diff --git a/bluetooth/aidl/default/Android.bp b/bluetooth/aidl/default/Android.bp
index 32d1a13..3f4ba99 100644
--- a/bluetooth/aidl/default/Android.bp
+++ b/bluetooth/aidl/default/Android.bp
@@ -30,15 +30,8 @@
     defaults: ["android.hardware.bluetooth-service-build-defaults"],
     srcs: [
         "BluetoothHci.cpp",
-        ":BluetoothPacketSources",
         "net_bluetooth_mgmt.cpp",
     ],
-    generated_headers: [
-        "BluetoothGeneratedPackets_h",
-    ],
-    include_dirs: [
-        "packages/modules/Bluetooth/system/gd",
-    ],
 }
 
 cc_binary {
diff --git a/bluetooth/aidl/default/BluetoothHci.cpp b/bluetooth/aidl/default/BluetoothHci.cpp
index ac2eabc..afe153a 100644
--- a/bluetooth/aidl/default/BluetoothHci.cpp
+++ b/bluetooth/aidl/default/BluetoothHci.cpp
@@ -29,11 +29,6 @@
 
 #include "log/log.h"
 
-// TODO: Remove custom logging defines from PDL packets.
-#undef LOG_INFO
-#undef LOG_DEBUG
-#include "hci/hci_packets.h"
-
 namespace {
 int SetTerminalRaw(int fd) {
   termios terminal_settings;
@@ -127,9 +122,7 @@
 void BluetoothHci::reset() {
   // Send a reset command and wait until the command complete comes back.
 
-  std::vector<uint8_t> reset;
-  ::bluetooth::packet::BitInserter bi{reset};
-  ::bluetooth::hci::ResetBuilder::Create()->Serialize(bi);
+  std::vector<uint8_t> reset = {0x03, 0x0c, 0x00};
 
   auto resetPromise = std::make_shared<std::promise<void>>();
   auto resetFuture = resetPromise->get_future();
@@ -149,13 +142,15 @@
               static_cast<int>(raw_sco.size()));
       },
       [resetPromise](const std::vector<uint8_t>& raw_event) {
-        bool valid = ::bluetooth::hci::ResetCompleteView::Create(
-                         ::bluetooth::hci::CommandCompleteView::Create(
-                             ::bluetooth::hci::EventView::Create(
-                                 ::bluetooth::hci::PacketView<true>(
-                                     std::make_shared<std::vector<uint8_t>>(
-                                         raw_event)))))
-                         .IsValid();
+        std::vector<uint8_t> reset_complete = {0x0e, 0x04, 0x01,
+                                               0x03, 0x0c, 0x00};
+        bool valid = raw_event.size() == 6 &&
+                     raw_event[0] == reset_complete[0] &&
+                     raw_event[1] == reset_complete[1] &&
+                     // Don't compare the number of packets field.
+                     raw_event[3] == reset_complete[3] &&
+                     raw_event[4] == reset_complete[4] &&
+                     raw_event[5] == reset_complete[5];
         if (valid) {
           resetPromise->set_value();
         } else {
@@ -221,6 +216,7 @@
     ALOGI("Unable to open Linux interface, trying default path.");
     mFd = getFdFromDevPath();
     if (mFd < 0) {
+      mState = HalState::READY;
       cb->initializationComplete(Status::UNABLE_TO_OPEN_INTERFACE);
       return ndk::ScopedAStatus::ok();
     }
@@ -278,6 +274,8 @@
   {
     std::lock_guard<std::mutex> guard(mStateMutex);
     if (mState != HalState::ONE_CLIENT) {
+      LOG_ALWAYS_FATAL_IF(mState == HalState::INITIALIZING,
+                          "mState is INITIALIZING");
       ALOGI("Already closed");
       return ndk::ScopedAStatus::ok();
     }
diff --git a/bluetooth/aidl/vts/Android.bp b/bluetooth/aidl/vts/Android.bp
index 5fc0b2e..ade3bef 100644
--- a/bluetooth/aidl/vts/Android.bp
+++ b/bluetooth/aidl/vts/Android.bp
@@ -16,10 +16,6 @@
     srcs: [
         "VtsHalBluetoothTargetTest.cpp",
         ":BluetoothPacketSources",
-        ":BluetoothHciPacketSources",
-    ],
-    generated_headers: [
-        "BluetoothGeneratedPackets_h",
     ],
     include_dirs: [
         "packages/modules/Bluetooth/system/gd",
@@ -31,7 +27,7 @@
     ],
     static_libs: [
         "android.hardware.bluetooth-V1-ndk",
-        "libbluetooth-types",
+        "libbluetooth_hci_pdl",
     ],
     test_config: "VtsHalBluetoothTargetTest.xml",
     test_suites: [
@@ -57,6 +53,5 @@
     ],
     tidy_disabled_srcs: [
         ":BluetoothPacketSources",
-        ":BluetoothHciPacketSources",
     ],
 }
diff --git a/bluetooth/audio/aidl/Android.bp b/bluetooth/audio/aidl/Android.bp
index 32f8cca..16b22fe 100644
--- a/bluetooth/audio/aidl/Android.bp
+++ b/bluetooth/audio/aidl/Android.bp
@@ -29,7 +29,7 @@
     imports: [
         "android.hardware.common-V2",
         "android.hardware.common.fmq-V1",
-        "android.hardware.audio.common-V1",
+        "android.hardware.audio.common-V2",
     ],
     backend: {
         cpp: {
@@ -69,7 +69,7 @@
             imports: [
                 "android.hardware.common-V2",
                 "android.hardware.common.fmq-V1",
-                "android.hardware.audio.common-V1",
+                "android.hardware.audio.common-V2",
             ],
         },
 
diff --git a/bluetooth/audio/aidl/vts/Android.bp b/bluetooth/audio/aidl/vts/Android.bp
index 3e6953f..fa85fa8 100644
--- a/bluetooth/audio/aidl/vts/Android.bp
+++ b/bluetooth/audio/aidl/vts/Android.bp
@@ -16,7 +16,7 @@
     tidy_timeout_srcs: ["VtsHalBluetoothAudioTargetTest.cpp"],
     srcs: ["VtsHalBluetoothAudioTargetTest.cpp"],
     static_libs: [
-        "android.hardware.audio.common-V1-ndk",
+        "android.hardware.audio.common-V2-ndk",
         "android.hardware.bluetooth.audio-V3-ndk",
         "android.hardware.common-V2-ndk",
         "android.hardware.common.fmq-V1-ndk",
diff --git a/compatibility_matrices/compatibility_matrix.9.xml b/compatibility_matrices/compatibility_matrix.9.xml
index 188746d..2f18a38 100644
--- a/compatibility_matrices/compatibility_matrix.9.xml
+++ b/compatibility_matrices/compatibility_matrix.9.xml
@@ -727,4 +727,12 @@
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.threadnetwork</name>
+        <version>1</version>
+        <interface>
+            <name>IThreadChip</name>
+            <regex-instance>chip[0-9]+</regex-instance>
+        </interface>
+    </hal>
 </compatibility-matrix>
diff --git a/staging/threadnetwork/OWNERS b/staging/threadnetwork/OWNERS
deleted file mode 100644
index 037215d..0000000
--- a/staging/threadnetwork/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Bug component: 1203089
-
-wgtdkp@google.com
-xyk@google.com
-zhanglongxia@google.com
diff --git a/staging/threadnetwork/README.md b/staging/threadnetwork/README.md
deleted file mode 100644
index 12104e5..0000000
--- a/staging/threadnetwork/README.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Staging threadnetwork HAL interface
-
-The directory includes the unstable/unreleased version of `hardware/interfaces/threadnetwork`
-code which should **NOT** be used in production. But vendors may start verifying their hardware
-with the HAL interface.
-
-This directory will be cleaned up when the stable Thread HAL interface is added in
-`hardware/interfaces/threadnetwork` by version `V` or later.
-
-More information about _Thread_:
-- https://www.threadgroup.org
-- https://openthread.io
diff --git a/staging/threadnetwork/aidl/Android.bp b/staging/threadnetwork/aidl/Android.bp
deleted file mode 100644
index b59d6da..0000000
--- a/staging/threadnetwork/aidl/Android.bp
+++ /dev/null
@@ -1,26 +0,0 @@
-package {
-    // See: http://go/android-license-faq
-    // A large-scale-change added 'default_applicable_licenses' to import
-    // all of the 'license_kinds' from "hardware_interfaces_license"
-    // to get the below license kinds:
-    //   SPDX-license-identifier-Apache-2.0
-    default_applicable_licenses: ["hardware_interfaces_license"],
-}
-
-aidl_interface {
-    name: "android.hardware.threadnetwork",
-    host_supported: true,
-    vendor_available: true,
-
-    srcs: [
-        "android/hardware/threadnetwork/*.aidl",
-    ],
-
-    unstable: true,
-
-    backend: {
-        ndk: {
-            enabled: true,
-        },
-    },
-}
diff --git a/staging/threadnetwork/aidl/default/Android.bp b/staging/threadnetwork/aidl/default/Android.bp
deleted file mode 100644
index 8fc22ad..0000000
--- a/staging/threadnetwork/aidl/default/Android.bp
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright (C) 2022 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
-    // See: http://go/android-license-faq
-    // A large-scale-change added 'default_applicable_licenses' to import
-    // all of the 'license_kinds' from "hardware_interfaces_license"
-    // to get the below license kinds:
-    //   SPDX-license-identifier-Apache-2.0
-    default_applicable_licenses: ["hardware_interfaces_license"],
-}
-
-cc_defaults {
-    name: "threadnetwork_service_default",
-    vendor: true,
-    relative_install_path: "hw",
-
-    shared_libs: [
-        "android.hardware.threadnetwork-ndk",
-        "libbase",
-        "libbinder_ndk",
-        "libcutils",
-        "liblog",
-        "libutils",
-    ],
-
-    static_libs: [
-        "openthread-common",
-        "openthread-hdlc",
-        "openthread-platform",
-        "openthread-posix",
-        "openthread-url",
-    ],
-
-    srcs: [
-        "main.cpp",
-        "service.cpp",
-        "thread_chip.cpp",
-        "utils.cpp",
-    ],
-}
-
-cc_binary {
-    name: "android.hardware.threadnetwork-service.sim",
-    defaults: ["threadnetwork_service_default"],
-    init_rc: ["android.hardware.threadnetwork-service.sim.rc"],
-}
-
-cc_binary {
-    name: "android.hardware.threadnetwork-service",
-    defaults: ["threadnetwork_service_default"],
-}
diff --git a/staging/threadnetwork/aidl/default/main.cpp b/staging/threadnetwork/aidl/default/main.cpp
deleted file mode 100644
index b6c8bbb..0000000
--- a/staging/threadnetwork/aidl/default/main.cpp
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <android-base/logging.h>
-#include <utils/Log.h>
-
-#include "service.hpp"
-
-int main(int argc, char* argv[]) {
-    CHECK_GT(argc, 1);
-    aidl::android::hardware::threadnetwork::Service service(&argv[1], argc - 1);
-
-    ALOGI("Thread Network HAL is running");
-
-    service.startLoop();
-    return EXIT_FAILURE;  // should not reach
-}
diff --git a/staging/threadnetwork/aidl/default/utils.cpp b/staging/threadnetwork/aidl/default/utils.cpp
deleted file mode 100644
index d3b4062..0000000
--- a/staging/threadnetwork/aidl/default/utils.cpp
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <openthread/logging.h>
-#include <utils/Log.h>
-
-void otLogCritPlat(const char* format, ...) {
-    va_list args;
-
-    va_start(args, format);
-    __android_log_vprint(ANDROID_LOG_FATAL, LOG_TAG, format, args);
-    va_end(args);
-}
-
-void otLogWarnPlat(const char* format, ...) {
-    va_list args;
-
-    va_start(args, format);
-    __android_log_vprint(ANDROID_LOG_WARN, LOG_TAG, format, args);
-    va_end(args);
-}
diff --git a/threadnetwork/aidl/Android.bp b/threadnetwork/aidl/Android.bp
new file mode 100644
index 0000000..5aa16a7
--- /dev/null
+++ b/threadnetwork/aidl/Android.bp
@@ -0,0 +1,26 @@
+aidl_interface {
+    name: "android.hardware.threadnetwork",
+    owner: "google",
+    vendor_available: true,
+    srcs: [
+        "android/hardware/threadnetwork/*.aidl",
+    ],
+
+    stability: "vintf",
+
+    backend: {
+        java: {
+            platform_apis: true,
+        },
+        ndk: {
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.tethering",
+                // Keep the threadnetwork apex to make it buildable on udc-mainline-prod.
+                // TODO: remove it after moving ot-daemon into tethering.
+                "com.android.threadnetwork",
+            ],
+            min_sdk_version: "30",
+        },
+    },
+}
diff --git a/threadnetwork/aidl/OWNERS b/threadnetwork/aidl/OWNERS
new file mode 100644
index 0000000..e3111c8
--- /dev/null
+++ b/threadnetwork/aidl/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 1288834
+zhanglongxia@google.com
+xyk@google.com
diff --git a/threadnetwork/aidl/aidl_api/android.hardware.threadnetwork/current/android/hardware/threadnetwork/IThreadChip.aidl b/threadnetwork/aidl/aidl_api/android.hardware.threadnetwork/current/android/hardware/threadnetwork/IThreadChip.aidl
new file mode 100644
index 0000000..607ceb3
--- /dev/null
+++ b/threadnetwork/aidl/aidl_api/android.hardware.threadnetwork/current/android/hardware/threadnetwork/IThreadChip.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.threadnetwork;
+@VintfStability
+interface IThreadChip {
+  void open(in android.hardware.threadnetwork.IThreadChipCallback callback);
+  void close();
+  void hardwareReset();
+  void sendSpinelFrame(in byte[] frame);
+  const int ERROR_FAILED = 1;
+  const int ERROR_NO_BUFS = 2;
+  const int ERROR_BUSY = 3;
+}
diff --git a/threadnetwork/aidl/aidl_api/android.hardware.threadnetwork/current/android/hardware/threadnetwork/IThreadChipCallback.aidl b/threadnetwork/aidl/aidl_api/android.hardware.threadnetwork/current/android/hardware/threadnetwork/IThreadChipCallback.aidl
new file mode 100644
index 0000000..e86b3ec
--- /dev/null
+++ b/threadnetwork/aidl/aidl_api/android.hardware.threadnetwork/current/android/hardware/threadnetwork/IThreadChipCallback.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.threadnetwork;
+@VintfStability
+interface IThreadChipCallback {
+  oneway void onReceiveSpinelFrame(in byte[] frame);
+}
diff --git a/staging/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChip.aidl b/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChip.aidl
similarity index 87%
rename from staging/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChip.aidl
rename to threadnetwork/aidl/android/hardware/threadnetwork/IThreadChip.aidl
index 3c57149..e695623 100644
--- a/staging/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChip.aidl
+++ b/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChip.aidl
@@ -22,6 +22,7 @@
  * Controls a Thread radio chip on the device.
  */
 
+@VintfStability
 interface IThreadChip {
     /**
      * The operation failed for the internal error.
@@ -43,10 +44,10 @@
      * successfully, then the Thread HAL instance is ready to accept spinel
      * messages through sendSpinelFrame() API.
      *
-     * @param callback  A IThreadChipCallback callback instance. If multiple
-     *                  callbacks are passed in, the open() will return ERROR_BUSY.
+     * @param callback  A IThreadChipCallback callback instance.
      *
      * @throws EX_ILLEGAL_ARGUMENT  if the callback handle is invalid (for example, it is null).
+     *
      * @throws ServiceSpecificException with one of the following values:
      *     - ERROR_FAILED        The interface cannot be opened due to an internal error.
      *     - ERROR_BUSY          This interface is in use.
@@ -55,18 +56,18 @@
 
     /**
      * Close the Thread HAL instance. Must free all resources.
-     *
-     * @throws EX_ILLEGAL_STATE  if the Thread HAL instance is not opened.
-     *
      */
     void close();
 
     /**
-     * This method resets the Thread HAL internal state. The callback registered by
-     * `open()` won’t be reset and the resource allocated by `open()` won’t be free.
+     * This method hardware resets the Thread radio chip via the physical reset pin.
+     * The callback registered by `open()` won’t be reset and the resource allocated
+     * by `open()` won’t be free.
+     *
+     * @throws EX_UNSUPPORTED_OPERATION  if the Thread radio chip doesn't support the hardware reset.
      *
      */
-    void reset();
+    void hardwareReset();
 
     /**
      * This method sends a spinel frame to the Thread HAL.
diff --git a/staging/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChipCallback.aidl b/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChipCallback.aidl
similarity index 98%
rename from staging/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChipCallback.aidl
rename to threadnetwork/aidl/android/hardware/threadnetwork/IThreadChipCallback.aidl
index a0fe88c..046edc3 100644
--- a/staging/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChipCallback.aidl
+++ b/threadnetwork/aidl/android/hardware/threadnetwork/IThreadChipCallback.aidl
@@ -16,6 +16,7 @@
 
 package android.hardware.threadnetwork;
 
+@VintfStability
 interface IThreadChipCallback {
     /**
      * This method is called when a spinel frame is received. Thread network
diff --git a/threadnetwork/aidl/default/Android.bp b/threadnetwork/aidl/default/Android.bp
new file mode 100644
index 0000000..bcd5704
--- /dev/null
+++ b/threadnetwork/aidl/default/Android.bp
@@ -0,0 +1,87 @@
+//
+//  Copyright (c) 2022 Google LLC.
+//  All rights reserved.
+//
+//  This document is the property of Google LLC, Inc. It is
+//  considered proprietary and confidential information.
+//
+//  This document may not be reproduced or transmitted in any form,
+//  in whole or in part, without the express written permission of
+//  Google LLC.
+
+cc_defaults {
+    name: "threadnetwork_service_default",
+    vintf_fragments: ["threadnetwork-default.xml"],
+    vendor: true,
+    relative_install_path: "hw",
+
+    shared_libs: [
+        "android.hardware.threadnetwork-V1-ndk",
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+        "liblog",
+        "libutils",
+    ],
+
+    static_libs: [
+        "openthread-common",
+        "openthread-hdlc",
+        "openthread-platform",
+        "openthread-posix",
+        "openthread-spi",
+        "openthread-url",
+    ],
+
+    srcs: [
+        "main.cpp",
+        "service.cpp",
+        "thread_chip.cpp",
+        "utils.cpp",
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.threadnetwork-service.sim",
+    defaults: ["threadnetwork_service_default"],
+    init_rc: ["android.hardware.threadnetwork-service.sim.rc"],
+    required: ["ot-rcp"],
+}
+
+cc_binary {
+    name: "android.hardware.threadnetwork-service",
+    defaults: ["threadnetwork_service_default"],
+}
+
+cc_fuzz {
+    name: "android.hardware.threadnetwork-service.fuzzer",
+
+    defaults:["service_fuzzer_defaults"],
+    shared_libs: [
+        "libbinder_ndk",
+    ],
+
+    static_libs: [
+        "android.hardware.threadnetwork-V1-ndk",
+        "libbase",
+        "liblog",
+        "openthread-common",
+        "openthread-hdlc",
+        "openthread-platform",
+        "openthread-posix",
+        "openthread-spi",
+        "openthread-url",
+    ],
+
+    srcs: [
+        "thread_chip.cpp",
+        "utils.cpp",
+        "fuzzer.cpp",
+    ],
+
+    fuzz_config: {
+        cc: [
+            "zhanglongxia@google.com",
+        ],
+    },
+}
diff --git a/staging/threadnetwork/aidl/default/android.hardware.threadnetwork-service.sim.rc b/threadnetwork/aidl/default/android.hardware.threadnetwork-service.sim.rc
similarity index 100%
rename from staging/threadnetwork/aidl/default/android.hardware.threadnetwork-service.sim.rc
rename to threadnetwork/aidl/default/android.hardware.threadnetwork-service.sim.rc
diff --git a/threadnetwork/aidl/default/fuzzer.cpp b/threadnetwork/aidl/default/fuzzer.cpp
new file mode 100644
index 0000000..fb6e548
--- /dev/null
+++ b/threadnetwork/aidl/default/fuzzer.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fuzzbinder/libbinder_ndk_driver.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include "thread_chip.hpp"
+
+using aidl::android::hardware::threadnetwork::ThreadChip;
+using android::fuzzService;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    char url[] = "spinel+hdlc+null:///dev/null";
+    auto service = ndk::SharedRefBase::make<ThreadChip>(url);
+
+    fuzzService(service->asBinder().get(), FuzzedDataProvider(data, size));
+
+    return 0;
+}
+
diff --git a/threadnetwork/aidl/default/main.cpp b/threadnetwork/aidl/default/main.cpp
new file mode 100644
index 0000000..8419041
--- /dev/null
+++ b/threadnetwork/aidl/default/main.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <aidl/android/hardware/threadnetwork/IThreadChip.h>
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <utils/Log.h>
+
+#include "service.hpp"
+#include "thread_chip.hpp"
+
+using aidl::android::hardware::threadnetwork::IThreadChip;
+using aidl::android::hardware::threadnetwork::ThreadChip;
+
+int main(int argc, char* argv[]) {
+    CHECK_GT(argc, 1);
+    std::vector<std::shared_ptr<ThreadChip>> threadChips;
+    aidl::android::hardware::threadnetwork::Service service;
+
+    for (int id = 0; id < argc - 1; id++) {
+        binder_status_t status;
+        const std::string serviceName(std::string() + IThreadChip::descriptor + "/chip" +
+                                      std::to_string(id));
+        auto threadChip = ndk::SharedRefBase::make<ThreadChip>(argv[id + 1]);
+
+        CHECK_NE(threadChip, nullptr);
+
+        status = AServiceManager_addService(threadChip->asBinder().get(), serviceName.c_str());
+        CHECK_EQ(status, STATUS_OK);
+
+        ALOGI("ServiceName: %s, Url: %s", serviceName.c_str(), argv[id + 1]);
+        threadChips.push_back(std::move(threadChip));
+    }
+
+    ALOGI("Thread Network HAL is running");
+
+    service.startLoop();
+    return EXIT_FAILURE;  // should not reach
+}
diff --git a/staging/threadnetwork/aidl/default/service.cpp b/threadnetwork/aidl/default/service.cpp
similarity index 75%
rename from staging/threadnetwork/aidl/default/service.cpp
rename to threadnetwork/aidl/default/service.cpp
index 8047214..7f583f4 100644
--- a/staging/threadnetwork/aidl/default/service.cpp
+++ b/threadnetwork/aidl/default/service.cpp
@@ -20,38 +20,24 @@
 #include <android/binder_process.h>
 #include <utils/Log.h>
 
-#include "thread_chip.hpp"
-
 namespace aidl {
 namespace android {
 namespace hardware {
 namespace threadnetwork {
 
-Service::Service(char* urls[], int numUrls) : mBinderFd(-1) {
-    int fd;
-
-    CHECK_NE(urls, nullptr);
-    CHECK_GT(numUrls, 0);
-
-    for (int i = 0; i < numUrls; i++) {
-        auto threadChip = ndk::SharedRefBase::make<ThreadChip>(i, urls[i]);
-        CHECK_NE(threadChip, nullptr);
-        mThreadChips.push_back(std::move(threadChip));
-    }
-
-    binder_status_t status = ABinderProcess_setupPolling(&fd);
+Service::Service(void) : mBinderFd(-1) {
+    binder_status_t status = ABinderProcess_setupPolling(&mBinderFd);
     CHECK_EQ(status, ::STATUS_OK);
-    CHECK_GE(fd, 0);
-    mBinderFd.reset(fd);
+    CHECK_GE(mBinderFd, 0);
 }
 
 void Service::Update(otSysMainloopContext& context) {
-    FD_SET(mBinderFd.get(), &context.mReadFdSet);
-    context.mMaxFd = std::max(context.mMaxFd, mBinderFd.get());
+    FD_SET(mBinderFd, &context.mReadFdSet);
+    context.mMaxFd = std::max(context.mMaxFd, mBinderFd);
 }
 
 void Service::Process(const otSysMainloopContext& context) {
-    if (FD_ISSET(mBinderFd.get(), &context.mReadFdSet)) {
+    if (FD_ISSET(mBinderFd, &context.mReadFdSet)) {
         ABinderProcess_handlePolledCommands();
     }
 }
diff --git a/staging/threadnetwork/aidl/default/service.hpp b/threadnetwork/aidl/default/service.hpp
similarity index 83%
rename from staging/threadnetwork/aidl/default/service.hpp
rename to threadnetwork/aidl/default/service.hpp
index 6e6e868..6a94791 100644
--- a/staging/threadnetwork/aidl/default/service.hpp
+++ b/threadnetwork/aidl/default/service.hpp
@@ -14,10 +14,7 @@
  * limitations under the License.
  */
 
-#include <android-base/unique_fd.h>
-
 #include "mainloop.hpp"
-#include "thread_chip.hpp"
 
 namespace aidl {
 namespace android {
@@ -26,15 +23,14 @@
 
 class Service : public ot::Posix::Mainloop::Source {
   public:
-    Service(char* urls[], int numUrls);
+    Service(void);
 
     void Update(otSysMainloopContext& context) override;
     void Process(const otSysMainloopContext& context) override;
     void startLoop(void);
 
   private:
-    ::android::base::unique_fd mBinderFd;
-    std::vector<std::shared_ptr<ThreadChip>> mThreadChips;
+    int mBinderFd;
 };
 }  // namespace threadnetwork
 }  // namespace hardware
diff --git a/staging/threadnetwork/aidl/default/thread_chip.cpp b/threadnetwork/aidl/default/thread_chip.cpp
similarity index 66%
rename from staging/threadnetwork/aidl/default/thread_chip.cpp
rename to threadnetwork/aidl/default/thread_chip.cpp
index 38abad4..3d38cb8 100644
--- a/staging/threadnetwork/aidl/default/thread_chip.cpp
+++ b/threadnetwork/aidl/default/thread_chip.cpp
@@ -23,56 +23,65 @@
 #include <android/binder_process.h>
 #include <utils/Log.h>
 
+#include "hdlc_interface.hpp"
+#include "spi_interface.hpp"
+
 namespace aidl {
 namespace android {
 namespace hardware {
 namespace threadnetwork {
 
-static ndk::ScopedAStatus errorStatus(int32_t error, const char* message) {
-    return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(error, message));
-}
+ThreadChip::ThreadChip(char* url) : mUrl(), mRxFrameBuffer(), mCallback(nullptr) {
+    static const char kHdlcProtocol[] = "spinel+hdlc";
+    static const char kSpiProtocol[] = "spinel+spi";
+    const char* protocol;
 
-ThreadChip::ThreadChip(uint8_t id, char* url)
-    : mUrl(),
-      mInterface(handleReceivedFrame, this, mRxFrameBuffer),
-      mRxFrameBuffer(),
-      mCallback(nullptr) {
-    const std::string name(std::string() + IThreadChip::descriptor + "/chip" + std::to_string(id));
-    binder_status_t status;
-
-    ALOGI("ServiceName: %s, Url: %s", name.c_str(), url);
     CHECK_EQ(mUrl.Init(url), 0);
-    status = AServiceManager_addService(asBinder().get(), name.c_str());
-    CHECK_EQ(status, STATUS_OK);
+
+    protocol = mUrl.GetProtocol();
+    CHECK_NE(protocol, nullptr);
+
+    if (memcmp(protocol, kSpiProtocol, strlen(kSpiProtocol)) == 0) {
+        mSpinelInterface = std::make_shared<ot::Posix::SpiInterface>(handleReceivedFrameJump, this,
+                                                                     mRxFrameBuffer);
+    } else if (memcmp(protocol, kHdlcProtocol, strlen(kHdlcProtocol)) == 0) {
+        mSpinelInterface = std::make_shared<ot::Posix::HdlcInterface>(handleReceivedFrameJump, this,
+                                                                      mRxFrameBuffer);
+    } else {
+        ALOGE("The protocol \"%s\" is not supported", protocol);
+        exit(EXIT_FAILURE);
+    }
+
+    CHECK_NE(mSpinelInterface, nullptr);
 
     mDeathRecipient = ndk::ScopedAIBinder_DeathRecipient(
-            AIBinder_DeathRecipient_new(ThreadChip::onBinderDied));
-    AIBinder_DeathRecipient_setOnUnlinked(mDeathRecipient.get(), ThreadChip::onBinderUnlinked);
+            AIBinder_DeathRecipient_new(ThreadChip::onBinderDiedJump));
+    AIBinder_DeathRecipient_setOnUnlinked(mDeathRecipient.get(), ThreadChip::onBinderUnlinkedJump);
 }
 
 ThreadChip::~ThreadChip() {
     AIBinder_DeathRecipient_delete(mDeathRecipient.get());
 }
 
-void ThreadChip::onBinderDied(void* context) {
+void ThreadChip::onBinderDiedJump(void* context) {
     reinterpret_cast<ThreadChip*>(context)->onBinderDied();
 }
 
 void ThreadChip::onBinderDied(void) {
-    ALOGW("Thread Network HAL client is dead.");
+    ALOGW("Thread Network HAL client is dead");
 }
 
-void ThreadChip::onBinderUnlinked(void* context) {
+void ThreadChip::onBinderUnlinkedJump(void* context) {
     reinterpret_cast<ThreadChip*>(context)->onBinderUnlinked();
 }
 
 void ThreadChip::onBinderUnlinked(void) {
-    ALOGW("ThreadChip binder is unlinked.");
+    ALOGW("ThreadChip binder is unlinked");
     deinitChip();
 }
 
-void ThreadChip::handleReceivedFrame(void* context) {
-    reinterpret_cast<ThreadChip*>(context)->handleReceivedFrame();
+void ThreadChip::handleReceivedFrameJump(void* context) {
+    static_cast<ThreadChip*>(context)->handleReceivedFrame();
 }
 
 void ThreadChip::handleReceivedFrame(void) {
@@ -89,9 +98,9 @@
 
     if (status.isOk()) {
         AIBinder_linkToDeath(in_callback->asBinder().get(), mDeathRecipient.get(), this);
-        ALOGI("Open IThreadChip successfully.");
+        ALOGI("Open IThreadChip successfully");
     } else {
-        ALOGW("Open IThreadChip failed, error: %s", status.getDescription().c_str());
+        ALOGW("Failed to open IThreadChip: %s", status.getDescription().c_str());
     }
 
     return status;
@@ -101,7 +110,7 @@
     if (in_callback == nullptr) {
         return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
     } else if (mCallback == nullptr) {
-        if (mInterface.Init(mUrl) != OT_ERROR_NONE) {
+        if (mSpinelInterface->Init(mUrl) != OT_ERROR_NONE) {
             return errorStatus(ERROR_FAILED, "Failed to initialize the interface");
         }
 
@@ -109,7 +118,7 @@
         ot::Posix::Mainloop::Manager::Get().Add(*this);
         return ndk::ScopedAStatus::ok();
     } else {
-        return errorStatus(ERROR_BUSY, "Interface is already opened");
+        return errorStatus(ERROR_BUSY, "Interface has been opened");
     }
 }
 
@@ -125,7 +134,7 @@
 
         ALOGI("Close IThreadChip successfully");
     } else {
-        ALOGW("Close IThreadChip failed, error: %s", status.getDescription().c_str());
+        ALOGW("Failed to close IThreadChip: %s", status.getDescription().c_str());
     }
 
     return status;
@@ -133,7 +142,7 @@
 
 ndk::ScopedAStatus ThreadChip::deinitChip() {
     if (mCallback != nullptr) {
-        mInterface.Deinit();
+        mSpinelInterface->Deinit();
         ot::Posix::Mainloop::Manager::Get().Remove(*this);
         mCallback = nullptr;
         return ndk::ScopedAStatus::ok();
@@ -149,8 +158,8 @@
     if (mCallback == nullptr) {
         status = errorStatus(ERROR_FAILED, "The interface is not open");
     } else {
-        error = mInterface.SendFrame(reinterpret_cast<const uint8_t*>(in_frame.data()),
-                                     in_frame.size());
+        error = mSpinelInterface->SendFrame(reinterpret_cast<const uint8_t*>(in_frame.data()),
+                                            in_frame.size());
         if (error == OT_ERROR_NONE) {
             status = ndk::ScopedAStatus::ok();
         } else if (error == OT_ERROR_NO_BUFS) {
@@ -169,28 +178,30 @@
     return status;
 }
 
-ndk::ScopedAStatus ThreadChip::reset() {
-    mInterface.OnRcpReset();
+ndk::ScopedAStatus ThreadChip::hardwareReset() {
+    if (mSpinelInterface->HardwareReset() == OT_ERROR_NOT_IMPLEMENTED) {
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+
     ALOGI("reset()");
     return ndk::ScopedAStatus::ok();
 }
 
 void ThreadChip::Update(otSysMainloopContext& context) {
     if (mCallback != nullptr) {
-        mInterface.UpdateFdSet(context.mReadFdSet, context.mWriteFdSet, context.mMaxFd,
-                               context.mTimeout);
+        mSpinelInterface->UpdateFdSet(&context);
     }
 }
 
 void ThreadChip::Process(const otSysMainloopContext& context) {
-    struct RadioProcessContext radioContext;
-
     if (mCallback != nullptr) {
-        radioContext.mReadFdSet = &context.mReadFdSet;
-        radioContext.mWriteFdSet = &context.mWriteFdSet;
-        mInterface.Process(radioContext);
+        mSpinelInterface->Process(&context);
     }
 }
+
+ndk::ScopedAStatus ThreadChip::errorStatus(int32_t error, const char* message) {
+    return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(error, message));
+}
 }  // namespace threadnetwork
 }  // namespace hardware
 }  // namespace android
diff --git a/staging/threadnetwork/aidl/default/thread_chip.hpp b/threadnetwork/aidl/default/thread_chip.hpp
similarity index 84%
rename from staging/threadnetwork/aidl/default/thread_chip.hpp
rename to threadnetwork/aidl/default/thread_chip.hpp
index da5cba7..1ab6d54 100644
--- a/staging/threadnetwork/aidl/default/thread_chip.hpp
+++ b/threadnetwork/aidl/default/thread_chip.hpp
@@ -19,7 +19,6 @@
 #include <aidl/android/hardware/threadnetwork/BnThreadChip.h>
 #include <aidl/android/hardware/threadnetwork/IThreadChipCallback.h>
 
-#include "hdlc_interface.hpp"
 #include "lib/spinel/spinel_interface.hpp"
 #include "mainloop.hpp"
 
@@ -34,29 +33,29 @@
 
 class ThreadChip : public BnThreadChip, ot::Posix::Mainloop::Source {
   public:
-    ThreadChip(uint8_t id, char* url);
+    ThreadChip(char* url);
     ~ThreadChip();
 
     ndk::ScopedAStatus open(const std::shared_ptr<IThreadChipCallback>& in_callback) override;
     ndk::ScopedAStatus close() override;
     ndk::ScopedAStatus sendSpinelFrame(const std::vector<uint8_t>& in_frame) override;
-    ndk::ScopedAStatus reset() override;
+    ndk::ScopedAStatus hardwareReset() override;
     void Update(otSysMainloopContext& context) override;
     void Process(const otSysMainloopContext& context) override;
 
   private:
-    static void onBinderDied(void* context);
+    static void onBinderDiedJump(void* context);
     void onBinderDied(void);
-    static void onBinderUnlinked(void* context);
+    static void onBinderUnlinkedJump(void* context);
     void onBinderUnlinked(void);
-    static void handleReceivedFrame(void* context);
+    static void handleReceivedFrameJump(void* context);
     void handleReceivedFrame(void);
-
+    ndk::ScopedAStatus errorStatus(int32_t error, const char* message);
     ndk::ScopedAStatus initChip(const std::shared_ptr<IThreadChipCallback>& in_callback);
     ndk::ScopedAStatus deinitChip();
 
     ot::Url::Url mUrl;
-    ot::Posix::HdlcInterface mInterface;
+    std::shared_ptr<ot::Spinel::SpinelInterface> mSpinelInterface;
     ot::Spinel::SpinelInterface::RxFrameBuffer mRxFrameBuffer;
     std::shared_ptr<IThreadChipCallback> mCallback;
     ::ndk::ScopedAIBinder_DeathRecipient mDeathRecipient;
diff --git a/threadnetwork/aidl/default/threadnetwork-default.xml b/threadnetwork/aidl/default/threadnetwork-default.xml
new file mode 100644
index 0000000..d7dee1e
--- /dev/null
+++ b/threadnetwork/aidl/default/threadnetwork-default.xml
@@ -0,0 +1,6 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.threadnetwork</name>
+        <fqname>IThreadChip/chip0</fqname>
+    </hal>
+</manifest>
diff --git a/threadnetwork/aidl/default/utils.cpp b/threadnetwork/aidl/default/utils.cpp
new file mode 100644
index 0000000..1cb42ec
--- /dev/null
+++ b/threadnetwork/aidl/default/utils.cpp
@@ -0,0 +1,80 @@
+
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <openthread/instance.h>
+#include <openthread/logging.h>
+#include <openthread/platform/alarm-milli.h>
+#include <utils/Log.h>
+
+void otLogCritPlat(const char* format, ...) {
+    va_list args;
+
+    va_start(args, format);
+    __android_log_vprint(ANDROID_LOG_FATAL, LOG_TAG, format, args);
+    va_end(args);
+}
+
+void otLogWarnPlat(const char* format, ...) {
+    va_list args;
+
+    va_start(args, format);
+    __android_log_vprint(ANDROID_LOG_WARN, LOG_TAG, format, args);
+    va_end(args);
+}
+
+void otLogNotePlat(const char* format, ...) {
+    va_list args;
+
+    va_start(args, format);
+    __android_log_vprint(ANDROID_LOG_INFO, LOG_TAG, format, args);
+    va_end(args);
+}
+
+void otLogInfoPlat(const char* format, ...) {
+    va_list args;
+
+    va_start(args, format);
+    __android_log_vprint(ANDROID_LOG_INFO, LOG_TAG, format, args);
+    va_end(args);
+}
+
+void otLogDebgPlat(const char* format, ...) {
+    va_list args;
+
+    va_start(args, format);
+    __android_log_vprint(ANDROID_LOG_DEBUG, LOG_TAG, format, args);
+    va_end(args);
+}
+
+void otDumpDebgPlat(const char* aText, const void* aData, uint16_t aDataLength) {
+    constexpr uint16_t kBufSize = 512;
+    char buf[kBufSize];
+
+    if ((aText != nullptr) && (aData != nullptr)) {
+        const uint8_t* data = reinterpret_cast<const uint8_t*>(aData);
+
+        for (uint16_t i = 0; (i < aDataLength) && (i < (kBufSize - 1) / 3); i++) {
+            snprintf(buf + (i * 3), (kBufSize - 1) - (i * 3), "%02x ", data[i]);
+        }
+
+        __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, "%s: %s", aText, buf);
+    }
+}
+
+OT_TOOL_WEAK void otPlatAlarmMilliFired(otInstance* aInstance) {
+    OT_UNUSED_VARIABLE(aInstance);
+}
diff --git a/staging/threadnetwork/aidl/vts/Android.bp b/threadnetwork/aidl/vts/Android.bp
similarity index 71%
rename from staging/threadnetwork/aidl/vts/Android.bp
rename to threadnetwork/aidl/vts/Android.bp
index e2609ed..864e885 100644
--- a/staging/threadnetwork/aidl/vts/Android.bp
+++ b/threadnetwork/aidl/vts/Android.bp
@@ -14,15 +14,6 @@
 // limitations under the License.
 //
 
-package {
-    // See: http://go/android-license-faq
-    // A large-scale-change added 'default_applicable_licenses' to import
-    // all of the 'license_kinds' from "hardware_interfaces_license"
-    // to get the below license kinds:
-    //   SPDX-license-identifier-Apache-2.0
-    default_applicable_licenses: ["hardware_interfaces_license"],
-}
-
 cc_test {
     name: "VtsHalThreadNetworkTargetTest",
     defaults: [
@@ -38,7 +29,7 @@
         "libbinder_ndk",
     ],
     static_libs: [
-        "android.hardware.threadnetwork-ndk",
+        "android.hardware.threadnetwork-V1-ndk",
     ],
     test_suites: [
         "general-tests",
diff --git a/staging/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.cpp b/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.cpp
similarity index 84%
rename from staging/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.cpp
rename to threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.cpp
index 14c5b06..5925b54 100644
--- a/staging/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.cpp
+++ b/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.cpp
@@ -67,39 +67,15 @@
     }
 
     virtual void TearDown() override { thread_chip->close(); }
-    bool DeviceSupportsFeature(const char* feature);
 
-    static constexpr char kTvFeatureName[] = "android.software.leanback";
     std::shared_ptr<IThreadChip> thread_chip;
 };
 
-bool ThreadNetworkAidl::DeviceSupportsFeature(const char* feature) {
-    bool device_supports_feature = false;
-    FILE* p = popen("pm list features", "re");
-    char* line = nullptr;
-    size_t len = 0;
-
-    if (!p) {
-        return false;
-    }
-
-    while (getline(&line, &len, p) > 0) {
-        if (strstr(line, feature)) {
-            device_supports_feature = true;
-            break;
-        }
-    }
-    pclose(p);
-
-    return device_supports_feature;
-}
-
 TEST_P(ThreadNetworkAidl, Open) {
     std::shared_ptr<ThreadChipCallback> callback =
             ndk::SharedRefBase::make<ThreadChipCallback>([](auto /* data */) {});
 
     EXPECT_TRUE(thread_chip->open(callback).isOk());
-    EXPECT_EQ(thread_chip->open(callback).getServiceSpecificError(), IThreadChip::ERROR_BUSY);
 }
 
 TEST_P(ThreadNetworkAidl, Close) {
@@ -108,7 +84,6 @@
 
     EXPECT_TRUE(thread_chip->open(callback).isOk());
     EXPECT_TRUE(thread_chip->close().isOk());
-    EXPECT_EQ(thread_chip->close().getExceptionCode(), EX_ILLEGAL_STATE);
 }
 
 TEST_P(ThreadNetworkAidl, Reset) {
@@ -116,7 +91,7 @@
             ndk::SharedRefBase::make<ThreadChipCallback>([](auto /* data */) {});
 
     EXPECT_TRUE(thread_chip->open(callback).isOk());
-    EXPECT_TRUE(thread_chip->reset().isOk());
+    EXPECT_TRUE(thread_chip->hardwareReset().isOk());
 }
 
 TEST_P(ThreadNetworkAidl, SendSpinelFrame) {
@@ -145,10 +120,6 @@
                 }
             });
 
-    if (DeviceSupportsFeature(kTvFeatureName)) {
-        GTEST_SKIP() << "SendSpinelFrame test is bypassed on TV devices";
-    }
-
     ASSERT_NE(callback, nullptr);
 
     EXPECT_TRUE(thread_chip->open(callback).isOk());
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
index 25d704e..21951b6 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
@@ -34,23 +34,25 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="int") @VintfStability
 enum UwbVendorCapabilityTlvTypes {
-  SUPPORTED_POWER_STATS_QUERY = 192,
-  CCC_SUPPORTED_CHAPS_PER_SLOT = 160,
-  CCC_SUPPORTED_SYNC_CODES = 161,
-  CCC_SUPPORTED_HOPPING_CONFIG_MODES_AND_SEQUENCES = 162,
-  CCC_SUPPORTED_CHANNELS = 163,
-  CCC_SUPPORTED_VERSIONS = 164,
-  CCC_SUPPORTED_UWB_CONFIGS = 165,
-  CCC_SUPPORTED_PULSE_SHAPE_COMBOS = 166,
-  CCC_SUPPORTED_RAN_MULTIPLIER = 167,
-  CCC_SUPPORTED_MAX_RANGING_SESSION_NUMBER = 168,
-  CCC_SUPPORTED_MIN_UWB_INITIATION_TIME_MS = 169,
-  SUPPORTED_AOA_RESULT_REQ_ANTENNA_INTERLEAVING = 227,
-  SUPPORTED_MIN_RANGING_INTERVAL_MS = 228,
-  SUPPORTED_RANGE_DATA_NTF_CONFIG = 229,
-  SUPPORTED_RSSI_REPORTING = 230,
-  SUPPORTED_DIAGNOSTICS = 231,
-  SUPPORTED_MIN_SLOT_DURATION_RSTU = 232,
-  SUPPORTED_MAX_RANGING_SESSION_NUMBER = 233,
-  SUPPORTED_CHANNELS_AOA = 234,
+  SUPPORTED_POWER_STATS_QUERY = 0xC0,
+  CCC_SUPPORTED_CHAPS_PER_SLOT = 0xA0,
+  CCC_SUPPORTED_SYNC_CODES = 0xA1,
+  CCC_SUPPORTED_HOPPING_CONFIG_MODES_AND_SEQUENCES = 0xA2,
+  CCC_SUPPORTED_CHANNELS = 0xA3,
+  CCC_SUPPORTED_VERSIONS = 0xA4,
+  CCC_SUPPORTED_UWB_CONFIGS = 0xA5,
+  CCC_SUPPORTED_PULSE_SHAPE_COMBOS = 0xA6,
+  CCC_SUPPORTED_RAN_MULTIPLIER = 0xA7,
+  CCC_SUPPORTED_MAX_RANGING_SESSION_NUMBER = 0xA8,
+  CCC_SUPPORTED_MIN_UWB_INITIATION_TIME_MS = 0xA9,
+  CCC_PRIORITIZED_CHANNEL_LIST = 0xAA,
+  RADAR_SUPPORT = 0xB0,
+  SUPPORTED_AOA_RESULT_REQ_ANTENNA_INTERLEAVING = 0xE3,
+  SUPPORTED_MIN_RANGING_INTERVAL_MS = 0xE4,
+  SUPPORTED_RANGE_DATA_NTF_CONFIG = 0xE5,
+  SUPPORTED_RSSI_REPORTING = 0xE6,
+  SUPPORTED_DIAGNOSTICS = 0xE7,
+  SUPPORTED_MIN_SLOT_DURATION_RSTU = 0xE8,
+  SUPPORTED_MAX_RANGING_SESSION_NUMBER = 0xE9,
+  SUPPORTED_CHANNELS_AOA = 0xEA,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
index 0e33f70..702e561 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
@@ -40,17 +40,19 @@
   PULSE_SHAPE_PRECURSOR_FREE = 1,
   PULSE_SHAPE_PRECURSOR_FREE_SPECIAL = 2,
   CHAPS_PER_SLOT_3 = 1,
-  CHAPS_PER_SLOT_4 = 2,
-  CHAPS_PER_SLOT_6 = 4,
-  CHAPS_PER_SLOT_8 = 8,
-  CHAPS_PER_SLOT_9 = 16,
-  CHAPS_PER_SLOT_12 = 32,
-  CHAPS_PER_SLOT_24 = 64,
-  HOPPING_SEQUENCE_DEFAULT = 16,
-  HOPPING_SEQUENCE_AES = 8,
-  HOPPING_CONFIG_MODE_NONE = 128,
-  HOPPING_CONFIG_MODE_CONTINUOUS = 64,
-  HOPPING_CONFIG_MODE_ADAPTIVE = 32,
+  CHAPS_PER_SLOT_4 = (1 << 1) /* 2 */,
+  CHAPS_PER_SLOT_6 = (1 << 2) /* 4 */,
+  CHAPS_PER_SLOT_8 = (1 << 3) /* 8 */,
+  CHAPS_PER_SLOT_9 = (1 << 4) /* 16 */,
+  CHAPS_PER_SLOT_12 = (1 << 5) /* 32 */,
+  CHAPS_PER_SLOT_24 = (1 << 6) /* 64 */,
+  HOPPING_SEQUENCE_DEFAULT = (1 << 4) /* 16 */,
+  HOPPING_SEQUENCE_AES = (1 << 3) /* 8 */,
+  HOPPING_CONFIG_MODE_NONE = (1 << 7) /* 128 */,
+  HOPPING_CONFIG_MODE_CONTINUOUS = (1 << 6) /* 64 */,
+  HOPPING_CONFIG_MODE_ADAPTIVE = (1 << 5) /* 32 */,
   CCC_CHANNEL_5 = 1,
-  CCC_CHANNEL_9 = 2,
+  CCC_CHANNEL_9 = (1 << 1) /* 2 */,
+  RADAR_NOT_SUPPORTED = 0,
+  RADAR_SWEEP_SAMPLES_SUPPORTED = 1,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorDataPacketFormat.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorDataPacketFormat.aidl
new file mode 100644
index 0000000..efafa32
--- /dev/null
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorDataPacketFormat.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.uwb.fira_android;
+@Backing(type="byte") @VintfStability
+enum UwbVendorDataPacketFormat {
+  RADAR_DATA_MESSAGE = 0xF,
+}
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl
index fbcfbff..1506406 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl
@@ -34,7 +34,9 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="byte") @VintfStability
 enum UwbVendorGidAndroidOids {
-  ANDROID_GET_POWER_STATS = 0,
-  ANDROID_SET_COUNTRY_CODE = 1,
-  ANDROID_RANGE_DIAGNOSTICS = 2,
+  ANDROID_GET_POWER_STATS = 0x0,
+  ANDROID_SET_COUNTRY_CODE = 0x1,
+  ANDROID_RANGE_DIAGNOSTICS = 0x2,
+  RADAR_SET_APP_CONFIG = 0x11,
+  RADAR_GET_APP_CONFIG = 0x12,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGids.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGids.aidl
index 5515c67..f02ed70 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGids.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorGids.aidl
@@ -34,5 +34,5 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="byte") @VintfStability
 enum UwbVendorGids {
-  ANDROID = 12,
+  ANDROID = 0xC,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvTypes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvTypes.aidl
new file mode 100644
index 0000000..760166c
--- /dev/null
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvTypes.aidl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.uwb.fira_android;
+@Backing(type="int") @VintfStability
+enum UwbVendorRadarAppConfigTlvTypes {
+  RADAR_TIMING_PARAMS = 0x0,
+  SAMPLES_PER_SWEEP = 0x1,
+  RADAR_CHANNEL_NUMBER = 0x2,
+  SWEEP_OFFSET = 0x3,
+  RADAR_RFRAME_CONFIG = 0x4,
+  RADAR_PREAMBLE_DURATION = 0x5,
+  RADAR_PREAMBLE_CODE_INDEX = 0x6,
+  RADAR_SESSION_PRIORITY = 0x7,
+  BITS_PER_SAMPLE = 0x8,
+  RADAR_PRF_MODE = 0x9,
+  NUMBER_OF_BURSTS = 0xA,
+  RADAR_DATA_TYPE = 0xB,
+}
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvValues.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvValues.aidl
new file mode 100644
index 0000000..1eb2ce9
--- /dev/null
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvValues.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.uwb.fira_android;
+@Backing(type="int") @VintfStability
+enum UwbVendorRadarAppConfigTlvValues {
+  RADAR_DATA_TYPE_RADAR_SWEEP_SAMPLES = 0x0,
+}
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorReasonCodes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorReasonCodes.aidl
index a438cbe..db1e0db 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorReasonCodes.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorReasonCodes.aidl
@@ -34,7 +34,7 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="int") @VintfStability
 enum UwbVendorReasonCodes {
-  REASON_ERROR_INVALID_CHANNEL_WITH_AOA = 128,
-  REASON_ERROR_STOPPED_DUE_TO_OTHER_SESSION_CONFLICT = 129,
-  REASON_REGULATION_UWB_OFF = 130,
+  REASON_ERROR_INVALID_CHANNEL_WITH_AOA = 0x80,
+  REASON_ERROR_STOPPED_DUE_TO_OTHER_SESSION_CONFLICT = 0x81,
+  REASON_REGULATION_UWB_OFF = 0x82,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
index c3ac401..d02cf4d 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
@@ -34,16 +34,16 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="int") @VintfStability
 enum UwbVendorSessionAppConfigTlvTypes {
-  CCC_HOP_MODE_KEY = 160,
-  CCC_UWB_TIME0 = 161,
-  CCC_RANGING_PROTOCOL_VER = 163,
-  CCC_UWB_CONFIG_ID = 164,
-  CCC_PULSESHAPE_COMBO = 165,
-  CCC_URSK_TTL = 166,
-  CCC_LAST_INDEX_USED = 168,
-  NB_OF_RANGE_MEASUREMENTS = 227,
-  NB_OF_AZIMUTH_MEASUREMENTS = 228,
-  NB_OF_ELEVATION_MEASUREMENTS = 229,
-  ENABLE_DIAGNOSTICS = 232,
-  DIAGRAMS_FRAME_REPORTS_FIELDS = 233,
+  CCC_HOP_MODE_KEY = 0xA0,
+  CCC_UWB_TIME0 = 0xA1,
+  CCC_RANGING_PROTOCOL_VER = 0xA3,
+  CCC_UWB_CONFIG_ID = 0xA4,
+  CCC_PULSESHAPE_COMBO = 0xA5,
+  CCC_URSK_TTL = 0xA6,
+  CCC_LAST_INDEX_USED = 0xA8,
+  NB_OF_RANGE_MEASUREMENTS = 0xE3,
+  NB_OF_AZIMUTH_MEASUREMENTS = 0xE4,
+  NB_OF_ELEVATION_MEASUREMENTS = 0xE5,
+  ENABLE_DIAGNOSTICS = 0xE8,
+  DIAGRAMS_FRAME_REPORTS_FIELDS = 0xE9,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvValues.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvValues.aidl
index a7f487b..5216e1f 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvValues.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvValues.aidl
@@ -34,5 +34,5 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="int") @VintfStability
 enum UwbVendorSessionAppConfigTlvValues {
-  AOA_RESULT_REQ_ANTENNA_INTERLEAVING = 240,
+  AOA_RESULT_REQ_ANTENNA_INTERLEAVING = 0xF0,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl
index 30a0a1b..bf968bd 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl
@@ -34,5 +34,6 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="int") @VintfStability
 enum UwbVendorSessionInitSessionType {
-  CCC = 160,
+  CCC = 0xA0,
+  RADAR = 0xA1,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
index 28cf7fe..52f1350 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
@@ -34,8 +34,8 @@
 package android.hardware.uwb.fira_android;
 @Backing(type="byte") @VintfStability
 enum UwbVendorStatusCodes {
-  STATUS_ERROR_CCC_SE_BUSY = 80,
-  STATUS_ERROR_CCC_LIFECYCLE = 81,
-  STATUS_ERROR_STOPPED_DUE_TO_OTHER_SESSION_CONFLICT = 82,
-  STATUS_REGULATION_UWB_OFF = 83,
+  STATUS_ERROR_CCC_SE_BUSY = 0x50,
+  STATUS_ERROR_CCC_LIFECYCLE = 0x51,
+  STATUS_ERROR_STOPPED_DUE_TO_OTHER_SESSION_CONFLICT = 0x52,
+  STATUS_REGULATION_UWB_OFF = 0x53,
 }
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/README.md b/uwb/aidl/android/hardware/uwb/fira_android/README.md
index e658d93..7912bbc 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/README.md
+++ b/uwb/aidl/android/hardware/uwb/fira_android/README.md
@@ -10,6 +10,3 @@
 All other interactions sent/received over the HAL interface is expected to
 comply with the UCI specification that can be found [here](
 https://groups.firaconsortium.org/wg/Technical/document/folder/127).
-
-TODO([b/196004116](b/196004116)): Link to the published specification.
-
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
index 22b7bfe..2141b5a 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
@@ -149,6 +149,21 @@
      */
     CCC_SUPPORTED_MIN_UWB_INITIATION_TIME_MS = 0xA9,
 
+    /**
+     * Byte array of channels supported by the device, ordered by priority from highest to lowest.
+     */
+    CCC_PRIORITIZED_CHANNEL_LIST = 0xAA,
+
+    /*********************************************
+     * RADAR specific
+     ********************************************/
+    /**
+     * 1 byte bitmask to indicate the supported Radar data types.
+     * Each "1" in this bitmap corresponds to a specific radar data type where:
+     * 0x01 = "Radar Sweep Samples",
+     */
+    RADAR_SUPPORT = 0xB0,
+
     /*********************************************
      * FIRA specific
      ********************************************/
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
index 7c86b79..6ef52fe 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
@@ -51,4 +51,10 @@
 
     CCC_CHANNEL_5 = 1,
     CCC_CHANNEL_9 = 1 << 1,
+
+    /*********************************************
+     * RADAR specific
+     ********************************************/
+    RADAR_NOT_SUPPORTED = 0,
+    RADAR_SWEEP_SAMPLES_SUPPORTED = 1,
 }
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorDataPacketFormat.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorDataPacketFormat.aidl
new file mode 100644
index 0000000..7a1b033
--- /dev/null
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorDataPacketFormat.aidl
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.uwb.fira_android;
+
+/**
+ * Android specific vendor DPF (Data Packet Format) should be defined here.
+ */
+@VintfStability
+@Backing(type="byte")
+enum UwbVendorDataPacketFormat {
+    // Used to send radar data messages from UWBS to the host.
+    RADAR_DATA_MESSAGE = 0xF,
+}
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl
index 4768f55..95c10a8 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorGidAndroidOids.aidl
@@ -37,4 +37,13 @@
     // Supported only if the UwbVendorCapabilityTlvTypes.SUPPORTED_DIAGNOSTICS set
     // to 1.
     ANDROID_RANGE_DIAGNOSTICS = 0x2,
+
+    /*********************************************
+     * Range 0x10 - 0x1F reserved for RADAR specific
+     * Supported only if the UwbVendorCapabilityTlvTypes.RADAR_SUPPORT is not 0x00.
+     ********************************************/
+    // Used to set application configurations for radar session.
+    RADAR_SET_APP_CONFIG = 0x11,
+    // Used to get application configurations for radar session.
+    RADAR_GET_APP_CONFIG = 0x12,
 }
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvTypes.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvTypes.aidl
new file mode 100644
index 0000000..a5ea688
--- /dev/null
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvTypes.aidl
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.uwb.fira_android;
+
+/**
+ * Android specific radar app params set/expected in UCI command:
+ * GID: 1100b (Android specific Group)
+ * OID: 010001b (RADAR_SET_APP_CONFIG_CMD)
+ * OID: 010010b (RADAR_GET_APP_CONFIG_CMD)
+ */
+@VintfStability
+@Backing(type="int")
+enum UwbVendorRadarAppConfigTlvTypes {
+    /**
+     * 7 byte data
+     * Radar frame timing parameters:
+     * Octet [3:0] - BURST_PERIOD
+     *   Duration between the start of two consecutive Radar bursts in ms.
+     * Octet [5:4] - SWEEP_PERIOD
+     *   Duration between the start times of two consecutive Radar sweeps in
+     *   RSTU.
+     * Octet [6] - SWEEPS_PER_BURST
+     *   Number of Radar sweeps within the Radar burst.
+     */
+    RADAR_TIMING_PARAMS = 0x0,
+    /**
+     * 1 byte data
+     * The number of samples captured for each radar sweep. (default = 64)
+     */
+    SAMPLES_PER_SWEEP = 0x1,
+    /**
+     * 1 byte data
+     * Same as in FiRa UCI Session App Config.
+     * (default = 9)
+     */
+    RADAR_CHANNEL_NUMBER = 0x2,
+    /**
+     * 2 byte data
+     * Defines the start offset with respect to 0cm distance to limit the sweep
+     * range. Signed value and unit in samples.
+     * (default = 0)
+     */
+    SWEEP_OFFSET = 0x3,
+    /**
+     * 1 byte data
+     * Same as in FiRa UCI Session App Config.
+     * (default = 0x0)
+     */
+    RADAR_RFRAME_CONFIG = 0x4,
+    /**
+     * 1 byte data
+     * Same as in FiRa UCI Session App Config, but extended to 0xA.
+     * (default = 0x2 : 128 symbols)
+     */
+    RADAR_PREAMBLE_DURATION = 0x5,
+    /**
+     * 1 byte data
+     * Same as in FiRa UCI Session App Config, but extended to 127.
+     * (default = 25)
+     */
+    RADAR_PREAMBLE_CODE_INDEX = 0x6,
+    /**
+     * 1 byte data
+     * Same as in FiRa UCI Session App Config.
+     * (default = 50)
+     */
+    RADAR_SESSION_PRIORITY = 0x7,
+    /**
+     * 1 byte data
+     * Bits per sample in the radar sweep.
+     * 0x00 = 32 bits per sample (default)
+     * 0x01 = 48 bits per sample
+     * 0x02 = 64 bits per sample
+     */
+    BITS_PER_SAMPLE = 0x8,
+    /**
+     * 1 byte data
+     * Same as in FiRa UCI Session App Config.
+     * (default = 0x1)
+     */
+    RADAR_PRF_MODE = 0x9,
+    /**
+     * 2 byte data
+     * Maximum number of Radar bursts to be executed in the session. The
+     * session is stopped and moved to SESSION_STATE_IDLE Session State when
+     * configured radar bursts are elapsed.
+     * 0x00 = Unlimited (default)
+     */
+    NUMBER_OF_BURSTS = 0xA,
+    /**
+     * 2 byte data
+     * Type of radar data to be reported.
+     * 0x00: Radar Sweep Samples. Reported in RADAR_DATA_NTF. (default)
+     */
+    RADAR_DATA_TYPE = 0xB,
+}
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvValues.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvValues.aidl
new file mode 100644
index 0000000..81c0a4d
--- /dev/null
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorRadarAppConfigTlvValues.aidl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.uwb.fira_android;
+
+/**
+ * Android specific radar app config values set/expected in UCI command:
+ * GID: 1100b (Android specific Group)
+ * OID: 010001b (RADAR_SET_APP_CONFIG_CMD)
+ * OID: 010010b (RADAR_GET_APP_CONFIG_CMD)
+ */
+@VintfStability
+@Backing(type="int")
+enum UwbVendorRadarAppConfigTlvValues {
+    RADAR_DATA_TYPE_RADAR_SWEEP_SAMPLES = 0x0,
+}
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl
index 1e2c817..d3df672 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionInitSessionType.aidl
@@ -29,4 +29,5 @@
 enum UwbVendorSessionInitSessionType {
     /** Added in vendor version 0. */
     CCC = 0xA0,
+    RADAR = 0xA1,
 }