event event = {
-      .timestamp = timestamp,
-      .sensorHandle = token,
-      .sensorType = static_cast<SensorType>(type),
-    };
-    event.u.data = android::hardware::hidl_array<float, 16>
-        (reinterpret_cast<float*>(mBuffer + offset + kOffsetData));
-
-    events.push_back(event);
-
-    lastCounter = atomicCounter;
-    offset += kEventSize;
-  }
-
-  return events;
-}
-
-SensorsTestSharedMemory::SensorsTestSharedMemory(SharedMemType type, size_t size)
-    : mType(type), mSize(0), mBuffer(nullptr) {
-  native_handle_t *handle = nullptr;
-  char *buffer = nullptr;
-  switch(type) {
-    case SharedMemType::ASHMEM: {
-      int fd;
-      handle = ::native_handle_create(1 /*nFds*/, 0/*nInts*/);
-      if (handle != nullptr) {
-        handle->data[0] = fd = ::ashmem_create_region("SensorsTestSharedMemory", size);
-        if (handle->data[0] > 0) {
-          // memory is pinned by default
-          buffer = static_cast<char *>
-              (::mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0));
-          if (buffer != reinterpret_cast<char*>(MAP_FAILED)) {
-            break;
-          }
-          ::native_handle_close(handle);
-        }
-        ::native_handle_delete(handle);
-        handle = nullptr;
-      }
-      break;
-    }
-    case SharedMemType::GRALLOC: {
-      mGrallocWrapper = std::make_unique<GrallocWrapper>();
-      if (mGrallocWrapper->getAllocator() == nullptr || mGrallocWrapper->getMapper() == nullptr) {
-        break;
-      }
-      using android::hardware::graphics::common::V1_0::BufferUsage;
-      using android::hardware::graphics::common::V1_0::PixelFormat;
-      mapper2::IMapper::BufferDescriptorInfo buf_desc_info = {
-        .width = static_cast<uint32_t>(size),
-        .height = 1,
-        .layerCount = 1,
-        .usage = static_cast<uint64_t> (BufferUsage::SENSOR_DIRECT_DATA |
-            BufferUsage::CPU_READ_OFTEN),
-        .format = PixelFormat::BLOB
-      };
-
-      handle = const_cast<native_handle_t *>(mGrallocWrapper->allocate(buf_desc_info));
-      if (handle != nullptr) {
-        mapper2::IMapper::Rect region{0, 0,
-            static_cast<int32_t>(buf_desc_info.width),
-            static_cast<int32_t>(buf_desc_info.height)};
-        buffer = static_cast<char *>
-                (mGrallocWrapper->lock(handle, buf_desc_info.usage, region, /*fence=*/-1));
-        if (buffer != nullptr) {
-          break;
-        }
-        mGrallocWrapper->freeBuffer(handle);
-        handle = nullptr;
-      }
-      break;
-    }
-    default:
-      break;
-  }
-
-  if (buffer != nullptr) {
-    mNativeHandle = handle;
-    mSize = size;
-    mBuffer = buffer;
-  }
-}
-
-SensorsTestSharedMemory::~SensorsTestSharedMemory() {
-  switch(mType) {
-    case SharedMemType::ASHMEM: {
-      if (mSize != 0) {
-        ::munmap(mBuffer, mSize);
-        mBuffer = nullptr;
-
-        ::native_handle_close(mNativeHandle);
-        ::native_handle_delete(mNativeHandle);
-
-        mNativeHandle = nullptr;
-        mSize = 0;
-      }
-      break;
-    }
-    case SharedMemType::GRALLOC: {
-      if (mSize != 0) {
-        mGrallocWrapper->unlock(mNativeHandle);
-        mGrallocWrapper->freeBuffer(mNativeHandle);
-
-        mNativeHandle = nullptr;
-        mSize = 0;
-      }
-      break;
-    }
-    default: {
-      if (mNativeHandle != nullptr || mSize != 0 || mBuffer != nullptr) {
-        ALOGE("SensorsTestSharedMemory %p not properly destructed: "
-            "type %d, native handle %p, size %zu, buffer %p",
-            this, static_cast<int>(mType), mNativeHandle, mSize, mBuffer);
-      }
-      break;
-    }
-  }
-}
-
-SensorsTestSharedMemory* SensorsTestSharedMemory::create(SharedMemType type, size_t size) {
-  constexpr size_t kMaxSize = 128*1024*1024; // sensor test should not need more than 128M
-  if (size == 0 || size >= kMaxSize) {
-    return nullptr;
-  }
-
-  auto m = new SensorsTestSharedMemory(type, size);
-  if (m->mSize != size || m->mBuffer == nullptr) {
-    delete m;
-    m = nullptr;
-  }
-  return m;
-}
-
-class SensorEventsChecker {
- public:
-  virtual bool check(const std::vector<Event> &events, std::string *out) const = 0;
-  virtual ~SensorEventsChecker() {}
-};
-
-class NullChecker : public SensorEventsChecker {
- public:
-  virtual bool check(const std::vector<Event> &, std::string *) const {
-    return true;
-  }
-};
-
-class SensorEventPerEventChecker : public SensorEventsChecker {
- public:
-  virtual bool checkEvent(const Event &event, std::string *out) const = 0;
-  virtual bool check(const std::vector<Event> &events, std::string *out) const {
-    for (const auto &e : events) {
-      if (!checkEvent(e, out)) {
-        return false;
-      }
-    }
-    return true;
-  }
-};
-
-class Vec3NormChecker : public SensorEventPerEventChecker {
- public:
-  Vec3NormChecker(float min, float max) : mRange(min, max) {}
-  static Vec3NormChecker byNominal(float nominal, float allowedError) {
-    return Vec3NormChecker(nominal - allowedError, nominal + allowedError);
-  }
-
-  virtual bool checkEvent(const Event &event, std::string *out) const {
-    Vec3 v = event.u.vec3;
-    float norm = std::sqrt(v.x * v.x + v.y * v.y + v.z * v.z);
-    if (norm < mRange.first || norm > mRange.second) {
-      if (out != nullptr) {
-        std::ostringstream ss;
-        ss << "Event @ " << event.timestamp << " (" << v.x << ", " << v.y << ", " << v.z << ")"
-           << " has norm " << norm << ", which is beyond range"
-           << " [" << mRange.first << ", " << mRange.second << "]";
-        *out = ss.str();
-      }
-      return false;
-    }
-    return true;
-  }
- protected:
-  std::pair<float, float> mRange;
-};
-
 // The main test class for SENSORS HIDL HAL.
-class SensorsHidlTest : public ::testing::VtsHalHidlTargetTestBase {
- public:
-  virtual void SetUp() override {
-  }
 
-  virtual void TearDown() override {
-    // stop all sensors
-    for (auto s : mSensorHandles) {
-      S()->activate(s, false);
+class SensorsHidlTest : public SensorsHidlTestBase {
+   protected:
+    SensorInfo defaultSensorByType(SensorType type) override;
+    std::vector<SensorInfo> getSensorsList();
+    // implementation wrapper
+    Return<void> getSensorsList(ISensors::getSensorsList_cb _hidl_cb) override {
+        return S()->getSensorsList(_hidl_cb);
     }
-    mSensorHandles.clear();
 
-    // stop all direct report and channels
-    for (auto c : mDirectChannelHandles) {
-      // disable all reports
-      S()->configDirectReport(-1, c, RateLevel::STOP, [] (auto, auto){});
-      S()->unregisterDirectChannel(c);
+    Return<Result> activate(int32_t sensorHandle, bool enabled) override;
+
+    Return<Result> batch(int32_t sensorHandle, int64_t samplingPeriodNs,
+                         int64_t maxReportLatencyNs) override {
+        return S()->batch(sensorHandle, samplingPeriodNs, maxReportLatencyNs);
     }
-    mDirectChannelHandles.clear();
-  }
 
- protected:
-  SensorInfo defaultSensorByType(SensorType type);
-  std::vector<SensorInfo> getSensorsList();
-  std::vector<Event> collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
-        bool clearBeforeStart = true, bool changeCollection = true);
+    Return<Result> flush(int32_t sensorHandle) override { return S()->flush(sensorHandle); }
 
-  // implementation wrapper
-  Return<void> getSensorsList(ISensors::getSensorsList_cb _hidl_cb) {
-    return S()->getSensorsList(_hidl_cb);
-  }
+    Return<Result> injectSensorData(const Event& event) override {
+        return S()->injectSensorData(event);
+    }
 
-  Return<Result> activate(
-          int32_t sensorHandle, bool enabled);
+    Return<void> registerDirectChannel(const SharedMemInfo& mem,
+                                       ISensors::registerDirectChannel_cb _hidl_cb) override;
 
-  Return<Result> batch(
-          int32_t sensorHandle,
-          int64_t samplingPeriodNs,
-          int64_t maxReportLatencyNs) {
-    return S()->batch(sensorHandle, samplingPeriodNs, maxReportLatencyNs);
-  }
+    Return<Result> unregisterDirectChannel(int32_t channelHandle) override {
+        return S()->unregisterDirectChannel(channelHandle);
+    }
 
-  Return<Result> flush(int32_t sensorHandle) {
-    return S()->flush(sensorHandle);
-  }
+    Return<void> configDirectReport(int32_t sensorHandle, int32_t channelHandle, RateLevel rate,
+                                    ISensors::configDirectReport_cb _hidl_cb) override {
+        return S()->configDirectReport(sensorHandle, channelHandle, rate, _hidl_cb);
+    }
 
-  Return<Result> injectSensorData(const Event& event) {
-    return S()->injectSensorData(event);
-  }
+    inline sp<ISensors>& S() { return SensorsHidlEnvironmentV1_0::Instance()->sensors; }
 
-  Return<void> registerDirectChannel(
-          const SharedMemInfo& mem, ISensors::registerDirectChannel_cb _hidl_cb);
-
-  Return<Result> unregisterDirectChannel(int32_t channelHandle) {
-    return S()->unregisterDirectChannel(channelHandle);
-  }
-
-  Return<void> configDirectReport(
-          int32_t sensorHandle, int32_t channelHandle, RateLevel rate,
-          ISensors::configDirectReport_cb _hidl_cb) {
-    return S()->configDirectReport(sensorHandle, channelHandle, rate, _hidl_cb);
-  }
-
-  inline sp<ISensors>& S() {
-    return SensorsHidlEnvironment::Instance()->sensors;
-  }
-
-  inline static SensorFlagBits extractReportMode(uint64_t flag) {
-    return (SensorFlagBits) (flag
-        & ((uint64_t) SensorFlagBits::CONTINUOUS_MODE
-          | (uint64_t) SensorFlagBits::ON_CHANGE_MODE
-          | (uint64_t) SensorFlagBits::ONE_SHOT_MODE
-          | (uint64_t) SensorFlagBits::SPECIAL_REPORTING_MODE));
-  }
-
-  inline static bool isMetaSensorType(SensorType type) {
-    return (type == SensorType::META_DATA
-            || type == SensorType::DYNAMIC_SENSOR_META
-            || type == SensorType::ADDITIONAL_INFO);
-  }
-
-  inline static bool isValidType(SensorType type) {
-    return (int32_t) type > 0;
-  }
-
-  void testStreamingOperation(SensorType type,
-                              std::chrono::nanoseconds samplingPeriod,
-                              std::chrono::seconds duration,
-                              const SensorEventsChecker &checker);
-  void testSamplingRateHotSwitchOperation(SensorType type, bool fastToSlow = true);
-  void testBatchingOperation(SensorType type);
-  void testDirectReportOperation(
-      SensorType type, SharedMemType memType, RateLevel rate, const SensorEventsChecker &checker);
-
-  static void assertTypeMatchStringType(SensorType type, const hidl_string& stringType);
-  static void assertTypeMatchReportMode(SensorType type, SensorFlagBits reportMode);
-  static void assertDelayMatchReportMode(
-          int32_t minDelay, int32_t maxDelay, SensorFlagBits reportMode);
-  static SensorFlagBits expectedReportModeForType(SensorType type);
-  static bool isDirectReportRateSupported(SensorInfo sensor, RateLevel rate);
-  static bool isDirectChannelTypeSupported(SensorInfo sensor, SharedMemType type);
-
-  // checkers
-  static const Vec3NormChecker sAccelNormChecker;
-  static const Vec3NormChecker sGyroNormChecker;
-
-  // all sensors and direct channnels used
-  std::unordered_set<int32_t> mSensorHandles;
-  std::unordered_set<int32_t> mDirectChannelHandles;
+    SensorsHidlEnvironmentBase* getEnvironment() override {
+        return SensorsHidlEnvironmentV1_0::Instance();
+    }
 };
 
-const Vec3NormChecker SensorsHidlTest::sAccelNormChecker(
-        Vec3NormChecker::byNominal(GRAVITY_EARTH, 1.0f/*m/s^2*/));
-const Vec3NormChecker SensorsHidlTest::sGyroNormChecker(
-        Vec3NormChecker::byNominal(0.f, 0.1f/*rad/s*/));
-
 Return<Result> SensorsHidlTest::activate(int32_t sensorHandle, bool enabled) {
   // If activating a sensor, add the handle in a set so that when test fails it can be turned off.
   // The handle is not removed when it is deactivating on purpose so that it is not necessary to
@@ -618,195 +101,6 @@
   return Void();
 }
 
-std::vector<Event> SensorsHidlTest::collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
-      bool clearBeforeStart, bool changeCollection) {
-  std::vector<Event> events;
-  constexpr useconds_t SLEEP_GRANULARITY = 100*1000; //granularity 100 ms
-
-  ALOGI("collect max of %zu events for %d us, clearBeforeStart %d",
-        nEventLimit, timeLimitUs, clearBeforeStart);
-
-  if (changeCollection) {
-    SensorsHidlEnvironment::Instance()->setCollection(true);
-  }
-  if (clearBeforeStart) {
-    SensorsHidlEnvironment::Instance()->catEvents(nullptr);
-  }
-
-  while (timeLimitUs > 0) {
-    useconds_t duration = std::min(SLEEP_GRANULARITY, timeLimitUs);
-    usleep(duration);
-    timeLimitUs -= duration;
-
-    SensorsHidlEnvironment::Instance()->catEvents(&events);
-    if (events.size() >= nEventLimit) {
-      break;
-    }
-    ALOGV("time to go = %d, events to go = %d",
-          (int)timeLimitUs, (int)(nEventLimit - events.size()));
-  }
-
-  if (changeCollection) {
-    SensorsHidlEnvironment::Instance()->setCollection(false);
-  }
-  return events;
-}
-
-void SensorsHidlTest::assertTypeMatchStringType(SensorType type, const hidl_string& stringType) {
-
-  if (type >= SensorType::DEVICE_PRIVATE_BASE) {
-    return;
-  }
-
-  switch (type) {
-#define CHECK_TYPE_STRING_FOR_SENSOR_TYPE(type) \
-    case SensorType::type: ASSERT_STREQ(SENSOR_STRING_TYPE_ ## type, stringType.c_str()); break;
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER_UNCALIBRATED);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ADDITIONAL_INFO);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(AMBIENT_TEMPERATURE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(DEVICE_ORIENTATION);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(DYNAMIC_SENSOR_META);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GAME_ROTATION_VECTOR);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GEOMAGNETIC_ROTATION_VECTOR);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GLANCE_GESTURE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GRAVITY);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_UNCALIBRATED);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_BEAT);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_RATE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(LIGHT);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(LINEAR_ACCELERATION);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(LOW_LATENCY_OFFBODY_DETECT);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(MAGNETIC_FIELD);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(MAGNETIC_FIELD_UNCALIBRATED);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(MOTION_DETECT);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ORIENTATION);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(PICK_UP_GESTURE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(POSE_6DOF);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(PRESSURE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(PROXIMITY);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(RELATIVE_HUMIDITY);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ROTATION_VECTOR);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(SIGNIFICANT_MOTION);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(STATIONARY_DETECT);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(STEP_COUNTER);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(STEP_DETECTOR);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(TEMPERATURE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(TILT_DETECTOR);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(WAKE_GESTURE);
-    CHECK_TYPE_STRING_FOR_SENSOR_TYPE(WRIST_TILT_GESTURE);
-    default:
-      FAIL() << "Type " << static_cast<int>(type) << " in android defined range is not checked, "
-             << "stringType = " << stringType;
-#undef CHECK_TYPE_STRING_FOR_SENSOR_TYPE
-  }
-}
-
-void SensorsHidlTest::assertTypeMatchReportMode(SensorType type, SensorFlagBits reportMode) {
-  if (type >= SensorType::DEVICE_PRIVATE_BASE) {
-    return;
-  }
-
-  SensorFlagBits expected = expectedReportModeForType(type);
-
-  ASSERT_TRUE(expected == (SensorFlagBits) -1 || expected == reportMode)
-      << "reportMode=" << static_cast<int>(reportMode)
-      << "expected=" << static_cast<int>(expected);
-}
-
-void SensorsHidlTest::assertDelayMatchReportMode(
-    int32_t minDelay, int32_t maxDelay, SensorFlagBits reportMode) {
-  switch(reportMode) {
-    case SensorFlagBits::CONTINUOUS_MODE:
-      ASSERT_LT(0, minDelay);
-      ASSERT_LE(0, maxDelay);
-      break;
-    case SensorFlagBits::ON_CHANGE_MODE:
-      ASSERT_LE(0, minDelay);
-      ASSERT_LE(0, maxDelay);
-      break;
-    case SensorFlagBits::ONE_SHOT_MODE:
-      ASSERT_EQ(-1, minDelay);
-      ASSERT_EQ(0, maxDelay);
-      break;
-    case SensorFlagBits::SPECIAL_REPORTING_MODE:
-      // do not enforce anything for special reporting mode
-      break;
-    default:
-      FAIL() << "Report mode " << static_cast<int>(reportMode) << " not checked";
-  }
-}
-
-// return -1 means no expectation for this type
-SensorFlagBits SensorsHidlTest::expectedReportModeForType(SensorType type) {
-  switch (type) {
-    case SensorType::ACCELEROMETER:
-    case SensorType::ACCELEROMETER_UNCALIBRATED:
-    case SensorType::GYROSCOPE:
-    case SensorType::MAGNETIC_FIELD:
-    case SensorType::ORIENTATION:
-    case SensorType::PRESSURE:
-    case SensorType::TEMPERATURE:
-    case SensorType::GRAVITY:
-    case SensorType::LINEAR_ACCELERATION:
-    case SensorType::ROTATION_VECTOR:
-    case SensorType::MAGNETIC_FIELD_UNCALIBRATED:
-    case SensorType::GAME_ROTATION_VECTOR:
-    case SensorType::GYROSCOPE_UNCALIBRATED:
-    case SensorType::GEOMAGNETIC_ROTATION_VECTOR:
-    case SensorType::POSE_6DOF:
-    case SensorType::HEART_BEAT:
-      return SensorFlagBits::CONTINUOUS_MODE;
-
-    case SensorType::LIGHT:
-    case SensorType::PROXIMITY:
-    case SensorType::RELATIVE_HUMIDITY:
-    case SensorType::AMBIENT_TEMPERATURE:
-    case SensorType::HEART_RATE:
-    case SensorType::DEVICE_ORIENTATION:
-    case SensorType::STEP_COUNTER:
-    case SensorType::LOW_LATENCY_OFFBODY_DETECT:
-      return SensorFlagBits::ON_CHANGE_MODE;
-
-    case SensorType::SIGNIFICANT_MOTION:
-    case SensorType::WAKE_GESTURE:
-    case SensorType::GLANCE_GESTURE:
-    case SensorType::PICK_UP_GESTURE:
-    case SensorType::MOTION_DETECT:
-    case SensorType::STATIONARY_DETECT:
-      return SensorFlagBits::ONE_SHOT_MODE;
-
-    case SensorType::STEP_DETECTOR:
-    case SensorType::TILT_DETECTOR:
-    case SensorType::WRIST_TILT_GESTURE:
-    case SensorType::DYNAMIC_SENSOR_META:
-      return SensorFlagBits::SPECIAL_REPORTING_MODE;
-
-    default:
-      ALOGW("Type %d is not implemented in expectedReportModeForType", (int)type);
-      return (SensorFlagBits)-1;
-  }
-}
-
-bool SensorsHidlTest::isDirectReportRateSupported(SensorInfo sensor, RateLevel rate) {
-  unsigned int r =
-      static_cast<unsigned int>(sensor.flags & SensorFlagBits::MASK_DIRECT_REPORT)
-        >> static_cast<unsigned int>(SensorFlagShift::DIRECT_REPORT);
-  return r >= static_cast<unsigned int>(rate);
-}
-
-bool SensorsHidlTest::isDirectChannelTypeSupported(SensorInfo sensor, SharedMemType type) {
-  switch (type) {
-    case SharedMemType::ASHMEM:
-      return (sensor.flags & SensorFlagBits::DIRECT_CHANNEL_ASHMEM) != 0;
-    case SharedMemType::GRALLOC:
-      return (sensor.flags & SensorFlagBits::DIRECT_CHANNEL_GRALLOC) != 0;
-    default:
-      return false;
-  }
-}
-
 SensorInfo SensorsHidlTest::defaultSensorByType(SensorType type) {
   SensorInfo ret;
 
@@ -951,69 +245,6 @@
     ASSERT_EQ(Result::OK, S()->setOperationMode(OperationMode::NORMAL));
 }
 
-void SensorsHidlTest::testStreamingOperation(SensorType type,
-                                             std::chrono::nanoseconds samplingPeriod,
-                                             std::chrono::seconds duration,
-                                             const SensorEventsChecker &checker) {
-  std::vector<Event> events;
-  std::vector<Event> sensorEvents;
-
-  const int64_t samplingPeriodInNs = samplingPeriod.count();
-  const int64_t batchingPeriodInNs = 0; // no batching
-  const useconds_t minTimeUs = std::chrono::microseconds(duration).count();
-  const size_t minNEvent = duration / samplingPeriod;
-
-  SensorInfo sensor = defaultSensorByType(type);
-
-  if (!isValidType(sensor.type)) {
-    // no default sensor of this type
-    return;
-  }
-
-  if (std::chrono::microseconds(sensor.minDelay) > samplingPeriod) {
-    // rate not supported
-    return;
-  }
-
-  int32_t handle = sensor.sensorHandle;
-
-  ASSERT_EQ(batch(handle, samplingPeriodInNs, batchingPeriodInNs), Result::OK);
-  ASSERT_EQ(activate(handle, 1), Result::OK);
-  events = collectEvents(minTimeUs, minNEvent, true /*clearBeforeStart*/);
-  ASSERT_EQ(activate(handle, 0), Result::OK);
-
-  ALOGI("Collected %zu samples", events.size());
-
-  ASSERT_GT(events.size(), 0u);
-
-  bool handleMismatchReported = false;
-  bool metaSensorTypeErrorReported = false;
-  for (auto & e : events) {
-    if (e.sensorType == type) {
-      // avoid generating hundreds of error
-      if (!handleMismatchReported) {
-        EXPECT_EQ(e.sensorHandle, handle)
-            << (handleMismatchReported = true,
-                "Event of the same type must come from the sensor registered");
-      }
-      sensorEvents.push_back(e);
-    } else {
-      // avoid generating hundreds of error
-      if (!metaSensorTypeErrorReported) {
-        EXPECT_TRUE(isMetaSensorType(e.sensorType))
-            << (metaSensorTypeErrorReported = true,
-                "Only meta types are allowed besides the type registered");
-      }
-    }
-  }
-
-  std::string s;
-  EXPECT_TRUE(checker.check(sensorEvents, &s)) << s;
-
-  EXPECT_GE(sensorEvents.size(),
-            minNEvent / 2);  // make sure returned events are not all meta
-}
-
 // Test if sensor hal can do UI speed accelerometer streaming properly
 TEST_F(SensorsHidlTest, AccelerometerStreamingOperationSlow) {
   testStreamingOperation(SensorType::ACCELEROMETER,
@@ -1086,103 +317,6 @@
                          NullChecker());
 }
 
-void SensorsHidlTest::testSamplingRateHotSwitchOperation(SensorType type, bool fastToSlow) {
-  std::vector<Event> events1, events2;
-
-  constexpr int64_t batchingPeriodInNs = 0; // no batching
-  constexpr int64_t collectionTimeoutUs = 60000000; // 60s
-  constexpr size_t minNEvent = 50;
-
-  SensorInfo sensor = defaultSensorByType(type);
-
-  if (!isValidType(sensor.type)) {
-    // no default sensor of this type
-    return;
-  }
-
-  int32_t handle = sensor.sensorHandle;
-  int64_t minSamplingPeriodInNs = sensor.minDelay * 1000ll;
-  int64_t maxSamplingPeriodInNs = sensor.maxDelay * 1000ll;
-
-  if (minSamplingPeriodInNs == maxSamplingPeriodInNs) {
-    // only support single rate
-    return;
-  }
-
-  int64_t firstCollectionPeriod = fastToSlow ? minSamplingPeriodInNs : maxSamplingPeriodInNs;
-  int64_t secondCollectionPeriod = !fastToSlow ? minSamplingPeriodInNs : maxSamplingPeriodInNs;
-
-  // first collection
-  ASSERT_EQ(batch(handle, firstCollectionPeriod, batchingPeriodInNs), Result::OK);
-  ASSERT_EQ(activate(handle, 1), Result::OK);
-
-  usleep(500000); // sleep 0.5 sec to wait for change rate to happen
-  events1 = collectEvents(collectionTimeoutUs, minNEvent);
-
-  // second collection, without stop sensor
-  ASSERT_EQ(batch(handle, secondCollectionPeriod, batchingPeriodInNs), Result::OK);
-
-  usleep(500000); // sleep 0.5 sec to wait for change rate to happen
-  events2 = collectEvents(collectionTimeoutUs, minNEvent);
-
-  // end of collection, stop sensor
-  ASSERT_EQ(activate(handle, 0), Result::OK);
-
-  ALOGI("Collected %zu fast samples and %zu slow samples", events1.size(), events2.size());
-
-  ASSERT_GT(events1.size(), 0u);
-  ASSERT_GT(events2.size(), 0u);
-
-  int64_t minDelayAverageInterval, maxDelayAverageInterval;
-  std::vector<Event> &minDelayEvents(fastToSlow ? events1 : events2);
-  std::vector<Event> &maxDelayEvents(fastToSlow ? events2 : events1);
-
-  size_t nEvent = 0;
-  int64_t prevTimestamp = -1;
-  int64_t timestampInterval = 0;
-  for (auto & e : minDelayEvents) {
-    if (e.sensorType == type) {
-      ASSERT_EQ(e.sensorHandle, handle);
-      if (prevTimestamp > 0) {
-        timestampInterval += e.timestamp - prevTimestamp;
-      }
-      prevTimestamp = e.timestamp;
-      ++ nEvent;
-    }
-  }
-  ASSERT_GT(nEvent, 2u);
-  minDelayAverageInterval = timestampInterval / (nEvent - 1);
-
-  nEvent = 0;
-  prevTimestamp = -1;
-  timestampInterval = 0;
-  for (auto & e : maxDelayEvents) {
-    if (e.sensorType == type) {
-      ASSERT_EQ(e.sensorHandle, handle);
-      if (prevTimestamp > 0) {
-        timestampInterval += e.timestamp - prevTimestamp;
-      }
-      prevTimestamp = e.timestamp;
-      ++ nEvent;
-    }
-  }
-  ASSERT_GT(nEvent, 2u);
-  maxDelayAverageInterval = timestampInterval / (nEvent - 1);
-
-  // change of rate is significant.
-  ALOGI("min/maxDelayAverageInterval = %" PRId64 " %" PRId64,
-      minDelayAverageInterval, maxDelayAverageInterval);
-  EXPECT_GT((maxDelayAverageInterval - minDelayAverageInterval), minDelayAverageInterval / 10);
-
-  // fastest rate sampling time is close to spec
-  EXPECT_LT(std::abs(minDelayAverageInterval - minSamplingPeriodInNs),
-      minSamplingPeriodInNs / 10);
-
-  // slowest rate sampling time is close to spec
-  EXPECT_LT(std::abs(maxDelayAverageInterval - maxSamplingPeriodInNs),
-      maxSamplingPeriodInNs / 10);
-}
-
 // Test if sensor hal can do accelerometer sampling rate switch properly when sensor is active
 TEST_F(SensorsHidlTest, AccelerometerSamplingPeriodHotSwitchOperation) {
   testSamplingRateHotSwitchOperation(SensorType::ACCELEROMETER);
@@ -1201,74 +335,6 @@
   testSamplingRateHotSwitchOperation(SensorType::MAGNETIC_FIELD, false /*fastToSlow*/);
 }
 
-void SensorsHidlTest::testBatchingOperation(SensorType type) {
-  std::vector<Event> events;
-
-  constexpr int64_t maxBatchingTestTimeNs = 30ull * 1000 * 1000 * 1000;
-  constexpr int64_t oneSecondInNs = 1ull * 1000 * 1000 * 1000;
-
-  SensorInfo sensor = defaultSensorByType(type);
-
-  if (!isValidType(sensor.type)) {
-    // no default sensor of this type
-    return;
-  }
-
-  int32_t handle = sensor.sensorHandle;
-  int64_t minSamplingPeriodInNs = sensor.minDelay * 1000ll;
-  uint32_t minFifoCount = sensor.fifoReservedEventCount;
-  int64_t batchingPeriodInNs = minFifoCount * minSamplingPeriodInNs;
-
-  if (batchingPeriodInNs < oneSecondInNs) {
-    // batching size too small to test reliably
-    return;
-  }
-
-  batchingPeriodInNs = std::min(batchingPeriodInNs, maxBatchingTestTimeNs);
-
-  ALOGI("Test batching for %d ms", (int)(batchingPeriodInNs / 1000 / 1000));
-
-  int64_t allowedBatchDeliverTimeNs =
-      std::max(oneSecondInNs, batchingPeriodInNs / 10);
-
-  ASSERT_EQ(batch(handle, minSamplingPeriodInNs, INT64_MAX), Result::OK);
-  ASSERT_EQ(activate(handle, 1), Result::OK);
-
-  usleep(500000); // sleep 0.5 sec to wait for initialization
-  ASSERT_EQ(flush(handle), Result::OK);
-
-  // wait for 80% of the reserved batching period
-  // there should not be any significant amount of events
-  // since collection is not enabled all events will go down the drain
-  usleep(batchingPeriodInNs / 1000 * 8 / 10);
-
-  SensorsHidlEnvironment::Instance()->setCollection(true);
-  // clean existing collections
-  collectEvents(0 /*timeLimitUs*/, 0/*nEventLimit*/,
-        true /*clearBeforeStart*/, false /*change collection*/);
-
-  // 0.8 + 0.2 times the batching period
-  usleep(batchingPeriodInNs / 1000 * 8 / 10);
-  ASSERT_EQ(flush(handle), Result::OK);
-
-  // plus some time for the event to deliver
-  events = collectEvents(allowedBatchDeliverTimeNs / 1000,
-        minFifoCount, false /*clearBeforeStart*/, false /*change collection*/);
-
-  SensorsHidlEnvironment::Instance()->setCollection(false);
-  ASSERT_EQ(activate(handle, 0), Result::OK);
-
-  size_t nEvent = 0;
-  for (auto & e : events) {
-    if (e.sensorType == type && e.sensorHandle == handle) {
-      ++ nEvent;
-    }
-  }
-
-  // at least reach 90% of advertised capacity
-  ASSERT_GT(nEvent, (size_t)(minFifoCount * 9 / 10));
-}
-
 // Test if sensor hal can do accelerometer batching properly
 TEST_F(SensorsHidlTest, AccelerometerBatchingOperation) {
   testBatchingOperation(SensorType::ACCELEROMETER);
@@ -1284,124 +350,6 @@
   testBatchingOperation(SensorType::MAGNETIC_FIELD);
 }
 
-void SensorsHidlTest::testDirectReportOperation(
-    SensorType type, SharedMemType memType, RateLevel rate, const SensorEventsChecker &checker) {
-  constexpr size_t kEventSize = static_cast<size_t>(SensorsEventFormatOffset::TOTAL_LENGTH);
-  constexpr size_t kNEvent = 4096;
-  constexpr size_t kMemSize = kEventSize * kNEvent;
-
-  constexpr float kNormalNominal = 50;
-  constexpr float kFastNominal = 200;
-  constexpr float kVeryFastNominal = 800;
-
-  constexpr float kNominalTestTimeSec = 1.f;
-  constexpr float kMaxTestTimeSec = kNominalTestTimeSec + 0.5f; // 0.5 second for initialization
-
-  SensorInfo sensor = defaultSensorByType(type);
-
-  if (!isValidType(sensor.type)) {
-    // no default sensor of this type
-    return;
-  }
-
-  if (!isDirectReportRateSupported(sensor, rate)) {
-    return;
-  }
-
-  if (!isDirectChannelTypeSupported(sensor, memType)) {
-    return;
-  }
-
-  std::unique_ptr<SensorsTestSharedMemory>
-      mem(SensorsTestSharedMemory::create(memType, kMemSize));
-  ASSERT_NE(mem, nullptr);
-
-  char* buffer = mem->getBuffer();
-  // fill memory with data
-  for (size_t i = 0; i < kMemSize; ++i) {
-    buffer[i] = '\xcc';
-  }
-
-  int32_t channelHandle;
-  registerDirectChannel(mem->getSharedMemInfo(),
-      [&channelHandle] (auto result, auto channelHandle_) {
-          ASSERT_EQ(result, Result::OK);
-          channelHandle = channelHandle_;
-      });
-
-  // check memory is zeroed
-  for (size_t i = 0; i < kMemSize; ++i) {
-    ASSERT_EQ(buffer[i], '\0');
-  }
-
-  int32_t eventToken;
-  configDirectReport(sensor.sensorHandle, channelHandle, rate,
-      [&eventToken] (auto result, auto token) {
-          ASSERT_EQ(result, Result::OK);
-          eventToken = token;
-      });
-
-  usleep(static_cast<useconds_t>(kMaxTestTimeSec * 1e6f));
-  auto events = mem->parseEvents();
-
-  // find norminal rate
-  float nominalFreq = 0.f;
-  switch (rate) {
-      case RateLevel::NORMAL:
-          nominalFreq = kNormalNominal;
-          break;
-      case RateLevel::FAST:
-          nominalFreq = kFastNominal;
-          break;
-      case RateLevel::VERY_FAST:
-          nominalFreq = kVeryFastNominal;
-          break;
-      case RateLevel::STOP:
-          FAIL();
-  }
-
-  // allowed to be between 55% and 220% of nominal freq
-  ASSERT_GT(events.size(), static_cast<size_t>(nominalFreq * 0.55f * kNominalTestTimeSec));
-  ASSERT_LT(events.size(), static_cast<size_t>(nominalFreq * 2.2f * kMaxTestTimeSec));
-
-  int64_t lastTimestamp = 0;
-  bool typeErrorReported = false;
-  bool tokenErrorReported = false;
-  bool timestampErrorReported = false;
-  std::vector<Event> sensorEvents;
-  for (auto &e : events) {
-    if (!tokenErrorReported) {
-      EXPECT_EQ(eventToken, e.sensorHandle)
-          << (tokenErrorReported = true,
-            "Event token does not match that retured from configDirectReport");
-    }
-
-    if (isMetaSensorType(e.sensorType)) {
-        continue;
-    }
-    sensorEvents.push_back(e);
-
-    if (!typeErrorReported) {
-      EXPECT_EQ(type, e.sensorType)
-          << (typeErrorReported = true,
-              "Type in event does not match type of sensor registered.");
-    }
-    if (!timestampErrorReported) {
-      EXPECT_GT(e.timestamp, lastTimestamp)
-          << (timestampErrorReported = true, "Timestamp not monotonically increasing");
-    }
-    lastTimestamp = e.timestamp;
-  }
-
-  std::string s;
-  EXPECT_TRUE(checker.check(sensorEvents, &s)) << s;
-
-  // stop sensor and unregister channel
-  configDirectReport(sensor.sensorHandle, channelHandle, RateLevel::STOP,
-                     [](auto result, auto) { EXPECT_EQ(result, Result::OK); });
-  EXPECT_EQ(unregisterDirectChannel(channelHandle), Result::OK);
-}
-
 // Test sensor event direct report with ashmem for accel sensor at normal rate
 TEST_F(SensorsHidlTest, AccelerometerAshmemDirectReportOperationNormal) {
   testDirectReportOperation(SensorType::ACCELEROMETER, SharedMemType::ASHMEM, RateLevel::NORMAL,
@@ -1511,11 +459,11 @@
 }
 
 int main(int argc, char **argv) {
-  ::testing::AddGlobalTestEnvironment(SensorsHidlEnvironment::Instance());
-  ::testing::InitGoogleTest(&argc, argv);
-  SensorsHidlEnvironment::Instance()->init(&argc, argv);
-  int status = RUN_ALL_TESTS();
-  ALOGI("Test result = %d", status);
-  return status;
+    ::testing::AddGlobalTestEnvironment(SensorsHidlEnvironmentV1_0::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    SensorsHidlEnvironmentV1_0::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
 }
 // vim: set ts=2 sw=2
diff --git a/sensors/2.0/Android.bp b/sensors/2.0/Android.bp
new file mode 100644
index 0000000..3b948a9
--- /dev/null
+++ b/sensors/2.0/Android.bp
@@ -0,0 +1,24 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.sensors@2.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "ISensors.hal",
+        "ISensorsCallback.hal",
+    ],
+    interfaces: [
+        "android.hardware.sensors@1.0",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "EventQueueFlagBits",
+        "SensorTimeout",
+    ],
+    gen_java: false,
+}
+
diff --git a/sensors/2.0/ISensors.hal b/sensors/2.0/ISensors.hal
new file mode 100644
index 0000000..939bf73
--- /dev/null
+++ b/sensors/2.0/ISensors.hal
@@ -0,0 +1,255 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.sensors@2.0;
+
+import @1.0::Event;
+import @1.0::OperationMode;
+import @1.0::RateLevel;
+import @1.0::Result;
+import @1.0::SensorInfo;
+import @1.0::SharedMemInfo;
+import @2.0::ISensorsCallback;
+
+interface ISensors {
+    /**
+     * Enumerate all available (static) sensors.
+     *
+     * The SensorInfo for each sensor returned by getSensorsList must be stable
+     * from the initial call to getSensorsList after a device boot until the
+     * entire system restarts. The SensorInfo for each sensor must not change
+     * between subsequent calls to getSensorsList, even across restarts of the
+     * HAL and its dependencies (for example, the sensor handle for a given
+     * sensor must not change across HAL restarts).
+     */
+    getSensorsList() generates (vec<SensorInfo> list);
+
+    /**
+     * Place the module in a specific mode. The following modes are defined
+     *
+     *  SENSOR_HAL_NORMAL_MODE - Normal operation. Default state of the module.
+     *
+     *  SENSOR_HAL_DATA_INJECTION_MODE - Loopback mode.
+     *    Data is injected for the supported sensors by the sensor service in
+     *    this mode.
+     *
+     * @return OK on success
+     *     BAD_VALUE if requested mode is not supported
+     *     PERMISSION_DENIED if operation is not allowed
+     */
+    setOperationMode(OperationMode mode) generates (Result result);
+
+    /**
+     * Activate/de-activate one sensor.
+     *
+     * After sensor de-activation, existing sensor events that have not
+     * been written to the event queue must be abandoned immediately so that
+     * subsequent activations do not get stale sensor events (events
+     * that are generated prior to the latter activation).
+     *
+     * @param sensorHandle is the handle of the sensor to change.
+     * @param enabled set to true to enable, or false to disable the sensor.
+     * @return result OK on success, BAD_VALUE if sensorHandle is invalid.
+     */
+    activate(int32_t sensorHandle, bool enabled) generates (Result result);
+
+    /**
+     * Initialize the Sensors HAL's Fast Message Queues (FMQ) and callback.
+     *
+     * The Fast Message Queues (FMQ) that are used to send data between the
+     * framework and the HAL. The callback is used by the HAL to notify the
+     * framework of asynchronous events, such as a dynamic sensor connection.
+     *
+     * The Event FMQ is used to transport sensor events from the HAL to the
+     * framework. The Event FMQ is created using the eventQueueDescriptor.
+     * Data may only be written to the Event FMQ. Data must not be read from
+     * the Event FMQ since the framework is the only reader. Upon receiving
+     * sensor events, the HAL should write the sensor events to the Event FMQ.
+     * Once the HAL is finished writing sensor events to the Event FMQ, the HAL
+     * must call the Event FMQ's EventFlag wake() function with the
+     * EventQueueFlagBits::READ_AND_PROCESS mask which notifies the framework
+     * that sensor events are available to be read and processed.
+     *
+     * The Wake Lock FMQ is used by the framework to notify the HAL when it is
+     * safe to release its wake_lock. When the framework receives WAKE_UP events
+     * from the Event FMQ and the framework has acquired a wake_lock, the
+     * framework must write a WakeLockEvent to the Wake Lock FMQ with the number
+     * of WAKE_UP events processed. When the HAL reads the WakeLockEvent from
+     * the Wake Lock FMQ, the HAL should decrement its current count of
+     * unprocessed WAKE_UP events and release its wake_lock if the current
+     * count of unprocessed WAKE_UP events is zero.
+     *
+     * The ISensorsCallback is used by the HAL to notify the framework of
+     * asynchronous events, such as a dynamic sensor connection.
+     *
+     * The name of any wake_lock acquired by the Sensors HAL for WAKE_UP events
+     * must begin with "SensorsHAL_WAKEUP".
+     *
+     * If WAKE_LOCK_TIMEOUT_SECONDS has elapsed since the most recent WAKE_UP
+     * event was written to the Event FMQ without receiving a message on the
+     * Wake Lock FMQ, then any held wake_lock for WAKE_UP events must be
+     * released.
+     *
+     * If either the Event FMQ or the Wake Lock FMQ is already initialized when
+     * initialize is invoked, then both existing FMQs must be discarded and the
+     * new descriptors must be used to create new FMQs within the HAL. The
+     * number of outstanding WAKE_UP events should also be reset to zero, and
+     * any outstanding wake_locks held as a result of WAKE_UP events should be
+     * released.
+     *
+     * initialize must be thread safe and prevent concurrent calls
+     * to initialize from simultaneously modifying state.
+     *
+     * @param eventQueueDescriptor Fast Message Queue descriptor that is used to
+     *     create the Event FMQ which is where sensor events are written. The
+     *     descriptor is obtained from the framework's FMQ that is used to read
+     *     sensor events.
+     * @param wakeLockDescriptor Fast Message Queue descriptor that is used to
+     *     create the Wake Lock FMQ which is where wake_lock events are read
+     *     from. The descriptor is obtained from the framework's FMQ that is
+     *     used to write wake_lock events.
+     * @param sensorsCallback sensors callback that receives asynchronous data
+     *     from the Sensors HAL.
+     * @return result OK on success; BAD_VALUE if descriptor is invalid (such
+     *     as null)
+     */
+    @entry
+    @callflow(next = {"getSensorsList"})
+    initialize(fmq_sync<Event> eventQueueDescriptor,
+               fmq_sync<uint32_t> wakeLockDescriptor,
+               ISensorsCallback sensorsCallback)
+        generates
+              (Result result);
+
+    /**
+     * Sets a sensor’s parameters, including sampling frequency and maximum
+     * report latency. This function can be called while the sensor is
+     * activated, in which case it must not cause any sensor measurements to
+     * be lost: transitioning from one sampling rate to the other cannot cause
+     * lost events, nor can transitioning from a high maximum report latency to
+     * a low maximum report latency.
+     *
+     * @param sensorHandle handle of sensor to be changed.
+     * @param samplingPeriodNs specifies sensor sample period in nanoseconds.
+     * @param maxReportLatencyNs allowed delay time before an event is sampled
+     *     to time of report.
+     * @return result OK on success, BAD_VALUE if any parameters are invalid.
+     */
+    batch(int32_t sensorHandle,
+          int64_t samplingPeriodNs,
+          int64_t maxReportLatencyNs)
+        generates (
+          Result result);
+
+    /**
+     * Trigger a flush of internal FIFO.
+     *
+     * Flush adds a FLUSH_COMPLETE metadata event to the end of the "batch mode"
+     * FIFO for the specified sensor and flushes the FIFO.  If the FIFO is empty
+     * or if the sensor doesn't support batching (FIFO size zero), return
+     * SUCCESS and add a trivial FLUSH_COMPLETE event added to the event stream.
+     * This applies to all sensors other than one-shot sensors. If the sensor
+     * is a one-shot sensor, flush must return BAD_VALUE and not generate any
+     * flush complete metadata.  If the sensor is not active at the time flush()
+     * is called, flush() return BAD_VALUE.
+     *
+     * @param sensorHandle handle of sensor to be flushed.
+     * @return result OK on success and BAD_VALUE if sensorHandle is invalid.
+     */
+    flush(int32_t sensorHandle) generates (Result result);
+
+    /**
+     * Inject a single sensor event or push operation environment parameters to
+     * device.
+     *
+     * When device is in NORMAL mode, this function is called to push operation
+     * environment data to device. In this operation, Event is always of
+     * SensorType::AdditionalInfo type. See operation evironment parameters
+     * section in AdditionalInfoType.
+     *
+     * When device is in DATA_INJECTION mode, this function is also used for
+     * injecting sensor events.
+     *
+     * Regardless of OperationMode, injected SensorType::ADDITIONAL_INFO
+     * type events should not be routed back to the sensor event queue.
+     *
+     * @see AdditionalInfoType
+     * @see OperationMode
+     * @param event sensor event to be injected
+     * @return result OK on success; PERMISSION_DENIED if operation is not
+     *     allowed; INVALID_OPERATION, if this functionality is unsupported;
+     *     BAD_VALUE if sensor event cannot be injected.
+     */
+    injectSensorData(Event event) generates (Result result);
+
+    /**
+     * Register direct report channel.
+     *
+     * Register a direct channel with supplied shared memory information. Upon
+     * return, the sensor hardware is responsible for resetting the memory
+     * content to initial value (depending on memory format settings).
+     *
+     * @param mem shared memory info data structure.
+     * @return result OK on success; BAD_VALUE if shared memory information is
+     *     not consistent; NO_MEMORY if shared memory cannot be used by sensor
+     *     system; INVALID_OPERATION if functionality is not supported.
+     * @return channelHandle a positive integer used for referencing registered
+     *     direct channel (>0) in configureDirectReport and
+     *     unregisterDirectChannel if result is OK, -1 otherwise.
+     */
+    registerDirectChannel(SharedMemInfo mem)
+               generates (Result result,
+                          int32_t channelHandle);
+
+    /**
+     * Unregister direct report channel.
+     *
+     * Unregister a direct channel previously registered using
+     * registerDirectChannel, and remove all active sensor report configured in
+     * still active sensor report configured in the direct channel.
+     *
+     * @param channelHandle handle of direct channel to be unregistered.
+     * @return result OK if direct report is supported; INVALID_OPERATION
+     *     otherwise.
+     */
+    unregisterDirectChannel(int32_t channelHandle) generates (Result result);
+
+    /**
+     * Configure direct sensor event report in direct channel.
+     *
+     * This function start, modify rate or stop direct report of a sensor in a
+     * certain direct channel.
+     *
+     * @param sensorHandle handle of sensor to be configured. When combined
+     *     with STOP rate, sensorHandle can be -1 to denote all active sensors
+     *     in the direct channel specified by channel Handle.
+     * @param channelHandle handle of direct channel to be configured.
+     * @param rate rate level, see RateLevel enum.
+     * @return result OK on success; BAD_VALUE if parameter is invalid (such as
+     *     rate level is not supported by sensor, channelHandle does not exist,
+     *     etc); INVALID_OPERATION if functionality is not supported.
+     * @return reportToken positive integer to identify multiple sensors of
+     *     the same type in a single direct channel. Ignored if rate is STOP.
+     *     See SharedMemFormat.
+     */
+    configDirectReport(
+            int32_t sensorHandle,
+            int32_t channelHandle,
+            RateLevel rate
+        ) generates (
+            Result result,
+            int32_t reportToken);
+};
diff --git a/sensors/2.0/ISensorsCallback.hal b/sensors/2.0/ISensorsCallback.hal
new file mode 100644
index 0000000..e0bd98f
--- /dev/null
+++ b/sensors/2.0/ISensorsCallback.hal
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.sensors@2.0;
+
+import @1.0::SensorInfo;
+
+interface ISensorsCallback {
+    /**
+     * Notify the framework that new dynamic sensors have been connected.
+     *
+     * If a dynamic sensor was previously connected and has not been
+     * disconnected, then that sensor must not be included in sensorInfos.
+     *
+     * @param sensorInfos vector of SensorInfo for each dynamic sensor that
+     *     was connected.
+     */
+    oneway onDynamicSensorsConnected(vec<SensorInfo> sensorInfos);
+
+    /**
+     * Notify the framework that previously connected dynamic sensors have been
+     * disconnected.
+     *
+     * If a dynamic sensor was previously disconnected and has not been
+     * reconnected, then that sensor must not be included in sensorHandles.
+     *
+     * The HAL must ensure that all sensor events from departing dynamic
+     * sensors have been written to the Event FMQ before calling
+     * onDynamicSensorsDisconnected.
+     *
+     * @param sensorHandles vector of sensor handles for each dynamic sensors
+     *     that was disconnected.
+     */
+    oneway onDynamicSensorsDisconnected(vec<int32_t> sensorHandles);
+};
diff --git a/sensors/2.0/default/Android.bp b/sensors/2.0/default/Android.bp
new file mode 100644
index 0000000..db0b148
--- /dev/null
+++ b/sensors/2.0/default/Android.bp
@@ -0,0 +1,38 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_binary {
+    name: "android.hardware.sensors@2.0-service",
+    defaults: ["hidl_defaults"],
+    vendor: true,
+    relative_install_path: "hw",
+    srcs: [
+        "service.cpp",
+        "Sensor.cpp",
+        "Sensors.cpp",
+    ],
+    init_rc: ["android.hardware.sensors@2.0-service.rc"],
+    shared_libs: [
+        "android.hardware.sensors@1.0",
+        "android.hardware.sensors@2.0",
+        "libcutils",
+        "libfmq",
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libpower",
+        "libutils",
+    ],
+}
diff --git a/sensors/2.0/default/OWNERS b/sensors/2.0/default/OWNERS
new file mode 100644
index 0000000..2031d84
--- /dev/null
+++ b/sensors/2.0/default/OWNERS
@@ -0,0 +1,2 @@
+bduddie@google.com
+bstack@google.com
diff --git a/sensors/2.0/default/Sensor.cpp b/sensors/2.0/default/Sensor.cpp
new file mode 100644
index 0000000..168b402
--- /dev/null
+++ b/sensors/2.0/default/Sensor.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Sensor.h"
+
+#include <utils/SystemClock.h>
+
+namespace android {
+namespace hardware {
+namespace sensors {
+namespace V2_0 {
+namespace implementation {
+
+using ::android::hardware::sensors::V1_0::MetaDataEventType;
+using ::android::hardware::sensors::V1_0::SensorFlagBits;
+using ::android::hardware::sensors::V1_0::SensorStatus;
+
+Sensor::Sensor(ISensorsEventCallback* callback)
+    : mIsEnabled(false),
+      mSamplingPeriodNs(0),
+      mLastSampleTimeNs(0),
+      mCallback(callback),
+      mMode(OperationMode::NORMAL) {
+    mRunThread = std::thread(startThread, this);
+}
+
+Sensor::~Sensor() {
+    std::unique_lock<std::mutex> lock(mRunMutex);
+    mStopThread = true;
+    mIsEnabled = false;
+    mWaitCV.notify_all();
+    lock.release();
+    mRunThread.join();
+}
+
+const SensorInfo& Sensor::getSensorInfo() const {
+    return mSensorInfo;
+}
+
+void Sensor::batch(int32_t samplingPeriodNs) {
+    if (samplingPeriodNs < mSensorInfo.minDelay * 1000) {
+        samplingPeriodNs = mSensorInfo.minDelay * 1000;
+    } else if (samplingPeriodNs > mSensorInfo.maxDelay * 1000) {
+        samplingPeriodNs = mSensorInfo.maxDelay * 1000;
+    }
+
+    if (mSamplingPeriodNs != samplingPeriodNs) {
+        mSamplingPeriodNs = samplingPeriodNs;
+        // Wake up the 'run' thread to check if a new event should be generated now
+        mWaitCV.notify_all();
+    }
+}
+
+void Sensor::activate(bool enable) {
+    if (mIsEnabled != enable) {
+        std::unique_lock<std::mutex> lock(mRunMutex);
+        mIsEnabled = enable;
+        mWaitCV.notify_all();
+    }
+}
+
+Result Sensor::flush() {
+    // Only generate a flush complete event if the sensor is enabled and if the sensor is not a
+    // one-shot sensor.
+    if (!mIsEnabled || (mSensorInfo.flags & static_cast<uint32_t>(SensorFlagBits::ONE_SHOT_MODE))) {
+        return Result::BAD_VALUE;
+    }
+
+    // Note: If a sensor supports batching, write all of the currently batched events for the sensor
+    // to the Event FMQ prior to writing the flush complete event.
+    Event ev;
+    ev.sensorHandle = mSensorInfo.sensorHandle;
+    ev.sensorType = SensorType::ADDITIONAL_INFO;
+    ev.u.meta.what = MetaDataEventType::META_DATA_FLUSH_COMPLETE;
+    std::vector<Event> evs{ev};
+    mCallback->postEvents(evs, isWakeUpSensor());
+
+    return Result::OK;
+}
+
+void Sensor::startThread(Sensor* sensor) {
+    sensor->run();
+}
+
+void Sensor::run() {
+    std::unique_lock<std::mutex> runLock(mRunMutex);
+    constexpr int64_t kNanosecondsInSeconds = 1000 * 1000 * 1000;
+
+    while (!mStopThread) {
+        if (!mIsEnabled || mMode == OperationMode::DATA_INJECTION) {
+            mWaitCV.wait(runLock, [&] {
+                return ((mIsEnabled && mMode == OperationMode::NORMAL) || mStopThread);
+            });
+        } else {
+            timespec curTime;
+            clock_gettime(CLOCK_REALTIME, &curTime);
+            int64_t now = (curTime.tv_sec * kNanosecondsInSeconds) + curTime.tv_nsec;
+            int64_t nextSampleTime = mLastSampleTimeNs + mSamplingPeriodNs;
+
+            if (now >= nextSampleTime) {
+                mLastSampleTimeNs = now;
+                nextSampleTime = mLastSampleTimeNs + mSamplingPeriodNs;
+                mCallback->postEvents(readEvents(), isWakeUpSensor());
+            }
+
+            mWaitCV.wait_for(runLock, std::chrono::nanoseconds(nextSampleTime - now));
+        }
+    }
+}
+
+bool Sensor::isWakeUpSensor() {
+    return mSensorInfo.flags & static_cast<uint32_t>(SensorFlagBits::WAKE_UP);
+}
+
+std::vector<Event> Sensor::readEvents() {
+    std::vector<Event> events;
+    Event event;
+    event.sensorHandle = mSensorInfo.sensorHandle;
+    event.sensorType = mSensorInfo.type;
+    event.timestamp = ::android::elapsedRealtimeNano();
+    event.u.vec3.x = 1;
+    event.u.vec3.y = 2;
+    event.u.vec3.z = 3;
+    event.u.vec3.status = SensorStatus::ACCURACY_HIGH;
+    events.push_back(event);
+    return events;
+}
+
+void Sensor::setOperationMode(OperationMode mode) {
+    if (mMode != mode) {
+        std::unique_lock<std::mutex> lock(mRunMutex);
+        mMode = mode;
+        mWaitCV.notify_all();
+    }
+}
+
+bool Sensor::supportsDataInjection() const {
+    return mSensorInfo.flags & static_cast<uint32_t>(SensorFlagBits::DATA_INJECTION);
+}
+
+Result Sensor::injectEvent(const Event& event) {
+    Result result = Result::OK;
+    if (event.sensorType == SensorType::ADDITIONAL_INFO) {
+        // When in OperationMode::NORMAL, SensorType::ADDITIONAL_INFO is used to push operation
+        // environment data into the device.
+    } else if (!supportsDataInjection()) {
+        result = Result::INVALID_OPERATION;
+    } else if (mMode == OperationMode::DATA_INJECTION) {
+        mCallback->postEvents(std::vector<Event>{event}, isWakeUpSensor());
+    } else {
+        result = Result::BAD_VALUE;
+    }
+    return result;
+}
+
+AccelSensor::AccelSensor(int32_t sensorHandle, ISensorsEventCallback* callback) : Sensor(callback) {
+    mSensorInfo.sensorHandle = sensorHandle;
+    mSensorInfo.name = "Accel Sensor";
+    mSensorInfo.vendor = "Vendor String";
+    mSensorInfo.version = 1;
+    mSensorInfo.type = SensorType::ACCELEROMETER;
+    mSensorInfo.typeAsString = "";
+    mSensorInfo.maxRange = 78.4f;  // +/- 8g
+    mSensorInfo.resolution = 1.52e-5;
+    mSensorInfo.power = 0.001f;          // mA
+    mSensorInfo.minDelay = 20 * 1000;    // microseconds
+    mSensorInfo.maxDelay = 1000 * 1000;  // microseconds
+    mSensorInfo.fifoReservedEventCount = 0;
+    mSensorInfo.fifoMaxEventCount = 0;
+    mSensorInfo.requiredPermission = "";
+    mSensorInfo.flags =
+        static_cast<uint32_t>(SensorFlagBits::WAKE_UP | SensorFlagBits::DATA_INJECTION);
+};
+
+}  // namespace implementation
+}  // namespace V2_0
+}  // namespace sensors
+}  // namespace hardware
+}  // namespace android
diff --git a/sensors/2.0/default/Sensor.h b/sensors/2.0/default/Sensor.h
new file mode 100644
index 0000000..3ab2299
--- /dev/null
+++ b/sensors/2.0/default/Sensor.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_SENSORS_V2_0_SENSOR_H
+#define ANDROID_HARDWARE_SENSORS_V2_0_SENSOR_H
+
+#include <android/hardware/sensors/1.0/types.h>
+
+#include <condition_variable>
+#include <memory>
+#include <mutex>
+#include <thread>
+#include <vector>
+
+using ::android::hardware::sensors::V1_0::Event;
+using ::android::hardware::sensors::V1_0::OperationMode;
+using ::android::hardware::sensors::V1_0::Result;
+using ::android::hardware::sensors::V1_0::SensorInfo;
+using ::android::hardware::sensors::V1_0::SensorType;
+
+namespace android {
+namespace hardware {
+namespace sensors {
+namespace V2_0 {
+namespace implementation {
+
+class ISensorsEventCallback {
+   public:
+    virtual ~ISensorsEventCallback(){};
+    virtual void postEvents(const std::vector<Event>& events, bool wakeup) = 0;
+};
+
+class Sensor {
+   public:
+    Sensor(ISensorsEventCallback* callback);
+    virtual ~Sensor();
+
+    const SensorInfo& getSensorInfo() const;
+    void batch(int32_t samplingPeriodNs);
+    void activate(bool enable);
+    Result flush();
+
+    void setOperationMode(OperationMode mode);
+    bool supportsDataInjection() const;
+    Result injectEvent(const Event& event);
+
+   protected:
+    void run();
+    virtual std::vector<Event> readEvents();
+    static void startThread(Sensor* sensor);
+
+    bool isWakeUpSensor();
+
+    bool mIsEnabled;
+    int64_t mSamplingPeriodNs;
+    int64_t mLastSampleTimeNs;
+    SensorInfo mSensorInfo;
+
+    std::atomic_bool mStopThread;
+    std::condition_variable mWaitCV;
+    std::mutex mRunMutex;
+    std::thread mRunThread;
+
+    ISensorsEventCallback* mCallback;
+
+    OperationMode mMode;
+};
+
+class AccelSensor : public Sensor {
+   public:
+    AccelSensor(int32_t sensorHandle, ISensorsEventCallback* callback);
+};
+
+}  // namespace implementation
+}  // namespace V2_0
+}  // namespace sensors
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_SENSORS_V2_0_SENSOR_H
diff --git a/sensors/2.0/default/Sensors.cpp b/sensors/2.0/default/Sensors.cpp
new file mode 100644
index 0000000..efc8b05
--- /dev/null
+++ b/sensors/2.0/default/Sensors.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Sensors.h"
+
+#include <android/hardware/sensors/2.0/types.h>
+#include <log/log.h>
+
+namespace android {
+namespace hardware {
+namespace sensors {
+namespace V2_0 {
+namespace implementation {
+
+using ::android::hardware::sensors::V1_0::Event;
+using ::android::hardware::sensors::V1_0::OperationMode;
+using ::android::hardware::sensors::V1_0::RateLevel;
+using ::android::hardware::sensors::V1_0::Result;
+using ::android::hardware::sensors::V1_0::SharedMemInfo;
+using ::android::hardware::sensors::V2_0::SensorTimeout;
+
+constexpr const char* kWakeLockName = "SensorsHAL_WAKEUP";
+
+Sensors::Sensors()
+    : mEventQueueFlag(nullptr),
+      mOutstandingWakeUpEvents(0),
+      mReadWakeLockQueueRun(false),
+      mAutoReleaseWakeLockTime(0),
+      mHasWakeLock(false) {
+    std::shared_ptr<AccelSensor> accel =
+        std::make_shared<AccelSensor>(1 /* sensorHandle */, this /* callback */);
+    mSensors[accel->getSensorInfo().sensorHandle] = accel;
+}
+
+Sensors::~Sensors() {
+    deleteEventFlag();
+    mReadWakeLockQueueRun = false;
+    mWakeLockThread.join();
+}
+
+// Methods from ::android::hardware::sensors::V2_0::ISensors follow.
+Return<void> Sensors::getSensorsList(getSensorsList_cb _hidl_cb) {
+    std::vector<SensorInfo> sensors;
+    for (const auto& sensor : mSensors) {
+        sensors.push_back(sensor.second->getSensorInfo());
+    }
+
+    // Call the HIDL callback with the SensorInfo
+    _hidl_cb(sensors);
+
+    return Void();
+}
+
+Return<Result> Sensors::setOperationMode(OperationMode mode) {
+    for (auto sensor : mSensors) {
+        sensor.second->setOperationMode(mode);
+    }
+    return Result::OK;
+}
+
+Return<Result> Sensors::activate(int32_t sensorHandle, bool enabled) {
+    auto sensor = mSensors.find(sensorHandle);
+    if (sensor != mSensors.end()) {
+        sensor->second->activate(enabled);
+        return Result::OK;
+    }
+    return Result::BAD_VALUE;
+}
+
+Return<Result> Sensors::initialize(
+    const ::android::hardware::MQDescriptorSync<Event>& eventQueueDescriptor,
+    const ::android::hardware::MQDescriptorSync<uint32_t>& wakeLockDescriptor,
+    const sp<ISensorsCallback>& sensorsCallback) {
+    Result result = Result::OK;
+
+    // Save a reference to the callback
+    mCallback = sensorsCallback;
+
+    // Create the Event FMQ from the eventQueueDescriptor. Reset the read/write positions.
+    mEventQueue =
+        std::make_unique<EventMessageQueue>(eventQueueDescriptor, true /* resetPointers */);
+
+    // Ensure that any existing EventFlag is properly deleted
+    deleteEventFlag();
+
+    // Create the EventFlag that is used to signal to the framework that sensor events have been
+    // written to the Event FMQ
+    if (EventFlag::createEventFlag(mEventQueue->getEventFlagWord(), &mEventQueueFlag) != OK) {
+        result = Result::BAD_VALUE;
+    }
+
+    // Create the Wake Lock FMQ that is used by the framework to communicate whenever WAKE_UP
+    // events have been successfully read and handled by the framework.
+    mWakeLockQueue =
+        std::make_unique<WakeLockMessageQueue>(wakeLockDescriptor, true /* resetPointers */);
+
+    if (!mCallback || !mEventQueue || !mWakeLockQueue || mEventQueueFlag == nullptr) {
+        result = Result::BAD_VALUE;
+    }
+
+    // Start the thread to read events from the Wake Lock FMQ
+    mReadWakeLockQueueRun = true;
+    mWakeLockThread = std::thread(startReadWakeLockThread, this);
+
+    return result;
+}
+
+Return<Result> Sensors::batch(int32_t sensorHandle, int64_t samplingPeriodNs,
+                              int64_t /* maxReportLatencyNs */) {
+    auto sensor = mSensors.find(sensorHandle);
+    if (sensor != mSensors.end()) {
+        sensor->second->batch(samplingPeriodNs);
+        return Result::OK;
+    }
+    return Result::BAD_VALUE;
+}
+
+Return<Result> Sensors::flush(int32_t sensorHandle) {
+    auto sensor = mSensors.find(sensorHandle);
+    if (sensor != mSensors.end()) {
+        return sensor->second->flush();
+    }
+    return Result::BAD_VALUE;
+}
+
+Return<Result> Sensors::injectSensorData(const Event& event) {
+    auto sensor = mSensors.find(event.sensorHandle);
+    if (sensor != mSensors.end()) {
+        return sensor->second->injectEvent(event);
+    }
+
+    return Result::BAD_VALUE;
+}
+
+Return<void> Sensors::registerDirectChannel(const SharedMemInfo& /* mem */,
+                                            registerDirectChannel_cb _hidl_cb) {
+    _hidl_cb(Result::INVALID_OPERATION, -1 /* channelHandle */);
+    return Return<void>();
+}
+
+Return<Result> Sensors::unregisterDirectChannel(int32_t /* channelHandle */) {
+    return Result::INVALID_OPERATION;
+}
+
+Return<void> Sensors::configDirectReport(int32_t /* sensorHandle */, int32_t /* channelHandle */,
+                                         RateLevel /* rate */, configDirectReport_cb _hidl_cb) {
+    _hidl_cb(Result::INVALID_OPERATION, 0 /* reportToken */);
+    return Return<void>();
+}
+
+void Sensors::postEvents(const std::vector<Event>& events, bool wakeup) {
+    std::lock_guard<std::mutex> lock(mWriteLock);
+    if (mEventQueue->write(events.data(), events.size())) {
+        mEventQueueFlag->wake(static_cast<uint32_t>(EventQueueFlagBits::READ_AND_PROCESS));
+
+        if (wakeup) {
+            // Keep track of the number of outstanding WAKE_UP events in order to properly hold
+            // a wake lock until the framework has secured a wake lock
+            updateWakeLock(events.size(), 0 /* eventsHandled */);
+        }
+    }
+}
+
+void Sensors::updateWakeLock(int32_t eventsWritten, int32_t eventsHandled) {
+    std::lock_guard<std::mutex> lock(mWakeLockLock);
+    int32_t newVal = mOutstandingWakeUpEvents + eventsWritten - eventsHandled;
+    if (newVal < 0) {
+        mOutstandingWakeUpEvents = 0;
+    } else {
+        mOutstandingWakeUpEvents = newVal;
+    }
+
+    if (eventsWritten > 0) {
+        // Update the time at which the last WAKE_UP event was sent
+        mAutoReleaseWakeLockTime = ::android::uptimeMillis() +
+                                   static_cast<uint32_t>(SensorTimeout::WAKE_LOCK_SECONDS) * 1000;
+    }
+
+    if (!mHasWakeLock && mOutstandingWakeUpEvents > 0 &&
+        acquire_wake_lock(PARTIAL_WAKE_LOCK, kWakeLockName) == 0) {
+        mHasWakeLock = true;
+    } else if (mHasWakeLock) {
+        // Check if the wake lock should be released automatically if
+        // SensorTimeout::WAKE_LOCK_SECONDS has elapsed since the last WAKE_UP event was written to
+        // the Wake Lock FMQ.
+        if (::android::uptimeMillis() > mAutoReleaseWakeLockTime) {
+            ALOGD("No events read from wake lock FMQ for %d seconds, auto releasing wake lock",
+                  SensorTimeout::WAKE_LOCK_SECONDS);
+            mOutstandingWakeUpEvents = 0;
+        }
+
+        if (mOutstandingWakeUpEvents == 0 && release_wake_lock(kWakeLockName) == 0) {
+            mHasWakeLock = false;
+        }
+    }
+}
+
+void Sensors::readWakeLockFMQ() {
+    while (mReadWakeLockQueueRun.load()) {
+        constexpr int64_t kReadTimeoutNs = 500 * 1000 * 1000;  // 500 ms
+        uint32_t eventsHandled = 0;
+
+        // Read events from the Wake Lock FMQ. Timeout after a reasonable amount of time to ensure
+        // that any held wake lock is able to be released if it is held for too long.
+        mWakeLockQueue->readBlocking(&eventsHandled, 1 /* count */, kReadTimeoutNs);
+        updateWakeLock(0 /* eventsWritten */, eventsHandled);
+    }
+}
+
+void Sensors::startReadWakeLockThread(Sensors* sensors) {
+    sensors->readWakeLockFMQ();
+}
+
+void Sensors::deleteEventFlag() {
+    status_t status = EventFlag::deleteEventFlag(&mEventQueueFlag);
+    if (status != OK) {
+        ALOGI("Failed to delete event flag: %d", status);
+    }
+}
+
+}  // namespace implementation
+}  // namespace V2_0
+}  // namespace sensors
+}  // namespace hardware
+}  // namespace android
diff --git a/sensors/2.0/default/Sensors.h b/sensors/2.0/default/Sensors.h
new file mode 100644
index 0000000..eba3f97
--- /dev/null
+++ b/sensors/2.0/default/Sensors.h
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_SENSORS_V2_0_SENSORS_H
+#define ANDROID_HARDWARE_SENSORS_V2_0_SENSORS_H
+
+#include "Sensor.h"
+
+#include <android/hardware/sensors/2.0/ISensors.h>
+#include <fmq/MessageQueue.h>
+#include <hardware_legacy/power.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+#include <atomic>
+#include <memory>
+#include <thread>
+
+namespace android {
+namespace hardware {
+namespace sensors {
+namespace V2_0 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::EventFlag;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::MessageQueue;
+using ::android::hardware::MQDescriptor;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+
+struct Sensors : public ISensors, public ISensorsEventCallback {
+    using Event = ::android::hardware::sensors::V1_0::Event;
+    using OperationMode = ::android::hardware::sensors::V1_0::OperationMode;
+    using RateLevel = ::android::hardware::sensors::V1_0::RateLevel;
+    using Result = ::android::hardware::sensors::V1_0::Result;
+    using SharedMemInfo = ::android::hardware::sensors::V1_0::SharedMemInfo;
+
+    Sensors();
+    virtual ~Sensors();
+
+    // Methods from ::android::hardware::sensors::V2_0::ISensors follow.
+    Return<void> getSensorsList(getSensorsList_cb _hidl_cb) override;
+
+    Return<Result> setOperationMode(OperationMode mode) override;
+
+    Return<Result> activate(int32_t sensorHandle, bool enabled) override;
+
+    Return<Result> initialize(
+        const ::android::hardware::MQDescriptorSync<Event>& eventQueueDescriptor,
+        const ::android::hardware::MQDescriptorSync<uint32_t>& wakeLockDescriptor,
+        const sp<ISensorsCallback>& sensorsCallback) override;
+
+    Return<Result> batch(int32_t sensorHandle, int64_t samplingPeriodNs,
+                         int64_t maxReportLatencyNs) override;
+
+    Return<Result> flush(int32_t sensorHandle) override;
+
+    Return<Result> injectSensorData(const Event& event) override;
+
+    Return<void> registerDirectChannel(const SharedMemInfo& mem,
+                                       registerDirectChannel_cb _hidl_cb) override;
+
+    Return<Result> unregisterDirectChannel(int32_t channelHandle) override;
+
+    Return<void> configDirectReport(int32_t sensorHandle, int32_t channelHandle, RateLevel rate,
+                                    configDirectReport_cb _hidl_cb) override;
+
+    void postEvents(const std::vector<Event>& events, bool wakeup) override;
+
+   private:
+    /**
+     * Utility function to delete the Event Flag
+     */
+    void deleteEventFlag();
+
+    /**
+     * Function to read the Wake Lock FMQ and release the wake lock when appropriate
+     */
+    void readWakeLockFMQ();
+
+    static void startReadWakeLockThread(Sensors* sensors);
+
+    /**
+     * Responsible for acquiring and releasing a wake lock when there are unhandled WAKE_UP events
+     */
+    void updateWakeLock(int32_t eventsWritten, int32_t eventsHandled);
+
+    using EventMessageQueue = MessageQueue<Event, kSynchronizedReadWrite>;
+    using WakeLockMessageQueue = MessageQueue<uint32_t, kSynchronizedReadWrite>;
+
+    /**
+     * The Event FMQ where sensor events are written
+     */
+    std::unique_ptr<EventMessageQueue> mEventQueue;
+
+    /**
+     * The Wake Lock FMQ that is read to determine when the framework has handled WAKE_UP events
+     */
+    std::unique_ptr<WakeLockMessageQueue> mWakeLockQueue;
+
+    /**
+     * Event Flag to signal to the framework when sensor events are available to be read
+     */
+    EventFlag* mEventQueueFlag;
+
+    /**
+     * Callback for asynchronous events, such as dynamic sensor connections.
+     */
+    sp<ISensorsCallback> mCallback;
+
+    /**
+     * A map of the available sensors
+     */
+    std::map<int32_t, std::shared_ptr<Sensor>> mSensors;
+
+    /**
+     * Lock to protect writes to the FMQs
+     */
+    std::mutex mWriteLock;
+
+    /**
+     * Lock to protect acquiring and releasing the wake lock
+     */
+    std::mutex mWakeLockLock;
+
+    /**
+     * Track the number of WAKE_UP events that have not been handled by the framework
+     */
+    uint32_t mOutstandingWakeUpEvents;
+
+    /**
+     * A thread to read the Wake Lock FMQ
+     */
+    std::thread mWakeLockThread;
+
+    /**
+     * Flag to indicate that the Wake Lock Thread should continue to run
+     */
+    std::atomic_bool mReadWakeLockQueueRun;
+
+    /**
+     * Track the time when the wake lock should automatically be released
+     */
+    int64_t mAutoReleaseWakeLockTime;
+
+    /**
+     * Flag to indicate if a wake lock has been acquired
+     */
+    bool mHasWakeLock;
+};
+
+}  // namespace implementation
+}  // namespace V2_0
+}  // namespace sensors
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_SENSORS_V2_0_SENSORS_H
diff --git a/sensors/2.0/default/android.hardware.sensors@2.0-service.rc b/sensors/2.0/default/android.hardware.sensors@2.0-service.rc
new file mode 100644
index 0000000..321d760
--- /dev/null
+++ b/sensors/2.0/default/android.hardware.sensors@2.0-service.rc
@@ -0,0 +1,5 @@
+service vendor.sensors-hal-2-0 /vendor/bin/hw/android.hardware.sensors@2.0-service
+    class hal
+    user system
+    group system
+    rlimit rtprio 10 10
diff --git a/sensors/2.0/default/service.cpp b/sensors/2.0/default/service.cpp
new file mode 100644
index 0000000..5c13e33
--- /dev/null
+++ b/sensors/2.0/default/service.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.sensors@2.0-service"
+
+#include <android/hardware/sensors/2.0/ISensors.h>
+#include <hidl/HidlTransportSupport.h>
+#include <log/log.h>
+#include <utils/StrongPointer.h>
+#include "Sensors.h"
+
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
+using android::hardware::sensors::V2_0::ISensors;
+using android::hardware::sensors::V2_0::implementation::Sensors;
+
+int main(int /* argc */, char** /* argv */) {
+    configureRpcThreadpool(1, true);
+
+    android::sp<ISensors> sensors = new Sensors();
+    if (sensors->registerAsService() != ::android::OK) {
+        ALOGE("Failed to register Sensors HAL instance");
+        return -1;
+    }
+
+    joinRpcThreadpool();
+    return 1;  // joinRpcThreadpool shouldn't exit
+}
diff --git a/sensors/2.0/types.hal b/sensors/2.0/types.hal
new file mode 100644
index 0000000..e1a029a
--- /dev/null
+++ b/sensors/2.0/types.hal
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.sensors@2.0;
+
+enum SensorTimeout : int32_t {
+    /**
+     * The maximum number of seconds to wait for a message on the Wake Lock FMQ
+     * before automatically releasing any wake_lock held for a WAKE_UP event.
+     */
+    WAKE_LOCK_SECONDS = 1,
+};
+
+enum EventQueueFlagBits : uint32_t {
+    /**
+     * Used to notify the Event FMQ that events should be read and processed.
+     */
+    READ_AND_PROCESS = 1 << 0,
+};
diff --git a/sensors/2.0/vts/functional/Android.bp b/sensors/2.0/vts/functional/Android.bp
new file mode 100644
index 0000000..8e8413c
--- /dev/null
+++ b/sensors/2.0/vts/functional/Android.bp
@@ -0,0 +1,33 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalSensorsV2_0TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: [
+        "SensorsHidlEnvironmentV2_0.cpp",
+        "VtsHalSensorsV2_0TargetTest.cpp"
+    ],
+    static_libs: [
+        "android.hardware.graphics.allocator@2.0",
+        "android.hardware.graphics.mapper@2.0",
+        "android.hardware.sensors@1.0",
+        "android.hardware.sensors@2.0",
+        "libfmq",
+        "VtsHalSensorsTargetTestUtils",
+    ],
+}
+
diff --git a/sensors/2.0/vts/functional/OWNERS b/sensors/2.0/vts/functional/OWNERS
new file mode 100644
index 0000000..759d87b
--- /dev/null
+++ b/sensors/2.0/vts/functional/OWNERS
@@ -0,0 +1,7 @@
+# Sensors team
+bduddie@google.com
+bstack@google.com
+
+# VTS team
+trong@google.com
+yim@google.com
diff --git a/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
new file mode 100644
index 0000000..37b7349
--- /dev/null
+++ b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SensorsHidlEnvironmentV2_0.h"
+
+#include <android/hardware/sensors/2.0/types.h>
+#include <log/log.h>
+
+#include <algorithm>
+#include <vector>
+
+using ::android::hardware::EventFlag;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::sensors::V1_0::Result;
+using ::android::hardware::sensors::V1_0::SensorInfo;
+using ::android::hardware::sensors::V2_0::EventQueueFlagBits;
+using ::android::hardware::sensors::V2_0::ISensors;
+
+template <typename EnumType>
+constexpr typename std::underlying_type<EnumType>::type asBaseType(EnumType value) {
+    return static_cast<typename std::underlying_type<EnumType>::type>(value);
+}
+
+constexpr size_t SensorsHidlEnvironmentV2_0::MAX_RECEIVE_BUFFER_EVENT_COUNT;
+
+bool SensorsHidlEnvironmentV2_0::resetHal() {
+    bool succeed = false;
+    do {
+        mSensors = ISensors::getService(
+            SensorsHidlEnvironmentV2_0::Instance()->getServiceName<ISensors>());
+        if (mSensors == nullptr) {
+            break;
+        }
+
+        // Initialize FMQs
+        mEventQueue = std::make_unique<EventMessageQueue>(MAX_RECEIVE_BUFFER_EVENT_COUNT,
+                                                          true /* configureEventFlagWord */);
+
+        mWakeLockQueue = std::make_unique<WakeLockQueue>(MAX_RECEIVE_BUFFER_EVENT_COUNT,
+                                                         true /* configureEventFlagWord */);
+
+        if (mEventQueue == nullptr || mWakeLockQueue == nullptr) {
+            break;
+        }
+
+        EventFlag::deleteEventFlag(&mEventQueueFlag);
+        EventFlag::createEventFlag(mEventQueue->getEventFlagWord(), &mEventQueueFlag);
+        if (mEventQueueFlag == nullptr) {
+            break;
+        }
+
+        mSensors->initialize(*mEventQueue->getDesc(), *mWakeLockQueue->getDesc(),
+                             nullptr /* TODO: callback */);
+
+        std::vector<SensorInfo> sensorList;
+        if (!mSensors->getSensorsList([&](const hidl_vec<SensorInfo>& list) { sensorList = list; })
+                 .isOk()) {
+            break;
+        }
+
+        // stop each sensor individually
+        bool ok = true;
+        for (const auto& i : sensorList) {
+            if (!mSensors->activate(i.sensorHandle, false).isOk()) {
+                ok = false;
+                break;
+            }
+        }
+        if (!ok) {
+            break;
+        }
+
+        // mark it done
+        succeed = true;
+    } while (0);
+
+    if (!succeed) {
+        mSensors = nullptr;
+    }
+
+    return succeed;
+}
+
+void SensorsHidlEnvironmentV2_0::HidlTearDown() {
+    mStopThread = true;
+
+    // Wake up the event queue so the poll thread can exit
+    mEventQueueFlag->wake(asBaseType(EventQueueFlagBits::READ_AND_PROCESS));
+    mPollThread.join();
+
+    EventFlag::deleteEventFlag(&mEventQueueFlag);
+}
+
+void SensorsHidlEnvironmentV2_0::startPollingThread() {
+    mStopThread = false;
+    mPollThread = std::thread(pollingThread, this);
+    mEvents.reserve(MAX_RECEIVE_BUFFER_EVENT_COUNT);
+}
+
+void SensorsHidlEnvironmentV2_0::readEvents() {
+    size_t availableEvents = mEventQueue->availableToRead();
+
+    if (availableEvents == 0) {
+        uint32_t eventFlagState = 0;
+
+        mEventQueueFlag->wait(asBaseType(EventQueueFlagBits::READ_AND_PROCESS), &eventFlagState);
+        availableEvents = mEventQueue->availableToRead();
+    }
+
+    size_t eventsToRead = std::min(availableEvents, mEventBuffer.size());
+    if (eventsToRead > 0) {
+        if (mEventQueue->read(mEventBuffer.data(), eventsToRead)) {
+            for (size_t i = 0; i < eventsToRead; i++) {
+                addEvent(mEventBuffer[i]);
+            }
+        }
+    }
+}
+
+void SensorsHidlEnvironmentV2_0::pollingThread(SensorsHidlEnvironmentV2_0* env) {
+    ALOGD("polling thread start");
+
+    while (!env->mStopThread.load()) {
+        env->readEvents();
+    }
+
+    ALOGD("polling thread end");
+}
diff --git a/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.h b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.h
new file mode 100644
index 0000000..5e54530
--- /dev/null
+++ b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SENSORS_HIDL_ENVIRONMENT_V2_0_H
+#define ANDROID_SENSORS_HIDL_ENVIRONMENT_V2_0_H
+
+#include "sensors-vts-utils/SensorsHidlEnvironmentBase.h"
+
+#include <android/hardware/sensors/1.0/types.h>
+#include <android/hardware/sensors/2.0/ISensors.h>
+#include <fmq/MessageQueue.h>
+#include <utils/StrongPointer.h>
+
+#include <array>
+#include <atomic>
+#include <memory>
+
+using ::android::sp;
+using ::android::hardware::MessageQueue;
+
+class SensorsHidlTest;
+class SensorsHidlEnvironmentV2_0 : public SensorsHidlEnvironmentBase {
+   public:
+    using Event = ::android::hardware::sensors::V1_0::Event;
+    // get the test environment singleton
+    static SensorsHidlEnvironmentV2_0* Instance() {
+        static SensorsHidlEnvironmentV2_0* instance = new SensorsHidlEnvironmentV2_0();
+        return instance;
+    }
+
+    virtual void registerTestServices() override {
+        registerTestService<android::hardware::sensors::V2_0::ISensors>();
+    }
+
+    virtual void HidlTearDown() override;
+
+   protected:
+    friend SensorsHidlTest;
+
+    SensorsHidlEnvironmentV2_0() : mEventQueueFlag(nullptr) {}
+
+    /**
+     * Resets the HAL with new FMQs and a new Event Flag
+     *
+     * @return bool true if successful, false otherwise
+     */
+    bool resetHal() override;
+
+    /**
+     * Starts the polling thread that reads sensor events from the Event FMQ
+     */
+    void startPollingThread() override;
+
+    /**
+     * Thread responsible for calling functions to read Event FMQ
+     *
+     * @param env SensorEnvironment to being polling for events on
+     */
+    static void pollingThread(SensorsHidlEnvironmentV2_0* env);
+
+    /**
+     * Reads and saves sensor events from the Event FMQ
+     */
+    void readEvents();
+
+    GTEST_DISALLOW_COPY_AND_ASSIGN_(SensorsHidlEnvironmentV2_0);
+
+    /**
+     * Pointer to the Sensors HAL Interface that allows the test to call HAL functions.
+     */
+    sp<android::hardware::sensors::V2_0::ISensors> mSensors;
+
+    /**
+     * Type used to simplify the creation of the Event FMQ
+     */
+    typedef MessageQueue<Event, ::android::hardware::kSynchronizedReadWrite> EventMessageQueue;
+
+    /**
+     * Type used to simplify the creation of the Wake Lock FMQ
+     */
+    typedef MessageQueue<uint32_t, ::android::hardware::kSynchronizedReadWrite> WakeLockQueue;
+
+    /**
+     * The Event FMQ where the test framework is able to read sensor events that the Sensors HAL
+     * has written.
+     */
+    std::unique_ptr<EventMessageQueue> mEventQueue;
+
+    /**
+     * The Wake Lock FMQ is used by the test to notify the Sensors HAL whenever it has processed
+     * WAKE_UP sensor events.
+     */
+    std::unique_ptr<WakeLockQueue> mWakeLockQueue;
+
+    /**
+     * The Event Queue Flag notifies the test framework when sensor events have been written to the
+     * Event FMQ by the Sensors HAL.
+     */
+    ::android::hardware::EventFlag* mEventQueueFlag;
+
+    /**
+     * The maximum number of sensor events that can be read from the Event FMQ at one time.
+     */
+    static constexpr size_t MAX_RECEIVE_BUFFER_EVENT_COUNT = 128;
+
+    /**
+     * An array that is used to store sensor events read from the Event FMQ
+     */
+    std::array<Event, MAX_RECEIVE_BUFFER_EVENT_COUNT> mEventBuffer;
+};
+
+#endif  // ANDROID_SENSORS_HIDL_ENVIRONMENT_V2_0_H
diff --git a/sensors/2.0/vts/functional/VtsHalSensorsV2_0TargetTest.cpp b/sensors/2.0/vts/functional/VtsHalSensorsV2_0TargetTest.cpp
new file mode 100644
index 0000000..ac020ad
--- /dev/null
+++ b/sensors/2.0/vts/functional/VtsHalSensorsV2_0TargetTest.cpp
@@ -0,0 +1,954 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "sensors_hidl_hal_test"
+
+#include "SensorsHidlEnvironmentV2_0.h"
+#include "sensors-vts-utils/SensorsHidlTestBase.h"
+#include "sensors-vts-utils/SensorsTestSharedMemory.h"
+
+#include <android/hardware/sensors/2.0/ISensors.h>
+#include <android/hardware/sensors/2.0/types.h>
+#include <log/log.h>
+#include <utils/SystemClock.h>
+
+#include <cinttypes>
+#include <condition_variable>
+#include <cstring>
+#include <map>
+#include <vector>
+
+using ::android::sp;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::sensors::V1_0::MetaDataEventType;
+using ::android::hardware::sensors::V1_0::OperationMode;
+using ::android::hardware::sensors::V1_0::SensorsEventFormatOffset;
+using ::android::hardware::sensors::V1_0::SensorStatus;
+using ::android::hardware::sensors::V1_0::SharedMemType;
+using ::android::hardware::sensors::V1_0::Vec3;
+
+class EventCallback : public IEventCallback {
+   public:
+    void reset() {
+        mFlushMap.clear();
+        mEventMap.clear();
+    }
+
+    void onEvent(const ::android::hardware::sensors::V1_0::Event& event) override {
+        if (event.sensorType == SensorType::ADDITIONAL_INFO &&
+            event.u.meta.what == MetaDataEventType::META_DATA_FLUSH_COMPLETE) {
+            std::unique_lock<std::recursive_mutex> lock(mFlushMutex);
+            mFlushMap[event.sensorHandle]++;
+            mFlushCV.notify_all();
+        } else if (event.sensorType != SensorType::ADDITIONAL_INFO) {
+            std::unique_lock<std::recursive_mutex> lock(mEventMutex);
+            mEventMap[event.sensorHandle].push_back(event);
+            mEventCV.notify_all();
+        }
+    }
+
+    int32_t getFlushCount(int32_t sensorHandle) {
+        std::unique_lock<std::recursive_mutex> lock(mFlushMutex);
+        return mFlushMap[sensorHandle];
+    }
+
+    void waitForFlushEvents(const std::vector<SensorInfo>& sensorsToWaitFor,
+                            int32_t numCallsToFlush, int64_t timeoutMs) {
+        std::unique_lock<std::recursive_mutex> lock(mFlushMutex);
+        mFlushCV.wait_for(lock, std::chrono::milliseconds(timeoutMs),
+                          [&] { return flushesReceived(sensorsToWaitFor, numCallsToFlush); });
+    }
+
+    const std::vector<Event> getEvents(int32_t sensorHandle) {
+        std::unique_lock<std::recursive_mutex> lock(mEventMutex);
+        return mEventMap[sensorHandle];
+    }
+
+    void waitForEvents(const std::vector<SensorInfo>& sensorsToWaitFor, int32_t timeoutMs) {
+        std::unique_lock<std::recursive_mutex> lock(mEventMutex);
+        mEventCV.wait_for(lock, std::chrono::milliseconds(timeoutMs),
+                          [&] { return eventsReceived(sensorsToWaitFor); });
+    }
+
+   protected:
+    bool flushesReceived(const std::vector<SensorInfo>& sensorsToWaitFor, int32_t numCallsToFlush) {
+        for (const SensorInfo& sensor : sensorsToWaitFor) {
+            if (getFlushCount(sensor.sensorHandle) < numCallsToFlush) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    bool eventsReceived(const std::vector<SensorInfo>& sensorsToWaitFor) {
+        for (const SensorInfo& sensor : sensorsToWaitFor) {
+            if (getEvents(sensor.sensorHandle).size() == 0) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    std::map<int32_t, int32_t> mFlushMap;
+    std::recursive_mutex mFlushMutex;
+    std::condition_variable_any mFlushCV;
+
+    std::map<int32_t, std::vector<Event>> mEventMap;
+    std::recursive_mutex mEventMutex;
+    std::condition_variable_any mEventCV;
+};
+
+// The main test class for SENSORS HIDL HAL.
+
+class SensorsHidlTest : public SensorsHidlTestBase {
+   protected:
+    SensorInfo defaultSensorByType(SensorType type) override;
+    std::vector<SensorInfo> getSensorsList();
+    // implementation wrapper
+    Return<void> getSensorsList(ISensors::getSensorsList_cb _hidl_cb) override {
+        return getSensors()->getSensorsList(_hidl_cb);
+    }
+
+    Return<Result> activate(int32_t sensorHandle, bool enabled) override;
+
+    Return<Result> batch(int32_t sensorHandle, int64_t samplingPeriodNs,
+                         int64_t maxReportLatencyNs) override {
+        return getSensors()->batch(sensorHandle, samplingPeriodNs, maxReportLatencyNs);
+    }
+
+    Return<Result> flush(int32_t sensorHandle) override {
+        return getSensors()->flush(sensorHandle);
+    }
+
+    Return<Result> injectSensorData(const Event& event) override {
+        return getSensors()->injectSensorData(event);
+    }
+
+    Return<void> registerDirectChannel(const SharedMemInfo& mem,
+                                       ISensors::registerDirectChannel_cb _hidl_cb) override;
+
+    Return<Result> unregisterDirectChannel(int32_t channelHandle) override {
+        return getSensors()->unregisterDirectChannel(channelHandle);
+    }
+
+    Return<void> configDirectReport(int32_t sensorHandle, int32_t channelHandle, RateLevel rate,
+                                    ISensors::configDirectReport_cb _hidl_cb) override {
+        return getSensors()->configDirectReport(sensorHandle, channelHandle, rate, _hidl_cb);
+    }
+
+    inline sp<::android::hardware::sensors::V2_0::ISensors>& getSensors() {
+        return SensorsHidlEnvironmentV2_0::Instance()->mSensors;
+    }
+
+    SensorsHidlEnvironmentBase* getEnvironment() override {
+        return SensorsHidlEnvironmentV2_0::Instance();
+    }
+
+    // Test helpers
+    void runSingleFlushTest(const std::vector<SensorInfo>& sensors, bool activateSensor,
+                            int32_t expectedFlushCount, Result expectedResponse);
+    void runFlushTest(const std::vector<SensorInfo>& sensors, bool activateSensor,
+                      int32_t flushCalls, int32_t expectedFlushCount, Result expectedResponse);
+
+    // Helper functions
+    void activateAllSensors(bool enable);
+    std::vector<SensorInfo> getNonOneShotSensors();
+    std::vector<SensorInfo> getOneShotSensors();
+    std::vector<SensorInfo> getInjectEventSensors();
+    int32_t getInvalidSensorHandle();
+    void verifyDirectChannel(SharedMemType memType);
+    void verifyRegisterDirectChannel(const SensorInfo& sensor, SharedMemType memType,
+                                     std::shared_ptr<SensorsTestSharedMemory> mem,
+                                     int32_t* directChannelHandle);
+    void verifyConfigure(const SensorInfo& sensor, SharedMemType memType,
+                         int32_t directChannelHandle);
+    void verifyUnregisterDirectChannel(const SensorInfo& sensor, SharedMemType memType,
+                                       int32_t directChannelHandle);
+    void checkRateLevel(const SensorInfo& sensor, int32_t directChannelHandle, RateLevel rateLevel);
+};
+
+Return<Result> SensorsHidlTest::activate(int32_t sensorHandle, bool enabled) {
+    // If activating a sensor, add the handle in a set so that when test fails it can be turned off.
+    // The handle is not removed when it is deactivating on purpose so that it is not necessary to
+    // check the return value of deactivation. Deactivating a sensor more than once does not have
+    // negative effect.
+    if (enabled) {
+        mSensorHandles.insert(sensorHandle);
+    }
+    return getSensors()->activate(sensorHandle, enabled);
+}
+
+Return<void> SensorsHidlTest::registerDirectChannel(const SharedMemInfo& mem,
+                                                    ISensors::registerDirectChannel_cb cb) {
+    // If registeration of a channel succeeds, add the handle of channel to a set so that it can be
+    // unregistered when test fails. Unregister a channel does not remove the handle on purpose.
+    // Unregistering a channel more than once should not have negative effect.
+    getSensors()->registerDirectChannel(mem, [&](auto result, auto channelHandle) {
+        if (result == Result::OK) {
+            mDirectChannelHandles.insert(channelHandle);
+        }
+        cb(result, channelHandle);
+    });
+    return Void();
+}
+
+SensorInfo SensorsHidlTest::defaultSensorByType(SensorType type) {
+    SensorInfo ret;
+
+    ret.type = (SensorType)-1;
+    getSensors()->getSensorsList([&](const auto& list) {
+        const size_t count = list.size();
+        for (size_t i = 0; i < count; ++i) {
+            if (list[i].type == type) {
+                ret = list[i];
+                return;
+            }
+        }
+    });
+
+    return ret;
+}
+
+std::vector<SensorInfo> SensorsHidlTest::getSensorsList() {
+    std::vector<SensorInfo> ret;
+
+    getSensors()->getSensorsList([&](const auto& list) {
+        const size_t count = list.size();
+        ret.reserve(list.size());
+        for (size_t i = 0; i < count; ++i) {
+            ret.push_back(list[i]);
+        }
+    });
+
+    return ret;
+}
+
+std::vector<SensorInfo> SensorsHidlTest::getNonOneShotSensors() {
+    std::vector<SensorInfo> sensors;
+    for (const SensorInfo& info : getSensorsList()) {
+        if (extractReportMode(info.flags) != SensorFlagBits::ONE_SHOT_MODE) {
+            sensors.push_back(info);
+        }
+    }
+    return sensors;
+}
+
+std::vector<SensorInfo> SensorsHidlTest::getOneShotSensors() {
+    std::vector<SensorInfo> sensors;
+    for (const SensorInfo& info : getSensorsList()) {
+        if (extractReportMode(info.flags) == SensorFlagBits::ONE_SHOT_MODE) {
+            sensors.push_back(info);
+        }
+    }
+    return sensors;
+}
+
+std::vector<SensorInfo> SensorsHidlTest::getInjectEventSensors() {
+    std::vector<SensorInfo> sensors;
+    for (const SensorInfo& info : getSensorsList()) {
+        if (info.flags & static_cast<uint32_t>(SensorFlagBits::DATA_INJECTION)) {
+            sensors.push_back(info);
+        }
+    }
+    return sensors;
+}
+
+int32_t SensorsHidlTest::getInvalidSensorHandle() {
+    // Find a sensor handle that does not exist in the sensor list
+    int32_t maxHandle = 0;
+    for (const SensorInfo& sensor : getSensorsList()) {
+        maxHandle = max(maxHandle, sensor.sensorHandle);
+    }
+    return maxHandle + 1;
+}
+
+// Test if sensor list returned is valid
+TEST_F(SensorsHidlTest, SensorListValid) {
+    getSensors()->getSensorsList([&](const auto& list) {
+        const size_t count = list.size();
+        for (size_t i = 0; i < count; ++i) {
+            const auto& s = list[i];
+            SCOPED_TRACE(::testing::Message()
+                         << i << "/" << count << ": "
+                         << " handle=0x" << std::hex << std::setw(8) << std::setfill('0')
+                         << s.sensorHandle << std::dec << " type=" << static_cast<int>(s.type)
+                         << " name=" << s.name);
+
+            // Test non-empty type string
+            EXPECT_FALSE(s.typeAsString.empty());
+
+            // Test defined type matches defined string type
+            EXPECT_NO_FATAL_FAILURE(assertTypeMatchStringType(s.type, s.typeAsString));
+
+            // Test if all sensor has name and vendor
+            EXPECT_FALSE(s.name.empty());
+            EXPECT_FALSE(s.vendor.empty());
+
+            // Test power > 0, maxRange > 0
+            EXPECT_LE(0, s.power);
+            EXPECT_LT(0, s.maxRange);
+
+            // Info type, should have no sensor
+            EXPECT_FALSE(s.type == SensorType::ADDITIONAL_INFO || s.type == SensorType::META_DATA);
+
+            // Test fifoMax >= fifoReserved
+            EXPECT_GE(s.fifoMaxEventCount, s.fifoReservedEventCount)
+                << "max=" << s.fifoMaxEventCount << " reserved=" << s.fifoReservedEventCount;
+
+            // Test Reporting mode valid
+            EXPECT_NO_FATAL_FAILURE(assertTypeMatchReportMode(s.type, extractReportMode(s.flags)));
+
+            // Test min max are in the right order
+            EXPECT_LE(s.minDelay, s.maxDelay);
+            // Test min/max delay matches reporting mode
+            EXPECT_NO_FATAL_FAILURE(
+                assertDelayMatchReportMode(s.minDelay, s.maxDelay, extractReportMode(s.flags)));
+        }
+    });
+}
+
+// Test that SetOperationMode returns the expected value
+TEST_F(SensorsHidlTest, SetOperationMode) {
+    std::vector<SensorInfo> sensors = getInjectEventSensors();
+    if (getInjectEventSensors().size() > 0) {
+        ASSERT_EQ(Result::OK, getSensors()->setOperationMode(OperationMode::NORMAL));
+        ASSERT_EQ(Result::OK, getSensors()->setOperationMode(OperationMode::DATA_INJECTION));
+        ASSERT_EQ(Result::OK, getSensors()->setOperationMode(OperationMode::NORMAL));
+    } else {
+        ASSERT_EQ(Result::BAD_VALUE, getSensors()->setOperationMode(OperationMode::DATA_INJECTION));
+    }
+}
+
+// Test that an injected event is written back to the Event FMQ
+TEST_F(SensorsHidlTest, InjectSensorEventData) {
+    std::vector<SensorInfo> sensors = getInjectEventSensors();
+    if (sensors.size() == 0) {
+        return;
+    }
+
+    ASSERT_EQ(Result::OK, getSensors()->setOperationMode(OperationMode::DATA_INJECTION));
+
+    EventCallback callback;
+    getEnvironment()->registerCallback(&callback);
+
+    // AdditionalInfo event should not be sent to Event FMQ
+    Event additionalInfoEvent;
+    additionalInfoEvent.sensorType = SensorType::ADDITIONAL_INFO;
+    additionalInfoEvent.timestamp = android::elapsedRealtimeNano();
+
+    Event injectedEvent;
+    injectedEvent.timestamp = android::elapsedRealtimeNano();
+    Vec3 data = {1, 2, 3, SensorStatus::ACCURACY_HIGH};
+    injectedEvent.u.vec3 = data;
+
+    for (const auto& s : sensors) {
+        additionalInfoEvent.sensorHandle = s.sensorHandle;
+        EXPECT_EQ(Result::OK, getSensors()->injectSensorData(additionalInfoEvent));
+
+        injectedEvent.sensorType = s.type;
+        injectedEvent.sensorHandle = s.sensorHandle;
+        EXPECT_EQ(Result::OK, getSensors()->injectSensorData(injectedEvent));
+    }
+
+    // Wait for events to be written back to the Event FMQ
+    callback.waitForEvents(sensors, 1000 /* timeoutMs */);
+
+    for (const auto& s : sensors) {
+        auto events = callback.getEvents(s.sensorHandle);
+        auto lastEvent = events.back();
+
+        // Verify that only a single event has been received
+        ASSERT_EQ(events.size(), 1);
+
+        // Verify that the event received matches the event injected and is not the additional
+        // info event
+        ASSERT_EQ(lastEvent.sensorType, s.type);
+        ASSERT_EQ(lastEvent.sensorType, s.type);
+        ASSERT_EQ(lastEvent.timestamp, injectedEvent.timestamp);
+        ASSERT_EQ(lastEvent.u.vec3.x, injectedEvent.u.vec3.x);
+        ASSERT_EQ(lastEvent.u.vec3.y, injectedEvent.u.vec3.y);
+        ASSERT_EQ(lastEvent.u.vec3.z, injectedEvent.u.vec3.z);
+        ASSERT_EQ(lastEvent.u.vec3.status, injectedEvent.u.vec3.status);
+    }
+
+    getEnvironment()->unregisterCallback();
+    ASSERT_EQ(Result::OK, getSensors()->setOperationMode(OperationMode::NORMAL));
+}
+
+// Test if sensor hal can do UI speed accelerometer streaming properly
+TEST_F(SensorsHidlTest, AccelerometerStreamingOperationSlow) {
+    testStreamingOperation(SensorType::ACCELEROMETER, std::chrono::milliseconds(200),
+                           std::chrono::seconds(5), sAccelNormChecker);
+}
+
+// Test if sensor hal can do normal speed accelerometer streaming properly
+TEST_F(SensorsHidlTest, AccelerometerStreamingOperationNormal) {
+    testStreamingOperation(SensorType::ACCELEROMETER, std::chrono::milliseconds(20),
+                           std::chrono::seconds(5), sAccelNormChecker);
+}
+
+// Test if sensor hal can do game speed accelerometer streaming properly
+TEST_F(SensorsHidlTest, AccelerometerStreamingOperationFast) {
+    testStreamingOperation(SensorType::ACCELEROMETER, std::chrono::milliseconds(5),
+                           std::chrono::seconds(5), sAccelNormChecker);
+}
+
+// Test if sensor hal can do UI speed gyroscope streaming properly
+TEST_F(SensorsHidlTest, GyroscopeStreamingOperationSlow) {
+    testStreamingOperation(SensorType::GYROSCOPE, std::chrono::milliseconds(200),
+                           std::chrono::seconds(5), sGyroNormChecker);
+}
+
+// Test if sensor hal can do normal speed gyroscope streaming properly
+TEST_F(SensorsHidlTest, GyroscopeStreamingOperationNormal) {
+    testStreamingOperation(SensorType::GYROSCOPE, std::chrono::milliseconds(20),
+                           std::chrono::seconds(5), sGyroNormChecker);
+}
+
+// Test if sensor hal can do game speed gyroscope streaming properly
+TEST_F(SensorsHidlTest, GyroscopeStreamingOperationFast) {
+    testStreamingOperation(SensorType::GYROSCOPE, std::chrono::milliseconds(5),
+                           std::chrono::seconds(5), sGyroNormChecker);
+}
+
+// Test if sensor hal can do UI speed magnetometer streaming properly
+TEST_F(SensorsHidlTest, MagnetometerStreamingOperationSlow) {
+    testStreamingOperation(SensorType::MAGNETIC_FIELD, std::chrono::milliseconds(200),
+                           std::chrono::seconds(5), NullChecker());
+}
+
+// Test if sensor hal can do normal speed magnetometer streaming properly
+TEST_F(SensorsHidlTest, MagnetometerStreamingOperationNormal) {
+    testStreamingOperation(SensorType::MAGNETIC_FIELD, std::chrono::milliseconds(20),
+                           std::chrono::seconds(5), NullChecker());
+}
+
+// Test if sensor hal can do game speed magnetometer streaming properly
+TEST_F(SensorsHidlTest, MagnetometerStreamingOperationFast) {
+    testStreamingOperation(SensorType::MAGNETIC_FIELD, std::chrono::milliseconds(5),
+                           std::chrono::seconds(5), NullChecker());
+}
+
+// Test if sensor hal can do accelerometer sampling rate switch properly when sensor is active
+TEST_F(SensorsHidlTest, AccelerometerSamplingPeriodHotSwitchOperation) {
+    testSamplingRateHotSwitchOperation(SensorType::ACCELEROMETER);
+    testSamplingRateHotSwitchOperation(SensorType::ACCELEROMETER, false /*fastToSlow*/);
+}
+
+// Test if sensor hal can do gyroscope sampling rate switch properly when sensor is active
+TEST_F(SensorsHidlTest, GyroscopeSamplingPeriodHotSwitchOperation) {
+    testSamplingRateHotSwitchOperation(SensorType::GYROSCOPE);
+    testSamplingRateHotSwitchOperation(SensorType::GYROSCOPE, false /*fastToSlow*/);
+}
+
+// Test if sensor hal can do magnetometer sampling rate switch properly when sensor is active
+TEST_F(SensorsHidlTest, MagnetometerSamplingPeriodHotSwitchOperation) {
+    testSamplingRateHotSwitchOperation(SensorType::MAGNETIC_FIELD);
+    testSamplingRateHotSwitchOperation(SensorType::MAGNETIC_FIELD, false /*fastToSlow*/);
+}
+
+// Test if sensor hal can do accelerometer batching properly
+TEST_F(SensorsHidlTest, AccelerometerBatchingOperation) {
+    testBatchingOperation(SensorType::ACCELEROMETER);
+}
+
+// Test if sensor hal can do gyroscope batching properly
+TEST_F(SensorsHidlTest, GyroscopeBatchingOperation) {
+    testBatchingOperation(SensorType::GYROSCOPE);
+}
+
+// Test if sensor hal can do magnetometer batching properly
+TEST_F(SensorsHidlTest, MagnetometerBatchingOperation) {
+    testBatchingOperation(SensorType::MAGNETIC_FIELD);
+}
+
+// Test sensor event direct report with ashmem for accel sensor at normal rate
+TEST_F(SensorsHidlTest, AccelerometerAshmemDirectReportOperationNormal) {
+    testDirectReportOperation(SensorType::ACCELEROMETER, SharedMemType::ASHMEM, RateLevel::NORMAL,
+                              sAccelNormChecker);
+}
+
+// Test sensor event direct report with ashmem for accel sensor at fast rate
+TEST_F(SensorsHidlTest, AccelerometerAshmemDirectReportOperationFast) {
+    testDirectReportOperation(SensorType::ACCELEROMETER, SharedMemType::ASHMEM, RateLevel::FAST,
+                              sAccelNormChecker);
+}
+
+// Test sensor event direct report with ashmem for accel sensor at very fast rate
+TEST_F(SensorsHidlTest, AccelerometerAshmemDirectReportOperationVeryFast) {
+    testDirectReportOperation(SensorType::ACCELEROMETER, SharedMemType::ASHMEM,
+                              RateLevel::VERY_FAST, sAccelNormChecker);
+}
+
+// Test sensor event direct report with ashmem for gyro sensor at normal rate
+TEST_F(SensorsHidlTest, GyroscopeAshmemDirectReportOperationNormal) {
+    testDirectReportOperation(SensorType::GYROSCOPE, SharedMemType::ASHMEM, RateLevel::NORMAL,
+                              sGyroNormChecker);
+}
+
+// Test sensor event direct report with ashmem for gyro sensor at fast rate
+TEST_F(SensorsHidlTest, GyroscopeAshmemDirectReportOperationFast) {
+    testDirectReportOperation(SensorType::GYROSCOPE, SharedMemType::ASHMEM, RateLevel::FAST,
+                              sGyroNormChecker);
+}
+
+// Test sensor event direct report with ashmem for gyro sensor at very fast rate
+TEST_F(SensorsHidlTest, GyroscopeAshmemDirectReportOperationVeryFast) {
+    testDirectReportOperation(SensorType::GYROSCOPE, SharedMemType::ASHMEM, RateLevel::VERY_FAST,
+                              sGyroNormChecker);
+}
+
+// Test sensor event direct report with ashmem for mag sensor at normal rate
+TEST_F(SensorsHidlTest, MagnetometerAshmemDirectReportOperationNormal) {
+    testDirectReportOperation(SensorType::MAGNETIC_FIELD, SharedMemType::ASHMEM, RateLevel::NORMAL,
+                              NullChecker());
+}
+
+// Test sensor event direct report with ashmem for mag sensor at fast rate
+TEST_F(SensorsHidlTest, MagnetometerAshmemDirectReportOperationFast) {
+    testDirectReportOperation(SensorType::MAGNETIC_FIELD, SharedMemType::ASHMEM, RateLevel::FAST,
+                              NullChecker());
+}
+
+// Test sensor event direct report with ashmem for mag sensor at very fast rate
+TEST_F(SensorsHidlTest, MagnetometerAshmemDirectReportOperationVeryFast) {
+    testDirectReportOperation(SensorType::MAGNETIC_FIELD, SharedMemType::ASHMEM,
+                              RateLevel::VERY_FAST, NullChecker());
+}
+
+// Test sensor event direct report with gralloc for accel sensor at normal rate
+TEST_F(SensorsHidlTest, AccelerometerGrallocDirectReportOperationNormal) {
+    testDirectReportOperation(SensorType::ACCELEROMETER, SharedMemType::GRALLOC, RateLevel::NORMAL,
+                              sAccelNormChecker);
+}
+
+// Test sensor event direct report with gralloc for accel sensor at fast rate
+TEST_F(SensorsHidlTest, AccelerometerGrallocDirectReportOperationFast) {
+    testDirectReportOperation(SensorType::ACCELEROMETER, SharedMemType::GRALLOC, RateLevel::FAST,
+                              sAccelNormChecker);
+}
+
+// Test sensor event direct report with gralloc for accel sensor at very fast rate
+TEST_F(SensorsHidlTest, AccelerometerGrallocDirectReportOperationVeryFast) {
+    testDirectReportOperation(SensorType::ACCELEROMETER, SharedMemType::GRALLOC,
+                              RateLevel::VERY_FAST, sAccelNormChecker);
+}
+
+// Test sensor event direct report with gralloc for gyro sensor at normal rate
+TEST_F(SensorsHidlTest, GyroscopeGrallocDirectReportOperationNormal) {
+    testDirectReportOperation(SensorType::GYROSCOPE, SharedMemType::GRALLOC, RateLevel::NORMAL,
+                              sGyroNormChecker);
+}
+
+// Test sensor event direct report with gralloc for gyro sensor at fast rate
+TEST_F(SensorsHidlTest, GyroscopeGrallocDirectReportOperationFast) {
+    testDirectReportOperation(SensorType::GYROSCOPE, SharedMemType::GRALLOC, RateLevel::FAST,
+                              sGyroNormChecker);
+}
+
+// Test sensor event direct report with gralloc for gyro sensor at very fast rate
+TEST_F(SensorsHidlTest, GyroscopeGrallocDirectReportOperationVeryFast) {
+    testDirectReportOperation(SensorType::GYROSCOPE, SharedMemType::GRALLOC, RateLevel::VERY_FAST,
+                              sGyroNormChecker);
+}
+
+// Test sensor event direct report with gralloc for mag sensor at normal rate
+TEST_F(SensorsHidlTest, MagnetometerGrallocDirectReportOperationNormal) {
+    testDirectReportOperation(SensorType::MAGNETIC_FIELD, SharedMemType::GRALLOC, RateLevel::NORMAL,
+                              NullChecker());
+}
+
+// Test sensor event direct report with gralloc for mag sensor at fast rate
+TEST_F(SensorsHidlTest, MagnetometerGrallocDirectReportOperationFast) {
+    testDirectReportOperation(SensorType::MAGNETIC_FIELD, SharedMemType::GRALLOC, RateLevel::FAST,
+                              NullChecker());
+}
+
+// Test sensor event direct report with gralloc for mag sensor at very fast rate
+TEST_F(SensorsHidlTest, MagnetometerGrallocDirectReportOperationVeryFast) {
+    testDirectReportOperation(SensorType::MAGNETIC_FIELD, SharedMemType::GRALLOC,
+                              RateLevel::VERY_FAST, NullChecker());
+}
+
+void SensorsHidlTest::activateAllSensors(bool enable) {
+    for (const SensorInfo& sensorInfo : getSensorsList()) {
+        if (isValidType(sensorInfo.type)) {
+            batch(sensorInfo.sensorHandle, sensorInfo.minDelay, 0 /* maxReportLatencyNs */);
+            activate(sensorInfo.sensorHandle, enable);
+        }
+    }
+}
+
+// Test that if initialize is called twice, then the HAL writes events to the FMQs from the second
+// call to the function.
+TEST_F(SensorsHidlTest, CallInitializeTwice) {
+    // Create a helper class so that a second environment is able to be instantiated
+    class SensorsHidlEnvironmentTest : public SensorsHidlEnvironmentV2_0 {};
+
+    if (getSensorsList().size() == 0) {
+        // No sensors
+        return;
+    }
+
+    constexpr useconds_t kCollectionTimeoutUs = 1000 * 1000;  // 1s
+    constexpr int32_t kNumEvents = 1;
+
+    // Create a new environment that calls initialize()
+    std::unique_ptr<SensorsHidlEnvironmentTest> newEnv =
+        std::make_unique<SensorsHidlEnvironmentTest>();
+    newEnv->HidlSetUp();
+
+    activateAllSensors(true);
+    // Verify that the old environment does not receive any events
+    ASSERT_EQ(collectEvents(kCollectionTimeoutUs, kNumEvents, getEnvironment()).size(), 0);
+    // Verify that the new event queue receives sensor events
+    ASSERT_GE(collectEvents(kCollectionTimeoutUs, kNumEvents, newEnv.get()).size(), kNumEvents);
+    activateAllSensors(false);
+
+    // Cleanup the test environment
+    newEnv->HidlTearDown();
+
+    // Restore the test environment for future tests
+    SensorsHidlEnvironmentV2_0::Instance()->HidlTearDown();
+    SensorsHidlEnvironmentV2_0::Instance()->HidlSetUp();
+
+    // Ensure that the original environment is receiving events
+    activateAllSensors(true);
+    ASSERT_GE(collectEvents(kCollectionTimeoutUs, kNumEvents).size(), kNumEvents);
+    activateAllSensors(false);
+}
+
+void SensorsHidlTest::runSingleFlushTest(const std::vector<SensorInfo>& sensors,
+                                         bool activateSensor, int32_t expectedFlushCount,
+                                         Result expectedResponse) {
+    runFlushTest(sensors, activateSensor, 1 /* flushCalls */, expectedFlushCount, expectedResponse);
+}
+
+void SensorsHidlTest::runFlushTest(const std::vector<SensorInfo>& sensors, bool activateSensor,
+                                   int32_t flushCalls, int32_t expectedFlushCount,
+                                   Result expectedResponse) {
+    EventCallback callback;
+    getEnvironment()->registerCallback(&callback);
+
+    for (const SensorInfo& sensor : sensors) {
+        // Configure and activate the sensor
+        batch(sensor.sensorHandle, sensor.maxDelay, 0 /* maxReportLatencyNs */);
+        activate(sensor.sensorHandle, activateSensor);
+
+        // Flush the sensor
+        for (int32_t i = 0; i < flushCalls; i++) {
+            Result flushResult = flush(sensor.sensorHandle);
+            ASSERT_EQ(flushResult, expectedResponse);
+        }
+        activate(sensor.sensorHandle, false);
+    }
+
+    // Wait up to one second for the flush events
+    callback.waitForFlushEvents(sensors, flushCalls, 1000 /* timeoutMs */);
+    getEnvironment()->unregisterCallback();
+
+    // Check that the correct number of flushes are present for each sensor
+    for (const SensorInfo& sensor : sensors) {
+        ASSERT_EQ(callback.getFlushCount(sensor.sensorHandle), expectedFlushCount);
+    }
+}
+
+TEST_F(SensorsHidlTest, FlushSensor) {
+    // Find a sensor that is not a one-shot sensor
+    std::vector<SensorInfo> sensors = getNonOneShotSensors();
+    if (sensors.size() == 0) {
+        return;
+    }
+
+    constexpr int32_t kFlushes = 5;
+    runSingleFlushTest(sensors, true /* activateSensor */, 1 /* expectedFlushCount */, Result::OK);
+    runFlushTest(sensors, true /* activateSensor */, kFlushes, kFlushes, Result::OK);
+}
+
+TEST_F(SensorsHidlTest, FlushOneShotSensor) {
+    // Find a sensor that is a one-shot sensor
+    std::vector<SensorInfo> sensors = getOneShotSensors();
+    if (sensors.size() == 0) {
+        return;
+    }
+
+    runSingleFlushTest(sensors, true /* activateSensor */, 0 /* expectedFlushCount */,
+                       Result::BAD_VALUE);
+}
+
+TEST_F(SensorsHidlTest, FlushInactiveSensor) {
+    // Attempt to find a non-one shot sensor, then a one-shot sensor if necessary
+    std::vector<SensorInfo> sensors = getNonOneShotSensors();
+    if (sensors.size() == 0) {
+        sensors = getOneShotSensors();
+        if (sensors.size() == 0) {
+            return;
+        }
+    }
+
+    runSingleFlushTest(sensors, false /* activateSensor */, 0 /* expectedFlushCount */,
+                       Result::BAD_VALUE);
+}
+
+TEST_F(SensorsHidlTest, FlushNonexistentSensor) {
+    SensorInfo sensor;
+    std::vector<SensorInfo> sensors = getNonOneShotSensors();
+    if (sensors.size() == 0) {
+        sensors = getOneShotSensors();
+        if (sensors.size() == 0) {
+            return;
+        }
+    }
+    sensor = sensors.front();
+    sensor.sensorHandle = getInvalidSensorHandle();
+    runSingleFlushTest(std::vector<SensorInfo>{sensor}, false /* activateSensor */,
+                       0 /* expectedFlushCount */, Result::BAD_VALUE);
+}
+
+TEST_F(SensorsHidlTest, Batch) {
+    if (getSensorsList().size() == 0) {
+        return;
+    }
+
+    activateAllSensors(false /* enable */);
+    for (const SensorInfo& sensor : getSensorsList()) {
+        // Call batch on inactive sensor
+        ASSERT_EQ(batch(sensor.sensorHandle, sensor.minDelay, 0 /* maxReportLatencyNs */),
+                  Result::OK);
+
+        // Activate the sensor
+        activate(sensor.sensorHandle, true /* enabled */);
+
+        // Call batch on an active sensor
+        ASSERT_EQ(batch(sensor.sensorHandle, sensor.maxDelay, 0 /* maxReportLatencyNs */),
+                  Result::OK);
+    }
+    activateAllSensors(false /* enable */);
+
+    // Call batch on an invalid sensor
+    SensorInfo sensor = getSensorsList().front();
+    sensor.sensorHandle = getInvalidSensorHandle();
+    ASSERT_EQ(batch(sensor.sensorHandle, sensor.minDelay, 0 /* maxReportLatencyNs */),
+              Result::BAD_VALUE);
+}
+
+TEST_F(SensorsHidlTest, Activate) {
+    if (getSensorsList().size() == 0) {
+        return;
+    }
+
+    // Verify that sensor events are generated when activate is called
+    for (const SensorInfo& sensor : getSensorsList()) {
+        batch(sensor.sensorHandle, sensor.minDelay, 0 /* maxReportLatencyNs */);
+        ASSERT_EQ(activate(sensor.sensorHandle, true), Result::OK);
+
+        // Call activate on a sensor that is already activated
+        ASSERT_EQ(activate(sensor.sensorHandle, true), Result::OK);
+
+        // Deactivate the sensor
+        ASSERT_EQ(activate(sensor.sensorHandle, false), Result::OK);
+
+        // Call deactivate on a sensor that is already deactivated
+        ASSERT_EQ(activate(sensor.sensorHandle, false), Result::OK);
+    }
+
+    // Attempt to activate an invalid sensor
+    int32_t invalidHandle = getInvalidSensorHandle();
+    ASSERT_EQ(activate(invalidHandle, true), Result::BAD_VALUE);
+    ASSERT_EQ(activate(invalidHandle, false), Result::BAD_VALUE);
+}
+
+TEST_F(SensorsHidlTest, NoStaleEvents) {
+    constexpr int64_t kFiveHundredMilliseconds = 500 * 1000;
+    constexpr int64_t kOneSecond = 1000 * 1000;
+
+    // Register the callback to receive sensor events
+    EventCallback callback;
+    getEnvironment()->registerCallback(&callback);
+
+    const std::vector<SensorInfo> sensors = getSensorsList();
+    int32_t maxMinDelay = 0;
+    for (const SensorInfo& sensor : getSensorsList()) {
+        maxMinDelay = std::max(maxMinDelay, sensor.minDelay);
+    }
+
+    // Activate the sensors so that they start generating events
+    activateAllSensors(true);
+
+    // According to the CDD, the first sample must be generated within 400ms + 2 * sample_time
+    // and the maximum reporting latency is 100ms + 2 * sample_time. Wait a sufficient amount
+    // of time to guarantee that a sample has arrived.
+    callback.waitForEvents(sensors, kFiveHundredMilliseconds + (5 * maxMinDelay));
+    activateAllSensors(false);
+
+    // Save the last received event for each sensor
+    std::map<int32_t, int64_t> lastEventTimestampMap;
+    for (const SensorInfo& sensor : sensors) {
+        ASSERT_GE(callback.getEvents(sensor.sensorHandle).size(), 1);
+        lastEventTimestampMap[sensor.sensorHandle] =
+            callback.getEvents(sensor.sensorHandle).back().timestamp;
+    }
+
+    // Allow some time to pass, reset the callback, then reactivate the sensors
+    usleep(kOneSecond + (5 * maxMinDelay));
+    callback.reset();
+    activateAllSensors(true);
+    callback.waitForEvents(sensors, kFiveHundredMilliseconds + (5 * maxMinDelay));
+    activateAllSensors(false);
+
+    for (const SensorInfo& sensor : sensors) {
+        // Ensure that the first event received is not stale by ensuring that its timestamp is
+        // sufficiently different from the previous event
+        const Event newEvent = callback.getEvents(sensor.sensorHandle).front();
+        int64_t delta = newEvent.timestamp - lastEventTimestampMap[sensor.sensorHandle];
+        ASSERT_GE(delta, kFiveHundredMilliseconds + (3 * sensor.minDelay));
+    }
+
+    getEnvironment()->unregisterCallback();
+}
+
+void SensorsHidlTest::checkRateLevel(const SensorInfo& sensor, int32_t directChannelHandle,
+                                     RateLevel rateLevel) {
+    configDirectReport(sensor.sensorHandle, directChannelHandle, rateLevel,
+                       [&](Result result, int32_t reportToken) {
+                           if (isDirectReportRateSupported(sensor, rateLevel)) {
+                               ASSERT_EQ(result, Result::OK);
+                               ASSERT_GT(reportToken, 0);
+                           } else {
+                               ASSERT_EQ(result, Result::BAD_VALUE);
+                           }
+                       });
+}
+
+void SensorsHidlTest::verifyRegisterDirectChannel(const SensorInfo& sensor, SharedMemType memType,
+                                                  std::shared_ptr<SensorsTestSharedMemory> mem,
+                                                  int32_t* directChannelHandle) {
+    char* buffer = mem->getBuffer();
+    memset(buffer, 0xff, mem->getSize());
+
+    registerDirectChannel(mem->getSharedMemInfo(), [&](Result result, int32_t channelHandle) {
+        if (isDirectChannelTypeSupported(sensor, memType)) {
+            ASSERT_EQ(result, Result::OK);
+            ASSERT_GT(channelHandle, 0);
+
+            // Verify that the memory has been zeroed
+            for (size_t i = 0; i < mem->getSize(); i++) {
+                ASSERT_EQ(buffer[i], 0x00);
+            }
+        } else {
+            ASSERT_EQ(result, Result::INVALID_OPERATION);
+            ASSERT_EQ(channelHandle, -1);
+        }
+        *directChannelHandle = channelHandle;
+    });
+}
+
+void SensorsHidlTest::verifyConfigure(const SensorInfo& sensor, SharedMemType memType,
+                                      int32_t directChannelHandle) {
+    if (isDirectChannelTypeSupported(sensor, memType)) {
+        // Verify that each rate level is properly supported
+        checkRateLevel(sensor, directChannelHandle, RateLevel::NORMAL);
+        checkRateLevel(sensor, directChannelHandle, RateLevel::FAST);
+        checkRateLevel(sensor, directChannelHandle, RateLevel::VERY_FAST);
+        checkRateLevel(sensor, directChannelHandle, RateLevel::STOP);
+
+        // Verify that a sensor handle of -1 is only acceptable when using RateLevel::STOP
+        configDirectReport(
+            -1 /* sensorHandle */, directChannelHandle, RateLevel::NORMAL,
+            [](Result result, int32_t /* reportToken */) { ASSERT_EQ(result, Result::BAD_VALUE); });
+        configDirectReport(
+            -1 /* sensorHandle */, directChannelHandle, RateLevel::STOP,
+            [](Result result, int32_t /* reportToken */) { ASSERT_EQ(result, Result::OK); });
+    } else {
+        // Direct channel is not supported for this SharedMemType
+        configDirectReport(sensor.sensorHandle, directChannelHandle, RateLevel::NORMAL,
+                           [](Result result, int32_t /* reportToken */) {
+                               ASSERT_EQ(result, Result::INVALID_OPERATION);
+                           });
+    }
+}
+
+void SensorsHidlTest::verifyUnregisterDirectChannel(const SensorInfo& sensor, SharedMemType memType,
+                                                    int32_t directChannelHandle) {
+    Result result = unregisterDirectChannel(directChannelHandle);
+    if (isDirectChannelTypeSupported(sensor, memType)) {
+        ASSERT_EQ(result, Result::OK);
+    } else {
+        ASSERT_EQ(result, Result::INVALID_OPERATION);
+    }
+}
+
+void SensorsHidlTest::verifyDirectChannel(SharedMemType memType) {
+    constexpr size_t kEventSize = static_cast<size_t>(SensorsEventFormatOffset::TOTAL_LENGTH);
+    constexpr size_t kNumEvents = 1;
+    constexpr size_t kMemSize = kNumEvents * kEventSize;
+
+    std::shared_ptr<SensorsTestSharedMemory> mem(
+        SensorsTestSharedMemory::create(memType, kMemSize));
+    ASSERT_NE(mem, nullptr);
+
+    for (const SensorInfo& sensor : getSensorsList()) {
+        int32_t directChannelHandle = 0;
+        verifyRegisterDirectChannel(sensor, memType, mem, &directChannelHandle);
+        verifyConfigure(sensor, memType, directChannelHandle);
+        verifyUnregisterDirectChannel(sensor, memType, directChannelHandle);
+    }
+}
+
+TEST_F(SensorsHidlTest, DirectChannelAshmem) {
+    verifyDirectChannel(SharedMemType::ASHMEM);
+}
+
+TEST_F(SensorsHidlTest, DirectChannelGralloc) {
+    verifyDirectChannel(SharedMemType::GRALLOC);
+}
+
+TEST_F(SensorsHidlTest, ConfigureDirectChannelWithInvalidHandle) {
+    for (const SensorInfo& sensor : getSensorsList()) {
+        if (isDirectChannelTypeSupported(sensor, SharedMemType::ASHMEM) ||
+            isDirectChannelTypeSupported(sensor, SharedMemType::GRALLOC)) {
+            // Find a supported rate level
+            RateLevel rate = RateLevel::STOP;
+            if (isDirectReportRateSupported(sensor, RateLevel::NORMAL)) {
+                rate = RateLevel::NORMAL;
+            } else if (isDirectReportRateSupported(sensor, RateLevel::FAST)) {
+                rate = RateLevel::FAST;
+            } else if (isDirectReportRateSupported(sensor, RateLevel::VERY_FAST)) {
+                rate = RateLevel::VERY_FAST;
+            }
+
+            // Ensure that at least one rate level is supported
+            ASSERT_NE(rate, RateLevel::STOP);
+
+            // Verify that an invalid channel handle produces a BAD_VALUE result
+            configDirectReport(sensor.sensorHandle, -1, rate,
+                               [](Result result, int32_t /* reportToken */) {
+                                   ASSERT_EQ(result, Result::BAD_VALUE);
+                               });
+        }
+    }
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(SensorsHidlEnvironmentV2_0::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    SensorsHidlEnvironmentV2_0::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
+}
+// vim: set ts=2 sw=2
diff --git a/sensors/common/vts/OWNERS b/sensors/common/vts/OWNERS
new file mode 100644
index 0000000..759d87b
--- /dev/null
+++ b/sensors/common/vts/OWNERS
@@ -0,0 +1,7 @@
+# Sensors team
+bduddie@google.com
+bstack@google.com
+
+# VTS team
+trong@google.com
+yim@google.com
diff --git a/sensors/common/vts/utils/Android.bp b/sensors/common/vts/utils/Android.bp
new file mode 100644
index 0000000..95df425
--- /dev/null
+++ b/sensors/common/vts/utils/Android.bp
@@ -0,0 +1,37 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_library_static {
+    name: "VtsHalSensorsTargetTestUtils",
+    srcs: [
+        "GrallocWrapper.cpp",
+        "SensorsHidlEnvironmentBase.cpp",
+        "SensorsHidlTestBase.cpp",
+        "SensorsTestSharedMemory.cpp",
+    ],
+    export_include_dirs: [
+        "include",
+    ],
+    local_include_dirs: [
+        "include/sensors-vts-utils",
+    ],
+    static_libs: [
+        "android.hardware.graphics.allocator@2.0",
+        "android.hardware.graphics.mapper@2.0",
+        "android.hardware.sensors@1.0",
+        "VtsHalHidlTargetTestBase",
+    ],
+}
diff --git a/sensors/common/vts/utils/GrallocWrapper.cpp b/sensors/common/vts/utils/GrallocWrapper.cpp
new file mode 100644
index 0000000..7bed16d
--- /dev/null
+++ b/sensors/common/vts/utils/GrallocWrapper.cpp
@@ -0,0 +1,224 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "GrallocWrapper"
+
+#include "GrallocWrapper.h"
+
+#include <utils/Log.h>
+
+namespace android {
+
+GrallocWrapper::GrallocWrapper() {
+    init();
+}
+
+void GrallocWrapper::init() {
+    mAllocator = allocator2::IAllocator::getService();
+    if (mAllocator == nullptr) {
+        ALOGE("Failed to get allocator service");
+    }
+
+    mMapper = mapper2::IMapper::getService();
+    if (mMapper == nullptr) {
+        ALOGE("Failed to get mapper service");
+    }
+    if (mMapper->isRemote()) {
+        ALOGE("Mapper is not in passthrough mode");
+    }
+}
+
+GrallocWrapper::~GrallocWrapper() {
+    for (auto bufferHandle : mClonedBuffers) {
+        auto buffer = const_cast<native_handle_t*>(bufferHandle);
+        native_handle_close(buffer);
+        native_handle_delete(buffer);
+    }
+    mClonedBuffers.clear();
+
+    for (auto bufferHandle : mImportedBuffers) {
+        auto buffer = const_cast<native_handle_t*>(bufferHandle);
+        if (mMapper->freeBuffer(buffer) != mapper2::Error::NONE) {
+            ALOGE("Failed to free buffer %p", buffer);
+        }
+    }
+    mImportedBuffers.clear();
+}
+
+sp<allocator2::IAllocator> GrallocWrapper::getAllocator() const {
+    return mAllocator;
+}
+
+std::string GrallocWrapper::dumpDebugInfo() {
+    std::string debugInfo;
+    mAllocator->dumpDebugInfo([&](const auto& tmpDebugInfo) { debugInfo = tmpDebugInfo.c_str(); });
+
+    return debugInfo;
+}
+
+const native_handle_t* GrallocWrapper::cloneBuffer(const hardware::hidl_handle& rawHandle) {
+    const native_handle_t* bufferHandle = native_handle_clone(rawHandle.getNativeHandle());
+
+    if (bufferHandle) {
+        mClonedBuffers.insert(bufferHandle);
+    }
+    return bufferHandle;
+}
+
+std::vector<const native_handle_t*> GrallocWrapper::allocate(
+    const mapper2::BufferDescriptor& descriptor, uint32_t count, bool import, uint32_t* outStride) {
+    std::vector<const native_handle_t*> bufferHandles;
+    bufferHandles.reserve(count);
+    mAllocator->allocate(descriptor, count,
+                         [&](const auto& tmpError, const auto& tmpStride, const auto& tmpBuffers) {
+                             if (mapper2::Error::NONE != tmpError) {
+                                 ALOGE("Failed to allocate buffers");
+                             }
+                             if (count != tmpBuffers.size()) {
+                                 ALOGE("Invalid buffer array");
+                             }
+
+                             for (uint32_t i = 0; i < count; i++) {
+                                 if (import) {
+                                     bufferHandles.push_back(importBuffer(tmpBuffers[i]));
+                                 } else {
+                                     bufferHandles.push_back(cloneBuffer(tmpBuffers[i]));
+                                 }
+                             }
+
+                             if (outStride) {
+                                 *outStride = tmpStride;
+                             }
+                         });
+
+    return bufferHandles;
+}
+
+const native_handle_t* GrallocWrapper::allocate(
+    const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo, bool import,
+    uint32_t* outStride) {
+    mapper2::BufferDescriptor descriptor = createDescriptor(descriptorInfo);
+    auto buffers = allocate(descriptor, 1, import, outStride);
+    return buffers[0];
+}
+
+sp<mapper2::IMapper> GrallocWrapper::getMapper() const {
+    return mMapper;
+}
+
+mapper2::BufferDescriptor GrallocWrapper::createDescriptor(
+    const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo) {
+    mapper2::BufferDescriptor descriptor;
+    mMapper->createDescriptor(descriptorInfo, [&](const auto& tmpError, const auto& tmpDescriptor) {
+        if (tmpError != mapper2::Error::NONE) {
+            ALOGE("Failed to create descriptor");
+        }
+        descriptor = tmpDescriptor;
+    });
+
+    return descriptor;
+}
+
+const native_handle_t* GrallocWrapper::importBuffer(const hardware::hidl_handle& rawHandle) {
+    const native_handle_t* bufferHandle = nullptr;
+    mMapper->importBuffer(rawHandle, [&](const auto& tmpError, const auto& tmpBuffer) {
+        if (tmpError != mapper2::Error::NONE) {
+            ALOGE("Failed to import buffer %p", rawHandle.getNativeHandle());
+        }
+        bufferHandle = static_cast<const native_handle_t*>(tmpBuffer);
+    });
+
+    if (bufferHandle) {
+        mImportedBuffers.insert(bufferHandle);
+    }
+
+    return bufferHandle;
+}
+
+void GrallocWrapper::freeBuffer(const native_handle_t* bufferHandle) {
+    auto buffer = const_cast<native_handle_t*>(bufferHandle);
+
+    if (mImportedBuffers.erase(bufferHandle)) {
+        mapper2::Error error = mMapper->freeBuffer(buffer);
+        if (error != mapper2::Error::NONE) {
+            ALOGE("Failed to free %p", buffer);
+        }
+    } else {
+        mClonedBuffers.erase(bufferHandle);
+        native_handle_close(buffer);
+        native_handle_delete(buffer);
+    }
+}
+
+void* GrallocWrapper::lock(const native_handle_t* bufferHandle, uint64_t cpuUsage,
+                           const mapper2::IMapper::Rect& accessRegion, int acquireFence) {
+    auto buffer = const_cast<native_handle_t*>(bufferHandle);
+
+    NATIVE_HANDLE_DECLARE_STORAGE(acquireFenceStorage, 1, 0);
+    hardware::hidl_handle acquireFenceHandle;
+    if (acquireFence >= 0) {
+        auto h = native_handle_init(acquireFenceStorage, 1, 0);
+        h->data[0] = acquireFence;
+        acquireFenceHandle = h;
+    }
+
+    void* data = nullptr;
+    mMapper->lock(buffer, cpuUsage, accessRegion, acquireFenceHandle,
+                  [&](const auto& tmpError, const auto& tmpData) {
+                      if (tmpError != mapper2::Error::NONE) {
+                          ALOGE("Failed to lock buffer %p", buffer);
+                      }
+                      data = tmpData;
+                  });
+
+    if (acquireFence >= 0) {
+        close(acquireFence);
+    }
+
+    return data;
+}
+
+int GrallocWrapper::unlock(const native_handle_t* bufferHandle) {
+    auto buffer = const_cast<native_handle_t*>(bufferHandle);
+
+    int releaseFence = -1;
+    mMapper->unlock(buffer, [&](const auto& tmpError, const auto& tmpReleaseFence) {
+        if (tmpError != mapper2::Error::NONE) {
+            ALOGE("Failed to unlock buffer %p", buffer);
+        }
+
+        auto fenceHandle = tmpReleaseFence.getNativeHandle();
+        if (fenceHandle) {
+            if (fenceHandle->numInts != 0) {
+                ALOGE("Invalid fence handle %p", fenceHandle);
+            }
+            if (fenceHandle->numFds == 1) {
+                releaseFence = dup(fenceHandle->data[0]);
+                if (releaseFence < 0) {
+                    ALOGE("Failed to dup fence fd");
+                }
+            } else {
+                if (fenceHandle->numFds != 0) {
+                    ALOGE("Invalid fence handle %p", fenceHandle);
+                }
+            }
+        }
+    });
+
+    return releaseFence;
+}
+
+}  // namespace android
diff --git a/sensors/common/vts/utils/OWNERS b/sensors/common/vts/utils/OWNERS
new file mode 100644
index 0000000..759d87b
--- /dev/null
+++ b/sensors/common/vts/utils/OWNERS
@@ -0,0 +1,7 @@
+# Sensors team
+bduddie@google.com
+bstack@google.com
+
+# VTS team
+trong@google.com
+yim@google.com
diff --git a/sensors/common/vts/utils/SensorsHidlEnvironmentBase.cpp b/sensors/common/vts/utils/SensorsHidlEnvironmentBase.cpp
new file mode 100644
index 0000000..affdf8b
--- /dev/null
+++ b/sensors/common/vts/utils/SensorsHidlEnvironmentBase.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SensorsHidlEnvironmentBase.h"
+
+void SensorsHidlEnvironmentBase::HidlSetUp() {
+    ASSERT_TRUE(resetHal()) << "could not get hidl service";
+
+    mCollectionEnabled = false;
+    startPollingThread();
+
+    // In case framework just stopped for test and there is sensor events in the pipe,
+    // wait some time for those events to be cleared to avoid them messing up the test.
+    std::this_thread::sleep_for(std::chrono::seconds(3));
+}
+
+void SensorsHidlEnvironmentBase::HidlTearDown() {
+    mStopThread = true;
+    mPollThread.detach();
+}
+
+void SensorsHidlEnvironmentBase::catEvents(std::vector<Event>* output) {
+    std::lock_guard<std::mutex> lock(mEventsMutex);
+    if (output) {
+        output->insert(output->end(), mEvents.begin(), mEvents.end());
+    }
+    mEvents.clear();
+}
+
+void SensorsHidlEnvironmentBase::setCollection(bool enable) {
+    std::lock_guard<std::mutex> lock(mEventsMutex);
+    mCollectionEnabled = enable;
+}
+
+void SensorsHidlEnvironmentBase::addEvent(const Event& ev) {
+    std::lock_guard<std::mutex> lock(mEventsMutex);
+    if (mCollectionEnabled) {
+        mEvents.push_back(ev);
+    }
+
+    if (mCallback != nullptr) {
+        mCallback->onEvent(ev);
+    }
+}
+
+void SensorsHidlEnvironmentBase::registerCallback(IEventCallback* callback) {
+    std::lock_guard<std::mutex> lock(mEventsMutex);
+    mCallback = callback;
+}
+
+void SensorsHidlEnvironmentBase::unregisterCallback() {
+    std::lock_guard<std::mutex> lock(mEventsMutex);
+    mCallback = nullptr;
+}
\ No newline at end of file
diff --git a/sensors/common/vts/utils/SensorsHidlTestBase.cpp b/sensors/common/vts/utils/SensorsHidlTestBase.cpp
new file mode 100644
index 0000000..18549df
--- /dev/null
+++ b/sensors/common/vts/utils/SensorsHidlTestBase.cpp
@@ -0,0 +1,584 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SensorsHidlTestBase.h"
+
+#include "sensors-vts-utils/GrallocWrapper.h"
+#include "sensors-vts-utils/SensorsTestSharedMemory.h"
+
+#include <hardware/sensors.h>  // for sensor type strings
+#include <log/log.h>
+#include <utils/SystemClock.h>
+
+#include <cinttypes>
+
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::sensors::V1_0::SensorFlagShift;
+using ::android::hardware::sensors::V1_0::SensorsEventFormatOffset;
+
+const Vec3NormChecker SensorsHidlTestBase::sAccelNormChecker(
+    Vec3NormChecker::byNominal(GRAVITY_EARTH, 1.0f /*m/s^2*/));
+const Vec3NormChecker SensorsHidlTestBase::sGyroNormChecker(
+    Vec3NormChecker::byNominal(0.f, 0.1f /*rad/s*/));
+
+std::vector<Event> SensorsHidlTestBase::collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
+                                                      bool clearBeforeStart,
+                                                      bool changeCollection) {
+    return collectEvents(timeLimitUs, nEventLimit, getEnvironment(), clearBeforeStart,
+                         changeCollection);
+}
+
+std::vector<Event> SensorsHidlTestBase::collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
+                                                      SensorsHidlEnvironmentBase* environment,
+                                                      bool clearBeforeStart,
+                                                      bool changeCollection) {
+    std::vector<Event> events;
+    constexpr useconds_t SLEEP_GRANULARITY = 100 * 1000;  // granularity 100 ms
+
+    ALOGI("collect max of %zu events for %d us, clearBeforeStart %d", nEventLimit, timeLimitUs,
+          clearBeforeStart);
+
+    if (changeCollection) {
+        environment->setCollection(true);
+    }
+    if (clearBeforeStart) {
+        environment->catEvents(nullptr);
+    }
+
+    while (timeLimitUs > 0) {
+        useconds_t duration = std::min(SLEEP_GRANULARITY, timeLimitUs);
+        usleep(duration);
+        timeLimitUs -= duration;
+
+        environment->catEvents(&events);
+        if (events.size() >= nEventLimit) {
+            break;
+        }
+        ALOGV("time to go = %d, events to go = %d", (int)timeLimitUs,
+              (int)(nEventLimit - events.size()));
+    }
+
+    if (changeCollection) {
+        environment->setCollection(false);
+    }
+    return events;
+}
+
+void SensorsHidlTestBase::assertTypeMatchStringType(SensorType type,
+                                                    const hidl_string& stringType) {
+    if (type >= SensorType::DEVICE_PRIVATE_BASE) {
+        return;
+    }
+
+    switch (type) {
+#define CHECK_TYPE_STRING_FOR_SENSOR_TYPE(type)                      \
+    case SensorType::type:                                           \
+        ASSERT_STREQ(SENSOR_STRING_TYPE_##type, stringType.c_str()); \
+        break;
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER_UNCALIBRATED);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ADDITIONAL_INFO);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(AMBIENT_TEMPERATURE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(DEVICE_ORIENTATION);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(DYNAMIC_SENSOR_META);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GAME_ROTATION_VECTOR);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GEOMAGNETIC_ROTATION_VECTOR);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GLANCE_GESTURE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GRAVITY);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_UNCALIBRATED);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_BEAT);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_RATE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(LIGHT);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(LINEAR_ACCELERATION);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(LOW_LATENCY_OFFBODY_DETECT);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(MAGNETIC_FIELD);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(MAGNETIC_FIELD_UNCALIBRATED);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(MOTION_DETECT);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ORIENTATION);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(PICK_UP_GESTURE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(POSE_6DOF);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(PRESSURE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(PROXIMITY);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(RELATIVE_HUMIDITY);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ROTATION_VECTOR);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(SIGNIFICANT_MOTION);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(STATIONARY_DETECT);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(STEP_COUNTER);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(STEP_DETECTOR);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(TEMPERATURE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(TILT_DETECTOR);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(WAKE_GESTURE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(WRIST_TILT_GESTURE);
+        default:
+            FAIL() << "Type " << static_cast<int>(type)
+                   << " in android defined range is not checked, "
+                   << "stringType = " << stringType;
+#undef CHECK_TYPE_STRING_FOR_SENSOR_TYPE
+    }
+}
+
+void SensorsHidlTestBase::assertTypeMatchReportMode(SensorType type, SensorFlagBits reportMode) {
+    if (type >= SensorType::DEVICE_PRIVATE_BASE) {
+        return;
+    }
+
+    SensorFlagBits expected = expectedReportModeForType(type);
+
+    ASSERT_TRUE(expected == (SensorFlagBits)-1 || expected == reportMode)
+        << "reportMode=" << static_cast<int>(reportMode)
+        << "expected=" << static_cast<int>(expected);
+}
+
+void SensorsHidlTestBase::assertDelayMatchReportMode(int32_t minDelay, int32_t maxDelay,
+                                                     SensorFlagBits reportMode) {
+    switch (reportMode) {
+        case SensorFlagBits::CONTINUOUS_MODE:
+            ASSERT_LT(0, minDelay);
+            ASSERT_LE(0, maxDelay);
+            break;
+        case SensorFlagBits::ON_CHANGE_MODE:
+            ASSERT_LE(0, minDelay);
+            ASSERT_LE(0, maxDelay);
+            break;
+        case SensorFlagBits::ONE_SHOT_MODE:
+            ASSERT_EQ(-1, minDelay);
+            ASSERT_EQ(0, maxDelay);
+            break;
+        case SensorFlagBits::SPECIAL_REPORTING_MODE:
+            // do not enforce anything for special reporting mode
+            break;
+        default:
+            FAIL() << "Report mode " << static_cast<int>(reportMode) << " not checked";
+    }
+}
+
+// return -1 means no expectation for this type
+SensorFlagBits SensorsHidlTestBase::expectedReportModeForType(SensorType type) {
+    switch (type) {
+        case SensorType::ACCELEROMETER:
+        case SensorType::ACCELEROMETER_UNCALIBRATED:
+        case SensorType::GYROSCOPE:
+        case SensorType::MAGNETIC_FIELD:
+        case SensorType::ORIENTATION:
+        case SensorType::PRESSURE:
+        case SensorType::TEMPERATURE:
+        case SensorType::GRAVITY:
+        case SensorType::LINEAR_ACCELERATION:
+        case SensorType::ROTATION_VECTOR:
+        case SensorType::MAGNETIC_FIELD_UNCALIBRATED:
+        case SensorType::GAME_ROTATION_VECTOR:
+        case SensorType::GYROSCOPE_UNCALIBRATED:
+        case SensorType::GEOMAGNETIC_ROTATION_VECTOR:
+        case SensorType::POSE_6DOF:
+        case SensorType::HEART_BEAT:
+            return SensorFlagBits::CONTINUOUS_MODE;
+
+        case SensorType::LIGHT:
+        case SensorType::PROXIMITY:
+        case SensorType::RELATIVE_HUMIDITY:
+        case SensorType::AMBIENT_TEMPERATURE:
+        case SensorType::HEART_RATE:
+        case SensorType::DEVICE_ORIENTATION:
+        case SensorType::STEP_COUNTER:
+        case SensorType::LOW_LATENCY_OFFBODY_DETECT:
+            return SensorFlagBits::ON_CHANGE_MODE;
+
+        case SensorType::SIGNIFICANT_MOTION:
+        case SensorType::WAKE_GESTURE:
+        case SensorType::GLANCE_GESTURE:
+        case SensorType::PICK_UP_GESTURE:
+        case SensorType::MOTION_DETECT:
+        case SensorType::STATIONARY_DETECT:
+            return SensorFlagBits::ONE_SHOT_MODE;
+
+        case SensorType::STEP_DETECTOR:
+        case SensorType::TILT_DETECTOR:
+        case SensorType::WRIST_TILT_GESTURE:
+        case SensorType::DYNAMIC_SENSOR_META:
+            return SensorFlagBits::SPECIAL_REPORTING_MODE;
+
+        default:
+            ALOGW("Type %d is not implemented in expectedReportModeForType", (int)type);
+            return (SensorFlagBits)-1;
+    }
+}
+
+bool SensorsHidlTestBase::isDirectReportRateSupported(SensorInfo sensor, RateLevel rate) {
+    unsigned int r = static_cast<unsigned int>(sensor.flags & SensorFlagBits::MASK_DIRECT_REPORT) >>
+                     static_cast<unsigned int>(SensorFlagShift::DIRECT_REPORT);
+    return r >= static_cast<unsigned int>(rate);
+}
+
+bool SensorsHidlTestBase::isDirectChannelTypeSupported(SensorInfo sensor, SharedMemType type) {
+    switch (type) {
+        case SharedMemType::ASHMEM:
+            return (sensor.flags & SensorFlagBits::DIRECT_CHANNEL_ASHMEM) != 0;
+        case SharedMemType::GRALLOC:
+            return (sensor.flags & SensorFlagBits::DIRECT_CHANNEL_GRALLOC) != 0;
+        default:
+            return false;
+    }
+}
+
+void SensorsHidlTestBase::testDirectReportOperation(SensorType type, SharedMemType memType,
+                                                    RateLevel rate,
+                                                    const SensorEventsChecker& checker) {
+    constexpr size_t kEventSize = static_cast<size_t>(SensorsEventFormatOffset::TOTAL_LENGTH);
+    constexpr size_t kNEvent = 4096;
+    constexpr size_t kMemSize = kEventSize * kNEvent;
+
+    constexpr float kNormalNominal = 50;
+    constexpr float kFastNominal = 200;
+    constexpr float kVeryFastNominal = 800;
+
+    constexpr float kNominalTestTimeSec = 1.f;
+    constexpr float kMaxTestTimeSec = kNominalTestTimeSec + 0.5f;  // 0.5 second for initialization
+
+    SensorInfo sensor = defaultSensorByType(type);
+
+    if (!isValidType(sensor.type)) {
+        // no default sensor of this type
+        return;
+    }
+
+    if (!isDirectReportRateSupported(sensor, rate)) {
+        return;
+    }
+
+    if (!isDirectChannelTypeSupported(sensor, memType)) {
+        return;
+    }
+
+    std::unique_ptr<SensorsTestSharedMemory> mem(
+        SensorsTestSharedMemory::create(memType, kMemSize));
+    ASSERT_NE(mem, nullptr);
+
+    char* buffer = mem->getBuffer();
+    // fill memory with data
+    for (size_t i = 0; i < kMemSize; ++i) {
+        buffer[i] = '\xcc';
+    }
+
+    int32_t channelHandle;
+    registerDirectChannel(mem->getSharedMemInfo(),
+                          [&channelHandle](auto result, auto channelHandle_) {
+                              ASSERT_EQ(result, Result::OK);
+                              channelHandle = channelHandle_;
+                          });
+
+    // check memory is zeroed
+    for (size_t i = 0; i < kMemSize; ++i) {
+        ASSERT_EQ(buffer[i], '\0');
+    }
+
+    int32_t eventToken;
+    configDirectReport(sensor.sensorHandle, channelHandle, rate,
+                       [&eventToken](auto result, auto token) {
+                           ASSERT_EQ(result, Result::OK);
+                           eventToken = token;
+                       });
+
+    usleep(static_cast<useconds_t>(kMaxTestTimeSec * 1e6f));
+    auto events = mem->parseEvents();
+
+    // find norminal rate
+    float nominalFreq = 0.f;
+    switch (rate) {
+        case RateLevel::NORMAL:
+            nominalFreq = kNormalNominal;
+            break;
+        case RateLevel::FAST:
+            nominalFreq = kFastNominal;
+            break;
+        case RateLevel::VERY_FAST:
+            nominalFreq = kVeryFastNominal;
+            break;
+        case RateLevel::STOP:
+            FAIL();
+    }
+
+    // allowed to be between 55% and 220% of nominal freq
+    ASSERT_GT(events.size(), static_cast<size_t>(nominalFreq * 0.55f * kNominalTestTimeSec));
+    ASSERT_LT(events.size(), static_cast<size_t>(nominalFreq * 2.2f * kMaxTestTimeSec));
+
+    int64_t lastTimestamp = 0;
+    bool typeErrorReported = false;
+    bool tokenErrorReported = false;
+    bool timestampErrorReported = false;
+    std::vector<Event> sensorEvents;
+    for (auto& e : events) {
+        if (!tokenErrorReported) {
+            EXPECT_EQ(eventToken, e.sensorHandle)
+                << (tokenErrorReported = true,
+                    "Event token does not match that retured from configDirectReport");
+        }
+
+        if (isMetaSensorType(e.sensorType)) {
+            continue;
+        }
+        sensorEvents.push_back(e);
+
+        if (!typeErrorReported) {
+            EXPECT_EQ(type, e.sensorType)
+                << (typeErrorReported = true,
+                    "Type in event does not match type of sensor registered.");
+        }
+        if (!timestampErrorReported) {
+            EXPECT_GT(e.timestamp, lastTimestamp)
+                << (timestampErrorReported = true, "Timestamp not monotonically increasing");
+        }
+        lastTimestamp = e.timestamp;
+    }
+
+    std::string s;
+    EXPECT_TRUE(checker.check(sensorEvents, &s)) << s;
+
+    // stop sensor and unregister channel
+    configDirectReport(sensor.sensorHandle, channelHandle, RateLevel::STOP,
+                       [](auto result, auto) { EXPECT_EQ(result, Result::OK); });
+    EXPECT_EQ(unregisterDirectChannel(channelHandle), Result::OK);
+}
+
+void SensorsHidlTestBase::testStreamingOperation(SensorType type,
+                                                 std::chrono::nanoseconds samplingPeriod,
+                                                 std::chrono::seconds duration,
+                                                 const SensorEventsChecker& checker) {
+    std::vector<Event> events;
+    std::vector<Event> sensorEvents;
+
+    const int64_t samplingPeriodInNs = samplingPeriod.count();
+    const int64_t batchingPeriodInNs = 0;  // no batching
+    const useconds_t minTimeUs = std::chrono::microseconds(duration).count();
+    const size_t minNEvent = duration / samplingPeriod;
+
+    SensorInfo sensor = defaultSensorByType(type);
+
+    if (!isValidType(sensor.type)) {
+        // no default sensor of this type
+        return;
+    }
+
+    if (std::chrono::microseconds(sensor.minDelay) > samplingPeriod) {
+        // rate not supported
+        return;
+    }
+
+    int32_t handle = sensor.sensorHandle;
+
+    ASSERT_EQ(batch(handle, samplingPeriodInNs, batchingPeriodInNs), Result::OK);
+    ASSERT_EQ(activate(handle, 1), Result::OK);
+    events = collectEvents(minTimeUs, minNEvent, true /*clearBeforeStart*/);
+    ASSERT_EQ(activate(handle, 0), Result::OK);
+
+    ALOGI("Collected %zu samples", events.size());
+
+    ASSERT_GT(events.size(), 0u);
+
+    bool handleMismatchReported = false;
+    bool metaSensorTypeErrorReported = false;
+    for (auto& e : events) {
+        if (e.sensorType == type) {
+            // avoid generating hundreds of error
+            if (!handleMismatchReported) {
+                EXPECT_EQ(e.sensorHandle, handle)
+                    << (handleMismatchReported = true,
+                        "Event of the same type must come from the sensor registered");
+            }
+            sensorEvents.push_back(e);
+        } else {
+            // avoid generating hundreds of error
+            if (!metaSensorTypeErrorReported) {
+                EXPECT_TRUE(isMetaSensorType(e.sensorType))
+                    << (metaSensorTypeErrorReported = true,
+                        "Only meta types are allowed besides the type registered");
+            }
+        }
+    }
+
+    std::string s;
+    EXPECT_TRUE(checker.check(sensorEvents, &s)) << s;
+
+    EXPECT_GE(sensorEvents.size(),
+              minNEvent / 2);  // make sure returned events are not all meta
+}
+
+void SensorsHidlTestBase::testSamplingRateHotSwitchOperation(SensorType type, bool fastToSlow) {
+    std::vector<Event> events1, events2;
+
+    constexpr int64_t batchingPeriodInNs = 0;          // no batching
+    constexpr int64_t collectionTimeoutUs = 60000000;  // 60s
+    constexpr size_t minNEvent = 50;
+
+    SensorInfo sensor = defaultSensorByType(type);
+
+    if (!isValidType(sensor.type)) {
+        // no default sensor of this type
+        return;
+    }
+
+    int32_t handle = sensor.sensorHandle;
+    int64_t minSamplingPeriodInNs = sensor.minDelay * 1000ll;
+    int64_t maxSamplingPeriodInNs = sensor.maxDelay * 1000ll;
+
+    if (minSamplingPeriodInNs == maxSamplingPeriodInNs) {
+        // only support single rate
+        return;
+    }
+
+    int64_t firstCollectionPeriod = fastToSlow ? minSamplingPeriodInNs : maxSamplingPeriodInNs;
+    int64_t secondCollectionPeriod = !fastToSlow ? minSamplingPeriodInNs : maxSamplingPeriodInNs;
+
+    // first collection
+    ASSERT_EQ(batch(handle, firstCollectionPeriod, batchingPeriodInNs), Result::OK);
+    ASSERT_EQ(activate(handle, 1), Result::OK);
+
+    usleep(500000);  // sleep 0.5 sec to wait for change rate to happen
+    events1 = collectEvents(collectionTimeoutUs, minNEvent);
+
+    // second collection, without stop sensor
+    ASSERT_EQ(batch(handle, secondCollectionPeriod, batchingPeriodInNs), Result::OK);
+
+    usleep(500000);  // sleep 0.5 sec to wait for change rate to happen
+    events2 = collectEvents(collectionTimeoutUs, minNEvent);
+
+    // end of collection, stop sensor
+    ASSERT_EQ(activate(handle, 0), Result::OK);
+
+    ALOGI("Collected %zu fast samples and %zu slow samples", events1.size(), events2.size());
+
+    ASSERT_GT(events1.size(), 0u);
+    ASSERT_GT(events2.size(), 0u);
+
+    int64_t minDelayAverageInterval, maxDelayAverageInterval;
+    std::vector<Event>& minDelayEvents(fastToSlow ? events1 : events2);
+    std::vector<Event>& maxDelayEvents(fastToSlow ? events2 : events1);
+
+    size_t nEvent = 0;
+    int64_t prevTimestamp = -1;
+    int64_t timestampInterval = 0;
+    for (auto& e : minDelayEvents) {
+        if (e.sensorType == type) {
+            ASSERT_EQ(e.sensorHandle, handle);
+            if (prevTimestamp > 0) {
+                timestampInterval += e.timestamp - prevTimestamp;
+            }
+            prevTimestamp = e.timestamp;
+            ++nEvent;
+        }
+    }
+    ASSERT_GT(nEvent, 2u);
+    minDelayAverageInterval = timestampInterval / (nEvent - 1);
+
+    nEvent = 0;
+    prevTimestamp = -1;
+    timestampInterval = 0;
+    for (auto& e : maxDelayEvents) {
+        if (e.sensorType == type) {
+            ASSERT_EQ(e.sensorHandle, handle);
+            if (prevTimestamp > 0) {
+                timestampInterval += e.timestamp - prevTimestamp;
+            }
+            prevTimestamp = e.timestamp;
+            ++nEvent;
+        }
+    }
+    ASSERT_GT(nEvent, 2u);
+    maxDelayAverageInterval = timestampInterval / (nEvent - 1);
+
+    // change of rate is significant.
+    ALOGI("min/maxDelayAverageInterval = %" PRId64 " %" PRId64, minDelayAverageInterval,
+          maxDelayAverageInterval);
+    EXPECT_GT((maxDelayAverageInterval - minDelayAverageInterval), minDelayAverageInterval / 10);
+
+    // fastest rate sampling time is close to spec
+    EXPECT_LT(std::abs(minDelayAverageInterval - minSamplingPeriodInNs),
+              minSamplingPeriodInNs / 10);
+
+    // slowest rate sampling time is close to spec
+    EXPECT_LT(std::abs(maxDelayAverageInterval - maxSamplingPeriodInNs),
+              maxSamplingPeriodInNs / 10);
+}
+
+void SensorsHidlTestBase::testBatchingOperation(SensorType type) {
+    std::vector<Event> events;
+
+    constexpr int64_t maxBatchingTestTimeNs = 30ull * 1000 * 1000 * 1000;
+    constexpr int64_t oneSecondInNs = 1ull * 1000 * 1000 * 1000;
+
+    SensorInfo sensor = defaultSensorByType(type);
+
+    if (!isValidType(sensor.type)) {
+        // no default sensor of this type
+        return;
+    }
+
+    int32_t handle = sensor.sensorHandle;
+    int64_t minSamplingPeriodInNs = sensor.minDelay * 1000ll;
+    uint32_t minFifoCount = sensor.fifoReservedEventCount;
+    int64_t batchingPeriodInNs = minFifoCount * minSamplingPeriodInNs;
+
+    if (batchingPeriodInNs < oneSecondInNs) {
+        // batching size too small to test reliably
+        return;
+    }
+
+    batchingPeriodInNs = std::min(batchingPeriodInNs, maxBatchingTestTimeNs);
+
+    ALOGI("Test batching for %d ms", (int)(batchingPeriodInNs / 1000 / 1000));
+
+    int64_t allowedBatchDeliverTimeNs = std::max(oneSecondInNs, batchingPeriodInNs / 10);
+
+    ASSERT_EQ(batch(handle, minSamplingPeriodInNs, INT64_MAX), Result::OK);
+    ASSERT_EQ(activate(handle, 1), Result::OK);
+
+    usleep(500000);  // sleep 0.5 sec to wait for initialization
+    ASSERT_EQ(flush(handle), Result::OK);
+
+    // wait for 80% of the reserved batching period
+    // there should not be any significant amount of events
+    // since collection is not enabled all events will go down the drain
+    usleep(batchingPeriodInNs / 1000 * 8 / 10);
+
+    getEnvironment()->setCollection(true);
+    // clean existing collections
+    collectEvents(0 /*timeLimitUs*/, 0 /*nEventLimit*/, true /*clearBeforeStart*/,
+                  false /*change collection*/);
+
+    // 0.8 + 0.2 times the batching period
+    usleep(batchingPeriodInNs / 1000 * 8 / 10);
+    ASSERT_EQ(flush(handle), Result::OK);
+
+    // plus some time for the event to deliver
+    events = collectEvents(allowedBatchDeliverTimeNs / 1000, minFifoCount,
+                           false /*clearBeforeStart*/, false /*change collection*/);
+
+    getEnvironment()->setCollection(false);
+    ASSERT_EQ(activate(handle, 0), Result::OK);
+
+    size_t nEvent = 0;
+    for (auto& e : events) {
+        if (e.sensorType == type && e.sensorHandle == handle) {
+            ++nEvent;
+        }
+    }
+
+    // at least reach 90% of advertised capacity
+    ASSERT_GT(nEvent, (size_t)(minFifoCount * 9 / 10));
+}
diff --git a/sensors/common/vts/utils/SensorsTestSharedMemory.cpp b/sensors/common/vts/utils/SensorsTestSharedMemory.cpp
new file mode 100644
index 0000000..819e297
--- /dev/null
+++ b/sensors/common/vts/utils/SensorsTestSharedMemory.cpp
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SensorsTestSharedMemory.h"
+
+#include <log/log.h>
+
+#include <sys/mman.h>
+#include <cinttypes>
+
+using namespace ::android::hardware::sensors::V1_0;
+
+SharedMemInfo SensorsTestSharedMemory::getSharedMemInfo() const {
+    SharedMemInfo mem = {.type = mType,
+                         .format = SharedMemFormat::SENSORS_EVENT,
+                         .size = static_cast<uint32_t>(mSize),
+                         .memoryHandle = mNativeHandle};
+    return mem;
+}
+
+char* SensorsTestSharedMemory::getBuffer() const {
+    return mBuffer;
+}
+
+size_t SensorsTestSharedMemory::getSize() const {
+    return mSize;
+}
+
+std::vector<Event> SensorsTestSharedMemory::parseEvents(int64_t lastCounter, size_t offset) const {
+    constexpr size_t kEventSize = static_cast<size_t>(SensorsEventFormatOffset::TOTAL_LENGTH);
+    constexpr size_t kOffsetSize = static_cast<size_t>(SensorsEventFormatOffset::SIZE_FIELD);
+    constexpr size_t kOffsetToken = static_cast<size_t>(SensorsEventFormatOffset::REPORT_TOKEN);
+    constexpr size_t kOffsetType = static_cast<size_t>(SensorsEventFormatOffset::SENSOR_TYPE);
+    constexpr size_t kOffsetAtomicCounter =
+        static_cast<size_t>(SensorsEventFormatOffset::ATOMIC_COUNTER);
+    constexpr size_t kOffsetTimestamp = static_cast<size_t>(SensorsEventFormatOffset::TIMESTAMP);
+    constexpr size_t kOffsetData = static_cast<size_t>(SensorsEventFormatOffset::DATA);
+
+    std::vector<Event> events;
+    std::vector<float> data(16);
+
+    while (offset + kEventSize <= mSize) {
+        int64_t atomicCounter =
+            *reinterpret_cast<uint32_t*>(mBuffer + offset + kOffsetAtomicCounter);
+        if (atomicCounter <= lastCounter) {
+            ALOGV("atomicCounter = %" PRId64 ", lastCounter = %" PRId64, atomicCounter,
+                  lastCounter);
+            break;
+        }
+
+        int32_t size = *reinterpret_cast<int32_t*>(mBuffer + offset + kOffsetSize);
+        if (size != kEventSize) {
+            // unknown error, events parsed may be wrong, remove all
+            events.clear();
+            break;
+        }
+
+        int32_t token = *reinterpret_cast<int32_t*>(mBuffer + offset + kOffsetToken);
+        int32_t type = *reinterpret_cast<int32_t*>(mBuffer + offset + kOffsetType);
+        int64_t timestamp = *reinterpret_cast<int64_t*>(mBuffer + offset + kOffsetTimestamp);
+
+        ALOGV("offset = %zu, cnt %" PRId64 ", token %" PRId32 ", type %" PRId32
+              ", timestamp %" PRId64,
+              offset, atomicCounter, token, type, timestamp);
+
+        Event event = {
+            .timestamp = timestamp,
+            .sensorHandle = token,
+            .sensorType = static_cast<SensorType>(type),
+        };
+        event.u.data = android::hardware::hidl_array<float, 16>(
+            reinterpret_cast<float*>(mBuffer + offset + kOffsetData));
+
+        events.push_back(event);
+
+        lastCounter = atomicCounter;
+        offset += kEventSize;
+    }
+
+    return events;
+}
+
+SensorsTestSharedMemory::SensorsTestSharedMemory(SharedMemType type, size_t size)
+    : mType(type), mSize(0), mBuffer(nullptr) {
+    native_handle_t* handle = nullptr;
+    char* buffer = nullptr;
+    switch (type) {
+        case SharedMemType::ASHMEM: {
+            int fd;
+            handle = ::native_handle_create(1 /*nFds*/, 0 /*nInts*/);
+            if (handle != nullptr) {
+                handle->data[0] = fd = ::ashmem_create_region("SensorsTestSharedMemory", size);
+                if (handle->data[0] > 0) {
+                    // memory is pinned by default
+                    buffer = static_cast<char*>(
+                        ::mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0));
+                    if (buffer != reinterpret_cast<char*>(MAP_FAILED)) {
+                        break;
+                    }
+                    ::native_handle_close(handle);
+                }
+                ::native_handle_delete(handle);
+                handle = nullptr;
+            }
+            break;
+        }
+        case SharedMemType::GRALLOC: {
+            mGrallocWrapper = std::make_unique<::android::GrallocWrapper>();
+            if (mGrallocWrapper->getAllocator() == nullptr ||
+                mGrallocWrapper->getMapper() == nullptr) {
+                break;
+            }
+            using android::hardware::graphics::common::V1_0::BufferUsage;
+            using android::hardware::graphics::common::V1_0::PixelFormat;
+            mapper2::IMapper::BufferDescriptorInfo buf_desc_info = {
+                .width = static_cast<uint32_t>(size),
+                .height = 1,
+                .layerCount = 1,
+                .usage = static_cast<uint64_t>(BufferUsage::SENSOR_DIRECT_DATA |
+                                               BufferUsage::CPU_READ_OFTEN),
+                .format = PixelFormat::BLOB};
+
+            handle = const_cast<native_handle_t*>(mGrallocWrapper->allocate(buf_desc_info));
+            if (handle != nullptr) {
+                mapper2::IMapper::Rect region{0, 0, static_cast<int32_t>(buf_desc_info.width),
+                                              static_cast<int32_t>(buf_desc_info.height)};
+                buffer = static_cast<char*>(
+                    mGrallocWrapper->lock(handle, buf_desc_info.usage, region, /*fence=*/-1));
+                if (buffer != nullptr) {
+                    break;
+                }
+                mGrallocWrapper->freeBuffer(handle);
+                handle = nullptr;
+            }
+            break;
+        }
+        default:
+            break;
+    }
+
+    if (buffer != nullptr) {
+        mNativeHandle = handle;
+        mSize = size;
+        mBuffer = buffer;
+    }
+}
+
+SensorsTestSharedMemory::~SensorsTestSharedMemory() {
+    switch (mType) {
+        case SharedMemType::ASHMEM: {
+            if (mSize != 0) {
+                ::munmap(mBuffer, mSize);
+                mBuffer = nullptr;
+
+                ::native_handle_close(mNativeHandle);
+                ::native_handle_delete(mNativeHandle);
+
+                mNativeHandle = nullptr;
+                mSize = 0;
+            }
+            break;
+        }
+        case SharedMemType::GRALLOC: {
+            if (mSize != 0) {
+                mGrallocWrapper->unlock(mNativeHandle);
+                mGrallocWrapper->freeBuffer(mNativeHandle);
+
+                mNativeHandle = nullptr;
+                mSize = 0;
+            }
+            break;
+        }
+        default: {
+            if (mNativeHandle != nullptr || mSize != 0 || mBuffer != nullptr) {
+                ALOGE(
+                    "SensorsTestSharedMemory %p not properly destructed: "
+                    "type %d, native handle %p, size %zu, buffer %p",
+                    this, static_cast<int>(mType), mNativeHandle, mSize, mBuffer);
+            }
+            break;
+        }
+    }
+}
+
+SensorsTestSharedMemory* SensorsTestSharedMemory::create(SharedMemType type, size_t size) {
+    constexpr size_t kMaxSize = 128 * 1024 * 1024;  // sensor test should not need more than 128M
+    if (size == 0 || size >= kMaxSize) {
+        return nullptr;
+    }
+
+    auto m = new SensorsTestSharedMemory(type, size);
+    if (m->mSize != size || m->mBuffer == nullptr) {
+        delete m;
+        m = nullptr;
+    }
+    return m;
+}
diff --git a/sensors/common/vts/utils/include/sensors-vts-utils/GrallocWrapper.h b/sensors/common/vts/utils/include/sensors-vts-utils/GrallocWrapper.h
new file mode 100644
index 0000000..3bd73c3
--- /dev/null
+++ b/sensors/common/vts/utils/include/sensors-vts-utils/GrallocWrapper.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef GRALLO_WRAPPER_H_
+#define GRALLO_WRAPPER_H_
+
+#include <unordered_set>
+
+#include <android/hardware/graphics/allocator/2.0/IAllocator.h>
+#include <android/hardware/graphics/mapper/2.0/IMapper.h>
+
+namespace allocator2 = ::android::hardware::graphics::allocator::V2_0;
+namespace mapper2 = ::android::hardware::graphics::mapper::V2_0;
+
+namespace android {
+
+// Modified from hardware/interfaces/graphics/mapper/2.0/vts/functional/
+class GrallocWrapper {
+   public:
+    GrallocWrapper();
+    ~GrallocWrapper();
+
+    sp<allocator2::IAllocator> getAllocator() const;
+    sp<mapper2::IMapper> getMapper() const;
+
+    std::string dumpDebugInfo();
+
+    // When import is false, this simply calls IAllocator::allocate. When import
+    // is true, the returned buffers are also imported into the mapper.
+    //
+    // Either case, the returned buffers must be freed with freeBuffer.
+    std::vector<const native_handle_t*> allocate(const mapper2::BufferDescriptor& descriptor,
+                                                 uint32_t count, bool import = true,
+                                                 uint32_t* outStride = nullptr);
+    const native_handle_t* allocate(const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo,
+                                    bool import = true, uint32_t* outStride = nullptr);
+
+    mapper2::BufferDescriptor createDescriptor(
+        const mapper2::IMapper::BufferDescriptorInfo& descriptorInfo);
+
+    const native_handle_t* importBuffer(const hardware::hidl_handle& rawHandle);
+    void freeBuffer(const native_handle_t* bufferHandle);
+
+    // We use fd instead of hardware::hidl_handle in these functions to pass fences
+    // in and out of the mapper.  The ownership of the fd is always transferred
+    // with each of these functions.
+    void* lock(const native_handle_t* bufferHandle, uint64_t cpuUsage,
+               const mapper2::IMapper::Rect& accessRegion, int acquireFence);
+
+    int unlock(const native_handle_t* bufferHandle);
+
+   private:
+    void init();
+    const native_handle_t* cloneBuffer(const hardware::hidl_handle& rawHandle);
+
+    sp<allocator2::IAllocator> mAllocator;
+    sp<mapper2::IMapper> mMapper;
+
+    // Keep track of all cloned and imported handles.  When a test fails with
+    // ASSERT_*, the destructor will free the handles for the test.
+    std::unordered_set<const native_handle_t*> mClonedBuffers;
+    std::unordered_set<const native_handle_t*> mImportedBuffers;
+};
+
+}  // namespace android
+#endif  // GRALLO_WRAPPER_H_
diff --git a/sensors/common/vts/utils/include/sensors-vts-utils/SensorEventsChecker.h b/sensors/common/vts/utils/include/sensors-vts-utils/SensorEventsChecker.h
new file mode 100644
index 0000000..b5daccc
--- /dev/null
+++ b/sensors/common/vts/utils/include/sensors-vts-utils/SensorEventsChecker.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SENSOR_EVENTS_CHECKER_H
+#define ANDROID_SENSOR_EVENTS_CHECKER_H
+
+#include <android/hardware/sensors/1.0/types.h>
+
+#include <cmath>
+
+class SensorEventsChecker {
+   public:
+    using Event = ::android::hardware::sensors::V1_0::Event;
+    virtual bool check(const std::vector<Event>& events, std::string* out) const = 0;
+    virtual ~SensorEventsChecker() {}
+};
+
+class NullChecker : public SensorEventsChecker {
+   public:
+    virtual bool check(const std::vector<Event>&, std::string*) const { return true; }
+};
+
+class SensorEventPerEventChecker : public SensorEventsChecker {
+   public:
+    virtual bool checkEvent(const Event& event, std::string* out) const = 0;
+    virtual bool check(const std::vector<Event>& events, std::string* out) const {
+        for (const auto& e : events) {
+            if (!checkEvent(e, out)) {
+                return false;
+            }
+        }
+        return true;
+    }
+};
+
+class Vec3NormChecker : public SensorEventPerEventChecker {
+   public:
+    Vec3NormChecker(float min, float max) : mLowerLimit(min), mUpperLimit(max) {}
+    static Vec3NormChecker byNominal(float nominal, float allowedError) {
+        return Vec3NormChecker(nominal - allowedError, nominal + allowedError);
+    }
+
+    virtual bool checkEvent(const Event& event, std::string* out) const {
+        android::hardware::sensors::V1_0::Vec3 v = event.u.vec3;
+        float norm = std::sqrt(v.x * v.x + v.y * v.y + v.z * v.z);
+        if (norm < mLowerLimit || norm > mUpperLimit) {
+            if (out != nullptr) {
+                std::ostringstream ss;
+                ss << "Event @ " << event.timestamp << " (" << v.x << ", " << v.y << ", " << v.z
+                   << ")"
+                   << " has norm " << norm << ", which is beyond range"
+                   << " [" << mLowerLimit << ", " << mUpperLimit << "]";
+                *out = ss.str();
+            }
+            return false;
+        }
+        return true;
+    }
+
+   protected:
+    float mLowerLimit;
+    float mUpperLimit;
+};
+
+#endif  // ANDROID_SENSOR_EVENTS_CHECKER_H
\ No newline at end of file
diff --git a/sensors/common/vts/utils/include/sensors-vts-utils/SensorsHidlEnvironmentBase.h b/sensors/common/vts/utils/include/sensors-vts-utils/SensorsHidlEnvironmentBase.h
new file mode 100644
index 0000000..6499fba
--- /dev/null
+++ b/sensors/common/vts/utils/include/sensors-vts-utils/SensorsHidlEnvironmentBase.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SENSORS_HIDL_ENVIRONMENT_BASE_H
+#define ANDROID_SENSORS_HIDL_ENVIRONMENT_BASE_H
+
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+#include <android/hardware/sensors/1.0/types.h>
+
+#include <atomic>
+#include <memory>
+#include <mutex>
+#include <thread>
+#include <vector>
+
+class IEventCallback {
+   public:
+    virtual ~IEventCallback() = default;
+    virtual void onEvent(const ::android::hardware::sensors::V1_0::Event& event) = 0;
+};
+
+class SensorsHidlEnvironmentBase : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    using Event = ::android::hardware::sensors::V1_0::Event;
+    virtual void HidlSetUp() override;
+    virtual void HidlTearDown() override;
+
+    // Get and clear all events collected so far (like "cat" shell command).
+    // If output is nullptr, it clears all collected events.
+    void catEvents(std::vector<Event>* output);
+
+    // set sensor event collection status
+    void setCollection(bool enable);
+
+    void registerCallback(IEventCallback* callback);
+    void unregisterCallback();
+
+   protected:
+    SensorsHidlEnvironmentBase() : mCollectionEnabled(false), mCallback(nullptr) {}
+
+    void addEvent(const Event& ev);
+
+    virtual void startPollingThread() = 0;
+    virtual bool resetHal() = 0;
+
+    bool mCollectionEnabled;
+    std::atomic_bool mStopThread;
+    std::thread mPollThread;
+    std::vector<Event> mEvents;
+    std::mutex mEventsMutex;
+
+    IEventCallback* mCallback;
+
+    GTEST_DISALLOW_COPY_AND_ASSIGN_(SensorsHidlEnvironmentBase);
+};
+
+#endif  // ANDROID_SENSORS_HIDL_ENVIRONMENT_BASE_H
\ No newline at end of file
diff --git a/sensors/common/vts/utils/include/sensors-vts-utils/SensorsHidlTestBase.h b/sensors/common/vts/utils/include/sensors-vts-utils/SensorsHidlTestBase.h
new file mode 100644
index 0000000..6fd9a2b
--- /dev/null
+++ b/sensors/common/vts/utils/include/sensors-vts-utils/SensorsHidlTestBase.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SENSORS_HIDL_TEST_BASE_H
+#define ANDROID_SENSORS_HIDL_TEST_BASE_H
+
+#include "sensors-vts-utils/SensorEventsChecker.h"
+#include "sensors-vts-utils/SensorsHidlEnvironmentBase.h"
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <android/hardware/sensors/1.0/ISensors.h>
+#include <android/hardware/sensors/1.0/types.h>
+
+#include <unordered_set>
+#include <vector>
+
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::sensors::V1_0::Event;
+using ::android::hardware::sensors::V1_0::ISensors;
+using ::android::hardware::sensors::V1_0::RateLevel;
+using ::android::hardware::sensors::V1_0::Result;
+using ::android::hardware::sensors::V1_0::SensorFlagBits;
+using ::android::hardware::sensors::V1_0::SensorInfo;
+using ::android::hardware::sensors::V1_0::SensorType;
+using ::android::hardware::sensors::V1_0::SharedMemInfo;
+using ::android::hardware::sensors::V1_0::SharedMemType;
+
+class SensorsHidlTestBase : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual SensorsHidlEnvironmentBase* getEnvironment() = 0;
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override {
+        // stop all sensors
+        for (auto s : mSensorHandles) {
+            activate(s, false);
+        }
+        mSensorHandles.clear();
+
+        // stop all direct report and channels
+        for (auto c : mDirectChannelHandles) {
+            // disable all reports
+            configDirectReport(-1, c, RateLevel::STOP, [](auto, auto) {});
+            unregisterDirectChannel(c);
+        }
+        mDirectChannelHandles.clear();
+    }
+
+    // implementation wrapper
+    virtual SensorInfo defaultSensorByType(SensorType type) = 0;
+    virtual Return<void> getSensorsList(ISensors::getSensorsList_cb _hidl_cb) = 0;
+
+    virtual Return<Result> activate(int32_t sensorHandle, bool enabled) = 0;
+
+    virtual Return<Result> batch(int32_t sensorHandle, int64_t samplingPeriodNs,
+                                 int64_t maxReportLatencyNs) = 0;
+
+    virtual Return<Result> flush(int32_t sensorHandle) = 0;
+    virtual Return<Result> injectSensorData(const Event& event) = 0;
+    virtual Return<void> registerDirectChannel(const SharedMemInfo& mem,
+                                               ISensors::registerDirectChannel_cb _hidl_cb) = 0;
+    virtual Return<Result> unregisterDirectChannel(int32_t channelHandle) = 0;
+    virtual Return<void> configDirectReport(int32_t sensorHandle, int32_t channelHandle,
+                                            RateLevel rate,
+                                            ISensors::configDirectReport_cb _hidl_cb) = 0;
+
+    std::vector<Event> collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
+                                     bool clearBeforeStart = true, bool changeCollection = true);
+    static std::vector<Event> collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
+                                            SensorsHidlEnvironmentBase* environment,
+                                            bool clearBeforeStart = true,
+                                            bool changeCollection = true);
+
+    inline static SensorFlagBits extractReportMode(uint64_t flag) {
+        return (SensorFlagBits)(flag & ((uint64_t)SensorFlagBits::CONTINUOUS_MODE |
+                                        (uint64_t)SensorFlagBits::ON_CHANGE_MODE |
+                                        (uint64_t)SensorFlagBits::ONE_SHOT_MODE |
+                                        (uint64_t)SensorFlagBits::SPECIAL_REPORTING_MODE));
+    }
+
+    inline static bool isMetaSensorType(SensorType type) {
+        return (type == SensorType::META_DATA || type == SensorType::DYNAMIC_SENSOR_META ||
+                type == SensorType::ADDITIONAL_INFO);
+    }
+
+    inline static bool isValidType(SensorType type) { return (int32_t)type > 0; }
+
+    void testStreamingOperation(SensorType type, std::chrono::nanoseconds samplingPeriod,
+                                std::chrono::seconds duration, const SensorEventsChecker& checker);
+    void testSamplingRateHotSwitchOperation(SensorType type, bool fastToSlow = true);
+    void testBatchingOperation(SensorType type);
+    void testDirectReportOperation(SensorType type, SharedMemType memType, RateLevel rate,
+                                   const SensorEventsChecker& checker);
+
+    static void assertTypeMatchStringType(SensorType type, const hidl_string& stringType);
+    static void assertTypeMatchReportMode(SensorType type, SensorFlagBits reportMode);
+    static void assertDelayMatchReportMode(int32_t minDelay, int32_t maxDelay,
+                                           SensorFlagBits reportMode);
+    static SensorFlagBits expectedReportModeForType(SensorType type);
+    static bool isDirectReportRateSupported(SensorInfo sensor, RateLevel rate);
+    static bool isDirectChannelTypeSupported(SensorInfo sensor, SharedMemType type);
+
+   protected:
+    // checkers
+    static const Vec3NormChecker sAccelNormChecker;
+    static const Vec3NormChecker sGyroNormChecker;
+
+    // all sensors and direct channnels used
+    std::unordered_set<int32_t> mSensorHandles;
+    std::unordered_set<int32_t> mDirectChannelHandles;
+};
+
+#endif  // ANDROID_SENSORS_HIDL_TEST_BASE_H
\ No newline at end of file
diff --git a/sensors/common/vts/utils/include/sensors-vts-utils/SensorsTestSharedMemory.h b/sensors/common/vts/utils/include/sensors-vts-utils/SensorsTestSharedMemory.h
new file mode 100644
index 0000000..002f42c
--- /dev/null
+++ b/sensors/common/vts/utils/include/sensors-vts-utils/SensorsTestSharedMemory.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SENSORS_TEST_SHARED_MEMORY_H
+#define ANDROID_SENSORS_TEST_SHARED_MEMORY_H
+
+#include "GrallocWrapper.h"
+
+#include <android-base/macros.h>
+#include <android/hardware/sensors/1.0/types.h>
+
+#include <cutils/ashmem.h>
+
+class SensorsTestSharedMemory {
+    using SharedMemType = ::android::hardware::sensors::V1_0::SharedMemType;
+    using SharedMemInfo = ::android::hardware::sensors::V1_0::SharedMemInfo;
+    using Event = ::android::hardware::sensors::V1_0::Event;
+
+   public:
+    static SensorsTestSharedMemory* create(SharedMemType type, size_t size);
+    SharedMemInfo getSharedMemInfo() const;
+    char* getBuffer() const;
+    size_t getSize() const;
+    std::vector<Event> parseEvents(int64_t lastCounter = -1, size_t offset = 0) const;
+    virtual ~SensorsTestSharedMemory();
+
+   private:
+    SensorsTestSharedMemory(SharedMemType type, size_t size);
+
+    SharedMemType mType;
+    native_handle_t* mNativeHandle;
+    size_t mSize;
+    char* mBuffer;
+    std::unique_ptr<::android::GrallocWrapper> mGrallocWrapper;
+
+    DISALLOW_COPY_AND_ASSIGN(SensorsTestSharedMemory);
+};
+
+#endif  // ANDROID_SENSORS_TEST_SHARED_MEMORY_H
diff --git a/soundtrigger/2.2/Android.bp b/soundtrigger/2.2/Android.bp
new file mode 100644
index 0000000..0a7c2d8
--- /dev/null
+++ b/soundtrigger/2.2/Android.bp
@@ -0,0 +1,20 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.soundtrigger@2.2",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "ISoundTriggerHw.hal",
+    ],
+    interfaces: [
+        "android.hardware.audio.common@2.0",
+        "android.hardware.soundtrigger@2.0",
+        "android.hardware.soundtrigger@2.1",
+        "android.hidl.base@1.0",
+    ],
+    gen_java: false,
+}
+
diff --git a/soundtrigger/2.2/ISoundTriggerHw.hal b/soundtrigger/2.2/ISoundTriggerHw.hal
new file mode 100644
index 0000000..a26896a
--- /dev/null
+++ b/soundtrigger/2.2/ISoundTriggerHw.hal
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.soundtrigger@2.2;
+
+import @2.0::SoundModelHandle;
+import @2.1::ISoundTriggerHw;
+
+/**
+ * SoundTrigger HAL interface. Used for hardware recognition of hotwords
+ * and other sounds.
+ */
+interface ISoundTriggerHw extends @2.1::ISoundTriggerHw {
+
+    /**
+     * Get the state of a given model.
+     * The model state is returned asynchronously as a RecognitionEvent via
+     * the callback that was registered in StartRecognition().
+     * @param modelHandle The handle of the sound model whose state is being
+     *                    queried.
+     * @return retval Operation completion status: 0 in case of success,
+     *                -ENOSYS in case of invalid model handle,
+     *                -ENOMEM in case of memory allocation failure,
+     *                -ENODEV in case of initialization error,
+     *                -EINVAL in case where a recognition event is already
+     *                        being processed.
+     */
+    getModelState(SoundModelHandle modelHandle) generates (int32_t retval);
+};
diff --git a/soundtrigger/2.2/default/Android.bp b/soundtrigger/2.2/default/Android.bp
new file mode 100644
index 0000000..78bb69f
--- /dev/null
+++ b/soundtrigger/2.2/default/Android.bp
@@ -0,0 +1,37 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_library_shared {
+    name: "android.hardware.soundtrigger@2.2-impl",
+    relative_install_path: "hw",
+    vendor: true,
+    srcs: [
+        "SoundTriggerHw.cpp",
+    ],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libhidlmemory",
+        "libutils",
+        "libhardware",
+        "android.hardware.soundtrigger@2.0",
+        "android.hardware.soundtrigger@2.0-core",
+        "android.hardware.soundtrigger@2.1",
+        "android.hardware.soundtrigger@2.2",
+        "android.hidl.allocator@1.0",
+        "android.hidl.memory@1.0",
+    ],
+}
diff --git a/soundtrigger/2.2/default/SoundTriggerHw.cpp b/soundtrigger/2.2/default/SoundTriggerHw.cpp
new file mode 100644
index 0000000..9d930ac
--- /dev/null
+++ b/soundtrigger/2.2/default/SoundTriggerHw.cpp
@@ -0,0 +1,725 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "SoundTriggerHw"
+
+#include "SoundTriggerHw.h"
+
+#include <android/hidl/allocator/1.0/IAllocator.h>
+#include <android/log.h>
+#include <hidlmemory/mapping.h>
+#include <utility>
+
+using android::hardware::hidl_memory;
+using android::hidl::allocator::V1_0::IAllocator;
+using android::hidl::memory::V1_0::IMemory;
+
+namespace android {
+namespace hardware {
+namespace soundtrigger {
+namespace V2_2 {
+namespace implementation {
+
+/**
+ * According to the HIDL C++ Users Guide: client and server implementations
+ * should never directly refer to anything other than the interface header
+ * generated from the HIDL definition file (ie. ISoundTriggerHw.hal), so
+ * this V2_2 implementation copies the V2_0 and V2_1 implementations and
+ * then adds the new V2_2 implementation.
+ */
+
+// Begin V2_0 implementation, copied from
+// hardware/interfaces/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp
+
+// static
+void soundModelCallback_(struct sound_trigger_model_event* halEvent, void* cookie) {
+    if (halEvent == NULL) {
+        ALOGW("soundModelCallback called with NULL event");
+        return;
+    }
+    sp<SoundTriggerHw::SoundModelClient> client =
+        wp<SoundTriggerHw::SoundModelClient>(static_cast<SoundTriggerHw::SoundModelClient*>(cookie))
+            .promote();
+    if (client == 0) {
+        ALOGW("soundModelCallback called on stale client");
+        return;
+    }
+    if (halEvent->model != client->getHalHandle()) {
+        ALOGW("soundModelCallback call with wrong handle %d on client with handle %d",
+              (int)halEvent->model, (int)client->getHalHandle());
+        return;
+    }
+
+    client->soundModelCallback(halEvent);
+}
+
+// static
+void recognitionCallback_(struct sound_trigger_recognition_event* halEvent, void* cookie) {
+    if (halEvent == NULL) {
+        ALOGW("recognitionCallback call NULL event");
+        return;
+    }
+    sp<SoundTriggerHw::SoundModelClient> client =
+        wp<SoundTriggerHw::SoundModelClient>(static_cast<SoundTriggerHw::SoundModelClient*>(cookie))
+            .promote();
+    if (client == 0) {
+        ALOGW("recognitionCallback called on stale client");
+        return;
+    }
+
+    client->recognitionCallback(halEvent);
+}
+
+Return<void> SoundTriggerHw::getProperties(ISoundTriggerHw::getProperties_cb _hidl_cb) {
+    ALOGV("getProperties() mHwDevice %p", mHwDevice);
+    int ret;
+    struct sound_trigger_properties halProperties;
+    ISoundTriggerHw::Properties properties;
+
+    if (mHwDevice == NULL) {
+        ret = -ENODEV;
+        goto exit;
+    }
+
+    ret = mHwDevice->get_properties(mHwDevice, &halProperties);
+
+    convertPropertiesFromHal(&properties, &halProperties);
+
+    ALOGV("getProperties implementor %s recognitionModes %08x", properties.implementor.c_str(),
+          properties.recognitionModes);
+
+exit:
+    _hidl_cb(ret, properties);
+    return Void();
+}
+
+int SoundTriggerHw::doLoadSoundModel(const V2_0::ISoundTriggerHw::SoundModel& soundModel,
+                                     sp<SoundTriggerHw::SoundModelClient> client) {
+    int32_t ret = 0;
+    struct sound_trigger_sound_model* halSoundModel;
+
+    ALOGV("doLoadSoundModel() data size %zu", soundModel.data.size());
+
+    if (mHwDevice == NULL) {
+        ret = -ENODEV;
+        goto exit;
+    }
+
+    halSoundModel = convertSoundModelToHal(&soundModel);
+    if (halSoundModel == NULL) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    sound_model_handle_t halHandle;
+    ret = mHwDevice->load_sound_model(mHwDevice, halSoundModel, soundModelCallback_, client.get(),
+                                      &halHandle);
+
+    free(halSoundModel);
+
+    if (ret != 0) {
+        goto exit;
+    }
+
+    client->setHalHandle(halHandle);
+    {
+        AutoMutex lock(mLock);
+        mClients.add(client->getId(), client);
+    }
+
+exit:
+    return ret;
+}
+
+Return<void> SoundTriggerHw::loadSoundModel(const V2_0::ISoundTriggerHw::SoundModel& soundModel,
+                                            const sp<V2_0::ISoundTriggerHwCallback>& callback,
+                                            V2_0::ISoundTriggerHwCallback::CallbackCookie cookie,
+                                            ISoundTriggerHw::loadSoundModel_cb _hidl_cb) {
+    sp<SoundTriggerHw::SoundModelClient> client =
+        new SoundModelClient_2_0(nextUniqueModelId(), cookie, callback);
+    _hidl_cb(doLoadSoundModel(soundModel, client), client->getId());
+    return Void();
+}
+
+Return<void> SoundTriggerHw::loadPhraseSoundModel(
+    const V2_0::ISoundTriggerHw::PhraseSoundModel& soundModel,
+    const sp<V2_0::ISoundTriggerHwCallback>& callback,
+    V2_0::ISoundTriggerHwCallback::CallbackCookie cookie,
+    ISoundTriggerHw::loadPhraseSoundModel_cb _hidl_cb) {
+    sp<SoundTriggerHw::SoundModelClient> client =
+        new SoundModelClient_2_0(nextUniqueModelId(), cookie, callback);
+    _hidl_cb(doLoadSoundModel((const V2_0::ISoundTriggerHw::SoundModel&)soundModel, client),
+             client->getId());
+    return Void();
+}
+
+Return<int32_t> SoundTriggerHw::unloadSoundModel(int32_t modelHandle) {
+    int32_t ret;
+    sp<SoundTriggerHw::SoundModelClient> client;
+
+    if (mHwDevice == NULL) {
+        ret = -ENODEV;
+        goto exit;
+    }
+
+    {
+        AutoMutex lock(mLock);
+        client = mClients.valueFor(modelHandle);
+        if (client == 0) {
+            ret = -ENOSYS;
+            goto exit;
+        }
+    }
+
+    ret = mHwDevice->unload_sound_model(mHwDevice, client->getHalHandle());
+
+    mClients.removeItem(modelHandle);
+
+exit:
+    return ret;
+}
+
+Return<int32_t> SoundTriggerHw::startRecognition(
+    int32_t modelHandle, const V2_0::ISoundTriggerHw::RecognitionConfig& config,
+    const sp<V2_0::ISoundTriggerHwCallback>& /* callback */, int32_t /* cookie */) {
+    int32_t ret;
+    sp<SoundTriggerHw::SoundModelClient> client;
+    struct sound_trigger_recognition_config* halConfig;
+
+    if (mHwDevice == NULL) {
+        ret = -ENODEV;
+        goto exit;
+    }
+
+    {
+        AutoMutex lock(mLock);
+        client = mClients.valueFor(modelHandle);
+        if (client == 0) {
+            ret = -ENOSYS;
+            goto exit;
+        }
+    }
+
+    halConfig =
+        convertRecognitionConfigToHal((const V2_0::ISoundTriggerHw::RecognitionConfig*)&config);
+
+    if (halConfig == NULL) {
+        ret = -EINVAL;
+        goto exit;
+    }
+    ret = mHwDevice->start_recognition(mHwDevice, client->getHalHandle(), halConfig,
+                                       recognitionCallback_, client.get());
+
+    free(halConfig);
+
+exit:
+    return ret;
+}
+
+Return<int32_t> SoundTriggerHw::stopRecognition(int32_t modelHandle) {
+    int32_t ret;
+    sp<SoundTriggerHw::SoundModelClient> client;
+    if (mHwDevice == NULL) {
+        ret = -ENODEV;
+        goto exit;
+    }
+
+    {
+        AutoMutex lock(mLock);
+        client = mClients.valueFor(modelHandle);
+        if (client == 0) {
+            ret = -ENOSYS;
+            goto exit;
+        }
+    }
+
+    ret = mHwDevice->stop_recognition(mHwDevice, client->getHalHandle());
+
+exit:
+    return ret;
+}
+
+Return<int32_t> SoundTriggerHw::stopAllRecognitions() {
+    int32_t ret;
+    if (mHwDevice == NULL) {
+        ret = -ENODEV;
+        goto exit;
+    }
+
+    if (mHwDevice->common.version >= SOUND_TRIGGER_DEVICE_API_VERSION_1_1 &&
+        mHwDevice->stop_all_recognitions) {
+        ret = mHwDevice->stop_all_recognitions(mHwDevice);
+    } else {
+        ret = -ENOSYS;
+    }
+exit:
+    return ret;
+}
+
+SoundTriggerHw::SoundTriggerHw() : mModuleName("primary"), mHwDevice(NULL), mNextModelId(1) {}
+
+void SoundTriggerHw::onFirstRef() {
+    const hw_module_t* mod;
+    int rc;
+
+    rc = hw_get_module_by_class(SOUND_TRIGGER_HARDWARE_MODULE_ID, mModuleName, &mod);
+    if (rc != 0) {
+        ALOGE("couldn't load sound trigger module %s.%s (%s)", SOUND_TRIGGER_HARDWARE_MODULE_ID,
+              mModuleName, strerror(-rc));
+        return;
+    }
+    rc = sound_trigger_hw_device_open(mod, &mHwDevice);
+    if (rc != 0) {
+        ALOGE("couldn't open sound trigger hw device in %s.%s (%s)",
+              SOUND_TRIGGER_HARDWARE_MODULE_ID, mModuleName, strerror(-rc));
+        mHwDevice = NULL;
+        return;
+    }
+    if (mHwDevice->common.version < SOUND_TRIGGER_DEVICE_API_VERSION_1_0 ||
+        mHwDevice->common.version > SOUND_TRIGGER_DEVICE_API_VERSION_CURRENT) {
+        ALOGE("wrong sound trigger hw device version %04x", mHwDevice->common.version);
+        sound_trigger_hw_device_close(mHwDevice);
+        mHwDevice = NULL;
+        return;
+    }
+
+    ALOGI("onFirstRef() mModuleName %s mHwDevice %p", mModuleName, mHwDevice);
+}
+
+SoundTriggerHw::~SoundTriggerHw() {
+    if (mHwDevice != NULL) {
+        sound_trigger_hw_device_close(mHwDevice);
+    }
+}
+
+uint32_t SoundTriggerHw::nextUniqueModelId() {
+    uint32_t modelId = 0;
+    {
+        AutoMutex lock(mLock);
+        do {
+            modelId =
+                atomic_fetch_add_explicit(&mNextModelId, (uint_fast32_t)1, memory_order_acq_rel);
+        } while (mClients.valueFor(modelId) != 0 && modelId != 0);
+    }
+    LOG_ALWAYS_FATAL_IF(modelId == 0, "wrap around in sound model IDs, num loaded models %zu",
+                        mClients.size());
+    return modelId;
+}
+
+void SoundTriggerHw::convertUuidFromHal(Uuid* uuid, const sound_trigger_uuid_t* halUuid) {
+    uuid->timeLow = halUuid->timeLow;
+    uuid->timeMid = halUuid->timeMid;
+    uuid->versionAndTimeHigh = halUuid->timeHiAndVersion;
+    uuid->variantAndClockSeqHigh = halUuid->clockSeq;
+    memcpy(&uuid->node[0], &halUuid->node[0], 6);
+}
+
+void SoundTriggerHw::convertUuidToHal(sound_trigger_uuid_t* halUuid, const Uuid* uuid) {
+    halUuid->timeLow = uuid->timeLow;
+    halUuid->timeMid = uuid->timeMid;
+    halUuid->timeHiAndVersion = uuid->versionAndTimeHigh;
+    halUuid->clockSeq = uuid->variantAndClockSeqHigh;
+    memcpy(&halUuid->node[0], &uuid->node[0], 6);
+}
+
+void SoundTriggerHw::convertPropertiesFromHal(
+    ISoundTriggerHw::Properties* properties, const struct sound_trigger_properties* halProperties) {
+    properties->implementor = halProperties->implementor;
+    properties->description = halProperties->description;
+    properties->version = halProperties->version;
+    convertUuidFromHal(&properties->uuid, &halProperties->uuid);
+    properties->maxSoundModels = halProperties->max_sound_models;
+    properties->maxKeyPhrases = halProperties->max_key_phrases;
+    properties->maxUsers = halProperties->max_users;
+    properties->recognitionModes = halProperties->recognition_modes;
+    properties->captureTransition = halProperties->capture_transition;
+    properties->maxBufferMs = halProperties->max_buffer_ms;
+    properties->concurrentCapture = halProperties->concurrent_capture;
+    properties->triggerInEvent = halProperties->trigger_in_event;
+    properties->powerConsumptionMw = halProperties->power_consumption_mw;
+}
+
+void SoundTriggerHw::convertTriggerPhraseToHal(struct sound_trigger_phrase* halTriggerPhrase,
+                                               const ISoundTriggerHw::Phrase* triggerPhrase) {
+    halTriggerPhrase->id = triggerPhrase->id;
+    halTriggerPhrase->recognition_mode = triggerPhrase->recognitionModes;
+    unsigned int i;
+
+    halTriggerPhrase->num_users =
+        std::min((int)triggerPhrase->users.size(), SOUND_TRIGGER_MAX_USERS);
+    for (i = 0; i < halTriggerPhrase->num_users; i++) {
+        halTriggerPhrase->users[i] = triggerPhrase->users[i];
+    }
+
+    strlcpy(halTriggerPhrase->locale, triggerPhrase->locale.c_str(), SOUND_TRIGGER_MAX_LOCALE_LEN);
+    strlcpy(halTriggerPhrase->text, triggerPhrase->text.c_str(), SOUND_TRIGGER_MAX_STRING_LEN);
+}
+
+struct sound_trigger_sound_model* SoundTriggerHw::convertSoundModelToHal(
+    const V2_0::ISoundTriggerHw::SoundModel* soundModel) {
+    struct sound_trigger_sound_model* halModel = NULL;
+    if (soundModel->type == V2_0::SoundModelType::KEYPHRASE) {
+        size_t allocSize =
+            sizeof(struct sound_trigger_phrase_sound_model) + soundModel->data.size();
+        struct sound_trigger_phrase_sound_model* halKeyPhraseModel =
+            static_cast<struct sound_trigger_phrase_sound_model*>(malloc(allocSize));
+        LOG_ALWAYS_FATAL_IF(halKeyPhraseModel == NULL,
+                            "malloc failed for size %zu in convertSoundModelToHal PHRASE",
+                            allocSize);
+
+        const ISoundTriggerHw::PhraseSoundModel* keyPhraseModel =
+            reinterpret_cast<const ISoundTriggerHw::PhraseSoundModel*>(soundModel);
+
+        size_t i;
+        for (i = 0; i < keyPhraseModel->phrases.size() && i < SOUND_TRIGGER_MAX_PHRASES; i++) {
+            convertTriggerPhraseToHal(&halKeyPhraseModel->phrases[i], &keyPhraseModel->phrases[i]);
+        }
+        halKeyPhraseModel->num_phrases = (unsigned int)i;
+        halModel = reinterpret_cast<struct sound_trigger_sound_model*>(halKeyPhraseModel);
+        halModel->data_offset = sizeof(struct sound_trigger_phrase_sound_model);
+    } else {
+        size_t allocSize = sizeof(struct sound_trigger_sound_model) + soundModel->data.size();
+        halModel = static_cast<struct sound_trigger_sound_model*>(malloc(allocSize));
+        LOG_ALWAYS_FATAL_IF(halModel == NULL,
+                            "malloc failed for size %zu in convertSoundModelToHal GENERIC",
+                            allocSize);
+
+        halModel->data_offset = sizeof(struct sound_trigger_sound_model);
+    }
+    halModel->type = (sound_trigger_sound_model_type_t)soundModel->type;
+    convertUuidToHal(&halModel->uuid, &soundModel->uuid);
+    convertUuidToHal(&halModel->vendor_uuid, &soundModel->vendorUuid);
+    halModel->data_size = soundModel->data.size();
+    uint8_t* dst = reinterpret_cast<uint8_t*>(halModel) + halModel->data_offset;
+    const uint8_t* src = reinterpret_cast<const uint8_t*>(&soundModel->data[0]);
+    memcpy(dst, src, soundModel->data.size());
+
+    return halModel;
+}
+
+void SoundTriggerHw::convertPhraseRecognitionExtraToHal(
+    struct sound_trigger_phrase_recognition_extra* halExtra,
+    const V2_0::PhraseRecognitionExtra* extra) {
+    halExtra->id = extra->id;
+    halExtra->recognition_modes = extra->recognitionModes;
+    halExtra->confidence_level = extra->confidenceLevel;
+
+    unsigned int i;
+    for (i = 0; i < extra->levels.size() && i < SOUND_TRIGGER_MAX_USERS; i++) {
+        halExtra->levels[i].user_id = extra->levels[i].userId;
+        halExtra->levels[i].level = extra->levels[i].levelPercent;
+    }
+    halExtra->num_levels = i;
+}
+
+struct sound_trigger_recognition_config* SoundTriggerHw::convertRecognitionConfigToHal(
+    const V2_0::ISoundTriggerHw::RecognitionConfig* config) {
+    size_t allocSize = sizeof(struct sound_trigger_recognition_config) + config->data.size();
+    struct sound_trigger_recognition_config* halConfig =
+        static_cast<struct sound_trigger_recognition_config*>(malloc(allocSize));
+
+    LOG_ALWAYS_FATAL_IF(halConfig == NULL,
+                        "malloc failed for size %zu in convertRecognitionConfigToHal", allocSize);
+
+    halConfig->capture_handle = (audio_io_handle_t)config->captureHandle;
+    halConfig->capture_device = (audio_devices_t)config->captureDevice;
+    halConfig->capture_requested = config->captureRequested;
+
+    unsigned int i;
+    for (i = 0; i < config->phrases.size() && i < SOUND_TRIGGER_MAX_PHRASES; i++) {
+        convertPhraseRecognitionExtraToHal(&halConfig->phrases[i], &config->phrases[i]);
+    }
+    halConfig->num_phrases = i;
+
+    halConfig->data_offset = sizeof(struct sound_trigger_recognition_config);
+    halConfig->data_size = config->data.size();
+    uint8_t* dst = reinterpret_cast<uint8_t*>(halConfig) + halConfig->data_offset;
+    const uint8_t* src = reinterpret_cast<const uint8_t*>(&config->data[0]);
+    memcpy(dst, src, config->data.size());
+    return halConfig;
+}
+
+// static
+void SoundTriggerHw::convertSoundModelEventFromHal(
+    V2_0::ISoundTriggerHwCallback::ModelEvent* event,
+    const struct sound_trigger_model_event* halEvent) {
+    event->status = (V2_0::ISoundTriggerHwCallback::SoundModelStatus)halEvent->status;
+    // event->model to be remapped by called
+    event->data.setToExternal(
+        const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(halEvent)) + halEvent->data_offset,
+        halEvent->data_size);
+}
+
+// static
+void SoundTriggerHw::convertPhaseRecognitionEventFromHal(
+    V2_0::ISoundTriggerHwCallback::PhraseRecognitionEvent* event,
+    const struct sound_trigger_phrase_recognition_event* halEvent) {
+    event->phraseExtras.resize(halEvent->num_phrases);
+    for (unsigned int i = 0; i < halEvent->num_phrases; i++) {
+        convertPhraseRecognitionExtraFromHal(&event->phraseExtras[i], &halEvent->phrase_extras[i]);
+    }
+    convertRecognitionEventFromHal(&event->common, &halEvent->common);
+}
+
+// static
+void SoundTriggerHw::convertRecognitionEventFromHal(
+    V2_0::ISoundTriggerHwCallback::RecognitionEvent* event,
+    const struct sound_trigger_recognition_event* halEvent) {
+    event->status = static_cast<V2_0::ISoundTriggerHwCallback::RecognitionStatus>(halEvent->status);
+    event->type = static_cast<V2_0::SoundModelType>(halEvent->type);
+    // event->model to be remapped by called
+    event->captureAvailable = halEvent->capture_available;
+    event->captureSession = halEvent->capture_session;
+    event->captureDelayMs = halEvent->capture_delay_ms;
+    event->capturePreambleMs = halEvent->capture_preamble_ms;
+    event->triggerInData = halEvent->trigger_in_data;
+    event->audioConfig.sampleRateHz = halEvent->audio_config.sample_rate;
+    event->audioConfig.channelMask =
+        (audio::common::V2_0::AudioChannelMask)halEvent->audio_config.channel_mask;
+    event->audioConfig.format = (audio::common::V2_0::AudioFormat)halEvent->audio_config.format;
+    event->data.setToExternal(
+        const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(halEvent)) + halEvent->data_offset,
+        halEvent->data_size);
+}
+
+// static
+void SoundTriggerHw::convertPhraseRecognitionExtraFromHal(
+    V2_0::PhraseRecognitionExtra* extra,
+    const struct sound_trigger_phrase_recognition_extra* halExtra) {
+    extra->id = halExtra->id;
+    extra->recognitionModes = halExtra->recognition_modes;
+    extra->confidenceLevel = halExtra->confidence_level;
+
+    extra->levels.resize(halExtra->num_levels);
+    for (unsigned int i = 0; i < halExtra->num_levels; i++) {
+        extra->levels[i].userId = halExtra->levels[i].user_id;
+        extra->levels[i].levelPercent = halExtra->levels[i].level;
+    }
+}
+
+void SoundTriggerHw::SoundModelClient_2_0::recognitionCallback(
+    struct sound_trigger_recognition_event* halEvent) {
+    if (halEvent->type == SOUND_MODEL_TYPE_KEYPHRASE) {
+        V2_0::ISoundTriggerHwCallback::PhraseRecognitionEvent event;
+        convertPhaseRecognitionEventFromHal(
+            &event, reinterpret_cast<sound_trigger_phrase_recognition_event*>(halEvent));
+        event.common.model = mId;
+        mCallback->phraseRecognitionCallback(event, mCookie);
+    } else {
+        V2_0::ISoundTriggerHwCallback::RecognitionEvent event;
+        convertRecognitionEventFromHal(&event, halEvent);
+        event.model = mId;
+        mCallback->recognitionCallback(event, mCookie);
+    }
+}
+
+void SoundTriggerHw::SoundModelClient_2_0::soundModelCallback(
+    struct sound_trigger_model_event* halEvent) {
+    V2_0::ISoundTriggerHwCallback::ModelEvent event;
+    convertSoundModelEventFromHal(&event, halEvent);
+    event.model = mId;
+    mCallback->soundModelCallback(event, mCookie);
+}
+
+// Begin V2_1 implementation, copied from
+// hardware/interfaces/soundtrigger/2.1/default/SoundTriggerHw.cpp
+
+namespace {
+
+// Backs up by the vector with the contents of shared memory.
+// It is assumed that the passed hidl_vector is empty, so it's
+// not cleared if the memory is a null object.
+// The caller needs to keep the returned sp<IMemory> as long as
+// the data is needed.
+std::pair<bool, sp<IMemory>> memoryAsVector(const hidl_memory& m, hidl_vec<uint8_t>* vec) {
+    sp<IMemory> memory;
+    if (m.size() == 0) {
+        return std::make_pair(true, memory);
+    }
+    memory = mapMemory(m);
+    if (memory != nullptr) {
+        memory->read();
+        vec->setToExternal(static_cast<uint8_t*>(static_cast<void*>(memory->getPointer())),
+                           memory->getSize());
+        return std::make_pair(true, memory);
+    }
+    ALOGE("%s: Could not map HIDL memory to IMemory", __func__);
+    return std::make_pair(false, memory);
+}
+
+// Moves the data from the vector into allocated shared memory,
+// emptying the vector.
+// It is assumed that the passed hidl_memory is a null object, so it's
+// not reset if the vector is empty.
+// The caller needs to keep the returned sp<IMemory> as long as
+// the data is needed.
+std::pair<bool, sp<IMemory>> moveVectorToMemory(hidl_vec<uint8_t>* v, hidl_memory* mem) {
+    sp<IMemory> memory;
+    if (v->size() == 0) {
+        return std::make_pair(true, memory);
+    }
+    sp<IAllocator> ashmem = IAllocator::getService("ashmem");
+    if (ashmem == 0) {
+        ALOGE("Failed to retrieve ashmem allocator service");
+        return std::make_pair(false, memory);
+    }
+    bool success = false;
+    Return<void> r = ashmem->allocate(v->size(), [&](bool s, const hidl_memory& m) {
+        success = s;
+        if (success) *mem = m;
+    });
+    if (r.isOk() && success) {
+        memory = hardware::mapMemory(*mem);
+        if (memory != 0) {
+            memory->update();
+            memcpy(memory->getPointer(), v->data(), v->size());
+            memory->commit();
+            v->resize(0);
+            return std::make_pair(true, memory);
+        } else {
+            ALOGE("Failed to map allocated ashmem");
+        }
+    } else {
+        ALOGE("Failed to allocate %llu bytes from ashmem", (unsigned long long)v->size());
+    }
+    return std::make_pair(false, memory);
+}
+
+}  // namespace
+
+Return<void> SoundTriggerHw::loadSoundModel_2_1(
+    const V2_1::ISoundTriggerHw::SoundModel& soundModel,
+    const sp<V2_1::ISoundTriggerHwCallback>& callback, int32_t cookie,
+    V2_1::ISoundTriggerHw::loadSoundModel_2_1_cb _hidl_cb) {
+    // It is assumed that legacy data vector is empty, thus making copy is cheap.
+    V2_0::ISoundTriggerHw::SoundModel soundModel_2_0(soundModel.header);
+    auto result = memoryAsVector(soundModel.data, &soundModel_2_0.data);
+    if (result.first) {
+        sp<SoundModelClient> client =
+            new SoundModelClient_2_1(nextUniqueModelId(), cookie, callback);
+        _hidl_cb(doLoadSoundModel(soundModel_2_0, client), client->getId());
+        return Void();
+    }
+    _hidl_cb(-ENOMEM, 0);
+    return Void();
+}
+
+Return<void> SoundTriggerHw::loadPhraseSoundModel_2_1(
+    const V2_1::ISoundTriggerHw::PhraseSoundModel& soundModel,
+    const sp<V2_1::ISoundTriggerHwCallback>& callback, int32_t cookie,
+    V2_1::ISoundTriggerHw::loadPhraseSoundModel_2_1_cb _hidl_cb) {
+    V2_0::ISoundTriggerHw::PhraseSoundModel soundModel_2_0;
+    // It is assumed that legacy data vector is empty, thus making copy is cheap.
+    soundModel_2_0.common = soundModel.common.header;
+    // Avoid copying phrases data.
+    soundModel_2_0.phrases.setToExternal(
+        const_cast<V2_0::ISoundTriggerHw::Phrase*>(soundModel.phrases.data()),
+        soundModel.phrases.size());
+    auto result = memoryAsVector(soundModel.common.data, &soundModel_2_0.common.data);
+    if (result.first) {
+        sp<SoundModelClient> client =
+            new SoundModelClient_2_1(nextUniqueModelId(), cookie, callback);
+        _hidl_cb(doLoadSoundModel((const V2_0::ISoundTriggerHw::SoundModel&)soundModel_2_0, client),
+                 client->getId());
+        return Void();
+    }
+    _hidl_cb(-ENOMEM, 0);
+    return Void();
+}
+
+Return<int32_t> SoundTriggerHw::startRecognition_2_1(
+    int32_t modelHandle, const V2_1::ISoundTriggerHw::RecognitionConfig& config,
+    const sp<V2_1::ISoundTriggerHwCallback>& callback, int32_t cookie) {
+    // It is assumed that legacy data vector is empty, thus making copy is cheap.
+    V2_0::ISoundTriggerHw::RecognitionConfig config_2_0(config.header);
+    auto result = memoryAsVector(config.data, &config_2_0.data);
+    return result.first ? startRecognition(modelHandle, config_2_0, callback, cookie)
+                        : Return<int32_t>(-ENOMEM);
+}
+
+void SoundTriggerHw::SoundModelClient_2_1::recognitionCallback(
+    struct sound_trigger_recognition_event* halEvent) {
+    if (halEvent->type == SOUND_MODEL_TYPE_KEYPHRASE) {
+        V2_0::ISoundTriggerHwCallback::PhraseRecognitionEvent event_2_0;
+        convertPhaseRecognitionEventFromHal(
+            &event_2_0, reinterpret_cast<sound_trigger_phrase_recognition_event*>(halEvent));
+        event_2_0.common.model = mId;
+        V2_1::ISoundTriggerHwCallback::PhraseRecognitionEvent event;
+        event.phraseExtras.setToExternal(event_2_0.phraseExtras.data(),
+                                         event_2_0.phraseExtras.size());
+        auto result = moveVectorToMemory(&event_2_0.common.data, &event.common.data);
+        if (result.first) {
+            // The data vector is now empty, thus copying is cheap.
+            event.common.header = event_2_0.common;
+            mCallback->phraseRecognitionCallback_2_1(event, mCookie);
+        }
+    } else {
+        V2_1::ISoundTriggerHwCallback::RecognitionEvent event;
+        convertRecognitionEventFromHal(&event.header, halEvent);
+        event.header.model = mId;
+        auto result = moveVectorToMemory(&event.header.data, &event.data);
+        if (result.first) {
+            mCallback->recognitionCallback_2_1(event, mCookie);
+        }
+    }
+}
+
+void SoundTriggerHw::SoundModelClient_2_1::soundModelCallback(
+    struct sound_trigger_model_event* halEvent) {
+    V2_1::ISoundTriggerHwCallback::ModelEvent event;
+    convertSoundModelEventFromHal(&event.header, halEvent);
+    event.header.model = mId;
+    auto result = moveVectorToMemory(&event.header.data, &event.data);
+    if (result.first) {
+        mCallback->soundModelCallback_2_1(event, mCookie);
+    }
+}
+
+// Begin V2_2 implementation
+
+Return<int32_t> SoundTriggerHw::getModelState(int32_t modelHandle) {
+    sp<SoundModelClient> client;
+    if (mHwDevice == NULL) {
+        return -ENODEV;
+    }
+
+    {
+        AutoMutex lock(mLock);
+        client = mClients.valueFor(modelHandle);
+        if (client == 0) {
+            return -ENOSYS;
+        }
+    }
+
+    if (mHwDevice->get_model_state == NULL) {
+        ALOGE("Failed to get model state from device, no such method");
+        return -ENODEV;
+    }
+
+    return mHwDevice->get_model_state(mHwDevice, client->getHalHandle());
+}
+
+// Methods from ::android::hidl::base::V1_0::IBase follow.
+
+ISoundTriggerHw* HIDL_FETCH_ISoundTriggerHw(const char* /* name */) {
+    return new SoundTriggerHw();
+}
+
+}  // namespace implementation
+}  // namespace V2_2
+}  // namespace soundtrigger
+}  // namespace hardware
+}  // namespace android
diff --git a/soundtrigger/2.2/default/SoundTriggerHw.h b/soundtrigger/2.2/default/SoundTriggerHw.h
new file mode 100644
index 0000000..6676318
--- /dev/null
+++ b/soundtrigger/2.2/default/SoundTriggerHw.h
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_SOUNDTRIGGER_V2_2_SOUNDTRIGGERHW_H
+#define ANDROID_HARDWARE_SOUNDTRIGGER_V2_2_SOUNDTRIGGERHW_H
+
+#include <android/hardware/soundtrigger/2.0/ISoundTriggerHw.h>
+#include <android/hardware/soundtrigger/2.0/ISoundTriggerHwCallback.h>
+#include <android/hardware/soundtrigger/2.2/ISoundTriggerHw.h>
+#include <hardware/sound_trigger.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+#include <stdatomic.h>
+#include <system/sound_trigger.h>
+#include <utils/KeyedVector.h>
+#include <utils/threads.h>
+
+namespace android {
+namespace hardware {
+namespace soundtrigger {
+namespace V2_2 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::audio::common::V2_0::Uuid;
+using ::android::hardware::soundtrigger::V2_0::ISoundTriggerHwCallback;
+
+/**
+ * According to the HIDL C++ Users Guide: client and server implementations
+ * should never directly refer to anything other than the interface header
+ * generated from the HIDL definition file (ie. ISoundTriggerHw.hal), so
+ * this V2_2 implementation copies the V2_0 and V2_1 implementations and
+ * then adds the new V2_2 implementation.
+ */
+struct SoundTriggerHw : public ISoundTriggerHw {
+    // Methods from V2_0::ISoundTriggerHw follow.
+    Return<void> getProperties(getProperties_cb _hidl_cb) override;
+    Return<void> loadSoundModel(const V2_0::ISoundTriggerHw::SoundModel& soundModel,
+                                const sp<V2_0::ISoundTriggerHwCallback>& callback, int32_t cookie,
+                                loadSoundModel_cb _hidl_cb) override;
+    Return<void> loadPhraseSoundModel(const V2_0::ISoundTriggerHw::PhraseSoundModel& soundModel,
+                                      const sp<V2_0::ISoundTriggerHwCallback>& callback,
+                                      int32_t cookie, loadPhraseSoundModel_cb _hidl_cb) override;
+    Return<int32_t> unloadSoundModel(int32_t modelHandle) override;
+    Return<int32_t> startRecognition(int32_t modelHandle,
+                                     const V2_0::ISoundTriggerHw::RecognitionConfig& config,
+                                     const sp<V2_0::ISoundTriggerHwCallback>& callback,
+                                     int32_t cookie) override;
+    Return<int32_t> stopRecognition(int32_t modelHandle) override;
+    Return<int32_t> stopAllRecognitions() override;
+
+    // Methods from V2_1::ISoundTriggerHw follow.
+    Return<void> loadSoundModel_2_1(const V2_1::ISoundTriggerHw::SoundModel& soundModel,
+                                    const sp<V2_1::ISoundTriggerHwCallback>& callback,
+                                    int32_t cookie, loadSoundModel_2_1_cb _hidl_cb) override;
+    Return<void> loadPhraseSoundModel_2_1(const V2_1::ISoundTriggerHw::PhraseSoundModel& soundModel,
+                                          const sp<V2_1::ISoundTriggerHwCallback>& callback,
+                                          int32_t cookie,
+                                          loadPhraseSoundModel_2_1_cb _hidl_cb) override;
+    Return<int32_t> startRecognition_2_1(int32_t modelHandle,
+                                         const V2_1::ISoundTriggerHw::RecognitionConfig& config,
+                                         const sp<V2_1::ISoundTriggerHwCallback>& callback,
+                                         int32_t cookie) override;
+
+    // Methods from V2_2::ISoundTriggerHw follow.
+    Return<int32_t> getModelState(int32_t modelHandle) override;
+
+    SoundTriggerHw();
+
+    // Copied from hardware/interfaces/soundtrigger/2.0/default/SoundTriggerHalImpl.h
+    class SoundModelClient : public RefBase {
+       public:
+        SoundModelClient(uint32_t id, V2_0::ISoundTriggerHwCallback::CallbackCookie cookie)
+            : mId(id), mCookie(cookie) {}
+        virtual ~SoundModelClient() {}
+
+        uint32_t getId() const { return mId; }
+        sound_model_handle_t getHalHandle() const { return mHalHandle; }
+        void setHalHandle(sound_model_handle_t handle) { mHalHandle = handle; }
+
+        virtual void recognitionCallback(struct sound_trigger_recognition_event* halEvent) = 0;
+        virtual void soundModelCallback(struct sound_trigger_model_event* halEvent) = 0;
+
+       protected:
+        const uint32_t mId;
+        sound_model_handle_t mHalHandle;
+        V2_0::ISoundTriggerHwCallback::CallbackCookie mCookie;
+    };
+
+   protected:
+    static void convertPhaseRecognitionEventFromHal(
+        V2_0::ISoundTriggerHwCallback::PhraseRecognitionEvent* event,
+        const struct sound_trigger_phrase_recognition_event* halEvent);
+    static void convertRecognitionEventFromHal(
+        V2_0::ISoundTriggerHwCallback::RecognitionEvent* event,
+        const struct sound_trigger_recognition_event* halEvent);
+    static void convertSoundModelEventFromHal(V2_0::ISoundTriggerHwCallback::ModelEvent* event,
+                                              const struct sound_trigger_model_event* halEvent);
+
+    virtual ~SoundTriggerHw();
+
+    uint32_t nextUniqueModelId();
+    int doLoadSoundModel(const V2_0::ISoundTriggerHw::SoundModel& soundModel,
+                         sp<SoundModelClient> client);
+
+    // RefBase
+    void onFirstRef() override;
+
+   private:
+    class SoundModelClient_2_0 : public SoundModelClient {
+       public:
+        SoundModelClient_2_0(uint32_t id, V2_0::ISoundTriggerHwCallback::CallbackCookie cookie,
+                             sp<V2_0::ISoundTriggerHwCallback> callback)
+            : SoundModelClient(id, cookie), mCallback(callback) {}
+
+        void recognitionCallback(struct sound_trigger_recognition_event* halEvent) override;
+        void soundModelCallback(struct sound_trigger_model_event* halEvent) override;
+
+       private:
+        sp<V2_0::ISoundTriggerHwCallback> mCallback;
+    };
+
+    void convertUuidFromHal(Uuid* uuid, const sound_trigger_uuid_t* halUuid);
+    void convertUuidToHal(sound_trigger_uuid_t* halUuid, const Uuid* uuid);
+    void convertPropertiesFromHal(V2_0::ISoundTriggerHw::Properties* properties,
+                                  const struct sound_trigger_properties* halProperties);
+    void convertTriggerPhraseToHal(struct sound_trigger_phrase* halTriggerPhrase,
+                                   const V2_0::ISoundTriggerHw::Phrase* triggerPhrase);
+    // returned HAL sound model must be freed by caller
+    struct sound_trigger_sound_model* convertSoundModelToHal(
+        const V2_0::ISoundTriggerHw::SoundModel* soundModel);
+    void convertPhraseRecognitionExtraToHal(struct sound_trigger_phrase_recognition_extra* halExtra,
+                                            const V2_0::PhraseRecognitionExtra* extra);
+    // returned recognition config must be freed by caller
+    struct sound_trigger_recognition_config* convertRecognitionConfigToHal(
+        const V2_0::ISoundTriggerHw::RecognitionConfig* config);
+
+    static void convertPhraseRecognitionExtraFromHal(
+        V2_0::PhraseRecognitionExtra* extra,
+        const struct sound_trigger_phrase_recognition_extra* halExtra);
+
+    static void soundModelCallback(struct sound_trigger_model_event* halEvent, void* cookie);
+    static void recognitionCallback(struct sound_trigger_recognition_event* halEvent, void* cookie);
+
+    const char* mModuleName;
+    struct sound_trigger_hw_device* mHwDevice;
+    volatile atomic_uint_fast32_t mNextModelId;
+    DefaultKeyedVector<int32_t, sp<SoundModelClient> > mClients;
+    Mutex mLock;
+
+    // Copied from hardware/interfaces/soundtrigger/2.1/default/SoundTriggerHw.h
+    class SoundModelClient_2_1 : public SoundModelClient {
+       public:
+        SoundModelClient_2_1(uint32_t id, V2_1::ISoundTriggerHwCallback::CallbackCookie cookie,
+                             sp<V2_1::ISoundTriggerHwCallback> callback)
+            : SoundModelClient(id, cookie), mCallback(callback) {}
+
+        void recognitionCallback(struct sound_trigger_recognition_event* halEvent) override;
+        void soundModelCallback(struct sound_trigger_model_event* halEvent) override;
+
+       private:
+        sp<V2_1::ISoundTriggerHwCallback> mCallback;
+    };
+};
+
+extern "C" ISoundTriggerHw* HIDL_FETCH_ISoundTriggerHw(const char* name);
+
+}  // namespace implementation
+}  // namespace V2_2
+}  // namespace soundtrigger
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_SOUNDTRIGGER_V2_2_SOUNDTRIGGERHW_H
diff --git a/soundtrigger/2.2/vts/functional/VtsHalSoundtriggerV2_2TargetTest.cpp b/soundtrigger/2.2/vts/functional/VtsHalSoundtriggerV2_2TargetTest.cpp
new file mode 100644
index 0000000..0f37816
--- /dev/null
+++ b/soundtrigger/2.2/vts/functional/VtsHalSoundtriggerV2_2TargetTest.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "SoundTriggerHidlHalTest"
+#include <stdlib.h>
+#include <time.h>
+
+#include <condition_variable>
+#include <mutex>
+
+#include <android/log.h>
+#include <cutils/native_handle.h>
+#include <log/log.h>
+
+#include <android/hardware/audio/common/2.0/types.h>
+#include <android/hardware/soundtrigger/2.0/ISoundTriggerHw.h>
+#include <android/hardware/soundtrigger/2.2/ISoundTriggerHw.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+using ::android::sp;
+using ::android::hardware::Return;
+using ::android::hardware::soundtrigger::V2_0::ISoundTriggerHwCallback;
+using ::android::hardware::soundtrigger::V2_0::SoundModelHandle;
+using ::android::hardware::soundtrigger::V2_2::ISoundTriggerHw;
+
+// Test environment for SoundTrigger HIDL HAL.
+class SoundTriggerHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static SoundTriggerHidlEnvironment* Instance() {
+        static SoundTriggerHidlEnvironment* instance = new SoundTriggerHidlEnvironment;
+        return instance;
+    }
+
+    void registerTestServices() override { registerTestService<ISoundTriggerHw>(); }
+
+   private:
+    SoundTriggerHidlEnvironment() {}
+};
+
+// The main test class for Sound Trigger HIDL HAL.
+class SoundTriggerHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    void SetUp() override {
+        mSoundTriggerHal = ::testing::VtsHalHidlTargetTestBase::getService<ISoundTriggerHw>(
+            SoundTriggerHidlEnvironment::Instance()->getServiceName<ISoundTriggerHw>());
+        ASSERT_NE(nullptr, mSoundTriggerHal.get());
+    }
+
+    static void SetUpTestCase() { srand(1234); }
+
+    void TearDown() override {}
+
+   protected:
+    sp<ISoundTriggerHw> mSoundTriggerHal;
+};
+
+/**
+ * Test ISoundTriggerHw::getModelState() method
+ *
+ * Verifies that:
+ *  - the implementation returns -ENOSYS with invalid model handle
+ *
+ */
+TEST_F(SoundTriggerHidlTest, GetModelStateInvalidModel) {
+    SoundModelHandle handle = 0;
+    Return<int32_t> hidlReturn = mSoundTriggerHal->getModelState(handle);
+    EXPECT_TRUE(hidlReturn.isOk());
+    EXPECT_EQ(-ENOSYS, hidlReturn);
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(SoundTriggerHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    SoundTriggerHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
+}
diff --git a/thermal/2.0/Android.bp b/thermal/2.0/Android.bp
new file mode 100644
index 0000000..6eb4da0
--- /dev/null
+++ b/thermal/2.0/Android.bp
@@ -0,0 +1,29 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.thermal@2.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IThermal.hal",
+        "IThermalChangedCallback.hal",
+    ],
+    interfaces: [
+        "android.hardware.thermal@1.0",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "CoolingDevice",
+        "CoolingType",
+        "Temperature",
+        "TemperatureThreshold",
+        "TemperatureType",
+        "ThrottlingSeverity",
+        "ThrottlingSeverityCount",
+    ],
+    gen_java: true,
+}
+
diff --git a/thermal/2.0/IThermal.hal b/thermal/2.0/IThermal.hal
new file mode 100644
index 0000000..f890694
--- /dev/null
+++ b/thermal/2.0/IThermal.hal
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.thermal@2.0;
+
+import android.hardware.thermal@1.0::IThermal;
+import android.hardware.thermal@1.0::ThermalStatus;
+import IThermalChangedCallback;
+
+interface IThermal extends @1.0::IThermal {
+
+    /**
+     * Retrieves temperatures in Celsius.
+     *
+     * @param filterType whether to filter the result for a given type.
+     * @param type the TemperatureType such as battery or skin.
+     *
+     * @return status Status of the operation. If status code is FAILURE,
+     *    the status.debugMessage must be populated with a human-readable
+     *    error message.
+     *
+     * @return temperatures If status code is SUCCESS, it's filled with the
+     *    current temperatures. The order of temperatures of built-in
+     *    devices (such as CPUs, GPUs and etc.) in the list must be kept
+     *    the same regardless of the number of calls to this method even if
+     *    they go offline, if these devices exist on boot. The method
+     *    always returns and never removes such temperatures.
+     */
+    getCurrentTemperatures(bool filterType, TemperatureType type)
+        generates (ThermalStatus status, vec<Temperature> temperatures);
+
+    /**
+     * Retrieves static temperature thresholds in Celsius.
+     *
+     * @param filterType whether to filter the result for a given type.
+     * @param type the TemperatureType such as battery or skin.
+     *
+     * @return status Status of the operation. If status code is FAILURE,
+     *    the status.debugMessage must be populated with a human-readable error message.
+     * @return temperatureThresholds If status code is SUCCESS, it's filled with the
+     *    temperatures thresholds. The order of temperatures of built-in
+     *    devices (such as CPUs, GPUs and etc.) in the list must be kept
+     *    the same regardless of the number of calls to this method even if
+     *    they go offline, if these devices exist on boot. The method
+     *    always returns and never removes such temperatures. The thresholds
+     *    are returned as static values and must not change across calls. The actual
+     *    throttling state is determined in driver and HAL and must not be simply
+     *    compared with these thresholds. To get accurate throttling status, use
+     *    getCurrentTemperatures or registerThermalChangedCallback and listen.
+     */
+    getTemperatureThresholds(bool filterType, TemperatureType type)
+        generates (ThermalStatus status, vec<TemperatureThreshold> temperatureThresholds);
+
+   /**
+    * Register an IThermalChangedCallback, used by the Thermal HAL
+    * to send thermal events when thermal mitigation status changed.
+    * Multiple registrations with different IThermalChangedCallback must be allowed.
+    * Multiple registrations with same IThermalChangedCallback is not allowed, client
+    * should unregister the given IThermalChangedCallback first.
+    *
+    * @param callback the IThermalChangedCallback to use for sending
+    *    thermal events (cannot be nullptr).
+    * @param filterType if filter for given sensor type.
+    * @param type the type to be filtered.
+    *
+    * @return status Status of the operation. If status code is FAILURE,
+    *    the status.debugMessage must be populated with a human-readable error message.
+    */
+   registerThermalChangedCallback(IThermalChangedCallback callback,
+                                  bool filterType,
+                                  TemperatureType type)
+       generates (ThermalStatus status);
+
+   /**
+    * Register an IThermalChangedCallback, used by the Thermal HAL
+    * to send thermal events when thermal mitigation status changed.
+    *
+    * @param callback the IThermalChangedCallback to use for sending
+    *    thermal events, or nullptr to set no callback.
+    *
+    * @return status Status of the operation. If status code is FAILURE,
+    *    the status.debugMessage must be populated with a human-readable error message.
+    */
+   unregisterThermalChangedCallback(IThermalChangedCallback callback)
+       generates (ThermalStatus status);
+
+    /**
+     * Retrieves the cooling devices information.
+     *
+     * @param filterType whether to filter the result for a given type.
+     * @param type the CoolingDevice such as CPU/GPU.
+     *
+     * @return status Status of the operation. If status code is FAILURE,
+     *    the status.debugMessage must be populated with the human-readable
+     *    error message.
+     * @return devices If status code is SUCCESS, it's filled with the current
+     *    cooling device information. The order of built-in cooling
+     *    devices in the list must be kept the same regardless of the number
+     *    of calls to this method even if they go offline, if these devices
+     *    exist on boot. The method always returns and never removes from
+     *    the list such cooling devices.
+     */
+   getCurrentCoolingDevices(bool filterType, CoolingType type)
+       generates (ThermalStatus status, vec<CoolingDevice> devices);
+};
diff --git a/thermal/2.0/IThermalChangedCallback.hal b/thermal/2.0/IThermalChangedCallback.hal
new file mode 100644
index 0000000..b06bfbf
--- /dev/null
+++ b/thermal/2.0/IThermalChangedCallback.hal
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.thermal@2.0;
+
+import android.hardware.thermal@2.0::Temperature;
+
+/**
+ * IThermalChangedCallback send throttling notification to clients.
+ */
+interface IThermalChangedCallback {
+    /**
+     * Send a thermal throttling event to all ThermalHAL
+     * thermal event listeners.
+     *
+     * @param temperature The temperature associated with the
+     *    throttling event.
+     */
+    oneway notifyThrottling (Temperature temperature);
+};
diff --git a/thermal/2.0/default/Android.bp b/thermal/2.0/default/Android.bp
new file mode 100644
index 0000000..f620e6e
--- /dev/null
+++ b/thermal/2.0/default/Android.bp
@@ -0,0 +1,35 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_binary {
+    name: "android.hardware.thermal@2.0-service",
+    defaults: ["hidl_defaults"],
+    relative_install_path: "hw",
+    vendor: true,
+    init_rc: ["android.hardware.thermal@2.0-service.rc"],
+    vintf_fragments: ["android.hardware.thermal@2.0-service.xml"],
+    srcs: [
+        "Thermal.cpp",
+        "service.cpp"
+    ],
+    shared_libs: [
+        "libbase",
+        "libhidlbase",
+        "libhidltransport",
+        "libutils",
+        "android.hardware.thermal@2.0",
+        "android.hardware.thermal@1.0",
+    ],
+}
diff --git a/thermal/2.0/default/Thermal.cpp b/thermal/2.0/default/Thermal.cpp
new file mode 100644
index 0000000..442af61
--- /dev/null
+++ b/thermal/2.0/default/Thermal.cpp
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.thermal@2.0-service-mock"
+
+#include <cmath>
+#include <set>
+
+#include <android-base/logging.h>
+#include <hidl/HidlTransportSupport.h>
+
+#include "Thermal.h"
+
+namespace android {
+namespace hardware {
+namespace thermal {
+namespace V2_0 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::interfacesEqual;
+using ::android::hardware::thermal::V1_0::ThermalStatus;
+using ::android::hardware::thermal::V1_0::ThermalStatusCode;
+
+std::set<sp<IThermalChangedCallback>> gCallbacks;
+
+static const Temperature_1_0 kTemp_1_0 = {
+    .type = static_cast<::android::hardware::thermal::V1_0::TemperatureType>(TemperatureType::CPU),
+    .name = "test temperature sensor",
+    .currentValue = 98.6,
+    .throttlingThreshold = 58,
+    .shutdownThreshold = 60.0,
+    .vrThrottlingThreshold = 59.0,
+};
+
+static const Temperature_2_0 kTemp_2_0 = {
+    .type = TemperatureType::SKIN,
+    .name = "test temperature sensor",
+    .value = 98.6,
+    .throttlingStatus = ThrottlingSeverity::CRITICAL,
+};
+
+static const TemperatureThreshold kTempThreshold = {
+    .type = TemperatureType::SKIN,
+    .name = "test temperature sensor",
+    .hotThrottlingThresholds = {{NAN, NAN, NAN, NAN, NAN, NAN, NAN}},
+    .coldThrottlingThresholds = {{NAN, NAN, NAN, NAN, NAN, NAN, NAN}},
+    .vrThrottlingThreshold = NAN,
+};
+
+static const CoolingDevice_1_0 kCooling_1_0 = {
+    .type = ::android::hardware::thermal::V1_0::CoolingType::FAN_RPM,
+    .name = "test cooling device",
+    .currentValue = 100.0,
+};
+
+static const CoolingDevice_2_0 kCooling_2_0 = {
+    .type = CoolingType::CPU,
+    .name = "test cooling device",
+    .value = 1,
+};
+
+static const CpuUsage kCpuUsage = {
+    .name = "cpu_name",
+    .active = 0,
+    .total = 0,
+    .isOnline = true,
+};
+
+// Methods from ::android::hardware::thermal::V1_0::IThermal follow.
+Return<void> Thermal::getTemperatures(getTemperatures_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    std::vector<Temperature_1_0> temperatures = {kTemp_1_0};
+    _hidl_cb(status, temperatures);
+    return Void();
+}
+
+Return<void> Thermal::getCpuUsages(getCpuUsages_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    std::vector<CpuUsage> cpu_usages = {kCpuUsage};
+    _hidl_cb(status, cpu_usages);
+    return Void();
+}
+
+Return<void> Thermal::getCoolingDevices(getCoolingDevices_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    std::vector<CoolingDevice_1_0> cooling_devices = {kCooling_1_0};
+    _hidl_cb(status, cooling_devices);
+    return Void();
+}
+
+// Methods from ::android::hardware::thermal::V2_0::IThermal follow.
+Return<void> Thermal::getCurrentTemperatures(bool filterType, TemperatureType type,
+                                             getCurrentTemperatures_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    std::vector<Temperature_2_0> temperatures;
+    if (filterType && type != kTemp_2_0.type) {
+        status.code = ThermalStatusCode::FAILURE;
+        status.debugMessage = "Failed to read data";
+    } else {
+        temperatures = {kTemp_2_0};
+    }
+    _hidl_cb(status, temperatures);
+    return Void();
+}
+
+Return<void> Thermal::getTemperatureThresholds(bool filterType, TemperatureType type,
+                                               getTemperatureThresholds_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    std::vector<TemperatureThreshold> temperature_thresholds;
+    if (filterType && type != kTempThreshold.type) {
+        status.code = ThermalStatusCode::FAILURE;
+        status.debugMessage = "Failed to read data";
+    } else {
+        temperature_thresholds = {kTempThreshold};
+    }
+    _hidl_cb(status, temperature_thresholds);
+    return Void();
+}
+
+Return<void> Thermal::getCurrentCoolingDevices(bool filterType, CoolingType type,
+                                               getCurrentCoolingDevices_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    std::vector<CoolingDevice_2_0> cooling_devices;
+    if (filterType && type != kCooling_2_0.type) {
+        status.code = ThermalStatusCode::FAILURE;
+        status.debugMessage = "Failed to read data";
+    } else {
+        cooling_devices = {kCooling_2_0};
+    }
+    _hidl_cb(status, cooling_devices);
+    return Void();
+}
+
+Return<void> Thermal::registerThermalChangedCallback(const sp<IThermalChangedCallback>& callback,
+                                                     bool filterType, TemperatureType type,
+                                                     registerThermalChangedCallback_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    std::lock_guard<std::mutex> _lock(thermal_callback_mutex_);
+    if (std::any_of(callbacks_.begin(), callbacks_.end(), [&](const CallbackSetting& c) {
+            return interfacesEqual(c.callback, callback);
+        })) {
+        status.code = ThermalStatusCode::FAILURE;
+        status.debugMessage = "Same callback interface registered already";
+        LOG(ERROR) << status.debugMessage;
+    } else {
+        callbacks_.emplace_back(callback, filterType, type);
+        LOG(INFO) << "A callback has been registered to ThermalHAL, isFilter: " << filterType
+                  << " Type: " << android::hardware::thermal::V2_0::toString(type);
+    }
+    _hidl_cb(status);
+    return Void();
+}
+
+Return<void> Thermal::unregisterThermalChangedCallback(
+    const sp<IThermalChangedCallback>& callback, unregisterThermalChangedCallback_cb _hidl_cb) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::SUCCESS;
+    bool removed = false;
+    std::lock_guard<std::mutex> _lock(thermal_callback_mutex_);
+    callbacks_.erase(
+        std::remove_if(callbacks_.begin(), callbacks_.end(),
+                       [&](const CallbackSetting& c) {
+                           if (interfacesEqual(c.callback, callback)) {
+                               LOG(INFO)
+                                   << "A callback has been unregistered from ThermalHAL, isFilter: "
+                                   << c.is_filter_type << " Type: "
+                                   << android::hardware::thermal::V2_0::toString(c.type);
+                               removed = true;
+                               return true;
+                           }
+                           return false;
+                       }),
+        callbacks_.end());
+    if (!removed) {
+        status.code = ThermalStatusCode::FAILURE;
+        status.debugMessage = "The callback was not registered before";
+        LOG(ERROR) << status.debugMessage;
+    }
+    _hidl_cb(status);
+    return Void();
+}
+
+}  // namespace implementation
+}  // namespace V2_0
+}  // namespace thermal
+}  // namespace hardware
+}  // namespace android
diff --git a/thermal/2.0/default/Thermal.h b/thermal/2.0/default/Thermal.h
new file mode 100644
index 0000000..5fa1abd
--- /dev/null
+++ b/thermal/2.0/default/Thermal.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_THERMAL_V2_0_THERMAL_H
+#define ANDROID_HARDWARE_THERMAL_V2_0_THERMAL_H
+
+#include <android/hardware/thermal/2.0/IThermal.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace thermal {
+namespace V2_0 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::thermal::V1_0::CpuUsage;
+using ::android::hardware::thermal::V2_0::CoolingType;
+using ::android::hardware::thermal::V2_0::IThermal;
+using CoolingDevice_1_0 = ::android::hardware::thermal::V1_0::CoolingDevice;
+using CoolingDevice_2_0 = ::android::hardware::thermal::V2_0::CoolingDevice;
+using Temperature_1_0 = ::android::hardware::thermal::V1_0::Temperature;
+using Temperature_2_0 = ::android::hardware::thermal::V2_0::Temperature;
+using ::android::hardware::thermal::V2_0::IThermalChangedCallback;
+using ::android::hardware::thermal::V2_0::TemperatureThreshold;
+using ::android::hardware::thermal::V2_0::TemperatureType;
+
+struct CallbackSetting {
+    CallbackSetting(sp<IThermalChangedCallback> callback, bool is_filter_type, TemperatureType type)
+        : callback(callback), is_filter_type(is_filter_type), type(type) {}
+    sp<IThermalChangedCallback> callback;
+    bool is_filter_type;
+    TemperatureType type;
+};
+
+class Thermal : public IThermal {
+   public:
+    // Methods from ::android::hardware::thermal::V1_0::IThermal follow.
+    Return<void> getTemperatures(getTemperatures_cb _hidl_cb) override;
+    Return<void> getCpuUsages(getCpuUsages_cb _hidl_cb) override;
+    Return<void> getCoolingDevices(getCoolingDevices_cb _hidl_cb) override;
+
+    // Methods from ::android::hardware::thermal::V2_0::IThermal follow.
+    Return<void> getCurrentTemperatures(bool filterType, TemperatureType type,
+                                        getCurrentTemperatures_cb _hidl_cb) override;
+    Return<void> getTemperatureThresholds(bool filterType, TemperatureType type,
+                                          getTemperatureThresholds_cb _hidl_cb) override;
+    Return<void> registerThermalChangedCallback(
+        const sp<IThermalChangedCallback>& callback, bool filterType, TemperatureType type,
+        registerThermalChangedCallback_cb _hidl_cb) override;
+    Return<void> unregisterThermalChangedCallback(
+        const sp<IThermalChangedCallback>& callback,
+        unregisterThermalChangedCallback_cb _hidl_cb) override;
+    Return<void> getCurrentCoolingDevices(bool filterType, CoolingType type,
+                                          getCurrentCoolingDevices_cb _hidl_cb) override;
+
+   private:
+    std::mutex thermal_callback_mutex_;
+    std::vector<CallbackSetting> callbacks_;
+};
+
+}  // namespace implementation
+}  // namespace V2_0
+}  // namespace thermal
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_THERMAL_V2_0_THERMAL_H
diff --git a/thermal/2.0/default/android.hardware.thermal@2.0-service.rc b/thermal/2.0/default/android.hardware.thermal@2.0-service.rc
new file mode 100644
index 0000000..de49d20
--- /dev/null
+++ b/thermal/2.0/default/android.hardware.thermal@2.0-service.rc
@@ -0,0 +1,5 @@
+service vendor.thermal-hal-2-0-mock /vendor/bin/hw/android.hardware.thermal@2.0-service
+    interface android.hardware.thermal@2.0::IThermal default
+    class hal
+    user system
+    group system
diff --git a/thermal/2.0/default/android.hardware.thermal@2.0-service.xml b/thermal/2.0/default/android.hardware.thermal@2.0-service.xml
new file mode 100644
index 0000000..bcd6344
--- /dev/null
+++ b/thermal/2.0/default/android.hardware.thermal@2.0-service.xml
@@ -0,0 +1,12 @@
+<manifest version="1.0" type="device">
+    <hal format="hidl">
+        <name>android.hardware.thermal</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <version>2.0</version>
+        <interface>
+            <name>IThermal</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/thermal/2.0/default/service.cpp b/thermal/2.0/default/service.cpp
new file mode 100644
index 0000000..dd24078
--- /dev/null
+++ b/thermal/2.0/default/service.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.thermal@2.0-service-mock"
+
+#include <android-base/logging.h>
+#include <hidl/HidlTransportSupport.h>
+#include "Thermal.h"
+
+using ::android::OK;
+using ::android::status_t;
+
+// libhwbinder:
+using ::android::hardware::configureRpcThreadpool;
+using ::android::hardware::joinRpcThreadpool;
+
+// Generated HIDL files:
+using ::android::hardware::thermal::V2_0::IThermal;
+using ::android::hardware::thermal::V2_0::implementation::Thermal;
+
+static int shutdown() {
+    LOG(ERROR) << "Thermal Service is shutting down.";
+    return 1;
+}
+
+int main(int /* argc */, char** /* argv */) {
+    status_t status;
+    android::sp<IThermal> service = nullptr;
+
+    LOG(INFO) << "Thermal HAL Service Mock 2.0 starting...";
+
+    service = new Thermal();
+    if (service == nullptr) {
+        LOG(ERROR) << "Error creating an instance of ThermalHAL.  Exiting...";
+        return shutdown();
+    }
+
+    configureRpcThreadpool(1, true /* callerWillJoin */);
+
+    status = service->registerAsService();
+    if (status != OK) {
+        LOG(ERROR) << "Could not register service for ThermalHAL (" << status << ")";
+        return shutdown();
+    }
+
+    LOG(INFO) << "Thermal Service started successfully.";
+    joinRpcThreadpool();
+    // We should not get past the joinRpcThreadpool().
+    return shutdown();
+}
diff --git a/thermal/2.0/types.hal b/thermal/2.0/types.hal
new file mode 100644
index 0000000..4929e44
--- /dev/null
+++ b/thermal/2.0/types.hal
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.thermal@2.0;
+
+import android.hardware.thermal@1.0::types;
+
+/** Device temperature types */
+enum TemperatureType : @1.0::TemperatureType {
+    USB_PORT = 4,
+    POWER_AMPLIFIER = 5,
+    /**
+     * Battery Charge Limit - virtual thermal sensors
+     */
+    BCL_VOLTAGE = 6,
+    BCL_CURRENT = 7,
+    BCL_PERCENTAGE = 8,
+};
+
+
+/** Device cooling device types */
+enum CoolingType : uint32_t {
+    FAN,
+    BATTERY,
+    CPU,
+    GPU,
+    MODEM,
+    NPU,
+    COMPONENT, // for the rest of components
+};
+
+/** Device throttling severity */
+enum ThrottlingSeverity : uint32_t {
+    /**
+     * Not under throttling.
+     */
+    NONE = 0,
+    /**
+     * Light throttling where UX is not impacted.
+     */
+    LIGHT,
+    /**
+     * Moderate throttling where UX is not largily impacted.
+     */
+    MODERATE,
+    /**
+     * Severe throttling where UX is largely impacted.
+     * Similar to 1.0 throttlingThreshold.
+     */
+    SEVERE,
+    /**
+     * Platform has done everything to reduce power.
+     */
+    CRITICAL,
+    /**
+     * User should be warned before shutdown.
+     */
+    WARNING,
+    /**
+     * Need shutdown immediately.
+     */
+    SHUTDOWN,
+};
+
+enum ThrottlingSeverityCount : uint32_t {NUM_THROTTLING_LEVELS = 7};
+
+struct TemperatureThreshold {
+    /**
+     * This temperature's type.
+     */
+    TemperatureType type;
+
+    /**
+     * Name of this temperature matching the Temperature struct.
+     * All temperatures of the same "type" must have a different "name",
+     * e.g., cpu0, battery. Clients use it to match Temperature struct.
+     */
+    string name;
+
+    /**
+     * Hot throttling temperature constant for this temperature sensor in
+     * level defined in ThrottlingSeverity including shutdown. Throttling
+     * happens when temperature >= threshold. If not available, set to NAN.
+     * Unit is same as Temperature's value.
+     */
+    float[ThrottlingSeverityCount:NUM_THROTTLING_LEVELS] hotThrottlingThresholds;
+
+    /**
+     * Cold throttling temperature constant for this temperature sensor in
+     * level defined in ThrottlingSeverity including shutdown. Throttling
+     * happens when temperature <= threshold. If not available, set to NAN.
+     * Unit is same as Temperature's value.
+     */
+    float[ThrottlingSeverityCount:NUM_THROTTLING_LEVELS] coldThrottlingThresholds;
+
+    /**
+     * Threshold temperature above which the VR mode clockrate minimums cannot
+     * be maintained for this device. If not available, set by HAL to NAN.
+     * Unit is same as Temperature's value.
+     */
+    float vrThrottlingThreshold;
+};
+
+struct Temperature {
+    /**
+     * This temperature's type.
+     */
+    TemperatureType type;
+
+    /**
+     * Name of this temperature matching the TemperatureThreshold.
+     * All temperatures of the same "type" must have a different "name",
+     * e.g., cpu0, battery. Clients use it to match with TemperatureThreshold
+     * struct.
+     */
+    string name;
+
+    /**
+     * For BCL, this is the current reading of the virtual sensor and the unit is
+     * millivolt, milliamp, percentage for BCL_VOLTAGE, BCL_CURRENT and BCL_PERCENTAGE
+     * respectively. For everything else, this is the current temperature in Celsius.
+     * If not available set by HAL to NAN.
+     */
+    float value;
+
+    /**
+     * The current throttling level of the sensor.
+     */
+    ThrottlingSeverity throttlingStatus;
+};
+
+struct CoolingDevice {
+    /**
+     * This cooling device type, CPU, GPU, BATTERY, and etc.
+     */
+    CoolingType type;
+
+    /**
+     * Name of this cooling device.
+     * All cooling devices of the same "type" must have a different "name".
+     * The name is usually defined in kernel device tree, and this is for client
+     * logging purpose.
+     */
+    string name;
+
+    /**
+     * Current throttle state of the cooling device. The value can any unsigned integer
+     * numbers between 0 and max_state defined in its driver, usually representing the
+     * associated device's power state. 0 means device is not in throttling, higher value
+     * means deeper throttling.
+     */
+    uint64_t value;
+};
diff --git a/thermal/2.0/vts/functional/Android.bp b/thermal/2.0/vts/functional/Android.bp
new file mode 100644
index 0000000..f4e95f8
--- /dev/null
+++ b/thermal/2.0/vts/functional/Android.bp
@@ -0,0 +1,26 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalThermalV2_0TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: ["VtsHalThermalV2_0TargetTest.cpp"],
+    static_libs: [
+        "android.hardware.thermal@1.0",
+        "android.hardware.thermal@2.0",
+    ],
+}
+
diff --git a/thermal/2.0/vts/functional/VtsHalThermalV2_0TargetTest.cpp b/thermal/2.0/vts/functional/VtsHalThermalV2_0TargetTest.cpp
new file mode 100644
index 0000000..cf1956d
--- /dev/null
+++ b/thermal/2.0/vts/functional/VtsHalThermalV2_0TargetTest.cpp
@@ -0,0 +1,264 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android/hardware/thermal/2.0/IThermal.h>
+#include <android/hardware/thermal/2.0/IThermalChangedCallback.h>
+#include <android/hardware/thermal/2.0/types.h>
+
+#include <VtsHalHidlTargetCallbackBase.h>
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+using ::android::sp;
+using ::android::hardware::hidl_enum_range;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::thermal::V1_0::ThermalStatus;
+using ::android::hardware::thermal::V1_0::ThermalStatusCode;
+using ::android::hardware::thermal::V2_0::CoolingDevice;
+using ::android::hardware::thermal::V2_0::CoolingType;
+using ::android::hardware::thermal::V2_0::IThermal;
+using ::android::hardware::thermal::V2_0::IThermalChangedCallback;
+using ::android::hardware::thermal::V2_0::Temperature;
+using ::android::hardware::thermal::V2_0::TemperatureThreshold;
+using ::android::hardware::thermal::V2_0::TemperatureType;
+using ::android::hardware::thermal::V2_0::ThrottlingSeverity;
+using ::android::hardware::thermal::V2_0::ThrottlingSeverityCount;
+
+constexpr char kCallbackNameNotifyThrottling[] = "notifyThrottling";
+static const Temperature kThrottleTemp = {
+    .type = TemperatureType::SKIN,
+    .name = "test temperature sensor",
+    .value = 98.6,
+    .throttlingStatus = ThrottlingSeverity::CRITICAL,
+};
+
+class ThermalCallbackArgs {
+   public:
+    Temperature temperature;
+};
+
+// Callback class for receiving thermal event notifications from main class
+class ThermalCallback : public ::testing::VtsHalHidlTargetCallbackBase<ThermalCallbackArgs>,
+                        public IThermalChangedCallback {
+   public:
+    Return<void> notifyThrottling(const Temperature& temperature) override {
+        ThermalCallbackArgs args;
+        args.temperature = temperature;
+        NotifyFromCallback(kCallbackNameNotifyThrottling, args);
+        return Void();
+    }
+};
+
+// Test environment for Thermal HIDL HAL.
+class ThermalHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static ThermalHidlEnvironment* Instance() {
+        static ThermalHidlEnvironment* instance = new ThermalHidlEnvironment;
+        return instance;
+    }
+
+    void registerTestServices() override { registerTestService<IThermal>(); }
+
+   private:
+    ThermalHidlEnvironment() {}
+};
+
+// The main test class for THERMAL HIDL HAL 2.0.
+class ThermalHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        mThermal = ::testing::VtsHalHidlTargetTestBase::getService<IThermal>(
+            ThermalHidlEnvironment::Instance()->getServiceName<IThermal>());
+        ASSERT_NE(mThermal, nullptr);
+        mThermalCallback = new (std::nothrow) ThermalCallback();
+        ASSERT_NE(mThermalCallback, nullptr);
+        auto ret = mThermal->registerThermalChangedCallback(
+            mThermalCallback, false, TemperatureType::SKIN,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+        // Expect to fail if register again
+        ret = mThermal->registerThermalChangedCallback(
+            mThermalCallback, false, TemperatureType::SKIN,
+            [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+    }
+
+    virtual void TearDown() override {
+        auto ret = mThermal->unregisterThermalChangedCallback(
+            mThermalCallback,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+        // Expect to fail if unregister again
+        ret = mThermal->unregisterThermalChangedCallback(
+            mThermalCallback,
+            [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+    }
+
+   protected:
+    sp<IThermal> mThermal;
+    sp<ThermalCallback> mThermalCallback;
+};  // class ThermalHidlTest
+
+// Test ThermalChangedCallback::notifyThrottling().
+// This just calls into and back from our local ThermalChangedCallback impl.
+// Note: a real thermal throttling event from the Thermal HAL could be
+// inadvertently received here.
+TEST_F(ThermalHidlTest, NotifyThrottlingTest) {
+    auto ret = mThermalCallback->notifyThrottling(kThrottleTemp);
+    ASSERT_TRUE(ret.isOk());
+    auto res = mThermalCallback->WaitForCallback(kCallbackNameNotifyThrottling);
+    EXPECT_TRUE(res.no_timeout);
+    ASSERT_TRUE(res.args);
+    EXPECT_EQ(kThrottleTemp, res.args->temperature);
+}
+
+// Test Thermal->registerThermalChangedCallback.
+TEST_F(ThermalHidlTest, RegisterThermalChangedCallbackTest) {
+    // Expect to fail with same callback
+    auto ret = mThermal->registerThermalChangedCallback(
+        mThermalCallback, false, TemperatureType::SKIN,
+        [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    sp<ThermalCallback> localThermalCallback = new (std::nothrow) ThermalCallback();
+    // Expect to succeed with different callback
+    ret = mThermal->registerThermalChangedCallback(
+        localThermalCallback, false, TemperatureType::SKIN,
+        [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Remove the local callback.
+    ret = mThermal->unregisterThermalChangedCallback(
+        localThermalCallback,
+        [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+}
+
+// Test Thermal->unregisterThermalChangedCallback.
+TEST_F(ThermalHidlTest, UnregisterThermalChangedCallbackTest) {
+    sp<ThermalCallback> localThermalCallback = new (std::nothrow) ThermalCallback();
+    // Expect to fail as the callback was not registered before
+    auto ret = mThermal->unregisterThermalChangedCallback(
+        localThermalCallback,
+        [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Register a local callback
+    ret = mThermal->registerThermalChangedCallback(
+        localThermalCallback, false, TemperatureType::SKIN,
+        [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Expect to succeed with callback removed
+    ret = mThermal->unregisterThermalChangedCallback(
+        localThermalCallback,
+        [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Expect to fail as the callback has been unregistered already
+    ret = mThermal->unregisterThermalChangedCallback(
+        localThermalCallback,
+        [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+}
+
+// Sanity test for Thermal::getCurrentTemperatures().
+TEST_F(ThermalHidlTest, TemperatureTest) {
+    mThermal->getCurrentTemperatures(false, TemperatureType::SKIN,
+                                     [](ThermalStatus status, hidl_vec<Temperature> temperatures) {
+                                         if (temperatures.size()) {
+                                             EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                                         } else {
+                                             EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                                         }
+                                     });
+    auto types = hidl_enum_range<TemperatureType>();
+    for (const auto& type : types) {
+        mThermal->getCurrentTemperatures(
+            true, type, [&type](ThermalStatus status, hidl_vec<Temperature> temperatures) {
+                if (temperatures.size()) {
+                    EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                } else {
+                    EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                }
+                for (int i = 0; i < temperatures.size(); ++i) {
+                    EXPECT_EQ(type, temperatures[i].type);
+                }
+            });
+    }
+}
+
+// Sanity test for Thermal::getTemperatureThresholds().
+TEST_F(ThermalHidlTest, TemperatureThresholdTest) {
+    mThermal->getTemperatureThresholds(
+        false, TemperatureType::SKIN,
+        [](ThermalStatus status, hidl_vec<TemperatureThreshold> temperatures) {
+            if (temperatures.size()) {
+                EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+            } else {
+                EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+            }
+        });
+    for (int i = static_cast<int>(TemperatureType::UNKNOWN);
+         i <= static_cast<int>(TemperatureType::POWER_AMPLIFIER); ++i) {
+        auto type = static_cast<TemperatureType>(i);
+        mThermal->getTemperatureThresholds(
+            true, type, [&type](ThermalStatus status, hidl_vec<TemperatureThreshold> temperatures) {
+                if (temperatures.size()) {
+                    EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                } else {
+                    EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                }
+                for (int i = 0; i < temperatures.size(); ++i) {
+                    EXPECT_EQ(type, temperatures[i].type);
+                }
+            });
+    }
+}
+
+// Sanity test for Thermal::getCurrentCoolingDevices().
+TEST_F(ThermalHidlTest, CoolingDeviceTest) {
+    mThermal->getCurrentCoolingDevices(
+        false, CoolingType::CPU, [](ThermalStatus status, hidl_vec<CoolingDevice> cooling_devices) {
+            if (cooling_devices.size()) {
+                EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+            } else {
+                EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+            }
+        });
+    for (int i = 0; i <= static_cast<int>(CoolingType::COMPONENT); ++i) {
+        auto type = static_cast<CoolingType>(i);
+        mThermal->getCurrentCoolingDevices(
+            true, type, [&type](ThermalStatus status, hidl_vec<CoolingDevice> cooling_devices) {
+                if (cooling_devices.size()) {
+                    EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                } else {
+                    EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                }
+                for (int i = 0; i < cooling_devices.size(); ++i) {
+                    EXPECT_EQ(type, cooling_devices[i].type);
+                }
+            });
+    }
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(ThermalHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    ThermalHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    cout << "Test result = " << status << std::endl;
+    return status;
+}
diff --git a/update-base-files.sh b/update-base-files.sh
index 75d2be5..daaa530 100755
--- a/update-base-files.sh
+++ b/update-base-files.sh
@@ -36,6 +36,9 @@
 hidl-gen $options \
          -o $ANDROID_BUILD_TOP/system/core/include/system/graphics-base-v1.1.h \
          android.hardware.graphics.common@1.1
+hidl-gen $options \
+         -o $ANDROID_BUILD_TOP/system/core/include/system/graphics-base-v1.2.h \
+         android.hardware.graphics.common@1.2
 
 # system/media
 hidl-gen $options \
diff --git a/wifi/1.2/default/OWNERS b/wifi/1.0/vts/OWNERS
similarity index 100%
copy from wifi/1.2/default/OWNERS
copy to wifi/1.0/vts/OWNERS
diff --git a/wifi/1.0/vts/functional/Android.bp b/wifi/1.0/vts/functional/Android.bp
index 6522f4d..d0dd915 100644
--- a/wifi/1.0/vts/functional/Android.bp
+++ b/wifi/1.0/vts/functional/Android.bp
@@ -45,6 +45,8 @@
     static_libs: [
         "VtsHalWifiV1_0TargetTestUtil",
         "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
     ],
 }
 
diff --git a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
index d16f1e7..a3fdf27 100644
--- a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
+++ b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
@@ -735,10 +735,10 @@
  * CreateRttController
  */
 TEST_F(WifiChipHidlTest, CreateRttController) {
-    configureChipForIfaceType(IfaceType::AP, true);
+    configureChipForIfaceType(IfaceType::STA, true);
 
-    sp<IWifiApIface> iface;
-    EXPECT_EQ(WifiStatusCode::SUCCESS, createApIface(&iface));
+    sp<IWifiStaIface> iface;
+    EXPECT_EQ(WifiStatusCode::SUCCESS, createStaIface(&iface));
     EXPECT_NE(nullptr, iface.get());
 
     const auto& status_and_rtt_controller =
diff --git a/wifi/1.0/vts/functional/wifi_sta_iface_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_sta_iface_hidl_test.cpp
index a341028..a22cd72 100644
--- a/wifi/1.0/vts/functional/wifi_sta_iface_hidl_test.cpp
+++ b/wifi/1.0/vts/functional/wifi_sta_iface_hidl_test.cpp
@@ -17,6 +17,7 @@
 #include <android-base/logging.h>
 
 #include <android/hardware/wifi/1.0/IWifiStaIface.h>
+#include <android/hardware/wifi/1.3/IWifiStaIface.h>
 
 #include <VtsHalHidlTargetTestBase.h>
 
@@ -143,6 +144,14 @@
         return;
     }
 
+    sp<::android::hardware::wifi::V1_3::IWifiStaIface> iface_converted =
+        ::android::hardware::wifi::V1_3::IWifiStaIface::castFrom(
+            wifi_sta_iface_);
+    if (iface_converted != nullptr) {
+        // Skip this test since this API is deprecated in this newer HAL version
+        return;
+    }
+
     // Enable link layer stats collection.
     EXPECT_EQ(WifiStatusCode::SUCCESS,
               HIDL_INVOKE(wifi_sta_iface_, enableLinkLayerStatsCollection, true)
diff --git a/wifi/1.2/default/OWNERS b/wifi/1.1/vts/OWNERS
similarity index 100%
copy from wifi/1.2/default/OWNERS
copy to wifi/1.1/vts/OWNERS
diff --git a/wifi/1.1/vts/functional/OWNERS b/wifi/1.1/vts/functional/OWNERS
deleted file mode 100644
index 2878acc..0000000
--- a/wifi/1.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-rpius@google.com
-quiche@google.com
diff --git a/wifi/1.2/default/tests/hidl_struct_util_unit_tests.cpp b/wifi/1.2/default/tests/hidl_struct_util_unit_tests.cpp
deleted file mode 100644
index 1d6e9e4..0000000
--- a/wifi/1.2/default/tests/hidl_struct_util_unit_tests.cpp
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Copyright (C) 2017, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <android-base/logging.h>
-#include <android-base/macros.h>
-#include <gmock/gmock.h>
-
-#undef NAN
-#include "hidl_struct_util.h"
-
-using testing::Test;
-
-namespace {
-constexpr uint32_t kMacId1 = 1;
-constexpr uint32_t kMacId2 = 2;
-constexpr uint32_t kIfaceChannel1 = 3;
-constexpr uint32_t kIfaceChannel2 = 5;
-constexpr char kIfaceName1[] = "wlan0";
-constexpr char kIfaceName2[] = "wlan1";
-}  // namespace
-namespace android {
-namespace hardware {
-namespace wifi {
-namespace V1_2 {
-namespace implementation {
-using namespace android::hardware::wifi::V1_0;
-
-class HidlStructUtilTest : public Test {};
-
-TEST_F(HidlStructUtilTest, CanConvertLegacyWifiMacInfosToHidlWithOneMac) {
-    std::vector<legacy_hal::WifiMacInfo> legacy_mac_infos;
-    legacy_hal::WifiMacInfo legacy_mac_info1 = {
-        .wlan_mac_id = kMacId1,
-        .mac_band =
-            legacy_hal::WLAN_MAC_5_0_BAND | legacy_hal::WLAN_MAC_2_4_BAND};
-    legacy_hal::WifiIfaceInfo legacy_iface_info1 = {.name = kIfaceName1,
-                                                    .channel = kIfaceChannel1};
-    legacy_hal::WifiIfaceInfo legacy_iface_info2 = {.name = kIfaceName2,
-                                                    .channel = kIfaceChannel2};
-    legacy_mac_info1.iface_infos.push_back(legacy_iface_info1);
-    legacy_mac_info1.iface_infos.push_back(legacy_iface_info2);
-    legacy_mac_infos.push_back(legacy_mac_info1);
-
-    std::vector<IWifiChipEventCallback::RadioModeInfo> hidl_radio_mode_infos;
-    ASSERT_TRUE(hidl_struct_util::convertLegacyWifiMacInfosToHidl(
-        legacy_mac_infos, &hidl_radio_mode_infos));
-
-    ASSERT_EQ(1u, hidl_radio_mode_infos.size());
-    auto hidl_radio_mode_info1 = hidl_radio_mode_infos[0];
-    EXPECT_EQ(legacy_mac_info1.wlan_mac_id, hidl_radio_mode_info1.radioId);
-    EXPECT_EQ(WifiBand::BAND_24GHZ_5GHZ, hidl_radio_mode_info1.bandInfo);
-    ASSERT_EQ(2u, hidl_radio_mode_info1.ifaceInfos.size());
-    auto hidl_iface_info1 = hidl_radio_mode_info1.ifaceInfos[0];
-    EXPECT_EQ(legacy_iface_info1.name, hidl_iface_info1.name);
-    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info1.channel),
-              hidl_iface_info1.channel);
-    auto hidl_iface_info2 = hidl_radio_mode_info1.ifaceInfos[1];
-    EXPECT_EQ(legacy_iface_info2.name, hidl_iface_info2.name);
-    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info2.channel),
-              hidl_iface_info2.channel);
-}
-
-TEST_F(HidlStructUtilTest, CanConvertLegacyWifiMacInfosToHidlWithTwoMac) {
-    std::vector<legacy_hal::WifiMacInfo> legacy_mac_infos;
-    legacy_hal::WifiMacInfo legacy_mac_info1 = {
-        .wlan_mac_id = kMacId1, .mac_band = legacy_hal::WLAN_MAC_5_0_BAND};
-    legacy_hal::WifiIfaceInfo legacy_iface_info1 = {.name = kIfaceName1,
-                                                    .channel = kIfaceChannel1};
-    legacy_hal::WifiMacInfo legacy_mac_info2 = {
-        .wlan_mac_id = kMacId2, .mac_band = legacy_hal::WLAN_MAC_2_4_BAND};
-    legacy_hal::WifiIfaceInfo legacy_iface_info2 = {.name = kIfaceName2,
-                                                    .channel = kIfaceChannel2};
-    legacy_mac_info1.iface_infos.push_back(legacy_iface_info1);
-    legacy_mac_infos.push_back(legacy_mac_info1);
-    legacy_mac_info2.iface_infos.push_back(legacy_iface_info2);
-    legacy_mac_infos.push_back(legacy_mac_info2);
-
-    std::vector<IWifiChipEventCallback::RadioModeInfo> hidl_radio_mode_infos;
-    ASSERT_TRUE(hidl_struct_util::convertLegacyWifiMacInfosToHidl(
-        legacy_mac_infos, &hidl_radio_mode_infos));
-
-    ASSERT_EQ(2u, hidl_radio_mode_infos.size());
-
-    // Find mac info 1.
-    const auto hidl_radio_mode_info1 = std::find_if(
-        hidl_radio_mode_infos.begin(), hidl_radio_mode_infos.end(),
-        [&legacy_mac_info1](const IWifiChipEventCallback::RadioModeInfo& x) {
-            return x.radioId == legacy_mac_info1.wlan_mac_id;
-        });
-    ASSERT_NE(hidl_radio_mode_infos.end(), hidl_radio_mode_info1);
-    EXPECT_EQ(WifiBand::BAND_5GHZ, hidl_radio_mode_info1->bandInfo);
-    ASSERT_EQ(1u, hidl_radio_mode_info1->ifaceInfos.size());
-    auto hidl_iface_info1 = hidl_radio_mode_info1->ifaceInfos[0];
-    EXPECT_EQ(legacy_iface_info1.name, hidl_iface_info1.name);
-    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info1.channel),
-              hidl_iface_info1.channel);
-
-    // Find mac info 2.
-    const auto hidl_radio_mode_info2 = std::find_if(
-        hidl_radio_mode_infos.begin(), hidl_radio_mode_infos.end(),
-        [&legacy_mac_info2](const IWifiChipEventCallback::RadioModeInfo& x) {
-            return x.radioId == legacy_mac_info2.wlan_mac_id;
-        });
-    ASSERT_NE(hidl_radio_mode_infos.end(), hidl_radio_mode_info2);
-    EXPECT_EQ(WifiBand::BAND_24GHZ, hidl_radio_mode_info2->bandInfo);
-    ASSERT_EQ(1u, hidl_radio_mode_info2->ifaceInfos.size());
-    auto hidl_iface_info2 = hidl_radio_mode_info2->ifaceInfos[0];
-    EXPECT_EQ(legacy_iface_info2.name, hidl_iface_info2.name);
-    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info2.channel),
-              hidl_iface_info2.channel);
-}
-}  // namespace implementation
-}  // namespace V1_2
-}  // namespace wifi
-}  // namespace hardware
-}  // namespace android
diff --git a/wifi/1.2/default/tests/runtests.sh b/wifi/1.2/default/tests/runtests.sh
deleted file mode 100755
index 966a6a7..0000000
--- a/wifi/1.2/default/tests/runtests.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright(C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0(the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http:// www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-if [ -z $ANDROID_BUILD_TOP ]; then
-  echo "You need to source and lunch before you can use this script"
-  exit 1
-fi
-
-echo "Running tests"
-set -e # fail early
-
-#NOTE We can't actually run these commands, since they rely on functions added by
-#build / envsetup.sh to the bash shell environment.
-echo "+ mmma -j32 $ANDROID_BUILD_TOP/"
-make -j32 -C $ANDROID_BUILD_TOP -f build/core/main.mk \
-    MODULES-IN-hardware-interfaces-wifi-1.2-default
-
-set -x # print commands
-
-adb wait-for-device
-adb root
-adb wait-for-device
-
-#'disable-verity' will appear in 'adb remount' output if
-#dm - verity is enabled and needs to be disabled.
-if adb remount | grep 'disable-verity'; then
-  adb disable-verity
-  adb reboot
-  adb wait-for-device
-  adb root
-  adb wait-for-device
-  adb remount
-fi
-
-adb sync
-
-adb shell /data/nativetest/vendor/android.hardware.wifi@1.0-service-tests/android.hardware.wifi@1.0-service-tests
diff --git a/wifi/1.2/vts/OWNERS b/wifi/1.2/vts/OWNERS
index 811c857..8bfb148 100644
--- a/wifi/1.2/vts/OWNERS
+++ b/wifi/1.2/vts/OWNERS
@@ -1,4 +1,2 @@
 rpius@google.com
-quiche@google.com
-arabawy@google.com
-yim@google.com
\ No newline at end of file
+etancohen@google.com
diff --git a/wifi/1.3/Android.bp b/wifi/1.3/Android.bp
new file mode 100644
index 0000000..163a870
--- /dev/null
+++ b/wifi/1.3/Android.bp
@@ -0,0 +1,27 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.wifi@1.3",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IWifi.hal",
+        "IWifiChip.hal",
+        "IWifiStaIface.hal",
+    ],
+    interfaces: [
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+      "StaLinkLayerRadioStats",
+      "StaLinkLayerStats",
+    ],
+    gen_java: true,
+}
+
diff --git a/wifi/1.3/IWifi.hal b/wifi/1.3/IWifi.hal
new file mode 100644
index 0000000..298e722
--- /dev/null
+++ b/wifi/1.3/IWifi.hal
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.3;
+
+import @1.2::IWifi;
+
+/**
+ * This is the root of the HAL module and is the interface returned when
+ * loading an implementation of the Wi-Fi HAL. There must be at most one
+ * module loaded in the system.
+ * IWifi.getChip() must return @1.2::IWifiChip
+ */
+interface IWifi extends @1.2::IWifi {
+};
diff --git a/wifi/1.3/IWifiChip.hal b/wifi/1.3/IWifiChip.hal
new file mode 100644
index 0000000..74d527d
--- /dev/null
+++ b/wifi/1.3/IWifiChip.hal
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.3;
+
+import @1.0::WifiStatus;
+import @1.2::IWifiChip;
+
+/**
+ * Interface that represents a chip that must be configured as a single unit.
+ */
+interface IWifiChip extends @1.2::IWifiChip {
+
+    /**
+     * Capabilities exposed by this chip.
+     */
+    enum ChipCapabilityMask : @1.2::IWifiChip.ChipCapabilityMask {
+        /**
+         * Set Latency Mode.
+         */
+         SET_LATENCY_MODE = 1 << 12
+    };
+
+    /**
+     * Get the capabilities supported by this chip.
+     *
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_CHIP_INVALID|,
+     *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     * @return capabilities Bitset of |ChipCapabilityMask| values.
+     */
+    getCapabilities_1_3()
+      generates (WifiStatus status, bitfield<ChipCapabilityMask> capabilities);
+
+    /**
+     * This enum represents the different latency modes that can be set through
+     * setLatencyMode()
+     */
+    enum LatencyMode : uint32_t {
+        NORMAL    = 0,
+        LOW       = 1
+    };
+
+    /**
+     * API to set the wifi latency mode
+     *
+     * Latency mode determines whether or not to optimize for reducing wifi
+     * latency as a tradeoff with other wifi functionality such as scanning,
+     * roaming, etc. This optimization is suitable for some applications such
+     * as gaming and virtual reality applications.
+     */
+    setLatencyMode(LatencyMode mode) generates (WifiStatus status);
+};
diff --git a/wifi/1.3/IWifiStaIface.hal b/wifi/1.3/IWifiStaIface.hal
new file mode 100644
index 0000000..0dc6128
--- /dev/null
+++ b/wifi/1.3/IWifiStaIface.hal
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.3;
+
+import @1.0::WifiStatus;
+import @1.2::IWifiStaIface;
+
+/**
+ * Interface used to represent a single STA iface.
+ *
+ * IWifiChip.createStaIface() may return a @1.3::IWifiStaIface when supported.
+ */
+interface IWifiStaIface extends @1.2::IWifiStaIface {
+    /**
+     * Retrieve the latest link layer stats.
+     * Must fail if |StaIfaceCapabilityMask.LINK_LAYER_STATS| is not set or if
+     * link layer stats collection hasn't been explicitly enabled.
+     *
+     * @return status WifiStatus of the operation.
+     *     Possible status codes:
+     *     |WifiStatusCode.SUCCESS|,
+     *     |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *     |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *     |WifiStatusCode.ERROR_NOT_STARTED|,
+     *     |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *     |WifiStatusCode.ERROR_UNKNOWN|
+     * @return stats Instance of |LinkLayerStats|.
+     */
+    getLinkLayerStats_1_3() generates (WifiStatus status, StaLinkLayerStats stats);
+};
diff --git a/wifi/1.2/default/Android.mk b/wifi/1.3/default/Android.mk
similarity index 91%
rename from wifi/1.2/default/Android.mk
rename to wifi/1.3/default/Android.mk
index 3919690..e05d2f0 100644
--- a/wifi/1.2/default/Android.mk
+++ b/wifi/1.3/default/Android.mk
@@ -30,6 +30,8 @@
 ifdef WIFI_HIDL_FEATURE_DISABLE_AP
 LOCAL_CPPFLAGS += -DWIFI_HIDL_FEATURE_DISABLE_AP
 endif
+# Allow implicit fallthroughs in wifi_legacy_hal.cpp until they are fixed.
+LOCAL_CFLAGS += -Wno-error=implicit-fallthrough
 LOCAL_SRC_FILES := \
     hidl_struct_util.cpp \
     hidl_sync_util.cpp \
@@ -58,7 +60,8 @@
     libwifi-system-iface \
     android.hardware.wifi@1.0 \
     android.hardware.wifi@1.1 \
-    android.hardware.wifi@1.2
+    android.hardware.wifi@1.2 \
+    android.hardware.wifi@1.3
 LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)
 include $(BUILD_STATIC_LIBRARY)
 
@@ -84,7 +87,8 @@
     libwifi-system-iface \
     android.hardware.wifi@1.0 \
     android.hardware.wifi@1.1 \
-    android.hardware.wifi@1.2
+    android.hardware.wifi@1.2 \
+    android.hardware.wifi@1.3
 LOCAL_STATIC_LIBRARIES := \
     android.hardware.wifi@1.0-service-lib
 LOCAL_INIT_RC := android.hardware.wifi@1.0-service.rc
@@ -107,11 +111,11 @@
 LOCAL_STATIC_LIBRARIES := \
     libgmock \
     libgtest \
+    libhidlbase \
     android.hardware.wifi@1.0-service-lib
 LOCAL_SHARED_LIBRARIES := \
     libbase \
     libcutils \
-    libhidlbase \
     libhidltransport \
     liblog \
     libnl \
@@ -120,5 +124,6 @@
     libwifi-system-iface \
     android.hardware.wifi@1.0 \
     android.hardware.wifi@1.1 \
-    android.hardware.wifi@1.2
+    android.hardware.wifi@1.2 \
+    android.hardware.wifi@1.3
 include $(BUILD_NATIVE_TEST)
diff --git a/wifi/1.2/default/OWNERS b/wifi/1.3/default/OWNERS
similarity index 100%
rename from wifi/1.2/default/OWNERS
rename to wifi/1.3/default/OWNERS
diff --git a/wifi/1.2/default/THREADING.README b/wifi/1.3/default/THREADING.README
similarity index 100%
rename from wifi/1.2/default/THREADING.README
rename to wifi/1.3/default/THREADING.README
diff --git a/wifi/1.2/default/android.hardware.wifi@1.0-service.rc b/wifi/1.3/default/android.hardware.wifi@1.0-service.rc
similarity index 100%
rename from wifi/1.2/default/android.hardware.wifi@1.0-service.rc
rename to wifi/1.3/default/android.hardware.wifi@1.0-service.rc
diff --git a/wifi/1.2/default/hidl_callback_util.h b/wifi/1.3/default/hidl_callback_util.h
similarity index 98%
rename from wifi/1.2/default/hidl_callback_util.h
rename to wifi/1.3/default/hidl_callback_util.h
index 97f312a..a44af79 100644
--- a/wifi/1.2/default/hidl_callback_util.h
+++ b/wifi/1.3/default/hidl_callback_util.h
@@ -52,7 +52,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace hidl_callback_util {
 template <typename CallbackType>
@@ -117,7 +117,7 @@
 
 }  // namespace hidl_callback_util
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/hidl_return_util.h b/wifi/1.3/default/hidl_return_util.h
similarity index 98%
rename from wifi/1.2/default/hidl_return_util.h
rename to wifi/1.3/default/hidl_return_util.h
index 914c1b4..9707444 100644
--- a/wifi/1.2/default/hidl_return_util.h
+++ b/wifi/1.3/default/hidl_return_util.h
@@ -23,7 +23,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace hidl_return_util {
 using namespace android::hardware::wifi::V1_0;
@@ -113,7 +113,7 @@
 
 }  // namespace hidl_return_util
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/hidl_struct_util.cpp b/wifi/1.3/default/hidl_struct_util.cpp
similarity index 97%
rename from wifi/1.2/default/hidl_struct_util.cpp
rename to wifi/1.3/default/hidl_struct_util.cpp
index 39ac544..c88ddaa 100644
--- a/wifi/1.2/default/hidl_struct_util.cpp
+++ b/wifi/1.3/default/hidl_struct_util.cpp
@@ -22,7 +22,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace hidl_struct_util {
 
@@ -69,9 +69,9 @@
     return {};
 }
 
-IWifiChip::ChipCapabilityMask convertLegacyFeatureToHidlChipCapability(
+V1_2::IWifiChip::ChipCapabilityMask convertLegacyFeatureToHidlChipCapability(
     uint32_t feature) {
-    using HidlChipCaps = IWifiChip::ChipCapabilityMask;
+    using HidlChipCaps = V1_2::IWifiChip::ChipCapabilityMask;
     switch (feature) {
         case WIFI_FEATURE_SET_TX_POWER_LIMIT:
             return HidlChipCaps::SET_TX_POWER_LIMIT;
@@ -139,9 +139,9 @@
                 convertLegacyLoggerFeatureToHidlChipCapability(feature);
         }
     }
-    for (const auto feature : {WIFI_FEATURE_SET_TX_POWER_LIMIT,
-                               WIFI_FEATURE_USE_BODY_HEAD_SAR,
-                               WIFI_FEATURE_D2D_RTT, WIFI_FEATURE_D2AP_RTT}) {
+    for (const auto feature :
+         {WIFI_FEATURE_SET_TX_POWER_LIMIT, WIFI_FEATURE_USE_BODY_HEAD_SAR,
+          WIFI_FEATURE_D2D_RTT, WIFI_FEATURE_D2AP_RTT}) {
         if (feature & legacy_feature_set) {
             *hidl_caps |= convertLegacyFeatureToHidlChipCapability(feature);
         }
@@ -267,26 +267,26 @@
     V1_1::IWifiChip::TxPowerScenario hidl_scenario) {
     switch (hidl_scenario) {
         // This is the only supported scenario for V1_1
-      case V1_1::IWifiChip::TxPowerScenario::VOICE_CALL:
+        case V1_1::IWifiChip::TxPowerScenario::VOICE_CALL:
             return legacy_hal::WIFI_POWER_SCENARIO_VOICE_CALL;
     };
     CHECK(false);
 }
 
 legacy_hal::wifi_power_scenario convertHidlTxPowerScenarioToLegacy_1_2(
-    IWifiChip::TxPowerScenario hidl_scenario) {
+    V1_2::IWifiChip::TxPowerScenario hidl_scenario) {
     switch (hidl_scenario) {
         // This is the only supported scenario for V1_1
-        case IWifiChip::TxPowerScenario::VOICE_CALL:
+        case V1_2::IWifiChip::TxPowerScenario::VOICE_CALL:
             return legacy_hal::WIFI_POWER_SCENARIO_VOICE_CALL;
         // Those are the supported scenarios for V1_2
-        case IWifiChip::TxPowerScenario::ON_HEAD_CELL_OFF:
+        case V1_2::IWifiChip::TxPowerScenario::ON_HEAD_CELL_OFF:
             return legacy_hal::WIFI_POWER_SCENARIO_ON_HEAD_CELL_OFF;
-        case IWifiChip::TxPowerScenario::ON_HEAD_CELL_ON:
+        case V1_2::IWifiChip::TxPowerScenario::ON_HEAD_CELL_ON:
             return legacy_hal::WIFI_POWER_SCENARIO_ON_HEAD_CELL_ON;
-        case IWifiChip::TxPowerScenario::ON_BODY_CELL_OFF:
+        case V1_2::IWifiChip::TxPowerScenario::ON_BODY_CELL_OFF:
             return legacy_hal::WIFI_POWER_SCENARIO_ON_BODY_CELL_OFF;
-        case IWifiChip::TxPowerScenario::ON_BODY_CELL_ON:
+        case V1_2::IWifiChip::TxPowerScenario::ON_BODY_CELL_ON:
             return legacy_hal::WIFI_POWER_SCENARIO_ON_BODY_CELL_ON;
     };
     CHECK(false);
@@ -294,7 +294,7 @@
 
 bool convertLegacyWifiMacInfoToHidl(
     const legacy_hal::WifiMacInfo& legacy_mac_info,
-    IWifiChipEventCallback::RadioModeInfo* hidl_radio_mode_info) {
+    V1_2::IWifiChipEventCallback::RadioModeInfo* hidl_radio_mode_info) {
     if (!hidl_radio_mode_info) {
         return false;
     }
@@ -313,9 +313,9 @@
     } else {
         hidl_radio_mode_info->bandInfo = WifiBand::BAND_UNSPECIFIED;
     }
-    std::vector<IWifiChipEventCallback::IfaceInfo> iface_info_vec;
+    std::vector<V1_2::IWifiChipEventCallback::IfaceInfo> iface_info_vec;
     for (const auto& legacy_iface_info : legacy_mac_info.iface_infos) {
-        IWifiChipEventCallback::IfaceInfo iface_info;
+        V1_2::IWifiChipEventCallback::IfaceInfo iface_info;
         iface_info.name = legacy_iface_info.name;
         iface_info.channel = legacy_iface_info.channel;
         iface_info_vec.push_back(iface_info);
@@ -326,14 +326,15 @@
 
 bool convertLegacyWifiMacInfosToHidl(
     const std::vector<legacy_hal::WifiMacInfo>& legacy_mac_infos,
-    std::vector<IWifiChipEventCallback::RadioModeInfo>* hidl_radio_mode_infos) {
+    std::vector<V1_2::IWifiChipEventCallback::RadioModeInfo>*
+        hidl_radio_mode_infos) {
     if (!hidl_radio_mode_infos) {
         return false;
     }
     *hidl_radio_mode_infos = {};
 
     for (const auto& legacy_mac_info : legacy_mac_infos) {
-        IWifiChipEventCallback::RadioModeInfo hidl_radio_mode_info;
+        V1_2::IWifiChipEventCallback::RadioModeInfo hidl_radio_mode_info;
         if (!convertLegacyWifiMacInfoToHidl(legacy_mac_info,
                                             &hidl_radio_mode_info)) {
             return false;
@@ -784,7 +785,7 @@
 
 bool convertLegacyLinkLayerStatsToHidl(
     const legacy_hal::LinkLayerStats& legacy_stats,
-    StaLinkLayerStats* hidl_stats) {
+    V1_3::StaLinkLayerStats* hidl_stats) {
     if (!hidl_stats) {
         return false;
     }
@@ -825,16 +826,26 @@
     hidl_stats->iface.wmeVoPktStats.retries =
         legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].retries;
     // radio legacy_stats conversion.
-    std::vector<StaLinkLayerRadioStats> hidl_radios_stats;
+    std::vector<V1_3::StaLinkLayerRadioStats> hidl_radios_stats;
     for (const auto& legacy_radio_stats : legacy_stats.radios) {
-        StaLinkLayerRadioStats hidl_radio_stats;
-        hidl_radio_stats.onTimeInMs = legacy_radio_stats.stats.on_time;
-        hidl_radio_stats.txTimeInMs = legacy_radio_stats.stats.tx_time;
-        hidl_radio_stats.rxTimeInMs = legacy_radio_stats.stats.rx_time;
-        hidl_radio_stats.onTimeInMsForScan =
+        V1_3::StaLinkLayerRadioStats hidl_radio_stats;
+        hidl_radio_stats.V1_0.onTimeInMs = legacy_radio_stats.stats.on_time;
+        hidl_radio_stats.V1_0.txTimeInMs = legacy_radio_stats.stats.tx_time;
+        hidl_radio_stats.V1_0.rxTimeInMs = legacy_radio_stats.stats.rx_time;
+        hidl_radio_stats.V1_0.onTimeInMsForScan =
             legacy_radio_stats.stats.on_time_scan;
-        hidl_radio_stats.txTimeInMsPerLevel =
+        hidl_radio_stats.V1_0.txTimeInMsPerLevel =
             legacy_radio_stats.tx_time_per_levels;
+        hidl_radio_stats.onTimeInMsForNanScan =
+            legacy_radio_stats.stats.on_time_nbd;
+        hidl_radio_stats.onTimeInMsForBgScan =
+            legacy_radio_stats.stats.on_time_gscan;
+        hidl_radio_stats.onTimeInMsForRoamScan =
+            legacy_radio_stats.stats.on_time_roam_scan;
+        hidl_radio_stats.onTimeInMsForPnoScan =
+            legacy_radio_stats.stats.on_time_pno_scan;
+        hidl_radio_stats.onTimeInMsForHs20Scan =
+            legacy_radio_stats.stats.on_time_hs20;
         hidl_radios_stats.push_back(hidl_radio_stats);
     }
     hidl_stats->radios = hidl_radios_stats;
@@ -1197,7 +1208,7 @@
 
 bool convertHidlNanEnableRequest_1_2ToLegacy(
     const NanEnableRequest& hidl_request1,
-    const NanConfigRequestSupplemental& hidl_request2,
+    const V1_2::NanConfigRequestSupplemental& hidl_request2,
     legacy_hal::NanEnableRequest* legacy_request) {
     if (!legacy_request) {
         LOG(ERROR)
@@ -1708,7 +1719,7 @@
 
 bool convertHidlNanConfigRequest_1_2ToLegacy(
     const NanConfigRequest& hidl_request1,
-    const NanConfigRequestSupplemental& hidl_request2,
+    const V1_2::NanConfigRequestSupplemental& hidl_request2,
     legacy_hal::NanConfigRequest* legacy_request) {
     if (!legacy_request) {
         LOG(ERROR) << "convertHidlNanConfigRequest_1_2ToLegacy: legacy_request "
@@ -2039,7 +2050,7 @@
 
 bool convertLegacyNdpChannelInfoToHidl(
     const legacy_hal::NanChannelInfo& legacy_struct,
-    NanDataPathChannelInfo* hidl_struct) {
+    V1_2::NanDataPathChannelInfo* hidl_struct) {
     if (!hidl_struct) {
         LOG(ERROR) << "convertLegacyNdpChannelInfoToHidl: hidl_struct is null";
         return false;
@@ -2056,7 +2067,7 @@
 
 bool convertLegacyNanDataPathConfirmIndToHidl(
     const legacy_hal::NanDataPathConfirmInd& legacy_ind,
-    NanDataPathConfirmInd* hidl_ind) {
+    V1_2::NanDataPathConfirmInd* hidl_ind) {
     if (!hidl_ind) {
         LOG(ERROR)
             << "convertLegacyNanDataPathConfirmIndToHidl: hidl_ind is null";
@@ -2077,9 +2088,9 @@
         convertLegacyNanStatusTypeToHidl(legacy_ind.reason_code);
     hidl_ind->V1_0.status.description = "";  // TODO: b/34059183
 
-    std::vector<NanDataPathChannelInfo> channelInfo;
+    std::vector<V1_2::NanDataPathChannelInfo> channelInfo;
     for (unsigned int i = 0; i < legacy_ind.num_channels; ++i) {
-        NanDataPathChannelInfo hidl_struct;
+        V1_2::NanDataPathChannelInfo hidl_struct;
         if (!convertLegacyNdpChannelInfoToHidl(legacy_ind.channel_info[i],
                                                &hidl_struct)) {
             return false;
@@ -2093,7 +2104,7 @@
 
 bool convertLegacyNanDataPathScheduleUpdateIndToHidl(
     const legacy_hal::NanDataPathScheduleUpdateInd& legacy_ind,
-    NanDataPathScheduleUpdateInd* hidl_ind) {
+    V1_2::NanDataPathScheduleUpdateInd* hidl_ind) {
     if (!hidl_ind) {
         LOG(ERROR) << "convertLegacyNanDataPathScheduleUpdateIndToHidl: "
                       "hidl_ind is null";
@@ -2103,9 +2114,9 @@
 
     hidl_ind->peerDiscoveryAddress =
         hidl_array<uint8_t, 6>(legacy_ind.peer_mac_addr);
-    std::vector<NanDataPathChannelInfo> channelInfo;
+    std::vector<V1_2::NanDataPathChannelInfo> channelInfo;
     for (unsigned int i = 0; i < legacy_ind.num_channels; ++i) {
-        NanDataPathChannelInfo hidl_struct;
+        V1_2::NanDataPathChannelInfo hidl_struct;
         if (!convertLegacyNdpChannelInfoToHidl(legacy_ind.channel_info[i],
                                                &hidl_struct)) {
             return false;
@@ -2616,7 +2627,7 @@
 }
 }  // namespace hidl_struct_util
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/hidl_struct_util.h b/wifi/1.3/default/hidl_struct_util.h
similarity index 94%
rename from wifi/1.2/default/hidl_struct_util.h
rename to wifi/1.3/default/hidl_struct_util.h
index 3c789c0..8df484d 100644
--- a/wifi/1.2/default/hidl_struct_util.h
+++ b/wifi/1.3/default/hidl_struct_util.h
@@ -24,6 +24,7 @@
 #include <android/hardware/wifi/1.2/IWifiChip.h>
 #include <android/hardware/wifi/1.2/IWifiChipEventCallback.h>
 #include <android/hardware/wifi/1.2/types.h>
+#include <android/hardware/wifi/1.3/types.h>
 
 #include "wifi_legacy_hal.h"
 
@@ -36,7 +37,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace hidl_struct_util {
 using namespace android::hardware::wifi::V1_0;
@@ -57,10 +58,11 @@
 legacy_hal::wifi_power_scenario convertHidlTxPowerScenarioToLegacy(
     V1_1::IWifiChip::TxPowerScenario hidl_scenario);
 legacy_hal::wifi_power_scenario convertHidlTxPowerScenarioToLegacy_1_2(
-    IWifiChip::TxPowerScenario hidl_scenario);
+    V1_2::IWifiChip::TxPowerScenario hidl_scenario);
 bool convertLegacyWifiMacInfosToHidl(
     const std::vector<legacy_hal::WifiMacInfo>& legacy_mac_infos,
-    std::vector<IWifiChipEventCallback::RadioModeInfo>* hidl_radio_mode_infos);
+    std::vector<V1_2::IWifiChipEventCallback::RadioModeInfo>*
+        hidl_radio_mode_infos);
 
 // STA iface conversion methods.
 bool convertLegacyFeaturesToHidlStaCapabilities(
@@ -88,7 +90,7 @@
     std::vector<StaScanData>* hidl_scan_datas);
 bool convertLegacyLinkLayerStatsToHidl(
     const legacy_hal::LinkLayerStats& legacy_stats,
-    StaLinkLayerStats* hidl_stats);
+    V1_3::StaLinkLayerStats* hidl_stats);
 bool convertLegacyRoamingCapabilitiesToHidl(
     const legacy_hal::wifi_roaming_capabilities& legacy_caps,
     StaRoamingCapabilities* hidl_caps);
@@ -115,11 +117,11 @@
     legacy_hal::NanConfigRequest* legacy_request);
 bool convertHidlNanEnableRequest_1_2ToLegacy(
     const NanEnableRequest& hidl_request1,
-    const NanConfigRequestSupplemental& hidl_request2,
+    const V1_2::NanConfigRequestSupplemental& hidl_request2,
     legacy_hal::NanEnableRequest* legacy_request);
 bool convertHidlNanConfigRequest_1_2ToLegacy(
     const NanConfigRequest& hidl_request1,
-    const NanConfigRequestSupplemental& hidl_request2,
+    const V1_2::NanConfigRequestSupplemental& hidl_request2,
     legacy_hal::NanConfigRequest* legacy_request);
 bool convertHidlNanPublishRequestToLegacy(
     const NanPublishRequest& hidl_request,
@@ -152,10 +154,10 @@
     NanDataPathRequestInd* hidl_ind);
 bool convertLegacyNanDataPathConfirmIndToHidl(
     const legacy_hal::NanDataPathConfirmInd& legacy_ind,
-    NanDataPathConfirmInd* hidl_ind);
+    V1_2::NanDataPathConfirmInd* hidl_ind);
 bool convertLegacyNanDataPathScheduleUpdateIndToHidl(
     const legacy_hal::NanDataPathScheduleUpdateInd& legacy_ind,
-    NanDataPathScheduleUpdateInd* hidl_ind);
+    V1_2::NanDataPathScheduleUpdateInd* hidl_ind);
 
 // RTT controller conversion methods.
 bool convertHidlVectorOfRttConfigToLegacy(
@@ -184,7 +186,7 @@
     std::vector<RttResult>* hidl_results);
 }  // namespace hidl_struct_util
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/hidl_sync_util.cpp b/wifi/1.3/default/hidl_sync_util.cpp
similarity index 96%
rename from wifi/1.2/default/hidl_sync_util.cpp
rename to wifi/1.3/default/hidl_sync_util.cpp
index ad8448a..160727f 100644
--- a/wifi/1.2/default/hidl_sync_util.cpp
+++ b/wifi/1.3/default/hidl_sync_util.cpp
@@ -23,7 +23,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace hidl_sync_util {
 
@@ -33,7 +33,7 @@
 
 }  // namespace hidl_sync_util
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/hidl_sync_util.h b/wifi/1.3/default/hidl_sync_util.h
similarity index 96%
rename from wifi/1.2/default/hidl_sync_util.h
rename to wifi/1.3/default/hidl_sync_util.h
index 8381862..ebfb051 100644
--- a/wifi/1.2/default/hidl_sync_util.h
+++ b/wifi/1.3/default/hidl_sync_util.h
@@ -24,13 +24,13 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace hidl_sync_util {
 std::unique_lock<std::recursive_mutex> acquireGlobalLock();
 }  // namespace hidl_sync_util
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/ringbuffer.cpp b/wifi/1.3/default/ringbuffer.cpp
similarity index 97%
rename from wifi/1.2/default/ringbuffer.cpp
rename to wifi/1.3/default/ringbuffer.cpp
index c126b36..1294c52 100644
--- a/wifi/1.2/default/ringbuffer.cpp
+++ b/wifi/1.3/default/ringbuffer.cpp
@@ -21,7 +21,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 
 Ringbuffer::Ringbuffer(size_t maxSize) : size_(0), maxSize_(maxSize) {}
@@ -48,7 +48,7 @@
 }
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/ringbuffer.h b/wifi/1.3/default/ringbuffer.h
similarity index 97%
rename from wifi/1.2/default/ringbuffer.h
rename to wifi/1.3/default/ringbuffer.h
index 4808e40..d9f8df6 100644
--- a/wifi/1.2/default/ringbuffer.h
+++ b/wifi/1.3/default/ringbuffer.h
@@ -23,7 +23,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 
 /**
@@ -45,7 +45,7 @@
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/service.cpp b/wifi/1.3/default/service.cpp
similarity index 83%
rename from wifi/1.2/default/service.cpp
rename to wifi/1.3/default/service.cpp
index 01d22bd..5fd83c1 100644
--- a/wifi/1.2/default/service.cpp
+++ b/wifi/1.3/default/service.cpp
@@ -26,10 +26,10 @@
 
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
-using android::hardware::wifi::V1_2::implementation::feature_flags::
+using android::hardware::wifi::V1_3::implementation::feature_flags::
     WifiFeatureFlags;
-using android::hardware::wifi::V1_2::implementation::legacy_hal::WifiLegacyHal;
-using android::hardware::wifi::V1_2::implementation::mode_controller::
+using android::hardware::wifi::V1_3::implementation::legacy_hal::WifiLegacyHal;
+using android::hardware::wifi::V1_3::implementation::mode_controller::
     WifiModeController;
 
 int main(int /*argc*/, char** argv) {
@@ -40,8 +40,8 @@
     configureRpcThreadpool(1, true /* callerWillJoin */);
 
     // Setup hwbinder service
-    android::sp<android::hardware::wifi::V1_2::IWifi> service =
-        new android::hardware::wifi::V1_2::implementation::Wifi(
+    android::sp<android::hardware::wifi::V1_3::IWifi> service =
+        new android::hardware::wifi::V1_3::implementation::Wifi(
             std::make_shared<WifiLegacyHal>(),
             std::make_shared<WifiModeController>(),
             std::make_shared<WifiFeatureFlags>());
diff --git a/wifi/1.3/default/tests/hidl_struct_util_unit_tests.cpp b/wifi/1.3/default/tests/hidl_struct_util_unit_tests.cpp
new file mode 100644
index 0000000..d600a2b
--- /dev/null
+++ b/wifi/1.3/default/tests/hidl_struct_util_unit_tests.cpp
@@ -0,0 +1,245 @@
+/*
+ * Copyright (C) 2017, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <android-base/macros.h>
+#include <gmock/gmock.h>
+
+#undef NAN
+#include "hidl_struct_util.h"
+
+using testing::Test;
+
+namespace {
+constexpr uint32_t kMacId1 = 1;
+constexpr uint32_t kMacId2 = 2;
+constexpr uint32_t kIfaceChannel1 = 3;
+constexpr uint32_t kIfaceChannel2 = 5;
+constexpr char kIfaceName1[] = "wlan0";
+constexpr char kIfaceName2[] = "wlan1";
+}  // namespace
+namespace android {
+namespace hardware {
+namespace wifi {
+namespace V1_3 {
+namespace implementation {
+using namespace android::hardware::wifi::V1_0;
+
+class HidlStructUtilTest : public Test {};
+
+TEST_F(HidlStructUtilTest, CanConvertLegacyWifiMacInfosToHidlWithOneMac) {
+    std::vector<legacy_hal::WifiMacInfo> legacy_mac_infos;
+    legacy_hal::WifiMacInfo legacy_mac_info1 = {
+        .wlan_mac_id = kMacId1,
+        .mac_band =
+            legacy_hal::WLAN_MAC_5_0_BAND | legacy_hal::WLAN_MAC_2_4_BAND};
+    legacy_hal::WifiIfaceInfo legacy_iface_info1 = {.name = kIfaceName1,
+                                                    .channel = kIfaceChannel1};
+    legacy_hal::WifiIfaceInfo legacy_iface_info2 = {.name = kIfaceName2,
+                                                    .channel = kIfaceChannel2};
+    legacy_mac_info1.iface_infos.push_back(legacy_iface_info1);
+    legacy_mac_info1.iface_infos.push_back(legacy_iface_info2);
+    legacy_mac_infos.push_back(legacy_mac_info1);
+
+    std::vector<V1_2::IWifiChipEventCallback::RadioModeInfo>
+        hidl_radio_mode_infos;
+    ASSERT_TRUE(hidl_struct_util::convertLegacyWifiMacInfosToHidl(
+        legacy_mac_infos, &hidl_radio_mode_infos));
+
+    ASSERT_EQ(1u, hidl_radio_mode_infos.size());
+    auto hidl_radio_mode_info1 = hidl_radio_mode_infos[0];
+    EXPECT_EQ(legacy_mac_info1.wlan_mac_id, hidl_radio_mode_info1.radioId);
+    EXPECT_EQ(WifiBand::BAND_24GHZ_5GHZ, hidl_radio_mode_info1.bandInfo);
+    ASSERT_EQ(2u, hidl_radio_mode_info1.ifaceInfos.size());
+    auto hidl_iface_info1 = hidl_radio_mode_info1.ifaceInfos[0];
+    EXPECT_EQ(legacy_iface_info1.name, hidl_iface_info1.name);
+    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info1.channel),
+              hidl_iface_info1.channel);
+    auto hidl_iface_info2 = hidl_radio_mode_info1.ifaceInfos[1];
+    EXPECT_EQ(legacy_iface_info2.name, hidl_iface_info2.name);
+    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info2.channel),
+              hidl_iface_info2.channel);
+}
+
+TEST_F(HidlStructUtilTest, CanConvertLegacyWifiMacInfosToHidlWithTwoMac) {
+    std::vector<legacy_hal::WifiMacInfo> legacy_mac_infos;
+    legacy_hal::WifiMacInfo legacy_mac_info1 = {
+        .wlan_mac_id = kMacId1, .mac_band = legacy_hal::WLAN_MAC_5_0_BAND};
+    legacy_hal::WifiIfaceInfo legacy_iface_info1 = {.name = kIfaceName1,
+                                                    .channel = kIfaceChannel1};
+    legacy_hal::WifiMacInfo legacy_mac_info2 = {
+        .wlan_mac_id = kMacId2, .mac_band = legacy_hal::WLAN_MAC_2_4_BAND};
+    legacy_hal::WifiIfaceInfo legacy_iface_info2 = {.name = kIfaceName2,
+                                                    .channel = kIfaceChannel2};
+    legacy_mac_info1.iface_infos.push_back(legacy_iface_info1);
+    legacy_mac_infos.push_back(legacy_mac_info1);
+    legacy_mac_info2.iface_infos.push_back(legacy_iface_info2);
+    legacy_mac_infos.push_back(legacy_mac_info2);
+
+    std::vector<V1_2::IWifiChipEventCallback::RadioModeInfo>
+        hidl_radio_mode_infos;
+    ASSERT_TRUE(hidl_struct_util::convertLegacyWifiMacInfosToHidl(
+        legacy_mac_infos, &hidl_radio_mode_infos));
+
+    ASSERT_EQ(2u, hidl_radio_mode_infos.size());
+
+    // Find mac info 1.
+    const auto hidl_radio_mode_info1 =
+        std::find_if(hidl_radio_mode_infos.begin(), hidl_radio_mode_infos.end(),
+                     [&legacy_mac_info1](
+                         const V1_2::IWifiChipEventCallback::RadioModeInfo& x) {
+                         return x.radioId == legacy_mac_info1.wlan_mac_id;
+                     });
+    ASSERT_NE(hidl_radio_mode_infos.end(), hidl_radio_mode_info1);
+    EXPECT_EQ(WifiBand::BAND_5GHZ, hidl_radio_mode_info1->bandInfo);
+    ASSERT_EQ(1u, hidl_radio_mode_info1->ifaceInfos.size());
+    auto hidl_iface_info1 = hidl_radio_mode_info1->ifaceInfos[0];
+    EXPECT_EQ(legacy_iface_info1.name, hidl_iface_info1.name);
+    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info1.channel),
+              hidl_iface_info1.channel);
+
+    // Find mac info 2.
+    const auto hidl_radio_mode_info2 =
+        std::find_if(hidl_radio_mode_infos.begin(), hidl_radio_mode_infos.end(),
+                     [&legacy_mac_info2](
+                         const V1_2::IWifiChipEventCallback::RadioModeInfo& x) {
+                         return x.radioId == legacy_mac_info2.wlan_mac_id;
+                     });
+    ASSERT_NE(hidl_radio_mode_infos.end(), hidl_radio_mode_info2);
+    EXPECT_EQ(WifiBand::BAND_24GHZ, hidl_radio_mode_info2->bandInfo);
+    ASSERT_EQ(1u, hidl_radio_mode_info2->ifaceInfos.size());
+    auto hidl_iface_info2 = hidl_radio_mode_info2->ifaceInfos[0];
+    EXPECT_EQ(legacy_iface_info2.name, hidl_iface_info2.name);
+    EXPECT_EQ(static_cast<uint32_t>(legacy_iface_info2.channel),
+              hidl_iface_info2.channel);
+}
+
+TEST_F(HidlStructUtilTest, canConvertLegacyLinkLayerStatsToHidl) {
+    legacy_hal::LinkLayerStats legacy_stats{};
+    legacy_stats.radios.push_back(legacy_hal::LinkLayerRadioStats{});
+    legacy_stats.radios.push_back(legacy_hal::LinkLayerRadioStats{});
+    legacy_stats.iface.beacon_rx = rand();
+    legacy_stats.iface.rssi_mgmt = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].rx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].tx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].mpdu_lost = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].retries = rand();
+
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].rx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].tx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].mpdu_lost = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].retries = rand();
+
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].rx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].tx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].mpdu_lost = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].retries = rand();
+
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].rx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].tx_mpdu = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].mpdu_lost = rand();
+    legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].retries = rand();
+
+    for (auto& radio : legacy_stats.radios) {
+        radio.stats.on_time = rand();
+        radio.stats.tx_time = rand();
+        radio.stats.rx_time = rand();
+        radio.stats.on_time_scan = rand();
+        radio.stats.on_time_nbd = rand();
+        radio.stats.on_time_gscan = rand();
+        radio.stats.on_time_roam_scan = rand();
+        radio.stats.on_time_pno_scan = rand();
+        radio.stats.on_time_hs20 = rand();
+        for (int i = 0; i < 4; i++) {
+            radio.tx_time_per_levels.push_back(rand());
+        }
+    }
+
+    V1_3::StaLinkLayerStats converted{};
+    hidl_struct_util::convertLegacyLinkLayerStatsToHidl(legacy_stats,
+                                                        &converted);
+    EXPECT_EQ(legacy_stats.iface.beacon_rx, converted.iface.beaconRx);
+    EXPECT_EQ(legacy_stats.iface.rssi_mgmt, converted.iface.avgRssiMgmt);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].rx_mpdu,
+              converted.iface.wmeBePktStats.rxMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].tx_mpdu,
+              converted.iface.wmeBePktStats.txMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].mpdu_lost,
+              converted.iface.wmeBePktStats.lostMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BE].retries,
+              converted.iface.wmeBePktStats.retries);
+
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].rx_mpdu,
+              converted.iface.wmeBkPktStats.rxMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].tx_mpdu,
+              converted.iface.wmeBkPktStats.txMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].mpdu_lost,
+              converted.iface.wmeBkPktStats.lostMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_BK].retries,
+              converted.iface.wmeBkPktStats.retries);
+
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].rx_mpdu,
+              converted.iface.wmeViPktStats.rxMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].tx_mpdu,
+              converted.iface.wmeViPktStats.txMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].mpdu_lost,
+              converted.iface.wmeViPktStats.lostMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VI].retries,
+              converted.iface.wmeViPktStats.retries);
+
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].rx_mpdu,
+              converted.iface.wmeVoPktStats.rxMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].tx_mpdu,
+              converted.iface.wmeVoPktStats.txMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].mpdu_lost,
+              converted.iface.wmeVoPktStats.lostMpdu);
+    EXPECT_EQ(legacy_stats.iface.ac[legacy_hal::WIFI_AC_VO].retries,
+              converted.iface.wmeVoPktStats.retries);
+
+    EXPECT_EQ(legacy_stats.radios.size(), converted.radios.size());
+    for (int i = 0; i < legacy_stats.radios.size(); i++) {
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time,
+                  converted.radios[i].V1_0.onTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.tx_time,
+                  converted.radios[i].V1_0.txTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.rx_time,
+                  converted.radios[i].V1_0.rxTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time_scan,
+                  converted.radios[i].V1_0.onTimeInMsForScan);
+        EXPECT_EQ(legacy_stats.radios[i].tx_time_per_levels.size(),
+                  converted.radios[i].V1_0.txTimeInMsPerLevel.size());
+        for (int j = 0; j < legacy_stats.radios[i].tx_time_per_levels.size();
+             j++) {
+            EXPECT_EQ(legacy_stats.radios[i].tx_time_per_levels[j],
+                      converted.radios[i].V1_0.txTimeInMsPerLevel[j]);
+        }
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time_nbd,
+                  converted.radios[i].onTimeInMsForNanScan);
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time_gscan,
+                  converted.radios[i].onTimeInMsForBgScan);
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time_roam_scan,
+                  converted.radios[i].onTimeInMsForRoamScan);
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time_pno_scan,
+                  converted.radios[i].onTimeInMsForPnoScan);
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time_hs20,
+                  converted.radios[i].onTimeInMsForHs20Scan);
+    }
+}
+}  // namespace implementation
+}  // namespace V1_3
+}  // namespace wifi
+}  // namespace hardware
+}  // namespace android
diff --git a/wifi/1.2/default/tests/main.cpp b/wifi/1.3/default/tests/main.cpp
similarity index 100%
rename from wifi/1.2/default/tests/main.cpp
rename to wifi/1.3/default/tests/main.cpp
diff --git a/wifi/1.2/default/tests/mock_wifi_feature_flags.cpp b/wifi/1.3/default/tests/mock_wifi_feature_flags.cpp
similarity index 96%
rename from wifi/1.2/default/tests/mock_wifi_feature_flags.cpp
rename to wifi/1.3/default/tests/mock_wifi_feature_flags.cpp
index 8d0b192..a393fdc 100644
--- a/wifi/1.2/default/tests/mock_wifi_feature_flags.cpp
+++ b/wifi/1.3/default/tests/mock_wifi_feature_flags.cpp
@@ -21,7 +21,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace feature_flags {
 
@@ -29,7 +29,7 @@
 
 }  // namespace feature_flags
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/tests/mock_wifi_feature_flags.h b/wifi/1.3/default/tests/mock_wifi_feature_flags.h
similarity index 96%
rename from wifi/1.2/default/tests/mock_wifi_feature_flags.h
rename to wifi/1.3/default/tests/mock_wifi_feature_flags.h
index 2a36dd5..86c50a7 100644
--- a/wifi/1.2/default/tests/mock_wifi_feature_flags.h
+++ b/wifi/1.3/default/tests/mock_wifi_feature_flags.h
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace feature_flags {
 
@@ -39,7 +39,7 @@
 
 }  // namespace feature_flags
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/tests/mock_wifi_legacy_hal.cpp b/wifi/1.3/default/tests/mock_wifi_legacy_hal.cpp
similarity index 96%
rename from wifi/1.2/default/tests/mock_wifi_legacy_hal.cpp
rename to wifi/1.3/default/tests/mock_wifi_legacy_hal.cpp
index 8381dde..4cd279d 100644
--- a/wifi/1.2/default/tests/mock_wifi_legacy_hal.cpp
+++ b/wifi/1.3/default/tests/mock_wifi_legacy_hal.cpp
@@ -24,14 +24,14 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace legacy_hal {
 
 MockWifiLegacyHal::MockWifiLegacyHal() : WifiLegacyHal() {}
 }  // namespace legacy_hal
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/tests/mock_wifi_legacy_hal.h b/wifi/1.3/default/tests/mock_wifi_legacy_hal.h
similarity index 97%
rename from wifi/1.2/default/tests/mock_wifi_legacy_hal.h
rename to wifi/1.3/default/tests/mock_wifi_legacy_hal.h
index 43370b4..deb3a5a 100644
--- a/wifi/1.2/default/tests/mock_wifi_legacy_hal.h
+++ b/wifi/1.3/default/tests/mock_wifi_legacy_hal.h
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace legacy_hal {
 
@@ -49,7 +49,7 @@
 };
 }  // namespace legacy_hal
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/tests/mock_wifi_mode_controller.cpp b/wifi/1.3/default/tests/mock_wifi_mode_controller.cpp
similarity index 96%
rename from wifi/1.2/default/tests/mock_wifi_mode_controller.cpp
rename to wifi/1.3/default/tests/mock_wifi_mode_controller.cpp
index 461a581..2b0ea36 100644
--- a/wifi/1.2/default/tests/mock_wifi_mode_controller.cpp
+++ b/wifi/1.3/default/tests/mock_wifi_mode_controller.cpp
@@ -24,14 +24,14 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace mode_controller {
 
 MockWifiModeController::MockWifiModeController() : WifiModeController() {}
 }  // namespace mode_controller
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/tests/mock_wifi_mode_controller.h b/wifi/1.3/default/tests/mock_wifi_mode_controller.h
similarity index 97%
rename from wifi/1.2/default/tests/mock_wifi_mode_controller.h
rename to wifi/1.3/default/tests/mock_wifi_mode_controller.h
index 50c3e35..c204059 100644
--- a/wifi/1.2/default/tests/mock_wifi_mode_controller.h
+++ b/wifi/1.3/default/tests/mock_wifi_mode_controller.h
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace mode_controller {
 
@@ -38,7 +38,7 @@
 };
 }  // namespace mode_controller
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/tests/ringbuffer_unit_tests.cpp b/wifi/1.3/default/tests/ringbuffer_unit_tests.cpp
similarity index 98%
rename from wifi/1.2/default/tests/ringbuffer_unit_tests.cpp
rename to wifi/1.3/default/tests/ringbuffer_unit_tests.cpp
index ad5289b..0cf1e4f 100644
--- a/wifi/1.2/default/tests/ringbuffer_unit_tests.cpp
+++ b/wifi/1.3/default/tests/ringbuffer_unit_tests.cpp
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 
 class RingbufferTest : public Test {
@@ -91,7 +91,7 @@
     EXPECT_EQ(input, buffer_.getData().front());
 }
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.3/default/tests/runtests.sh b/wifi/1.3/default/tests/runtests.sh
new file mode 100755
index 0000000..6bce3ef
--- /dev/null
+++ b/wifi/1.3/default/tests/runtests.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Copyright(C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0(the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http:// www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ -z $ANDROID_BUILD_TOP ]; then
+  echo "You need to source and lunch before you can use this script"
+  exit 1
+fi
+set -e
+
+$ANDROID_BUILD_TOP/build/soong/soong_ui.bash --make-mode android.hardware.wifi@1.0-service-tests
+adb root
+adb sync data
+adb shell /data/nativetest64/vendor/android.hardware.wifi@1.0-service-tests/android.hardware.wifi@1.0-service-tests
diff --git a/wifi/1.2/default/tests/wifi_chip_unit_tests.cpp b/wifi/1.3/default/tests/wifi_chip_unit_tests.cpp
similarity index 89%
rename from wifi/1.2/default/tests/wifi_chip_unit_tests.cpp
rename to wifi/1.3/default/tests/wifi_chip_unit_tests.cpp
index 8722d0a..61060b5 100644
--- a/wifi/1.2/default/tests/wifi_chip_unit_tests.cpp
+++ b/wifi/1.3/default/tests/wifi_chip_unit_tests.cpp
@@ -38,7 +38,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 
 class WifiChipTest : public Test {
@@ -204,6 +204,19 @@
         }
     }
 
+    bool createRttController() {
+        bool success = false;
+        chip_->createRttController(
+            NULL, [&success](const WifiStatus& status,
+                             const sp<IWifiRttController>& rtt) {
+                if (WifiStatusCode::SUCCESS == status.code) {
+                    ASSERT_NE(rtt.get(), nullptr);
+                    success = true;
+                }
+            });
+        return success;
+    }
+
    public:
     void SetUp() override {
         chip_ = new WifiChip(chip_id_, legacy_hal_, mode_controller_,
@@ -386,6 +399,29 @@
     ASSERT_TRUE(createIface(IfaceType::NAN).empty());
 }
 
+TEST_F(WifiChipV1IfaceCombinationTest, RttControllerFlowStaModeNoSta) {
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_TRUE(createRttController());
+}
+
+TEST_F(WifiChipV1IfaceCombinationTest, RttControllerFlowStaModeWithSta) {
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_TRUE(createRttController());
+}
+
+TEST_F(WifiChipV1IfaceCombinationTest, RttControllerFlowApToSta) {
+    findModeAndConfigureForIfaceType(IfaceType::AP);
+    const auto ap_iface_name = createIface(IfaceType::AP);
+    ASSERT_FALSE(ap_iface_name.empty());
+    ASSERT_FALSE(createRttController());
+
+    removeIface(IfaceType::AP, ap_iface_name);
+
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_TRUE(createRttController());
+}
+
 ////////// V2 + Aware Iface Combinations ////////////
 // Mode 1 - STA + STA/AP
 //        - STA + P2P/NAN
@@ -540,40 +576,58 @@
     ASSERT_NE(sta_iface_name, ap_iface_name);
 }
 
+TEST_F(WifiChipV2_AwareIfaceCombinationTest, RttControllerFlowStaModeNoSta) {
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_TRUE(createRttController());
+}
+
+TEST_F(WifiChipV2_AwareIfaceCombinationTest, RttControllerFlowStaModeWithSta) {
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_TRUE(createRttController());
+}
+
+TEST_F(WifiChipV2_AwareIfaceCombinationTest, RttControllerFlow) {
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_FALSE(createIface(IfaceType::AP).empty());
+    ASSERT_TRUE(createRttController());
+}
+
 ////////// V1 Iface Combinations when AP creation is disabled //////////
 class WifiChipV1_AwareDisabledApIfaceCombinationTest : public WifiChipTest {
- public:
-  void SetUp() override {
-    setupV1_AwareDisabledApIfaceCombination();
-    WifiChipTest::SetUp();
-  }
+   public:
+    void SetUp() override {
+        setupV1_AwareDisabledApIfaceCombination();
+        WifiChipTest::SetUp();
+    }
 };
 
 TEST_F(WifiChipV1_AwareDisabledApIfaceCombinationTest,
        StaMode_CreateSta_ShouldSucceed) {
-  findModeAndConfigureForIfaceType(IfaceType::STA);
-  ASSERT_FALSE(createIface(IfaceType::STA).empty());
-  ASSERT_TRUE(createIface(IfaceType::AP).empty());
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_TRUE(createIface(IfaceType::AP).empty());
 }
 
 ////////// V2 Iface Combinations when AP creation is disabled //////////
-class WifiChipV2_AwareDisabledApIfaceCombinationTest: public WifiChipTest {
- public:
-  void SetUp() override {
-    setupV2_AwareDisabledApIfaceCombination();
-    WifiChipTest::SetUp();
-  }
+class WifiChipV2_AwareDisabledApIfaceCombinationTest : public WifiChipTest {
+   public:
+    void SetUp() override {
+        setupV2_AwareDisabledApIfaceCombination();
+        WifiChipTest::SetUp();
+    }
 };
 
 TEST_F(WifiChipV2_AwareDisabledApIfaceCombinationTest,
        CreateSta_ShouldSucceed) {
-  findModeAndConfigureForIfaceType(IfaceType::STA);
-  ASSERT_FALSE(createIface(IfaceType::STA).empty());
-  ASSERT_TRUE(createIface(IfaceType::AP).empty());
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_TRUE(createIface(IfaceType::AP).empty());
 }
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi.cpp b/wifi/1.3/default/wifi.cpp
similarity index 99%
rename from wifi/1.2/default/wifi.cpp
rename to wifi/1.3/default/wifi.cpp
index 79f921f..e3af1ea 100644
--- a/wifi/1.2/default/wifi.cpp
+++ b/wifi/1.3/default/wifi.cpp
@@ -28,7 +28,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using hidl_return_util::validateAndCall;
 using hidl_return_util::validateAndCallWithLock;
@@ -206,7 +206,7 @@
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi.h b/wifi/1.3/default/wifi.h
similarity index 96%
rename from wifi/1.2/default/wifi.h
rename to wifi/1.3/default/wifi.h
index 86919b1..e921424 100644
--- a/wifi/1.2/default/wifi.h
+++ b/wifi/1.3/default/wifi.h
@@ -20,7 +20,7 @@
 #include <functional>
 
 #include <android-base/macros.h>
-#include <android/hardware/wifi/1.2/IWifi.h>
+#include <android/hardware/wifi/1.3/IWifi.h>
 #include <utils/Looper.h>
 
 #include "hidl_callback_util.h"
@@ -32,13 +32,13 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 
 /**
  * Root HIDL interface object used to control the Wifi HAL.
  */
-class Wifi : public V1_2::IWifi {
+class Wifi : public V1_3::IWifi {
    public:
     Wifi(const std::shared_ptr<legacy_hal::WifiLegacyHal> legacy_hal,
          const std::shared_ptr<mode_controller::WifiModeController>
@@ -88,7 +88,7 @@
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_ap_iface.cpp b/wifi/1.3/default/wifi_ap_iface.cpp
similarity index 98%
rename from wifi/1.2/default/wifi_ap_iface.cpp
rename to wifi/1.3/default/wifi_ap_iface.cpp
index 92b7b48..c203e47 100644
--- a/wifi/1.2/default/wifi_ap_iface.cpp
+++ b/wifi/1.3/default/wifi_ap_iface.cpp
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using hidl_return_util::validateAndCall;
 
@@ -93,7 +93,7 @@
     return {createWifiStatusFromLegacyError(legacy_status), valid_frequencies};
 }
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_ap_iface.h b/wifi/1.3/default/wifi_ap_iface.h
similarity index 98%
rename from wifi/1.2/default/wifi_ap_iface.h
rename to wifi/1.3/default/wifi_ap_iface.h
index 5363ec2..9f3d870 100644
--- a/wifi/1.2/default/wifi_ap_iface.h
+++ b/wifi/1.3/default/wifi_ap_iface.h
@@ -25,7 +25,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 
@@ -65,7 +65,7 @@
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_chip.cpp b/wifi/1.3/default/wifi_chip.cpp
similarity index 96%
rename from wifi/1.2/default/wifi_chip.cpp
rename to wifi/1.3/default/wifi_chip.cpp
index 3bd0557..faf1862 100644
--- a/wifi/1.2/default/wifi_chip.cpp
+++ b/wifi/1.3/default/wifi_chip.cpp
@@ -28,13 +28,13 @@
 #include "wifi_status_util.h"
 
 namespace {
+using android::sp;
 using android::base::unique_fd;
 using android::hardware::hidl_string;
 using android::hardware::hidl_vec;
 using android::hardware::wifi::V1_0::ChipModeId;
 using android::hardware::wifi::V1_0::IfaceType;
 using android::hardware::wifi::V1_0::IWifiChip;
-using android::sp;
 
 constexpr ChipModeId kInvalidModeId = UINT32_MAX;
 // These mode ID's should be unique (even across combo versions). Refer to
@@ -111,16 +111,16 @@
 bool removeOldFilesInternal() {
     time_t now = time(0);
     const time_t delete_files_before = now - kMaxRingBufferFileAgeSeconds;
-    DIR* dir_dump = opendir(kTombstoneFolderPath);
+    std::unique_ptr<DIR, decltype(&closedir)> dir_dump(
+        opendir(kTombstoneFolderPath), closedir);
     if (!dir_dump) {
         LOG(ERROR) << "Failed to open directory: " << strerror(errno);
         return false;
     }
-    unique_fd dir_auto_closer(dirfd(dir_dump));
     struct dirent* dp;
     bool success = true;
     std::list<std::pair<const time_t, std::string>> valid_files;
-    while ((dp = readdir(dir_dump))) {
+    while ((dp = readdir(dir_dump.get()))) {
         if (dp->d_type != DT_REG) {
             continue;
         }
@@ -246,13 +246,13 @@
 size_t cpioArchiveFilesInDir(int out_fd, const char* input_dir) {
     struct dirent* dp;
     size_t n_error = 0;
-    DIR* dir_dump = opendir(input_dir);
+    std::unique_ptr<DIR, decltype(&closedir)> dir_dump(opendir(input_dir),
+                                                       closedir);
     if (!dir_dump) {
         LOG(ERROR) << "Failed to open directory: " << strerror(errno);
         return ++n_error;
     }
-    unique_fd dir_auto_closer(dirfd(dir_dump));
-    while ((dp = readdir(dir_dump))) {
+    while ((dp = readdir(dir_dump.get()))) {
         if (dp->d_type != DT_REG) {
             continue;
         }
@@ -304,7 +304,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using hidl_return_util::validateAndCall;
 using hidl_return_util::validateAndCallWithLock;
@@ -335,7 +335,7 @@
 
 bool WifiChip::isValid() { return is_valid_; }
 
-std::set<sp<IWifiChipEventCallback>> WifiChip::getEventCallbacks() {
+std::set<sp<V1_2::IWifiChipEventCallback>> WifiChip::getEventCallbacks() {
     return event_cb_handler_.getCallbacks();
 }
 
@@ -344,6 +344,7 @@
                            &WifiChip::getIdInternal, hidl_status_cb);
 }
 
+// Deprecated support for this callback
 Return<void> WifiChip::registerEventCallback(
     const sp<V1_0::IWifiChipEventCallback>& event_callback,
     registerEventCallback_cb hidl_status_cb) {
@@ -546,7 +547,8 @@
 }
 
 Return<void> WifiChip::selectTxPowerScenario(
-    V1_1::IWifiChip::TxPowerScenario scenario, selectTxPowerScenario_cb hidl_status_cb) {
+    V1_1::IWifiChip::TxPowerScenario scenario,
+    selectTxPowerScenario_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
                            &WifiChip::selectTxPowerScenarioInternal,
                            hidl_status_cb, scenario);
@@ -560,7 +562,7 @@
 }
 
 Return<void> WifiChip::registerEventCallback_1_2(
-    const sp<IWifiChipEventCallback>& event_callback,
+    const sp<V1_2::IWifiChipEventCallback>& event_callback,
     registerEventCallback_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
                            &WifiChip::registerEventCallbackInternal_1_2,
@@ -568,9 +570,10 @@
 }
 
 Return<void> WifiChip::selectTxPowerScenario_1_2(
-        TxPowerScenario scenario, selectTxPowerScenario_cb hidl_status_cb) {
+    TxPowerScenario scenario, selectTxPowerScenario_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
-            &WifiChip::selectTxPowerScenarioInternal_1_2, hidl_status_cb, scenario);
+                           &WifiChip::selectTxPowerScenarioInternal_1_2,
+                           hidl_status_cb, scenario);
 }
 
 Return<void> WifiChip::debug(const hidl_handle& handle,
@@ -927,6 +930,12 @@
 
 std::pair<WifiStatus, sp<IWifiRttController>>
 WifiChip::createRttControllerInternal(const sp<IWifiIface>& bound_iface) {
+    if (sta_ifaces_.size() == 0 &&
+        !canCurrentModeSupportIfaceOfType(IfaceType::STA)) {
+        LOG(ERROR) << "createRttControllerInternal: Chip cannot support STAs "
+                      "(and RTT by extension)";
+        return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
+    }
     sp<WifiRttController> rtt =
         new WifiRttController(getWlan0IfaceName(), bound_iface, legacy_hal_);
     rtt_controllers_.emplace_back(rtt);
@@ -1036,7 +1045,7 @@
 }
 
 WifiStatus WifiChip::selectTxPowerScenarioInternal(
-        V1_1::IWifiChip::TxPowerScenario scenario) {
+    V1_1::IWifiChip::TxPowerScenario scenario) {
     auto legacy_status = legacy_hal_.lock()->selectTxPowerScenario(
         getWlan0IfaceName(),
         hidl_struct_util::convertHidlTxPowerScenarioToLegacy(scenario));
@@ -1050,14 +1059,15 @@
 }
 
 WifiStatus WifiChip::registerEventCallbackInternal_1_2(
-    const sp<IWifiChipEventCallback>& event_callback) {
+    const sp<V1_2::IWifiChipEventCallback>& event_callback) {
     if (!event_cb_handler_.addCallback(event_callback)) {
         return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
     }
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
-WifiStatus WifiChip::selectTxPowerScenarioInternal_1_2(TxPowerScenario scenario) {
+WifiStatus WifiChip::selectTxPowerScenarioInternal_1_2(
+    TxPowerScenario scenario) {
     auto legacy_status = legacy_hal_.lock()->selectTxPowerScenario(
         getWlan0IfaceName(),
         hidl_struct_util::convertHidlTxPowerScenarioToLegacy_1_2(scenario));
@@ -1156,7 +1166,7 @@
                 LOG(ERROR) << "Callback invoked on an invalid object";
                 return;
             }
-            std::vector<IWifiChipEventCallback::RadioModeInfo>
+            std::vector<V1_2::IWifiChipEventCallback::RadioModeInfo>
                 hidl_radio_mode_infos;
             if (!hidl_struct_util::convertLegacyWifiMacInfosToHidl(
                     mac_infos, &hidl_radio_mode_infos)) {
@@ -1212,15 +1222,14 @@
         const IWifiChip::ChipIfaceCombination chip_iface_combination_2 = {
             {chip_iface_combination_limit_1, chip_iface_combination_limit_3}};
         if (feature_flags_.lock()->isApDisabled()) {
-          const IWifiChip::ChipMode chip_mode = {
-              kV2ChipModeId,
-              {chip_iface_combination_2}};
-          modes_ = {chip_mode};
+            const IWifiChip::ChipMode chip_mode = {kV2ChipModeId,
+                                                   {chip_iface_combination_2}};
+            modes_ = {chip_mode};
         } else {
-          const IWifiChip::ChipMode chip_mode = {
-            kV2ChipModeId,
-            {chip_iface_combination_1, chip_iface_combination_2}};
-          modes_ = {chip_mode};
+            const IWifiChip::ChipMode chip_mode = {
+                kV2ChipModeId,
+                {chip_iface_combination_1, chip_iface_combination_2}};
+            modes_ = {chip_mode};
         }
     } else {
         // V1 Iface combinations for Mode Id = 0. (STA Mode)
@@ -1246,9 +1255,9 @@
         const IWifiChip::ChipMode ap_chip_mode = {kV1ApChipModeId,
                                                   {ap_chip_iface_combination}};
         if (feature_flags_.lock()->isApDisabled()) {
-          modes_ = {sta_chip_mode};
+            modes_ = {sta_chip_mode};
         } else {
-          modes_ = {sta_chip_mode, ap_chip_mode};
+            modes_ = {sta_chip_mode, ap_chip_mode};
         }
     }
 }
@@ -1415,7 +1424,7 @@
 }
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_chip.h b/wifi/1.3/default/wifi_chip.h
similarity index 95%
rename from wifi/1.2/default/wifi_chip.h
rename to wifi/1.3/default/wifi_chip.h
index ada9458..ba60a8e 100644
--- a/wifi/1.2/default/wifi_chip.h
+++ b/wifi/1.3/default/wifi_chip.h
@@ -37,7 +37,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 
@@ -69,10 +69,11 @@
     // marked valid before processing them.
     void invalidate();
     bool isValid();
-    std::set<sp<IWifiChipEventCallback>> getEventCallbacks();
+    std::set<sp<V1_2::IWifiChipEventCallback>> getEventCallbacks();
 
     // HIDL methods exposed.
     Return<void> getId(getId_cb hidl_status_cb) override;
+    // Deprecated support for this callback
     Return<void> registerEventCallback(
         const sp<V1_0::IWifiChipEventCallback>& event_callback,
         registerEventCallback_cb hidl_status_cb) override;
@@ -137,18 +138,20 @@
     Return<void> resetTxPowerScenario(
         resetTxPowerScenario_cb hidl_status_cb) override;
     Return<void> registerEventCallback_1_2(
-        const sp<IWifiChipEventCallback>& event_callback,
+        const sp<V1_2::IWifiChipEventCallback>& event_callback,
         registerEventCallback_1_2_cb hidl_status_cb) override;
     Return<void> selectTxPowerScenario_1_2(
         TxPowerScenario scenario,
         selectTxPowerScenario_cb hidl_status_cb) override;
     Return<void> debug(const hidl_handle& handle,
                        const hidl_vec<hidl_string>& options) override;
+
    private:
     void invalidateAndRemoveAllIfaces();
 
     // Corresponding worker functions for the HIDL methods.
     std::pair<WifiStatus, ChipId> getIdInternal();
+    // Deprecated support for this callback
     WifiStatus registerEventCallbackInternal(
         const sp<V1_0::IWifiChipEventCallback>& event_callback);
     std::pair<WifiStatus, uint32_t> getCapabilitiesInternal();
@@ -195,10 +198,11 @@
     std::pair<WifiStatus, WifiDebugHostWakeReasonStats>
     getDebugHostWakeReasonStatsInternal();
     WifiStatus enableDebugErrorAlertsInternal(bool enable);
-    WifiStatus selectTxPowerScenarioInternal(V1_1::IWifiChip::TxPowerScenario scenario);
+    WifiStatus selectTxPowerScenarioInternal(
+        V1_1::IWifiChip::TxPowerScenario scenario);
     WifiStatus resetTxPowerScenarioInternal();
     WifiStatus registerEventCallbackInternal_1_2(
-        const sp<IWifiChipEventCallback>& event_callback);
+        const sp<V1_2::IWifiChipEventCallback>& event_callback);
     WifiStatus selectTxPowerScenarioInternal_1_2(TxPowerScenario scenario);
     WifiStatus handleChipConfiguration(
         std::unique_lock<std::recursive_mutex>* lock, ChipModeId mode_id);
@@ -236,14 +240,14 @@
     // registration mechanism. Use this to check if we have already
     // registered a callback.
     bool debug_ring_buffer_cb_registered_;
-    hidl_callback_util::HidlCallbackHandler<IWifiChipEventCallback>
+    hidl_callback_util::HidlCallbackHandler<V1_2::IWifiChipEventCallback>
         event_cb_handler_;
 
     DISALLOW_COPY_AND_ASSIGN(WifiChip);
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_feature_flags.cpp b/wifi/1.3/default/wifi_feature_flags.cpp
similarity index 93%
rename from wifi/1.2/default/wifi_feature_flags.cpp
rename to wifi/1.3/default/wifi_feature_flags.cpp
index 778944d..8d48c36 100644
--- a/wifi/1.2/default/wifi_feature_flags.cpp
+++ b/wifi/1.3/default/wifi_feature_flags.cpp
@@ -38,7 +38,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace feature_flags {
 
@@ -47,13 +47,11 @@
 bool WifiFeatureFlags::isDualInterfaceSupported() {
     return wifiHidlFeatureDualInterface;
 }
-bool WifiFeatureFlags::isApDisabled() {
-  return wifiHidlFeatureDisableAp;
-}
+bool WifiFeatureFlags::isApDisabled() { return wifiHidlFeatureDisableAp; }
 
 }  // namespace feature_flags
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_feature_flags.h b/wifi/1.3/default/wifi_feature_flags.h
similarity index 96%
rename from wifi/1.2/default/wifi_feature_flags.h
rename to wifi/1.3/default/wifi_feature_flags.h
index 4a7b2d2..ce74e23 100644
--- a/wifi/1.2/default/wifi_feature_flags.h
+++ b/wifi/1.3/default/wifi_feature_flags.h
@@ -20,7 +20,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace feature_flags {
 
@@ -36,7 +36,7 @@
 
 }  // namespace feature_flags
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_legacy_hal.cpp b/wifi/1.3/default/wifi_legacy_hal.cpp
similarity index 99%
rename from wifi/1.2/default/wifi_legacy_hal.cpp
rename to wifi/1.3/default/wifi_legacy_hal.cpp
index 375204c..817c860 100644
--- a/wifi/1.2/default/wifi_legacy_hal.cpp
+++ b/wifi/1.3/default/wifi_legacy_hal.cpp
@@ -18,6 +18,7 @@
 #include <chrono>
 
 #include <android-base/logging.h>
+#include <cutils/properties.h>
 
 #include "hidl_sync_util.h"
 #include "wifi_legacy_hal.h"
@@ -35,6 +36,7 @@
 static constexpr uint32_t kMaxWakeReasonStatsArraySize = 32;
 static constexpr uint32_t kMaxRingBuffers = 10;
 static constexpr uint32_t kMaxStopCompleteWaitMs = 100;
+static constexpr char kDriverPropName[] = "wlan.driver.status";
 
 // Helper function to create a non-const char* for legacy Hal API's.
 std::vector<char> makeCharVec(const std::string& str) {
@@ -48,7 +50,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace legacy_hal {
 // Legacy HAL functions accept "C" style function pointers, so use global
@@ -366,6 +368,8 @@
         LOG(ERROR) << "Timed out awaiting driver ready";
         return status;
     }
+    property_set(kDriverPropName, "ok");
+
     LOG(DEBUG) << "Starting legacy HAL";
     if (!iface_tool_.SetWifiUpState(true)) {
         LOG(ERROR) << "Failed to set WiFi interface up";
@@ -1417,7 +1421,7 @@
 
 }  // namespace legacy_hal
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_legacy_hal.h b/wifi/1.3/default/wifi_legacy_hal.h
similarity index 98%
rename from wifi/1.2/default/wifi_legacy_hal.h
rename to wifi/1.3/default/wifi_legacy_hal.h
index 00dfeef..af654fa 100644
--- a/wifi/1.2/default/wifi_legacy_hal.h
+++ b/wifi/1.3/default/wifi_legacy_hal.h
@@ -27,14 +27,15 @@
 
 // HACK: The include inside the namespace below also transitively includes a
 // bunch of libc headers into the namespace, which leads to functions like
-// socketpair being defined in android::hardware::wifi::V1_1::implementation::legacy_hal.
-// Include this one particular header as a hacky workaround until that's fixed.
+// socketpair being defined in
+// android::hardware::wifi::V1_1::implementation::legacy_hal. Include this one
+// particular header as a hacky workaround until that's fixed.
 #include <sys/socket.h>
 
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 // This is in a separate namespace to prevent typename conflicts between
 // the legacy HAL types and the HIDL interface types.
@@ -106,7 +107,8 @@
         on_event_transmit_follow_up;
     std::function<void(const NanRangeRequestInd&)> on_event_range_request;
     std::function<void(const NanRangeReportInd&)> on_event_range_report;
-    std::function<void(const NanDataPathScheduleUpdateInd&)> on_event_schedule_update;
+    std::function<void(const NanDataPathScheduleUpdateInd&)>
+        on_event_schedule_update;
 };
 
 // Full scan results contain IE info and are hence passed by reference, to
@@ -389,7 +391,7 @@
 
 }  // namespace legacy_hal
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_legacy_hal_stubs.cpp b/wifi/1.3/default/wifi_legacy_hal_stubs.cpp
similarity index 99%
rename from wifi/1.2/default/wifi_legacy_hal_stubs.cpp
rename to wifi/1.3/default/wifi_legacy_hal_stubs.cpp
index fc28bb5..942df2a 100644
--- a/wifi/1.2/default/wifi_legacy_hal_stubs.cpp
+++ b/wifi/1.3/default/wifi_legacy_hal_stubs.cpp
@@ -20,7 +20,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace legacy_hal {
 template <typename>
@@ -141,7 +141,7 @@
 }
 }  // namespace legacy_hal
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_legacy_hal_stubs.h b/wifi/1.3/default/wifi_legacy_hal_stubs.h
similarity index 96%
rename from wifi/1.2/default/wifi_legacy_hal_stubs.h
rename to wifi/1.3/default/wifi_legacy_hal_stubs.h
index d560dd4..64854e0 100644
--- a/wifi/1.2/default/wifi_legacy_hal_stubs.h
+++ b/wifi/1.3/default/wifi_legacy_hal_stubs.h
@@ -20,7 +20,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace legacy_hal {
 #include <hardware_legacy/wifi_hal.h>
@@ -28,7 +28,7 @@
 bool initHalFuncTableWithStubs(wifi_hal_fn* hal_fn);
 }  // namespace legacy_hal
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_mode_controller.cpp b/wifi/1.3/default/wifi_mode_controller.cpp
similarity index 98%
rename from wifi/1.2/default/wifi_mode_controller.cpp
rename to wifi/1.3/default/wifi_mode_controller.cpp
index c286d24..c392486 100644
--- a/wifi/1.2/default/wifi_mode_controller.cpp
+++ b/wifi/1.3/default/wifi_mode_controller.cpp
@@ -48,7 +48,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace mode_controller {
 
@@ -85,7 +85,7 @@
 }
 }  // namespace mode_controller
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_mode_controller.h b/wifi/1.3/default/wifi_mode_controller.h
similarity index 97%
rename from wifi/1.2/default/wifi_mode_controller.h
rename to wifi/1.3/default/wifi_mode_controller.h
index 395aa5d..ace5a52 100644
--- a/wifi/1.2/default/wifi_mode_controller.h
+++ b/wifi/1.3/default/wifi_mode_controller.h
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 namespace mode_controller {
 using namespace android::hardware::wifi::V1_0;
@@ -55,7 +55,7 @@
 
 }  // namespace mode_controller
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_nan_iface.cpp b/wifi/1.3/default/wifi_nan_iface.cpp
similarity index 98%
rename from wifi/1.2/default/wifi_nan_iface.cpp
rename to wifi/1.3/default/wifi_nan_iface.cpp
index 566d36e..4325f44 100644
--- a/wifi/1.2/default/wifi_nan_iface.cpp
+++ b/wifi/1.3/default/wifi_nan_iface.cpp
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using hidl_return_util::validateAndCall;
 
@@ -420,7 +420,7 @@
                 LOG(ERROR) << "Callback invoked on an invalid object";
                 return;
             }
-            NanDataPathConfirmInd hidl_struct;
+            V1_2::NanDataPathConfirmInd hidl_struct;
             if (!hidl_struct_util::convertLegacyNanDataPathConfirmIndToHidl(
                     msg, &hidl_struct)) {
                 LOG(ERROR) << "Failed to convert nan capabilities response";
@@ -477,7 +477,7 @@
             LOG(ERROR) << "Callback invoked on an invalid object";
             return;
         }
-        NanDataPathScheduleUpdateInd hidl_struct;
+        V1_2::NanDataPathScheduleUpdateInd hidl_struct;
         if (!hidl_struct_util::convertLegacyNanDataPathScheduleUpdateIndToHidl(
                 msg, &hidl_struct)) {
             LOG(ERROR) << "Failed to convert nan capabilities response";
@@ -655,7 +655,7 @@
 }
 
 Return<void> WifiNanIface::registerEventCallback_1_2(
-    const sp<IWifiNanIfaceEventCallback>& callback,
+    const sp<V1_2::IWifiNanIfaceEventCallback>& callback,
     registerEventCallback_1_2_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::registerEventCallback_1_2Internal,
@@ -664,7 +664,7 @@
 
 Return<void> WifiNanIface::enableRequest_1_2(
     uint16_t cmd_id, const NanEnableRequest& msg1,
-    const NanConfigRequestSupplemental& msg2,
+    const V1_2::NanConfigRequestSupplemental& msg2,
     enableRequest_1_2_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::enableRequest_1_2Internal,
@@ -673,7 +673,7 @@
 
 Return<void> WifiNanIface::configRequest_1_2(
     uint16_t cmd_id, const NanConfigRequest& msg1,
-    const NanConfigRequestSupplemental& msg2,
+    const V1_2::NanConfigRequestSupplemental& msg2,
     configRequest_1_2_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::configRequest_1_2Internal,
@@ -832,7 +832,7 @@
 
 WifiStatus WifiNanIface::enableRequest_1_2Internal(
     uint16_t cmd_id, const NanEnableRequest& msg1,
-    const NanConfigRequestSupplemental& msg2) {
+    const V1_2::NanConfigRequestSupplemental& msg2) {
     legacy_hal::NanEnableRequest legacy_msg;
     if (!hidl_struct_util::convertHidlNanEnableRequest_1_2ToLegacy(
             msg1, msg2, &legacy_msg)) {
@@ -845,7 +845,7 @@
 
 WifiStatus WifiNanIface::configRequest_1_2Internal(
     uint16_t cmd_id, const NanConfigRequest& msg1,
-    const NanConfigRequestSupplemental& msg2) {
+    const V1_2::NanConfigRequestSupplemental& msg2) {
     legacy_hal::NanConfigRequest legacy_msg;
     if (!hidl_struct_util::convertHidlNanConfigRequest_1_2ToLegacy(
             msg1, msg2, &legacy_msg)) {
@@ -857,7 +857,7 @@
 }
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_nan_iface.h b/wifi/1.3/default/wifi_nan_iface.h
similarity index 95%
rename from wifi/1.2/default/wifi_nan_iface.h
rename to wifi/1.3/default/wifi_nan_iface.h
index dba527b..f735d61 100644
--- a/wifi/1.2/default/wifi_nan_iface.h
+++ b/wifi/1.3/default/wifi_nan_iface.h
@@ -27,7 +27,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 
@@ -89,15 +89,15 @@
         terminateDataPathRequest_cb hidl_status_cb) override;
 
     Return<void> registerEventCallback_1_2(
-        const sp<IWifiNanIfaceEventCallback>& callback,
+        const sp<V1_2::IWifiNanIfaceEventCallback>& callback,
         registerEventCallback_1_2_cb hidl_status_cb) override;
     Return<void> enableRequest_1_2(
         uint16_t cmd_id, const NanEnableRequest& msg1,
-        const NanConfigRequestSupplemental& msg2,
+        const V1_2::NanConfigRequestSupplemental& msg2,
         enableRequest_1_2_cb hidl_status_cb) override;
     Return<void> configRequest_1_2(
         uint16_t cmd_id, const NanConfigRequest& msg1,
-        const NanConfigRequestSupplemental& msg2,
+        const V1_2::NanConfigRequestSupplemental& msg2,
         configRequest_1_2_cb hidl_status_cb) override;
 
    private:
@@ -135,10 +135,10 @@
         const sp<V1_2::IWifiNanIfaceEventCallback>& callback);
     WifiStatus enableRequest_1_2Internal(
         uint16_t cmd_id, const NanEnableRequest& msg1,
-        const NanConfigRequestSupplemental& msg2);
+        const V1_2::NanConfigRequestSupplemental& msg2);
     WifiStatus configRequest_1_2Internal(
         uint16_t cmd_id, const NanConfigRequest& msg,
-        const NanConfigRequestSupplemental& msg2);
+        const V1_2::NanConfigRequestSupplemental& msg2);
 
     // all 1_0 and descendant callbacks
     std::set<sp<V1_0::IWifiNanIfaceEventCallback>> getEventCallbacks();
@@ -157,7 +157,7 @@
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_p2p_iface.cpp b/wifi/1.3/default/wifi_p2p_iface.cpp
similarity index 97%
rename from wifi/1.2/default/wifi_p2p_iface.cpp
rename to wifi/1.3/default/wifi_p2p_iface.cpp
index 92bbaee..b5d5886 100644
--- a/wifi/1.2/default/wifi_p2p_iface.cpp
+++ b/wifi/1.3/default/wifi_p2p_iface.cpp
@@ -23,7 +23,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using hidl_return_util::validateAndCall;
 
@@ -60,7 +60,7 @@
 }
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_p2p_iface.h b/wifi/1.3/default/wifi_p2p_iface.h
similarity index 97%
rename from wifi/1.2/default/wifi_p2p_iface.h
rename to wifi/1.3/default/wifi_p2p_iface.h
index 76120b1..8a7207a 100644
--- a/wifi/1.2/default/wifi_p2p_iface.h
+++ b/wifi/1.3/default/wifi_p2p_iface.h
@@ -25,7 +25,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 
@@ -58,7 +58,7 @@
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_rtt_controller.cpp b/wifi/1.3/default/wifi_rtt_controller.cpp
similarity index 99%
rename from wifi/1.2/default/wifi_rtt_controller.cpp
rename to wifi/1.3/default/wifi_rtt_controller.cpp
index b68445b..fa317e3 100644
--- a/wifi/1.2/default/wifi_rtt_controller.cpp
+++ b/wifi/1.3/default/wifi_rtt_controller.cpp
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using hidl_return_util::validateAndCall;
 
@@ -269,7 +269,7 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_rtt_controller.h b/wifi/1.3/default/wifi_rtt_controller.h
similarity index 98%
rename from wifi/1.2/default/wifi_rtt_controller.h
rename to wifi/1.3/default/wifi_rtt_controller.h
index 1ab01e1..9798b79 100644
--- a/wifi/1.2/default/wifi_rtt_controller.h
+++ b/wifi/1.3/default/wifi_rtt_controller.h
@@ -27,7 +27,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 
 /**
@@ -97,7 +97,7 @@
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_sta_iface.cpp b/wifi/1.3/default/wifi_sta_iface.cpp
similarity index 97%
rename from wifi/1.2/default/wifi_sta_iface.cpp
rename to wifi/1.3/default/wifi_sta_iface.cpp
index daa5610..b0fa1ae 100644
--- a/wifi/1.2/default/wifi_sta_iface.cpp
+++ b/wifi/1.3/default/wifi_sta_iface.cpp
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using hidl_return_util::validateAndCall;
 
@@ -152,6 +152,13 @@
                            hidl_status_cb);
 }
 
+Return<void> WifiStaIface::getLinkLayerStats_1_3(
+    getLinkLayerStats_1_3_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiStaIface::getLinkLayerStatsInternal_1_3,
+                           hidl_status_cb);
+}
+
 Return<void> WifiStaIface::startRssiMonitoring(
     uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi,
     startRssiMonitoring_cb hidl_status_cb) {
@@ -445,8 +452,13 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-std::pair<WifiStatus, StaLinkLayerStats>
+std::pair<WifiStatus, V1_0::StaLinkLayerStats>
 WifiStaIface::getLinkLayerStatsInternal() {
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+std::pair<WifiStatus, V1_3::StaLinkLayerStats>
+WifiStaIface::getLinkLayerStatsInternal_1_3() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::LinkLayerStats legacy_stats;
     std::tie(legacy_status, legacy_stats) =
@@ -454,7 +466,7 @@
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    StaLinkLayerStats hidl_stats;
+    V1_3::StaLinkLayerStats hidl_stats;
     if (!hidl_struct_util::convertLegacyLinkLayerStatsToHidl(legacy_stats,
                                                              &hidl_stats)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
@@ -622,7 +634,7 @@
 }
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_sta_iface.h b/wifi/1.3/default/wifi_sta_iface.h
similarity index 94%
rename from wifi/1.2/default/wifi_sta_iface.h
rename to wifi/1.3/default/wifi_sta_iface.h
index 71cd17d..bc3090f 100644
--- a/wifi/1.2/default/wifi_sta_iface.h
+++ b/wifi/1.3/default/wifi_sta_iface.h
@@ -19,7 +19,7 @@
 
 #include <android-base/macros.h>
 #include <android/hardware/wifi/1.0/IWifiStaIfaceEventCallback.h>
-#include <android/hardware/wifi/1.2/IWifiStaIface.h>
+#include <android/hardware/wifi/1.3/IWifiStaIface.h>
 
 #include <wifi_system/interface_tool.h>
 
@@ -29,14 +29,14 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 
 /**
  * HIDL interface object used to control a STA Iface instance.
  */
-class WifiStaIface : public V1_2::IWifiStaIface {
+class WifiStaIface : public V1_3::IWifiStaIface {
    public:
     WifiStaIface(const std::string& ifname,
                  const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal);
@@ -75,6 +75,8 @@
         disableLinkLayerStatsCollection_cb hidl_status_cb) override;
     Return<void> getLinkLayerStats(
         getLinkLayerStats_cb hidl_status_cb) override;
+    Return<void> getLinkLayerStats_1_3(
+        getLinkLayerStats_1_3_cb hidl_status_cb) override;
     Return<void> startRssiMonitoring(
         uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi,
         startRssiMonitoring_cb hidl_status_cb) override;
@@ -130,7 +132,9 @@
     WifiStatus stopBackgroundScanInternal(uint32_t cmd_id);
     WifiStatus enableLinkLayerStatsCollectionInternal(bool debug);
     WifiStatus disableLinkLayerStatsCollectionInternal();
-    std::pair<WifiStatus, StaLinkLayerStats> getLinkLayerStatsInternal();
+    std::pair<WifiStatus, V1_0::StaLinkLayerStats> getLinkLayerStatsInternal();
+    std::pair<WifiStatus, V1_3::StaLinkLayerStats>
+    getLinkLayerStatsInternal_1_3();
     WifiStatus startRssiMonitoringInternal(uint32_t cmd_id, int32_t max_rssi,
                                            int32_t min_rssi);
     WifiStatus stopRssiMonitoringInternal(uint32_t cmd_id);
@@ -163,7 +167,7 @@
 };
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_status_util.cpp b/wifi/1.3/default/wifi_status_util.cpp
similarity index 98%
rename from wifi/1.2/default/wifi_status_util.cpp
rename to wifi/1.3/default/wifi_status_util.cpp
index dd37b6b..0a5bb13 100644
--- a/wifi/1.2/default/wifi_status_util.cpp
+++ b/wifi/1.3/default/wifi_status_util.cpp
@@ -19,7 +19,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 
 std::string legacyErrorToString(legacy_hal::wifi_error error) {
@@ -100,7 +100,7 @@
 }
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.2/default/wifi_status_util.h b/wifi/1.3/default/wifi_status_util.h
similarity index 97%
rename from wifi/1.2/default/wifi_status_util.h
rename to wifi/1.3/default/wifi_status_util.h
index e9136b3..bc8baa9 100644
--- a/wifi/1.2/default/wifi_status_util.h
+++ b/wifi/1.3/default/wifi_status_util.h
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace wifi {
-namespace V1_2 {
+namespace V1_3 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 
@@ -37,7 +37,7 @@
 WifiStatus createWifiStatusFromLegacyError(legacy_hal::wifi_error error);
 
 }  // namespace implementation
-}  // namespace V1_2
+}  // namespace V1_3
 }  // namespace wifi
 }  // namespace hardware
 }  // namespace android
diff --git a/wifi/1.3/types.hal b/wifi/1.3/types.hal
new file mode 100644
index 0000000..4585ff3
--- /dev/null
+++ b/wifi/1.3/types.hal
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.3;
+
+import @1.0::StaLinkLayerRadioStats;
+import @1.0::StaLinkLayerIfaceStats;
+import @1.0::TimeStampInMs;
+
+struct StaLinkLayerRadioStats {
+    /**
+     * Baseline information as defined in HAL 1.0.
+     */
+    @1.0::StaLinkLayerRadioStats V1_0;
+
+    /**
+     * Total time for which the radio is awake due to NAN scan since boot or crash.
+     */
+    uint32_t onTimeInMsForNanScan;
+
+    /**
+     * Total time for which the radio is awake due to background scan since boot or crash.
+     */
+    uint32_t onTimeInMsForBgScan;
+
+    /**
+     * Total time for which the radio is awake due to roam scan since boot or crash.
+     */
+    uint32_t onTimeInMsForRoamScan;
+
+    /**
+     * Total time for which the radio is awake due to PNO scan since boot or crash.
+     */
+    uint32_t onTimeInMsForPnoScan;
+
+    /**
+     * Total time for which the radio is awake due to Hotspot 2.0 scans and GAS exchange since boot
+     * or crash.
+     */
+    uint32_t onTimeInMsForHs20Scan;
+};
+
+/**
+ * Link layer stats retrieved via |getLinkLayerStats|.
+ */
+struct StaLinkLayerStats {
+    StaLinkLayerIfaceStats iface;
+    vec<StaLinkLayerRadioStats> radios;
+    /**
+     * TimeStamp for each stats sample.
+     * This is the absolute milliseconds from boot when these stats were
+     * sampled.
+     */
+    TimeStampInMs timeStampInMs;
+};
\ No newline at end of file
diff --git a/wifi/1.2/default/OWNERS b/wifi/1.3/vts/OWNERS
similarity index 100%
copy from wifi/1.2/default/OWNERS
copy to wifi/1.3/vts/OWNERS
diff --git a/wifi/1.3/vts/functional/Android.bp b/wifi/1.3/vts/functional/Android.bp
new file mode 100644
index 0000000..dbe77bd
--- /dev/null
+++ b/wifi/1.3/vts/functional/Android.bp
@@ -0,0 +1,30 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalWifiV1_3TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: [
+        "VtsHalWifiV1_3TargetTest.cpp",
+    ],
+    static_libs: [
+        "VtsHalWifiV1_0TargetTestUtil",
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+    ],
+}
diff --git a/wifi/1.3/vts/functional/VtsHalWifiV1_3TargetTest.cpp b/wifi/1.3/vts/functional/VtsHalWifiV1_3TargetTest.cpp
new file mode 100644
index 0000000..b410a48
--- /dev/null
+++ b/wifi/1.3/vts/functional/VtsHalWifiV1_3TargetTest.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <android/hardware/wifi/1.3/IWifi.h>
+
+#include "wifi_hidl_test_utils.h"
+
+// Test environment for Wifi HIDL HAL.
+class WifiHidlEnvironment_1_3 : public WifiHidlEnvironment {
+   public:
+    // get the test environment singleton
+    static WifiHidlEnvironment_1_3* Instance() {
+        static WifiHidlEnvironment_1_3* instance = new WifiHidlEnvironment_1_3;
+        return instance;
+    }
+
+    virtual void registerTestServices() override {
+        registerTestService<android::hardware::wifi::V1_3::IWifi>();
+    }
+
+   private:
+    WifiHidlEnvironment_1_3() {}
+};
+
+WifiHidlEnvironment_1_3* gEnv = WifiHidlEnvironment_1_3::Instance();
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(gEnv);
+    ::testing::InitGoogleTest(&argc, argv);
+    gEnv->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    return status;
+}
diff --git a/wifi/hostapd/1.1/Android.bp b/wifi/hostapd/1.1/Android.bp
new file mode 100644
index 0000000..d4170b6
--- /dev/null
+++ b/wifi/hostapd/1.1/Android.bp
@@ -0,0 +1,20 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.wifi.hostapd@1.1",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "IHostapd.hal",
+        "IHostapdCallback.hal",
+    ],
+    interfaces: [
+        "android.hardware.wifi.hostapd@1.0",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hidl.base@1.0",
+    ],
+    gen_java: true,
+}
+
diff --git a/wifi/hostapd/1.1/IHostapd.hal b/wifi/hostapd/1.1/IHostapd.hal
new file mode 100644
index 0000000..4e59ffc
--- /dev/null
+++ b/wifi/hostapd/1.1/IHostapd.hal
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.hostapd@1.1;
+
+import @1.0::IHostapd;
+import @1.0::HostapdStatus;
+
+import IHostapdCallback;
+
+/**
+ * Top-level object for managing SoftAPs.
+ */
+interface IHostapd extends @1.0::IHostapd {
+    /**
+     * Register for callbacks from the hostapd service.
+     *
+     * These callbacks are invoked for global events that are not specific
+     * to any interface or network. Registration of multiple callback
+     * objects is supported. These objects must be deleted when the corresponding
+     * client process is dead.
+     *
+     * @param callback An instance of the |IHostapdCallback| HIDL interface
+     *     object.
+     * @return status Status of the operation.
+     *     Possible status codes:
+     *     |HostapdStatusCode.SUCCESS|,
+     *     |HostapdStatusCode.FAILURE_UNKNOWN|
+     */
+    registerCallback(IHostapdCallback callback)
+        generates (HostapdStatus status);
+};
diff --git a/wifi/hostapd/1.1/IHostapdCallback.hal b/wifi/hostapd/1.1/IHostapdCallback.hal
new file mode 100644
index 0000000..1d314fe
--- /dev/null
+++ b/wifi/hostapd/1.1/IHostapdCallback.hal
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.hostapd@1.1;
+
+/**
+ * Top-level object for managing SoftAPs.
+ */
+interface IHostapdCallback {
+    /**
+     * Invoked when an asynchronous failure is encountered in one of the access
+     * points added via |IHostapd.addAccessPoint|.
+     *
+     * @param ifaceName Name of the interface.
+     */
+    oneway onFailure(string ifaceName);
+};
diff --git a/wifi/supplicant/1.0/vts/functional/Android.bp b/wifi/supplicant/1.0/vts/functional/Android.bp
index ee6a68e..7a6857c 100644
--- a/wifi/supplicant/1.0/vts/functional/Android.bp
+++ b/wifi/supplicant/1.0/vts/functional/Android.bp
@@ -39,7 +39,6 @@
     srcs: [
         "VtsHalWifiSupplicantV1_0TargetTest.cpp",
         "supplicant_hidl_test.cpp",
-        "supplicant_p2p_iface_hidl_test.cpp",
         "supplicant_sta_iface_hidl_test.cpp",
         "supplicant_sta_network_hidl_test.cpp",
     ],
@@ -55,3 +54,23 @@
         "libwifi-system-iface",
     ],
 }
+
+cc_test {
+    name: "VtsHalWifiSupplicantP2pV1_0TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: [
+        "VtsHalWifiSupplicantV1_0TargetTest.cpp",
+        "supplicant_p2p_iface_hidl_test.cpp",
+    ],
+    static_libs: [
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiSupplicantV1_0TargetTestUtil",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
+        "android.hardware.wifi@1.0",
+        "libcrypto",
+        "libgmock",
+        "libwifi-system",
+        "libwifi-system-iface",
+    ],
+}
diff --git a/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp b/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp
index adf2a85..6ca0546 100644
--- a/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp
+++ b/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp
@@ -44,7 +44,10 @@
     ::testing::AddGlobalTestEnvironment(gEnv);
     ::testing::InitGoogleTest(&argc, argv);
     gEnv->init(&argc, argv);
-    int status = RUN_ALL_TESTS();
-    LOG(INFO) << "Test result = " << status;
+    int status = gEnv->initFromOptions(argc, argv);
+    if (status == 0) {
+        int status = RUN_ALL_TESTS();
+        LOG(INFO) << "Test result = " << status;
+    }
     return status;
 }
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test.cpp
index c6ac03c..436b88b 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test.cpp
@@ -30,6 +30,8 @@
 using ::android::hardware::wifi::supplicant::V1_0::SupplicantStatusCode;
 using ::android::hardware::wifi::supplicant::V1_0::IfaceType;
 
+extern WifiSupplicantHidlEnvironment* gEnv;
+
 class SupplicantHidlTest : public ::testing::VtsHalHidlTargetTestBase {
    public:
     virtual void SetUp() override {
@@ -72,10 +74,13 @@
               std::find_if(ifaces.begin(), ifaces.end(), [](const auto& iface) {
                   return iface.type == IfaceType::STA;
               }));
-    EXPECT_NE(ifaces.end(),
-              std::find_if(ifaces.begin(), ifaces.end(), [](const auto& iface) {
-                  return iface.type == IfaceType::P2P;
-              }));
+    if (gEnv->isP2pOn) {
+        EXPECT_NE(
+            ifaces.end(),
+            std::find_if(ifaces.begin(), ifaces.end(), [](const auto& iface) {
+                return iface.type == IfaceType::P2P;
+            }));
+    }
 }
 
 /*
@@ -178,8 +183,10 @@
         IfaceType::STA, [](const SupplicantStatus& status) {
             EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
         });
-    supplicant_->setConcurrencyPriority(
-        IfaceType::P2P, [](const SupplicantStatus& status) {
-            EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
-        });
+    if (gEnv->isP2pOn) {
+        supplicant_->setConcurrencyPriority(
+            IfaceType::P2P, [](const SupplicantStatus& status) {
+                EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
+            });
+    }
 }
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
index bdedfba..47c3056 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
@@ -225,7 +225,9 @@
     // For 1.1 supplicant, we need to add interfaces at initialization.
     if (is_1_1(supplicant)) {
         addSupplicantStaIface_1_1(supplicant);
-        addSupplicantP2pIface_1_1(supplicant);
+        if (gEnv->isP2pOn) {
+            addSupplicantP2pIface_1_1(supplicant);
+        }
     }
     return supplicant;
 }
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
index d4a768f..21a1ae6 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
@@ -23,6 +23,8 @@
 #include <android/hardware/wifi/supplicant/1.0/ISupplicantStaNetwork.h>
 #include <android/hardware/wifi/supplicant/1.1/ISupplicant.h>
 
+#include <getopt.h>
+
 #include <VtsHalHidlTargetTestEnvBase.h>
 
 // Used to stop the android wifi framework before every test.
@@ -50,11 +52,48 @@
 
 class WifiSupplicantHidlEnvironment
     : public ::testing::VtsHalHidlTargetTestEnvBase {
-   public:
+   protected:
     virtual void HidlSetUp() override { stopSupplicant(); }
     virtual void HidlTearDown() override {
         startSupplicantAndWaitForHidlService();
     }
+
+   public:
+    // Whether P2P feature is supported on the device.
+    bool isP2pOn = true;
+
+    void usage(char* me, char* arg) {
+        fprintf(stderr,
+                "unrecognized option: %s\n\n"
+                "usage: %s <gtest options> <test options>\n\n"
+                "test options are:\n\n"
+                "-P, --p2p_on: Whether P2P feature is supported\n",
+                arg, me);
+    }
+
+    int initFromOptions(int argc, char** argv) {
+        static struct option options[] = {{"p2p_off", no_argument, 0, 'P'},
+                                          {0, 0, 0, 0}};
+
+        int c;
+        while ((c = getopt_long(argc, argv, "P", options, NULL)) >= 0) {
+            switch (c) {
+                case 'P':
+                    isP2pOn = false;
+                    break;
+                default:
+                    usage(argv[0], argv[optind]);
+                    return 2;
+            }
+        }
+
+        if (optind < argc) {
+            usage(argv[0], argv[optind]);
+            return 2;
+        }
+
+        return 0;
+    }
 };
 
 #endif /* SUPPLICANT_HIDL_TEST_UTILS_H */
diff --git a/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp b/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp
index 3d24fc3..9063a3b 100644
--- a/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp
+++ b/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp
@@ -30,8 +30,11 @@
         return instance;
     }
     virtual void registerTestServices() override {
+        registerTestService<::android::hardware::wifi::V1_0::IWifi>();
         registerTestService<::android::hardware::wifi::V1_1::IWifi>();
         registerTestService<
+            ::android::hardware::wifi::supplicant::V1_0::ISupplicant>();
+        registerTestService<
             ::android::hardware::wifi::supplicant::V1_1::ISupplicant>();
     }
 
@@ -46,7 +49,10 @@
     ::testing::AddGlobalTestEnvironment(gEnv);
     ::testing::InitGoogleTest(&argc, argv);
     gEnv->init(&argc, argv);
-    int status = RUN_ALL_TESTS();
-    LOG(INFO) << "Test result = " << status;
+    int status = gEnv->initFromOptions(argc, argv);
+    if (status == 0) {
+        int status = RUN_ALL_TESTS();
+        LOG(INFO) << "Test result = " << status;
+    }
     return status;
 }
diff --git a/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp b/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp
index 7e773d6..28f980c 100644
--- a/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp
+++ b/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp
@@ -33,6 +33,8 @@
 using ::android::hardware::wifi::supplicant::V1_1::ISupplicant;
 using ::android::sp;
 
+extern WifiSupplicantHidlEnvironment* gEnv;
+
 class SupplicantHidlTest : public ::testing::VtsHalHidlTargetTestBase {
    public:
     virtual void SetUp() override {
@@ -81,6 +83,7 @@
  * AddP2pInterface
  */
 TEST_F(SupplicantHidlTest, AddP2pInterface) {
+    if (!gEnv->isP2pOn) return;
     ISupplicant::IfaceInfo iface_info;
     iface_info.name = getP2pIfaceName();
     iface_info.type = IfaceType::P2P;
@@ -120,6 +123,7 @@
  * RemoveP2pInterface
  */
 TEST_F(SupplicantHidlTest, RemoveP2pInterface) {
+    if (!gEnv->isP2pOn) return;
     ISupplicant::IfaceInfo iface_info;
     iface_info.name = getP2pIfaceName();
     iface_info.type = IfaceType::P2P;
diff --git a/wifi/supplicant/1.2/Android.bp b/wifi/supplicant/1.2/Android.bp
new file mode 100644
index 0000000..93ce573
--- /dev/null
+++ b/wifi/supplicant/1.2/Android.bp
@@ -0,0 +1,21 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.wifi.supplicant@1.2",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "ISupplicant.hal",
+        "ISupplicantStaIface.hal",
+        "ISupplicantStaNetwork.hal",
+    ],
+    interfaces: [
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
+        "android.hidl.base@1.0",
+    ],
+    gen_java: true,
+}
+
diff --git a/wifi/supplicant/1.2/ISupplicant.hal b/wifi/supplicant/1.2/ISupplicant.hal
new file mode 100644
index 0000000..b0ec65d
--- /dev/null
+++ b/wifi/supplicant/1.2/ISupplicant.hal
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant@1.2;
+
+import @1.1::ISupplicant;
+
+/**
+ * Interface exposed by the supplicant HIDL service registered
+ * with the hardware service manager.
+ * This is the root level object for any the supplicant interactions.
+ * To use 1.2 features you must cast specific interfaces returned from the
+ * 1.1 HAL. For example V1_1::ISupplicant::addIface() adds V1_1::ISupplicantIface,
+ * which can be cast to V1_2::ISupplicantStaIface.
+ */
+interface ISupplicant extends @1.1::ISupplicant {
+};
diff --git a/wifi/supplicant/1.2/ISupplicantStaIface.hal b/wifi/supplicant/1.2/ISupplicantStaIface.hal
new file mode 100644
index 0000000..a338c6a
--- /dev/null
+++ b/wifi/supplicant/1.2/ISupplicantStaIface.hal
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant@1.2;
+
+import @1.0::SupplicantStatus;
+import @1.1::ISupplicantStaIface;
+import @1.2::ISupplicantStaNetwork;
+
+/**
+ * Interface exposed by the supplicant for each station mode network
+ * interface (e.g wlan0) it controls.
+ */
+interface ISupplicantStaIface extends @1.1::ISupplicantStaIface {
+
+    /**
+     * Get Key management capabilities of the device
+     *
+     * @return status Status of the operation, and a bitmap of key management mask.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    getKeyMgmtCapabilities()
+        generates (SupplicantStatus status, bitfield<KeyMgmtMask> keyMgmtMask);
+};
+
diff --git a/wifi/supplicant/1.2/ISupplicantStaNetwork.hal b/wifi/supplicant/1.2/ISupplicantStaNetwork.hal
new file mode 100644
index 0000000..6fd0d51
--- /dev/null
+++ b/wifi/supplicant/1.2/ISupplicantStaNetwork.hal
@@ -0,0 +1,259 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant@1.2;
+
+import @1.0::ISupplicantStaNetworkCallback;
+import @1.0::ISupplicantStaNetwork;
+import @1.0::SupplicantStatus;
+import @1.1::ISupplicantStaNetwork;
+
+/**
+ * Interface exposed by the supplicant for each station mode network
+ * configuration it controls.
+ */
+interface ISupplicantStaNetwork extends @1.1::ISupplicantStaNetwork {
+    /** Possble mask of values for KeyMgmt param. */
+    enum KeyMgmtMask : @1.0::ISupplicantStaNetwork.KeyMgmtMask {
+        /** WPA3-Personal SAE Key management */
+        SAE = 1 << 10,
+
+        /** WPA3-Enterprise Suite-B Key management */
+        SUITE_B_192 = 1 << 17,
+
+        /** Enhacned Open (OWE) Key management */
+        OWE = 1 << 22,
+    };
+
+    /** Possble mask of values for PairwiseCipher param. */
+    enum PairwiseCipherMask : @1.0::ISupplicantStaNetwork.PairwiseCipherMask {
+        /** GCMP-256 Pairwise Cipher */
+        GCMP_256 = 1 << 8,
+    };
+
+    /** Possble mask of values for GroupCipher param. */
+    enum GroupCipherMask : @1.0::ISupplicantStaNetwork.GroupCipherMask {
+        /** GCMP-256 Group Cipher */
+        GCMP_256 = 1 << 8,
+    };
+
+    /** Possble mask of values for GroupMgmtCipher param. */
+    enum GroupMgmtCipherMask : uint32_t {
+        /** BIP_GMAC-128 Group Management Cipher */
+        BIP_GMAC_128 = 1 << 11,
+
+        /** BIP_GMAC-256 Group Management Cipher */
+        BIP_GMAC_256 = 1 << 12,
+
+        /** BIP_CMAC-256 Group Management Cipher */
+        BIP_CMAC_256 = 1 << 13,
+    };
+
+    /**
+     * Set key management mask for the network.
+     *
+     * @param keyMgmtMask value to set.
+     *        Combination of |KeyMgmtMask| values.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    setKeyMgmt_1_2(bitfield<KeyMgmtMask> keyMgmtMask) generates (SupplicantStatus status);
+
+    /**
+     * Get the key mgmt mask set for the network.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     * @return keyMgmtMask Combination of |KeyMgmtMask| values.
+     */
+    getKeyMgmt_1_2()
+        generates (SupplicantStatus status, bitfield<KeyMgmtMask> keyMgmtMask);
+
+    /**
+     * Set pairwise cipher mask for the network.
+     *
+     * @param pairwiseCipherMask value to set.
+     *        Combination of |PairwiseCipherMask| values.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    setPairwiseCipher_1_2(bitfield<PairwiseCipherMask> pairwiseCipherMask)
+        generates (SupplicantStatus status);
+
+    /**
+     * Get the pairwise cipher mask set for the network.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     * @return pairwiseCipherMask Combination of |PairwiseCipherMask| values.
+     */
+    getPairwiseCipher_1_2()
+        generates (SupplicantStatus status,
+            bitfield<PairwiseCipherMask> pairwiseCipherMask);
+
+    /**
+     * Set group cipher mask for the network.
+     *
+     * @param groupCipherMask value to set.
+     *        Combination of |GroupCipherMask| values.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    setGroupCipher_1_2(bitfield<GroupCipherMask> groupCipherMask)
+        generates (SupplicantStatus status);
+
+    /**
+     * Get the group cipher mask set for the network.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     * @return groupCipherMask Combination of |GroupCipherMask| values.
+     */
+    getGroupCipher_1_2()
+        generates (SupplicantStatus status,
+            bitfield<GroupCipherMask> groupCipherMask);
+
+    /**
+     * Set group management cipher mask for the network.
+     *
+     * @param groupMgmtCipherMask value to set.
+     *        Combination of |GroupMgmtCipherMask| values.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    setGroupMgmtCipher(bitfield<GroupMgmtCipherMask> groupMgmtCipherMask)
+        generates (SupplicantStatus status);
+
+    /**
+     * Get the group management cipher mask set for the network.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     * @return groupMgmtCipherMask Combination of |GroupMgmtCipherMask| values.
+     */
+    getGroupMgmtCipher()
+        generates (SupplicantStatus status,
+            bitfield<GroupMgmtCipherMask> groupMgmtCipherMask);
+
+    /**
+     * Enable TLS Suite-B in EAP Phase1
+     *
+     * @param enable Set to true to enable TLS Suite-B in EAP phase1
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    enableTlsSuiteBEapPhase1Param(bool enable)
+        generates (SupplicantStatus status);
+
+    /**
+     * Set EAP OpenSSL Suite-B-192 ciphers for WPA3-Enterprise
+     *        Supported option:
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    enableSuiteBEapOpenSslCiphers()
+        generates (SupplicantStatus status);
+
+    /**
+     * Get SAE password for WPA3-Personal
+     *
+     * @return status Status of the operation, and a string.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    getSaePassword()
+        generates (SupplicantStatus status, string saePassword);
+
+    /**
+     * Get SAE password ID for WPA3-Personal
+     *
+     * @return status Status of the operation, and a string.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    getSaePasswordId()
+        generates (SupplicantStatus status, string saePasswordId);
+
+    /**
+    * Set SAE password for WPA3-Personal
+    *
+    * @param saePassword string with the above option
+    *
+    * @return status Status of the operation.
+    *         Possible status codes:
+    *         |SupplicantStatusCode.SUCCESS|,
+    *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+    *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+    *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+    */
+    setSaePassword(string saePassword)
+        generates (SupplicantStatus status);
+
+    /**
+     * Set SAE password ID for WPA3-Personal
+     *
+     * @param sae_password_id string with the above option
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    setSaePasswordId(string saePasswordId)
+        generates (SupplicantStatus status);
+};