diff --git a/audio/2.0/IStreamOutCallback.hal b/audio/2.0/IStreamOutCallback.hal
index 267c46d..cdb38de 100644
--- a/audio/2.0/IStreamOutCallback.hal
+++ b/audio/2.0/IStreamOutCallback.hal
@@ -23,15 +23,15 @@
     /*
      * Non blocking write completed.
      */
-    onWriteReady();
+    oneway onWriteReady();
 
     /*
      * Drain completed.
      */
-    onDrainReady();
+    oneway onDrainReady();
 
     /*
      * Stream hit an error.
      */
-    onError();
+    oneway onError();
 };
diff --git a/audio/2.0/default/StreamOut.cpp b/audio/2.0/default/StreamOut.cpp
index 913b6ae..805734b 100644
--- a/audio/2.0/default/StreamOut.cpp
+++ b/audio/2.0/default/StreamOut.cpp
@@ -15,6 +15,7 @@
  */
 
 #define LOG_TAG "StreamOutHAL"
+//#define LOG_NDEBUG 0
 
 #include <hardware/audio.h>
 #include <android/log.h>
diff --git a/audio/common/2.0/default/HidlUtils.cpp b/audio/common/2.0/default/HidlUtils.cpp
index b1bff00..241ca90 100644
--- a/audio/common/2.0/default/HidlUtils.cpp
+++ b/audio/common/2.0/default/HidlUtils.cpp
@@ -97,6 +97,7 @@
         const audio_offload_info_t& halOffload, AudioOffloadInfo* offload) {
     offload->sampleRateHz = halOffload.sample_rate;
     offload->channelMask = AudioChannelMask(halOffload.channel_mask);
+    offload->format = AudioFormat(halOffload.format);
     offload->streamType = AudioStreamType(halOffload.stream_type);
     offload->bitRatePerSecond = halOffload.bit_rate;
     offload->durationMicroseconds = halOffload.duration_us;
@@ -109,6 +110,7 @@
     *halOffload = AUDIO_INFO_INITIALIZER;
     halOffload->sample_rate = offload.sampleRateHz;
     halOffload->channel_mask = static_cast<audio_channel_mask_t>(offload.channelMask);
+    halOffload->format = static_cast<audio_format_t>(offload.format);
     halOffload->stream_type = static_cast<audio_stream_type_t>(offload.streamType);
     halOffload->bit_rate = offload.bitRatePerSecond;
     halOffload->duration_us = offload.durationMicroseconds;
diff --git a/audio/common/2.0/types.hal b/audio/common/2.0/types.hal
index d1674e4..13fd19b 100644
--- a/audio/common/2.0/types.hal
+++ b/audio/common/2.0/types.hal
@@ -665,6 +665,7 @@
                              // data bursts, not PCM.
     DIRECT_PCM = 0x2000,     // Audio stream containing PCM data that needs
                              // to pass through compress path for DSP post proc.
+    MMAP_NOIRQ = 0x4000, // output operates in MMAP no IRQ mode.
 };
 
 /*
@@ -680,6 +681,7 @@
     HW_HOTWORD = 0x2,  // prefer an input that captures from hw hotword source
     RAW        = 0x4,  // minimize signal processing
     SYNC       = 0x8,  // synchronize I/O streams
+    MMAP_NOIRQ = 0x10, // input operates in MMAP no IRQ mode.
 };
 
 @export(name="audio_usage_t", value_prefix="AUDIO_USAGE_")
diff --git a/boot/1.0/Android.bp b/boot/1.0/Android.bp
index d67972f..4eb728d 100644
--- a/boot/1.0/Android.bp
+++ b/boot/1.0/Android.bp
@@ -54,3 +54,61 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.boot.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.boot@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/boot/1.0/ $(genDir)/android/hardware/boot/1.0/",
+    srcs: [
+        "types.hal",
+        "IBootControl.hal",
+    ],
+    out: [
+        "android/hardware/boot/1.0/types.vts.cpp",
+        "android/hardware/boot/1.0/BootControl.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.boot.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.boot@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/boot/1.0/ $(genDir)/android/hardware/boot/1.0/",
+    srcs: [
+        "types.hal",
+        "IBootControl.hal",
+    ],
+    out: [
+        "android/hardware/boot/1.0/types.vts.h",
+        "android/hardware/boot/1.0/BootControl.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.boot.vts.driver@1.0",
+    generated_sources: ["android.hardware.boot.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.boot.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.boot.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.boot@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/boot/1.0/vts/Android.mk b/boot/1.0/vts/Android.mk
index 9b30ef1..d3a3851 100644
--- a/boot/1.0/vts/Android.mk
+++ b/boot/1.0/vts/Android.mk
@@ -16,36 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Boot Control v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_boot@1.0
-
-LOCAL_SRC_FILES := \
-  BootControl.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.boot@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for boot.
 include $(CLEAR_VARS)
 
diff --git a/evs/1.0/Android.bp b/evs/1.0/Android.bp
new file mode 100644
index 0000000..86e9c1c
--- /dev/null
+++ b/evs/1.0/Android.bp
@@ -0,0 +1,80 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+genrule {
+    name: "android.hardware.evs@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.evs@1.0",
+    srcs: [
+        "types.hal",
+        "IEvsCamera.hal",
+        "IEvsCameraStream.hal",
+        "IEvsDisplay.hal",
+        "IEvsEnumerator.hal",
+    ],
+    out: [
+        "android/hardware/evs/1.0/types.cpp",
+        "android/hardware/evs/1.0/EvsCameraAll.cpp",
+        "android/hardware/evs/1.0/EvsCameraStreamAll.cpp",
+        "android/hardware/evs/1.0/EvsDisplayAll.cpp",
+        "android/hardware/evs/1.0/EvsEnumeratorAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.evs@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.evs@1.0",
+    srcs: [
+        "types.hal",
+        "IEvsCamera.hal",
+        "IEvsCameraStream.hal",
+        "IEvsDisplay.hal",
+        "IEvsEnumerator.hal",
+    ],
+    out: [
+        "android/hardware/evs/1.0/types.h",
+        "android/hardware/evs/1.0/IEvsCamera.h",
+        "android/hardware/evs/1.0/IHwEvsCamera.h",
+        "android/hardware/evs/1.0/BnEvsCamera.h",
+        "android/hardware/evs/1.0/BpEvsCamera.h",
+        "android/hardware/evs/1.0/BsEvsCamera.h",
+        "android/hardware/evs/1.0/IEvsCameraStream.h",
+        "android/hardware/evs/1.0/IHwEvsCameraStream.h",
+        "android/hardware/evs/1.0/BnEvsCameraStream.h",
+        "android/hardware/evs/1.0/BpEvsCameraStream.h",
+        "android/hardware/evs/1.0/BsEvsCameraStream.h",
+        "android/hardware/evs/1.0/IEvsDisplay.h",
+        "android/hardware/evs/1.0/IHwEvsDisplay.h",
+        "android/hardware/evs/1.0/BnEvsDisplay.h",
+        "android/hardware/evs/1.0/BpEvsDisplay.h",
+        "android/hardware/evs/1.0/BsEvsDisplay.h",
+        "android/hardware/evs/1.0/IEvsEnumerator.h",
+        "android/hardware/evs/1.0/IHwEvsEnumerator.h",
+        "android/hardware/evs/1.0/BnEvsEnumerator.h",
+        "android/hardware/evs/1.0/BpEvsEnumerator.h",
+        "android/hardware/evs/1.0/BsEvsEnumerator.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.evs@1.0",
+    generated_sources: ["android.hardware.evs@1.0_genc++"],
+    generated_headers: ["android.hardware.evs@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.evs@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hidl.base@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/evs/1.0/IEvsCamera.hal b/evs/1.0/IEvsCamera.hal
new file mode 100644
index 0000000..a2fc565
--- /dev/null
+++ b/evs/1.0/IEvsCamera.hal
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.evs@1.0;
+
+import types;
+import IEvsCameraStream;
+
+
+/**
+ * Represents a single camera and is the primary interface for capturing images.
+ */
+interface IEvsCamera {
+
+    /**
+     * Returns the ID of this camera.
+     *
+     * Returns the string id of this camera. This must be the same value as reported in
+     * the camera_id field of the CameraDesc structure by EvsEnumerator::getCamerList().
+     */
+    getId() generates (string cameraId);
+
+    /**
+     * Specifies the depth of the buffer chain the camera is asked to support.
+     *
+     * Up to this many frames may be held concurrently by the client of IEvsCamera.
+     * If this many frames have been delivered to the receiver without being returned
+     * by doneWithFrame, the stream must skip frames until a buffer is returned for reuse.
+     * It is legal for this call to come at any time, even while streams are already running,
+     * in which case buffers should be added or removed from the chain as appropriate.
+     * If no call is made to this entry point, the IEvsCamera must support at least one
+     * frame by default. More is acceptable.
+     * BUFFER_NOT_AVAILABLE is returned if the implementation cannot support the
+     * requested number of concurrent frames.
+     */
+    setMaxFramesInFlight(uint32_t bufferCount) generates (EvsResult result);
+
+    /**
+     * Request delivery of EVS camera frames from this camera.
+     *
+     * The IEvsCameraStream must begin receiving periodic calls with new image
+     * frames until stopVideoStream() is called.
+     */
+    startVideoStream(IEvsCameraStream receiver) generates (EvsResult result);
+
+    /**
+     * Return a frame that was delivered by to the IEvsCameraStream.
+     *
+     * When done consuming a frame delivered to the IEvsCameraStream
+     * interface, it must be returned to the IEvsCamera for reuse.
+     * A small, finite number of buffers are available (possibly as small
+     * as one), and if the supply is exhausted, no further frames may be
+     * delivered until a buffer is returned.
+     */
+    doneWithFrame(uint32_t frameId, handle bufferHandle) generates (EvsResult result);
+
+    /**
+     * Stop the delivery of EVS camera frames.
+     *
+     * Because delivery is asynchronous, frames may continue to arrive for
+     * some time after this call returns. Each must be returned until the
+     * closure of the stream is signaled to the IEvsCameraStream.
+     * This function cannot fail and is simply ignored if the stream isn't running.
+     */
+    stopVideoStream();
+
+    /**
+     * Request driver specific information from the HAL implementation.
+     *
+     * The values allowed for opaqueIdentifier are driver specific,
+     * but no value passed in may crash the driver. The driver should
+     * return 0 for any unrecognized opaqueIdentifier.
+     */
+    getExtendedInfo(uint32_t opaqueIdentifier) generates (int32_t value);
+
+    /**
+     * Send a driver specific value to the HAL implementation.
+     *
+     * This extension is provided to facilitate car specific
+     * extensions, but no HAL implementation may require this call
+     * in order to function in a default state.
+     * INVALID_ARG is returned if the opaqueValue is not meaningful to
+     * the driver implementation.
+     */
+    setExtendedInfo(uint32_t opaqueIdentifier, int32_t opaqueValue) generates (EvsResult result);
+};
diff --git a/evs/1.0/IEvsCameraStream.hal b/evs/1.0/IEvsCameraStream.hal
new file mode 100644
index 0000000..ef5460f
--- /dev/null
+++ b/evs/1.0/IEvsCameraStream.hal
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.evs@1.0;
+
+
+/**
+ * Implemented on client side to receive asynchronous video frame deliveries.
+ */
+interface IEvsCameraStream {
+
+    /**
+     * Receives calls from the HAL each time a video frame is ready for inspection.
+     * Buffer handles received by this method must be returned via calls to
+     * IEvsCamera::doneWithFrame(). When the video stream is stopped via a call
+     * to IEvsCamera::stopVideoStream(), this callback may continue to happen for
+     * some time as the pipeline drains. Each frame must still be returned.
+     * When the last frame in the stream has been delivered, a NULL bufferHandle
+     * must be delivered, signifying the end of the stream. No further frame
+     * deliveries may happen thereafter.
+     */
+    oneway deliverFrame(uint32_t frameId, handle bufferHandle);
+};
diff --git a/evs/1.0/IEvsDisplay.hal b/evs/1.0/IEvsDisplay.hal
new file mode 100644
index 0000000..a473872
--- /dev/null
+++ b/evs/1.0/IEvsDisplay.hal
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.evs@1.0;
+
+import types;
+
+
+/**
+ * Represents a single camera and is the primary interface for capturing images.
+ */
+interface IEvsDisplay {
+
+    /**
+     * Returns basic information about the EVS display provided by the system.
+     *
+     * See the description of the DisplayDesc structure below for details.
+     */
+     getDisplayInfo() generates (DisplayDesc info);
+
+
+    /**
+     * Clients may set the display state to express their desired state.
+     *
+     * The HAL implementation must gracefully accept a request for any state while in
+     * any other state, although the response may be to defer or ignore the request. The display
+     * is defined to start in the NOT_VISIBLE state upon initialization. The client is
+     * then expected to request the VISIBLE_ON_NEXT_FRAME state, and then begin providing
+     * video. When the display is no longer required, the client is expected to request
+     * the NOT_VISIBLE state after passing the last video frame.
+     * Returns INVALID_ARG if the requested state is not a recognized value.
+     */
+     setDisplayState(DisplayState state) generates (EvsResult result);
+
+
+    /**
+     * This call requests the current state of the display
+     *
+     * The HAL implementation should report the actual current state, which might
+     * transiently differ from the most recently requested state. Note, however, that
+     * the logic responsible for changing display states should generally live above
+     * the device layer, making it undesirable for the HAL implementation to spontaneously
+     * change display states.
+     */
+     getDisplayState() generates (DisplayState state);
+
+
+    /**
+     * This call returns a handle to a frame buffer associated with the display.
+     *
+     * The returned buffer may be locked and written to by software and/or GL. This buffer
+     * must be returned via a call to returnTargetBufferForDisplay() even if the
+     * display is no longer visible.
+     */
+     getTargetBuffer() generates (handle bufferHandle);
+
+
+    /**
+     * This call tells the display that the buffer is ready for display.
+     *
+     * The buffer is no longer valid for use by the client after this call.
+     * There is no maximum time the caller may hold onto the buffer before making this
+     * call. The buffer may be returned at any time and in any DisplayState, but all
+     * buffers are expected to be returned before the IEvsDisplay interface is destroyed.
+     */
+    returnTargetBufferForDisplay(handle bufferHandle) generates (EvsResult result);
+};
diff --git a/evs/1.0/IEvsEnumerator.hal b/evs/1.0/IEvsEnumerator.hal
new file mode 100644
index 0000000..e3a1382
--- /dev/null
+++ b/evs/1.0/IEvsEnumerator.hal
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.evs@1.0;
+
+import types;
+import IEvsCamera;
+import IEvsDisplay;
+
+
+/**
+ * Provides the mechanism for EVS camera discovery
+ */
+interface IEvsEnumerator {
+
+    /**
+     * Returns a list of all EVS cameras available to the system
+     */
+    getCameraList() generates (vec<CameraDesc> cameras);
+
+
+    /**
+     * Get the IEvsCamera associated with a cameraId from a CameraDesc
+     *
+     * Given a camera's unique cameraId from ca CameraDesc, returns
+     * the ICamera interface assocaited with the specified camera.
+     * When done using the camera, it must be returned by calling
+     * closeCamera on the ICamera interface.
+     */
+    openCamera(string cameraId) generates (IEvsCamera carCamera);
+
+    /**
+     * Return the specified IEvsCamera interface as no longer in use
+     *
+     * When the IEvsCamera object is no longer required, it must be released.
+     * NOTE: Video streaming must be cleanly stopped before making this call.
+     */
+    closeCamera(IEvsCamera carCamera);
+
+
+    /**
+     * Get exclusive access to IEvsDisplay for the system
+     *
+     * There can be at most one EVS display object for the system and this function
+     * requests access to it. If the EVS display is not available or is already in use,
+     * a null pointer is returned.
+     */
+    openDisplay() generates (IEvsDisplay display);
+
+    /**
+     * Return the specified IEvsDisplay interface as no longer in use
+     *
+     * When the IEvsDisplay object is no longer required, it must be released.
+     * NOTE: All buffer must have been returned to the display before making this call.
+     */
+    closeDisplay(IEvsDisplay display);
+};
+
diff --git a/evs/1.0/default/Android.bp b/evs/1.0/default/Android.bp
new file mode 100644
index 0000000..3bda250
--- /dev/null
+++ b/evs/1.0/default/Android.bp
@@ -0,0 +1,26 @@
+cc_binary {
+    name: "android.hardware.evs@1.0-service",
+    relative_install_path: "hw",
+    srcs: [
+        "service.cpp",
+        "EvsCamera.cpp",
+        "EvsEnumerator.cpp",
+        "EvsDisplay.cpp"
+    ],
+    init_rc: ["android.hardware.evs@1.0-service.rc"],
+
+    shared_libs: [
+        "android.hardware.evs@1.0",
+        "android.hardware.graphics.allocator@2.0",
+        "libui",
+        "libbase",
+        "libbinder",
+        "libcutils",
+        "libhardware",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+    ],
+}
diff --git a/evs/1.0/default/EvsCamera.cpp b/evs/1.0/default/EvsCamera.cpp
new file mode 100644
index 0000000..32d4ed7
--- /dev/null
+++ b/evs/1.0/default/EvsCamera.cpp
@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.evs@1.0-service"
+
+#include "EvsCamera.h"
+
+#include <ui/GraphicBufferAllocator.h>
+#include <ui/GraphicBufferMapper.h>
+
+
+namespace android {
+namespace hardware {
+namespace evs {
+namespace V1_0 {
+namespace implementation {
+
+
+// These are the special camera names for which we'll initialize custom test data
+const char EvsCamera::kCameraName_Backup[]    = "backup";
+const char EvsCamera::kCameraName_RightTurn[] = "Right Turn";
+
+
+// TODO(b/31632518):  Need to get notification when our client dies so we can close the camera.
+// As it stands, if the client dies suddently, the buffer may be stranded.
+// As possible work around would be to give the client a HIDL object to exclusively hold
+// and use it's destructor to perform some work in the server side.
+
+EvsCamera::EvsCamera(const char *id) {
+    ALOGD("EvsCamera instantiated");
+
+    mDescription.cameraId = id;
+    mFrameBusy = false;
+    mStreamState = STOPPED;
+
+    // Set up dummy data for testing
+    if (mDescription.cameraId == kCameraName_Backup) {
+        mDescription.hints                  = UsageHint::USAGE_HINT_REVERSE;
+        mDescription.vendorFlags            = 0xFFFFFFFF;   // Arbitrary value
+        mDescription.defaultHorResolution   = 320;          // 1/2 NTSC/VGA
+        mDescription.defaultVerResolution   = 240;          // 1/2 NTSC/VGA
+    }
+    else if (mDescription.cameraId == kCameraName_RightTurn) {
+        // Nothing but the name and the usage hint
+        mDescription.hints                  = UsageHint::USAGE_HINT_RIGHT_TURN;
+    }
+    else {
+        // Leave empty for a minimalist camera description without even a hint
+    }
+}
+
+EvsCamera::~EvsCamera() {
+    ALOGD("EvsCamera being destroyed");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // Make sure our output stream is cleaned up
+    // (It really should be already)
+    stopVideoStream();
+
+    // Drop the graphics buffer we've been using
+    if (mBuffer) {
+        // Drop the graphics buffer we've been using
+        GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
+        alloc.free(mBuffer);
+    }
+
+    ALOGD("EvsCamera destroyed");
+}
+
+
+// Methods from ::android::hardware::evs::V1_0::IEvsCamera follow.
+Return<void> EvsCamera::getId(getId_cb id_cb) {
+    ALOGD("getId");
+
+    id_cb(mDescription.cameraId);
+
+    return Void();
+}
+
+
+Return<EvsResult> EvsCamera::setMaxFramesInFlight(uint32_t bufferCount) {
+    ALOGD("setMaxFramesInFlight");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // TODO:  Update our stored value
+
+    // TODO:  Adjust our buffer count right now if we can.  Otherwise, it'll adjust in doneWithFrame
+
+    // For now we support only one!
+    if (bufferCount != 1) {
+        return EvsResult::BUFFER_NOT_AVAILABLE;
+    }
+
+    return EvsResult::OK;
+}
+
+Return<EvsResult> EvsCamera::startVideoStream(const ::android::sp<IEvsCameraStream>& stream)  {
+    ALOGD("startVideoStream");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // We only support a single stream at a time
+    if (mStreamState != STOPPED) {
+        ALOGE("ignoring startVideoStream call when a stream is already running.");
+        return EvsResult::STREAM_ALREADY_RUNNING;
+    }
+
+    // Record the user's callback for use when we have a frame ready
+    mStream = stream;
+
+    // Allocate a graphics buffer into which we'll put our test images
+    if (!mBuffer) {
+        mWidth  = (mDescription.defaultHorResolution) ? mDescription.defaultHorResolution : 640;
+        mHeight = (mDescription.defaultVerResolution) ? mDescription.defaultVerResolution : 480;
+        // TODO:  What about stride?  Assume no padding for now...
+        mStride = 4* mWidth;    // Special cased to assume 4 byte pixels with no padding for now
+
+        ALOGD("Allocating buffer for camera frame");
+        GraphicBufferAllocator &alloc(GraphicBufferAllocator::get());
+        status_t result = alloc.allocate(mWidth, mHeight,
+                                         HAL_PIXEL_FORMAT_RGBA_8888, 1, GRALLOC_USAGE_HW_TEXTURE,
+                                         &mBuffer, &mStride, 0, "EvsCamera");
+        if (result != NO_ERROR) {
+            ALOGE("Error %d allocating %d x %d graphics buffer", result, mWidth, mHeight);
+            return EvsResult::BUFFER_NOT_AVAILABLE;
+        }
+        if (!mBuffer) {
+            ALOGE("We didn't get a buffer handle back from the allocator");
+            return EvsResult::BUFFER_NOT_AVAILABLE;
+        }
+    }
+
+    // Start the frame generation thread
+    mStreamState = RUNNING;
+    mCaptureThread = std::thread([this](){GenerateFrames();});
+
+    return EvsResult::OK;
+}
+
+Return<EvsResult> EvsCamera::doneWithFrame(uint32_t frameId, const hidl_handle& bufferHandle)  {
+    ALOGD("doneWithFrame");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    if (!bufferHandle)
+    {
+        ALOGE("ignoring doneWithFrame called with invalid handle");
+        return EvsResult::INVALID_ARG;
+    }
+
+    // TODO:  Track which frames we've delivered and validate this is one of them
+
+    // Mark the frame buffer as available for a new frame
+    mFrameBusy = false;
+
+    // TODO:  If we currently have too many buffers, drop this one
+
+    return EvsResult::OK;
+}
+
+Return<void> EvsCamera::stopVideoStream()  {
+    ALOGD("stopVideoStream");
+
+    bool waitForJoin = false;
+    // Lock scope
+    {
+        std::lock_guard <std::mutex> lock(mAccessLock);
+
+        if (mStreamState == RUNNING) {
+            // Tell the GenerateFrames loop we want it to stop
+            mStreamState = STOPPING;
+
+            // Note that we asked the thread to stop and should wait for it do so
+            waitForJoin = true;
+        }
+    }
+
+    if (waitForJoin) {
+        // Block outside the mutex until the "stop" flag has been acknowledged
+        // NOTE:  We won't send any more frames, but the client might still get one already in flight
+        ALOGD("Waiting for stream thread to end...");
+        mCaptureThread.join();
+
+        // Lock scope
+        {
+            std::lock_guard <std::mutex> lock(mAccessLock);
+            mStreamState = STOPPED;
+        }
+    }
+
+    return Void();
+}
+
+Return<int32_t> EvsCamera::getExtendedInfo(uint32_t opaqueIdentifier)  {
+    ALOGD("getExtendedInfo");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // For any single digit value, return the index itself as a test value
+    if (opaqueIdentifier <= 9) {
+        return opaqueIdentifier;
+    }
+
+    // Return zero by default as required by the spec
+    return 0;
+}
+
+Return<EvsResult> EvsCamera::setExtendedInfo(uint32_t /*opaqueIdentifier*/, int32_t /*opaqueValue*/)  {
+    ALOGD("setExtendedInfo");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // We don't store any device specific information in this implementation
+    return EvsResult::INVALID_ARG;
+}
+
+
+void EvsCamera::GenerateFrames() {
+    ALOGD("Frame generate loop started");
+
+    uint32_t frameNumber;
+
+    while (true) {
+        bool timeForFrame = false;
+        // Lock scope
+        {
+            std::lock_guard<std::mutex> lock(mAccessLock);
+
+            // Tick the frame counter -- rollover is tolerated
+            frameNumber = mFrameId++;
+
+            if (mStreamState != RUNNING) {
+                // Break out of our main thread loop
+                break;
+            }
+
+            if (mFrameBusy) {
+                // Can't do anything right now -- skip this frame
+                ALOGW("Skipped a frame because client hasn't returned a buffer\n");
+            }
+            else {
+                // We're going to make the frame busy
+                mFrameBusy = true;
+                timeForFrame = true;
+            }
+        }
+
+        if (timeForFrame) {
+            // Lock our output buffer for writing
+            uint32_t *pixels = nullptr;
+            GraphicBufferMapper &mapper = GraphicBufferMapper::get();
+            mapper.lock(mBuffer,
+                        GRALLOC_USAGE_SW_WRITE_OFTEN,
+                        android::Rect(mWidth, mHeight),
+                        (void **) &pixels);
+
+            // If we failed to lock the pixel buffer, we're about to crash, but log it first
+            if (!pixels) {
+                ALOGE("Camera failed to gain access to image buffer for writing");
+            }
+
+            // Fill in the test pixels
+            for (unsigned row = 0; row < mHeight; row++) {
+                for (unsigned col = 0; col < mWidth; col++) {
+                    // Index into the row to set the pixel at this column
+                    // (We're making vertical gradient in the green channel, and
+                    // horitzontal gradient in the blue channel)
+                    pixels[col] = 0xFF0000FF | ((row & 0xFF) << 16) | ((col & 0xFF) << 8);
+                }
+                // Point to the next row
+                pixels = pixels + (mStride / sizeof(*pixels));
+            }
+
+            // Release our output buffer
+            mapper.unlock(mBuffer);
+
+            // Issue the (asynchronous) callback to the client
+            mStream->deliverFrame(frameNumber, mBuffer);
+            ALOGD("Delivered %p as frame %d", mBuffer, frameNumber);
+        }
+
+        // We arbitrarily choose to generate frames at 10 fps (1/10 * uSecPerSec)
+        usleep(100000);
+    }
+
+    // If we've been asked to stop, send one last NULL frame to signal the actual end of stream
+    mStream->deliverFrame(frameNumber, nullptr);
+
+    return;
+}
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace evs
+} // namespace hardware
+} // namespace android
diff --git a/evs/1.0/default/EvsCamera.h b/evs/1.0/default/EvsCamera.h
new file mode 100644
index 0000000..5d29125
--- /dev/null
+++ b/evs/1.0/default/EvsCamera.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_EVS_V1_0_EVSCAMERA_H
+#define ANDROID_HARDWARE_EVS_V1_0_EVSCAMERA_H
+
+#include <android/hardware/evs/1.0/types.h>
+#include <android/hardware/evs/1.0/IEvsCamera.h>
+#include <ui/GraphicBuffer.h>
+
+#include <thread>
+
+namespace android {
+namespace hardware {
+namespace evs {
+namespace V1_0 {
+namespace implementation {
+
+class EvsCamera : public IEvsCamera {
+public:
+    // Methods from ::android::hardware::evs::V1_0::IEvsCamera follow.
+    Return<void> getId(getId_cb id_cb)  override;
+    Return<EvsResult> setMaxFramesInFlight(uint32_t bufferCount)  override;
+    Return<EvsResult> startVideoStream(const ::android::sp<IEvsCameraStream>& stream) override;
+    Return<EvsResult> doneWithFrame(uint32_t frameId, const hidl_handle& bufferHandle)  override;
+    Return<void> stopVideoStream()  override;
+    Return<int32_t> getExtendedInfo(uint32_t opaqueIdentifier)  override;
+    Return<EvsResult> setExtendedInfo(uint32_t opaqueIdentifier, int32_t opaqueValue)  override;
+
+    // Implementation details
+    EvsCamera(const char* id);
+    virtual ~EvsCamera() override;
+
+    const CameraDesc& getDesc() { return mDescription; };
+    void GenerateFrames();
+
+    static const char kCameraName_Backup[];
+    static const char kCameraName_RightTurn[];
+
+private:
+    CameraDesc              mDescription = {};  // The properties of this camera
+
+    buffer_handle_t         mBuffer = nullptr;  // A graphics buffer into which we'll store images
+    uint32_t                mWidth  = 0;        // number of pixels across the buffer
+    uint32_t                mHeight = 0;        // number of pixels vertically in the buffer
+    uint32_t                mStride = 0;        // Bytes per line in the buffer
+
+    sp<IEvsCameraStream>    mStream = nullptr;  // The callback the user expects when a frame is ready
+
+    std::thread             mCaptureThread;     // The thread we'll use to synthesize frames
+
+    uint32_t                mFrameId;           // A frame counter used to identify specific frames
+
+    enum StreamStateValues {
+        STOPPED,
+        RUNNING,
+        STOPPING,
+    };
+    StreamStateValues       mStreamState;
+    bool                    mFrameBusy;         // A flag telling us our one buffer is in use
+
+    std::mutex              mAccessLock;
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace evs
+} // namespace hardware
+} // namespace android
+
+#endif  // ANDROID_HARDWARE_EVS_V1_0_EVSCAMERA_H
diff --git a/evs/1.0/default/EvsDisplay.cpp b/evs/1.0/default/EvsDisplay.cpp
new file mode 100644
index 0000000..9dba6fc
--- /dev/null
+++ b/evs/1.0/default/EvsDisplay.cpp
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.evs@1.0-service"
+
+#include "EvsDisplay.h"
+
+#include <ui/GraphicBufferAllocator.h>
+#include <ui/GraphicBufferMapper.h>
+
+
+namespace android {
+namespace hardware {
+namespace evs {
+namespace V1_0 {
+namespace implementation {
+
+
+// TODO(b/31632518):  Need to get notification when our client dies so we can close the camera.
+// As it stands, if the client dies suddently, the buffer may be stranded.
+// As possible work around would be to give the client a HIDL object to exclusively hold
+// and use it's destructor to perform some work in the server side.
+
+
+EvsDisplay::EvsDisplay() {
+    ALOGD("EvsDisplay instantiated");
+
+    // Set up our self description
+    mInfo.displayId             = "Mock Display";
+    mInfo.vendorFlags           = 3870;
+    mInfo.defaultHorResolution  = 320;
+    mInfo.defaultVerResolution  = 240;
+}
+
+
+EvsDisplay::~EvsDisplay() {
+    ALOGD("EvsDisplay being destroyed");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // Report if we're going away while a buffer is outstanding.  This could be bad.
+    if (mFrameBusy) {
+        ALOGE("EvsDisplay going down while client is holding a buffer\n");
+    }
+
+    // Make sure we release our frame buffer
+    if (mBuffer) {
+        // Drop the graphics buffer we've been using
+        GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
+        alloc.free(mBuffer);
+    }
+    ALOGD("EvsDisplay destroyed");
+}
+
+
+/**
+ * Returns basic information about the EVS display provided by the system.
+ * See the description of the DisplayDesc structure below for details.
+ */
+Return<void> EvsDisplay::getDisplayInfo(getDisplayInfo_cb _hidl_cb)  {
+    ALOGD("getDisplayInfo");
+
+    // Send back our self description
+    _hidl_cb(mInfo);
+    return Void();
+}
+
+
+/**
+ * Clients may set the display state to express their desired state.
+ * The HAL implementation must gracefully accept a request for any state
+ * while in any other state, although the response may be to ignore the request.
+ * The display is defined to start in the NOT_VISIBLE state upon initialization.
+ * The client is then expected to request the VISIBLE_ON_NEXT_FRAME state, and
+ * then begin providing video.  When the display is no longer required, the client
+ * is expected to request the NOT_VISIBLE state after passing the last video frame.
+ */
+Return<EvsResult> EvsDisplay::setDisplayState(DisplayState state) {
+    ALOGD("setDisplayState");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // Ensure we recognize the requested state so we don't go off the rails
+    if (state < DisplayState::NUM_STATES) {
+        // Record the requested state
+        mRequestedState = state;
+        return EvsResult::OK;
+    }
+    else {
+        // Turn off the display if asked for an unrecognized state
+        mRequestedState = DisplayState::NOT_VISIBLE;
+        return EvsResult::INVALID_ARG;
+    }
+}
+
+
+/**
+ * The HAL implementation should report the actual current state, which might
+ * transiently differ from the most recently requested state.  Note, however, that
+ * the logic responsible for changing display states should generally live above
+ * the device layer, making it undesirable for the HAL implementation to
+ * spontaneously change display states.
+ */
+Return<DisplayState> EvsDisplay::getDisplayState()  {
+    ALOGD("getDisplayState");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // At the moment, we treat the requested state as immediately active
+    DisplayState currentState = mRequestedState;
+
+    return currentState;
+}
+
+
+/**
+ * This call returns a handle to a frame buffer associated with the display.
+ * This buffer may be locked and written to by software and/or GL.  This buffer
+ * must be returned via a call to returnTargetBufferForDisplay() even if the
+ * display is no longer visible.
+ */
+// TODO: We need to know if/when our client dies so we can get the buffer back! (blocked b/31632518)
+Return<void> EvsDisplay::getTargetBuffer(getTargetBuffer_cb _hidl_cb)  {
+    ALOGD("getTargetBuffer");
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // If we don't already have a buffer, allocate one now
+    if (!mBuffer) {
+        GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
+        status_t result = alloc.allocate(mInfo.defaultHorResolution, mInfo.defaultVerResolution,
+                                         HAL_PIXEL_FORMAT_RGBA_8888, 1,
+                                         GRALLOC_USAGE_HW_FB | GRALLOC_USAGE_HW_COMPOSER,
+                                         &mBuffer, &mStride, 0, "EvsDisplay");
+        mFrameBusy = false;
+        ALOGD("Allocated new buffer %p with stride %u", mBuffer, mStride);
+    }
+
+    // Do we have a frame available?
+    if (mFrameBusy) {
+        // This means either we have a 2nd client trying to compete for buffers
+        // (an unsupported mode of operation) or else the client hasn't returned
+        // a previously issues buffer yet (they're behaving badly).
+        // NOTE:  We have to make callback even if we have nothing to provide
+        ALOGE("getTargetBuffer called while no buffers available.");
+        _hidl_cb(nullptr);
+    }
+    else {
+        // Mark our buffer as busy
+        mFrameBusy = true;
+
+        // Send the buffer to the client
+        ALOGD("Providing display buffer %p", mBuffer);
+        _hidl_cb(mBuffer);
+    }
+
+    // All done
+    return Void();
+}
+
+
+/**
+ * This call tells the display that the buffer is ready for display.
+ * The buffer is no longer valid for use by the client after this call.
+ */
+Return<EvsResult> EvsDisplay::returnTargetBufferForDisplay(const hidl_handle& bufferHandle)  {
+    ALOGD("returnTargetBufferForDisplay %p", bufferHandle.getNativeHandle());
+    std::lock_guard<std::mutex> lock(mAccessLock);
+
+    // This shouldn't happen if we haven't issued the buffer!
+    if (!bufferHandle) {
+        ALOGE ("returnTargetBufferForDisplay called without a valid buffer handle.\n");
+        return EvsResult::INVALID_ARG;
+    }
+    /* TODO(b/33492405): It would be nice to validate we got back the buffer we expect,
+     * but HIDL doesn't support that (yet?)
+    if (bufferHandle != mBuffer) {
+        ALOGE ("Got an unrecognized frame returned.\n");
+        return EvsResult::INVALID_ARG;
+    }
+    */
+    if (!mFrameBusy) {
+        ALOGE ("A frame was returned with no outstanding frames.\n");
+        return EvsResult::BUFFER_NOT_AVAILABLE;
+    }
+
+    mFrameBusy = false;
+
+    // If we were waiting for a new frame, this is it!
+    if (mRequestedState == DisplayState::VISIBLE_ON_NEXT_FRAME) {
+        mRequestedState = DisplayState::VISIBLE;
+    }
+
+    // Validate we're in an expected state
+    if (mRequestedState != DisplayState::VISIBLE) {
+        // We shouldn't get frames back when we're not visible.
+        ALOGE ("Got an unexpected frame returned while not visible - ignoring.\n");
+    }
+    else {
+        // Make this buffer visible
+        // TODO:  Add code to put this image on the screen (or validate it somehow?)
+    }
+
+    return EvsResult::OK;
+}
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace evs
+} // namespace hardware
+} // namespace android
diff --git a/evs/1.0/default/EvsDisplay.h b/evs/1.0/default/EvsDisplay.h
new file mode 100644
index 0000000..a2d5d3e
--- /dev/null
+++ b/evs/1.0/default/EvsDisplay.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_EVS_V1_0_EVSDISPLAY_H
+#define ANDROID_HARDWARE_EVS_V1_0_EVSDISPLAY_H
+
+#include <android/hardware/evs/1.0/IEvsDisplay.h>
+#include <ui/GraphicBuffer.h>
+
+namespace android {
+namespace hardware {
+namespace evs {
+namespace V1_0 {
+namespace implementation {
+
+class EvsDisplay : public IEvsDisplay {
+public:
+    // Methods from ::android::hardware::evs::V1_0::IEvsDisplay follow.
+    Return<void> getDisplayInfo(getDisplayInfo_cb _hidl_cb)  override;
+    Return<EvsResult> setDisplayState(DisplayState state)  override;
+    Return<DisplayState> getDisplayState()  override;
+    Return<void> getTargetBuffer(getTargetBuffer_cb _hidl_cb)  override;
+    Return<EvsResult> returnTargetBufferForDisplay(const hidl_handle& bufferHandle)  override;
+
+    // Implementation details
+    EvsDisplay();
+    virtual ~EvsDisplay() override;
+
+private:
+    DisplayDesc     mInfo           = {};
+    buffer_handle_t mBuffer         = nullptr;      // A graphics buffer into which we'll store images
+    uint32_t        mStride         = 0;            // Bytes per line in the buffer
+
+    bool            mFrameBusy      = false;        // A flag telling us our buffer is in use
+    DisplayState    mRequestedState = DisplayState::NOT_VISIBLE;
+
+    std::mutex      mAccessLock;
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace evs
+} // namespace hardware
+} // namespace android
+
+#endif  // ANDROID_HARDWARE_EVS_V1_0_EVSDISPLAY_H
diff --git a/evs/1.0/default/EvsEnumerator.cpp b/evs/1.0/default/EvsEnumerator.cpp
new file mode 100644
index 0000000..9f38041
--- /dev/null
+++ b/evs/1.0/default/EvsEnumerator.cpp
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.evs@1.0-service"
+
+#include "EvsEnumerator.h"
+#include "EvsCamera.h"
+#include "EvsDisplay.h"
+
+namespace android {
+namespace hardware {
+namespace evs {
+namespace V1_0 {
+namespace implementation {
+
+
+EvsEnumerator::EvsEnumerator() {
+    ALOGD("EvsEnumerator created");
+
+    // Add sample camera data to our list of cameras
+    // NOTE:  The id strings trigger special initialization inside the EvsCamera constructor
+    mCameraList.emplace_back( new EvsCamera(EvsCamera::kCameraName_Backup),    false );
+    mCameraList.emplace_back( new EvsCamera("LaneView"),                       false );
+    mCameraList.emplace_back( new EvsCamera(EvsCamera::kCameraName_RightTurn), false );
+}
+
+// Methods from ::android::hardware::evs::V1_0::IEvsEnumerator follow.
+Return<void> EvsEnumerator::getCameraList(getCameraList_cb _hidl_cb)  {
+    ALOGD("getCameraList");
+
+    const unsigned numCameras = mCameraList.size();
+
+    // Build up a packed array of CameraDesc for return
+    // NOTE:  Only has to live until the callback returns
+    std::vector<CameraDesc> descriptions;
+    descriptions.reserve(numCameras);
+    for (const auto& cam : mCameraList) {
+        descriptions.push_back( cam.pCamera->getDesc() );
+    }
+
+    // Encapsulate our camera descriptions in the HIDL vec type
+    hidl_vec<CameraDesc> hidlCameras(descriptions);
+
+    // Send back the results
+    ALOGD("reporting %zu cameras available", hidlCameras.size());
+    _hidl_cb(hidlCameras);
+
+    // HIDL convention says we return Void if we sent our result back via callback
+    return Void();
+}
+
+Return<void> EvsEnumerator::openCamera(const hidl_string& cameraId,
+                                             openCamera_cb callback) {
+    ALOGD("openCamera");
+
+    // Find the named camera
+    CameraRecord *pRecord = nullptr;
+    for (auto &&cam : mCameraList) {
+        if (cam.pCamera->getDesc().cameraId == cameraId) {
+            // Found a match!
+            pRecord = &cam;
+            break;
+        }
+    }
+
+    if (!pRecord) {
+        ALOGE("Requested camera %s not found", cameraId.c_str());
+        callback(nullptr);
+    }
+    else if (pRecord->inUse) {
+        ALOGE("Cannot open camera %s which is already in use", cameraId.c_str());
+        callback(nullptr);
+    }
+    else {
+        /* TODO(b/33492405):  Do this, When HIDL can give us back a recognizable pointer
+        pRecord->inUse = true;
+         */
+        callback(pRecord->pCamera);
+    }
+
+    return Void();
+}
+
+Return<void> EvsEnumerator::closeCamera(const ::android::sp<IEvsCamera>& camera) {
+    ALOGD("closeCamera");
+
+    if (camera == nullptr) {
+        ALOGE("Ignoring call to closeCamera with null camera pointer");
+    }
+    else {
+        // Make sure the camera has stopped streaming
+        camera->stopVideoStream();
+
+        /* TODO(b/33492405):  Do this, When HIDL can give us back a recognizable pointer
+        pRecord->inUse = false;
+         */
+    }
+
+    return Void();
+}
+
+Return<void> EvsEnumerator::openDisplay(openDisplay_cb callback) {
+    ALOGD("openDisplay");
+
+    // If we already have a display active, then this request must be denied
+    if (mActiveDisplay != nullptr) {
+        ALOGW("Rejecting openDisplay request the display is already in use.");
+        callback(nullptr);
+    }
+    else {
+        // Create a new display interface and return it
+        mActiveDisplay = new EvsDisplay();
+        ALOGD("Returning new EvsDisplay object %p", mActiveDisplay.get());
+        callback(mActiveDisplay);
+    }
+
+    return Void();
+}
+
+Return<void> EvsEnumerator::closeDisplay(const ::android::sp<IEvsDisplay>& display) {
+    ALOGD("closeDisplay");
+
+    if (mActiveDisplay == nullptr) {
+        ALOGE("Ignoring closeDisplay when display is not active");
+    }
+    else if (display == nullptr) {
+        ALOGE("Ignoring closeDisplay with null display pointer");
+    }
+    else {
+        // Drop the active display
+        // TODO(b/33492405):  When HIDL provides recognizable pointers, add validation here.
+        mActiveDisplay = nullptr;
+    }
+
+    return Void();
+}
+
+
+// TODO(b/31632518):  Need to get notification when our client dies so we can close the camera.
+// As possible work around would be to give the client a HIDL object to exclusively hold
+// and use it's destructor to perform some work in the server side.
+
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace evs
+} // namespace hardware
+} // namespace android
diff --git a/evs/1.0/default/EvsEnumerator.h b/evs/1.0/default/EvsEnumerator.h
new file mode 100644
index 0000000..69caa17
--- /dev/null
+++ b/evs/1.0/default/EvsEnumerator.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_EVS_V1_0_EVSCAMERAENUMERATOR_H
+#define ANDROID_HARDWARE_EVS_V1_0_EVSCAMERAENUMERATOR_H
+
+#include <android/hardware/evs/1.0/IEvsEnumerator.h>
+#include <android/hardware/evs/1.0/IEvsCamera.h>
+
+#include <list>
+
+#include "EvsCamera.h"
+
+namespace android {
+namespace hardware {
+namespace evs {
+namespace V1_0 {
+namespace implementation {
+
+class EvsEnumerator : public IEvsEnumerator {
+public:
+    // Methods from ::android::hardware::evs::V1_0::IEvsEnumerator follow.
+    Return<void> getCameraList(getCameraList_cb _hidl_cb)  override;
+    Return<void> openCamera(const hidl_string& cameraId, openCamera_cb callback)  override;
+    Return<void> closeCamera(const ::android::sp<IEvsCamera>& carCamera)  override;
+    Return<void> openDisplay(openDisplay_cb callback)  override;
+    Return<void> closeDisplay(const ::android::sp<IEvsDisplay>& display)  override;
+
+    // Implementation details
+    EvsEnumerator();
+
+private:
+    struct CameraRecord {
+        sp<EvsCamera>   pCamera;
+        bool            inUse;
+        CameraRecord(EvsCamera* p, bool b) : pCamera(p), inUse(b) {}
+    };
+    std::list<CameraRecord> mCameraList;
+
+    sp<IEvsDisplay>         mActiveDisplay;
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace evs
+} // namespace hardware
+} // namespace android
+
+#endif  // ANDROID_HARDWARE_EVS_V1_0_EVSCAMERAENUMERATOR_H
diff --git a/evs/1.0/default/ServiceNames.h b/evs/1.0/default/ServiceNames.h
new file mode 100644
index 0000000..d20a37f
--- /dev/null
+++ b/evs/1.0/default/ServiceNames.h
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const static char kEnumeratorServiceName[] = "EvsEnumeratorHw-Mock";
diff --git a/evs/1.0/default/android.hardware.evs@1.0-service.rc b/evs/1.0/default/android.hardware.evs@1.0-service.rc
new file mode 100644
index 0000000..be7c9f9
--- /dev/null
+++ b/evs/1.0/default/android.hardware.evs@1.0-service.rc
@@ -0,0 +1,4 @@
+service evs-hal-1-0 /system/bin/hw/android.hardware.evs@1.0-service
+    class hal
+    user cameraserver
+    group camera
diff --git a/evs/1.0/default/service.cpp b/evs/1.0/default/service.cpp
new file mode 100644
index 0000000..6ab2975
--- /dev/null
+++ b/evs/1.0/default/service.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.evs@1.0-service"
+
+#include <unistd.h>
+
+#include <hwbinder/IPCThreadState.h>
+#include <hwbinder/ProcessState.h>
+#include <utils/Errors.h>
+#include <utils/StrongPointer.h>
+#include <utils/Log.h>
+
+#include "ServiceNames.h"
+#include "EvsEnumerator.h"
+#include "EvsDisplay.h"
+
+
+// libhwbinder:
+using android::hardware::IPCThreadState;
+using android::hardware::ProcessState;
+
+// Generated HIDL files
+using android::hardware::evs::V1_0::IEvsEnumerator;
+using android::hardware::evs::V1_0::IEvsDisplay;
+
+// The namespace in which all our implementation code lives
+using namespace android::hardware::evs::V1_0::implementation;
+using namespace android;
+
+
+int main() {
+    ALOGI("EVS Hardware Enumerator service is starting");
+    android::sp<IEvsEnumerator> service = new EvsEnumerator();
+
+    // Register our service -- if somebody is already registered by our name,
+    // they will be killed (their thread pool will throw an exception).
+    status_t status = service->registerAsService(kEnumeratorServiceName);
+    if (status == OK) {
+        ALOGD("%s is ready.", kEnumeratorServiceName);
+
+        // Set thread pool size to ensure the API is not called in parallel.
+        // By setting the size to zero, the main thread will be the only one
+        // serving requests once we "joinThreadPool".
+        ProcessState::self()->setThreadPoolMaxThreadCount(0);
+
+        // Note:  We don't start the thread pool because it'll add at least one (default)
+        //        thread to it, which we don't want.  See b/31226656
+        // ProcessState::self()->startThreadPool();
+
+        // Send this main thread to become a permanent part of the thread pool.
+        // This bumps up the thread count by 1 (from zero in this case).
+        // This is not expected to return.
+        IPCThreadState::self()->joinThreadPool();
+    } else {
+        ALOGE("Could not register service %s (%d).", kEnumeratorServiceName, status);
+    }
+
+    // In normal operation, we don't expect the thread pool to exit
+    ALOGE("EVS Hardware Enumerator is shutting down");
+    return 1;
+}
diff --git a/evs/1.0/types.hal b/evs/1.0/types.hal
new file mode 100644
index 0000000..e0051e1
--- /dev/null
+++ b/evs/1.0/types.hal
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.evs@1.0;
+
+
+/*
+ * Bit flags indicating suggested uses for a given EVS camera
+ *
+ * The values in the UsageHint bit field provide a generic expression of how a
+ * given camera is intended to be used. The values for these flags support
+ * existing use cases, and are used by the default EVS application to select
+ * appropriate cameras for display based on observed vehicle state (such as
+ * turn signal activation or selection of reverse gear). When implementing
+ * their own specialized EVS Applications, OEMs are free to use these flags
+ * and/or the opaque vendor_flags to drive their own vehicle specific logic.
+ */
+enum UsageHint : uint32_t {
+    USAGE_HINT_REVERSE      = 0x00000001,
+    USAGE_HINT_LEFT_TURN    = 0x00000002,
+    USAGE_HINT_RIGHT_TURN   = 0x00000004,
+    // remaining bits are reserved for future use
+};
+
+
+/*
+ * Structure describing the basic properties of an EVS camera
+ *
+ * The HAL is responsible for filling out this structure for each
+ * EVS camera in the system. Attention should be given to the field
+ * of view, direction of view, and location parameters as these may
+ * be used to (if available) to project overlay graphics into the
+ * scene by an EVS application.
+ * Any of these values for which the HAL does not have reasonable values
+ * should be set to ZERO.
+ */
+struct CameraDesc {
+    string      cameraId;
+    UsageHint   hints;                  // Bit flags (legal to | values together) (TODO: b/31702236)
+    uint32_t    vendorFlags;            // Opaque value from driver
+    uint32_t    defaultHorResolution;   // Units of pixels
+    uint32_t    defaultVerResolution;   // Units of pixels
+};
+
+
+/*
+ * Structure describing the basic properties of an EVS display
+ *
+ * The HAL is responsible for filling out this structure to describe
+ * the EVS display. As an implementation detail, this may be a physical
+ * display or a virtual display that is overlaid or mixed with another
+ * presentation device.
+ */
+struct DisplayDesc {
+    string      displayId;
+    uint32_t    vendorFlags;                // Opaque value from driver
+    uint32_t    defaultHorResolution;       // Units of pixels
+    uint32_t    defaultVerResolution;       // Units of pixels
+};
+
+
+/*
+ * States for control of the EVS display
+ *
+ * The DisplayInfo structure describes the basic properties of an EVS display. Any EVS
+ * implementation is required to have one. The HAL is responsible for filling out this
+ * structure to describe the EVS display. As an implementation detail, this may be a
+ * physical display or a virtual display that is overlaid or mixed with another
+ * presentation device.
+ */
+enum DisplayState : uint32_t {
+    NOT_VISIBLE = 0,        // Display is inhibited
+    VISIBLE_ON_NEXT_FRAME,  // Will become visible with next frame
+    VISIBLE,                // Display is currently active
+    NUM_STATES              // Must be last
+};
+
+
+/* Error codes used in EVS HAL interface. */
+/* TODO:  Adopt a common set of function return codes */
+enum EvsResult : uint32_t {
+    OK = 0,
+    INVALID_ARG,
+    STREAM_ALREADY_RUNNING,
+    BUFFER_NOT_AVAILABLE,
+};
\ No newline at end of file
diff --git a/evs/Android.bp b/evs/Android.bp
new file mode 100644
index 0000000..ba90f2c
--- /dev/null
+++ b/evs/Android.bp
@@ -0,0 +1,5 @@
+// This is an autogenerated file, do not edit.
+subdirs = [
+    "1.0",
+    "1.0/default",
+]
diff --git a/graphics/common/1.0/types.hal b/graphics/common/1.0/types.hal
index 9726c3a..e20fedc 100644
--- a/graphics/common/1.0/types.hal
+++ b/graphics/common/1.0/types.hal
@@ -39,12 +39,14 @@
 
     /*
      * The following formats use a 16bit float per color component.
+     *
+     * When used with ANativeWindow, the dataSpace field describes the color
+     * space of the buffer.
      */
-    RGBA_FP16          = 0x10,
-    RGBX_FP16          = 0x11,
+    RGBA_FP16          = 0x16,
 
     /*
-     * 0x100 - 0x1FF
+     * 0x101 - 0x1FF
      *
      * This range is reserved for pixel formats that are specific to the HAL
      * implementation.  Implementations can use any value in this range to
@@ -422,9 +424,10 @@
     FLEX_RGBA_8888 = 0x2A,
 
     /* Legacy formats (deprecated), used by ImageFormat.java */
-    YCBCR_422_SP       = 0x10, // NV16
-    YCRCB_420_SP       = 0x11, // NV21
-    YCBCR_422_I        = 0x14, // YUY2
+    YCBCR_422_SP       = 0x10,  // NV16
+    YCRCB_420_SP       = 0x11,  // NV21
+    YCBCR_422_I        = 0x14,  // YUY2
+    JPEG               = 0x100,
 };
 
 /**
diff --git a/graphics/composer/2.1/Android.bp b/graphics/composer/2.1/Android.bp
index 2bc8e93..26c7739 100644
--- a/graphics/composer/2.1/Android.bp
+++ b/graphics/composer/2.1/Android.bp
@@ -8,11 +8,13 @@
         "types.hal",
         "IComposer.hal",
         "IComposerCallback.hal",
+        "IComposerClient.hal",
     ],
     out: [
         "android/hardware/graphics/composer/2.1/types.cpp",
         "android/hardware/graphics/composer/2.1/ComposerAll.cpp",
         "android/hardware/graphics/composer/2.1/ComposerCallbackAll.cpp",
+        "android/hardware/graphics/composer/2.1/ComposerClientAll.cpp",
     ],
 }
 
@@ -24,6 +26,7 @@
         "types.hal",
         "IComposer.hal",
         "IComposerCallback.hal",
+        "IComposerClient.hal",
     ],
     out: [
         "android/hardware/graphics/composer/2.1/types.h",
@@ -37,6 +40,11 @@
         "android/hardware/graphics/composer/2.1/BnComposerCallback.h",
         "android/hardware/graphics/composer/2.1/BpComposerCallback.h",
         "android/hardware/graphics/composer/2.1/BsComposerCallback.h",
+        "android/hardware/graphics/composer/2.1/IComposerClient.h",
+        "android/hardware/graphics/composer/2.1/IHwComposerClient.h",
+        "android/hardware/graphics/composer/2.1/BnComposerClient.h",
+        "android/hardware/graphics/composer/2.1/BpComposerClient.h",
+        "android/hardware/graphics/composer/2.1/BsComposerClient.h",
     ],
 }
 
diff --git a/graphics/composer/2.1/IComposer.hal b/graphics/composer/2.1/IComposer.hal
index dd61c11..771fc7d 100644
--- a/graphics/composer/2.1/IComposer.hal
+++ b/graphics/composer/2.1/IComposer.hal
@@ -16,8 +16,7 @@
 
 package android.hardware.graphics.composer@2.1;
 
-import android.hardware.graphics.common@1.0;
-import IComposerCallback;
+import IComposerClient;
 
 interface IComposer {
     /*
@@ -47,210 +46,6 @@
         SKIP_CLIENT_COLOR_TRANSFORM = 2,
     };
 
-    /* Display attributes queryable through getDisplayAttribute. */
-    enum Attribute : int32_t {
-        INVALID = 0,
-
-        /* Dimensions in pixels */
-        WIDTH = 1,
-        HEIGHT = 2,
-
-        /* Vsync period in nanoseconds */
-        VSYNC_PERIOD = 3,
-
-        /*
-         * Dots per thousand inches (DPI * 1000). Scaling by 1000 allows these
-         * numbers to be stored in an int32_t without losing too much
-         * precision. If the DPI for a configuration is unavailable or is
-         * considered unreliable, the device may return UNSUPPORTED instead.
-         */
-        DPI_X = 4,
-        DPI_Y = 5,
-    };
-
-    /* Display requests returned by getDisplayRequests. */
-    enum DisplayRequest : uint32_t {
-        /*
-         * Instructs the client to provide a new client target buffer, even if
-         * no layers are marked for client composition.
-         */
-        FLIP_CLIENT_TARGET = 1 << 0,
-
-        /*
-         * Instructs the client to write the result of client composition
-         * directly into the virtual display output buffer. If any of the
-         * layers are not marked as Composition::CLIENT or the given display
-         * is not a virtual display, this request has no effect.
-         */
-        WRITE_CLIENT_TARGET_TO_OUTPUT = 1 << 1,
-    };
-
-    /* Layer requests returned from getDisplayRequests. */
-    enum LayerRequest : uint32_t {
-        /*
-         * The client should clear its target with transparent pixels where
-         * this layer would be. The client may ignore this request if the
-         * layer must be blended.
-         */
-        CLEAR_CLIENT_TARGET = 1 << 0,
-    };
-
-    /* Power modes for use with setPowerMode. */
-    enum PowerMode : int32_t {
-        /* The display is fully off (blanked). */
-        OFF = 0,
-
-        /*
-         * These are optional low power modes. getDozeSupport may be called to
-         * determine whether a given display supports these modes.
-         */
-
-        /*
-         * The display is turned on and configured in a low power state that
-         * is suitable for presenting ambient information to the user,
-         * possibly with lower fidelity than ON, but with greater efficiency.
-         */
-        DOZE = 1,
-
-        /*
-         * The display is configured as in DOZE but may stop applying display
-         * updates from the client. This is effectively a hint to the device
-         * that drawing to the display has been suspended and that the the
-         * device should remain on in a low power state and continue
-         * displaying its current contents indefinitely until the power mode
-         * changes.
-         *
-         * This mode may also be used as a signal to enable hardware-based
-         * doze functionality. In this case, the device is free to take over
-         * the display and manage it autonomously to implement a low power
-         * always-on display.
-         */
-        DOZE_SUSPEND = 3,
-
-        /* The display is fully on. */
-        ON = 2,
-    };
-
-    /* Vsync values passed to setVsyncEnabled. */
-    enum Vsync : int32_t {
-        INVALID = 0,
-
-        /* Enable vsync. */
-        ENABLE = 1,
-
-        /* Disable vsync. */
-        DISABLE = 2,
-    };
-
-    /* Blend modes, settable per layer. */
-    enum BlendMode : int32_t {
-        INVALID = 0,
-
-        /* colorOut = colorSrc */
-        NONE = 1,
-
-        /* colorOut = colorSrc + colorDst * (1 - alphaSrc) */
-        PREMULTIPLIED = 2,
-
-        /* colorOut = colorSrc * alphaSrc + colorDst * (1 - alphaSrc) */
-        COVERAGE = 3,
-    };
-
-    /* Possible composition types for a given layer. */
-    enum Composition : int32_t {
-        INVALID = 0,
-
-        /*
-         * The client will composite this layer into the client target buffer
-         * (provided to the device through setClientTarget).
-         *
-         * The device must not request any composition type changes for layers
-         * of this type.
-         */
-        CLIENT = 1,
-
-        /*
-         * The device will handle the composition of this layer through a
-         * hardware overlay or other similar means.
-         *
-         * Upon validateDisplay, the device may request a change from this
-         * type to CLIENT.
-         */
-        DEVICE = 2,
-
-        /*
-         * The device will render this layer using the color set through
-         * setLayerColor. If this functionality is not supported on a layer
-         * that the client sets to SOLID_COLOR, the device must request that
-         * the composition type of that layer is changed to CLIENT upon the
-         * next call to validateDisplay.
-         *
-         * Upon validateDisplay, the device may request a change from this
-         * type to CLIENT.
-         */
-        SOLID_COLOR = 3,
-
-        /*
-         * Similar to DEVICE, but the position of this layer may also be set
-         * asynchronously through setCursorPosition. If this functionality is
-         * not supported on a layer that the client sets to CURSOR, the device
-         * must request that the composition type of that layer is changed to
-         * CLIENT upon the next call to validateDisplay.
-         *
-         * Upon validateDisplay, the device may request a change from this
-         * type to either DEVICE or CLIENT.  Changing to DEVICE will prevent
-         * the use of setCursorPosition but still permit the device to
-         * composite the layer.
-         */
-        CURSOR = 4,
-
-        /*
-         * The device will handle the composition of this layer, as well as
-         * its buffer updates and content synchronization. Only supported on
-         * devices which provide Capability::SIDEBAND_STREAM.
-         *
-         * Upon validateDisplay, the device may request a change from this
-         * type to either DEVICE or CLIENT, but it is unlikely that content
-         * will display correctly in these cases.
-         */
-        SIDEBAND = 5,
-    };
-
-    /* Display types returned by getDisplayType. */
-    enum DisplayType : int32_t {
-        INVALID = 0,
-
-        /*
-         * All physical displays, including both internal displays and
-         * hotpluggable external displays.
-         */
-        PHYSICAL = 1,
-
-        /* Virtual displays created by createVirtualDisplay. */
-        VIRTUAL = 2,
-    };
-
-    struct Rect {
-        int32_t left;
-        int32_t top;
-        int32_t right;
-        int32_t bottom;
-    };
-
-    struct FRect {
-        float left;
-        float top;
-        float right;
-        float bottom;
-    };
-
-    struct Color {
-        uint8_t r;
-        uint8_t g;
-        uint8_t b;
-        uint8_t a;
-    };
-
     /*
      * Provides a list of supported capabilities (as described in the
      * definition of Capability above). This list must not change after
@@ -269,898 +64,14 @@
     dumpDebugInfo() generates (string debugInfo);
 
     /*
-     * Provides a IComposerCallback object for the device to call.
+     * Creates a client of the composer. All resources created by the client
+     * are owned by the client and are only visible to the client.
      *
-     * @param callback is the IComposerCallback object.
-     */
-    registerCallback(IComposerCallback callback);
-
-    /*
-     * Returns the maximum number of virtual displays supported by this device
-     * (which may be 0). The client will not attempt to create more than this
-     * many virtual displays on this device. This number must not change for
-     * the lifetime of the device.
-     */
-    getMaxVirtualDisplayCount() generates (uint32_t count);
-
-    /*
-     * Creates a new virtual display with the given width and height. The
-     * format passed into this function is the default format requested by the
-     * consumer of the virtual display output buffers.
-     *
-     * The display will be assumed to be on from the time the first frame is
-     * presented until the display is destroyed.
-     *
-     * @param width is the width in pixels.
-     * @param height is the height in pixels.
-     * @param formatHint is the default output buffer format selected by
-     *        the consumer.
-     * @return error is NONE upon success. Otherwise,
-     *         UNSUPPORTED when the width or height is too large for the
-     *                     device to be able to create a virtual display.
-     *         NO_RESOURCES when the device is unable to create a new virtual
-     *                      display at this time.
-     * @return display is the newly-created virtual display.
-     * @return format is the format of the buffer the device will produce.
-     */
-    createVirtualDisplay(uint32_t width,
-                         uint32_t height,
-                         PixelFormat formatHint)
-              generates (Error error,
-                         Display display,
-                         PixelFormat format);
-
-    /*
-     * Destroys a virtual display. After this call all resources consumed by
-     * this display may be freed by the device and any operations performed on
-     * this display should fail.
-     *
-     * @param display is the virtual display to destroy.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_PARAMETER when the display handle which was passed in does
-     *                       not refer to a virtual display.
-     */
-    destroyVirtualDisplay(Display display) generates (Error error);
-
-    /*
-     * Accepts the changes required by the device from the previous
-     * validateDisplay call (which may be queried using
-     * getChangedCompositionTypes) and revalidates the display. This function
-     * is equivalent to requesting the changed types from
-     * getChangedCompositionTypes, setting those types on the corresponding
-     * layers, and then calling validateDisplay again.
-     *
-     * After this call it must be valid to present this display. Calling this
-     * after validateDisplay returns 0 changes must succeed with NONE, but
-     * should have no other effect.
+     * There can only be one client at any time.
      *
      * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         NOT_VALIDATED when validateDisplay has not been called.
+     *         NO_RESOURCES when no more client can be created currently.
+     * @return client is the newly created client.
      */
-    acceptDisplayChanges(Display display) generates (Error error);
-
-    /*
-     * Creates a new layer on the given display.
-     *
-     * @param display is the display on which to create the layer.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         NO_RESOURCES when the device was unable to create a layer this
-     *                      time.
-     * @return layer is the handle of the new layer.
-     */
-    createLayer(Display display) generates (Error error, Layer layer);
-
-    /*
-     * Destroys the given layer.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to destroy.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    destroyLayer(Display display, Layer layer) generates (Error error);
-
-    /*
-     * Retrieves which display configuration is currently active.
-     *
-     * If no display configuration is currently active, this function must
-     * return BAD_CONFIG. It is the responsibility of the client to call
-     * setActiveConfig with a valid configuration before attempting to present
-     * anything on the display.
-     *
-     * @param display is the display to which the active config is queried.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_CONFIG when no configuration is currently active.
-     * @return config is the currently active display configuration.
-     */
-    getActiveConfig(Display display) generates (Error error, Config config);
-
-    /*
-     * Retrieves the layers for which the device requires a different
-     * composition type than had been set prior to the last call to
-     * validateDisplay. The client will either update its state with these
-     * types and call acceptDisplayChanges, or will set new types and attempt
-     * to validate the display again.
-     *
-     * The number of changed layers must be the same as the value returned in
-     * numTypes from the last call to validateDisplay.
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         NOT_VALIDATED when validateDisplay has not been called.
-     * @return layers is an array of layer handles.
-     * @return types is an array of composition types, each corresponding to
-     *         an element of layers.
-     */
-    getChangedCompositionTypes(Display display)
-                    generates (Error error,
-                               vec<Layer> layers,
-                               vec<Composition> types);
-
-    /*
-     * Returns whether a client target with the given properties can be
-     * handled by the device.
-     *
-     * This function must return true for a client target with width and
-     * height equal to the active display configuration dimensions,
-     * PixelFormat::RGBA_8888, and Dataspace::UNKNOWN. It is not required to
-     * return true for any other configuration.
-     *
-     * @param display is the display to query.
-     * @param width is the client target width in pixels.
-     * @param height is the client target height in pixels.
-     * @param format is the client target format.
-     * @param dataspace is the client target dataspace, as described in
-     *        setLayerDataspace.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         UNSUPPORTED when the given configuration is not supported.
-     */
-    getClientTargetSupport(Display display,
-                           uint32_t width,
-                           uint32_t height,
-                           PixelFormat format,
-                           Dataspace dataspace)
-                generates (Error error);
-
-    /*
-     * Returns the color modes supported on this display.
-     *
-     * All devices must support at least ColorMode::NATIVE.
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return modes is an array of color modes.
-     */
-    getColorModes(Display display)
-       generates (Error error,
-                  vec<ColorMode> modes);
-
-    /*
-     * Returns a display attribute value for a particular display
-     * configuration.
-     *
-     * @param display is the display to query.
-     * @param config is the display configuration for which to return
-     *        attribute values.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_CONFIG when config does not name a valid configuration for
-     *                    this display.
-     *         BAD_PARAMETER when attribute is unrecognized.
-     *         UNSUPPORTED when attribute cannot be queried for the config.
-     * @return value is the value of the attribute.
-     */
-    getDisplayAttribute(Display display,
-                        Config config,
-                        Attribute attribute)
-             generates (Error error,
-                        int32_t value);
-
-    /*
-     * Returns handles for all of the valid display configurations on this
-     * display.
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return configs is an array of configuration handles.
-     */
-    getDisplayConfigs(Display display)
-           generates (Error error,
-                      vec<Config> configs);
-
-    /*
-     * Returns a human-readable version of the display's name.
-     *
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return name is the name of the display.
-     */
-    getDisplayName(Display display) generates (Error error, string name);
-
-    /*
-     * Returns the display requests and the layer requests required for the
-     * last validated configuration.
-     *
-     * Display requests provide information about how the client should handle
-     * the client target. Layer requests provide information about how the
-     * client should handle an individual layer.
-     *
-     * The number of layer requests must be equal to the value returned in
-     * numRequests from the last call to validateDisplay.
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         NOT_VALIDATED when validateDisplay has not been called.
-     * @return displayRequestMask is the display requests for the current
-     *         validated state.
-     * @return layers is an array of layers which all have at least one
-     *         request.
-     * @return layerRequestMasks is the requests corresponding to each element
-     *         of layers.
-     */
-    getDisplayRequests(Display display)
-            generates (Error error,
-                       uint32_t displayRequestMask,
-                       vec<Layer> layers,
-                       vec<uint32_t> layerRequestMasks);
-
-    /*
-     * Returns whether the given display is a physical or virtual display.
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return type is the type of the display.
-     */
-    getDisplayType(Display display) generates (Error error, DisplayType type);
-
-    /*
-     * Returns whether the given display supports PowerMode::DOZE and
-     * PowerMode::DOZE_SUSPEND. DOZE_SUSPEND may not provide any benefit over
-     * DOZE (see the definition of PowerMode for more information), but if
-     * both DOZE and DOZE_SUSPEND are no different from PowerMode::ON, the
-     * device should not claim support.
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return support is true only when the display supports doze modes.
-     */
-    getDozeSupport(Display display) generates (Error error, bool support);
-
-    /*
-     * Returns the high dynamic range (HDR) capabilities of the given display,
-     * which are invariant with regard to the active configuration.
-     *
-     * Displays which are not HDR-capable must return no types.
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return types is an array of HDR types, may have 0 elements if the
-     *         display is not HDR-capable.
-     * @return maxLuminance is the desired content maximum luminance for this
-     *         display in cd/m^2.
-     * @return maxAverageLuminance - the desired content maximum frame-average
-     *         luminance for this display in cd/m^2.
-     * @return minLuminance is the desired content minimum luminance for this
-     *         display in cd/m^2.
-     */
-    getHdrCapabilities(Display display)
-            generates (Error error,
-                       vec<Hdr> types,
-                       float maxLuminance,
-                       float maxAverageLuminance,
-                       float minLuminance);
-
-    /*
-     * Retrieves the release fences for device layers on this display which
-     * will receive new buffer contents this frame.
-     *
-     * A release fence is a file descriptor referring to a sync fence object
-     * which will be signaled after the device has finished reading from the
-     * buffer presented in the prior frame. This indicates that it is safe to
-     * start writing to the buffer again. If a given layer's fence is not
-     * returned from this function, it will be assumed that the buffer
-     * presented on the previous frame is ready to be written.
-     *
-     * The fences returned by this function should be unique for each layer
-     * (even if they point to the same underlying sync object).
-     *
-     * @param display is the display to query.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return layers is an array of layer handles.
-     * @return fences is handle that contains an array of sync fence file
-     *         descriptors as described above, each corresponding to an
-     *         element of layers.
-     */
-    getReleaseFences(Display display)
-          generates (Error error,
-                     vec<Layer> layers,
-                     handle releaseFences);
-
-    /*
-     * Presents the current display contents on the screen (or in the case of
-     * virtual displays, into the output buffer).
-     *
-     * Prior to calling this function, the display must be successfully
-     * validated with validateDisplay. Note that setLayerBuffer and
-     * setLayerSurfaceDamage specifically do not count as layer state, so if
-     * there are no other changes to the layer state (or to the buffer's
-     * properties as described in setLayerBuffer), then it is safe to call
-     * this function without first validating the display.
-     *
-     * If this call succeeds, presentFence will be populated with a file
-     * descriptor referring to a present sync fence object. For physical
-     * displays, this fence will be signaled at the vsync when the result of
-     * composition of this frame starts to appear (for video-mode panels) or
-     * starts to transfer to panel memory (for command-mode panels). For
-     * virtual displays, this fence will be signaled when writes to the output
-     * buffer have completed and it is safe to read from it.
-     *
-     * @param display is the display to present.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         NO_RESOURCES when no valid output buffer has been set for a
-     *                      virtual display.
-     *         NOT_VALIDATED when validateDisplay has not successfully been
-     *                       called for this display.
-     * @return presentFence is a sync fence file descriptor as described
-     *         above.
-     */
-    presentDisplay(Display display)
-        generates (Error error,
-                   handle presentFence);
-
-    /*
-     * Sets the active configuration for this display. Upon returning, the
-     * given display configuration should be active and remain so until either
-     * this function is called again or the display is disconnected.
-     *
-     * @param display is the display to which the active config is set.
-     * @param config is the new display configuration.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_CONFIG when the configuration handle passed in is not valid
-     *                    for this display.
-     */
-    setActiveConfig(Display display, Config config) generates (Error error);
-
-    /*
-     * Sets the buffer handle which will receive the output of client
-     * composition.  Layers marked as Composition::CLIENT will be composited
-     * into this buffer prior to the call to presentDisplay, and layers not
-     * marked as Composition::CLIENT should be composited with this buffer by
-     * the device.
-     *
-     * The buffer handle provided may be empty if no layers are being
-     * composited by the client. This must not result in an error (unless an
-     * invalid display handle is also provided).
-     *
-     * Also provides a file descriptor referring to an acquire sync fence
-     * object, which will be signaled when it is safe to read from the client
-     * target buffer.  If it is already safe to read from this buffer, an
-     * empty handle may be passed instead.
-     *
-     * For more about dataspaces, see setLayerDataspace.
-     *
-     * The damage parameter describes a surface damage region as defined in
-     * the description of setLayerSurfaceDamage.
-     *
-     * Will be called before presentDisplay if any of the layers are marked as
-     * Composition::CLIENT. If no layers are so marked, then it is not
-     * necessary to call this function. It is not necessary to call
-     * validateDisplay after changing the target through this function.
-     *
-     * @param display is the display to which the client target is set.
-     * @param target is the new target buffer.
-     * @param acquireFence is a sync fence file descriptor as described above.
-     * @param dataspace is the dataspace of the buffer, as described in
-     *        setLayerDataspace.
-     * @param damage is the surface damage region.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_PARAMETER when the new target handle was invalid.
-     */
-    setClientTarget(Display display,
-                    handle target,
-                    handle acquireFence,
-                    Dataspace dataspace,
-                    vec<Rect> damage)
-         generates (Error error);
-
-    /*
-     * Sets the color mode of the given display.
-     *
-     * Upon returning from this function, the color mode change must have
-     * fully taken effect.
-     *
-     * All devices must support at least ColorMode::NATIVE, and displays are
-     * assumed to be in this mode upon hotplug.
-     *
-     * @param display is the display to which the color mode is set.
-     * @param mode is the mode to set to.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_PARAMETER when mode is not a valid color mode.
-     *         UNSUPPORTED when mode is not supported on this display.
-     */
-    setColorMode(Display display, ColorMode mode) generates (Error error);
-
-    /*
-     * Sets a color transform which will be applied after composition.
-     *
-     * If hint is not ColorTransform::ARBITRARY, then the device may use the
-     * hint to apply the desired color transform instead of using the color
-     * matrix directly.
-     *
-     * If the device is not capable of either using the hint or the matrix to
-     * apply the desired color transform, it should force all layers to client
-     * composition during validateDisplay.
-     *
-     * If Capability::SKIP_CLIENT_COLOR_TRANSFORM is present, then the client
-     * will never apply the color transform during client composition, even if
-     * all layers are being composed by the client.
-     *
-     * The matrix provided is an affine color transformation of the following
-     * form:
-     *
-     * |r.r r.g r.b 0|
-     * |g.r g.g g.b 0|
-     * |b.r b.g b.b 0|
-     * |Tr  Tg  Tb  1|
-     *
-     * This matrix will be provided in row-major form:
-     *
-     * {r.r, r.g, r.b, 0, g.r, ...}.
-     *
-     * Given a matrix of this form and an input color [R_in, G_in, B_in], the
-     * output color [R_out, G_out, B_out] will be:
-     *
-     * R_out = R_in * r.r + G_in * g.r + B_in * b.r + Tr
-     * G_out = R_in * r.g + G_in * g.g + B_in * b.g + Tg
-     * B_out = R_in * r.b + G_in * g.b + B_in * b.b + Tb
-     *
-     * @param display is the display to which the color transform is set.
-     * @param matrix is a 4x4 transform matrix (16 floats) as described above.
-     * @param hint is a hint value which may be used instead of the given
-     *        matrix unless it is ColorTransform::ARBITRARY.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_PARAMETER when hint is not a valid color transform hint.
-     */
-    setColorTransform(Display display,
-                      vec<float> matrix,
-                      ColorTransform hint)
-           generates (Error error);
-
-    /*
-     * Sets the output buffer for a virtual display. That is, the buffer to
-     * which the composition result will be written.
-     *
-     * Also provides a file descriptor referring to a release sync fence
-     * object, which will be signaled when it is safe to write to the output
-     * buffer. If it is already safe to write to the output buffer, an empty
-     * handle may be passed instead.
-     *
-     * Must be called at least once before presentDisplay, but does not have
-     * any interaction with layer state or display validation.
-     *
-     * @param display is the virtual display to which the output buffer is
-     *        set.
-     * @param buffer is the new output buffer.
-     * @param releaseFence is a sync fence file descriptor as described above.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_PARAMETER when the new output buffer handle was invalid.
-     *         UNSUPPORTED when display does not refer to a virtual display.
-     */
-    setOutputBuffer(Display display,
-                    handle buffer,
-                    handle releaseFence)
-         generates (Error error);
-
-    /*
-     * Sets the power mode of the given display. The transition must be
-     * complete when this function returns. It is valid to call this function
-     * multiple times with the same power mode.
-     *
-     * All displays must support PowerMode::ON and PowerMode::OFF.  Whether a
-     * display supports PowerMode::DOZE or PowerMode::DOZE_SUSPEND may be
-     * queried using getDozeSupport.
-     *
-     * @param display is the display to which the power mode is set.
-     * @param mode is the new power mode.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_PARAMETER when mode was not a valid power mode.
-     *         UNSUPPORTED when mode is not supported on this display.
-     */
-    setPowerMode(Display display, PowerMode mode) generates (Error error);
-
-    /*
-     * Enables or disables the vsync signal for the given display. Virtual
-     * displays never generate vsync callbacks, and any attempt to enable
-     * vsync for a virtual display though this function must succeed and have
-     * no other effect.
-     *
-     * @param display is the display to which the vsync mode is set.
-     * @param enabled indicates whether to enable or disable vsync
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_PARAMETER when enabled was an invalid value.
-     */
-    setVsyncEnabled(Display display, Vsync enabled) generates (Error error);
-
-    /*
-     * Instructs the device to inspect all of the layer state and determine if
-     * there are any composition type changes necessary before presenting the
-     * display. Permitted changes are described in the definition of
-     * Composition above.
-     *
-     * Also returns the number of layer requests required by the given layer
-     * configuration.
-     *
-     * @param display is the display to validate.
-     * @return error is NONE or HAS_CHANGES upon success.
-     *         NONE when no changes are necessary and it is safe to present
-     *              the display using the current layer state.
-     *         HAS_CHANGES when composition type changes are needed.
-     *         Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     * @return numTypes is the number of composition type changes required by
-     *         the device; if greater than 0, the client must either set and
-     *         validate new types, or call acceptDisplayChanges to accept the
-     *         changes returned by getChangedCompositionTypes. It must be the
-     *         same as the number of changes returned by
-     *         getChangedCompositionTypes (see the declaration of that
-     *         function for more information).
-     * @return numRequests is the number of layer requests required by this
-     *         layer configuration. It must be equal to the number of layer
-     *         requests returned by getDisplayRequests (see the declaration of
-     *         that function for more information).
-     */
-    validateDisplay(Display display)
-         generates (Error error,
-                    uint32_t numTypes,
-                    uint32_t numRequests);
-
-    /*
-     * Layer Functions
-     *
-     * These are functions which operate on layers, but which do not modify
-     * state that must be validated before use. See also 'Layer State
-     * Functions' below.
-     */
-
-    /*
-     * Asynchronously sets the position of a cursor layer.
-     *
-     * Prior to validateDisplay, a layer may be marked as Composition::CURSOR.
-     * If validation succeeds (i.e., the device does not request a composition
-     * change for that layer), then once a buffer has been set for the layer
-     * and it has been presented, its position may be set by this function at
-     * any time between presentDisplay and any subsequent validateDisplay
-     * calls for this display.
-     *
-     * Once validateDisplay is called, this function will not be called again
-     * until the validate/present sequence is completed.
-     *
-     * May be called from any thread so long as it is not interleaved with the
-     * validate/present sequence as described above.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the position is set.
-     * @param x is the new x coordinate (in pixels from the left of the
-     *        screen).
-     * @param y is the new y coordinate (in pixels from the top of the
-     *        screen).
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when the layer is invalid or is not currently marked
-     *                   as Composition::CURSOR.
-     *         NOT_VALIDATED when the device is currently in the middle of the
-     *                       validate/present sequence.
-     */
-    setCursorPosition(Display display,
-                      Layer layer,
-                      int32_t x,
-                      int32_t y)
-           generates (Error error);
-
-    /*
-     * Sets the buffer handle to be displayed for this layer. If the buffer
-     * properties set at allocation time (width, height, format, and usage)
-     * have not changed since the previous frame, it is not necessary to call
-     * validateDisplay before calling presentDisplay unless new state needs to
-     * be validated in the interim.
-     *
-     * Also provides a file descriptor referring to an acquire sync fence
-     * object, which will be signaled when it is safe to read from the given
-     * buffer. If it is already safe to read from the buffer, an empty handle
-     * may be passed instead.
-     *
-     * This function must return NONE and have no other effect if called for a
-     * layer with a composition type of Composition::SOLID_COLOR (because it
-     * has no buffer) or Composition::SIDEBAND or Composition::CLIENT (because
-     * synchronization and buffer updates for these layers are handled
-     * elsewhere).
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the buffer is set.
-     * @param buffer is the buffer handle to set.
-     * @param acquireFence is a sync fence file descriptor as described above.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     *         BAD_PARAMETER when the buffer handle passed in was invalid.
-     */
-    setLayerBuffer(Display display,
-                   Layer layer,
-                   handle buffer,
-                   handle acquireFence)
-        generates (Error error);
-
-    /*
-     * Provides the region of the source buffer which has been modified since
-     * the last frame. This region does not need to be validated before
-     * calling presentDisplay.
-     *
-     * Once set through this function, the damage region remains the same
-     * until a subsequent call to this function.
-     *
-     * If damage is non-empty, then it may be assumed that any portion of the
-     * source buffer not covered by one of the rects has not been modified
-     * this frame. If damage is empty, then the whole source buffer must be
-     * treated as if it has been modified.
-     *
-     * If the layer's contents are not modified relative to the prior frame,
-     * damage will contain exactly one empty rect([0, 0, 0, 0]).
-     *
-     * The damage rects are relative to the pre-transformed buffer, and their
-     * origin is the top-left corner. They will not exceed the dimensions of
-     * the latched buffer.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the damage region is set.
-     * @param damage is the new surface damage region.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerSurfaceDamage(Display display,
-                          Layer layer,
-                          vec<Rect> damage)
-               generates (Error error);
-
-    /*
-     * Layer State Functions
-     *
-     * These functions modify the state of a given layer. They do not take
-     * effect until the display configuration is successfully validated with
-     * validateDisplay and the display contents are presented with
-     * presentDisplay.
-     */
-
-    /*
-     * Sets the blend mode of the given layer.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the blend mode is set.
-     * @param mode is the new blend mode.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     *         BAD_PARAMETER when an invalid blend mode was passed in.
-     */
-    setLayerBlendMode(Display display,
-                      Layer layer,
-                      BlendMode mode)
-           generates (Error error);
-
-    /*
-     * Sets the color of the given layer. If the composition type of the layer
-     * is not Composition::SOLID_COLOR, this call must succeed and have no
-     * other effect.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the blend mode is set.
-     * @param color is the new color.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerColor(Display display,
-                  Layer layer,
-                  Color color)
-       generates (Error error);
-
-    /*
-     * Sets the desired composition type of the given layer. During
-     * validateDisplay, the device may request changes to the composition
-     * types of any of the layers as described in the definition of
-     * Composition above.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the blend mode is set.
-     * @param type is the new composition type.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     *         BAD_PARAMETER when an invalid composition type was passed in.
-     *         UNSUPPORTED when a valid composition type was passed in, but it
-     *                     is not supported by this device.
-     */
-    setLayerCompositionType(Display display,
-                            Layer layer,
-                            Composition type)
-                 generates (Error error);
-
-    /*
-     * Sets the dataspace that the current buffer on this layer is in.
-     *
-     * The dataspace provides more information about how to interpret the
-     * buffer contents, such as the encoding standard and color transform.
-     *
-     * See the values of Dataspace for more information.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the dataspace is set.
-     * @param dataspace is the new dataspace.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerDataspace(Display display,
-                      Layer layer,
-                      Dataspace dataspace)
-           generates (Error error);
-
-    /*
-     * Sets the display frame (the portion of the display covered by a layer)
-     * of the given layer. This frame will not exceed the display dimensions.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the frame is set.
-     * @param frame is the new display frame.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerDisplayFrame(Display display,
-                         Layer layer,
-                         Rect frame)
-              generates (Error error);
-
-    /*
-     * Sets an alpha value (a floating point value in the range [0.0, 1.0])
-     * which will be applied to the whole layer. It can be conceptualized as a
-     * preprocessing step which applies the following function:
-     *   if (blendMode == BlendMode::PREMULTIPLIED)
-     *       out.rgb = in.rgb * planeAlpha
-     *   out.a = in.a * planeAlpha
-     *
-     * If the device does not support this operation on a layer which is
-     * marked Composition::DEVICE, it must request a composition type change
-     * to Composition::CLIENT upon the next validateDisplay call.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the plane alpha is set.
-     * @param alpha is the plane alpha value to apply.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerPlaneAlpha(Display display,
-                       Layer layer,
-                       float alpha)
-            generates (Error error);
-
-    /*
-     * Sets the sideband stream for this layer. If the composition type of the
-     * given layer is not Composition::SIDEBAND, this call must succeed and
-     * have no other effect.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the sideband stream is set.
-     * @param stream is the new sideband stream.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     *         BAD_PARAMETER when an invalid sideband stream was passed in.
-     */
-    setLayerSidebandStream(Display display,
-                           Layer layer,
-                           handle stream)
-                generates (Error error);
-
-    /*
-     * Sets the source crop (the portion of the source buffer which will fill
-     * the display frame) of the given layer. This crop rectangle will not
-     * exceed the dimensions of the latched buffer.
-     *
-     * If the device is not capable of supporting a true float source crop
-     * (i.e., it will truncate or round the floats to integers), it should set
-     * this layer to Composition::CLIENT when crop is non-integral for the
-     * most accurate rendering.
-     *
-     * If the device cannot support float source crops, but still wants to
-     * handle the layer, it should use the following code (or similar) to
-     * convert to an integer crop:
-     *   intCrop.left = (int) ceilf(crop.left);
-     *   intCrop.top = (int) ceilf(crop.top);
-     *   intCrop.right = (int) floorf(crop.right);
-     *   intCrop.bottom = (int) floorf(crop.bottom);
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the source crop is set.
-     * @param crop is the new source crop.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerSourceCrop(Display display,
-                       Layer layer,
-                       FRect crop)
-            generates (Error error);
-
-    /*
-     * Sets the transform (rotation/flip) of the given layer.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the transform is set.
-     * @param transform is the new transform.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     *         BAD_PARAMETER when an invalid transform was passed in.
-     */
-    setLayerTransform(Display display,
-                      Layer layer,
-                      Transform transform)
-           generates (Error error);
-
-    /*
-     * Specifies the portion of the layer that is visible, including portions
-     * under translucent areas of other layers. The region is in screen space,
-     * and will not exceed the dimensions of the screen.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the visible region is set.
-     * @param visible is the new visible region, in screen space.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerVisibleRegion(Display display,
-                          Layer layer,
-                          vec<Rect> visible)
-               generates (Error error);
-
-    /*
-     * Sets the desired Z order (height) of the given layer. A layer with a
-     * greater Z value occludes a layer with a lesser Z value.
-     *
-     * @param display is the display on which the layer was created.
-     * @param layer is the layer to which the Z order is set.
-     * @param z is the new Z order.
-     * @return error is NONE upon success. Otherwise,
-     *         BAD_DISPLAY when an invalid display handle was passed in.
-     *         BAD_LAYER when an invalid layer handle was passed in.
-     */
-    setLayerZOrder(Display display,
-                   Layer layer,
-                   uint32_t z)
-        generates (Error error);
+    createClient() generates (Error error, IComposerClient client);
 };
diff --git a/graphics/composer/2.1/IComposerClient.hal b/graphics/composer/2.1/IComposerClient.hal
new file mode 100644
index 0000000..1a82215
--- /dev/null
+++ b/graphics/composer/2.1/IComposerClient.hal
@@ -0,0 +1,1118 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.composer@2.1;
+
+import android.hardware.graphics.common@1.0;
+import IComposerCallback;
+
+interface IComposerClient {
+    /* Display attributes queryable through getDisplayAttribute. */
+    enum Attribute : int32_t {
+        INVALID = 0,
+
+        /* Dimensions in pixels */
+        WIDTH = 1,
+        HEIGHT = 2,
+
+        /* Vsync period in nanoseconds */
+        VSYNC_PERIOD = 3,
+
+        /*
+         * Dots per thousand inches (DPI * 1000). Scaling by 1000 allows these
+         * numbers to be stored in an int32_t without losing too much
+         * precision. If the DPI for a configuration is unavailable or is
+         * considered unreliable, the device may return UNSUPPORTED instead.
+         */
+        DPI_X = 4,
+        DPI_Y = 5,
+    };
+
+    /* Display requests returned by getDisplayRequests. */
+    enum DisplayRequest : uint32_t {
+        /*
+         * Instructs the client to provide a new client target buffer, even if
+         * no layers are marked for client composition.
+         */
+        FLIP_CLIENT_TARGET = 1 << 0,
+
+        /*
+         * Instructs the client to write the result of client composition
+         * directly into the virtual display output buffer. If any of the
+         * layers are not marked as Composition::CLIENT or the given display
+         * is not a virtual display, this request has no effect.
+         */
+        WRITE_CLIENT_TARGET_TO_OUTPUT = 1 << 1,
+    };
+
+    /* Layer requests returned from getDisplayRequests. */
+    enum LayerRequest : uint32_t {
+        /*
+         * The client must clear its target with transparent pixels where
+         * this layer would be. The client may ignore this request if the
+         * layer must be blended.
+         */
+        CLEAR_CLIENT_TARGET = 1 << 0,
+    };
+
+    /* Power modes for use with setPowerMode. */
+    enum PowerMode : int32_t {
+        /* The display is fully off (blanked). */
+        OFF = 0,
+
+        /*
+         * These are optional low power modes. getDozeSupport may be called to
+         * determine whether a given display supports these modes.
+         */
+
+        /*
+         * The display is turned on and configured in a low power state that
+         * is suitable for presenting ambient information to the user,
+         * possibly with lower fidelity than ON, but with greater efficiency.
+         */
+        DOZE = 1,
+
+        /*
+         * The display is configured as in DOZE but may stop applying display
+         * updates from the client. This is effectively a hint to the device
+         * that drawing to the display has been suspended and that the the
+         * device must remain on in a low power state and continue
+         * displaying its current contents indefinitely until the power mode
+         * changes.
+         *
+         * This mode may also be used as a signal to enable hardware-based
+         * doze functionality. In this case, the device is free to take over
+         * the display and manage it autonomously to implement a low power
+         * always-on display.
+         */
+        DOZE_SUSPEND = 3,
+
+        /* The display is fully on. */
+        ON = 2,
+    };
+
+    /* Vsync values passed to setVsyncEnabled. */
+    enum Vsync : int32_t {
+        INVALID = 0,
+
+        /* Enable vsync. */
+        ENABLE = 1,
+
+        /* Disable vsync. */
+        DISABLE = 2,
+    };
+
+    /* Blend modes, settable per layer. */
+    enum BlendMode : int32_t {
+        INVALID = 0,
+
+        /* colorOut = colorSrc */
+        NONE = 1,
+
+        /* colorOut = colorSrc + colorDst * (1 - alphaSrc) */
+        PREMULTIPLIED = 2,
+
+        /* colorOut = colorSrc * alphaSrc + colorDst * (1 - alphaSrc) */
+        COVERAGE = 3,
+    };
+
+    /* Possible composition types for a given layer. */
+    enum Composition : int32_t {
+        INVALID = 0,
+
+        /*
+         * The client must composite this layer into the client target buffer
+         * (provided to the device through setClientTarget).
+         *
+         * The device must not request any composition type changes for layers
+         * of this type.
+         */
+        CLIENT = 1,
+
+        /*
+         * The device must handle the composition of this layer through a
+         * hardware overlay or other similar means.
+         *
+         * Upon validateDisplay, the device may request a change from this
+         * type to CLIENT.
+         */
+        DEVICE = 2,
+
+        /*
+         * The device must render this layer using the color set through
+         * setLayerColor. If this functionality is not supported on a layer
+         * that the client sets to SOLID_COLOR, the device must request that
+         * the composition type of that layer is changed to CLIENT upon the
+         * next call to validateDisplay.
+         *
+         * Upon validateDisplay, the device may request a change from this
+         * type to CLIENT.
+         */
+        SOLID_COLOR = 3,
+
+        /*
+         * Similar to DEVICE, but the position of this layer may also be set
+         * asynchronously through setCursorPosition. If this functionality is
+         * not supported on a layer that the client sets to CURSOR, the device
+         * must request that the composition type of that layer is changed to
+         * CLIENT upon the next call to validateDisplay.
+         *
+         * Upon validateDisplay, the device may request a change from this
+         * type to either DEVICE or CLIENT.  Changing to DEVICE will prevent
+         * the use of setCursorPosition but still permit the device to
+         * composite the layer.
+         */
+        CURSOR = 4,
+
+        /*
+         * The device must handle the composition of this layer, as well as
+         * its buffer updates and content synchronization. Only supported on
+         * devices which provide Capability::SIDEBAND_STREAM.
+         *
+         * Upon validateDisplay, the device may request a change from this
+         * type to either DEVICE or CLIENT, but it is unlikely that content
+         * will display correctly in these cases.
+         */
+        SIDEBAND = 5,
+    };
+
+    /* Display types returned by getDisplayType. */
+    enum DisplayType : int32_t {
+        INVALID = 0,
+
+        /*
+         * All physical displays, including both internal displays and
+         * hotpluggable external displays.
+         */
+        PHYSICAL = 1,
+
+        /* Virtual displays created by createVirtualDisplay. */
+        VIRTUAL = 2,
+    };
+
+    /* Special index values (always negative) for command queue commands. */
+    enum HandleIndex : int32_t {
+        /* No handle */
+        EMPTY = -1,
+
+        /* Use cached handle */
+        CACHED = -2,
+    };
+
+    struct Rect {
+        int32_t left;
+        int32_t top;
+        int32_t right;
+        int32_t bottom;
+    };
+
+    struct FRect {
+        float left;
+        float top;
+        float right;
+        float bottom;
+    };
+
+    struct Color {
+        uint8_t r;
+        uint8_t g;
+        uint8_t b;
+        uint8_t a;
+    };
+
+    /*
+     * Provides a IComposerCallback object for the device to call.
+     *
+     * This function must be called only once.
+     *
+     * @param callback is the IComposerCallback object.
+     */
+    registerCallback(IComposerCallback callback);
+
+    /*
+     * Returns the maximum number of virtual displays supported by this device
+     * (which may be 0). The client must not attempt to create more than this
+     * many virtual displays on this device. This number must not change for
+     * the lifetime of the device.
+     *
+     * @return count is the maximum number of virtual displays supported.
+     */
+    getMaxVirtualDisplayCount() generates (uint32_t count);
+
+    /*
+     * Creates a new virtual display with the given width and height. The
+     * format passed into this function is the default format requested by the
+     * consumer of the virtual display output buffers.
+     *
+     * The display must be assumed to be on from the time the first frame is
+     * presented until the display is destroyed.
+     *
+     * @param width is the width in pixels.
+     * @param height is the height in pixels.
+     * @param formatHint is the default output buffer format selected by
+     *        the consumer.
+     * @param outputBufferSlotCount is the number of output buffer slots to be
+     *        reserved.
+     * @return error is NONE upon success. Otherwise,
+     *         UNSUPPORTED when the width or height is too large for the
+     *                     device to be able to create a virtual display.
+     *         NO_RESOURCES when the device is unable to create a new virtual
+     *                      display at this time.
+     * @return display is the newly-created virtual display.
+     * @return format is the format of the buffer the device will produce.
+     */
+    createVirtualDisplay(uint32_t width,
+                         uint32_t height,
+                         PixelFormat formatHint,
+                         uint32_t outputBufferSlotCount)
+              generates (Error error,
+                         Display display,
+                         PixelFormat format);
+
+    /*
+     * Destroys a virtual display. After this call all resources consumed by
+     * this display may be freed by the device and any operations performed on
+     * this display must fail.
+     *
+     * @param display is the virtual display to destroy.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_PARAMETER when the display handle which was passed in does
+     *                       not refer to a virtual display.
+     */
+    destroyVirtualDisplay(Display display) generates (Error error);
+
+    /*
+     * Creates a new layer on the given display.
+     *
+     * @param display is the display on which to create the layer.
+     * @param bufferSlotCount is the number of buffer slot to be reserved.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         NO_RESOURCES when the device was unable to create a layer this
+     *                      time.
+     * @return layer is the handle of the new layer.
+     */
+    createLayer(Display display,
+                uint32_t bufferSlotCount)
+     generates (Error error,
+                Layer layer);
+
+    /*
+     * Destroys the given layer.
+     *
+     * @param display is the display on which the layer was created.
+     * @param layer is the layer to destroy.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_LAYER when an invalid layer handle was passed in.
+     */
+    destroyLayer(Display display, Layer layer) generates (Error error);
+
+    /*
+     * Retrieves which display configuration is currently active.
+     *
+     * If no display configuration is currently active, this function must
+     * return BAD_CONFIG. It is the responsibility of the client to call
+     * setActiveConfig with a valid configuration before attempting to present
+     * anything on the display.
+     *
+     * @param display is the display to which the active config is queried.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_CONFIG when no configuration is currently active.
+     * @return config is the currently active display configuration.
+     */
+    getActiveConfig(Display display) generates (Error error, Config config);
+
+    /*
+     * Returns whether a client target with the given properties can be
+     * handled by the device.
+     *
+     * This function must return true for a client target with width and
+     * height equal to the active display configuration dimensions,
+     * PixelFormat::RGBA_8888, and Dataspace::UNKNOWN. It is not required to
+     * return true for any other configuration.
+     *
+     * @param display is the display to query.
+     * @param width is the client target width in pixels.
+     * @param height is the client target height in pixels.
+     * @param format is the client target format.
+     * @param dataspace is the client target dataspace, as described in
+     *        setLayerDataspace.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         UNSUPPORTED when the given configuration is not supported.
+     */
+    getClientTargetSupport(Display display,
+                           uint32_t width,
+                           uint32_t height,
+                           PixelFormat format,
+                           Dataspace dataspace)
+                generates (Error error);
+
+    /*
+     * Returns the color modes supported on this display.
+     *
+     * All devices must support at least ColorMode::NATIVE.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     * @return modes is an array of color modes.
+     */
+    getColorModes(Display display)
+       generates (Error error,
+                  vec<ColorMode> modes);
+
+    /*
+     * Returns a display attribute value for a particular display
+     * configuration.
+     *
+     * @param display is the display to query.
+     * @param config is the display configuration for which to return
+     *        attribute values.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_CONFIG when config does not name a valid configuration for
+     *                    this display.
+     *         BAD_PARAMETER when attribute is unrecognized.
+     *         UNSUPPORTED when attribute cannot be queried for the config.
+     * @return value is the value of the attribute.
+     */
+    getDisplayAttribute(Display display,
+                        Config config,
+                        Attribute attribute)
+             generates (Error error,
+                        int32_t value);
+
+    /*
+     * Returns handles for all of the valid display configurations on this
+     * display.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     * @return configs is an array of configuration handles.
+     */
+    getDisplayConfigs(Display display)
+           generates (Error error,
+                      vec<Config> configs);
+
+    /*
+     * Returns a human-readable version of the display's name.
+     *
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     * @return name is the name of the display.
+     */
+    getDisplayName(Display display) generates (Error error, string name);
+
+    /*
+     * Returns whether the given display is a physical or virtual display.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     * @return type is the type of the display.
+     */
+    getDisplayType(Display display) generates (Error error, DisplayType type);
+
+    /*
+     * Returns whether the given display supports PowerMode::DOZE and
+     * PowerMode::DOZE_SUSPEND. DOZE_SUSPEND may not provide any benefit over
+     * DOZE (see the definition of PowerMode for more information), but if
+     * both DOZE and DOZE_SUSPEND are no different from PowerMode::ON, the
+     * device must not claim support.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     * @return support is true only when the display supports doze modes.
+     */
+    getDozeSupport(Display display) generates (Error error, bool support);
+
+    /*
+     * Returns the high dynamic range (HDR) capabilities of the given display,
+     * which are invariant with regard to the active configuration.
+     *
+     * Displays which are not HDR-capable must return no types.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     * @return types is an array of HDR types, may have 0 elements if the
+     *         display is not HDR-capable.
+     * @return maxLuminance is the desired content maximum luminance for this
+     *         display in cd/m^2.
+     * @return maxAverageLuminance - the desired content maximum frame-average
+     *         luminance for this display in cd/m^2.
+     * @return minLuminance is the desired content minimum luminance for this
+     *         display in cd/m^2.
+     */
+    getHdrCapabilities(Display display)
+            generates (Error error,
+                       vec<Hdr> types,
+                       float maxLuminance,
+                       float maxAverageLuminance,
+                       float minLuminance);
+
+    /*
+     * Set the number of client target slots to be reserved.
+     *
+     * @param display is the display to which the slots are reserved.
+     * @param clientTargetSlotCount is the slot count for client targets.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         NO_RESOURCES when unable to reserve the slots.
+     */
+    setClientTargetSlotCount(Display display,
+                             uint32_t clientTargetSlotCount)
+                  generates (Error error);
+
+    /*
+     * Sets the active configuration for this display. Upon returning, the
+     * given display configuration must be active and remain so until either
+     * this function is called again or the display is disconnected.
+     *
+     * @param display is the display to which the active config is set.
+     * @param config is the new display configuration.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_CONFIG when the configuration handle passed in is not valid
+     *                    for this display.
+     */
+    setActiveConfig(Display display, Config config) generates (Error error);
+
+    /*
+     * Sets the color mode of the given display.
+     *
+     * Upon returning from this function, the color mode change must have
+     * fully taken effect.
+     *
+     * All devices must support at least ColorMode::NATIVE, and displays are
+     * assumed to be in this mode upon hotplug.
+     *
+     * @param display is the display to which the color mode is set.
+     * @param mode is the mode to set to.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_PARAMETER when mode is not a valid color mode.
+     *         UNSUPPORTED when mode is not supported on this display.
+     */
+    setColorMode(Display display, ColorMode mode) generates (Error error);
+
+    /*
+     * Sets the power mode of the given display. The transition must be
+     * complete when this function returns. It is valid to call this function
+     * multiple times with the same power mode.
+     *
+     * All displays must support PowerMode::ON and PowerMode::OFF.  Whether a
+     * display supports PowerMode::DOZE or PowerMode::DOZE_SUSPEND may be
+     * queried using getDozeSupport.
+     *
+     * @param display is the display to which the power mode is set.
+     * @param mode is the new power mode.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_PARAMETER when mode was not a valid power mode.
+     *         UNSUPPORTED when mode is not supported on this display.
+     */
+    setPowerMode(Display display, PowerMode mode) generates (Error error);
+
+    /*
+     * Enables or disables the vsync signal for the given display. Virtual
+     * displays never generate vsync callbacks, and any attempt to enable
+     * vsync for a virtual display though this function must succeed and have
+     * no other effect.
+     *
+     * @param display is the display to which the vsync mode is set.
+     * @param enabled indicates whether to enable or disable vsync
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_PARAMETER when enabled was an invalid value.
+     */
+    setVsyncEnabled(Display display, Vsync enabled) generates (Error error);
+
+    /*
+     * Sets the input command message queue.
+     *
+     * @param descriptor is the descriptor of the input command message queue.
+     * @return error is NONE upon success. Otherwise,
+     *         NO_RESOURCES when failed to set the queue temporarily.
+     */
+    setInputCommandQueue(MQDescriptorSync descriptor)
+              generates (Error error);
+
+    /*
+     * Gets the output command message queue.
+     *
+     * This function must only be called inside executeCommands closure.
+     *
+     * @return error is NONE upon success. Otherwise,
+     *         NO_RESOURCES when failed to get the queue temporarily.
+     * @return descriptor is the descriptor of the output command queue.
+     */
+    getOutputCommandQueue()
+              generates (Error error,
+                         MQDescriptorSync descriptor);
+
+    /*
+     * Executes commands from the input command message queue. Return values
+     * generated by the input commands are written to the output command
+     * message queue in the form of value commands.
+     *
+     * @param inLength is the length of input commands.
+     * @param inHandles is an array of handles referenced by the input
+     *        commands.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_PARAMETER when inLength is not equal to the length of
+     *                       commands in the input command message queue.
+     *         NO_RESOURCES when the output command message queue was not
+     *                      properly drained.
+     * @param outQueueChanged indicates whether the output command message
+     *        queue has changed.
+     * @param outLength is the length of output commands.
+     * @param outHandles is an array of handles referenced by the output
+     *        commands.
+     */
+    executeCommands(uint32_t inLength,
+                    vec<handle> inHandles)
+         generates (Error error,
+                    bool outQueueChanged,
+                    uint32_t outLength,
+                    vec<handle> outHandles);
+
+    /*
+     * SELECT_DISPLAY has this pseudo prototype
+     *
+     *   selectDisplay(Display display);
+     *
+     * Selects the current display implied by all other commands.
+     *
+     * @param display is the newly selected display.
+     *
+     *
+     * SELECT_LAYER has this pseudo prototype
+     *
+     *   selectLayer(Layer layer);
+     *
+     * Selects the current layer implied by all implicit layer commands.
+     *
+     * @param layer is the newly selected layer.
+     *
+     *
+     * SET_ERROR has this pseudo prototype
+     *
+     *   setError(uint32_t location, Error error);
+     *
+     * Indicates an error generated by a command.
+     *
+     * @param location is the offset of the command in the input command
+     *        message queue.
+     * @param error is the error generated by the command.
+     *
+     *
+     * SET_CHANGED_COMPOSITION_TYPES has this pseudo prototype
+     *
+     *   setChangedCompositionTypes(vec<Layer> layers,
+     *                              vec<Composition> types);
+     *
+     * Sets the layers for which the device requires a different composition
+     * type than had been set prior to the last call to VALIDATE_DISPLAY. The
+     * client must either update its state with these types and call
+     * ACCEPT_DISPLAY_CHANGES, or must set new types and attempt to validate
+     * the display again.
+     *
+     * @param layers is an array of layer handles.
+     * @param types is an array of composition types, each corresponding to
+     *         an element of layers.
+     *
+     *
+     * SET_DISPLAY_REQUESTS has this pseudo prototype
+     *
+     *   setDisplayRequests(uint32_t displayRequestMask,
+     *                      vec<Layer> layers,
+     *                      vec<uint32_t> layerRequestMasks);
+     *
+     * Sets the display requests and the layer requests required for the last
+     * validated configuration.
+     *
+     * Display requests provide information about how the client must handle
+     * the client target. Layer requests provide information about how the
+     * client must handle an individual layer.
+     *
+     * @param displayRequestMask is the display requests for the current
+     *        validated state.
+     * @param layers is an array of layers which all have at least one
+     *        request.
+     * @param layerRequestMasks is the requests corresponding to each element
+     *        of layers.
+     *
+     *
+     * SET_PRESENT_FENCE has this pseudo prototype
+     *
+     *   setPresentFence(int32_t presentFenceIndex);
+     *
+     * Sets the present fence as a result of PRESENT_DISPLAY. For physical
+     * displays, this fence must be signaled at the vsync when the result
+     * of composition of this frame starts to appear (for video-mode panels)
+     * or starts to transfer to panel memory (for command-mode panels). For
+     * virtual displays, this fence must be signaled when writes to the output
+     * buffer have completed and it is safe to read from it.
+     *
+     * @param presentFenceIndex is an index into outHandles array.
+     *
+     *
+     * SET_RELEASE_FENCES has this pseudo prototype
+     *
+     *   setReleaseFences(vec<Layer> layers,
+     *                    vec<int32_t> releaseFenceIndices);
+     *
+     * Sets the release fences for device layers on this display which will
+     * receive new buffer contents this frame.
+     *
+     * A release fence is a file descriptor referring to a sync fence object
+     * which must be signaled after the device has finished reading from the
+     * buffer presented in the prior frame. This indicates that it is safe to
+     * start writing to the buffer again. If a given layer's fence is not
+     * returned from this function, it must be assumed that the buffer
+     * presented on the previous frame is ready to be written.
+     *
+     * The fences returned by this function must be unique for each layer
+     * (even if they point to the same underlying sync object).
+     *
+     * @param layers is an array of layer handles.
+     * @param releaseFenceIndices are indices into outHandles array, each
+     *        corresponding to an element of layers.
+     *
+     *
+     * SET_COLOR_TRANSFORM has this pseudo prototype
+     *
+     *   setColorTransform(float[16] matrix,
+     *                     ColorTransform hint);
+     *
+     * Sets a color transform which will be applied after composition.
+     *
+     * If hint is not ColorTransform::ARBITRARY, then the device may use the
+     * hint to apply the desired color transform instead of using the color
+     * matrix directly.
+     *
+     * If the device is not capable of either using the hint or the matrix to
+     * apply the desired color transform, it must force all layers to client
+     * composition during VALIDATE_DISPLAY.
+     *
+     * If IComposer::Capability::SKIP_CLIENT_COLOR_TRANSFORM is present, then
+     * the client must never apply the color transform during client
+     * composition, even if all layers are being composed by the client.
+     *
+     * The matrix provided is an affine color transformation of the following
+     * form:
+     *
+     * |r.r r.g r.b 0|
+     * |g.r g.g g.b 0|
+     * |b.r b.g b.b 0|
+     * |Tr  Tg  Tb  1|
+     *
+     * This matrix must be provided in row-major form:
+     *
+     * {r.r, r.g, r.b, 0, g.r, ...}.
+     *
+     * Given a matrix of this form and an input color [R_in, G_in, B_in], the
+     * output color [R_out, G_out, B_out] will be:
+     *
+     * R_out = R_in * r.r + G_in * g.r + B_in * b.r + Tr
+     * G_out = R_in * r.g + G_in * g.g + B_in * b.g + Tg
+     * B_out = R_in * r.b + G_in * g.b + B_in * b.b + Tb
+     *
+     * @param matrix is a 4x4 transform matrix (16 floats) as described above.
+     * @param hint is a hint value which may be used instead of the given
+     *        matrix unless it is ColorTransform::ARBITRARY.
+     *
+     *
+     * SET_CLIENT_TARGET has this pseudo prototype
+     *
+     *   setClientTarget(uint32_t targetSlot,
+     *                   int32_t targetIndex,
+     *                   int32_t acquireFenceIndex,
+     *                   Dataspace dataspace,
+     *                   vec<Rect> damage);
+     *
+     * Sets the buffer handle which will receive the output of client
+     * composition.  Layers marked as Composition::CLIENT must be composited
+     * into this buffer prior to the call to PRESENT_DISPLAY, and layers not
+     * marked as Composition::CLIENT must be composited with this buffer by
+     * the device.
+     *
+     * The buffer handle provided may be empty if no layers are being
+     * composited by the client. This must not result in an error (unless an
+     * invalid display handle is also provided).
+     *
+     * Also provides a file descriptor referring to an acquire sync fence
+     * object, which must be signaled when it is safe to read from the client
+     * target buffer.  If it is already safe to read from this buffer, an
+     * empty handle may be passed instead.
+     *
+     * For more about dataspaces, see SET_LAYER_DATASPACE.
+     *
+     * The damage parameter describes a surface damage region as defined in
+     * the description of SET_LAYER_SURFACE_DAMAGE.
+     *
+     * Will be called before PRESENT_DISPLAY if any of the layers are marked
+     * as Composition::CLIENT. If no layers are so marked, then it is not
+     * necessary to call this function. It is not necessary to call
+     * validateDisplay after changing the target through this function.
+     *
+     * @param targetSlot is the client target buffer slot to use.
+     * @param targetIndex is an index into inHandles for the new target
+     *        buffer.
+     * @param acquireFenceIndex is an index into inHandles for a sync fence
+     *        file descriptor as described above.
+     * @param dataspace is the dataspace of the buffer, as described in
+     *        setLayerDataspace.
+     * @param damage is the surface damage region.
+     *
+     *
+     * SET_OUTPUT_BUFFER has this pseudo prototype
+     *
+     *   setOutputBuffer(uint32_t bufferSlot,
+     *                   int32_t bufferIndex,
+     *                   int32_t releaseFenceIndex);
+     *
+     * Sets the output buffer for a virtual display. That is, the buffer to
+     * which the composition result will be written.
+     *
+     * Also provides a file descriptor referring to a release sync fence
+     * object, which must be signaled when it is safe to write to the output
+     * buffer. If it is already safe to write to the output buffer, an empty
+     * handle may be passed instead.
+     *
+     * Must be called at least once before PRESENT_DISPLAY, but does not have
+     * any interaction with layer state or display validation.
+     *
+     * @param bufferSlot is the new output buffer.
+     * @param bufferIndex is the new output buffer.
+     * @param releaseFenceIndex is a sync fence file descriptor as described
+     *        above.
+     *
+     *
+     * VALIDATE_DISPLAY has this pseudo prototype
+     *
+     *   validateDisplay();
+     *
+     * Instructs the device to inspect all of the layer state and determine if
+     * there are any composition type changes necessary before presenting the
+     * display. Permitted changes are described in the definition of
+     * Composition above.
+     *
+     *
+     * ACCEPT_DISPLAY_CHANGES has this pseudo prototype
+     *
+     *   acceptDisplayChanges();
+     *
+     * Accepts the changes required by the device from the previous
+     * validateDisplay call (which may be queried using
+     * getChangedCompositionTypes) and revalidates the display. This function
+     * is equivalent to requesting the changed types from
+     * getChangedCompositionTypes, setting those types on the corresponding
+     * layers, and then calling validateDisplay again.
+     *
+     * After this call it must be valid to present this display. Calling this
+     * after validateDisplay returns 0 changes must succeed with NONE, but
+     * must have no other effect.
+     *
+     *
+     * PRESENT_DISPLAY has this pseudo prototype
+     *
+     *   presentDisplay();
+     *
+     * Presents the current display contents on the screen (or in the case of
+     * virtual displays, into the output buffer).
+     *
+     * Prior to calling this function, the display must be successfully
+     * validated with validateDisplay. Note that setLayerBuffer and
+     * setLayerSurfaceDamage specifically do not count as layer state, so if
+     * there are no other changes to the layer state (or to the buffer's
+     * properties as described in setLayerBuffer), then it is safe to call
+     * this function without first validating the display.
+     *
+     *
+     * SET_LAYER_CURSOR_POSITION has this pseudo prototype
+     *
+     *   setLayerCursorPosition(int32_t x, int32_t y);
+     *
+     * Asynchronously sets the position of a cursor layer.
+     *
+     * Prior to validateDisplay, a layer may be marked as Composition::CURSOR.
+     * If validation succeeds (i.e., the device does not request a composition
+     * change for that layer), then once a buffer has been set for the layer
+     * and it has been presented, its position may be set by this function at
+     * any time between presentDisplay and any subsequent validateDisplay
+     * calls for this display.
+     *
+     * Once validateDisplay is called, this function must not be called again
+     * until the validate/present sequence is completed.
+     *
+     * May be called from any thread so long as it is not interleaved with the
+     * validate/present sequence as described above.
+     *
+     * @param layer is the layer to which the position is set.
+     * @param x is the new x coordinate (in pixels from the left of the
+     *        screen).
+     * @param y is the new y coordinate (in pixels from the top of the
+     *        screen).
+     *
+     *
+     * SET_LAYER_BUFFER has this pseudo prototype
+     *
+     *   setLayerBuffer(uint32_t bufferSlot,
+     *                  int32_t bufferIndex,
+     *                  int32_t acquireFenceIndex);
+     *
+     * Sets the buffer handle to be displayed for this layer. If the buffer
+     * properties set at allocation time (width, height, format, and usage)
+     * have not changed since the previous frame, it is not necessary to call
+     * validateDisplay before calling presentDisplay unless new state needs to
+     * be validated in the interim.
+     *
+     * Also provides a file descriptor referring to an acquire sync fence
+     * object, which must be signaled when it is safe to read from the given
+     * buffer. If it is already safe to read from the buffer, an empty handle
+     * may be passed instead.
+     *
+     * This function must return NONE and have no other effect if called for a
+     * layer with a composition type of Composition::SOLID_COLOR (because it
+     * has no buffer) or Composition::SIDEBAND or Composition::CLIENT (because
+     * synchronization and buffer updates for these layers are handled
+     * elsewhere).
+     *
+     * @param layer is the layer to which the buffer is set.
+     * @param bufferSlot is the buffer slot to use.
+     * @param bufferIndex is the buffer handle to set.
+     * @param acquireFenceIndex is a sync fence file descriptor as described above.
+     *
+     *
+     * SET_LAYER_SURFACE_DAMAGE has this pseudo prototype
+     *
+     *   setLayerSurfaceDamage(vec<Rect> damage);
+     *
+     * Provides the region of the source buffer which has been modified since
+     * the last frame. This region does not need to be validated before
+     * calling presentDisplay.
+     *
+     * Once set through this function, the damage region remains the same
+     * until a subsequent call to this function.
+     *
+     * If damage is non-empty, then it may be assumed that any portion of the
+     * source buffer not covered by one of the rects has not been modified
+     * this frame. If damage is empty, then the whole source buffer must be
+     * treated as if it has been modified.
+     *
+     * If the layer's contents are not modified relative to the prior frame,
+     * damage must contain exactly one empty rect([0, 0, 0, 0]).
+     *
+     * The damage rects are relative to the pre-transformed buffer, and their
+     * origin is the top-left corner. They must not exceed the dimensions of
+     * the latched buffer.
+     *
+     * @param layer is the layer to which the damage region is set.
+     * @param damage is the new surface damage region.
+     *
+     *
+     * SET_LAYER_BLEND_MODE has this pseudo prototype
+     *
+     *   setLayerBlendMode(BlendMode mode)
+     *
+     * Sets the blend mode of the given layer.
+     *
+     * @param mode is the new blend mode.
+     *
+     *
+     * SET_LAYER_COLOR has this pseudo prototype
+     *
+     *   setLayerColor(Color color);
+     *
+     * Sets the color of the given layer. If the composition type of the layer
+     * is not Composition::SOLID_COLOR, this call must succeed and have no
+     * other effect.
+     *
+     * @param color is the new color.
+     *
+     *
+     * SET_LAYER_COMPOSITION_TYPE has this pseudo prototype
+     *
+     *   setLayerCompositionType(Composition type);
+     *
+     * Sets the desired composition type of the given layer. During
+     * validateDisplay, the device may request changes to the composition
+     * types of any of the layers as described in the definition of
+     * Composition above.
+     *
+     * @param type is the new composition type.
+     *
+     *
+     * SET_LAYER_DATASPACE has this pseudo prototype
+     *
+     *   setLayerDataspace(Dataspace dataspace);
+     *
+     * Sets the dataspace that the current buffer on this layer is in.
+     *
+     * The dataspace provides more information about how to interpret the
+     * buffer contents, such as the encoding standard and color transform.
+     *
+     * See the values of Dataspace for more information.
+     *
+     * @param dataspace is the new dataspace.
+     *
+     *
+     * SET_LAYER_DISPLAY_FRAME has this pseudo prototype
+     *
+     *   setLayerDisplayFrame(Rect frame);
+     *
+     * Sets the display frame (the portion of the display covered by a layer)
+     * of the given layer. This frame must not exceed the display dimensions.
+     *
+     * @param frame is the new display frame.
+     *
+     *
+     * SET_LAYER_PLANE_ALPHA has this pseudo prototype
+     *
+     *   setLayerPlaneAlpha(float alpha);
+     *
+     * Sets an alpha value (a floating point value in the range [0.0, 1.0])
+     * which will be applied to the whole layer. It can be conceptualized as a
+     * preprocessing step which applies the following function:
+     *   if (blendMode == BlendMode::PREMULTIPLIED)
+     *       out.rgb = in.rgb * planeAlpha
+     *   out.a = in.a * planeAlpha
+     *
+     * If the device does not support this operation on a layer which is
+     * marked Composition::DEVICE, it must request a composition type change
+     * to Composition::CLIENT upon the next validateDisplay call.
+     *
+     * @param alpha is the plane alpha value to apply.
+     *
+     *
+     * SET_LAYER_SIDEBAND_STREAM has this pseudo prototype
+     *
+     *   setLayerSidebandStream(int32_t streamIndex)
+     *
+     * Sets the sideband stream for this layer. If the composition type of the
+     * given layer is not Composition::SIDEBAND, this call must succeed and
+     * have no other effect.
+     *
+     * @param streamIndex is the new sideband stream.
+     *
+     *
+     * SET_LAYER_SOURCE_CROP has this pseudo prototype
+     *
+     *   setLayerSourceCrop(FRect crop);
+     *
+     * Sets the source crop (the portion of the source buffer which will fill
+     * the display frame) of the given layer. This crop rectangle must not
+     * exceed the dimensions of the latched buffer.
+     *
+     * If the device is not capable of supporting a true float source crop
+     * (i.e., it will truncate or round the floats to integers), it must set
+     * this layer to Composition::CLIENT when crop is non-integral for the
+     * most accurate rendering.
+     *
+     * If the device cannot support float source crops, but still wants to
+     * handle the layer, it must use the following code (or similar) to
+     * convert to an integer crop:
+     *   intCrop.left = (int) ceilf(crop.left);
+     *   intCrop.top = (int) ceilf(crop.top);
+     *   intCrop.right = (int) floorf(crop.right);
+     *   intCrop.bottom = (int) floorf(crop.bottom);
+     *
+     * @param crop is the new source crop.
+     *
+     *
+     * SET_LAYER_TRANSFORM has this pseudo prototype
+     *
+     * Sets the transform (rotation/flip) of the given layer.
+     *
+     *   setLayerTransform(Transform transform);
+     *
+     * @param transform is the new transform.
+     *
+     *
+     * SET_LAYER_VISIBLE_REGION has this pseudo prototype
+     *
+     *   setLayerVisibleRegion(vec<Rect> visible);
+     *
+     * Specifies the portion of the layer that is visible, including portions
+     * under translucent areas of other layers. The region is in screen space,
+     * and must not exceed the dimensions of the screen.
+     *
+     * @param visible is the new visible region, in screen space.
+     *
+     *
+     * SET_LAYER_Z_ORDER has this pseudo prototype
+     *
+     *   setLayerZOrder(uint32_t z);
+     *
+     * Sets the desired Z order (height) of the given layer. A layer with a
+     * greater Z value occludes a layer with a lesser Z value.
+     *
+     * @param z is the new Z order.
+     */
+    enum Command : int32_t {
+        LENGTH_MASK                        = 0xffff,
+        OPCODE_SHIFT                       = 16,
+        OPCODE_MASK                        = 0xffff << OPCODE_SHIFT,
+
+        /* special commands */
+        SELECT_DISPLAY                     = 0x000 << OPCODE_SHIFT,
+        SELECT_LAYER                       = 0x001 << OPCODE_SHIFT,
+
+        /* value commands (for return values) */
+        SET_ERROR                          = 0x100 << OPCODE_SHIFT,
+        SET_CHANGED_COMPOSITION_TYPES      = 0x101 << OPCODE_SHIFT,
+        SET_DISPLAY_REQUESTS               = 0x102 << OPCODE_SHIFT,
+        SET_PRESENT_FENCE                  = 0x103 << OPCODE_SHIFT,
+        SET_RELEASE_FENCES                 = 0x104 << OPCODE_SHIFT,
+
+        /* display commands */
+        SET_COLOR_TRANSFORM                = 0x200 << OPCODE_SHIFT,
+        SET_CLIENT_TARGET                  = 0x201 << OPCODE_SHIFT,
+        SET_OUTPUT_BUFFER                  = 0x202 << OPCODE_SHIFT,
+        VALIDATE_DISPLAY                   = 0x203 << OPCODE_SHIFT,
+        ACCEPT_DISPLAY_CHANGES             = 0x204 << OPCODE_SHIFT,
+        PRESENT_DISPLAY                    = 0x205 << OPCODE_SHIFT,
+
+        /* layer commands (VALIDATE_DISPLAY not required) */
+        SET_LAYER_CURSOR_POSITION          = 0x300 << OPCODE_SHIFT,
+        SET_LAYER_BUFFER                   = 0x301 << OPCODE_SHIFT,
+        SET_LAYER_SURFACE_DAMAGE           = 0x302 << OPCODE_SHIFT,
+
+        /* layer state commands (VALIDATE_DISPLAY required) */
+        SET_LAYER_BLEND_MODE               = 0x400 << OPCODE_SHIFT,
+        SET_LAYER_COLOR                    = 0x401 << OPCODE_SHIFT,
+        SET_LAYER_COMPOSITION_TYPE         = 0x402 << OPCODE_SHIFT,
+        SET_LAYER_DATASPACE                = 0x403 << OPCODE_SHIFT,
+        SET_LAYER_DISPLAY_FRAME            = 0x404 << OPCODE_SHIFT,
+        SET_LAYER_PLANE_ALPHA              = 0x405 << OPCODE_SHIFT,
+        SET_LAYER_SIDEBAND_STREAM          = 0x406 << OPCODE_SHIFT,
+        SET_LAYER_SOURCE_CROP              = 0x407 << OPCODE_SHIFT,
+        SET_LAYER_TRANSFORM                = 0x408 << OPCODE_SHIFT,
+        SET_LAYER_VISIBLE_REGION           = 0x409 << OPCODE_SHIFT,
+        SET_LAYER_Z_ORDER                  = 0x40a << OPCODE_SHIFT,
+
+        /* 0x800 - 0xfff are reserved for vendor extensions */
+        /* 0x1000 - 0xffff are reserved */
+    };
+};
diff --git a/graphics/composer/2.1/default/Android.bp b/graphics/composer/2.1/default/Android.bp
index 22f4906..0d63c3c 100644
--- a/graphics/composer/2.1/default/Android.bp
+++ b/graphics/composer/2.1/default/Android.bp
@@ -1,17 +1,19 @@
 cc_library_shared {
     name: "android.hardware.graphics.composer@2.1-impl",
     relative_install_path: "hw",
-    srcs: ["Hwc.cpp"],
+    srcs: ["Hwc.cpp", "HwcClient.cpp"],
     shared_libs: [
         "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.composer@2.1",
         "libbase",
         "libcutils",
+        "libfmq",
         "libhardware",
         "libhidlbase",
         "libhidltransport",
         "libhwbinder",
         "liblog",
+        "libsync",
         "libutils",
     ],
 }
@@ -19,7 +21,7 @@
 cc_binary {
     name: "android.hardware.graphics.composer@2.1-service",
     relative_install_path: "hw",
-    srcs: ["service.cpp", "Hwc.cpp"],
+    srcs: ["service.cpp", "Hwc.cpp", "HwcClient.cpp"],
     cppflags: ["-DBINDERIZED"],
     init_rc: ["android.hardware.graphics.composer@2.1-service.rc"],
 
@@ -29,11 +31,19 @@
         "libbase",
         "libbinder",
         "libcutils",
+        "libfmq",
         "libhardware",
         "libhidlbase",
         "libhidltransport",
         "libhwbinder",
         "liblog",
+        "libsync",
         "libutils",
     ],
 }
+
+cc_library_static {
+    name: "libhwcomposer-command-buffer",
+    shared_libs: ["android.hardware.graphics.composer@2.1"],
+    export_include_dirs: ["."],
+}
diff --git a/graphics/composer/2.1/default/Hwc.cpp b/graphics/composer/2.1/default/Hwc.cpp
index 36c6e54..d14de6f 100644
--- a/graphics/composer/2.1/default/Hwc.cpp
+++ b/graphics/composer/2.1/default/Hwc.cpp
@@ -16,19 +16,12 @@
 
 #define LOG_TAG "HwcPassthrough"
 
-#include <mutex>
 #include <type_traits>
-#include <unordered_map>
-#include <unordered_set>
-#include <utility>
-#include <vector>
 
-#include <hardware/gralloc.h>
-#include <hardware/gralloc1.h>
-#include <hardware/hwcomposer2.h>
 #include <log/log.h>
 
 #include "Hwc.h"
+#include "HwcClient.h"
 
 namespace android {
 namespace hardware {
@@ -37,419 +30,9 @@
 namespace V2_1 {
 namespace implementation {
 
-using android::hardware::graphics::common::V1_0::PixelFormat;
-using android::hardware::graphics::common::V1_0::Transform;
-using android::hardware::graphics::common::V1_0::Dataspace;
-using android::hardware::graphics::common::V1_0::ColorMode;
-using android::hardware::graphics::common::V1_0::ColorTransform;
-using android::hardware::graphics::common::V1_0::Hdr;
-
-namespace {
-
-class HandleImporter {
-public:
-    HandleImporter() : mInitialized(false) {}
-
-    bool initialize()
-    {
-        // allow only one client
-        if (mInitialized) {
-            return false;
-        }
-
-        if (!openGralloc()) {
-            return false;
-        }
-
-        mInitialized = true;
-        return true;
-    }
-
-    void cleanup()
-    {
-        if (!mInitialized) {
-            return;
-        }
-
-        closeGralloc();
-        mInitialized = false;
-    }
-
-    // In IComposer, any buffer_handle_t is owned by the caller and we need to
-    // make a clone for hwcomposer2.  We also need to translate empty handle
-    // to nullptr.  This function does that, in-place.
-    bool importBuffer(buffer_handle_t& handle)
-    {
-        if (!handle->numFds && !handle->numInts) {
-            handle = nullptr;
-            return true;
-        }
-
-        buffer_handle_t clone = cloneBuffer(handle);
-        if (!clone) {
-            return false;
-        }
-
-        handle = clone;
-        return true;
-    }
-
-    void freeBuffer(buffer_handle_t handle)
-    {
-        if (!handle) {
-            return;
-        }
-
-        releaseBuffer(handle);
-    }
-
-    bool importFence(const native_handle_t* handle, int& fd)
-    {
-        if (handle->numFds == 0) {
-            fd = -1;
-        } else if (handle->numFds == 1) {
-            fd = dup(handle->data[0]);
-            if (fd < 0) {
-                ALOGE("failed to dup fence fd %d", handle->data[0]);
-                return false;
-            }
-        } else {
-            ALOGE("invalid fence handle with %d file descriptors",
-                    handle->numFds);
-            return false;
-        }
-
-        return true;
-    }
-
-    void closeFence(int fd)
-    {
-        if (fd >= 0) {
-            close(fd);
-        }
-    }
-
-private:
-    bool mInitialized;
-
-    // Some existing gralloc drivers do not support retaining more than once,
-    // when we are in passthrough mode.
-#ifdef BINDERIZED
-    bool openGralloc()
-    {
-        const hw_module_t* module;
-        int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
-        if (err) {
-            ALOGE("failed to get gralloc module");
-            return false;
-        }
-
-        uint8_t major = (module->module_api_version >> 8) & 0xff;
-        if (major > 1) {
-            ALOGE("unknown gralloc module major version %d", major);
-            return false;
-        }
-
-        if (major == 1) {
-            err = gralloc1_open(module, &mDevice);
-            if (err) {
-                ALOGE("failed to open gralloc1 device");
-                return false;
-            }
-
-            mRetain = reinterpret_cast<GRALLOC1_PFN_RETAIN>(
-                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RETAIN));
-            mRelease = reinterpret_cast<GRALLOC1_PFN_RELEASE>(
-                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RELEASE));
-            if (!mRetain || !mRelease) {
-                ALOGE("invalid gralloc1 device");
-                gralloc1_close(mDevice);
-                return false;
-            }
-        } else {
-            mModule = reinterpret_cast<const gralloc_module_t*>(module);
-        }
-
-        return true;
-    }
-
-    void closeGralloc()
-    {
-        if (mDevice) {
-            gralloc1_close(mDevice);
-        }
-    }
-
-    buffer_handle_t cloneBuffer(buffer_handle_t handle)
-    {
-        native_handle_t* clone = native_handle_clone(handle);
-        if (!clone) {
-            ALOGE("failed to clone buffer %p", handle);
-            return nullptr;
-        }
-
-        bool err;
-        if (mDevice) {
-            err = (mRetain(mDevice, clone) != GRALLOC1_ERROR_NONE);
-        } else {
-            err = (mModule->registerBuffer(mModule, clone) != 0);
-        }
-
-        if (err) {
-            ALOGE("failed to retain/register buffer %p", clone);
-            native_handle_close(clone);
-            native_handle_delete(clone);
-            return nullptr;
-        }
-
-        return clone;
-    }
-
-    void releaseBuffer(buffer_handle_t handle)
-    {
-        if (mDevice) {
-            mRelease(mDevice, handle);
-        } else {
-            mModule->unregisterBuffer(mModule, handle);
-            native_handle_close(handle);
-            native_handle_delete(const_cast<native_handle_t*>(handle));
-        }
-    }
-
-    // gralloc1
-    gralloc1_device_t* mDevice;
-    GRALLOC1_PFN_RETAIN mRetain;
-    GRALLOC1_PFN_RELEASE mRelease;
-
-    // gralloc0
-    const gralloc_module_t* mModule;
-#else
-    bool openGralloc() { return true; }
-    void closeGralloc() {}
-    buffer_handle_t cloneBuffer(buffer_handle_t handle) { return handle; }
-    void releaseBuffer(buffer_handle_t) {}
-#endif
-};
-
-HandleImporter sHandleImporter;
-
-class BufferClone {
-public:
-    BufferClone() : mHandle(nullptr) {}
-
-    BufferClone(BufferClone&& other)
-    {
-        mHandle = other.mHandle;
-        other.mHandle = nullptr;
-    }
-
-    BufferClone(const BufferClone& other) = delete;
-    BufferClone& operator=(const BufferClone& other) = delete;
-
-    BufferClone& operator=(buffer_handle_t handle)
-    {
-        clear();
-        mHandle = handle;
-        return *this;
-    }
-
-    ~BufferClone()
-    {
-        clear();
-    }
-
-private:
-    void clear()
-    {
-        if (mHandle) {
-            sHandleImporter.freeBuffer(mHandle);
-        }
-    }
-
-    buffer_handle_t mHandle;
-};
-
-} // anonymous namespace
-
-class HwcHal : public IComposer {
-public:
-    HwcHal(const hw_module_t* module);
-    virtual ~HwcHal();
-
-    // IComposer interface
-    Return<void> getCapabilities(getCapabilities_cb hidl_cb) override;
-    Return<void> dumpDebugInfo(dumpDebugInfo_cb hidl_cb) override;
-    Return<void> registerCallback(const sp<IComposerCallback>& callback) override;
-    Return<uint32_t> getMaxVirtualDisplayCount() override;
-    Return<void> createVirtualDisplay(uint32_t width, uint32_t height,
-            PixelFormat formatHint, createVirtualDisplay_cb hidl_cb) override;
-    Return<Error> destroyVirtualDisplay(Display display) override;
-    Return<Error> acceptDisplayChanges(Display display) override;
-    Return<void> createLayer(Display display,
-            createLayer_cb hidl_cb) override;
-    Return<Error> destroyLayer(Display display, Layer layer) override;
-    Return<void> getActiveConfig(Display display,
-            getActiveConfig_cb hidl_cb) override;
-    Return<void> getChangedCompositionTypes(Display display,
-            getChangedCompositionTypes_cb hidl_cb) override;
-    Return<Error> getClientTargetSupport(Display display,
-            uint32_t width, uint32_t height,
-            PixelFormat format, Dataspace dataspace) override;
-    Return<void> getColorModes(Display display,
-            getColorModes_cb hidl_cb) override;
-    Return<void> getDisplayAttribute(Display display,
-            Config config, Attribute attribute,
-            getDisplayAttribute_cb hidl_cb) override;
-    Return<void> getDisplayConfigs(Display display,
-            getDisplayConfigs_cb hidl_cb) override;
-    Return<void> getDisplayName(Display display,
-            getDisplayName_cb hidl_cb) override;
-    Return<void> getDisplayRequests(Display display,
-            getDisplayRequests_cb hidl_cb) override;
-    Return<void> getDisplayType(Display display,
-            getDisplayType_cb hidl_cb) override;
-    Return<void> getDozeSupport(Display display,
-            getDozeSupport_cb hidl_cb) override;
-    Return<void> getHdrCapabilities(Display display,
-            getHdrCapabilities_cb hidl_cb) override;
-    Return<void> getReleaseFences(Display display,
-            getReleaseFences_cb hidl_cb) override;
-    Return<void> presentDisplay(Display display,
-            presentDisplay_cb hidl_cb) override;
-    Return<Error> setActiveConfig(Display display, Config config) override;
-    Return<Error> setClientTarget(Display display,
-            const hidl_handle& target,
-            const hidl_handle& acquireFence,
-            Dataspace dataspace, const hidl_vec<Rect>& damage) override;
-    Return<Error> setColorMode(Display display, ColorMode mode) override;
-    Return<Error> setColorTransform(Display display,
-            const hidl_vec<float>& matrix, ColorTransform hint) override;
-    Return<Error> setOutputBuffer(Display display,
-            const hidl_handle& buffer,
-            const hidl_handle& releaseFence) override;
-    Return<Error> setPowerMode(Display display, PowerMode mode) override;
-    Return<Error> setVsyncEnabled(Display display, Vsync enabled) override;
-    Return<void> validateDisplay(Display display,
-            validateDisplay_cb hidl_cb) override;
-    Return<Error> setCursorPosition(Display display,
-            Layer layer, int32_t x, int32_t y) override;
-    Return<Error> setLayerBuffer(Display display,
-            Layer layer, const hidl_handle& buffer,
-            const hidl_handle& acquireFence) override;
-    Return<Error> setLayerSurfaceDamage(Display display,
-            Layer layer, const hidl_vec<Rect>& damage) override;
-    Return<Error> setLayerBlendMode(Display display,
-            Layer layer, BlendMode mode) override;
-    Return<Error> setLayerColor(Display display,
-            Layer layer, const Color& color) override;
-    Return<Error> setLayerCompositionType(Display display,
-            Layer layer, Composition type) override;
-    Return<Error> setLayerDataspace(Display display,
-            Layer layer, Dataspace dataspace) override;
-    Return<Error> setLayerDisplayFrame(Display display,
-            Layer layer, const Rect& frame) override;
-    Return<Error> setLayerPlaneAlpha(Display display,
-            Layer layer, float alpha) override;
-    Return<Error> setLayerSidebandStream(Display display,
-            Layer layer, const hidl_handle& stream) override;
-    Return<Error> setLayerSourceCrop(Display display,
-            Layer layer, const FRect& crop) override;
-    Return<Error> setLayerTransform(Display display,
-            Layer layer, Transform transform) override;
-    Return<Error> setLayerVisibleRegion(Display display,
-            Layer layer, const hidl_vec<Rect>& visible) override;
-    Return<Error> setLayerZOrder(Display display,
-            Layer layer, uint32_t z) override;
-
-private:
-    void initCapabilities();
-
-    template<typename T>
-    void initDispatch(T& func, hwc2_function_descriptor_t desc);
-    void initDispatch();
-
-    bool hasCapability(Capability capability) const;
-
-    static void hotplugHook(hwc2_callback_data_t callbackData,
-        hwc2_display_t display, int32_t connected);
-    static void refreshHook(hwc2_callback_data_t callbackData,
-        hwc2_display_t display);
-    static void vsyncHook(hwc2_callback_data_t callbackData,
-        hwc2_display_t display, int64_t timestamp);
-
-    hwc2_device_t* mDevice;
-
-    std::unordered_set<Capability> mCapabilities;
-
-    struct {
-        HWC2_PFN_ACCEPT_DISPLAY_CHANGES acceptDisplayChanges;
-        HWC2_PFN_CREATE_LAYER createLayer;
-        HWC2_PFN_CREATE_VIRTUAL_DISPLAY createVirtualDisplay;
-        HWC2_PFN_DESTROY_LAYER destroyLayer;
-        HWC2_PFN_DESTROY_VIRTUAL_DISPLAY destroyVirtualDisplay;
-        HWC2_PFN_DUMP dump;
-        HWC2_PFN_GET_ACTIVE_CONFIG getActiveConfig;
-        HWC2_PFN_GET_CHANGED_COMPOSITION_TYPES getChangedCompositionTypes;
-        HWC2_PFN_GET_CLIENT_TARGET_SUPPORT getClientTargetSupport;
-        HWC2_PFN_GET_COLOR_MODES getColorModes;
-        HWC2_PFN_GET_DISPLAY_ATTRIBUTE getDisplayAttribute;
-        HWC2_PFN_GET_DISPLAY_CONFIGS getDisplayConfigs;
-        HWC2_PFN_GET_DISPLAY_NAME getDisplayName;
-        HWC2_PFN_GET_DISPLAY_REQUESTS getDisplayRequests;
-        HWC2_PFN_GET_DISPLAY_TYPE getDisplayType;
-        HWC2_PFN_GET_DOZE_SUPPORT getDozeSupport;
-        HWC2_PFN_GET_HDR_CAPABILITIES getHdrCapabilities;
-        HWC2_PFN_GET_MAX_VIRTUAL_DISPLAY_COUNT getMaxVirtualDisplayCount;
-        HWC2_PFN_GET_RELEASE_FENCES getReleaseFences;
-        HWC2_PFN_PRESENT_DISPLAY presentDisplay;
-        HWC2_PFN_REGISTER_CALLBACK registerCallback;
-        HWC2_PFN_SET_ACTIVE_CONFIG setActiveConfig;
-        HWC2_PFN_SET_CLIENT_TARGET setClientTarget;
-        HWC2_PFN_SET_COLOR_MODE setColorMode;
-        HWC2_PFN_SET_COLOR_TRANSFORM setColorTransform;
-        HWC2_PFN_SET_CURSOR_POSITION setCursorPosition;
-        HWC2_PFN_SET_LAYER_BLEND_MODE setLayerBlendMode;
-        HWC2_PFN_SET_LAYER_BUFFER setLayerBuffer;
-        HWC2_PFN_SET_LAYER_COLOR setLayerColor;
-        HWC2_PFN_SET_LAYER_COMPOSITION_TYPE setLayerCompositionType;
-        HWC2_PFN_SET_LAYER_DATASPACE setLayerDataspace;
-        HWC2_PFN_SET_LAYER_DISPLAY_FRAME setLayerDisplayFrame;
-        HWC2_PFN_SET_LAYER_PLANE_ALPHA setLayerPlaneAlpha;
-        HWC2_PFN_SET_LAYER_SIDEBAND_STREAM setLayerSidebandStream;
-        HWC2_PFN_SET_LAYER_SOURCE_CROP setLayerSourceCrop;
-        HWC2_PFN_SET_LAYER_SURFACE_DAMAGE setLayerSurfaceDamage;
-        HWC2_PFN_SET_LAYER_TRANSFORM setLayerTransform;
-        HWC2_PFN_SET_LAYER_VISIBLE_REGION setLayerVisibleRegion;
-        HWC2_PFN_SET_LAYER_Z_ORDER setLayerZOrder;
-        HWC2_PFN_SET_OUTPUT_BUFFER setOutputBuffer;
-        HWC2_PFN_SET_POWER_MODE setPowerMode;
-        HWC2_PFN_SET_VSYNC_ENABLED setVsyncEnabled;
-        HWC2_PFN_VALIDATE_DISPLAY validateDisplay;
-    } mDispatch;
-
-    // cloned buffers for a display
-    struct DisplayBuffers {
-        BufferClone ClientTarget;
-        BufferClone OutputBuffer;
-
-        std::unordered_map<Layer, BufferClone> LayerBuffers;
-        std::unordered_map<Layer, BufferClone> LayerSidebandStreams;
-    };
-
-    std::mutex mCallbackMutex;
-    sp<IComposerCallback> mCallback;
-
-    std::mutex mDisplayMutex;
-    std::unordered_map<Display, DisplayBuffers> mDisplays;
-};
-
 HwcHal::HwcHal(const hw_module_t* module)
     : mDevice(nullptr), mDispatch()
 {
-    if (!sHandleImporter.initialize()) {
-        LOG_ALWAYS_FATAL("failed to initialize handle importer");
-    }
-
     int status = hwc2_open(module, &mDevice);
     if (status) {
         LOG_ALWAYS_FATAL("failed to open hwcomposer2 device: %s",
@@ -463,8 +46,6 @@
 HwcHal::~HwcHal()
 {
     hwc2_close(mDevice);
-    mDisplays.clear();
-    sHandleImporter.cleanup();
 }
 
 void HwcHal::initCapabilities()
@@ -599,694 +180,509 @@
     return Void();
 }
 
+Return<void> HwcHal::createClient(createClient_cb hidl_cb)
+{
+    Error err = Error::NONE;
+    sp<HwcClient> client;
+
+    {
+        std::lock_guard<std::mutex> lock(mClientMutex);
+
+        // only one client is allowed
+        if (mClient == nullptr) {
+            client = new HwcClient(*this);
+            mClient = client;
+        } else {
+            err = Error::NO_RESOURCES;
+        }
+    }
+
+    hidl_cb(err, client);
+
+    return Void();
+}
+
+sp<HwcClient> HwcHal::getClient()
+{
+    std::lock_guard<std::mutex> lock(mClientMutex);
+    return (mClient != nullptr) ? mClient.promote() : nullptr;
+}
+
+void HwcHal::removeClient()
+{
+    std::lock_guard<std::mutex> lock(mClientMutex);
+    mClient = nullptr;
+}
+
 void HwcHal::hotplugHook(hwc2_callback_data_t callbackData,
         hwc2_display_t display, int32_t connected)
 {
     auto hal = reinterpret_cast<HwcHal*>(callbackData);
-
-    {
-        std::lock_guard<std::mutex> lock(hal->mDisplayMutex);
-
-        if (connected == HWC2_CONNECTION_CONNECTED) {
-            hal->mDisplays.emplace(display, DisplayBuffers());
-        } else if (connected == HWC2_CONNECTION_DISCONNECTED) {
-            hal->mDisplays.erase(display);
-        }
+    auto client = hal->getClient();
+    if (client != nullptr) {
+        client->onHotplug(display,
+                static_cast<IComposerCallback::Connection>(connected));
     }
-
-    hal->mCallback->onHotplug(display,
-            static_cast<IComposerCallback::Connection>(connected));
 }
 
 void HwcHal::refreshHook(hwc2_callback_data_t callbackData,
         hwc2_display_t display)
 {
     auto hal = reinterpret_cast<HwcHal*>(callbackData);
-    hal->mCallback->onRefresh(display);
+    auto client = hal->getClient();
+    if (client != nullptr) {
+        client->onRefresh(display);
+    }
 }
 
 void HwcHal::vsyncHook(hwc2_callback_data_t callbackData,
         hwc2_display_t display, int64_t timestamp)
 {
     auto hal = reinterpret_cast<HwcHal*>(callbackData);
-    hal->mCallback->onVsync(display, timestamp);
+    auto client = hal->getClient();
+    if (client != nullptr) {
+        client->onVsync(display, timestamp);
+    }
 }
 
-Return<void> HwcHal::registerCallback(const sp<IComposerCallback>& callback)
+void HwcHal::enableCallback(bool enable)
 {
-    std::lock_guard<std::mutex> lock(mCallbackMutex);
-
-    mCallback = callback;
-
-    mDispatch.registerCallback(mDevice, HWC2_CALLBACK_HOTPLUG, this,
-            reinterpret_cast<hwc2_function_pointer_t>(hotplugHook));
-    mDispatch.registerCallback(mDevice, HWC2_CALLBACK_REFRESH, this,
-            reinterpret_cast<hwc2_function_pointer_t>(refreshHook));
-    mDispatch.registerCallback(mDevice, HWC2_CALLBACK_VSYNC, this,
-            reinterpret_cast<hwc2_function_pointer_t>(vsyncHook));
-
-    return Void();
+    if (enable) {
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_HOTPLUG, this,
+                reinterpret_cast<hwc2_function_pointer_t>(hotplugHook));
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_REFRESH, this,
+                reinterpret_cast<hwc2_function_pointer_t>(refreshHook));
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_VSYNC, this,
+                reinterpret_cast<hwc2_function_pointer_t>(vsyncHook));
+    } else {
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_HOTPLUG, this,
+                nullptr);
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_REFRESH, this,
+                nullptr);
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_VSYNC, this,
+                nullptr);
+    }
 }
 
-Return<uint32_t> HwcHal::getMaxVirtualDisplayCount()
+uint32_t HwcHal::getMaxVirtualDisplayCount()
 {
     return mDispatch.getMaxVirtualDisplayCount(mDevice);
 }
 
-Return<void> HwcHal::createVirtualDisplay(uint32_t width, uint32_t height,
-        PixelFormat formatHint, createVirtualDisplay_cb hidl_cb)
+Error HwcHal::createVirtualDisplay(uint32_t width, uint32_t height,
+    PixelFormat& format, Display& display)
 {
-    int32_t format = static_cast<int32_t>(formatHint);
-    hwc2_display_t display;
-    auto error = mDispatch.createVirtualDisplay(mDevice, width, height,
-            &format, &display);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
+    int32_t hwc_format = static_cast<int32_t>(format);
+    int32_t err = mDispatch.createVirtualDisplay(mDevice, width, height,
+            &hwc_format, &display);
+    format = static_cast<PixelFormat>(hwc_format);
 
-        mDisplays.emplace(display, DisplayBuffers());
-    }
-
-    hidl_cb(static_cast<Error>(error), display,
-            static_cast<PixelFormat>(format));
-
-    return Void();
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::destroyVirtualDisplay(Display display)
+Error HwcHal::destroyVirtualDisplay(Display display)
 {
-    auto error = mDispatch.destroyVirtualDisplay(mDevice, display);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        mDisplays.erase(display);
-    }
-
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.destroyVirtualDisplay(mDevice, display);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::acceptDisplayChanges(Display display)
+Error HwcHal::createLayer(Display display, Layer& layer)
 {
-    auto error = mDispatch.acceptDisplayChanges(mDevice, display);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.createLayer(mDevice, display, &layer);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::createLayer(Display display, createLayer_cb hidl_cb)
+Error HwcHal::destroyLayer(Display display, Layer layer)
 {
-    hwc2_layer_t layer;
-    auto error = mDispatch.createLayer(mDevice, display, &layer);
-
-    hidl_cb(static_cast<Error>(error), layer);
-
-    return Void();
+    int32_t err = mDispatch.destroyLayer(mDevice, display, layer);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::destroyLayer(Display display, Layer layer)
+Error HwcHal::getActiveConfig(Display display, Config& config)
 {
-    auto error = mDispatch.destroyLayer(mDevice, display, layer);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.LayerBuffers.erase(layer);
-        dpy->second.LayerSidebandStreams.erase(layer);
-    }
-
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.getActiveConfig(mDevice, display, &config);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::getActiveConfig(Display display,
-        getActiveConfig_cb hidl_cb)
-{
-    hwc2_config_t config;
-    auto error = mDispatch.getActiveConfig(mDevice, display, &config);
-
-    hidl_cb(static_cast<Error>(error), config);
-
-    return Void();
-}
-
-Return<void> HwcHal::getChangedCompositionTypes(Display display,
-        getChangedCompositionTypes_cb hidl_cb)
-{
-    uint32_t count = 0;
-    auto error = mDispatch.getChangedCompositionTypes(mDevice, display,
-            &count, nullptr, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-
-    std::vector<hwc2_layer_t> layers(count);
-    std::vector<Composition> types(count);
-    error = mDispatch.getChangedCompositionTypes(mDevice, display,
-            &count, layers.data(),
-            reinterpret_cast<std::underlying_type<Composition>::type*>(
-                types.data()));
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-    layers.resize(count);
-    types.resize(count);
-
-    hidl_vec<Layer> layers_reply;
-    layers_reply.setToExternal(layers.data(), layers.size());
-
-    hidl_vec<Composition> types_reply;
-    types_reply.setToExternal(types.data(), types.size());
-
-    hidl_cb(static_cast<Error>(error), layers_reply, types_reply);
-
-    return Void();
-}
-
-Return<Error> HwcHal::getClientTargetSupport(Display display,
+Error HwcHal::getClientTargetSupport(Display display,
         uint32_t width, uint32_t height,
         PixelFormat format, Dataspace dataspace)
 {
-    auto error = mDispatch.getClientTargetSupport(mDevice, display,
+    int32_t err = mDispatch.getClientTargetSupport(mDevice, display,
             width, height, static_cast<int32_t>(format),
             static_cast<int32_t>(dataspace));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::getColorModes(Display display, getColorModes_cb hidl_cb)
+Error HwcHal::getColorModes(Display display, hidl_vec<ColorMode>& modes)
 {
     uint32_t count = 0;
-    auto error = mDispatch.getColorModes(mDevice, display, &count, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    int32_t err = mDispatch.getColorModes(mDevice, display, &count, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<ColorMode> modes(count);
-    error = mDispatch.getColorModes(mDevice, display, &count,
+    modes.resize(count);
+    err = mDispatch.getColorModes(mDevice, display, &count,
             reinterpret_cast<std::underlying_type<ColorMode>::type*>(
                 modes.data()));
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    if (err != HWC2_ERROR_NONE) {
+        modes = hidl_vec<ColorMode>();
+        return static_cast<Error>(err);
     }
-    modes.resize(count);
 
-    hidl_vec<ColorMode> modes_reply;
-    modes_reply.setToExternal(modes.data(), modes.size());
-    hidl_cb(static_cast<Error>(error), modes_reply);
-
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getDisplayAttribute(Display display,
-        Config config, Attribute attribute,
-        getDisplayAttribute_cb hidl_cb)
+Error HwcHal::getDisplayAttribute(Display display, Config config,
+        IComposerClient::Attribute attribute, int32_t& value)
 {
-    int32_t value;
-    auto error = mDispatch.getDisplayAttribute(mDevice, display, config,
+    int32_t err = mDispatch.getDisplayAttribute(mDevice, display, config,
             static_cast<int32_t>(attribute), &value);
-
-    hidl_cb(static_cast<Error>(error), value);
-
-    return Void();
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::getDisplayConfigs(Display display,
-        getDisplayConfigs_cb hidl_cb)
+Error HwcHal::getDisplayConfigs(Display display, hidl_vec<Config>& configs)
 {
     uint32_t count = 0;
-    auto error = mDispatch.getDisplayConfigs(mDevice, display,
+    int32_t err = mDispatch.getDisplayConfigs(mDevice, display,
             &count, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<hwc2_config_t> configs(count);
-    error = mDispatch.getDisplayConfigs(mDevice, display,
-            &count, configs.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
     configs.resize(count);
+    err = mDispatch.getDisplayConfigs(mDevice, display,
+            &count, configs.data());
+    if (err != HWC2_ERROR_NONE) {
+        configs = hidl_vec<Config>();
+        return static_cast<Error>(err);
+    }
 
-    hidl_vec<Config> configs_reply;
-    configs_reply.setToExternal(configs.data(), configs.size());
-    hidl_cb(static_cast<Error>(error), configs_reply);
-
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getDisplayName(Display display,
-        getDisplayName_cb hidl_cb)
+Error HwcHal::getDisplayName(Display display, hidl_string& name)
 {
     uint32_t count = 0;
-    auto error = mDispatch.getDisplayName(mDevice, display, &count, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    int32_t err = mDispatch.getDisplayName(mDevice, display, &count, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<char> name(count + 1);
-    error = mDispatch.getDisplayName(mDevice, display, &count, name.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    std::vector<char> buf(count + 1);
+    err = mDispatch.getDisplayName(mDevice, display, &count, buf.data());
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
-    name.resize(count + 1);
-    name[count] = '\0';
+    buf.resize(count + 1);
+    buf[count] = '\0';
 
-    hidl_string name_reply;
-    name_reply.setToExternal(name.data(), count);
-    hidl_cb(static_cast<Error>(error), name_reply);
+    name = buf.data();
 
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getDisplayRequests(Display display,
-        getDisplayRequests_cb hidl_cb)
+Error HwcHal::getDisplayType(Display display, IComposerClient::DisplayType& type)
 {
-    int32_t display_reqs;
+    int32_t hwc_type = HWC2_DISPLAY_TYPE_INVALID;
+    int32_t err = mDispatch.getDisplayType(mDevice, display, &hwc_type);
+    type = static_cast<IComposerClient::DisplayType>(hwc_type);
+
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::getDozeSupport(Display display, bool& support)
+{
+    int32_t hwc_support = 0;
+    int32_t err = mDispatch.getDozeSupport(mDevice, display, &hwc_support);
+    support = hwc_support;
+
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::getHdrCapabilities(Display display, hidl_vec<Hdr>& types,
+        float& maxLuminance, float& maxAverageLuminance, float& minLuminance)
+{
     uint32_t count = 0;
-    auto error = mDispatch.getDisplayRequests(mDevice, display,
-            &display_reqs, &count, nullptr, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    int32_t err = mDispatch.getHdrCapabilities(mDevice, display, &count,
+            nullptr, &maxLuminance, &maxAverageLuminance, &minLuminance);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<hwc2_layer_t> layers(count);
-    std::vector<int32_t> layer_reqs(count);
-    error = mDispatch.getDisplayRequests(mDevice, display,
-            &display_reqs, &count, layers.data(), layer_reqs.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-    layers.resize(count);
-    layer_reqs.resize(count);
-
-    hidl_vec<Layer> layers_reply;
-    layers_reply.setToExternal(layers.data(), layers.size());
-
-    hidl_vec<uint32_t> layer_reqs_reply;
-    layer_reqs_reply.setToExternal(
-            reinterpret_cast<uint32_t*>(layer_reqs.data()),
-            layer_reqs.size());
-
-    hidl_cb(static_cast<Error>(error), display_reqs,
-            layers_reply, layer_reqs_reply);
-
-    return Void();
-}
-
-Return<void> HwcHal::getDisplayType(Display display,
-        getDisplayType_cb hidl_cb)
-{
-    int32_t type;
-    auto error = mDispatch.getDisplayType(mDevice, display, &type);
-
-    hidl_cb(static_cast<Error>(error), static_cast<DisplayType>(type));
-
-    return Void();
-}
-
-Return<void> HwcHal::getDozeSupport(Display display,
-        getDozeSupport_cb hidl_cb)
-{
-    int32_t support;
-    auto error = mDispatch.getDozeSupport(mDevice, display, &support);
-
-    hidl_cb(static_cast<Error>(error), support);
-
-    return Void();
-}
-
-Return<void> HwcHal::getHdrCapabilities(Display display,
-        getHdrCapabilities_cb hidl_cb)
-{
-    float max_lumi, max_avg_lumi, min_lumi;
-    uint32_t count = 0;
-    auto error = mDispatch.getHdrCapabilities(mDevice, display,
-            &count, nullptr, &max_lumi, &max_avg_lumi, &min_lumi);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-
-    std::vector<Hdr> types(count);
-    error = mDispatch.getHdrCapabilities(mDevice, display, &count,
-            reinterpret_cast<std::underlying_type<Hdr>::type*>(types.data()),
-            &max_lumi, &max_avg_lumi, &min_lumi);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
     types.resize(count);
+    err = mDispatch.getHdrCapabilities(mDevice, display, &count,
+            reinterpret_cast<std::underlying_type<Hdr>::type*>(types.data()),
+            &maxLuminance, &maxAverageLuminance, &minLuminance);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
+    }
 
-    hidl_vec<Hdr> types_reply;
-    types_reply.setToExternal(types.data(), types.size());
-    hidl_cb(static_cast<Error>(error), types_reply,
-            max_lumi, max_avg_lumi, min_lumi);
-
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getReleaseFences(Display display,
-        getReleaseFences_cb hidl_cb)
+Error HwcHal::setActiveConfig(Display display, Config config)
 {
-    uint32_t count = 0;
-    auto error = mDispatch.getReleaseFences(mDevice, display,
-            &count, nullptr, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-
-    std::vector<hwc2_layer_t> layers(count);
-    std::vector<int32_t> fences(count);
-    error = mDispatch.getReleaseFences(mDevice, display,
-            &count, layers.data(), fences.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-    layers.resize(count);
-    fences.resize(count);
-
-    // filter out layers with release fence -1
-    std::vector<hwc2_layer_t> filtered_layers;
-    std::vector<int> filtered_fences;
-    for (size_t i = 0; i < layers.size(); i++) {
-        if (fences[i] >= 0) {
-            filtered_layers.push_back(layers[i]);
-            filtered_fences.push_back(fences[i]);
-        }
-    }
-
-    hidl_vec<Layer> layers_reply;
-    native_handle_t* fences_reply =
-        native_handle_create(filtered_fences.size(), 0);
-    if (fences_reply) {
-        layers_reply.setToExternal(filtered_layers.data(),
-                filtered_layers.size());
-        memcpy(fences_reply->data, filtered_fences.data(),
-                sizeof(int) * filtered_fences.size());
-
-        hidl_cb(static_cast<Error>(error), layers_reply, fences_reply);
-
-        native_handle_close(fences_reply);
-        native_handle_delete(fences_reply);
-    } else {
-        NATIVE_HANDLE_DECLARE_STORAGE(fences_storage, 0, 0);
-        fences_reply = native_handle_init(fences_storage, 0, 0);
-
-        hidl_cb(Error::NO_RESOURCES, layers_reply, fences_reply);
-
-        for (auto fence : filtered_fences) {
-            close(fence);
-        }
-    }
-
-    return Void();
+    int32_t err = mDispatch.setActiveConfig(mDevice, display, config);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::presentDisplay(Display display,
-        presentDisplay_cb hidl_cb)
+Error HwcHal::setColorMode(Display display, ColorMode mode)
 {
-    int32_t fence = -1;
-    auto error = mDispatch.presentDisplay(mDevice, display, &fence);
-
-    NATIVE_HANDLE_DECLARE_STORAGE(fence_storage, 1, 0);
-    native_handle_t* fence_reply;
-    if (fence >= 0) {
-        fence_reply = native_handle_init(fence_storage, 1, 0);
-        fence_reply->data[0] = fence;
-    } else {
-        fence_reply = native_handle_init(fence_storage, 0, 0);
-    }
-
-    hidl_cb(static_cast<Error>(error), fence_reply);
-
-    if (fence >= 0) {
-        close(fence);
-    }
-
-    return Void();
-}
-
-Return<Error> HwcHal::setActiveConfig(Display display, Config config)
-{
-    auto error = mDispatch.setActiveConfig(mDevice, display, config);
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setClientTarget(Display display,
-        const hidl_handle& target,
-        const hidl_handle& acquireFence,
-        Dataspace dataspace, const hidl_vec<Rect>& damage)
-{
-    const native_handle_t* targetHandle = target.getNativeHandle();
-    if (!sHandleImporter.importBuffer(targetHandle)) {
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t fence;
-    if (!sHandleImporter.importFence(acquireFence, fence)) {
-        sHandleImporter.freeBuffer(targetHandle);
-        return Error::NO_RESOURCES;
-    }
-
-    hwc_region_t damage_region = { damage.size(),
-        reinterpret_cast<const hwc_rect_t*>(&damage[0]) };
-
-    int32_t error = mDispatch.setClientTarget(mDevice, display,
-            targetHandle, fence, static_cast<int32_t>(dataspace),
-            damage_region);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.ClientTarget = targetHandle;
-    } else {
-        sHandleImporter.freeBuffer(target);
-        sHandleImporter.closeFence(fence);
-    }
-
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setColorMode(Display display, ColorMode mode)
-{
-    auto error = mDispatch.setColorMode(mDevice, display,
+    int32_t err = mDispatch.setColorMode(mDevice, display,
             static_cast<int32_t>(mode));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setColorTransform(Display display,
-        const hidl_vec<float>& matrix, ColorTransform hint)
+Error HwcHal::setPowerMode(Display display, IComposerClient::PowerMode mode)
 {
-    auto error = mDispatch.setColorTransform(mDevice, display,
-            &matrix[0], static_cast<int32_t>(hint));
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setOutputBuffer(Display display,
-        const hidl_handle& buffer,
-        const hidl_handle& releaseFence)
-{
-    const native_handle_t* bufferHandle = buffer.getNativeHandle();
-    if (!sHandleImporter.importBuffer(bufferHandle)) {
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t fence;
-    if (!sHandleImporter.importFence(releaseFence, fence)) {
-        sHandleImporter.freeBuffer(bufferHandle);
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t error = mDispatch.setOutputBuffer(mDevice,
-            display, bufferHandle, fence);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.OutputBuffer = bufferHandle;
-    } else {
-        sHandleImporter.freeBuffer(bufferHandle);
-    }
-
-    // unlike in setClientTarget, fence is owned by us and is always closed
-    sHandleImporter.closeFence(fence);
-
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setPowerMode(Display display, PowerMode mode)
-{
-    auto error = mDispatch.setPowerMode(mDevice, display,
+    int32_t err = mDispatch.setPowerMode(mDevice, display,
             static_cast<int32_t>(mode));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setVsyncEnabled(Display display,
-        Vsync enabled)
+Error HwcHal::setVsyncEnabled(Display display, IComposerClient::Vsync enabled)
 {
-    auto error = mDispatch.setVsyncEnabled(mDevice, display,
+    int32_t err = mDispatch.setVsyncEnabled(mDevice, display,
             static_cast<int32_t>(enabled));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::validateDisplay(Display display,
-        validateDisplay_cb hidl_cb)
+Error HwcHal::setColorTransform(Display display, const float* matrix,
+        int32_t hint)
+{
+    int32_t err = mDispatch.setColorTransform(mDevice, display, matrix, hint);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setClientTarget(Display display, buffer_handle_t target,
+        int32_t acquireFence, int32_t dataspace,
+        const std::vector<hwc_rect_t>& damage)
+{
+    hwc_region region = { damage.size(), damage.data() };
+    int32_t err = mDispatch.setClientTarget(mDevice, display, target,
+            acquireFence, dataspace, region);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setOutputBuffer(Display display, buffer_handle_t buffer,
+        int32_t releaseFence)
+{
+    int32_t err = mDispatch.setOutputBuffer(mDevice, display, buffer,
+            releaseFence);
+    // unlike in setClientTarget, releaseFence is owned by us
+    if (err == HWC2_ERROR_NONE && releaseFence >= 0) {
+        close(releaseFence);
+    }
+
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::validateDisplay(Display display,
+        std::vector<Layer>& changedLayers,
+        std::vector<IComposerClient::Composition>& compositionTypes,
+        uint32_t& displayRequestMask,
+        std::vector<Layer>& requestedLayers,
+        std::vector<uint32_t>& requestMasks)
 {
     uint32_t types_count = 0;
     uint32_t reqs_count = 0;
-    auto error = mDispatch.validateDisplay(mDevice, display,
+    int32_t err = mDispatch.validateDisplay(mDevice, display,
             &types_count, &reqs_count);
-
-    hidl_cb(static_cast<Error>(error), types_count, reqs_count);
-
-    return Void();
-}
-
-Return<Error> HwcHal::setCursorPosition(Display display,
-        Layer layer, int32_t x, int32_t y)
-{
-    auto error = mDispatch.setCursorPosition(mDevice, display, layer, x, y);
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setLayerBuffer(Display display,
-        Layer layer, const hidl_handle& buffer,
-        const hidl_handle& acquireFence)
-{
-    const native_handle_t* bufferHandle = buffer.getNativeHandle();
-    if (!sHandleImporter.importBuffer(bufferHandle)) {
-        return Error::NO_RESOURCES;
+    if (err != HWC2_ERROR_NONE && err != HWC2_ERROR_HAS_CHANGES) {
+        return static_cast<Error>(err);
     }
 
-    int32_t fence;
-    if (!sHandleImporter.importFence(acquireFence, fence)) {
-        sHandleImporter.freeBuffer(bufferHandle);
-        return Error::NO_RESOURCES;
+    err = mDispatch.getChangedCompositionTypes(mDevice, display,
+            &types_count, nullptr, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    int32_t error = mDispatch.setLayerBuffer(mDevice,
-            display, layer, bufferHandle, fence);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.LayerBuffers[layer] = bufferHandle;
-    } else {
-        sHandleImporter.freeBuffer(bufferHandle);
-        sHandleImporter.closeFence(fence);
+    changedLayers.resize(types_count);
+    compositionTypes.resize(types_count);
+    err = mDispatch.getChangedCompositionTypes(mDevice, display,
+            &types_count, changedLayers.data(),
+            reinterpret_cast<
+            std::underlying_type<IComposerClient::Composition>::type*>(
+                compositionTypes.data()));
+    if (err != HWC2_ERROR_NONE) {
+        changedLayers.clear();
+        compositionTypes.clear();
+        return static_cast<Error>(err);
     }
 
-    return static_cast<Error>(error);
+    int32_t display_reqs = 0;
+    err = mDispatch.getDisplayRequests(mDevice, display, &display_reqs,
+            &reqs_count, nullptr, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        changedLayers.clear();
+        compositionTypes.clear();
+        return static_cast<Error>(err);
+    }
+
+    requestedLayers.resize(reqs_count);
+    requestMasks.resize(reqs_count);
+    err = mDispatch.getDisplayRequests(mDevice, display, &display_reqs,
+            &reqs_count, requestedLayers.data(),
+            reinterpret_cast<int32_t*>(requestMasks.data()));
+    if (err != HWC2_ERROR_NONE) {
+        changedLayers.clear();
+        compositionTypes.clear();
+
+        requestedLayers.clear();
+        requestMasks.clear();
+        return static_cast<Error>(err);
+    }
+
+    displayRequestMask = display_reqs;
+
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerSurfaceDamage(Display display,
-        Layer layer, const hidl_vec<Rect>& damage)
+Error HwcHal::acceptDisplayChanges(Display display)
 {
-    hwc_region_t damage_region = { damage.size(),
-        reinterpret_cast<const hwc_rect_t*>(&damage[0]) };
-
-    auto error = mDispatch.setLayerSurfaceDamage(mDevice, display, layer,
-            damage_region);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.acceptDisplayChanges(mDevice, display);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerBlendMode(Display display,
-        Layer layer, BlendMode mode)
+Error HwcHal::presentDisplay(Display display, int32_t& presentFence,
+        std::vector<Layer>& layers, std::vector<int32_t>& releaseFences)
 {
-    auto error = mDispatch.setLayerBlendMode(mDevice, display, layer,
-            static_cast<int32_t>(mode));
-    return static_cast<Error>(error);
+    presentFence = -1;
+    int32_t err = mDispatch.presentDisplay(mDevice, display, &presentFence);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
+    }
+
+    uint32_t count = 0;
+    err = mDispatch.getReleaseFences(mDevice, display, &count,
+            nullptr, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        ALOGW("failed to get release fences");
+        return Error::NONE;
+    }
+
+    layers.resize(count);
+    releaseFences.resize(count);
+    err = mDispatch.getReleaseFences(mDevice, display, &count,
+            layers.data(), releaseFences.data());
+    if (err != HWC2_ERROR_NONE) {
+        ALOGW("failed to get release fences");
+        layers.clear();
+        releaseFences.clear();
+        return Error::NONE;
+    }
+
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerColor(Display display,
-        Layer layer, const Color& color)
+Error HwcHal::setLayerCursorPosition(Display display, Layer layer,
+        int32_t x, int32_t y)
+{
+    int32_t err = mDispatch.setCursorPosition(mDevice, display, layer, x, y);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerBuffer(Display display, Layer layer,
+        buffer_handle_t buffer, int32_t acquireFence)
+{
+    int32_t err = mDispatch.setLayerBuffer(mDevice, display, layer,
+            buffer, acquireFence);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerSurfaceDamage(Display display, Layer layer,
+        const std::vector<hwc_rect_t>& damage)
+{
+    hwc_region region = { damage.size(), damage.data() };
+    int32_t err = mDispatch.setLayerSurfaceDamage(mDevice, display, layer,
+            region);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerBlendMode(Display display, Layer layer, int32_t mode)
+{
+    int32_t err = mDispatch.setLayerBlendMode(mDevice, display, layer, mode);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerColor(Display display, Layer layer,
+        IComposerClient::Color color)
 {
     hwc_color_t hwc_color{color.r, color.g, color.b, color.a};
-    auto error = mDispatch.setLayerColor(mDevice, display, layer, hwc_color);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerColor(mDevice, display, layer, hwc_color);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerCompositionType(Display display,
-        Layer layer, Composition type)
+Error HwcHal::setLayerCompositionType(Display display, Layer layer,
+        int32_t type)
 {
-    auto error = mDispatch.setLayerCompositionType(mDevice, display, layer,
-            static_cast<int32_t>(type));
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerCompositionType(mDevice, display, layer,
+            type);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerDataspace(Display display,
-        Layer layer, Dataspace dataspace)
+Error HwcHal::setLayerDataspace(Display display, Layer layer,
+        int32_t dataspace)
 {
-    auto error = mDispatch.setLayerDataspace(mDevice, display, layer,
-            static_cast<int32_t>(dataspace));
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerDataspace(mDevice, display, layer,
+            dataspace);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerDisplayFrame(Display display,
-        Layer layer, const Rect& frame)
+Error HwcHal::setLayerDisplayFrame(Display display, Layer layer,
+        const hwc_rect_t& frame)
 {
-    hwc_rect_t hwc_frame{frame.left, frame.top, frame.right, frame.bottom};
-    auto error = mDispatch.setLayerDisplayFrame(mDevice, display, layer,
-            hwc_frame);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerDisplayFrame(mDevice, display, layer,
+            frame);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerPlaneAlpha(Display display,
-        Layer layer, float alpha)
+Error HwcHal::setLayerPlaneAlpha(Display display, Layer layer, float alpha)
 {
-    auto error = mDispatch.setLayerPlaneAlpha(mDevice, display, layer, alpha);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerPlaneAlpha(mDevice, display, layer,
+            alpha);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerSidebandStream(Display display,
-        Layer layer, const hidl_handle& stream)
+Error HwcHal::setLayerSidebandStream(Display display, Layer layer,
+        buffer_handle_t stream)
 {
-    const native_handle_t* streamHandle = stream.getNativeHandle();
-    if (!sHandleImporter.importBuffer(streamHandle)) {
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t error = mDispatch.setLayerSidebandStream(mDevice,
-            display, layer, streamHandle);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.LayerSidebandStreams[layer] = streamHandle;
-    } else {
-        sHandleImporter.freeBuffer(streamHandle);
-    }
-
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerSidebandStream(mDevice, display, layer,
+            stream);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerSourceCrop(Display display,
-        Layer layer, const FRect& crop)
+Error HwcHal::setLayerSourceCrop(Display display, Layer layer,
+        const hwc_frect_t& crop)
 {
-    hwc_frect_t hwc_crop{crop.left, crop.top, crop.right, crop.bottom};
-    auto error = mDispatch.setLayerSourceCrop(mDevice, display, layer,
-            hwc_crop);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerSourceCrop(mDevice, display, layer, crop);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerTransform(Display display,
-        Layer layer, Transform transform)
+Error HwcHal::setLayerTransform(Display display, Layer layer,
+        int32_t transform)
 {
-    auto error = mDispatch.setLayerTransform(mDevice, display, layer,
-            static_cast<int32_t>(transform));
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerTransform(mDevice, display, layer,
+            transform);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerVisibleRegion(Display display,
-        Layer layer, const hidl_vec<Rect>& visible)
+Error HwcHal::setLayerVisibleRegion(Display display, Layer layer,
+        const std::vector<hwc_rect_t>& visible)
 {
-    hwc_region_t visible_region = { visible.size(),
-        reinterpret_cast<const hwc_rect_t*>(&visible[0]) };
-
-    auto error = mDispatch.setLayerVisibleRegion(mDevice, display, layer,
-            visible_region);
-    return static_cast<Error>(error);
+    hwc_region_t region = { visible.size(), visible.data() };
+    int32_t err = mDispatch.setLayerVisibleRegion(mDevice, display, layer,
+            region);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerZOrder(Display display,
-        Layer layer, uint32_t z)
+Error HwcHal::setLayerZOrder(Display display, Layer layer, uint32_t z)
 {
-    auto error = mDispatch.setLayerZOrder(mDevice, display, layer, z);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerZOrder(mDevice, display, layer, z);
+    return static_cast<Error>(err);
 }
 
 IComposer* HIDL_FETCH_IComposer(const char*)
diff --git a/graphics/composer/2.1/default/Hwc.h b/graphics/composer/2.1/default/Hwc.h
index de69417..89ac4f7 100644
--- a/graphics/composer/2.1/default/Hwc.h
+++ b/graphics/composer/2.1/default/Hwc.h
@@ -17,7 +17,12 @@
 #ifndef ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_H
 #define ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_H
 
+#include <mutex>
+#include <unordered_set>
+#include <vector>
+
 #include <android/hardware/graphics/composer/2.1/IComposer.h>
+#include <hardware/hwcomposer2.h>
 
 namespace android {
 namespace hardware {
@@ -26,6 +31,172 @@
 namespace V2_1 {
 namespace implementation {
 
+using android::hardware::graphics::common::V1_0::PixelFormat;
+using android::hardware::graphics::common::V1_0::Transform;
+using android::hardware::graphics::common::V1_0::Dataspace;
+using android::hardware::graphics::common::V1_0::ColorMode;
+using android::hardware::graphics::common::V1_0::ColorTransform;
+using android::hardware::graphics::common::V1_0::Hdr;
+
+class HwcClient;
+
+class HwcHal : public IComposer {
+public:
+    HwcHal(const hw_module_t* module);
+    virtual ~HwcHal();
+
+    // IComposer interface
+    Return<void> getCapabilities(getCapabilities_cb hidl_cb) override;
+    Return<void> dumpDebugInfo(dumpDebugInfo_cb hidl_cb) override;
+    Return<void> createClient(createClient_cb hidl_cb) override;
+
+    bool hasCapability(Capability capability) const;
+
+    void removeClient();
+
+    void enableCallback(bool enable);
+
+    uint32_t getMaxVirtualDisplayCount();
+    Error createVirtualDisplay(uint32_t width, uint32_t height,
+        PixelFormat& format, Display& display);
+    Error destroyVirtualDisplay(Display display);
+
+    Error createLayer(Display display, Layer& layer);
+    Error destroyLayer(Display display, Layer layer);
+
+    Error getActiveConfig(Display display, Config& config);
+    Error getClientTargetSupport(Display display,
+            uint32_t width, uint32_t height,
+            PixelFormat format, Dataspace dataspace);
+    Error getColorModes(Display display, hidl_vec<ColorMode>& modes);
+    Error getDisplayAttribute(Display display, Config config,
+            IComposerClient::Attribute attribute, int32_t& value);
+    Error getDisplayConfigs(Display display, hidl_vec<Config>& configs);
+    Error getDisplayName(Display display, hidl_string& name);
+    Error getDisplayType(Display display, IComposerClient::DisplayType& type);
+    Error getDozeSupport(Display display, bool& support);
+    Error getHdrCapabilities(Display display, hidl_vec<Hdr>& types,
+            float& maxLuminance, float& maxAverageLuminance,
+            float& minLuminance);
+
+    Error setActiveConfig(Display display, Config config);
+    Error setColorMode(Display display, ColorMode mode);
+    Error setPowerMode(Display display, IComposerClient::PowerMode mode);
+    Error setVsyncEnabled(Display display, IComposerClient::Vsync enabled);
+
+    Error setColorTransform(Display display, const float* matrix,
+            int32_t hint);
+    Error setClientTarget(Display display, buffer_handle_t target,
+            int32_t acquireFence, int32_t dataspace,
+            const std::vector<hwc_rect_t>& damage);
+    Error setOutputBuffer(Display display, buffer_handle_t buffer,
+            int32_t releaseFence);
+    Error validateDisplay(Display display,
+            std::vector<Layer>& changedLayers,
+            std::vector<IComposerClient::Composition>& compositionTypes,
+            uint32_t& displayRequestMask,
+            std::vector<Layer>& requestedLayers,
+            std::vector<uint32_t>& requestMasks);
+    Error acceptDisplayChanges(Display display);
+    Error presentDisplay(Display display, int32_t& presentFence,
+            std::vector<Layer>& layers, std::vector<int32_t>& releaseFences);
+
+    Error setLayerCursorPosition(Display display, Layer layer,
+            int32_t x, int32_t y);
+    Error setLayerBuffer(Display display, Layer layer,
+            buffer_handle_t buffer, int32_t acquireFence);
+    Error setLayerSurfaceDamage(Display display, Layer layer,
+            const std::vector<hwc_rect_t>& damage);
+    Error setLayerBlendMode(Display display, Layer layer, int32_t mode);
+    Error setLayerColor(Display display, Layer layer,
+            IComposerClient::Color color);
+    Error setLayerCompositionType(Display display, Layer layer,
+            int32_t type);
+    Error setLayerDataspace(Display display, Layer layer,
+            int32_t dataspace);
+    Error setLayerDisplayFrame(Display display, Layer layer,
+            const hwc_rect_t& frame);
+    Error setLayerPlaneAlpha(Display display, Layer layer, float alpha);
+    Error setLayerSidebandStream(Display display, Layer layer,
+            buffer_handle_t stream);
+    Error setLayerSourceCrop(Display display, Layer layer,
+            const hwc_frect_t& crop);
+    Error setLayerTransform(Display display, Layer layer,
+            int32_t transform);
+    Error setLayerVisibleRegion(Display display, Layer layer,
+            const std::vector<hwc_rect_t>& visible);
+    Error setLayerZOrder(Display display, Layer layer, uint32_t z);
+
+private:
+    void initCapabilities();
+
+    template<typename T>
+    void initDispatch(T& func, hwc2_function_descriptor_t desc);
+    void initDispatch();
+
+    sp<HwcClient> getClient();
+
+    static void hotplugHook(hwc2_callback_data_t callbackData,
+        hwc2_display_t display, int32_t connected);
+    static void refreshHook(hwc2_callback_data_t callbackData,
+        hwc2_display_t display);
+    static void vsyncHook(hwc2_callback_data_t callbackData,
+        hwc2_display_t display, int64_t timestamp);
+
+    hwc2_device_t* mDevice;
+
+    std::unordered_set<Capability> mCapabilities;
+
+    struct {
+        HWC2_PFN_ACCEPT_DISPLAY_CHANGES acceptDisplayChanges;
+        HWC2_PFN_CREATE_LAYER createLayer;
+        HWC2_PFN_CREATE_VIRTUAL_DISPLAY createVirtualDisplay;
+        HWC2_PFN_DESTROY_LAYER destroyLayer;
+        HWC2_PFN_DESTROY_VIRTUAL_DISPLAY destroyVirtualDisplay;
+        HWC2_PFN_DUMP dump;
+        HWC2_PFN_GET_ACTIVE_CONFIG getActiveConfig;
+        HWC2_PFN_GET_CHANGED_COMPOSITION_TYPES getChangedCompositionTypes;
+        HWC2_PFN_GET_CLIENT_TARGET_SUPPORT getClientTargetSupport;
+        HWC2_PFN_GET_COLOR_MODES getColorModes;
+        HWC2_PFN_GET_DISPLAY_ATTRIBUTE getDisplayAttribute;
+        HWC2_PFN_GET_DISPLAY_CONFIGS getDisplayConfigs;
+        HWC2_PFN_GET_DISPLAY_NAME getDisplayName;
+        HWC2_PFN_GET_DISPLAY_REQUESTS getDisplayRequests;
+        HWC2_PFN_GET_DISPLAY_TYPE getDisplayType;
+        HWC2_PFN_GET_DOZE_SUPPORT getDozeSupport;
+        HWC2_PFN_GET_HDR_CAPABILITIES getHdrCapabilities;
+        HWC2_PFN_GET_MAX_VIRTUAL_DISPLAY_COUNT getMaxVirtualDisplayCount;
+        HWC2_PFN_GET_RELEASE_FENCES getReleaseFences;
+        HWC2_PFN_PRESENT_DISPLAY presentDisplay;
+        HWC2_PFN_REGISTER_CALLBACK registerCallback;
+        HWC2_PFN_SET_ACTIVE_CONFIG setActiveConfig;
+        HWC2_PFN_SET_CLIENT_TARGET setClientTarget;
+        HWC2_PFN_SET_COLOR_MODE setColorMode;
+        HWC2_PFN_SET_COLOR_TRANSFORM setColorTransform;
+        HWC2_PFN_SET_CURSOR_POSITION setCursorPosition;
+        HWC2_PFN_SET_LAYER_BLEND_MODE setLayerBlendMode;
+        HWC2_PFN_SET_LAYER_BUFFER setLayerBuffer;
+        HWC2_PFN_SET_LAYER_COLOR setLayerColor;
+        HWC2_PFN_SET_LAYER_COMPOSITION_TYPE setLayerCompositionType;
+        HWC2_PFN_SET_LAYER_DATASPACE setLayerDataspace;
+        HWC2_PFN_SET_LAYER_DISPLAY_FRAME setLayerDisplayFrame;
+        HWC2_PFN_SET_LAYER_PLANE_ALPHA setLayerPlaneAlpha;
+        HWC2_PFN_SET_LAYER_SIDEBAND_STREAM setLayerSidebandStream;
+        HWC2_PFN_SET_LAYER_SOURCE_CROP setLayerSourceCrop;
+        HWC2_PFN_SET_LAYER_SURFACE_DAMAGE setLayerSurfaceDamage;
+        HWC2_PFN_SET_LAYER_TRANSFORM setLayerTransform;
+        HWC2_PFN_SET_LAYER_VISIBLE_REGION setLayerVisibleRegion;
+        HWC2_PFN_SET_LAYER_Z_ORDER setLayerZOrder;
+        HWC2_PFN_SET_OUTPUT_BUFFER setOutputBuffer;
+        HWC2_PFN_SET_POWER_MODE setPowerMode;
+        HWC2_PFN_SET_VSYNC_ENABLED setVsyncEnabled;
+        HWC2_PFN_VALIDATE_DISPLAY validateDisplay;
+    } mDispatch;
+
+    std::mutex mClientMutex;
+    wp<HwcClient> mClient;
+};
+
 extern "C" IComposer* HIDL_FETCH_IComposer(const char* name);
 
 } // namespace implementation
diff --git a/graphics/composer/2.1/default/HwcClient.cpp b/graphics/composer/2.1/default/HwcClient.cpp
new file mode 100644
index 0000000..16af94c
--- /dev/null
+++ b/graphics/composer/2.1/default/HwcClient.cpp
@@ -0,0 +1,1126 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "HwcPassthrough"
+
+#include <hardware/gralloc.h>
+#include <hardware/gralloc1.h>
+#include <log/log.h>
+
+#include "Hwc.h"
+#include "HwcClient.h"
+#include "IComposerCommandBuffer.h"
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_1 {
+namespace implementation {
+
+namespace {
+
+class HandleImporter {
+public:
+    HandleImporter() : mInitialized(false) {}
+
+    bool initialize()
+    {
+        // allow only one client
+        if (mInitialized) {
+            return false;
+        }
+
+        if (!openGralloc()) {
+            return false;
+        }
+
+        mInitialized = true;
+        return true;
+    }
+
+    void cleanup()
+    {
+        if (!mInitialized) {
+            return;
+        }
+
+        closeGralloc();
+        mInitialized = false;
+    }
+
+    // In IComposer, any buffer_handle_t is owned by the caller and we need to
+    // make a clone for hwcomposer2.  We also need to translate empty handle
+    // to nullptr.  This function does that, in-place.
+    bool importBuffer(buffer_handle_t& handle)
+    {
+        if (!handle) {
+            return true;
+        }
+
+        if (!handle->numFds && !handle->numInts) {
+            handle = nullptr;
+            return true;
+        }
+
+        buffer_handle_t clone = cloneBuffer(handle);
+        if (!clone) {
+            return false;
+        }
+
+        handle = clone;
+        return true;
+    }
+
+    void freeBuffer(buffer_handle_t handle)
+    {
+        if (!handle) {
+            return;
+        }
+
+        releaseBuffer(handle);
+    }
+
+private:
+    bool mInitialized;
+
+    // Some existing gralloc drivers do not support retaining more than once,
+    // when we are in passthrough mode.
+#ifdef BINDERIZED
+    bool openGralloc()
+    {
+        const hw_module_t* module;
+        int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
+        if (err) {
+            ALOGE("failed to get gralloc module");
+            return false;
+        }
+
+        uint8_t major = (module->module_api_version >> 8) & 0xff;
+        if (major > 1) {
+            ALOGE("unknown gralloc module major version %d", major);
+            return false;
+        }
+
+        if (major == 1) {
+            err = gralloc1_open(module, &mDevice);
+            if (err) {
+                ALOGE("failed to open gralloc1 device");
+                return false;
+            }
+
+            mRetain = reinterpret_cast<GRALLOC1_PFN_RETAIN>(
+                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RETAIN));
+            mRelease = reinterpret_cast<GRALLOC1_PFN_RELEASE>(
+                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RELEASE));
+            if (!mRetain || !mRelease) {
+                ALOGE("invalid gralloc1 device");
+                gralloc1_close(mDevice);
+                return false;
+            }
+        } else {
+            mModule = reinterpret_cast<const gralloc_module_t*>(module);
+        }
+
+        return true;
+    }
+
+    void closeGralloc()
+    {
+        if (mDevice) {
+            gralloc1_close(mDevice);
+        }
+    }
+
+    buffer_handle_t cloneBuffer(buffer_handle_t handle)
+    {
+        native_handle_t* clone = native_handle_clone(handle);
+        if (!clone) {
+            ALOGE("failed to clone buffer %p", handle);
+            return nullptr;
+        }
+
+        bool err;
+        if (mDevice) {
+            err = (mRetain(mDevice, clone) != GRALLOC1_ERROR_NONE);
+        } else {
+            err = (mModule->registerBuffer(mModule, clone) != 0);
+        }
+
+        if (err) {
+            ALOGE("failed to retain/register buffer %p", clone);
+            native_handle_close(clone);
+            native_handle_delete(clone);
+            return nullptr;
+        }
+
+        return clone;
+    }
+
+    void releaseBuffer(buffer_handle_t handle)
+    {
+        if (mDevice) {
+            mRelease(mDevice, handle);
+        } else {
+            mModule->unregisterBuffer(mModule, handle);
+            native_handle_close(handle);
+            native_handle_delete(const_cast<native_handle_t*>(handle));
+        }
+    }
+
+    // gralloc1
+    gralloc1_device_t* mDevice;
+    GRALLOC1_PFN_RETAIN mRetain;
+    GRALLOC1_PFN_RELEASE mRelease;
+
+    // gralloc0
+    const gralloc_module_t* mModule;
+#else
+    bool openGralloc() { return true; }
+    void closeGralloc() {}
+    buffer_handle_t cloneBuffer(buffer_handle_t handle) { return handle; }
+    void releaseBuffer(buffer_handle_t) {}
+#endif
+};
+
+HandleImporter sHandleImporter;
+
+} // anonymous namespace
+
+BufferClone::BufferClone()
+    : mHandle(nullptr)
+{
+}
+
+BufferClone::BufferClone(BufferClone&& other)
+{
+    mHandle = other.mHandle;
+    other.mHandle = nullptr;
+}
+
+BufferClone& BufferClone::operator=(buffer_handle_t handle)
+{
+    clear();
+    mHandle = handle;
+    return *this;
+}
+
+BufferClone::~BufferClone()
+{
+    clear();
+}
+
+void BufferClone::clear()
+{
+    if (mHandle) {
+        sHandleImporter.freeBuffer(mHandle);
+    }
+}
+
+HwcClient::HwcClient(HwcHal& hal)
+    : mHal(hal), mReader(*this), mWriter(kWriterInitialSize)
+{
+    if (!sHandleImporter.initialize()) {
+        LOG_ALWAYS_FATAL("failed to initialize handle importer");
+    }
+}
+
+HwcClient::~HwcClient()
+{
+    mHal.enableCallback(false);
+    mHal.removeClient();
+
+    // no need to grab the mutex as any in-flight hwbinder call should keep
+    // the client alive
+    for (const auto& dpy : mDisplayData) {
+        if (!dpy.second.Layers.empty()) {
+            ALOGW("client destroyed with valid layers");
+        }
+        for (const auto& ly : dpy.second.Layers) {
+            mHal.destroyLayer(dpy.first, ly.first);
+        }
+
+        if (dpy.second.IsVirtual) {
+            ALOGW("client destroyed with valid virtual display");
+            mHal.destroyVirtualDisplay(dpy.first);
+        }
+    }
+
+    mDisplayData.clear();
+
+    sHandleImporter.cleanup();
+}
+
+void HwcClient::onHotplug(Display display,
+        IComposerCallback::Connection connected)
+{
+    {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        if (connected == IComposerCallback::Connection::CONNECTED) {
+            mDisplayData.emplace(display, DisplayData(false));
+        } else if (connected == IComposerCallback::Connection::DISCONNECTED) {
+            mDisplayData.erase(display);
+        }
+    }
+
+    mCallback->onHotplug(display, connected);
+}
+
+void HwcClient::onRefresh(Display display)
+{
+    mCallback->onRefresh(display);
+}
+
+void HwcClient::onVsync(Display display, int64_t timestamp)
+{
+    mCallback->onVsync(display, timestamp);
+}
+
+Return<void> HwcClient::registerCallback(const sp<IComposerCallback>& callback)
+{
+    // no locking as we require this function to be called only once
+    mCallback = callback;
+    mHal.enableCallback(callback != nullptr);
+
+    return Void();
+}
+
+Return<uint32_t> HwcClient::getMaxVirtualDisplayCount()
+{
+    return mHal.getMaxVirtualDisplayCount();
+}
+
+Return<void> HwcClient::createVirtualDisplay(uint32_t width, uint32_t height,
+        PixelFormat formatHint, uint32_t outputBufferSlotCount,
+        createVirtualDisplay_cb hidl_cb)
+{
+    Display display;
+    Error err = mHal.createVirtualDisplay(width, height, formatHint, display);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        auto dpy = mDisplayData.emplace(display, DisplayData(true)).first;
+        dpy->second.OutputBuffers.resize(outputBufferSlotCount);
+    }
+
+    hidl_cb(err, display, formatHint);
+    return Void();
+}
+
+Return<Error> HwcClient::destroyVirtualDisplay(Display display)
+{
+    Error err = mHal.destroyVirtualDisplay(display);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        mDisplayData.erase(display);
+    }
+
+    return err;
+}
+
+Return<void> HwcClient::createLayer(Display display, uint32_t bufferSlotCount,
+        createLayer_cb hidl_cb)
+{
+    Layer layer;
+    Error err = mHal.createLayer(display, layer);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        auto dpy = mDisplayData.find(display);
+        auto ly = dpy->second.Layers.emplace(layer, LayerBuffers()).first;
+        ly->second.Buffers.resize(bufferSlotCount);
+    }
+
+    hidl_cb(err, layer);
+    return Void();
+}
+
+Return<Error> HwcClient::destroyLayer(Display display, Layer layer)
+{
+    Error err = mHal.destroyLayer(display, layer);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        auto dpy = mDisplayData.find(display);
+        dpy->second.Layers.erase(layer);
+    }
+
+    return err;
+}
+
+Return<void> HwcClient::getActiveConfig(Display display,
+        getActiveConfig_cb hidl_cb)
+{
+    Config config;
+    Error err = mHal.getActiveConfig(display, config);
+
+    hidl_cb(err, config);
+    return Void();
+}
+
+Return<Error> HwcClient::getClientTargetSupport(Display display,
+        uint32_t width, uint32_t height,
+        PixelFormat format, Dataspace dataspace)
+{
+    Error err = mHal.getClientTargetSupport(display,
+            width, height, format, dataspace);
+    return err;
+}
+
+Return<void> HwcClient::getColorModes(Display display, getColorModes_cb hidl_cb)
+{
+    hidl_vec<ColorMode> modes;
+    Error err = mHal.getColorModes(display, modes);
+
+    hidl_cb(err, modes);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayAttribute(Display display,
+        Config config, Attribute attribute,
+        getDisplayAttribute_cb hidl_cb)
+{
+    int32_t value;
+    Error err = mHal.getDisplayAttribute(display, config, attribute, value);
+
+    hidl_cb(err, value);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayConfigs(Display display,
+        getDisplayConfigs_cb hidl_cb)
+{
+    hidl_vec<Config> configs;
+    Error err = mHal.getDisplayConfigs(display, configs);
+
+    hidl_cb(err, configs);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayName(Display display,
+        getDisplayName_cb hidl_cb)
+{
+    hidl_string name;
+    Error err = mHal.getDisplayName(display, name);
+
+    hidl_cb(err, name);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayType(Display display,
+        getDisplayType_cb hidl_cb)
+{
+    DisplayType type;
+    Error err = mHal.getDisplayType(display, type);
+
+    hidl_cb(err, type);
+    return Void();
+}
+
+Return<void> HwcClient::getDozeSupport(Display display,
+        getDozeSupport_cb hidl_cb)
+{
+    bool support;
+    Error err = mHal.getDozeSupport(display, support);
+
+    hidl_cb(err, support);
+    return Void();
+}
+
+Return<void> HwcClient::getHdrCapabilities(Display display,
+        getHdrCapabilities_cb hidl_cb)
+{
+    hidl_vec<Hdr> types;
+    float max_lumi = 0.0f;
+    float max_avg_lumi = 0.0f;
+    float min_lumi = 0.0f;
+    Error err = mHal.getHdrCapabilities(display, types,
+            max_lumi, max_avg_lumi, min_lumi);
+
+    hidl_cb(err, types, max_lumi, max_avg_lumi, min_lumi);
+    return Void();
+}
+
+Return<Error> HwcClient::setClientTargetSlotCount(Display display,
+        uint32_t clientTargetSlotCount)
+{
+    std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+    auto dpy = mDisplayData.find(display);
+    if (dpy == mDisplayData.end()) {
+        return Error::BAD_DISPLAY;
+    }
+
+    dpy->second.ClientTargets.resize(clientTargetSlotCount);
+
+    return Error::NONE;
+}
+
+Return<Error> HwcClient::setActiveConfig(Display display, Config config)
+{
+    Error err = mHal.setActiveConfig(display, config);
+    return err;
+}
+
+Return<Error> HwcClient::setColorMode(Display display, ColorMode mode)
+{
+    Error err = mHal.setColorMode(display, mode);
+    return err;
+}
+
+Return<Error> HwcClient::setPowerMode(Display display, PowerMode mode)
+{
+    Error err = mHal.setPowerMode(display, mode);
+    return err;
+}
+
+Return<Error> HwcClient::setVsyncEnabled(Display display, Vsync enabled)
+{
+    Error err = mHal.setVsyncEnabled(display, enabled);
+    return err;
+}
+
+Return<Error> HwcClient::setInputCommandQueue(
+        const MQDescriptorSync& descriptor)
+{
+    std::lock_guard<std::mutex> lock(mCommandMutex);
+    return mReader.setMQDescriptor(descriptor) ?
+        Error::NONE : Error::NO_RESOURCES;
+}
+
+Return<void> HwcClient::getOutputCommandQueue(
+        getOutputCommandQueue_cb hidl_cb)
+{
+    // no locking as we require this function to be called inside
+    // executeCommands_cb
+
+    auto outDescriptor = mWriter.getMQDescriptor();
+    if (outDescriptor) {
+        hidl_cb(Error::NONE, *outDescriptor);
+    } else {
+        hidl_cb(Error::NO_RESOURCES, MQDescriptorSync(0, nullptr, 0));
+    }
+
+    return Void();
+}
+
+Return<void> HwcClient::executeCommands(uint32_t inLength,
+        const hidl_vec<hidl_handle>& inHandles,
+        executeCommands_cb hidl_cb)
+{
+    std::lock_guard<std::mutex> lock(mCommandMutex);
+
+    bool outChanged = false;
+    uint32_t outLength = 0;
+    hidl_vec<hidl_handle> outHandles;
+
+    if (!mReader.readQueue(inLength, inHandles)) {
+        hidl_cb(Error::BAD_PARAMETER, outChanged, outLength, outHandles);
+        return Void();
+    }
+
+    Error err = mReader.parse();
+    if (err == Error::NONE &&
+            !mWriter.writeQueue(outChanged, outLength, outHandles)) {
+        err = Error::NO_RESOURCES;
+    }
+
+    hidl_cb(err, outChanged, outLength, outHandles);
+
+    mReader.reset();
+    mWriter.reset();
+
+    return Void();
+}
+
+HwcClient::CommandReader::CommandReader(HwcClient& client)
+    : mClient(client), mHal(client.mHal), mWriter(client.mWriter)
+{
+}
+
+Error HwcClient::CommandReader::parse()
+{
+    IComposerClient::Command command;
+    uint16_t length;
+
+    while (!isEmpty()) {
+        if (!beginCommand(command, length)) {
+            break;
+        }
+
+        bool parsed = false;
+        switch (command) {
+        case IComposerClient::Command::SELECT_DISPLAY:
+            parsed = parseSelectDisplay(length);
+            break;
+        case IComposerClient::Command::SELECT_LAYER:
+            parsed = parseSelectLayer(length);
+            break;
+        case IComposerClient::Command::SET_COLOR_TRANSFORM:
+            parsed = parseSetColorTransform(length);
+            break;
+        case IComposerClient::Command::SET_CLIENT_TARGET:
+            parsed = parseSetClientTarget(length);
+            break;
+        case IComposerClient::Command::SET_OUTPUT_BUFFER:
+            parsed = parseSetOutputBuffer(length);
+            break;
+        case IComposerClient::Command::VALIDATE_DISPLAY:
+            parsed = parseValidateDisplay(length);
+            break;
+        case IComposerClient::Command::ACCEPT_DISPLAY_CHANGES:
+            parsed = parseAcceptDisplayChanges(length);
+            break;
+        case IComposerClient::Command::PRESENT_DISPLAY:
+            parsed = parsePresentDisplay(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_CURSOR_POSITION:
+            parsed = parseSetLayerCursorPosition(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_BUFFER:
+            parsed = parseSetLayerBuffer(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_SURFACE_DAMAGE:
+            parsed = parseSetLayerSurfaceDamage(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_BLEND_MODE:
+            parsed = parseSetLayerBlendMode(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_COLOR:
+            parsed = parseSetLayerColor(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_COMPOSITION_TYPE:
+            parsed = parseSetLayerCompositionType(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_DATASPACE:
+            parsed = parseSetLayerDataspace(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_DISPLAY_FRAME:
+            parsed = parseSetLayerDisplayFrame(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_PLANE_ALPHA:
+            parsed = parseSetLayerPlaneAlpha(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_SIDEBAND_STREAM:
+            parsed = parseSetLayerSidebandStream(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_SOURCE_CROP:
+            parsed = parseSetLayerSourceCrop(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_TRANSFORM:
+            parsed = parseSetLayerTransform(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_VISIBLE_REGION:
+            parsed = parseSetLayerVisibleRegion(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_Z_ORDER:
+            parsed = parseSetLayerZOrder(length);
+            break;
+        default:
+            parsed = false;
+            break;
+        }
+
+        endCommand();
+
+        if (!parsed) {
+            ALOGE("failed to parse command 0x%x, length %" PRIu16,
+                    command, length);
+            break;
+        }
+    }
+
+    return (isEmpty()) ? Error::NONE : Error::BAD_PARAMETER;
+}
+
+bool HwcClient::CommandReader::parseSelectDisplay(uint16_t length)
+{
+    if (length != CommandWriter::kSelectDisplayLength) {
+        return false;
+    }
+
+    mDisplay = read64();
+    mWriter.selectDisplay(mDisplay);
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSelectLayer(uint16_t length)
+{
+    if (length != CommandWriter::kSelectLayerLength) {
+        return false;
+    }
+
+    mLayer = read64();
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetColorTransform(uint16_t length)
+{
+    if (length != CommandWriter::kSetColorTransformLength) {
+        return false;
+    }
+
+    float matrix[16];
+    for (int i = 0; i < 16; i++) {
+        matrix[i] = readFloat();
+    }
+    auto transform = readSigned();
+
+    auto err = mHal.setColorTransform(mDisplay, matrix, transform);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetClientTarget(uint16_t length)
+{
+    // 4 parameters followed by N rectangles
+    if ((length - 4) % 4 != 0) {
+        return false;
+    }
+
+    bool useCache;
+    auto slot = read();
+    auto clientTarget = readHandle(useCache);
+    auto fence = readFence();
+    auto dataspace = readSigned();
+    auto damage = readRegion((length - 4) / 4);
+
+    auto err = lookupBuffer(BufferCache::CLIENT_TARGETS,
+            slot, useCache, clientTarget);
+    if (err == Error::NONE) {
+        err = mHal.setClientTarget(mDisplay, clientTarget, fence,
+                dataspace, damage);
+    }
+    if (err != Error::NONE) {
+        close(fence);
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetOutputBuffer(uint16_t length)
+{
+    if (length != CommandWriter::kSetOutputBufferLength) {
+        return false;
+    }
+
+    bool useCache;
+    auto slot = read();
+    auto outputBuffer = readHandle(useCache);
+    auto fence = readFence();
+
+    auto err = lookupBuffer(BufferCache::OUTPUT_BUFFERS,
+            slot, useCache, outputBuffer);
+    if (err == Error::NONE) {
+        err = mHal.setOutputBuffer(mDisplay, outputBuffer, fence);
+    }
+    if (err != Error::NONE) {
+        close(fence);
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseValidateDisplay(uint16_t length)
+{
+    if (length != CommandWriter::kValidateDisplayLength) {
+        return false;
+    }
+
+    std::vector<Layer> changedLayers;
+    std::vector<IComposerClient::Composition> compositionTypes;
+    uint32_t displayRequestMask;
+    std::vector<Layer> requestedLayers;
+    std::vector<uint32_t> requestMasks;
+
+    auto err = mHal.validateDisplay(mDisplay, changedLayers, compositionTypes,
+            displayRequestMask, requestedLayers, requestMasks);
+    if (err == Error::NONE) {
+        mWriter.setChangedCompositionTypes(changedLayers,
+                compositionTypes);
+        mWriter.setDisplayRequests(displayRequestMask,
+                requestedLayers, requestMasks);
+    } else {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseAcceptDisplayChanges(uint16_t length)
+{
+    if (length != CommandWriter::kAcceptDisplayChangesLength) {
+        return false;
+    }
+
+    auto err = mHal.acceptDisplayChanges(mDisplay);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parsePresentDisplay(uint16_t length)
+{
+    if (length != CommandWriter::kPresentDisplayLength) {
+        return false;
+    }
+
+    int presentFence;
+    std::vector<Layer> layers;
+    std::vector<int> fences;
+    auto err = mHal.presentDisplay(mDisplay, presentFence, layers, fences);
+    if (err == Error::NONE) {
+        mWriter.setPresentFence(presentFence);
+        mWriter.setReleaseFences(layers, fences);
+    } else {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerCursorPosition(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerCursorPositionLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerCursorPosition(mDisplay, mLayer,
+            readSigned(), readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerBuffer(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerBufferLength) {
+        return false;
+    }
+
+    bool useCache;
+    auto slot = read();
+    auto buffer = readHandle(useCache);
+    auto fence = readFence();
+
+    auto err = lookupBuffer(BufferCache::LAYER_BUFFERS,
+            slot, useCache, buffer);
+    if (err == Error::NONE) {
+        err = mHal.setLayerBuffer(mDisplay, mLayer, buffer, fence);
+    }
+    if (err != Error::NONE) {
+        close(fence);
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerSurfaceDamage(uint16_t length)
+{
+    // N rectangles
+    if (length % 4 != 0) {
+        return false;
+    }
+
+    auto damage = readRegion(length / 4);
+    auto err = mHal.setLayerSurfaceDamage(mDisplay, mLayer, damage);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerBlendMode(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerBlendModeLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerBlendMode(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerColor(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerColorLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerColor(mDisplay, mLayer, readColor());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerCompositionType(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerCompositionTypeLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerCompositionType(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerDataspace(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerDataspaceLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerDataspace(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerDisplayFrame(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerDisplayFrameLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerDisplayFrame(mDisplay, mLayer, readRect());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerPlaneAlpha(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerPlaneAlphaLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerPlaneAlpha(mDisplay, mLayer, read());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerSidebandStream(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerSidebandStreamLength) {
+        return false;
+    }
+
+    auto stream = readHandle();
+
+    auto err = lookupLayerSidebandStream(stream);
+    if (err == Error::NONE) {
+        err = mHal.setLayerSidebandStream(mDisplay, mLayer, stream);
+    }
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerSourceCrop(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerSourceCropLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerSourceCrop(mDisplay, mLayer, readFRect());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerTransform(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerTransformLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerTransform(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerVisibleRegion(uint16_t length)
+{
+    // N rectangles
+    if (length % 4 != 0) {
+        return false;
+    }
+
+    auto region = readRegion(length / 4);
+    auto err = mHal.setLayerVisibleRegion(mDisplay, mLayer, region);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerZOrder(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerZOrderLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerZOrder(mDisplay, mLayer, read());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+hwc_rect_t HwcClient::CommandReader::readRect()
+{
+    return hwc_rect_t{
+        readSigned(),
+        readSigned(),
+        readSigned(),
+        readSigned(),
+    };
+}
+
+std::vector<hwc_rect_t> HwcClient::CommandReader::readRegion(size_t count)
+{
+    std::vector<hwc_rect_t> region;
+    region.reserve(count);
+    while (count > 0) {
+        region.emplace_back(readRect());
+        count--;
+    }
+
+    return region;
+}
+
+hwc_frect_t HwcClient::CommandReader::readFRect()
+{
+    return hwc_frect_t{
+        readFloat(),
+        readFloat(),
+        readFloat(),
+        readFloat(),
+    };
+}
+
+Error HwcClient::CommandReader::lookupBuffer(BufferCache cache, uint32_t slot,
+        bool useCache, buffer_handle_t& handle)
+{
+    std::lock_guard<std::mutex> lock(mClient.mDisplayDataMutex);
+
+    auto dpy = mClient.mDisplayData.find(mDisplay);
+    if (dpy == mClient.mDisplayData.end()) {
+        return Error::BAD_DISPLAY;
+    }
+
+    BufferClone* clone = nullptr;
+    switch (cache) {
+    case BufferCache::CLIENT_TARGETS:
+        if (slot < dpy->second.ClientTargets.size()) {
+            clone = &dpy->second.ClientTargets[slot];
+        }
+        break;
+    case BufferCache::OUTPUT_BUFFERS:
+        if (slot < dpy->second.OutputBuffers.size()) {
+            clone = &dpy->second.OutputBuffers[slot];
+        }
+        break;
+    case BufferCache::LAYER_BUFFERS:
+        {
+            auto ly = dpy->second.Layers.find(mLayer);
+            if (ly == dpy->second.Layers.end()) {
+                return Error::BAD_LAYER;
+            }
+            if (slot < ly->second.Buffers.size()) {
+                clone = &ly->second.Buffers[slot];
+            }
+        }
+        break;
+    case BufferCache::LAYER_SIDEBAND_STREAMS:
+        {
+            auto ly = dpy->second.Layers.find(mLayer);
+            if (ly == dpy->second.Layers.end()) {
+                return Error::BAD_LAYER;
+            }
+            if (slot == 0) {
+                clone = &ly->second.SidebandStream;
+            }
+        }
+        break;
+    default:
+        break;
+    }
+
+    if (!clone) {
+        ALOGW("invalid buffer slot");
+        return Error::BAD_PARAMETER;
+    }
+
+    // use or update cache
+    if (useCache) {
+        handle = *clone;
+    } else {
+        if (!sHandleImporter.importBuffer(handle)) {
+            return Error::NO_RESOURCES;
+        }
+
+        *clone = handle;
+    }
+
+    return Error::NONE;
+}
+
+} // namespace implementation
+} // namespace V2_1
+} // namespace composer
+} // namespace graphics
+} // namespace hardware
+} // namespace android
diff --git a/graphics/composer/2.1/default/HwcClient.h b/graphics/composer/2.1/default/HwcClient.h
new file mode 100644
index 0000000..a9bc4cd
--- /dev/null
+++ b/graphics/composer/2.1/default/HwcClient.h
@@ -0,0 +1,202 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_CLIENT_H
+#define ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_CLIENT_H
+
+#include <mutex>
+#include <unordered_map>
+#include <vector>
+
+#include "Hwc.h"
+#include "IComposerCommandBuffer.h"
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_1 {
+namespace implementation {
+
+class BufferClone {
+public:
+    BufferClone();
+    BufferClone(BufferClone&& other);
+
+    BufferClone(const BufferClone& other) = delete;
+    BufferClone& operator=(const BufferClone& other) = delete;
+
+    BufferClone& operator=(buffer_handle_t handle);
+    ~BufferClone();
+
+    operator buffer_handle_t() const { return mHandle; }
+
+private:
+    void clear();
+
+    buffer_handle_t mHandle;
+};
+
+class HwcClient : public IComposerClient {
+public:
+    HwcClient(HwcHal& hal);
+    virtual ~HwcClient();
+
+    void onHotplug(Display display, IComposerCallback::Connection connected);
+    void onRefresh(Display display);
+    void onVsync(Display display, int64_t timestamp);
+
+    // IComposerClient interface
+    Return<void> registerCallback(
+            const sp<IComposerCallback>& callback) override;
+    Return<uint32_t> getMaxVirtualDisplayCount() override;
+    Return<void> createVirtualDisplay(uint32_t width, uint32_t height,
+            PixelFormat formatHint, uint32_t outputBufferSlotCount,
+            createVirtualDisplay_cb hidl_cb) override;
+    Return<Error> destroyVirtualDisplay(Display display) override;
+    Return<void> createLayer(Display display, uint32_t bufferSlotCount,
+            createLayer_cb hidl_cb) override;
+    Return<Error> destroyLayer(Display display, Layer layer) override;
+    Return<void> getActiveConfig(Display display,
+            getActiveConfig_cb hidl_cb) override;
+    Return<Error> getClientTargetSupport(Display display,
+            uint32_t width, uint32_t height,
+            PixelFormat format, Dataspace dataspace) override;
+    Return<void> getColorModes(Display display,
+            getColorModes_cb hidl_cb) override;
+    Return<void> getDisplayAttribute(Display display,
+            Config config, Attribute attribute,
+            getDisplayAttribute_cb hidl_cb) override;
+    Return<void> getDisplayConfigs(Display display,
+            getDisplayConfigs_cb hidl_cb) override;
+    Return<void> getDisplayName(Display display,
+            getDisplayName_cb hidl_cb) override;
+    Return<void> getDisplayType(Display display,
+            getDisplayType_cb hidl_cb) override;
+    Return<void> getDozeSupport(Display display,
+            getDozeSupport_cb hidl_cb) override;
+    Return<void> getHdrCapabilities(Display display,
+            getHdrCapabilities_cb hidl_cb) override;
+    Return<Error> setActiveConfig(Display display, Config config) override;
+    Return<Error> setColorMode(Display display, ColorMode mode) override;
+    Return<Error> setPowerMode(Display display, PowerMode mode) override;
+    Return<Error> setVsyncEnabled(Display display, Vsync enabled) override;
+    Return<Error> setClientTargetSlotCount(Display display,
+            uint32_t clientTargetSlotCount) override;
+    Return<Error> setInputCommandQueue(
+            const MQDescriptorSync& descriptor) override;
+    Return<void> getOutputCommandQueue(
+            getOutputCommandQueue_cb hidl_cb) override;
+    Return<void> executeCommands(uint32_t inLength,
+            const hidl_vec<hidl_handle>& inHandles,
+            executeCommands_cb hidl_cb) override;
+
+private:
+    struct LayerBuffers {
+        std::vector<BufferClone> Buffers;
+        BufferClone SidebandStream;
+    };
+
+    struct DisplayData {
+        bool IsVirtual;
+
+        std::vector<BufferClone> ClientTargets;
+        std::vector<BufferClone> OutputBuffers;
+
+        std::unordered_map<Layer, LayerBuffers> Layers;
+
+        DisplayData(bool isVirtual) : IsVirtual(isVirtual) {}
+    };
+
+    class CommandReader : public CommandReaderBase {
+    public:
+        CommandReader(HwcClient& client);
+        Error parse();
+
+    private:
+        bool parseSelectDisplay(uint16_t length);
+        bool parseSelectLayer(uint16_t length);
+        bool parseSetColorTransform(uint16_t length);
+        bool parseSetClientTarget(uint16_t length);
+        bool parseSetOutputBuffer(uint16_t length);
+        bool parseValidateDisplay(uint16_t length);
+        bool parseAcceptDisplayChanges(uint16_t length);
+        bool parsePresentDisplay(uint16_t length);
+        bool parseSetLayerCursorPosition(uint16_t length);
+        bool parseSetLayerBuffer(uint16_t length);
+        bool parseSetLayerSurfaceDamage(uint16_t length);
+        bool parseSetLayerBlendMode(uint16_t length);
+        bool parseSetLayerColor(uint16_t length);
+        bool parseSetLayerCompositionType(uint16_t length);
+        bool parseSetLayerDataspace(uint16_t length);
+        bool parseSetLayerDisplayFrame(uint16_t length);
+        bool parseSetLayerPlaneAlpha(uint16_t length);
+        bool parseSetLayerSidebandStream(uint16_t length);
+        bool parseSetLayerSourceCrop(uint16_t length);
+        bool parseSetLayerTransform(uint16_t length);
+        bool parseSetLayerVisibleRegion(uint16_t length);
+        bool parseSetLayerZOrder(uint16_t length);
+
+        hwc_rect_t readRect();
+        std::vector<hwc_rect_t> readRegion(size_t count);
+        hwc_frect_t readFRect();
+
+        enum class BufferCache {
+            CLIENT_TARGETS,
+            OUTPUT_BUFFERS,
+            LAYER_BUFFERS,
+            LAYER_SIDEBAND_STREAMS,
+        };
+        Error lookupBuffer(BufferCache cache, uint32_t slot,
+                bool useCache, buffer_handle_t& handle);
+
+        Error lookupLayerSidebandStream(buffer_handle_t& handle)
+        {
+            return lookupBuffer(BufferCache::LAYER_SIDEBAND_STREAMS,
+                    0, false, handle);
+        }
+
+        HwcClient& mClient;
+        HwcHal& mHal;
+        CommandWriter& mWriter;
+
+        Display mDisplay;
+        Layer mLayer;
+    };
+
+    HwcHal& mHal;
+
+    // 64KiB minus a small space for metadata such as read/write pointers
+    static constexpr size_t kWriterInitialSize =
+        64 * 1024 / sizeof(uint32_t) - 16;
+    std::mutex mCommandMutex;
+    CommandReader mReader;
+    CommandWriter mWriter;
+
+    sp<IComposerCallback> mCallback;
+
+    std::mutex mDisplayDataMutex;
+    std::unordered_map<Display, DisplayData> mDisplayData;
+};
+
+} // namespace implementation
+} // namespace V2_1
+} // namespace composer
+} // namespace graphics
+} // namespace hardware
+} // namespace android
+
+#endif  // ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_CLIENT_H
diff --git a/graphics/composer/2.1/default/IComposerCommandBuffer.h b/graphics/composer/2.1/default/IComposerCommandBuffer.h
new file mode 100644
index 0000000..030db88
--- /dev/null
+++ b/graphics/composer/2.1/default/IComposerCommandBuffer.h
@@ -0,0 +1,848 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_GRAPHICS_COMPOSER_COMMAND_BUFFER_H
+#define ANDROID_HARDWARE_GRAPHICS_COMPOSER_COMMAND_BUFFER_H
+
+#ifndef LOG_TAG
+#warn "IComposerCommandBuffer.h included without LOG_TAG"
+#endif
+
+#undef LOG_NDEBUG
+#define LOG_NDEBUG 0
+
+#include <algorithm>
+#include <limits>
+#include <memory>
+#include <vector>
+
+#include <inttypes.h>
+#include <string.h>
+
+#include <android/hardware/graphics/composer/2.1/IComposer.h>
+#include <log/log.h>
+#include <sync/sync.h>
+#include <MessageQueue.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_1 {
+
+using android::hardware::graphics::common::V1_0::ColorTransform;
+using android::hardware::graphics::common::V1_0::Dataspace;
+using android::hardware::graphics::common::V1_0::Transform;
+using android::hardware::MessageQueue;
+
+using CommandQueueType = MessageQueue<uint32_t, kSynchronizedReadWrite>;
+
+// This class helps build a command queue.  Note that all sizes/lengths are in
+// units of uint32_t's.
+class CommandWriter {
+public:
+    CommandWriter(uint32_t initialMaxSize)
+        : mDataMaxSize(initialMaxSize)
+    {
+        mData = std::make_unique<uint32_t[]>(mDataMaxSize);
+        reset();
+    }
+
+    ~CommandWriter()
+    {
+        reset();
+    }
+
+    void reset()
+    {
+        mDataWritten = 0;
+        mCommandEnd = 0;
+
+        // handles in mDataHandles are owned by the caller
+        mDataHandles.clear();
+
+        // handles in mTemporaryHandles are owned by the writer
+        for (auto handle : mTemporaryHandles) {
+            native_handle_close(handle);
+            native_handle_delete(handle);
+        }
+        mTemporaryHandles.clear();
+    }
+
+    IComposerClient::Command getCommand(uint32_t offset)
+    {
+        uint32_t val = (offset < mDataWritten) ? mData[offset] : 0;
+        return static_cast<IComposerClient::Command>(val &
+                static_cast<uint32_t>(IComposerClient::Command::OPCODE_MASK));
+    }
+
+    bool writeQueue(bool& queueChanged, uint32_t& commandLength,
+            hidl_vec<hidl_handle>& commandHandles)
+    {
+        // write data to queue, optionally resizing it
+        if (mQueue && (mDataMaxSize <= mQueue->getQuantumCount())) {
+            if (!mQueue->write(mData.get(), mDataWritten)) {
+                ALOGE("failed to write commands to message queue");
+                return false;
+            }
+
+            queueChanged = false;
+        } else {
+            auto newQueue = std::make_unique<CommandQueueType>(mDataMaxSize);
+            if (!newQueue->isValid() ||
+                    !newQueue->write(mData.get(), mDataWritten)) {
+                ALOGE("failed to prepare a new message queue ");
+                return false;
+            }
+
+            mQueue = std::move(newQueue);
+            queueChanged = true;
+        }
+
+        commandLength = mDataWritten;
+        commandHandles.setToExternal(
+                const_cast<hidl_handle*>(mDataHandles.data()),
+                mDataHandles.size());
+
+        return true;
+    }
+
+    const MQDescriptorSync* getMQDescriptor() const
+    {
+        return (mQueue) ? mQueue->getDesc() : nullptr;
+    }
+
+    static constexpr uint16_t kSelectDisplayLength = 2;
+    void selectDisplay(Display display)
+    {
+        beginCommand(IComposerClient::Command::SELECT_DISPLAY,
+                kSelectDisplayLength);
+        write64(display);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSelectLayerLength = 2;
+    void selectLayer(Layer layer)
+    {
+        beginCommand(IComposerClient::Command::SELECT_LAYER,
+                kSelectLayerLength);
+        write64(layer);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetErrorLength = 2;
+    void setError(uint32_t location, Error error)
+    {
+        beginCommand(IComposerClient::Command::SET_ERROR, kSetErrorLength);
+        write(location);
+        writeSigned(static_cast<int32_t>(error));
+        endCommand();
+    }
+
+    void setChangedCompositionTypes(const std::vector<Layer>& layers,
+            const std::vector<IComposerClient::Composition>& types)
+    {
+        size_t totalLayers = std::min(layers.size(), types.size());
+        size_t currentLayer = 0;
+
+        while (currentLayer < totalLayers) {
+            size_t count = std::min(totalLayers - currentLayer,
+                    static_cast<size_t>(kMaxLength) / 3);
+
+            beginCommand(
+                    IComposerClient::Command::SET_CHANGED_COMPOSITION_TYPES,
+                    count * 3);
+            for (size_t i = 0; i < count; i++) {
+                write64(layers[currentLayer + i]);
+                writeSigned(static_cast<int32_t>(types[currentLayer + i]));
+            }
+            endCommand();
+
+            currentLayer += count;
+        }
+    }
+
+    void setDisplayRequests(uint32_t displayRequestMask,
+            const std::vector<Layer>& layers,
+            const std::vector<uint32_t>& layerRequestMasks)
+    {
+        size_t totalLayers = std::min(layers.size(),
+                layerRequestMasks.size());
+        size_t currentLayer = 0;
+
+        while (currentLayer < totalLayers) {
+            size_t count = std::min(totalLayers - currentLayer,
+                    static_cast<size_t>(kMaxLength - 1) / 3);
+
+            beginCommand(IComposerClient::Command::SET_DISPLAY_REQUESTS,
+                    1 + count * 3);
+            write(displayRequestMask);
+            for (size_t i = 0; i < count; i++) {
+                write64(layers[currentLayer + i]);
+                write(static_cast<int32_t>(layerRequestMasks[currentLayer + i]));
+            }
+            endCommand();
+
+            currentLayer += count;
+        }
+    }
+
+    static constexpr uint16_t kSetPresentFenceLength = 1;
+    void setPresentFence(int presentFence)
+    {
+        beginCommand(IComposerClient::Command::SET_PRESENT_FENCE,
+                kSetPresentFenceLength);
+        writeFence(presentFence);
+        endCommand();
+    }
+
+    void setReleaseFences(const std::vector<Layer>& layers,
+            const std::vector<int>& releaseFences)
+    {
+        size_t totalLayers = std::min(layers.size(), releaseFences.size());
+        size_t currentLayer = 0;
+
+        while (currentLayer < totalLayers) {
+            size_t count = std::min(totalLayers - currentLayer,
+                    static_cast<size_t>(kMaxLength) / 3);
+
+            beginCommand(IComposerClient::Command::SET_RELEASE_FENCES,
+                    count * 3);
+            for (size_t i = 0; i < count; i++) {
+                write64(layers[currentLayer + i]);
+                writeFence(releaseFences[currentLayer + i]);
+            }
+            endCommand();
+
+            currentLayer += count;
+        }
+    }
+
+    static constexpr uint16_t kSetColorTransformLength = 17;
+    void setColorTransform(const float* matrix, ColorTransform hint)
+    {
+        beginCommand(IComposerClient::Command::SET_COLOR_TRANSFORM,
+                kSetColorTransformLength);
+        for (int i = 0; i < 16; i++) {
+            writeFloat(matrix[i]);
+        }
+        writeSigned(static_cast<int32_t>(hint));
+        endCommand();
+    }
+
+    void setClientTarget(uint32_t slot, const native_handle_t* target,
+            int acquireFence, Dataspace dataspace,
+            const std::vector<IComposerClient::Rect>& damage)
+    {
+        bool doWrite = (damage.size() <= (kMaxLength - 4) / 4);
+        size_t length = 4 + ((doWrite) ? damage.size() * 4 : 0);
+
+        beginCommand(IComposerClient::Command::SET_CLIENT_TARGET, length);
+        write(slot);
+        writeHandle(target, true);
+        writeFence(acquireFence);
+        writeSigned(static_cast<int32_t>(dataspace));
+        // When there are too many rectangles in the damage region and doWrite
+        // is false, we write no rectangle at all which means the entire
+        // client target is damaged.
+        if (doWrite) {
+            writeRegion(damage);
+        }
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetOutputBufferLength = 3;
+    void setOutputBuffer(uint32_t slot, const native_handle_t* buffer,
+            int releaseFence)
+    {
+        beginCommand(IComposerClient::Command::SET_OUTPUT_BUFFER,
+                kSetOutputBufferLength);
+        write(slot);
+        writeHandle(buffer, true);
+        writeFence(releaseFence);
+        endCommand();
+    }
+
+    static constexpr uint16_t kValidateDisplayLength = 0;
+    void validateDisplay()
+    {
+        beginCommand(IComposerClient::Command::VALIDATE_DISPLAY,
+                kValidateDisplayLength);
+        endCommand();
+    }
+
+    static constexpr uint16_t kAcceptDisplayChangesLength = 0;
+    void acceptDisplayChanges()
+    {
+        beginCommand(IComposerClient::Command::ACCEPT_DISPLAY_CHANGES,
+                kAcceptDisplayChangesLength);
+        endCommand();
+    }
+
+    static constexpr uint16_t kPresentDisplayLength = 0;
+    void presentDisplay()
+    {
+        beginCommand(IComposerClient::Command::PRESENT_DISPLAY,
+                kPresentDisplayLength);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerCursorPositionLength = 2;
+    void setLayerCursorPosition(int32_t x, int32_t y)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_CURSOR_POSITION,
+                kSetLayerCursorPositionLength);
+        writeSigned(x);
+        writeSigned(y);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerBufferLength = 3;
+    void setLayerBuffer(uint32_t slot, const native_handle_t* buffer,
+            int acquireFence)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_BUFFER,
+                kSetLayerBufferLength);
+        write(slot);
+        writeHandle(buffer, true);
+        writeFence(acquireFence);
+        endCommand();
+    }
+
+    void setLayerSurfaceDamage(
+            const std::vector<IComposerClient::Rect>& damage)
+    {
+        bool doWrite = (damage.size() <= kMaxLength / 4);
+        size_t length = (doWrite) ? damage.size() * 4 : 0;
+
+        beginCommand(IComposerClient::Command::SET_LAYER_SURFACE_DAMAGE,
+                length);
+        // When there are too many rectangles in the damage region and doWrite
+        // is false, we write no rectangle at all which means the entire
+        // layer is damaged.
+        if (doWrite) {
+            writeRegion(damage);
+        }
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerBlendModeLength = 1;
+    void setLayerBlendMode(IComposerClient::BlendMode mode)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_BLEND_MODE,
+                kSetLayerBlendModeLength);
+        writeSigned(static_cast<int32_t>(mode));
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerColorLength = 1;
+    void setLayerColor(IComposerClient::Color color)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_COLOR,
+                kSetLayerColorLength);
+        writeColor(color);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerCompositionTypeLength = 1;
+    void setLayerCompositionType(IComposerClient::Composition type)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_COMPOSITION_TYPE,
+                kSetLayerCompositionTypeLength);
+        writeSigned(static_cast<int32_t>(type));
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerDataspaceLength = 1;
+    void setLayerDataspace(Dataspace dataspace)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_DATASPACE,
+                kSetLayerDataspaceLength);
+        writeSigned(static_cast<int32_t>(dataspace));
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerDisplayFrameLength = 4;
+    void setLayerDisplayFrame(const IComposerClient::Rect& frame)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_DISPLAY_FRAME,
+                kSetLayerDisplayFrameLength);
+        writeRect(frame);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerPlaneAlphaLength = 1;
+    void setLayerPlaneAlpha(float alpha)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_PLANE_ALPHA,
+                kSetLayerPlaneAlphaLength);
+        writeFloat(alpha);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerSidebandStreamLength = 1;
+    void setLayerSidebandStream(const native_handle_t* stream)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_SIDEBAND_STREAM,
+                kSetLayerSidebandStreamLength);
+        writeHandle(stream);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerSourceCropLength = 4;
+    void setLayerSourceCrop(const IComposerClient::FRect& crop)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_SOURCE_CROP,
+                kSetLayerSourceCropLength);
+        writeFRect(crop);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerTransformLength = 1;
+    void setLayerTransform(Transform transform)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_TRANSFORM,
+                kSetLayerTransformLength);
+        writeSigned(static_cast<int32_t>(transform));
+        endCommand();
+    }
+
+    void setLayerVisibleRegion(
+            const std::vector<IComposerClient::Rect>& visible)
+    {
+        bool doWrite = (visible.size() <= kMaxLength / 4);
+        size_t length = (doWrite) ? visible.size() * 4 : 0;
+
+        beginCommand(IComposerClient::Command::SET_LAYER_VISIBLE_REGION,
+                length);
+        // When there are too many rectangles in the visible region and
+        // doWrite is false, we write no rectangle at all which means the
+        // entire layer is visible.
+        if (doWrite) {
+            writeRegion(visible);
+        }
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerZOrderLength = 1;
+    void setLayerZOrder(uint32_t z)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_Z_ORDER,
+                kSetLayerZOrderLength);
+        write(z);
+        endCommand();
+    }
+
+protected:
+    void beginCommand(IComposerClient::Command command, uint16_t length)
+    {
+        if (mCommandEnd) {
+            LOG_FATAL("endCommand was not called before command 0x%x",
+                    command);
+        }
+
+        growData(1 + length);
+        write(static_cast<uint32_t>(command) | length);
+
+        mCommandEnd = mDataWritten + length;
+    }
+
+    void endCommand()
+    {
+        if (!mCommandEnd) {
+            LOG_FATAL("beginCommand was not called");
+        } else if (mDataWritten > mCommandEnd) {
+            LOG_FATAL("too much data written");
+            mDataWritten = mCommandEnd;
+        } else if (mDataWritten < mCommandEnd) {
+            LOG_FATAL("too little data written");
+            while (mDataWritten < mCommandEnd) {
+                write(0);
+            }
+        }
+
+        mCommandEnd = 0;
+    }
+
+    void write(uint32_t val)
+    {
+        mData[mDataWritten++] = val;
+    }
+
+    void writeSigned(int32_t val)
+    {
+        memcpy(&mData[mDataWritten++], &val, sizeof(val));
+    }
+
+    void writeFloat(float val)
+    {
+        memcpy(&mData[mDataWritten++], &val, sizeof(val));
+    }
+
+    void write64(uint64_t val)
+    {
+        uint32_t lo = static_cast<uint32_t>(val & 0xffffffff);
+        uint32_t hi = static_cast<uint32_t>(val >> 32);
+        write(lo);
+        write(hi);
+    }
+
+    void writeRect(const IComposerClient::Rect& rect)
+    {
+        writeSigned(rect.left);
+        writeSigned(rect.top);
+        writeSigned(rect.right);
+        writeSigned(rect.bottom);
+    }
+
+    void writeRegion(const std::vector<IComposerClient::Rect>& region)
+    {
+        for (const auto& rect : region) {
+            writeRect(rect);
+        }
+    }
+
+    void writeFRect(const IComposerClient::FRect& rect)
+    {
+        writeFloat(rect.left);
+        writeFloat(rect.top);
+        writeFloat(rect.right);
+        writeFloat(rect.bottom);
+    }
+
+    void writeColor(const IComposerClient::Color& color)
+    {
+        write((color.r <<  0) |
+              (color.g <<  8) |
+              (color.b << 16) |
+              (color.a << 24));
+    }
+
+    // ownership of handle is not transferred
+    void writeHandle(const native_handle_t* handle, bool useCache)
+    {
+        if (!handle) {
+            writeSigned(static_cast<int32_t>((useCache) ?
+                        IComposerClient::HandleIndex::CACHED :
+                        IComposerClient::HandleIndex::EMPTY));
+            return;
+        }
+
+        mDataHandles.push_back(handle);
+        writeSigned(mDataHandles.size() - 1);
+    }
+
+    void writeHandle(const native_handle_t* handle)
+    {
+        writeHandle(handle, false);
+    }
+
+    // ownership of fence is transferred
+    void writeFence(int fence)
+    {
+        native_handle_t* handle = nullptr;
+        if (fence >= 0) {
+            handle = getTemporaryHandle(1, 0);
+            if (handle) {
+                handle->data[0] = fence;
+            } else {
+                ALOGW("failed to get temporary handle for fence %d", fence);
+                sync_wait(fence, -1);
+                close(fence);
+            }
+        }
+
+        writeHandle(handle);
+    }
+
+    native_handle_t* getTemporaryHandle(int numFds, int numInts)
+    {
+        native_handle_t* handle = native_handle_create(numFds, numInts);
+        if (handle) {
+            mTemporaryHandles.push_back(handle);
+        }
+        return handle;
+    }
+
+    static constexpr uint16_t kMaxLength =
+        std::numeric_limits<uint16_t>::max();
+
+private:
+    void growData(uint32_t grow)
+    {
+        uint32_t newWritten = mDataWritten + grow;
+        if (newWritten < mDataWritten) {
+            LOG_ALWAYS_FATAL("buffer overflowed; data written %" PRIu32
+                    ", growing by %" PRIu32, mDataWritten, grow);
+        }
+
+        if (newWritten <= mDataMaxSize) {
+            return;
+        }
+
+        uint32_t newMaxSize = mDataMaxSize << 1;
+        if (newMaxSize < newWritten) {
+            newMaxSize = newWritten;
+        }
+
+        auto newData = std::make_unique<uint32_t[]>(newMaxSize);
+        std::copy_n(mData.get(), mDataWritten, newData.get());
+        mDataMaxSize = newMaxSize;
+        mData = std::move(newData);
+    }
+
+    uint32_t mDataMaxSize;
+    std::unique_ptr<uint32_t[]> mData;
+
+    uint32_t mDataWritten;
+    // end offset of the current command
+    uint32_t mCommandEnd;
+
+    std::vector<hidl_handle> mDataHandles;
+    std::vector<native_handle_t *> mTemporaryHandles;
+
+    std::unique_ptr<CommandQueueType> mQueue;
+};
+
+// This class helps parse a command queue.  Note that all sizes/lengths are in
+// units of uint32_t's.
+class CommandReaderBase {
+public:
+    CommandReaderBase() : mDataMaxSize(0)
+    {
+        reset();
+    }
+
+    bool setMQDescriptor(const MQDescriptorSync& descriptor)
+    {
+        mQueue = std::make_unique<CommandQueueType>(descriptor, false);
+        if (mQueue->isValid()) {
+            return true;
+        } else {
+            mQueue = nullptr;
+            return false;
+        }
+    }
+
+    bool readQueue(uint32_t commandLength,
+            const hidl_vec<hidl_handle>& commandHandles)
+    {
+        if (!mQueue) {
+            return false;
+        }
+
+        auto quantumCount = mQueue->getQuantumCount();
+        if (mDataMaxSize < quantumCount) {
+            mDataMaxSize = quantumCount;
+            mData = std::make_unique<uint32_t[]>(mDataMaxSize);
+        }
+
+        if (commandLength > mDataMaxSize ||
+                !mQueue->read(mData.get(), commandLength)) {
+            ALOGE("failed to read commands from message queue");
+            return false;
+        }
+
+        mDataSize = commandLength;
+        mDataRead = 0;
+        mCommandBegin = 0;
+        mCommandEnd = 0;
+        mDataHandles.setToExternal(
+                const_cast<hidl_handle*>(commandHandles.data()),
+                commandHandles.size());
+
+        return true;
+    }
+
+    void reset()
+    {
+        mDataSize = 0;
+        mDataRead = 0;
+        mCommandBegin = 0;
+        mCommandEnd = 0;
+        mDataHandles.setToExternal(nullptr, 0);
+    }
+
+protected:
+    bool isEmpty() const
+    {
+        return (mDataRead >= mDataSize);
+    }
+
+    bool beginCommand(IComposerClient::Command& command, uint16_t& length)
+    {
+        if (mCommandEnd) {
+            LOG_FATAL("endCommand was not called before command 0x%x",
+                    command);
+        }
+
+        constexpr uint32_t opcode_mask =
+            static_cast<uint32_t>(IComposerClient::Command::OPCODE_MASK);
+        constexpr uint32_t length_mask =
+            static_cast<uint32_t>(IComposerClient::Command::LENGTH_MASK);
+
+        uint32_t val = read();
+        command = static_cast<IComposerClient::Command>(val & opcode_mask);
+        length = static_cast<uint16_t>(val & length_mask);
+
+        if (mDataRead + length > mDataSize) {
+            ALOGE("command 0x%x has invalid command length %" PRIu16,
+                    command, length);
+            // undo the read() above
+            mDataRead--;
+            return false;
+        }
+
+        mCommandEnd = mDataRead + length;
+
+        return true;
+    }
+
+    void endCommand()
+    {
+        if (!mCommandEnd) {
+            LOG_FATAL("beginCommand was not called");
+        } else if (mDataRead > mCommandEnd) {
+            LOG_FATAL("too much data read");
+            mDataRead = mCommandEnd;
+        } else if (mDataRead < mCommandEnd) {
+            LOG_FATAL("too little data read");
+            mDataRead = mCommandEnd;
+        }
+
+        mCommandBegin = mCommandEnd;
+        mCommandEnd = 0;
+    }
+
+    uint32_t getCommandLoc() const
+    {
+        return mCommandBegin;
+    }
+
+    uint32_t read()
+    {
+        return mData[mDataRead++];
+    }
+
+    int32_t readSigned()
+    {
+        int32_t val;
+        memcpy(&val, &mData[mDataRead++], sizeof(val));
+        return val;
+    }
+
+    float readFloat()
+    {
+        float val;
+        memcpy(&val, &mData[mDataRead++], sizeof(val));
+        return val;
+    }
+
+    uint64_t read64()
+    {
+        uint32_t lo = read();
+        uint32_t hi = read();
+        return (static_cast<uint64_t>(hi) << 32) | lo;
+    }
+
+    IComposerClient::Color readColor()
+    {
+        uint32_t val = read();
+        return IComposerClient::Color{
+            static_cast<uint8_t>((val >>  0) & 0xff),
+            static_cast<uint8_t>((val >>  8) & 0xff),
+            static_cast<uint8_t>((val >> 16) & 0xff),
+            static_cast<uint8_t>((val >> 24) & 0xff),
+        };
+    }
+
+    // ownership of handle is not transferred
+    const native_handle_t* readHandle(bool& useCache)
+    {
+        const native_handle_t* handle = nullptr;
+
+        int32_t index = readSigned();
+        switch (index) {
+        case static_cast<int32_t>(IComposerClient::HandleIndex::EMPTY):
+            useCache = false;
+            break;
+        case static_cast<int32_t>(IComposerClient::HandleIndex::CACHED):
+            useCache = true;
+            break;
+        default:
+            if (static_cast<size_t>(index) < mDataHandles.size()) {
+                handle = mDataHandles[index].getNativeHandle();
+            } else {
+                ALOGE("invalid handle index %zu", static_cast<size_t>(index));
+            }
+            useCache = false;
+            break;
+        }
+
+        return handle;
+    }
+
+    const native_handle_t* readHandle()
+    {
+        bool useCache;
+        return readHandle(useCache);
+    }
+
+    // ownership of fence is transferred
+    int readFence()
+    {
+        auto handle = readHandle();
+        if (!handle || handle->numFds == 0) {
+            return -1;
+        }
+
+        if (handle->numFds != 1) {
+            ALOGE("invalid fence handle with %d fds", handle->numFds);
+            return -1;
+        }
+
+        int fd = dup(handle->data[0]);
+        if (fd < 0) {
+            ALOGW("failed to dup fence %d", handle->data[0]);
+            sync_wait(handle->data[0], -1);
+            fd = -1;
+        }
+
+        return fd;
+    }
+
+private:
+    std::unique_ptr<CommandQueueType> mQueue;
+    uint32_t mDataMaxSize;
+    std::unique_ptr<uint32_t[]> mData;
+
+    uint32_t mDataSize;
+    uint32_t mDataRead;
+
+    // begin/end offsets of the current command
+    uint32_t mCommandBegin;
+    uint32_t mCommandEnd;
+
+    hidl_vec<hidl_handle> mDataHandles;
+};
+
+} // namespace V2_1
+} // namespace composer
+} // namespace graphics
+} // namespace hardware
+} // namespace android
+
+#endif // ANDROID_HARDWARE_GRAPHICS_COMPOSER_COMMAND_BUFFER_H
diff --git a/graphics/composer/2.1/types.hal b/graphics/composer/2.1/types.hal
index 9c2e1d7..e54031e 100644
--- a/graphics/composer/2.1/types.hal
+++ b/graphics/composer/2.1/types.hal
@@ -23,7 +23,7 @@
     BAD_DISPLAY     = 2, /* invalid Display */
     BAD_LAYER       = 3, /* invalid Layer */
     BAD_PARAMETER   = 4, /* invalid width, height, etc. */
-    HAS_CHANGES     = 5,
+    /* 5 is reserved */
     NO_RESOURCES    = 6, /* temporary failure due to resource contention */
     NOT_VALIDATED   = 7, /* validateDisplay has not been called */
     UNSUPPORTED     = 8, /* permanent failure */
diff --git a/light/2.0/Android.bp b/light/2.0/Android.bp
index 60e8f8e..a98801c 100644
--- a/light/2.0/Android.bp
+++ b/light/2.0/Android.bp
@@ -54,3 +54,61 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.light.vts.driver@2.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.light@2.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/light/2.0/ $(genDir)/android/hardware/light/2.0/",
+    srcs: [
+        "types.hal",
+        "ILight.hal",
+    ],
+    out: [
+        "android/hardware/light/2.0/types.vts.cpp",
+        "android/hardware/light/2.0/Light.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.light.vts.driver@2.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.light@2.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/light/2.0/ $(genDir)/android/hardware/light/2.0/",
+    srcs: [
+        "types.hal",
+        "ILight.hal",
+    ],
+    out: [
+        "android/hardware/light/2.0/types.vts.h",
+        "android/hardware/light/2.0/Light.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.light.vts.driver@2.0",
+    generated_sources: ["android.hardware.light.vts.driver@2.0_genc++"],
+    generated_headers: ["android.hardware.light.vts.driver@2.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.light.vts.driver@2.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.light@2.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/light/2.0/vts/Android.mk b/light/2.0/vts/Android.mk
index 0df4772..089503b 100644
--- a/light/2.0/vts/Android.mk
+++ b/light/2.0/vts/Android.mk
@@ -16,34 +16,4 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Light v2.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_light@2.0
-
-LOCAL_SRC_FILES := \
-    Light.vts \
-    types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-    android.hardware.light@2.0 \
-    libbase \
-    libutils \
-    libcutils \
-    liblog \
-    libhidlbase \
-    libhidltransport \
-    libhwbinder \
-    libprotobuf-cpp-full \
-    libvts_common \
-    libvts_datatype \
-    libvts_measurement \
-    libvts_multidevice_proto
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/light/2.0/vts/functional/Android.bp b/light/2.0/vts/functional/Android.bp
index edb5ca9..889457f 100644
--- a/light/2.0/vts/functional/Android.bp
+++ b/light/2.0/vts/functional/Android.bp
@@ -20,6 +20,7 @@
     srcs: ["light_hidl_hal_test.cpp"],
     shared_libs: [
         "libbase",
+        "libhidlbase",
         "liblog",
         "libutils",
         "android.hardware.light@2.0",
diff --git a/memtrack/1.0/Android.bp b/memtrack/1.0/Android.bp
index b56ffeb..c80ebf8 100644
--- a/memtrack/1.0/Android.bp
+++ b/memtrack/1.0/Android.bp
@@ -54,3 +54,61 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.memtrack.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.memtrack@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/memtrack/1.0/ $(genDir)/android/hardware/memtrack/1.0/",
+    srcs: [
+        "types.hal",
+        "IMemtrack.hal",
+    ],
+    out: [
+        "android/hardware/memtrack/1.0/types.vts.cpp",
+        "android/hardware/memtrack/1.0/Memtrack.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.memtrack.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.memtrack@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/memtrack/1.0/ $(genDir)/android/hardware/memtrack/1.0/",
+    srcs: [
+        "types.hal",
+        "IMemtrack.hal",
+    ],
+    out: [
+        "android/hardware/memtrack/1.0/types.vts.h",
+        "android/hardware/memtrack/1.0/Memtrack.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.memtrack.vts.driver@1.0",
+    generated_sources: ["android.hardware.memtrack.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.memtrack.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.memtrack.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.memtrack@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/memtrack/1.0/vts/Android.mk b/memtrack/1.0/vts/Android.mk
index 8a5ceb1..4a5ca4f 100644
--- a/memtrack/1.0/vts/Android.mk
+++ b/memtrack/1.0/vts/Android.mk
@@ -16,36 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for memtrack v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_memtrack@1.0
-
-LOCAL_SRC_FILES := \
-  Memtrack.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.memtrack@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for memtrack.
 include $(CLEAR_VARS)
 
diff --git a/nfc/1.0/Android.bp b/nfc/1.0/Android.bp
index 518b8e3..930fb14 100644
--- a/nfc/1.0/Android.bp
+++ b/nfc/1.0/Android.bp
@@ -62,3 +62,65 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.nfc.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.nfc@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/nfc/1.0/ $(genDir)/android/hardware/nfc/1.0/",
+    srcs: [
+        "types.hal",
+        "INfc.hal",
+        "INfcClientCallback.hal",
+    ],
+    out: [
+        "android/hardware/nfc/1.0/types.vts.cpp",
+        "android/hardware/nfc/1.0/Nfc.vts.cpp",
+        "android/hardware/nfc/1.0/NfcClientCallback.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.nfc.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.nfc@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/nfc/1.0/ $(genDir)/android/hardware/nfc/1.0/",
+    srcs: [
+        "types.hal",
+        "INfc.hal",
+        "INfcClientCallback.hal",
+    ],
+    out: [
+        "android/hardware/nfc/1.0/types.vts.h",
+        "android/hardware/nfc/1.0/Nfc.vts.h",
+        "android/hardware/nfc/1.0/NfcClientCallback.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.nfc.vts.driver@1.0",
+    generated_sources: ["android.hardware.nfc.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.nfc.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.nfc.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.nfc@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/nfc/1.0/vts/Android.mk b/nfc/1.0/vts/Android.mk
index b008b63..e7dec14 100644
--- a/nfc/1.0/vts/Android.mk
+++ b/nfc/1.0/vts/Android.mk
@@ -5,7 +5,7 @@
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
-#       http://www.apache.org/licenses/LICENSE-2.0
+#      http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,37 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Nfc v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_nfc@1.0
-
-LOCAL_SRC_FILES := \
-  Nfc.vts \
-  NfcClientCallback.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.nfc@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for Nfc.
 include $(CLEAR_VARS)
 
diff --git a/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py b/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py
index ede7897..136704a 100644
--- a/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py
+++ b/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py
@@ -52,6 +52,7 @@
                                  target_version=1.0,
                                  target_package="android.hardware.nfc",
                                  target_component_name="INfc",
+                                 hw_binder_service_name="nfc_nci",
                                  bits=64)
 
     def tearDownClass(self):
diff --git a/power/1.0/Android.bp b/power/1.0/Android.bp
index 3503f0e..2eb9e34 100644
--- a/power/1.0/Android.bp
+++ b/power/1.0/Android.bp
@@ -54,3 +54,61 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.power.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.power@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/power/1.0/ $(genDir)/android/hardware/power/1.0/",
+    srcs: [
+        "types.hal",
+        "IPower.hal",
+    ],
+    out: [
+        "android/hardware/power/1.0/types.vts.cpp",
+        "android/hardware/power/1.0/Power.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.power.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.power@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/power/1.0/ $(genDir)/android/hardware/power/1.0/",
+    srcs: [
+        "types.hal",
+        "IPower.hal",
+    ],
+    out: [
+        "android/hardware/power/1.0/types.vts.h",
+        "android/hardware/power/1.0/Power.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.power.vts.driver@1.0",
+    generated_sources: ["android.hardware.power.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.power.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.power.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.power@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/power/1.0/vts/Android.mk b/power/1.0/vts/Android.mk
index 887b6bf..db7e98e 100644
--- a/power/1.0/vts/Android.mk
+++ b/power/1.0/vts/Android.mk
@@ -16,36 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Power v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_power@1.0
-
-LOCAL_SRC_FILES := \
-  Power.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.power@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for power.
 include $(CLEAR_VARS)
 
@@ -77,3 +47,5 @@
 LOCAL_PROTOC_OPTIMIZE_TYPE := full
 
 include $(BUILD_SHARED_LIBRARY)
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/power/1.0/vts/functional/Android.mk b/power/1.0/vts/functional/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/power/1.0/vts/functional/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/power/1.0/vts/functional/power_hidl_hal_test.cpp b/power/1.0/vts/functional/power_hidl_hal_test.cpp
index af6eb86..8833c04 100644
--- a/power/1.0/vts/functional/power_hidl_hal_test.cpp
+++ b/power/1.0/vts/functional/power_hidl_hal_test.cpp
@@ -17,6 +17,8 @@
 #define LOG_TAG "power_hidl_hal_test"
 #include <android-base/logging.h>
 
+#include <cutils/properties.h>
+
 #include <android/hardware/power/1.0/IPower.h>
 
 #include <gtest/gtest.h>
@@ -33,8 +35,18 @@
 class PowerHidlTest : public ::testing::Test {
  public:
   virtual void SetUp() override {
-    power = IPower::getService("power");
+    // TODO(b/33385836) Delete copied code
+    bool getStub = false;
+    char getSubProperty[PROPERTY_VALUE_MAX];
+    if (property_get("vts.hidl.get_stub", getSubProperty, "") > 0) {
+        if (!strcmp(getSubProperty, "true") || !strcmp(getSubProperty, "True") ||
+            !strcmp(getSubProperty, "1")) {
+            getStub = true;
+        }
+    }
+    power = IPower::getService("power", getStub);
     ASSERT_NE(power, nullptr);
+    ASSERT_EQ(!getStub, power->isRemote());
   }
 
   virtual void TearDown() override {}
diff --git a/power/1.0/vts/functional/vts/Android.mk b/power/1.0/vts/functional/vts/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/power/1.0/vts/functional/vts/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/power/1.0/vts/functional/vts/testcases/Android.mk b/power/1.0/vts/functional/vts/testcases/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/power/1.0/vts/functional/vts/testcases/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/power/1.0/vts/functional/vts/testcases/hal/Android.mk b/power/1.0/vts/functional/vts/testcases/hal/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/power/1.0/vts/functional/vts/testcases/hal/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/radio/1.0/types.hal b/radio/1.0/types.hal
index 9c4b453..5b853b4 100644
--- a/radio/1.0/types.hal
+++ b/radio/1.0/types.hal
@@ -51,6 +51,7 @@
 };
 
 enum RadioError : int32_t {
+    INVALID_RESPONSE = -1,                // Response from vendor had invalid data
     NONE = 0,                             // Success
     RADIO_NOT_AVAILABLE = 1,              // If radio did not start or is resetting
     GENERIC_FAILURE = 2,
diff --git a/sensors/1.0/default/Android.bp b/sensors/1.0/default/Android.bp
index 7fbe117..994febe 100644
--- a/sensors/1.0/default/Android.bp
+++ b/sensors/1.0/default/Android.bp
@@ -8,7 +8,6 @@
         "libhardware",
         "libhwbinder",
         "libbase",
-        "libcutils",
         "libutils",
         "libhidlbase",
         "libhidltransport",
@@ -16,6 +15,7 @@
     ],
     static_libs: [
         "android.hardware.sensors@1.0-convert",
+        "multihal",
     ],
     local_include_dirs: ["include/sensors"],
 }
@@ -30,7 +30,6 @@
         "libhardware",
         "libhwbinder",
         "libbase",
-        "libcutils",
         "libutils",
         "libhidlbase",
         "libhidltransport",
diff --git a/sensors/1.0/default/Android.mk b/sensors/1.0/default/Android.mk
index b2b2c60..f37c3cb 100644
--- a/sensors/1.0/default/Android.mk
+++ b/sensors/1.0/default/Android.mk
@@ -5,21 +5,21 @@
 LOCAL_MODULE := android.hardware.sensors@1.0-service
 LOCAL_INIT_RC := android.hardware.sensors@1.0-service.rc
 LOCAL_SRC_FILES := \
-	service.cpp \
+        service.cpp \
 
 LOCAL_SHARED_LIBRARIES := \
-	liblog \
-	libcutils \
-	libdl \
-	libbase \
-	libutils \
-	libhardware_legacy \
-	libhardware \
+        liblog \
+        libcutils \
+        libdl \
+        libbase \
+        libutils \
+        libhardware_legacy \
+        libhardware \
 
 LOCAL_SHARED_LIBRARIES += \
-	libhwbinder \
-	libhidlbase \
-	libhidltransport \
-	android.hardware.sensors@1.0 \
+        libhwbinder \
+        libhidlbase \
+        libhidltransport \
+        android.hardware.sensors@1.0 \
 
 include $(BUILD_EXECUTABLE)
diff --git a/sensors/1.0/default/Sensors.cpp b/sensors/1.0/default/Sensors.cpp
index ef052c3..c76369f 100644
--- a/sensors/1.0/default/Sensors.cpp
+++ b/sensors/1.0/default/Sensors.cpp
@@ -15,17 +15,29 @@
  */
 
 #include "Sensors.h"
-
 #include "convert.h"
+#include "multihal.h"
 
 #include <android-base/logging.h>
 
+#include <sys/stat.h>
+
 namespace android {
 namespace hardware {
 namespace sensors {
 namespace V1_0 {
 namespace implementation {
 
+/*
+ * If a multi-hal configuration file exists in the proper location,
+ * return true indicating we need to use multi-hal functionality.
+ */
+static bool UseMultiHal() {
+    const std::string& name = MULTI_HAL_CONFIG_FILE_PATH;
+    struct stat buffer;
+    return (stat (name.c_str(), &buffer) == 0);
+}
+
 static Result ResultFromStatus(status_t err) {
     switch (err) {
         case OK:
@@ -43,10 +55,14 @@
     : mInitCheck(NO_INIT),
       mSensorModule(nullptr),
       mSensorDevice(nullptr) {
-    status_t err = hw_get_module(
+    status_t err = OK;
+    if (UseMultiHal()) {
+        mSensorModule = ::get_multi_hal_module_info();
+    } else {
+        err = hw_get_module(
             SENSORS_HARDWARE_MODULE_ID,
             (hw_module_t const **)&mSensorModule);
-
+    }
     if (mSensorModule == NULL) {
         err = UNKNOWN_ERROR;
     }
diff --git a/tests/bar/1.0/Android.bp b/tests/bar/1.0/Android.bp
index 6ef8ac2..e4c79fa 100644
--- a/tests/bar/1.0/Android.bp
+++ b/tests/bar/1.0/Android.bp
@@ -6,10 +6,12 @@
     cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tests.bar@1.0",
     srcs: [
         "IBar.hal",
+        "IComplicated.hal",
         "IImportTypes.hal",
     ],
     out: [
         "android/hardware/tests/bar/1.0/BarAll.cpp",
+        "android/hardware/tests/bar/1.0/ComplicatedAll.cpp",
         "android/hardware/tests/bar/1.0/ImportTypesAll.cpp",
     ],
 }
@@ -20,6 +22,7 @@
     cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tests.bar@1.0",
     srcs: [
         "IBar.hal",
+        "IComplicated.hal",
         "IImportTypes.hal",
     ],
     out: [
@@ -28,6 +31,11 @@
         "android/hardware/tests/bar/1.0/BnBar.h",
         "android/hardware/tests/bar/1.0/BpBar.h",
         "android/hardware/tests/bar/1.0/BsBar.h",
+        "android/hardware/tests/bar/1.0/IComplicated.h",
+        "android/hardware/tests/bar/1.0/IHwComplicated.h",
+        "android/hardware/tests/bar/1.0/BnComplicated.h",
+        "android/hardware/tests/bar/1.0/BpComplicated.h",
+        "android/hardware/tests/bar/1.0/BsComplicated.h",
         "android/hardware/tests/bar/1.0/IImportTypes.h",
         "android/hardware/tests/bar/1.0/IHwImportTypes.h",
         "android/hardware/tests/bar/1.0/BnImportTypes.h",
diff --git a/tests/bar/1.0/IBar.hal b/tests/bar/1.0/IBar.hal
index 21c3473..5f94d07 100644
--- a/tests/bar/1.0/IBar.hal
+++ b/tests/bar/1.0/IBar.hal
@@ -17,9 +17,12 @@
 package android.hardware.tests.bar@1.0;
 
 import android.hardware.tests.foo@1.0::IFoo;
+import android.hardware.tests.foo@1.0::ISimple;
 import android.hardware.tests.foo@1.0::Abc;
 import android.hardware.tests.foo@1.0::Unrelated;
 
+import IComplicated;
+
 interface IBar extends android.hardware.tests.foo@1.0::IFoo {
 
     typedef android.hardware.tests.foo@1.0::IFoo FunkyAlias;
@@ -33,4 +36,6 @@
     expectNullHandle(handle h, Abc xyz) generates (bool hIsNull, bool xyzHasNull);
     takeAMask(BitField bf, bitfield<BitField> first, MyMask second, Mask third)
             generates (BitField bf, uint8_t first, uint8_t second, uint8_t third);
+
+    haveAInterface(ISimple i) generates (ISimple i);
 };
diff --git a/tests/bar/1.0/IComplicated.hal b/tests/bar/1.0/IComplicated.hal
new file mode 100644
index 0000000..deaef8d
--- /dev/null
+++ b/tests/bar/1.0/IComplicated.hal
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tests.bar@1.0;
+
+import android.hardware.tests.foo@1.0::ISimple;
+
+interface IComplicated extends ISimple {
+};
diff --git a/tests/bar/1.0/default/Bar.cpp b/tests/bar/1.0/default/Bar.cpp
index a9b6c25..4152bb9 100644
--- a/tests/bar/1.0/default/Bar.cpp
+++ b/tests/bar/1.0/default/Bar.cpp
@@ -122,36 +122,10 @@
     return Void();
 }
 
-// TODO: remove after b/33173166 is fixed.
-struct Simple : public ISimple {
-    Simple(int32_t cookie)
-        : mCookie(cookie) {
-    }
-
-    Return<int32_t> getCookie() override {
-        return mCookie;
-    }
-
-private:
-    int32_t mCookie;
-};
-
-// TODO: use _hidl_cb(in) after b/33173166 is fixed.
 Return<void> Bar::haveAVectorOfGenericInterfaces(
         const hidl_vec<sp<android::hidl::base::V1_0::IBase> > &in,
         haveAVectorOfGenericInterfaces_cb _hidl_cb) {
-    // _hidl_cb(in);
-    hidl_vec<sp<android::hidl::base::V1_0::IBase> > out;
-    out.resize(in.size());
-    for (size_t i = 0; i < in.size(); ++i) {
-        sp<ISimple> s = ISimple::castFrom(in[i]);
-        if (s.get() == nullptr) {
-            out[i] = new Simple(-1);
-        } else {
-            out[i] = new Simple(s->getCookie());
-        }
-    }
-    _hidl_cb(out);
+    _hidl_cb(in);
 
     return Void();
 }
@@ -191,6 +165,13 @@
     return Void();
 }
 
+Return<void> Bar::haveAInterface(const sp<ISimple> &in,
+            haveAInterface_cb _hidl_cb) {
+    _hidl_cb(in);
+    return Void();
+}
+
+
 IBar* HIDL_FETCH_IBar(const char* /* name */) {
     return new Bar();
 }
diff --git a/tests/bar/1.0/default/Bar.h b/tests/bar/1.0/default/Bar.h
index 71737fe..70bffe7 100644
--- a/tests/bar/1.0/default/Bar.h
+++ b/tests/bar/1.0/default/Bar.h
@@ -71,6 +71,8 @@
 
     Return<void> takeAMask(BitField bf, uint8_t first, const MyMask& second, uint8_t third,
             takeAMask_cb _hidl_cb) override;
+    Return<void> haveAInterface(const sp<ISimple> &in,
+            haveAInterface_cb _hidl_cb) override;
 
 private:
     sp<IFoo> mFoo;
diff --git a/tests/foo/1.0/ISimple.hal b/tests/foo/1.0/ISimple.hal
index 92e9d95..0d45835 100644
--- a/tests/foo/1.0/ISimple.hal
+++ b/tests/foo/1.0/ISimple.hal
@@ -18,4 +18,8 @@
 
 interface ISimple {
     getCookie() generates (int32_t cookie);
+    customVecInt() generates (vec<int32_t> chain);
+    customVecStr() generates (vec<string> chain);
+    mystr() generates (string str);
+    myhandle() generates (handle str);
 };
diff --git a/thermal/1.0/Android.bp b/thermal/1.0/Android.bp
index b887f16..c73ab42 100644
--- a/thermal/1.0/Android.bp
+++ b/thermal/1.0/Android.bp
@@ -54,3 +54,61 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.thermal.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.thermal@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/thermal/1.0/ $(genDir)/android/hardware/thermal/1.0/",
+    srcs: [
+        "types.hal",
+        "IThermal.hal",
+    ],
+    out: [
+        "android/hardware/thermal/1.0/types.vts.cpp",
+        "android/hardware/thermal/1.0/Thermal.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.thermal.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.thermal@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/thermal/1.0/ $(genDir)/android/hardware/thermal/1.0/",
+    srcs: [
+        "types.hal",
+        "IThermal.hal",
+    ],
+    out: [
+        "android/hardware/thermal/1.0/types.vts.h",
+        "android/hardware/thermal/1.0/Thermal.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.thermal.vts.driver@1.0",
+    generated_sources: ["android.hardware.thermal.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.thermal.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.thermal.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.thermal@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/tv/cec/1.0/Android.bp b/tv/cec/1.0/Android.bp
index 53b1ce8..b6dc3b1 100644
--- a/tv/cec/1.0/Android.bp
+++ b/tv/cec/1.0/Android.bp
@@ -62,3 +62,65 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.tv.cec.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tv.cec@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/tv/cec/1.0/ $(genDir)/android/hardware/tv/cec/1.0/",
+    srcs: [
+        "types.hal",
+        "IHdmiCec.hal",
+        "IHdmiCecCallback.hal",
+    ],
+    out: [
+        "android/hardware/tv/cec/1.0/types.vts.cpp",
+        "android/hardware/tv/cec/1.0/HdmiCec.vts.cpp",
+        "android/hardware/tv/cec/1.0/HdmiCecCallback.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.tv.cec.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tv.cec@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/tv/cec/1.0/ $(genDir)/android/hardware/tv/cec/1.0/",
+    srcs: [
+        "types.hal",
+        "IHdmiCec.hal",
+        "IHdmiCecCallback.hal",
+    ],
+    out: [
+        "android/hardware/tv/cec/1.0/types.vts.h",
+        "android/hardware/tv/cec/1.0/HdmiCec.vts.h",
+        "android/hardware/tv/cec/1.0/HdmiCecCallback.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.tv.cec.vts.driver@1.0",
+    generated_sources: ["android.hardware.tv.cec.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.tv.cec.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.tv.cec.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.tv.cec@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/tv/cec/1.0/vts/Android.mk b/tv/cec/1.0/vts/Android.mk
index 2666ca6..a7eeb33 100644
--- a/tv/cec/1.0/vts/Android.mk
+++ b/tv/cec/1.0/vts/Android.mk
@@ -16,42 +16,10 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for TvCec v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_tv_hdmi_cec@1.0
-
-LOCAL_SRC_FILES := \
-  HdmiCec.vts \
-  HdmiCecCallback.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.tv.cec@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
-
 # build VTS profiler for HdmiCec
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := libvts_profiler_hidl_tv_hdmi_cec@1.0
+LOCAL_MODULE := libvts_profiler_hidl_tv_cec@1.0
 
 LOCAL_SRC_FILES := \
   HdmiCec.vts \
@@ -86,7 +54,7 @@
 # build VTS profiler for HdmiCecCallback
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := libvts_profiler_hidl_tv_hdmi_cec_callback_@1.0
+LOCAL_MODULE := libvts_profiler_hidl_tv_cec_callback_@1.0
 
 LOCAL_SRC_FILES := \
   HdmiCecCallback.vts \
@@ -115,4 +83,6 @@
 
 LOCAL_MULTILIB := both
 
-include $(BUILD_SHARED_LIBRARY)
\ No newline at end of file
+include $(BUILD_SHARED_LIBRARY)
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/tv/cec/1.0/vts/functional/Android.mk b/tv/cec/1.0/vts/functional/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/cec/1.0/vts/functional/vts/Android.mk b/tv/cec/1.0/vts/functional/vts/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/Android.mk b/tv/cec/1.0/vts/functional/vts/testcases/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/Android.mk b/tv/cec/1.0/vts/functional/vts/testcases/hal/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/Android.mk b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/__init__.py b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/__init__.py
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/Android.mk b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/__init__.py b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/__init__.py
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/Android.mk b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/Android.mk
new file mode 100644
index 0000000..ece38d7
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/Android.mk
@@ -0,0 +1,25 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := TvCecHidlTest
+VTS_CONFIG_SRC_DIR := testcases/hal/tv_cec/hidl/host
+include test/vts/tools/build/Android.host_config.mk
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/AndroidTest.xml b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/AndroidTest.xml
new file mode 100644
index 0000000..79584d5
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/AndroidTest.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2016 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS Tv Input HIDL HAL's host-side test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+        <option name="push" value="spec/hardware/interfaces/tv/cec/1.0/vts/HdmiCec.vts->/data/local/tmp/spec/HdmiCec.vts" />
+        <option name="push" value="spec/hardware/interfaces/tv/cec/1.0/vts/HdmiCecCallback.vts->/data/local/tmp/spec/HdmiCecCallback.vts" />
+        <option name="push" value="spec/hardware/interfaces/tv/cec/1.0/vts/types.vts->/data/local/tmp/spec/types.vts" />
+        <option name="cleanup" value="true" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer">
+    </target_preparer>
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="TvCecHidlTest" />
+        <option name="test-case-path" value="vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest" />
+    </test>
+</configuration>
\ No newline at end of file
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
new file mode 100644
index 0000000..ba062d9
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import logging
+
+from vts.runners.host import asserts
+from vts.runners.host import base_test_with_webdb
+from vts.runners.host import const
+from vts.runners.host import test_runner
+from vts.utils.python.controllers import android_device
+
+
+class TvCecHidlTest(base_test_with_webdb.BaseTestWithWebDbClass):
+    """Host testcase class for the TV HDMI_CEC HIDL HAL."""
+
+    def setUpClass(self):
+        """Creates a mirror and init tv hdmi cec hal service."""
+        self.dut = self.registerController(android_device)[0]
+
+        self.dut.shell.InvokeTerminal("one")
+        self.dut.shell.one.Execute("setenforce 0")  # SELinux permissive mode
+
+        self.dut.hal.InitHidlHal(target_type="tv_cec",
+                                 target_basepaths=["/system/lib64"],
+                                 target_version=1.0,
+                                 target_package="android.hardware.tv.cec",
+                                 target_component_name="IHdmiCec",
+                                 bits=64)
+
+    def testGetCecVersion1(self):
+        """A simple test case which queries the cec version."""
+        logging.info('DIR HAL %s', dir(self.dut.hal))
+        version = self.dut.hal.tv_cec.getCecVersion()
+        logging.info('Cec version: %s', version)
+
+
+if __name__ == "__main__":
+    test_runner.main()
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/__init__.py b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/__init__.py
diff --git a/vehicle/2.0/Android.bp b/vehicle/2.0/Android.bp
index 6c96d3f..571ef2b 100644
--- a/vehicle/2.0/Android.bp
+++ b/vehicle/2.0/Android.bp
@@ -62,3 +62,65 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.vehicle.vts.driver@2.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.vehicle@2.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/vehicle/2.0/ $(genDir)/android/hardware/vehicle/2.0/",
+    srcs: [
+        "types.hal",
+        "IVehicle.hal",
+        "IVehicleCallback.hal",
+    ],
+    out: [
+        "android/hardware/vehicle/2.0/types.vts.cpp",
+        "android/hardware/vehicle/2.0/Vehicle.vts.cpp",
+        "android/hardware/vehicle/2.0/VehicleCallback.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.vehicle.vts.driver@2.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.vehicle@2.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/vehicle/2.0/ $(genDir)/android/hardware/vehicle/2.0/",
+    srcs: [
+        "types.hal",
+        "IVehicle.hal",
+        "IVehicleCallback.hal",
+    ],
+    out: [
+        "android/hardware/vehicle/2.0/types.vts.h",
+        "android/hardware/vehicle/2.0/Vehicle.vts.h",
+        "android/hardware/vehicle/2.0/VehicleCallback.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.vehicle.vts.driver@2.0",
+    generated_sources: ["android.hardware.vehicle.vts.driver@2.0_genc++"],
+    generated_headers: ["android.hardware.vehicle.vts.driver@2.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.vehicle.vts.driver@2.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.vehicle@2.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/vehicle/2.0/default/android.hardware.vehicle@2.0-service.rc b/vehicle/2.0/default/android.hardware.vehicle@2.0-service.rc
index 7c96da6..622cb1e 100644
--- a/vehicle/2.0/default/android.hardware.vehicle@2.0-service.rc
+++ b/vehicle/2.0/default/android.hardware.vehicle@2.0-service.rc
@@ -1,4 +1,4 @@
 service vehicle-hal-2.0 /system/bin/hw/android.hardware.vehicle@2.0-service
     class hal
-    user system
+    user vehicle_network
     group system
diff --git a/vehicle/2.0/vts/Android.mk b/vehicle/2.0/vts/Android.mk
index 8370067..b7f185d 100644
--- a/vehicle/2.0/vts/Android.mk
+++ b/vehicle/2.0/vts/Android.mk
@@ -16,38 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Vehicle v2.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_vehicle@2.0
-
-LOCAL_SRC_FILES := \
-  Vehicle.vts \
-  VehicleCallback.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.vehicle@2.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
-
 # build profiler for Vehicle.
 include $(CLEAR_VARS)
 
diff --git a/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py b/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
index bc37e59..8da36d1 100644
--- a/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
+++ b/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
@@ -33,6 +33,7 @@
         self.dut = self.registerController(android_device)[0]
 
         self.dut.shell.InvokeTerminal("one")
+        self.dut.shell.one.Execute("setenforce 0")  # SELinux permissive mode
 
         if self.enable_profiling:
             profiling_utils.EnableVTSProfiling(self.dut.shell.one)
@@ -55,25 +56,13 @@
             self.ProcessAndUploadTraceData(self.dut, profiling_trace_path)
             profiling_utils.DisableVTSProfiling(self.dut.shell.one)
 
-    def testEcho1(self):
-        """A simple testcase which sends a command."""
-        self.dut.shell.InvokeTerminal("my_shell1")  # creates a remote shell instance.
-        results = self.dut.shell.my_shell1.Execute("echo hello_world")  # runs a shell command.
-        logging.info(str(results[const.STDOUT]))  # prints the stdout
-        asserts.assertEqual(results[const.STDOUT][0].strip(), "hello_world")  # checks the stdout
-        asserts.assertEqual(results[const.EXIT_CODE][0], 0)  # checks the exit code
+    def testListProperties(self):
+        logging.info("vehicle_types")
+        vehicle_types = self.dut.hal.vehicle.GetHidlTypeInterface("types")
+        logging.info("vehicle_types: %s", vehicle_types)
 
-    def testEcho2(self):
-        """A simple testcase which sends two commands."""
-        self.dut.shell.InvokeTerminal("my_shell2")
-        my_shell = getattr(self.dut.shell, "my_shell2")
-        results = my_shell.Execute(["echo hello", "echo world"])
-        logging.info(str(results[const.STDOUT]))
-        asserts.assertEqual(len(results[const.STDOUT]), 2)  # check the number of processed commands
-        asserts.assertEqual(results[const.STDOUT][0].strip(), "hello")
-        asserts.assertEqual(results[const.STDOUT][1].strip(), "world")
-        asserts.assertEqual(results[const.EXIT_CODE][0], 0)
-        asserts.assertEqual(results[const.EXIT_CODE][1], 0)
+        allConfigs = self.dut.hal.vehicle.getAllPropConfigs()
+        logging.info("all supported properties: %s", allConfigs)
 
 if __name__ == "__main__":
     test_runner.main()
diff --git a/vibrator/1.0/Android.bp b/vibrator/1.0/Android.bp
index 75a3bfa..ec97cfb 100644
--- a/vibrator/1.0/Android.bp
+++ b/vibrator/1.0/Android.bp
@@ -54,3 +54,61 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.vibrator.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.vibrator@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/vibrator/1.0/ $(genDir)/android/hardware/vibrator/1.0/",
+    srcs: [
+        "types.hal",
+        "IVibrator.hal",
+    ],
+    out: [
+        "android/hardware/vibrator/1.0/types.vts.cpp",
+        "android/hardware/vibrator/1.0/Vibrator.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.vibrator.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.vibrator@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/vibrator/1.0/ $(genDir)/android/hardware/vibrator/1.0/",
+    srcs: [
+        "types.hal",
+        "IVibrator.hal",
+    ],
+    out: [
+        "android/hardware/vibrator/1.0/types.vts.h",
+        "android/hardware/vibrator/1.0/Vibrator.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.vibrator.vts.driver@1.0",
+    generated_sources: ["android.hardware.vibrator.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.vibrator.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.vibrator.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.vibrator@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/vibrator/1.0/vts/Android.mk b/vibrator/1.0/vts/Android.mk
index 080eb88..084dcf7 100644
--- a/vibrator/1.0/vts/Android.mk
+++ b/vibrator/1.0/vts/Android.mk
@@ -16,36 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Vibrator v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_vibrator@1.0
-
-LOCAL_SRC_FILES := \
-  Vibrator.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.vibrator@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for vibrator.
 include $(CLEAR_VARS)
 
diff --git a/vibrator/1.0/vts/functional/vts/testcases/hal/vibrator/hidl/host/VibratorHidlTest.py b/vibrator/1.0/vts/functional/vts/testcases/hal/vibrator/hidl/host/VibratorHidlTest.py
index e8fae30..b36f47a 100644
--- a/vibrator/1.0/vts/functional/vts/testcases/hal/vibrator/hidl/host/VibratorHidlTest.py
+++ b/vibrator/1.0/vts/functional/vts/testcases/hal/vibrator/hidl/host/VibratorHidlTest.py
@@ -48,6 +48,7 @@
             target_version=1.0,
             target_package="android.hardware.vibrator",
             target_component_name="IVibrator",
+            hw_binder_service_name="vibrator",
             bits=64)
 
     def tearDownClass(self):
diff --git a/vr/1.0/Android.bp b/vr/1.0/Android.bp
index 57c9257..240b7ad 100644
--- a/vr/1.0/Android.bp
+++ b/vr/1.0/Android.bp
@@ -50,3 +50,57 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.vr.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.vr@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/vr/1.0/ $(genDir)/android/hardware/vr/1.0/",
+    srcs: [
+        "IVr.hal",
+    ],
+    out: [
+        "android/hardware/vr/1.0/Vr.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.vr.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.vr@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/vr/1.0/ $(genDir)/android/hardware/vr/1.0/",
+    srcs: [
+        "IVr.hal",
+    ],
+    out: [
+        "android/hardware/vr/1.0/Vr.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.vr.vts.driver@1.0",
+    generated_sources: ["android.hardware.vr.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.vr.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.vr.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.vr@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/vr/1.0/vts/Android.mk b/vr/1.0/vts/Android.mk
index 12f0175..ac1cad5 100644
--- a/vr/1.0/vts/Android.mk
+++ b/vr/1.0/vts/Android.mk
@@ -16,35 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Vr v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_vr@1.0
-
-LOCAL_SRC_FILES := \
-  Vr.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.vr@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for Vr.
 include $(CLEAR_VARS)
 
@@ -76,3 +47,5 @@
 
 include $(BUILD_SHARED_LIBRARY)
 
+# include hidl test makefiles
+include $(LOCAL_PATH)/functional/vts/testcases/hal/vr/hidl/Android.mk
diff --git a/vr/1.0/vts/functional/Android.bp b/vr/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..2929fe7
--- /dev/null
+++ b/vr/1.0/vts/functional/Android.bp
@@ -0,0 +1,32 @@
+//
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "vr_hidl_hal_test",
+    gtest: true,
+    srcs: ["vr_hidl_hal_test.cpp"],
+    shared_libs: [
+        "liblog",
+        "libhidlbase",
+        "libutils",
+        "android.hardware.vr@1.0",
+    ],
+    static_libs: ["libgtest"],
+    cflags: [
+        "-O0",
+        "-g",
+    ],
+}
diff --git a/vr/1.0/vts/functional/vr_hidl_hal_test.cpp b/vr/1.0/vts/functional/vr_hidl_hal_test.cpp
new file mode 100644
index 0000000..85ecbdc
--- /dev/null
+++ b/vr/1.0/vts/functional/vr_hidl_hal_test.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "vr_hidl_hal_test"
+#include <android-base/logging.h>
+#include <android/hardware/vr/1.0/IVr.h>
+#include <android/log.h>
+#include <gtest/gtest.h>
+#include <hardware/vr.h>
+
+using ::android::hardware::vr::V1_0::IVr;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::sp;
+
+#define VR_SERVICE_NAME "vr"
+
+// The main test class for VR HIDL HAL.
+class VrHidlTest : public ::testing::Test {
+ public:
+  void SetUp() override {
+    // currently test passthrough mode only
+    vr = IVr::getService(VR_SERVICE_NAME, true);
+    ASSERT_NE(vr, nullptr);
+    ASSERT_TRUE(!vr->isRemote());
+  }
+
+  void TearDown() override {}
+
+  sp<IVr> vr;
+};
+
+
+// A class for test environment setup (kept since this file is a template).
+class VrHidlEnvironment : public ::testing::Environment {
+ public:
+  void SetUp() {}
+  void TearDown() {}
+
+ private:
+};
+
+// Sanity check that Vr::init does not crash.
+TEST_F(VrHidlTest, Init) {
+  EXPECT_TRUE(vr->init().isOk());
+}
+
+// Sanity check Vr::setVrMode is able to enable and disable VR mode.
+TEST_F(VrHidlTest, SetVrMode) {
+  EXPECT_TRUE(vr->init().isOk());
+  EXPECT_TRUE(vr->setVrMode(true).isOk());
+  EXPECT_TRUE(vr->setVrMode(false).isOk());
+}
+
+// Sanity check that Vr::init and Vr::setVrMode can be used in any order.
+TEST_F(VrHidlTest, ReInit) {
+  EXPECT_TRUE(vr->init().isOk());
+  EXPECT_TRUE(vr->setVrMode(true).isOk());
+  EXPECT_TRUE(vr->init().isOk());
+  EXPECT_TRUE(vr->setVrMode(false).isOk());
+  EXPECT_TRUE(vr->init().isOk());
+  EXPECT_TRUE(vr->setVrMode(false).isOk());
+}
+
+int main(int argc, char **argv) {
+  ::testing::AddGlobalTestEnvironment(new VrHidlEnvironment);
+  ::testing::InitGoogleTest(&argc, argv);
+  int status = RUN_ALL_TESTS();
+  ALOGI("Test result = %d", status);
+  return status;
+}
diff --git a/vr/1.0/vts/functional/vts/Android.mk b/vr/1.0/vts/functional/vts/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/vr/1.0/vts/functional/vts/testcases/Android.mk b/vr/1.0/vts/functional/vts/testcases/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/Android.mk b/vr/1.0/vts/functional/vts/testcases/hal/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/Android.mk b/vr/1.0/vts/functional/vts/testcases/hal/vr/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/__init__.py b/vr/1.0/vts/functional/vts/testcases/hal/vr/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/__init__.py
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/Android.mk b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/__init__.py b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/__init__.py
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target/Android.mk b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target/Android.mk
new file mode 100644
index 0000000..691d1a4
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target/Android.mk
@@ -0,0 +1,25 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := VrHidlTargetTest
+VTS_CONFIG_SRC_DIR := testcases/hal/vr/hidl/target
+include test/vts/tools/build/Android.host_config.mk
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target/AndroidTest.xml b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target/AndroidTest.xml
new file mode 100644
index 0000000..a29c23b
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target/AndroidTest.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2016 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS VR HIDL HAL's target-side test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer" />
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="VrHidlTargetTest" />
+        <option name="binary-test-sources" value="
+            _32bit::DATA/nativetest/vr_hidl_hal_test/vr_hidl_hal_test,
+            _64bit::DATA/nativetest64/vr_hidl_hal_test/vr_hidl_hal_test,
+            "/>
+        <option name="binary-test-type" value="gtest" />
+        <option name="test-timeout" value="1m" />
+    </test>
+</configuration>
+
diff --git a/vr/Android.bp b/vr/Android.bp
index ba90f2c..ed19a37 100644
--- a/vr/Android.bp
+++ b/vr/Android.bp
@@ -2,4 +2,5 @@
 subdirs = [
     "1.0",
     "1.0/default",
+    "1.0/vts/functional",
 ]
diff --git a/wifi/1.0/Android.mk b/wifi/1.0/Android.mk
index ee7f980..bb8d144 100644
--- a/wifi/1.0/Android.mk
+++ b/wifi/1.0/Android.mk
@@ -1556,6 +1556,63 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (StaRoamingCapabilities)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/StaRoamingCapabilities.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.StaRoamingCapabilities
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (StaRoamingConfig)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/StaRoamingConfig.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.StaRoamingConfig
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (StaRoamingState)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/StaRoamingState.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.StaRoamingState
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (StaScanData)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/StaScanData.java
@@ -1822,177 +1879,6 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (WifiDebugRingEntryConnectivityEvent)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryConnectivityEvent.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryConnectivityEvent
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryEventTlv)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryEventTlv.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryEventTlv
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryEventTlvType)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryEventTlvType.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryEventTlvType
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryEventType)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryEventType.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryEventType
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryFlags)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryFlags.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryFlags
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryHeader)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryHeader.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryHeader
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryPowerEvent)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryPowerEvent.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryPowerEvent
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryVendorData)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryVendorData.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryVendorData
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryWakelockEvent)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryWakelockEvent.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryWakelockEvent
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
 # Build types.hal (WifiDebugRxPacketFate)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRxPacketFate.java
@@ -4041,6 +3927,63 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (StaRoamingCapabilities)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/StaRoamingCapabilities.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.StaRoamingCapabilities
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (StaRoamingConfig)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/StaRoamingConfig.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.StaRoamingConfig
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (StaRoamingState)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/StaRoamingState.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.StaRoamingState
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (StaScanData)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/StaScanData.java
@@ -4307,177 +4250,6 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (WifiDebugRingEntryConnectivityEvent)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryConnectivityEvent.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryConnectivityEvent
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryEventTlv)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryEventTlv.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryEventTlv
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryEventTlvType)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryEventTlvType.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryEventTlvType
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryEventType)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryEventType.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryEventType
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryFlags)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryFlags.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryFlags
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryHeader)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryHeader.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryHeader
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryPowerEvent)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryPowerEvent.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryPowerEvent
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryVendorData)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryVendorData.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryVendorData
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
-# Build types.hal (WifiDebugRingEntryWakelockEvent)
-#
-GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRingEntryWakelockEvent.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.wifi@1.0::types.WifiDebugRingEntryWakelockEvent
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
 # Build types.hal (WifiDebugRxPacketFate)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/WifiDebugRxPacketFate.java
diff --git a/wifi/1.0/IWifiChip.hal b/wifi/1.0/IWifiChip.hal
index 051a088..d790404 100644
--- a/wifi/1.0/IWifiChip.hal
+++ b/wifi/1.0/IWifiChip.hal
@@ -137,32 +137,36 @@
     /**
      * Memory dump of Firmware.
      */
-    DEBUG_MEMORY_FIRMWARE_DUMP_SUPPORTED = 1 << 0,
+    DEBUG_MEMORY_FIRMWARE_DUMP = 1 << 0,
     /**
      * Memory dump of Driver.
      */
-    DEBUG_MEMORY_DRIVER_DUMP_SUPPORTED = 1 << 1,
+    DEBUG_MEMORY_DRIVER_DUMP = 1 << 1,
     /**
      * Connectivity events reported via debug ring buffer.
      */
-    DEBUG_RING_BUFFER_CONNECT_EVENT_SUPPORTED = 1 << 2,
+    DEBUG_RING_BUFFER_CONNECT_EVENT = 1 << 2,
     /**
      * Power events reported via debug ring buffer.
      */
-    DEBUG_RING_BUFFER_POWER_EVENT_SUPPORTED = 1 << 3,
+    DEBUG_RING_BUFFER_POWER_EVENT = 1 << 3,
     /**
      * Wakelock events reported via debug ring buffer.
      */
-    DEBUG_RING_BUFFER_WAKELOCK_EVENT_SUPPORTED = 1 << 4,
+    DEBUG_RING_BUFFER_WAKELOCK_EVENT = 1 << 4,
     /**
      * Vendor data reported via debug ring buffer.
      * This mostly contains firmware event logs.
      */
-    DEBUG_RING_BUFFER_VENDOR_DATA_SUPPORTED = 1 << 5,
+    DEBUG_RING_BUFFER_VENDOR_DATA = 1 << 5,
     /**
      * Host wake reasons stats collection.
      */
     DEBUG_HOST_WAKE_REASON_STATS = 1 << 6,
+    /**
+     * Error alerts.
+     */
+    DEBUG_ERROR_ALERTS = 1 << 7
   };
 
   /**
@@ -288,7 +292,7 @@
    * Create an AP iface on the chip.
    *
    * Depending on the mode the chip is configured in, the interface creation
-   * may fail (code: |ERROR_NOT_SUPPORTED|) if we've already reached the maximum
+   * may fail (code: |ERROR_NOT_AVAILABLE|) if we've already reached the maximum
    * allowed (specified in |ChipIfaceCombination|) number of ifaces of the AP
    * type.
    *
@@ -348,7 +352,7 @@
    * Create a NAN iface on the chip.
    *
    * Depending on the mode the chip is configured in, the interface creation
-   * may fail (code: |ERROR_NOT_SUPPORTED|) if we've already reached the maximum
+   * may fail (code: |ERROR_NOT_AVAILABLE|) if we've already reached the maximum
    * allowed (specified in |ChipIfaceCombination|) number of ifaces of the NAN
    * type.
    *
@@ -408,7 +412,7 @@
    * Create a P2P iface on the chip.
    *
    * Depending on the mode the chip is configured in, the interface creation
-   * may fail (code: |ERROR_NOT_SUPPORTED|) if we've already reached the maximum
+   * may fail (code: |ERROR_NOT_AVAILABLE|) if we've already reached the maximum
    * allowed (specified in |ChipIfaceCombination|) number of ifaces of the P2P
    * type.
    *
@@ -468,7 +472,7 @@
    * Create an STA iface on the chip.
    *
    * Depending on the mode the chip is configured in, the interface creation
-   * may fail (code: |ERROR_NOT_SUPPORTED|) if we've already reached the maximum
+   * may fail (code: |ERROR_NOT_AVAILABLE|) if we've already reached the maximum
    * allowed (specified in |ChipIfaceCombination|) number of ifaces of the STA
    * type.
    *
@@ -554,7 +558,7 @@
    *   ring. The vebose level for each ring buffer can be specified in this API.
    * - During wifi operations, driver must periodically report per ring data to
    *   framework by invoking the
-   *   |IWifiChipEventCallback.onDebugRingBuffer<Type>EntriesAvailable| callback.
+   *   |IWifiChipEventCallback.onDebugRingBufferDataAvailable| callback.
    * - When capturing a bug report, framework must indicate to driver that all
    *   the data has to be uploaded urgently by calling
    *   |forceDumpToDebugRingBuffer|.
@@ -640,4 +644,21 @@
    */
   getDebugHostWakeReasonStats()
       generates (WifiStatus status, WifiDebugHostWakeReasonStats stats);
+
+  /**
+   * API to enable/disable alert notifications from the chip.
+   * These alerts must be used to notify framework of any fatal error events
+   * that the chip encounters via |IWifiChipEventCallback.onDebugErrorAlert| method.
+   * Must fail if |ChipCapabilityMask.DEBUG_ERROR_ALERTS| is not set.
+   *
+   * @param enable true to enable, false to disable.
+   * @return status WifiStatus of the operation.
+   *         Possible status codes:
+   *         |WifiStatusCode.SUCCESS|,
+   *         |WifiStatusCode.ERROR_WIFI_CHIP_INVALID|,
+   *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+   *         |WifiStatusCode.NOT_AVAILABLE|,
+   *         |WifiStatusCode.UNKNOWN|
+   */
+  enableDebugErrorAlerts(bool enable) generates (WifiStatus status);
 };
diff --git a/wifi/1.0/IWifiChipEventCallback.hal b/wifi/1.0/IWifiChipEventCallback.hal
index 292b10f..0d9e329 100644
--- a/wifi/1.0/IWifiChipEventCallback.hal
+++ b/wifi/1.0/IWifiChipEventCallback.hal
@@ -20,7 +20,7 @@
   /**
    * Callback indicating that the chip has been reconfigured successfully. At
    * this point the interfaces available in the mode must be able to be
-   * configured. When this is called any previous interface indexes will be
+   * configured. When this is called any previous iface objects must be
    * considered invalid.
    *
    * @param modeId The mode that the chip switched to, corresponding to the id
@@ -29,6 +29,32 @@
   oneway onChipReconfigured(ChipModeId modeId);
 
   /**
+   * Callback indicating that a chip reconfiguration failed. This is a fatal
+   * error and any iface objects available previously must be considered
+   * invalid. The client can attempt to recover by trying to reconfigure the
+   * chip again using |IWifiChip.configureChip|.
+   *
+   * @param status Failure reason code.
+   */
+  oneway onChipReconfigureFailure(WifiStatus status);
+
+  /**
+   * Callback indicating that a new iface has been added to the chip.
+   *
+   * @param type Type of iface added.
+   * @param name Name of iface added.
+   */
+  oneway onIfaceAdded(IfaceType type, string name);
+
+  /**
+   * Callback indicating that an existing iface has been removed from the chip.
+   *
+   * @param type Type of iface removed.
+   * @param name Name of iface removed.
+   */
+  oneway onIfaceRemoved(IfaceType type, string name);
+
+  /**
    * Callbacks for reporting debug ring buffer data.
    *
    * The ring buffer data collection is event based:
@@ -48,26 +74,19 @@
    * @return status Status of the corresponding ring buffer. This should
    *         contain the name of the ring buffer on which the data is
    *         available.
-   * @return entries Vector of debug ring buffer data entries. These
-   *         should be parsed based on the type of entry.
+   * @return data Raw bytes of data sent by the driver. Must be dumped
+   *         out to a bugreport and post processed.
    */
-  /** Connectivity event data callback */
-  oneway onDebugRingBufferConnectivityEventEntriesAvailable(
-      WifiDebugRingBufferStatus status,
-      vec<WifiDebugRingEntryConnectivityEvent> entries);
+  oneway onDebugRingBufferDataAvailable(
+      WifiDebugRingBufferStatus status, vec<uint8_t> data);
 
-  /** Power event data callback */
-  oneway onDebugRingBufferPowerEventEntriesAvailable(
-      WifiDebugRingBufferStatus status,
-      vec<WifiDebugRingEntryPowerEvent> entries);
-
-  /** Wakelock event data callback */
-  oneway onDebugRingBufferWakelockEventEntriesAvailable(
-      WifiDebugRingBufferStatus status,
-      vec<WifiDebugRingEntryWakelockEvent> entries);
-
-  /** Vendor data event data callback */
-  oneway onDebugRingBufferVendorDataEntriesAvailable(
-      WifiDebugRingBufferStatus status,
-      vec<WifiDebugRingEntryVendorData> entries);
+  /**
+   * Callback indicating that the chip has encountered a fatal error.
+   * Client must not attempt to parse either the errorCode or debugData.
+   * Must only be captured in a bugreport.
+   *
+   * @param errorCode Vendor defined error code.
+   * @param debugData Vendor defined data used for debugging.
+   */
+  oneway onDebugErrorAlert(int32_t errorCode, vec<uint8_t> debugData);
 };
diff --git a/wifi/1.0/IWifiStaIface.hal b/wifi/1.0/IWifiStaIface.hal
index 7b514a7..98af043 100644
--- a/wifi/1.0/IWifiStaIface.hal
+++ b/wifi/1.0/IWifiStaIface.hal
@@ -49,9 +49,41 @@
      */
     RSSI_MONITOR = 1 << 3,
     /**
-     * Tracks connection packets' fate.
+     * If set indicates that the roaming API's are supported.
      */
-    DEBUG_PACKET_FATE_SUPPORTED = 1 << 4
+    CONTROL_ROAMING = 1 << 4,
+    /**
+     * If set indicates support for Probe IE white listing.
+     */
+    PROBE_IE_WHITELIST =  1 << 5,
+    /**
+     * If set indicates support for MAC & Probe Sequence Number randomization.
+     */
+    SCAN_RAND = 1 << 6,
+    /**
+     * Support for 5 GHz Band.
+     */
+    STA_5G = 1 << 7,
+    /**
+     * Support for GAS/ANQP queries.
+     */
+    HOTSPOT = 1 << 8,
+    /**
+     * Support for Preferred Network Offload.
+     */
+    PNO = 1 << 9,
+    /**
+     * Support for Tunneled Direct Link Setup.
+     */
+    TDLS = 1 << 10,
+    /**
+     * Support for Tunneled Direct Link Setup off channel.
+     */
+    TDLS_OFFCHANNEL = 1 << 11,
+    /**
+     * Support for tracking connection packets' fate.
+     */
+    DEBUG_PACKET_FATE = 1 << 12
   };
 
   /**
@@ -301,6 +333,52 @@
   stopRssiMonitoring(CommandId cmdId) generates (WifiStatus status);
 
   /**
+   * Get roaming control capabilities.
+   * Must fail if |StaIfaceCapabilityMask.CONTROL_ROAMING| is not set.
+   *
+   * @return status WifiStatus of the operation.
+   *         Possible status codes:
+   *         |WifiStatusCode.SUCCESS|,
+   *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+   *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+   *         |WifiStatusCode.ERROR_UNKNOWN|
+   * @return caps Instance of |StaRoamingCapabilities|.
+   */
+  getRoamingCapabilities()
+      generates (WifiStatus status, StaRoamingCapabilities caps);
+
+  /**
+   * Configure roaming control parameters.
+   * Must fail if |StaIfaceCapabilityMask.CONTROL_ROAMING| is not set.
+   *
+   * @param config Instance of |StaRoamingConfig|.
+   * @return status WifiStatus of the operation.
+   *         Possible status codes:
+   *         |WifiStatusCode.SUCCESS|,
+   *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+   *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+   *         |WifiStatusCode.ERROR_UNKNOWN|
+   */
+  configureRoaming(StaRoamingConfig config) generates (WifiStatus status);
+
+  /**
+   * Set the roaming control state with the parameters configured
+   * using |configureRoaming|. Depending on the roaming state set, the
+   * driver/firmware would enable/disable control over roaming decisions.
+   * Must fail if |StaIfaceCapabilityMask.CONTROL_ROAMING| is not set.
+   *
+   * @param state State of the roaming control.
+   * @return status WifiStatus of the operation.
+   *         Possible status codes:
+   *         |WifiStatusCode.SUCCESS|,
+   *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+   *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+   *         |WifiStatusCode.ERROR_BUSY|,
+   *         |WifiStatusCode.ERROR_UNKNOWN|
+   */
+  setRoamingState(StaRoamingState state) generates (WifiStatus status);
+
+  /**
    * API to start packet fate monitoring.
    * - Once stared, monitoring must remain active until HAL is unloaded.
    * - When HAL is unloaded, all packet fate buffers must be cleared.
diff --git a/wifi/1.0/default/hidl_struct_util.cpp b/wifi/1.0/default/hidl_struct_util.cpp
index 61a2c2c..a94d812 100644
--- a/wifi/1.0/default/hidl_struct_util.cpp
+++ b/wifi/1.0/default/hidl_struct_util.cpp
@@ -31,15 +31,15 @@
   using HidlChipCaps = IWifiChip::ChipCapabilityMask;
   switch (feature) {
     case legacy_hal::WIFI_LOGGER_MEMORY_DUMP_SUPPORTED:
-      return HidlChipCaps::DEBUG_MEMORY_FIRMWARE_DUMP_SUPPORTED;
+      return HidlChipCaps::DEBUG_MEMORY_FIRMWARE_DUMP;
     case legacy_hal::WIFI_LOGGER_DRIVER_DUMP_SUPPORTED:
-      return HidlChipCaps::DEBUG_MEMORY_DRIVER_DUMP_SUPPORTED;
+      return HidlChipCaps::DEBUG_MEMORY_DRIVER_DUMP;
     case legacy_hal::WIFI_LOGGER_CONNECT_EVENT_SUPPORTED:
-      return HidlChipCaps::DEBUG_RING_BUFFER_CONNECT_EVENT_SUPPORTED;
+      return HidlChipCaps::DEBUG_RING_BUFFER_CONNECT_EVENT;
     case legacy_hal::WIFI_LOGGER_POWER_EVENT_SUPPORTED:
-      return HidlChipCaps::DEBUG_RING_BUFFER_POWER_EVENT_SUPPORTED;
+      return HidlChipCaps::DEBUG_RING_BUFFER_POWER_EVENT;
     case legacy_hal::WIFI_LOGGER_WAKE_LOCK_SUPPORTED:
-      return HidlChipCaps::DEBUG_RING_BUFFER_WAKELOCK_EVENT_SUPPORTED;
+      return HidlChipCaps::DEBUG_RING_BUFFER_WAKELOCK_EVENT;
   };
   CHECK(false) << "Unknown legacy feature: " << feature;
   return {};
@@ -50,7 +50,7 @@
   using HidlStaIfaceCaps = IWifiStaIface::StaIfaceCapabilityMask;
   switch (feature) {
     case legacy_hal::WIFI_LOGGER_PACKET_FATE_SUPPORTED:
-      return HidlStaIfaceCaps::DEBUG_PACKET_FATE_SUPPORTED;
+      return HidlStaIfaceCaps::DEBUG_PACKET_FATE;
   };
   CHECK(false) << "Unknown legacy feature: " << feature;
   return {};
@@ -66,6 +66,22 @@
       return HidlStaIfaceCaps::LINK_LAYER_STATS;
     case WIFI_FEATURE_RSSI_MONITOR:
       return HidlStaIfaceCaps::RSSI_MONITOR;
+    case WIFI_FEATURE_CONTROL_ROAMING:
+      return HidlStaIfaceCaps::CONTROL_ROAMING;
+    case WIFI_FEATURE_IE_WHITELIST:
+      return HidlStaIfaceCaps::PROBE_IE_WHITELIST;
+    case WIFI_FEATURE_SCAN_RAND:
+      return HidlStaIfaceCaps::SCAN_RAND;
+    case WIFI_FEATURE_INFRA_5G:
+      return HidlStaIfaceCaps::STA_5G;
+    case WIFI_FEATURE_HOTSPOT:
+      return HidlStaIfaceCaps::HOTSPOT;
+    case WIFI_FEATURE_PNO:
+      return HidlStaIfaceCaps::PNO;
+    case WIFI_FEATURE_TDLS:
+      return HidlStaIfaceCaps::TDLS;
+    case WIFI_FEATURE_TDLS_OFFCHANNEL:
+      return HidlStaIfaceCaps::TDLS_OFFCHANNEL;
   };
   CHECK(false) << "Unknown legacy feature: " << feature;
   return {};
@@ -87,10 +103,11 @@
       *hidl_caps |= convertLegacyLoggerFeatureToHidlChipCapability(feature);
     }
   }
-  // There is no flags for these 2 in the legacy feature set. Adding it to the
-  // set because all the current devices support it.
-  *hidl_caps |= HidlChipCaps::DEBUG_RING_BUFFER_VENDOR_DATA_SUPPORTED;
+  // There are no flags for these 3 in the legacy feature set. Adding them to
+  // the set because all the current devices support it.
+  *hidl_caps |= HidlChipCaps::DEBUG_RING_BUFFER_VENDOR_DATA;
   *hidl_caps |= HidlChipCaps::DEBUG_HOST_WAKE_REASON_STATS;
+  *hidl_caps |= HidlChipCaps::DEBUG_ERROR_ALERTS;
   return true;
 }
 
@@ -214,7 +231,15 @@
   }
   for (const auto feature : {WIFI_FEATURE_GSCAN,
                              WIFI_FEATURE_LINK_LAYER_STATS,
-                             WIFI_FEATURE_RSSI_MONITOR}) {
+                             WIFI_FEATURE_RSSI_MONITOR,
+                             WIFI_FEATURE_CONTROL_ROAMING,
+                             WIFI_FEATURE_IE_WHITELIST,
+                             WIFI_FEATURE_SCAN_RAND,
+                             WIFI_FEATURE_INFRA_5G,
+                             WIFI_FEATURE_HOTSPOT,
+                             WIFI_FEATURE_PNO,
+                             WIFI_FEATURE_TDLS,
+                             WIFI_FEATURE_TDLS_OFFCHANNEL}) {
     if (feature & legacy_feature_set) {
       *hidl_caps |= convertLegacyFeatureToHidlStaIfaceCapability(feature);
     }
@@ -669,6 +694,55 @@
   return true;
 }
 
+bool convertLegacyRoamingCapabilitiesToHidl(
+    const legacy_hal::wifi_roaming_capabilities& legacy_caps,
+    StaRoamingCapabilities* hidl_caps) {
+  if (!hidl_caps) {
+    return false;
+  }
+  hidl_caps->maxBlacklistSize = legacy_caps.max_blacklist_size;
+  hidl_caps->maxWhitelistSize = legacy_caps.max_whitelist_size;
+  return true;
+}
+
+bool convertHidlRoamingConfigToLegacy(
+    const StaRoamingConfig& hidl_config,
+    legacy_hal::wifi_roaming_config* legacy_config) {
+  if (!legacy_config) {
+    return false;
+  }
+  if (hidl_config.bssidBlacklist.size() > MAX_BLACKLIST_BSSID ||
+      hidl_config.ssidWhitelist.size() > MAX_WHITELIST_SSID) {
+    return false;
+  }
+  legacy_config->num_blacklist_bssid = hidl_config.bssidBlacklist.size();
+  uint32_t i = 0;
+  for (const auto& bssid : hidl_config.bssidBlacklist) {
+    CHECK(bssid.size() == sizeof(legacy_hal::mac_addr));
+    memcpy(legacy_config->blacklist_bssid[i++], bssid.data(), bssid.size());
+  }
+  legacy_config->num_whitelist_ssid = hidl_config.ssidWhitelist.size();
+  i = 0;
+  for (const auto& ssid : hidl_config.ssidWhitelist) {
+    CHECK(ssid.size() <= sizeof(legacy_hal::ssid_t::ssid_str));
+    legacy_config->whitelist_ssid[i].length = ssid.size();
+    memcpy(legacy_config->whitelist_ssid[i].ssid_str, ssid.data(), ssid.size());
+    i++;
+  }
+  return true;
+}
+
+legacy_hal::fw_roaming_state_t convertHidlRoamingStateToLegacy(
+    StaRoamingState state) {
+  switch (state) {
+    case StaRoamingState::ENABLED:
+      return legacy_hal::ROAMING_ENABLE;
+    case StaRoamingState::DISABLED:
+      return legacy_hal::ROAMING_DISABLE;
+  };
+  CHECK(false);
+}
+
 legacy_hal::NanPublishType convertHidlNanPublishTypeToLegacy(
     NanPublishType type) {
   switch (type) {
diff --git a/wifi/1.0/default/hidl_struct_util.h b/wifi/1.0/default/hidl_struct_util.h
index 3ff94fd..9086666 100644
--- a/wifi/1.0/default/hidl_struct_util.h
+++ b/wifi/1.0/default/hidl_struct_util.h
@@ -39,6 +39,9 @@
 // Chip conversion methods.
 bool convertLegacyFeaturesToHidlChipCapabilities(
     uint32_t legacy_logger_feature_set, uint32_t* hidl_caps);
+bool convertLegacyDebugRingBufferStatusToHidl(
+    const legacy_hal::wifi_ring_buffer_status& legacy_status,
+    WifiDebugRingBufferStatus* hidl_status);
 bool convertLegacyVectorOfDebugRingBufferStatusToHidl(
     const std::vector<legacy_hal::wifi_ring_buffer_status>& legacy_status_vec,
     std::vector<WifiDebugRingBufferStatus>* hidl_status_vec);
@@ -75,6 +78,14 @@
 bool convertLegacyLinkLayerStatsToHidl(
     const legacy_hal::LinkLayerStats& legacy_stats,
     StaLinkLayerStats* hidl_stats);
+bool convertLegacyRoamingCapabilitiesToHidl(
+    const legacy_hal::wifi_roaming_capabilities& legacy_caps,
+    StaRoamingCapabilities* hidl_caps);
+bool convertHidlRoamingConfigToLegacy(
+    const StaRoamingConfig& hidl_config,
+    legacy_hal::wifi_roaming_config* legacy_config);
+legacy_hal::fw_roaming_state_t convertHidlRoamingStateToLegacy(
+    StaRoamingState state);
 bool convertLegacyVectorOfDebugTxPacketFateToHidl(
     const std::vector<legacy_hal::wifi_tx_report>& legacy_fates,
     std::vector<WifiDebugTxPacketFateReport>* hidl_fates);
diff --git a/wifi/1.0/default/wifi_chip.cpp b/wifi/1.0/default/wifi_chip.cpp
index d70f548..e15178d 100644
--- a/wifi/1.0/default/wifi_chip.cpp
+++ b/wifi/1.0/default/wifi_chip.cpp
@@ -25,12 +25,13 @@
 using android::sp;
 using android::hardware::hidl_vec;
 using android::hardware::hidl_string;
+using android::hardware::wifi::V1_0::ChipModeId;
 using android::hardware::wifi::V1_0::IWifiChip;
 using android::hardware::wifi::V1_0::IfaceType;
 
-constexpr uint32_t kStaChipModeId = 0;
-constexpr uint32_t kApChipModeId = 1;
-constexpr uint32_t kInvalidModeId = UINT32_MAX;
+constexpr ChipModeId kStaChipModeId = 0;
+constexpr ChipModeId kApChipModeId = 1;
+constexpr ChipModeId kInvalidModeId = UINT32_MAX;
 
 template <typename Iface>
 void invalidateAndClear(sp<Iface>& iface) {
@@ -56,7 +57,8 @@
       legacy_hal_(legacy_hal),
       mode_controller_(mode_controller),
       is_valid_(true),
-      current_mode_id_(kInvalidModeId) {}
+      current_mode_id_(kInvalidModeId),
+      debug_ring_buffer_cb_registered_(false) {}
 
 void WifiChip::invalidate() {
   invalidateAndRemoveAllIfaces();
@@ -69,6 +71,10 @@
   return is_valid_;
 }
 
+std::vector<sp<IWifiChipEventCallback>> WifiChip::getEventCallbacks() {
+  return event_callbacks_;
+}
+
 Return<void> WifiChip::getId(getId_cb hidl_status_cb) {
   return validateAndCall(this,
                          WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
@@ -100,7 +106,7 @@
                          hidl_status_cb);
 }
 
-Return<void> WifiChip::configureChip(uint32_t mode_id,
+Return<void> WifiChip::configureChip(ChipModeId mode_id,
                                      configureChip_cb hidl_status_cb) {
   return validateAndCall(this,
                          WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
@@ -319,6 +325,15 @@
                          hidl_status_cb);
 }
 
+Return<void> WifiChip::enableDebugErrorAlerts(
+    bool enable, enableDebugErrorAlerts_cb hidl_status_cb) {
+  return validateAndCall(this,
+                         WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                         &WifiChip::enableDebugErrorAlertsInternal,
+                         hidl_status_cb,
+                         enable);
+}
+
 void WifiChip::invalidateAndRemoveAllIfaces() {
   invalidateAndClear(ap_iface_);
   invalidateAndClear(nan_iface_);
@@ -389,7 +404,7 @@
           {sta_chip_mode, ap_chip_mode}};
 }
 
-WifiStatus WifiChip::configureChipInternal(uint32_t mode_id) {
+WifiStatus WifiChip::configureChipInternal(ChipModeId mode_id) {
   if (mode_id != kStaChipModeId && mode_id != kApChipModeId) {
     return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
   }
@@ -397,40 +412,18 @@
     LOG(DEBUG) << "Already in the specified mode " << mode_id;
     return createWifiStatus(WifiStatusCode::SUCCESS);
   }
-  // If the chip is already configured in a different mode, stop
-  // the legacy HAL and then start it after firmware mode change.
-  if (current_mode_id_ != kInvalidModeId) {
-    invalidateAndRemoveAllIfaces();
-    legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->stop([]() {});
-    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
-      LOG(ERROR) << "Failed to stop legacy HAL: "
-                 << legacyErrorToString(legacy_status);
-      // TODO(b/33038823): Need to invoke onChipReconfigureFailure()
-      return createWifiStatusFromLegacyError(legacy_status);
+  WifiStatus status = handleChipConfiguration(mode_id);
+  if (status.code != WifiStatusCode::SUCCESS) {
+    for (const auto& callback : event_callbacks_) {
+      callback->onChipReconfigureFailure(status);
     }
-  }
-  bool success;
-  if (mode_id == kStaChipModeId) {
-    success = mode_controller_.lock()->changeFirmwareMode(IfaceType::STA);
-  } else {
-    success = mode_controller_.lock()->changeFirmwareMode(IfaceType::AP);
-  }
-  if (!success) {
-    // TODO(b/33038823): Need to invoke onChipReconfigureFailure()
-    return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
-  }
-  legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->start();
-  if (legacy_status != legacy_hal::WIFI_SUCCESS) {
-    LOG(ERROR) << "Failed to start legacy HAL: "
-               << legacyErrorToString(legacy_status);
-    // TODO(b/33038823): Need to invoke onChipReconfigureFailure()
-    return createWifiStatusFromLegacyError(legacy_status);
+    return status;
   }
   for (const auto& callback : event_callbacks_) {
     callback->onChipReconfigured(mode_id);
   }
   current_mode_id_ = mode_id;
-  return createWifiStatus(WifiStatusCode::SUCCESS);
+  return status;
 }
 
 std::pair<WifiStatus, uint32_t> WifiChip::getModeInternal() {
@@ -506,6 +499,9 @@
   }
   std::string ifname = legacy_hal_.lock()->getApIfaceName();
   ap_iface_ = new WifiApIface(ifname, legacy_hal_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceAdded(IfaceType::AP, ifname);
+  }
   return {createWifiStatus(WifiStatusCode::SUCCESS), ap_iface_};
 }
 
@@ -531,6 +527,9 @@
     return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
   }
   invalidateAndClear(ap_iface_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceRemoved(IfaceType::AP, ifname);
+  }
   return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
@@ -542,6 +541,9 @@
   }
   std::string ifname = legacy_hal_.lock()->getNanIfaceName();
   nan_iface_ = new WifiNanIface(ifname, legacy_hal_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceAdded(IfaceType::NAN, ifname);
+  }
   return {createWifiStatus(WifiStatusCode::SUCCESS), nan_iface_};
 }
 
@@ -567,6 +569,9 @@
     return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
   }
   invalidateAndClear(nan_iface_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceRemoved(IfaceType::NAN, ifname);
+  }
   return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
@@ -578,6 +583,9 @@
   }
   std::string ifname = legacy_hal_.lock()->getP2pIfaceName();
   p2p_iface_ = new WifiP2pIface(ifname, legacy_hal_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceAdded(IfaceType::P2P, ifname);
+  }
   return {createWifiStatus(WifiStatusCode::SUCCESS), p2p_iface_};
 }
 
@@ -603,6 +611,9 @@
     return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
   }
   invalidateAndClear(p2p_iface_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceRemoved(IfaceType::P2P, ifname);
+  }
   return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
@@ -612,6 +623,9 @@
   }
   std::string ifname = legacy_hal_.lock()->getStaIfaceName();
   sta_iface_ = new WifiStaIface(ifname, legacy_hal_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceAdded(IfaceType::STA, ifname);
+  }
   return {createWifiStatus(WifiStatusCode::SUCCESS), sta_iface_};
 }
 
@@ -637,6 +651,9 @@
     return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
   }
   invalidateAndClear(sta_iface_);
+  for (const auto& callback : event_callbacks_) {
+    callback->onIfaceRemoved(IfaceType::STA, ifname);
+  }
   return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
@@ -671,6 +688,10 @@
     WifiDebugRingBufferVerboseLevel verbose_level,
     uint32_t max_interval_in_sec,
     uint32_t min_data_size_in_bytes) {
+  WifiStatus status = registerDebugRingBufferCallback();
+  if (status.code != WifiStatusCode::SUCCESS) {
+    return status;
+  }
   legacy_hal::wifi_error legacy_status =
       legacy_hal_.lock()->startRingBufferLogging(
           ring_name,
@@ -684,6 +705,10 @@
 
 WifiStatus WifiChip::forceDumpToDebugRingBufferInternal(
     const hidl_string& ring_name) {
+  WifiStatus status = registerDebugRingBufferCallback();
+  if (status.code != WifiStatusCode::SUCCESS) {
+    return status;
+  }
   legacy_hal::wifi_error legacy_status =
       legacy_hal_.lock()->getRingBufferData(ring_name);
   return createWifiStatusFromLegacyError(legacy_status);
@@ -706,6 +731,94 @@
   return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_stats};
 }
 
+WifiStatus WifiChip::enableDebugErrorAlertsInternal(bool enable) {
+  legacy_hal::wifi_error legacy_status;
+  if (enable) {
+    android::wp<WifiChip> weak_ptr_this(this);
+    const auto& on_alert_callback = [weak_ptr_this](
+        int32_t error_code, std::vector<uint8_t> debug_data) {
+      const auto shared_ptr_this = weak_ptr_this.promote();
+      if (!shared_ptr_this.get() || !shared_ptr_this->isValid()) {
+        LOG(ERROR) << "Callback invoked on an invalid object";
+        return;
+      }
+      for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
+        callback->onDebugErrorAlert(error_code, debug_data);
+      }
+    };
+    legacy_status = legacy_hal_.lock()->registerErrorAlertCallbackHandler(
+        on_alert_callback);
+  } else {
+    legacy_status = legacy_hal_.lock()->deregisterErrorAlertCallbackHandler();
+  }
+  return createWifiStatusFromLegacyError(legacy_status);
+}
+
+WifiStatus WifiChip::handleChipConfiguration(ChipModeId mode_id) {
+  // If the chip is already configured in a different mode, stop
+  // the legacy HAL and then start it after firmware mode change.
+  if (current_mode_id_ != kInvalidModeId) {
+    invalidateAndRemoveAllIfaces();
+    legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->stop([]() {});
+    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+      LOG(ERROR) << "Failed to stop legacy HAL: "
+                 << legacyErrorToString(legacy_status);
+      return createWifiStatusFromLegacyError(legacy_status);
+    }
+  }
+  bool success;
+  if (mode_id == kStaChipModeId) {
+    success = mode_controller_.lock()->changeFirmwareMode(IfaceType::STA);
+  } else {
+    success = mode_controller_.lock()->changeFirmwareMode(IfaceType::AP);
+  }
+  if (!success) {
+    return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+  }
+  legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->start();
+  if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+    LOG(ERROR) << "Failed to start legacy HAL: "
+               << legacyErrorToString(legacy_status);
+    return createWifiStatusFromLegacyError(legacy_status);
+  }
+  return createWifiStatus(WifiStatusCode::SUCCESS);
+}
+
+WifiStatus WifiChip::registerDebugRingBufferCallback() {
+  if (debug_ring_buffer_cb_registered_) {
+    return createWifiStatus(WifiStatusCode::SUCCESS);
+  }
+
+  android::wp<WifiChip> weak_ptr_this(this);
+  const auto& on_ring_buffer_data_callback = [weak_ptr_this](
+      const std::string& /* name */,
+      const std::vector<uint8_t>& data,
+      const legacy_hal::wifi_ring_buffer_status& status) {
+    const auto shared_ptr_this = weak_ptr_this.promote();
+    if (!shared_ptr_this.get() || !shared_ptr_this->isValid()) {
+      LOG(ERROR) << "Callback invoked on an invalid object";
+      return;
+    }
+    WifiDebugRingBufferStatus hidl_status;
+    if (!hidl_struct_util::convertLegacyDebugRingBufferStatusToHidl(
+            status, &hidl_status)) {
+      LOG(ERROR) << "Error converting ring buffer status";
+      return;
+    }
+    for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
+      callback->onDebugRingBufferDataAvailable(hidl_status, data);
+    }
+  };
+  legacy_hal::wifi_error legacy_status =
+      legacy_hal_.lock()->registerRingBufferCallbackHandler(
+          on_ring_buffer_data_callback);
+
+  if (legacy_status == legacy_hal::WIFI_SUCCESS) {
+    debug_ring_buffer_cb_registered_ = true;
+  }
+  return createWifiStatusFromLegacyError(legacy_status);
+}
+
 }  // namespace implementation
 }  // namespace V1_0
 }  // namespace wifi
diff --git a/wifi/1.0/default/wifi_chip.h b/wifi/1.0/default/wifi_chip.h
index 5e7a0c3..938b180 100644
--- a/wifi/1.0/default/wifi_chip.h
+++ b/wifi/1.0/default/wifi_chip.h
@@ -62,6 +62,7 @@
   // valid before processing them.
   void invalidate();
   bool isValid();
+  std::vector<sp<IWifiChipEventCallback>> getEventCallbacks();
 
   // HIDL methods exposed.
   Return<void> getId(getId_cb hidl_status_cb) override;
@@ -70,7 +71,7 @@
       registerEventCallback_cb hidl_status_cb) override;
   Return<void> getCapabilities(getCapabilities_cb hidl_status_cb) override;
   Return<void> getAvailableModes(getAvailableModes_cb hidl_status_cb) override;
-  Return<void> configureChip(uint32_t mode_id,
+  Return<void> configureChip(ChipModeId mode_id,
                              configureChip_cb hidl_status_cb) override;
   Return<void> getMode(getMode_cb hidl_status_cb) override;
   Return<void> requestChipDebugInfo(
@@ -119,6 +120,8 @@
       forceDumpToDebugRingBuffer_cb hidl_status_cb) override;
   Return<void> getDebugHostWakeReasonStats(
       getDebugHostWakeReasonStats_cb hidl_status_cb) override;
+  Return<void> enableDebugErrorAlerts(
+      bool enable, enableDebugErrorAlerts_cb hidl_status_cb) override;
 
  private:
   void invalidateAndRemoveAllIfaces();
@@ -129,7 +132,7 @@
       const sp<IWifiChipEventCallback>& event_callback);
   std::pair<WifiStatus, uint32_t> getCapabilitiesInternal();
   std::pair<WifiStatus, std::vector<ChipMode>> getAvailableModesInternal();
-  WifiStatus configureChipInternal(uint32_t mode_id);
+  WifiStatus configureChipInternal(ChipModeId mode_id);
   std::pair<WifiStatus, uint32_t> getModeInternal();
   std::pair<WifiStatus, IWifiChip::ChipDebugInfo>
   requestChipDebugInfoInternal();
@@ -168,6 +171,10 @@
   WifiStatus forceDumpToDebugRingBufferInternal(const hidl_string& ring_name);
   std::pair<WifiStatus, WifiDebugHostWakeReasonStats>
   getDebugHostWakeReasonStatsInternal();
+  WifiStatus enableDebugErrorAlertsInternal(bool enable);
+
+  WifiStatus handleChipConfiguration(ChipModeId mode_id);
+  WifiStatus registerDebugRingBufferCallback();
 
   ChipId chip_id_;
   std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
@@ -180,6 +187,10 @@
   std::vector<sp<WifiRttController>> rtt_controllers_;
   bool is_valid_;
   uint32_t current_mode_id_;
+  // The legacy ring buffer callback API has only a global callback
+  // registration mechanism. Use this to check if we have already
+  // registered a callback.
+  bool debug_ring_buffer_cb_registered_;
 
   DISALLOW_COPY_AND_ASSIGN(WifiChip);
 };
diff --git a/wifi/1.0/default/wifi_legacy_hal.cpp b/wifi/1.0/default/wifi_legacy_hal.cpp
index d7a1f15..3b99e60 100644
--- a/wifi/1.0/default/wifi_legacy_hal.cpp
+++ b/wifi/1.0/default/wifi_legacy_hal.cpp
@@ -121,6 +121,18 @@
   }
 }
 
+// Callback to be invoked for error alert indication.
+std::function<void(wifi_request_id, char*, int, int)>
+    on_error_alert_internal_callback;
+void onErrorAlert(wifi_request_id id,
+                  char* buffer,
+                  int buffer_size,
+                  int err_code) {
+  if (on_error_alert_internal_callback) {
+    on_error_alert_internal_callback(id, buffer, buffer_size, err_code);
+  }
+}
+
 // Callback to be invoked for rtt results results.
 std::function<void(
     wifi_request_id, unsigned num_results, wifi_rtt_result* rtt_results[])>
@@ -613,6 +625,25 @@
   return status;
 }
 
+std::pair<wifi_error, wifi_roaming_capabilities>
+WifiLegacyHal::getRoamingCapabilities() {
+  wifi_roaming_capabilities caps;
+  wifi_error status = global_func_table_.wifi_get_roaming_capabilities(
+      wlan_interface_handle_, &caps);
+  return {status, caps};
+}
+
+wifi_error WifiLegacyHal::enableFirmwareRoaming(fw_roaming_state_t state) {
+  return global_func_table_.wifi_enable_firmware_roaming(wlan_interface_handle_,
+                                                         state);
+}
+
+wifi_error WifiLegacyHal::configureRoaming(const wifi_roaming_config& config) {
+  wifi_roaming_config config_internal = config;
+  return global_func_table_.wifi_configure_roaming(wlan_interface_handle_,
+                                                   &config_internal);
+}
+
 std::pair<wifi_error, uint32_t> WifiLegacyHal::getLoggerSupportedFeatureSet() {
   uint32_t supported_features;
   wifi_error status = global_func_table_.wifi_get_logger_supported_feature_set(
@@ -710,15 +741,27 @@
       on_user_data_callback(ring_name, buffer_vector, *status);
     }
   };
-  return global_func_table_.wifi_set_log_handler(
+  wifi_error status = global_func_table_.wifi_set_log_handler(
       0, wlan_interface_handle_, {onRingBufferData});
+  if (status != WIFI_SUCCESS) {
+    on_ring_buffer_data_internal_callback = nullptr;
+  }
+  return status;
+}
+
+wifi_error WifiLegacyHal::deregisterRingBufferCallbackHandler() {
+  if (!on_ring_buffer_data_internal_callback) {
+    return WIFI_ERROR_NOT_AVAILABLE;
+  }
+  on_ring_buffer_data_internal_callback = nullptr;
+  return global_func_table_.wifi_reset_log_handler(0, wlan_interface_handle_);
 }
 
 std::pair<wifi_error, std::vector<wifi_ring_buffer_status>>
 WifiLegacyHal::getRingBuffersStatus() {
   std::vector<wifi_ring_buffer_status> ring_buffers_status;
   ring_buffers_status.resize(kMaxRingBuffers);
-  uint32_t num_rings = 0;
+  uint32_t num_rings = kMaxRingBuffers;
   wifi_error status = global_func_table_.wifi_get_ring_buffers_status(
       wlan_interface_handle_, &num_rings, ring_buffers_status.data());
   CHECK(num_rings <= kMaxRingBuffers);
@@ -745,6 +788,38 @@
                                                ring_name_internal.data());
 }
 
+wifi_error WifiLegacyHal::registerErrorAlertCallbackHandler(
+    const on_error_alert_callback& on_user_alert_callback) {
+  if (on_error_alert_internal_callback) {
+    return WIFI_ERROR_NOT_AVAILABLE;
+  }
+  on_error_alert_internal_callback = [on_user_alert_callback](
+      wifi_request_id id, char* buffer, int buffer_size, int err_code) {
+    if (buffer) {
+      CHECK(id == 0);
+      on_user_alert_callback(
+          err_code,
+          std::vector<uint8_t>(
+              reinterpret_cast<uint8_t*>(buffer),
+              reinterpret_cast<uint8_t*>(buffer) + buffer_size));
+    }
+  };
+  wifi_error status = global_func_table_.wifi_set_alert_handler(
+      0, wlan_interface_handle_, {onErrorAlert});
+  if (status != WIFI_SUCCESS) {
+    on_error_alert_internal_callback = nullptr;
+  }
+  return status;
+}
+
+wifi_error WifiLegacyHal::deregisterErrorAlertCallbackHandler() {
+  if (!on_error_alert_internal_callback) {
+    return WIFI_ERROR_NOT_AVAILABLE;
+  }
+  on_error_alert_internal_callback = nullptr;
+  return global_func_table_.wifi_reset_alert_handler(0, wlan_interface_handle_);
+}
+
 wifi_error WifiLegacyHal::startRttRangeRequest(
     wifi_request_id id,
     const std::vector<wifi_rtt_config>& rtt_configs,
@@ -1095,6 +1170,7 @@
   on_link_layer_stats_result_internal_callback = nullptr;
   on_rssi_threshold_breached_internal_callback = nullptr;
   on_ring_buffer_data_internal_callback = nullptr;
+  on_error_alert_internal_callback = nullptr;
   on_rtt_results_internal_callback = nullptr;
   on_nan_notify_response_user_callback = nullptr;
   on_nan_event_publish_terminated_user_callback = nullptr;
diff --git a/wifi/1.0/default/wifi_legacy_hal.h b/wifi/1.0/default/wifi_legacy_hal.h
index 07bc93a..b585314 100644
--- a/wifi/1.0/default/wifi_legacy_hal.h
+++ b/wifi/1.0/default/wifi_legacy_hal.h
@@ -118,6 +118,9 @@
                        const std::vector<uint8_t>&,
                        const wifi_ring_buffer_status&)>;
 
+// Callback for alerts.
+using on_error_alert_callback =
+    std::function<void(int32_t, const std::vector<uint8_t>&)>;
 /**
  * Class that encapsulates all legacy HAL interactions.
  * This class manages the lifetime of the event loop thread used by legacy HAL.
@@ -178,6 +181,9 @@
                                  const on_rssi_threshold_breached_callback&
                                      on_threshold_breached_callback);
   wifi_error stopRssiMonitoring(wifi_request_id id);
+  std::pair<wifi_error, wifi_roaming_capabilities> getRoamingCapabilities();
+  wifi_error enableFirmwareRoaming(fw_roaming_state_t state);
+  wifi_error configureRoaming(const wifi_roaming_config& config);
   // Logger/debug functions.
   std::pair<wifi_error, uint32_t> getLoggerSupportedFeatureSet();
   wifi_error startPktFateMonitoring();
@@ -186,6 +192,7 @@
   std::pair<wifi_error, WakeReasonStats> getWakeReasonStats();
   wifi_error registerRingBufferCallbackHandler(
       const on_ring_buffer_data_callback& on_data_callback);
+  wifi_error deregisterRingBufferCallbackHandler();
   std::pair<wifi_error, std::vector<wifi_ring_buffer_status>>
   getRingBuffersStatus();
   wifi_error startRingBufferLogging(const std::string& ring_name,
@@ -193,6 +200,9 @@
                                     uint32_t max_interval_sec,
                                     uint32_t min_data_size);
   wifi_error getRingBufferData(const std::string& ring_name);
+  wifi_error registerErrorAlertCallbackHandler(
+      const on_error_alert_callback& on_alert_callback);
+  wifi_error deregisterErrorAlertCallbackHandler();
   // RTT functions.
   wifi_error startRttRangeRequest(
       wifi_request_id id,
diff --git a/wifi/1.0/default/wifi_sta_iface.cpp b/wifi/1.0/default/wifi_sta_iface.cpp
index c91a99b..e48978e 100644
--- a/wifi/1.0/default/wifi_sta_iface.cpp
+++ b/wifi/1.0/default/wifi_sta_iface.cpp
@@ -186,6 +186,32 @@
                          cmd_id);
 }
 
+Return<void> WifiStaIface::getRoamingCapabilities(
+    getRoamingCapabilities_cb hidl_status_cb) {
+  return validateAndCall(this,
+                         WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                         &WifiStaIface::getRoamingCapabilitiesInternal,
+                         hidl_status_cb);
+}
+
+Return<void> WifiStaIface::configureRoaming(
+    const StaRoamingConfig& config, configureRoaming_cb hidl_status_cb) {
+  return validateAndCall(this,
+                         WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                         &WifiStaIface::configureRoamingInternal,
+                         hidl_status_cb,
+                         config);
+}
+
+Return<void> WifiStaIface::setRoamingState(StaRoamingState state,
+                                           setRoamingState_cb hidl_status_cb) {
+  return validateAndCall(this,
+                         WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                         &WifiStaIface::setRoamingStateInternal,
+                         hidl_status_cb,
+                         state);
+}
+
 Return<void> WifiStaIface::startDebugPacketFateMonitoring(
     startDebugPacketFateMonitoring_cb hidl_status_cb) {
   return validateAndCall(this,
@@ -436,6 +462,42 @@
   return createWifiStatusFromLegacyError(legacy_status);
 }
 
+std::pair<WifiStatus, StaRoamingCapabilities>
+WifiStaIface::getRoamingCapabilitiesInternal() {
+  legacy_hal::wifi_error legacy_status;
+  legacy_hal::wifi_roaming_capabilities legacy_caps;
+  std::tie(legacy_status, legacy_caps) =
+      legacy_hal_.lock()->getRoamingCapabilities();
+  if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+    return {createWifiStatusFromLegacyError(legacy_status), {}};
+  }
+  StaRoamingCapabilities hidl_caps;
+  if (!hidl_struct_util::convertLegacyRoamingCapabilitiesToHidl(legacy_caps,
+                                                                &hidl_caps)) {
+    return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
+  }
+  return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_caps};
+}
+
+WifiStatus WifiStaIface::configureRoamingInternal(
+    const StaRoamingConfig& config) {
+  legacy_hal::wifi_roaming_config legacy_config;
+  if (!hidl_struct_util::convertHidlRoamingConfigToLegacy(config,
+                                                          &legacy_config)) {
+    return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
+  }
+  legacy_hal::wifi_error legacy_status =
+      legacy_hal_.lock()->configureRoaming(legacy_config);
+  return createWifiStatusFromLegacyError(legacy_status);
+}
+
+WifiStatus WifiStaIface::setRoamingStateInternal(StaRoamingState state) {
+  legacy_hal::wifi_error legacy_status =
+      legacy_hal_.lock()->enableFirmwareRoaming(
+          hidl_struct_util::convertHidlRoamingStateToLegacy(state));
+  return createWifiStatusFromLegacyError(legacy_status);
+}
+
 WifiStatus WifiStaIface::startDebugPacketFateMonitoringInternal() {
   legacy_hal::wifi_error legacy_status =
       legacy_hal_.lock()->startPktFateMonitoring();
diff --git a/wifi/1.0/default/wifi_sta_iface.h b/wifi/1.0/default/wifi_sta_iface.h
index b4f2721..90126cd 100644
--- a/wifi/1.0/default/wifi_sta_iface.h
+++ b/wifi/1.0/default/wifi_sta_iface.h
@@ -77,6 +77,12 @@
       startRssiMonitoring_cb hidl_status_cb) override;
   Return<void> stopRssiMonitoring(
       uint32_t cmd_id, stopRssiMonitoring_cb hidl_status_cb) override;
+  Return<void> getRoamingCapabilities(
+      getRoamingCapabilities_cb hidl_status_cb) override;
+  Return<void> configureRoaming(const StaRoamingConfig& config,
+                                configureRoaming_cb hidl_status_cb) override;
+  Return<void> setRoamingState(StaRoamingState state,
+                               setRoamingState_cb hidl_status_cb) override;
   Return<void> startDebugPacketFateMonitoring(
       startDebugPacketFateMonitoring_cb hidl_status_cb) override;
   Return<void> stopDebugPacketFateMonitoring(
@@ -111,6 +117,10 @@
                                          int32_t max_rssi,
                                          int32_t min_rssi);
   WifiStatus stopRssiMonitoringInternal(uint32_t cmd_id);
+  std::pair<WifiStatus, StaRoamingCapabilities>
+  getRoamingCapabilitiesInternal();
+  WifiStatus configureRoamingInternal(const StaRoamingConfig& config);
+  WifiStatus setRoamingStateInternal(StaRoamingState state);
   WifiStatus startDebugPacketFateMonitoringInternal();
   WifiStatus stopDebugPacketFateMonitoringInternal();
   std::pair<WifiStatus, std::vector<WifiDebugTxPacketFateReport>>
diff --git a/wifi/1.0/default/wifi_status_util.cpp b/wifi/1.0/default/wifi_status_util.cpp
index 9a7ad0d..518032f 100644
--- a/wifi/1.0/default/wifi_status_util.cpp
+++ b/wifi/1.0/default/wifi_status_util.cpp
@@ -83,6 +83,9 @@
       return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN,
                               desc + ", out of memory");
 
+    case legacy_hal::WIFI_ERROR_BUSY:
+      return createWifiStatus(WifiStatusCode::ERROR_BUSY);
+
     case legacy_hal::WIFI_ERROR_NONE:
       return createWifiStatus(WifiStatusCode::SUCCESS, desc);
 
diff --git a/wifi/1.0/types.hal b/wifi/1.0/types.hal
index 8dd33b5..76c89e3 100644
--- a/wifi/1.0/types.hal
+++ b/wifi/1.0/types.hal
@@ -32,6 +32,7 @@
   ERROR_NOT_AVAILABLE,
   ERROR_NOT_STARTED,
   ERROR_INVALID_ARGS,
+  ERROR_BUSY,
   ERROR_UNKNOWN
 };
 
@@ -213,7 +214,7 @@
  * TODO(b/32159498): Move to a separate nan_types.hal.
  */
 /**
- * Parameters to specify the APF capability of this iface.
+ * Parameters to specify the APF capabilities of this iface.
  */
 struct StaApfPacketFilterCapabilities {
   /**
@@ -227,7 +228,7 @@
 };
 
 /**
- * Parameters to specify the Background Scan capability of this iface.
+ * Parameters to specify the Background Scan capabilities of this iface.
  */
 struct StaBackgroundScanCapabilities {
   /**
@@ -515,6 +516,50 @@
 };
 
 /**
+ * Structure describing the roaming control capabilities supported.
+ */
+struct StaRoamingCapabilities {
+  /**
+   * Maximum number of BSSID's that may be blacklisted.
+   */
+  uint32_t maxBlacklistSize;
+  /**
+   * Maximum number of SSID's that may be whitelisted.
+   */
+  uint32_t maxWhitelistSize;
+};
+
+/**
+ * Structure describing the roaming control configuration.
+ */
+struct StaRoamingConfig {
+  /**
+   * List of BSSID's that are blacklisted for roaming.
+   */
+  vec<Bssid> bssidBlacklist;
+  /**
+   * List of SSID's that are whitelisted for roaming.
+   */
+  vec<Ssid> ssidWhitelist;
+};
+
+/**
+ * Enum describing the various states to set the roaming
+ * control to.
+ */
+enum StaRoamingState : uint8_t {
+  /**
+   * Driver/Firmware is allowed to perform roaming respecting
+   * the |StaRoamingConfig| parameters set using |configureRoaming|.
+   */
+  ENABLED = 0,
+  /**
+   * Driver/Firmware must not perform any roaming.
+   */
+  DISABLED = 1
+};
+
+/**
  * NAN specific types.
  * TODO(b/32159498): Move to a separate nan_types.hal.
  */
@@ -2314,468 +2359,6 @@
 typedef uint32_t WifiRingBufferId;
 
 /**
- * Mask of flags present in |WifiDebugRingEntryHeader.flags| field.
- */
-enum WifiDebugRingEntryFlags : uint8_t {
-  /**
-   * Set for binary entries
-   */
-  HAS_BINARY = 1 << 0,
-  /**
-   * Set if 64 bits timestamp is present
-   */
-  HAS_TIMESTAMP = 1 << 1,
-};
-
-/**
- * This structure represent an entry within a debug ring buffer.
- * Wifi driver are responsible to manage the debug ring buffer and write the
- * debug information into those buffer.
- *
- * In general, the debug entries can be used to store meaningful 802.11
- * information (SME, MLME, connection and packet statistics) as well as vendor
- * proprietary data that is specific to a specific driver or chipset.
- * Binary entries can be used so as to store packet data or vendor specific
- * information and will be treated as blobs of data by android framework.
- *
- * A user land process will be started by framework so as to periodically
- * retrieve the data logged by drivers into their debug ring buffer, store the
- * data into log files and include the logs into android bugreports.
- */
-struct WifiDebugRingEntryHeader {
-  /**
-   * The size of |payload| excluding the header.
-   */
-  uint16_t sizeInBytes;
-  /**
-   * Combination of |WifiDebugRingEntryFlags| values.
-   */
-  uint8_t flags;
-  /**
-   * Present if |HAS_TIMESTAMP| bit is set.
-   */
-  TimeStampInUs timestamp;
-};
-
-/**
- * Below event types are used for both the connect and power event
- * ring entries.
- */
-enum WifiDebugRingEntryEventType : uint16_t {
-  /**
-   * Driver receives association command from kernel.
-   */
-  ASSOCIATION_REQUESTED = 0,
-  AUTH_COMPLETE = 1,
-  ASSOC_COMPLETE = 2,
-  /**
-   * Firmware event indicating auth frames are sent.
-   */
-  FW_AUTH_STARTED = 3,
-  /**
-   * Firmware event indicating assoc frames are sent.
-   */
-  FW_ASSOC_STARTED = 4,
-  /**
-   * Firmware event indicating reassoc frames are sent.
-   */
-  FW_RE_ASSOC_STARTED = 5,
-  DRIVER_SCAN_REQUESTED = 6,
-  DRIVER_SCAN_RESULT_FOUND = 7,
-  DRIVER_SCAN_COMPLETE = 8,
-  BACKGROUND_SCAN_STARTED = 9,
-  BACKGROUND_SCAN_COMPLETE = 10,
-  DISASSOCIATION_REQUESTED = 11,
-  RE_ASSOCIATION_REQUESTED = 12,
-  ROAM_REQUESTED = 13,
-  /**
-   * Received beacon from AP (event enabled  only in verbose mode).
-   */
-  BEACON_RECEIVED = 14,
-  /**
-   * Firmware has triggered a roam scan (not g-scan).
-   */
-  ROAM_SCAN_STARTED = 15,
-  /**
-   * Firmware has completed a roam scan (not g-scan).
-   */
-  ROAM_SCAN_COMPLETE = 16,
-  /**
-   * Firmware has started searching for roam candidates (with reason =xx).
-   */
-  ROAM_SEARCH_STARTED = 17,
-  /**
-   * Firmware has stopped searching for roam candidates (with reason =xx).
-   */
-  ROAM_SEARCH_STOPPED = 18,
-  /**
-   * Received channel switch anouncement from AP.
-   */
-  CHANNEL_SWITCH_ANOUNCEMENT = 20,
-  /**
-   * Firmware start transmit eapol frame, with  EAPOL index 1-4.
-   */
-  FW_EAPOL_FRAME_TRANSMIT_START = 21,
-  /**
-   * Firmware gives up eapol frame, with rate, success/failure and number
-   * retries.
-   */
-  FW_EAPOL_FRAME_TRANSMIT_STOP = 22,
-  /**
-   * Kernel queue EAPOL for transmission  in driver with EAPOL index 1-4.
-   */
-  DRIVER_EAPOL_FRAME_TRANSMIT_REQUESTED = 23,
-  /**
-   * With rate, regardless of the fact that EAPOL frame is accepted or
-   * rejected by firmware.
-   */
-  FW_EAPOL_FRAME_RECEIVED = 24,
-  /**
-   * With rate, and eapol index, driver has received EAPOL frame and will
-   * queue it up to wpa_supplicant.
-   */
-  DRIVER_EAPOL_FRAME_RECEIVED = 26,
-  /**
-   * With success/failure, parameters
-   */
-  BLOCK_ACK_NEGOTIATION_COMPLETE = 27,
-  BT_COEX_BT_SCO_START = 28,
-  BT_COEX_BT_SCO_STOP = 29,
-  /**
-   * For paging/scan etc., when BT starts transmiting twice per BT slot.
-   */
-  BT_COEX_BT_SCAN_START = 30,
-  BT_COEX_BT_SCAN_STOP = 31,
-  BT_COEX_BT_HID_START = 32,
-  BT_COEX_BT_HID_STOP = 33,
-  /**
-   * Firmware sends auth frame in roaming to next candidate.
-   */
-  ROAM_AUTH_STARTED = 34,
-  /**
-   * Firmware receive auth confirm from ap
-   */
-  ROAM_AUTH_COMPLETE = 35,
-  /**
-   * Firmware sends assoc/reassoc frame in roaming to next candidate.
-   */
-  ROAM_ASSOC_STARTED = 36,
-  /**
-   * Firmware receive assoc/reassoc confirm from ap.
-   */
-  ROAM_ASSOC_COMPLETE = 37,
-  /**
-   * Firmware sends stop BACKGROUND_SCAN
-   */
-  BACKGROUND_SCAN_STOP = 38,
-  /**
-   * Firmware indicates BACKGROUND_SCAN scan cycle started.
-   */
-  BACKGROUND_SCAN_CYCLE_STARTED = 39,
-  /**
-   * Firmware indicates BACKGROUND_SCAN scan cycle completed.
-   */
-  BACKGROUND_SCAN_CYCLE_COMPLETED = 40,
-  /**
-   * Firmware indicates BACKGROUND_SCAN scan start for a particular bucket.
-   */
-  BACKGROUND_SCAN_BUCKET_STARTED = 41,
-  /**
-   * Firmware indicates BACKGROUND_SCAN scan completed for for a particular bucket.
-   */
-  BACKGROUND_SCAN_BUCKET_COMPLETED = 42,
-  /**
-   * Event received from firmware about BACKGROUND_SCAN scan results being available.
-   */
-  BACKGROUND_SCAN_RESULTS_AVAILABLE = 43,
-  /**
-   * Event received from firmware with BACKGROUND_SCAN capabilities.
-   */
-  BACKGROUND_SCAN_CAPABILITIES = 44,
-  /**
-   * Event received from firmware when eligible candidate is found.
-   */
-  ROAM_CANDIDATE_FOUND = 45,
-  /**
-   * Event received from firmware when roam scan configuration gets
-   * enabled or disabled.
-   */
-  ROAM_SCAN_CONFIG = 46,
-  /**
-   * Firmware/driver timed out authentication.
-   */
-  AUTH_TIMEOUT = 47,
-  /**
-   * Firmware/driver timed out association.
-   */
-  ASSOC_TIMEOUT = 48,
-  /**
-   * Firmware/driver encountered allocation failure.
-   */
-  MEM_ALLOC_FAILURE = 49,
-  /**
-   * Driver added a PNO network in firmware.
-   */
-  DRIVER_PNO_ADD = 50,
-  /**
-   * Driver removed a PNO network in firmware.
-   */
-  DRIVER_PNO_REMOVE = 51,
-  /**
-   * Driver received PNO networks found indication from firmware.
-   */
-  DRIVER_PNO_NETWORK_FOUND = 52,
-  /**
-   * Driver triggered a scan for PNO networks.
-   */
-  DRIVER_PNO_SCAN_REQUESTED = 53,
-  /**
-   * Driver received scan results  of PNO networks.
-   */
-  DRIVER_PNO_SCAN_RESULT_FOUND = 54,
-  /**
-   * Driver updated scan results from  PNO networks to cfg80211.
-   */
-  DRIVER_PNO_SCAN_COMPLETE = 55,
-};
-
-/**
- * Parameters of the various events are a sequence of TLVs
- * (type, length, value). The types for different TLV's are defined below.
- */
-enum WifiDebugRingEntryEventTlvType : uint16_t {
-  /**
-   * Take a byte stream as parameter.
-   */
-  VENDOR_SPECIFIC = 0,
-  /**
-   * Takes a MAC address as parameter.
-   */
-  BSSID = 1,
-  /**
-   * Takes a MAC address as parameter.
-   */
-  ADDR = 2,
-  /**
-   * Takes an SSID as parameter.
-   */
-  SSID = 3,
-  /**
-   * Takes an integer as parameter.
-   */
-  STATUS = 4,
-  /**
-   * Takes a |WifiChannelInfo| struct as parameter.
-   */
-  CHANNEL_SPEC = 5,
-  /**
-   * Takes a MAC address as parameter.
-   */
-  ADDR_1 = 6,
-  /**
-   * Takes a MAC address as parameter.
-   */
-  ADDR_2 = 7,
-  /**
-   * Takes a MAC address as parameter.
-   */
-  ADDR_3 = 8,
-  /**
-   * Takes a MAC address as parameter.
-   */
-  ADDR_4 = 9,
-  /**
-   * Takes a TSF value as parameter.
-   */
-  TSF = 10,
-  /**
-   * Takes one or more specific 802.11 IEs parameter IEs are in turn
-   * indicated in TLV format as per 802.11, spec.
-   */
-  IE = 11,
-  /**
-   * Takes a string interface name as parameter.
-   */
-  IFACE_NAME = 12,
-  /**
-   * Takes a integer reason code as per 802.11 as parameter.
-   */
-  REASON_CODE = 13,
-  /**
-   * Takes an integer representing wifi rate in 1 mbps as parameter.
-   */
-  RATE_MBPS = 14,
-  /**
-   * Takes an integer as parameter.
-   */
-  REQUEST_ID = 15,
-  /**
-   * Takes an integer as parameter.
-   */
-  BUCKET_ID = 16,
-  /**
-   * Takes a |BackgroundScanParameters| struct as parameter.
-   */
-  BACKGROUND_SCAN_PARAMS = 17,
-  /**
-   * Takes a |BackgroundScanCapabilities| struct as parameter.
-   */
-  BACKGROUND_SCAN_CAPABILITIES = 18,
-  /**
-   * Takes an integer as parameter.
-   */
-  SCAN_ID = 19,
-  /**
-   * Takes an integer as parameter.
-   */
-  RSSI = 20,
-  /**
-   * Takes a |WifiChannelInMhz| as parameter.
-   */
-  CHANNEL = 21,
-  /**
-   * Takes an integer as parameter.
-   */
-  LINK_ID = 22,
-  /**
-   * Takes an integer as parameter.
-   */
-  LINK_ROLE = 23,
-  /**
-   * Takes an integer as parameter.
-   */
-  LINK_STATE = 24,
-  /**
-   * Takes an integer as parameter.
-   */
-  LINK_TYPE = 25,
-  /**
-   * Takes an integer as parameter.
-   */
-  TSCO = 26,
-  /**
-   * Takes an integer as parameter.
-   */
-  RSCO = 27,
-  /**
-   * Takes an integer as parameter.
-   * M1=1, M2=2, M3=3, M=4,
-   */
-  EAPOL_MESSAGE_TYPE = 28,
-};
-
-/**
- * Used to describe a specific TLV in an event entry.
- */
-struct WifiDebugRingEntryEventTlv {
-  WifiDebugRingEntryEventTlvType type;
-  /**
-   * All possible types of values that can be held in the TLV.
-   * Note: This should ideally be a union. But, since this HIDL package
-   * is going to be used by a java client, we cannot have unions in this
-   * package.
-   */
-  /* TODO(b/32207606): This can be moved to vendor extension. */
-  vec<uint8_t> vendorSpecific;
-  Bssid bssid;
-  MacAddress addr;
-  Ssid ssid;
-  WifiChannelInfo channelSpec;
-  uint64_t tsf;
-  vec<WifiInformationElement> ie;
-  string ifaceName;
-  StaBackgroundScanParameters bgScanParams;
-  StaBackgroundScanCapabilities bgScanCapabilities;
-  Rssi rssi;
-  WifiChannelInMhz channel;
-  uint32_t integerVal;
-};
-
-/**
- * Used to describe a connect event ring entry.
- */
-struct WifiDebugRingEntryConnectivityEvent {
-  /**
-   * Ring entry header.
-   */
-  WifiDebugRingEntryHeader header;
-  /**
-   * Type of connection event.
-   */
-  WifiDebugRingEntryEventType event;
-  /**
-   * Separate parameter structure per event to be provided and optional data.
-   * The event data is expected to include an official android part, with some
-   * parameter as transmit rate, num retries, num scan result found, etc.
-   * event data can include a vendor proprietary part which is understood by
-   * the vendor only.
-   */
-  vec<WifiDebugRingEntryEventTlv> tlvs;
-};
-
-/**
- * Used to describe a power event ring entry.
- */
-struct WifiDebugRingEntryPowerEvent {
-  /**
-   * Ring entry header.
-   */
-  WifiDebugRingEntryHeader header;
-  /**
-   * Type of power event.
-   */
-  WifiDebugRingEntryEventType event;
-  /**
-   * Separate parameter structure per event to be provided and optional data.
-   * The event data is expected to include an official android part, with some
-   * parameter as transmit rate, num retries, num scan result found, etc.
-   * event data can include a vendor proprietary part which is understood by
-   * the vendor only.
-   */
-  vec<WifiDebugRingEntryEventTlv> tlvs;
-};
-
-/**
- * Used to describe a wakelock event ring entry.
- */
-struct WifiDebugRingEntryWakelockEvent {
-  /**
-   * Ring entry header.
-   */
-  WifiDebugRingEntryHeader header;
-  /**
-   * true = wake lock acquired.
-   * false = wake lock released.
-   */
-  bool wasAcquired;
-  /**
-   * Reason why this wake lock is taken.
-   * This is a vendor defined reason and can only be understood by the
-   * vendor.
-   */
-  uint32_t vendorSpecificReason;
-  /**
-   * Wake lock name.
-   */
-  string wakelockName;
-};
-
-/**
- * Used to describe a vendor specific data ring entry.
- */
-struct WifiDebugRingEntryVendorData {
-  /**
-   * Ring entry header.
-   */
-  WifiDebugRingEntryHeader header;
-  /**
-   * This is a blob that will only be understood by the
-   * vendor.
-   */
-  vec<uint8_t> vendorData;
-};
-
-/**
  * Flags describing each debug ring buffer.
  */
 enum WifiDebugRingBufferFlags : uint32_t {
diff --git a/wifi/supplicant/1.0/ISupplicant.hal b/wifi/supplicant/1.0/ISupplicant.hal
index 32d73da..34cea18 100644
--- a/wifi/supplicant/1.0/ISupplicant.hal
+++ b/wifi/supplicant/1.0/ISupplicant.hal
@@ -44,14 +44,14 @@
    * controlled by the supplicant.
    */
   struct IfaceInfo {
-      /**
-       * Type of the network interface.
-       */
-      IfaceType type;
-      /**
-       * Name of the network interface, e.g., wlan0
-       */
-      string name;
+    /**
+     * Type of the network interface.
+     */
+    IfaceType type;
+    /**
+     * Name of the network interface, e.g., wlan0
+     */
+    string name;
   };
 
   /**
diff --git a/wifi/supplicant/1.0/ISupplicantP2pIface.hal b/wifi/supplicant/1.0/ISupplicantP2pIface.hal
index 0cdac2d..0fa19c8 100644
--- a/wifi/supplicant/1.0/ISupplicantP2pIface.hal
+++ b/wifi/supplicant/1.0/ISupplicantP2pIface.hal
@@ -60,6 +60,22 @@
   };
 
   /**
+   * Enum describing the modes of Miracast supported
+   * via driver commands.
+   */
+  enum MiracastMode : uint8_t {
+    DISABLED = 0,
+    /**
+     * Operating as source.
+     */
+    SOURCE = 1,
+    /**
+     * Operating as sink.
+     */
+    SINK = 2
+  };
+
+  /**
    * Register for callbacks from this interface.
    *
    * These callbacks are invoked for events that are specific to this interface.
@@ -341,8 +357,7 @@
    *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
    *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
    */
-  configureExtListen(bool enable,
-                     uint32_t periodInMillis,
+  configureExtListen(uint32_t periodInMillis,
                      uint32_t intervalInMillis)
       generates (SupplicantStatus status);
 
@@ -476,8 +491,7 @@
    *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
    *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
    */
-  flushServices(uint32_t version, string serviceName)
-      generates (SupplicantStatus status);
+  flushServices() generates (SupplicantStatus status);
 
   /**
    * Schedule a P2P service discovery request. The parameters for this command
@@ -511,4 +525,16 @@
    */
   cancelServiceDiscovery(uint64_t identifier)
       generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to set Miracast mode.
+   *
+   * @param mode Mode of Miracast.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  setMiracastMode(MiracastMode mode)
+      generates (SupplicantStatus status);
 };
diff --git a/wifi/supplicant/1.0/ISupplicantStaIface.hal b/wifi/supplicant/1.0/ISupplicantStaIface.hal
index 31706cd..2fc4d0f 100644
--- a/wifi/supplicant/1.0/ISupplicantStaIface.hal
+++ b/wifi/supplicant/1.0/ISupplicantStaIface.hal
@@ -49,6 +49,25 @@
   };
 
   /**
+   * Enum describing the types of RX filter supported
+   * via driver commands.
+   */
+  enum RxFilterType : uint8_t {
+    V4_MULTICAST = 0,
+    V6_MULTICAST = 1
+  };
+
+  /**
+   * Enum describing the modes of BT coexistence supported
+   * via driver commands.
+   */
+  enum BtCoexistenceMode : uint8_t {
+    ENABLED = 0,
+    DISABLED = 1,
+    SENSE = 2
+  };
+
+  /**
    * Register for callbacks from this interface.
    *
    * These callbacks are invoked for events that are specific to this interface.
@@ -120,7 +139,7 @@
   setPowerSave(bool enable) generates (SupplicantStatus status);
 
   /**
-   * Initiate TDLS discover with the provided peer mac address.
+   * Initiate TDLS discover with the provided peer MAC address.
    *
    * @param macAddress MAC address of the peer.
    * @return status Status of the operation.
@@ -133,7 +152,7 @@
       generates (SupplicantStatus status);
 
   /**
-   * Initiate TDLS setup with the provided peer mac address.
+   * Initiate TDLS setup with the provided peer MAC address.
    *
    * @param macAddress MAC address of the peer.
    * @return status Status of the operation.
@@ -146,7 +165,7 @@
       generates (SupplicantStatus status);
 
   /**
-   * Initiate TDLS teardown with the provided peer mac address.
+   * Initiate TDLS teardown with the provided peer MAC address.
    *
    * @param macAddress MAC address of the peer.
    * @return status Status of the operation.
@@ -193,4 +212,111 @@
    */
   initiateHs20IconQuery(MacAddress macAddress, string fileName)
       generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to get MAC address of the device.
+   *
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   * @return macAddr MAC address of the device.
+   */
+  getMacAddress()
+      generates (SupplicantStatus status, MacAddress macAddr);
+
+  /**
+   * Send driver command to start RX filter.
+   *
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  startRxFilter() generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to stop RX filter.
+   *
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  stopRxFilter() generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to add the specified RX filter.
+   *
+   * @param type Type of filter.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  addRxFilter(RxFilterType type)
+      generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to remove the specified RX filter.
+   *
+   * @param type Type of filter.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  removeRxFilter(RxFilterType type)
+      generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to set Bluetooth coexistence mode.
+   *
+   * @param mode Mode of Bluetooth coexistence.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  setBtCoexistenceMode(BtCoexistenceMode mode)
+      generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to set Bluetooth coexistence scan mode.
+   * When this mode is on, some of the low-level scan parameters
+   * used by the driver are changed to reduce interference
+   * with A2DP streaming.
+   *
+   * @param enable true to enable, false to disable.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  setBtCoexistenceScanModeEnabled(bool enable)
+      generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to set suspend optimizations for power save.
+   *
+   * @param enable true to enable, false to disable.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  setSuspendModeEnabled(bool enable)
+      generates (SupplicantStatus status);
+
+  /**
+   * Send driver command to set country code.
+   *
+   * @param code 2 byte country code (as defined in ISO 3166) to set.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+   */
+  setCountryCode(int8_t[2] code)
+      generates (SupplicantStatus status);
 };