diff --git a/audio/7.1/Android.bp b/audio/7.1/Android.bp
new file mode 100644
index 0000000..52980e2
--- /dev/null
+++ b/audio/7.1/Android.bp
@@ -0,0 +1,32 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+hidl_interface {
+    name: "android.hardware.audio@7.1",
+    root: "android.hardware",
+    srcs: [
+        "types.hal",
+        "IDevice.hal",
+        "IDevicesFactory.hal",
+        "IPrimaryDevice.hal",
+        "IStreamIn.hal",
+        "IStreamOut.hal",
+        "IStreamOutLatencyModeCallback.hal",
+    ],
+    interfaces: [
+        "android.hardware.audio@7.0",
+        "android.hardware.audio.common@7.0",
+        "android.hidl.base@1.0",
+        "android.hidl.safe_union@1.0",
+    ],
+    gen_java: false,
+    gen_java_constants: false,
+}
diff --git a/audio/7.1/IDevice.hal b/audio/7.1/IDevice.hal
new file mode 100644
index 0000000..e0b1e92
--- /dev/null
+++ b/audio/7.1/IDevice.hal
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio@7.1;
+
+import android.hardware.audio.common@7.0;
+import @7.0::AudioInOutFlag;
+import @7.0::IDevice;
+import @7.0::Result;
+import IStreamIn;
+import IStreamOut;
+
+interface IDevice extends @7.0::IDevice {
+    /**
+     * This method creates and opens the audio hardware output stream.
+     * If the stream can not be opened with the proposed audio config,
+     * HAL must provide suggested values for the audio config.
+     *
+     * Note: INVALID_ARGUMENTS is returned both in the case when the
+     * HAL can not use the provided config and in the case when
+     * the value of any argument is invalid. In the latter case the
+     * HAL must provide a default initialized suggested config.
+     *
+     * @param ioHandle handle assigned by AudioFlinger.
+     * @param device device type and (if needed) address.
+     * @param config stream configuration.
+     * @param flags additional flags.
+     * @param sourceMetadata Description of the audio that will be played.
+                             May be used by implementations to configure hardware effects.
+     * @return retval operation completion status.
+     * @return outStream created output stream.
+     * @return suggestedConfig in the case of rejection of the proposed config,
+     *                         a config suggested by the HAL.
+     */
+    openOutputStream_7_1(
+            AudioIoHandle ioHandle,
+            DeviceAddress device,
+            AudioConfig config,
+            vec<AudioInOutFlag> flags,
+            SourceMetadata sourceMetadata) generates (
+                    Result retval,
+                    IStreamOut outStream,
+                    AudioConfig suggestedConfig);
+
+    /**
+     * This method creates and opens the audio hardware input stream.
+     * If the stream can not be opened with the proposed audio config,
+     * HAL must provide suggested values for the audio config.
+     *
+     * Note: INVALID_ARGUMENTS is returned both in the case when the
+     * HAL can not use the provided config and in the case when
+     * the value of any argument is invalid. In the latter case the
+     * HAL must provide a default initialized suggested config.
+     *
+     * @param ioHandle handle assigned by AudioFlinger.
+     * @param device device type and (if needed) address.
+     * @param config stream configuration.
+     * @param flags additional flags.
+     * @param sinkMetadata Description of the audio that is suggested by the client.
+     *                     May be used by implementations to configure processing effects.
+     * @return retval operation completion status.
+     * @return inStream in case of success, created input stream.
+     * @return suggestedConfig in the case of rejection of the proposed config,
+     *                         a config suggested by the HAL.
+     */
+    openInputStream_7_1(
+            AudioIoHandle ioHandle,
+            DeviceAddress device,
+            AudioConfig config,
+            vec<AudioInOutFlag> flags,
+            SinkMetadata sinkMetadata) generates (
+                    Result retval,
+                    IStreamIn inStream,
+                    AudioConfig suggestedConfig);
+
+    /**
+     * Notifies the device module about the connection state of an input/output
+     * device attached to it. The devicePort identifies the device and may also
+     * provide extra information such as raw audio descriptors.
+     *
+     * @param devicePort audio device port.
+     * @param connected whether the device is connected.
+     * @return retval operation completion status.
+     */
+    setConnectedState_7_1(AudioPort devicePort, bool connected)
+            generates (Result retval);
+};
diff --git a/audio/7.1/IDevicesFactory.hal b/audio/7.1/IDevicesFactory.hal
new file mode 100644
index 0000000..7669614
--- /dev/null
+++ b/audio/7.1/IDevicesFactory.hal
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio@7.1;
+
+import @7.0::IDevicesFactory;
+import @7.0::Result;
+import IDevice;
+import IPrimaryDevice;
+
+/**
+ * This factory allows a HAL implementation to be split in multiple independent
+ * devices (called module in the pre-treble API). Note that this division is
+ * arbitrary and implementation are free to only have a Primary. The framework
+ * will query the devices according to audio_policy_configuration.xml
+ *
+ * Each device name is arbitrary, provided by the vendor's audio_policy_configuration.xml
+ * and only used to identify a device in this factory.
+ * The framework must not interpret the name, treating it as a vendor opaque data
+ * with the following exception:
+ * - the "r_submix" device that must be present to support policyMixes (Eg: Android projected).
+ *   Note that this Device is included by default in a build derived from AOSP.
+ */
+interface IDevicesFactory extends @7.0::IDevicesFactory {
+
+    /**
+     * Opens an audio device. To close the device, it is necessary to call
+     * 'close' method on the returned device object.
+     *
+     * Important note: due to rules of HIDL, @7.1::IPrimaryDevice extends
+     * @7.0::IPrimaryDevice, rather than @7.1::IDevice. Thus the returned
+     * IDevice interface can not be up-casted to @7.1::IPrimaryDevice for the
+     * primary device. The client needs to use IPrimaryDevice instead of this
+     * method if it needs full functionality of the IPrimaryDevice interface.
+     *
+     * @param device device name.
+     * @return retval operation completion status. Returns INVALID_ARGUMENTS
+     *         if there is no corresponding hardware module found,
+     *         NOT_INITIALIZED if an error occurred while opening the hardware
+     *         module.
+     * @return result the interface for the created device.
+     */
+    openDevice_7_1(string device) generates (Result retval, IDevice result);
+
+    /**
+     * Opens the Primary audio device that must be present.
+     * This function is not optional and must return successfully the primary device.
+     *
+     * This device must have the name "primary".
+     *
+     * The telephony stack uses this device to control the audio during a voice call.
+     *
+     * @return retval operation completion status. Must be SUCCESS.
+     *         For debugging, return INVALID_ARGUMENTS if there is no corresponding
+     *         hardware module found, NOT_INITIALIZED if an error occurred
+     *         while opening the hardware module.
+     * @return result the interface for the created device.
+     */
+    openPrimaryDevice_7_1() generates (Result retval, IPrimaryDevice result);
+};
diff --git a/audio/7.1/IPrimaryDevice.hal b/audio/7.1/IPrimaryDevice.hal
new file mode 100644
index 0000000..1659671
--- /dev/null
+++ b/audio/7.1/IPrimaryDevice.hal
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio@7.1;
+
+import android.hardware.audio.common@7.0;
+import @7.0::IPrimaryDevice;
+import IDevice;
+
+interface IPrimaryDevice extends @7.0::IPrimaryDevice {
+    /**
+     * Retrieve the generic @7.1::IDevice interface.
+     *
+     * Since @7.1::IPrimaryDevice extends @7.0::IPrimaryDevice, the interface
+     * reference can not be downcasted to @7.1::IDevice using standard methods.
+     * For this reason a dedicated interface method is provided.
+     *
+     * @return result the generic part of the interface.
+     */
+    getDevice() generates (IDevice result);
+};
diff --git a/audio/7.1/IStreamIn.hal b/audio/7.1/IStreamIn.hal
new file mode 100644
index 0000000..abebe6a
--- /dev/null
+++ b/audio/7.1/IStreamIn.hal
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio@7.1;
+
+import @7.0::IStreamIn;
+
+interface IStreamIn extends @7.0::IStreamIn {
+};
diff --git a/audio/7.1/IStreamOut.hal b/audio/7.1/IStreamOut.hal
new file mode 100644
index 0000000..b2013cf
--- /dev/null
+++ b/audio/7.1/IStreamOut.hal
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio@7.1;
+
+import @7.0::Result;
+import @7.0::IStreamOut;
+
+import IStreamOutLatencyModeCallback;
+
+interface IStreamOut extends @7.0::IStreamOut {
+    /**
+     * Indicates the requested latency mode for this output stream.
+     *
+     * The requested mode can be one of the modes returned by
+     * getRecommendedLatencyModes() API.
+     *
+     * Optional method.
+     * Mandated only on specific spatial audio streams indicated by
+     * AUDIO_OUTPUT_FLAG_SPATIALIZER flag if they can be routed to a BT classic sink.
+     *
+     * @return retval operation completion status.
+     */
+    setLatencyMode(LatencyMode mode) generates (Result retval);
+
+    /**
+     * Indicates which latency modes are currently supported on this output stream.
+     * If the transport protocol (e.g Bluetooth A2DP) used by this output stream to reach
+     * the output device supports variable latency modes, the HAL indicates which
+     * modes are currently supported.
+     * The framework can then call setLatencyMode() with one of the supported modes to select
+     * the desired operation mode.
+     *
+     * Optional method.
+     * Mandated only on specific spatial audio streams indicated by
+     * AUDIO_OUTPUT_FLAG_SPATIALIZER flag if they can be routed to a BT classic sink.
+     *
+     * @return retval operation completion status.
+     * @return modes currrently supported latency modes.
+     */
+    getRecommendedLatencyModes() generates (Result retval, vec<LatencyMode> modes);
+
+    /**
+     * Set the callback interface for notifying changes in supported latency modes.
+     *
+     * Calling this method with a null pointer will result in releasing
+     * the callback.
+     *
+     * Optional method.
+     * Mandated only on specific spatial audio streams indicated by
+     * AUDIO_OUTPUT_FLAG_SPATIALIZER flag if they can be routed to a BT classic sink.
+     *
+     * @return retval operation completion status.
+     */
+    setLatencyModeCallback(IStreamOutLatencyModeCallback callback) generates (Result retval);
+};
diff --git a/audio/7.1/IStreamOutLatencyModeCallback.hal b/audio/7.1/IStreamOutLatencyModeCallback.hal
new file mode 100644
index 0000000..45b453f
--- /dev/null
+++ b/audio/7.1/IStreamOutLatencyModeCallback.hal
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package android.hardware.audio@7.1;
+
+/**
+ * Callback interface for output stream variable latency mode feature.
+ */
+interface IStreamOutLatencyModeCallback {
+    /**
+     * Called with the new list of supported latency modes when a change occurs.
+     */
+    oneway onRecommendedLatencyModeChanged(vec<LatencyMode> modes);
+};
diff --git a/audio/7.1/config/Android.bp b/audio/7.1/config/Android.bp
new file mode 100644
index 0000000..70c8fd4
--- /dev/null
+++ b/audio/7.1/config/Android.bp
@@ -0,0 +1,31 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+xsd_config {
+    name: "audio_policy_configuration_V7_1",
+    srcs: ["audio_policy_configuration.xsd"],
+    package_name: "android.audio.policy.configuration.V7_1",
+    nullability: true,
+}
+
+xsd_config {
+    name: "audio_policy_configuration_V7_1_enums",
+    srcs: ["audio_policy_configuration.xsd"],
+    package_name: "android.audio.policy.configuration.V7_1",
+    nullability: true,
+    enums_only: true,
+}
+
+xsd_config {
+    name: "audio_policy_configuration_V7_1_parser",
+    srcs: ["audio_policy_configuration.xsd"],
+    package_name: "android.audio.policy.configuration.V7_1",
+    nullability: true,
+    parser_only: true,
+}
diff --git a/audio/7.1/config/api/current.txt b/audio/7.1/config/api/current.txt
new file mode 100644
index 0000000..2963904
--- /dev/null
+++ b/audio/7.1/config/api/current.txt
@@ -0,0 +1,598 @@
+// Signature format: 2.0
+package android.audio.policy.configuration.V7_1 {
+
+  public class AttachedDevices {
+    ctor public AttachedDevices();
+    method @Nullable public java.util.List<java.lang.String> getItem();
+  }
+
+  public enum AudioChannelMask {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_10;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_11;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_12;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_13;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_14;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_15;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_16;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_17;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_18;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_19;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_20;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_21;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_22;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_23;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_24;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_3;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_4;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_5;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_6;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_7;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_8;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_INDEX_MASK_9;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_2POINT0POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_2POINT1POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_3POINT0POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_3POINT1POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_5POINT1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_6;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_FRONT_BACK;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_MONO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_STEREO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_VOICE_CALL_MONO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_VOICE_DNLINK_MONO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_IN_VOICE_UPLINK_MONO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_NONE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_13POINT_360RA;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_22POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_2POINT0POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_2POINT1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_2POINT1POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_3POINT0POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_3POINT1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_3POINT1POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_5POINT1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_5POINT1POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_5POINT1POINT4;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_5POINT1_BACK;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_5POINT1_SIDE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_6POINT1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_7POINT1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_7POINT1POINT2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_7POINT1POINT4;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_9POINT1POINT4;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_9POINT1POINT6;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_HAPTIC_AB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_MONO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_MONO_HAPTIC_A;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_MONO_HAPTIC_AB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_PENTA;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_QUAD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_QUAD_BACK;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_QUAD_SIDE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_STEREO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_STEREO_HAPTIC_A;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_STEREO_HAPTIC_AB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_SURROUND;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_TRI;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioChannelMask AUDIO_CHANNEL_OUT_TRI_BACK;
+  }
+
+  public enum AudioContentType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioContentType AUDIO_CONTENT_TYPE_MOVIE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioContentType AUDIO_CONTENT_TYPE_MUSIC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioContentType AUDIO_CONTENT_TYPE_SONIFICATION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioContentType AUDIO_CONTENT_TYPE_SPEECH;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioContentType AUDIO_CONTENT_TYPE_UNKNOWN;
+  }
+
+  public enum AudioDevice {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_AMBIENT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_ANLG_DOCK_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_AUX_DIGITAL;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_BACK_MIC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_BLE_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_BLUETOOTH_A2DP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_BLUETOOTH_BLE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_BUILTIN_MIC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_BUS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_COMMUNICATION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_DEFAULT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_DGTL_DOCK_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_ECHO_REFERENCE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_FM_TUNER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_HDMI;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_HDMI_ARC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_HDMI_EARC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_IP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_LINE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_LOOPBACK;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_PROXY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_REMOTE_SUBMIX;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_SPDIF;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_STUB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_TELEPHONY_RX;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_TV_TUNER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_USB_ACCESSORY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_USB_DEVICE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_USB_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_VOICE_CALL;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_IN_WIRED_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_NONE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_AUX_DIGITAL;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_AUX_LINE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLE_BROADCAST;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLE_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLE_SPEAKER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLUETOOTH_A2DP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLUETOOTH_SCO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_BUS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_DEFAULT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_EARPIECE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_ECHO_CANCELLER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_FM;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_HDMI;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_HDMI_ARC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_HDMI_EARC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_HEARING_AID;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_IP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_LINE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_PROXY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_REMOTE_SUBMIX;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_SPDIF;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_SPEAKER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_SPEAKER_SAFE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_STUB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_TELEPHONY_TX;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_USB_ACCESSORY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_USB_DEVICE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_USB_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_WIRED_HEADPHONE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioDevice AUDIO_DEVICE_OUT_WIRED_HEADSET;
+  }
+
+  public enum AudioEncapsulationType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioEncapsulationType AUDIO_ENCAPSULATION_TYPE_IEC61937;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioEncapsulationType AUDIO_ENCAPSULATION_TYPE_NONE;
+  }
+
+  public enum AudioFormat {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADIF;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_ELD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_ERLC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_HE_V1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_HE_V2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_LC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_LD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_LTP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_MAIN;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_SCALABLE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_SSR;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ADTS_XHE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ELD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_ERLC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_HE_V1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_HE_V2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_LATM;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_LATM_HE_V1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_LATM_HE_V2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_LATM_LC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_LC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_LD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_LTP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_MAIN;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_SCALABLE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_SSR;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AAC_XHE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AC3;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AC4;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_ALAC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AMR_NB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AMR_WB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_AMR_WB_PLUS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_APE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_APTX;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_APTX_ADAPTIVE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_APTX_HD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_APTX_TWSP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_CELT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_DEFAULT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_DOLBY_TRUEHD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_DRA;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_DSD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_DTS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_DTS_HD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_DTS_UHD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_EVRC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_EVRCB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_EVRCNW;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_EVRCWB;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_E_AC3;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_E_AC3_JOC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_FLAC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_HE_AAC_V1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_HE_AAC_V2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_IEC60958;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_IEC61937;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_LC3;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_LDAC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_LHDC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_LHDC_LL;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MAT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MAT_1_0;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MAT_2_0;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MAT_2_1;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MP2;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MP3;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MPEGH_BL_L3;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MPEGH_BL_L4;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MPEGH_LC_L3;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_MPEGH_LC_L4;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_OPUS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_PCM_16_BIT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_PCM_24_BIT_PACKED;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_PCM_32_BIT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_PCM_8_24_BIT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_PCM_8_BIT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_PCM_FLOAT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_QCELP;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_SBC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_VORBIS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_WMA;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioFormat AUDIO_FORMAT_WMA_PRO;
+  }
+
+  public enum AudioGainMode {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioGainMode AUDIO_GAIN_MODE_CHANNELS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioGainMode AUDIO_GAIN_MODE_JOINT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioGainMode AUDIO_GAIN_MODE_RAMP;
+  }
+
+  public enum AudioInOutFlag {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_DIRECT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_FAST;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_HW_AV_SYNC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_HW_HOTWORD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_MMAP_NOIRQ;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_RAW;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_SYNC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_INPUT_FLAG_VOIP_TX;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_DEEP_BUFFER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_DIRECT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_DIRECT_PCM;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_FAST;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_GAPLESS_OFFLOAD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_HW_AV_SYNC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_IEC958_NONAUDIO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_INCALL_MUSIC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_MMAP_NOIRQ;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_NON_BLOCKING;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_PRIMARY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_RAW;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_SPATIALIZER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_SYNC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_TTS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioInOutFlag AUDIO_OUTPUT_FLAG_VOIP_RX;
+  }
+
+  public class AudioPolicyConfiguration {
+    ctor public AudioPolicyConfiguration();
+    method @Nullable public android.audio.policy.configuration.V7_1.GlobalConfiguration getGlobalConfiguration();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Modules> getModules();
+    method @Nullable public android.audio.policy.configuration.V7_1.SurroundSound getSurroundSound();
+    method @Nullable public android.audio.policy.configuration.V7_1.Version getVersion();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Volumes> getVolumes();
+    method public void setGlobalConfiguration(@Nullable android.audio.policy.configuration.V7_1.GlobalConfiguration);
+    method public void setSurroundSound(@Nullable android.audio.policy.configuration.V7_1.SurroundSound);
+    method public void setVersion(@Nullable android.audio.policy.configuration.V7_1.Version);
+  }
+
+  public enum AudioSource {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_CAMCORDER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_DEFAULT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_ECHO_REFERENCE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_FM_TUNER;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_HOTWORD;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_MIC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_REMOTE_SUBMIX;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_UNPROCESSED;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_VOICE_CALL;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_VOICE_COMMUNICATION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_VOICE_DOWNLINK;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_VOICE_PERFORMANCE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_VOICE_RECOGNITION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioSource AUDIO_SOURCE_VOICE_UPLINK;
+  }
+
+  public enum AudioStreamType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_ACCESSIBILITY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_ALARM;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_ASSISTANT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_BLUETOOTH_SCO;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_CALL_ASSISTANT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_DTMF;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_ENFORCED_AUDIBLE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_MUSIC;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_NOTIFICATION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_PATCH;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_REROUTING;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_RING;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_SYSTEM;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_TTS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioStreamType AUDIO_STREAM_VOICE_CALL;
+  }
+
+  public enum AudioUsage {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_ALARM;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_ANNOUNCEMENT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_ASSISTANCE_ACCESSIBILITY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_ASSISTANCE_SONIFICATION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_ASSISTANT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_CALL_ASSISTANT;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_EMERGENCY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_GAME;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_MEDIA;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_NOTIFICATION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_SAFETY;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_UNKNOWN;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_VEHICLE_STATUS;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_VIRTUAL_SOURCE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_VOICE_COMMUNICATION;
+    enum_constant public static final android.audio.policy.configuration.V7_1.AudioUsage AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING;
+  }
+
+  public enum DeviceCategory {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.DeviceCategory DEVICE_CATEGORY_EARPIECE;
+    enum_constant public static final android.audio.policy.configuration.V7_1.DeviceCategory DEVICE_CATEGORY_EXT_MEDIA;
+    enum_constant public static final android.audio.policy.configuration.V7_1.DeviceCategory DEVICE_CATEGORY_HEADSET;
+    enum_constant public static final android.audio.policy.configuration.V7_1.DeviceCategory DEVICE_CATEGORY_HEARING_AID;
+    enum_constant public static final android.audio.policy.configuration.V7_1.DeviceCategory DEVICE_CATEGORY_SPEAKER;
+  }
+
+  public class DevicePorts {
+    ctor public DevicePorts();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.DevicePorts.DevicePort> getDevicePort();
+  }
+
+  public static class DevicePorts.DevicePort {
+    ctor public DevicePorts.DevicePort();
+    method @Nullable public String getAddress();
+    method @Nullable public java.util.List<java.lang.String> getEncodedFormats();
+    method @Nullable public android.audio.policy.configuration.V7_1.Gains getGains();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Profile> getProfile();
+    method @Nullable public android.audio.policy.configuration.V7_1.Role getRole();
+    method @Nullable public String getTagName();
+    method @Nullable public String getType();
+    method @Nullable public boolean get_default();
+    method public void setAddress(@Nullable String);
+    method public void setEncodedFormats(@Nullable java.util.List<java.lang.String>);
+    method public void setGains(@Nullable android.audio.policy.configuration.V7_1.Gains);
+    method public void setRole(@Nullable android.audio.policy.configuration.V7_1.Role);
+    method public void setTagName(@Nullable String);
+    method public void setType(@Nullable String);
+    method public void set_default(@Nullable boolean);
+  }
+
+  public enum EngineSuffix {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.EngineSuffix _default;
+    enum_constant public static final android.audio.policy.configuration.V7_1.EngineSuffix configurable;
+  }
+
+  public class Gains {
+    ctor public Gains();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Gains.Gain> getGain();
+  }
+
+  public static class Gains.Gain {
+    ctor public Gains.Gain();
+    method @Nullable public android.audio.policy.configuration.V7_1.AudioChannelMask getChannel_mask();
+    method @Nullable public int getDefaultValueMB();
+    method @Nullable public int getMaxRampMs();
+    method @Nullable public int getMaxValueMB();
+    method @Nullable public int getMinRampMs();
+    method @Nullable public int getMinValueMB();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.AudioGainMode> getMode();
+    method @Nullable public String getName();
+    method @Nullable public int getStepValueMB();
+    method @Nullable public boolean getUseForVolume();
+    method public void setChannel_mask(@Nullable android.audio.policy.configuration.V7_1.AudioChannelMask);
+    method public void setDefaultValueMB(@Nullable int);
+    method public void setMaxRampMs(@Nullable int);
+    method public void setMaxValueMB(@Nullable int);
+    method public void setMinRampMs(@Nullable int);
+    method public void setMinValueMB(@Nullable int);
+    method public void setMode(@Nullable java.util.List<android.audio.policy.configuration.V7_1.AudioGainMode>);
+    method public void setName(@Nullable String);
+    method public void setStepValueMB(@Nullable int);
+    method public void setUseForVolume(@Nullable boolean);
+  }
+
+  public class GlobalConfiguration {
+    ctor public GlobalConfiguration();
+    method @Nullable public boolean getCall_screen_mode_supported();
+    method @Nullable public android.audio.policy.configuration.V7_1.EngineSuffix getEngine_library();
+    method @Nullable public boolean getSpeaker_drc_enabled();
+    method public void setCall_screen_mode_supported(@Nullable boolean);
+    method public void setEngine_library(@Nullable android.audio.policy.configuration.V7_1.EngineSuffix);
+    method public void setSpeaker_drc_enabled(@Nullable boolean);
+  }
+
+  public enum HalVersion {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.HalVersion _2_0;
+    enum_constant public static final android.audio.policy.configuration.V7_1.HalVersion _3_0;
+  }
+
+  public class MixPorts {
+    ctor public MixPorts();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.MixPorts.MixPort> getMixPort();
+  }
+
+  public static class MixPorts.MixPort {
+    ctor public MixPorts.MixPort();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.AudioInOutFlag> getFlags();
+    method @Nullable public android.audio.policy.configuration.V7_1.Gains getGains();
+    method @Nullable public long getMaxActiveCount();
+    method @Nullable public long getMaxOpenCount();
+    method @Nullable public String getName();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.AudioUsage> getPreferredUsage();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Profile> getProfile();
+    method @Nullable public long getRecommendedMuteDurationMs();
+    method @Nullable public android.audio.policy.configuration.V7_1.Role getRole();
+    method public void setFlags(@Nullable java.util.List<android.audio.policy.configuration.V7_1.AudioInOutFlag>);
+    method public void setGains(@Nullable android.audio.policy.configuration.V7_1.Gains);
+    method public void setMaxActiveCount(@Nullable long);
+    method public void setMaxOpenCount(@Nullable long);
+    method public void setName(@Nullable String);
+    method public void setPreferredUsage(@Nullable java.util.List<android.audio.policy.configuration.V7_1.AudioUsage>);
+    method public void setRecommendedMuteDurationMs(@Nullable long);
+    method public void setRole(@Nullable android.audio.policy.configuration.V7_1.Role);
+  }
+
+  public enum MixType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.MixType mix;
+    enum_constant public static final android.audio.policy.configuration.V7_1.MixType mux;
+  }
+
+  public class Modules {
+    ctor public Modules();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Modules.Module> getModule();
+  }
+
+  public static class Modules.Module {
+    ctor public Modules.Module();
+    method @Nullable public android.audio.policy.configuration.V7_1.AttachedDevices getAttachedDevices();
+    method @Nullable public String getDefaultOutputDevice();
+    method @Nullable public android.audio.policy.configuration.V7_1.DevicePorts getDevicePorts();
+    method @Nullable public android.audio.policy.configuration.V7_1.HalVersion getHalVersion();
+    method @Nullable public android.audio.policy.configuration.V7_1.MixPorts getMixPorts();
+    method @Nullable public String getName();
+    method @Nullable public android.audio.policy.configuration.V7_1.Routes getRoutes();
+    method public void setAttachedDevices(@Nullable android.audio.policy.configuration.V7_1.AttachedDevices);
+    method public void setDefaultOutputDevice(@Nullable String);
+    method public void setDevicePorts(@Nullable android.audio.policy.configuration.V7_1.DevicePorts);
+    method public void setHalVersion(@Nullable android.audio.policy.configuration.V7_1.HalVersion);
+    method public void setMixPorts(@Nullable android.audio.policy.configuration.V7_1.MixPorts);
+    method public void setName(@Nullable String);
+    method public void setRoutes(@Nullable android.audio.policy.configuration.V7_1.Routes);
+  }
+
+  public class Profile {
+    ctor public Profile();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.AudioChannelMask> getChannelMasks();
+    method @Nullable public android.audio.policy.configuration.V7_1.AudioEncapsulationType getEncapsulationType();
+    method @Nullable public String getFormat();
+    method @Nullable public String getName();
+    method @Nullable public java.util.List<java.math.BigInteger> getSamplingRates();
+    method public void setChannelMasks(@Nullable java.util.List<android.audio.policy.configuration.V7_1.AudioChannelMask>);
+    method public void setEncapsulationType(@Nullable android.audio.policy.configuration.V7_1.AudioEncapsulationType);
+    method public void setFormat(@Nullable String);
+    method public void setName(@Nullable String);
+    method public void setSamplingRates(@Nullable java.util.List<java.math.BigInteger>);
+  }
+
+  public class Reference {
+    ctor public Reference();
+    method @Nullable public String getName();
+    method @Nullable public java.util.List<java.lang.String> getPoint();
+    method public void setName(@Nullable String);
+  }
+
+  public enum Role {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.Role sink;
+    enum_constant public static final android.audio.policy.configuration.V7_1.Role source;
+  }
+
+  public class Routes {
+    ctor public Routes();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Routes.Route> getRoute();
+  }
+
+  public static class Routes.Route {
+    ctor public Routes.Route();
+    method @Nullable public String getSink();
+    method @Nullable public String getSources();
+    method @Nullable public android.audio.policy.configuration.V7_1.MixType getType();
+    method public void setSink(@Nullable String);
+    method public void setSources(@Nullable String);
+    method public void setType(@Nullable android.audio.policy.configuration.V7_1.MixType);
+  }
+
+  public class SurroundFormats {
+    ctor public SurroundFormats();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.SurroundFormats.Format> getFormat();
+  }
+
+  public static class SurroundFormats.Format {
+    ctor public SurroundFormats.Format();
+    method @Nullable public String getName();
+    method @Nullable public java.util.List<java.lang.String> getSubformats();
+    method public void setName(@Nullable String);
+    method public void setSubformats(@Nullable java.util.List<java.lang.String>);
+  }
+
+  public class SurroundSound {
+    ctor public SurroundSound();
+    method @Nullable public android.audio.policy.configuration.V7_1.SurroundFormats getFormats();
+    method public void setFormats(@Nullable android.audio.policy.configuration.V7_1.SurroundFormats);
+  }
+
+  public enum Version {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.configuration.V7_1.Version _7_0;
+    enum_constant public static final android.audio.policy.configuration.V7_1.Version _7_1;
+  }
+
+  public class Volume {
+    ctor public Volume();
+    method @Nullable public android.audio.policy.configuration.V7_1.DeviceCategory getDeviceCategory();
+    method @Nullable public java.util.List<java.lang.String> getPoint();
+    method @Nullable public String getRef();
+    method @Nullable public android.audio.policy.configuration.V7_1.AudioStreamType getStream();
+    method public void setDeviceCategory(@Nullable android.audio.policy.configuration.V7_1.DeviceCategory);
+    method public void setRef(@Nullable String);
+    method public void setStream(@Nullable android.audio.policy.configuration.V7_1.AudioStreamType);
+  }
+
+  public class Volumes {
+    ctor public Volumes();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Reference> getReference();
+    method @Nullable public java.util.List<android.audio.policy.configuration.V7_1.Volume> getVolume();
+  }
+
+  public class XmlParser {
+    ctor public XmlParser();
+    method @Nullable public static android.audio.policy.configuration.V7_1.AudioPolicyConfiguration read(@NonNull java.io.InputStream) throws javax.xml.datatype.DatatypeConfigurationException, java.io.IOException, org.xmlpull.v1.XmlPullParserException;
+    method @Nullable public static String readText(@NonNull org.xmlpull.v1.XmlPullParser) throws java.io.IOException, org.xmlpull.v1.XmlPullParserException;
+    method public static void skip(@NonNull org.xmlpull.v1.XmlPullParser) throws java.io.IOException, org.xmlpull.v1.XmlPullParserException;
+  }
+
+}
+
diff --git a/audio/7.1/config/api/last_current.txt b/audio/7.1/config/api/last_current.txt
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/audio/7.1/config/api/last_current.txt
diff --git a/audio/7.1/config/api/last_removed.txt b/audio/7.1/config/api/last_removed.txt
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/audio/7.1/config/api/last_removed.txt
diff --git a/audio/7.1/config/api/removed.txt b/audio/7.1/config/api/removed.txt
new file mode 100644
index 0000000..d802177
--- /dev/null
+++ b/audio/7.1/config/api/removed.txt
@@ -0,0 +1 @@
+// Signature format: 2.0
diff --git a/audio/7.1/config/audio_policy_configuration.xsd b/audio/7.1/config/audio_policy_configuration.xsd
new file mode 100644
index 0000000..414552e
--- /dev/null
+++ b/audio/7.1/config/audio_policy_configuration.xsd
@@ -0,0 +1,820 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright (C) 2020 The Android Open Source Project
+
+         Licensed under the Apache License, Version 2.0 (the "License");
+         you may not use this file except in compliance with the License.
+         You may obtain a copy of the License at
+
+                    http://www.apache.org/licenses/LICENSE-2.0
+
+         Unless required by applicable law or agreed to in writing, software
+         distributed under the License is distributed on an "AS IS" BASIS,
+         WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+         See the License for the specific language governing permissions and
+         limitations under the License.
+-->
+<xs:schema version="2.0"
+           elementFormDefault="qualified"
+           attributeFormDefault="unqualified"
+           xmlns:xs="http://www.w3.org/2001/XMLSchema">
+    <!-- List the config versions supported by audio policy. -->
+    <xs:simpleType name="version">
+        <xs:restriction base="xs:decimal">
+            <xs:enumeration value="7.0"/>
+            <xs:enumeration value="7.1"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="halVersion">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Version of the interface the hal implements. Note that this
+                relates to legacy HAL API versions since HIDL APIs are versioned
+                using other mechanisms.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:decimal">
+            <!-- List of HAL versions supported by the framework. -->
+            <xs:enumeration value="2.0"/>
+            <xs:enumeration value="3.0"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:element name="audioPolicyConfiguration">
+        <xs:complexType>
+            <xs:sequence>
+                <xs:element name="globalConfiguration" type="globalConfiguration"/>
+                <xs:element name="modules" type="modules" maxOccurs="unbounded"/>
+                <xs:element name="volumes" type="volumes" maxOccurs="unbounded"/>
+                <xs:element name="surroundSound" type="surroundSound" minOccurs="0" />
+            </xs:sequence>
+            <xs:attribute name="version" type="version"/>
+        </xs:complexType>
+        <xs:key name="moduleNameKey">
+            <xs:selector xpath="modules/module"/>
+            <xs:field xpath="@name"/>
+        </xs:key>
+        <xs:unique name="volumeTargetUniqueness">
+            <xs:selector xpath="volumes/volume"/>
+            <xs:field xpath="@stream"/>
+            <xs:field xpath="@deviceCategory"/>
+        </xs:unique>
+        <xs:key name="volumeCurveNameKey">
+            <xs:selector xpath="volumes/reference"/>
+            <xs:field xpath="@name"/>
+        </xs:key>
+        <xs:keyref name="volumeCurveRef" refer="volumeCurveNameKey">
+            <xs:selector xpath="volumes/volume"/>
+            <xs:field xpath="@ref"/>
+        </xs:keyref>
+    </xs:element>
+    <xs:complexType name="globalConfiguration">
+        <xs:attribute name="speaker_drc_enabled" type="xs:boolean" use="required"/>
+        <xs:attribute name="call_screen_mode_supported" type="xs:boolean" use="optional"/>
+        <xs:attribute name="engine_library" type="engineSuffix" use="optional"/>
+    </xs:complexType>
+    <xs:complexType name="modules">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                There should be one section per audio HW module present on the platform.
+                Each <module/> contains two mandatory tags: “halVersion” and “name”.
+                The module "name" is the same as in previous .conf file.
+                Each module must contain the following sections:
+                 - <devicePorts/>: a list of device descriptors for all
+                   input and output devices accessible via this module.
+                   This contains both permanently attached devices and removable devices.
+                 - <mixPorts/>: listing all output and input streams exposed by the audio HAL
+                 - <routes/>: list of possible connections between input
+                   and output devices or between stream and devices.
+                   A <route/> is defined by a set of 3 attributes:
+                        -"type": mux|mix means all sources are mutual exclusive (mux) or can be mixed (mix)
+                        -"sink": the sink involved in this route
+                        -"sources": all the sources than can be connected to the sink via this route
+                 - <attachedDevices/>: permanently attached devices.
+                   The attachedDevices section is a list of devices names.
+                   Their names correspond to device names defined in "devicePorts" section.
+                 - <defaultOutputDevice/> is the device to be used when no policy rule applies
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="module" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="attachedDevices" type="attachedDevices" minOccurs="0">
+                            <xs:unique name="attachedDevicesUniqueness">
+                                <xs:selector xpath="item"/>
+                                <xs:field xpath="."/>
+                            </xs:unique>
+                        </xs:element>
+                        <xs:element name="defaultOutputDevice" type="xs:token" minOccurs="0"/>
+                        <xs:element name="mixPorts" type="mixPorts" minOccurs="0"/>
+                        <xs:element name="devicePorts" type="devicePorts" minOccurs="0"/>
+                        <xs:element name="routes" type="routes" minOccurs="0"/>
+                    </xs:sequence>
+                    <xs:attribute name="name" type="xs:string" use="required"/>
+                    <xs:attribute name="halVersion" type="halVersion" use="required"/>
+                </xs:complexType>
+                <xs:unique name="mixPortNameUniqueness">
+                    <xs:selector xpath="mixPorts/mixPort"/>
+                    <xs:field xpath="@name"/>
+                </xs:unique>
+                <xs:key name="devicePortNameKey">
+                    <xs:selector xpath="devicePorts/devicePort"/>
+                    <xs:field xpath="@tagName"/>
+                </xs:key>
+                <xs:unique name="devicePortUniqueness">
+                    <xs:selector xpath="devicePorts/devicePort"/>
+                    <xs:field xpath="@type"/>
+                    <xs:field xpath="@address"/>
+                </xs:unique>
+                <xs:keyref name="defaultOutputDeviceRef" refer="devicePortNameKey">
+                    <xs:selector xpath="defaultOutputDevice"/>
+                    <xs:field xpath="."/>
+                </xs:keyref>
+                <xs:keyref name="attachedDeviceRef" refer="devicePortNameKey">
+                    <xs:selector xpath="attachedDevices/item"/>
+                    <xs:field xpath="."/>
+                </xs:keyref>
+                <!-- The following 3 constraints try to make sure each sink port
+                     is reference in one an only one route. -->
+                <xs:key name="routeSinkKey">
+                    <!-- predicate [@type='sink'] does not work in xsd 1.0 -->
+                    <xs:selector xpath="devicePorts/devicePort|mixPorts/mixPort"/>
+                    <xs:field xpath="@tagName|@name"/>
+                </xs:key>
+                <xs:keyref name="routeSinkRef" refer="routeSinkKey">
+                    <xs:selector xpath="routes/route"/>
+                    <xs:field xpath="@sink"/>
+                </xs:keyref>
+                <xs:unique name="routeUniqueness">
+                    <xs:selector xpath="routes/route"/>
+                    <xs:field xpath="@sink"/>
+                </xs:unique>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:complexType name="attachedDevices">
+        <xs:sequence>
+            <xs:element name="item" type="xs:token" minOccurs="0" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:simpleType name="audioInOutFlag">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+              The flags indicate suggested stream attributes supported by the profile.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_DIRECT" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_PRIMARY" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_FAST" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_DEEP_BUFFER" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_NON_BLOCKING" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_HW_AV_SYNC" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_TTS" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_RAW" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_SYNC" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_IEC958_NONAUDIO" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_DIRECT_PCM" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_MMAP_NOIRQ" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_VOIP_RX" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_INCALL_MUSIC" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_GAPLESS_OFFLOAD" />
+            <xs:enumeration value="AUDIO_OUTPUT_FLAG_SPATIALIZER" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_FAST" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_HW_HOTWORD" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_RAW" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_SYNC" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_MMAP_NOIRQ" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_VOIP_TX" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_HW_AV_SYNC" />
+            <xs:enumeration value="AUDIO_INPUT_FLAG_DIRECT" />
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="audioInOutFlags">
+        <xs:list itemType="audioInOutFlag" />
+    </xs:simpleType>
+    <xs:simpleType name="role">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="sink"/>
+            <xs:enumeration value="source"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="mixPorts">
+        <xs:sequence>
+            <xs:element name="mixPort" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="profile" type="profile" minOccurs="0" maxOccurs="unbounded"/>
+                        <xs:element name="gains" type="gains" minOccurs="0"/>
+                    </xs:sequence>
+                    <xs:attribute name="name" type="xs:token" use="required"/>
+                    <xs:attribute name="role" type="role" use="required"/>
+                    <xs:attribute name="flags" type="audioInOutFlags"/>
+                    <xs:attribute name="maxOpenCount" type="xs:unsignedInt"/>
+                    <xs:attribute name="maxActiveCount" type="xs:unsignedInt"/>
+                    <xs:attribute name="preferredUsage" type="audioUsageList">
+                        <xs:annotation>
+                            <xs:documentation xml:lang="en">
+                                When choosing the mixPort of an audio track, the audioPolicy
+                                first considers the mixPorts with a preferredUsage including
+                                the track AudioUsage preferred .
+                                If non support the track format, the other mixPorts are considered.
+                                Eg: a <mixPort preferredUsage="AUDIO_USAGE_MEDIA" /> will receive
+                                    the audio of all apps playing with a MEDIA usage.
+                                    It may receive audio from ALARM if there are no audio compatible
+                                    <mixPort preferredUsage="AUDIO_USAGE_ALARM" />.
+                             </xs:documentation>
+                        </xs:annotation>
+                    </xs:attribute>
+                    <xs:attribute name="recommendedMuteDurationMs" type="xs:unsignedInt"/>
+                </xs:complexType>
+                <xs:unique name="mixPortProfileUniqueness">
+                    <xs:selector xpath="profile"/>
+                    <xs:field xpath="format"/>
+                    <xs:field xpath="samplingRate"/>
+                    <xs:field xpath="channelMasks"/>
+                </xs:unique>
+                <xs:unique name="mixPortGainUniqueness">
+                    <xs:selector xpath="gains/gain"/>
+                    <xs:field xpath="@name"/>
+                </xs:unique>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:simpleType name="audioDevice">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_DEVICE_NONE"/>
+
+            <xs:enumeration value="AUDIO_DEVICE_OUT_EARPIECE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_SPEAKER"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_WIRED_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_WIRED_HEADPHONE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HDMI"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HDMI_EARC"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_AUX_DIGITAL"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_USB_ACCESSORY"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_USB_DEVICE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_REMOTE_SUBMIX"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_TELEPHONY_TX"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_LINE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HDMI_ARC"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_SPDIF"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_FM"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_AUX_LINE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_SPEAKER_SAFE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_IP"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BUS"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_PROXY"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_USB_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HEARING_AID"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_ECHO_CANCELLER"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLE_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLE_SPEAKER"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_BLE_BROADCAST"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_DEFAULT"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_STUB"/>
+
+            <xs:enumeration value="AUDIO_DEVICE_IN_COMMUNICATION"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_AMBIENT"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BUILTIN_MIC"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_WIRED_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_HDMI"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_AUX_DIGITAL"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_VOICE_CALL"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_TELEPHONY_RX"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BACK_MIC"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_REMOTE_SUBMIX"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_ANLG_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_DGTL_DOCK_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_USB_ACCESSORY"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_USB_DEVICE"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_FM_TUNER"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_TV_TUNER"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_LINE"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_SPDIF"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_A2DP"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_LOOPBACK"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_IP"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BUS"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_PROXY"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_USB_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_BLE"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_HDMI_ARC"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_HDMI_EARC"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_ECHO_REFERENCE"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLE_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_DEFAULT"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_STUB"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="vendorExtension">
+        <!-- Vendor extension names must be prefixed by "VX_" to distinguish them from
+             AOSP values. Vendors must namespace their names to avoid conflicts. The
+             namespace part must only use capital latin characters and decimal digits and
+             consist of at least 3 characters. The part of the extension name after the
+             namespace may in addition include underscores. Example for a hypothetical
+             Google virtual reality device:
+
+                 <devicePort tagName="VR" type="VX_GOOGLE_VR" role="sink" />
+        -->
+        <xs:restriction base="xs:string">
+            <xs:pattern value="VX_[A-Z0-9]{3,}_[_A-Z0-9]+"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="extendableAudioDevice">
+        <xs:union memberTypes="audioDevice vendorExtension"/>
+    </xs:simpleType>
+    <xs:simpleType name="audioFormat">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_FORMAT_DEFAULT" />
+            <xs:enumeration value="AUDIO_FORMAT_PCM_16_BIT" />
+            <xs:enumeration value="AUDIO_FORMAT_PCM_8_BIT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_32_BIT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_8_24_BIT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_FLOAT"/>
+            <xs:enumeration value="AUDIO_FORMAT_PCM_24_BIT_PACKED"/>
+            <xs:enumeration value="AUDIO_FORMAT_MP3"/>
+            <xs:enumeration value="AUDIO_FORMAT_AMR_NB"/>
+            <xs:enumeration value="AUDIO_FORMAT_AMR_WB"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_MAIN"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_SSR"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LTP"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_HE_V1"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_SCALABLE"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ERLC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_HE_V2"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ELD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_XHE"/>
+            <xs:enumeration value="AUDIO_FORMAT_HE_AAC_V1"/>
+            <xs:enumeration value="AUDIO_FORMAT_HE_AAC_V2"/>
+            <xs:enumeration value="AUDIO_FORMAT_VORBIS"/>
+            <xs:enumeration value="AUDIO_FORMAT_OPUS"/>
+            <xs:enumeration value="AUDIO_FORMAT_AC3"/>
+            <xs:enumeration value="AUDIO_FORMAT_E_AC3"/>
+            <xs:enumeration value="AUDIO_FORMAT_E_AC3_JOC"/>
+            <xs:enumeration value="AUDIO_FORMAT_DTS"/>
+            <xs:enumeration value="AUDIO_FORMAT_DTS_HD"/>
+            <xs:enumeration value="AUDIO_FORMAT_IEC61937"/>
+            <xs:enumeration value="AUDIO_FORMAT_DOLBY_TRUEHD"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRC"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRCB"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRCWB"/>
+            <xs:enumeration value="AUDIO_FORMAT_EVRCNW"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADIF"/>
+            <xs:enumeration value="AUDIO_FORMAT_WMA"/>
+            <xs:enumeration value="AUDIO_FORMAT_WMA_PRO"/>
+            <xs:enumeration value="AUDIO_FORMAT_AMR_WB_PLUS"/>
+            <xs:enumeration value="AUDIO_FORMAT_MP2"/>
+            <xs:enumeration value="AUDIO_FORMAT_QCELP"/>
+            <xs:enumeration value="AUDIO_FORMAT_DSD"/>
+            <xs:enumeration value="AUDIO_FORMAT_FLAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_ALAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_APE"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_MAIN"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_LC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_SSR"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_LTP"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_HE_V1"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_SCALABLE"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_ERLC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_LD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_HE_V2"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_ELD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_ADTS_XHE"/>
+            <xs:enumeration value="AUDIO_FORMAT_SBC"/>
+            <xs:enumeration value="AUDIO_FORMAT_APTX"/>
+            <xs:enumeration value="AUDIO_FORMAT_APTX_HD"/>
+            <xs:enumeration value="AUDIO_FORMAT_AC4"/>
+            <xs:enumeration value="AUDIO_FORMAT_LDAC"/>
+            <xs:enumeration value="AUDIO_FORMAT_MAT"/>
+            <xs:enumeration value="AUDIO_FORMAT_MAT_1_0"/>
+            <xs:enumeration value="AUDIO_FORMAT_MAT_2_0"/>
+            <xs:enumeration value="AUDIO_FORMAT_MAT_2_1"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LATM"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LATM_LC"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LATM_HE_V1"/>
+            <xs:enumeration value="AUDIO_FORMAT_AAC_LATM_HE_V2"/>
+            <xs:enumeration value="AUDIO_FORMAT_CELT"/>
+            <xs:enumeration value="AUDIO_FORMAT_APTX_ADAPTIVE"/>
+            <xs:enumeration value="AUDIO_FORMAT_LHDC"/>
+            <xs:enumeration value="AUDIO_FORMAT_LHDC_LL"/>
+            <xs:enumeration value="AUDIO_FORMAT_APTX_TWSP"/>
+            <xs:enumeration value="AUDIO_FORMAT_LC3"/>
+            <xs:enumeration value="AUDIO_FORMAT_MPEGH_BL_L3"/>
+            <xs:enumeration value="AUDIO_FORMAT_MPEGH_BL_L4"/>
+            <xs:enumeration value="AUDIO_FORMAT_MPEGH_LC_L3"/>
+            <xs:enumeration value="AUDIO_FORMAT_MPEGH_LC_L4"/>
+            <xs:enumeration value="AUDIO_FORMAT_IEC60958"/>
+            <xs:enumeration value="AUDIO_FORMAT_DTS_UHD"/>
+            <xs:enumeration value="AUDIO_FORMAT_DRA"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="extendableAudioFormat">
+        <xs:union memberTypes="audioFormat vendorExtension"/>
+    </xs:simpleType>
+    <xs:simpleType name="audioUsage">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Audio usage specifies the intended use case for the sound being played.
+                Please consult frameworks/base/media/java/android/media/AudioAttributes.java
+                for the description of each value.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_USAGE_UNKNOWN" />
+            <xs:enumeration value="AUDIO_USAGE_MEDIA" />
+            <xs:enumeration value="AUDIO_USAGE_VOICE_COMMUNICATION" />
+            <xs:enumeration value="AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING" />
+            <xs:enumeration value="AUDIO_USAGE_ALARM" />
+            <xs:enumeration value="AUDIO_USAGE_NOTIFICATION" />
+            <xs:enumeration value="AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANCE_ACCESSIBILITY" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANCE_SONIFICATION" />
+            <xs:enumeration value="AUDIO_USAGE_GAME" />
+            <xs:enumeration value="AUDIO_USAGE_VIRTUAL_SOURCE" />
+            <xs:enumeration value="AUDIO_USAGE_ASSISTANT" />
+            <xs:enumeration value="AUDIO_USAGE_CALL_ASSISTANT" />
+            <xs:enumeration value="AUDIO_USAGE_EMERGENCY" />
+            <xs:enumeration value="AUDIO_USAGE_SAFETY" />
+            <xs:enumeration value="AUDIO_USAGE_VEHICLE_STATUS" />
+            <xs:enumeration value="AUDIO_USAGE_ANNOUNCEMENT" />
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="audioUsageList">
+        <xs:list itemType="audioUsage"/>
+    </xs:simpleType>
+    <xs:simpleType name="audioContentType">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Audio content type expresses the general category of the content.
+                Please consult frameworks/base/media/java/android/media/AudioAttributes.java
+                for the description of each value.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_CONTENT_TYPE_UNKNOWN"/>
+            <xs:enumeration value="AUDIO_CONTENT_TYPE_SPEECH"/>
+            <xs:enumeration value="AUDIO_CONTENT_TYPE_MUSIC"/>
+            <xs:enumeration value="AUDIO_CONTENT_TYPE_MOVIE"/>
+            <xs:enumeration value="AUDIO_CONTENT_TYPE_SONIFICATION"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="samplingRates">
+        <xs:list itemType="xs:nonNegativeInteger" />
+    </xs:simpleType>
+    <xs:simpleType name="audioChannelMask">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Audio channel mask specifies presence of particular channels.
+                There are two representations:
+                - representation position (traditional discrete channel specification,
+                  e.g. "left", "right");
+                - indexed (this is similar to "tracks" in audio mixing, channels
+                  are represented using numbers).
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_CHANNEL_NONE"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_MONO"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_STEREO"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_2POINT1"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_TRI"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_TRI_BACK"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_3POINT1"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_2POINT0POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_2POINT1POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_3POINT0POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_3POINT1POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_QUAD"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_QUAD_BACK"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_QUAD_SIDE"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_SURROUND"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_PENTA"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_5POINT1"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_5POINT1_BACK"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_5POINT1_SIDE"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_5POINT1POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_5POINT1POINT4"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_6POINT1"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_7POINT1"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_7POINT1POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_7POINT1POINT4"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_9POINT1POINT4"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_9POINT1POINT6"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_13POINT_360RA"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_22POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_MONO_HAPTIC_A"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_STEREO_HAPTIC_A"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_HAPTIC_AB"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_MONO_HAPTIC_AB"/>
+            <xs:enumeration value="AUDIO_CHANNEL_OUT_STEREO_HAPTIC_AB"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_MONO"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_STEREO"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_FRONT_BACK"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_6"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_2POINT0POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_2POINT1POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_3POINT0POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_3POINT1POINT2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_5POINT1"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_VOICE_UPLINK_MONO"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_VOICE_DNLINK_MONO"/>
+            <xs:enumeration value="AUDIO_CHANNEL_IN_VOICE_CALL_MONO"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_1"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_2"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_3"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_4"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_5"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_6"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_7"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_8"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_9"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_10"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_11"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_12"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_13"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_14"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_15"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_16"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_17"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_18"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_19"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_20"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_21"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_22"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_23"/>
+            <xs:enumeration value="AUDIO_CHANNEL_INDEX_MASK_24"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="channelMasks">
+        <xs:list itemType="audioChannelMask" />
+    </xs:simpleType>
+    <xs:simpleType name="audioEncapsulationType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_ENCAPSULATION_TYPE_NONE"/>
+            <xs:enumeration value="AUDIO_ENCAPSULATION_TYPE_IEC61937"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="profile">
+        <xs:attribute name="name" type="xs:token" use="optional"/>
+        <xs:attribute name="format" type="extendableAudioFormat" use="optional"/>
+        <xs:attribute name="samplingRates" type="samplingRates" use="optional"/>
+        <xs:attribute name="channelMasks" type="channelMasks" use="optional"/>
+        <xs:attribute name="encapsulationType" type="audioEncapsulationType" use="optional"/>
+    </xs:complexType>
+    <xs:simpleType name="audioGainMode">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_GAIN_MODE_JOINT"/>
+            <xs:enumeration value="AUDIO_GAIN_MODE_CHANNELS"/>
+            <xs:enumeration value="AUDIO_GAIN_MODE_RAMP"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="audioGainModeMaskUnrestricted">
+        <xs:list itemType="audioGainMode" />
+    </xs:simpleType>
+    <xs:simpleType name='audioGainModeMask'>
+        <xs:restriction base='audioGainModeMaskUnrestricted'>
+            <xs:minLength value='1' />
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="gains">
+        <xs:sequence>
+            <xs:element name="gain" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:attribute name="name" type="xs:token" use="required"/>
+                    <xs:attribute name="mode" type="audioGainModeMask" use="required"/>
+                    <xs:attribute name="channel_mask" type="audioChannelMask" use="optional"/>
+                    <xs:attribute name="minValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="maxValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="defaultValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="stepValueMB" type="xs:int" use="optional"/>
+                    <xs:attribute name="minRampMs" type="xs:int" use="optional"/>
+                    <xs:attribute name="maxRampMs" type="xs:int" use="optional"/>
+                    <xs:attribute name="useForVolume" type="xs:boolean" use="optional"/>
+                </xs:complexType>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:complexType name="devicePorts">
+        <xs:sequence>
+            <xs:element name="devicePort" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="profile" type="profile" minOccurs="0" maxOccurs="unbounded"/>
+                        <xs:element name="gains" type="gains" minOccurs="0"/>
+                    </xs:sequence>
+                    <xs:attribute name="tagName" type="xs:token" use="required"/>
+                    <xs:attribute name="type" type="extendableAudioDevice" use="required"/>
+                    <xs:attribute name="role" type="role" use="required"/>
+                    <xs:attribute name="address" type="xs:string" use="optional" default=""/>
+                    <!-- Note that XSD 1.0 can not check that a type only has one default. -->
+                    <xs:attribute name="default" type="xs:boolean" use="optional">
+                        <xs:annotation>
+                            <xs:documentation xml:lang="en">
+                                The default device will be used if multiple have the same type
+                                and no explicit route request exists for a specific device of
+                                that type.
+                            </xs:documentation>
+                        </xs:annotation>
+                    </xs:attribute>
+                    <xs:attribute name="encodedFormats" type="audioFormatsList" use="optional"
+                                  default="" />
+                </xs:complexType>
+                <xs:unique name="devicePortProfileUniqueness">
+                    <xs:selector xpath="profile"/>
+                    <xs:field xpath="format"/>
+                    <xs:field xpath="samplingRate"/>
+                    <xs:field xpath="channelMasks"/>
+                </xs:unique>
+                <xs:unique name="devicePortGainUniqueness">
+                    <xs:selector xpath="gains/gain"/>
+                    <xs:field xpath="@name"/>
+                </xs:unique>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:simpleType name="mixType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="mix"/>
+            <xs:enumeration value="mux"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="routes">
+        <xs:sequence>
+            <xs:element name="route" minOccurs="0" maxOccurs="unbounded">
+                <xs:annotation>
+                    <xs:documentation xml:lang="en">
+                        List all available sources for a given sink.
+                    </xs:documentation>
+                </xs:annotation>
+                <xs:complexType>
+                    <xs:attribute name="type" type="mixType" use="required"/>
+                    <xs:attribute name="sink" type="xs:string" use="required"/>
+                    <xs:attribute name="sources" type="xs:string" use="required"/>
+                </xs:complexType>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:complexType name="volumes">
+        <xs:sequence>
+            <xs:element name="volume" type="volume" minOccurs="0" maxOccurs="unbounded"/>
+            <xs:element name="reference" type="reference" minOccurs="0" maxOccurs="unbounded">
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <!-- TODO: Always require a ref for better xsd validations.
+               Currently a volume could have no points nor ref
+               as it can not be forbidden by xsd 1.0.-->
+    <xs:simpleType name="volumePoint">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Comma separated pair of number.
+                The fist one is the framework level (between 0 and 100).
+                The second one is the volume to send to the HAL.
+                The framework will interpolate volumes not specified.
+                Their MUST be at least 2 points specified.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:pattern value="([0-9]{1,2}|100),-?[0-9]+"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="audioStreamType">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Audio stream type describing the intended use case of a stream.
+                Please consult frameworks/base/media/java/android/media/AudioSystem.java
+                for the description of each value.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_STREAM_VOICE_CALL"/>
+            <xs:enumeration value="AUDIO_STREAM_SYSTEM"/>
+            <xs:enumeration value="AUDIO_STREAM_RING"/>
+            <xs:enumeration value="AUDIO_STREAM_MUSIC"/>
+            <xs:enumeration value="AUDIO_STREAM_ALARM"/>
+            <xs:enumeration value="AUDIO_STREAM_NOTIFICATION"/>
+            <xs:enumeration value="AUDIO_STREAM_BLUETOOTH_SCO"/>
+            <xs:enumeration value="AUDIO_STREAM_ENFORCED_AUDIBLE"/>
+            <xs:enumeration value="AUDIO_STREAM_DTMF"/>
+            <xs:enumeration value="AUDIO_STREAM_TTS"/>
+            <xs:enumeration value="AUDIO_STREAM_ACCESSIBILITY"/>
+            <xs:enumeration value="AUDIO_STREAM_ASSISTANT"/>
+            <xs:enumeration value="AUDIO_STREAM_REROUTING"/>
+            <xs:enumeration value="AUDIO_STREAM_PATCH"/>
+            <xs:enumeration value="AUDIO_STREAM_CALL_ASSISTANT"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:simpleType name="audioSource">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                An audio source defines the intended use case for the sound being recorded.
+                Please consult frameworks/base/media/java/android/media/MediaRecorder.java
+                for the description of each value.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_SOURCE_DEFAULT"/>
+            <xs:enumeration value="AUDIO_SOURCE_MIC"/>
+            <xs:enumeration value="AUDIO_SOURCE_VOICE_UPLINK"/>
+            <xs:enumeration value="AUDIO_SOURCE_VOICE_DOWNLINK"/>
+            <xs:enumeration value="AUDIO_SOURCE_VOICE_CALL"/>
+            <xs:enumeration value="AUDIO_SOURCE_CAMCORDER"/>
+            <xs:enumeration value="AUDIO_SOURCE_VOICE_RECOGNITION"/>
+            <xs:enumeration value="AUDIO_SOURCE_VOICE_COMMUNICATION"/>
+            <xs:enumeration value="AUDIO_SOURCE_REMOTE_SUBMIX"/>
+            <xs:enumeration value="AUDIO_SOURCE_UNPROCESSED"/>
+            <xs:enumeration value="AUDIO_SOURCE_VOICE_PERFORMANCE"/>
+            <xs:enumeration value="AUDIO_SOURCE_ECHO_REFERENCE"/>
+            <xs:enumeration value="AUDIO_SOURCE_FM_TUNER"/>
+            <xs:enumeration value="AUDIO_SOURCE_HOTWORD"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <!-- Enum values of device_category from Volume.h. -->
+    <xs:simpleType name="deviceCategory">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="DEVICE_CATEGORY_HEADSET"/>
+            <xs:enumeration value="DEVICE_CATEGORY_SPEAKER"/>
+            <xs:enumeration value="DEVICE_CATEGORY_EARPIECE"/>
+            <xs:enumeration value="DEVICE_CATEGORY_EXT_MEDIA"/>
+            <xs:enumeration value="DEVICE_CATEGORY_HEARING_AID"/>
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:complexType name="volume">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Volume section defines a volume curve for a given use case and device category.
+                It contains a list of points of this curve expressing the attenuation in Millibels
+                for a given volume index from 0 to 100.
+                <volume stream="AUDIO_STREAM_MUSIC" deviceCategory="DEVICE_CATEGORY_SPEAKER">
+                    <point>0,-9600</point>
+                    <point>100,0</point>
+                </volume>
+
+                It may also reference a reference/@name to avoid duplicating curves.
+                <volume stream="AUDIO_STREAM_MUSIC" deviceCategory="DEVICE_CATEGORY_SPEAKER"
+                        ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
+                <reference name="DEFAULT_MEDIA_VOLUME_CURVE">
+                    <point>0,-9600</point>
+                    <point>100,0</point>
+                </reference>
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="point" type="volumePoint" minOccurs="0" maxOccurs="unbounded"/>
+        </xs:sequence>
+        <xs:attribute name="stream" type="audioStreamType"/>
+        <xs:attribute name="deviceCategory" type="deviceCategory"/>
+        <xs:attribute name="ref" type="xs:token" use="optional"/>
+    </xs:complexType>
+    <xs:complexType name="reference">
+        <xs:sequence>
+            <xs:element name="point" type="volumePoint" minOccurs="2" maxOccurs="unbounded"/>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:token" use="required"/>
+    </xs:complexType>
+    <xs:complexType name="surroundSound">
+        <xs:annotation>
+            <xs:documentation xml:lang="en">
+                Surround Sound section provides configuration related to handling of
+                multi-channel formats.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="formats" type="surroundFormats"/>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:simpleType name="audioFormatsList">
+        <xs:list itemType="extendableAudioFormat" />
+    </xs:simpleType>
+    <xs:complexType name="surroundFormats">
+        <xs:sequence>
+            <xs:element name="format" minOccurs="0" maxOccurs="unbounded">
+                <xs:complexType>
+                    <xs:attribute name="name" type="extendableAudioFormat" use="required"/>
+                    <xs:attribute name="subformats" type="audioFormatsList" />
+                </xs:complexType>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:simpleType name="engineSuffix">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="default"/>
+            <xs:enumeration value="configurable"/>
+        </xs:restriction>
+    </xs:simpleType>
+</xs:schema>
diff --git a/audio/7.1/types.hal b/audio/7.1/types.hal
new file mode 100644
index 0000000..9d8ee4d
--- /dev/null
+++ b/audio/7.1/types.hal
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio@7.1;
+
+/**
+ * Latency modes used for the variable latency feature on output streams.
+ * Used by setLatencyMode() and getRecommendedLatencyModes() methods.
+ */
+
+@export(name="audio_latency_mode_t", value_prefix="AUDIO_LATENCY_MODE_")
+enum LatencyMode : int32_t {
+    /** No specific constraint on the latency */
+    FREE = 0,
+    /** A relatively low latency compatible with head tracking operation (e.g less than 100ms) */
+    LOW = 1,
+};
diff --git a/audio/common/7.1/Android.bp b/audio/common/7.1/Android.bp
new file mode 100644
index 0000000..a257510
--- /dev/null
+++ b/audio/common/7.1/Android.bp
@@ -0,0 +1,23 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_library {
+    name: "android.hardware.audio.common@7.1-enums",
+    vendor_available: true,
+    generated_headers: ["audio_policy_configuration_V7_1_enums"],
+    generated_sources: ["audio_policy_configuration_V7_1_enums"],
+    header_libs: ["libxsdc-utils"],
+    export_generated_headers: ["audio_policy_configuration_V7_1_enums"],
+    export_header_lib_headers: ["libxsdc-utils"],
+    export_include_dirs: ["enums/include"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+    ],
+}
diff --git a/audio/common/7.1/enums/OWNERS b/audio/common/7.1/enums/OWNERS
new file mode 100644
index 0000000..24071af
--- /dev/null
+++ b/audio/common/7.1/enums/OWNERS
@@ -0,0 +1,2 @@
+elaurent@google.com
+mnaganov@google.com
diff --git a/audio/common/7.1/enums/include/android_audio_policy_configuration_V7_1-enums.h b/audio/common/7.1/enums/include/android_audio_policy_configuration_V7_1-enums.h
new file mode 100644
index 0000000..6f6a0ca
--- /dev/null
+++ b/audio/common/7.1/enums/include/android_audio_policy_configuration_V7_1-enums.h
@@ -0,0 +1,303 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_AUDIO_POLICY_CONFIGURATION_V7_1__ENUMS_H
+#define ANDROID_AUDIO_POLICY_CONFIGURATION_V7_1__ENUMS_H
+
+#include <sys/types.h>
+#include <regex>
+#include <string>
+
+#include <android_audio_policy_configuration_V7_1_enums.h>
+
+namespace android::audio::policy::configuration::V7_1 {
+
+static inline size_t getChannelCount(AudioChannelMask mask) {
+    switch (mask) {
+        case AudioChannelMask::AUDIO_CHANNEL_NONE:
+            return 0;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_MONO:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_MONO:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_1:
+            return 1;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_MONO_HAPTIC_A:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_HAPTIC_AB:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_STEREO:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_FRONT_BACK:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_VOICE_UPLINK_MONO:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_VOICE_DNLINK_MONO:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_VOICE_CALL_MONO:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_2:
+            return 2;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_2POINT1:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO_HAPTIC_A:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_MONO_HAPTIC_AB:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_TRI:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_TRI_BACK:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_3:
+            return 3;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_2POINT0POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_3POINT1:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_QUAD:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_QUAD_BACK:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_QUAD_SIDE:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_SURROUND:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO_HAPTIC_AB:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_2POINT0POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_4:
+            return 4;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_2POINT1POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_3POINT0POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_PENTA:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_2POINT1POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_3POINT0POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_5:
+            return 5;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_3POINT1POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_5POINT1:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_5POINT1_BACK:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_5POINT1_SIDE:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_6:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_3POINT1POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_IN_5POINT1:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_6:
+            return 6;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_6POINT1:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_7:
+            return 7;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_5POINT1POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_7POINT1:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_8:
+            return 8;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_9:
+            return 9;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_5POINT1POINT4:
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_7POINT1POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_10:
+            return 10;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_11:
+            return 11;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_7POINT1POINT4:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_12:
+            return 12;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_13POINT_360RA:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_13:
+            return 13;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_9POINT1POINT4:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_14:
+            return 14;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_15:
+            return 15;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_9POINT1POINT6:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_16:
+            return 16;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_17:
+            return 17;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_18:
+            return 18;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_19:
+            return 19;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_20:
+            return 20;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_21:
+            return 21;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_22:
+            return 22;
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_23:
+            return 23;
+        case AudioChannelMask::AUDIO_CHANNEL_OUT_22POINT2:
+        case AudioChannelMask::AUDIO_CHANNEL_INDEX_MASK_24:
+            return 24;
+        case AudioChannelMask::UNKNOWN:
+            return 0;
+            // No default to make sure all cases are covered.
+    }
+    // This is to avoid undefined behavior if 'mask' isn't a valid enum value.
+    return 0;
+}
+
+static inline ssize_t getChannelCount(const std::string& mask) {
+    return getChannelCount(stringToAudioChannelMask(mask));
+}
+
+static inline bool isOutputDevice(AudioDevice device) {
+    switch (device) {
+        case AudioDevice::UNKNOWN:
+        case AudioDevice::AUDIO_DEVICE_NONE:
+            return false;
+        case AudioDevice::AUDIO_DEVICE_OUT_EARPIECE:
+        case AudioDevice::AUDIO_DEVICE_OUT_SPEAKER:
+        case AudioDevice::AUDIO_DEVICE_OUT_WIRED_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_OUT_WIRED_HEADPHONE:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLUETOOTH_SCO:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLUETOOTH_A2DP:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER:
+        case AudioDevice::AUDIO_DEVICE_OUT_AUX_DIGITAL:
+        case AudioDevice::AUDIO_DEVICE_OUT_HDMI:
+        case AudioDevice::AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_OUT_USB_ACCESSORY:
+        case AudioDevice::AUDIO_DEVICE_OUT_USB_DEVICE:
+        case AudioDevice::AUDIO_DEVICE_OUT_REMOTE_SUBMIX:
+        case AudioDevice::AUDIO_DEVICE_OUT_TELEPHONY_TX:
+        case AudioDevice::AUDIO_DEVICE_OUT_LINE:
+        case AudioDevice::AUDIO_DEVICE_OUT_HDMI_ARC:
+        case AudioDevice::AUDIO_DEVICE_OUT_HDMI_EARC:
+        case AudioDevice::AUDIO_DEVICE_OUT_SPDIF:
+        case AudioDevice::AUDIO_DEVICE_OUT_FM:
+        case AudioDevice::AUDIO_DEVICE_OUT_AUX_LINE:
+        case AudioDevice::AUDIO_DEVICE_OUT_SPEAKER_SAFE:
+        case AudioDevice::AUDIO_DEVICE_OUT_IP:
+        case AudioDevice::AUDIO_DEVICE_OUT_BUS:
+        case AudioDevice::AUDIO_DEVICE_OUT_PROXY:
+        case AudioDevice::AUDIO_DEVICE_OUT_USB_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_OUT_HEARING_AID:
+        case AudioDevice::AUDIO_DEVICE_OUT_ECHO_CANCELLER:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLE_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLE_SPEAKER:
+        case AudioDevice::AUDIO_DEVICE_OUT_BLE_BROADCAST:
+        case AudioDevice::AUDIO_DEVICE_OUT_DEFAULT:
+        case AudioDevice::AUDIO_DEVICE_OUT_STUB:
+            return true;
+        case AudioDevice::AUDIO_DEVICE_IN_COMMUNICATION:
+        case AudioDevice::AUDIO_DEVICE_IN_AMBIENT:
+        case AudioDevice::AUDIO_DEVICE_IN_BUILTIN_MIC:
+        case AudioDevice::AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_IN_WIRED_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_IN_AUX_DIGITAL:
+        case AudioDevice::AUDIO_DEVICE_IN_HDMI:
+        case AudioDevice::AUDIO_DEVICE_IN_VOICE_CALL:
+        case AudioDevice::AUDIO_DEVICE_IN_TELEPHONY_RX:
+        case AudioDevice::AUDIO_DEVICE_IN_BACK_MIC:
+        case AudioDevice::AUDIO_DEVICE_IN_REMOTE_SUBMIX:
+        case AudioDevice::AUDIO_DEVICE_IN_ANLG_DOCK_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_IN_DGTL_DOCK_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_IN_USB_ACCESSORY:
+        case AudioDevice::AUDIO_DEVICE_IN_USB_DEVICE:
+        case AudioDevice::AUDIO_DEVICE_IN_FM_TUNER:
+        case AudioDevice::AUDIO_DEVICE_IN_TV_TUNER:
+        case AudioDevice::AUDIO_DEVICE_IN_LINE:
+        case AudioDevice::AUDIO_DEVICE_IN_SPDIF:
+        case AudioDevice::AUDIO_DEVICE_IN_BLUETOOTH_A2DP:
+        case AudioDevice::AUDIO_DEVICE_IN_LOOPBACK:
+        case AudioDevice::AUDIO_DEVICE_IN_IP:
+        case AudioDevice::AUDIO_DEVICE_IN_BUS:
+        case AudioDevice::AUDIO_DEVICE_IN_PROXY:
+        case AudioDevice::AUDIO_DEVICE_IN_USB_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_IN_BLUETOOTH_BLE:
+        case AudioDevice::AUDIO_DEVICE_IN_HDMI_ARC:
+        case AudioDevice::AUDIO_DEVICE_IN_HDMI_EARC:
+        case AudioDevice::AUDIO_DEVICE_IN_ECHO_REFERENCE:
+        case AudioDevice::AUDIO_DEVICE_IN_BLE_HEADSET:
+        case AudioDevice::AUDIO_DEVICE_IN_DEFAULT:
+        case AudioDevice::AUDIO_DEVICE_IN_STUB:
+            return false;
+            // No default to make sure all cases are covered.
+    }
+    // This is to avoid undefined behavior if 'device' isn't a valid enum value.
+    return false;
+}
+
+static inline bool isOutputDevice(const std::string& device) {
+    return isOutputDevice(stringToAudioDevice(device));
+}
+
+static inline bool isTelephonyDevice(AudioDevice device) {
+    return device == AudioDevice::AUDIO_DEVICE_OUT_TELEPHONY_TX ||
+           device == AudioDevice::AUDIO_DEVICE_IN_TELEPHONY_RX;
+}
+
+static inline bool isTelephonyDevice(const std::string& device) {
+    return isTelephonyDevice(stringToAudioDevice(device));
+}
+
+static inline bool maybeVendorExtension(const std::string& s) {
+    // Only checks whether the string starts with the "vendor prefix".
+    static const std::string vendorPrefix = "VX_";
+    return s.size() > vendorPrefix.size() && s.substr(0, vendorPrefix.size()) == vendorPrefix;
+}
+
+static inline bool isVendorExtension(const std::string& s) {
+    // Must be the same as the "vendorExtension" rule from the XSD file.
+    static const std::regex vendorExtension("VX_[A-Z0-9]{3,}_[_A-Z0-9]+");
+    return std::regex_match(s.begin(), s.end(), vendorExtension);
+}
+
+static inline bool isUnknownAudioChannelMask(const std::string& mask) {
+    return stringToAudioChannelMask(mask) == AudioChannelMask::UNKNOWN;
+}
+
+static inline bool isUnknownAudioContentType(const std::string& contentType) {
+    return stringToAudioContentType(contentType) == AudioContentType::UNKNOWN;
+}
+
+static inline bool isUnknownAudioDevice(const std::string& device) {
+    return stringToAudioDevice(device) == AudioDevice::UNKNOWN && !isVendorExtension(device);
+}
+
+static inline bool isUnknownAudioFormat(const std::string& format) {
+    return stringToAudioFormat(format) == AudioFormat::UNKNOWN && !isVendorExtension(format);
+}
+
+static inline bool isUnknownAudioGainMode(const std::string& mode) {
+    return stringToAudioGainMode(mode) == AudioGainMode::UNKNOWN;
+}
+
+static inline bool isUnknownAudioInOutFlag(const std::string& flag) {
+    return stringToAudioInOutFlag(flag) == AudioInOutFlag::UNKNOWN;
+}
+
+static inline bool isUnknownAudioSource(const std::string& source) {
+    return stringToAudioSource(source) == AudioSource::UNKNOWN;
+}
+
+static inline bool isUnknownAudioStreamType(const std::string& streamType) {
+    return stringToAudioStreamType(streamType) == AudioStreamType::UNKNOWN;
+}
+
+static inline bool isUnknownAudioUsage(const std::string& usage) {
+    return stringToAudioUsage(usage) == AudioUsage::UNKNOWN;
+}
+
+static inline bool isLinearPcm(AudioFormat format) {
+    switch (format) {
+        case AudioFormat::AUDIO_FORMAT_PCM_16_BIT:
+        case AudioFormat::AUDIO_FORMAT_PCM_8_BIT:
+        case AudioFormat::AUDIO_FORMAT_PCM_32_BIT:
+        case AudioFormat::AUDIO_FORMAT_PCM_8_24_BIT:
+        case AudioFormat::AUDIO_FORMAT_PCM_FLOAT:
+        case AudioFormat::AUDIO_FORMAT_PCM_24_BIT_PACKED:
+            return true;
+        default:
+            return false;
+    }
+}
+
+static inline bool isLinearPcm(const std::string& format) {
+    return isLinearPcm(stringToAudioFormat(format));
+}
+
+static inline bool isUnknownAudioEncapsulationType(const std::string& encapsulationType) {
+    return stringToAudioEncapsulationType(encapsulationType) == AudioEncapsulationType::UNKNOWN;
+}
+
+}  // namespace android::audio::policy::configuration::V7_1
+
+#endif  // ANDROID_AUDIO_POLICY_CONFIGURATION_V7_1__ENUMS_H
diff --git a/audio/common/all-versions/default/7.0/HidlUtils.cpp b/audio/common/all-versions/default/7.0/HidlUtils.cpp
index 5a5b5d2..218d7c0 100644
--- a/audio/common/all-versions/default/7.0/HidlUtils.cpp
+++ b/audio/common/all-versions/default/7.0/HidlUtils.cpp
@@ -21,7 +21,7 @@
 #define LOG_TAG "HidlUtils"
 #include <log/log.h>
 
-#include <android_audio_policy_configuration_V7_0-enums.h>
+#include PATH(APM_XSD_ENUMS_H_FILENAME)
 #include <common/all-versions/HidlSupport.h>
 #include <common/all-versions/VersionUtils.h>
 
@@ -31,11 +31,11 @@
 namespace hardware {
 namespace audio {
 namespace common {
-namespace CPP_VERSION {
+namespace COMMON_TYPES_CPP_VERSION {
 namespace implementation {
 
 namespace xsd {
-using namespace ::android::audio::policy::configuration::V7_0;
+using namespace ::android::audio::policy::configuration::CPP_VERSION;
 }
 
 #define CONVERT_CHECKED(expr, result)                   \
@@ -1151,7 +1151,7 @@
 }
 
 }  // namespace implementation
-}  // namespace CPP_VERSION
+}  // namespace COMMON_TYPES_CPP_VERSION
 }  // namespace common
 }  // namespace audio
 }  // namespace hardware
diff --git a/audio/common/all-versions/default/HidlUtils.h b/audio/common/all-versions/default/HidlUtils.h
index 98ecc07..ad9dee2 100644
--- a/audio/common/all-versions/default/HidlUtils.h
+++ b/audio/common/all-versions/default/HidlUtils.h
@@ -17,7 +17,9 @@
 #ifndef android_hardware_audio_Hidl_Utils_H_
 #define android_hardware_audio_Hidl_Utils_H_
 
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+// clang-format off
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
+// clang-format on
 
 #include <memory>
 #include <string>
@@ -29,11 +31,11 @@
 namespace hardware {
 namespace audio {
 namespace common {
-namespace CPP_VERSION {
+namespace COMMON_TYPES_CPP_VERSION {
 namespace implementation {
 
 using ::android::hardware::hidl_vec;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 
 struct HidlUtils {
     static status_t audioConfigFromHal(const audio_config_t& halConfig, bool isInput,
@@ -267,7 +269,7 @@
 #endif  // MAJOR_VERSION <= 6
 
 }  // namespace implementation
-}  // namespace CPP_VERSION
+}  // namespace COMMON_TYPES_CPP_VERSION
 }  // namespace common
 }  // namespace audio
 }  // namespace hardware
diff --git a/audio/common/all-versions/default/UuidUtils.h b/audio/common/all-versions/default/UuidUtils.h
index cd04fb0..4a64f0a 100644
--- a/audio/common/all-versions/default/UuidUtils.h
+++ b/audio/common/all-versions/default/UuidUtils.h
@@ -20,7 +20,7 @@
 #include <string>
 
 // clang-format off
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 // clang-format on
 
 #include <system/audio.h>
@@ -32,7 +32,7 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 
 class UuidUtils {
   public:
diff --git a/audio/common/all-versions/default/VersionUtils.h b/audio/common/all-versions/default/VersionUtils.h
index 9bfca0c..9771374 100644
--- a/audio/common/all-versions/default/VersionUtils.h
+++ b/audio/common/all-versions/default/VersionUtils.h
@@ -17,7 +17,30 @@
 #ifndef ANDROID_HARDWARE_AUDIO_EFFECT_VERSION_UTILS_H
 #define ANDROID_HARDWARE_AUDIO_EFFECT_VERSION_UTILS_H
 
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+// A workaround for b/216149583 (vendor code having its own copy of VersionMacro.h)
+#ifndef COMMON_TYPES_MINOR_VERSION
+#define COMMON_TYPES_MINOR_VERSION MINOR_VERSION
+#endif
+#ifndef CORE_TYPES_MINOR_VERSION
+#define CORE_TYPES_MINOR_VERSION MINOR_VERSION
+#endif
+#ifndef COMMON_TYPES_FILE_VERSION
+#define COMMON_TYPES_FILE_VERSION EXPAND_CONCAT_3(MAJOR_VERSION, ., COMMON_TYPES_MINOR_VERSION)
+#endif
+#ifndef CORE_TYPES_FILE_VERSION
+#define CORE_TYPES_FILE_VERSION EXPAND_CONCAT_3(MAJOR_VERSION, ., CORE_TYPES_MINOR_VERSION)
+#endif
+#ifndef COMMON_TYPES_CPP_VERSION
+#define COMMON_TYPES_CPP_VERSION EXPAND_CONCAT_4(V, MAJOR_VERSION, _, COMMON_TYPES_MINOR_VERSION)
+#endif
+#ifndef CORE_TYPES_CPP_VERSION
+#define CORE_TYPES_CPP_VERSION EXPAND_CONCAT_4(V, MAJOR_VERSION, _, CORE_TYPES_MINOR_VERSION)
+#endif
+// End of workaround
+
+// clang-format off
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
+// clang-format on
 
 namespace android {
 namespace hardware {
diff --git a/audio/common/all-versions/default/service/service.cpp b/audio/common/all-versions/default/service/service.cpp
index 89585b0..e26369f 100644
--- a/audio/common/all-versions/default/service/service.cpp
+++ b/audio/common/all-versions/default/service/service.cpp
@@ -66,6 +66,7 @@
     const std::vector<InterfacesList> mandatoryInterfaces = {
         {
             "Audio Core API",
+            "android.hardware.audio@7.1::IDevicesFactory",
             "android.hardware.audio@7.0::IDevicesFactory",
             "android.hardware.audio@6.0::IDevicesFactory",
             "android.hardware.audio@5.0::IDevicesFactory",
diff --git a/audio/common/all-versions/default/tests/hidlutils6_tests.cpp b/audio/common/all-versions/default/tests/hidlutils6_tests.cpp
index 3a24e75..ca59b9d 100644
--- a/audio/common/all-versions/default/tests/hidlutils6_tests.cpp
+++ b/audio/common/all-versions/default/tests/hidlutils6_tests.cpp
@@ -23,14 +23,14 @@
 #include <system/audio.h>
 
 using namespace android;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
 
 // Not generated automatically because DeviceAddress contains
 // an union.
 //
 // operator== must be defined in the same namespace as the data type.
-namespace android::hardware::audio::common::CPP_VERSION {
+namespace android::hardware::audio::common::COMMON_TYPES_CPP_VERSION {
 
 inline bool operator==(const DeviceAddress& lhs, const DeviceAddress& rhs) {
     if (lhs.device != rhs.device) return false;
@@ -49,7 +49,7 @@
     return lhs.busAddress == rhs.busAddress;
 }
 
-}  // namespace android::hardware::audio::common::CPP_VERSION
+}  // namespace android::hardware::audio::common::COMMON_TYPES_CPP_VERSION
 
 static void ConvertDeviceAddress(const DeviceAddress& device) {
     audio_devices_t halDeviceType;
diff --git a/audio/common/all-versions/default/tests/hidlutils_tests.cpp b/audio/common/all-versions/default/tests/hidlutils_tests.cpp
index c9e6fac..2749cce 100644
--- a/audio/common/all-versions/default/tests/hidlutils_tests.cpp
+++ b/audio/common/all-versions/default/tests/hidlutils_tests.cpp
@@ -29,8 +29,8 @@
 
 using namespace android;
 using ::android::hardware::hidl_vec;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
 namespace xsd {
 using namespace ::android::audio::policy::configuration::V7_0;
 }
diff --git a/audio/common/all-versions/util/include/common/all-versions/VersionMacro.h b/audio/common/all-versions/util/include/common/all-versions/VersionMacro.h
index dc54cee..875e167 100644
--- a/audio/common/all-versions/util/include/common/all-versions/VersionMacro.h
+++ b/audio/common/all-versions/util/include/common/all-versions/VersionMacro.h
@@ -21,6 +21,14 @@
 #error "MAJOR_VERSION and MINOR_VERSION must be defined"
 #endif
 
+#ifndef COMMON_TYPES_MINOR_VERSION
+#define COMMON_TYPES_MINOR_VERSION MINOR_VERSION
+#endif
+
+#ifndef CORE_TYPES_MINOR_VERSION
+#define CORE_TYPES_MINOR_VERSION MINOR_VERSION
+#endif
+
 /** Allows macro expansion for x and add surrounding `<>`.
  * Is intended to be used for version dependant includes as
  * `#include` do not macro expand if starting with < or "
@@ -34,10 +42,30 @@
 #define EXPAND_CONCAT_3(a, b, c) CONCAT_3(a, b, c)
 /** The directory name of the version: <major>.<minor> */
 #define FILE_VERSION EXPAND_CONCAT_3(MAJOR_VERSION, ., MINOR_VERSION)
+#define COMMON_TYPES_FILE_VERSION EXPAND_CONCAT_3(MAJOR_VERSION, ., COMMON_TYPES_MINOR_VERSION)
+#define CORE_TYPES_FILE_VERSION EXPAND_CONCAT_3(MAJOR_VERSION, ., CORE_TYPES_MINOR_VERSION)
 
 #define CONCAT_4(a, b, c, d) a##b##c##d
 #define EXPAND_CONCAT_4(a, b, c, d) CONCAT_4(a, b, c, d)
 /** The c++ namespace of the version: V<major>_<minor> */
 #define CPP_VERSION EXPAND_CONCAT_4(V, MAJOR_VERSION, _, MINOR_VERSION)
+#define COMMON_TYPES_CPP_VERSION EXPAND_CONCAT_4(V, MAJOR_VERSION, _, COMMON_TYPES_MINOR_VERSION)
+#define CORE_TYPES_CPP_VERSION EXPAND_CONCAT_4(V, MAJOR_VERSION, _, CORE_TYPES_MINOR_VERSION)
+
+/* Gluing these file names from macros is non-trivial due to "illegal tokens"
+   occurring during expansion. The XSD and enums always use the minor version. */
+// clang-format off
+#if MAJOR_VERSION >= 7
+#if MINOR_VERSION == 0
+#define APM_XSD_H_FILENAME android_audio_policy_configuration_V7_0.h
+#define APM_XSD_ENUMS_H_FILENAME android_audio_policy_configuration_V7_0-enums.h
+#elif MINOR_VERSION == 1
+#define APM_XSD_H_FILENAME android_audio_policy_configuration_V7_1.h
+#define APM_XSD_ENUMS_H_FILENAME android_audio_policy_configuration_V7_1-enums.h
+#else
+#error "Unsupported minor version"
+#endif
+#endif
+// clang-format on
 
 #endif  // ANDROID_HARDWARE_VERSION_MACRO_H
diff --git a/audio/core/all-versions/default/Android.bp b/audio/core/all-versions/default/Android.bp
index 6a0d0a0..df688fd 100644
--- a/audio/core/all-versions/default/Android.bp
+++ b/audio/core/all-versions/default/Android.bp
@@ -161,3 +161,29 @@
     name: "android.hardware.audio@7.0-impl",
     defaults: ["android.hardware.audio@7.0-impl_default"],
 }
+
+cc_defaults {
+    name: "android.hardware.audio@7.1-impl_default",
+    defaults: ["android.hardware.audio-impl_default"],
+    shared_libs: [
+        "android.hardware.audio@7.0",
+        "android.hardware.audio@7.1",
+        "android.hardware.audio@7.0-util",
+        "android.hardware.audio.common@7.0",
+        "android.hardware.audio.common@7.1-enums",
+        "android.hardware.audio.common@7.0-util",
+        "libbase",
+    ],
+    cflags: [
+        "-DMAJOR_VERSION=7",
+        "-DMINOR_VERSION=1",
+        "-DCOMMON_TYPES_MINOR_VERSION=0",
+        "-DCORE_TYPES_MINOR_VERSION=0",
+        "-include common/all-versions/VersionMacro.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.audio@7.1-impl",
+    defaults: ["android.hardware.audio@7.1-impl_default"],
+}
diff --git a/audio/core/all-versions/default/Device.cpp b/audio/core/all-versions/default/Device.cpp
index c33e6f3..ca8c03d 100644
--- a/audio/core/all-versions/default/Device.cpp
+++ b/audio/core/all-versions/default/Device.cpp
@@ -41,7 +41,10 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
+namespace util {
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::util;
+}
 
 Device::Device(audio_hw_device_t* device) : mIsClosed(false), mDevice(device) {}
 
@@ -84,7 +87,7 @@
     if (mDevice->set_master_volume == NULL) {
         return Result::NOT_SUPPORTED;
     }
-    if (!isGainNormalized(volume)) {
+    if (!util::isGainNormalized(volume)) {
         ALOGW("Can not set a master volume (%f) outside [0,1]", volume);
         return Result::INVALID_ARGUMENTS;
     }
@@ -150,7 +153,7 @@
     return Void();
 }
 
-std::tuple<Result, sp<IStreamOut>> Device::openOutputStreamImpl(int32_t ioHandle,
+std::tuple<Result, sp<IStreamOut>> Device::openOutputStreamCore(int32_t ioHandle,
                                                                 const DeviceAddress& device,
                                                                 const AudioConfig& config,
                                                                 const AudioOutputFlags& flags,
@@ -187,7 +190,7 @@
     return {analyzeStatus("open_output_stream", status, {EINVAL} /*ignore*/), streamOut};
 }
 
-std::tuple<Result, sp<IStreamIn>> Device::openInputStreamImpl(
+std::tuple<Result, sp<IStreamIn>> Device::openInputStreamCore(
         int32_t ioHandle, const DeviceAddress& device, const AudioConfig& config,
         const AudioInputFlags& flags, AudioSource source, AudioConfig* suggestedConfig) {
     audio_config_t halConfig;
@@ -230,7 +233,7 @@
                                       openOutputStream_cb _hidl_cb) {
     AudioConfig suggestedConfig;
     auto [result, streamOut] =
-        openOutputStreamImpl(ioHandle, device, config, flags, &suggestedConfig);
+            openOutputStreamCore(ioHandle, device, config, flags, &suggestedConfig);
     _hidl_cb(result, streamOut, suggestedConfig);
     return Void();
 }
@@ -240,12 +243,36 @@
                                      AudioSource source, openInputStream_cb _hidl_cb) {
     AudioConfig suggestedConfig;
     auto [result, streamIn] =
-        openInputStreamImpl(ioHandle, device, config, flags, source, &suggestedConfig);
+            openInputStreamCore(ioHandle, device, config, flags, source, &suggestedConfig);
     _hidl_cb(result, streamIn, suggestedConfig);
     return Void();
 }
 
 #elif MAJOR_VERSION >= 4
+std::tuple<Result, sp<IStreamOut>, AudioConfig> Device::openOutputStreamImpl(
+        int32_t ioHandle, const DeviceAddress& device, const AudioConfig& config,
+        const SourceMetadata& sourceMetadata,
+#if MAJOR_VERSION <= 6
+        AudioOutputFlags flags) {
+    if (status_t status = CoreUtils::sourceMetadataToHal(sourceMetadata, nullptr);
+        status != NO_ERROR) {
+#else
+        const AudioOutputFlags& flags) {
+    if (status_t status = CoreUtils::sourceMetadataToHalV7(sourceMetadata,
+                                                           false /*ignoreNonVendorTags*/, nullptr);
+        status != NO_ERROR) {
+#endif
+        return {analyzeStatus("sourceMetadataToHal", status), nullptr, {}};
+    }
+    AudioConfig suggestedConfig;
+    auto [result, streamOut] =
+            openOutputStreamCore(ioHandle, device, config, flags, &suggestedConfig);
+    if (streamOut) {
+        streamOut->updateSourceMetadata(sourceMetadata);
+    }
+    return {result, streamOut, suggestedConfig};
+}
+
 Return<void> Device::openOutputStream(int32_t ioHandle, const DeviceAddress& device,
                                       const AudioConfig& config,
 #if MAJOR_VERSION <= 6
@@ -255,27 +282,46 @@
 #endif
                                       const SourceMetadata& sourceMetadata,
                                       openOutputStream_cb _hidl_cb) {
-#if MAJOR_VERSION <= 6
-    if (status_t status = CoreUtils::sourceMetadataToHal(sourceMetadata, nullptr);
-        status != NO_ERROR) {
-#else
-    if (status_t status = CoreUtils::sourceMetadataToHalV7(sourceMetadata,
-                                                           false /*ignoreNonVendorTags*/, nullptr);
-        status != NO_ERROR) {
-#endif
-        _hidl_cb(analyzeStatus("sourceMetadataToHal", status), nullptr, AudioConfig{});
-        return Void();
-    }
-    AudioConfig suggestedConfig;
-    auto [result, streamOut] =
-        openOutputStreamImpl(ioHandle, device, config, flags, &suggestedConfig);
-    if (streamOut) {
-        streamOut->updateSourceMetadata(sourceMetadata);
-    }
+    auto [result, streamOut, suggestedConfig] =
+            openOutputStreamImpl(ioHandle, device, config, sourceMetadata, flags);
     _hidl_cb(result, streamOut, suggestedConfig);
     return Void();
 }
 
+std::tuple<Result, sp<IStreamIn>, AudioConfig> Device::openInputStreamImpl(
+        int32_t ioHandle, const DeviceAddress& device, const AudioConfig& config,
+#if MAJOR_VERSION <= 6
+        AudioInputFlags flags,
+#else
+        const AudioInputFlags& flags,
+#endif
+        const SinkMetadata& sinkMetadata) {
+    if (sinkMetadata.tracks.size() == 0) {
+        // This should never happen, the framework must not create as stream
+        // if there is no client
+        ALOGE("openInputStream called without tracks connected");
+        return {Result::INVALID_ARGUMENTS, nullptr, AudioConfig{}};
+    }
+#if MAJOR_VERSION <= 6
+    if (status_t status = CoreUtils::sinkMetadataToHal(sinkMetadata, nullptr); status != NO_ERROR) {
+#else
+    if (status_t status = CoreUtils::sinkMetadataToHalV7(sinkMetadata,
+                                                         false /*ignoreNonVendorTags*/, nullptr);
+        status != NO_ERROR) {
+#endif
+        return {analyzeStatus("sinkMetadataToHal", status), nullptr, AudioConfig{}};
+    }
+    // Pick the first one as the main.
+    AudioSource source = sinkMetadata.tracks[0].source;
+    AudioConfig suggestedConfig;
+    auto [result, streamIn] =
+            openInputStreamCore(ioHandle, device, config, flags, source, &suggestedConfig);
+    if (streamIn) {
+        streamIn->updateSinkMetadata(sinkMetadata);
+    }
+    return {result, streamIn, suggestedConfig};
+}
+
 Return<void> Device::openInputStream(int32_t ioHandle, const DeviceAddress& device,
                                      const AudioConfig& config,
 #if MAJOR_VERSION <= 6
@@ -285,36 +331,35 @@
 #endif
                                      const SinkMetadata& sinkMetadata,
                                      openInputStream_cb _hidl_cb) {
-    if (sinkMetadata.tracks.size() == 0) {
-        // This should never happen, the framework must not create as stream
-        // if there is no client
-        ALOGE("openInputStream called without tracks connected");
-        _hidl_cb(Result::INVALID_ARGUMENTS, nullptr, AudioConfig{});
-        return Void();
-    }
-#if MAJOR_VERSION <= 6
-    if (status_t status = CoreUtils::sinkMetadataToHal(sinkMetadata, nullptr); status != NO_ERROR) {
-#else
-    if (status_t status = CoreUtils::sinkMetadataToHalV7(sinkMetadata,
-                                                         false /*ignoreNonVendorTags*/, nullptr);
-        status != NO_ERROR) {
-#endif
-        _hidl_cb(analyzeStatus("sinkMetadataToHal", status), nullptr, AudioConfig{});
-        return Void();
-    }
-    // Pick the first one as the main.
-    AudioSource source = sinkMetadata.tracks[0].source;
-    AudioConfig suggestedConfig;
-    auto [result, streamIn] =
-        openInputStreamImpl(ioHandle, device, config, flags, source, &suggestedConfig);
-    if (streamIn) {
-        streamIn->updateSinkMetadata(sinkMetadata);
-    }
+    auto [result, streamIn, suggestedConfig] =
+            openInputStreamImpl(ioHandle, device, config, flags, sinkMetadata);
     _hidl_cb(result, streamIn, suggestedConfig);
     return Void();
 }
 #endif /* MAJOR_VERSION */
 
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+Return<void> Device::openOutputStream_7_1(int32_t ioHandle, const DeviceAddress& device,
+                                          const AudioConfig& config, const AudioOutputFlags& flags,
+                                          const SourceMetadata& sourceMetadata,
+                                          openOutputStream_7_1_cb _hidl_cb) {
+    auto [result, streamOut, suggestedConfig] =
+            openOutputStreamImpl(ioHandle, device, config, sourceMetadata, flags);
+    _hidl_cb(result, streamOut, suggestedConfig);
+    return Void();
+}
+
+Return<void> Device::openInputStream_7_1(int32_t ioHandle, const DeviceAddress& device,
+                                         const AudioConfig& config, const AudioInputFlags& flags,
+                                         const SinkMetadata& sinkMetadata,
+                                         openInputStream_7_1_cb _hidl_cb) {
+    auto [result, streamIn, suggestedConfig] =
+            openInputStreamImpl(ioHandle, device, config, flags, sinkMetadata);
+    _hidl_cb(result, streamIn, suggestedConfig);
+    return Void();
+}
+#endif  // V7.1
+
 Return<bool> Device::supportsAudioPatches() {
     return version() >= AUDIO_DEVICE_API_VERSION_3_0;
 }
@@ -571,6 +616,21 @@
 
 #endif
 
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+Return<Result> Device::setConnectedState_7_1(const AudioPort& devicePort, bool connected) {
+    if (version() >= AUDIO_DEVICE_API_VERSION_3_2 &&
+        mDevice->set_device_connected_state_v7 != nullptr) {
+        audio_port_v7 halPort;
+        if (status_t status = HidlUtils::audioPortToHal(devicePort, &halPort); status != NO_ERROR) {
+            return analyzeStatus("audioPortToHal", status);
+        }
+        return analyzeStatus("set_device_connected_state_v7",
+                             mDevice->set_device_connected_state_v7(mDevice, &halPort, connected));
+    }
+    return Result::NOT_SUPPORTED;
+}
+#endif
+
 }  // namespace implementation
 }  // namespace CPP_VERSION
 }  // namespace audio
diff --git a/audio/core/all-versions/default/DevicesFactory.cpp b/audio/core/all-versions/default/DevicesFactory.cpp
index 729f18c..f44daf0 100644
--- a/audio/core/all-versions/default/DevicesFactory.cpp
+++ b/audio/core/all-versions/default/DevicesFactory.cpp
@@ -47,22 +47,54 @@
     _hidl_cb(Result::INVALID_ARGUMENTS, nullptr);
     return Void();
 }
+
+Return<void> DevicesFactory::openDevice(const char* moduleName, openDevice_cb _hidl_cb) {
+    return openDevice<implementation::Device>(moduleName, _hidl_cb);
+}
 #elif MAJOR_VERSION >= 4
 Return<void> DevicesFactory::openDevice(const hidl_string& moduleName, openDevice_cb _hidl_cb) {
     if (moduleName == AUDIO_HARDWARE_MODULE_ID_PRIMARY) {
         return openDevice<PrimaryDevice>(moduleName.c_str(), _hidl_cb);
     }
-    return openDevice(moduleName.c_str(), _hidl_cb);
+    return openDevice<implementation::Device>(moduleName.c_str(), _hidl_cb);
 }
 Return<void> DevicesFactory::openPrimaryDevice(openPrimaryDevice_cb _hidl_cb) {
     return openDevice<PrimaryDevice>(AUDIO_HARDWARE_MODULE_ID_PRIMARY, _hidl_cb);
 }
 #endif
 
-Return<void> DevicesFactory::openDevice(const char* moduleName, openDevice_cb _hidl_cb) {
-    return openDevice<implementation::Device>(moduleName, _hidl_cb);
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+Return<void> DevicesFactory::openDevice_7_1(const hidl_string& moduleName,
+                                            openDevice_7_1_cb _hidl_cb) {
+    if (moduleName == AUDIO_HARDWARE_MODULE_ID_PRIMARY) {
+        Result result;
+        sp<IPrimaryDevice> primary;
+        auto ret = openDevice<PrimaryDevice>(
+                AUDIO_HARDWARE_MODULE_ID_PRIMARY,
+                [&result, &primary](Result r, const sp<IPrimaryDevice>& p) {
+                    result = r;
+                    primary = p;
+                });
+        if (ret.isOk() && result == Result::OK && primary != nullptr) {
+            auto getDeviceRet = primary->getDevice();
+            if (getDeviceRet.isOk()) {
+                _hidl_cb(result, getDeviceRet);
+            } else {
+                _hidl_cb(Result::NOT_INITIALIZED, nullptr);
+            }
+        } else {
+            _hidl_cb(result, nullptr);
+        }
+        return Void();
+    }
+    return openDevice<implementation::Device>(moduleName.c_str(), _hidl_cb);
 }
 
+Return<void> DevicesFactory::openPrimaryDevice_7_1(openPrimaryDevice_7_1_cb _hidl_cb) {
+    return openDevice<PrimaryDevice>(AUDIO_HARDWARE_MODULE_ID_PRIMARY, _hidl_cb);
+}
+#endif  // V7.1
+
 template <class DeviceShim, class Callback>
 Return<void> DevicesFactory::openDevice(const char* moduleName, Callback _hidl_cb) {
     audio_hw_device_t* halDevice;
diff --git a/audio/core/all-versions/default/ParametersUtil.cpp b/audio/core/all-versions/default/ParametersUtil.cpp
index 4d53645..e21eff2 100644
--- a/audio/core/all-versions/default/ParametersUtil.cpp
+++ b/audio/core/all-versions/default/ParametersUtil.cpp
@@ -24,7 +24,7 @@
 namespace android {
 namespace hardware {
 namespace audio {
-namespace CPP_VERSION {
+namespace CORE_TYPES_CPP_VERSION {
 namespace implementation {
 
 /** Converts a status_t in Result according to the rules of AudioParameter::get*
@@ -168,7 +168,7 @@
 }
 
 }  // namespace implementation
-}  // namespace CPP_VERSION
+}  // namespace CORE_TYPES_CPP_VERSION
 }  // namespace audio
 }  // namespace hardware
 }  // namespace android
diff --git a/audio/core/all-versions/default/PrimaryDevice.cpp b/audio/core/all-versions/default/PrimaryDevice.cpp
index fe56177..cf162f1 100644
--- a/audio/core/all-versions/default/PrimaryDevice.cpp
+++ b/audio/core/all-versions/default/PrimaryDevice.cpp
@@ -29,6 +29,10 @@
 namespace CPP_VERSION {
 namespace implementation {
 
+namespace util {
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::util;
+}
+
 PrimaryDevice::PrimaryDevice(audio_hw_device_t* device) : mDevice(new Device(device)) {}
 
 PrimaryDevice::~PrimaryDevice() {
@@ -195,7 +199,7 @@
 
 // Methods from ::android::hardware::audio::CPP_VERSION::IPrimaryDevice follow.
 Return<Result> PrimaryDevice::setVoiceVolume(float volume) {
-    if (!isGainNormalized(volume)) {
+    if (!util::isGainNormalized(volume)) {
         ALOGW("Can not set a voice volume (%f) outside [0,1]", volume);
         return Result::INVALID_ARGUMENTS;
     }
@@ -326,7 +330,7 @@
     return mDevice->setParam(AUDIO_PARAMETER_KEY_HFP_SET_SAMPLING_RATE, int(sampleRateHz));
 }
 Return<Result> PrimaryDevice::setBtHfpVolume(float volume) {
-    if (!isGainNormalized(volume)) {
+    if (!util::isGainNormalized(volume)) {
         ALOGW("Can not set BT HFP volume (%f) outside [0,1]", volume);
         return Result::INVALID_ARGUMENTS;
     }
diff --git a/audio/core/all-versions/default/Stream.cpp b/audio/core/all-versions/default/Stream.cpp
index 7e32573..8e85a8b 100644
--- a/audio/core/all-versions/default/Stream.cpp
+++ b/audio/core/all-versions/default/Stream.cpp
@@ -37,8 +37,12 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
 using ::android::hardware::audio::common::utils::splitString;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::CoreUtils;
+namespace util {
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::util;
+}
 
 Stream::Stream(bool isInput, audio_stream_t* stream) : mIsInput(isInput), mStream(stream) {
     (void)mIsInput;  // prevent 'unused field' warnings in pre-V7 versions.
diff --git a/audio/core/all-versions/default/StreamIn.cpp b/audio/core/all-versions/default/StreamIn.cpp
index 2aeee43..2bea425 100644
--- a/audio/core/all-versions/default/StreamIn.cpp
+++ b/audio/core/all-versions/default/StreamIn.cpp
@@ -37,7 +37,11 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::CoreUtils;
+namespace util {
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::util;
+}
 
 namespace {
 
@@ -348,7 +352,7 @@
 }
 
 Return<Result> StreamIn::setGain(float gain) {
-    if (!isGainNormalized(gain)) {
+    if (!util::isGainNormalized(gain)) {
         ALOGW("Can not set a stream input gain (%f) outside [0,1]", gain);
         return Result::INVALID_ARGUMENTS;
     }
diff --git a/audio/core/all-versions/default/StreamOut.cpp b/audio/core/all-versions/default/StreamOut.cpp
index d027231..09df4ed 100644
--- a/audio/core/all-versions/default/StreamOut.cpp
+++ b/audio/core/all-versions/default/StreamOut.cpp
@@ -39,7 +39,11 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::CoreUtils;
+namespace util {
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::util;
+}
 
 namespace {
 
@@ -334,7 +338,7 @@
     if (mStream->set_volume == NULL) {
         return Result::NOT_SUPPORTED;
     }
-    if (!isGainNormalized(left)) {
+    if (!util::isGainNormalized(left)) {
         ALOGW("Can not set a stream output volume {%f, %f} outside [0,1]", left, right);
         return Result::INVALID_ARGUMENTS;
     }
@@ -757,6 +761,73 @@
     ALOGW_IF(!result.isOk(), "Client callback failed: %s", result.description().c_str());
     return 0;
 }
+
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+Return<Result> StreamOut::setLatencyMode(LatencyMode mode) {
+    return mStream->set_latency_mode != nullptr
+                   ? Stream::analyzeStatus(
+                             "set_latency_mode",
+                             mStream->set_latency_mode(mStream,
+                                                       static_cast<audio_latency_mode_t>(mode)))
+                   : Result::NOT_SUPPORTED;
+};
+
+Return<void> StreamOut::getRecommendedLatencyModes(getRecommendedLatencyModes_cb _hidl_cb) {
+    Result retval = Result::NOT_SUPPORTED;
+    hidl_vec<LatencyMode> hidlModes;
+    size_t num_modes = AUDIO_LATENCY_MODE_CNT;
+    audio_latency_mode_t modes[AUDIO_LATENCY_MODE_CNT];
+
+    if (mStream->get_recommended_latency_modes != nullptr &&
+        mStream->get_recommended_latency_modes(mStream, &modes[0], &num_modes) == 0) {
+        if (num_modes == 0 || num_modes > AUDIO_LATENCY_MODE_CNT) {
+            ALOGW("%s invalid number of modes returned: %zu", __func__, num_modes);
+            retval = Result::INVALID_STATE;
+        } else {
+            hidlModes.resize(num_modes);
+            for (size_t i = 0; i < num_modes; ++i) {
+                hidlModes[i] = static_cast<LatencyMode>(modes[i]);
+            }
+            retval = Result::OK;
+        }
+    }
+    _hidl_cb(retval, hidlModes);
+    return Void();
+};
+
+// static
+void StreamOut::latencyModeCallback(audio_latency_mode_t* modes, size_t num_modes, void* cookie) {
+    StreamOut* self = reinterpret_cast<StreamOut*>(cookie);
+    sp<IStreamOutLatencyModeCallback> callback = self->mLatencyModeCallback.load();
+    if (callback.get() == nullptr) return;
+
+    ALOGV("%s", __func__);
+
+    if (num_modes == 0 || num_modes > AUDIO_LATENCY_MODE_CNT) {
+        ALOGW("%s invalid number of modes returned: %zu", __func__, num_modes);
+        return;
+    }
+
+    hidl_vec<LatencyMode> hidlModes(num_modes);
+    for (size_t i = 0; i < num_modes; ++i) {
+        hidlModes[i] = static_cast<LatencyMode>(modes[i]);
+    }
+    Return<void> result = callback->onRecommendedLatencyModeChanged(hidlModes);
+    ALOGW_IF(!result.isOk(), "Client callback failed: %s", result.description().c_str());
+}
+
+Return<Result> StreamOut::setLatencyModeCallback(
+        const sp<IStreamOutLatencyModeCallback>& callback) {
+    if (mStream->set_latency_mode_callback == nullptr) return Result::NOT_SUPPORTED;
+    int result = mStream->set_latency_mode_callback(mStream, StreamOut::latencyModeCallback, this);
+    if (result == 0) {
+        mLatencyModeCallback = callback;
+    }
+    return Stream::analyzeStatus("set_latency_mode_callback", result, {ENOSYS} /*ignore*/);
+};
+
+#endif
+
 #endif
 
 }  // namespace implementation
diff --git a/audio/core/all-versions/default/include/core/default/Device.h b/audio/core/all-versions/default/include/core/default/Device.h
index 94cad53..8cde3e0 100644
--- a/audio/core/all-versions/default/include/core/default/Device.h
+++ b/audio/core/all-versions/default/include/core/default/Device.h
@@ -44,7 +44,10 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::CoreUtils;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::ParametersUtil;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::CPP_VERSION;
 using AudioInputFlags = CoreUtils::AudioInputFlags;
 using AudioOutputFlags = CoreUtils::AudioOutputFlags;
@@ -63,14 +66,32 @@
     Return<void> getInputBufferSize(const AudioConfig& config,
                                     getInputBufferSize_cb _hidl_cb) override;
 
-    std::tuple<Result, sp<IStreamOut>> openOutputStreamImpl(int32_t ioHandle,
+    std::tuple<Result, sp<IStreamOut>> openOutputStreamCore(int32_t ioHandle,
                                                             const DeviceAddress& device,
                                                             const AudioConfig& config,
                                                             const AudioOutputFlags& flags,
                                                             AudioConfig* suggestedConfig);
-    std::tuple<Result, sp<IStreamIn>> openInputStreamImpl(
+    std::tuple<Result, sp<IStreamIn>> openInputStreamCore(
             int32_t ioHandle, const DeviceAddress& device, const AudioConfig& config,
             const AudioInputFlags& flags, AudioSource source, AudioConfig* suggestedConfig);
+#if MAJOR_VERSION >= 4
+    std::tuple<Result, sp<IStreamOut>, AudioConfig> openOutputStreamImpl(
+            int32_t ioHandle, const DeviceAddress& device, const AudioConfig& config,
+            const SourceMetadata& sourceMetadata,
+#if MAJOR_VERSION <= 6
+            AudioOutputFlags flags);
+#else
+            const AudioOutputFlags& flags);
+#endif
+    std::tuple<Result, sp<IStreamIn>, AudioConfig> openInputStreamImpl(
+            int32_t ioHandle, const DeviceAddress& device, const AudioConfig& config,
+#if MAJOR_VERSION <= 6
+            AudioInputFlags flags,
+#else
+            const AudioInputFlags& flags,
+#endif
+            const SinkMetadata& sinkMetadata);
+#endif  // MAJOR_VERSION >= 4
 
     Return<void> openOutputStream(int32_t ioHandle, const DeviceAddress& device,
                                   const AudioConfig& config,
@@ -97,6 +118,17 @@
 #endif
                                  openInputStream_cb _hidl_cb) override;
 
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    Return<void> openOutputStream_7_1(int32_t ioHandle, const DeviceAddress& device,
+                                      const AudioConfig& config, const AudioOutputFlags& flags,
+                                      const SourceMetadata& sourceMetadata,
+                                      openOutputStream_7_1_cb _hidl_cb) override;
+    Return<void> openInputStream_7_1(int32_t ioHandle, const DeviceAddress& device,
+                                     const AudioConfig& config, const AudioInputFlags& flags,
+                                     const SinkMetadata& sinkMetadata,
+                                     openInputStream_7_1_cb _hidl_cb) override;
+#endif
+
     Return<bool> supportsAudioPatches() override;
     Return<void> createAudioPatch(const hidl_vec<AudioPortConfig>& sources,
                                   const hidl_vec<AudioPortConfig>& sinks,
@@ -131,6 +163,9 @@
                                   const hidl_vec<AudioPortConfig>& sinks,
                                   createAudioPatch_cb _hidl_cb) override;
 #endif
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    Return<Result> setConnectedState_7_1(const AudioPort& devicePort, bool connected) override;
+#endif
     Return<void> debug(const hidl_handle& fd, const hidl_vec<hidl_string>& options) override;
 
     // Utility methods for extending interfaces.
diff --git a/audio/core/all-versions/default/include/core/default/DevicesFactory.h b/audio/core/all-versions/default/include/core/default/DevicesFactory.h
index 9f93a38..566bc8a 100644
--- a/audio/core/all-versions/default/include/core/default/DevicesFactory.h
+++ b/audio/core/all-versions/default/include/core/default/DevicesFactory.h
@@ -44,11 +44,17 @@
     Return<void> openDevice(const hidl_string& device, openDevice_cb _hidl_cb) override;
     Return<void> openPrimaryDevice(openPrimaryDevice_cb _hidl_cb) override;
 #endif
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    Return<void> openDevice_7_1(const hidl_string& device, openDevice_7_1_cb _hidl_cb) override;
+    Return<void> openPrimaryDevice_7_1(openPrimaryDevice_7_1_cb _hidl_cb) override;
+#endif
 
-   private:
+  private:
     template <class DeviceShim, class Callback>
     Return<void> openDevice(const char* moduleName, Callback _hidl_cb);
+#if MAJOR_VERSION == 2
     Return<void> openDevice(const char* moduleName, openDevice_cb _hidl_cb);
+#endif
 
     static int loadAudioInterface(const char* if_name, audio_hw_device_t** dev);
 };
diff --git a/audio/core/all-versions/default/include/core/default/ParametersUtil.h b/audio/core/all-versions/default/include/core/default/ParametersUtil.h
index 45d9b21..25c193a 100644
--- a/audio/core/all-versions/default/include/core/default/ParametersUtil.h
+++ b/audio/core/all-versions/default/include/core/default/ParametersUtil.h
@@ -17,7 +17,10 @@
 #ifndef ANDROID_HARDWARE_AUDIO_PARAMETERS_UTIL_H_
 #define ANDROID_HARDWARE_AUDIO_PARAMETERS_UTIL_H_
 
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
+// clang-format off
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+// clang-format on
 
 #include <functional>
 #include <memory>
@@ -28,13 +31,13 @@
 namespace android {
 namespace hardware {
 namespace audio {
-namespace CPP_VERSION {
+namespace CORE_TYPES_CPP_VERSION {
 namespace implementation {
 
 using ::android::hardware::hidl_string;
 using ::android::hardware::hidl_vec;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using namespace ::android::hardware::audio::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 
 class ParametersUtil {
    public:
@@ -62,7 +65,7 @@
 };
 
 }  // namespace implementation
-}  // namespace CPP_VERSION
+}  // namespace CORE_TYPES_CPP_VERSION
 }  // namespace audio
 }  // namespace hardware
 }  // namespace android
diff --git a/audio/core/all-versions/default/include/core/default/PrimaryDevice.h b/audio/core/all-versions/default/include/core/default/PrimaryDevice.h
index 5f65acf..8b37e01 100644
--- a/audio/core/all-versions/default/include/core/default/PrimaryDevice.h
+++ b/audio/core/all-versions/default/include/core/default/PrimaryDevice.h
@@ -36,7 +36,8 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::CPP_VERSION;
 
 struct PrimaryDevice : public IPrimaryDevice {
@@ -135,8 +136,10 @@
     Return<Result> setBtHfpVolume(float volume) override;
     Return<Result> updateRotation(IPrimaryDevice::Rotation rotation) override;
 #endif
-
-   private:
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    Return<sp<::android::hardware::audio::V7_1::IDevice>> getDevice() override { return mDevice; }
+#endif
+  private:
     sp<Device> mDevice;
 
     virtual ~PrimaryDevice();
diff --git a/audio/core/all-versions/default/include/core/default/Stream.h b/audio/core/all-versions/default/include/core/default/Stream.h
index 66d60e3..4e79884 100644
--- a/audio/core/all-versions/default/include/core/default/Stream.h
+++ b/audio/core/all-versions/default/include/core/default/Stream.h
@@ -17,7 +17,9 @@
 #ifndef ANDROID_HARDWARE_AUDIO_STREAM_H
 #define ANDROID_HARDWARE_AUDIO_STREAM_H
 
-#include PATH(android/hardware/audio/FILE_VERSION/IStream.h)
+// clang-format off
+#include PATH(android/hardware/audio/COMMON_TYPES_FILE_VERSION/IStream.h)
+// clang-format on
 
 #include "ParametersUtil.h"
 
@@ -41,10 +43,13 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::implementation::ParametersUtil;
 #if MAJOR_VERSION <= 6
-using ::android::hardware::audio::common::CPP_VERSION::implementation::AudioChannelBitfield;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::
+        AudioChannelBitfield;
 #endif
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::CPP_VERSION;
 
 struct Stream : public IStream, public ParametersUtil {
diff --git a/audio/core/all-versions/default/include/core/default/StreamIn.h b/audio/core/all-versions/default/include/core/default/StreamIn.h
index a980f3f..a6346e5 100644
--- a/audio/core/all-versions/default/include/core/default/StreamIn.h
+++ b/audio/core/all-versions/default/include/core/default/StreamIn.h
@@ -42,7 +42,8 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::CPP_VERSION;
 
 struct StreamIn : public IStreamIn {
diff --git a/audio/core/all-versions/default/include/core/default/StreamOut.h b/audio/core/all-versions/default/include/core/default/StreamOut.h
index 0b07972..ce5253f 100644
--- a/audio/core/all-versions/default/include/core/default/StreamOut.h
+++ b/audio/core/all-versions/default/include/core/default/StreamOut.h
@@ -43,7 +43,8 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::CPP_VERSION;
 
 struct StreamOut : public IStreamOut {
@@ -152,6 +153,12 @@
     Result doUpdateSourceMetadata(const SourceMetadata& sourceMetadata);
 #if MAJOR_VERSION >= 7
     Result doUpdateSourceMetadataV7(const SourceMetadata& sourceMetadata);
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    Return<Result> setLatencyMode(LatencyMode mode) override;
+    Return<void> getRecommendedLatencyModes(getRecommendedLatencyModes_cb _hidl_cb) override;
+    Return<Result> setLatencyModeCallback(
+            const sp<IStreamOutLatencyModeCallback>& callback) override;
+#endif
 #endif
 #endif  // MAJOR_VERSION >= 4
 
@@ -162,6 +169,9 @@
     mediautils::atomic_sp<IStreamOutCallback> mCallback;  // for non-blocking write and drain
 #if MAJOR_VERSION >= 6
     mediautils::atomic_sp<IStreamOutEventCallback> mEventCallback;
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    mediautils::atomic_sp<IStreamOutLatencyModeCallback> mLatencyModeCallback;
+#endif
 #endif
     std::unique_ptr<CommandMQ> mCommandMQ;
     std::unique_ptr<DataMQ> mDataMQ;
@@ -176,6 +186,9 @@
 
 #if MAJOR_VERSION >= 6
     static int asyncEventCallback(stream_event_callback_type_t event, void* param, void* cookie);
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    static void latencyModeCallback(audio_latency_mode_t* modes, size_t num_modes, void* cookie);
+#endif
 #endif
 };
 
diff --git a/audio/core/all-versions/default/include/core/default/Util.h b/audio/core/all-versions/default/include/core/default/Util.h
index 78ae03e..abf5317 100644
--- a/audio/core/all-versions/default/include/core/default/Util.h
+++ b/audio/core/all-versions/default/include/core/default/Util.h
@@ -17,7 +17,9 @@
 #ifndef ANDROID_HARDWARE_AUDIO_UTIL_H
 #define ANDROID_HARDWARE_AUDIO_UTIL_H
 
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
+// clang-format off
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+// clang-format on
 
 #include <algorithm>
 #include <vector>
@@ -27,19 +29,19 @@
 namespace android {
 namespace hardware {
 namespace audio {
-namespace CPP_VERSION {
+namespace CORE_TYPES_CPP_VERSION {
 namespace implementation {
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using namespace ::android::hardware::audio::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
+
+namespace util {
 
 /** @return true if gain is between 0 and 1 included. */
 constexpr bool isGainNormalized(float gain) {
     return gain >= 0.0 && gain <= 1.0;
 }
 
-namespace util {
-
 template <typename T>
 inline bool element_in(T e, const std::vector<T>& v) {
     return std::find(v.begin(), v.end(), e) != v.end();
@@ -72,7 +74,7 @@
 
 }  // namespace util
 }  // namespace implementation
-}  // namespace CPP_VERSION
+}  // namespace CORE_TYPES_CPP_VERSION
 }  // namespace audio
 }  // namespace hardware
 }  // namespace android
diff --git a/audio/core/all-versions/default/util/CoreUtils.cpp b/audio/core/all-versions/default/util/CoreUtils.cpp
index 773be21..8e83ea1 100644
--- a/audio/core/all-versions/default/util/CoreUtils.cpp
+++ b/audio/core/all-versions/default/util/CoreUtils.cpp
@@ -15,24 +15,24 @@
  */
 
 #if MAJOR_VERSION >= 7
-#include <android_audio_policy_configuration_V7_0-enums.h>
+#include PATH(APM_XSD_ENUMS_H_FILENAME)
 #endif
 #include <HidlUtils.h>
 #include <log/log.h>
 
 #include "util/CoreUtils.h"
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
 #if MAJOR_VERSION >= 7
 namespace xsd {
-using namespace ::android::audio::policy::configuration::V7_0;
+using namespace ::android::audio::policy::configuration::CPP_VERSION;
 }
 #endif
 
 namespace android {
 namespace hardware {
 namespace audio {
-namespace CPP_VERSION {
+namespace CORE_TYPES_CPP_VERSION {
 namespace implementation {
 
 #define CONVERT_CHECKED(expr, result)                   \
@@ -389,7 +389,7 @@
 
 #if MAJOR_VERSION >= 7
 namespace xsd {
-using namespace ::android::audio::policy::configuration::V7_0;
+using namespace ::android::audio::policy::configuration::CPP_VERSION;
 }
 
 status_t CoreUtils::audioInputFlagsFromHal(audio_input_flags_t halFlagMask,
@@ -470,7 +470,7 @@
 #endif
 
 }  // namespace implementation
-}  // namespace CPP_VERSION
+}  // namespace CORE_TYPES_CPP_VERSION
 }  // namespace audio
 }  // namespace hardware
 }  // namespace android
diff --git a/audio/core/all-versions/default/util/include/util/CoreUtils.h b/audio/core/all-versions/default/util/include/util/CoreUtils.h
index 1e5272a..dc35772 100644
--- a/audio/core/all-versions/default/util/include/util/CoreUtils.h
+++ b/audio/core/all-versions/default/util/include/util/CoreUtils.h
@@ -17,7 +17,7 @@
 #pragma once
 
 // clang-format off
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
 // clang-format off
 
 #include <vector>
@@ -30,13 +30,13 @@
 namespace android {
 namespace hardware {
 namespace audio {
-namespace CPP_VERSION {
+namespace CORE_TYPES_CPP_VERSION {
 namespace implementation {
 
 using ::android::hardware::audio::common::utils::EnumBitfield;
 using ::android::hardware::hidl_vec;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using namespace ::android::hardware::audio::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 
 struct CoreUtils {
     // Note: the converters for DeviceAddress have to be in CoreUtils for HAL V4
@@ -93,8 +93,8 @@
         return NO_ERROR;
     }
 #else
-    using AudioInputFlags = hidl_vec<::android::hardware::audio::CPP_VERSION::AudioInOutFlag>;
-    using AudioOutputFlags = hidl_vec<::android::hardware::audio::CPP_VERSION::AudioInOutFlag>;
+    using AudioInputFlags = hidl_vec<::android::hardware::audio::CORE_TYPES_CPP_VERSION::AudioInOutFlag>;
+    using AudioOutputFlags = hidl_vec<::android::hardware::audio::CORE_TYPES_CPP_VERSION::AudioInOutFlag>;
     static status_t audioInputFlagsFromHal(audio_input_flags_t halFlagMask, AudioInputFlags* flags);
     static status_t audioInputFlagsToHal(const AudioInputFlags& flags, audio_input_flags_t* halFlagMask);
     static status_t audioOutputFlagsFromHal(audio_output_flags_t halFlagMask, AudioOutputFlags* flags);
diff --git a/audio/core/all-versions/default/util/tests/coreutils_tests.cpp b/audio/core/all-versions/default/util/tests/coreutils_tests.cpp
index 0c18482..3976b08 100644
--- a/audio/core/all-versions/default/util/tests/coreutils_tests.cpp
+++ b/audio/core/all-versions/default/util/tests/coreutils_tests.cpp
@@ -28,7 +28,7 @@
 #include <xsdc/XsdcSupport.h>
 
 using namespace android;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::CPP_VERSION;
 using ::android::hardware::hidl_vec;
 using ::android::hardware::audio::CPP_VERSION::implementation::CoreUtils;
diff --git a/audio/core/all-versions/vts/functional/2.0/AudioPrimaryHidlHalUtils.h b/audio/core/all-versions/vts/functional/2.0/AudioPrimaryHidlHalUtils.h
index 1cffd41..dd80dd6 100644
--- a/audio/core/all-versions/vts/functional/2.0/AudioPrimaryHidlHalUtils.h
+++ b/audio/core/all-versions/vts/functional/2.0/AudioPrimaryHidlHalUtils.h
@@ -14,16 +14,18 @@
  * limitations under the License.
  */
 
+// clang-format off
 #include PATH(android/hardware/audio/FILE_VERSION/IStream.h)
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
+// clang-format on
 #include <hidl/HidlSupport.h>
 
 using ::android::hardware::hidl_handle;
 using ::android::hardware::hidl_string;
 using ::android::hardware::hidl_vec;
-using ::android::hardware::audio::common::CPP_VERSION::AudioChannelMask;
-using ::android::hardware::audio::common::CPP_VERSION::AudioFormat;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioChannelMask;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioFormat;
 using ::android::hardware::audio::CPP_VERSION::IStream;
 using ::android::hardware::audio::CPP_VERSION::ParameterValue;
 using ::android::hardware::audio::CPP_VERSION::Result;
diff --git a/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalTest.cpp b/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalTest.cpp
index 787654b..a9797bb 100644
--- a/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalTest.cpp
+++ b/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalTest.cpp
@@ -17,7 +17,7 @@
 #include "AudioPrimaryHidlHalTest.h"
 
 #if MAJOR_VERSION >= 7
-#include <android_audio_policy_configuration_V7_0.h>
+#include PATH(APM_XSD_H_FILENAME)
 #include <xsdc/XsdcSupport.h>
 
 using android::xsdc_enum_range;
@@ -28,17 +28,37 @@
     if (getDeviceName() != DeviceManager::kPrimaryDevice) {
         GTEST_SKIP() << "No primary device on this factory";  // returns
     }
-
-    {  // Scope for device SPs
-        sp<IDevice> baseDevice =
-                DeviceManager::getInstance().get(getFactoryName(), DeviceManager::kPrimaryDevice);
-        ASSERT_TRUE(baseDevice != nullptr);
-        Return<sp<IPrimaryDevice>> primaryDevice = IPrimaryDevice::castFrom(baseDevice);
-        EXPECT_TRUE(primaryDevice.isOk());
-        EXPECT_TRUE(sp<IPrimaryDevice>(primaryDevice) != nullptr);
-    }
     EXPECT_TRUE(
             DeviceManager::getInstance().reset(getFactoryName(), DeviceManager::kPrimaryDevice));
+
+    // Must use IDevicesFactory directly because DeviceManager always uses
+    // the latest interfaces version and corresponding methods for opening
+    // them. However, in minor package uprevs IPrimaryDevice does not inherit
+    // IDevice from the same package and thus IDevice can not be upcasted
+    // (see the interfaces in V7.1).
+    auto factory = DevicesFactoryManager::getInstance().get(getFactoryName());
+    ASSERT_TRUE(factory != nullptr);
+    sp<::android::hardware::audio::CORE_TYPES_CPP_VERSION::IDevice> baseDevice;
+    Result result;
+    auto ret = factory->openDevice(DeviceManager::kPrimaryDevice, returnIn(result, baseDevice));
+    ASSERT_TRUE(ret.isOk()) << ret.description();
+    ASSERT_EQ(Result::OK, result);
+    ASSERT_TRUE(baseDevice != nullptr);
+    {
+        Return<sp<::android::hardware::audio::CORE_TYPES_CPP_VERSION::IPrimaryDevice>>
+                primaryDevice = ::android::hardware::audio::CORE_TYPES_CPP_VERSION::IPrimaryDevice::
+                        castFrom(baseDevice);
+        EXPECT_TRUE(primaryDevice.isOk());
+        EXPECT_TRUE(sp<::android::hardware::audio::CORE_TYPES_CPP_VERSION::IPrimaryDevice>(
+                            primaryDevice) != nullptr);
+    }
+#if MAJOR_VERSION < 6
+    baseDevice.clear();
+    DeviceManager::waitForInstanceDestruction();
+#else
+    auto closeRet = baseDevice->close();
+    EXPECT_TRUE(closeRet.isOk());
+#endif
 }
 
 //////////////////////////////////////////////////////////////////////////////
@@ -183,7 +203,7 @@
                areAudioPatchesSupported() ? doc::partialTest("Audio patches are supported")
                                           : testSetDevices(stream.get(), address))
 
-static void checkGetHwAVSync(IDevice* device) {
+static void checkGetHwAVSync(::android::hardware::audio::CPP_VERSION::IDevice* device) {
     Result res;
     AudioHwSync sync;
     ASSERT_OK(device->getHwAvSync(returnIn(res, sync)));
@@ -215,7 +235,7 @@
     ASSERT_OK(stream->updateSinkMetadata(initMetadata));
 
 #elif MAJOR_VERSION >= 7
-    xsdc_enum_range<android::audio::policy::configuration::V7_0::AudioSource> range;
+    xsdc_enum_range<android::audio::policy::configuration::CPP_VERSION::AudioSource> range;
     // Test all possible track configuration
     for (auto source : range) {
         for (float volume : {0.0, 0.5, 1.0}) {
@@ -272,8 +292,9 @@
     // Restore initial
     ASSERT_OK(stream->updateSourceMetadata(initMetadata));
 #elif MAJOR_VERSION >= 7
-    xsdc_enum_range<android::audio::policy::configuration::V7_0::AudioUsage> usageRange;
-    xsdc_enum_range<android::audio::policy::configuration::V7_0::AudioContentType> contentRange;
+    xsdc_enum_range<android::audio::policy::configuration::CPP_VERSION::AudioUsage> usageRange;
+    xsdc_enum_range<android::audio::policy::configuration::CPP_VERSION::AudioContentType>
+            contentRange;
     // Test all possible track configuration
     for (auto usage : usageRange) {
         for (auto content : contentRange) {
diff --git a/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalUtils.h b/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalUtils.h
index 81a1f7b..a567cf9 100644
--- a/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalUtils.h
+++ b/audio/core/all-versions/vts/functional/4.0/AudioPrimaryHidlHalUtils.h
@@ -14,33 +14,36 @@
  * limitations under the License.
  */
 
-#include PATH(android/hardware/audio/FILE_VERSION/IStream.h)
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+// clang-format off
+#include PATH(android/hardware/audio/FILE_VERSION/IStreamIn.h)
+#include PATH(android/hardware/audio/FILE_VERSION/IStreamOut.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
+// clang-format on
 #include <hidl/HidlSupport.h>
 
 using ::android::hardware::hidl_bitfield;
 using ::android::hardware::hidl_handle;
 using ::android::hardware::hidl_string;
 using ::android::hardware::hidl_vec;
-using ::android::hardware::audio::common::CPP_VERSION::AudioChannelMask;
-using ::android::hardware::audio::common::CPP_VERSION::AudioFormat;
-using ::android::hardware::audio::CPP_VERSION::IStream;
-using ::android::hardware::audio::CPP_VERSION::ParameterValue;
-using ::android::hardware::audio::CPP_VERSION::Result;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioChannelMask;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioFormat;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::IStream;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::ParameterValue;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::Result;
 
 using namespace ::android::hardware::audio::common::test::utility;
 
-using Rotation = ::android::hardware::audio::CPP_VERSION::IPrimaryDevice::Rotation;
-using ::android::hardware::audio::common::CPP_VERSION::AudioContentType;
-using ::android::hardware::audio::common::CPP_VERSION::AudioUsage;
-using ::android::hardware::audio::CPP_VERSION::MicrophoneInfo;
+using Rotation = ::android::hardware::audio::CORE_TYPES_CPP_VERSION::IPrimaryDevice::Rotation;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioContentType;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioUsage;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::MicrophoneInfo;
 #if MAJOR_VERSION < 5
 using ::android::hardware::audio::CPP_VERSION::SinkMetadata;
 using ::android::hardware::audio::CPP_VERSION::SourceMetadata;
 #else
-using ::android::hardware::audio::common::CPP_VERSION::SinkMetadata;
-using ::android::hardware::audio::common::CPP_VERSION::SourceMetadata;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::SinkMetadata;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::SourceMetadata;
 #endif
 
 struct Parameters {
diff --git a/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp b/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp
index 8af4c78..aef94da 100644
--- a/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp
+++ b/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp
@@ -59,7 +59,8 @@
     testAccessors<OPTIONAL>(&OutputStreamTest::getStream, "dual mono mode",
                             Initial{DualMonoMode::OFF},
                             {DualMonoMode::LR, DualMonoMode::LL, DualMonoMode::RR},
-                            &IStreamOut::setDualMonoMode, &IStreamOut::getDualMonoMode);
+                            &::android::hardware::audio::CPP_VERSION::IStreamOut::setDualMonoMode,
+                            &::android::hardware::audio::CPP_VERSION::IStreamOut::getDualMonoMode);
 }
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(DualMonoModeAccessorHidlTest);
@@ -73,7 +74,8 @@
     testAccessors<OPTIONAL>(
             &OutputStreamTest::getStream, "audio description mix level",
             Initial{-std::numeric_limits<float>::infinity()}, {-48.0f, -1.0f, 0.0f, 1.0f, 48.0f},
-            &IStreamOut::setAudioDescriptionMixLevel, &IStreamOut::getAudioDescriptionMixLevel,
+            &::android::hardware::audio::CPP_VERSION::IStreamOut::setAudioDescriptionMixLevel,
+            &::android::hardware::audio::CPP_VERSION::IStreamOut::getAudioDescriptionMixLevel,
             {48.5f, 1000.0f, std::numeric_limits<float>::infinity()});
 }
 
@@ -105,7 +107,8 @@
              PlaybackRate{0.5f, 0.5f, TimestretchMode::VOICE, TimestretchFallbackMode::MUTE},
              PlaybackRate{1000.0f, 1000.0f, TimestretchMode::VOICE, TimestretchFallbackMode::MUTE},
              PlaybackRate{1.0f, 1.0f, TimestretchMode::VOICE, TimestretchFallbackMode::FAIL}},
-            &IStreamOut::setPlaybackRateParameters, &IStreamOut::getPlaybackRateParameters,
+            &::android::hardware::audio::CPP_VERSION::IStreamOut::setPlaybackRateParameters,
+            &::android::hardware::audio::CPP_VERSION::IStreamOut::getPlaybackRateParameters,
             {PlaybackRate{1000.0f, 1000.0f, TimestretchMode::DEFAULT,
                           TimestretchFallbackMode::FAIL},
              PlaybackRate{1000.0f, 1000.0f, TimestretchMode::VOICE,
diff --git a/audio/core/all-versions/vts/functional/6.0/Generators.cpp b/audio/core/all-versions/vts/functional/6.0/Generators.cpp
index e3b98c9..dafd326 100644
--- a/audio/core/all-versions/vts/functional/6.0/Generators.cpp
+++ b/audio/core/all-versions/vts/functional/6.0/Generators.cpp
@@ -21,8 +21,8 @@
 #include "PolicyConfig.h"
 
 // clang-format off
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 // clang-format on
 
 // Forward declaration for functions that are substituted
@@ -30,7 +30,7 @@
 const PolicyConfig& getCachedPolicyConfig();
 const std::vector<DeviceParameter>& getDeviceParameters();
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::CPP_VERSION;
 
 std::vector<DeviceConfigParameter> generateOutputDeviceConfigParameters(bool oneProfilePerDevice) {
diff --git a/audio/core/all-versions/vts/functional/7.0/AudioPrimaryHidlHalTest.cpp b/audio/core/all-versions/vts/functional/7.0/AudioPrimaryHidlHalTest.cpp
index 2759801..f25c391 100644
--- a/audio/core/all-versions/vts/functional/7.0/AudioPrimaryHidlHalTest.cpp
+++ b/audio/core/all-versions/vts/functional/7.0/AudioPrimaryHidlHalTest.cpp
@@ -53,9 +53,9 @@
 
 TEST_P(AudioHidlDeviceTest, SetConnectedStateInvalidDeviceAddress) {
     doc::test("Check that invalid device address is rejected by IDevice::setConnectedState");
-    EXPECT_RESULT(Result::INVALID_ARGUMENTS,
+    EXPECT_RESULT(invalidArgsOrNotSupported,
                   getDevice()->setConnectedState(getInvalidDeviceAddress(), true));
-    EXPECT_RESULT(Result::INVALID_ARGUMENTS,
+    EXPECT_RESULT(invalidArgsOrNotSupported,
                   getDevice()->setConnectedState(getInvalidDeviceAddress(), false));
 }
 
@@ -381,13 +381,13 @@
             "IDevice::open{Input|Output}Stream method.");
     AudioConfig suggestedConfig{};
     if (isParamForInputStream()) {
-        sp<IStreamIn> stream;
+        sp<::android::hardware::audio::CORE_TYPES_CPP_VERSION::IStreamIn> stream;
         ASSERT_OK(getDevice()->openInputStream(AudioIoHandle{}, getDeviceAddress(), getConfig(),
                                                getFlags(), getSinkMetadata(),
                                                returnIn(res, stream, suggestedConfig)));
         ASSERT_TRUE(stream == nullptr);
     } else {
-        sp<IStreamOut> stream;
+        sp<::android::hardware::audio::CORE_TYPES_CPP_VERSION::IStreamOut> stream;
         ASSERT_OK(getDevice()->openOutputStream(AudioIoHandle{}, getDeviceAddress(), getConfig(),
                                                 getFlags(), getSourceMetadata(),
                                                 returnIn(res, stream, suggestedConfig)));
@@ -551,13 +551,15 @@
     }
 
     void releasePatchIfNeeded() {
-        if (areAudioPatchesSupported()) {
-            if (mHasPatch) {
+        if (getDevice()) {
+            if (areAudioPatchesSupported() && mHasPatch) {
                 EXPECT_OK(getDevice()->releaseAudioPatch(mPatchHandle));
                 mHasPatch = false;
             }
         } else {
-            EXPECT_OK(stream->setDevices({address}));
+            if (stream) {
+                EXPECT_OK(stream->setDevices({address}));
+            }
         }
     }
 
@@ -724,13 +726,15 @@
     }
 
     void releasePatchIfNeeded() {
-        if (areAudioPatchesSupported()) {
-            if (mHasPatch) {
+        if (getDevice()) {
+            if (areAudioPatchesSupported() && mHasPatch) {
                 EXPECT_OK(getDevice()->releaseAudioPatch(mPatchHandle));
                 mHasPatch = false;
             }
         } else {
-            EXPECT_OK(stream->setDevices({address}));
+            if (stream) {
+                EXPECT_OK(stream->setDevices({address}));
+            }
         }
     }
 
diff --git a/audio/core/all-versions/vts/functional/7.0/Generators.cpp b/audio/core/all-versions/vts/functional/7.0/Generators.cpp
index 42bf1d3..f936d0a 100644
--- a/audio/core/all-versions/vts/functional/7.0/Generators.cpp
+++ b/audio/core/all-versions/vts/functional/7.0/Generators.cpp
@@ -20,20 +20,20 @@
 #include "7.0/PolicyConfig.h"
 
 // clang-format off
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 // clang-format on
 
-#include <android_audio_policy_configuration_V7_0-enums.h>
-#include <android_audio_policy_configuration_V7_0.h>
+#include PATH(APM_XSD_ENUMS_H_FILENAME)
+#include PATH(APM_XSD_H_FILENAME)
 
 // Forward declaration for functions that are substituted
 // in generator unit tests.
 const PolicyConfig& getCachedPolicyConfig();
 const std::vector<DeviceParameter>& getDeviceParameters();
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using namespace ::android::hardware::audio::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 namespace xsd {
 using namespace ::android::audio::policy::configuration::CPP_VERSION;
 }
diff --git a/audio/core/all-versions/vts/functional/7.0/PolicyConfig.cpp b/audio/core/all-versions/vts/functional/7.0/PolicyConfig.cpp
index 2988207..d674403 100644
--- a/audio/core/all-versions/vts/functional/7.0/PolicyConfig.cpp
+++ b/audio/core/all-versions/vts/functional/7.0/PolicyConfig.cpp
@@ -30,9 +30,9 @@
 using ::android::NO_ERROR;
 using ::android::OK;
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using namespace ::android::hardware::audio::CPP_VERSION;
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
 using ::android::hardware::audio::common::utils::splitString;
 namespace xsd {
 using namespace ::android::audio::policy::configuration::CPP_VERSION;
diff --git a/audio/core/all-versions/vts/functional/7.0/PolicyConfig.h b/audio/core/all-versions/vts/functional/7.0/PolicyConfig.h
index f798839..4aea503 100644
--- a/audio/core/all-versions/vts/functional/7.0/PolicyConfig.h
+++ b/audio/core/all-versions/vts/functional/7.0/PolicyConfig.h
@@ -25,15 +25,15 @@
 #include <utils/Errors.h>
 
 // clang-format off
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 // clang-format on
 
-#include <android_audio_policy_configuration_V7_0-enums.h>
-#include <android_audio_policy_configuration_V7_0.h>
+#include PATH(APM_XSD_ENUMS_H_FILENAME)
+#include PATH(APM_XSD_H_FILENAME)
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
-using namespace ::android::hardware::audio::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
+using namespace ::android::hardware::audio::CORE_TYPES_CPP_VERSION;
 namespace xsd {
 using namespace ::android::audio::policy::configuration::CPP_VERSION;
 using Module = Modules::Module;
diff --git a/audio/core/all-versions/vts/functional/7.1/AudioPrimaryHidlHalTest.cpp b/audio/core/all-versions/vts/functional/7.1/AudioPrimaryHidlHalTest.cpp
new file mode 100644
index 0000000..d82d4ad
--- /dev/null
+++ b/audio/core/all-versions/vts/functional/7.1/AudioPrimaryHidlHalTest.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// pull in all the <= 7.0 tests
+#include "7.0/AudioPrimaryHidlHalTest.cpp"
+
+TEST_P(AudioHidlDeviceTest, SetConnectedState_7_1) {
+    doc::test("Check that the HAL can be notified of device connection and disconnection");
+    using AD = xsd::AudioDevice;
+    for (auto deviceType : {AD::AUDIO_DEVICE_OUT_HDMI, AD::AUDIO_DEVICE_OUT_WIRED_HEADPHONE,
+                            AD::AUDIO_DEVICE_IN_USB_HEADSET}) {
+        SCOPED_TRACE("device=" + toString(deviceType));
+        for (bool state : {true, false}) {
+            SCOPED_TRACE("state=" + ::testing::PrintToString(state));
+            DeviceAddress address = {};
+            address.deviceType = toString(deviceType);
+            if (deviceType == AD::AUDIO_DEVICE_IN_USB_HEADSET) {
+                address.address.alsa({0, 0});
+            }
+            AudioPort devicePort;
+            devicePort.ext.device(address);
+            auto ret = getDevice()->setConnectedState_7_1(devicePort, state);
+            ASSERT_TRUE(ret.isOk());
+            if (ret == Result::NOT_SUPPORTED) {
+                doc::partialTest("setConnectedState_7_1 is not supported");
+                break;  // other deviceType might be supported
+            }
+            ASSERT_OK(ret);
+        }
+    }
+
+    // Because there is no way of knowing if the devices were connected before
+    // calling setConnectedState, there is no way to restore the HAL to its
+    // initial state. To workaround this, destroy the HAL at the end of this test.
+    ASSERT_TRUE(resetDevice());
+}
diff --git a/audio/core/all-versions/vts/functional/Android.bp b/audio/core/all-versions/vts/functional/Android.bp
index b280d7c..61ab1bb 100644
--- a/audio/core/all-versions/vts/functional/Android.bp
+++ b/audio/core/all-versions/vts/functional/Android.bp
@@ -184,6 +184,39 @@
     test_config: "VtsHalAudioV7_0TargetTest.xml",
 }
 
+cc_test {
+    name: "VtsHalAudioV7_1TargetTest",
+    defaults: ["VtsHalAudioTargetTest_defaults"],
+    srcs: [
+        "7.1/AudioPrimaryHidlHalTest.cpp",
+        "7.0/Generators.cpp",
+        "7.0/PolicyConfig.cpp",
+    ],
+    generated_headers: ["audio_policy_configuration_V7_1_parser"],
+    generated_sources: ["audio_policy_configuration_V7_1_parser"],
+    static_libs: [
+        "android.hardware.audio@7.0",
+        "android.hardware.audio@7.1",
+        "android.hardware.audio.common@7.0",
+        "android.hardware.audio.common@7.0-enums",
+        "android.hardware.audio.common@7.1-enums",
+        "android.hardware.audio.common@7.0-util",
+    ],
+    cflags: [
+        "-DMAJOR_VERSION=7",
+        "-DMINOR_VERSION=1",
+        "-DCOMMON_TYPES_MINOR_VERSION=0",
+        "-DCORE_TYPES_MINOR_VERSION=0",
+        "-include common/all-versions/VersionMacro.h",
+    ],
+    data: [
+        ":audio_policy_configuration_V7_1",
+    ],
+    // Use test_config for vts suite.
+    // TODO(b/146104851): Add auto-gen rules and remove it.
+    test_config: "VtsHalAudioV7_1TargetTest.xml",
+}
+
 // Note: the following aren't VTS tests, but rather unit tests
 // to verify correctness of test utilities.
 cc_test {
diff --git a/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h b/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
index 340903a..404532a 100644
--- a/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
+++ b/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
@@ -37,15 +37,17 @@
 #include <android-base/logging.h>
 #include <system/audio_config.h>
 
+// clang-format off
 #include PATH(android/hardware/audio/FILE_VERSION/IDevice.h)
 #include PATH(android/hardware/audio/FILE_VERSION/IDevicesFactory.h)
 #include PATH(android/hardware/audio/FILE_VERSION/IPrimaryDevice.h)
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 #if MAJOR_VERSION >= 7
-#include <android_audio_policy_configuration_V7_0-enums.h>
-#include <android_audio_policy_configuration_V7_0.h>
+#include PATH(APM_XSD_ENUMS_H_FILENAME)
+#include PATH(APM_XSD_H_FILENAME)
 #endif
+// clang-format on
 
 #include <fmq/EventFlag.h>
 #include <fmq/MessageQueue.h>
@@ -86,7 +88,7 @@
 using ::android::hardware::audio::common::utils::mkEnumBitfield;
 using ::android::hardware::details::toHexString;
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::common::test::utility;
 using namespace ::android::hardware::audio::CPP_VERSION;
 using ReadParameters = ::android::hardware::audio::CPP_VERSION::IStreamIn::ReadParameters;
@@ -124,6 +126,9 @@
 
 class HidlTest : public ::testing::Test {
   public:
+    using IDevice = ::android::hardware::audio::CPP_VERSION::IDevice;
+    using IDevicesFactory = ::android::hardware::audio::CPP_VERSION::IDevicesFactory;
+
     virtual ~HidlTest() = default;
     // public access to avoid annoyances when using this method in template classes
     // derived from test classes
@@ -168,7 +173,8 @@
 }
 
 TEST(CheckConfig, audioPolicyConfigurationValidation) {
-    const auto factories = ::android::hardware::getAllHalInstanceNames(IDevicesFactory::descriptor);
+    const auto factories = ::android::hardware::getAllHalInstanceNames(
+            ::android::hardware::audio::CPP_VERSION::IDevicesFactory::descriptor);
     if (factories.size() == 0) {
         GTEST_SKIP() << "Skipping audioPolicyConfigurationValidation because no factory instances "
                         "are found.";
@@ -198,8 +204,8 @@
 const std::vector<DeviceParameter>& getDeviceParameters() {
     static std::vector<DeviceParameter> parameters = [] {
         std::vector<DeviceParameter> result;
-        const auto factories =
-                ::android::hardware::getAllHalInstanceNames(IDevicesFactory::descriptor);
+        const auto factories = ::android::hardware::getAllHalInstanceNames(
+                ::android::hardware::audio::CPP_VERSION::IDevicesFactory::descriptor);
         const auto devices = getCachedPolicyConfig().getModulesWithDevicesNames();
         result.reserve(devices.size());
         for (const auto& factoryName : factories) {
@@ -217,8 +223,8 @@
 const std::vector<DeviceParameter>& getDeviceParametersForFactoryTests() {
     static std::vector<DeviceParameter> parameters = [] {
         std::vector<DeviceParameter> result;
-        const auto factories =
-                ::android::hardware::getAllHalInstanceNames(IDevicesFactory::descriptor);
+        const auto factories = ::android::hardware::getAllHalInstanceNames(
+                ::android::hardware::audio::CPP_VERSION::IDevicesFactory::descriptor);
         for (const auto& factoryName : factories) {
             result.emplace_back(factoryName,
                                 DeviceManager::getInstance().getPrimary(factoryName) != nullptr
@@ -288,6 +294,8 @@
 // Test audio devices factory
 class AudioHidlTest : public AudioHidlTestWithDeviceParameter {
   public:
+    using IPrimaryDevice = ::android::hardware::audio::CPP_VERSION::IPrimaryDevice;
+
     void SetUp() override {
         ASSERT_NO_FATAL_FAILURE(AudioHidlTestWithDeviceParameter::SetUp());  // setup base
         ASSERT_TRUE(getDevicesFactory() != nullptr);
@@ -301,7 +309,7 @@
 TEST_P(AudioHidlTest, OpenDeviceInvalidParameter) {
     doc::test("Test passing an invalid parameter to openDevice");
     Result result;
-    sp<IDevice> device;
+    sp<::android::hardware::audio::CORE_TYPES_CPP_VERSION::IDevice> device;
 #if MAJOR_VERSION == 2
     auto invalidDevice = IDevicesFactory::Device(-1);
 #elif MAJOR_VERSION >= 4
@@ -572,8 +580,8 @@
                     [](auto&& arg) -> std::string {
                         using T = std::decay_t<decltype(arg)>;
                         // Need to use FQN of toString to avoid confusing the compiler
-                        return ::android::hardware::audio::common::CPP_VERSION::toString<T>(
-                                hidl_bitfield<T>(arg));
+                        return ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::
+                                toString<T>(hidl_bitfield<T>(arg));
                     },
                     std::get<PARAM_FLAGS>(info.param)));
 #elif MAJOR_VERSION >= 7
@@ -890,6 +898,8 @@
 
 class StreamWriter : public StreamWorker<StreamWriter> {
   public:
+    using IStreamOut = ::android::hardware::audio::CPP_VERSION::IStreamOut;
+
     StreamWriter(IStreamOut* stream, size_t bufferSize)
         : mStream(stream), mBufferSize(bufferSize), mData(mBufferSize) {}
     ~StreamWriter() {
@@ -998,7 +1008,8 @@
     EventFlag* mEfGroup = nullptr;
 };
 
-class OutputStreamTest : public OpenStreamTest<IStreamOut> {
+class OutputStreamTest
+    : public OpenStreamTest<::android::hardware::audio::CPP_VERSION::IStreamOut> {
     void SetUp() override {
         ASSERT_NO_FATAL_FAILURE(OpenStreamTest::SetUp());  // setup base
 #if MAJOR_VERSION <= 6
@@ -1012,9 +1023,12 @@
                 [&](AudioIoHandle handle, AudioConfig config, auto cb) {
 #if MAJOR_VERSION == 2
                     return getDevice()->openOutputStream(handle, address, config, flags, cb);
-#elif MAJOR_VERSION >= 4
+#elif MAJOR_VERSION >= 4 && (MAJOR_VERSION < 7 || (MAJOR_VERSION == 7 && MINOR_VERSION == 0))
                     return getDevice()->openOutputStream(handle, address, config, flags,
                                                          initMetadata, cb);
+#elif MAJOR_VERSION == 7 && MINOR_VERSION == 1
+                    return getDevice()->openOutputStream_7_1(handle, address, config, flags,
+                                                             initMetadata, cb);
 #endif
                 },
                 config);
@@ -1075,6 +1089,8 @@
 
 class StreamReader : public StreamWorker<StreamReader> {
   public:
+    using IStreamIn = ::android::hardware::audio::CPP_VERSION::IStreamIn;
+
     StreamReader(IStreamIn* stream, size_t bufferSize)
         : mStream(stream), mBufferSize(bufferSize), mData(mBufferSize) {}
     ~StreamReader() {
@@ -1188,7 +1204,7 @@
     EventFlag* mEfGroup = nullptr;
 };
 
-class InputStreamTest : public OpenStreamTest<IStreamIn> {
+class InputStreamTest : public OpenStreamTest<::android::hardware::audio::CPP_VERSION::IStreamIn> {
     void SetUp() override {
         ASSERT_NO_FATAL_FAILURE(OpenStreamTest::SetUp());  // setup base
 #if MAJOR_VERSION <= 6
@@ -1210,8 +1226,13 @@
         auto flags = getInputFlags();
         testOpen(
                 [&](AudioIoHandle handle, AudioConfig config, auto cb) {
+#if MAJOR_VERSION < 7 || (MAJOR_VERSION == 7 && MINOR_VERSION == 0)
                     return getDevice()->openInputStream(handle, address, config, flags,
                                                         initMetadata, cb);
+#elif MAJOR_VERSION == 7 && MINOR_VERSION == 1
+                    return getDevice()->openInputStream_7_1(handle, address, config, flags,
+                                                            initMetadata, cb);
+#endif
                 },
                 config);
     }
@@ -1584,7 +1605,8 @@
                             "InputStream::setGain");
 }
 
-static void testPrepareForReading(IStreamIn* stream, uint32_t frameSize, uint32_t framesCount) {
+static void testPrepareForReading(::android::hardware::audio::CPP_VERSION::IStreamIn* stream,
+                                  uint32_t frameSize, uint32_t framesCount) {
     Result res;
     // Ignore output parameters as the call should fail
     ASSERT_OK(stream->prepareForReading(frameSize, framesCount,
@@ -1655,7 +1677,8 @@
                             "setVolume");
 }
 
-static void testPrepareForWriting(IStreamOut* stream, uint32_t frameSize, uint32_t framesCount) {
+static void testPrepareForWriting(::android::hardware::audio::CPP_VERSION::IStreamOut* stream,
+                                  uint32_t frameSize, uint32_t framesCount) {
     Result res;
     // Ignore output parameters as the call should fail
     ASSERT_OK(stream->prepareForWriting(frameSize, framesCount,
@@ -1682,6 +1705,8 @@
 }
 
 struct Capability {
+    using IStreamOut = ::android::hardware::audio::CPP_VERSION::IStreamOut;
+
     Capability(IStreamOut* stream) {
         EXPECT_OK(stream->supportsPauseAndResume(returnIn(pause, resume)));
         drain = extract(stream->supportsDrain());
@@ -1725,7 +1750,7 @@
     Return<void> onError() override { return {}; }
 };
 
-static bool isAsyncModeSupported(IStreamOut* stream) {
+static bool isAsyncModeSupported(::android::hardware::audio::CPP_VERSION::IStreamOut* stream) {
     auto res = stream->setCallback(new MockOutCallbacks);
     stream->clearCallback();  // try to restore the no callback state, ignore
                               // any error
@@ -1780,7 +1805,8 @@
     ASSERT_RESULT(Result::INVALID_STATE, stream->pause());
 }
 
-static void testDrain(IStreamOut* stream, AudioDrain type) {
+static void testDrain(::android::hardware::audio::CPP_VERSION::IStreamOut* stream,
+                      AudioDrain type) {
     if (!Capability(stream).drain) {
         doc::partialTest("The output stream does not support drain");
         return;
@@ -1866,7 +1892,8 @@
 }
 
 using TtyModeAccessorPrimaryHidlTest =
-        AccessorHidlTest<IPrimaryDevice::TtyMode, AudioPrimaryHidlTest>;
+        AccessorHidlTest<::android::hardware::audio::CPP_VERSION::IPrimaryDevice::TtyMode,
+                         AudioPrimaryHidlTest>;
 TEST_P(TtyModeAccessorPrimaryHidlTest, setGetTtyMode) {
     doc::test("Query and set the TTY mode state");
     testAccessors<OPTIONAL>(
diff --git a/audio/core/all-versions/vts/functional/AudioTestDefinitions.h b/audio/core/all-versions/vts/functional/AudioTestDefinitions.h
index aa67630..802b87b 100644
--- a/audio/core/all-versions/vts/functional/AudioTestDefinitions.h
+++ b/audio/core/all-versions/vts/functional/AudioTestDefinitions.h
@@ -22,8 +22,8 @@
 #include <vector>
 
 // clang-format off
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 // clang-format on
 
 enum { PARAM_FACTORY_NAME, PARAM_DEVICE_NAME };
@@ -34,14 +34,14 @@
 #if MAJOR_VERSION <= 6
 enum { PARAM_DEVICE, PARAM_CONFIG, PARAM_FLAGS };
 enum { INDEX_INPUT, INDEX_OUTPUT };
-using DeviceConfigParameter =
-        std::tuple<DeviceParameter, android::hardware::audio::common::CPP_VERSION::AudioConfig,
-                   std::variant<android::hardware::audio::common::CPP_VERSION::AudioInputFlag,
-                                android::hardware::audio::common::CPP_VERSION::AudioOutputFlag>>;
+using DeviceConfigParameter = std::tuple<
+        DeviceParameter, android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioConfig,
+        std::variant<android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioInputFlag,
+                     android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioOutputFlag>>;
 #elif MAJOR_VERSION >= 7
 enum { PARAM_DEVICE, PARAM_PORT_NAME, PARAM_CONFIG, PARAM_FLAGS };
 using DeviceConfigParameter =
         std::tuple<DeviceParameter, std::string,
-                   android::hardware::audio::common::CPP_VERSION::AudioConfig,
-                   std::vector<android::hardware::audio::CPP_VERSION::AudioInOutFlag>>;
+                   android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::AudioConfig,
+                   std::vector<android::hardware::audio::CORE_TYPES_CPP_VERSION::AudioInOutFlag>>;
 #endif
diff --git a/audio/core/all-versions/vts/functional/ConfigHelper.h b/audio/core/all-versions/vts/functional/ConfigHelper.h
index a2bb1ee..e4008cf 100644
--- a/audio/core/all-versions/vts/functional/ConfigHelper.h
+++ b/audio/core/all-versions/vts/functional/ConfigHelper.h
@@ -21,8 +21,8 @@
 #include "PolicyConfig.h"
 
 // clang-format off
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 // clang-format on
 
 using ::android::hardware::audio::common::utils::EnumBitfield;
diff --git a/audio/core/all-versions/vts/functional/DeviceManager.h b/audio/core/all-versions/vts/functional/DeviceManager.h
index 6db78a7..c8e0167 100644
--- a/audio/core/all-versions/vts/functional/DeviceManager.h
+++ b/audio/core/all-versions/vts/functional/DeviceManager.h
@@ -22,19 +22,21 @@
 
 #include <android-base/logging.h>
 #include <hwbinder/IPCThreadState.h>
+#include <system/audio.h>
 
 // clang-format off
 #include PATH(android/hardware/audio/FILE_VERSION/IDevice.h)
 #include PATH(android/hardware/audio/FILE_VERSION/IDevicesFactory.h)
 #include PATH(android/hardware/audio/FILE_VERSION/IPrimaryDevice.h)
-#include PATH(android/hardware/audio/FILE_VERSION/types.h)
-#include PATH(android/hardware/audio/common/FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/CORE_TYPES_FILE_VERSION/types.h)
+#include PATH(android/hardware/audio/common/COMMON_TYPES_FILE_VERSION/types.h)
 // clang-format on
 
 #include "utility/ReturnIn.h"
 
 using ::android::sp;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using ::android::hardware::audio::CORE_TYPES_CPP_VERSION::Result;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::common::test::utility;
 using namespace ::android::hardware::audio::CPP_VERSION;
 
@@ -104,21 +106,30 @@
     static sp<IDevice> createInterfaceInstance(const FactoryAndDevice& factoryAndDevice) {
         auto [factoryName, name] = factoryAndDevice;
         sp<IDevicesFactory> factory = DevicesFactoryManager::getInstance().get(factoryName);
-        return name == kPrimaryDevice ? openPrimaryDevice(factory) : openDevice(factory, name);
+        return openDevice(factory, name);
     }
     using InterfaceManager::reset;
 
     static constexpr const char* kPrimaryDevice = "primary";
 
     sp<IDevice> get(const std::string& factoryName, const std::string& name) {
+        if (name == kPrimaryDevice) {
+            (void)getPrimary(factoryName);  // for initializing primaryDevice if needed.
+        }
         return InterfaceManager::get(std::make_tuple(factoryName, name));
     }
     sp<IPrimaryDevice> getPrimary(const std::string& factoryName) {
-        sp<IDevice> device = get(factoryName, kPrimaryDevice);
-        return device != nullptr ? IPrimaryDevice::castFrom(device) : nullptr;
+        if (primaryDevice == nullptr) {
+            sp<IDevicesFactory> factory = DevicesFactoryManager::getInstance().get(factoryName);
+            primaryDevice = openPrimaryDevice(factory);
+        }
+        return primaryDevice;
     }
     bool reset(const std::string& factoryName, const std::string& name)
             __attribute__((warn_unused_result)) {
+        if (name == kPrimaryDevice) {
+            primaryDevice.clear();
+        }
 #if MAJOR_VERSION <= 5
         return InterfaceManager::reset(std::make_tuple(factoryName, name), true);
 #elif MAJOR_VERSION >= 6
@@ -140,35 +151,75 @@
   private:
     static sp<IDevice> openDevice(const sp<IDevicesFactory>& factory, const std::string& name) {
         if (factory == nullptr) return nullptr;
-        sp<IDevice> device;
-#if MAJOR_VERSION >= 4
         Result result;
+        sp<IDevice> device;
+#if MAJOR_VERSION == 2
+        IDevicesFactory::Device dev = IDevicesFactory::IDevicesFactory::Device(-1);
+        if (name == AUDIO_HARDWARE_MODULE_ID_PRIMARY) {
+            dev = IDevicesFactory::Device::PRIMARY;
+        } else if (name == AUDIO_HARDWARE_MODULE_ID_A2DP) {
+            dev = IDevicesFactory::Device::A2DP;
+        } else if (name == AUDIO_HARDWARE_MODULE_ID_USB) {
+            dev = IDevicesFactory::Device::USB;
+        } else if (name == AUDIO_HARDWARE_MODULE_ID_REMOTE_SUBMIX) {
+            dev = IDevicesFactory::Device::R_SUBMIX;
+        } else if (name == AUDIO_HARDWARE_MODULE_ID_STUB) {
+            dev = IDevicesFactory::Device::STUB;
+        }
+        auto ret = factory->openDevice(dev, returnIn(result, device));
+#elif MAJOR_VERSION >= 4 && (MAJOR_VERSION < 7 || (MAJOR_VERSION == 7 && MINOR_VERSION == 0))
         auto ret = factory->openDevice(name, returnIn(result, device));
+#elif MAJOR_VERSION == 7 && MINOR_VERSION == 1
+        auto ret = factory->openDevice_7_1(name, returnIn(result, device));
+#endif
         if (!ret.isOk() || result != Result::OK || device == nullptr) {
             ALOGW("Device %s can not be opened, transaction: %s, result %d, device %p",
                   name.c_str(), ret.description().c_str(), result, device.get());
             return nullptr;
         }
-#else
-        (void)name;
-#endif
         return device;
     }
 
-    static sp<IDevice> openPrimaryDevice(const sp<IDevicesFactory>& factory) {
-        if (factory == nullptr) return nullptr;
+    static sp<IPrimaryDevice> openPrimaryDevice(const sp<IDevicesFactory>& factory) {
+        if (factory == nullptr) return {};
         Result result;
         sp<IDevice> device;
+        sp<IPrimaryDevice> primaryDevice;
 #if MAJOR_VERSION == 2
         auto ret = factory->openDevice(IDevicesFactory::Device::PRIMARY, returnIn(result, device));
-#elif MAJOR_VERSION >= 4
+        if (ret.isOk() && result == Result::OK && device != nullptr) {
+            primaryDevice = IPrimaryDevice::castFrom(device);
+        }
+#elif MAJOR_VERSION >= 4 && (MAJOR_VERSION < 7 || (MAJOR_VERSION == 7 && MINOR_VERSION == 0))
         auto ret = factory->openPrimaryDevice(returnIn(result, device));
+        if (ret.isOk() && result == Result::OK && device != nullptr) {
+            primaryDevice = IPrimaryDevice::castFrom(device);
+        }
+#elif MAJOR_VERSION == 7 && MINOR_VERSION == 1
+        auto ret = factory->openPrimaryDevice_7_1(returnIn(result, primaryDevice));
+        if (ret.isOk() && result == Result::OK && primaryDevice != nullptr) {
+            auto getDeviceRet = primaryDevice->getDevice();
+            if (getDeviceRet.isOk()) {
+                device = getDeviceRet;
+            } else {
+                primaryDevice.clear();
+                ALOGW("Primary device can not downcast, transaction: %s, primary %p",
+                      getDeviceRet.description().c_str(), primaryDevice.get());
+                return {};
+            }
+        }
 #endif
         if (!ret.isOk() || result != Result::OK || device == nullptr) {
             ALOGW("Primary device can not be opened, transaction: %s, result %d, device %p",
                   ret.description().c_str(), result, device.get());
-            return nullptr;
+            return {};
         }
-        return device;
+        return primaryDevice;
     }
+
+  private:
+    // There can only be one primary device across all HAL modules.
+    // A reference to a complete interface is used because in V7.1 IDevice can not
+    // be upcasted to IPrimaryDevice.
+    sp<IPrimaryDevice> primaryDevice;
 };
diff --git a/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml b/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml
index f035baf..ae57125 100644
--- a/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml
+++ b/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml
@@ -34,5 +34,6 @@
     <test class="com.android.tradefed.testtype.GTest" >
         <option name="native-test-device-path" value="/data/local/tmp" />
         <option name="module-name" value="VtsHalAudioV6_0TargetTest" />
+        <option name="native-test-timeout" value="5m" />
     </test>
 </configuration>
diff --git a/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml b/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml
index 6635f31..55dbaf1 100644
--- a/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml
+++ b/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml
@@ -34,5 +34,6 @@
     <test class="com.android.tradefed.testtype.GTest" >
         <option name="native-test-device-path" value="/data/local/tmp" />
         <option name="module-name" value="VtsHalAudioV7_0TargetTest" />
+        <option name="native-test-timeout" value="5m" />
     </test>
 </configuration>
diff --git a/audio/core/all-versions/vts/functional/VtsHalAudioV7_1TargetTest.xml b/audio/core/all-versions/vts/functional/VtsHalAudioV7_1TargetTest.xml
new file mode 100644
index 0000000..7b33a8f
--- /dev/null
+++ b/audio/core/all-versions/vts/functional/VtsHalAudioV7_1TargetTest.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsHalAudioV7_1TargetTest.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-native" />
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer"/>
+    <target_preparer class="com.android.tradefed.targetprep.StopServicesSetup"/>
+
+    <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
+        <option name="run-command" value="setprop vts.native_server.on 1"/>
+        <option name="teardown-command" value="setprop vts.native_server.on 0"/>
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="VtsHalAudioV7_1TargetTest->/data/local/tmp/VtsHalAudioV7_1TargetTest" />
+        <option name="push" value="audio_policy_configuration_V7_1.xsd->/data/local/tmp/audio_policy_configuration_V7_1.xsd" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="VtsHalAudioV7_1TargetTest" />
+        <option name="native-test-timeout" value="5m" />
+    </test>
+</configuration>
diff --git a/audio/core/all-versions/vts/functional/tests/generators_tests.cpp b/audio/core/all-versions/vts/functional/tests/generators_tests.cpp
index 3fdd8e6..76bf93e 100644
--- a/audio/core/all-versions/vts/functional/tests/generators_tests.cpp
+++ b/audio/core/all-versions/vts/functional/tests/generators_tests.cpp
@@ -33,7 +33,7 @@
 #endif
 
 using namespace android;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 #if MAJOR_VERSION == 7
 namespace xsd {
 using namespace ::android::audio::policy::configuration::CPP_VERSION;
diff --git a/audio/effect/all-versions/default/Effect.cpp b/audio/effect/all-versions/default/Effect.cpp
index ccfc6b2..49f6bf2 100644
--- a/audio/effect/all-versions/default/Effect.cpp
+++ b/audio/effect/all-versions/default/Effect.cpp
@@ -42,9 +42,10 @@
 namespace implementation {
 
 #if MAJOR_VERSION <= 6
-using ::android::hardware::audio::common::CPP_VERSION::implementation::AudioChannelBitfield;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::
+        AudioChannelBitfield;
 #endif
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
 
 namespace {
 
diff --git a/audio/effect/all-versions/default/Effect.h b/audio/effect/all-versions/default/Effect.h
index d5218f7..f9a6796 100644
--- a/audio/effect/all-versions/default/Effect.h
+++ b/audio/effect/all-versions/default/Effect.h
@@ -48,9 +48,10 @@
 using ::android::hardware::Return;
 using ::android::hardware::Void;
 #if MAJOR_VERSION <= 6
-using ::android::hardware::audio::common::CPP_VERSION::implementation::AudioDeviceBitfield;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::
+        AudioDeviceBitfield;
 #endif
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct Effect : public IEffect {
diff --git a/audio/effect/all-versions/default/EffectsFactory.cpp b/audio/effect/all-versions/default/EffectsFactory.cpp
index eb1cb49..e93ad89 100644
--- a/audio/effect/all-versions/default/EffectsFactory.cpp
+++ b/audio/effect/all-versions/default/EffectsFactory.cpp
@@ -53,7 +53,7 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::UuidUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::UuidUtils;
 
 // static
 sp<IEffect> EffectsFactory::dispatchEffectInstanceCreation(const effect_descriptor_t& halDescriptor,
diff --git a/audio/effect/all-versions/default/EffectsFactory.h b/audio/effect/all-versions/default/EffectsFactory.h
index 0b86836..da16923 100644
--- a/audio/effect/all-versions/default/EffectsFactory.h
+++ b/audio/effect/all-versions/default/EffectsFactory.h
@@ -41,7 +41,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct EffectsFactory : public IEffectsFactory {
diff --git a/audio/effect/all-versions/default/EnvironmentalReverbEffect.h b/audio/effect/all-versions/default/EnvironmentalReverbEffect.h
index 9694b5d..001774d 100644
--- a/audio/effect/all-versions/default/EnvironmentalReverbEffect.h
+++ b/audio/effect/all-versions/default/EnvironmentalReverbEffect.h
@@ -43,7 +43,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct EnvironmentalReverbEffect : public IEnvironmentalReverbEffect {
diff --git a/audio/effect/all-versions/default/EqualizerEffect.h b/audio/effect/all-versions/default/EqualizerEffect.h
index 7a6bc0a..c4d76c1 100644
--- a/audio/effect/all-versions/default/EqualizerEffect.h
+++ b/audio/effect/all-versions/default/EqualizerEffect.h
@@ -43,7 +43,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct EqualizerEffect : public IEqualizerEffect {
diff --git a/audio/effect/all-versions/default/LoudnessEnhancerEffect.h b/audio/effect/all-versions/default/LoudnessEnhancerEffect.h
index 6d80207..122ec36 100644
--- a/audio/effect/all-versions/default/LoudnessEnhancerEffect.h
+++ b/audio/effect/all-versions/default/LoudnessEnhancerEffect.h
@@ -39,7 +39,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct LoudnessEnhancerEffect : public ILoudnessEnhancerEffect {
diff --git a/audio/effect/all-versions/default/NoiseSuppressionEffect.h b/audio/effect/all-versions/default/NoiseSuppressionEffect.h
index 6cc45b9..96b9ecf 100644
--- a/audio/effect/all-versions/default/NoiseSuppressionEffect.h
+++ b/audio/effect/all-versions/default/NoiseSuppressionEffect.h
@@ -41,7 +41,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct NoiseSuppressionEffect : public INoiseSuppressionEffect {
diff --git a/audio/effect/all-versions/default/PresetReverbEffect.h b/audio/effect/all-versions/default/PresetReverbEffect.h
index eb55e20..9d82c08 100644
--- a/audio/effect/all-versions/default/PresetReverbEffect.h
+++ b/audio/effect/all-versions/default/PresetReverbEffect.h
@@ -39,7 +39,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct PresetReverbEffect : public IPresetReverbEffect {
diff --git a/audio/effect/all-versions/default/VirtualizerEffect.cpp b/audio/effect/all-versions/default/VirtualizerEffect.cpp
index 1dce181..6efc4ea 100644
--- a/audio/effect/all-versions/default/VirtualizerEffect.cpp
+++ b/audio/effect/all-versions/default/VirtualizerEffect.cpp
@@ -34,7 +34,7 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
 
 VirtualizerEffect::VirtualizerEffect(effect_handle_t handle)
     : mEffect(new Effect(false /*isInput*/, handle)) {}
diff --git a/audio/effect/all-versions/default/VirtualizerEffect.h b/audio/effect/all-versions/default/VirtualizerEffect.h
index 3ed06d1..f26e4fa 100644
--- a/audio/effect/all-versions/default/VirtualizerEffect.h
+++ b/audio/effect/all-versions/default/VirtualizerEffect.h
@@ -40,9 +40,10 @@
 using ::android::hardware::Return;
 using ::android::hardware::Void;
 #if MAJOR_VERSION <= 6
-using ::android::hardware::audio::common::CPP_VERSION::implementation::AudioChannelBitfield;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::
+        AudioChannelBitfield;
 #endif
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct VirtualizerEffect : public IVirtualizerEffect {
diff --git a/audio/effect/all-versions/default/VisualizerEffect.h b/audio/effect/all-versions/default/VisualizerEffect.h
index 3ae4b08..b8424c4 100644
--- a/audio/effect/all-versions/default/VisualizerEffect.h
+++ b/audio/effect/all-versions/default/VisualizerEffect.h
@@ -39,7 +39,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 
 struct VisualizerEffect : public IVisualizerEffect {
diff --git a/audio/effect/all-versions/default/util/EffectUtils.cpp b/audio/effect/all-versions/default/util/EffectUtils.cpp
index 1156d21..296f84d 100644
--- a/audio/effect/all-versions/default/util/EffectUtils.cpp
+++ b/audio/effect/all-versions/default/util/EffectUtils.cpp
@@ -25,8 +25,8 @@
 
 #include "util/EffectUtils.h"
 
-using ::android::hardware::audio::common::CPP_VERSION::implementation::HidlUtils;
-using ::android::hardware::audio::common::CPP_VERSION::implementation::UuidUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::HidlUtils;
+using ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION::implementation::UuidUtils;
 using ::android::hardware::audio::common::utils::EnumBitfield;
 
 namespace android {
@@ -36,7 +36,7 @@
 namespace CPP_VERSION {
 namespace implementation {
 
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 
 #define CONVERT_CHECKED(expr, result)                   \
     if (status_t status = (expr); status != NO_ERROR) { \
diff --git a/audio/effect/all-versions/default/util/tests/effectutils_tests.cpp b/audio/effect/all-versions/default/util/tests/effectutils_tests.cpp
index d021fa0..adfa167 100644
--- a/audio/effect/all-versions/default/util/tests/effectutils_tests.cpp
+++ b/audio/effect/all-versions/default/util/tests/effectutils_tests.cpp
@@ -27,7 +27,7 @@
 #include <xsdc/XsdcSupport.h>
 
 using namespace android;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 using ::android::hardware::audio::effect::CPP_VERSION::implementation::EffectUtils;
 namespace xsd {
diff --git a/audio/effect/all-versions/vts/functional/VtsHalAudioEffectTargetTest.cpp b/audio/effect/all-versions/vts/functional/VtsHalAudioEffectTargetTest.cpp
index 23e7786..e59423f 100644
--- a/audio/effect/all-versions/vts/functional/VtsHalAudioEffectTargetTest.cpp
+++ b/audio/effect/all-versions/vts/functional/VtsHalAudioEffectTargetTest.cpp
@@ -50,7 +50,7 @@
 using ::android::hardware::audio::common::utils::mkEnumBitfield;
 using ::android::hidl::allocator::V1_0::IAllocator;
 using ::android::hidl::memory::V1_0::IMemory;
-using namespace ::android::hardware::audio::common::CPP_VERSION;
+using namespace ::android::hardware::audio::common::COMMON_TYPES_CPP_VERSION;
 using namespace ::android::hardware::audio::effect::CPP_VERSION;
 #if MAJOR_VERSION >= 7
 // Make an alias for enumerations generated from the APM config XSD.
diff --git a/automotive/evs/1.1/default/Android.bp b/automotive/evs/1.1/default/Android.bp
index ea1851f..4c08ef3 100644
--- a/automotive/evs/1.1/default/Android.bp
+++ b/automotive/evs/1.1/default/Android.bp
@@ -13,48 +13,46 @@
     proprietary: true,
     relative_install_path: "hw",
     srcs: [
-        "service.cpp",
-        "EvsCamera.cpp",
-        "EvsEnumerator.cpp",
-        "EvsDisplay.cpp",
-        "ConfigManager.cpp",
-        "ConfigManagerUtil.cpp",
-        "EvsUltrasonicsArray.cpp",
+        "*.cpp",
     ],
     init_rc: ["android.hardware.automotive.evs@1.1-service.rc"],
-
     shared_libs: [
+        "android.frameworks.automotive.display@1.0",
         "android.hardware.automotive.evs@1.0",
         "android.hardware.automotive.evs@1.1",
         "android.hardware.camera.device@3.3",
+        "android.hardware.graphics.bufferqueue@1.0",
+        "android.hardware.graphics.bufferqueue@2.0",
         "android.hidl.allocator@1.0",
         "android.hidl.memory@1.0",
+        "android.hidl.token@1.0-utils",
+        "libEGL",
+        "libGLESv2",
         "libbase",
         "libbinder",
-        "liblog",
+        "libbufferqueueconverter",
+        "libcamera_metadata",
         "libhardware",
         "libhidlbase",
         "libhidlmemory",
         "liblog",
+        "libtinyxml2",
         "libui",
         "libutils",
-        "libcamera_metadata",
-        "libtinyxml2",
-        "android.hidl.token@1.0-utils",
-        "android.frameworks.automotive.display@1.0",
-        "android.hardware.graphics.bufferqueue@1.0",
-        "android.hardware.graphics.bufferqueue@2.0",
     ],
-
     cflags: [
         "-O0",
         "-g",
+        "-DLOG_TAG=\"MockEvsDriver\"",
+        "-DGL_GLEXT_PROTOTYPES",
+        "-DEGL_EGLEXT_PROTOTYPES",
     ],
-
+    include_dirs: [
+        "frameworks/native/include/",
+    ],
     required: [
         "evs_default_configuration.xml",
     ],
-
     vintf_fragments: [
         "manifest_android.hardware.automotive.evs@1.1-service.xml",
     ],
diff --git a/automotive/evs/1.1/default/ConfigManager.cpp b/automotive/evs/1.1/default/ConfigManager.cpp
index 986793e..ca8cfae 100644
--- a/automotive/evs/1.1/default/ConfigManager.cpp
+++ b/automotive/evs/1.1/default/ConfigManager.cpp
@@ -14,38 +14,40 @@
  * limitations under the License.
  */
 
-#include <sstream>
-#include <fstream>
-#include <thread>
-
-#include <hardware/gralloc.h>
-#include <utils/SystemClock.h>
-#include <android/hardware/camera/device/3.2/ICameraDevice.h>
-
 #include "ConfigManager.h"
 
-using ::android::hardware::camera::device::V3_2::StreamRotation;
+#include <android/hardware/camera/device/3.2/ICameraDevice.h>
+#include <hardware/gralloc.h>
+#include <utils/SystemClock.h>
 
+#include <fstream>
+#include <sstream>
+#include <thread>
+
+namespace android::hardware::automotive::evs::V1_1::implementation {
+
+using namespace std;
+using namespace tinyxml2;
+using hardware::camera::device::V3_2::StreamRotation;
 
 ConfigManager::~ConfigManager() {
     /* Nothing to do */
 }
 
-
-void ConfigManager::readCameraInfo(const XMLElement * const aCameraElem) {
+void ConfigManager::readCameraInfo(const XMLElement* const aCameraElem) {
     if (aCameraElem == nullptr) {
         ALOGW("XML file does not have required camera element");
         return;
     }
 
-    const XMLElement *curElem = aCameraElem->FirstChildElement();
+    const XMLElement* curElem = aCameraElem->FirstChildElement();
     while (curElem != nullptr) {
         if (!strcmp(curElem->Name(), "group")) {
             /* camera group identifier */
-            const char *id = curElem->FindAttribute("id")->Value();
+            const char* id = curElem->FindAttribute("id")->Value();
 
             /* create a camera group to be filled */
-            CameraGroupInfo *aCamera = new CameraGroupInfo();
+            CameraGroupInfo* aCamera = new CameraGroupInfo();
 
             /* read camera device information */
             if (!readCameraDeviceInfo(aCamera, curElem)) {
@@ -55,28 +57,26 @@
             }
 
             /* camera group synchronization */
-            const char *sync = curElem->FindAttribute("synchronized")->Value();
+            const char* sync = curElem->FindAttribute("synchronized")->Value();
             if (!strcmp(sync, "CALIBRATED")) {
-                aCamera->synchronized =
-                    ANDROID_LOGICAL_MULTI_CAMERA_SENSOR_SYNC_TYPE_CALIBRATED;
+                aCamera->synchronized = ANDROID_LOGICAL_MULTI_CAMERA_SENSOR_SYNC_TYPE_CALIBRATED;
             } else if (!strcmp(sync, "APPROXIMATE")) {
-                aCamera->synchronized =
-                    ANDROID_LOGICAL_MULTI_CAMERA_SENSOR_SYNC_TYPE_APPROXIMATE;
+                aCamera->synchronized = ANDROID_LOGICAL_MULTI_CAMERA_SENSOR_SYNC_TYPE_APPROXIMATE;
             } else {
-                aCamera->synchronized = 0; // Not synchronized
+                aCamera->synchronized = 0;  // Not synchronized
             }
 
             /* add a group to hash map */
             mCameraGroupInfos.insert_or_assign(id, unique_ptr<CameraGroupInfo>(aCamera));
         } else if (!strcmp(curElem->Name(), "device")) {
             /* camera unique identifier */
-            const char *id = curElem->FindAttribute("id")->Value();
+            const char* id = curElem->FindAttribute("id")->Value();
 
             /* camera mount location */
-            const char *pos = curElem->FindAttribute("position")->Value();
+            const char* pos = curElem->FindAttribute("position")->Value();
 
             /* create a camera device to be filled */
-            CameraInfo *aCamera = new CameraInfo();
+            CameraInfo* aCamera = new CameraInfo();
 
             /* read camera device information */
             if (!readCameraDeviceInfo(aCamera, curElem)) {
@@ -99,10 +99,7 @@
     }
 }
 
-
-bool
-ConfigManager::readCameraDeviceInfo(CameraInfo *aCamera,
-                                    const XMLElement *aDeviceElem) {
+bool ConfigManager::readCameraDeviceInfo(CameraInfo* aCamera, const XMLElement* aDeviceElem) {
     if (aCamera == nullptr || aDeviceElem == nullptr) {
         return false;
     }
@@ -113,16 +110,11 @@
 
     /* read device capabilities */
     totalEntries +=
-        readCameraCapabilities(aDeviceElem->FirstChildElement("caps"),
-                               aCamera,
-                               totalDataSize);
-
+            readCameraCapabilities(aDeviceElem->FirstChildElement("caps"), aCamera, totalDataSize);
 
     /* read camera metadata */
-    totalEntries +=
-        readCameraMetadata(aDeviceElem->FirstChildElement("characteristics"),
-                           aCamera,
-                           totalDataSize);
+    totalEntries += readCameraMetadata(aDeviceElem->FirstChildElement("characteristics"), aCamera,
+                                       totalDataSize);
 
     /* construct camera_metadata_t */
     if (!constructCameraMetadata(aCamera, totalEntries, totalDataSize)) {
@@ -133,40 +125,34 @@
     return true;
 }
 
-
-size_t
-ConfigManager::readCameraCapabilities(const XMLElement * const aCapElem,
-                                      CameraInfo *aCamera,
-                                      size_t &dataSize) {
+size_t ConfigManager::readCameraCapabilities(const XMLElement* const aCapElem, CameraInfo* aCamera,
+                                             size_t& dataSize) {
     if (aCapElem == nullptr || aCamera == nullptr) {
         return 0;
     }
 
     string token;
-    const XMLElement *curElem = nullptr;
+    const XMLElement* curElem = nullptr;
 
     /* a list of supported camera parameters/controls */
     curElem = aCapElem->FirstChildElement("supported_controls");
     if (curElem != nullptr) {
-        const XMLElement *ctrlElem = curElem->FirstChildElement("control");
+        const XMLElement* ctrlElem = curElem->FirstChildElement("control");
         while (ctrlElem != nullptr) {
-            const char *nameAttr = ctrlElem->FindAttribute("name")->Value();;
+            const char* nameAttr = ctrlElem->FindAttribute("name")->Value();
+            ;
             const int32_t minVal = stoi(ctrlElem->FindAttribute("min")->Value());
             const int32_t maxVal = stoi(ctrlElem->FindAttribute("max")->Value());
 
             int32_t stepVal = 1;
-            const XMLAttribute *stepAttr = ctrlElem->FindAttribute("step");
+            const XMLAttribute* stepAttr = ctrlElem->FindAttribute("step");
             if (stepAttr != nullptr) {
                 stepVal = stoi(stepAttr->Value());
             }
 
             CameraParam aParam;
-            if (ConfigManagerUtil::convertToEvsCameraParam(nameAttr,
-                                                           aParam)) {
-                aCamera->controls.emplace(
-                    aParam,
-                    make_tuple(minVal, maxVal, stepVal)
-                );
+            if (ConfigManagerUtil::convertToEvsCameraParam(nameAttr, aParam)) {
+                aCamera->controls.emplace(aParam, make_tuple(minVal, maxVal, stepVal));
             }
 
             ctrlElem = ctrlElem->NextSiblingElement("control");
@@ -177,11 +163,11 @@
     curElem = aCapElem->FirstChildElement("stream");
     while (curElem != nullptr) {
         /* read 5 attributes */
-        const XMLAttribute *idAttr     = curElem->FindAttribute("id");
-        const XMLAttribute *widthAttr  = curElem->FindAttribute("width");
-        const XMLAttribute *heightAttr = curElem->FindAttribute("height");
-        const XMLAttribute *fmtAttr    = curElem->FindAttribute("format");
-        const XMLAttribute *fpsAttr    = curElem->FindAttribute("framerate");
+        const XMLAttribute* idAttr = curElem->FindAttribute("id");
+        const XMLAttribute* widthAttr = curElem->FindAttribute("width");
+        const XMLAttribute* heightAttr = curElem->FindAttribute("height");
+        const XMLAttribute* fmtAttr = curElem->FindAttribute("format");
+        const XMLAttribute* fpsAttr = curElem->FindAttribute("framerate");
 
         const int32_t id = stoi(idAttr->Value());
         int32_t framerate = 0;
@@ -190,16 +176,13 @@
         }
 
         int32_t pixFormat;
-        if (ConfigManagerUtil::convertToPixelFormat(fmtAttr->Value(),
-                                                    pixFormat)) {
-            RawStreamConfiguration cfg = {
-                id,
-                stoi(widthAttr->Value()),
-                stoi(heightAttr->Value()),
-                pixFormat,
-                ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_OUTPUT,
-                framerate
-            };
+        if (ConfigManagerUtil::convertToPixelFormat(fmtAttr->Value(), pixFormat)) {
+            RawStreamConfiguration cfg = {id,
+                                          stoi(widthAttr->Value()),
+                                          stoi(heightAttr->Value()),
+                                          pixFormat,
+                                          ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_OUTPUT,
+                                          framerate};
             aCamera->streamConfigurations.insert_or_assign(id, cfg);
         }
 
@@ -207,70 +190,58 @@
     }
 
     dataSize = calculate_camera_metadata_entry_data_size(
-                   get_camera_metadata_tag_type(
-                       ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS
-                   ),
-                   aCamera->streamConfigurations.size() * kStreamCfgSz
-               );
+            get_camera_metadata_tag_type(ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS),
+            aCamera->streamConfigurations.size() * kStreamCfgSz);
 
     /* a single camera metadata entry contains multiple stream configurations */
     return dataSize > 0 ? 1 : 0;
 }
 
-
-size_t
-ConfigManager::readCameraMetadata(const XMLElement * const aParamElem,
-                                  CameraInfo *aCamera,
-                                  size_t &dataSize) {
+size_t ConfigManager::readCameraMetadata(const XMLElement* const aParamElem, CameraInfo* aCamera,
+                                         size_t& dataSize) {
     if (aParamElem == nullptr || aCamera == nullptr) {
         return 0;
     }
 
-    const XMLElement *curElem = aParamElem->FirstChildElement("parameter");
+    const XMLElement* curElem = aParamElem->FirstChildElement("parameter");
     size_t numEntries = 0;
     camera_metadata_tag_t tag;
     while (curElem != nullptr) {
         if (!ConfigManagerUtil::convertToMetadataTag(curElem->FindAttribute("name")->Value(),
                                                      tag)) {
-            switch(tag) {
+            switch (tag) {
                 case ANDROID_LENS_DISTORTION:
                 case ANDROID_LENS_POSE_ROTATION:
                 case ANDROID_LENS_POSE_TRANSLATION:
                 case ANDROID_LENS_INTRINSIC_CALIBRATION: {
                     /* float[] */
                     size_t count = 0;
-                    void   *data = ConfigManagerUtil::convertFloatArray(
-                                        curElem->FindAttribute("size")->Value(),
-                                        curElem->FindAttribute("value")->Value(),
-                                        count
-                                   );
+                    void* data = ConfigManagerUtil::convertFloatArray(
+                            curElem->FindAttribute("size")->Value(),
+                            curElem->FindAttribute("value")->Value(), count);
 
                     aCamera->cameraMetadata.insert_or_assign(
-                        tag, make_pair(make_unique<void *>(data), count)
-                    );
+                            tag, make_pair(make_unique<void*>(data), count));
 
                     ++numEntries;
                     dataSize += calculate_camera_metadata_entry_data_size(
-                                    get_camera_metadata_tag_type(tag), count
-                                );
+                            get_camera_metadata_tag_type(tag), count);
 
                     break;
                 }
 
                 case ANDROID_REQUEST_AVAILABLE_CAPABILITIES: {
-                    camera_metadata_enum_android_request_available_capabilities_t *data =
-                        new camera_metadata_enum_android_request_available_capabilities_t[1];
+                    camera_metadata_enum_android_request_available_capabilities_t* data =
+                            new camera_metadata_enum_android_request_available_capabilities_t[1];
                     if (ConfigManagerUtil::convertToCameraCapability(
-                            curElem->FindAttribute("value")->Value(), *data)) {
-                                        curElem->FindAttribute("value")->Value(),
-                        aCamera->cameraMetadata.insert_or_assign(
-                            tag, make_pair(make_unique<void *>(data), 1)
-                        );
+                                curElem->FindAttribute("value")->Value(), *data)) {
+                        curElem->FindAttribute("value")->Value(),
+                                aCamera->cameraMetadata.insert_or_assign(
+                                        tag, make_pair(make_unique<void*>(data), 1));
 
                         ++numEntries;
                         dataSize += calculate_camera_metadata_entry_data_size(
-                                        get_camera_metadata_tag_type(tag), 1
-                                    );
+                                get_camera_metadata_tag_type(tag), 1);
                     }
                     break;
                 }
@@ -278,13 +249,11 @@
                 case ANDROID_LOGICAL_MULTI_CAMERA_PHYSICAL_IDS: {
                     /* a comma-separated list of physical camera devices */
                     size_t len = strlen(curElem->FindAttribute("value")->Value());
-                    char *data = new char[len + 1];
-                    memcpy(data,
-                           curElem->FindAttribute("value")->Value(),
-                           len * sizeof(char));
+                    char* data = new char[len + 1];
+                    memcpy(data, curElem->FindAttribute("value")->Value(), len * sizeof(char));
 
                     /* replace commas with null char */
-                    char *p = data;
+                    char* p = data;
                     while (*p != '\0') {
                         if (*p == ',') {
                             *p = '\0';
@@ -293,19 +262,16 @@
                     }
 
                     aCamera->cameraMetadata.insert_or_assign(
-                        tag, make_pair(make_unique<void *>(data), len)
-                    );
+                            tag, make_pair(make_unique<void*>(data), len));
 
                     ++numEntries;
                     dataSize += calculate_camera_metadata_entry_data_size(
-                                    get_camera_metadata_tag_type(tag), len
-                                );
+                            get_camera_metadata_tag_type(tag), len);
                     break;
                 }
 
                 default:
-                    ALOGW("Parameter %s is not supported",
-                          curElem->FindAttribute("name")->Value());
+                    ALOGW("Parameter %s is not supported", curElem->FindAttribute("name")->Value());
                     break;
             }
         }
@@ -316,11 +282,8 @@
     return numEntries;
 }
 
-
-bool
-ConfigManager::constructCameraMetadata(CameraInfo *aCamera,
-                                       const size_t totalEntries,
-                                       const size_t totalDataSize) {
+bool ConfigManager::constructCameraMetadata(CameraInfo* aCamera, const size_t totalEntries,
+                                            const size_t totalDataSize) {
     if (aCamera == nullptr || !aCamera->allocate(totalEntries, totalDataSize)) {
         ALOGE("Failed to allocate memory for camera metadata");
         return false;
@@ -328,16 +291,15 @@
 
     const size_t numStreamConfigs = aCamera->streamConfigurations.size();
     unique_ptr<int32_t[]> data(new int32_t[kStreamCfgSz * numStreamConfigs]);
-    int32_t *ptr = data.get();
-    for (auto &cfg : aCamera->streamConfigurations) {
+    int32_t* ptr = data.get();
+    for (auto& cfg : aCamera->streamConfigurations) {
         for (auto i = 0; i < kStreamCfgSz; ++i) {
-          *ptr++ = cfg.second[i];
+            *ptr++ = cfg.second[i];
         }
     }
     int32_t err = add_camera_metadata_entry(aCamera->characteristics,
                                             ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS,
-                                            data.get(),
-                                            numStreamConfigs * kStreamCfgSz);
+                                            data.get(), numStreamConfigs * kStreamCfgSz);
 
     if (err) {
         ALOGE("Failed to add stream configurations to metadata, ignored");
@@ -345,11 +307,9 @@
     }
 
     bool success = true;
-    for (auto &[tag, entry] : aCamera->cameraMetadata) {
+    for (auto& [tag, entry] : aCamera->cameraMetadata) {
         /* try to add new camera metadata entry */
-        int32_t err = add_camera_metadata_entry(aCamera->characteristics,
-                                                tag,
-                                                entry.first.get(),
+        int32_t err = add_camera_metadata_entry(aCamera->characteristics, tag, entry.first.get(),
                                                 entry.second);
         if (err) {
             ALOGE("Failed to add an entry with a tag 0x%X", tag);
@@ -376,8 +336,7 @@
     return success;
 }
 
-
-void ConfigManager::readSystemInfo(const XMLElement * const aSysElem) {
+void ConfigManager::readSystemInfo(const XMLElement* const aSysElem) {
     if (aSysElem == nullptr) {
         return;
     }
@@ -389,24 +348,22 @@
      */
 
     /* read number of cameras available in the system */
-    const XMLElement *xmlElem = aSysElem->FirstChildElement("num_cameras");
+    const XMLElement* xmlElem = aSysElem->FirstChildElement("num_cameras");
     if (xmlElem != nullptr) {
-        mSystemInfo.numCameras =
-            stoi(xmlElem->FindAttribute("value")->Value());
+        mSystemInfo.numCameras = stoi(xmlElem->FindAttribute("value")->Value());
     }
 }
 
-
-void ConfigManager::readDisplayInfo(const XMLElement * const aDisplayElem) {
+void ConfigManager::readDisplayInfo(const XMLElement* const aDisplayElem) {
     if (aDisplayElem == nullptr) {
         ALOGW("XML file does not have required camera element");
         return;
     }
 
-    const XMLElement *curDev = aDisplayElem->FirstChildElement("device");
+    const XMLElement* curDev = aDisplayElem->FirstChildElement("device");
     while (curDev != nullptr) {
-        const char *id = curDev->FindAttribute("id")->Value();
-        //const char *pos = curDev->FirstAttribute("position")->Value();
+        const char* id = curDev->FindAttribute("id")->Value();
+        // const char *pos = curDev->FirstAttribute("position")->Value();
 
         unique_ptr<DisplayInfo> dpy(new DisplayInfo());
         if (dpy == nullptr) {
@@ -414,27 +371,26 @@
             return;
         }
 
-        const XMLElement *cap = curDev->FirstChildElement("caps");
+        const XMLElement* cap = curDev->FirstChildElement("caps");
         if (cap != nullptr) {
-            const XMLElement *curStream = cap->FirstChildElement("stream");
+            const XMLElement* curStream = cap->FirstChildElement("stream");
             while (curStream != nullptr) {
                 /* read 4 attributes */
-                const XMLAttribute *idAttr     = curStream->FindAttribute("id");
-                const XMLAttribute *widthAttr  = curStream->FindAttribute("width");
-                const XMLAttribute *heightAttr = curStream->FindAttribute("height");
-                const XMLAttribute *fmtAttr    = curStream->FindAttribute("format");
+                const XMLAttribute* idAttr = curStream->FindAttribute("id");
+                const XMLAttribute* widthAttr = curStream->FindAttribute("width");
+                const XMLAttribute* heightAttr = curStream->FindAttribute("height");
+                const XMLAttribute* fmtAttr = curStream->FindAttribute("format");
 
                 const int32_t id = stoi(idAttr->Value());
                 int32_t pixFormat;
-                if (ConfigManagerUtil::convertToPixelFormat(fmtAttr->Value(),
-                                                            pixFormat)) {
+                if (ConfigManagerUtil::convertToPixelFormat(fmtAttr->Value(), pixFormat)) {
                     RawStreamConfiguration cfg = {
-                        id,
-                        stoi(widthAttr->Value()),
-                        stoi(heightAttr->Value()),
-                        pixFormat,
-                        ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_INPUT,
-                        0   // unused
+                            id,
+                            stoi(widthAttr->Value()),
+                            stoi(heightAttr->Value()),
+                            pixFormat,
+                            ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_INPUT,
+                            0  // unused
                     };
                     dpy->streamConfigurations.insert_or_assign(id, cfg);
                 }
@@ -450,7 +406,6 @@
     return;
 }
 
-
 bool ConfigManager::readConfigDataFromXML() noexcept {
     XMLDocument xmlDoc;
 
@@ -464,7 +419,7 @@
     }
 
     /* retrieve the root element */
-    const XMLElement *rootElem = xmlDoc.RootElement();
+    const XMLElement* rootElem = xmlDoc.RootElement();
     if (strcmp(rootElem->Name(), "configuration")) {
         ALOGE("A configuration file is not in the required format.  "
               "See /etc/automotive/evs/evs_configuration.dtd");
@@ -487,12 +442,10 @@
     ALOGI("Parsing configuration file takes %lf (ms)",
           (double)(parsingEnd - parsingStart) / 1000000.0);
 
-
     return true;
 }
 
-
-std::unique_ptr<ConfigManager> ConfigManager::Create(const char *path) {
+std::unique_ptr<ConfigManager> ConfigManager::Create(const char* path) {
     unique_ptr<ConfigManager> cfgMgr(new ConfigManager(path));
 
     /*
@@ -510,3 +463,4 @@
     }
 }
 
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
diff --git a/automotive/evs/1.1/default/ConfigManager.h b/automotive/evs/1.1/default/ConfigManager.h
index b0b2670..0a15360 100644
--- a/automotive/evs/1.1/default/ConfigManager.h
+++ b/automotive/evs/1.1/default/ConfigManager.h
@@ -13,28 +13,26 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#ifndef CONFIG_MANAGER_H
-#define CONFIG_MANAGER_H
-
-#include <vector>
-#include <string>
-#include <unordered_map>
-#include <unordered_set>
-
-#include <tinyxml2.h>
-
-#include <system/camera_metadata.h>
-#include <log/log.h>
-#include <android/hardware/automotive/evs/1.1/types.h>
+#ifndef ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_CONFIGMANAGER_H
+#define ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_CONFIGMANAGER_H
 
 #include "ConfigManagerUtil.h"
 
-using namespace std;
-using namespace tinyxml2;
+#include <android/hardware/automotive/evs/1.1/types.h>
+#include <log/log.h>
+#include <system/camera_metadata.h>
+#include <tinyxml2.h>
 
-using ::android::hardware::hidl_vec;
-using ::android::hardware::camera::device::V3_2::Stream;
-using ::android::hardware::automotive::evs::V1_1::CameraParam;
+#include <string>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+namespace android::hardware::automotive::evs::V1_1::implementation {
+
+using hardware::hidl_vec;
+using hardware::automotive::evs::V1_1::CameraParam;
+using hardware::camera::device::V3_2::Stream;
 
 /*
  * Plese note that this is different from what is defined in
@@ -45,8 +43,8 @@
 typedef std::array<int32_t, kStreamCfgSz> RawStreamConfiguration;
 
 class ConfigManager {
-public:
-    static std::unique_ptr<ConfigManager> Create(const char *path = "");
+  public:
+    static std::unique_ptr<ConfigManager> Create(const char* path = "");
     ConfigManager(const ConfigManager&) = delete;
     ConfigManager& operator=(const ConfigManager&) = delete;
 
@@ -54,15 +52,11 @@
 
     /* Camera device's capabilities and metadata */
     class CameraInfo {
-    public:
-        CameraInfo() :
-            characteristics(nullptr) {
-            /* Nothing to do */
+      public:
+        CameraInfo() : characteristics(nullptr) { /* Nothing to do */
         }
 
-        virtual ~CameraInfo() {
-            free_camera_metadata(characteristics);
-        }
+        virtual ~CameraInfo() { free_camera_metadata(characteristics); }
 
         /* Allocate memory for camera_metadata_t */
         bool allocate(size_t entry_cap, size_t data_cap) {
@@ -79,50 +73,49 @@
          * List of supported controls that the primary client can program.
          * Paraemters are stored with its valid range
          */
-        unordered_map<CameraParam,
-                      tuple<int32_t, int32_t, int32_t>> controls;
+        std::unordered_map<CameraParam, std::tuple<int32_t, int32_t, int32_t>> controls;
 
         /*
          * List of supported output stream configurations; each array stores
          * format, width, height, and direction values in the order.
          */
-        unordered_map<int32_t, RawStreamConfiguration> streamConfigurations;
+        std::unordered_map<int32_t, RawStreamConfiguration> streamConfigurations;
 
         /*
          * Internal storage for camera metadata.  Each entry holds a pointer to
          * data and number of elements
          */
-        unordered_map<camera_metadata_tag_t,
-                      pair<unique_ptr<void *>, size_t>> cameraMetadata;
+        std::unordered_map<camera_metadata_tag_t, std::pair<std::unique_ptr<void*>, size_t>>
+                cameraMetadata;
 
         /* Camera module characteristics */
-        camera_metadata_t *characteristics;
+        camera_metadata_t* characteristics;
     };
 
     class CameraGroupInfo : public CameraInfo {
-    public:
+      public:
         CameraGroupInfo() {}
 
         /* ID of member camera devices */
-        unordered_set<string> devices;
+        std::unordered_set<std::string> devices;
 
         /* The capture operation of member camera devices are synchronized */
         bool synchronized = false;
     };
 
     class SystemInfo {
-    public:
+      public:
         /* number of available cameras */
         int32_t numCameras = 0;
     };
 
     class DisplayInfo {
-    public:
+      public:
         /*
          * List of supported input stream configurations; each array stores
          * format, width, height, and direction values in the order.
          */
-        unordered_map<int32_t, RawStreamConfiguration> streamConfigurations;
+        std::unordered_map<int32_t, RawStreamConfiguration> streamConfigurations;
     };
 
     /*
@@ -131,80 +124,74 @@
      * @return SystemInfo
      *         Constant reference of SystemInfo.
      */
-    const SystemInfo &getSystemInfo() {
-        return mSystemInfo;
-    }
+    const SystemInfo& getSystemInfo() { return mSystemInfo; }
 
     /*
      * Return a list of cameras
      *
      * This function assumes that it is not being called frequently.
      *
-     * @return vector<string>
+     * @return std::vector<std::string>
      *         A vector that contains unique camera device identifiers.
      */
-    vector<string> getCameraList() {
-        vector<string> aList;
-        for (auto &v : mCameraInfo) {
-            aList.emplace_back(v.first);
+    std::vector<std::string> getCameraList() {
+        std::vector<std::string> aList;
+        for (auto& v : mCameraInfo) {
+            aList.push_back(v.first);
         }
 
         return aList;
     }
 
-
     /*
      * Return a list of cameras
      *
      * @return CameraGroupInfo
      *         A pointer to a camera group identified by a given id.
      */
-    unique_ptr<CameraGroupInfo>& getCameraGroupInfo(const string& gid) {
+    std::unique_ptr<CameraGroupInfo>& getCameraGroupInfo(const std::string& gid) {
         return mCameraGroupInfos[gid];
     }
 
-
     /*
      * Return a camera metadata
      *
      * @param  cameraId
-     *         Unique camera node identifier in string
+     *         Unique camera node identifier in std::string
      *
-     * @return unique_ptr<CameraInfo>
+     * @return std::unique_ptr<CameraInfo>
      *         A pointer to CameraInfo that is associated with a given camera
      *         ID.  This returns a null pointer if this does not recognize a
      *         given camera identifier.
      */
-    unique_ptr<CameraInfo>& getCameraInfo(const string cameraId) noexcept {
+    std::unique_ptr<CameraInfo>& getCameraInfo(const std::string cameraId) noexcept {
         return mCameraInfo[cameraId];
     }
 
-private:
+  private:
     /* Constructors */
-    ConfigManager(const char *xmlPath) :
-        mConfigFilePath(xmlPath) {
-    }
+    ConfigManager(const char* xmlPath) : mConfigFilePath(xmlPath) {}
 
     /* System configuration */
     SystemInfo mSystemInfo;
 
     /* Internal data structure for camera device information */
-    unordered_map<string, unique_ptr<CameraInfo>> mCameraInfo;
+    std::unordered_map<std::string, std::unique_ptr<CameraInfo>> mCameraInfo;
 
     /* Internal data structure for camera device information */
-    unordered_map<string, unique_ptr<DisplayInfo>> mDisplayInfo;
+    std::unordered_map<std::string, std::unique_ptr<DisplayInfo>> mDisplayInfo;
 
     /* Camera groups are stored in <groud id, CameraGroupInfo> hash map */
-    unordered_map<string, unique_ptr<CameraGroupInfo>> mCameraGroupInfos;
+    std::unordered_map<std::string, std::unique_ptr<CameraGroupInfo>> mCameraGroupInfos;
 
     /*
      * Camera positions are stored in <position, camera id set> hash map.
      * The position must be one of front, rear, left, and right.
      */
-    unordered_map<string, unordered_set<string>>  mCameraPosition;
+    std::unordered_map<std::string, std::unordered_set<std::string>> mCameraPosition;
 
     /* A path to XML configuration file */
-    const char *mConfigFilePath;
+    const char* mConfigFilePath;
 
     /*
      * Parse a given EVS configuration file and store the information
@@ -221,7 +208,7 @@
      * @param  aSysElem
      *         A pointer to "system" XML element.
      */
-    void readSystemInfo(const XMLElement * const aSysElem);
+    void readSystemInfo(const tinyxml2::XMLElement* const aSysElem);
 
     /*
      * read the information of camera devices
@@ -230,7 +217,7 @@
      *         A pointer to "camera" XML element that may contain multiple
      *         "device" elements.
      */
-    void readCameraInfo(const XMLElement * const aCameraElem);
+    void readCameraInfo(const tinyxml2::XMLElement* const aCameraElem);
 
     /*
      * read display device information
@@ -239,7 +226,7 @@
      *         A pointer to "display" XML element that may contain multiple
      *         "device" elements.
      */
-    void readDisplayInfo(const XMLElement * const aDisplayElem);
+    void readDisplayInfo(const tinyxml2::XMLElement* const aDisplayElem);
 
     /*
      * read camera device information
@@ -255,8 +242,7 @@
      *         Return false upon any failure in reading and processing camera
      *         device information.
      */
-    bool readCameraDeviceInfo(CameraInfo *aCamera,
-                              const XMLElement *aDeviceElem);
+    bool readCameraDeviceInfo(CameraInfo* aCamera, const tinyxml2::XMLElement* aDeviceElem);
 
     /*
      * read camera metadata
@@ -273,9 +259,8 @@
      * @return size_t
      *         Number of camera metadata entries
      */
-    size_t readCameraCapabilities(const XMLElement * const aCapElem,
-                                  CameraInfo *aCamera,
-                                  size_t &dataSize);
+    size_t readCameraCapabilities(const tinyxml2::XMLElement* const aCapElem, CameraInfo* aCamera,
+                                  size_t& dataSize);
 
     /*
      * read camera metadata
@@ -291,9 +276,8 @@
      * @return size_t
      *         Number of camera metadata entries
      */
-    size_t readCameraMetadata(const XMLElement * const aParamElem,
-                              CameraInfo *aCamera,
-                              size_t &dataSize);
+    size_t readCameraMetadata(const tinyxml2::XMLElement* const aParamElem, CameraInfo* aCamera,
+                              size_t& dataSize);
 
     /*
      * construct camera_metadata_t from camera capabilities and metadata
@@ -310,9 +294,9 @@
      *         or its size is not large enough to add all found camera metadata
      *         entries.
      */
-    bool constructCameraMetadata(CameraInfo *aCamera,
-                                 const size_t totalEntries,
+    bool constructCameraMetadata(CameraInfo* aCamera, const size_t totalEntries,
                                  const size_t totalDataSize);
 };
-#endif // CONFIG_MANAGER_H
 
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
+#endif  // ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_CONFIGMANAGER_H
diff --git a/automotive/evs/1.1/default/ConfigManagerUtil.cpp b/automotive/evs/1.1/default/ConfigManagerUtil.cpp
index d10f236..5edd405 100644
--- a/automotive/evs/1.1/default/ConfigManagerUtil.cpp
+++ b/automotive/evs/1.1/default/ConfigManagerUtil.cpp
@@ -16,43 +16,45 @@
 
 #include "ConfigManagerUtil.h"
 
-#include <string>
-#include <sstream>
-#include <linux/videodev2.h>
-
 #include <log/log.h>
 #include <system/graphics-base-v1.0.h>
 
+#include <linux/videodev2.h>
+#include <sstream>
+#include <string>
 
-bool ConfigManagerUtil::convertToEvsCameraParam(const string &id,
-                                                CameraParam &camParam) {
+namespace android::hardware::automotive::evs::V1_1::implementation {
+
+using namespace std;
+
+bool ConfigManagerUtil::convertToEvsCameraParam(const string& id, CameraParam& camParam) {
     string trimmed = ConfigManagerUtil::trimString(id);
     bool success = true;
 
     if (!trimmed.compare("BRIGHTNESS")) {
-        camParam =  CameraParam::BRIGHTNESS;
+        camParam = CameraParam::BRIGHTNESS;
     } else if (!trimmed.compare("CONTRAST")) {
-        camParam =  CameraParam::CONTRAST;
+        camParam = CameraParam::CONTRAST;
     } else if (!trimmed.compare("AUTOGAIN")) {
-        camParam =  CameraParam::AUTOGAIN;
+        camParam = CameraParam::AUTOGAIN;
     } else if (!trimmed.compare("GAIN")) {
-        camParam =  CameraParam::GAIN;
+        camParam = CameraParam::GAIN;
     } else if (!trimmed.compare("AUTO_WHITE_BALANCE")) {
-        camParam =  CameraParam::AUTO_WHITE_BALANCE;
+        camParam = CameraParam::AUTO_WHITE_BALANCE;
     } else if (!trimmed.compare("WHITE_BALANCE_TEMPERATURE")) {
-        camParam =  CameraParam::WHITE_BALANCE_TEMPERATURE;
+        camParam = CameraParam::WHITE_BALANCE_TEMPERATURE;
     } else if (!trimmed.compare("SHARPNESS")) {
-        camParam =  CameraParam::SHARPNESS;
+        camParam = CameraParam::SHARPNESS;
     } else if (!trimmed.compare("AUTO_EXPOSURE")) {
-        camParam =  CameraParam::AUTO_EXPOSURE;
+        camParam = CameraParam::AUTO_EXPOSURE;
     } else if (!trimmed.compare("ABSOLUTE_EXPOSURE")) {
-        camParam =  CameraParam::ABSOLUTE_EXPOSURE;
+        camParam = CameraParam::ABSOLUTE_EXPOSURE;
     } else if (!trimmed.compare("ABSOLUTE_FOCUS")) {
-        camParam =  CameraParam::ABSOLUTE_FOCUS;
+        camParam = CameraParam::ABSOLUTE_FOCUS;
     } else if (!trimmed.compare("AUTO_FOCUS")) {
-        camParam =  CameraParam::AUTO_FOCUS;
+        camParam = CameraParam::AUTO_FOCUS;
     } else if (!trimmed.compare("ABSOLUTE_ZOOM")) {
-        camParam =  CameraParam::ABSOLUTE_ZOOM;
+        camParam = CameraParam::ABSOLUTE_ZOOM;
     } else {
         success = false;
     }
@@ -60,18 +62,16 @@
     return success;
 }
 
-
-bool ConfigManagerUtil::convertToPixelFormat(const string &format,
-                                             int32_t &pixFormat) {
+bool ConfigManagerUtil::convertToPixelFormat(const string& format, int32_t& pixFormat) {
     string trimmed = ConfigManagerUtil::trimString(format);
     bool success = true;
 
     if (!trimmed.compare("RGBA_8888")) {
-        pixFormat =  HAL_PIXEL_FORMAT_RGBA_8888;
+        pixFormat = HAL_PIXEL_FORMAT_RGBA_8888;
     } else if (!trimmed.compare("YCRCB_420_SP")) {
-        pixFormat =  HAL_PIXEL_FORMAT_YCRCB_420_SP;
+        pixFormat = HAL_PIXEL_FORMAT_YCRCB_420_SP;
     } else if (!trimmed.compare("YCBCR_422_I")) {
-        pixFormat =  HAL_PIXEL_FORMAT_YCBCR_422_I;
+        pixFormat = HAL_PIXEL_FORMAT_YCBCR_422_I;
     } else {
         success = false;
     }
@@ -79,21 +79,19 @@
     return success;
 }
 
-
-bool ConfigManagerUtil::convertToMetadataTag(const char *name,
-                                             camera_metadata_tag &aTag) {
+bool ConfigManagerUtil::convertToMetadataTag(const char* name, camera_metadata_tag& aTag) {
     if (!strcmp(name, "LENS_DISTORTION")) {
-        aTag =  ANDROID_LENS_DISTORTION;
+        aTag = ANDROID_LENS_DISTORTION;
     } else if (!strcmp(name, "LENS_INTRINSIC_CALIBRATION")) {
-        aTag =  ANDROID_LENS_INTRINSIC_CALIBRATION;
+        aTag = ANDROID_LENS_INTRINSIC_CALIBRATION;
     } else if (!strcmp(name, "LENS_POSE_ROTATION")) {
-        aTag =  ANDROID_LENS_POSE_ROTATION;
+        aTag = ANDROID_LENS_POSE_ROTATION;
     } else if (!strcmp(name, "LENS_POSE_TRANSLATION")) {
-        aTag =  ANDROID_LENS_POSE_TRANSLATION;
+        aTag = ANDROID_LENS_POSE_TRANSLATION;
     } else if (!strcmp(name, "REQUEST_AVAILABLE_CAPABILITIES")) {
-        aTag =  ANDROID_REQUEST_AVAILABLE_CAPABILITIES;
+        aTag = ANDROID_REQUEST_AVAILABLE_CAPABILITIES;
     } else if (!strcmp(name, "LOGICAL_MULTI_CAMERA_PHYSICAL_IDS")) {
-        aTag =  ANDROID_LOGICAL_MULTI_CAMERA_PHYSICAL_IDS;
+        aTag = ANDROID_LOGICAL_MULTI_CAMERA_PHYSICAL_IDS;
     } else {
         return false;
     }
@@ -101,11 +99,8 @@
     return true;
 }
 
-
 bool ConfigManagerUtil::convertToCameraCapability(
-    const char *name,
-    camera_metadata_enum_android_request_available_capabilities_t &cap) {
-
+        const char* name, camera_metadata_enum_android_request_available_capabilities_t& cap) {
     if (!strcmp(name, "DEPTH_OUTPUT")) {
         cap = ANDROID_REQUEST_AVAILABLE_CAPABILITIES_DEPTH_OUTPUT;
     } else if (!strcmp(name, "LOGICAL_MULTI_CAMERA")) {
@@ -121,14 +116,13 @@
     return true;
 }
 
-
-float *ConfigManagerUtil::convertFloatArray(const char *sz, const char *vals,
-                                            size_t &count, const char delimiter) {
+float* ConfigManagerUtil::convertFloatArray(const char* sz, const char* vals, size_t& count,
+                                            const char delimiter) {
     string size_string(sz);
     string value_string(vals);
 
     count = stoi(size_string);
-    float *result = new float[count];
+    float* result = new float[count];
     stringstream values(value_string);
 
     int32_t idx = 0;
@@ -140,8 +134,7 @@
     return result;
 }
 
-
-string ConfigManagerUtil::trimString(const string &src, const string &ws) {
+string ConfigManagerUtil::trimString(const string& src, const string& ws) {
     const auto s = src.find_first_not_of(ws);
     if (s == string::npos) {
         return "";
@@ -153,3 +146,4 @@
     return src.substr(s, r);
 }
 
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
diff --git a/automotive/evs/1.1/default/ConfigManagerUtil.h b/automotive/evs/1.1/default/ConfigManagerUtil.h
index 1710cac..9d42ec1 100644
--- a/automotive/evs/1.1/default/ConfigManagerUtil.h
+++ b/automotive/evs/1.1/default/ConfigManagerUtil.h
@@ -13,57 +13,48 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#ifndef CONFIG_MANAGER_UTIL_H
-#define CONFIG_MANAGER_UTIL_H
+#ifndef ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_CONFIGMANAGERUTIL_H
+#define ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_CONFIGMANAGERUTIL_H
 
-#include <utility>
-#include <string>
-#include <system/camera_metadata.h>
 #include <android/hardware/automotive/evs/1.1/types.h>
+#include <system/camera_metadata.h>
+#include <string>
+#include <utility>
 
-using namespace std;
-using ::android::hardware::automotive::evs::V1_1::CameraParam;
-
+namespace android::hardware::automotive::evs::V1_1::implementation {
 
 class ConfigManagerUtil {
-public:
+  public:
     /**
      * Convert a given string into V4L2_CID_*
      */
-    static bool convertToEvsCameraParam(const string &id,
-                                        CameraParam &camParam);
+    static bool convertToEvsCameraParam(const std::string& id, CameraParam& camParam);
     /**
      * Convert a given string into android.hardware.graphics.common.PixelFormat
      */
-    static bool convertToPixelFormat(const string &format,
-                                     int32_t &pixelFormat);
+    static bool convertToPixelFormat(const std::string& format, int32_t& pixelFormat);
     /**
      * Convert a given string into corresponding camera metadata data tag defined in
      * system/media/camera/include/system/camera_metadta_tags.h
      */
-    static bool convertToMetadataTag(const char *name,
-                                     camera_metadata_tag &aTag);
+    static bool convertToMetadataTag(const char* name, camera_metadata_tag& aTag);
     /**
      * Convert a given string into a floating value array
      */
-    static float *convertFloatArray(const char *sz,
-                                    const char *vals,
-                                    size_t &count,
+    static float* convertFloatArray(const char* sz, const char* vals, size_t& count,
                                     const char delimiter = ',');
     /**
      * Trim a string
      */
-    static string trimString(const string &src,
-                             const string &ws = " \n\r\t\f\v");
+    static std::string trimString(const std::string& src, const std::string& ws = " \n\r\t\f\v");
 
     /**
      * Convert a given string to corresponding camera capabilities
      */
     static bool convertToCameraCapability(
-        const char *name,
-        camera_metadata_enum_android_request_available_capabilities_t &cap);
-
+            const char* name, camera_metadata_enum_android_request_available_capabilities_t& cap);
 };
 
-#endif // CONFIG_MANAGER_UTIL_H
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
 
+#endif  // ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_CONFIGMANAGERUTIL_H
diff --git a/automotive/evs/1.1/default/EvsCamera.cpp b/automotive/evs/1.1/default/EvsCamera.cpp
index 0e69ed4..520670a 100644
--- a/automotive/evs/1.1/default/EvsCamera.cpp
+++ b/automotive/evs/1.1/default/EvsCamera.cpp
@@ -14,69 +14,69 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.automotive.evs@1.1-service"
-
 #include "EvsCamera.h"
+#include "ConfigManager.h"
 #include "EvsEnumerator.h"
 
 #include <ui/GraphicBufferAllocator.h>
 #include <ui/GraphicBufferMapper.h>
 #include <utils/SystemClock.h>
 
-namespace android {
-namespace hardware {
-namespace automotive {
-namespace evs {
-namespace V1_1 {
-namespace implementation {
-
-
-// Special camera names for which we'll initialize alternate test data
-const char EvsCamera::kCameraName_Backup[] = "backup";
-
+namespace {
 
 // Arbitrary limit on number of graphics buffers allowed to be allocated
 // Safeguards against unreasonable resource consumption and provides a testable limit
-const unsigned MAX_BUFFERS_IN_FLIGHT = 100;
+constexpr unsigned kMaxBuffersInFlight = 100;
 
+// Minimum number of buffers to run a video stream
+constexpr int kMinimumBuffersInFlight = 1;
 
-EvsCamera::EvsCamera(const char *id,
-                     unique_ptr<ConfigManager::CameraInfo> &camInfo) :
-        mFramesAllowed(0),
-        mFramesInUse(0),
-        mStreamState(STOPPED),
-        mCameraInfo(camInfo) {
+// Colors for the colorbar test pattern in ABGR format
+constexpr uint32_t kColors[] = {
+        0xFFFFFFFF,  // white
+        0xFF00FFFF,  // yellow
+        0xFFFFFF00,  // cyan
+        0xFF00FF00,  // green
+        0xFFFF00FF,  // fuchsia
+        0xFF0000FF,  // red
+        0xFFFF0000,  // blue
+        0xFF000000,  // black
+};
+constexpr uint32_t kNumColors = sizeof(kColors) / sizeof(kColors[0]);
 
-    ALOGD("EvsCamera instantiated");
+}  // namespace
+
+namespace android::hardware::automotive::evs::V1_1::implementation {
+
+using V1_0::EvsResult;
+
+EvsCamera::EvsCamera(const char* id, std::unique_ptr<ConfigManager::CameraInfo>& camInfo)
+    : mFramesAllowed(0), mFramesInUse(0), mStreamState(STOPPED), mCameraInfo(camInfo) {
+    ALOGD("%s", __FUNCTION__);
 
     /* set a camera id */
     mDescription.v1.cameraId = id;
 
     /* set camera metadata */
-    mDescription.metadata.setToExternal((uint8_t *)camInfo->characteristics,
+    mDescription.metadata.setToExternal((uint8_t*)camInfo->characteristics,
                                         get_camera_metadata_size(camInfo->characteristics));
 }
 
-
 EvsCamera::~EvsCamera() {
-    ALOGD("EvsCamera being destroyed");
+    ALOGD("%s", __FUNCTION__);
     forceShutdown();
 }
 
-
-//
 // This gets called if another caller "steals" ownership of the camera
-//
-void EvsCamera::forceShutdown()
-{
-    ALOGD("EvsCamera forceShutdown");
+void EvsCamera::forceShutdown() {
+    ALOGD("%s", __FUNCTION__);
 
     // Make sure our output stream is cleaned up
     // (It really should be already)
     stopVideoStream();
 
     // Claim the lock while we work on internal state
-    std::lock_guard <std::mutex> lock(mAccessLock);
+    std::lock_guard<std::mutex> lock(mAccessLock);
 
     // Drop all the graphics buffers we've been using
     if (mBuffers.size() > 0) {
@@ -96,19 +96,18 @@
     mStreamState = DEAD;
 }
 
-
 // Methods from ::android::hardware::automotive::evs::V1_0::IEvsCamera follow.
 Return<void> EvsCamera::getCameraInfo(getCameraInfo_cb _hidl_cb) {
-    ALOGD("getCameraInfo");
+    ALOGD("%s", __FUNCTION__);
 
     // Send back our self description
     _hidl_cb(mDescription.v1);
-    return Void();
+    return {};
 }
 
-
 Return<EvsResult> EvsCamera::setMaxFramesInFlight(uint32_t bufferCount) {
-    ALOGD("setMaxFramesInFlight");
+    ALOGD("%s, bufferCount = %u", __FUNCTION__, bufferCount);
+
     std::lock_guard<std::mutex> lock(mAccessLock);
 
     // If we've been displaced by another owner of the camera, then we can't do anything else
@@ -131,9 +130,9 @@
     }
 }
 
+Return<EvsResult> EvsCamera::startVideoStream(const ::android::sp<V1_0::IEvsCameraStream>& stream) {
+    ALOGD("%s", __FUNCTION__);
 
-Return<EvsResult> EvsCamera::startVideoStream(const ::android::sp<IEvsCameraStream_1_0>& stream)  {
-    ALOGD("startVideoStream");
     std::lock_guard<std::mutex> lock(mAccessLock);
 
     // If we've been displaced by another owner of the camera, then we can't do anything else
@@ -141,82 +140,86 @@
         ALOGE("ignoring startVideoStream call when camera has been lost.");
         return EvsResult::OWNERSHIP_LOST;
     }
+
     if (mStreamState != STOPPED) {
         ALOGE("ignoring startVideoStream call when a stream is already running.");
         return EvsResult::STREAM_ALREADY_RUNNING;
     }
 
     // If the client never indicated otherwise, configure ourselves for a single streaming buffer
-    if (mFramesAllowed < 1) {
-        if (!setAvailableFrames_Locked(1)) {
+    if (mFramesAllowed < kMinimumBuffersInFlight) {
+        if (!setAvailableFrames_Locked(kMinimumBuffersInFlight)) {
             ALOGE("Failed to start stream because we couldn't get a graphics buffer");
             return EvsResult::BUFFER_NOT_AVAILABLE;
         }
     }
 
     // Record the user's callback for use when we have a frame ready
-    mStream = IEvsCameraStream_1_1::castFrom(stream).withDefault(nullptr);
-    if (mStream == nullptr) {
+    mStream = IEvsCameraStream::castFrom(stream).withDefault(nullptr);
+    if (!mStream) {
         ALOGE("Default implementation does not support v1.0 IEvsCameraStream");
         return EvsResult::INVALID_ARG;
     }
 
     // Start the frame generation thread
     mStreamState = RUNNING;
-    mCaptureThread = std::thread([this](){ generateFrames(); });
+    mCaptureThread = std::thread([this]() { generateFrames(); });
 
     return EvsResult::OK;
 }
 
-
-Return<void> EvsCamera::doneWithFrame(const BufferDesc_1_0& buffer) {
-    std::lock_guard <std::mutex> lock(mAccessLock);
-    returnBuffer(buffer.bufferId, buffer.memHandle);
-
-    return Void();
-}
-
-
-Return<void> EvsCamera::stopVideoStream()  {
-    ALOGD("stopVideoStream");
-    std::unique_lock <std::mutex> lock(mAccessLock);
-
-    if (mStreamState == RUNNING) {
-        // Tell the GenerateFrames loop we want it to stop
-        mStreamState = STOPPING;
-
-        // Block outside the mutex until the "stop" flag has been acknowledged
-        // We won't send any more frames, but the client might still get some already in flight
-        ALOGD("Waiting for stream thread to end...");
-        lock.unlock();
-        mCaptureThread.join();
-        lock.lock();
-
-        mStreamState = STOPPED;
-        mStream = nullptr;
-        ALOGD("Stream marked STOPPED.");
-    }
-
-    return Void();
-}
-
-
-Return<int32_t> EvsCamera::getExtendedInfo(uint32_t opaqueIdentifier)  {
-    ALOGD("getExtendedInfo");
+Return<void> EvsCamera::doneWithFrame(const V1_0::BufferDesc& buffer) {
     std::lock_guard<std::mutex> lock(mAccessLock);
+    returnBufferLocked(buffer.bufferId, buffer.memHandle);
 
-    // For any single digit value, return the index itself as a test value
-    if (opaqueIdentifier <= 9) {
-        return opaqueIdentifier;
-    }
-
-    // Return zero by default as required by the spec
-    return 0;
+    return {};
 }
 
+Return<void> EvsCamera::stopVideoStream() {
+    ALOGD("%s", __FUNCTION__);
 
-Return<EvsResult> EvsCamera::setExtendedInfo(uint32_t /*opaqueIdentifier*/, int32_t /*opaqueValue*/)  {
-    ALOGD("setExtendedInfo");
+    std::unique_lock<std::mutex> lock(mAccessLock);
+
+    if (mStreamState != RUNNING) {
+        return {};
+    }
+
+    // Tell the GenerateFrames loop we want it to stop
+    mStreamState = STOPPING;
+
+    // Block outside the mutex until the "stop" flag has been acknowledged
+    // We won't send any more frames, but the client might still get some already in flight
+    ALOGD("Waiting for stream thread to end...");
+    lock.unlock();
+    if (mCaptureThread.joinable()) {
+        mCaptureThread.join();
+    }
+    lock.lock();
+
+    mStreamState = STOPPED;
+    mStream = nullptr;
+    ALOGD("Stream marked STOPPED.");
+
+    return {};
+}
+
+Return<int32_t> EvsCamera::getExtendedInfo(uint32_t opaqueIdentifier) {
+    ALOGD("%s", __FUNCTION__);
+
+    std::lock_guard<std::mutex> lock(mAccessLock);
+    const auto it = mExtInfo.find(opaqueIdentifier);
+    if (it == mExtInfo.end()) {
+        // Return zero by default as required by the spec
+        return 0;
+    } else {
+        return it->second[0];
+    }
+}
+
+Return<EvsResult> EvsCamera::setExtendedInfo([[maybe_unused]] uint32_t opaqueIdentifier,
+                                             [[maybe_unused]] int32_t opaqueValue) {
+    ALOGD("%s", __FUNCTION__);
+
     std::lock_guard<std::mutex> lock(mAccessLock);
 
     // If we've been displaced by another owner of the camera, then we can't do anything else
@@ -225,76 +228,73 @@
         return EvsResult::OWNERSHIP_LOST;
     }
 
-    // We don't store any device specific information in this implementation
-    return EvsResult::INVALID_ARG;
+    mExtInfo.insert_or_assign(opaqueIdentifier, opaqueValue);
+    return EvsResult::OK;
 }
 
-
 // Methods from ::android::hardware::automotive::evs::V1_1::IEvsCamera follow.
 Return<void> EvsCamera::getCameraInfo_1_1(getCameraInfo_1_1_cb _hidl_cb) {
-    ALOGD("getCameraInfo_1_1");
+    ALOGD("%s", __FUNCTION__);
 
     // Send back our self description
     _hidl_cb(mDescription);
-    return Void();
+    return {};
 }
 
-
-Return<void> EvsCamera::getPhysicalCameraInfo(const hidl_string& id,
+Return<void> EvsCamera::getPhysicalCameraInfo([[maybe_unused]] const hidl_string& id,
                                               getCameraInfo_1_1_cb _hidl_cb) {
     ALOGD("%s", __FUNCTION__);
 
     // This works exactly same as getCameraInfo_1_1() in default implementation.
-    (void)id;
     _hidl_cb(mDescription);
-    return Void();
+    return {};
 }
 
+Return<EvsResult> EvsCamera::doneWithFrame_1_1(const hidl_vec<BufferDesc>& buffers) {
+    ALOGD("%s", __FUNCTION__);
 
-Return<EvsResult> EvsCamera::doneWithFrame_1_1(const hidl_vec<BufferDesc_1_1>& buffers)  {
-    std::lock_guard <std::mutex> lock(mAccessLock);
-
+    std::lock_guard<std::mutex> lock(mAccessLock);
     for (auto&& buffer : buffers) {
-        returnBuffer(buffer.bufferId, buffer.buffer.nativeHandle);
+        returnBufferLocked(buffer.bufferId, buffer.buffer.nativeHandle);
     }
-
     return EvsResult::OK;
 }
 
-
 Return<EvsResult> EvsCamera::pauseVideoStream() {
+    ALOGD("%s", __FUNCTION__);
     // Default implementation does not support this.
     return EvsResult::UNDERLYING_SERVICE_ERROR;
 }
 
-
 Return<EvsResult> EvsCamera::resumeVideoStream() {
+    ALOGD("%s", __FUNCTION__);
     // Default implementation does not support this.
     return EvsResult::UNDERLYING_SERVICE_ERROR;
 }
 
-
 Return<EvsResult> EvsCamera::setMaster() {
+    ALOGD("%s", __FUNCTION__);
     // Default implementation does not expect multiple subscribers and therefore
     // return a success code always.
     return EvsResult::OK;
 }
 
-Return<EvsResult> EvsCamera::forceMaster(const sp<IEvsDisplay_1_0>& ) {
+Return<EvsResult> EvsCamera::forceMaster(const sp<V1_0::IEvsDisplay>&) {
+    ALOGD("%s", __FUNCTION__);
     // Default implementation does not expect multiple subscribers and therefore
     // return a success code always.
     return EvsResult::OK;
 }
 
-
 Return<EvsResult> EvsCamera::unsetMaster() {
+    ALOGD("%s", __FUNCTION__);
     // Default implementation does not expect multiple subscribers and therefore
     // return a success code always.
     return EvsResult::OK;
 }
 
-
 Return<void> EvsCamera::getParameterList(getParameterList_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
     hidl_vec<CameraParam> hidlCtrls;
     hidlCtrls.resize(mCameraInfo->controls.size());
     unsigned idx = 0;
@@ -303,72 +303,132 @@
     }
 
     _hidl_cb(hidlCtrls);
-    return Void();
-}
-
-
-Return<void> EvsCamera::getIntParameterRange(CameraParam id,
-                                             getIntParameterRange_cb _hidl_cb) {
-    auto range = mCameraInfo->controls[id];
-    _hidl_cb(get<0>(range), get<1>(range), get<2>(range));
-    return Void();
-}
-
-
-Return<void> EvsCamera::setIntParameter(CameraParam id, int32_t value,
-                                        setIntParameter_cb _hidl_cb) {
-    // Default implementation does not support this.
-    (void)id;
-    (void)value;
-    _hidl_cb(EvsResult::INVALID_ARG, 0);
-    return Void();
-}
-
-
-Return<void> EvsCamera::getIntParameter(CameraParam id,
-                                        getIntParameter_cb _hidl_cb) {
-    // Default implementation does not support this.
-    (void)id;
-    _hidl_cb(EvsResult::INVALID_ARG, 0);
-    return Void();
-}
-
-
-Return<EvsResult> EvsCamera::setExtendedInfo_1_1(uint32_t opaqueIdentifier,
-                                                 const hidl_vec<uint8_t>& opaqueValue) {
-    // Default implementation does not use an extended info.
-    (void)opaqueIdentifier;
-    (void)opaqueValue;
-    return EvsResult::INVALID_ARG;
-}
-
-
-Return<void> EvsCamera::getExtendedInfo_1_1(uint32_t opaqueIdentifier,
-                                            getExtendedInfo_1_1_cb _hidl_cb) {
-    // Default implementation does not use an extended info.
-    (void)opaqueIdentifier;
-
-    hidl_vec<uint8_t> value;
-    _hidl_cb(EvsResult::INVALID_ARG, value);
-    return Void();
-}
-
-
-Return<void>
-EvsCamera::importExternalBuffers(const hidl_vec<BufferDesc_1_1>& /* buffers */,
-                                 importExternalBuffers_cb _hidl_cb) {
-    ALOGW("%s is not implemented yet.", __FUNCTION__);
-    _hidl_cb(EvsResult::UNDERLYING_SERVICE_ERROR, 0);
     return {};
 }
 
+Return<void> EvsCamera::getIntParameterRange(CameraParam id, getIntParameterRange_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
+    auto it = mCameraInfo->controls.find(id);
+    if (it == mCameraInfo->controls.end()) {
+        _hidl_cb(0, 0, 0);
+    } else {
+        _hidl_cb(std::get<0>(it->second), std::get<1>(it->second), std::get<2>(it->second));
+    }
+    return {};
+}
+
+Return<void> EvsCamera::setIntParameter(CameraParam id, int32_t value,
+                                        setIntParameter_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
+    mParams.insert_or_assign(id, value);
+    _hidl_cb(EvsResult::OK, {value});
+    return {};
+}
+
+Return<void> EvsCamera::getIntParameter([[maybe_unused]] CameraParam id,
+                                        getIntParameter_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
+    auto it = mParams.find(id);
+    std::vector<int32_t> values;
+    if (it == mParams.end()) {
+        _hidl_cb(EvsResult::INVALID_ARG, values);
+    } else {
+        values.push_back(it->second);
+        _hidl_cb(EvsResult::OK, values);
+    }
+    return {};
+}
+
+Return<EvsResult> EvsCamera::setExtendedInfo_1_1(uint32_t opaqueIdentifier,
+                                                 const hidl_vec<uint8_t>& opaqueValue) {
+    ALOGD("%s", __FUNCTION__);
+    mExtInfo.insert_or_assign(opaqueIdentifier, opaqueValue);
+    return EvsResult::OK;
+}
+
+Return<void> EvsCamera::getExtendedInfo_1_1(uint32_t opaqueIdentifier,
+                                            getExtendedInfo_1_1_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
+    auto status = EvsResult::OK;
+    hidl_vec<uint8_t> value;
+    const auto it = mExtInfo.find(opaqueIdentifier);
+    if (it == mExtInfo.end()) {
+        status = EvsResult::INVALID_ARG;
+    } else {
+        value = it->second;
+    }
+    _hidl_cb(status, value);
+    return {};
+}
+
+Return<void> EvsCamera::importExternalBuffers([[maybe_unused]] const hidl_vec<BufferDesc>& buffers,
+                                              importExternalBuffers_cb _hidl_cb) {
+    auto numBuffersToAdd = buffers.size();
+    if (numBuffersToAdd < 1) {
+        ALOGD("No buffers to add");
+        _hidl_cb(EvsResult::OK, mFramesAllowed);
+        return {};
+    }
+
+    {
+        std::scoped_lock<std::mutex> lock(mAccessLock);
+
+        if (numBuffersToAdd > (kMaxBuffersInFlight - mFramesAllowed)) {
+            numBuffersToAdd -= (kMaxBuffersInFlight - mFramesAllowed);
+            ALOGW("Exceed the limit on number of buffers. %" PRIu64 " buffers will be added only.",
+                  static_cast<uint64_t>(numBuffersToAdd));
+        }
+
+        GraphicBufferMapper& mapper = GraphicBufferMapper::get();
+        const auto before = mFramesAllowed;
+        for (auto i = 0; i < numBuffersToAdd; ++i) {
+            // TODO: reject if external buffer is configured differently.
+            auto& b = buffers[i];
+            const AHardwareBuffer_Desc* pDesc =
+                    reinterpret_cast<const AHardwareBuffer_Desc*>(&b.buffer.description);
+
+            // Import a buffer to add
+            buffer_handle_t memHandle = nullptr;
+            status_t result =
+                    mapper.importBuffer(b.buffer.nativeHandle, pDesc->width, pDesc->height, 1,
+                                        pDesc->format, pDesc->usage, pDesc->stride, &memHandle);
+            if (result != android::NO_ERROR || !memHandle) {
+                ALOGW("Failed to import a buffer %d", b.bufferId);
+                continue;
+            }
+
+            auto stored = false;
+            for (auto&& rec : mBuffers) {
+                if (rec.handle == nullptr) {
+                    // Use this existing entry
+                    rec.handle = memHandle;
+                    rec.inUse = false;
+
+                    stored = true;
+                    break;
+                }
+            }
+
+            if (!stored) {
+                // Add a BufferRecord wrapping this handle to our set of available buffers
+                mBuffers.emplace_back(memHandle);
+            }
+
+            ++mFramesAllowed;
+        }
+
+        _hidl_cb(EvsResult::OK, mFramesAllowed - before);
+        return {};
+    }
+}
 
 bool EvsCamera::setAvailableFrames_Locked(unsigned bufferCount) {
-    if (bufferCount < 1) {
-        ALOGE("Ignoring request to set buffer count to zero");
+    if (bufferCount < kMinimumBuffersInFlight) {
+        ALOGE("Ignoring request to set buffer count below the minimum number of buffers to run a "
+              "video stream");
         return false;
     }
-    if (bufferCount > MAX_BUFFERS_IN_FLIGHT) {
+    if (bufferCount > kMaxBuffersInFlight) {
         ALOGE("Rejecting buffer request in excess of internal limit");
         return false;
     }
@@ -403,17 +463,16 @@
     return true;
 }
 
-
 unsigned EvsCamera::increaseAvailableFrames_Locked(unsigned numToAdd) {
     // Acquire the graphics buffer allocator
-    GraphicBufferAllocator &alloc(GraphicBufferAllocator::get());
+    GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
 
     unsigned added = 0;
 
     while (added < numToAdd) {
         buffer_handle_t memHandle = nullptr;
-        status_t result = alloc.allocate(mWidth, mHeight, mFormat, 1, mUsage,
-                                         &memHandle, &mStride, 0, "EvsCamera");
+        status_t result = alloc.allocate(mWidth, mHeight, mFormat, 1, mUsage, &memHandle, &mStride,
+                                         0, "EvsCamera");
         if (result != NO_ERROR) {
             ALOGE("Error %d allocating %d x %d graphics buffer", result, mWidth, mHeight);
             break;
@@ -436,7 +495,7 @@
         }
         if (!stored) {
             // Add a BufferRecord wrapping this handle to our set of available buffers
-            mBuffers.emplace_back(memHandle);
+            mBuffers.push_back(std::move(BufferRecord(memHandle)));
         }
 
         mFramesAllowed++;
@@ -446,10 +505,9 @@
     return added;
 }
 
-
 unsigned EvsCamera::decreaseAvailableFrames_Locked(unsigned numToRemove) {
     // Acquire the graphics buffer allocator
-    GraphicBufferAllocator &alloc(GraphicBufferAllocator::get());
+    GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
 
     unsigned removed = 0;
 
@@ -472,14 +530,12 @@
     return removed;
 }
 
-
 // This is the asynchronous frame generation thread that runs in parallel with the
 // main serving thread.  There is one for each active camera instance.
 void EvsCamera::generateFrames() {
     ALOGD("Frame generation loop started");
 
     unsigned idx;
-
     while (true) {
         bool timeForFrame = false;
         nsecs_t startTime = systemTime(SYSTEM_TIME_MONOTONIC);
@@ -521,9 +577,9 @@
 
         if (timeForFrame) {
             // Assemble the buffer description we'll transmit below
-            BufferDesc_1_1 newBuffer = {};
+            BufferDesc newBuffer = {};
             AHardwareBuffer_Desc* pDesc =
-                reinterpret_cast<AHardwareBuffer_Desc *>(&newBuffer.buffer.description);
+                    reinterpret_cast<AHardwareBuffer_Desc*>(&newBuffer.buffer.description);
             pDesc->width = mWidth;
             pDesc->height = mHeight;
             pDesc->layers = 1;
@@ -534,19 +590,16 @@
             newBuffer.pixelSize = sizeof(uint32_t);
             newBuffer.bufferId = idx;
             newBuffer.deviceId = mDescription.v1.cameraId;
-            newBuffer.timestamp = elapsedRealtimeNano();
+            newBuffer.timestamp = elapsedRealtimeNano() * 1e+3;  // timestamps is in microseconds
 
             // Write test data into the image buffer
             fillTestFrame(newBuffer);
 
             // Issue the (asynchronous) callback to the client -- can't be holding the lock
-            hidl_vec<BufferDesc_1_1> frames;
-            frames.resize(1);
-            frames[0] = newBuffer;
-            auto result = mStream->deliverFrame_1_1(frames);
+            auto result = mStream->deliverFrame_1_1({newBuffer});
             if (result.isOk()) {
-                ALOGD("Delivered %p as id %d",
-                      newBuffer.buffer.nativeHandle.getNativeHandle(), newBuffer.bufferId);
+                ALOGD("Delivered %p as id %d", newBuffer.buffer.nativeHandle.getNativeHandle(),
+                      newBuffer.bufferId);
             } else {
                 // This can happen if the client dies and is likely unrecoverable.
                 // To avoid consuming resources generating failing calls, we stop sending
@@ -563,63 +616,50 @@
             }
         }
 
-        // We arbitrarily choose to generate frames at 12 fps to ensure we pass the 10fps test requirement
-        static const int kTargetFrameRate = 12;
-        static const nsecs_t kTargetFrameTimeUs = 1000*1000 / kTargetFrameRate;
+        // We arbitrarily choose to generate frames at 15 fps to ensure we pass the 10fps test
+        // requirement
+        static const int kTargetFrameRate = 15;
+        static const nsecs_t kTargetFrameIntervalUs = 1000 * 1000 / kTargetFrameRate;
         const nsecs_t now = systemTime(SYSTEM_TIME_MONOTONIC);
-        const nsecs_t workTimeUs = (now - startTime) / 1000;
-        const nsecs_t sleepDurationUs = kTargetFrameTimeUs - workTimeUs;
+        const nsecs_t elapsedTimeUs = (now - startTime) / 1000;
+        const nsecs_t sleepDurationUs = kTargetFrameIntervalUs - elapsedTimeUs;
         if (sleepDurationUs > 0) {
             usleep(sleepDurationUs);
         }
     }
 
     // If we've been asked to stop, send an event to signal the actual end of stream
-    EvsEventDesc event;
-    event.aType = EvsEventType::STREAM_STOPPED;
-    auto result = mStream->notify(event);
-    if (!result.isOk()) {
+    EvsEventDesc event = {
+            .aType = EvsEventType::STREAM_STOPPED,
+    };
+    if (!mStream->notify(event).isOk()) {
         ALOGE("Error delivering end of stream marker");
     }
 
     return;
 }
 
-
-void EvsCamera::fillTestFrame(const BufferDesc_1_1& buff) {
+void EvsCamera::fillTestFrame(const BufferDesc& buff) {
     // Lock our output buffer for writing
-    uint32_t *pixels = nullptr;
+    uint32_t* pixels = nullptr;
     const AHardwareBuffer_Desc* pDesc =
-        reinterpret_cast<const AHardwareBuffer_Desc *>(&buff.buffer.description);
-    GraphicBufferMapper &mapper = GraphicBufferMapper::get();
+            reinterpret_cast<const AHardwareBuffer_Desc*>(&buff.buffer.description);
+    GraphicBufferMapper& mapper = GraphicBufferMapper::get();
     mapper.lock(buff.buffer.nativeHandle,
                 GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_NEVER,
-                android::Rect(pDesc->width, pDesc->height),
-                (void **) &pixels);
+                android::Rect(pDesc->width, pDesc->height), (void**)&pixels);
 
     // If we failed to lock the pixel buffer, we're about to crash, but log it first
     if (!pixels) {
         ALOGE("Camera failed to gain access to image buffer for writing");
+        return;
     }
 
-    // Fill in the test pixels
+    // Fill in the test pixels; the colorbar in ABGR format
     for (unsigned row = 0; row < pDesc->height; row++) {
         for (unsigned col = 0; col < pDesc->width; col++) {
-            // Index into the row to check the pixel at this column.
-            // We expect 0xFF in the LSB channel, a vertical gradient in the
-            // second channel, a horitzontal gradient in the third channel, and
-            // 0xFF in the MSB.
-            // The exception is the very first 32 bits which is used for the
-            // time varying frame signature to avoid getting fooled by a static image.
-            uint32_t expectedPixel = 0xFF0000FF           | // MSB and LSB
-                                     ((row & 0xFF) <<  8) | // vertical gradient
-                                     ((col & 0xFF) << 16);  // horizontal gradient
-            if ((row | col) == 0) {
-                static uint32_t sFrameTicker = 0;
-                expectedPixel = (sFrameTicker) & 0xFF;
-                sFrameTicker++;
-            }
-            pixels[col] = expectedPixel;
+            const uint32_t index = col * kNumColors / pDesc->width;
+            pixels[col] = kColors[index];
         }
         // Point to the next row
         // NOTE:  stride retrieved from gralloc is in units of pixels
@@ -630,39 +670,35 @@
     mapper.unlock(buff.buffer.nativeHandle);
 }
 
-
-void EvsCamera::fillTestFrame(const BufferDesc_1_0& buff) {
-    BufferDesc_1_1 newBufDesc = {};
-    AHardwareBuffer_Desc desc = {
-        buff.width,   // width
-        buff.height,  // height
-        1,            // layers, always 1 for EVS
-        buff.format,  // One of AHardwareBuffer_Format
-        buff.usage,   // Combination of AHardwareBuffer_UsageFlags
-        buff.stride,  // Row stride in pixels
-        0,            // Reserved
-        0             // Reserved
+void EvsCamera::fillTestFrame(const V1_0::BufferDesc& buff) {
+    BufferDesc newBuffer = {
+            .buffer.nativeHandle = buff.memHandle,
+            .pixelSize = buff.pixelSize,
+            .bufferId = buff.bufferId,
     };
-    memcpy(&desc, &newBufDesc.buffer.description, sizeof(desc));
-    newBufDesc.buffer.nativeHandle = buff.memHandle;
-    newBufDesc.pixelSize = buff.pixelSize;
-    newBufDesc.bufferId = buff.bufferId;
-
-    return fillTestFrame(newBufDesc);
+    AHardwareBuffer_Desc* pDesc =
+            reinterpret_cast<AHardwareBuffer_Desc*>(&newBuffer.buffer.description);
+    *pDesc = {
+            buff.width,   // width
+            buff.height,  // height
+            1,            // layers, always 1 for EVS
+            buff.format,  // One of AHardwareBuffer_Format
+            buff.usage,   // Combination of AHardwareBuffer_UsageFlags
+            buff.stride,  // Row stride in pixels
+            0,            // Reserved
+            0             // Reserved
+    };
+    return fillTestFrame(newBuffer);
 }
 
-
-void EvsCamera::returnBuffer(const uint32_t bufferId, const buffer_handle_t memHandle) {
-    std::lock_guard <std::mutex> lock(mAccessLock);
-
+void EvsCamera::returnBufferLocked(const uint32_t bufferId, const buffer_handle_t memHandle) {
     if (memHandle == nullptr) {
         ALOGE("ignoring doneWithFrame called with null handle");
     } else if (bufferId >= mBuffers.size()) {
-        ALOGE("ignoring doneWithFrame called with invalid bufferId %d (max is %zu)",
-              bufferId, mBuffers.size()-1);
+        ALOGE("ignoring doneWithFrame called with invalid bufferId %d (max is %zu)", bufferId,
+              mBuffers.size() - 1);
     } else if (!mBuffers[bufferId].inUse) {
-        ALOGE("ignoring doneWithFrame called on frame %d which is already free",
-              bufferId);
+        ALOGE("ignoring doneWithFrame called on frame %d which is already free", bufferId);
     } else {
         // Mark the frame as available
         mBuffers[bufferId].inUse = false;
@@ -683,42 +719,33 @@
     }
 }
 
-
-sp<EvsCamera> EvsCamera::Create(const char *deviceName) {
-    unique_ptr<ConfigManager::CameraInfo> nullCamInfo = nullptr;
+sp<EvsCamera> EvsCamera::Create(const char* deviceName) {
+    std::unique_ptr<ConfigManager::CameraInfo> nullCamInfo = nullptr;
 
     return Create(deviceName, nullCamInfo);
 }
 
-
-sp<EvsCamera> EvsCamera::Create(const char *deviceName,
-                                unique_ptr<ConfigManager::CameraInfo> &camInfo,
-                                const Stream *streamCfg) {
+sp<EvsCamera> EvsCamera::Create(const char* deviceName,
+                                std::unique_ptr<ConfigManager::CameraInfo>& camInfo,
+                                [[maybe_unused]] const Stream* streamCfg) {
     sp<EvsCamera> evsCamera = new EvsCamera(deviceName, camInfo);
     if (evsCamera == nullptr) {
         return nullptr;
     }
 
-    /* default implementation does not use a given configuration */
-    (void)streamCfg;
-
-    /* Use the first resolution from the list for the testing */
+    // Use the first resolution from the list for the testing
+    // TODO(b/214835237): Uses a given Stream configuration to choose the best
+    // stream configuration.
     auto it = camInfo->streamConfigurations.begin();
     evsCamera->mWidth = it->second[1];
     evsCamera->mHeight = it->second[2];
-    evsCamera->mDescription.v1.vendorFlags = 0xFFFFFFFF; // Arbitrary test value
+    evsCamera->mDescription.v1.vendorFlags = 0xFFFFFFFF;  // Arbitrary test value
 
     evsCamera->mFormat = HAL_PIXEL_FORMAT_RGBA_8888;
-    evsCamera->mUsage  = GRALLOC_USAGE_HW_TEXTURE | GRALLOC_USAGE_HW_CAMERA_WRITE |
-                         GRALLOC_USAGE_SW_READ_RARELY | GRALLOC_USAGE_SW_WRITE_RARELY;
+    evsCamera->mUsage = GRALLOC_USAGE_HW_TEXTURE | GRALLOC_USAGE_HW_CAMERA_WRITE |
+                        GRALLOC_USAGE_SW_READ_RARELY | GRALLOC_USAGE_SW_WRITE_RARELY;
 
     return evsCamera;
 }
 
-
-} // namespace implementation
-} // namespace V1_0
-} // namespace evs
-} // namespace automotive
-} // namespace hardware
-} // namespace android
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
diff --git a/automotive/evs/1.1/default/EvsCamera.h b/automotive/evs/1.1/default/EvsCamera.h
index 6163a34..1ea1186 100644
--- a/automotive/evs/1.1/default/EvsCamera.h
+++ b/automotive/evs/1.1/default/EvsCamera.h
@@ -17,91 +17,70 @@
 #ifndef ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSCAMERA_H
 #define ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSCAMERA_H
 
-#include <android/hardware/automotive/evs/1.1/types.h>
+#include "ConfigManager.h"
+
 #include <android/hardware/automotive/evs/1.1/IEvsCamera.h>
 #include <android/hardware/automotive/evs/1.1/IEvsCameraStream.h>
 #include <android/hardware/automotive/evs/1.1/IEvsDisplay.h>
+#include <android/hardware/automotive/evs/1.1/types.h>
 #include <ui/GraphicBuffer.h>
 
 #include <thread>
 
-#include "ConfigManager.h"
-
-using BufferDesc_1_0 = ::android::hardware::automotive::evs::V1_0::BufferDesc;
-using BufferDesc_1_1 = ::android::hardware::automotive::evs::V1_1::BufferDesc;
-using IEvsCameraStream_1_0 = ::android::hardware::automotive::evs::V1_0::IEvsCameraStream;
-using IEvsCameraStream_1_1 = ::android::hardware::automotive::evs::V1_1::IEvsCameraStream;
-using ::android::hardware::automotive::evs::V1_0::EvsResult;
-using ::android::hardware::automotive::evs::V1_0::CameraDesc;
-using IEvsDisplay_1_0 = ::android::hardware::automotive::evs::V1_0::IEvsDisplay;
-using IEvsDisplay_1_1 = ::android::hardware::automotive::evs::V1_1::IEvsDisplay;
-
-
-namespace android {
-namespace hardware {
-namespace automotive {
-namespace evs {
-namespace V1_1 {
-namespace implementation {
-
+namespace android::hardware::automotive::evs::V1_1::implementation {
 
 // From EvsEnumerator.h
 class EvsEnumerator;
 
-
 class EvsCamera : public IEvsCamera {
-public:
+  public:
     // Methods from ::android::hardware::automotive::evs::V1_0::IEvsCamera follow.
-    Return<void>      getCameraInfo(getCameraInfo_cb _hidl_cb)  override;
-    Return<EvsResult> setMaxFramesInFlight(uint32_t bufferCount) override;
-    Return<EvsResult> startVideoStream(const ::android::sp<IEvsCameraStream_1_0>& stream) override;
-    Return<void>      stopVideoStream() override;
-    Return<void>      doneWithFrame(const BufferDesc_1_0& buffer) override;
+    Return<void> getCameraInfo(getCameraInfo_cb _hidl_cb) override;
+    Return<V1_0::EvsResult> setMaxFramesInFlight(uint32_t bufferCount) override;
+    Return<V1_0::EvsResult> startVideoStream(const sp<V1_0::IEvsCameraStream>& stream) override;
+    Return<void> stopVideoStream() override;
+    Return<void> doneWithFrame(const V1_0::BufferDesc& buffer) override;
 
-    Return<int32_t>   getExtendedInfo(uint32_t opaqueIdentifier) override;
-    Return<EvsResult> setExtendedInfo(uint32_t opaqueIdentifier, int32_t opaqueValue) override;
+    Return<int32_t> getExtendedInfo(uint32_t opaqueIdentifier) override;
+    Return<V1_0::EvsResult> setExtendedInfo(uint32_t opaqueIdentifier,
+                                            int32_t opaqueValue) override;
 
     // Methods from ::android::hardware::automotive::evs::V1_1::IEvsCamera follow.
-    Return<void>      getCameraInfo_1_1(getCameraInfo_1_1_cb _hidl_cb)  override;
-    Return<void>      getPhysicalCameraInfo(const hidl_string& id,
-                                            getPhysicalCameraInfo_cb _hidl_cb)  override;
-    Return<EvsResult> pauseVideoStream() override;
-    Return<EvsResult> resumeVideoStream() override;
-    Return<EvsResult> doneWithFrame_1_1(const hidl_vec<BufferDesc_1_1>& buffer) override;
-    Return<EvsResult> setMaster() override;
-    Return<EvsResult> forceMaster(const sp<IEvsDisplay_1_0>& display) override;
-    Return<EvsResult> unsetMaster() override;
-    Return<void>      getParameterList(getParameterList_cb _hidl_cb) override;
-    Return<void>      getIntParameterRange(CameraParam id,
-                                           getIntParameterRange_cb _hidl_cb) override;
-    Return<void>      setIntParameter(CameraParam id, int32_t value,
-                                      setIntParameter_cb _hidl_cb) override;
-    Return<void>      getIntParameter(CameraParam id,
-                                      getIntParameter_cb _hidl_cb) override;
-    Return<EvsResult> setExtendedInfo_1_1(uint32_t opaqueIdentifier,
-                                          const hidl_vec<uint8_t>& opaqueValue) override;
-    Return<void>      getExtendedInfo_1_1(uint32_t opaqueIdentifier,
-                                          getExtendedInfo_1_1_cb _hidl_cb) override;
-    Return<void>      importExternalBuffers(const hidl_vec<BufferDesc_1_1>& buffers,
-                                            importExternalBuffers_cb _hidl_cb) override;
+    Return<void> getCameraInfo_1_1(getCameraInfo_1_1_cb _hidl_cb) override;
+    Return<void> getPhysicalCameraInfo(const hidl_string& id,
+                                       getPhysicalCameraInfo_cb _hidl_cb) override;
+    Return<V1_0::EvsResult> pauseVideoStream() override;
+    Return<V1_0::EvsResult> resumeVideoStream() override;
+    Return<V1_0::EvsResult> doneWithFrame_1_1(const hidl_vec<BufferDesc>& buffer) override;
+    Return<V1_0::EvsResult> setMaster() override;
+    Return<V1_0::EvsResult> forceMaster(const sp<V1_0::IEvsDisplay>& display) override;
+    Return<V1_0::EvsResult> unsetMaster() override;
+    Return<void> getParameterList(getParameterList_cb _hidl_cb) override;
+    Return<void> getIntParameterRange(CameraParam id, getIntParameterRange_cb _hidl_cb) override;
+    Return<void> setIntParameter(CameraParam id, int32_t value,
+                                 setIntParameter_cb _hidl_cb) override;
+    Return<void> getIntParameter(CameraParam id, getIntParameter_cb _hidl_cb) override;
+    Return<V1_0::EvsResult> setExtendedInfo_1_1(uint32_t opaqueIdentifier,
+                                                const hidl_vec<uint8_t>& opaqueValue) override;
+    Return<void> getExtendedInfo_1_1(uint32_t opaqueIdentifier,
+                                     getExtendedInfo_1_1_cb _hidl_cb) override;
+    Return<void> importExternalBuffers(const hidl_vec<BufferDesc>& buffers,
+                                       importExternalBuffers_cb _hidl_cb) override;
 
-    static sp<EvsCamera> Create(const char *deviceName);
-    static sp<EvsCamera> Create(const char *deviceName,
-                                unique_ptr<ConfigManager::CameraInfo> &camInfo,
-                                const Stream *streamCfg = nullptr);
+    static sp<EvsCamera> Create(const char* deviceName);
+    static sp<EvsCamera> Create(const char* deviceName,
+                                std::unique_ptr<ConfigManager::CameraInfo>& camInfo,
+                                const Stream* streamCfg = nullptr);
     EvsCamera(const EvsCamera&) = delete;
     EvsCamera& operator=(const EvsCamera&) = delete;
 
     virtual ~EvsCamera() override;
-    void forceShutdown();   // This gets called if another caller "steals" ownership of the camera
+    void forceShutdown();  // This gets called if another caller "steals" ownership of the camera
 
     const CameraDesc& getDesc() { return mDescription; };
 
-    static const char kCameraName_Backup[];
-
-private:
-    EvsCamera(const char *id,
-              unique_ptr<ConfigManager::CameraInfo> &camInfo);
+  private:
+    EvsCamera(const char* id, std::unique_ptr<ConfigManager::CameraInfo>& camInfo);
     // These three functions are expected to be called while mAccessLock is held
     //
     bool setAvailableFrames_Locked(unsigned bufferCount);
@@ -109,34 +88,34 @@
     unsigned decreaseAvailableFrames_Locked(unsigned numToRemove);
 
     void generateFrames();
-    void fillTestFrame(const BufferDesc_1_0& buff);
-    void fillTestFrame(const BufferDesc_1_1& buff);
-    void returnBuffer(const uint32_t bufferId, const buffer_handle_t memHandle);
+    void fillTestFrame(const V1_0::BufferDesc& buff);
+    void fillTestFrame(const BufferDesc& buff);
+    void returnBufferLocked(const uint32_t bufferId, const buffer_handle_t memHandle);
 
     sp<EvsEnumerator> mEnumerator;  // The enumerator object that created this camera
 
-    CameraDesc mDescription = {};   // The properties of this camera
+    CameraDesc mDescription = {};  // The properties of this camera
 
-    std::thread mCaptureThread;     // The thread we'll use to synthesize frames
+    std::thread mCaptureThread;  // The thread we'll use to synthesize frames
 
-    uint32_t mWidth  = 0;           // Horizontal pixel count in the buffers
-    uint32_t mHeight = 0;           // Vertical pixel count in the buffers
-    uint32_t mFormat = 0;           // Values from android_pixel_format_t
-    uint64_t mUsage  = 0;           // Values from from Gralloc.h
-    uint32_t mStride = 0;           // Bytes per line in the buffers
+    uint32_t mWidth = 0;   // Horizontal pixel count in the buffers
+    uint32_t mHeight = 0;  // Vertical pixel count in the buffers
+    uint32_t mFormat = 0;  // Values from android_pixel_format_t
+    uint64_t mUsage = 0;   // Values from from Gralloc.h
+    uint32_t mStride = 0;  // Bytes per line in the buffers
 
-    sp<IEvsCameraStream_1_1> mStream = nullptr;  // The callback used to deliver each frame
+    sp<IEvsCameraStream> mStream = nullptr;  // The callback used to deliver each frame
 
     struct BufferRecord {
         buffer_handle_t handle;
         bool inUse;
 
-        explicit BufferRecord(buffer_handle_t h) : handle(h), inUse(false) {};
+        explicit BufferRecord(buffer_handle_t h) : handle(h), inUse(false){};
     };
 
-    std::vector <BufferRecord> mBuffers;  // Graphics buffers to transfer images
-    unsigned mFramesAllowed;              // How many buffers are we currently using
-    unsigned mFramesInUse;                // How many buffers are currently outstanding
+    std::vector<BufferRecord> mBuffers;  // Graphics buffers to transfer images
+    unsigned mFramesAllowed;             // How many buffers are we currently using
+    unsigned mFramesInUse;               // How many buffers are currently outstanding
 
     enum StreamStateValues {
         STOPPED,
@@ -150,14 +129,13 @@
     std::mutex mAccessLock;
 
     // Static camera module information
-    unique_ptr<ConfigManager::CameraInfo> &mCameraInfo;
+    std::unique_ptr<ConfigManager::CameraInfo>& mCameraInfo;
+
+    // For the extended info
+    std::unordered_map<uint32_t, hidl_vec<uint8_t>> mExtInfo;
+    std::unordered_map<CameraParam, int32_t> mParams;
 };
 
-} // namespace implementation
-} // namespace V1_1
-} // namespace evs
-} // namespace automotive
-} // namespace hardware
-} // namespace android
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
 
 #endif  // ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSCAMERA_H
diff --git a/automotive/evs/1.1/default/EvsDisplay.cpp b/automotive/evs/1.1/default/EvsDisplay.cpp
index 2b5a4a9..f7169e5 100644
--- a/automotive/evs/1.1/default/EvsDisplay.cpp
+++ b/automotive/evs/1.1/default/EvsDisplay.cpp
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.automotive.evs@1.1-service"
-
 #include "EvsDisplay.h"
 
 #include <ui/GraphicBufferAllocator.h>
@@ -23,51 +21,53 @@
 
 using ::android::frameworks::automotive::display::V1_0::HwDisplayConfig;
 using ::android::frameworks::automotive::display::V1_0::HwDisplayState;
+using ::android::frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService;
+using ::android::hardware::automotive::evs::V1_0::DisplayDesc;
+using ::android::hardware::automotive::evs::V1_0::DisplayState;
+using ::android::hardware::automotive::evs::V1_0::EvsResult;
 
-namespace android {
-namespace hardware {
-namespace automotive {
-namespace evs {
-namespace V1_1 {
-namespace implementation {
+namespace {
 
+    // Arbitrary magic number for self-recognition
+    constexpr uint32_t kDefaultDisplayBufferId = 0x3870;
+
+}  // namespace
+
+namespace android::hardware::automotive::evs::V1_1::implementation {
 
 EvsDisplay::EvsDisplay() {
     EvsDisplay(nullptr, 0);
 }
 
-
 EvsDisplay::EvsDisplay(sp<IAutomotiveDisplayProxyService> pDisplayProxy, uint64_t displayId)
     : mDisplayProxy(pDisplayProxy),
-      mDisplayId(displayId) {
+      mDisplayId(displayId),
+      mGlWrapper(std::make_unique<GlWrapper>()) {
     ALOGD("EvsDisplay instantiated");
 
     // Set up our self description
     // NOTE:  These are arbitrary values chosen for testing
-    mInfo.displayId             = "Mock Display";
-    mInfo.vendorFlags           = 3870;
+    mInfo.displayId = "Mock Display";
+    mInfo.vendorFlags = 3870;
 
     // Assemble the buffer description we'll use for our render target
-    mBuffer.width       = 320;
-    mBuffer.height      = 240;
-    mBuffer.format      = HAL_PIXEL_FORMAT_RGBA_8888;
-    mBuffer.usage       = GRALLOC_USAGE_HW_RENDER | GRALLOC_USAGE_HW_COMPOSER;
-    mBuffer.bufferId    = 0x3870;  // Arbitrary magic number for self recognition
-    mBuffer.pixelSize   = 4;
+    mBuffer.width = 640;
+    mBuffer.height = 360;
+    mBuffer.format = HAL_PIXEL_FORMAT_RGBA_8888;
+    mBuffer.usage = GRALLOC_USAGE_HW_RENDER | GRALLOC_USAGE_HW_COMPOSER;
+    mBuffer.bufferId = kDefaultDisplayBufferId;
+    mBuffer.pixelSize = 4;
 }
 
-
 EvsDisplay::~EvsDisplay() {
     ALOGD("EvsDisplay being destroyed");
     forceShutdown();
 }
 
-
 /**
  * This gets called if another caller "steals" ownership of the display
  */
-void EvsDisplay::forceShutdown()
-{
+void EvsDisplay::forceShutdown() {
     ALOGD("EvsDisplay forceShutdown");
     std::lock_guard<std::mutex> lock(mAccessLock);
 
@@ -84,6 +84,11 @@
         GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
         alloc.free(mBuffer.memHandle);
         mBuffer.memHandle = nullptr;
+
+        if (mGlWrapper) {
+            mGlWrapper->hideWindow(mDisplayProxy, mDisplayId);
+            mGlWrapper->shutdown();
+        }
     }
 
     // Put this object into an unrecoverable error state since somebody else
@@ -91,20 +96,18 @@
     mRequestedState = DisplayState::DEAD;
 }
 
-
 /**
  * Returns basic information about the EVS display provided by the system.
  * See the description of the DisplayDesc structure for details.
  */
-Return<void> EvsDisplay::getDisplayInfo(getDisplayInfo_cb _hidl_cb)  {
+Return<void> EvsDisplay::getDisplayInfo(getDisplayInfo_cb _hidl_cb) {
     ALOGD("getDisplayInfo");
 
     // Send back our self description
     _hidl_cb(mInfo);
-    return Void();
+    return {};
 }
 
-
 /**
  * Clients may set the display state to express their desired state.
  * The HAL implementation must gracefully accept a request for any state
@@ -124,18 +127,28 @@
     }
 
     // Ensure we recognize the requested state so we don't go off the rails
-    if (state < DisplayState::NUM_STATES) {
-        // Record the requested state
-        mRequestedState = state;
-        return EvsResult::OK;
-    }
-    else {
-        // Turn off the display if asked for an unrecognized state
-        mRequestedState = DisplayState::NOT_VISIBLE;
+    if (state >= DisplayState::NUM_STATES) {
         return EvsResult::INVALID_ARG;
     }
-}
 
+    if (!mGlWrapper) {
+        switch (state) {
+            case DisplayState::NOT_VISIBLE:
+                mGlWrapper->hideWindow(mDisplayProxy, mDisplayId);
+                break;
+            case DisplayState::VISIBLE:
+                mGlWrapper->showWindow(mDisplayProxy, mDisplayId);
+                break;
+            default:
+                break;
+        }
+    }
+
+    // Record the requested state
+    mRequestedState = state;
+
+    return EvsResult::OK;
+}
 
 /**
  * The HAL implementation should report the actual current state, which might
@@ -144,14 +157,13 @@
  * the device layer, making it undesirable for the HAL implementation to
  * spontaneously change display states.
  */
-Return<DisplayState> EvsDisplay::getDisplayState()  {
+Return<DisplayState> EvsDisplay::getDisplayState() {
     ALOGD("getDisplayState");
     std::lock_guard<std::mutex> lock(mAccessLock);
 
     return mRequestedState;
 }
 
-
 /**
  * This call returns a handle to a frame buffer associated with the display.
  * This buffer may be locked and written to by software and/or GL.  This buffer
@@ -159,43 +171,55 @@
  * display is no longer visible.
  */
 // TODO: We need to know if/when our client dies so we can get the buffer back! (blocked b/31632518)
-Return<void> EvsDisplay::getTargetBuffer(getTargetBuffer_cb _hidl_cb)  {
+Return<void> EvsDisplay::getTargetBuffer(getTargetBuffer_cb _hidl_cb) {
     ALOGD("getTargetBuffer");
     std::lock_guard<std::mutex> lock(mAccessLock);
 
     if (mRequestedState == DisplayState::DEAD) {
         ALOGE("Rejecting buffer request from object that lost ownership of the display.");
-        BufferDesc_1_0 nullBuff = {};
-        _hidl_cb(nullBuff);
-        return Void();
+        _hidl_cb({});
+        return {};
     }
 
     // If we don't already have a buffer, allocate one now
     if (!mBuffer.memHandle) {
+        // Initialize our display window
+        // NOTE:  This will cause the display to become "VISIBLE" before a frame is actually
+        // returned, which is contrary to the spec and will likely result in a black frame being
+        // (briefly) shown.
+        if (mGlWrapper->initialize(mDisplayProxy, mDisplayId)) {
+            // Assemble the buffer description we'll use for our render target
+            mBuffer.width = mGlWrapper->getWidth();
+            mBuffer.height = mGlWrapper->getHeight();
+            mBuffer.format = HAL_PIXEL_FORMAT_RGBA_8888;
+            mBuffer.usage = GRALLOC_USAGE_HW_RENDER | GRALLOC_USAGE_HW_COMPOSER;
+            mBuffer.bufferId = kDefaultDisplayBufferId;
+            mBuffer.pixelSize = 4;
+        } else {
+            // If we failed to initialize a EGL, then we're not going to display
+            // any.
+            mGlWrapper = nullptr;
+        }
+
         // Allocate the buffer that will hold our displayable image
         buffer_handle_t handle = nullptr;
         GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
-        status_t result = alloc.allocate(
-            mBuffer.width, mBuffer.height, mBuffer.format, 1, mBuffer.usage,
-            &handle, &mBuffer.stride, 0, "EvsDisplay");
-        if (result != NO_ERROR) {
-            ALOGE("Error %d allocating %d x %d graphics buffer",
-                  result, mBuffer.width, mBuffer.height);
-            BufferDesc_1_0 nullBuff = {};
-            _hidl_cb(nullBuff);
-            return Void();
-        }
-        if (!handle) {
-            ALOGE("We didn't get a buffer handle back from the allocator");
-            BufferDesc_1_0 nullBuff = {};
-            _hidl_cb(nullBuff);
-            return Void();
+        status_t result = alloc.allocate(mBuffer.width, mBuffer.height, mBuffer.format, 1,
+                                         mBuffer.usage, &handle, &mBuffer.stride, 0, "EvsDisplay");
+        if (result != NO_ERROR || !handle) {
+            ALOGE("Error %d allocating %d x %d graphics buffer", result, mBuffer.width,
+                  mBuffer.height);
+            if (mGlWrapper) {
+                mGlWrapper->shutdown();
+            }
+            _hidl_cb({});
+            return {};
         }
 
         mBuffer.memHandle = handle;
         mFrameBusy = false;
-        ALOGD("Allocated new buffer %p with stride %u",
-              mBuffer.memHandle.getNativeHandle(), mBuffer.stride);
+        ALOGD("Allocated new buffer %p with stride %u", mBuffer.memHandle.getNativeHandle(),
+              mBuffer.stride);
     }
 
     // Do we have a frame available?
@@ -205,41 +229,40 @@
         // a previously issued buffer yet (they're behaving badly).
         // NOTE:  We have to make the callback even if we have nothing to provide
         ALOGE("getTargetBuffer called while no buffers available.");
-        BufferDesc_1_0 nullBuff = {};
-        _hidl_cb(nullBuff);
-        return Void();
+        _hidl_cb({});
+        return {};
     } else {
         // Mark our buffer as busy
         mFrameBusy = true;
 
         // Send the buffer to the client
-        ALOGD("Providing display buffer handle %p as id %d",
-              mBuffer.memHandle.getNativeHandle(), mBuffer.bufferId);
+        ALOGD("Providing display buffer handle %p as id %d", mBuffer.memHandle.getNativeHandle(),
+              mBuffer.bufferId);
         _hidl_cb(mBuffer);
-        return Void();
+        return {};
     }
 }
 
-
 /**
  * This call tells the display that the buffer is ready for display.
  * The buffer is no longer valid for use by the client after this call.
  */
-Return<EvsResult> EvsDisplay::returnTargetBufferForDisplayImpl(const uint32_t bufferId, const buffer_handle_t memHandle) {
+Return<EvsResult> EvsDisplay::returnTargetBufferForDisplayImpl(const uint32_t bufferId,
+                                                               const buffer_handle_t memHandle) {
     ALOGD("returnTargetBufferForDisplay %p", memHandle);
     std::lock_guard<std::mutex> lock(mAccessLock);
 
     // Nobody should call us with a null handle
     if (!memHandle) {
-        ALOGE ("returnTargetBufferForDisplay called without a valid buffer handle.\n");
+        ALOGE("returnTargetBufferForDisplay called without a valid buffer handle.\n");
         return EvsResult::INVALID_ARG;
     }
     if (bufferId != mBuffer.bufferId) {
-        ALOGE ("Got an unrecognized frame returned.\n");
+        ALOGE("Got an unrecognized frame returned.\n");
         return EvsResult::INVALID_ARG;
     }
     if (!mFrameBusy) {
-        ALOGE ("A frame was returned with no outstanding frames.\n");
+        ALOGE("A frame was returned with no outstanding frames.\n");
         return EvsResult::BUFFER_NOT_AVAILABLE;
     }
 
@@ -253,23 +276,32 @@
     // If we were waiting for a new frame, this is it!
     if (mRequestedState == DisplayState::VISIBLE_ON_NEXT_FRAME) {
         mRequestedState = DisplayState::VISIBLE;
+        if (mGlWrapper) {
+            mGlWrapper->showWindow(mDisplayProxy, mDisplayId);
+        }
     }
 
     // Validate we're in an expected state
     if (mRequestedState != DisplayState::VISIBLE) {
         // We shouldn't get frames back when we're not visible.
-        ALOGE ("Got an unexpected frame returned while not visible - ignoring.\n");
-    } else {
+        ALOGE("Got an unexpected frame returned while not visible - ignoring.\n");
+    } else if (mGlWrapper) {
         // This is where the buffer would be made visible.
-        // For now we simply validate it has the data we expect in it by reading it back
+        if (!mGlWrapper->updateImageTexture(mBuffer)) {
+            return EvsResult::UNDERLYING_SERVICE_ERROR;
+        }
 
+        // Put the image on the screen
+        mGlWrapper->renderImageToScreen();
+    } else {
+        // TODO: Move below validation logic to somewhere else
+#if 0
+        // For now we simply validate it has the data we expect in it by reading it back
         // Lock our display buffer for reading
         uint32_t* pixels = nullptr;
-        GraphicBufferMapper &mapper = GraphicBufferMapper::get();
-        mapper.lock(mBuffer.memHandle,
-                    GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_SW_WRITE_NEVER,
-                    android::Rect(mBuffer.width, mBuffer.height),
-                    (void **)&pixels);
+        GraphicBufferMapper& mapper = GraphicBufferMapper::get();
+        mapper.lock(mBuffer.memHandle, GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_SW_WRITE_NEVER,
+                    android::Rect(mBuffer.width, mBuffer.height), (void**)&pixels);
 
         // If we failed to lock the pixel buffer, we're about to crash, but log it first
         if (!pixels) {
@@ -286,8 +318,8 @@
                 // 0xFF in the MSB.
                 // The exception is the very first 32 bits which is used for the
                 // time varying frame signature to avoid getting fooled by a static image.
-                uint32_t expectedPixel = 0xFF0000FF           | // MSB and LSB
-                                         ((row & 0xFF) <<  8) | // vertical gradient
+                uint32_t expectedPixel = 0xFF0000FF |           // MSB and LSB
+                                         ((row & 0xFF) << 8) |  // vertical gradient
                                          ((col & 0xFF) << 16);  // horizontal gradient
                 if ((row | col) == 0) {
                     // we'll check the "uniqueness" of the frame signature below
@@ -318,39 +350,31 @@
             ALOGE("Duplicate, likely stale frame buffer detected");
         }
 
-
         // Release our output buffer
         mapper.unlock(mBuffer.memHandle);
 
         if (!frameLooksGood) {
             return EvsResult::UNDERLYING_SERVICE_ERROR;
         }
+#endif
     }
 
     return EvsResult::OK;
 }
 
-
-Return<EvsResult> EvsDisplay::returnTargetBufferForDisplay(const BufferDesc_1_0& buffer)  {
+Return<EvsResult> EvsDisplay::returnTargetBufferForDisplay(const V1_0::BufferDesc& buffer) {
     return returnTargetBufferForDisplayImpl(buffer.bufferId, buffer.memHandle);
 }
 
-
 Return<void> EvsDisplay::getDisplayInfo_1_1(getDisplayInfo_1_1_cb _info_cb) {
     if (mDisplayProxy != nullptr) {
         return mDisplayProxy->getDisplayInfo(mDisplayId, _info_cb);
     } else {
         HwDisplayConfig nullConfig;
-        HwDisplayState  nullState;
+        HwDisplayState nullState;
         _info_cb(nullConfig, nullState);
-        return Void();
+        return {};
     }
 }
 
-
-} // namespace implementation
-} // namespace V1_1
-} // namespace evs
-} // namespace automotive
-} // namespace hardware
-} // namespace android
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
diff --git a/automotive/evs/1.1/default/EvsDisplay.h b/automotive/evs/1.1/default/EvsDisplay.h
index 9b2ed90..b2ec3e8 100644
--- a/automotive/evs/1.1/default/EvsDisplay.h
+++ b/automotive/evs/1.1/default/EvsDisplay.h
@@ -17,64 +17,48 @@
 #ifndef ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSDISPLAY_H
 #define ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSDISPLAY_H
 
-#include <android/hardware/automotive/evs/1.1/IEvsDisplay.h>
+#include "GlWrapper.h"
+
 #include <android/frameworks/automotive/display/1.0/IAutomotiveDisplayProxyService.h>
+#include <android/hardware/automotive/evs/1.1/IEvsDisplay.h>
 #include <ui/GraphicBuffer.h>
 
-using ::android::hardware::automotive::evs::V1_1::IEvsDisplay;
-using ::android::hardware::automotive::evs::V1_0::DisplayDesc;
-using ::android::hardware::automotive::evs::V1_0::DisplayState;
-using ::android::hardware::automotive::evs::V1_0::EvsResult;
-using BufferDesc_1_0 = ::android::hardware::automotive::evs::V1_0::BufferDesc;
-using android::frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService;
-
-namespace android {
-namespace hardware {
-namespace automotive {
-namespace evs {
-namespace V1_1 {
-namespace implementation {
-
+namespace android::hardware::automotive::evs::V1_1::implementation {
 
 class EvsDisplay : public IEvsDisplay {
-public:
+  public:
     // Methods from ::android::hardware::automotive::evs::V1_0::IEvsDisplay follow.
-    Return<void>         getDisplayInfo(getDisplayInfo_cb _hidl_cb)  override;
-    Return<EvsResult>    setDisplayState(DisplayState state)  override;
-    Return<DisplayState> getDisplayState()  override;
-    Return<void>         getTargetBuffer(getTargetBuffer_cb _hidl_cb)  override;
-    Return<EvsResult>    returnTargetBufferForDisplay(const BufferDesc_1_0& buffer)  override;
+    Return<void> getDisplayInfo(getDisplayInfo_cb _hidl_cb) override;
+    Return<V1_0::EvsResult> setDisplayState(V1_0::DisplayState state) override;
+    Return<V1_0::DisplayState> getDisplayState() override;
+    Return<void> getTargetBuffer(getTargetBuffer_cb _hidl_cb) override;
+    Return<V1_0::EvsResult> returnTargetBufferForDisplay(const V1_0::BufferDesc& buffer) override;
 
     // Methods from ::android::hardware::automotive::evs::V1_1::IEvsDisplay follow.
-    Return<void>         getDisplayInfo_1_1(getDisplayInfo_1_1_cb _info_cb) override;
+    Return<void> getDisplayInfo_1_1(getDisplayInfo_1_1_cb _info_cb) override;
 
     // Implementation details
     EvsDisplay();
-    EvsDisplay(sp<IAutomotiveDisplayProxyService> pDisplayProxy, uint64_t displayId);
+    EvsDisplay(
+            sp<frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService> pDisplayProxy,
+            uint64_t displayId);
     virtual ~EvsDisplay() override;
 
-    void forceShutdown();   // This gets called if another caller "steals" ownership of the display
-    Return<EvsResult> returnTargetBufferForDisplayImpl(const uint32_t bufferId,
-                                                       const buffer_handle_t memHandle);
+    void forceShutdown();  // This gets called if another caller "steals" ownership of the display
+    Return<V1_0::EvsResult> returnTargetBufferForDisplayImpl(const uint32_t bufferId,
+                                                             const buffer_handle_t memHandle);
 
-private:
-    DisplayDesc     mInfo           = {};
-    BufferDesc_1_0  mBuffer         = {};       // A graphics buffer into which we'll store images
-
-    bool            mFrameBusy      = false;    // A flag telling us our buffer is in use
-    DisplayState    mRequestedState = DisplayState::NOT_VISIBLE;
-
-    std::mutex      mAccessLock;
-
-    sp<IAutomotiveDisplayProxyService> mDisplayProxy;
-    uint64_t                           mDisplayId;
+  private:
+    V1_0::DisplayDesc mInfo = {};
+    V1_0::BufferDesc mBuffer = {};  // A graphics buffer into which we'll store images
+    V1_0::DisplayState mRequestedState = V1_0::DisplayState::NOT_VISIBLE;
+    bool mFrameBusy = false;  // A flag telling us our buffer is in use
+    std::mutex mAccessLock;
+    sp<frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService> mDisplayProxy;
+    uint64_t mDisplayId;
+    std::unique_ptr<GlWrapper> mGlWrapper;
 };
 
-} // namespace implementation
-} // namespace V1_1
-} // namespace evs
-} // namespace automotive
-} // namespace hardware
-} // namespace android
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
 
 #endif  // ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSDISPLAY_H
diff --git a/automotive/evs/1.1/default/EvsEnumerator.cpp b/automotive/evs/1.1/default/EvsEnumerator.cpp
index d066471..b84268a 100644
--- a/automotive/evs/1.1/default/EvsEnumerator.cpp
+++ b/automotive/evs/1.1/default/EvsEnumerator.cpp
@@ -14,184 +14,171 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.automotive.evs@1.1-service"
-
 #include "EvsEnumerator.h"
 #include "EvsCamera.h"
 #include "EvsDisplay.h"
 #include "EvsUltrasonicsArray.h"
 
-namespace android {
-namespace hardware {
-namespace automotive {
-namespace evs {
-namespace V1_1 {
-namespace implementation {
+using android::frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService;
+using android::hardware::automotive::evs::V1_0::EvsResult;
 
+namespace android::hardware::automotive::evs::V1_1::implementation {
+
+namespace evs_v1_0 = ::android::hardware::automotive::evs::V1_0;
 
 // NOTE:  All members values are static so that all clients operate on the same state
 //        That is to say, this is effectively a singleton despite the fact that HIDL
 //        constructs a new instance for each client.
-std::list<EvsEnumerator::CameraRecord>              EvsEnumerator::sCameraList;
-wp<EvsDisplay>                                      EvsEnumerator::sActiveDisplay;
-unique_ptr<ConfigManager>                           EvsEnumerator::sConfigManager;
-sp<IAutomotiveDisplayProxyService>                  EvsEnumerator::sDisplayProxyService;
-std::unordered_map<uint8_t, uint64_t>               EvsEnumerator::sDisplayPortList;
-std::list<EvsEnumerator::UltrasonicsArrayRecord>    EvsEnumerator::sUltrasonicsArrayRecordList;
+std::list<EvsEnumerator::CameraRecord> EvsEnumerator::sCameraList;
+wp<EvsDisplay> EvsEnumerator::sActiveDisplay;
+std::unique_ptr<ConfigManager> EvsEnumerator::sConfigManager;
+sp<IAutomotiveDisplayProxyService> EvsEnumerator::sDisplayProxyService;
+std::unordered_map<uint8_t, uint64_t> EvsEnumerator::sDisplayPortList;
+std::list<EvsEnumerator::UltrasonicsArrayRecord> EvsEnumerator::sUltrasonicsArrayRecordList;
+uint64_t EvsEnumerator::sInternalDisplayId;
 
-EvsEnumerator::EvsEnumerator(sp<IAutomotiveDisplayProxyService> windowService) {
-    ALOGD("EvsEnumerator created");
+EvsEnumerator::EvsEnumerator(sp<IAutomotiveDisplayProxyService>& windowService) {
+    ALOGD("%s", __FUNCTION__);
 
     // Add sample camera data to our list of cameras
     // In a real driver, this would be expected to can the available hardware
     sConfigManager =
-        ConfigManager::Create("/vendor/etc/automotive/evs/evs_default_configuration.xml");
+            ConfigManager::Create("/vendor/etc/automotive/evs/evs_default_configuration.xml");
 
     // Add available cameras
     for (auto v : sConfigManager->getCameraList()) {
-        sCameraList.emplace_back(v.c_str());
+        CameraRecord rec(v.data());
+        std::unique_ptr<ConfigManager::CameraInfo>& pInfo = sConfigManager->getCameraInfo(v);
+        if (pInfo) {
+            rec.desc.metadata.setToExternal(reinterpret_cast<uint8_t*>(pInfo->characteristics),
+                                            get_camera_metadata_size(pInfo->characteristics));
+        }
+        sCameraList.push_back(std::move(rec));
     }
 
-    if (sDisplayProxyService == nullptr) {
+    if (!sDisplayProxyService) {
         /* sets a car-window service handle */
         sDisplayProxyService = windowService;
     }
 
     // Add available displays
-    if (sDisplayProxyService != nullptr) {
+    if (sDisplayProxyService) {
         // Get a display ID list.
-        sDisplayProxyService->getDisplayIdList([](const auto& displayIds) {
-            for (const auto& id : displayIds) {
-                const auto port = id & 0xF;
-                sDisplayPortList.insert_or_assign(port, id);
+        auto status = sDisplayProxyService->getDisplayIdList([](const auto& displayIds) {
+            if (displayIds.size() > 0) {
+                sInternalDisplayId = displayIds[0];
+                for (const auto& id : displayIds) {
+                    const auto port = id & 0xF;
+                    sDisplayPortList.insert_or_assign(port, id);
+                }
             }
         });
+
+        if (!status.isOk()) {
+            ALOGE("Failed to read a display list");
+        }
     }
 
     // Add ultrasonics array desc.
-    sUltrasonicsArrayRecordList.emplace_back(
-            EvsUltrasonicsArray::GetMockArrayDesc("front_array"));
+    sUltrasonicsArrayRecordList.emplace_back(EvsUltrasonicsArray::GetMockArrayDesc("front_array"));
 }
 
-
 // Methods from ::android::hardware::automotive::evs::V1_0::IEvsEnumerator follow.
-Return<void> EvsEnumerator::getCameraList(getCameraList_cb _hidl_cb)  {
-    ALOGD("getCameraList");
+Return<void> EvsEnumerator::getCameraList(getCameraList_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
 
-    const unsigned numCameras = sCameraList.size();
+    const auto numCameras = sCameraList.size();
 
     // Build up a packed array of CameraDesc for return
     // NOTE:  Only has to live until the callback returns
-    std::vector<CameraDesc_1_0> descriptions;
+    std::vector<evs_v1_0::CameraDesc> descriptions;
     descriptions.reserve(numCameras);
     for (const auto& cam : sCameraList) {
-        descriptions.push_back( cam.desc.v1 );
+        descriptions.push_back(cam.desc.v1);
     }
 
     // Encapsulate our camera descriptions in the HIDL vec type
-    hidl_vec<CameraDesc_1_0> hidlCameras(descriptions);
+    hidl_vec<evs_v1_0::CameraDesc> hidlCameras(descriptions);
 
     // Send back the results
     ALOGD("reporting %zu cameras available", hidlCameras.size());
     _hidl_cb(hidlCameras);
-
-    // HIDL convention says we return Void if we sent our result back via callback
-    return Void();
+    return {};
 }
 
-
-Return<sp<IEvsCamera_1_0>> EvsEnumerator::openCamera(const hidl_string& cameraId) {
-    ALOGD("openCamera");
+Return<sp<evs_v1_0::IEvsCamera>> EvsEnumerator::openCamera(const hidl_string& cameraId) {
+    ALOGD("%s", __FUNCTION__);
 
     // Find the named camera
-    CameraRecord *pRecord = nullptr;
-    for (auto &&cam : sCameraList) {
-        if (cam.desc.v1.cameraId == cameraId) {
-            // Found a match!
-            pRecord = &cam;
-            break;
-        }
-    }
-
-    // Is this a recognized camera id?
-    if (!pRecord) {
+    auto it = std::find_if(sCameraList.begin(), sCameraList.end(), [&cameraId](const auto& cam) {
+        return cameraId == cam.desc.v1.cameraId;
+    });
+    if (it == sCameraList.end()) {
         ALOGE("Requested camera %s not found", cameraId.c_str());
         return nullptr;
     }
 
     // Has this camera already been instantiated by another caller?
-    sp<EvsCamera> pActiveCamera = pRecord->activeInstance.promote();
+    sp<EvsCamera> pActiveCamera = it->activeInstance.promote();
     if (pActiveCamera != nullptr) {
         ALOGW("Killing previous camera because of new caller");
         closeCamera(pActiveCamera);
     }
 
     // Construct a camera instance for the caller
-    if (sConfigManager == nullptr) {
+    if (!sConfigManager) {
         pActiveCamera = EvsCamera::Create(cameraId.c_str());
     } else {
-        pActiveCamera = EvsCamera::Create(cameraId.c_str(),
-                                          sConfigManager->getCameraInfo(cameraId));
+        pActiveCamera =
+                EvsCamera::Create(cameraId.c_str(), sConfigManager->getCameraInfo(cameraId));
     }
-    pRecord->activeInstance = pActiveCamera;
-    if (pActiveCamera == nullptr) {
+    it->activeInstance = pActiveCamera;
+    if (!pActiveCamera) {
         ALOGE("Failed to allocate new EvsCamera object for %s\n", cameraId.c_str());
     }
 
     return pActiveCamera;
 }
 
+Return<void> EvsEnumerator::closeCamera(const ::android::sp<evs_v1_0::IEvsCamera>& pCamera) {
+    ALOGD("%s", __FUNCTION__);
 
-Return<void> EvsEnumerator::closeCamera(const ::android::sp<IEvsCamera_1_0>& pCamera) {
-    ALOGD("closeCamera");
-
-    auto pCamera_1_1 = IEvsCamera_1_1::castFrom(pCamera).withDefault(nullptr);
-    if (pCamera_1_1 == nullptr) {
+    auto pCamera_1_1 = IEvsCamera::castFrom(pCamera).withDefault(nullptr);
+    if (!pCamera_1_1) {
         ALOGE("Ignoring call to closeCamera with null camera ptr");
-        return Void();
+        return {};
     }
 
     // Get the camera id so we can find it in our list
     std::string cameraId;
-    pCamera_1_1->getCameraInfo_1_1([&cameraId](CameraDesc desc) {
-                               cameraId = desc.v1.cameraId;
-                           }
-    );
+    pCamera_1_1->getCameraInfo_1_1([&cameraId](CameraDesc desc) { cameraId = desc.v1.cameraId; });
 
     // Find the named camera
-    CameraRecord *pRecord = nullptr;
-    for (auto &&cam : sCameraList) {
-        if (cam.desc.v1.cameraId == cameraId) {
-            // Found a match!
-            pRecord = &cam;
-            break;
-        }
+    auto it = std::find_if(sCameraList.begin(), sCameraList.end(), [&cameraId](const auto& cam) {
+        return cameraId == cam.desc.v1.cameraId;
+    });
+    if (it == sCameraList.end()) {
+        ALOGE("Ignores a request to close unknown camera, %s", cameraId.data());
+        return {};
     }
 
-    // Is the display being destroyed actually the one we think is active?
-    if (!pRecord) {
-        ALOGE("Asked to close a camera who's name isn't recognized");
+    sp<EvsCamera> pActiveCamera = it->activeInstance.promote();
+    if (!pActiveCamera) {
+        ALOGE("Somehow a camera is being destroyed when the enumerator didn't know one existed");
+    } else if (pActiveCamera != pCamera_1_1) {
+        // This can happen if the camera was aggressively reopened, orphaning this previous instance
+        ALOGW("Ignoring close of previously orphaned camera - why did a client steal?");
     } else {
-        sp<EvsCamera> pActiveCamera = pRecord->activeInstance.promote();
-
-        if (pActiveCamera == nullptr) {
-            ALOGE("Somehow a camera is being destroyed when the enumerator didn't know one existed");
-        } else if (pActiveCamera != pCamera_1_1) {
-            // This can happen if the camera was aggressively reopened, orphaning this previous instance
-            ALOGW("Ignoring close of previously orphaned camera - why did a client steal?");
-        } else {
-            // Drop the active camera
-            pActiveCamera->forceShutdown();
-            pRecord->activeInstance = nullptr;
-        }
+        // Drop the active camera
+        pActiveCamera->forceShutdown();
+        it->activeInstance = nullptr;
     }
 
-    return Void();
+    return {};
 }
 
-
-Return<sp<IEvsDisplay_1_0>> EvsEnumerator::openDisplay() {
-    ALOGD("openDisplay");
+Return<sp<V1_0::IEvsDisplay>> EvsEnumerator::openDisplay() {
+    ALOGD("%s", __FUNCTION__);
 
     // If we already have a display active, then we need to shut it down so we can
     // give exclusive access to the new caller.
@@ -202,28 +189,25 @@
     }
 
     // Create a new display interface and return it
-    pActiveDisplay = new EvsDisplay();
+    pActiveDisplay = new EvsDisplay(sDisplayProxyService, sInternalDisplayId);
     sActiveDisplay = pActiveDisplay;
 
     ALOGD("Returning new EvsDisplay object %p", pActiveDisplay.get());
     return pActiveDisplay;
 }
 
-
 Return<void> EvsEnumerator::getDisplayIdList(getDisplayIdList_cb _list_cb) {
     hidl_vec<uint8_t> ids;
-
     ids.resize(sDisplayPortList.size());
+
     unsigned i = 0;
-    for (const auto& [port, id] : sDisplayPortList) {
-        ids[i++] = port;
-    }
+    std::for_each(sDisplayPortList.begin(), sDisplayPortList.end(),
+                  [&](const auto& element) { ids[i++] = element.first; });
 
     _list_cb(ids);
-    return Void();
+    return {};
 }
 
-
 Return<sp<IEvsDisplay>> EvsEnumerator::openDisplay_1_1(uint8_t port) {
     ALOGD("%s", __FUNCTION__);
 
@@ -243,10 +227,8 @@
     return pActiveDisplay;
 }
 
-
-
-Return<void> EvsEnumerator::closeDisplay(const ::android::sp<IEvsDisplay_1_0>& pDisplay) {
-    ALOGD("closeDisplay");
+Return<void> EvsEnumerator::closeDisplay(const ::android::sp<V1_0::IEvsDisplay>& pDisplay) {
+    ALOGD("%s", __FUNCTION__);
 
     // Do we still have a display object we think should be active?
     sp<EvsDisplay> pActiveDisplay = sActiveDisplay.promote();
@@ -260,123 +242,111 @@
         sActiveDisplay = nullptr;
     }
 
-    return Void();
+    return {};
 }
 
-
-Return<DisplayState> EvsEnumerator::getDisplayState()  {
-    ALOGD("getDisplayState");
+Return<V1_0::DisplayState> EvsEnumerator::getDisplayState() {
+    ALOGD("%s", __FUNCTION__);
 
     // Do we still have a display object we think should be active?
     sp<IEvsDisplay> pActiveDisplay = sActiveDisplay.promote();
     if (pActiveDisplay != nullptr) {
         return pActiveDisplay->getDisplayState();
     } else {
-        return DisplayState::NOT_OPEN;
+        return V1_0::DisplayState::NOT_OPEN;
     }
 }
 
-
 // Methods from ::android::hardware::automotive::evs::V1_1::IEvsEnumerator follow.
-Return<void> EvsEnumerator::getCameraList_1_1(getCameraList_1_1_cb _hidl_cb)  {
-    ALOGD("getCameraList");
+Return<void> EvsEnumerator::getCameraList_1_1(getCameraList_1_1_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
 
-    const unsigned numCameras = sCameraList.size();
+    const auto numCameras = sCameraList.size();
 
     // Build up a packed array of CameraDesc for return
     // NOTE:  Only has to live until the callback returns
-    std::vector<CameraDesc_1_1> descriptions;
+    std::vector<CameraDesc> descriptions;
     descriptions.reserve(numCameras);
-    for (const auto& cam : sCameraList) {
-        descriptions.push_back( cam.desc );
-    }
+    std::for_each(sCameraList.begin(), sCameraList.end(),
+                  [&](const auto& cam) { descriptions.push_back(cam.desc); });
 
     // Encapsulate our camera descriptions in the HIDL vec type
-    hidl_vec<CameraDesc_1_1> hidlCameras(descriptions);
+    hidl_vec<CameraDesc> hidlCameras(descriptions);
 
     // Send back the results
     ALOGD("reporting %zu cameras available", hidlCameras.size());
     _hidl_cb(hidlCameras);
-
-    // HIDL convention says we return Void if we sent our result back via callback
-    return Void();
+    return {};
 }
 
-Return<sp<IEvsCamera_1_1>>
-EvsEnumerator::openCamera_1_1(const hidl_string& cameraId,
-                              const Stream& streamCfg) {
-    // Find the named camera
-    CameraRecord *pRecord = nullptr;
-    for (auto &&cam : sCameraList) {
-        if (cam.desc.v1.cameraId == cameraId) {
-            // Found a match!
-            pRecord = &cam;
-            break;
-        }
-    }
+Return<sp<IEvsCamera>> EvsEnumerator::openCamera_1_1(const hidl_string& cameraId,
+                                                     const Stream& streamCfg) {
+    ALOGD("%s", __FUNCTION__);
 
-    // Is this a recognized camera id?
-    if (!pRecord) {
+    // Find the named camera
+    auto it = std::find_if(sCameraList.begin(), sCameraList.end(), [&cameraId](const auto& cam) {
+        return cameraId == cam.desc.v1.cameraId;
+    });
+    if (it == sCameraList.end()) {
         ALOGE("Requested camera %s not found", cameraId.c_str());
         return nullptr;
     }
 
     // Has this camera already been instantiated by another caller?
-    sp<EvsCamera> pActiveCamera = pRecord->activeInstance.promote();
+    sp<EvsCamera> pActiveCamera = it->activeInstance.promote();
     if (pActiveCamera != nullptr) {
         ALOGW("Killing previous camera because of new caller");
         closeCamera(pActiveCamera);
     }
 
     // Construct a camera instance for the caller
-    if (sConfigManager == nullptr) {
+    if (!sConfigManager) {
         pActiveCamera = EvsCamera::Create(cameraId.c_str());
     } else {
-        pActiveCamera = EvsCamera::Create(cameraId.c_str(),
-                                          sConfigManager->getCameraInfo(cameraId),
+        pActiveCamera = EvsCamera::Create(cameraId.c_str(), sConfigManager->getCameraInfo(cameraId),
                                           &streamCfg);
     }
 
-    pRecord->activeInstance = pActiveCamera;
-    if (pActiveCamera == nullptr) {
+    it->activeInstance = pActiveCamera;
+    if (!pActiveCamera) {
         ALOGE("Failed to allocate new EvsCamera object for %s\n", cameraId.c_str());
     }
 
     return pActiveCamera;
 }
 
-
 EvsEnumerator::CameraRecord* EvsEnumerator::findCameraById(const std::string& cameraId) {
-    // Find the named camera
-    CameraRecord *pRecord = nullptr;
-    for (auto &&cam : sCameraList) {
-        if (cam.desc.v1.cameraId == cameraId) {
-            // Found a match!
-            pRecord = &cam;
-            break;
-        }
-    }
+    ALOGD("%s", __FUNCTION__);
 
-    return pRecord;
+    // Find the named camera
+    auto it = std::find_if(sCameraList.begin(), sCameraList.end(), [&cameraId](const auto& cam) {
+        return cameraId == cam.desc.v1.cameraId;
+    });
+    return (it != sCameraList.end()) ? &*it : nullptr;
 }
 
 EvsEnumerator::UltrasonicsArrayRecord* EvsEnumerator::findUltrasonicsArrayById(
         const std::string& ultrasonicsArrayId) {
-    auto recordIt = std::find_if(
-            sUltrasonicsArrayRecordList.begin(), sUltrasonicsArrayRecordList.end(),
-                    [&ultrasonicsArrayId](const UltrasonicsArrayRecord& record) {
-                            return ultrasonicsArrayId == record.desc.ultrasonicsArrayId;});
+    ALOGD("%s", __FUNCTION__);
+
+    auto recordIt =
+            std::find_if(sUltrasonicsArrayRecordList.begin(), sUltrasonicsArrayRecordList.end(),
+                         [&ultrasonicsArrayId](const UltrasonicsArrayRecord& record) {
+                             return ultrasonicsArrayId == record.desc.ultrasonicsArrayId;
+                         });
 
     return (recordIt != sUltrasonicsArrayRecordList.end()) ? &*recordIt : nullptr;
 }
 
 Return<void> EvsEnumerator::getUltrasonicsArrayList(getUltrasonicsArrayList_cb _hidl_cb) {
+    ALOGD("%s", __FUNCTION__);
+
     hidl_vec<UltrasonicsArrayDesc> desc;
     desc.resize(sUltrasonicsArrayRecordList.size());
 
     // Copy over desc from sUltrasonicsArrayRecordList.
     for (auto p = std::make_pair(sUltrasonicsArrayRecordList.begin(), desc.begin());
-            p.first != sUltrasonicsArrayRecordList.end(); p.first++, p.second++) {
+         p.first != sUltrasonicsArrayRecordList.end(); p.first++, p.second++) {
         *p.second = p.first->desc;
     }
 
@@ -385,11 +355,13 @@
     _hidl_cb(desc);
 
     // HIDL convention says we return Void if we sent our result back via callback
-    return Void();
+    return {};
 }
 
 Return<sp<IEvsUltrasonicsArray>> EvsEnumerator::openUltrasonicsArray(
         const hidl_string& ultrasonicsArrayId) {
+    ALOGD("%s", __FUNCTION__);
+
     // Find the named ultrasonic array.
     UltrasonicsArrayRecord* pRecord = findUltrasonicsArrayById(ultrasonicsArrayId);
 
@@ -419,10 +391,11 @@
 
 Return<void> EvsEnumerator::closeUltrasonicsArray(
         const sp<IEvsUltrasonicsArray>& pEvsUltrasonicsArray) {
+    ALOGD("%s", __FUNCTION__);
 
     if (pEvsUltrasonicsArray.get() == nullptr) {
         ALOGE("Ignoring call to closeUltrasonicsArray with null ultrasonics array");
-        return Void();
+        return {};
     }
 
     // Get the ultrasonics array id so we can find it in our list.
@@ -435,7 +408,7 @@
     UltrasonicsArrayRecord* pRecord = findUltrasonicsArrayById(ultrasonicsArrayId);
     if (!pRecord) {
         ALOGE("Asked to close a ultrasonics array whose name isnt not found");
-        return Void();
+        return {};
     }
 
     sp<EvsUltrasonicsArray> pActiveUltrasonicsArray = pRecord->activeInstance.promote();
@@ -453,12 +426,7 @@
         pRecord->activeInstance = nullptr;
     }
 
-    return Void();
+    return {};
 }
 
-} // namespace implementation
-} // namespace V1_1
-} // namespace evs
-} // namespace automotive
-} // namespace hardware
-} // namespace android
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
diff --git a/automotive/evs/1.1/default/EvsEnumerator.h b/automotive/evs/1.1/default/EvsEnumerator.h
index d80124b..513fc8d 100644
--- a/automotive/evs/1.1/default/EvsEnumerator.h
+++ b/automotive/evs/1.1/default/EvsEnumerator.h
@@ -17,56 +17,41 @@
 #ifndef ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSCAMERAENUMERATOR_H
 #define ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSCAMERAENUMERATOR_H
 
-#include <android/hardware/automotive/evs/1.1/IEvsEnumerator.h>
+#include "ConfigManager.h"
+
+#include <android/frameworks/automotive/display/1.0/IAutomotiveDisplayProxyService.h>
 #include <android/hardware/automotive/evs/1.1/IEvsCamera.h>
 #include <android/hardware/automotive/evs/1.1/IEvsDisplay.h>
-#include <android/frameworks/automotive/display/1.0/IAutomotiveDisplayProxyService.h>
+#include <android/hardware/automotive/evs/1.1/IEvsEnumerator.h>
 #include <android/hardware/automotive/evs/1.1/IEvsUltrasonicsArray.h>
 
 #include <list>
 
-#include "ConfigManager.h"
+namespace android::hardware::automotive::evs::V1_1::implementation {
 
-using ::android::hardware::automotive::evs::V1_0::EvsResult;
-using ::android::hardware::automotive::evs::V1_0::DisplayState;
-using IEvsCamera_1_0 = ::android::hardware::automotive::evs::V1_0::IEvsCamera;
-using IEvsCamera_1_1 = ::android::hardware::automotive::evs::V1_1::IEvsCamera;
-using CameraDesc_1_0 = ::android::hardware::automotive::evs::V1_0::CameraDesc;
-using CameraDesc_1_1 = ::android::hardware::automotive::evs::V1_1::CameraDesc;
-using IEvsDisplay_1_0  = ::android::hardware::automotive::evs::V1_0::IEvsDisplay;
-using IEvsDisplay_1_1  = ::android::hardware::automotive::evs::V1_1::IEvsDisplay;
-using android::frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService;
+namespace evs_v1_0 = ::android::hardware::automotive::evs::V1_0;
 
-namespace android {
-namespace hardware {
-namespace automotive {
-namespace evs {
-namespace V1_1 {
-namespace implementation {
-
-
-class EvsCamera;    // from EvsCamera.h
-class EvsDisplay;   // from EvsDisplay.h
+class EvsCamera;            // from EvsCamera.h
+class EvsDisplay;           // from EvsDisplay.h
 class EvsUltrasonicsArray;  // from EvsUltrasonicsArray.h
 
-
 class EvsEnumerator : public IEvsEnumerator {
-public:
+  public:
     // Methods from ::android::hardware::automotive::evs::V1_0::IEvsEnumerator follow.
-    Return<void>                getCameraList(getCameraList_cb _hidl_cb)  override;
-    Return<sp<IEvsCamera_1_0>>  openCamera(const hidl_string& cameraId) override;
-    Return<void>                closeCamera(const ::android::sp<IEvsCamera_1_0>& carCamera)  override;
-    Return<sp<IEvsDisplay_1_0>> openDisplay()  override;
-    Return<void>                closeDisplay(const ::android::sp<IEvsDisplay_1_0>& display)  override;
-    Return<DisplayState>        getDisplayState()  override;
+    Return<void> getCameraList(getCameraList_cb _hidl_cb) override;
+    Return<sp<evs_v1_0::IEvsCamera>> openCamera(const hidl_string& cameraId) override;
+    Return<void> closeCamera(const ::android::sp<evs_v1_0::IEvsCamera>& carCamera) override;
+    Return<sp<evs_v1_0::IEvsDisplay>> openDisplay() override;
+    Return<void> closeDisplay(const ::android::sp<evs_v1_0::IEvsDisplay>& display) override;
+    Return<V1_0::DisplayState> getDisplayState() override;
 
     // Methods from ::android::hardware::automotive::evs::V1_1::IEvsEnumerator follow.
-    Return<void> getCameraList_1_1(getCameraList_1_1_cb _hidl_cb)  override;
-    Return<sp<IEvsCamera_1_1>>  openCamera_1_1(const hidl_string& cameraId,
-                                               const Stream& streamCfg) override;
+    Return<void> getCameraList_1_1(getCameraList_1_1_cb _hidl_cb) override;
+    Return<sp<IEvsCamera>> openCamera_1_1(const hidl_string& cameraId,
+                                          const Stream& streamCfg) override;
     Return<bool> isHardware() override { return true; }
-    Return<void>                getDisplayIdList(getDisplayIdList_cb _list_cb) override;
-    Return<sp<IEvsDisplay_1_1>> openDisplay_1_1(uint8_t port) override;
+    Return<void> getDisplayIdList(getDisplayIdList_cb _list_cb) override;
+    Return<sp<IEvsDisplay>> openDisplay_1_1(uint8_t port) override;
     Return<void> getUltrasonicsArrayList(getUltrasonicsArrayList_cb _hidl_cb) override;
     Return<sp<IEvsUltrasonicsArray>> openUltrasonicsArray(
             const hidl_string& ultrasonicsArrayId) override;
@@ -74,49 +59,40 @@
             const ::android::sp<IEvsUltrasonicsArray>& evsUltrasonicsArray) override;
 
     // Implementation details
-    EvsEnumerator(sp<IAutomotiveDisplayProxyService> windowService = nullptr);
+    EvsEnumerator(sp<frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService>&
+                          windowService);
 
-private:
+  private:
     // NOTE:  All members values are static so that all clients operate on the same state
     //        That is to say, this is effectively a singleton despite the fact that HIDL
     //        constructs a new instance for each client.
     struct CameraRecord {
-        CameraDesc_1_1      desc;
-        wp<EvsCamera>       activeInstance;
+        CameraDesc desc;
+        wp<EvsCamera> activeInstance;
 
-        CameraRecord(const char *cameraId) : desc() { desc.v1.cameraId = cameraId; }
+        CameraRecord(const char* cameraId) : desc() { desc.v1.cameraId = cameraId; }
     };
 
     struct UltrasonicsArrayRecord {
         UltrasonicsArrayDesc desc;
         wp<EvsUltrasonicsArray> activeInstance;
 
-        UltrasonicsArrayRecord(const UltrasonicsArrayDesc& arrayDesc) : desc(arrayDesc) {};
+        UltrasonicsArrayRecord(const UltrasonicsArrayDesc& arrayDesc) : desc(arrayDesc){};
     };
 
     static CameraRecord* findCameraById(const std::string& cameraId);
-
-    static std::list<CameraRecord>   sCameraList;
-
+    static std::list<CameraRecord> sCameraList;
     static UltrasonicsArrayRecord* findUltrasonicsArrayById(const std::string& ultrasonicsArrayId);
-
     static std::list<UltrasonicsArrayRecord> sUltrasonicsArrayRecordList;
 
-    // Weak pointer. Object destructs if client dies.
-    static wp<EvsDisplay>            sActiveDisplay;
-
-    static unique_ptr<ConfigManager> sConfigManager;
-
-    static sp<IAutomotiveDisplayProxyService> sDisplayProxyService;
-    static std::unordered_map<uint8_t,
-                              uint64_t> sDisplayPortList;
+    static wp<EvsDisplay> sActiveDisplay;  // Weak pointer. Object destructs if client dies.
+    static uint64_t sInternalDisplayId;
+    static sp<frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService>
+            sDisplayProxyService;
+    static std::unordered_map<uint8_t, uint64_t> sDisplayPortList;
+    static std::unique_ptr<ConfigManager> sConfigManager;
 };
 
-} // namespace implementation
-} // namespace V1_1
-} // namespace evs
-} // namespace automotive
-} // namespace hardware
-} // namespace android
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
 
 #endif  // ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_EVSCAMERAENUMERATOR_H
diff --git a/automotive/evs/1.1/default/EvsUltrasonicsArray.cpp b/automotive/evs/1.1/default/EvsUltrasonicsArray.cpp
index ebd47c6..951937a 100644
--- a/automotive/evs/1.1/default/EvsUltrasonicsArray.cpp
+++ b/automotive/evs/1.1/default/EvsUltrasonicsArray.cpp
@@ -113,10 +113,9 @@
     dataFrameDesc.receiversReadingsCountList = receiversReadingsCountList;
 
     const std::vector<WaveformData> waveformDataList = {
-            {recvIdList[0], { {1000, 0.1f}, {2000, 0.8f} }},
-            {recvIdList[1], { {1000, 0.1f}, {2000, 1.0f} }},
-            {recvIdList[2], { {1000, 0.1f}, {2000, 0.2f}, {4000, 0.2f}, {5000, 0.1f} }}
-    };
+            {recvIdList[0], {{1000, 0.1f}, {2000, 0.8f}}},
+            {recvIdList[1], {{1000, 0.1f}, {2000, 1.0f}}},
+            {recvIdList[2], {{1000, 0.1f}, {2000, 0.2f}, {4000, 0.2f}, {5000, 0.1f}}}};
 
     if (pIMemory.get() == nullptr) {
         return false;
diff --git a/automotive/evs/1.1/default/EvsUltrasonicsArray.h b/automotive/evs/1.1/default/EvsUltrasonicsArray.h
index 88aa600..681f68f 100644
--- a/automotive/evs/1.1/default/EvsUltrasonicsArray.h
+++ b/automotive/evs/1.1/default/EvsUltrasonicsArray.h
@@ -119,7 +119,7 @@
     std::mutex mAccessLock;
     std::vector<DataFrameRecord> mDataFrames GUARDED_BY(mAccessLock);  // Shared memory buffers.
     unsigned mFramesAllowed GUARDED_BY(mAccessLock);  // How many buffers are we currently using.
-    unsigned mFramesInUse GUARDED_BY(mAccessLock);  // How many buffers are currently outstanding.
+    unsigned mFramesInUse GUARDED_BY(mAccessLock);    // How many buffers are currently outstanding.
 
     StreamStateValues mStreamState GUARDED_BY(mAccessLock);
 };
diff --git a/automotive/evs/1.1/default/GlWrapper.cpp b/automotive/evs/1.1/default/GlWrapper.cpp
new file mode 100644
index 0000000..357b67c
--- /dev/null
+++ b/automotive/evs/1.1/default/GlWrapper.cpp
@@ -0,0 +1,450 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "GlWrapper.h"
+
+#include <ui/DisplayMode.h>
+#include <ui/DisplayState.h>
+#include <ui/GraphicBuffer.h>
+
+#include <fcntl.h>
+#include <stdio.h>
+#include <sys/ioctl.h>
+#include <utility>
+
+using android::GraphicBuffer;
+using android::sp;
+
+namespace {
+
+// Defines a default color to clear the screen in RGBA format
+constexpr float kDefaultColorInRgba[] = {0.1f, 0.5f, 0.1f, 1.0f};
+
+// Defines the size of the preview area relative to the entire display
+constexpr float kDisplayAreaRatio = 0.8f;
+
+constexpr const char vertexShaderSource[] =
+        ""
+        "#version 300 es                    \n"
+        "layout(location = 0) in vec4 pos;  \n"
+        "layout(location = 1) in vec2 tex;  \n"
+        "out vec2 uv;                       \n"
+        "void main()                        \n"
+        "{                                  \n"
+        "   gl_Position = pos;              \n"
+        "   uv = tex;                       \n"
+        "}                                  \n";
+
+constexpr const char pixelShaderSource[] =
+        "#version 300 es                    \n"
+        "precision mediump float;           \n"
+        "uniform sampler2D tex;             \n"
+        "in vec2 uv;                        \n"
+        "out vec4 color;                    \n"
+        "void main()                        \n"
+        "{                                  \n"
+        "    vec4 texel = texture(tex, uv); \n"
+        "    color = texel;                 \n"
+        "}                                  \n";
+
+const char* getEGLError(void) {
+    switch (eglGetError()) {
+        case EGL_SUCCESS:
+            return "EGL_SUCCESS";
+        case EGL_NOT_INITIALIZED:
+            return "EGL_NOT_INITIALIZED";
+        case EGL_BAD_ACCESS:
+            return "EGL_BAD_ACCESS";
+        case EGL_BAD_ALLOC:
+            return "EGL_BAD_ALLOC";
+        case EGL_BAD_ATTRIBUTE:
+            return "EGL_BAD_ATTRIBUTE";
+        case EGL_BAD_CONTEXT:
+            return "EGL_BAD_CONTEXT";
+        case EGL_BAD_CONFIG:
+            return "EGL_BAD_CONFIG";
+        case EGL_BAD_CURRENT_SURFACE:
+            return "EGL_BAD_CURRENT_SURFACE";
+        case EGL_BAD_DISPLAY:
+            return "EGL_BAD_DISPLAY";
+        case EGL_BAD_SURFACE:
+            return "EGL_BAD_SURFACE";
+        case EGL_BAD_MATCH:
+            return "EGL_BAD_MATCH";
+        case EGL_BAD_PARAMETER:
+            return "EGL_BAD_PARAMETER";
+        case EGL_BAD_NATIVE_PIXMAP:
+            return "EGL_BAD_NATIVE_PIXMAP";
+        case EGL_BAD_NATIVE_WINDOW:
+            return "EGL_BAD_NATIVE_WINDOW";
+        case EGL_CONTEXT_LOST:
+            return "EGL_CONTEXT_LOST";
+        default:
+            return "Unknown error";
+    }
+}
+
+// Given shader source, load and compile it
+GLuint loadShader(GLenum type, const char* shaderSrc) {
+    // Create the shader object
+    GLuint shader = glCreateShader(type);
+    if (shader == 0) {
+        LOG(ERROR) << "glCreateSharder() failed with error = " << glGetError();
+        return 0;
+    }
+
+    // Load and compile the shader
+    glShaderSource(shader, 1, &shaderSrc, nullptr);
+    glCompileShader(shader);
+
+    // Verify the compilation worked as expected
+    GLint compiled = 0;
+    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+    if (!compiled) {
+        LOG(ERROR) << "Error compiling shader";
+
+        GLint size = 0;
+        glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &size);
+        if (size > 0) {
+            // Get and report the error message
+            char infoLog[size];
+            glGetShaderInfoLog(shader, size, nullptr, infoLog);
+            LOG(ERROR) << "  msg:" << std::endl << infoLog;
+        }
+
+        glDeleteShader(shader);
+        return 0;
+    }
+
+    return shader;
+}
+
+// Create a program object given vertex and pixels shader source
+GLuint buildShaderProgram(const char* vtxSrc, const char* pxlSrc) {
+    GLuint program = glCreateProgram();
+    if (program == 0) {
+        LOG(ERROR) << "Failed to allocate program object";
+        return 0;
+    }
+
+    // Compile the shaders and bind them to this program
+    GLuint vertexShader = loadShader(GL_VERTEX_SHADER, vtxSrc);
+    if (vertexShader == 0) {
+        LOG(ERROR) << "Failed to load vertex shader";
+        glDeleteProgram(program);
+        return 0;
+    }
+    GLuint pixelShader = loadShader(GL_FRAGMENT_SHADER, pxlSrc);
+    if (pixelShader == 0) {
+        LOG(ERROR) << "Failed to load pixel shader";
+        glDeleteProgram(program);
+        glDeleteShader(vertexShader);
+        return 0;
+    }
+    glAttachShader(program, vertexShader);
+    glAttachShader(program, pixelShader);
+
+    // Link the program
+    glLinkProgram(program);
+    GLint linked = 0;
+    glGetProgramiv(program, GL_LINK_STATUS, &linked);
+    if (!linked) {
+        LOG(ERROR) << "Error linking program";
+        GLint size = 0;
+        glGetProgramiv(program, GL_INFO_LOG_LENGTH, &size);
+        if (size > 0) {
+            // Get and report the error message
+            char* infoLog = (char*)malloc(size);
+            glGetProgramInfoLog(program, size, nullptr, infoLog);
+            LOG(ERROR) << "  msg:  " << infoLog;
+            free(infoLog);
+        }
+
+        glDeleteProgram(program);
+        glDeleteShader(vertexShader);
+        glDeleteShader(pixelShader);
+        return 0;
+    }
+
+    return program;
+}
+
+}  // namespace
+
+namespace android::hardware::automotive::evs::V1_1::implementation {
+
+// Main entry point
+bool GlWrapper::initialize(const sp<IAutomotiveDisplayProxyService>& service, uint64_t displayId) {
+    LOG(DEBUG) << __FUNCTION__;
+
+    if (!service) {
+        LOG(WARNING) << "IAutomotiveDisplayProxyService is invalid.";
+        return false;
+    }
+
+    // We will use the first display in the list as the primary.
+    service->getDisplayInfo(displayId, [this](auto dpyConfig, auto dpyState) {
+        ui::DisplayMode* pConfig = reinterpret_cast<ui::DisplayMode*>(dpyConfig.data());
+        mWidth = pConfig->resolution.getWidth();
+        mHeight = pConfig->resolution.getHeight();
+
+        ui::DisplayState* pState = reinterpret_cast<ui::DisplayState*>(dpyState.data());
+        if (pState->orientation != ui::ROTATION_0 && pState->orientation != ui::ROTATION_180) {
+            // rotate
+            std::swap(mWidth, mHeight);
+        }
+
+        LOG(DEBUG) << "Display resolution is " << mWidth << " x " << mHeight;
+    });
+
+    mGfxBufferProducer = service->getIGraphicBufferProducer(displayId);
+    if (mGfxBufferProducer == nullptr) {
+        LOG(ERROR) << "Failed to get IGraphicBufferProducer from IAutomotiveDisplayProxyService.";
+        return false;
+    }
+
+    mSurfaceHolder = getSurfaceFromHGBP(mGfxBufferProducer);
+    if (mSurfaceHolder == nullptr) {
+        LOG(ERROR) << "Failed to get a Surface from HGBP.";
+        return false;
+    }
+
+    mWindow = getNativeWindow(mSurfaceHolder.get());
+    if (mWindow == nullptr) {
+        LOG(ERROR) << "Failed to get a native window from Surface.";
+        return false;
+    }
+
+    // Set up our OpenGL ES context associated with the default display
+    mDisplay = eglGetDisplay(EGL_DEFAULT_DISPLAY);
+    if (mDisplay == EGL_NO_DISPLAY) {
+        LOG(ERROR) << "Failed to get egl display";
+        return false;
+    }
+
+    EGLint major = 3;
+    EGLint minor = 0;
+    if (!eglInitialize(mDisplay, &major, &minor)) {
+        LOG(ERROR) << "Failed to initialize EGL: " << getEGLError();
+        return false;
+    }
+
+    const EGLint config_attribs[] = {
+            // Tag                  Value
+            EGL_RED_SIZE, 8, EGL_GREEN_SIZE, 8, EGL_BLUE_SIZE, 8, EGL_DEPTH_SIZE, 0, EGL_NONE};
+
+    // Pick the default configuration without constraints (is this good enough?)
+    EGLConfig egl_config = {0};
+    EGLint numConfigs = -1;
+    eglChooseConfig(mDisplay, config_attribs, &egl_config, 1, &numConfigs);
+    if (numConfigs != 1) {
+        LOG(ERROR) << "Didn't find a suitable format for our display window";
+        return false;
+    }
+
+    // Create the EGL render target surface
+    mSurface = eglCreateWindowSurface(mDisplay, egl_config, mWindow, nullptr);
+    if (mSurface == EGL_NO_SURFACE) {
+        LOG(ERROR) << "eglCreateWindowSurface failed: " << getEGLError();
+        ;
+        return false;
+    }
+
+    // Create the EGL context
+    // NOTE:  Our shader is (currently at least) written to require version 3, so this
+    //        is required.
+    const EGLint context_attribs[] = {EGL_CONTEXT_CLIENT_VERSION, 3, EGL_NONE};
+    mContext = eglCreateContext(mDisplay, egl_config, EGL_NO_CONTEXT, context_attribs);
+    if (mContext == EGL_NO_CONTEXT) {
+        LOG(ERROR) << "Failed to create OpenGL ES Context: " << getEGLError();
+        return false;
+    }
+
+    // Activate our render target for drawing
+    if (!eglMakeCurrent(mDisplay, mSurface, mSurface, mContext)) {
+        LOG(ERROR) << "Failed to make the OpenGL ES Context current: " << getEGLError();
+        return false;
+    }
+
+    // Create the shader program for our simple pipeline
+    mShaderProgram = buildShaderProgram(vertexShaderSource, pixelShaderSource);
+    if (!mShaderProgram) {
+        LOG(ERROR) << "Failed to build shader program: " << getEGLError();
+        return false;
+    }
+
+    // Create a GL texture that will eventually wrap our externally created texture surface(s)
+    glGenTextures(1, &mTextureMap);
+    if (mTextureMap <= 0) {
+        LOG(ERROR) << "Didn't get a texture handle allocated: " << getEGLError();
+        return false;
+    }
+
+    // Turn off mip-mapping for the created texture surface
+    // (the inbound camera imagery doesn't have MIPs)
+    glBindTexture(GL_TEXTURE_2D, mTextureMap);
+    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    glBindTexture(GL_TEXTURE_2D, 0);
+
+    return true;
+}
+
+void GlWrapper::shutdown() {
+    // Drop our device textures
+    if (mKHRimage != EGL_NO_IMAGE_KHR) {
+        eglDestroyImageKHR(mDisplay, mKHRimage);
+        mKHRimage = EGL_NO_IMAGE_KHR;
+    }
+
+    // Release all GL resources
+    eglMakeCurrent(mDisplay, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
+    eglDestroySurface(mDisplay, mSurface);
+    eglDestroyContext(mDisplay, mContext);
+    eglTerminate(mDisplay);
+    mSurface = EGL_NO_SURFACE;
+    mContext = EGL_NO_CONTEXT;
+    mDisplay = EGL_NO_DISPLAY;
+
+    // Release the window
+    mSurfaceHolder = nullptr;
+}
+
+void GlWrapper::showWindow(sp<IAutomotiveDisplayProxyService>& service, uint64_t id) {
+    if (service != nullptr) {
+        service->showWindow(id);
+    } else {
+        LOG(ERROR) << "IAutomotiveDisplayProxyService is not available.";
+    }
+}
+
+void GlWrapper::hideWindow(sp<IAutomotiveDisplayProxyService>& service, uint64_t id) {
+    if (service != nullptr) {
+        service->hideWindow(id);
+    } else {
+        LOG(ERROR) << "IAutomotiveDisplayProxyService is not available.";
+    }
+}
+
+bool GlWrapper::updateImageTexture(const V1_0::BufferDesc& buffer) {
+    BufferDesc newBuffer = {
+            .buffer =
+                    {
+                            .nativeHandle = buffer.memHandle,
+                    },
+            .pixelSize = buffer.pixelSize,
+            .bufferId = buffer.bufferId,
+    };
+    AHardwareBuffer_Desc* pDesc =
+            reinterpret_cast<AHardwareBuffer_Desc*>(&newBuffer.buffer.description);
+    *pDesc = {
+            .width = buffer.width,
+            .height = buffer.height,
+            .layers = 1,
+            .format = buffer.format,
+            .usage = buffer.usage,
+    };
+    return updateImageTexture(newBuffer);
+}
+
+bool GlWrapper::updateImageTexture(const BufferDesc& aFrame) {
+    // If we haven't done it yet, create an "image" object to wrap the gralloc buffer
+    if (mKHRimage == EGL_NO_IMAGE_KHR) {
+        // create a temporary GraphicBuffer to wrap the provided handle
+        const AHardwareBuffer_Desc* pDesc =
+                reinterpret_cast<const AHardwareBuffer_Desc*>(&aFrame.buffer.description);
+        sp<GraphicBuffer> pGfxBuffer = new GraphicBuffer(
+                pDesc->width, pDesc->height, pDesc->format, pDesc->layers, pDesc->usage,
+                pDesc->stride,
+                const_cast<native_handle_t*>(aFrame.buffer.nativeHandle.getNativeHandle()),
+                false /* keep ownership */
+        );
+        if (pGfxBuffer.get() == nullptr) {
+            LOG(ERROR) << "Failed to allocate GraphicBuffer to wrap our native handle";
+            return false;
+        }
+
+        // Get a GL compatible reference to the graphics buffer we've been given
+        EGLint eglImageAttributes[] = {EGL_IMAGE_PRESERVED_KHR, EGL_TRUE, EGL_NONE};
+        EGLClientBuffer cbuf = static_cast<EGLClientBuffer>(pGfxBuffer->getNativeBuffer());
+        mKHRimage = eglCreateImageKHR(mDisplay, EGL_NO_CONTEXT, EGL_NATIVE_BUFFER_ANDROID, cbuf,
+                                      eglImageAttributes);
+        if (mKHRimage == EGL_NO_IMAGE_KHR) {
+            LOG(ERROR) << "Error creating EGLImage: " << getEGLError();
+            return false;
+        }
+
+        // Update the texture handle we already created to refer to this gralloc buffer
+        glActiveTexture(GL_TEXTURE0);
+        glBindTexture(GL_TEXTURE_2D, mTextureMap);
+        glEGLImageTargetTexture2DOES(GL_TEXTURE_2D, static_cast<GLeglImageOES>(mKHRimage));
+    }
+
+    return true;
+}
+
+void GlWrapper::renderImageToScreen() {
+    // Set the viewport
+    glViewport(0, 0, mWidth, mHeight);
+
+    // Clear the color buffer
+    glClearColor(kDefaultColorInRgba[0], kDefaultColorInRgba[1],
+                 kDefaultColorInRgba[2], kDefaultColorInRgba[3]);
+    glClear(GL_COLOR_BUFFER_BIT);
+
+    // Select our screen space simple texture shader
+    glUseProgram(mShaderProgram);
+
+    // Bind the texture and assign it to the shader's sampler
+    glActiveTexture(GL_TEXTURE0);
+    glBindTexture(GL_TEXTURE_2D, mTextureMap);
+    GLint sampler = glGetUniformLocation(mShaderProgram, "tex");
+    glUniform1i(sampler, 0);
+
+    // We want our image to show up opaque regardless of alpha values
+    glDisable(GL_BLEND);
+
+    // Draw a rectangle on the screen
+    GLfloat vertsCarPos[] = {
+            -kDisplayAreaRatio,  kDisplayAreaRatio, 0.0f,  // left top in window space
+             kDisplayAreaRatio,  kDisplayAreaRatio, 0.0f,  // right top
+            -kDisplayAreaRatio, -kDisplayAreaRatio, 0.0f,  // left bottom
+             kDisplayAreaRatio, -kDisplayAreaRatio, 0.0f   // right bottom
+    };
+
+    // NOTE:  We didn't flip the image in the texture, so V=0 is actually the top of the image
+    GLfloat vertsCarTex[] = {
+            0.0f, 0.0f,  // left top
+            1.0f, 0.0f,  // right top
+            0.0f, 1.0f,  // left bottom
+            1.0f, 1.0f   // right bottom
+    };
+    glVertexAttribPointer(0, 3, GL_FLOAT, GL_FALSE, 0, vertsCarPos);
+    glVertexAttribPointer(1, 2, GL_FLOAT, GL_FALSE, 0, vertsCarTex);
+    glEnableVertexAttribArray(0);
+    glEnableVertexAttribArray(1);
+
+    glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+
+    // Clean up and flip the rendered result to the front so it is visible
+    glDisableVertexAttribArray(0);
+    glDisableVertexAttribArray(1);
+
+    glFinish();
+
+    eglSwapBuffers(mDisplay, mSurface);
+}
+
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
diff --git a/automotive/evs/1.1/default/GlWrapper.h b/automotive/evs/1.1/default/GlWrapper.h
new file mode 100644
index 0000000..44c206f
--- /dev/null
+++ b/automotive/evs/1.1/default/GlWrapper.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_DISPLAY_GLWRAPPER_H
+#define ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_DISPLAY_GLWRAPPER_H
+
+#include <android-base/logging.h>
+#include <android/frameworks/automotive/display/1.0/IAutomotiveDisplayProxyService.h>
+#include <android/hardware/automotive/evs/1.1/types.h>
+#include <bufferqueueconverter/BufferQueueConverter.h>
+
+#include <EGL/egl.h>
+#include <EGL/eglext.h>
+#include <GLES2/gl2.h>
+#include <GLES2/gl2ext.h>
+#include <GLES3/gl3.h>
+#include <GLES3/gl3ext.h>
+
+namespace android::hardware::automotive::evs::V1_1::implementation {
+
+using frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService;
+using hardware::graphics::bufferqueue::V2_0::IGraphicBufferProducer;
+
+class GlWrapper {
+  public:
+    GlWrapper() : mSurfaceHolder(android::SurfaceHolderUniquePtr(nullptr, nullptr)) {}
+    bool initialize(const sp<IAutomotiveDisplayProxyService>& service, uint64_t displayId);
+    void shutdown();
+
+    bool updateImageTexture(const V1_0::BufferDesc& buffer);
+    bool updateImageTexture(const BufferDesc& buffer);
+    void renderImageToScreen();
+
+    void showWindow(sp<IAutomotiveDisplayProxyService>& service, uint64_t id);
+    void hideWindow(sp<IAutomotiveDisplayProxyService>& service, uint64_t id);
+
+    unsigned getWidth() { return mWidth; };
+    unsigned getHeight() { return mHeight; };
+
+  private:
+    sp<IGraphicBufferProducer> mGfxBufferProducer;
+
+    EGLDisplay mDisplay;
+    EGLSurface mSurface;
+    EGLContext mContext;
+
+    unsigned mWidth = 0;
+    unsigned mHeight = 0;
+
+    EGLImageKHR mKHRimage = EGL_NO_IMAGE_KHR;
+
+    GLuint mTextureMap = 0;
+    GLuint mShaderProgram = 0;
+
+    // Opaque handle for a native hardware buffer defined in
+    // frameworks/native/opengl/include/EGL/eglplatform.h
+    ANativeWindow* mWindow;
+
+    // Pointer to a Surface wrapper.
+    android::SurfaceHolderUniquePtr mSurfaceHolder;
+};
+
+}  // namespace android::hardware::automotive::evs::V1_1::implementation
+
+#endif  // ANDROID_HARDWARE_AUTOMOTIVE_EVS_V1_1_DISPLAY_GLWRAPPER_H
diff --git a/automotive/evs/1.1/default/android.hardware.automotive.evs@1.1-service.rc b/automotive/evs/1.1/default/android.hardware.automotive.evs@1.1-service.rc
index 284b3fd..5d4daf9 100644
--- a/automotive/evs/1.1/default/android.hardware.automotive.evs@1.1-service.rc
+++ b/automotive/evs/1.1/default/android.hardware.automotive.evs@1.1-service.rc
@@ -1,5 +1,8 @@
 service vendor.evs-hal-mock /vendor/bin/hw/android.hardware.automotive.evs@1.1-service
     class hal
-    user automotive_evs
-    group automotive_evs
-    disabled
+    priority -20
+    user graphics
+    group automotive_evs camera
+    onrestart restart automotive_display
+    onrestart restart evs_manager
+    disabled # will not automatically start with its class; must be explicitly started.
diff --git a/automotive/evs/1.1/default/manifest_android.hardware.automotive.evs@1.1-service.xml b/automotive/evs/1.1/default/manifest_android.hardware.automotive.evs@1.1-service.xml
index d4d9b17..d975701 100644
--- a/automotive/evs/1.1/default/manifest_android.hardware.automotive.evs@1.1-service.xml
+++ b/automotive/evs/1.1/default/manifest_android.hardware.automotive.evs@1.1-service.xml
@@ -15,12 +15,8 @@
 -->
 <manifest version="1.0" type="device" >
     <hal format="hidl">
-        <name>android.hardware.automotive.evs</name>
         <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IEvsEnumerator</name>
-            <instance>hw/0</instance>
-        </interface>
+        <name>android.hardware.automotive.evs</name>
+        <fqname>@1.1::IEvsEnumerator/hw/0</fqname>
     </hal>
 </manifest>
diff --git a/automotive/evs/1.1/default/resources/evs_default_configuration.xml b/automotive/evs/1.1/default/resources/evs_default_configuration.xml
index a79e7c2..6cbc18e 100644
--- a/automotive/evs/1.1/default/resources/evs_default_configuration.xml
+++ b/automotive/evs/1.1/default/resources/evs_default_configuration.xml
@@ -30,31 +30,8 @@
 
     <!-- camera information -->
     <camera>
-        <!-- camera group starts -->
-        <group id='group1' synchronized='APPROXIMATE'>
-            <caps>
-                <stream id='0' width='640'  height='360'  format='RGBA_8888' framerate='30'/>
-            </caps>
-
-            <!-- list of parameters -->
-            <characteristics>
-                <parameter
-                    name='REQUEST_AVAILABLE_CAPABILITIES'
-                    type='enum'
-                    size='1'
-                    value='LOGICAL_MULTI_CAMERA'
-                />
-                <parameter
-                    name='LOGICAL_MULTI_CAMERA_PHYSICAL_IDS'
-                    type='byte[]'
-                    size='1'
-                    value='/dev/video1'
-                />
-            </characteristics>
-        </group>
-
         <!-- camera device starts -->
-        <device id='/dev/video1' position='rear'>
+        <device id='/dev/video10' position='rear'>
             <caps>
                 <!-- list of supported controls -->
                 <supported_controls>
diff --git a/automotive/evs/1.1/default/service.cpp b/automotive/evs/1.1/default/service.cpp
index 374b646..2764a26 100644
--- a/automotive/evs/1.1/default/service.cpp
+++ b/automotive/evs/1.1/default/service.cpp
@@ -14,42 +14,42 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.automotive.evs@1.1-service"
-
-#include <unistd.h>
+#include "EvsDisplay.h"
+#include "EvsEnumerator.h"
+#include "ServiceNames.h"
 
 #include <hidl/HidlTransportSupport.h>
 #include <log/log.h>
 #include <utils/Errors.h>
 #include <utils/StrongPointer.h>
 
-#include "ServiceNames.h"
-#include "EvsEnumerator.h"
-#include "EvsDisplay.h"
+#include <unistd.h>
 
-
-// libhidl:
+using android::frameworks::automotive::display::V1_0::IAutomotiveDisplayProxyService;
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
-
-// Generated HIDL files
+using android::hardware::automotive::evs::V1_0::DisplayState;
 using android::hardware::automotive::evs::V1_1::IEvsEnumerator;
-
-// The namespace in which all our implementation code lives
-using namespace android::hardware::automotive::evs::V1_1::implementation;
-using namespace android;
-
+using android::hardware::automotive::evs::V1_1::implementation::EvsEnumerator;
 
 int main() {
     ALOGI("EVS Hardware Enumerator service is starting");
-    android::sp<IEvsEnumerator> service = new EvsEnumerator();
+
+    android::sp<IAutomotiveDisplayProxyService> carWindowService =
+            IAutomotiveDisplayProxyService::getService("default");
+    if (carWindowService == nullptr) {
+        ALOGE("Cannot use AutomotiveDisplayProxyService.  Exiting.");
+        return EXIT_FAILURE;
+    }
+
+    android::sp<IEvsEnumerator> service = new EvsEnumerator(carWindowService);
 
     configureRpcThreadpool(1, true /* callerWillJoin */);
 
     // Register our service -- if somebody is already registered by our name,
     // they will be killed (their thread pool will throw an exception).
-    status_t status = service->registerAsService(kEnumeratorServiceName);
-    if (status == OK) {
+    auto status = service->registerAsService(kEnumeratorServiceName);
+    if (status == android::OK) {
         ALOGD("%s is ready.", kEnumeratorServiceName);
         joinRpcThreadpool();
     } else {
@@ -58,5 +58,5 @@
 
     // In normal operation, we don't expect the thread pool to exit
     ALOGE("EVS Hardware Enumerator is shutting down");
-    return 1;
+    return EXIT_SUCCESS;
 }
diff --git a/automotive/evs/aidl/aidl_api/android.hardware.automotive.evs/current/android/hardware/automotive/evs/IEvsEnumerator.aidl b/automotive/evs/aidl/aidl_api/android.hardware.automotive.evs/current/android/hardware/automotive/evs/IEvsEnumerator.aidl
index a79c68d..225b504 100644
--- a/automotive/evs/aidl/aidl_api/android.hardware.automotive.evs/current/android/hardware/automotive/evs/IEvsEnumerator.aidl
+++ b/automotive/evs/aidl/aidl_api/android.hardware.automotive.evs/current/android/hardware/automotive/evs/IEvsEnumerator.aidl
@@ -44,7 +44,7 @@
   android.hardware.automotive.evs.UltrasonicsArrayDesc[] getUltrasonicsArrayList();
   boolean isHardware();
   android.hardware.automotive.evs.IEvsCamera openCamera(in String cameraId, in android.hardware.automotive.evs.Stream streamCfg);
-  android.hardware.automotive.evs.IEvsDisplay openDisplay(in byte id);
+  android.hardware.automotive.evs.IEvsDisplay openDisplay(in int id);
   android.hardware.automotive.evs.IEvsUltrasonicsArray openUltrasonicsArray(in String ultrasonicsArrayId);
   void registerStatusCallback(in android.hardware.automotive.evs.IEvsEnumeratorStatusCallback callback);
 }
diff --git a/automotive/evs/aidl/android/hardware/automotive/evs/IEvsEnumerator.aidl b/automotive/evs/aidl/android/hardware/automotive/evs/IEvsEnumerator.aidl
index 8e380e0..8698700 100644
--- a/automotive/evs/aidl/android/hardware/automotive/evs/IEvsEnumerator.aidl
+++ b/automotive/evs/aidl/android/hardware/automotive/evs/IEvsEnumerator.aidl
@@ -146,7 +146,7 @@
      * @return EvsDisplay object to be used.
      * @throws EvsResult::INVALID_ARG if no display with a given id exists
      */
-    IEvsDisplay openDisplay(in byte id);
+    IEvsDisplay openDisplay(in int id);
 
     /**
      * Gets the IEvsUltrasonicsArray associated with a ultrasonicsArrayId from a
diff --git a/automotive/evs/aidl/impl/default/include/DefaultEvsEnumerator.h b/automotive/evs/aidl/impl/default/include/DefaultEvsEnumerator.h
index 8bcd867..03a578d 100644
--- a/automotive/evs/aidl/impl/default/include/DefaultEvsEnumerator.h
+++ b/automotive/evs/aidl/impl/default/include/DefaultEvsEnumerator.h
@@ -37,7 +37,7 @@
             const ::aidl::android::hardware::automotive::evs::CameraDesc& desc,
             std::vector<::aidl::android::hardware::automotive::evs::Stream>* _aidl_return) override;
     ::ndk::ScopedAStatus openDisplay(
-            int8_t displayId,
+            int32_t displayId,
             std::shared_ptr<::aidl::android::hardware::automotive::evs::IEvsDisplay>* obj) override;
     ::ndk::ScopedAStatus closeDisplay(
             const std::shared_ptr<::aidl::android::hardware::automotive::evs::IEvsDisplay>& obj)
diff --git a/automotive/evs/aidl/impl/default/src/DefaultEvsEnumerator.cpp b/automotive/evs/aidl/impl/default/src/DefaultEvsEnumerator.cpp
index 2ff6d59..5a81d05 100644
--- a/automotive/evs/aidl/impl/default/src/DefaultEvsEnumerator.cpp
+++ b/automotive/evs/aidl/impl/default/src/DefaultEvsEnumerator.cpp
@@ -51,7 +51,7 @@
     return ScopedAStatus::ok();
 }
 
-ScopedAStatus DefaultEvsEnumerator::openDisplay(int8_t displayId,
+ScopedAStatus DefaultEvsEnumerator::openDisplay(int32_t displayId,
                                                 std::shared_ptr<IEvsDisplay>* obj) {
     return ScopedAStatus::ok();
 }
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/VehicleHalProto.proto b/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/VehicleHalProto.proto
deleted file mode 100644
index 58daca6..0000000
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/VehicleHalProto.proto
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright (C) 2015 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-syntax = "proto2";
-
-package vhal_proto;
-
-// CMD messages are from workstation --> VHAL
-// RESP messages are from VHAL --> workstation
-enum MsgType {
-    GET_CONFIG_CMD                      = 0;
-    GET_CONFIG_RESP                     = 1;
-    GET_CONFIG_ALL_CMD                  = 2;
-    GET_CONFIG_ALL_RESP                 = 3;
-    GET_PROPERTY_CMD                    = 4;
-    GET_PROPERTY_RESP                   = 5;
-    GET_PROPERTY_ALL_CMD                = 6;
-    GET_PROPERTY_ALL_RESP               = 7;
-    SET_PROPERTY_CMD                    = 8;
-    SET_PROPERTY_RESP                   = 9;
-    SET_PROPERTY_ASYNC                  = 10;
-    DEBUG_CMD                           = 11;
-    DEBUG_RESP                          = 12;
-}
-enum Status {
-    RESULT_OK                           = 0;
-    ERROR_UNKNOWN                       = 1;
-    ERROR_UNIMPLEMENTED_CMD             = 2;
-    ERROR_INVALID_PROPERTY              = 3;
-    ERROR_INVALID_AREA_ID               = 4;
-    ERROR_PROPERTY_UNINITIALIZED        = 5;
-    ERROR_WRITE_ONLY_PROPERTY           = 6;
-    ERROR_MEMORY_ALLOC_FAILED           = 7;
-    ERROR_INVALID_OPERATION             = 8;
-}
-
-enum VehiclePropStatus {
-    AVAILABLE                           = 0;
-    UNAVAILABLE                         = 1;
-    ERROR                               = 2;
-}
-
-message VehicleAreaConfig {
-    required int32  area_id             = 1;
-    optional sint32 min_int32_value     = 2;
-    optional sint32 max_int32_value     = 3;
-    optional sint64 min_int64_value     = 4;
-    optional sint64 max_int64_value     = 5;
-    optional float  min_float_value     = 6;
-    optional float  max_float_value     = 7;
-}
-
-message VehiclePropConfig {
-    required int32             prop                = 1;
-    optional int32             access              = 2;
-    optional int32             change_mode         = 3;
-    optional int32             value_type          = 4;
-    optional int32             supported_areas     = 5;     // Deprecated - DO NOT USE
-    repeated VehicleAreaConfig area_configs        = 6;
-    optional int32             config_flags        = 7;
-    repeated int32             config_array        = 8;
-    optional string            config_string       = 9;
-    optional float             min_sample_rate     = 10;
-    optional float             max_sample_rate     = 11;
-};
-
-message VehiclePropValue {
-    // common data
-    required int32  prop                = 1;
-    optional int32  value_type          = 2;
-    optional int64  timestamp           = 3;    // required for valid data from HAL, skipped for set
-    optional VehiclePropStatus  status  = 10;   // required for valid data from HAL, skipped for set
-
-    // values
-    optional int32  area_id             = 4;
-    repeated sint32 int32_values        = 5;    // this also covers boolean value.
-    repeated sint64 int64_values        = 6;
-    repeated float  float_values        = 7;
-    optional string string_value        = 8;
-    optional bytes  bytes_value         = 9;
-};
-
-// This structure is used to notify what values to get from the Vehicle HAL
-message VehiclePropGet {
-    required int32 prop                 = 1;
-    optional int32 area_id              = 2;
-};
-
-message EmulatorMessage {
-    required MsgType           msg_type       = 1;
-    optional Status            status         = 2; // Only for RESP messages
-    repeated VehiclePropGet    prop           = 3; // Provided for getConfig, getProperty commands
-    repeated VehiclePropConfig config         = 4;
-    repeated VehiclePropValue  value          = 5;
-    repeated string            debug_commands = 6; // Required for debug command
-    optional string            debug_result   = 7; // Required for debug RESP messages
-};
diff --git a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehicleProperty.aidl b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
index 12126ea..bcb63b6 100644
--- a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
+++ b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
@@ -194,4 +194,8 @@
   CLUSTER_NAVIGATION_STATE = 292556600,
   ELECTRONIC_TOLL_COLLECTION_CARD_TYPE = 289410873,
   ELECTRONIC_TOLL_COLLECTION_CARD_STATUS = 289410874,
+  FRONT_FOG_LIGHTS_STATE = 289410875,
+  FRONT_FOG_LIGHTS_SWITCH = 289410876,
+  REAR_FOG_LIGHTS_STATE = 289410877,
+  REAR_FOG_LIGHTS_SWITCH = 289410878,
 }
diff --git a/automotive/vehicle/aidl/aidl_test/Android.bp b/automotive/vehicle/aidl/aidl_test/Android.bp
index 5284a0a..cb92c6b 100644
--- a/automotive/vehicle/aidl/aidl_test/Android.bp
+++ b/automotive/vehicle/aidl/aidl_test/Android.bp
@@ -26,7 +26,7 @@
         "libhidlbase",
     ],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "android.hardware.automotive.vehicle@2.0",
         "libgtest",
         "libgmock",
diff --git a/automotive/vehicle/aidl/android/hardware/automotive/vehicle/VehicleProperty.aidl b/automotive/vehicle/aidl/android/hardware/automotive/vehicle/VehicleProperty.aidl
index fe2de8f..533c7a2 100644
--- a/automotive/vehicle/aidl/android/hardware/automotive/vehicle/VehicleProperty.aidl
+++ b/automotive/vehicle/aidl/android/hardware/automotive/vehicle/VehicleProperty.aidl
@@ -1888,6 +1888,22 @@
      *
      * Return the current state of fog lights.
      *
+     * If the car has both front and rear fog lights:
+     *   If front and rear fog lights can only be controlled together: FOG_LIGHTS_STATE must be
+     *   implemented. FRONT_FOG_LIGHTS_STATE and REAR_FOG_LIGHTS_STATE must not be implemented.
+     *
+     *   If the front and rear fog lights can only be controlled independently: FOG_LIGHTS_STATE
+     *   must not be implemented. FRONT_FOG_LIGHTS_STATE and REAR_FOG_LIGHTS_STATE must be
+     *   implemented.
+     *
+     * If the car has only front fog lights:
+     * Only one of FOG_LIGHTS_STATE or FRONT_FOG_LIGHTS_STATE must be implemented and not both.
+     * REAR_FOG_LIGHTS_STATE must not be implemented.
+     *
+     * If the car has only rear fog lights:
+     * Only one of FOG_LIGHTS_STATE or REAR_FOG_LIGHTS_STATE must be implemented and not both.
+     * FRONT_FOG_LIGHTS_STATE must not be implemented.
+     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
      * @data_enum VehicleLightState
@@ -1932,6 +1948,22 @@
      *
      * The setting that the user wants.
      *
+     * If the car has both front and rear fog lights:
+     *   If front and rear fog lights can only be controlled together: FOG_LIGHTS_SWITCH must be
+     *   implemented. FRONT_FOG_LIGHTS_SWITCH and REAR_FOG_LIGHTS_SWITCH must not be implemented.
+     *
+     *   If the front and rear fog lights can only be controlled independently: FOG_LIGHTS_SWITCH
+     *   must not be implemented. FRONT_FOG_LIGHTS_SWITCH and REAR_FOG_LIGHTS_SWITCH must be
+     *   implemented.
+     *
+     * If the car has only front fog lights:
+     * Only one of FOG_LIGHTS_SWITCH or FRONT_FOG_LIGHTS_SWITCH must be implemented and not both.
+     * REAR_FOG_LIGHTS_SWITCH must not be implemented.
+     *
+     * If the car has only rear fog lights:
+     * Only one of FOG_LIGHTS_SWITCH or REAR_FOG_LIGHTS_SWITCH must be implemented and not both.
+     * FRONT_FOG_LIGHTS_SWITCH must not be implemented.
+     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      * @data_enum VehicleLightSwitch
@@ -2637,4 +2669,59 @@
      */
     ELECTRONIC_TOLL_COLLECTION_CARD_STATUS = 0x0F3A + 0x10000000 + 0x01000000
             + 0x00400000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+    /**
+     * Front fog lights state
+     *
+     * Return the current state of the front fog lights.
+     * Only one of FOG_LIGHTS_STATE or FRONT_FOG_LIGHTS_STATE must be implemented. Please refer to
+     * the documentation on FOG_LIGHTS_STATE for more information.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ
+     * @data_enum VehicleLightState
+     */
+    FRONT_FOG_LIGHTS_STATE = 0x0F3B + 0x10000000 + 0x01000000
+            + 0x00400000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+
+    /**
+     * Front fog lights switch
+     *
+     * The setting that the user wants.
+     * Only one of FOG_LIGHTS_SWITCH or FRONT_FOG_LIGHTS_SWITCH must be implemented. Please refer to
+     * the documentation on FOG_LIGHTS_SWITCH for more information.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     * @data_enum VehicleLightSwitch
+     */
+    FRONT_FOG_LIGHTS_SWITCH = 0x0F3C + 0x10000000 + 0x01000000
+            + 0x00400000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+
+    /**
+     * Rear fog lights state
+     *
+     * Return the current state of the rear fog lights.
+     * Only one of FOG_LIGHTS_STATE or REAR_FOG_LIGHTS_STATE must be implemented. Please refer to
+     * the documentation on FOG_LIGHTS_STATE for more information.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ
+     * @data_enum VehicleLightState
+     */
+    REAR_FOG_LIGHTS_STATE = 0x0F3D + 0x10000000 + 0x01000000
+            + 0x00400000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+
+    /**
+     * Rear fog lights switch
+     *
+     * The setting that the user wants.
+     * Only one of FOG_LIGHTS_SWITCH or REAR_FOG_LIGHTS_SWITCH must be implemented. Please refer to
+     * the documentation on FOG_LIGHTS_SWITCH for more information.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     * @data_enum VehicleLightSwitch
+     */
+    REAR_FOG_LIGHTS_SWITCH = 0x0F3E + 0x10000000 + 0x01000000
+            + 0x00400000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
 }
diff --git a/automotive/vehicle/aidl/impl/Android.bp b/automotive/vehicle/aidl/impl/Android.bp
index 94f590d..16b6fde 100644
--- a/automotive/vehicle/aidl/impl/Android.bp
+++ b/automotive/vehicle/aidl/impl/Android.bp
@@ -21,6 +21,7 @@
 cc_defaults {
     name: "VehicleHalDefaults",
     static_libs: [
+        "android-automotive-large-parcelable-vendor-lib",
         "android.hardware.automotive.vehicle-V1-ndk",
         "libmath",
     ],
@@ -35,4 +36,7 @@
         "-Werror",
         "-Wthread-safety",
     ],
+    defaults: [
+        "android-automotive-large-parcelable-defaults",
+    ],
 }
diff --git a/automotive/vehicle/aidl/impl/default_config/Android.bp b/automotive/vehicle/aidl/impl/default_config/Android.bp
index 0feaf23..7a98b64 100644
--- a/automotive/vehicle/aidl/impl/default_config/Android.bp
+++ b/automotive/vehicle/aidl/impl/default_config/Android.bp
@@ -24,8 +24,8 @@
     local_include_dirs: ["include"],
     export_include_dirs: ["include"],
     defaults: ["VehicleHalDefaults"],
-    static_libs: ["VehicleHalUtils"],
+    static_libs: ["VehicleHalUtilsVendor"],
     header_libs: ["VehicleHalTestUtilHeaders"],
-    export_static_lib_headers: ["VehicleHalUtils"],
+    export_static_lib_headers: ["VehicleHalUtilsVendor"],
     export_header_lib_headers: ["VehicleHalTestUtilHeaders"],
 }
diff --git a/automotive/vehicle/aidl/impl/default_config/test/Android.bp b/automotive/vehicle/aidl/impl/default_config/test/Android.bp
index 771472c..0c4a3a4 100644
--- a/automotive/vehicle/aidl/impl/default_config/test/Android.bp
+++ b/automotive/vehicle/aidl/impl/default_config/test/Android.bp
@@ -24,7 +24,7 @@
     defaults: ["VehicleHalDefaults"],
     srcs: ["*.cpp"],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "libgtest",
     ],
     header_libs: [
diff --git a/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/Android.bp
index ab223d3..e6c4ee9 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/Android.bp
@@ -26,7 +26,7 @@
     export_include_dirs: ["include"],
     defaults: ["VehicleHalDefaults"],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "FakeObd2Frame",
     ],
     shared_libs: [
diff --git a/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/test/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/test/Android.bp
index ac8db44..58f0e98 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/test/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/GeneratorHub/test/Android.bp
@@ -24,7 +24,7 @@
     srcs: ["*.cpp"],
     defaults: ["VehicleHalDefaults"],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "FakeVehicleHalValueGenerators",
         "FakeObd2Frame",
     ],
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/hardware/Android.bp
index dcd9208..49f7671 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/Android.bp
@@ -39,7 +39,7 @@
     ],
     export_header_lib_headers: ["IVehicleHardware"],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "FakeVehicleHalValueGenerators",
         "FakeObd2Frame",
         "FakeUserHal",
@@ -47,5 +47,5 @@
     shared_libs: [
         "libjsoncpp",
     ],
-    export_static_lib_headers: ["VehicleHalUtils"],
+    export_static_lib_headers: ["VehicleHalUtilsVendor"],
 }
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h b/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
index cab184b..578d045 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
@@ -23,7 +23,9 @@
 #include <IVehicleHardware.h>
 #include <VehicleHalTypes.h>
 #include <VehiclePropertyStore.h>
+#include <android-base/parseint.h>
 #include <android-base/result.h>
+#include <android-base/stringprintf.h>
 #include <android-base/thread_annotations.h>
 
 #include <map>
@@ -37,7 +39,7 @@
 namespace vehicle {
 namespace fake {
 
-class FakeVehicleHardware final : public IVehicleHardware {
+class FakeVehicleHardware : public IVehicleHardware {
   public:
     FakeVehicleHardware();
 
@@ -78,13 +80,21 @@
     void registerOnPropertySetErrorEvent(
             std::unique_ptr<const PropertySetErrorCallback> callback) override;
 
+  protected:
+    // mValuePool is also used in mServerSidePropStore.
+    const std::shared_ptr<VehiclePropValuePool> mValuePool;
+    const std::shared_ptr<VehiclePropertyStore> mServerSidePropStore;
+
+    ::android::base::Result<VehiclePropValuePool::RecyclableType> getValue(
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
+
+    ::android::base::Result<void> setValue(
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value);
+
   private:
     // Expose private methods to unit test.
     friend class FakeVehicleHardwareTestHelper;
 
-    // mValuePool is also used in mServerSidePropStore.
-    const std::shared_ptr<VehiclePropValuePool> mValuePool;
-    const std::shared_ptr<VehiclePropertyStore> mServerSidePropStore;
     const std::unique_ptr<obd2frame::FakeObd2Frame> mFakeObd2Frame;
     const std::unique_ptr<FakeUserHal> mFakeUserHal;
     std::mutex mCallbackLock;
@@ -120,6 +130,35 @@
     ::android::base::Result<VehiclePropValuePool::RecyclableType> getUserHalProp(
             const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
     bool isHvacPropAndHvacNotAvailable(int32_t propId);
+
+    std::string dumpAllProperties();
+    std::string dumpOnePropertyByConfig(
+            int rowNumber,
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig& config);
+    std::string dumpOnePropertyById(int32_t propId, int32_t areaId);
+    std::string dumpHelp();
+    std::string dumpListProperties();
+    std::string dumpSpecificProperty(const std::vector<std::string>& options);
+    std::string dumpSetProperties(const std::vector<std::string>& options);
+
+    template <typename T>
+    ::android::base::Result<T> safelyParseInt(int index, const std::string& s) {
+        T out;
+        if (!::android::base::ParseInt(s, &out)) {
+            return ::android::base::Error() << ::android::base::StringPrintf(
+                           "non-integer argument at index %d: %s\n", index, s.c_str());
+        }
+        return out;
+    }
+    ::android::base::Result<float> safelyParseFloat(int index, const std::string& s);
+    std::vector<std::string> getOptionValues(const std::vector<std::string>& options,
+                                             size_t* index);
+    ::android::base::Result<::aidl::android::hardware::automotive::vehicle::VehiclePropValue>
+    parseSetPropOptions(const std::vector<std::string>& options);
+    ::android::base::Result<std::vector<uint8_t>> parseHexString(const std::string& s);
+
+    ::android::base::Result<void> checkArgumentsSize(const std::vector<std::string>& options,
+                                                     size_t minSize);
 };
 
 }  // namespace fake
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
index e75f0e7..097257e 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
@@ -14,6 +14,9 @@
  * limitations under the License.
  */
 
+#define LOG_TAG "FakeVehicleHardware"
+#define FAKE_VEHICLEHARDWARE_DEBUG false  // STOPSHIP if true.
+
 #include "FakeVehicleHardware.h"
 
 #include <DefaultConfig.h>
@@ -22,7 +25,9 @@
 #include <PropertyUtils.h>
 #include <VehicleHalTypes.h>
 #include <VehicleUtils.h>
+#include <android-base/parsedouble.h>
 #include <android-base/properties.h>
+#include <android-base/strings.h>
 #include <utils/Log.h>
 #include <utils/SystemClock.h>
 
@@ -56,12 +61,31 @@
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyType;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 
+using ::android::base::EqualsIgnoreCase;
 using ::android::base::Error;
+using ::android::base::ParseFloat;
 using ::android::base::Result;
+using ::android::base::StartsWith;
+using ::android::base::StringPrintf;
 
 const char* VENDOR_OVERRIDE_DIR = "/vendor/etc/automotive/vhaloverride/";
 const char* OVERRIDE_PROPERTY = "persist.vendor.vhal_init_value_override";
 
+// A list of supported options for "--set" command.
+const std::unordered_set<std::string> SET_PROP_OPTIONS = {
+        // integer.
+        "-i",
+        // 64bit integer.
+        "-i64",
+        // float.
+        "-f",
+        // string.
+        "-s",
+        // bytes in hex format, e.g. 0xDEADBEEF.
+        "-b",
+        // Area id in integer.
+        "-a"};
+
 }  // namespace
 
 void FakeVehicleHardware::storePropInitialValue(const defaultconfig::ConfigDeclaration& config) {
@@ -381,44 +405,26 @@
 
 StatusCode FakeVehicleHardware::setValues(std::shared_ptr<const SetValuesCallback> callback,
                                           const std::vector<SetValueRequest>& requests) {
-    std::vector<VehiclePropValue> updatedValues;
     std::vector<SetValueResult> results;
     for (auto& request : requests) {
         const VehiclePropValue& value = request.value;
         int propId = value.prop;
 
-        ALOGD("Set value for property ID: %d", propId);
+        if (FAKE_VEHICLEHARDWARE_DEBUG) {
+            ALOGD("Set value for property ID: %d", propId);
+        }
 
         SetValueResult setValueResult;
         setValueResult.requestId = request.requestId;
-        setValueResult.status = StatusCode::OK;
 
-        bool isSpecialValue = false;
-        auto setSpecialValueResult = maybeSetSpecialValue(value, &isSpecialValue);
-
-        if (isSpecialValue) {
-            if (!setSpecialValueResult.ok()) {
-                ALOGE("failed to set special value for property ID: %d, error: %s, status: %d",
-                      propId, getErrorMsg(setSpecialValueResult).c_str(),
-                      getIntErrorCode(setSpecialValueResult));
-                setValueResult.status = getErrorCode(setSpecialValueResult);
-            }
-
-            // Special values are already handled.
-            results.push_back(std::move(setValueResult));
-            continue;
+        if (auto result = setValue(value); !result.ok()) {
+            ALOGE("failed to set value, error: %s, code: %d", getErrorMsg(result).c_str(),
+                  getIntErrorCode(result));
+            setValueResult.status = getErrorCode(result);
+        } else {
+            setValueResult.status = StatusCode::OK;
         }
 
-        auto updatedValue = mValuePool->obtain(value);
-        int64_t timestamp = elapsedRealtimeNano();
-        updatedValue->timestamp = timestamp;
-
-        auto writeResult = mServerSidePropStore->writeValue(std::move(updatedValue));
-        if (!writeResult.ok()) {
-            ALOGE("failed to write value into property store, error: %s, code: %d",
-                  getErrorMsg(writeResult).c_str(), getIntErrorCode(writeResult));
-            setValueResult.status = getErrorCode(writeResult);
-        }
         results.push_back(std::move(setValueResult));
     }
 
@@ -429,61 +435,378 @@
     return StatusCode::OK;
 }
 
+Result<void> FakeVehicleHardware::setValue(const VehiclePropValue& value) {
+    bool isSpecialValue = false;
+    auto setSpecialValueResult = maybeSetSpecialValue(value, &isSpecialValue);
+
+    if (isSpecialValue) {
+        if (!setSpecialValueResult.ok()) {
+            return Error(getIntErrorCode(setSpecialValueResult))
+                   << StringPrintf("failed to set special value for property ID: %d, error: %s",
+                                   value.prop, getErrorMsg(setSpecialValueResult).c_str());
+        }
+        return {};
+    }
+
+    auto updatedValue = mValuePool->obtain(value);
+    int64_t timestamp = elapsedRealtimeNano();
+    updatedValue->timestamp = timestamp;
+
+    auto writeResult = mServerSidePropStore->writeValue(std::move(updatedValue));
+    if (!writeResult.ok()) {
+        return Error(getIntErrorCode(writeResult))
+               << StringPrintf("failed to write value into property store, error: %s",
+                               getErrorMsg(writeResult).c_str());
+    }
+
+    return {};
+}
+
 StatusCode FakeVehicleHardware::getValues(std::shared_ptr<const GetValuesCallback> callback,
                                           const std::vector<GetValueRequest>& requests) const {
     std::vector<GetValueResult> results;
     for (auto& request : requests) {
         const VehiclePropValue& value = request.prop;
-        ALOGD("getValues(%d)", value.prop);
+
+        if (FAKE_VEHICLEHARDWARE_DEBUG) {
+            ALOGD("getValues(%d)", value.prop);
+        }
 
         GetValueResult getValueResult;
         getValueResult.requestId = request.requestId;
-        bool isSpecialValue = false;
 
-        auto result = maybeGetSpecialValue(value, &isSpecialValue);
-        if (isSpecialValue) {
-            if (!result.ok()) {
-                ALOGE("failed to get special value: %d, error: %s, code: %d", value.prop,
-                      getErrorMsg(result).c_str(), getIntErrorCode(result));
-                getValueResult.status = getErrorCode(result);
-            } else {
-                getValueResult.status = StatusCode::OK;
-                getValueResult.prop = *result.value();
-            }
-            results.push_back(std::move(getValueResult));
-            continue;
-        }
-
-        auto readResult = mServerSidePropStore->readValue(value);
-        if (!readResult.ok()) {
-            StatusCode errorCode = getErrorCode(readResult);
-            if (errorCode == StatusCode::NOT_AVAILABLE) {
-                ALOGW("%s", "value has not been set yet");
-            } else {
-                ALOGE("failed to get value, error: %s, code: %d", getErrorMsg(readResult).c_str(),
-                      toInt(errorCode));
-            }
-            getValueResult.status = errorCode;
+        auto result = getValue(value);
+        if (!result.ok()) {
+            ALOGE("failed to get value, error: %s, code: %d", getErrorMsg(result).c_str(),
+                  getIntErrorCode(result));
+            getValueResult.status = getErrorCode(result);
         } else {
             getValueResult.status = StatusCode::OK;
-            getValueResult.prop = *readResult.value();
+            getValueResult.prop = *result.value();
         }
         results.push_back(std::move(getValueResult));
     }
 
+    // In a real VHAL implementation, getValue would be async and we would call the callback after
+    // we actually received the values from vehicle bus. Here we are getting the result
+    // synchronously so we could call the callback here.
     (*callback)(std::move(results));
 
     return StatusCode::OK;
 }
 
-DumpResult FakeVehicleHardware::dump(const std::vector<std::string>&) {
+Result<VehiclePropValuePool::RecyclableType> FakeVehicleHardware::getValue(
+        const VehiclePropValue& value) const {
+    bool isSpecialValue = false;
+    auto result = maybeGetSpecialValue(value, &isSpecialValue);
+    if (isSpecialValue) {
+        if (!result.ok()) {
+            return Error(getIntErrorCode(result))
+                   << StringPrintf("failed to get special value: %d, error: %s", value.prop,
+                                   getErrorMsg(result).c_str());
+        } else {
+            return std::move(result);
+        }
+    }
+
+    auto readResult = mServerSidePropStore->readValue(value);
+    if (!readResult.ok()) {
+        StatusCode errorCode = getErrorCode(readResult);
+        if (errorCode == StatusCode::NOT_AVAILABLE) {
+            return Error(toInt(errorCode)) << "value has not been set yet";
+        } else {
+            return Error(toInt(errorCode))
+                   << "failed to get value, error: " << getErrorMsg(readResult);
+        }
+    }
+
+    return std::move(readResult);
+}
+
+DumpResult FakeVehicleHardware::dump(const std::vector<std::string>& options) {
     DumpResult result;
-    // TODO(b/201830716): Implement this.
+    result.callerShouldDumpState = false;
+    if (options.size() == 0) {
+        // We only want caller to dump default state when there is no options.
+        result.callerShouldDumpState = true;
+        result.buffer = dumpAllProperties();
+        return result;
+    }
+    std::string option = options[0];
+    if (EqualsIgnoreCase(option, "--help")) {
+        result.buffer = dumpHelp();
+        return result;
+    } else if (EqualsIgnoreCase(option, "--list")) {
+        result.buffer = dumpListProperties();
+    } else if (EqualsIgnoreCase(option, "--get")) {
+        result.buffer = dumpSpecificProperty(options);
+    } else if (EqualsIgnoreCase(option, "--set")) {
+        result.buffer = dumpSetProperties(options);
+    } else {
+        result.buffer = StringPrintf("Invalid option: %s\n", option.c_str());
+    }
     return result;
 }
 
+std::string FakeVehicleHardware::dumpHelp() {
+    return "Usage: \n\n"
+           "[no args]: dumps (id and value) all supported properties \n"
+           "--help: shows this help\n"
+           "--list: lists the ids of all supported properties\n"
+           "--get <PROP1> [PROP2] [PROPN]: dumps the value of specific properties \n"
+           "--set <PROP> [-i INT_VALUE [INT_VALUE ...]] [-i64 INT64_VALUE [INT64_VALUE ...]] "
+           "[-f FLOAT_VALUE [FLOAT_VALUE ...]] [-s STR_VALUE] "
+           "[-b BYTES_VALUE] [-a AREA_ID] : sets the value of property PROP. "
+           "Notice that the string, bytes and area value can be set just once, while the other can"
+           " have multiple values (so they're used in the respective array), "
+           "BYTES_VALUE is in the form of 0xXXXX, e.g. 0xdeadbeef.\n";
+}
+
+std::string FakeVehicleHardware::dumpAllProperties() {
+    auto configs = mServerSidePropStore->getAllConfigs();
+    if (configs.size() == 0) {
+        return "no properties to dump\n";
+    }
+    std::string msg = StringPrintf("dumping %zu properties\n", configs.size());
+    int rowNumber = 1;
+    for (const VehiclePropConfig& config : configs) {
+        msg += dumpOnePropertyByConfig(rowNumber++, config);
+    }
+    return msg;
+}
+
+std::string FakeVehicleHardware::dumpOnePropertyByConfig(int rowNumber,
+                                                         const VehiclePropConfig& config) {
+    size_t numberAreas = config.areaConfigs.size();
+    std::string msg = "";
+    if (numberAreas == 0) {
+        msg += StringPrintf("%d: ", rowNumber);
+        msg += dumpOnePropertyById(config.prop, /* areaId= */ 0);
+        return msg;
+    }
+    for (size_t j = 0; j < numberAreas; ++j) {
+        if (numberAreas > 1) {
+            msg += StringPrintf("%d-%zu: ", rowNumber, j);
+        } else {
+            msg += StringPrintf("%d: ", rowNumber);
+        }
+        msg += dumpOnePropertyById(config.prop, config.areaConfigs[j].areaId);
+    }
+    return msg;
+}
+
+std::string FakeVehicleHardware::dumpOnePropertyById(int32_t propId, int32_t areaId) {
+    VehiclePropValue value = {
+            .prop = propId,
+            .areaId = areaId,
+    };
+    bool isSpecialValue = false;
+    auto result = maybeGetSpecialValue(value, &isSpecialValue);
+    if (!isSpecialValue) {
+        result = mServerSidePropStore->readValue(value);
+    }
+    if (!result.ok()) {
+        return StringPrintf("failed to read property value: %d, error: %s, code: %d\n", propId,
+                            getErrorMsg(result).c_str(), getIntErrorCode(result));
+
+    } else {
+        return result.value()->toString() + "\n";
+    }
+}
+
+std::string FakeVehicleHardware::dumpListProperties() {
+    auto configs = mServerSidePropStore->getAllConfigs();
+    if (configs.size() == 0) {
+        return "no properties to list\n";
+    }
+    int rowNumber = 1;
+    std::string msg = StringPrintf("listing %zu properties\n", configs.size());
+    for (const auto& config : configs) {
+        msg += StringPrintf("%d: %d\n", rowNumber++, config.prop);
+    }
+    return msg;
+}
+
+Result<void> FakeVehicleHardware::checkArgumentsSize(const std::vector<std::string>& options,
+                                                     size_t minSize) {
+    size_t size = options.size();
+    if (size >= minSize) {
+        return {};
+    }
+    return Error() << StringPrintf("Invalid number of arguments: required at least %zu, got %zu\n",
+                                   minSize, size);
+}
+
+std::string FakeVehicleHardware::dumpSpecificProperty(const std::vector<std::string>& options) {
+    if (auto result = checkArgumentsSize(options, /*minSize=*/2); !result.ok()) {
+        return getErrorMsg(result);
+    }
+
+    // options[0] is the command itself...
+    int rowNumber = 1;
+    size_t size = options.size();
+    std::string msg = "";
+    for (size_t i = 1; i < size; ++i) {
+        auto propResult = safelyParseInt<int32_t>(i, options[i]);
+        if (!propResult.ok()) {
+            msg += getErrorMsg(propResult);
+            continue;
+        }
+        int32_t prop = propResult.value();
+        auto result = mServerSidePropStore->getConfig(prop);
+        if (!result.ok()) {
+            msg += StringPrintf("No property %d\n", prop);
+            continue;
+        }
+        msg += dumpOnePropertyByConfig(rowNumber++, *result.value());
+    }
+    return msg;
+}
+
+std::vector<std::string> FakeVehicleHardware::getOptionValues(
+        const std::vector<std::string>& options, size_t* index) {
+    std::vector<std::string> values;
+    while (*index < options.size()) {
+        std::string option = options[*index];
+        if (SET_PROP_OPTIONS.find(option) != SET_PROP_OPTIONS.end()) {
+            return std::move(values);
+        }
+        values.push_back(option);
+        (*index)++;
+    }
+    return std::move(values);
+}
+
+Result<VehiclePropValue> FakeVehicleHardware::parseSetPropOptions(
+        const std::vector<std::string>& options) {
+    // Options format:
+    // --set PROP [-f f1 f2...] [-i i1 i2...] [-i64 i1 i2...] [-s s1 s2...] [-b b1 b2...] [-a a]
+    size_t optionIndex = 1;
+    auto result = safelyParseInt<int32_t>(optionIndex, options[optionIndex]);
+    if (!result.ok()) {
+        return Error() << StringPrintf("Property value: \"%s\" is not a valid int: %s\n",
+                                       options[optionIndex].c_str(), getErrorMsg(result).c_str());
+    }
+    VehiclePropValue prop = {};
+    prop.prop = result.value();
+    prop.status = VehiclePropertyStatus::AVAILABLE;
+    optionIndex++;
+    std::unordered_set<std::string> parsedOptions;
+
+    while (optionIndex < options.size()) {
+        std::string type = options[optionIndex];
+        optionIndex++;
+        size_t currentIndex = optionIndex;
+        std::vector<std::string> values = getOptionValues(options, &optionIndex);
+        if (parsedOptions.find(type) != parsedOptions.end()) {
+            return Error() << StringPrintf("Duplicate \"%s\" options\n", type.c_str());
+        }
+        parsedOptions.insert(type);
+        if (EqualsIgnoreCase(type, "-i")) {
+            if (values.size() == 0) {
+                return Error() << "No values specified when using \"-i\"\n";
+            }
+            prop.value.int32Values.resize(values.size());
+            for (size_t i = 0; i < values.size(); i++) {
+                auto int32Result = safelyParseInt<int32_t>(currentIndex + i, values[i]);
+                if (!int32Result.ok()) {
+                    return Error()
+                           << StringPrintf("Value: \"%s\" is not a valid int: %s\n",
+                                           values[i].c_str(), getErrorMsg(int32Result).c_str());
+                }
+                prop.value.int32Values[i] = int32Result.value();
+            }
+        } else if (EqualsIgnoreCase(type, "-i64")) {
+            if (values.size() == 0) {
+                return Error() << "No values specified when using \"-i64\"\n";
+            }
+            prop.value.int64Values.resize(values.size());
+            for (size_t i = 0; i < values.size(); i++) {
+                auto int64Result = safelyParseInt<int64_t>(currentIndex + i, values[i]);
+                if (!int64Result.ok()) {
+                    return Error()
+                           << StringPrintf("Value: \"%s\" is not a valid int64: %s\n",
+                                           values[i].c_str(), getErrorMsg(int64Result).c_str());
+                }
+                prop.value.int64Values[i] = int64Result.value();
+            }
+        } else if (EqualsIgnoreCase(type, "-f")) {
+            if (values.size() == 0) {
+                return Error() << "No values specified when using \"-f\"\n";
+            }
+            prop.value.floatValues.resize(values.size());
+            for (size_t i = 0; i < values.size(); i++) {
+                auto floatResult = safelyParseFloat(currentIndex + i, values[i]);
+                if (!floatResult.ok()) {
+                    return Error()
+                           << StringPrintf("Value: \"%s\" is not a valid float: %s\n",
+                                           values[i].c_str(), getErrorMsg(floatResult).c_str());
+                }
+                prop.value.floatValues[i] = floatResult.value();
+            }
+        } else if (EqualsIgnoreCase(type, "-s")) {
+            if (values.size() != 1) {
+                return Error() << "Expect exact one value when using \"-s\"\n";
+            }
+            prop.value.stringValue = values[0];
+        } else if (EqualsIgnoreCase(type, "-b")) {
+            if (values.size() != 1) {
+                return Error() << "Expect exact one value when using \"-b\"\n";
+            }
+            auto bytesResult = parseHexString(values[0]);
+            if (!bytesResult.ok()) {
+                return Error() << StringPrintf("value: \"%s\" is not a valid hex string: %s\n",
+                                               values[0].c_str(), getErrorMsg(bytesResult).c_str());
+            }
+            prop.value.byteValues = std::move(bytesResult.value());
+        } else if (EqualsIgnoreCase(type, "-a")) {
+            if (values.size() != 1) {
+                return Error() << "Expect exact one value when using \"-a\"\n";
+            }
+            auto int32Result = safelyParseInt<int32_t>(currentIndex, values[0]);
+            if (!int32Result.ok()) {
+                return Error() << StringPrintf("Area ID: \"%s\" is not a valid int: %s\n",
+                                               values[0].c_str(), getErrorMsg(int32Result).c_str());
+            }
+            prop.areaId = int32Result.value();
+        } else {
+            return Error() << StringPrintf("Unknown option: %s\n", type.c_str());
+        }
+    }
+
+    return prop;
+}
+
+std::string FakeVehicleHardware::dumpSetProperties(const std::vector<std::string>& options) {
+    if (auto result = checkArgumentsSize(options, 3); !result.ok()) {
+        return getErrorMsg(result);
+    }
+
+    auto parseResult = parseSetPropOptions(options);
+    if (!parseResult.ok()) {
+        return getErrorMsg(parseResult);
+    }
+    VehiclePropValue prop = std::move(parseResult.value());
+    ALOGD("Dump: Setting property: %s", prop.toString().c_str());
+
+    bool isSpecialValue = false;
+    auto setResult = maybeSetSpecialValue(prop, &isSpecialValue);
+
+    if (!isSpecialValue) {
+        auto updatedValue = mValuePool->obtain(prop);
+        updatedValue->timestamp = elapsedRealtimeNano();
+        setResult = mServerSidePropStore->writeValue(std::move(updatedValue));
+    }
+
+    if (setResult.ok()) {
+        return StringPrintf("Set property: %s\n", prop.toString().c_str());
+    }
+    return StringPrintf("failed to set property: %s, error: %s\n", prop.toString().c_str(),
+                        getErrorMsg(setResult).c_str());
+}
+
 StatusCode FakeVehicleHardware::checkHealth() {
-    // TODO(b/201830716): Implement this.
+    // Always return OK for checkHealth.
     return StatusCode::OK;
 }
 
@@ -544,6 +867,49 @@
     }
 }
 
+Result<float> FakeVehicleHardware::safelyParseFloat(int index, const std::string& s) {
+    float out;
+    if (!ParseFloat(s, &out)) {
+        return Error() << StringPrintf("non-float argument at index %d: %s\n", index, s.c_str());
+    }
+    return out;
+}
+
+Result<std::vector<uint8_t>> FakeVehicleHardware::parseHexString(const std::string& s) {
+    std::vector<uint8_t> bytes;
+    if (s.size() % 2 != 0) {
+        return Error() << StringPrintf("invalid hex string: %s, should have even size\n",
+                                       s.c_str());
+    }
+    if (!StartsWith(s, "0x")) {
+        return Error() << StringPrintf("hex string should start with \"0x\", got %s\n", s.c_str());
+    }
+    std::string subs = s.substr(2);
+    std::transform(subs.begin(), subs.end(), subs.begin(),
+                   [](unsigned char c) { return std::tolower(c); });
+
+    bool highDigit = true;
+    for (size_t i = 0; i < subs.size(); i++) {
+        char c = subs[i];
+        uint8_t v;
+        if (c >= '0' && c <= '9') {
+            v = c - '0';
+        } else if (c >= 'a' && c <= 'f') {
+            v = c - 'a' + 10;
+        } else {
+            return Error() << StringPrintf("invalid character %c in hex string %s\n", c,
+                                           subs.c_str());
+        }
+        if (highDigit) {
+            bytes.push_back(v * 16);
+        } else {
+            bytes[bytes.size() - 1] += v;
+        }
+        highDigit = !highDigit;
+    }
+    return bytes;
+}
+
 }  // namespace fake
 }  // namespace vehicle
 }  // namespace automotive
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/Android.bp
index 90d1516..9f679bc 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/Android.bp
@@ -29,7 +29,7 @@
         "VehicleHalTestUtilHeaders",
     ],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "FakeVehicleHardware",
         "FakeVehicleHalValueGenerators",
         "FakeObd2Frame",
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
index 970d044..0812c2a 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
@@ -24,6 +24,7 @@
 
 #include <android-base/expected.h>
 #include <android-base/file.h>
+#include <android-base/stringprintf.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <utils/Log.h>
@@ -52,13 +53,16 @@
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyStatus;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 using ::android::base::expected;
+using ::android::base::StringPrintf;
 using ::android::base::unexpected;
 using ::testing::ContainerEq;
+using ::testing::ContainsRegex;
 using ::testing::Eq;
 using ::testing::IsSubsetOf;
 using ::testing::WhenSortedBy;
 
 constexpr int INVALID_PROP_ID = 0;
+constexpr char CAR_MAKE[] = "Default Car";
 
 }  // namespace
 
@@ -1203,6 +1207,261 @@
                          }));
 }
 
+TEST_F(FakeVehicleHardwareTest, testDumpAllProperties) {
+    std::vector<std::string> options;
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_TRUE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("dumping .+ properties"));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpHelp) {
+    std::vector<std::string> options;
+    options.push_back("--help");
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("Usage: "));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpListProperties) {
+    std::vector<std::string> options;
+    options.push_back("--list");
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("listing .+ properties"));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpSpecificProperties) {
+    std::vector<std::string> options;
+    options.push_back("--get");
+    std::string prop1 = std::to_string(toInt(VehicleProperty::INFO_FUEL_CAPACITY));
+    std::string prop2 = std::to_string(toInt(VehicleProperty::TIRE_PRESSURE));
+    options.push_back(prop1);
+    options.push_back(prop2);
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer,
+                ContainsRegex(StringPrintf("1:.*prop: %s.*\n2-0:.*prop: %s.*\n2-1:.*prop: %s.*\n",
+                                           prop1.c_str(), prop2.c_str(), prop2.c_str())));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpSpecificPropertiesInvalidProp) {
+    std::vector<std::string> options;
+    options.push_back("--get");
+    std::string prop1 = std::to_string(toInt(VehicleProperty::INFO_FUEL_CAPACITY));
+    std::string prop2 = std::to_string(INVALID_PROP_ID);
+    options.push_back(prop1);
+    options.push_back(prop2);
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex(StringPrintf("1:.*prop: %s.*\nNo property %d\n",
+                                                          prop1.c_str(), INVALID_PROP_ID)));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpSpecificPropertiesNoArg) {
+    std::vector<std::string> options;
+    options.push_back("--get");
+
+    // No arguments.
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("Invalid number of arguments"));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpInvalidOptions) {
+    std::vector<std::string> options;
+    options.push_back("--invalid");
+
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("Invalid option: --invalid"));
+}
+
+struct SetPropTestCase {
+    std::string test_name;
+    std::vector<std::string> options;
+    bool success;
+    std::string errorMsg = "";
+};
+
+class FakeVehicleHardwareSetPropTest : public FakeVehicleHardwareTest,
+                                       public testing::WithParamInterface<SetPropTestCase> {};
+
+TEST_P(FakeVehicleHardwareSetPropTest, cmdSetOneProperty) {
+    const SetPropTestCase& tc = GetParam();
+
+    DumpResult result = getHardware()->dump(tc.options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    if (tc.success) {
+        ASSERT_THAT(result.buffer, ContainsRegex("Set property:"));
+    } else {
+        ASSERT_THAT(result.buffer, ContainsRegex(tc.errorMsg));
+    }
+}
+
+std::vector<SetPropTestCase> GenSetPropParams() {
+    std::string infoMakeProperty = std::to_string(toInt(VehicleProperty::INFO_MAKE));
+    return {
+            {"success_set_string", {"--set", infoMakeProperty, "-s", CAR_MAKE}, true},
+            {"success_set_bytes", {"--set", infoMakeProperty, "-b", "0xdeadbeef"}, true},
+            {"success_set_bytes_caps", {"--set", infoMakeProperty, "-b", "0xDEADBEEF"}, true},
+            {"success_set_int", {"--set", infoMakeProperty, "-i", "2147483647"}, true},
+            {"success_set_ints",
+             {"--set", infoMakeProperty, "-i", "2147483647", "0", "-2147483648"},
+             true},
+            {"success_set_int64",
+             {"--set", infoMakeProperty, "-i64", "-9223372036854775808"},
+             true},
+            {"success_set_int64s",
+             {"--set", infoMakeProperty, "-i64", "-9223372036854775808", "0",
+              "9223372036854775807"},
+             true},
+            {"success_set_float", {"--set", infoMakeProperty, "-f", "1.175494351E-38"}, true},
+            {"success_set_floats",
+             {"--set", infoMakeProperty, "-f", "-3.402823466E+38", "0", "3.402823466E+38"},
+             true},
+            {"success_set_area", {"--set", infoMakeProperty, "-a", "2147483647"}, true},
+            {"fail_no_options", {"--set", infoMakeProperty}, false, "Invalid number of arguments"},
+            {"fail_less_than_4_options",
+             {"--set", infoMakeProperty, "-i"},
+             false,
+             "No values specified"},
+            {"fail_unknown_options", {"--set", infoMakeProperty, "-abcd"}, false, "Unknown option"},
+            {"fail_invalid_property",
+             {"--set", "not valid", "-s", CAR_MAKE},
+             false,
+             "not a valid int"},
+            {"fail_duplicate_string",
+             {"--set", infoMakeProperty, "-s", CAR_MAKE, "-s", CAR_MAKE},
+             false,
+             "Duplicate \"-s\" options"},
+            {"fail_multiple_strings",
+             {"--set", infoMakeProperty, "-s", CAR_MAKE, CAR_MAKE},
+             false,
+             "Expect exact one value"},
+            {"fail_no_string_value",
+             {"--set", infoMakeProperty, "-s", "-a", "1234"},
+             false,
+             "Expect exact one value"},
+            {"fail_duplicate_bytes",
+             {"--set", infoMakeProperty, "-b", "0xdeadbeef", "-b", "0xdeadbeef"},
+             false,
+             "Duplicate \"-b\" options"},
+            {"fail_multiple_bytes",
+             {"--set", infoMakeProperty, "-b", "0xdeadbeef", "0xdeadbeef"},
+             false,
+             "Expect exact one value"},
+            {"fail_invalid_bytes",
+             {"--set", infoMakeProperty, "-b", "0xgood"},
+             false,
+             "not a valid hex string"},
+            {"fail_invalid_bytes_no_prefix",
+             {"--set", infoMakeProperty, "-b", "deadbeef"},
+             false,
+             "not a valid hex string"},
+            {"fail_invalid_int",
+             {"--set", infoMakeProperty, "-i", "abc"},
+             false,
+             "not a valid int"},
+            {"fail_int_out_of_range",
+             {"--set", infoMakeProperty, "-i", "2147483648"},
+             false,
+             "not a valid int"},
+            {"fail_no_int_value",
+             {"--set", infoMakeProperty, "-i", "-s", CAR_MAKE},
+             false,
+             "No values specified"},
+            {"fail_invalid_int64",
+             {"--set", infoMakeProperty, "-i64", "abc"},
+             false,
+             "not a valid int64"},
+            {"fail_int64_out_of_range",
+             {"--set", infoMakeProperty, "-i64", "-9223372036854775809"},
+             false,
+             "not a valid int64"},
+            {"fail_no_int64_value",
+             {"--set", infoMakeProperty, "-i64", "-s", CAR_MAKE},
+             false,
+             "No values specified"},
+            {"fail_invalid_float",
+             {"--set", infoMakeProperty, "-f", "abc"},
+             false,
+             "not a valid float"},
+            {"fail_float_out_of_range",
+             {"--set", infoMakeProperty, "-f", "-3.402823466E+39"},
+             false,
+             "not a valid float"},
+            {"fail_no_float_value",
+             {"--set", infoMakeProperty, "-f", "-s", CAR_MAKE},
+             false,
+             "No values specified"},
+            {"fail_multiple_areas",
+             {"--set", infoMakeProperty, "-a", "2147483648", "0"},
+             false,
+             "Expect exact one value"},
+            {"fail_invalid_area",
+             {"--set", infoMakeProperty, "-a", "abc"},
+             false,
+             "not a valid int"},
+            {"fail_area_out_of_range",
+             {"--set", infoMakeProperty, "-a", "2147483648"},
+             false,
+             "not a valid int"},
+            {"fail_no_area_value",
+             {"--set", infoMakeProperty, "-a", "-s", CAR_MAKE},
+             false,
+             "Expect exact one value"},
+    };
+}
+
+INSTANTIATE_TEST_SUITE_P(
+        FakeVehicleHardwareSetPropTests, FakeVehicleHardwareSetPropTest,
+        testing::ValuesIn(GenSetPropParams()),
+        [](const testing::TestParamInfo<FakeVehicleHardwareSetPropTest::ParamType>& info) {
+            return info.param.test_name;
+        });
+
+TEST_F(FakeVehicleHardwareTest, SetComplexPropTest) {
+    std::string infoMakeProperty = std::to_string(toInt(VehicleProperty::INFO_MAKE));
+    getHardware()->dump({"--set", infoMakeProperty,      "-s",   CAR_MAKE,
+                         "-b",    "0xdeadbeef",          "-i",   "2147483647",
+                         "0",     "-2147483648",         "-i64", "-9223372036854775808",
+                         "0",     "9223372036854775807", "-f",   "-3.402823466E+38",
+                         "0",     "3.402823466E+38",     "-a",   "123"});
+    VehiclePropValue requestProp;
+    requestProp.prop = toInt(VehicleProperty::INFO_MAKE);
+    requestProp.areaId = 123;
+    auto result = getValue(requestProp);
+    ASSERT_TRUE(result.ok());
+    VehiclePropValue value = result.value();
+    ASSERT_EQ(value.prop, toInt(VehicleProperty::INFO_MAKE));
+    ASSERT_EQ(value.areaId, 123);
+    ASSERT_STREQ(CAR_MAKE, value.value.stringValue.c_str());
+    uint8_t bytes[] = {0xde, 0xad, 0xbe, 0xef};
+    ASSERT_FALSE(memcmp(bytes, value.value.byteValues.data(), sizeof(bytes)));
+    ASSERT_EQ(3u, value.value.int32Values.size());
+    ASSERT_EQ(2147483647, value.value.int32Values[0]);
+    ASSERT_EQ(0, value.value.int32Values[1]);
+    ASSERT_EQ(-2147483648, value.value.int32Values[2]);
+    ASSERT_EQ(3u, value.value.int64Values.size());
+    // -9223372036854775808 is not a valid literal since '-' and '9223372036854775808' would be two
+    // tokens and the later does not fit in unsigned long long.
+    ASSERT_EQ(-9223372036854775807 - 1, value.value.int64Values[0]);
+    ASSERT_EQ(0, value.value.int64Values[1]);
+    ASSERT_EQ(9223372036854775807, value.value.int64Values[2]);
+    ASSERT_EQ(3u, value.value.floatValues.size());
+    ASSERT_EQ(-3.402823466E+38f, value.value.floatValues[0]);
+    ASSERT_EQ(0.0f, value.value.floatValues[1]);
+    ASSERT_EQ(3.402823466E+38f, value.value.floatValues[2]);
+}
+
 }  // namespace fake
 }  // namespace vehicle
 }  // namespace automotive
diff --git a/automotive/vehicle/aidl/impl/fake_impl/obd2frame/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/obd2frame/Android.bp
index c1cee84..c21ad53 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/obd2frame/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/obd2frame/Android.bp
@@ -26,7 +26,7 @@
     export_include_dirs: ["include"],
     defaults: ["VehicleHalDefaults"],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
     ],
-    export_static_lib_headers: ["VehicleHalUtils"],
+    export_static_lib_headers: ["VehicleHalUtilsVendor"],
 }
diff --git a/automotive/vehicle/aidl/impl/fake_impl/obd2frame/test/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/obd2frame/test/Android.bp
index 55b8c93..a16185b 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/obd2frame/test/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/obd2frame/test/Android.bp
@@ -25,7 +25,7 @@
     defaults: ["VehicleHalDefaults"],
     static_libs: [
         "FakeObd2Frame",
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
     ],
     test_suites: ["device-tests"],
 }
diff --git a/automotive/vehicle/aidl/impl/fake_impl/userhal/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/userhal/Android.bp
index 2e95531..1689102 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/userhal/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/userhal/Android.bp
@@ -26,7 +26,7 @@
     export_include_dirs: ["include"],
     defaults: ["VehicleHalDefaults"],
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
     ],
-    export_static_lib_headers: ["VehicleHalUtils"],
+    export_static_lib_headers: ["VehicleHalUtilsVendor"],
 }
diff --git a/automotive/vehicle/aidl/impl/fake_impl/userhal/test/Android.bp b/automotive/vehicle/aidl/impl/fake_impl/userhal/test/Android.bp
index 7d0a534..1471ea6 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/userhal/test/Android.bp
+++ b/automotive/vehicle/aidl/impl/fake_impl/userhal/test/Android.bp
@@ -25,7 +25,7 @@
     defaults: ["VehicleHalDefaults"],
     static_libs: [
         "FakeUserHal",
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "libgtest",
         "libgmock",
     ],
diff --git a/automotive/vehicle/aidl/impl/grpc/utils/proto_message_converter/Android.bp b/automotive/vehicle/aidl/impl/grpc/utils/proto_message_converter/Android.bp
index 7670c25..6209880 100644
--- a/automotive/vehicle/aidl/impl/grpc/utils/proto_message_converter/Android.bp
+++ b/automotive/vehicle/aidl/impl/grpc/utils/proto_message_converter/Android.bp
@@ -34,10 +34,10 @@
     shared_libs: ["libprotobuf-cpp-full"],
     static_libs: [
         "VehicleHalProtos",
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
     ],
     defaults: ["VehicleHalDefaults"],
-    export_static_lib_headers: ["VehicleHalUtils"],
+    export_static_lib_headers: ["VehicleHalUtilsVendor"],
 }
 
 cc_test {
@@ -51,7 +51,7 @@
     static_libs: [
         "VehicleHalProtoMessageConverter",
         "VehicleHalProtos",
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "libgtest",
     ],
     header_libs: ["VehicleHalDefaultConfig"],
diff --git a/automotive/vehicle/aidl/impl/utils/common/Android.bp b/automotive/vehicle/aidl/impl/utils/common/Android.bp
index ace505d..88713f1 100644
--- a/automotive/vehicle/aidl/impl/utils/common/Android.bp
+++ b/automotive/vehicle/aidl/impl/utils/common/Android.bp
@@ -19,7 +19,7 @@
 }
 
 cc_library {
-    name: "VehicleHalUtils",
+    name: "VehicleHalUtilsVendor",
     srcs: ["src/*.cpp"],
     vendor: true,
     local_include_dirs: ["include"],
@@ -27,6 +27,33 @@
     defaults: ["VehicleHalDefaults"],
 }
 
+// This is a non-vendor version for VehicleHalUtilsVendor.
+cc_library {
+    name: "VehicleHalUtils",
+    srcs: ["src/*.cpp"],
+    local_include_dirs: ["include"],
+    export_include_dirs: ["include"],
+    static_libs: [
+        "android-automotive-large-parcelable-lib",
+        "android.hardware.automotive.vehicle-V1-ndk",
+        "libmath",
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libutils",
+    ],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        "-Wthread-safety",
+    ],
+    defaults: [
+        "android-automotive-large-parcelable-defaults",
+    ],
+}
+
 cc_library_headers {
     name: "VehicleHalUtilHeaders",
     export_include_dirs: ["include"],
diff --git a/automotive/vehicle/aidl/impl/vhal/include/ParcelableUtils.h b/automotive/vehicle/aidl/impl/utils/common/include/ParcelableUtils.h
similarity index 88%
rename from automotive/vehicle/aidl/impl/vhal/include/ParcelableUtils.h
rename to automotive/vehicle/aidl/impl/utils/common/include/ParcelableUtils.h
index 4b7c2f3..7b2111b 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/ParcelableUtils.h
+++ b/automotive/vehicle/aidl/impl/utils/common/include/ParcelableUtils.h
@@ -29,6 +29,9 @@
 namespace automotive {
 namespace vehicle {
 
+// Turns the values into a stable large parcelable that could be sent via binder.
+// If values is small enough, it would be put into output.payloads, otherwise a shared memory file
+// would be created and output.sharedMemoryFd would be filled in.
 template <class T1, class T2>
 ::ndk::ScopedAStatus vectorToStableLargeParcelable(std::vector<T1>&& values, T2* output) {
     output->payloads = std::move(values);
@@ -44,6 +47,9 @@
         // 'sharedMemoryFd' field.
         output->payloads.clear();
         output->sharedMemoryFd = std::move(*fd);
+    } else {
+        output->sharedMemoryFd = ::ndk::ScopedFileDescriptor();
+        // Do not modify payloads.
     }
     return ::ndk::ScopedAStatus::ok();
 }
diff --git a/automotive/vehicle/aidl/impl/vhal/include/PendingRequestPool.h b/automotive/vehicle/aidl/impl/utils/common/include/PendingRequestPool.h
similarity index 98%
rename from automotive/vehicle/aidl/impl/vhal/include/PendingRequestPool.h
rename to automotive/vehicle/aidl/impl/utils/common/include/PendingRequestPool.h
index efb3315..dcf5057 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/PendingRequestPool.h
+++ b/automotive/vehicle/aidl/impl/utils/common/include/PendingRequestPool.h
@@ -37,7 +37,7 @@
   public:
     using TimeoutCallbackFunc = std::function<void(const std::unordered_set<int64_t>&)>;
 
-    explicit PendingRequestPool(int64_t timeoutInSec);
+    explicit PendingRequestPool(int64_t timeoutInNano);
 
     ~PendingRequestPool();
 
diff --git a/automotive/vehicle/aidl/impl/utils/common/include/VehicleUtils.h b/automotive/vehicle/aidl/impl/utils/common/include/VehicleUtils.h
index 49b33d5..0f0ccf1 100644
--- a/automotive/vehicle/aidl/impl/utils/common/include/VehicleUtils.h
+++ b/automotive/vehicle/aidl/impl/utils/common/include/VehicleUtils.h
@@ -67,24 +67,30 @@
 }
 
 inline const ::aidl::android::hardware::automotive::vehicle::VehicleAreaConfig* getAreaConfig(
-        const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& propValue,
+        int32_t propId, int32_t areaId,
         const ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig& config) {
     if (config.areaConfigs.size() == 0) {
         return nullptr;
     }
 
-    if (isGlobalProp(propValue.prop)) {
+    if (isGlobalProp(propId)) {
         return &(config.areaConfigs[0]);
     }
 
     for (const auto& c : config.areaConfigs) {
-        if (c.areaId == propValue.areaId) {
+        if (c.areaId == areaId) {
             return &c;
         }
     }
     return nullptr;
 }
 
+inline const ::aidl::android::hardware::automotive::vehicle::VehicleAreaConfig* getAreaConfig(
+        const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& propValue,
+        const ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig& config) {
+    return getAreaConfig(propValue.prop, propValue.areaId, config);
+}
+
 inline std::unique_ptr<::aidl::android::hardware::automotive::vehicle::VehiclePropValue>
 createVehiclePropValueVec(::aidl::android::hardware::automotive::vehicle::VehiclePropertyType type,
                           size_t vecSize) {
diff --git a/automotive/vehicle/aidl/impl/vhal/src/PendingRequestPool.cpp b/automotive/vehicle/aidl/impl/utils/common/src/PendingRequestPool.cpp
similarity index 100%
rename from automotive/vehicle/aidl/impl/vhal/src/PendingRequestPool.cpp
rename to automotive/vehicle/aidl/impl/utils/common/src/PendingRequestPool.cpp
diff --git a/automotive/vehicle/aidl/impl/utils/common/src/VehiclePropertyStore.cpp b/automotive/vehicle/aidl/impl/utils/common/src/VehiclePropertyStore.cpp
index 1a79230..c1fa896 100644
--- a/automotive/vehicle/aidl/impl/utils/common/src/VehiclePropertyStore.cpp
+++ b/automotive/vehicle/aidl/impl/utils/common/src/VehiclePropertyStore.cpp
@@ -21,9 +21,11 @@
 
 #include <VehicleHalTypes.h>
 #include <VehicleUtils.h>
-#include <android-base/format.h>
+#include <android-base/stringprintf.h>
 #include <math/HashCombine.h>
 
+#include <inttypes.h>
+
 namespace android {
 namespace hardware {
 namespace automotive {
@@ -36,13 +38,14 @@
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 using ::android::base::Error;
 using ::android::base::Result;
+using ::android::base::StringPrintf;
 
 bool VehiclePropertyStore::RecordId::operator==(const VehiclePropertyStore::RecordId& other) const {
     return area == other.area && token == other.token;
 }
 
 std::string VehiclePropertyStore::RecordId::toString() const {
-    return ::fmt::format("RecordID{{.areaId={:d}, .token={:d}}}", area, token);
+    return StringPrintf("RecordID{{.areaId=% " PRId32 ", .token=%" PRId64 "}", area, token);
 }
 
 size_t VehiclePropertyStore::RecordIdHash::operator()(RecordId const& recordId) const {
diff --git a/automotive/vehicle/aidl/impl/utils/common/test/Android.bp b/automotive/vehicle/aidl/impl/utils/common/test/Android.bp
index 250b331..bcb3c8d 100644
--- a/automotive/vehicle/aidl/impl/utils/common/test/Android.bp
+++ b/automotive/vehicle/aidl/impl/utils/common/test/Android.bp
@@ -19,11 +19,11 @@
 }
 
 cc_test {
-    name: "VehicleHalVehicleUtilsTest",
+    name: "VehicleHalVehicleUtilsVendorTest",
     srcs: ["*.cpp"],
     vendor: true,
     static_libs: [
-        "VehicleHalUtils",
+        "VehicleHalUtilsVendor",
         "libgtest",
         "libgmock",
     ],
diff --git a/automotive/vehicle/aidl/impl/vhal/test/PendingRequestPoolTest.cpp b/automotive/vehicle/aidl/impl/utils/common/test/PendingRequestPoolTest.cpp
similarity index 100%
rename from automotive/vehicle/aidl/impl/vhal/test/PendingRequestPoolTest.cpp
rename to automotive/vehicle/aidl/impl/utils/common/test/PendingRequestPoolTest.cpp
diff --git a/automotive/vehicle/aidl/impl/vhal/Android.bp b/automotive/vehicle/aidl/impl/vhal/Android.bp
index 0132e6f..295cbb7 100644
--- a/automotive/vehicle/aidl/impl/vhal/Android.bp
+++ b/automotive/vehicle/aidl/impl/vhal/Android.bp
@@ -33,8 +33,7 @@
     static_libs: [
         "DefaultVehicleHal",
         "FakeVehicleHardware",
-        "VehicleHalUtils",
-        "android-automotive-large-parcelable-vendor-lib",
+        "VehicleHalUtilsVendor",
     ],
     header_libs: [
         "IVehicleHardware",
@@ -49,20 +48,17 @@
     vendor: true,
     defaults: [
         "VehicleHalDefaults",
-        "android-automotive-large-parcelable-defaults",
     ],
     local_include_dirs: ["include"],
     export_include_dirs: ["include"],
     srcs: [
         "src/ConnectedClient.cpp",
         "src/DefaultVehicleHal.cpp",
-        "src/PendingRequestPool.cpp",
         "src/RecurrentTimer.cpp",
         "src/SubscriptionManager.cpp",
     ],
     static_libs: [
-        "VehicleHalUtils",
-        "android-automotive-large-parcelable-vendor-lib",
+        "VehicleHalUtilsVendor",
     ],
     header_libs: [
         "IVehicleHardware",
diff --git a/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h b/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h
index d8516b1..15a6278 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h
+++ b/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h
@@ -19,6 +19,7 @@
 
 #include "PendingRequestPool.h"
 
+#include <IVehicleHardware.h>
 #include <VehicleHalTypes.h>
 
 #include <aidl/android/hardware/automotive/vehicle/IVehicleCallback.h>
@@ -41,24 +42,24 @@
 // This class is thread-safe.
 class ConnectedClient {
   public:
-    ConnectedClient(
-            std::shared_ptr<PendingRequestPool> requestPool,
-            std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>
-                    callback);
+    using CallbackType =
+            std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>;
+
+    ConnectedClient(std::shared_ptr<PendingRequestPool> requestPool, CallbackType callback);
 
     virtual ~ConnectedClient() = default;
 
     // Gets the unique ID for this client.
     const void* id();
 
-    // Add client requests. The requests would be registered as pending requests until
+    // Adds client requests. The requests would be registered as pending requests until
     // {@code tryFinishRequests} is called for them.
     // Returns {@code INVALID_ARG} error if any of the requestIds are duplicate with one of the
     // pending request IDs or {@code TRY_AGAIN} error if the pending request pool is full and could
     // no longer add requests.
     ::android::base::Result<void> addRequests(const std::unordered_set<int64_t>& requestIds);
 
-    // Mark the requests as finished. Returns a list of request IDs that was pending and has been
+    // Marks the requests as finished. Returns a list of request IDs that was pending and has been
     // finished. It must be a set of the requested request IDs.
     std::unordered_set<int64_t> tryFinishRequests(const std::unordered_set<int64_t>& requestIds);
 
@@ -67,8 +68,7 @@
     virtual std::shared_ptr<const PendingRequestPool::TimeoutCallbackFunc> getTimeoutCallback() = 0;
 
     const std::shared_ptr<PendingRequestPool> mRequestPool;
-    const std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>
-            mCallback;
+    const CallbackType mCallback;
 };
 
 // A class to represent a client that calls {@code IVehicle.setValues} or {@code
@@ -76,13 +76,10 @@
 template <class ResultType, class ResultsType>
 class GetSetValuesClient final : public ConnectedClient {
   public:
-    GetSetValuesClient(
-            std::shared_ptr<PendingRequestPool> requestPool,
-            std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>
-                    callback);
+    GetSetValuesClient(std::shared_ptr<PendingRequestPool> requestPool, CallbackType callback);
 
     // Sends the results to this client.
-    void sendResults(const std::vector<ResultType>& results);
+    void sendResults(std::vector<ResultType>&& results);
 
     // Sends each result separately to this client. Each result would be sent through one callback
     // invocation.
@@ -104,15 +101,17 @@
 // A class to represent a client that calls {@code IVehicle.subscribe}.
 class SubscriptionClient final : public ConnectedClient {
   public:
-    SubscriptionClient(
-            std::shared_ptr<PendingRequestPool> requestPool,
-            std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>
-                    callback);
+    SubscriptionClient(std::shared_ptr<PendingRequestPool> requestPool, CallbackType callback);
 
     // Gets the callback to be called when the request for this client has finished.
-    std::shared_ptr<const std::function<
-            void(std::vector<::aidl::android::hardware::automotive::vehicle::GetValueResult>)>>
-    getResultCallback();
+    std::shared_ptr<const IVehicleHardware::GetValuesCallback> getResultCallback();
+
+    // Marshals the updated values into largeParcelable and sents it through {@code onPropertyEvent}
+    // callback.
+    static void sendUpdatedValues(
+            CallbackType callback,
+            std::vector<::aidl::android::hardware::automotive::vehicle::VehiclePropValue>&&
+                    updatedValues);
 
   protected:
     // Gets the callback to be called when the request for this client has timeout.
@@ -121,14 +120,11 @@
   private:
     // The following members are only initialized during construction.
     std::shared_ptr<const PendingRequestPool::TimeoutCallbackFunc> mTimeoutCallback;
-    std::shared_ptr<const std::function<void(
-            std::vector<::aidl::android::hardware::automotive::vehicle::GetValueResult>)>>
-            mResultCallback;
+    std::shared_ptr<const IVehicleHardware::GetValuesCallback> mResultCallback;
+    std::shared_ptr<const IVehicleHardware::PropertyChangeCallback> mPropertyChangeCallback;
 
     static void onGetValueResults(
-            const void* clientId,
-            std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>
-                    callback,
+            const void* clientId, CallbackType callback,
             std::shared_ptr<PendingRequestPool> requestPool,
             std::vector<::aidl::android::hardware::automotive::vehicle::GetValueResult> results);
 };
diff --git a/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h b/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h
index b0423a3..5e7adfc 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h
+++ b/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h
@@ -39,13 +39,6 @@
 namespace automotive {
 namespace vehicle {
 
-// private namespace
-namespace defaultvehiclehal_impl {
-
-constexpr int INVALID_MEMORY_FD = -1;
-
-}  // namespace defaultvehiclehal_impl
-
 class DefaultVehicleHal final : public ::aidl::android::hardware::automotive::vehicle::BnVehicle {
   public:
     using CallbackType =
@@ -79,6 +72,7 @@
                                      const std::vector<int32_t>& propIds) override;
     ::ndk::ScopedAStatus returnSharedMemory(const CallbackType& callback,
                                             int64_t sharedMemoryId) override;
+    binder_status_t dump(int fd, const char** args, uint32_t numArgs) override;
 
     IVehicleHardware* getHardware();
 
@@ -93,11 +87,68 @@
             GetSetValuesClient<::aidl::android::hardware::automotive::vehicle::SetValueResult,
                                ::aidl::android::hardware::automotive::vehicle::SetValueResults>;
 
+    // A thread safe class to maintain an increasing request ID for each subscribe client. This
+    // class is safe to pass to async callbacks.
+    class SubscribeIdByClient {
+      public:
+        int64_t getId(const CallbackType& callback);
+
+      private:
+        std::mutex mLock;
+        std::unordered_map<const AIBinder*, int64_t> mIds GUARDED_BY(mLock);
+    };
+
+    // A thread safe class to store all subscribe clients. This class is safe to pass to async
+    // callbacks.
+    class SubscriptionClients {
+      public:
+        SubscriptionClients(std::shared_ptr<PendingRequestPool> pool) : mPendingRequestPool(pool) {}
+
+        std::shared_ptr<SubscriptionClient> getClient(const CallbackType& callback);
+
+        void removeClient(const AIBinder* clientId);
+
+        size_t countClients();
+
+      private:
+        std::mutex mLock;
+        std::unordered_map<const AIBinder*, std::shared_ptr<SubscriptionClient>> mClients
+                GUARDED_BY(mLock);
+        // PendingRequestPool is thread-safe.
+        std::shared_ptr<PendingRequestPool> mPendingRequestPool;
+    };
+
+    // A wrapper for linkToDeath to enable stubbing for test.
+    class ILinkToDeath {
+      public:
+        virtual ~ILinkToDeath() = default;
+
+        virtual binder_status_t linkToDeath(AIBinder* binder, AIBinder_DeathRecipient* recipient,
+                                            void* cookie) = 0;
+    };
+
+    // A real implementation for ILinkToDeath.
+    class AIBinderLinkToDeathImpl final : public ILinkToDeath {
+      public:
+        binder_status_t linkToDeath(AIBinder* binder, AIBinder_DeathRecipient* recipient,
+                                    void* cookie) override;
+    };
+
+    // OnBinderDiedContext is a type used as a cookie passed deathRecipient. The deathRecipient's
+    // onBinderDied function takes only a cookie as input and we have to store all the contexts
+    // as the cookie.
+    struct OnBinderDiedContext {
+        DefaultVehicleHal* vhal;
+        const AIBinder* clientId;
+    };
+
     // The default timeout of get or set value requests is 30s.
     // TODO(b/214605968): define TIMEOUT_IN_NANO in IVehicle and allow getValues/setValues/subscribe
     // to specify custom timeouts.
     static constexpr int64_t TIMEOUT_IN_NANO = 30'000'000'000;
-    const std::unique_ptr<IVehicleHardware> mVehicleHardware;
+    // heart beat event interval: 3s
+    static constexpr int64_t HEART_BEAT_INTERVAL_IN_NANO = 3'000'000'000;
+    const std::shared_ptr<IVehicleHardware> mVehicleHardware;
 
     // mConfigsByPropId and mConfigFile are only modified during initialization, so no need to
     // lock guard them.
@@ -108,22 +159,24 @@
     // PendingRequestPool is thread-safe.
     std::shared_ptr<PendingRequestPool> mPendingRequestPool;
     // SubscriptionManager is thread-safe.
-    std::unique_ptr<SubscriptionManager> mSubscriptionManager;
+    std::shared_ptr<SubscriptionManager> mSubscriptionManager;
 
     std::mutex mLock;
-    std::unordered_map<CallbackType, std::shared_ptr<GetValuesClient>> mGetValuesClients
+    std::unordered_map<const AIBinder*, std::unique_ptr<OnBinderDiedContext>> mOnBinderDiedContexts
             GUARDED_BY(mLock);
-    std::unordered_map<CallbackType, std::shared_ptr<SetValuesClient>> mSetValuesClients
+    std::unordered_map<const AIBinder*, std::shared_ptr<GetValuesClient>> mGetValuesClients
             GUARDED_BY(mLock);
-    std::unordered_map<CallbackType, std::shared_ptr<SubscriptionClient>> mSubscriptionClients
+    std::unordered_map<const AIBinder*, std::shared_ptr<SetValuesClient>> mSetValuesClients
             GUARDED_BY(mLock);
-    // An increasing request ID we keep for subscribe clients.
-    std::unordered_map<CallbackType, int64_t> mSubscribeIdByClient GUARDED_BY(mLock);
+    // SubscriptionClients is thread-safe.
+    std::shared_ptr<SubscriptionClients> mSubscriptionClients;
+    // mLinkToDeathImpl is only going to be changed in test.
+    std::unique_ptr<ILinkToDeath> mLinkToDeathImpl;
 
-    template <class T>
-    std::shared_ptr<T> getOrCreateClient(
-            std::unordered_map<CallbackType, std::shared_ptr<T>>* clients,
-            const CallbackType& callback) REQUIRES(mLock);
+    // RecurrentTimer is thread-safe.
+    RecurrentTimer mRecurrentTimer;
+
+    ::ndk::ScopedAIBinder_DeathRecipient mDeathRecipient;
 
     ::android::base::Result<void> checkProperty(
             const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& propValue);
@@ -136,13 +189,57 @@
             const std::vector<::aidl::android::hardware::automotive::vehicle::SetValueRequest>&
                     requests);
 
-    void getValueFromHardwareCallCallback(
-            const CallbackType& callback,
+    ::android::base::Result<void> checkSubscribeOptions(
+            const std::vector<::aidl::android::hardware::automotive::vehicle::SubscribeOptions>&
+                    options);
+
+    ::android::base::Result<void> checkReadPermission(
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
+
+    ::android::base::Result<void> checkWritePermission(
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
+
+    ::android::base::Result<
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig*>
+    getConfig(int32_t propId) const;
+
+    void onBinderDiedWithContext(const AIBinder* clientId);
+
+    void onBinderUnlinkedWithContext(const AIBinder* clientId);
+
+    void monitorBinderLifeCycle(const CallbackType& callback);
+
+    bool checkDumpPermission();
+
+    template <class T>
+    static std::shared_ptr<T> getOrCreateClient(
+            std::unordered_map<const AIBinder*, std::shared_ptr<T>>* clients,
+            const CallbackType& callback, std::shared_ptr<PendingRequestPool> pendingRequestPool);
+
+    static void getValueFromHardwareCallCallback(
+            std::weak_ptr<IVehicleHardware> vehicleHardware,
+            std::shared_ptr<SubscribeIdByClient> subscribeIdByClient,
+            std::shared_ptr<SubscriptionClients> subscriptionClients, const CallbackType& callback,
             const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value);
 
+    static void onPropertyChangeEvent(
+            std::weak_ptr<SubscriptionManager> subscriptionManager,
+            const std::vector<::aidl::android::hardware::automotive::vehicle::VehiclePropValue>&
+                    updatedValues);
+
+    static void checkHealth(std::weak_ptr<IVehicleHardware> hardware,
+                            std::weak_ptr<SubscriptionManager> subscriptionManager);
+
+    static void onBinderDied(void* cookie);
+
+    static void onBinderUnlinked(void* cookie);
+
     // Test-only
     // Set the default timeout for pending requests.
     void setTimeout(int64_t timeoutInNano);
+
+    // Test-only
+    void setLinkToDeathImpl(std::unique_ptr<ILinkToDeath> impl);
 };
 
 }  // namespace vehicle
diff --git a/automotive/vehicle/aidl/impl/vhal/include/SubscriptionManager.h b/automotive/vehicle/aidl/impl/vhal/include/SubscriptionManager.h
index 28809c6..e739c8c 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/SubscriptionManager.h
+++ b/automotive/vehicle/aidl/impl/vhal/include/SubscriptionManager.h
@@ -38,6 +38,7 @@
 // A thread-safe subscription manager that manages all VHAL subscriptions.
 class SubscriptionManager final {
   public:
+    using ClientIdType = const AIBinder*;
     using CallbackType =
             std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>;
     using GetValueFunc = std::function<void(
@@ -59,24 +60,24 @@
                     options,
             bool isContinuousProperty);
 
-    // Unsubscribes from the properties for the callback.
-    // Returns error if the callback was not subscribed before or one of the given property was not
+    // Unsubscribes from the properties for the client.
+    // Returns error if the client was not subscribed before or one of the given property was not
     // subscribed. If error is returned, no property would be unsubscribed.
-    // Returns ok if all the requested properties for the callback are unsubscribed.
-    ::android::base::Result<void> unsubscribe(const CallbackType& callback,
+    // Returns ok if all the requested properties for the client are unsubscribed.
+    ::android::base::Result<void> unsubscribe(ClientIdType client,
                                               const std::vector<int32_t>& propIds);
 
-    // Unsubscribes to all the properties for the callback.
-    // Returns error if the callback was not subscribed before. If error is returned, no property
+    // Unsubscribes from all the properties for the client.
+    // Returns error if the client was not subscribed before. If error is returned, no property
     // would be unsubscribed.
-    // Returns ok if all the properties for the callback are unsubscribed.
-    ::android::base::Result<void> unsubscribe(const CallbackType& callback);
+    // Returns ok if all the properties for the client are unsubscribed.
+    ::android::base::Result<void> unsubscribe(ClientIdType client);
 
     // For a list of updated properties, returns a map that maps clients subscribing to
     // the updated properties to a list of updated values. This would only return on-change property
     // clients that should be informed for the given updated values.
     std::unordered_map<
-            std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback>,
+            CallbackType,
             std::vector<const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue*>>
     getSubscribedClients(
             const std::vector<::aidl::android::hardware::automotive::vehicle::VehiclePropValue>&
@@ -86,6 +87,9 @@
     static bool checkSampleRate(float sampleRate);
 
   private:
+    // Friend class for testing.
+    friend class DefaultVehicleHalTest;
+
     struct PropIdAreaId {
         int32_t propId;
         int32_t areaId;
@@ -131,9 +135,10 @@
     };
 
     mutable std::mutex mLock;
-    std::unordered_map<PropIdAreaId, std::unordered_set<CallbackType>, PropIdAreaIdHash>
+    std::unordered_map<PropIdAreaId, std::unordered_map<ClientIdType, CallbackType>,
+                       PropIdAreaIdHash>
             mClientsByPropIdArea GUARDED_BY(mLock);
-    std::unordered_map<CallbackType, std::unordered_map<PropIdAreaId, std::unique_ptr<Subscription>,
+    std::unordered_map<ClientIdType, std::unordered_map<PropIdAreaId, std::unique_ptr<Subscription>,
                                                         PropIdAreaIdHash>>
             mSubscriptionsByClient GUARDED_BY(mLock);
     // RecurrentTimer is thread-safe.
@@ -141,6 +146,9 @@
     const GetValueFunc mGetValue;
 
     static ::android::base::Result<int64_t> getInterval(float sampleRate);
+
+    // Checks whether the manager is empty. For testing purpose.
+    bool isEmpty();
 };
 
 }  // namespace vehicle
diff --git a/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp b/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp
index 7d02a05..098bfee 100644
--- a/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp
@@ -84,9 +84,9 @@
 // Send all the GetValue/SetValue results through callback in a single callback invocation.
 template <class ResultType, class ResultsType>
 void sendGetOrSetValueResults(std::shared_ptr<IVehicleCallback> callback,
-                              const std::vector<ResultType>& results) {
+                              std::vector<ResultType>&& results) {
     ResultsType parcelableResults;
-    ScopedAStatus status = vectorToStableLargeParcelable(results, &parcelableResults);
+    ScopedAStatus status = vectorToStableLargeParcelable(std::move(results), &parcelableResults);
     if (status.isOk()) {
         if (ScopedAStatus callbackStatus = callCallback(callback, parcelableResults);
             !callbackStatus.isOk()) {
@@ -99,7 +99,8 @@
     ALOGE("failed to marshal result into large parcelable, error: "
           "%s, code: %d",
           status.getMessage(), statusCode);
-    sendGetOrSetValueResultsSeparately<ResultType, ResultsType>(callback, results);
+    sendGetOrSetValueResultsSeparately<ResultType, ResultsType>(callback,
+                                                                parcelableResults.payloads);
 }
 
 // The timeout callback for GetValues/SetValues.
@@ -115,7 +116,7 @@
                 .status = StatusCode::TRY_AGAIN,
         });
     }
-    sendGetOrSetValueResults<ResultType, ResultsType>(callback, timeoutResults);
+    sendGetOrSetValueResults<ResultType, ResultsType>(callback, std::move(timeoutResults));
 }
 
 // The on-results callback for GetValues/SetValues.
@@ -123,7 +124,7 @@
 void getOrSetValuesCallback(
         const void* clientId,
         std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback> callback,
-        std::vector<ResultType> results, std::shared_ptr<PendingRequestPool> requestPool) {
+        std::vector<ResultType>&& results, std::shared_ptr<PendingRequestPool> requestPool) {
     std::unordered_set<int64_t> requestIds;
     for (const auto& result : results) {
         requestIds.insert(result.requestId);
@@ -145,7 +146,7 @@
     }
 
     if (!results.empty()) {
-        sendGetOrSetValueResults<ResultType, ResultsType>(callback, results);
+        sendGetOrSetValueResults<ResultType, ResultsType>(callback, std::move(results));
     }
 }
 
@@ -156,9 +157,9 @@
         std::shared_ptr<IVehicleCallback> callback, const SetValueResult& result);
 
 template void sendGetOrSetValueResults<GetValueResult, GetValueResults>(
-        std::shared_ptr<IVehicleCallback> callback, const std::vector<GetValueResult>& results);
+        std::shared_ptr<IVehicleCallback> callback, std::vector<GetValueResult>&& results);
 template void sendGetOrSetValueResults<SetValueResult, SetValueResults>(
-        std::shared_ptr<IVehicleCallback> callback, const std::vector<SetValueResult>& results);
+        std::shared_ptr<IVehicleCallback> callback, std::vector<SetValueResult>&& results);
 
 template void sendGetOrSetValueResultsSeparately<GetValueResult, GetValueResults>(
         std::shared_ptr<IVehicleCallback> callback, const std::vector<GetValueResult>& results);
@@ -175,11 +176,11 @@
 template void getOrSetValuesCallback<GetValueResult, GetValueResults>(
         const void* clientId,
         std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback> callback,
-        std::vector<GetValueResult> results, std::shared_ptr<PendingRequestPool> requestPool);
+        std::vector<GetValueResult>&& results, std::shared_ptr<PendingRequestPool> requestPool);
 template void getOrSetValuesCallback<SetValueResult, SetValueResults>(
         const void* clientId,
         std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback> callback,
-        std::vector<SetValueResult> results, std::shared_ptr<PendingRequestPool> requestPool);
+        std::vector<SetValueResult>&& results, std::shared_ptr<PendingRequestPool> requestPool);
 
 }  // namespace
 
@@ -230,9 +231,8 @@
 }
 
 template <class ResultType, class ResultsType>
-void GetSetValuesClient<ResultType, ResultsType>::sendResults(
-        const std::vector<ResultType>& results) {
-    return sendGetOrSetValueResults<ResultType, ResultsType>(mCallback, results);
+void GetSetValuesClient<ResultType, ResultsType>::sendResults(std::vector<ResultType>&& results) {
+    return sendGetOrSetValueResults<ResultType, ResultsType>(mCallback, std::move(results));
 }
 
 template <class ResultType, class ResultsType>
@@ -258,7 +258,7 @@
             });
     auto requestPoolCopy = mRequestPool;
     const void* clientId = reinterpret_cast<const void*>(this);
-    mResultCallback = std::make_shared<const std::function<void(std::vector<GetValueResult>)>>(
+    mResultCallback = std::make_shared<const IVehicleHardware::GetValuesCallback>(
             [clientId, callback, requestPoolCopy](std::vector<GetValueResult> results) {
                 onGetValueResults(clientId, callback, requestPoolCopy, results);
             });
@@ -274,6 +274,33 @@
     return mTimeoutCallback;
 }
 
+void SubscriptionClient::sendUpdatedValues(std::shared_ptr<IVehicleCallback> callback,
+                                           std::vector<VehiclePropValue>&& updatedValues) {
+    if (updatedValues.empty()) {
+        return;
+    }
+
+    // TODO(b/205189110): Use memory pool here and fill in sharedMemoryId.
+    VehiclePropValues vehiclePropValues;
+    int32_t sharedMemoryFileCount = 0;
+    ScopedAStatus status =
+            vectorToStableLargeParcelable(std::move(updatedValues), &vehiclePropValues);
+    if (!status.isOk()) {
+        int statusCode = status.getServiceSpecificError();
+        ALOGE("subscribe: failed to marshal result into large parcelable, error: "
+              "%s, code: %d",
+              status.getMessage(), statusCode);
+        return;
+    }
+
+    if (ScopedAStatus callbackStatus =
+                callback->onPropertyEvent(vehiclePropValues, sharedMemoryFileCount);
+        !callbackStatus.isOk()) {
+        ALOGE("subscribe: failed to call callback, error: %s, code: %d", status.getMessage(),
+              status.getServiceSpecificError());
+    }
+}
+
 void SubscriptionClient::onGetValueResults(const void* clientId,
                                            std::shared_ptr<IVehicleCallback> callback,
                                            std::shared_ptr<PendingRequestPool> requestPool,
@@ -308,27 +335,7 @@
         propValues.push_back(std::move(result.prop.value()));
     }
 
-    if (propValues.empty()) {
-        return;
-    }
-    // TODO(b/205189110): Use memory pool here and fill in sharedMemoryId.
-    VehiclePropValues vehiclePropValues;
-    int32_t sharedMemoryFileCount = 0;
-    ScopedAStatus status = vectorToStableLargeParcelable(propValues, &vehiclePropValues);
-    if (!status.isOk()) {
-        int statusCode = status.getServiceSpecificError();
-        ALOGE("failed to marshal result into large parcelable, error: "
-              "%s, code: %d",
-              status.getMessage(), statusCode);
-        return;
-    }
-
-    if (ScopedAStatus callbackStatus =
-                callback->onPropertyEvent(vehiclePropValues, sharedMemoryFileCount);
-        !callbackStatus.isOk()) {
-        ALOGE("failed to call callback, error: %s, code: %d", status.getMessage(),
-              status.getServiceSpecificError());
-    }
+    sendUpdatedValues(callback, std::move(propValues));
 }
 
 }  // namespace vehicle
diff --git a/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp b/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp
index 1e76eb7..c0a66da 100644
--- a/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp
@@ -23,7 +23,11 @@
 #include <VehicleUtils.h>
 
 #include <android-base/result.h>
+#include <android-base/stringprintf.h>
+#include <android/binder_ibinder.h>
+#include <private/android_filesystem_config.h>
 #include <utils/Log.h>
+#include <utils/SystemClock.h>
 
 #include <inttypes.h>
 #include <set>
@@ -40,7 +44,6 @@
 using ::aidl::android::hardware::automotive::vehicle::GetValueRequests;
 using ::aidl::android::hardware::automotive::vehicle::GetValueResult;
 using ::aidl::android::hardware::automotive::vehicle::GetValueResults;
-using ::aidl::android::hardware::automotive::vehicle::IVehicleCallback;
 using ::aidl::android::hardware::automotive::vehicle::SetValueRequest;
 using ::aidl::android::hardware::automotive::vehicle::SetValueRequests;
 using ::aidl::android::hardware::automotive::vehicle::SetValueResult;
@@ -50,11 +53,18 @@
 using ::aidl::android::hardware::automotive::vehicle::VehicleAreaConfig;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropConfigs;
+using ::aidl::android::hardware::automotive::vehicle::VehicleProperty;
+using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyAccess;
+using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyChangeMode;
+using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyStatus;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 using ::android::automotive::car_binder_lib::LargeParcelableBase;
 using ::android::base::Error;
 using ::android::base::expected;
 using ::android::base::Result;
+using ::android::base::StringPrintf;
+
+using ::ndk::ScopedAIBinder_DeathRecipient;
 using ::ndk::ScopedAStatus;
 
 std::string toString(const std::unordered_set<int64_t>& values) {
@@ -70,6 +80,29 @@
 
 }  // namespace
 
+std::shared_ptr<SubscriptionClient> DefaultVehicleHal::SubscriptionClients::getClient(
+        const CallbackType& callback) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    return getOrCreateClient(&mClients, callback, mPendingRequestPool);
+}
+
+int64_t DefaultVehicleHal::SubscribeIdByClient::getId(const CallbackType& callback) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    // This would be initialized to 0 if callback does not exist in the map.
+    int64_t subscribeId = (mIds[callback->asBinder().get()])++;
+    return subscribeId;
+}
+
+void DefaultVehicleHal::SubscriptionClients::removeClient(const AIBinder* clientId) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mClients.erase(clientId);
+}
+
+size_t DefaultVehicleHal::SubscriptionClients::countClients() {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    return mClients.size();
+}
+
 DefaultVehicleHal::DefaultVehicleHal(std::unique_ptr<IVehicleHardware> hardware)
     : mVehicleHardware(std::move(hardware)),
       mPendingRequestPool(std::make_shared<PendingRequestPool>(TIMEOUT_IN_NANO)) {
@@ -90,51 +123,139 @@
         mConfigFile = std::move(result.value());
     }
 
-    mSubscriptionManager = std::make_unique<SubscriptionManager>(
-            [this](const CallbackType& callback, const VehiclePropValue& value) {
-                getValueFromHardwareCallCallback(callback, value);
-            });
+    mSubscriptionClients = std::make_shared<SubscriptionClients>(mPendingRequestPool);
+
+    auto subscribeIdByClient = std::make_shared<SubscribeIdByClient>();
+    // Make a weak copy of IVehicleHardware because subscriptionManager uses IVehicleHardware and
+    // IVehicleHardware uses subscriptionManager. We want to avoid cyclic reference.
+    std::weak_ptr<IVehicleHardware> hardwareCopy = mVehicleHardware;
+    SubscriptionManager::GetValueFunc getValueFunc = std::bind(
+            &DefaultVehicleHal::getValueFromHardwareCallCallback, hardwareCopy, subscribeIdByClient,
+            mSubscriptionClients, std::placeholders::_1, std::placeholders::_2);
+    mSubscriptionManager = std::make_shared<SubscriptionManager>(std::move(getValueFunc));
+
+    std::weak_ptr<SubscriptionManager> subscriptionManagerCopy = mSubscriptionManager;
+    mVehicleHardware->registerOnPropertyChangeEvent(
+            std::make_unique<IVehicleHardware::PropertyChangeCallback>(
+                    [subscriptionManagerCopy](std::vector<VehiclePropValue> updatedValues) {
+                        onPropertyChangeEvent(subscriptionManagerCopy, updatedValues);
+                    }));
+
+    // Register heartbeat event.
+    mRecurrentTimer.registerTimerCallback(
+            HEART_BEAT_INTERVAL_IN_NANO,
+            std::make_shared<std::function<void()>>([hardwareCopy, subscriptionManagerCopy]() {
+                checkHealth(hardwareCopy, subscriptionManagerCopy);
+            }));
+
+    mLinkToDeathImpl = std::make_unique<AIBinderLinkToDeathImpl>();
+    mDeathRecipient = ScopedAIBinder_DeathRecipient(
+            AIBinder_DeathRecipient_new(&DefaultVehicleHal::onBinderDied));
+    AIBinder_DeathRecipient_setOnUnlinked(mDeathRecipient.get(),
+                                          &DefaultVehicleHal::onBinderUnlinked);
 }
 
 DefaultVehicleHal::~DefaultVehicleHal() {
-    // mSubscriptionManager has reference to this, so must be destroyed before other members.
-    mSubscriptionManager.reset();
+    // Delete the deathRecipient so that onBinderDied would not be called to reference 'this'.
+    mDeathRecipient = ScopedAIBinder_DeathRecipient();
+}
+
+void DefaultVehicleHal::onPropertyChangeEvent(
+        std::weak_ptr<SubscriptionManager> subscriptionManager,
+        const std::vector<VehiclePropValue>& updatedValues) {
+    auto manager = subscriptionManager.lock();
+    if (manager == nullptr) {
+        ALOGW("the SubscriptionManager is destroyed, DefaultVehicleHal is ending");
+        return;
+    }
+    auto updatedValuesByClients = manager->getSubscribedClients(updatedValues);
+    for (const auto& [callback, valuePtrs] : updatedValuesByClients) {
+        std::vector<VehiclePropValue> values;
+        for (const VehiclePropValue* valuePtr : valuePtrs) {
+            values.push_back(*valuePtr);
+        }
+        SubscriptionClient::sendUpdatedValues(callback, std::move(values));
+    }
 }
 
 template <class T>
 std::shared_ptr<T> DefaultVehicleHal::getOrCreateClient(
-        std::unordered_map<CallbackType, std::shared_ptr<T>>* clients,
-        const CallbackType& callback) {
-    if (clients->find(callback) == clients->end()) {
-        // TODO(b/204943359): Remove client from clients when linkToDeath is implemented.
-        (*clients)[callback] = std::make_shared<T>(mPendingRequestPool, callback);
+        std::unordered_map<const AIBinder*, std::shared_ptr<T>>* clients,
+        const CallbackType& callback, std::shared_ptr<PendingRequestPool> pendingRequestPool) {
+    const AIBinder* clientId = callback->asBinder().get();
+    if (clients->find(clientId) == clients->end()) {
+        (*clients)[clientId] = std::make_shared<T>(pendingRequestPool, callback);
     }
-    return (*clients)[callback];
+    return (*clients)[clientId];
+}
+
+void DefaultVehicleHal::monitorBinderLifeCycle(const CallbackType& callback) {
+    AIBinder* clientId = callback->asBinder().get();
+    {
+        std::scoped_lock<std::mutex> lockGuard(mLock);
+        if (mOnBinderDiedContexts.find(clientId) != mOnBinderDiedContexts.end()) {
+            // Already registered.
+            return;
+        }
+    }
+
+    std::unique_ptr<OnBinderDiedContext> context = std::make_unique<OnBinderDiedContext>(
+            OnBinderDiedContext{.vhal = this, .clientId = clientId});
+    binder_status_t status = mLinkToDeathImpl->linkToDeath(clientId, mDeathRecipient.get(),
+                                                           static_cast<void*>(context.get()));
+    if (status == STATUS_OK) {
+        std::scoped_lock<std::mutex> lockGuard(mLock);
+        // Insert into a map to keep the context object alive.
+        mOnBinderDiedContexts[clientId] = std::move(context);
+    } else {
+        ALOGE("failed to call linkToDeath on client binder, status: %d", static_cast<int>(status));
+    }
+}
+
+void DefaultVehicleHal::onBinderDied(void* cookie) {
+    OnBinderDiedContext* context = reinterpret_cast<OnBinderDiedContext*>(cookie);
+    context->vhal->onBinderDiedWithContext(context->clientId);
+}
+
+void DefaultVehicleHal::onBinderDiedWithContext(const AIBinder* clientId) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mSetValuesClients.erase(clientId);
+    mGetValuesClients.erase(clientId);
+    mSubscriptionClients->removeClient(clientId);
+    mSubscriptionManager->unsubscribe(clientId);
+}
+
+void DefaultVehicleHal::onBinderUnlinked(void* cookie) {
+    // Delete the context associated with this cookie.
+    OnBinderDiedContext* context = reinterpret_cast<OnBinderDiedContext*>(cookie);
+    context->vhal->onBinderUnlinkedWithContext(context->clientId);
+}
+
+void DefaultVehicleHal::onBinderUnlinkedWithContext(const AIBinder* clientId) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mOnBinderDiedContexts.erase(clientId);
 }
 
 template std::shared_ptr<DefaultVehicleHal::GetValuesClient>
 DefaultVehicleHal::getOrCreateClient<DefaultVehicleHal::GetValuesClient>(
-        std::unordered_map<CallbackType, std::shared_ptr<GetValuesClient>>* clients,
-        const CallbackType& callback);
+        std::unordered_map<const AIBinder*, std::shared_ptr<GetValuesClient>>* clients,
+        const CallbackType& callback, std::shared_ptr<PendingRequestPool> pendingRequestPool);
 template std::shared_ptr<DefaultVehicleHal::SetValuesClient>
 DefaultVehicleHal::getOrCreateClient<DefaultVehicleHal::SetValuesClient>(
-        std::unordered_map<CallbackType, std::shared_ptr<SetValuesClient>>* clients,
-        const CallbackType& callback);
+        std::unordered_map<const AIBinder*, std::shared_ptr<SetValuesClient>>* clients,
+        const CallbackType& callback, std::shared_ptr<PendingRequestPool> pendingRequestPool);
 template std::shared_ptr<SubscriptionClient>
 DefaultVehicleHal::getOrCreateClient<SubscriptionClient>(
-        std::unordered_map<CallbackType, std::shared_ptr<SubscriptionClient>>* clients,
-        const CallbackType& callback);
+        std::unordered_map<const AIBinder*, std::shared_ptr<SubscriptionClient>>* clients,
+        const CallbackType& callback, std::shared_ptr<PendingRequestPool> pendingRequestPool);
 
-void DefaultVehicleHal::getValueFromHardwareCallCallback(const CallbackType& callback,
-                                                         const VehiclePropValue& value) {
-    int64_t subscribeId;
-    std::shared_ptr<SubscriptionClient> client;
-    {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        // This is initialized to 0 if callback does not exist in the map.
-        subscribeId = (mSubscribeIdByClient[callback])++;
-        client = getOrCreateClient(&mSubscriptionClients, callback);
-    }
+void DefaultVehicleHal::getValueFromHardwareCallCallback(
+        std::weak_ptr<IVehicleHardware> vehicleHardware,
+        std::shared_ptr<SubscribeIdByClient> subscribeIdByClient,
+        std::shared_ptr<SubscriptionClients> subscriptionClients, const CallbackType& callback,
+        const VehiclePropValue& value) {
+    int64_t subscribeId = subscribeIdByClient->getId(callback);
+    auto client = subscriptionClients->getClient(callback);
     if (auto addRequestResult = client->addRequests({subscribeId}); !addRequestResult.ok()) {
         ALOGE("subscribe[%" PRId64 "]: too many pending requests, ignore the getValue request",
               subscribeId);
@@ -146,8 +267,12 @@
             .prop = value,
     }};
 
-    if (StatusCode status =
-                mVehicleHardware->getValues(client->getResultCallback(), hardwareRequests);
+    std::shared_ptr<IVehicleHardware> hardware = vehicleHardware.lock();
+    if (hardware == nullptr) {
+        ALOGW("the IVehicleHardware is destroyed, DefaultVehicleHal is ending");
+        return;
+    }
+    if (StatusCode status = hardware->getValues(client->getResultCallback(), hardwareRequests);
         status != StatusCode::OK) {
         // If the hardware returns error, finish all the pending requests for this request because
         // we never expect hardware to call callback for these requests.
@@ -174,33 +299,43 @@
     return ScopedAStatus::ok();
 }
 
-Result<void> DefaultVehicleHal::checkProperty(const VehiclePropValue& propValue) {
-    int32_t propId = propValue.prop;
+Result<const VehiclePropConfig*> DefaultVehicleHal::getConfig(int32_t propId) const {
     auto it = mConfigsByPropId.find(propId);
     if (it == mConfigsByPropId.end()) {
         return Error() << "no config for property, ID: " << propId;
     }
-    const VehiclePropConfig& config = it->second;
-    const VehicleAreaConfig* areaConfig = getAreaConfig(propValue, config);
+    return &(it->second);
+}
+
+Result<void> DefaultVehicleHal::checkProperty(const VehiclePropValue& propValue) {
+    int32_t propId = propValue.prop;
+    auto result = getConfig(propId);
+    if (!result.ok()) {
+        return result.error();
+    }
+    const VehiclePropConfig* config = result.value();
+    const VehicleAreaConfig* areaConfig = getAreaConfig(propValue, *config);
     if (!isGlobalProp(propId) && areaConfig == nullptr) {
         // Ignore areaId for global property. For non global property, check whether areaId is
         // allowed. areaId must appear in areaConfig.
         return Error() << "invalid area ID: " << propValue.areaId << " for prop ID: " << propId
                        << ", not listed in config";
     }
-    if (auto result = checkPropValue(propValue, &config); !result.ok()) {
+    if (auto result = checkPropValue(propValue, config); !result.ok()) {
         return Error() << "invalid property value: " << propValue.toString()
-                       << ", error: " << result.error().message();
+                       << ", error: " << getErrorMsg(result);
     }
     if (auto result = checkValueRange(propValue, areaConfig); !result.ok()) {
         return Error() << "property value out of range: " << propValue.toString()
-                       << ", error: " << result.error().message();
+                       << ", error: " << getErrorMsg(result);
     }
     return {};
 }
 
 ScopedAStatus DefaultVehicleHal::getValues(const CallbackType& callback,
                                            const GetValueRequests& requests) {
+    monitorBinderLifeCycle(callback);
+
     expected<LargeParcelableBase::BorrowedOwnedObject<GetValueRequests>, ScopedAStatus>
             deserializedResults = fromStableLargeParcelable(requests);
     if (!deserializedResults.ok()) {
@@ -215,24 +350,54 @@
         ALOGE("getValues: duplicate request ID");
         return toScopedAStatus(maybeRequestIds, StatusCode::INVALID_ARG);
     }
+
+    // A list of failed result we already know before sending to hardware.
+    std::vector<GetValueResult> failedResults;
+    // The list of requests that we would send to hardware.
+    std::vector<GetValueRequest> hardwareRequests;
+
+    for (const auto& request : getValueRequests) {
+        if (auto result = checkReadPermission(request.prop); !result.ok()) {
+            ALOGW("property does not support reading: %s", getErrorMsg(result).c_str());
+            failedResults.push_back(GetValueResult{
+                    .requestId = request.requestId,
+                    .status = getErrorCode(result),
+                    .prop = {},
+            });
+        } else {
+            hardwareRequests.push_back(request);
+        }
+    }
+
     // The set of request Ids that we would send to hardware.
-    std::unordered_set<int64_t> hardwareRequestIds(maybeRequestIds.value().begin(),
-                                                   maybeRequestIds.value().end());
+    std::unordered_set<int64_t> hardwareRequestIds;
+    for (const auto& request : hardwareRequests) {
+        hardwareRequestIds.insert(request.requestId);
+    }
 
     std::shared_ptr<GetValuesClient> client;
     {
         std::scoped_lock<std::mutex> lockGuard(mLock);
-        client = getOrCreateClient(&mGetValuesClients, callback);
+        client = getOrCreateClient(&mGetValuesClients, callback, mPendingRequestPool);
     }
     // Register the pending hardware requests and also check for duplicate request Ids.
     if (auto addRequestResult = client->addRequests(hardwareRequestIds); !addRequestResult.ok()) {
         ALOGE("getValues[%s]: failed to add pending requests, error: %s",
-              toString(hardwareRequestIds).c_str(), addRequestResult.error().message().c_str());
+              toString(hardwareRequestIds).c_str(), getErrorMsg(addRequestResult).c_str());
         return toScopedAStatus(addRequestResult);
     }
 
+    if (!failedResults.empty()) {
+        // First send the failed results we already know back to the client.
+        client->sendResults(std::move(failedResults));
+    }
+
+    if (hardwareRequests.empty()) {
+        return ScopedAStatus::ok();
+    }
+
     if (StatusCode status =
-                mVehicleHardware->getValues(client->getResultCallback(), getValueRequests);
+                mVehicleHardware->getValues(client->getResultCallback(), hardwareRequests);
         status != StatusCode::OK) {
         // If the hardware returns error, finish all the pending requests for this request because
         // we never expect hardware to call callback for these requests.
@@ -247,6 +412,8 @@
 
 ScopedAStatus DefaultVehicleHal::setValues(const CallbackType& callback,
                                            const SetValueRequests& requests) {
+    monitorBinderLifeCycle(callback);
+
     expected<LargeParcelableBase::BorrowedOwnedObject<SetValueRequests>, ScopedAStatus>
             deserializedResults = fromStableLargeParcelable(requests);
     if (!deserializedResults.ok()) {
@@ -269,9 +436,17 @@
 
     for (auto& request : setValueRequests) {
         int64_t requestId = request.requestId;
+        if (auto result = checkWritePermission(request.value); !result.ok()) {
+            ALOGW("property does not support writing: %s", getErrorMsg(result).c_str());
+            failedResults.push_back(SetValueResult{
+                    .requestId = requestId,
+                    .status = getErrorCode(result),
+            });
+            continue;
+        }
         if (auto result = checkProperty(request.value); !result.ok()) {
-            ALOGW("setValues[%" PRId64 "]: property not valid: %s", requestId,
-                  result.error().message().c_str());
+            ALOGW("setValues[%" PRId64 "]: property is not valid: %s", requestId,
+                  getErrorMsg(result).c_str());
             failedResults.push_back(SetValueResult{
                     .requestId = requestId,
                     .status = StatusCode::INVALID_ARG,
@@ -291,19 +466,23 @@
     std::shared_ptr<SetValuesClient> client;
     {
         std::scoped_lock<std::mutex> lockGuard(mLock);
-        client = getOrCreateClient(&mSetValuesClients, callback);
+        client = getOrCreateClient(&mSetValuesClients, callback, mPendingRequestPool);
     }
 
     // Register the pending hardware requests and also check for duplicate request Ids.
     if (auto addRequestResult = client->addRequests(hardwareRequestIds); !addRequestResult.ok()) {
         ALOGE("setValues[%s], failed to add pending requests, error: %s",
-              toString(hardwareRequestIds).c_str(), addRequestResult.error().message().c_str());
+              toString(hardwareRequestIds).c_str(), getErrorMsg(addRequestResult).c_str());
         return toScopedAStatus(addRequestResult, StatusCode::INVALID_ARG);
     }
 
     if (!failedResults.empty()) {
         // First send the failed results we already know back to the client.
-        client->sendResults(failedResults);
+        client->sendResults(std::move(failedResults));
+    }
+
+    if (hardwareRequests.empty()) {
+        return ScopedAStatus::ok();
     }
 
     if (StatusCode status =
@@ -360,13 +539,112 @@
     return vectorToStableLargeParcelable(std::move(configs), output);
 }
 
-ScopedAStatus DefaultVehicleHal::subscribe(const CallbackType&,
-                                           const std::vector<SubscribeOptions>&, int32_t) {
+Result<void> DefaultVehicleHal::checkSubscribeOptions(
+        const std::vector<SubscribeOptions>& options) {
+    for (const auto& option : options) {
+        int32_t propId = option.propId;
+        if (mConfigsByPropId.find(propId) == mConfigsByPropId.end()) {
+            return Error(toInt(StatusCode::INVALID_ARG))
+                   << StringPrintf("no config for property, ID: %" PRId32, propId);
+        }
+        const VehiclePropConfig& config = mConfigsByPropId[propId];
+
+        if (config.changeMode != VehiclePropertyChangeMode::ON_CHANGE &&
+            config.changeMode != VehiclePropertyChangeMode::CONTINUOUS) {
+            return Error(toInt(StatusCode::INVALID_ARG))
+                   << "only support subscribing to ON_CHANGE or CONTINUOUS property";
+        }
+
+        if (config.access != VehiclePropertyAccess::READ &&
+            config.access != VehiclePropertyAccess::READ_WRITE) {
+            return Error(toInt(StatusCode::ACCESS_DENIED))
+                   << StringPrintf("Property %" PRId32 " has no read access", propId);
+        }
+
+        if (config.changeMode == VehiclePropertyChangeMode::CONTINUOUS) {
+            float sampleRate = option.sampleRate;
+            float minSampleRate = config.minSampleRate;
+            float maxSampleRate = config.maxSampleRate;
+            if (sampleRate < minSampleRate || sampleRate > maxSampleRate) {
+                return Error(toInt(StatusCode::INVALID_ARG))
+                       << StringPrintf("sample rate: %f out of range, must be within %f and %f",
+                                       sampleRate, minSampleRate, maxSampleRate);
+            }
+            if (!SubscriptionManager::checkSampleRate(sampleRate)) {
+                return Error(toInt(StatusCode::INVALID_ARG))
+                       << "invalid sample rate: " << sampleRate;
+            }
+        }
+
+        if (isGlobalProp(propId)) {
+            continue;
+        }
+
+        // Non-global property.
+        for (int32_t areaId : option.areaIds) {
+            if (auto areaConfig = getAreaConfig(propId, areaId, config); areaConfig == nullptr) {
+                return Error(toInt(StatusCode::INVALID_ARG))
+                       << StringPrintf("invalid area ID: %" PRId32 " for prop ID: %" PRId32
+                                       ", not listed in config",
+                                       areaId, propId);
+            }
+        }
+    }
+    return {};
+}
+
+ScopedAStatus DefaultVehicleHal::subscribe(const CallbackType& callback,
+                                           const std::vector<SubscribeOptions>& options,
+                                           [[maybe_unused]] int32_t maxSharedMemoryFileCount) {
+    monitorBinderLifeCycle(callback);
+
+    // TODO(b/205189110): Use shared memory file count.
+    if (auto result = checkSubscribeOptions(options); !result.ok()) {
+        ALOGE("subscribe: invalid subscribe options: %s", getErrorMsg(result).c_str());
+        return toScopedAStatus(result);
+    }
+
+    std::vector<SubscribeOptions> onChangeSubscriptions;
+    std::vector<SubscribeOptions> continuousSubscriptions;
+    for (const auto& option : options) {
+        int32_t propId = option.propId;
+        // We have already validate config exists.
+        const VehiclePropConfig& config = mConfigsByPropId[propId];
+
+        SubscribeOptions optionCopy = option;
+        // If areaIds is empty, subscribe to all areas.
+        if (optionCopy.areaIds.empty() && !isGlobalProp(propId)) {
+            for (const auto& areaConfig : config.areaConfigs) {
+                optionCopy.areaIds.push_back(areaConfig.areaId);
+            }
+        }
+
+        if (isGlobalProp(propId)) {
+            optionCopy.areaIds = {0};
+        }
+
+        if (config.changeMode == VehiclePropertyChangeMode::CONTINUOUS) {
+            continuousSubscriptions.push_back(std::move(optionCopy));
+        } else {
+            onChangeSubscriptions.push_back(std::move(optionCopy));
+        }
+    }
+    // Since we have already check the sample rates, the following functions must succeed.
+    if (!onChangeSubscriptions.empty()) {
+        mSubscriptionManager->subscribe(callback, onChangeSubscriptions,
+                                        /*isContinuousProperty=*/false);
+    }
+    if (!continuousSubscriptions.empty()) {
+        mSubscriptionManager->subscribe(callback, continuousSubscriptions,
+                                        /*isContinuousProperty=*/true);
+    }
     return ScopedAStatus::ok();
 }
 
-ScopedAStatus DefaultVehicleHal::unsubscribe(const CallbackType&, const std::vector<int32_t>&) {
-    return ScopedAStatus::ok();
+ScopedAStatus DefaultVehicleHal::unsubscribe(const CallbackType& callback,
+                                             const std::vector<int32_t>& propIds) {
+    return toScopedAStatus(mSubscriptionManager->unsubscribe(callback->asBinder().get(), propIds),
+                           StatusCode::INVALID_ARG);
 }
 
 ScopedAStatus DefaultVehicleHal::returnSharedMemory(const CallbackType&, int64_t) {
@@ -378,6 +656,103 @@
     return mVehicleHardware.get();
 }
 
+Result<void> DefaultVehicleHal::checkWritePermission(const VehiclePropValue& value) const {
+    int32_t propId = value.prop;
+    auto result = getConfig(propId);
+    if (!result.ok()) {
+        return Error(toInt(StatusCode::INVALID_ARG)) << getErrorMsg(result);
+    }
+    const VehiclePropConfig* config = result.value();
+
+    if (config->access != VehiclePropertyAccess::WRITE &&
+        config->access != VehiclePropertyAccess::READ_WRITE) {
+        return Error(toInt(StatusCode::ACCESS_DENIED))
+               << StringPrintf("Property %" PRId32 " has no write access", propId);
+    }
+    return {};
+}
+
+Result<void> DefaultVehicleHal::checkReadPermission(const VehiclePropValue& value) const {
+    int32_t propId = value.prop;
+    auto result = getConfig(propId);
+    if (!result.ok()) {
+        return Error(toInt(StatusCode::INVALID_ARG)) << getErrorMsg(result);
+    }
+    const VehiclePropConfig* config = result.value();
+
+    if (config->access != VehiclePropertyAccess::READ &&
+        config->access != VehiclePropertyAccess::READ_WRITE) {
+        return Error(toInt(StatusCode::ACCESS_DENIED))
+               << StringPrintf("Property %" PRId32 " has no read access", propId);
+    }
+    return {};
+}
+
+void DefaultVehicleHal::checkHealth(std::weak_ptr<IVehicleHardware> hardware,
+                                    std::weak_ptr<SubscriptionManager> subscriptionManager) {
+    auto hardwarePtr = hardware.lock();
+    if (hardwarePtr == nullptr) {
+        ALOGW("the VehicleHardware is destroyed, DefaultVehicleHal is ending");
+        return;
+    }
+
+    StatusCode status = hardwarePtr->checkHealth();
+    if (status != StatusCode::OK) {
+        ALOGE("VHAL check health returns non-okay status");
+        return;
+    }
+    std::vector<VehiclePropValue> values = {{
+            .prop = toInt(VehicleProperty::VHAL_HEARTBEAT),
+            .areaId = 0,
+            .status = VehiclePropertyStatus::AVAILABLE,
+            .value.int64Values = {uptimeMillis()},
+    }};
+    onPropertyChangeEvent(subscriptionManager, values);
+    return;
+}
+
+binder_status_t DefaultVehicleHal::AIBinderLinkToDeathImpl::linkToDeath(
+        AIBinder* binder, AIBinder_DeathRecipient* recipient, void* cookie) {
+    return AIBinder_linkToDeath(binder, recipient, cookie);
+}
+
+void DefaultVehicleHal::setLinkToDeathImpl(std::unique_ptr<ILinkToDeath> impl) {
+    mLinkToDeathImpl = std::move(impl);
+}
+
+bool DefaultVehicleHal::checkDumpPermission() {
+    uid_t uid = AIBinder_getCallingUid();
+    return uid == AID_ROOT || uid == AID_SHELL || uid == AID_SYSTEM;
+}
+
+binder_status_t DefaultVehicleHal::dump(int fd, const char** args, uint32_t numArgs) {
+    if (!checkDumpPermission()) {
+        dprintf(fd, "Caller must be root, system or shell");
+        return STATUS_PERMISSION_DENIED;
+    }
+
+    std::vector<std::string> options;
+    for (uint32_t i = 0; i < numArgs; i++) {
+        options.push_back(args[i]);
+    }
+    DumpResult result = mVehicleHardware->dump(options);
+    dprintf(fd, "%s", (result.buffer + "\n").c_str());
+    if (!result.callerShouldDumpState) {
+        dprintf(fd, "Skip dumping Vehicle HAL State.\n");
+        return STATUS_OK;
+    }
+    dprintf(fd, "Vehicle HAL State: \n");
+    {
+        std::scoped_lock<std::mutex> lockGuard(mLock);
+        dprintf(fd, "Containing %zu property configs\n", mConfigsByPropId.size());
+        dprintf(fd, "Currently have %zu getValues clients\n", mGetValuesClients.size());
+        dprintf(fd, "Currently have %zu setValues clients\n", mSetValuesClients.size());
+        dprintf(fd, "Currently have %zu subscription clients\n",
+                mSubscriptionClients->countClients());
+    }
+    return STATUS_OK;
+}
+
 }  // namespace vehicle
 }  // namespace automotive
 }  // namespace hardware
diff --git a/automotive/vehicle/aidl/impl/vhal/src/SubscriptionManager.cpp b/automotive/vehicle/aidl/impl/vhal/src/SubscriptionManager.cpp
index dc9a6ce..21bfba6 100644
--- a/automotive/vehicle/aidl/impl/vhal/src/SubscriptionManager.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/src/SubscriptionManager.cpp
@@ -26,7 +26,7 @@
 
 namespace {
 
-constexpr float ONE_SECOND_IN_NANO = 1000000000.;
+constexpr float ONE_SECOND_IN_NANO = 1'000'000'000.;
 
 }  // namespace
 
@@ -55,6 +55,8 @@
     std::scoped_lock<std::mutex> lockGuard(mLock);
 
     mClientsByPropIdArea.clear();
+    // RecurrentSubscription has reference to mGetValue, so it must be destroyed before mGetValue is
+    // destroyed.
     mSubscriptionsByClient.clear();
 }
 
@@ -80,7 +82,6 @@
     std::scoped_lock<std::mutex> lockGuard(mLock);
 
     std::vector<int64_t> intervals;
-
     for (const auto& option : options) {
         float sampleRate = option.sampleRate;
 
@@ -99,6 +100,7 @@
     }
 
     size_t intervalIndex = 0;
+    ClientIdType clientId = callback->asBinder().get();
     for (const auto& option : options) {
         int32_t propId = option.propId;
         const std::vector<int32_t>& areaIds = option.areaIds;
@@ -117,7 +119,7 @@
                         .prop = propId,
                         .areaId = areaId,
                 };
-                mSubscriptionsByClient[callback][propIdAreaId] =
+                mSubscriptionsByClient[clientId][propIdAreaId] =
                         std::make_unique<RecurrentSubscription>(
                                 mTimer,
                                 [this, callback, propValueRequest] {
@@ -125,24 +127,24 @@
                                 },
                                 interval);
             } else {
-                mSubscriptionsByClient[callback][propIdAreaId] =
+                mSubscriptionsByClient[clientId][propIdAreaId] =
                         std::make_unique<OnChangeSubscription>();
             }
-            mClientsByPropIdArea[propIdAreaId].insert(callback);
+            mClientsByPropIdArea[propIdAreaId][clientId] = callback;
         }
     }
     return {};
 }
 
-Result<void> SubscriptionManager::unsubscribe(const std::shared_ptr<IVehicleCallback>& callback,
+Result<void> SubscriptionManager::unsubscribe(SubscriptionManager::ClientIdType clientId,
                                               const std::vector<int32_t>& propIds) {
     std::scoped_lock<std::mutex> lockGuard(mLock);
 
-    if (mSubscriptionsByClient.find(callback) == mSubscriptionsByClient.end()) {
+    if (mSubscriptionsByClient.find(clientId) == mSubscriptionsByClient.end()) {
         return Error() << "No property was subscribed for the callback";
     }
     std::unordered_set<int32_t> subscribedPropIds;
-    for (auto const& [propIdAreaId, _] : mSubscriptionsByClient[callback]) {
+    for (auto const& [propIdAreaId, _] : mSubscriptionsByClient[clientId]) {
         subscribedPropIds.insert(propIdAreaId.propId);
     }
 
@@ -152,13 +154,13 @@
         }
     }
 
-    auto& subscriptions = mSubscriptionsByClient[callback];
+    auto& subscriptions = mSubscriptionsByClient[clientId];
     auto it = subscriptions.begin();
     while (it != subscriptions.end()) {
         int32_t propId = it->first.propId;
         if (std::find(propIds.begin(), propIds.end(), propId) != propIds.end()) {
             auto& clients = mClientsByPropIdArea[it->first];
-            clients.erase(callback);
+            clients.erase(clientId);
             if (clients.empty()) {
                 mClientsByPropIdArea.erase(it->first);
             }
@@ -168,27 +170,27 @@
         }
     }
     if (subscriptions.empty()) {
-        mSubscriptionsByClient.erase(callback);
+        mSubscriptionsByClient.erase(clientId);
     }
     return {};
 }
 
-Result<void> SubscriptionManager::unsubscribe(const std::shared_ptr<IVehicleCallback>& callback) {
+Result<void> SubscriptionManager::unsubscribe(SubscriptionManager::ClientIdType clientId) {
     std::scoped_lock<std::mutex> lockGuard(mLock);
 
-    if (mSubscriptionsByClient.find(callback) == mSubscriptionsByClient.end()) {
-        return Error() << "No property was subscribed for the callback";
+    if (mSubscriptionsByClient.find(clientId) == mSubscriptionsByClient.end()) {
+        return Error() << "No property was subscribed for this client";
     }
 
-    auto& subscriptions = mSubscriptionsByClient[callback];
+    auto& subscriptions = mSubscriptionsByClient[clientId];
     for (auto const& [propIdAreaId, _] : subscriptions) {
         auto& clients = mClientsByPropIdArea[propIdAreaId];
-        clients.erase(callback);
+        clients.erase(clientId);
         if (clients.empty()) {
             mClientsByPropIdArea.erase(propIdAreaId);
         }
     }
-    mSubscriptionsByClient.erase(callback);
+    mSubscriptionsByClient.erase(clientId);
     return {};
 }
 
@@ -206,8 +208,8 @@
         if (mClientsByPropIdArea.find(propIdAreaId) == mClientsByPropIdArea.end()) {
             continue;
         }
-        for (const auto& client : mClientsByPropIdArea[propIdAreaId]) {
-            if (!mSubscriptionsByClient[client][propIdAreaId]->isOnChange()) {
+        for (const auto& [clientId, client] : mClientsByPropIdArea[propIdAreaId]) {
+            if (!mSubscriptionsByClient[clientId][propIdAreaId]->isOnChange()) {
                 continue;
             }
             clients[client].push_back(&value);
@@ -216,6 +218,11 @@
     return clients;
 }
 
+bool SubscriptionManager::isEmpty() {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    return mSubscriptionsByClient.empty() && mClientsByPropIdArea.empty();
+}
+
 SubscriptionManager::RecurrentSubscription::RecurrentSubscription(
         std::shared_ptr<RecurrentTimer> timer, std::function<void()>&& action, int64_t interval)
     : mAction(std::make_shared<std::function<void()>>(action)), mTimer(timer) {
diff --git a/automotive/vehicle/aidl/impl/vhal/test/Android.bp b/automotive/vehicle/aidl/impl/vhal/test/Android.bp
index bf16475..d89f2c1 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/Android.bp
+++ b/automotive/vehicle/aidl/impl/vhal/test/Android.bp
@@ -24,8 +24,7 @@
     srcs: ["*.cpp"],
     static_libs: [
         "DefaultVehicleHal",
-        "VehicleHalUtils",
-        "android-automotive-large-parcelable-vendor-lib",
+        "VehicleHalUtilsVendor",
         "libgtest",
         "libgmock",
     ],
@@ -40,7 +39,6 @@
     ],
     defaults: [
         "VehicleHalDefaults",
-        "android-automotive-large-parcelable-defaults",
     ],
     test_suites: ["device-tests"],
 }
diff --git a/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp b/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp
index bd4a565..bdb0d31 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp
@@ -80,7 +80,8 @@
 
     GetValuesClient client(getPool(), getCallbackClient());
 
-    client.sendResults(results);
+    auto resultsCopy = results;
+    client.sendResults(std::move(resultsCopy));
 
     auto maybeGetValueResults = getCallback()->nextGetValueResults();
     ASSERT_TRUE(maybeGetValueResults.has_value());
@@ -160,7 +161,8 @@
 
     SetValuesClient client(getPool(), getCallbackClient());
 
-    client.sendResults(results);
+    auto resultsCopy = results;
+    client.sendResults(std::move(resultsCopy));
 
     auto maybeSetValueResults = getCallback()->nextSetValueResults();
     ASSERT_TRUE(maybeSetValueResults.has_value());
diff --git a/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp b/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp
index d763f03..7443d5b 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp
@@ -17,6 +17,7 @@
 #include "ConnectedClient.h"
 #include "DefaultVehicleHal.h"
 #include "MockVehicleCallback.h"
+#include "MockVehicleHardware.h"
 
 #include <IVehicleHardware.h>
 #include <LargeParcelableBase.h>
@@ -26,7 +27,9 @@
 #include <android-base/thread_annotations.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <sys/mman.h>
 #include <utils/Log.h>
+#include <utils/SystemClock.h>
 
 #include <chrono>
 #include <list>
@@ -55,10 +58,14 @@
 using ::aidl::android::hardware::automotive::vehicle::SetValueResult;
 using ::aidl::android::hardware::automotive::vehicle::SetValueResults;
 using ::aidl::android::hardware::automotive::vehicle::StatusCode;
+using ::aidl::android::hardware::automotive::vehicle::SubscribeOptions;
 using ::aidl::android::hardware::automotive::vehicle::VehicleAreaWindow;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropConfigs;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropErrors;
+using ::aidl::android::hardware::automotive::vehicle::VehicleProperty;
+using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyAccess;
+using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyChangeMode;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValues;
 
@@ -67,208 +74,35 @@
 
 using ::ndk::ScopedAStatus;
 using ::ndk::ScopedFileDescriptor;
+using ::ndk::SpAIBinder;
 
+using ::testing::ContainsRegex;
 using ::testing::Eq;
+using ::testing::UnorderedElementsAre;
 using ::testing::UnorderedElementsAreArray;
 using ::testing::WhenSortedBy;
 
 constexpr int32_t INVALID_PROP_ID = 0;
 // VehiclePropertyGroup:SYSTEM,VehicleArea:WINDOW,VehiclePropertyType:INT32
 constexpr int32_t INT32_WINDOW_PROP = 10001 + 0x10000000 + 0x03000000 + 0x00400000;
-
-template <class T>
-std::optional<T> pop(std::list<T>& items) {
-    if (items.size() > 0) {
-        auto item = std::move(items.front());
-        items.pop_front();
-        return item;
-    }
-    return std::nullopt;
-}
+// VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+constexpr int32_t GLOBAL_ON_CHANGE_PROP = 10002 + 0x10000000 + 0x01000000 + 0x00400000;
+// VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+constexpr int32_t GLOBAL_CONTINUOUS_PROP = 10003 + 0x10000000 + 0x01000000 + 0x00400000;
+// VehiclePropertyGroup:SYSTEM,VehicleArea:WINDOW,VehiclePropertyType:INT32
+constexpr int32_t AREA_ON_CHANGE_PROP = 10004 + 0x10000000 + 0x03000000 + 0x00400000;
+// VehiclePropertyGroup:SYSTEM,VehicleArea:WINDOW,VehiclePropertyType:INT32
+constexpr int32_t AREA_CONTINUOUS_PROP = 10005 + 0x10000000 + 0x03000000 + 0x00400000;
+// VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+constexpr int32_t READ_ONLY_PROP = 10006 + 0x10000000 + 0x01000000 + 0x00400000;
+// VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
+constexpr int32_t WRITE_ONLY_PROP = 10007 + 0x10000000 + 0x01000000 + 0x00400000;
 
 int32_t testInt32VecProp(size_t i) {
     // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32_VEC
     return static_cast<int32_t>(i) + 0x10000000 + 0x01000000 + 0x00410000;
 }
 
-class MockVehicleHardware final : public IVehicleHardware {
-  public:
-    ~MockVehicleHardware() {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        for (auto& thread : mThreads) {
-            thread.join();
-        }
-    }
-
-    std::vector<VehiclePropConfig> getAllPropertyConfigs() const override {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        return mPropertyConfigs;
-    }
-
-    StatusCode setValues(std::shared_ptr<const SetValuesCallback> callback,
-                         const std::vector<SetValueRequest>& requests) override {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        return handleRequests(__func__, callback, requests, &mSetValueRequests,
-                              &mSetValueResponses);
-    }
-
-    StatusCode getValues(std::shared_ptr<const GetValuesCallback> callback,
-                         const std::vector<GetValueRequest>& requests) const override {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        return handleRequests(__func__, callback, requests, &mGetValueRequests,
-                              &mGetValueResponses);
-    }
-
-    DumpResult dump(const std::vector<std::string>&) override {
-        // TODO(b/200737967): mock this.
-        return DumpResult{};
-    }
-
-    StatusCode checkHealth() override {
-        // TODO(b/200737967): mock this.
-        return StatusCode::OK;
-    }
-
-    void registerOnPropertyChangeEvent(std::unique_ptr<const PropertyChangeCallback>) override {
-        // TODO(b/200737967): mock this.
-    }
-
-    void registerOnPropertySetErrorEvent(std::unique_ptr<const PropertySetErrorCallback>) override {
-        // TODO(b/200737967): mock this.
-    }
-
-    // Test functions.
-    void setPropertyConfigs(const std::vector<VehiclePropConfig>& configs) {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        mPropertyConfigs = configs;
-    }
-
-    void addGetValueResponses(const std::vector<GetValueResult>& responses) {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        mGetValueResponses.push_back(responses);
-    }
-
-    void addSetValueResponses(const std::vector<SetValueResult>& responses) {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        mSetValueResponses.push_back(responses);
-    }
-
-    std::vector<GetValueRequest> nextGetValueRequests() {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        std::optional<std::vector<GetValueRequest>> request = pop(mGetValueRequests);
-        if (!request.has_value()) {
-            return std::vector<GetValueRequest>();
-        }
-        return std::move(request.value());
-    }
-
-    std::vector<SetValueRequest> nextSetValueRequests() {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        std::optional<std::vector<SetValueRequest>> request = pop(mSetValueRequests);
-        if (!request.has_value()) {
-            return std::vector<SetValueRequest>();
-        }
-        return std::move(request.value());
-    }
-
-    void setStatus(const char* functionName, StatusCode status) {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        mStatusByFunctions[functionName] = status;
-    }
-
-    void setSleepTime(int64_t timeInNano) {
-        std::scoped_lock<std::mutex> lockGuard(mLock);
-        mSleepTime = timeInNano;
-    }
-
-  private:
-    mutable std::mutex mLock;
-    std::vector<VehiclePropConfig> mPropertyConfigs GUARDED_BY(mLock);
-    mutable std::list<std::vector<GetValueRequest>> mGetValueRequests GUARDED_BY(mLock);
-    mutable std::list<std::vector<GetValueResult>> mGetValueResponses GUARDED_BY(mLock);
-    mutable std::list<std::vector<SetValueRequest>> mSetValueRequests GUARDED_BY(mLock);
-    mutable std::list<std::vector<SetValueResult>> mSetValueResponses GUARDED_BY(mLock);
-    std::unordered_map<const char*, StatusCode> mStatusByFunctions GUARDED_BY(mLock);
-    int64_t mSleepTime GUARDED_BY(mLock) = 0;
-    mutable std::vector<std::thread> mThreads GUARDED_BY(mLock);
-
-    template <class ResultType>
-    StatusCode returnResponse(
-            std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
-            std::list<std::vector<ResultType>>* storedResponses) const;
-
-    template <class RequestType, class ResultType>
-    StatusCode handleRequests(
-            const char* functionName,
-            std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
-            const std::vector<RequestType>& requests,
-            std::list<std::vector<RequestType>>* storedRequests,
-            std::list<std::vector<ResultType>>* storedResponses) const REQUIRES(mLock);
-};
-
-template <class ResultType>
-StatusCode MockVehicleHardware::returnResponse(
-        std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
-        std::list<std::vector<ResultType>>* storedResponses) const {
-    if (storedResponses->size() > 0) {
-        (*callback)(std::move(storedResponses->front()));
-        storedResponses->pop_front();
-        return StatusCode::OK;
-    } else {
-        ALOGE("no more response");
-        return StatusCode::INTERNAL_ERROR;
-    }
-}
-
-template StatusCode MockVehicleHardware::returnResponse<GetValueResult>(
-        std::shared_ptr<const std::function<void(std::vector<GetValueResult>)>> callback,
-        std::list<std::vector<GetValueResult>>* storedResponses) const;
-
-template StatusCode MockVehicleHardware::returnResponse<SetValueResult>(
-        std::shared_ptr<const std::function<void(std::vector<SetValueResult>)>> callback,
-        std::list<std::vector<SetValueResult>>* storedResponses) const;
-
-template <class RequestType, class ResultType>
-StatusCode MockVehicleHardware::handleRequests(
-        const char* functionName,
-        std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
-        const std::vector<RequestType>& requests,
-        std::list<std::vector<RequestType>>* storedRequests,
-        std::list<std::vector<ResultType>>* storedResponses) const {
-    storedRequests->push_back(requests);
-    if (auto it = mStatusByFunctions.find(functionName); it != mStatusByFunctions.end()) {
-        if (StatusCode status = it->second; status != StatusCode::OK) {
-            return status;
-        }
-    }
-
-    if (mSleepTime != 0) {
-        int64_t sleepTime = mSleepTime;
-        mThreads.emplace_back([this, callback, sleepTime, storedResponses]() {
-            std::this_thread::sleep_for(std::chrono::nanoseconds(sleepTime));
-            returnResponse(callback, storedResponses);
-        });
-        return StatusCode::OK;
-
-    } else {
-        return returnResponse(callback, storedResponses);
-    }
-}
-
-template StatusCode MockVehicleHardware::handleRequests<GetValueRequest, GetValueResult>(
-        const char* functionName,
-        std::shared_ptr<const std::function<void(std::vector<GetValueResult>)>> callback,
-        const std::vector<GetValueRequest>& requests,
-        std::list<std::vector<GetValueRequest>>* storedRequests,
-        std::list<std::vector<GetValueResult>>* storedResponses) const;
-
-template StatusCode MockVehicleHardware::handleRequests<SetValueRequest, SetValueResult>(
-        const char* functionName,
-        std::shared_ptr<const std::function<void(std::vector<SetValueResult>)>> callback,
-        const std::vector<SetValueRequest>& requests,
-        std::list<std::vector<SetValueRequest>>* storedRequests,
-        std::list<std::vector<SetValueResult>>* storedResponses) const;
-
 struct PropConfigCmp {
     bool operator()(const VehiclePropConfig& a, const VehiclePropConfig& b) const {
         return (a.prop < b.prop);
@@ -321,6 +155,62 @@
                                     .areaId = toInt(VehicleAreaWindow::ROW_1_RIGHT),
                             },
                     .expectedStatus = StatusCode::INVALID_ARG,
+            },
+            {
+                    .name = "no_write_permission",
+                    .request =
+                            {
+                                    .prop = READ_ONLY_PROP,
+                                    .value.int32Values = {0},
+                            },
+                    .expectedStatus = StatusCode::ACCESS_DENIED,
+            }};
+}
+
+struct SubscribeInvalidOptionsTestCase {
+    std::string name;
+    SubscribeOptions option;
+};
+
+std::vector<SubscribeInvalidOptionsTestCase> getSubscribeInvalidOptionsTestCases() {
+    return {{
+                    .name = "invalid_prop",
+                    .option =
+                            {
+                                    .propId = INVALID_PROP_ID,
+                            },
+            },
+            {
+                    .name = "invalid_area_ID",
+                    .option =
+                            {
+                                    .propId = AREA_ON_CHANGE_PROP,
+                                    .areaIds = {0},
+                            },
+            },
+            {
+                    .name = "invalid_sample_rate",
+                    .option =
+                            {
+                                    .propId = GLOBAL_CONTINUOUS_PROP,
+                                    .sampleRate = 0.0,
+                            },
+            },
+            {
+                    .name = "sample_rate_out_of_range",
+                    .option =
+                            {
+                                    .propId = GLOBAL_CONTINUOUS_PROP,
+                                    .sampleRate = 1000.0,
+                            },
+            },
+            {
+                    .name = "static_property",
+                    .option =
+                            {
+                                    // Default change mode is static.
+                                    .propId = testInt32VecProp(0),
+                            },
             }};
 }
 
@@ -334,6 +224,7 @@
         for (size_t i = 0; i < 10000; i++) {
             testConfigs.push_back(VehiclePropConfig{
                     .prop = testInt32VecProp(i),
+                    .access = VehiclePropertyAccess::READ_WRITE,
                     .areaConfigs =
                             {
                                     {
@@ -344,19 +235,104 @@
                             },
             });
         }
+        // A property with area config.
         testConfigs.push_back(
                 VehiclePropConfig{.prop = INT32_WINDOW_PROP,
+                                  .access = VehiclePropertyAccess::READ_WRITE,
                                   .areaConfigs = {{
                                           .areaId = toInt(VehicleAreaWindow::ROW_1_LEFT),
                                           .minInt32Value = 0,
                                           .maxInt32Value = 100,
                                   }}});
+        // A global on-change property.
+        testConfigs.push_back(VehiclePropConfig{
+                .prop = GLOBAL_ON_CHANGE_PROP,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+        });
+        // A global continuous property.
+        testConfigs.push_back(VehiclePropConfig{
+                .prop = GLOBAL_CONTINUOUS_PROP,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+                .minSampleRate = 0.0,
+                .maxSampleRate = 100.0,
+        });
+        // A per-area on-change property.
+        testConfigs.push_back(VehiclePropConfig{
+                .prop = AREA_ON_CHANGE_PROP,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs =
+                        {
+                                {
+
+                                        .areaId = toInt(VehicleAreaWindow::ROW_1_LEFT),
+                                        .minInt32Value = 0,
+                                        .maxInt32Value = 100,
+                                },
+                                {
+                                        .areaId = toInt(VehicleAreaWindow::ROW_1_RIGHT),
+                                        .minInt32Value = 0,
+                                        .maxInt32Value = 100,
+                                },
+                        },
+        });
+        // A per-area continuous property.
+        testConfigs.push_back(VehiclePropConfig{
+                .prop = AREA_CONTINUOUS_PROP,
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+                .minSampleRate = 0.0,
+                .maxSampleRate = 1000.0,
+                .areaConfigs =
+                        {
+                                {
+
+                                        .areaId = toInt(VehicleAreaWindow::ROW_1_LEFT),
+                                        .minInt32Value = 0,
+                                        .maxInt32Value = 100,
+                                },
+                                {
+                                        .areaId = toInt(VehicleAreaWindow::ROW_1_RIGHT),
+                                        .minInt32Value = 0,
+                                        .maxInt32Value = 100,
+                                },
+                        },
+        });
+        // A read-only property.
+        testConfigs.push_back(VehiclePropConfig{
+                .prop = READ_ONLY_PROP,
+                .access = VehiclePropertyAccess::READ,
+                .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+                .minSampleRate = 0.0,
+                .maxSampleRate = 1000.0,
+        });
+        // A write-only property.
+        testConfigs.push_back(VehiclePropConfig{
+                .prop = WRITE_ONLY_PROP,
+                .access = VehiclePropertyAccess::WRITE,
+                .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+                .minSampleRate = 0.0,
+                .maxSampleRate = 1000.0,
+        });
+        // Register the heartbeat event property.
+        testConfigs.push_back(VehiclePropConfig{
+                .prop = toInt(VehicleProperty::VHAL_HEARTBEAT),
+                .access = VehiclePropertyAccess::READ,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+        });
         hardware->setPropertyConfigs(testConfigs);
         mHardwarePtr = hardware.get();
         mVhal = ndk::SharedRefBase::make<DefaultVehicleHal>(std::move(hardware));
         mVhalClient = IVehicle::fromBinder(mVhal->asBinder());
         mCallback = ndk::SharedRefBase::make<MockVehicleCallback>();
-        mCallbackClient = IVehicleCallback::fromBinder(mCallback->asBinder());
+        // Keep the local binder alive.
+        mBinder = mCallback->asBinder();
+        mCallbackClient = IVehicleCallback::fromBinder(mBinder);
+
+        // Set the linkToDeath to a fake implementation that always returns OK.
+        setTestLinkToDeathImpl();
     }
 
     void TearDown() override {
@@ -374,10 +350,36 @@
 
     void setTimeout(int64_t timeoutInNano) { mVhal->setTimeout(timeoutInNano); }
 
+    void setTestLinkToDeathImpl() {
+        mVhal->setLinkToDeathImpl(std::make_unique<TestLinkToDeathImpl>());
+    }
+
     size_t countPendingRequests() { return mVhal->mPendingRequestPool->countPendingRequests(); }
 
+    size_t countClients() {
+        std::scoped_lock<std::mutex> lockGuard(mVhal->mLock);
+        return mVhal->mGetValuesClients.size() + mVhal->mSetValuesClients.size() +
+               mVhal->mSubscriptionClients->countClients();
+    }
+
     std::shared_ptr<PendingRequestPool> getPool() { return mVhal->mPendingRequestPool; }
 
+    void onBinderDied(void* cookie) { return mVhal->onBinderDied(cookie); }
+
+    void onBinderUnlinked(void* cookie) { return mVhal->onBinderUnlinked(cookie); }
+
+    void* getOnBinderDiedContexts(AIBinder* clientId) {
+        std::scoped_lock<std::mutex> lockGuard(mVhal->mLock);
+        return mVhal->mOnBinderDiedContexts[clientId].get();
+    }
+
+    size_t countOnBinderDiedContexts() {
+        std::scoped_lock<std::mutex> lockGuard(mVhal->mLock);
+        return mVhal->mOnBinderDiedContexts.size();
+    }
+
+    bool hasNoSubscriptions() { return mVhal->mSubscriptionManager->isEmpty(); }
+
     static Result<void> getValuesTestCases(size_t size, GetValueRequests& requests,
                                            std::vector<GetValueResult>& expectedResults,
                                            std::vector<GetValueRequest>& expectedHardwareRequests) {
@@ -444,21 +446,25 @@
         if (result.value() != nullptr) {
             requests.payloads.clear();
             requests.sharedMemoryFd = std::move(*result.value());
+            requests.payloads.clear();
         }
         return {};
     }
 
-    size_t countClients() {
-        std::scoped_lock<std::mutex> lockGuard(mVhal->mLock);
-        return mVhal->mGetValuesClients.size() + mVhal->mSetValuesClients.size();
-    }
-
   private:
     std::shared_ptr<DefaultVehicleHal> mVhal;
     std::shared_ptr<IVehicle> mVhalClient;
     MockVehicleHardware* mHardwarePtr;
     std::shared_ptr<MockVehicleCallback> mCallback;
     std::shared_ptr<IVehicleCallback> mCallbackClient;
+    SpAIBinder mBinder;
+
+    class TestLinkToDeathImpl final : public DefaultVehicleHal::ILinkToDeath {
+      public:
+        binder_status_t linkToDeath(AIBinder*, AIBinder_DeathRecipient*, void*) override {
+            return STATUS_OK;
+        }
+    };
 };
 
 TEST_F(DefaultVehicleHalTest, testGetAllPropConfigsSmall) {
@@ -584,6 +590,39 @@
     ASSERT_EQ(status.getServiceSpecificError(), toInt(StatusCode::INVALID_ARG));
 }
 
+TEST_F(DefaultVehicleHalTest, testGetValuesNoReadPermission) {
+    GetValueRequests requests = {
+            .sharedMemoryFd = {},
+            .payloads =
+                    {
+                            {
+                                    .requestId = 0,
+                                    .prop =
+                                            {
+                                                    .prop = WRITE_ONLY_PROP,
+                                            },
+                            },
+                    },
+    };
+
+    auto status = getClient()->getValues(getCallbackClient(), requests);
+
+    ASSERT_TRUE(status.isOk()) << "getValue with no read permission should return okay with error "
+                                  "returned from callback"
+                               << ", error: " << status.getMessage();
+    EXPECT_TRUE(getHardware()->nextGetValueRequests().empty()) << "expect no request to hardware";
+
+    auto maybeResult = getCallback()->nextGetValueResults();
+    ASSERT_TRUE(maybeResult.has_value()) << "no results in callback";
+    EXPECT_EQ(maybeResult.value().payloads, std::vector<GetValueResult>({
+                                                    {
+                                                            .requestId = 0,
+                                                            .status = StatusCode::ACCESS_DENIED,
+                                                    },
+                                            }))
+            << "expect to get ACCESS_DENIED status if no read permission";
+}
+
 TEST_F(DefaultVehicleHalTest, testGetValuesFinishBeforeTimeout) {
     // timeout: 0.1s
     int64_t timeout = 100000000;
@@ -970,6 +1009,583 @@
     ASSERT_FALSE(status.isOk()) << "duplicate request properties in one request must fail";
 }
 
+TEST_F(DefaultVehicleHalTest, testSubscribeUnsubscribe) {
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = GLOBAL_ON_CHANGE_PROP,
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    status = getClient()->unsubscribe(getCallbackClient(),
+                                      std::vector<int32_t>({GLOBAL_ON_CHANGE_PROP}));
+
+    ASSERT_TRUE(status.isOk()) << "unsubscribe failed: " << status.getMessage();
+}
+
+TEST_F(DefaultVehicleHalTest, testSubscribeGlobalOnChangeNormal) {
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = GLOBAL_ON_CHANGE_PROP,
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    VehiclePropValue testValue{
+            .prop = GLOBAL_ON_CHANGE_PROP,
+            .value.int32Values = {0},
+    };
+    SetValueRequests setValueRequests = {
+            .payloads =
+                    {
+                            SetValueRequest{
+                                    .requestId = 0,
+                                    .value = testValue,
+                            },
+                    },
+    };
+    std::vector<SetValueResult> setValueResults = {{
+            .requestId = 0,
+            .status = StatusCode::OK,
+    }};
+
+    // Set the value to trigger a property change event.
+    getHardware()->addSetValueResponses(setValueResults);
+    status = getClient()->setValues(getCallbackClient(), setValueRequests);
+
+    ASSERT_TRUE(status.isOk()) << "setValues failed: " << status.getMessage();
+
+    auto maybeResults = getCallback()->nextOnPropertyEventResults();
+    ASSERT_TRUE(maybeResults.has_value()) << "no results in callback";
+    ASSERT_THAT(maybeResults.value().payloads, UnorderedElementsAre(testValue))
+            << "results mismatch, expect on change event for the updated value";
+    ASSERT_FALSE(getCallback()->nextOnPropertyEventResults().has_value())
+            << "more results than expected";
+    EXPECT_EQ(countClients(), static_cast<size_t>(1));
+}
+
+TEST_F(DefaultVehicleHalTest, testSubscribeGlobalOnchangeUnrelatedEventIgnored) {
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = GLOBAL_ON_CHANGE_PROP,
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    VehiclePropValue testValue{
+            .prop = GLOBAL_CONTINUOUS_PROP,
+            .value.int32Values = {0},
+    };
+
+    // Set the value to trigger a property change event. This event should be ignored because we
+    // have not subscribed to it.
+    getHardware()->addSetValueResponses({{
+            .requestId = 0,
+            .status = StatusCode::OK,
+    }});
+    status = getClient()->setValues(getCallbackClient(),
+                                    {
+                                            .payloads =
+                                                    {
+                                                            SetValueRequest{
+                                                                    .requestId = 0,
+                                                                    .value = testValue,
+                                                            },
+                                                    },
+                                    });
+
+    ASSERT_TRUE(status.isOk()) << "setValues failed: " << status.getMessage();
+
+    ASSERT_FALSE(getCallback()->nextOnPropertyEventResults().has_value())
+            << "must receive no property update event if the property is not subscribed";
+}
+
+TEST_F(DefaultVehicleHalTest, testSubscribeAreaOnChange) {
+    int testAreaId = toInt(VehicleAreaWindow::ROW_1_LEFT);
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = AREA_ON_CHANGE_PROP,
+                    .areaIds = {testAreaId},
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    VehiclePropValue testValue{
+            .prop = AREA_ON_CHANGE_PROP,
+            .areaId = testAreaId,
+            .value.int32Values = {0},
+    };
+
+    // Set the value to trigger a property change event.
+    getHardware()->addSetValueResponses({{
+            .requestId = 0,
+            .status = StatusCode::OK,
+    }});
+    status = getClient()->setValues(getCallbackClient(),
+                                    {
+                                            .payloads =
+                                                    {
+                                                            SetValueRequest{
+                                                                    .requestId = 0,
+                                                                    .value = testValue,
+                                                            },
+                                                    },
+                                    });
+
+    ASSERT_TRUE(status.isOk()) << "setValues failed: " << status.getMessage();
+
+    auto maybeResults = getCallback()->nextOnPropertyEventResults();
+    ASSERT_TRUE(maybeResults.has_value()) << "no results in callback";
+    ASSERT_THAT(maybeResults.value().payloads, UnorderedElementsAre(testValue))
+            << "results mismatch, expect on change event for the updated value";
+    ASSERT_FALSE(getCallback()->nextOnPropertyEventResults().has_value())
+            << "more results than expected";
+}
+
+TEST_F(DefaultVehicleHalTest, testSubscribeAreaOnChangeAllAreas) {
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = AREA_ON_CHANGE_PROP,
+                    // No areaIds means subscribing to all area IDs.
+                    .areaIds = {},
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    VehiclePropValue testValue1{
+            .prop = AREA_ON_CHANGE_PROP,
+            .areaId = toInt(VehicleAreaWindow::ROW_1_LEFT),
+            .value.int32Values = {0},
+    };
+    VehiclePropValue testValue2{
+            .prop = AREA_ON_CHANGE_PROP,
+            .areaId = toInt(VehicleAreaWindow::ROW_1_RIGHT),
+            .value.int32Values = {0},
+    };
+
+    // Set the values to trigger property change events for two areas.
+    getHardware()->addSetValueResponses({{
+                                                 .requestId = 0,
+                                                 .status = StatusCode::OK,
+                                         },
+                                         {
+                                                 .requestId = 1,
+                                                 .status = StatusCode::OK,
+                                         }});
+    status = getClient()->setValues(getCallbackClient(),
+                                    {
+                                            .payloads =
+                                                    {
+                                                            SetValueRequest{
+                                                                    .requestId = 0,
+                                                                    .value = testValue1,
+                                                            },
+                                                            SetValueRequest{
+                                                                    .requestId = 1,
+                                                                    .value = testValue2,
+                                                            },
+                                                    },
+                                    });
+
+    ASSERT_TRUE(status.isOk()) << "setValues failed: " << status.getMessage();
+
+    auto maybeResults = getCallback()->nextOnPropertyEventResults();
+    ASSERT_TRUE(maybeResults.has_value()) << "no results in callback";
+    ASSERT_THAT(maybeResults.value().payloads, UnorderedElementsAre(testValue1, testValue2))
+            << "results mismatch, expect two on-change events for all updated areas";
+    ASSERT_FALSE(getCallback()->nextOnPropertyEventResults().has_value())
+            << "more results than expected";
+}
+
+TEST_F(DefaultVehicleHalTest, testSubscribeGlobalContinuous) {
+    VehiclePropValue testValue{
+            .prop = GLOBAL_CONTINUOUS_PROP,
+            .value.int32Values = {0},
+    };
+    // Set responses for all the hardware getValues requests.
+    getHardware()->setGetValueResponder(
+            [](std::shared_ptr<const IVehicleHardware::GetValuesCallback> callback,
+               const std::vector<GetValueRequest>& requests) {
+                std::vector<GetValueResult> results;
+                for (auto& request : requests) {
+                    VehiclePropValue prop = request.prop;
+                    prop.value.int32Values = {0};
+                    results.push_back({
+                            .requestId = request.requestId,
+                            .status = StatusCode::OK,
+                            .prop = prop,
+                    });
+                }
+                (*callback)(results);
+                return StatusCode::OK;
+            });
+
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = GLOBAL_CONTINUOUS_PROP,
+                    .sampleRate = 20.0,
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    // Sleep for 1s, which should generate ~20 events.
+    std::this_thread::sleep_for(std::chrono::seconds(1));
+
+    // Should trigger about 20 times, check for at least 15 events to be safe.
+    for (size_t i = 0; i < 15; i++) {
+        auto maybeResults = getCallback()->nextOnPropertyEventResults();
+        ASSERT_TRUE(maybeResults.has_value()) << "no results in callback";
+        ASSERT_THAT(maybeResults.value().payloads, UnorderedElementsAre(testValue))
+                << "results mismatch, expect to get the updated value";
+    }
+    EXPECT_EQ(countClients(), static_cast<size_t>(1));
+}
+
+TEST_F(DefaultVehicleHalTest, testSubscribeAreaContinuous) {
+    // Set responses for all the hardware getValues requests.
+    getHardware()->setGetValueResponder(
+            [](std::shared_ptr<const IVehicleHardware::GetValuesCallback> callback,
+               const std::vector<GetValueRequest>& requests) {
+                std::vector<GetValueResult> results;
+                for (auto& request : requests) {
+                    VehiclePropValue prop = request.prop;
+                    prop.value.int32Values = {0};
+                    results.push_back({
+                            .requestId = request.requestId,
+                            .status = StatusCode::OK,
+                            .prop = prop,
+                    });
+                }
+                (*callback)(results);
+                return StatusCode::OK;
+            });
+
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = AREA_CONTINUOUS_PROP,
+                    .sampleRate = 20.0,
+                    .areaIds = {toInt(VehicleAreaWindow::ROW_1_LEFT)},
+            },
+            {
+                    .propId = AREA_CONTINUOUS_PROP,
+                    .sampleRate = 10.0,
+                    .areaIds = {toInt(VehicleAreaWindow::ROW_1_RIGHT)},
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    // Sleep for 1s, which should generate ~20 events.
+    std::this_thread::sleep_for(std::chrono::seconds(1));
+
+    std::vector<VehiclePropValue> events;
+    while (true) {
+        auto maybeResults = getCallback()->nextOnPropertyEventResults();
+        if (!maybeResults.has_value()) {
+            break;
+        }
+        for (const auto& value : maybeResults.value().payloads) {
+            events.push_back(value);
+        }
+    }
+
+    size_t leftCount = 0;
+    size_t rightCount = 0;
+
+    for (const auto& event : events) {
+        ASSERT_EQ(event.prop, AREA_CONTINUOUS_PROP);
+        if (event.areaId == toInt(VehicleAreaWindow::ROW_1_LEFT)) {
+            leftCount++;
+            continue;
+        }
+        rightCount++;
+    }
+
+    // Should trigger about 20 times, check for at least 15 events to be safe.
+    ASSERT_GE(leftCount, static_cast<size_t>(15));
+    // Should trigger about 10 times, check for at least 5 events to be safe.
+    ASSERT_GE(rightCount, static_cast<size_t>(5));
+}
+
+TEST_F(DefaultVehicleHalTest, testUnsubscribeOnChange) {
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = GLOBAL_ON_CHANGE_PROP,
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    status = getClient()->unsubscribe(getCallbackClient(),
+                                      std::vector<int32_t>({GLOBAL_ON_CHANGE_PROP}));
+
+    ASSERT_TRUE(status.isOk()) << "unsubscribe failed: " << status.getMessage();
+
+    VehiclePropValue testValue{
+            .prop = GLOBAL_ON_CHANGE_PROP,
+            .value.int32Values = {0},
+    };
+
+    // Set the value to trigger a property change event.
+    getHardware()->addSetValueResponses({{
+            .requestId = 0,
+            .status = StatusCode::OK,
+    }});
+    status = getClient()->setValues(getCallbackClient(),
+                                    {
+                                            .payloads =
+                                                    {
+                                                            SetValueRequest{
+                                                                    .requestId = 0,
+                                                                    .value = testValue,
+                                                            },
+                                                    },
+                                    });
+
+    ASSERT_TRUE(status.isOk()) << "setValues failed: " << status.getMessage();
+
+    ASSERT_FALSE(getCallback()->nextOnPropertyEventResults().has_value())
+            << "No property event should be generated after unsubscription";
+}
+
+TEST_F(DefaultVehicleHalTest, testUnsubscribeContinuous) {
+    VehiclePropValue testValue{
+            .prop = GLOBAL_CONTINUOUS_PROP,
+            .value.int32Values = {0},
+    };
+    // Set responses for all the hardware getValues requests.
+    getHardware()->setGetValueResponder(
+            [](std::shared_ptr<const IVehicleHardware::GetValuesCallback> callback,
+               const std::vector<GetValueRequest>& requests) {
+                std::vector<GetValueResult> results;
+                for (auto& request : requests) {
+                    VehiclePropValue prop = request.prop;
+                    prop.value.int32Values = {0};
+                    results.push_back({
+                            .requestId = request.requestId,
+                            .status = StatusCode::OK,
+                            .prop = prop,
+                    });
+                }
+                (*callback)(results);
+                return StatusCode::OK;
+            });
+
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = GLOBAL_CONTINUOUS_PROP,
+                    .sampleRate = 20.0,
+            },
+    };
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+
+    status = getClient()->unsubscribe(getCallbackClient(),
+                                      std::vector<int32_t>({GLOBAL_CONTINUOUS_PROP}));
+
+    ASSERT_TRUE(status.isOk()) << "unsubscribe failed: " << status.getMessage();
+
+    // Clear existing events.
+    while (getCallback()->nextOnPropertyEventResults().has_value()) {
+        // Do nothing.
+    }
+
+    // Wait for a while, make sure no new events are generated.
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+    ASSERT_FALSE(getCallback()->nextOnPropertyEventResults().has_value())
+            << "No property event should be generated after unsubscription";
+}
+
+class SubscribeInvalidOptionsTest
+    : public DefaultVehicleHalTest,
+      public testing::WithParamInterface<SubscribeInvalidOptionsTestCase> {};
+
+INSTANTIATE_TEST_SUITE_P(
+        SubscribeInvalidOptionsTests, SubscribeInvalidOptionsTest,
+        ::testing::ValuesIn(getSubscribeInvalidOptionsTestCases()),
+        [](const testing::TestParamInfo<SubscribeInvalidOptionsTest::ParamType>& info) {
+            return info.param.name;
+        });
+
+TEST_P(SubscribeInvalidOptionsTest, testSubscribeInvalidOptions) {
+    std::vector<SubscribeOptions> options = {GetParam().option};
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_FALSE(status.isOk()) << "invalid subscribe options must fail";
+    ASSERT_EQ(status.getServiceSpecificError(), toInt(StatusCode::INVALID_ARG));
+}
+
+TEST_F(DefaultVehicleHalTest, testSubscribeNoReadPermission) {
+    std::vector<SubscribeOptions> options = {{
+            .propId = WRITE_ONLY_PROP,
+    }};
+
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_FALSE(status.isOk()) << "subscribe to a write-only property must fail";
+    ASSERT_EQ(status.getServiceSpecificError(), toInt(StatusCode::ACCESS_DENIED));
+}
+
+TEST_F(DefaultVehicleHalTest, testUnsubscribeFailure) {
+    auto status = getClient()->unsubscribe(getCallbackClient(),
+                                           std::vector<int32_t>({GLOBAL_ON_CHANGE_PROP}));
+
+    ASSERT_FALSE(status.isOk()) << "unsubscribe to a not-subscribed property must fail";
+    ASSERT_EQ(status.getServiceSpecificError(), toInt(StatusCode::INVALID_ARG));
+}
+
+TEST_F(DefaultVehicleHalTest, testHeartbeatEvent) {
+    std::vector<SubscribeOptions> options = {{
+            .propId = toInt(VehicleProperty::VHAL_HEARTBEAT),
+    }};
+    int64_t currentTime = uptimeMillis();
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+
+    ASSERT_TRUE(status.isOk()) << "unable to subscribe to heartbeat event: " << status.getMessage();
+
+    // We send out a heartbeat event every 3s, so sleep for 3s.
+    std::this_thread::sleep_for(std::chrono::seconds(3));
+
+    auto maybeResults = getCallback()->nextOnPropertyEventResults();
+    ASSERT_TRUE(maybeResults.has_value()) << "no results in callback";
+    ASSERT_EQ(maybeResults.value().payloads.size(), static_cast<size_t>(1));
+    VehiclePropValue gotValue = maybeResults.value().payloads[0];
+    ASSERT_EQ(gotValue.prop, toInt(VehicleProperty::VHAL_HEARTBEAT));
+    ASSERT_EQ(gotValue.value.int64Values.size(), static_cast<size_t>(1));
+    ASSERT_GE(gotValue.value.int64Values[0], currentTime)
+            << "expect to get the latest timestamp with the heartbeat event";
+}
+
+TEST_F(DefaultVehicleHalTest, testOnBinderDiedUnlinked) {
+    // First subscribe to a continuous property so that we register a death recipient for our
+    // client.
+    VehiclePropValue testValue{
+            .prop = GLOBAL_CONTINUOUS_PROP,
+            .value.int32Values = {0},
+    };
+    // Set responses for all the hardware getValues requests.
+    getHardware()->setGetValueResponder(
+            [](std::shared_ptr<const IVehicleHardware::GetValuesCallback> callback,
+               const std::vector<GetValueRequest>& requests) {
+                std::vector<GetValueResult> results;
+                for (auto& request : requests) {
+                    VehiclePropValue prop = request.prop;
+                    prop.value.int32Values = {0};
+                    results.push_back({
+                            .requestId = request.requestId,
+                            .status = StatusCode::OK,
+                            .prop = prop,
+                    });
+                }
+                (*callback)(results);
+                return StatusCode::OK;
+            });
+    std::vector<SubscribeOptions> options = {
+            {
+                    .propId = GLOBAL_CONTINUOUS_PROP,
+                    .sampleRate = 20.0,
+            },
+    };
+    auto status = getClient()->subscribe(getCallbackClient(), options, 0);
+    ASSERT_TRUE(status.isOk()) << "subscribe failed: " << status.getMessage();
+    // Sleep for 100ms so that the subscriptionClient gets created because we would at least try to
+    // get value once.
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+    // Issue another getValue request on the same client.
+    GetValueRequests requests;
+    std::vector<GetValueResult> expectedResults;
+    std::vector<GetValueRequest> expectedHardwareRequests;
+    ASSERT_TRUE(getValuesTestCases(1, requests, expectedResults, expectedHardwareRequests).ok());
+    getHardware()->addGetValueResponses(expectedResults);
+    status = getClient()->getValues(getCallbackClient(), requests);
+    ASSERT_TRUE(status.isOk()) << "getValues failed: " << status.getMessage();
+
+    ASSERT_EQ(countOnBinderDiedContexts(), static_cast<size_t>(1))
+            << "expect one OnBinderDied context when one client is registered";
+
+    // Get the death recipient cookie for our callback that would be used in onBinderDied and
+    // onBinderUnlinked.
+    AIBinder* clientId = getCallbackClient()->asBinder().get();
+    void* context = getOnBinderDiedContexts(clientId);
+
+    onBinderDied(context);
+
+    ASSERT_EQ(countClients(), static_cast<size_t>(0))
+            << "expect all clients to be removed when binder died";
+    ASSERT_TRUE(hasNoSubscriptions()) << "expect no subscriptions when binder died";
+
+    onBinderUnlinked(context);
+
+    ASSERT_EQ(countOnBinderDiedContexts(), static_cast<size_t>(0))
+            << "expect OnBinderDied context to be deleted when binder is unlinked";
+}
+
+TEST_F(DefaultVehicleHalTest, testDumpCallerShouldDump) {
+    std::string buffer = "Dump from hardware";
+    getHardware()->setDumpResult({
+            .callerShouldDumpState = true,
+            .buffer = buffer,
+    });
+    int fd = memfd_create("memfile", 0);
+    getClient()->dump(fd, nullptr, 0);
+
+    lseek(fd, 0, SEEK_SET);
+    char buf[10240] = {};
+    read(fd, buf, sizeof(buf));
+    close(fd);
+
+    std::string msg(buf);
+
+    ASSERT_THAT(msg, ContainsRegex(buffer + "\nVehicle HAL State: \n"));
+}
+
+TEST_F(DefaultVehicleHalTest, testDumpCallerShouldNotDump) {
+    std::string buffer = "Dump from hardware";
+    getHardware()->setDumpResult({
+            .callerShouldDumpState = false,
+            .buffer = buffer,
+    });
+    int fd = memfd_create("memfile", 0);
+    getClient()->dump(fd, nullptr, 0);
+
+    lseek(fd, 0, SEEK_SET);
+    char buf[10240] = {};
+    read(fd, buf, sizeof(buf));
+    close(fd);
+
+    std::string msg(buf);
+
+    ASSERT_THAT(msg, ContainsRegex(buffer));
+    ASSERT_EQ(msg.find("Vehicle HAL State: "), std::string::npos);
+}
+
 }  // namespace vehicle
 }  // namespace automotive
 }  // namespace hardware
diff --git a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.cpp b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.cpp
index ca366cd..5e3e03c 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.cpp
@@ -31,16 +31,6 @@
 using ::ndk::ScopedFileDescriptor;
 
 template <class T>
-std::optional<T> pop(std::list<T>& items) {
-    if (items.size() > 0) {
-        auto item = std::move(items.front());
-        items.pop_front();
-        return item;
-    }
-    return std::nullopt;
-}
-
-template <class T>
 static ScopedAStatus storeResults(const T& results, std::list<T>* storedResults) {
     T resultsCopy{
             .payloads = results.payloads,
@@ -65,8 +55,12 @@
     return storeResults(results, &mSetValueResults);
 }
 
-ScopedAStatus MockVehicleCallback::onPropertyEvent(const VehiclePropValues&, int32_t) {
-    return ScopedAStatus::ok();
+ScopedAStatus MockVehicleCallback::onPropertyEvent(const VehiclePropValues& results,
+                                                   int32_t sharedMemoryFileCount) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+
+    mSharedMemoryFileCount = sharedMemoryFileCount;
+    return storeResults(results, &mOnPropertyEventResults);
 }
 
 ScopedAStatus MockVehicleCallback::onPropertySetError(const VehiclePropErrors&) {
@@ -83,6 +77,11 @@
     return pop(mSetValueResults);
 }
 
+std::optional<VehiclePropValues> MockVehicleCallback::nextOnPropertyEventResults() {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    return pop(mOnPropertyEventResults);
+}
+
 }  // namespace vehicle
 }  // namespace automotive
 }  // namespace hardware
diff --git a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.h b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.h
index 916575a..c83164f 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.h
+++ b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleCallback.h
@@ -31,6 +31,16 @@
 namespace automotive {
 namespace vehicle {
 
+template <class T>
+std::optional<T> pop(std::list<T>& items) {
+    if (items.size() > 0) {
+        auto item = std::move(items.front());
+        items.pop_front();
+        return item;
+    }
+    return std::nullopt;
+}
+
 // MockVehicleCallback is a mock VehicleCallback implementation that simply stores the results.
 class MockVehicleCallback final
     : public ::aidl::android::hardware::automotive::vehicle::BnVehicleCallback {
@@ -52,6 +62,8 @@
     nextGetValueResults();
     std::optional<::aidl::android::hardware::automotive::vehicle::SetValueResults>
     nextSetValueResults();
+    std::optional<::aidl::android::hardware::automotive::vehicle::VehiclePropValues>
+    nextOnPropertyEventResults();
 
   private:
     std::mutex mLock;
@@ -59,6 +71,9 @@
             GUARDED_BY(mLock);
     std::list<::aidl::android::hardware::automotive::vehicle::SetValueResults> mSetValueResults
             GUARDED_BY(mLock);
+    std::list<::aidl::android::hardware::automotive::vehicle::VehiclePropValues>
+            mOnPropertyEventResults GUARDED_BY(mLock);
+    int32_t mSharedMemoryFileCount GUARDED_BY(mLock);
 };
 
 }  // namespace vehicle
diff --git a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.cpp b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.cpp
new file mode 100644
index 0000000..66aef7c
--- /dev/null
+++ b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.cpp
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "MockVehicleHardware.h"
+#include "MockVehicleCallback.h"
+
+#include <utils/Log.h>
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace vehicle {
+
+using ::aidl::android::hardware::automotive::vehicle::GetValueRequest;
+using ::aidl::android::hardware::automotive::vehicle::GetValueResult;
+using ::aidl::android::hardware::automotive::vehicle::SetValueRequest;
+using ::aidl::android::hardware::automotive::vehicle::SetValueResult;
+using ::aidl::android::hardware::automotive::vehicle::StatusCode;
+using ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig;
+using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
+
+MockVehicleHardware::~MockVehicleHardware() {
+    std::unique_lock<std::mutex> lk(mLock);
+    mCv.wait(lk, [this] { return mThreadCount == 0; });
+}
+
+std::vector<VehiclePropConfig> MockVehicleHardware::getAllPropertyConfigs() const {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    return mPropertyConfigs;
+}
+
+StatusCode MockVehicleHardware::setValues(std::shared_ptr<const SetValuesCallback> callback,
+                                          const std::vector<SetValueRequest>& requests) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    if (StatusCode status = handleRequestsLocked(__func__, callback, requests, &mSetValueRequests,
+                                                 &mSetValueResponses);
+        status != StatusCode::OK) {
+        return status;
+    }
+    if (mPropertyChangeCallback == nullptr) {
+        return StatusCode::OK;
+    }
+    std::vector<VehiclePropValue> values;
+    for (auto& request : requests) {
+        values.push_back(request.value);
+    }
+    (*mPropertyChangeCallback)(values);
+    return StatusCode::OK;
+}
+
+StatusCode MockVehicleHardware::getValues(std::shared_ptr<const GetValuesCallback> callback,
+                                          const std::vector<GetValueRequest>& requests) const {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    if (mGetValueResponder != nullptr) {
+        return mGetValueResponder(callback, requests);
+    }
+    return handleRequestsLocked(__func__, callback, requests, &mGetValueRequests,
+                                &mGetValueResponses);
+}
+
+void MockVehicleHardware::setDumpResult(DumpResult result) {
+    mDumpResult = result;
+}
+
+DumpResult MockVehicleHardware::dump(const std::vector<std::string>&) {
+    return mDumpResult;
+}
+
+StatusCode MockVehicleHardware::checkHealth() {
+    return StatusCode::OK;
+}
+
+void MockVehicleHardware::registerOnPropertyChangeEvent(
+        std::unique_ptr<const PropertyChangeCallback> callback) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mPropertyChangeCallback = std::move(callback);
+}
+
+void MockVehicleHardware::registerOnPropertySetErrorEvent(
+        std::unique_ptr<const PropertySetErrorCallback>) {
+    // TODO(b/200737967): mock this.
+}
+
+void MockVehicleHardware::setPropertyConfigs(const std::vector<VehiclePropConfig>& configs) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mPropertyConfigs = configs;
+}
+
+void MockVehicleHardware::addGetValueResponses(const std::vector<GetValueResult>& responses) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mGetValueResponses.push_back(responses);
+}
+
+void MockVehicleHardware::addSetValueResponses(const std::vector<SetValueResult>& responses) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mSetValueResponses.push_back(responses);
+}
+
+void MockVehicleHardware::setGetValueResponder(
+        std::function<StatusCode(std::shared_ptr<const GetValuesCallback>,
+                                 const std::vector<GetValueRequest>&)>&& responder) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mGetValueResponder = responder;
+}
+
+std::vector<GetValueRequest> MockVehicleHardware::nextGetValueRequests() {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    std::optional<std::vector<GetValueRequest>> request = pop(mGetValueRequests);
+    if (!request.has_value()) {
+        return std::vector<GetValueRequest>();
+    }
+    return std::move(request.value());
+}
+
+std::vector<SetValueRequest> MockVehicleHardware::nextSetValueRequests() {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    std::optional<std::vector<SetValueRequest>> request = pop(mSetValueRequests);
+    if (!request.has_value()) {
+        return std::vector<SetValueRequest>();
+    }
+    return std::move(request.value());
+}
+
+void MockVehicleHardware::setStatus(const char* functionName, StatusCode status) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mStatusByFunctions[functionName] = status;
+}
+
+void MockVehicleHardware::setSleepTime(int64_t timeInNano) {
+    std::scoped_lock<std::mutex> lockGuard(mLock);
+    mSleepTime = timeInNano;
+}
+
+template <class ResultType>
+StatusCode MockVehicleHardware::returnResponse(
+        std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
+        std::list<std::vector<ResultType>>* storedResponses) const {
+    if (storedResponses->size() > 0) {
+        (*callback)(std::move(storedResponses->front()));
+        storedResponses->pop_front();
+        return StatusCode::OK;
+    } else {
+        ALOGE("no more response");
+        return StatusCode::INTERNAL_ERROR;
+    }
+}
+
+template StatusCode MockVehicleHardware::returnResponse<GetValueResult>(
+        std::shared_ptr<const std::function<void(std::vector<GetValueResult>)>> callback,
+        std::list<std::vector<GetValueResult>>* storedResponses) const;
+
+template StatusCode MockVehicleHardware::returnResponse<SetValueResult>(
+        std::shared_ptr<const std::function<void(std::vector<SetValueResult>)>> callback,
+        std::list<std::vector<SetValueResult>>* storedResponses) const;
+
+template <class RequestType, class ResultType>
+StatusCode MockVehicleHardware::handleRequestsLocked(
+        const char* functionName,
+        std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
+        const std::vector<RequestType>& requests,
+        std::list<std::vector<RequestType>>* storedRequests,
+        std::list<std::vector<ResultType>>* storedResponses) const {
+    storedRequests->push_back(requests);
+    if (auto it = mStatusByFunctions.find(functionName); it != mStatusByFunctions.end()) {
+        if (StatusCode status = it->second; status != StatusCode::OK) {
+            return status;
+        }
+    }
+
+    if (mSleepTime != 0) {
+        int64_t sleepTime = mSleepTime;
+        mThreadCount++;
+        std::thread t([this, callback, sleepTime, storedResponses]() {
+            std::this_thread::sleep_for(std::chrono::nanoseconds(sleepTime));
+            returnResponse(callback, storedResponses);
+            mThreadCount--;
+            mCv.notify_one();
+        });
+        // Detach the thread here so we do not have to maintain the thread object. mThreadCount
+        // and mCv make sure we wait for all threads to end before we exit.
+        t.detach();
+        return StatusCode::OK;
+
+    } else {
+        return returnResponse(callback, storedResponses);
+    }
+}
+
+template StatusCode MockVehicleHardware::handleRequestsLocked<GetValueRequest, GetValueResult>(
+        const char* functionName,
+        std::shared_ptr<const std::function<void(std::vector<GetValueResult>)>> callback,
+        const std::vector<GetValueRequest>& requests,
+        std::list<std::vector<GetValueRequest>>* storedRequests,
+        std::list<std::vector<GetValueResult>>* storedResponses) const;
+
+template StatusCode MockVehicleHardware::handleRequestsLocked<SetValueRequest, SetValueResult>(
+        const char* functionName,
+        std::shared_ptr<const std::function<void(std::vector<SetValueResult>)>> callback,
+        const std::vector<SetValueRequest>& requests,
+        std::list<std::vector<SetValueRequest>>* storedRequests,
+        std::list<std::vector<SetValueResult>>* storedResponses) const;
+
+}  // namespace vehicle
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.h b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.h
new file mode 100644
index 0000000..74d4fae
--- /dev/null
+++ b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef android_hardware_automotive_vehicle_aidl_impl_vhal_test_MockVehicleHardware_H_
+#define android_hardware_automotive_vehicle_aidl_impl_vhal_test_MockVehicleHardware_H_
+
+#include <IVehicleHardware.h>
+#include <VehicleHalTypes.h>
+
+#include <android-base/thread_annotations.h>
+
+#include <atomic>
+#include <condition_variable>
+#include <list>
+#include <memory>
+#include <mutex>
+#include <thread>
+#include <unordered_map>
+#include <vector>
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace vehicle {
+
+class MockVehicleHardware final : public IVehicleHardware {
+  public:
+    ~MockVehicleHardware();
+
+    std::vector<::aidl::android::hardware::automotive::vehicle::VehiclePropConfig>
+    getAllPropertyConfigs() const override;
+    ::aidl::android::hardware::automotive::vehicle::StatusCode setValues(
+            std::shared_ptr<const SetValuesCallback> callback,
+            const std::vector<::aidl::android::hardware::automotive::vehicle::SetValueRequest>&
+                    requests) override;
+    ::aidl::android::hardware::automotive::vehicle::StatusCode getValues(
+            std::shared_ptr<const GetValuesCallback> callback,
+            const std::vector<::aidl::android::hardware::automotive::vehicle::GetValueRequest>&
+                    requests) const override;
+    DumpResult dump(const std::vector<std::string>&) override;
+    ::aidl::android::hardware::automotive::vehicle::StatusCode checkHealth() override;
+    void registerOnPropertyChangeEvent(
+            std::unique_ptr<const PropertyChangeCallback> callback) override;
+    void registerOnPropertySetErrorEvent(std::unique_ptr<const PropertySetErrorCallback>) override;
+
+    // Test functions.
+    void setPropertyConfigs(
+            const std::vector<::aidl::android::hardware::automotive::vehicle::VehiclePropConfig>&
+                    configs);
+    void addGetValueResponses(
+            const std::vector<::aidl::android::hardware::automotive::vehicle::GetValueResult>&
+                    responses);
+    void addSetValueResponses(
+            const std::vector<::aidl::android::hardware::automotive::vehicle::SetValueResult>&
+                    responses);
+    void setGetValueResponder(
+            std::function<::aidl::android::hardware::automotive::vehicle::StatusCode(
+                    std::shared_ptr<const GetValuesCallback>,
+                    const std::vector<
+                            ::aidl::android::hardware::automotive::vehicle::GetValueRequest>&)>&&
+                    responder);
+    std::vector<::aidl::android::hardware::automotive::vehicle::GetValueRequest>
+    nextGetValueRequests();
+    std::vector<::aidl::android::hardware::automotive::vehicle::SetValueRequest>
+    nextSetValueRequests();
+    void setStatus(const char* functionName,
+                   ::aidl::android::hardware::automotive::vehicle::StatusCode status);
+    void setSleepTime(int64_t timeInNano);
+    void setDumpResult(DumpResult result);
+
+  private:
+    mutable std::mutex mLock;
+    mutable std::condition_variable mCv;
+    mutable std::atomic<int> mThreadCount;
+    std::vector<::aidl::android::hardware::automotive::vehicle::VehiclePropConfig> mPropertyConfigs
+            GUARDED_BY(mLock);
+    mutable std::list<std::vector<::aidl::android::hardware::automotive::vehicle::GetValueRequest>>
+            mGetValueRequests GUARDED_BY(mLock);
+    mutable std::list<std::vector<::aidl::android::hardware::automotive::vehicle::GetValueResult>>
+            mGetValueResponses GUARDED_BY(mLock);
+    mutable std::list<std::vector<::aidl::android::hardware::automotive::vehicle::SetValueRequest>>
+            mSetValueRequests GUARDED_BY(mLock);
+    mutable std::list<std::vector<::aidl::android::hardware::automotive::vehicle::SetValueResult>>
+            mSetValueResponses GUARDED_BY(mLock);
+    std::unordered_map<const char*, ::aidl::android::hardware::automotive::vehicle::StatusCode>
+            mStatusByFunctions GUARDED_BY(mLock);
+    int64_t mSleepTime GUARDED_BY(mLock) = 0;
+    std::unique_ptr<const PropertyChangeCallback> mPropertyChangeCallback GUARDED_BY(mLock);
+    std::function<::aidl::android::hardware::automotive::vehicle::StatusCode(
+            std::shared_ptr<const GetValuesCallback>,
+            const std::vector<::aidl::android::hardware::automotive::vehicle::GetValueRequest>&)>
+            mGetValueResponder GUARDED_BY(mLock);
+
+    template <class ResultType>
+    ::aidl::android::hardware::automotive::vehicle::StatusCode returnResponse(
+            std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
+            std::list<std::vector<ResultType>>* storedResponses) const;
+    template <class RequestType, class ResultType>
+    ::aidl::android::hardware::automotive::vehicle::StatusCode handleRequestsLocked(
+            const char* functionName,
+            std::shared_ptr<const std::function<void(std::vector<ResultType>)>> callback,
+            const std::vector<RequestType>& requests,
+            std::list<std::vector<RequestType>>* storedRequests,
+            std::list<std::vector<ResultType>>* storedResponses) const REQUIRES(mLock);
+
+    DumpResult mDumpResult;
+};
+
+}  // namespace vehicle
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
+
+#endif  // android_hardware_automotive_vehicle_aidl_impl_vhal_test_MockVehicleHardware_H_
diff --git a/automotive/vehicle/aidl/impl/vhal/test/SubscriptionManagerTest.cpp b/automotive/vehicle/aidl/impl/vhal/test/SubscriptionManagerTest.cpp
index fa08d6c..f81b1a2 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/SubscriptionManagerTest.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/test/SubscriptionManagerTest.cpp
@@ -45,6 +45,7 @@
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValues;
 using ::ndk::ScopedAStatus;
+using ::ndk::SpAIBinder;
 using ::testing::ElementsAre;
 using ::testing::WhenSorted;
 
@@ -95,7 +96,9 @@
                             0);
                 });
         mCallback = ::ndk::SharedRefBase::make<PropertyCallback>();
-        mCallbackClient = IVehicleCallback::fromBinder(mCallback->asBinder());
+        // Keep the local binder alive.
+        mBinder = mCallback->asBinder();
+        mCallbackClient = IVehicleCallback::fromBinder(mBinder);
     }
 
     SubscriptionManager* getManager() { return mManager.get(); }
@@ -112,6 +115,7 @@
     std::unique_ptr<SubscriptionManager> mManager;
     std::shared_ptr<PropertyCallback> mCallback;
     std::shared_ptr<IVehicleCallback> mCallbackClient;
+    SpAIBinder mBinder;
 };
 
 TEST_F(SubscriptionManagerTest, testSubscribeGlobalContinuous) {
@@ -185,7 +189,7 @@
 
     // Theoretically trigger 10 times, but check for at least 9 times to be stable.
     EXPECT_GE(getEvents().size(), static_cast<size_t>(9));
-    EXPECT_LE(getEvents().size(), static_cast<size_t>(11));
+    EXPECT_LE(getEvents().size(), static_cast<size_t>(15));
 }
 
 TEST_F(SubscriptionManagerTest, testSubscribeMultipleAreasContinuous) {
@@ -229,7 +233,7 @@
     auto result = getManager()->subscribe(getCallbackClient(), options, true);
     ASSERT_TRUE(result.ok()) << "failed to subscribe: " << result.error().message();
 
-    result = getManager()->unsubscribe(getCallbackClient());
+    result = getManager()->unsubscribe(getCallbackClient()->asBinder().get());
     ASSERT_TRUE(result.ok()) << "failed to unsubscribe: " << result.error().message();
 
     clearEvents();
@@ -257,7 +261,8 @@
     auto result = getManager()->subscribe(getCallbackClient(), options, true);
     ASSERT_TRUE(result.ok()) << "failed to subscribe: " << result.error().message();
 
-    result = getManager()->unsubscribe(getCallbackClient(), std::vector<int32_t>({0}));
+    result = getManager()->unsubscribe(getCallbackClient()->asBinder().get(),
+                                       std::vector<int32_t>({0}));
     ASSERT_TRUE(result.ok()) << "failed to unsubscribe: " << result.error().message();
 
     clearEvents();
@@ -289,7 +294,7 @@
     auto result = getManager()->subscribe(getCallbackClient(), options, true);
     ASSERT_TRUE(result.ok()) << "failed to subscribe: " << result.error().message();
 
-    result = getManager()->unsubscribe(getCallbackClient());
+    result = getManager()->unsubscribe(getCallbackClient()->asBinder().get());
     ASSERT_TRUE(result.ok()) << "failed to unsubscribe: " << result.error().message();
 
     clearEvents();
@@ -315,12 +320,14 @@
     ASSERT_TRUE(result.ok()) << "failed to subscribe: " << result.error().message();
 
     // Property ID: 2 was not subscribed.
-    result = getManager()->unsubscribe(getCallbackClient(), std::vector<int32_t>({0, 1, 2}));
+    result = getManager()->unsubscribe(getCallbackClient()->asBinder().get(),
+                                       std::vector<int32_t>({0, 1, 2}));
     ASSERT_FALSE(result.ok()) << "unsubscribe an unsubscribed property must fail";
 
     // Since property 0 and property 1 was not unsubscribed successfully, we should be able to
     // unsubscribe them again.
-    result = getManager()->unsubscribe(getCallbackClient(), std::vector<int32_t>({0, 1}));
+    result = getManager()->unsubscribe(getCallbackClient()->asBinder().get(),
+                                       std::vector<int32_t>({0, 1}));
     ASSERT_TRUE(result.ok()) << "a failed unsubscription must not unsubscribe any properties"
                              << result.error().message();
 }
@@ -343,10 +350,10 @@
             },
     };
 
-    std::shared_ptr<IVehicleCallback> client1 = IVehicleCallback::fromBinder(
-            ::ndk::SharedRefBase::make<PropertyCallback>()->asBinder());
-    std::shared_ptr<IVehicleCallback> client2 = IVehicleCallback::fromBinder(
-            ::ndk::SharedRefBase::make<PropertyCallback>()->asBinder());
+    SpAIBinder binder1 = ::ndk::SharedRefBase::make<PropertyCallback>()->asBinder();
+    std::shared_ptr<IVehicleCallback> client1 = IVehicleCallback::fromBinder(binder1);
+    SpAIBinder binder2 = ::ndk::SharedRefBase::make<PropertyCallback>()->asBinder();
+    std::shared_ptr<IVehicleCallback> client2 = IVehicleCallback::fromBinder(binder2);
     auto result = getManager()->subscribe(client1, options1, false);
     ASSERT_TRUE(result.ok()) << "failed to subscribe: " << result.error().message();
     result = getManager()->subscribe(client2, options2, false);
@@ -447,7 +454,8 @@
     auto result = getManager()->subscribe(getCallbackClient(), options, false);
     ASSERT_TRUE(result.ok()) << "failed to subscribe: " << result.error().message();
 
-    result = getManager()->unsubscribe(getCallbackClient(), std::vector<int32_t>({0}));
+    result = getManager()->unsubscribe(getCallbackClient()->asBinder().get(),
+                                       std::vector<int32_t>({0}));
     ASSERT_TRUE(result.ok()) << "failed to unsubscribe: " << result.error().message();
 
     std::vector<VehiclePropValue> updatedValues = {
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/Android.bp b/automotive/vehicle/proto/Android.bp
similarity index 94%
rename from automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/Android.bp
rename to automotive/vehicle/proto/Android.bp
index 3307bd6..683f128 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/Android.bp
+++ b/automotive/vehicle/proto/Android.bp
@@ -25,8 +25,8 @@
 cc_library_static {
     name: "android.hardware.automotive.vehicle@2.0-libproto-native",
     visibility: [
-        "//hardware/interfaces/automotive/vehicle/2.0/default:__subpackages__",
-        "//device/generic/car/emulator/vhal_v2_0:__subpackages__",
+        "//hardware/interfaces/automotive/vehicle:__subpackages__",
+        "//device/generic/car/emulator:__subpackages__",
     ],
     vendor: true,
     host_supported: true,
diff --git a/automotive/vehicle/proto/VehicleHalProto.proto b/automotive/vehicle/proto/VehicleHalProto.proto
new file mode 100644
index 0000000..0dafe8c
--- /dev/null
+++ b/automotive/vehicle/proto/VehicleHalProto.proto
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+syntax = "proto2";
+
+package vhal_proto;
+
+// CMD messages are from workstation --> VHAL
+// RESP messages are from VHAL --> workstation
+enum MsgType {
+    GET_CONFIG_CMD = 0;
+    GET_CONFIG_RESP = 1;
+    GET_CONFIG_ALL_CMD = 2;
+    GET_CONFIG_ALL_RESP = 3;
+    GET_PROPERTY_CMD = 4;
+    GET_PROPERTY_RESP = 5;
+    GET_PROPERTY_ALL_CMD = 6;
+    GET_PROPERTY_ALL_RESP = 7;
+    SET_PROPERTY_CMD = 8;
+    SET_PROPERTY_RESP = 9;
+    SET_PROPERTY_ASYNC = 10;
+    DEBUG_CMD = 11;
+    DEBUG_RESP = 12;
+}
+enum Status {
+    RESULT_OK = 0;
+    ERROR_UNKNOWN = 1;
+    ERROR_UNIMPLEMENTED_CMD = 2;
+    ERROR_INVALID_PROPERTY = 3;
+    ERROR_INVALID_AREA_ID = 4;
+    ERROR_PROPERTY_UNINITIALIZED = 5;
+    ERROR_WRITE_ONLY_PROPERTY = 6;
+    ERROR_MEMORY_ALLOC_FAILED = 7;
+    ERROR_INVALID_OPERATION = 8;
+}
+
+enum VehiclePropStatus {
+    AVAILABLE = 0;
+    UNAVAILABLE = 1;
+    ERROR = 2;
+}
+
+message VehicleAreaConfig {
+    required int32 area_id = 1;
+    optional sint32 min_int32_value = 2;
+    optional sint32 max_int32_value = 3;
+    optional sint64 min_int64_value = 4;
+    optional sint64 max_int64_value = 5;
+    optional float min_float_value = 6;
+    optional float max_float_value = 7;
+}
+
+message VehiclePropConfig {
+    required int32 prop = 1;
+    optional int32 access = 2;
+    optional int32 change_mode = 3;
+    optional int32 value_type = 4;
+    optional int32 supported_areas = 5;  // Deprecated - DO NOT USE
+    repeated VehicleAreaConfig area_configs = 6;
+    optional int32 config_flags = 7;
+    repeated int32 config_array = 8;
+    optional string config_string = 9;
+    optional float min_sample_rate = 10;
+    optional float max_sample_rate = 11;
+};
+
+message VehiclePropValue {
+    // common data
+    required int32 prop = 1;
+    optional int32 value_type = 2;
+    optional int64 timestamp = 3;            // required for valid data from HAL, skipped for set
+    optional VehiclePropStatus status = 10;  // required for valid data from HAL, skipped for set
+
+    // values
+    optional int32 area_id = 4;
+    repeated sint32 int32_values = 5;  // this also covers boolean value.
+    repeated sint64 int64_values = 6;
+    repeated float float_values = 7;
+    optional string string_value = 8;
+    optional bytes bytes_value = 9;
+};
+
+// This structure is used to notify what values to get from the Vehicle HAL
+message VehiclePropGet {
+    required int32 prop = 1;
+    optional int32 area_id = 2;
+};
+
+message EmulatorMessage {
+    required MsgType msg_type = 1;
+    optional Status status = 2;        // Only for RESP messages
+    repeated VehiclePropGet prop = 3;  // Provided for getConfig, getProperty commands
+    repeated VehiclePropConfig config = 4;
+    repeated VehiclePropValue value = 5;
+    repeated string debug_commands = 6;  // Required for debug command
+    optional string debug_result = 7;    // Required for debug RESP messages
+};
diff --git a/biometrics/face/aidl/Android.bp b/biometrics/face/aidl/Android.bp
index fff2c1d..174f1da 100644
--- a/biometrics/face/aidl/Android.bp
+++ b/biometrics/face/aidl/Android.bp
@@ -22,7 +22,6 @@
     backend: {
         java: {
             platform_apis: true,
-            srcs_available: true,
         },
         cpp: {
             enabled: false,
diff --git a/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/ISession.aidl b/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/ISession.aidl
index 4b51bb1..3665534 100644
--- a/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/ISession.aidl
+++ b/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/ISession.aidl
@@ -51,4 +51,5 @@
   android.hardware.biometrics.common.ICancellationSignal authenticateWithContext(in long operationId, in android.hardware.biometrics.common.OperationContext context);
   android.hardware.biometrics.common.ICancellationSignal enrollWithContext(in android.hardware.keymaster.HardwareAuthToken hat, in android.hardware.biometrics.face.EnrollmentType type, in android.hardware.biometrics.face.Feature[] features, in @nullable android.hardware.common.NativeHandle previewSurface, in android.hardware.biometrics.common.OperationContext context);
   android.hardware.biometrics.common.ICancellationSignal detectInteractionWithContext(in android.hardware.biometrics.common.OperationContext context);
+  void onContextChanged(in android.hardware.biometrics.common.OperationContext context);
 }
diff --git a/biometrics/face/aidl/android/hardware/biometrics/face/ISession.aidl b/biometrics/face/aidl/android/hardware/biometrics/face/ISession.aidl
index bbe3632..a92b366 100644
--- a/biometrics/face/aidl/android/hardware/biometrics/face/ISession.aidl
+++ b/biometrics/face/aidl/android/hardware/biometrics/face/ISession.aidl
@@ -461,4 +461,10 @@
 
     /* See ISession#detectInteraction() */
     ICancellationSignal detectInteractionWithContext(in OperationContext context);
+
+    /**
+     * This may be called while an authenticate, detect interaction, or enrollment operation is
+     * running when the context changes.
+     */
+    void onContextChanged(in OperationContext context);
 }
diff --git a/biometrics/face/aidl/default/Session.cpp b/biometrics/face/aidl/default/Session.cpp
index 9e753e5..984a1a9 100644
--- a/biometrics/face/aidl/default/Session.cpp
+++ b/biometrics/face/aidl/default/Session.cpp
@@ -172,4 +172,8 @@
     return detectInteraction(out);
 }
 
+ndk::ScopedAStatus Session::onContextChanged(const common::OperationContext& /*context*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::biometrics::face
diff --git a/biometrics/face/aidl/default/Session.h b/biometrics/face/aidl/default/Session.h
index 0ce9e20..9db17d2 100644
--- a/biometrics/face/aidl/default/Session.h
+++ b/biometrics/face/aidl/default/Session.h
@@ -82,6 +82,8 @@
             const common::OperationContext& context,
             std::shared_ptr<common::ICancellationSignal>* out) override;
 
+    ndk::ScopedAStatus onContextChanged(const common::OperationContext& context) override;
+
   private:
     std::shared_ptr<ISessionCallback> cb_;
     std::mt19937 mRandom;
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
index 4e7b3b4..30f299d 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
@@ -53,4 +53,5 @@
   android.hardware.biometrics.common.ICancellationSignal detectInteractionWithContext(in android.hardware.biometrics.common.OperationContext context);
   void onPointerDownWithContext(in android.hardware.biometrics.fingerprint.PointerContext context);
   void onPointerUpWithContext(in android.hardware.biometrics.fingerprint.PointerContext context);
+  void onContextChanged(in android.hardware.biometrics.common.OperationContext context);
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
index ea8c6aa..db01145 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
@@ -473,4 +473,10 @@
 
     /** See ISession#onPointerUp(int) */
     void onPointerUpWithContext(in PointerContext context);
+
+    /**
+     * This may be called while an authenticate, detect interaction, or enrollment operation is
+     * running when the context changes.
+     */
+    void onContextChanged(in OperationContext context);
 }
diff --git a/biometrics/fingerprint/aidl/default/Session.cpp b/biometrics/fingerprint/aidl/default/Session.cpp
index 8cbcfc7..452ed12 100644
--- a/biometrics/fingerprint/aidl/default/Session.cpp
+++ b/biometrics/fingerprint/aidl/default/Session.cpp
@@ -270,4 +270,8 @@
     return onPointerUp(context.pointerId);
 }
 
+ndk::ScopedAStatus Session::onContextChanged(const common::OperationContext& /*context*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::biometrics::fingerprint
diff --git a/biometrics/fingerprint/aidl/default/include/Session.h b/biometrics/fingerprint/aidl/default/include/Session.h
index 584cb27..acd5def 100644
--- a/biometrics/fingerprint/aidl/default/include/Session.h
+++ b/biometrics/fingerprint/aidl/default/include/Session.h
@@ -95,6 +95,8 @@
 
     ndk::ScopedAStatus onPointerUpWithContext(const PointerContext& context) override;
 
+    ndk::ScopedAStatus onContextChanged(const common::OperationContext& context) override;
+
     bool isClosed();
 
   private:
diff --git a/bluetooth/audio/2.2/default/OWNERS b/bluetooth/audio/2.2/default/OWNERS
new file mode 100644
index 0000000..17ea464
--- /dev/null
+++ b/bluetooth/audio/2.2/default/OWNERS
@@ -0,0 +1,4 @@
+include platform/packages/modules/Bluetooth:/OWNERS
+
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl
index e2a08a0..948c04a 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl
@@ -37,11 +37,16 @@
   android.hardware.bluetooth.audio.CodecType codecType;
   android.hardware.bluetooth.audio.CodecCapabilities.Capabilities capabilities;
   @VintfStability
+  parcelable VendorCapabilities {
+    ParcelableHolder extension;
+  }
+  @VintfStability
   union Capabilities {
     android.hardware.bluetooth.audio.SbcCapabilities sbcCapabilities;
     android.hardware.bluetooth.audio.AacCapabilities aacCapabilities;
     android.hardware.bluetooth.audio.LdacCapabilities ldacCapabilities;
     android.hardware.bluetooth.audio.AptxCapabilities aptxCapabilities;
     android.hardware.bluetooth.audio.Lc3Capabilities lc3Capabilities;
+    android.hardware.bluetooth.audio.CodecCapabilities.VendorCapabilities vendorCapabilities;
   }
 }
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl
index 34ebd60..32bccd8 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl
@@ -40,11 +40,18 @@
   boolean isScmstEnabled;
   android.hardware.bluetooth.audio.CodecConfiguration.CodecSpecific config;
   @VintfStability
+  parcelable VendorConfiguration {
+    int vendorId;
+    char codecId;
+    ParcelableHolder codecConfig;
+  }
+  @VintfStability
   union CodecSpecific {
     android.hardware.bluetooth.audio.SbcConfiguration sbcConfig;
     android.hardware.bluetooth.audio.AacConfiguration aacConfig;
     android.hardware.bluetooth.audio.LdacConfiguration ldacConfig;
     android.hardware.bluetooth.audio.AptxConfiguration aptxConfig;
     android.hardware.bluetooth.audio.Lc3Configuration lc3Config;
+    android.hardware.bluetooth.audio.CodecConfiguration.VendorConfiguration vendorConfig;
   }
 }
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl
index 44b434b..3a5f951 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl
@@ -41,4 +41,5 @@
   APTX_HD = 4,
   LDAC = 5,
   LC3 = 6,
+  VENDOR = 7,
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl
index 5bf0252..41e2431 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl
@@ -30,12 +30,17 @@
 @VintfStability
 parcelable CodecCapabilities {
     @VintfStability
+    parcelable VendorCapabilities {
+        ParcelableHolder extension;
+    }
+    @VintfStability
     union Capabilities {
         SbcCapabilities sbcCapabilities;
         AacCapabilities aacCapabilities;
         LdacCapabilities ldacCapabilities;
         AptxCapabilities aptxCapabilities;
         Lc3Capabilities lc3Capabilities;
+        VendorCapabilities vendorCapabilities;
     }
     CodecType codecType;
     Capabilities capabilities;
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl
index 9e43f22..3679537 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl
@@ -30,12 +30,19 @@
 @VintfStability
 parcelable CodecConfiguration {
     @VintfStability
+    parcelable VendorConfiguration {
+        int vendorId;
+        char codecId;
+        ParcelableHolder codecConfig;
+    }
+    @VintfStability
     union CodecSpecific {
         SbcConfiguration sbcConfig;
         AacConfiguration aacConfig;
         LdacConfiguration ldacConfig;
         AptxConfiguration aptxConfig;
         Lc3Configuration lc3Config;
+        VendorConfiguration vendorConfig;
     }
     CodecType codecType;
     /**
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl
index 68c60f5..9c33081 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl
@@ -26,4 +26,5 @@
     APTX_HD,
     LDAC,
     LC3,
+    VENDOR,
 }
diff --git a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
index 7e49074..5a413e0 100644
--- a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
@@ -88,8 +88,9 @@
     return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
   }
   *_aidl_return = data_mq_->dupeDesc();
+  auto desc = data_mq_->dupeDesc();
   BluetoothAudioSessionReport::OnSessionStarted(session_type_, stack_iface_,
-                                                _aidl_return, *audio_config_);
+                                                &desc, *audio_config_);
   return ndk::ScopedAStatus::ok();
 }
 
diff --git a/bluetooth/audio/aidl/default/Android.bp b/bluetooth/audio/aidl/default/Android.bp
index 846702f..fc882d4 100644
--- a/bluetooth/audio/aidl/default/Android.bp
+++ b/bluetooth/audio/aidl/default/Android.bp
@@ -8,7 +8,7 @@
 }
 
 cc_library_shared {
-    name: "android.hardware.bluetooth.audio-V1-impl",
+    name: "android.hardware.bluetooth.audio-impl",
     vendor: true,
     vintf_fragments: ["bluetooth_audio.xml"],
     srcs: [
diff --git a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
index 8e6cee7..1e55a0b 100644
--- a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
+++ b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BTAudioProvidersFactory"
+#define LOG_TAG "BTAudioProviderFactoryAIDL"
 
 #include "BluetoothAudioProviderFactory.h"
 
diff --git a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h
index 96d888c..b38cfd2 100644
--- a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h
+++ b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h
@@ -18,13 +18,6 @@
 
 #include <aidl/android/hardware/bluetooth/audio/BnBluetoothAudioProviderFactory.h>
 
-#include "A2dpOffloadAudioProvider.h"
-#include "A2dpSoftwareAudioProvider.h"
-#include "BluetoothAudioProvider.h"
-#include "HearingAidAudioProvider.h"
-#include "LeAudioOffloadAudioProvider.h"
-#include "LeAudioSoftwareAudioProvider.h"
-
 namespace aidl {
 namespace android {
 namespace hardware {
diff --git a/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp b/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp
index a993059..66ce93b 100644
--- a/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp
@@ -81,10 +81,10 @@
     *_aidl_return = DataMQDesc();
     return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
   }
+  *_aidl_return = data_mq_->dupeDesc();
   auto desc = data_mq_->dupeDesc();
   BluetoothAudioSessionReport::OnSessionStarted(session_type_, stack_iface_,
                                                 &desc, *audio_config_);
-  *_aidl_return = data_mq_->dupeDesc();
   return ndk::ScopedAStatus::ok();
 }
 
diff --git a/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp b/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
index 4078783..72ac9bd 100644
--- a/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BTAudioProviderLeAudioSW"
+#define LOG_TAG "BTAudioProviderLeAudioHW"
 
 #include "LeAudioOffloadAudioProvider.h"
 
diff --git a/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp b/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp
index f9962fd..67b7d60 100644
--- a/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BTAudioProviderLeAudioHW"
+#define LOG_TAG "BTAudioProviderLeAudioSW"
 
 #include "LeAudioSoftwareAudioProvider.h"
 
@@ -88,6 +88,16 @@
       channel_mode_to_channel_count(pcm_config.channelMode) *
       (pcm_config.bitsPerSample / 8) * (pcm_config.dataIntervalUs / 1000) *
       buffer_modifier;
+  if (data_mq_size <= 0) {
+    LOG(ERROR) << __func__ << "Unexpected audio buffer size: " << data_mq_size
+               << ", SampleRateHz: " << pcm_config.sampleRateHz
+               << ", ChannelMode: " << toString(pcm_config.channelMode)
+               << ", BitsPerSample: "
+               << static_cast<int>(pcm_config.bitsPerSample)
+               << ", DataIntervalUs: " << pcm_config.dataIntervalUs
+               << ", SessionType: " << toString(session_type_);
+    return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+  }
 
   LOG(INFO) << __func__ << " - size of audio buffer " << data_mq_size
             << " byte(s)";
@@ -113,8 +123,9 @@
     return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
   }
   *_aidl_return = data_mq_->dupeDesc();
+  auto desc = data_mq_->dupeDesc();
   BluetoothAudioSessionReport::OnSessionStarted(session_type_, stack_iface_,
-                                                _aidl_return, *audio_config_);
+                                                &desc, *audio_config_);
   return ndk::ScopedAStatus::ok();
 }
 
diff --git a/bluetooth/audio/aidl/default/OWNERS b/bluetooth/audio/aidl/default/OWNERS
new file mode 100644
index 0000000..17ea464
--- /dev/null
+++ b/bluetooth/audio/aidl/default/OWNERS
@@ -0,0 +1,4 @@
+include platform/packages/modules/Bluetooth:/OWNERS
+
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/aidl/vts/OWNERS b/bluetooth/audio/aidl/vts/OWNERS
new file mode 100644
index 0000000..17ea464
--- /dev/null
+++ b/bluetooth/audio/aidl/vts/OWNERS
@@ -0,0 +1,4 @@
+include platform/packages/modules/Bluetooth:/OWNERS
+
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/utils/OWNERS b/bluetooth/audio/utils/OWNERS
index ed92847..17ea464 100644
--- a/bluetooth/audio/utils/OWNERS
+++ b/bluetooth/audio/utils/OWNERS
@@ -1,3 +1,4 @@
 include platform/packages/modules/Bluetooth:/OWNERS
 
-cheneyni@google.com
\ No newline at end of file
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
index 92cd0f5..516ebe8 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
@@ -78,7 +78,7 @@
     .bitsPerSample = {24},
 };
 
-static const Lc3Capabilities kDefaultOffloadLc3Capability = {
+static const Lc3Capabilities kDefaultA2dpOffloadLc3Capability = {
     .samplingFrequencyHz = {44100, 48000},
     .frameDurationUs = {7500, 10000},
     .channelMode = {ChannelMode::MONO, ChannelMode::STEREO},
@@ -285,11 +285,11 @@
   const Lc3Configuration lc3_data =
       codec_specific.get<CodecConfiguration::CodecSpecific::lc3Config>();
 
-  if (ContainedInVector(kDefaultOffloadLc3Capability.samplingFrequencyHz,
+  if (ContainedInVector(kDefaultA2dpOffloadLc3Capability.samplingFrequencyHz,
                         lc3_data.samplingFrequencyHz) &&
-      ContainedInVector(kDefaultOffloadLc3Capability.frameDurationUs,
+      ContainedInVector(kDefaultA2dpOffloadLc3Capability.frameDurationUs,
                         lc3_data.frameDurationUs) &&
-      ContainedInVector(kDefaultOffloadLc3Capability.channelMode,
+      ContainedInVector(kDefaultA2dpOffloadLc3Capability.channelMode,
                         lc3_data.channelMode)) {
     return true;
   }
@@ -352,10 +352,10 @@
       case CodecType::LC3:
         codec_capability.capabilities
             .set<CodecCapabilities::Capabilities::lc3Capabilities>(
-                kDefaultOffloadLc3Capability);
+                kDefaultA2dpOffloadLc3Capability);
         break;
       case CodecType::UNKNOWN:
-        codec_capability = {};
+      case CodecType::VENDOR:
         break;
     }
   }
@@ -420,6 +420,7 @@
       }
       break;
     case CodecType::UNKNOWN:
+    case CodecType::VENDOR:
       break;
   }
   return false;
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
index c542ce5..0259a7e 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
@@ -45,11 +45,7 @@
       const SessionType& session_type, const CodecConfiguration& codec_config);
 
   static bool IsOffloadLeAudioConfigurationValid(
-      const SessionType& session_type, const Lc3Configuration& codec_config);
-
-  static bool IsOffloadLeAudioConfigurationValid(
-      const SessionType& session_type,
-      const LeAudioConfiguration& codec_config);
+      const SessionType& session_type, const LeAudioConfiguration&);
 
   static std::vector<LeAudioCodecCapabilitiesSetting>
   GetLeAudioOffloadCodecCapabilities(const SessionType& session_type);
@@ -77,8 +73,6 @@
       const CodecConfiguration::CodecSpecific& codec_specific);
   static bool IsOffloadLc3ConfigurationValid(
       const CodecConfiguration::CodecSpecific& codec_specific);
-  static bool IsOffloadLeAudioConfigurationValid(
-      const SessionType& session_type, const LeAudioCodecConfiguration&);
 };
 
 }  // namespace audio
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
index 95e473e..f626db8 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
@@ -35,22 +35,8 @@
 static constexpr int kWritePollMs = 1;  // polled non-blocking interval
 static constexpr int kReadPollMs = 1;   // polled non-blocking interval
 
-const CodecConfiguration BluetoothAudioSession::kInvalidCodecConfiguration = {};
-const LeAudioConfiguration kInvalidLeAudioConfiguration = {};
-AudioConfiguration BluetoothAudioSession::invalidSoftwareAudioConfiguration =
-    {};
-AudioConfiguration BluetoothAudioSession::invalidOffloadAudioConfiguration = {};
-AudioConfiguration BluetoothAudioSession::invalidLeOffloadAudioConfig = {};
-
 BluetoothAudioSession::BluetoothAudioSession(const SessionType& session_type)
-    : session_type_(session_type), stack_iface_(nullptr), data_mq_(nullptr) {
-  invalidSoftwareAudioConfiguration.set<AudioConfiguration::pcmConfig>(
-      kInvalidPcmConfiguration);
-  invalidOffloadAudioConfiguration.set<AudioConfiguration::a2dpConfig>(
-      kInvalidCodecConfiguration);
-  invalidLeOffloadAudioConfig.set<AudioConfiguration::leAudioConfig>(
-      kInvalidLeAudioConfiguration);
-}
+    : session_type_(session_type), stack_iface_(nullptr), data_mq_(nullptr) {}
 
 /***
  *
@@ -72,13 +58,7 @@
   } else if (!UpdateDataPath(mq_desc)) {
     LOG(ERROR) << __func__ << " - SessionType=" << toString(session_type_)
                << " MqDescriptor Invalid";
-    if (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-      audio_config_ = std::make_unique<AudioConfiguration>(
-          invalidOffloadAudioConfiguration);
-    } else {
-      audio_config_ = std::make_unique<AudioConfiguration>(
-          invalidSoftwareAudioConfiguration);
-    }
+    audio_config_ = nullptr;
   } else {
     stack_iface_ = stack_iface;
     LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_)
@@ -91,13 +71,7 @@
   std::lock_guard<std::recursive_mutex> guard(mutex_);
   bool toggled = IsSessionReady();
   LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_);
-  if (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-    audio_config_ =
-        std::make_unique<AudioConfiguration>(invalidOffloadAudioConfiguration);
-  } else {
-    audio_config_ =
-        std::make_unique<AudioConfiguration>(invalidSoftwareAudioConfiguration);
-  }
+  audio_config_ = nullptr;
   stack_iface_ = nullptr;
   UpdateDataPath(nullptr);
   if (toggled) {
@@ -111,22 +85,17 @@
  *
  ***/
 
-const AudioConfiguration& BluetoothAudioSession::GetAudioConfig() {
+const AudioConfiguration BluetoothAudioSession::GetAudioConfig() {
   std::lock_guard<std::recursive_mutex> guard(mutex_);
   if (!IsSessionReady()) {
-    if (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-      return invalidOffloadAudioConfiguration;
-    } else {
-      return invalidSoftwareAudioConfiguration;
-    }
     switch (session_type_) {
       case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
-        return invalidOffloadAudioConfiguration;
+        return AudioConfiguration(CodecConfiguration{});
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH:
-        return invalidLeOffloadAudioConfig;
+        return AudioConfiguration(LeAudioConfiguration{});
       default:
-        return invalidSoftwareAudioConfiguration;
+        return AudioConfiguration(PcmConfiguration{});
     }
   }
   return *audio_config_;
@@ -169,7 +138,7 @@
        session_type_ ==
            SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
        (data_mq_ != nullptr && data_mq_->isValid()));
-  return stack_iface_ != nullptr && is_mq_valid;
+  return stack_iface_ != nullptr && is_mq_valid && audio_config_ != nullptr;
 }
 
 /***
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h
index 85fd571..73bc0f8 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h
@@ -144,7 +144,7 @@
    * The control function is for the bluetooth_audio module to get the current
    * AudioConfiguration
    ***/
-  const AudioConfiguration& GetAudioConfig();
+  const AudioConfiguration GetAudioConfig();
 
   /***
    * The report function is used to report that the Bluetooth stack has notified
@@ -173,14 +173,6 @@
   // Return if IBluetoothAudioProviderFactory implementation existed
   static bool IsAidlAvailable();
 
-  static constexpr PcmConfiguration kInvalidPcmConfiguration = {};
-  // can't be constexpr because of non-literal type
-  static const CodecConfiguration kInvalidCodecConfiguration;
-
-  static AudioConfiguration invalidSoftwareAudioConfiguration;
-  static AudioConfiguration invalidOffloadAudioConfiguration;
-  static AudioConfiguration invalidLeOffloadAudioConfig;
-
  private:
   // using recursive_mutex to allow hwbinder to re-enter again.
   std::recursive_mutex mutex_;
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
index a3ed428..aff01e5 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
@@ -79,11 +79,15 @@
         BluetoothAudioSessionInstance::GetSessionInstance(session_type);
     if (session_ptr != nullptr) {
       return session_ptr->GetAudioConfig();
-    } else if (session_type ==
-               SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-      return BluetoothAudioSession::invalidOffloadAudioConfiguration;
-    } else {
-      return BluetoothAudioSession::invalidSoftwareAudioConfiguration;
+    }
+    switch (session_type) {
+      case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
+        return AudioConfiguration(CodecConfiguration{});
+      case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
+      case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH:
+        return AudioConfiguration(LeAudioConfiguration{});
+      default:
+        return AudioConfiguration(PcmConfiguration{});
     }
   }
 
diff --git a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp
index 91e0238..632a389 100644
--- a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp
+++ b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp
@@ -93,16 +93,6 @@
     std::unordered_map<uint16_t, std::shared_ptr<PortStatusCallbacks_2_2>>>
     legacy_callback_table;
 
-const static std::unordered_map<SessionType_2_0, SessionType>
-    session_type_2_0_to_aidl_map{
-        {SessionType_2_0::A2DP_SOFTWARE_ENCODING_DATAPATH,
-         SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH},
-        {SessionType_2_0::A2DP_HARDWARE_OFFLOAD_DATAPATH,
-         SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH},
-        {SessionType_2_0::HEARING_AID_SOFTWARE_ENCODING_DATAPATH,
-         SessionType::HEARING_AID_SOFTWARE_ENCODING_DATAPATH},
-    };
-
 const static std::unordered_map<SessionType_2_1, SessionType>
     session_type_2_1_to_aidl_map{
         {SessionType_2_1::A2DP_SOFTWARE_ENCODING_DATAPATH,
@@ -121,18 +111,6 @@
          SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH},
     };
 
-const static std::unordered_map<int32_t, SampleRate_2_0>
-    sample_rate_to_hidl_2_0_map{
-        {44100, SampleRate_2_0::RATE_44100},
-        {48000, SampleRate_2_0::RATE_48000},
-        {88200, SampleRate_2_0::RATE_88200},
-        {96000, SampleRate_2_0::RATE_96000},
-        {176400, SampleRate_2_0::RATE_176400},
-        {192000, SampleRate_2_0::RATE_192000},
-        {16000, SampleRate_2_0::RATE_16000},
-        {24000, SampleRate_2_0::RATE_24000},
-    };
-
 const static std::unordered_map<int32_t, SampleRate_2_1>
     sample_rate_to_hidl_2_1_map{
         {44100, SampleRate_2_1::RATE_44100},
@@ -211,20 +189,6 @@
         {LdacQualityIndex::ABR, LdacQualityIndex_2_0::QUALITY_ABR},
     };
 
-const static std::unordered_map<LeAudioMode, LeAudioMode_2_2>
-    leaudio_mode_to_hidl_map{
-        {LeAudioMode::UNKNOWN, LeAudioMode_2_2::UNKNOWN},
-        {LeAudioMode::UNICAST, LeAudioMode_2_2::UNICAST},
-        {LeAudioMode::BROADCAST, LeAudioMode_2_2::BROADCAST},
-    };
-
-inline SessionType from_session_type_2_0(
-    const SessionType_2_0& session_type_hidl) {
-  auto it = session_type_2_0_to_aidl_map.find(session_type_hidl);
-  if (it != session_type_2_0_to_aidl_map.end()) return it->second;
-  return SessionType::UNKNOWN;
-}
-
 inline SessionType from_session_type_2_1(
     const SessionType_2_1& session_type_hidl) {
   auto it = session_type_2_1_to_aidl_map.find(session_type_hidl);
@@ -232,6 +196,11 @@
   return SessionType::UNKNOWN;
 }
 
+inline SessionType from_session_type_2_0(
+    const SessionType_2_0& session_type_hidl) {
+  return from_session_type_2_1(static_cast<SessionType_2_1>(session_type_hidl));
+}
+
 inline HidlStatus to_hidl_status(const BluetoothAudioStatus& status) {
   switch (status) {
     case BluetoothAudioStatus::SUCCESS:
@@ -243,18 +212,19 @@
   }
 }
 
-inline SampleRate_2_0 to_hidl_sample_rate_2_0(const int32_t sample_rate_hz) {
-  auto it = sample_rate_to_hidl_2_0_map.find(sample_rate_hz);
-  if (it != sample_rate_to_hidl_2_0_map.end()) return it->second;
-  return SampleRate_2_0::RATE_UNKNOWN;
-}
-
 inline SampleRate_2_1 to_hidl_sample_rate_2_1(const int32_t sample_rate_hz) {
   auto it = sample_rate_to_hidl_2_1_map.find(sample_rate_hz);
   if (it != sample_rate_to_hidl_2_1_map.end()) return it->second;
   return SampleRate_2_1::RATE_UNKNOWN;
 }
 
+inline SampleRate_2_0 to_hidl_sample_rate_2_0(const int32_t sample_rate_hz) {
+  auto it = sample_rate_to_hidl_2_1_map.find(sample_rate_hz);
+  if (it != sample_rate_to_hidl_2_1_map.end())
+    return static_cast<SampleRate_2_0>(it->second);
+  return SampleRate_2_0::RATE_UNKNOWN;
+}
+
 inline BitsPerSample_2_0 to_hidl_bits_per_sample(const int8_t bit_per_sample) {
   switch (bit_per_sample) {
     case 16:
@@ -449,18 +419,49 @@
 
 inline Lc3CodecConfig_2_1 to_hidl_leaudio_config_2_1(
     const LeAudioConfiguration& leaudio_config) {
-  auto& unicast_config =
-      leaudio_config.modeConfig
-          .get<LeAudioConfiguration::LeAudioModeConfig::unicastConfig>();
+  Lc3CodecConfig_2_1 hidl_lc3_codec_config = {
+      .audioChannelAllocation = 0,
+  };
+  if (leaudio_config.modeConfig.getTag() ==
+      LeAudioConfiguration::LeAudioModeConfig::unicastConfig) {
+    auto& unicast_config =
+        leaudio_config.modeConfig
+            .get<LeAudioConfiguration::LeAudioModeConfig::unicastConfig>();
+    if (unicast_config.leAudioCodecConfig.getTag() ==
+        LeAudioCodecConfiguration::lc3Config) {
+      LOG(FATAL) << __func__ << ": unexpected codec type(vendor?)";
+    }
+    auto& le_codec_config = unicast_config.leAudioCodecConfig
+                                .get<LeAudioCodecConfiguration::lc3Config>();
 
-  auto& le_codec_config = unicast_config.leAudioCodecConfig
-                              .get<LeAudioCodecConfiguration::lc3Config>();
+    hidl_lc3_codec_config.lc3Config = to_hidl_lc3_config_2_1(le_codec_config);
 
-  Lc3CodecConfig_2_1 hidl_lc3_codec_config;
-  hidl_lc3_codec_config.lc3Config = to_hidl_lc3_config_2_1(le_codec_config);
+    for (const auto& map : unicast_config.streamMap) {
+      hidl_lc3_codec_config.audioChannelAllocation |=
+          map.audioChannelAllocation;
+    }
+  } else {
+    // NOTE: Broadcast is not officially supported in HIDL
+    auto& bcast_config =
+        leaudio_config.modeConfig
+            .get<LeAudioConfiguration::LeAudioModeConfig::broadcastConfig>();
+    if (bcast_config.streamMap.empty()) {
+      return hidl_lc3_codec_config;
+    }
+    if (bcast_config.streamMap[0].leAudioCodecConfig.getTag() !=
+        LeAudioCodecConfiguration::lc3Config) {
+      LOG(FATAL) << __func__ << ": unexpected codec type(vendor?)";
+    }
+    auto& le_codec_config =
+        bcast_config.streamMap[0]
+            .leAudioCodecConfig.get<LeAudioCodecConfiguration::lc3Config>();
+    hidl_lc3_codec_config.lc3Config = to_hidl_lc3_config_2_1(le_codec_config);
 
-  hidl_lc3_codec_config.audioChannelAllocation =
-      unicast_config.streamMap.size();
+    for (const auto& map : bcast_config.streamMap) {
+      hidl_lc3_codec_config.audioChannelAllocation |=
+          map.audioChannelAllocation;
+    }
+  }
 
   return hidl_lc3_codec_config;
 }
@@ -468,13 +469,10 @@
 inline LeAudioConfig_2_2 to_hidl_leaudio_config_2_2(
     const LeAudioConfiguration& leaudio_config) {
   LeAudioConfig_2_2 hidl_leaudio_config;
-  if (leaudio_mode_to_hidl_map.find(leaudio_config.mode) !=
-      leaudio_mode_to_hidl_map.end()) {
-    hidl_leaudio_config.mode = leaudio_mode_to_hidl_map.at(leaudio_config.mode);
-  }
 
   if (leaudio_config.modeConfig.getTag() ==
       LeAudioConfiguration::LeAudioModeConfig::unicastConfig) {
+    hidl_leaudio_config.mode = LeAudioMode_2_2::UNICAST;
     auto& unicast_config =
         leaudio_config.modeConfig
             .get<LeAudioConfiguration::LeAudioModeConfig::unicastConfig>();
@@ -497,6 +495,7 @@
     }
   } else if (leaudio_config.modeConfig.getTag() ==
              LeAudioConfiguration::LeAudioModeConfig::broadcastConfig) {
+    hidl_leaudio_config.mode = LeAudioMode_2_2::BROADCAST;
     auto bcast_config =
         leaudio_config.modeConfig
             .get<LeAudioConfiguration::LeAudioModeConfig::broadcastConfig>();
@@ -641,6 +640,12 @@
       from_session_type_2_0(session_type), buffer, bytes);
 }
 
+size_t HidlToAidlMiddleware_2_0::InReadPcmData(
+    const SessionType_2_0& session_type, void* buffer, size_t bytes) {
+  return BluetoothAudioSessionControl::InReadPcmData(
+      from_session_type_2_0(session_type), buffer, bytes);
+}
+
 bool HidlToAidlMiddleware_2_0::IsAidlAvailable() {
   return BluetoothAudioSession::IsAidlAvailable();
 }
@@ -761,6 +766,13 @@
       from_session_type_2_1(session_type));
 }
 
+void HidlToAidlMiddleware_2_2::UpdateTracksMetadata(
+    const SessionType_2_1& session_type,
+    const struct source_metadata* source_metadata) {
+  return BluetoothAudioSessionControl::UpdateSourceMetadata(
+      from_session_type_2_1(session_type), *source_metadata);
+}
+
 void HidlToAidlMiddleware_2_2::UpdateSinkMetadata(
     const SessionType_2_1& session_type,
     const struct sink_metadata* sink_metadata) {
diff --git a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h
index d10ee37..b124d8f 100644
--- a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h
+++ b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h
@@ -64,6 +64,9 @@
 
   static size_t OutWritePcmData(const SessionType_2_0& session_type,
                                 const void* buffer, size_t bytes);
+
+  static size_t InReadPcmData(const SessionType_2_0& session_type, void* buffer,
+                              size_t bytes);
 };
 
 }  // namespace audio
diff --git a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h
index 149e404..f6c3e5c 100644
--- a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h
+++ b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h
@@ -54,6 +54,10 @@
 
   static void StopStream(const SessionType_2_1& session_type);
 
+  static void UpdateTracksMetadata(
+      const SessionType_2_1& session_type,
+      const struct source_metadata* source_metadata);
+
   static void UpdateSinkMetadata(const SessionType_2_1& session_type,
                                  const struct sink_metadata* sink_metadata);
 };
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSession.cpp b/bluetooth/audio/utils/session/BluetoothAudioSession.cpp
index 6d5608b..283952e 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSession.cpp
+++ b/bluetooth/audio/utils/session/BluetoothAudioSession.cpp
@@ -437,6 +437,9 @@
 
 // The control function reads stream from FMQ
 size_t BluetoothAudioSession::InReadPcmData(void* buffer, size_t bytes) {
+  if (HidlToAidlMiddleware_2_0::IsAidlAvailable())
+    return HidlToAidlMiddleware_2_0::InReadPcmData(session_type_, buffer,
+                                                   bytes);
   if (buffer == nullptr || !bytes) return 0;
   size_t totalRead = 0;
   int ms_timeout = kFmqReceiveTimeoutMs;
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h b/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h
index 368939e..c270ef0 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h
+++ b/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h
@@ -152,7 +152,7 @@
     std::shared_ptr<BluetoothAudioSession_2_2> session_ptr =
         BluetoothAudioSessionInstance_2_2::GetSessionInstance(session_type);
     if (session_ptr != nullptr) {
-      session_ptr->GetAudioSession()->UpdateTracksMetadata(source_metadata);
+      session_ptr->UpdateTracksMetadata(source_metadata);
     }
   }
 
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp
index 4613ddc..ceb0662 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp
+++ b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp
@@ -31,9 +31,13 @@
 
 using ::aidl::android::hardware::bluetooth::audio::HidlToAidlMiddleware_2_0;
 using ::aidl::android::hardware::bluetooth::audio::HidlToAidlMiddleware_2_2;
+using ::android::hardware::audio::common::V5_0::AudioContentType;
 using ::android::hardware::audio::common::V5_0::AudioSource;
+using ::android::hardware::audio::common::V5_0::AudioUsage;
+using ::android::hardware::audio::common::V5_0::PlaybackTrackMetadata;
 using ::android::hardware::audio::common::V5_0::RecordTrackMetadata;
 using ::android::hardware::audio::common::V5_0::SinkMetadata;
+using ::android::hardware::audio::common::V5_0::SourceMetadata;
 using ::android::hardware::bluetooth::audio::V2_0::BitsPerSample;
 using ::android::hardware::bluetooth::audio::V2_0::ChannelMode;
 using ::android::hardware::bluetooth::audio::V2_2::LeAudioConfiguration;
@@ -128,6 +132,53 @@
   return audio_session_2_1;
 }
 
+void BluetoothAudioSession_2_2::UpdateTracksMetadata(
+    const struct source_metadata* source_metadata) {
+  if (HidlToAidlMiddleware_2_0::IsAidlAvailable())
+    return HidlToAidlMiddleware_2_2::UpdateTracksMetadata(raw_session_type_,
+                                                          source_metadata);
+  std::lock_guard<std::recursive_mutex> guard(audio_session->mutex_);
+  if (!IsSessionReady()) {
+    LOG(DEBUG) << __func__ << " - SessionType=" << toString(session_type_2_1_)
+               << " has NO session";
+    return;
+  }
+
+  ssize_t track_count = source_metadata->track_count;
+  LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_2_1_)
+            << ", " << track_count << " track(s)";
+
+  if (session_type_2_1_ == SessionType_2_1::UNKNOWN) {
+    audio_session->UpdateTracksMetadata(source_metadata);
+    return;
+  }
+
+  struct playback_track_metadata* track = source_metadata->tracks;
+  SourceMetadata sourceMetadata;
+  PlaybackTrackMetadata* halMetadata;
+
+  sourceMetadata.tracks.resize(track_count);
+  halMetadata = sourceMetadata.tracks.data();
+  while (track_count && track) {
+    halMetadata->usage = static_cast<AudioUsage>(track->usage);
+    halMetadata->contentType =
+        static_cast<AudioContentType>(track->content_type);
+    halMetadata->gain = track->gain;
+    LOG(VERBOSE) << __func__ << " - SessionType=" << toString(session_type_2_1_)
+                 << ", usage=" << toString(halMetadata->usage)
+                 << ", content=" << toString(halMetadata->contentType)
+                 << ", gain=" << halMetadata->gain;
+    --track_count;
+    ++track;
+    ++halMetadata;
+  }
+  auto hal_retval = audio_session->stack_iface_->updateMetadata(sourceMetadata);
+  if (!hal_retval.isOk()) {
+    LOG(WARNING) << __func__ << " - IBluetoothAudioPort SessionType="
+                 << toString(session_type_2_1_) << " failed";
+  }
+}
+
 void BluetoothAudioSession_2_2::UpdateSinkMetadata(
     const struct sink_metadata* sink_metadata) {
   if (HidlToAidlMiddleware_2_0::IsAidlAvailable())
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h
index b6f96ab..e04ad80 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h
+++ b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h
@@ -152,6 +152,7 @@
   const ::android::hardware::bluetooth::audio::V2_2::AudioConfiguration
   GetAudioConfig();
 
+  void UpdateTracksMetadata(const struct source_metadata* source_metadata);
   void UpdateSinkMetadata(const struct sink_metadata* sink_metadata);
 
   static constexpr ::android::hardware::bluetooth::audio::V2_2::
diff --git a/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp b/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp
index c812d54..b63e3bb 100644
--- a/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp
+++ b/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp
@@ -292,8 +292,7 @@
     } else {
         deviceName = std::string("device@3.4/external/") + cameraId;
     }
-    if (mCameraStatusMap.find(deviceName) != mCameraStatusMap.end()) {
-        mCameraStatusMap.erase(deviceName);
+    if (mCameraStatusMap.erase(deviceName) != 0) {
         if (mCallbacks != nullptr) {
             mCallbacks->cameraDeviceStatusChange(deviceName, CameraDeviceStatus::NOT_PRESENT);
         }
@@ -391,4 +390,4 @@
 }  // namespace provider
 }  // namespace camera
 }  // namespace hardware
-}  // namespace android
\ No newline at end of file
+}  // namespace android
diff --git a/cas/1.0/Android.bp b/cas/1.0/Android.bp
index 368156a..e27695c 100644
--- a/cas/1.0/Android.bp
+++ b/cas/1.0/Android.bp
@@ -23,4 +23,8 @@
         "android.hidl.base@1.0",
     ],
     gen_java: true,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media",
+    ],
 }
diff --git a/cas/1.1/Android.bp b/cas/1.1/Android.bp
index f5b1cc9..1bf9c5f 100644
--- a/cas/1.1/Android.bp
+++ b/cas/1.1/Android.bp
@@ -22,4 +22,8 @@
         "android.hidl.base@1.0",
     ],
     gen_java: true,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media",
+    ],
 }
diff --git a/cas/1.2/Android.bp b/cas/1.2/Android.bp
index 6c94020..5468ed0 100644
--- a/cas/1.2/Android.bp
+++ b/cas/1.2/Android.bp
@@ -24,4 +24,8 @@
         "android.hidl.base@1.0",
     ],
     gen_java: true,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media",
+    ],
 }
diff --git a/cas/native/1.0/Android.bp b/cas/native/1.0/Android.bp
index 3bb74c1..ef77ab4 100644
--- a/cas/native/1.0/Android.bp
+++ b/cas/native/1.0/Android.bp
@@ -21,4 +21,8 @@
         "android.hidl.base@1.0",
     ],
     gen_java: false,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media",
+    ],
 }
diff --git a/common/fmq/aidl/Android.bp b/common/fmq/aidl/Android.bp
index 376ac97..842a75f 100644
--- a/common/fmq/aidl/Android.bp
+++ b/common/fmq/aidl/Android.bp
@@ -25,7 +25,6 @@
     backend: {
         java: {
             sdk_version: "module_current",
-            srcs_available: true,
         },
         cpp: {
             enabled: false,
diff --git a/common/support/Android.bp b/common/support/Android.bp
index 718901e..12ab1f7 100644
--- a/common/support/Android.bp
+++ b/common/support/Android.bp
@@ -25,6 +25,7 @@
     apex_available: [
         "//apex_available:platform",
         "com.android.neuralnetworks",
+        "com.android.media.swcodec",
     ],
     min_sdk_version: "29",
 }
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 594f07b..95ba217 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -10,7 +10,7 @@
     <hal format="hidl" optional="false">
         <name>android.hardware.audio</name>
         <version>6.0</version>
-        <version>7.0</version>
+        <version>7.0-1</version>
         <interface>
             <name>IDevicesFactory</name>
             <instance>default</instance>
@@ -292,6 +292,14 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.graphics.allocator</name>
+        <version>1</version>
+        <interface>
+            <name>IAllocator</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.graphics.composer</name>
         <version>2.1-4</version>
@@ -374,6 +382,14 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.input.processor</name>
+        <version>1</version>
+        <interface>
+            <name>IInputProcessor</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.keymaster</name>
         <version>3.0</version>
@@ -478,6 +494,13 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.nfc</name>
+        <interface>
+            <name>INfc</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.oemlock</name>
         <version>1.0</version>
@@ -488,7 +511,7 @@
     </hal>
     <hal format="aidl" optional="false">
         <name>android.hardware.power</name>
-        <version>1-3</version>
+        <version>2-3</version>
         <interface>
             <name>IPower</name>
             <instance>default</instance>
@@ -744,6 +767,13 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.usb</name>
+        <interface>
+            <name>IUsb</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.usb.gadget</name>
         <version>1.0-2</version>
diff --git a/contexthub/aidl/aidl_api/android.hardware.contexthub/current/android/hardware/contexthub/Setting.aidl b/contexthub/aidl/aidl_api/android.hardware.contexthub/current/android/hardware/contexthub/Setting.aidl
index 41bc9ae..d998478 100644
--- a/contexthub/aidl/aidl_api/android.hardware.contexthub/current/android/hardware/contexthub/Setting.aidl
+++ b/contexthub/aidl/aidl_api/android.hardware.contexthub/current/android/hardware/contexthub/Setting.aidl
@@ -39,4 +39,6 @@
   WIFI_SCANNING = 3,
   AIRPLANE_MODE = 4,
   MICROPHONE = 5,
+  BT_MAIN = 6,
+  BT_SCANNING = 7,
 }
diff --git a/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl b/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl
index 2135041..16666ef 100644
--- a/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl
+++ b/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl
@@ -189,9 +189,8 @@
      * called, the HAL is expected to clean up any resources attached to the messaging channel
      * associated with this host endpoint ID.
      *
-     * @param hostEndPointId The ID of the host that has disconnected.
-     *
-     * @throws EX_ILLEGAL_ARGUMENT if hostEndpointId is not associated with a connected host.
+     * @param hostEndPointId The ID of the host that has disconnected. Any invalid values for this
+     *                       parameter should be ignored (no-op).
      */
     void onHostEndpointDisconnected(char hostEndpointId);
 
diff --git a/contexthub/aidl/android/hardware/contexthub/Setting.aidl b/contexthub/aidl/android/hardware/contexthub/Setting.aidl
index f2e55db..91d4c3f 100644
--- a/contexthub/aidl/android/hardware/contexthub/Setting.aidl
+++ b/contexthub/aidl/android/hardware/contexthub/Setting.aidl
@@ -39,4 +39,12 @@
      * by CHRE.
      */
     MICROPHONE,
+    /**
+     * The main BT toggle in the Android settings for BT connectivity.
+     */
+    BT_MAIN,
+    /**
+     * The "BT scanning" setting for location scans.
+     */
+    BT_SCANNING,
 }
diff --git a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
index a47f64e..3c01c6b 100644
--- a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
+++ b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
@@ -300,6 +300,14 @@
     testSettingChanged(Setting::MICROPHONE);
 }
 
+TEST_P(ContextHubAidl, TestOnBtMainSettingChanged) {
+    testSettingChanged(Setting::BT_MAIN);
+}
+
+TEST_P(ContextHubAidl, TestOnBtScanningSettingChanged) {
+    testSettingChanged(Setting::BT_SCANNING);
+}
+
 std::vector<std::tuple<std::string, int32_t>> generateContextHubMapping() {
     std::vector<std::tuple<std::string, int32_t>> tuples;
     auto contextHubAidlNames = android::getAidlHalInstanceNames(IContextHub::descriptor);
@@ -330,8 +338,7 @@
 TEST_P(ContextHubAidl, TestInvalidHostConnection) {
     constexpr char16_t kHostEndpointId = 1;
 
-    Status status = contextHub->onHostEndpointDisconnected(kHostEndpointId);
-    ASSERT_EQ(status.exceptionCode(), android::binder::Status::EX_ILLEGAL_ARGUMENT);
+    ASSERT_TRUE(contextHub->onHostEndpointDisconnected(kHostEndpointId).isOk());
 }
 
 std::string PrintGeneratedTest(const testing::TestParamInfo<ContextHubAidl::ParamType>& info) {
diff --git a/drm/1.0/vts/functional/Android.bp b/drm/1.0/vts/functional/Android.bp
index 5ea6ad3..a35d41d 100644
--- a/drm/1.0/vts/functional/Android.bp
+++ b/drm/1.0/vts/functional/Android.bp
@@ -23,6 +23,14 @@
     default_applicable_licenses: ["hardware_interfaces_license"],
 }
 
+cc_library_headers {
+    name: "drm_hal_vendor_module_headers",
+    vendor_available: true,
+    export_include_dirs: [
+        "include",
+    ],
+}
+
 cc_library_static {
     name: "libdrmvtshelper",
     defaults: ["VtsHalTargetTestDefaults"],
@@ -36,6 +44,7 @@
         "android.hardware.drm@1.0-helper",
     ],
     export_include_dirs: ["include"],
+    export_static_lib_headers: ["android.hardware.drm@1.0-helper"],
 }
 
 cc_library_static {
diff --git a/drm/1.2/vts/functional/Android.bp b/drm/1.2/vts/functional/Android.bp
index ca90ee9..5a655e7 100644
--- a/drm/1.2/vts/functional/Android.bp
+++ b/drm/1.2/vts/functional/Android.bp
@@ -24,6 +24,19 @@
 }
 
 cc_library_static {
+    name: "libvtsclearkey",
+    srcs: [
+        "drm_hal_clearkey_module.cpp",
+    ],
+    static_libs: [
+        "libgtest",
+    ],
+    header_libs: ["drm_hal_vendor_module_headers"],
+    export_header_lib_headers: ["drm_hal_vendor_module_headers"],
+    export_include_dirs: ["."],
+}
+
+cc_library_static {
     name: "android.hardware.drm@1.2-vts",
     defaults: ["VtsHalTargetTestDefaults"],
     local_include_dirs: [
diff --git a/drm/aidl/Android.bp b/drm/aidl/Android.bp
index d8500ec..1d97e80 100644
--- a/drm/aidl/Android.bp
+++ b/drm/aidl/Android.bp
@@ -29,4 +29,5 @@
             min_sdk_version: "current",
         },
     },
+    double_loadable: true,
 }
diff --git a/drm/aidl/vts/Android.bp b/drm/aidl/vts/Android.bp
new file mode 100644
index 0000000..5b41830
--- /dev/null
+++ b/drm/aidl/vts/Android.bp
@@ -0,0 +1,73 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_test {
+    name: "VtsAidlHalDrmTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: [
+        "drm_hal_common.cpp",
+        "drm_hal_test.cpp",
+        "drm_hal_test_main.cpp",
+    ],
+    local_include_dirs: [
+        "include",
+    ],
+    header_libs: [
+        "drm_hal_vendor_module_headers",
+    ],
+    shared_libs: [
+        "libandroid",
+        "libbinder_ndk",
+        "libcrypto",
+        "libnativehelper",
+    ],
+    static_libs: [
+        "android.hardware.drm@1.0-helper",
+        "android.hardware.drm-V1-ndk",
+        "android.hardware.common-V2-ndk",
+        "libdrmvtshelper",
+        "libvtsclearkey",
+    ],
+    arch: {
+        arm: {
+            data: [":libvtswidevine-arm-prebuilts"],
+        },
+        arm64: {
+            data: [":libvtswidevine-arm64-prebuilts"],
+        },
+        x86: {
+            data: [":libvtswidevine-x86-prebuilts"],
+        },
+        x86_64: {
+            data: [":libvtswidevine-x86_64-prebuilts"],
+        },
+    },
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+}
diff --git a/drm/aidl/vts/AndroidTest.xml b/drm/aidl/vts/AndroidTest.xml
new file mode 100644
index 0000000..9e5b41a
--- /dev/null
+++ b/drm/aidl/vts/AndroidTest.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2020 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsAidlHalDrmTargetTest.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-native" />
+    <option name="not-shardable" value="true" />
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer"/>
+
+    <target_preparer class="com.android.tradefed.targetprep.WifiPreparer" >
+        <option name="verify-only" value="true" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push-file" key="VtsAidlHalDrmTargetTest" value="/data/local/tmp/VtsAidlHalDrmTargetTest" />
+        <option name="push-file" key="libvtswidevine64.so" value="/data/local/tmp/64/lib/libvtswidevine.so" />
+        <option name="push-file" key="libvtswidevine32.so" value="/data/local/tmp/32/lib/libvtswidevine.so" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="VtsAidlHalDrmTargetTest" />
+    </test>
+</configuration>
diff --git a/drm/aidl/vts/OWNERS b/drm/aidl/vts/OWNERS
new file mode 100644
index 0000000..e44b93e
--- /dev/null
+++ b/drm/aidl/vts/OWNERS
@@ -0,0 +1,4 @@
+edwinwong@google.com
+jtinker@google.com
+kelzhan@google.com
+robertshih@google.com
diff --git a/drm/aidl/vts/drm_hal_common.cpp b/drm/aidl/vts/drm_hal_common.cpp
new file mode 100644
index 0000000..751c25b
--- /dev/null
+++ b/drm/aidl/vts/drm_hal_common.cpp
@@ -0,0 +1,602 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "drm_hal_common"
+
+#include <gtest/gtest.h>
+#include <log/log.h>
+#include <openssl/aes.h>
+#include <sys/mman.h>
+#include <random>
+
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <android/sharedmem.h>
+
+#include "drm_hal_clearkey_module.h"
+#include "drm_hal_common.h"
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace drm {
+namespace vts {
+
+namespace clearkeydrm = ::android::hardware::drm::V1_2::vts;
+
+using std::vector;
+using ::aidl::android::hardware::common::Ashmem;
+using ::aidl::android::hardware::drm::BufferType;
+using ::aidl::android::hardware::drm::DecryptResult;
+using ::aidl::android::hardware::drm::DestinationBuffer;
+using ::aidl::android::hardware::drm::EventType;
+using ::aidl::android::hardware::drm::ICryptoPlugin;
+using ::aidl::android::hardware::drm::IDrmPlugin;
+using ::aidl::android::hardware::drm::KeyRequest;
+using ::aidl::android::hardware::drm::KeyRequestType;
+using ::aidl::android::hardware::drm::KeySetId;
+using ::aidl::android::hardware::drm::KeyType;
+using ::aidl::android::hardware::drm::KeyValue;
+using ::aidl::android::hardware::drm::Mode;
+using ::aidl::android::hardware::drm::Pattern;
+using ::aidl::android::hardware::drm::ProvisionRequest;
+using ::aidl::android::hardware::drm::ProvideProvisionResponseResult;
+using ::aidl::android::hardware::drm::SecurityLevel;
+using ::aidl::android::hardware::drm::Status;
+using ::aidl::android::hardware::drm::SubSample;
+using ::aidl::android::hardware::drm::Uuid;
+
+Status DrmErr(const ::ndk::ScopedAStatus& ret) {
+    return static_cast<Status>(ret.getServiceSpecificError());
+}
+
+std::string HalBaseName(const std::string& fullname) {
+    auto idx = fullname.find('/');
+    if (idx == std::string::npos) {
+        return fullname;
+    }
+    return fullname.substr(idx + 1);
+}
+
+const char* kDrmIface = "android.hardware.drm.IDrmFactory";
+const char* kCryptoIface = "android.hardware.drm.ICryptoFactory";
+
+std::string HalFullName(const std::string& iface, const std::string& basename) {
+    return iface + '/' + basename;
+}
+
+testing::AssertionResult IsOk(const ::ndk::ScopedAStatus& ret) {
+    if (ret.isOk()) {
+        return testing::AssertionSuccess();
+    }
+    return testing::AssertionFailure() << "ex: " << ret.getExceptionCode()
+                                       << "; svc err: " << ret.getServiceSpecificError()
+                                       << "; desc: " << ret.getDescription();
+}
+
+const char* kCallbackLostState = "LostState";
+const char* kCallbackKeysChange = "KeysChange";
+
+drm_vts::VendorModules* DrmHalTest::gVendorModules = nullptr;
+
+/**
+ * DrmHalPluginListener
+ */
+::ndk::ScopedAStatus DrmHalPluginListener::onEvent(
+        EventType eventType,
+        const vector<uint8_t>& sessionId,
+        const vector<uint8_t>& data) {
+    ListenerArgs args{};
+    args.eventType = eventType;
+    args.sessionId = sessionId;
+    args.data = data;
+    eventPromise.set_value(args);
+    return ::ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus DrmHalPluginListener::onExpirationUpdate(
+        const vector<uint8_t>& sessionId,
+        int64_t expiryTimeInMS) {
+    ListenerArgs args{};
+    args.sessionId = sessionId;
+    args.expiryTimeInMS = expiryTimeInMS;
+    expirationUpdatePromise.set_value(args);
+    return ::ndk::ScopedAStatus::ok();
+
+}
+
+::ndk::ScopedAStatus DrmHalPluginListener::onSessionLostState(const vector<uint8_t>& sessionId) {
+    ListenerArgs args{};
+    args.sessionId = sessionId;
+    sessionLostStatePromise.set_value(args);
+    return ::ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus DrmHalPluginListener::onKeysChange(
+        const std::vector<uint8_t>& sessionId,
+        const std::vector<::aidl::android::hardware::drm::KeyStatus>& keyStatusList,
+        bool hasNewUsableKey) {
+    ListenerArgs args{};
+    args.sessionId = sessionId;
+    args.keyStatusList = keyStatusList;
+    args.hasNewUsableKey = hasNewUsableKey;
+    keysChangePromise.set_value(args);
+    return ::ndk::ScopedAStatus::ok();
+}
+
+ListenerArgs DrmHalPluginListener::getListenerArgs(std::promise<ListenerArgs>& promise) {
+    auto future = promise.get_future();
+    auto timeout = std::chrono::milliseconds(500);
+    EXPECT_EQ(future.wait_for(timeout), std::future_status::ready);
+    return future.get();
+}
+
+ListenerArgs DrmHalPluginListener::getEventArgs() {
+    return getListenerArgs(eventPromise);
+}
+
+ListenerArgs DrmHalPluginListener::getExpirationUpdateArgs() {
+    return getListenerArgs(expirationUpdatePromise);
+}
+
+ListenerArgs DrmHalPluginListener::getSessionLostStateArgs() {
+    return getListenerArgs(sessionLostStatePromise);
+}
+
+ListenerArgs DrmHalPluginListener::getKeysChangeArgs() {
+    return getListenerArgs(keysChangePromise);
+}
+
+static DrmHalVTSVendorModule_V1* getModuleForInstance(const std::string& instance) {
+    if (instance.find("clearkey") != std::string::npos ||
+        instance.find("default") != std::string::npos) {
+        return new clearkeydrm::DrmHalVTSClearkeyModule();
+    }
+
+    return static_cast<DrmHalVTSVendorModule_V1*>(
+            DrmHalTest::gVendorModules->getModuleByName(instance));
+}
+
+/**
+ * DrmHalTest
+ */
+
+DrmHalTest::DrmHalTest() : vendorModule(getModuleForInstance(GetParamService())) {}
+
+void DrmHalTest::SetUp() {
+    const ::testing::TestInfo* const test_info =
+            ::testing::UnitTest::GetInstance()->current_test_info();
+
+    ALOGD("Running test %s.%s from (vendor) module %s", test_info->test_case_name(),
+          test_info->name(), GetParamService().c_str());
+
+    auto svc = GetParamService();
+    const string cryptoInstance = HalFullName(kCryptoIface, svc);
+    const string drmInstance = HalFullName(kDrmIface, svc);
+
+    if (drmInstance.find("IDrmFactory") != std::string::npos) {
+        drmFactory = IDrmFactory::fromBinder(
+                ::ndk::SpAIBinder(AServiceManager_waitForService(drmInstance.c_str())));
+        ASSERT_NE(drmFactory, nullptr);
+        drmPlugin = createDrmPlugin();
+    }
+
+    if (cryptoInstance.find("ICryptoFactory") != std::string::npos) {
+        cryptoFactory = ICryptoFactory::fromBinder(
+                ::ndk::SpAIBinder(AServiceManager_waitForService(cryptoInstance.c_str())));
+        ASSERT_NE(cryptoFactory, nullptr);
+        cryptoPlugin = createCryptoPlugin();
+    }
+
+    if (!vendorModule) {
+        ASSERT_NE(drmInstance, "widevine") << "Widevine requires vendor module.";
+        ASSERT_NE(drmInstance, "clearkey") << "Clearkey requires vendor module.";
+        GTEST_SKIP() << "No vendor module installed";
+    }
+
+    ASSERT_EQ(HalBaseName(drmInstance), vendorModule->getServiceName());
+    contentConfigurations = vendorModule->getContentConfigurations();
+
+    // If drm scheme not installed skip subsequent tests
+    bool result = false;
+    drmFactory->isCryptoSchemeSupported({getUUID()}, "cenc", SecurityLevel::SW_SECURE_CRYPTO,
+                                        &result);
+    if (!result) {
+        if (GetParamUUID() == std::array<uint8_t, 16>()) {
+            GTEST_SKIP() << "vendor module drm scheme not supported";
+        } else {
+            FAIL() << "param scheme must not supported";
+        }
+    }
+
+    ASSERT_NE(nullptr, drmPlugin.get())
+            << "Can't find " << vendorModule->getServiceName() << " drm aidl plugin";
+    ASSERT_NE(nullptr, cryptoPlugin.get())
+            << "Can't find " << vendorModule->getServiceName() << " crypto aidl plugin";
+}
+
+std::shared_ptr<::aidl::android::hardware::drm::IDrmPlugin> DrmHalTest::createDrmPlugin() {
+    if (drmFactory == nullptr) {
+        return nullptr;
+    }
+    std::string packageName("aidl.android.hardware.drm.test");
+    std::shared_ptr<::aidl::android::hardware::drm::IDrmPlugin> result;
+    auto ret = drmFactory->createPlugin({getUUID()}, packageName, &result);
+    EXPECT_OK(ret) << "createDrmPlugin remote call failed";
+    return result;
+}
+
+std::shared_ptr<::aidl::android::hardware::drm::ICryptoPlugin> DrmHalTest::createCryptoPlugin() {
+    if (cryptoFactory == nullptr) {
+        return nullptr;
+    }
+    vector<uint8_t> initVec;
+    std::shared_ptr<::aidl::android::hardware::drm::ICryptoPlugin> result;
+    auto ret = cryptoFactory->createPlugin({getUUID()}, initVec, &result);
+    EXPECT_OK(ret) << "createCryptoPlugin remote call failed";
+    return result;
+}
+
+::aidl::android::hardware::drm::Uuid DrmHalTest::getAidlUUID() {
+    return toAidlUuid(getUUID());
+}
+
+std::vector<uint8_t> DrmHalTest::getUUID() {
+    auto paramUUID = GetParamUUID();
+    if (paramUUID == std::array<uint8_t, 16>()) {
+        return getVendorUUID();
+    }
+    return std::vector(paramUUID.begin(), paramUUID.end());
+}
+
+std::vector<uint8_t> DrmHalTest::getVendorUUID() {
+    if (vendorModule == nullptr) {
+        ALOGW("vendor module for %s not found", GetParamService().c_str());
+        return {};
+    }
+    return vendorModule->getUUID();
+}
+
+void DrmHalTest::provision() {
+    std::string certificateType;
+    std::string certificateAuthority;
+    vector<uint8_t> provisionRequest;
+    std::string defaultUrl;
+    ProvisionRequest result;
+    auto ret = drmPlugin->getProvisionRequest(certificateType, certificateAuthority, &result);
+
+    EXPECT_TXN(ret);
+    if (ret.isOk()) {
+        EXPECT_NE(result.request.size(), 0u);
+        provisionRequest = result.request;
+        defaultUrl = result.defaultUrl;
+    } else if (DrmErr(ret) == Status::ERROR_DRM_CANNOT_HANDLE) {
+        EXPECT_EQ(0u, result.request.size());
+    }
+
+    if (provisionRequest.size() > 0) {
+        vector<uint8_t> response =
+                vendorModule->handleProvisioningRequest(provisionRequest, defaultUrl);
+        ASSERT_NE(0u, response.size());
+
+        ProvideProvisionResponseResult result;
+        auto ret = drmPlugin->provideProvisionResponse(response, &result);
+        EXPECT_TXN(ret);
+    }
+}
+
+SessionId DrmHalTest::openSession(SecurityLevel level, Status* err) {
+    SessionId sessionId;
+    auto ret = drmPlugin->openSession(level, &sessionId);
+    EXPECT_TXN(ret);
+    *err = DrmErr(ret);
+    return sessionId;
+}
+
+/**
+ * Helper method to open a session and verify that a non-empty
+ * session ID is returned
+ */
+SessionId DrmHalTest::openSession() {
+    SessionId sessionId;
+    auto ret = drmPlugin->openSession(SecurityLevel::DEFAULT, &sessionId);
+    EXPECT_OK(ret);
+    EXPECT_NE(0u, sessionId.size());
+    return sessionId;
+}
+
+/**
+ * Helper method to close a session
+ */
+void DrmHalTest::closeSession(const SessionId& sessionId) {
+    auto ret = drmPlugin->closeSession(sessionId);
+    EXPECT_OK(ret);
+}
+
+vector<uint8_t> DrmHalTest::getKeyRequest(
+        const SessionId& sessionId,
+        const DrmHalVTSVendorModule_V1::ContentConfiguration& configuration,
+        const KeyType& type = KeyType::STREAMING) {
+    KeyRequest result;
+    auto ret = drmPlugin->getKeyRequest(sessionId, configuration.initData, configuration.mimeType,
+                                        type, toAidlKeyedVector(configuration.optionalParameters),
+                                        &result);
+    EXPECT_OK(ret) << "Failed to get key request for configuration "
+                   << configuration.name << " for key type "
+                   << static_cast<int>(type);
+    if (type == KeyType::RELEASE) {
+        EXPECT_EQ(KeyRequestType::RELEASE, result.requestType);
+    } else {
+        EXPECT_EQ(KeyRequestType::INITIAL, result.requestType);
+    }
+    EXPECT_NE(result.request.size(), 0u) << "Expected key request size"
+                                            " to have length > 0 bytes";
+    return result.request;
+}
+
+DrmHalVTSVendorModule_V1::ContentConfiguration DrmHalTest::getContent(const KeyType& type) const {
+    for (const auto& config : contentConfigurations) {
+        if (type != KeyType::OFFLINE || config.policy.allowOffline) {
+            return config;
+        }
+    }
+    ADD_FAILURE() << "no content configurations found";
+    return {};
+}
+
+vector<uint8_t> DrmHalTest::provideKeyResponse(const SessionId& sessionId,
+                                               const vector<uint8_t>& keyResponse) {
+    KeySetId result;
+    auto ret = drmPlugin->provideKeyResponse(sessionId, keyResponse, &result);
+    EXPECT_OK(ret) << "Failure providing key response for configuration ";
+    return result.keySetId;
+}
+
+/**
+ * Helper method to load keys for subsequent decrypt tests.
+ * These tests use predetermined key request/response to
+ * avoid requiring a round trip to a license server.
+ */
+vector<uint8_t> DrmHalTest::loadKeys(
+        const SessionId& sessionId,
+        const DrmHalVTSVendorModule_V1::ContentConfiguration& configuration, const KeyType& type) {
+    vector<uint8_t> keyRequest = getKeyRequest(sessionId, configuration, type);
+
+    /**
+     * Get key response from vendor module
+     */
+    vector<uint8_t> keyResponse =
+            vendorModule->handleKeyRequest(keyRequest, configuration.serverUrl);
+    EXPECT_NE(keyResponse.size(), 0u) << "Expected key response size "
+                                         "to have length > 0 bytes";
+
+    return provideKeyResponse(sessionId, keyResponse);
+}
+
+vector<uint8_t> DrmHalTest::loadKeys(const SessionId& sessionId, const KeyType& type) {
+    return loadKeys(sessionId, getContent(type), type);
+}
+
+std::array<uint8_t, 16> DrmHalTest::toStdArray(const vector<uint8_t>& vec) {
+    EXPECT_EQ(16u, vec.size());
+    std::array<uint8_t, 16> arr;
+    std::copy_n(vec.begin(), vec.size(), arr.begin());
+    return arr;
+}
+
+KeyedVector DrmHalTest::toAidlKeyedVector(const map<string, string>& params) {
+    std::vector<KeyValue> stdKeyedVector;
+    for (auto it = params.begin(); it != params.end(); ++it) {
+        KeyValue keyValue;
+        keyValue.key = it->first;
+        keyValue.value = it->second;
+        stdKeyedVector.push_back(keyValue);
+    }
+    return KeyedVector(stdKeyedVector);
+}
+
+/**
+ * getDecryptMemory allocates memory for decryption, then sets it
+ * as a shared buffer base in the crypto hal.  A parcelable Ashmem
+ * is returned.
+ *
+ * @param size the size of the memory segment to allocate
+ * @param the index of the memory segment which will be used
+ * to refer to it for decryption.
+ */
+Ashmem DrmHalTest::getDecryptMemory(size_t size, size_t index) {
+    int fd = ASharedMemory_create("drmVtsSharedMemory", size);
+    EXPECT_GE(fd, 0);
+    EXPECT_EQ(size, ASharedMemory_getSize(fd));
+
+    Ashmem ashmem;
+    ashmem.fd = ::ndk::ScopedFileDescriptor(fd);
+    ashmem.size = size;
+    EXPECT_OK(cryptoPlugin->setSharedBufferBase(ashmem, index));
+    return ashmem;
+}
+
+void DrmHalTest::fillRandom(const Ashmem& ashmem) {
+    std::random_device rd;
+    std::mt19937 rand(rd());
+
+    ::ndk::ScopedFileDescriptor fd = ashmem.fd.dup();
+    size_t size = ashmem.size;
+    uint8_t* base = static_cast<uint8_t*>(
+            mmap(nullptr, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd.get(), 0));
+    EXPECT_NE(MAP_FAILED, base);
+    for (size_t i = 0; i < size / sizeof(uint32_t); i++) {
+        auto p = static_cast<uint32_t*>(static_cast<void*>(base));
+        p[i] = rand();
+    }
+}
+
+uint32_t DrmHalTest::decrypt(Mode mode, bool isSecure, const std::array<uint8_t, 16>& keyId,
+                             uint8_t* iv, const vector<SubSample>& subSamples,
+                             const Pattern& pattern, const vector<uint8_t>& key,
+                             Status expectedStatus) {
+    const size_t kSegmentIndex = 0;
+
+    uint8_t localIv[AES_BLOCK_SIZE];
+    memcpy(localIv, iv, AES_BLOCK_SIZE);
+    vector<uint8_t> ivVec(localIv, localIv + AES_BLOCK_SIZE);
+
+    int64_t totalSize = 0;
+    for (size_t i = 0; i < subSamples.size(); i++) {
+        totalSize += subSamples[i].numBytesOfClearData;
+        totalSize += subSamples[i].numBytesOfEncryptedData;
+    }
+
+    // The first totalSize bytes of shared memory is the encrypted
+    // input, the second totalSize bytes (if exists) is the decrypted output.
+    size_t factor = expectedStatus == Status::ERROR_DRM_FRAME_TOO_LARGE ? 1 : 2;
+    Ashmem sharedMemory = getDecryptMemory(totalSize * factor, kSegmentIndex);
+
+    const SharedBuffer sourceBuffer = {.bufferId = kSegmentIndex, .offset = 0, .size = totalSize};
+    fillRandom(sharedMemory);
+
+    const DestinationBuffer destBuffer = {
+            .type = BufferType::SHARED_MEMORY,
+            .nonsecureMemory = {.bufferId = kSegmentIndex, .offset = totalSize, .size = totalSize},
+            .secureMemory = {.fds = {}, .ints = {}}};
+    const uint64_t offset = 0;
+    uint32_t bytesWritten = 0;
+    vector<uint8_t> keyIdVec(keyId.begin(), keyId.end());
+    DecryptResult result;
+    auto ret = cryptoPlugin->decrypt(isSecure, keyIdVec, ivVec, mode, pattern, subSamples,
+                                     sourceBuffer, offset, destBuffer, &result);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(expectedStatus, DrmErr(ret)) << "Unexpected decrypt status " << result.detailedError;
+    bytesWritten = result.bytesWritten;
+
+    if (bytesWritten != totalSize) {
+        return bytesWritten;
+    }
+    ::ndk::ScopedFileDescriptor fd = sharedMemory.fd.dup();
+    uint8_t* base = static_cast<uint8_t*>(
+            mmap(nullptr, totalSize, PROT_READ | PROT_WRITE, MAP_SHARED, fd.get(), 0));
+    EXPECT_NE(MAP_FAILED, base);
+
+    // generate reference vector
+    vector<uint8_t> reference(totalSize);
+
+    memcpy(localIv, iv, AES_BLOCK_SIZE);
+    switch (mode) {
+        case Mode::UNENCRYPTED:
+            memcpy(&reference[0], base, totalSize);
+            break;
+        case Mode::AES_CTR:
+            aes_ctr_decrypt(&reference[0], base, localIv, subSamples, key);
+            break;
+        case Mode::AES_CBC:
+            aes_cbc_decrypt(&reference[0], base, localIv, subSamples, key);
+            break;
+        case Mode::AES_CBC_CTS:
+            ADD_FAILURE() << "AES_CBC_CTS mode not supported";
+            break;
+    }
+
+    // compare reference to decrypted data which is at base + total size
+    EXPECT_EQ(0, memcmp(static_cast<void*>(&reference[0]), static_cast<void*>(base + totalSize),
+                        totalSize))
+            << "decrypt data mismatch";
+    return totalSize;
+}
+
+/**
+ * Decrypt a list of clear+encrypted subsamples using the specified key
+ * in AES-CTR mode
+ */
+void DrmHalTest::aes_ctr_decrypt(uint8_t* dest, uint8_t* src, uint8_t* iv,
+                                 const vector<SubSample>& subSamples, const vector<uint8_t>& key) {
+    AES_KEY decryptionKey;
+    AES_set_encrypt_key(&key[0], 128, &decryptionKey);
+
+    size_t offset = 0;
+    unsigned int blockOffset = 0;
+    uint8_t previousEncryptedCounter[AES_BLOCK_SIZE];
+    memset(previousEncryptedCounter, 0, AES_BLOCK_SIZE);
+
+    for (size_t i = 0; i < subSamples.size(); i++) {
+        const SubSample& subSample = subSamples[i];
+
+        if (subSample.numBytesOfClearData > 0) {
+            memcpy(dest + offset, src + offset, subSample.numBytesOfClearData);
+            offset += subSample.numBytesOfClearData;
+        }
+
+        if (subSample.numBytesOfEncryptedData > 0) {
+            AES_ctr128_encrypt(src + offset, dest + offset, subSample.numBytesOfEncryptedData,
+                               &decryptionKey, iv, previousEncryptedCounter, &blockOffset);
+            offset += subSample.numBytesOfEncryptedData;
+        }
+    }
+}
+
+/**
+ * Decrypt a list of clear+encrypted subsamples using the specified key
+ * in AES-CBC mode
+ */
+void DrmHalTest::aes_cbc_decrypt(uint8_t* dest, uint8_t* src, uint8_t* iv,
+                                 const vector<SubSample>& subSamples, const vector<uint8_t>& key) {
+    AES_KEY decryptionKey;
+    AES_set_encrypt_key(&key[0], 128, &decryptionKey);
+
+    size_t offset = 0;
+    for (size_t i = 0; i < subSamples.size(); i++) {
+        memcpy(dest + offset, src + offset, subSamples[i].numBytesOfClearData);
+        offset += subSamples[i].numBytesOfClearData;
+
+        AES_cbc_encrypt(src + offset, dest + offset, subSamples[i].numBytesOfEncryptedData,
+                        &decryptionKey, iv, 0 /* decrypt */);
+        offset += subSamples[i].numBytesOfEncryptedData;
+    }
+}
+
+/**
+ * Helper method to test decryption with invalid keys is returned
+ */
+void DrmHalClearkeyTest::decryptWithInvalidKeys(vector<uint8_t>& invalidResponse,
+                                                vector<uint8_t>& iv, const Pattern& noPattern,
+                                                const vector<SubSample>& subSamples) {
+    DrmHalVTSVendorModule_V1::ContentConfiguration content = getContent();
+    if (content.keys.empty()) {
+        FAIL() << "no keys";
+    }
+
+    const auto& key = content.keys[0];
+    auto sessionId = openSession();
+    KeySetId result;
+    auto ret = drmPlugin->provideKeyResponse(sessionId, invalidResponse, &result);
+
+    EXPECT_OK(ret);
+    EXPECT_EQ(0u, result.keySetId.size());
+
+    EXPECT_OK(cryptoPlugin->setMediaDrmSession(sessionId));
+
+    uint32_t byteCount =
+            decrypt(Mode::AES_CTR, key.isSecure, toStdArray(key.keyId), &iv[0], subSamples,
+                    noPattern, key.clearContentKey, Status::ERROR_DRM_NO_LICENSE);
+    EXPECT_EQ(0u, byteCount);
+
+    closeSession(sessionId);
+}
+
+}  // namespace vts
+}  // namespace drm
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/drm/aidl/vts/drm_hal_test.cpp b/drm/aidl/vts/drm_hal_test.cpp
new file mode 100644
index 0000000..3ac9f5c
--- /dev/null
+++ b/drm/aidl/vts/drm_hal_test.cpp
@@ -0,0 +1,551 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "drm_hal_test"
+
+#include <gtest/gtest.h>
+#include <log/log.h>
+#include <openssl/aes.h>
+
+#include <memory>
+#include <vector>
+
+#include "drm_hal_common.h"
+
+using ::aidl::android::hardware::drm::EventType;
+using ::aidl::android::hardware::drm::HdcpLevels;
+using ::aidl::android::hardware::drm::KeyRequest;
+using ::aidl::android::hardware::drm::HdcpLevel;
+using ::aidl::android::hardware::drm::IDrmPluginListener;
+using ::aidl::android::hardware::drm::KeyRequestType;
+using ::aidl::android::hardware::drm::KeySetId;
+using ::aidl::android::hardware::drm::KeyStatus;
+using ::aidl::android::hardware::drm::KeyStatusType;
+using ::aidl::android::hardware::drm::KeyType;
+using ::aidl::android::hardware::drm::Mode;
+using ::aidl::android::hardware::drm::OfflineLicenseState;
+using ::aidl::android::hardware::drm::Pattern;
+using ::aidl::android::hardware::drm::SecurityLevel;
+using ::aidl::android::hardware::drm::Status;
+using ::aidl::android::hardware::drm::SubSample;
+using ::aidl::android::hardware::drm::Uuid;
+
+using ::aidl::android::hardware::drm::vts::DrmErr;
+using ::aidl::android::hardware::drm::vts::DrmHalClearkeyTest;
+using ::aidl::android::hardware::drm::vts::DrmHalPluginListener;
+using ::aidl::android::hardware::drm::vts::DrmHalTest;
+using ::aidl::android::hardware::drm::vts::ListenerArgs;
+using ::aidl::android::hardware::drm::vts::kCallbackKeysChange;
+using ::aidl::android::hardware::drm::vts::kCallbackLostState;
+
+using std::string;
+using std::vector;
+
+static const char* const kVideoMp4 = "video/mp4";
+static const char* const kBadMime = "video/unknown";
+static const char* const kDrmErrorTestKey = "drmErrorTest";
+static const char* const kDrmErrorInvalidState = "invalidState";
+static const char* const kDrmErrorResourceContention = "resourceContention";
+static constexpr SecurityLevel kSwSecureCrypto = SecurityLevel::SW_SECURE_CRYPTO;
+static constexpr SecurityLevel kHwSecureAll = SecurityLevel::HW_SECURE_ALL;
+
+/**
+ * Ensure drm factory supports module UUID Scheme
+ */
+TEST_P(DrmHalTest, VendorUuidSupported) {
+    bool result = false;
+    auto ret =
+            drmFactory->isCryptoSchemeSupported(getAidlUUID(), kVideoMp4, kSwSecureCrypto, &result);
+    ALOGI("kVideoMp4 = %s res %d", kVideoMp4, static_cast<bool>(result));
+    EXPECT_OK(ret);
+    EXPECT_TRUE(result);
+}
+
+/**
+ * Ensure drm factory doesn't support an invalid scheme UUID
+ */
+TEST_P(DrmHalTest, InvalidPluginNotSupported) {
+    const vector<uint8_t> kInvalidUUID = {0x10, 0x20, 0x30, 0x40, 0x50, 0x60, 0x70, 0x80,
+                                          0x10, 0x20, 0x30, 0x40, 0x50, 0x60, 0x70, 0x80};
+    bool result = false;
+    auto ret = drmFactory->isCryptoSchemeSupported(toAidlUuid(kInvalidUUID), kVideoMp4,
+                                                   kSwSecureCrypto, &result);
+    EXPECT_OK(ret);
+    EXPECT_FALSE(result);
+}
+
+/**
+ * Ensure drm factory doesn't support an empty UUID
+ */
+TEST_P(DrmHalTest, EmptyPluginUUIDNotSupported) {
+    vector<uint8_t> emptyUUID(16);
+    memset(emptyUUID.data(), 0, 16);
+    bool result = false;
+    auto ret = drmFactory->isCryptoSchemeSupported(toAidlUuid(emptyUUID), kVideoMp4,
+                                                   kSwSecureCrypto, &result);
+    EXPECT_OK(ret);
+    EXPECT_FALSE(result);
+}
+
+/**
+ * Ensure drm factory doesn't support an invalid mime type
+ */
+TEST_P(DrmHalTest, BadMimeNotSupported) {
+    bool result = false;
+    auto ret =
+            drmFactory->isCryptoSchemeSupported(getAidlUUID(), kBadMime, kSwSecureCrypto, &result);
+    EXPECT_OK(ret);
+    EXPECT_FALSE(result);
+}
+
+/**
+ *  DrmPlugin tests
+ */
+
+/**
+ * Test that a DRM plugin can handle provisioning.  While
+ * it is not required that a DRM scheme require provisioning,
+ * it should at least return appropriate status values. If
+ * a provisioning request is returned, it is passed to the
+ * vendor module which should provide a provisioning response
+ * that is delivered back to the HAL.
+ */
+TEST_P(DrmHalTest, DoProvisioning) {
+    for (auto level : {kHwSecureAll, kSwSecureCrypto}) {
+        Status err = Status::OK;
+        auto sid = openSession(level, &err);
+        if (err == Status::OK) {
+            closeSession(sid);
+        } else if (err == Status::ERROR_DRM_CANNOT_HANDLE) {
+            continue;
+        } else {
+            EXPECT_EQ(Status::ERROR_DRM_NOT_PROVISIONED, err);
+            provision();
+        }
+    }
+}
+
+/**
+ * A get key request should fail if no sessionId is provided
+ */
+TEST_P(DrmHalTest, GetKeyRequestNoSession) {
+    SessionId invalidSessionId;
+    vector<uint8_t> initData;
+    KeyedVector optionalParameters;
+    KeyRequest result;
+    auto ret = drmPlugin->getKeyRequest(invalidSessionId, initData, kVideoMp4, KeyType::STREAMING,
+                                        optionalParameters, &result);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(Status::BAD_VALUE, DrmErr(ret));
+}
+
+/**
+ * Test that the plugin returns the documented error for the
+ * case of attempting to generate a key request using an
+ * invalid mime type
+ */
+TEST_P(DrmHalTest, GetKeyRequestBadMime) {
+    auto sessionId = openSession();
+    vector<uint8_t> initData;
+    KeyedVector optionalParameters;
+    KeyRequest result;
+    auto ret = drmPlugin->getKeyRequest(sessionId, initData, kBadMime, KeyType::STREAMING,
+                                        optionalParameters, &result);
+    EXPECT_EQ(EX_SERVICE_SPECIFIC, ret.getExceptionCode());
+    closeSession(sessionId);
+}
+
+/**
+ * Test drm plugin offline key support
+ */
+TEST_P(DrmHalTest, OfflineLicenseTest) {
+    auto sessionId = openSession();
+    vector<uint8_t> keySetId = loadKeys(sessionId, KeyType::OFFLINE);
+    closeSession(sessionId);
+
+    vector<KeySetId> result;
+    auto ret = drmPlugin->getOfflineLicenseKeySetIds(&result);
+    EXPECT_OK(ret);
+    bool found = false;
+    for (KeySetId keySetId2 : result) {
+        if (keySetId == keySetId2.keySetId) {
+            found = true;
+            break;
+        }
+    }
+    EXPECT_TRUE(found) << "keySetId not found";
+
+    ret = drmPlugin->removeOfflineLicense({keySetId});
+    EXPECT_OK(ret);
+
+    ret = drmPlugin->getOfflineLicenseKeySetIds(&result);
+    EXPECT_OK(ret);
+    for (KeySetId keySetId2 : result) {
+        EXPECT_NE(keySetId, keySetId2.keySetId);
+    }
+
+    ret = drmPlugin->removeOfflineLicense({keySetId});
+    EXPECT_TXN(ret);
+    EXPECT_EQ(Status::BAD_VALUE, DrmErr(ret));
+}
+
+/**
+ * Test drm plugin offline key state
+ */
+TEST_P(DrmHalTest, OfflineLicenseStateTest) {
+    auto sessionId = openSession();
+    DrmHalVTSVendorModule_V1::ContentConfiguration content = getContent(KeyType::OFFLINE);
+    vector<uint8_t> keySetId = loadKeys(sessionId, content, KeyType::OFFLINE);
+    closeSession(sessionId);
+
+    OfflineLicenseState result{};
+    auto ret = drmPlugin->getOfflineLicenseState({keySetId}, &result);
+    EXPECT_OK(ret);
+    EXPECT_EQ(OfflineLicenseState::USABLE, result);
+
+    vector<uint8_t> keyRequest = getKeyRequest(keySetId, content, KeyType::RELEASE);
+    ret = drmPlugin->getOfflineLicenseState({keySetId}, &result);
+    EXPECT_OK(ret);
+    EXPECT_EQ(OfflineLicenseState::INACTIVE, result);
+
+    /**
+     * Get key response from vendor module
+     */
+    vector<uint8_t> keyResponse = vendorModule->handleKeyRequest(keyRequest, content.serverUrl);
+    EXPECT_GT(keyResponse.size(), 0u);
+
+    result = OfflineLicenseState::UNKNOWN;
+    provideKeyResponse(keySetId, keyResponse);
+    ret = drmPlugin->getOfflineLicenseState({keySetId}, &result);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(Status::BAD_VALUE, DrmErr(ret));
+    EXPECT_EQ(OfflineLicenseState::UNKNOWN, result);
+}
+
+/**
+ * Negative offline license test. Remove empty keySetId
+ */
+TEST_P(DrmHalTest, RemoveEmptyKeySetId) {
+    KeySetId emptyKeySetId;
+    auto ret = drmPlugin->removeOfflineLicense(emptyKeySetId);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(Status::BAD_VALUE, DrmErr(ret));
+}
+
+/**
+ * Negative offline license test. Get empty keySetId state
+ */
+TEST_P(DrmHalTest, GetEmptyKeySetIdState) {
+    KeySetId emptyKeySetId;
+    OfflineLicenseState result;
+    auto ret = drmPlugin->getOfflineLicenseState(emptyKeySetId, &result);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(Status::BAD_VALUE, DrmErr(ret));
+    EXPECT_EQ(OfflineLicenseState::UNKNOWN, result);
+}
+
+/**
+ * Test that the plugin returns valid connected and max HDCP levels
+ */
+TEST_P(DrmHalTest, GetHdcpLevels) {
+    HdcpLevels result;
+    auto ret = drmPlugin->getHdcpLevels(&result);
+    EXPECT_OK(ret);
+    EXPECT_GE(result.connectedLevel, HdcpLevel::HDCP_NONE);
+    EXPECT_LE(result.maxLevel, HdcpLevel::HDCP_V2_3);
+}
+
+/**
+ *  CryptoPlugin Decrypt tests
+ */
+
+/**
+ * Positive decrypt test. "Decrypt" a single clear segment
+ */
+TEST_P(DrmHalTest, ClearSegmentTest) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
+            const size_t kSegmentSize = 1024;
+            vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+            const Pattern noPattern = {0, 0};
+            const vector<SubSample> subSamples = {
+                    {.numBytesOfClearData = kSegmentSize, .numBytesOfEncryptedData = 0}};
+            auto sessionId = openSession();
+            loadKeys(sessionId, config);
+
+            auto ret = cryptoPlugin->setMediaDrmSession(sessionId);
+            EXPECT_OK(ret);
+
+            uint32_t byteCount =
+                    decrypt(Mode::UNENCRYPTED, key.isSecure, toStdArray(key.keyId), &iv[0],
+                            subSamples, noPattern, key.clearContentKey, Status::OK);
+            EXPECT_EQ(kSegmentSize, byteCount);
+
+            closeSession(sessionId);
+        }
+    }
+}
+
+/**
+ * Positive decrypt test. Decrypt a single segment using aes_ctr.
+ * Verify data matches.
+ */
+TEST_P(DrmHalTest, EncryptedAesCtrSegmentTest) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
+            const size_t kSegmentSize = 1024;
+            vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+            const Pattern noPattern = {0, 0};
+            const vector<SubSample> subSamples = {
+                    {.numBytesOfClearData = kSegmentSize, .numBytesOfEncryptedData = 0}};
+            auto sessionId = openSession();
+            loadKeys(sessionId, config);
+
+            auto ret = cryptoPlugin->setMediaDrmSession(sessionId);
+            EXPECT_OK(ret);
+
+            uint32_t byteCount = decrypt(Mode::AES_CTR, key.isSecure, toStdArray(key.keyId), &iv[0],
+                                         subSamples, noPattern, key.clearContentKey, Status::OK);
+            EXPECT_EQ(kSegmentSize, byteCount);
+
+            closeSession(sessionId);
+        }
+    }
+}
+
+/**
+ * Negative decrypt test.  Decrypted frame too large to fit in output buffer
+ */
+TEST_P(DrmHalTest, ErrorFrameTooLarge) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
+            const size_t kSegmentSize = 1024;
+            vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+            const Pattern noPattern = {0, 0};
+            const vector<SubSample> subSamples = {
+                    {.numBytesOfClearData = kSegmentSize, .numBytesOfEncryptedData = 0}};
+            auto sessionId = openSession();
+            loadKeys(sessionId, config);
+
+            auto ret = cryptoPlugin->setMediaDrmSession(sessionId);
+            EXPECT_OK(ret);
+
+            decrypt(Mode::UNENCRYPTED, key.isSecure, toStdArray(key.keyId), &iv[0], subSamples,
+                    noPattern, key.clearContentKey, Status::ERROR_DRM_FRAME_TOO_LARGE);
+
+            closeSession(sessionId);
+        }
+    }
+}
+
+/**
+ * Negative decrypt test. Decrypt without loading keys.
+ */
+TEST_P(DrmHalTest, EncryptedAesCtrSegmentTestNoKeys) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
+            vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+            const Pattern noPattern = {0, 0};
+            const vector<SubSample> subSamples = {
+                    {.numBytesOfClearData = 256, .numBytesOfEncryptedData = 256}};
+            auto sessionId = openSession();
+
+            auto ret = cryptoPlugin->setMediaDrmSession(sessionId);
+            EXPECT_OK(ret);
+
+            uint32_t byteCount =
+                    decrypt(Mode::AES_CTR, key.isSecure, toStdArray(key.keyId), &iv[0], subSamples,
+                            noPattern, key.clearContentKey, Status::ERROR_DRM_NO_LICENSE);
+            EXPECT_EQ(0u, byteCount);
+
+            closeSession(sessionId);
+        }
+    }
+}
+
+/**
+ * Ensure clearkey drm factory doesn't support security level higher than supported
+ */
+TEST_P(DrmHalClearkeyTest, BadLevelNotSupported) {
+    bool result = false;
+    auto ret = drmFactory->isCryptoSchemeSupported(getAidlUUID(), kVideoMp4, kHwSecureAll, &result);
+    EXPECT_OK(ret);
+    EXPECT_FALSE(result);
+}
+
+/**
+ * Test resource contention during attempt to generate key request
+ */
+TEST_P(DrmHalClearkeyTest, GetKeyRequestResourceContention) {
+    auto ret = drmPlugin->setPropertyString(kDrmErrorTestKey, kDrmErrorResourceContention);
+    EXPECT_OK(ret);
+
+    auto sessionId = openSession();
+    vector<uint8_t> initData;
+    KeyedVector optionalParameters;
+    KeyRequest result;
+    ret = drmPlugin->getKeyRequest(sessionId, initData, kVideoMp4, KeyType::STREAMING,
+                                   optionalParameters, &result);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(Status::ERROR_DRM_RESOURCE_CONTENTION, DrmErr(ret));
+
+    ret = drmPlugin->closeSession(sessionId);
+    EXPECT_TXN(ret);
+    EXPECT_NE(Status::OK, DrmErr(ret));
+}
+
+/**
+ * Test clearkey plugin offline key with mock error
+ */
+TEST_P(DrmHalClearkeyTest, OfflineLicenseInvalidState) {
+    auto sessionId = openSession();
+    vector<uint8_t> keySetId = loadKeys(sessionId, KeyType::OFFLINE);
+    auto ret = drmPlugin->setPropertyString(kDrmErrorTestKey, kDrmErrorInvalidState);
+    EXPECT_OK(ret);
+
+    // everything should start failing
+    const Status kInvalidState = Status::ERROR_DRM_INVALID_STATE;
+    vector<KeySetId> result;
+    ret = drmPlugin->getOfflineLicenseKeySetIds(&result);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(kInvalidState, DrmErr(ret));
+    EXPECT_EQ(0u, result.size());
+
+    OfflineLicenseState state = OfflineLicenseState::UNKNOWN;
+    ret = drmPlugin->getOfflineLicenseState({keySetId}, &state);
+    EXPECT_TXN(ret);
+    EXPECT_EQ(kInvalidState, DrmErr(ret));
+    EXPECT_EQ(OfflineLicenseState::UNKNOWN, state);
+
+    ret = drmPlugin->removeOfflineLicense({keySetId});
+    EXPECT_TXN(ret);
+    EXPECT_EQ(kInvalidState, DrmErr(ret));
+    closeSession(sessionId);
+}
+
+/**
+ * Test listener is triggered on key response
+ */
+TEST_P(DrmHalClearkeyTest, ListenerCallbacks) {
+    auto listener = ndk::SharedRefBase::make<DrmHalPluginListener>();
+    auto res = drmPlugin->setListener(listener);
+    EXPECT_OK(res);
+
+    auto sessionId = openSession();
+    loadKeys(sessionId, KeyType::STREAMING);
+    closeSession(sessionId);
+
+    auto args = listener->getEventArgs();
+    EXPECT_EQ(EventType::VENDOR_DEFINED, args.eventType);
+    EXPECT_EQ(sessionId, args.data);
+    EXPECT_EQ(sessionId, args.sessionId);
+
+    args = listener->getExpirationUpdateArgs();
+    EXPECT_EQ(sessionId, args.sessionId);
+    EXPECT_EQ(100, args.expiryTimeInMS);
+
+    args = listener->getKeysChangeArgs();
+    const vector<KeyStatus> keyStatusList = {
+            {{0xa, 0xb, 0xc}, KeyStatusType::USABLE},
+            {{0xd, 0xe, 0xf}, KeyStatusType::EXPIRED},
+            {{0x0, 0x1, 0x2}, KeyStatusType::USABLEINFUTURE},
+    };
+    EXPECT_EQ(sessionId, args.sessionId);
+    EXPECT_EQ(keyStatusList, args.keyStatusList);
+    EXPECT_TRUE(args.hasNewUsableKey);
+}
+
+/**
+ * Test SessionLostState is triggered on error
+ */
+TEST_P(DrmHalClearkeyTest, SessionLostState) {
+    auto listener = ndk::SharedRefBase::make<DrmHalPluginListener>();
+    auto res = drmPlugin->setListener(listener);
+    EXPECT_OK(res);
+
+    res = drmPlugin->setPropertyString(kDrmErrorTestKey, kDrmErrorInvalidState);
+    EXPECT_OK(res);
+
+    auto sessionId = openSession();
+    auto ret = drmPlugin->closeSession(sessionId);
+
+    auto args = listener->getSessionLostStateArgs();
+    EXPECT_EQ(sessionId, args.sessionId);
+}
+
+/**
+ * Negative decrypt test. Decrypt with invalid key.
+ */
+TEST_P(DrmHalClearkeyTest, DecryptWithEmptyKey) {
+    vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+    const Pattern noPattern = {0, 0};
+    const uint32_t kClearBytes = 512;
+    const uint32_t kEncryptedBytes = 512;
+    const vector<SubSample> subSamples = {
+            {.numBytesOfClearData = kClearBytes, .numBytesOfEncryptedData = kEncryptedBytes}};
+
+    // base 64 encoded JSON response string, must not contain padding character '='
+    const string emptyKeyResponse =
+            "{\"keys\":["
+            "{"
+            "\"kty\":\"oct\""
+            "\"alg\":\"A128KW2\""
+            "\"k\":\"SGVsbG8gRnJpZW5kIQ\""
+            "\"kid\":\"Y2xlYXJrZXlrZXlpZDAyAy\""
+            "}"
+            "{"
+            "\"kty\":\"oct\","
+            "\"alg\":\"A128KW2\""
+            "\"kid\":\"Y2xlYXJrZXlrZXlpZDAzAy\","  // empty key follows
+            "\"k\":\"R\""
+            "}]"
+            "}";
+    const size_t kEmptyKeyResponseSize = emptyKeyResponse.size();
+
+    vector<uint8_t> invalidResponse;
+    invalidResponse.resize(kEmptyKeyResponseSize);
+    memcpy(invalidResponse.data(), emptyKeyResponse.c_str(), kEmptyKeyResponseSize);
+    decryptWithInvalidKeys(invalidResponse, iv, noPattern, subSamples);
+}
+
+/**
+ * Negative decrypt test. Decrypt with a key exceeds AES_BLOCK_SIZE.
+ */
+TEST_P(DrmHalClearkeyTest, DecryptWithKeyTooLong) {
+    vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
+    const Pattern noPattern = {0, 0};
+    const uint32_t kClearBytes = 512;
+    const uint32_t kEncryptedBytes = 512;
+    const vector<SubSample> subSamples = {
+            {.numBytesOfClearData = kClearBytes, .numBytesOfEncryptedData = kEncryptedBytes}};
+
+    // base 64 encoded JSON response string, must not contain padding character '='
+    const string keyTooLongResponse =
+            "{\"keys\":["
+            "{"
+            "\"kty\":\"oct\","
+            "\"alg\":\"A128KW2\""
+            "\"kid\":\"Y2xlYXJrZXlrZXlpZDAzAy\","  // key too long
+            "\"k\":\"V2lubmllIHRoZSBwb29oIVdpbm5pZSB0aGUgcG9vaCE=\""
+            "}]"
+            "}";
+    const size_t kKeyTooLongResponseSize = keyTooLongResponse.size();
+
+    vector<uint8_t> invalidResponse;
+    invalidResponse.resize(kKeyTooLongResponseSize);
+    memcpy(invalidResponse.data(), keyTooLongResponse.c_str(), kKeyTooLongResponseSize);
+    decryptWithInvalidKeys(invalidResponse, iv, noPattern, subSamples);
+}
diff --git a/drm/aidl/vts/drm_hal_test_main.cpp b/drm/aidl/vts/drm_hal_test_main.cpp
new file mode 100644
index 0000000..dc0f6d7
--- /dev/null
+++ b/drm/aidl/vts/drm_hal_test_main.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Instantiate the set of test cases for each vendor module
+ */
+
+#define LOG_TAG "drm_hal_test_main"
+
+#include <aidl/Gtest.h>
+#include <aidl/Vintf.h>
+#include <android/binder_process.h>
+#include <log/log.h>
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <iterator>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "drm_hal_common.h"
+
+using ::aidl::android::hardware::drm::vts::DrmHalClearkeyTest;
+using ::aidl::android::hardware::drm::vts::DrmHalTest;
+using ::aidl::android::hardware::drm::vts::HalBaseName;
+using drm_vts::DrmHalTestParam;
+using drm_vts::PrintParamInstanceToString;
+
+static const std::vector<DrmHalTestParam> getAllInstances() {
+    using ::aidl::android::hardware::drm::ICryptoFactory;
+    using ::aidl::android::hardware::drm::IDrmFactory;
+
+    std::vector<std::string> drmInstances =
+            android::getAidlHalInstanceNames(IDrmFactory::descriptor);
+    std::vector<std::string> cryptoInstances =
+            android::getAidlHalInstanceNames(ICryptoFactory::descriptor);
+
+    std::set<std::string> allInstances;
+    for (auto svc : drmInstances) {
+        allInstances.insert(HalBaseName(svc));
+    }
+    for (auto svc : cryptoInstances) {
+        allInstances.insert(HalBaseName(svc));
+    }
+
+    std::vector<DrmHalTestParam> allInstanceUuidCombos;
+    auto noUUID = [](std::string s) { return DrmHalTestParam(s); };
+    std::transform(allInstances.begin(), allInstances.end(),
+                   std::back_inserter(allInstanceUuidCombos), noUUID);
+    return allInstanceUuidCombos;
+};
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(DrmHalTest);
+INSTANTIATE_TEST_SUITE_P(PerInstance, DrmHalTest, testing::ValuesIn(getAllInstances()),
+                         PrintParamInstanceToString);
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(DrmHalClearkeyTest);
+INSTANTIATE_TEST_SUITE_P(PerInstance, DrmHalClearkeyTest, testing::ValuesIn(getAllInstances()),
+                         PrintParamInstanceToString);
+
+int main(int argc, char** argv) {
+#if defined(__LP64__)
+    const char* kModulePath = "/data/local/tmp/64/lib";
+#else
+    const char* kModulePath = "/data/local/tmp/32/lib";
+#endif
+    DrmHalTest::gVendorModules = new drm_vts::VendorModules(kModulePath);
+    if (DrmHalTest::gVendorModules->getPathList().size() == 0) {
+        std::cerr << "WARNING: No vendor modules found in " << kModulePath
+                  << ", all vendor tests will be skipped" << std::endl;
+    }
+    ABinderProcess_setThreadPoolMaxThreadCount(1);
+    ABinderProcess_startThreadPool();
+    ::testing::InitGoogleTest(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
+}
diff --git a/drm/aidl/vts/include/drm_hal_common.h b/drm/aidl/vts/include/drm_hal_common.h
new file mode 100644
index 0000000..4aac48b
--- /dev/null
+++ b/drm/aidl/vts/include/drm_hal_common.h
@@ -0,0 +1,214 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/common/Ashmem.h>
+#include <aidl/android/hardware/drm/BnDrmPluginListener.h>
+#include <aidl/android/hardware/drm/ICryptoFactory.h>
+#include <aidl/android/hardware/drm/ICryptoPlugin.h>
+#include <aidl/android/hardware/drm/IDrmFactory.h>
+#include <aidl/android/hardware/drm/IDrmPlugin.h>
+#include <aidl/android/hardware/drm/IDrmPluginListener.h>
+#include <aidl/android/hardware/drm/Status.h>
+
+#include <array>
+#include <chrono>
+#include <future>
+#include <iostream>
+#include <map>
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include <android/binder_auto_utils.h>
+
+#include "VtsHalHidlTargetCallbackBase.h"
+#include "drm_hal_vendor_module_api.h"
+#include "drm_vts_helper.h"
+#include "vendor_modules.h"
+
+using drm_vts::DrmHalTestParam;
+
+namespace {
+typedef vector<::aidl::android::hardware::drm::KeyValue> KeyedVector;
+typedef std::vector<uint8_t> SessionId;
+}  // namespace
+
+#define EXPECT_OK(ret) EXPECT_TRUE(::aidl::android::hardware::drm::vts::IsOk(ret))
+#define EXPECT_TXN(ret) EXPECT_TRUE(ret.isOk() || ret.getExceptionCode() == EX_SERVICE_SPECIFIC)
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace drm {
+namespace vts {
+
+::aidl::android::hardware::drm::Status DrmErr(const ::ndk::ScopedAStatus& ret);
+std::string HalBaseName(const std::string& fullname);
+std::string HalFullName(const std::string& iface, const std::string& basename);
+testing::AssertionResult IsOk(const ::ndk::ScopedAStatus& ret);
+
+extern const char* kDrmIface;
+extern const char* kCryptoIface;
+
+class DrmHalTest : public ::testing::TestWithParam<DrmHalTestParam> {
+  public:
+    static drm_vts::VendorModules* gVendorModules;
+    DrmHalTest();
+    virtual void SetUp() override;
+    virtual void TearDown() override {}
+
+  protected:
+    ::aidl::android::hardware::drm::Uuid getAidlUUID();
+    std::vector<uint8_t> getUUID();
+    std::vector<uint8_t> getVendorUUID();
+    std::array<uint8_t, 16> GetParamUUID() { return GetParam().scheme_; }
+    std::string GetParamService() { return GetParam().instance_; }
+    ::aidl::android::hardware::drm::Uuid toAidlUuid(const std::vector<uint8_t>& in_uuid) {
+        ::aidl::android::hardware::drm::Uuid uuid;
+        uuid.uuid = in_uuid;
+        return uuid;
+    }
+
+    void provision();
+    SessionId openSession(::aidl::android::hardware::drm::SecurityLevel level,
+                          ::aidl::android::hardware::drm::Status* err);
+    SessionId openSession();
+    void closeSession(const SessionId& sessionId);
+    std::vector<uint8_t> loadKeys(
+            const SessionId& sessionId,
+            const ::aidl::android::hardware::drm::KeyType& type = KeyType::STREAMING);
+    std::vector<uint8_t> loadKeys(
+            const SessionId& sessionId, const DrmHalVTSVendorModule_V1::ContentConfiguration&,
+            const ::aidl::android::hardware::drm::KeyType& type = KeyType::STREAMING);
+    std::vector<uint8_t> getKeyRequest(const SessionId& sessionId,
+                                       const DrmHalVTSVendorModule_V1::ContentConfiguration&,
+                                       const ::aidl::android::hardware::drm::KeyType& type);
+    std::vector<uint8_t> provideKeyResponse(const SessionId& sessionId,
+                                            const std::vector<uint8_t>& keyResponse);
+    DrmHalVTSVendorModule_V1::ContentConfiguration getContent(
+            const ::aidl::android::hardware::drm::KeyType& type = KeyType::STREAMING) const;
+
+    KeyedVector toAidlKeyedVector(const std::map<std::string, std::string>& params);
+    std::array<uint8_t, 16> toStdArray(const std::vector<uint8_t>& vec);
+    void fillRandom(const ::aidl::android::hardware::common::Ashmem& ashmem);
+    ::aidl::android::hardware::common::Ashmem getDecryptMemory(size_t size, size_t index);
+
+    uint32_t decrypt(::aidl::android::hardware::drm::Mode mode, bool isSecure,
+                     const std::array<uint8_t, 16>& keyId, uint8_t* iv,
+                     const std::vector<::aidl::android::hardware::drm::SubSample>& subSamples,
+                     const ::aidl::android::hardware::drm::Pattern& pattern,
+                     const std::vector<uint8_t>& key,
+                     ::aidl::android::hardware::drm::Status expectedStatus);
+    void aes_ctr_decrypt(uint8_t* dest, uint8_t* src, uint8_t* iv,
+                         const std::vector<::aidl::android::hardware::drm::SubSample>& subSamples,
+                         const std::vector<uint8_t>& key);
+    void aes_cbc_decrypt(uint8_t* dest, uint8_t* src, uint8_t* iv,
+                         const std::vector<::aidl::android::hardware::drm::SubSample>& subSamples,
+                         const std::vector<uint8_t>& key);
+
+    std::shared_ptr<::aidl::android::hardware::drm::IDrmFactory> drmFactory;
+    std::shared_ptr<::aidl::android::hardware::drm::ICryptoFactory> cryptoFactory;
+    std::shared_ptr<::aidl::android::hardware::drm::IDrmPlugin> drmPlugin;
+    std::shared_ptr<::aidl::android::hardware::drm::ICryptoPlugin> cryptoPlugin;
+
+    unique_ptr<DrmHalVTSVendorModule_V1> vendorModule;
+    std::vector<DrmHalVTSVendorModule_V1::ContentConfiguration> contentConfigurations;
+
+  private:
+    std::shared_ptr<::aidl::android::hardware::drm::IDrmPlugin> createDrmPlugin();
+    std::shared_ptr<::aidl::android::hardware::drm::ICryptoPlugin> createCryptoPlugin();
+};
+
+class DrmHalClearkeyTest : public DrmHalTest {
+  public:
+    virtual void SetUp() override {
+        DrmHalTest::SetUp();
+        const std::vector<uint8_t> kClearKeyUUID = {0xE2, 0x71, 0x9D, 0x58, 0xA9, 0x85, 0xB3, 0xC9,
+                                                    0x78, 0x1A, 0xB0, 0x30, 0xAF, 0x78, 0xD3, 0x0E};
+        static const std::string kMimeType = "video/mp4";
+        static constexpr ::aidl::android::hardware::drm::SecurityLevel kSecurityLevel =
+                ::aidl::android::hardware::drm::SecurityLevel::SW_SECURE_CRYPTO;
+
+        bool drmClearkey = false;
+        auto ret = drmFactory->isCryptoSchemeSupported(toAidlUuid(kClearKeyUUID), kMimeType,
+                                                       kSecurityLevel, &drmClearkey);
+        if (!drmClearkey) {
+            GTEST_SKIP() << "ClearKey not supported by " << GetParamService();
+        }
+    }
+    virtual void TearDown() override {}
+    void decryptWithInvalidKeys(
+            std::vector<uint8_t>& invalidResponse, std::vector<uint8_t>& iv,
+            const ::aidl::android::hardware::drm::Pattern& noPattern,
+            const std::vector<::aidl::android::hardware::drm::SubSample>& subSamples);
+};
+
+/**
+ *  Event Handling tests
+ */
+extern const char* kCallbackLostState;
+extern const char* kCallbackKeysChange;
+
+struct ListenerArgs {
+    EventType eventType;
+    SessionId sessionId;
+    int64_t expiryTimeInMS;
+    std::vector<uint8_t> data;
+    std::vector<KeyStatus> keyStatusList;
+    bool hasNewUsableKey;
+};
+
+class DrmHalPluginListener : public BnDrmPluginListener {
+  public:
+    DrmHalPluginListener() {}
+    virtual ~DrmHalPluginListener() {}
+
+    virtual ::ndk::ScopedAStatus onEvent(
+            ::aidl::android::hardware::drm::EventType in_eventType,
+            const std::vector<uint8_t>& in_sessionId,
+            const std::vector<uint8_t>& in_data) override;
+
+    virtual ::ndk::ScopedAStatus onExpirationUpdate(
+            const std::vector<uint8_t>& in_sessionId,
+            int64_t in_expiryTimeInMS) override;
+
+    virtual ::ndk::ScopedAStatus onSessionLostState(
+            const std::vector<uint8_t>& in_sessionId) override;
+
+    virtual ::ndk::ScopedAStatus onKeysChange(
+            const std::vector<uint8_t>& in_sessionId,
+            const std::vector<::aidl::android::hardware::drm::KeyStatus>& in_keyStatusList,
+            bool in_hasNewUsableKey) override;
+
+    ListenerArgs getEventArgs();
+    ListenerArgs getExpirationUpdateArgs();
+    ListenerArgs getSessionLostStateArgs();
+    ListenerArgs getKeysChangeArgs();
+
+  private:
+    ListenerArgs getListenerArgs(std::promise<ListenerArgs>& promise);
+    std::promise<ListenerArgs> eventPromise, expirationUpdatePromise,
+            sessionLostStatePromise, keysChangePromise;
+};
+
+}  // namespace vts
+}  // namespace drm
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/GnssData.aidl b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/GnssData.aidl
index aa514da..01a3b3a 100644
--- a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/GnssData.aidl
+++ b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/GnssData.aidl
@@ -37,7 +37,7 @@
   android.hardware.gnss.GnssMeasurement[] measurements;
   android.hardware.gnss.GnssClock clock;
   android.hardware.gnss.ElapsedRealtime elapsedRealtime;
-  @nullable android.hardware.gnss.GnssData.GnssAgc[] gnssAgcs;
+  android.hardware.gnss.GnssData.GnssAgc[] gnssAgcs = {};
   @VintfStability
   parcelable GnssAgc {
     double agcLevelDb;
diff --git a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IAGnssRil.aidl b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IAGnssRil.aidl
index 73df195..69fa32b 100644
--- a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IAGnssRil.aidl
+++ b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IAGnssRil.aidl
@@ -36,7 +36,7 @@
 interface IAGnssRil {
   void setCallback(in android.hardware.gnss.IAGnssRilCallback callback);
   void setRefLocation(in android.hardware.gnss.IAGnssRil.AGnssRefLocation agnssReflocation);
-  void setSetId(in android.hardware.gnss.IAGnssRil.SetIDType type, in @utf8InCpp String setid);
+  void setSetId(in android.hardware.gnss.IAGnssRil.SetIdType type, in @utf8InCpp String setid);
   void updateNetworkState(in android.hardware.gnss.IAGnssRil.NetworkAttributes attributes);
   const int NETWORK_CAPABILITY_NOT_METERED = 1;
   const int NETWORK_CAPABILITY_NOT_ROAMING = 2;
@@ -48,7 +48,7 @@
     NR_CELLID = 8,
   }
   @Backing(type="int") @VintfStability
-  enum SetIDType {
+  enum SetIdType {
     NONE = 0,
     IMSI = 1,
     MSISDM = 2,
diff --git a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl
index a16d27b..affef2b 100644
--- a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl
+++ b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl
@@ -53,7 +53,7 @@
   void injectLocation(in android.hardware.gnss.GnssLocation location);
   void injectBestLocation(in android.hardware.gnss.GnssLocation location);
   void deleteAidingData(in android.hardware.gnss.IGnss.GnssAidingData aidingDataFlags);
-  void setPositionMode(in android.hardware.gnss.IGnss.GnssPositionMode mode, in android.hardware.gnss.IGnss.GnssPositionRecurrence recurrence, in int minIntervalMs, in int preferredAccuracyMeters, in int preferredTimeMs, in boolean lowPowerMode);
+  void setPositionMode(in android.hardware.gnss.IGnss.PositionModeOptions options);
   android.hardware.gnss.IGnssAntennaInfo getExtensionGnssAntennaInfo();
   @nullable android.hardware.gnss.measurement_corrections.IMeasurementCorrectionsInterface getExtensionMeasurementCorrections();
   const int ERROR_INVALID_ARGUMENT = 1;
@@ -72,18 +72,27 @@
   }
   @Backing(type="int") @VintfStability
   enum GnssAidingData {
-    DELETE_EPHEMERIS = 1,
-    DELETE_ALMANAC = 2,
-    DELETE_POSITION = 4,
-    DELETE_TIME = 8,
-    DELETE_IONO = 16,
-    DELETE_UTC = 32,
-    DELETE_HEALTH = 64,
-    DELETE_SVDIR = 128,
-    DELETE_SVSTEER = 256,
-    DELETE_SADATA = 512,
-    DELETE_RTI = 1024,
-    DELETE_CELLDB_INFO = 32768,
-    DELETE_ALL = 65535,
+    EPHEMERIS = 1,
+    ALMANAC = 2,
+    POSITION = 4,
+    TIME = 8,
+    IONO = 16,
+    UTC = 32,
+    HEALTH = 64,
+    SVDIR = 128,
+    SVSTEER = 256,
+    SADATA = 512,
+    RTI = 1024,
+    CELLDB_INFO = 32768,
+    ALL = 65535,
+  }
+  @VintfStability
+  parcelable PositionModeOptions {
+    android.hardware.gnss.IGnss.GnssPositionMode mode;
+    android.hardware.gnss.IGnss.GnssPositionRecurrence recurrence;
+    int minIntervalMs;
+    int preferredAccuracyMeters;
+    int preferredTimeMs;
+    boolean lowPowerMode;
   }
 }
diff --git a/gnss/aidl/android/hardware/gnss/GnssData.aidl b/gnss/aidl/android/hardware/gnss/GnssData.aidl
index 204eb65..6b2068e 100644
--- a/gnss/aidl/android/hardware/gnss/GnssData.aidl
+++ b/gnss/aidl/android/hardware/gnss/GnssData.aidl
@@ -76,6 +76,10 @@
          * is the primary common use central frequency, e.g. L1 = 1575.45 MHz
          * for GPS.
          *
+         * If all the GLO frequencies have a common AGC, the FC0 (frequency
+         * channel number 0) of the individual GLO bands is used to represent
+         * all the GLO frequencies.
+         *
          * For an L1, L5 receiver tracking a satellite on L1 and L5 at the same
          * time, two raw measurement structs must be reported for this same
          * satellite, in one of the measurement structs, all the values related
@@ -92,5 +96,5 @@
      * GnssMeasurement or GnssClock fields are not reported yet. E.g., when a GNSS signal is too
      * weak to be acquired, the AGC value must still be reported.
      */
-    @nullable GnssAgc[] gnssAgcs;
+    GnssAgc[] gnssAgcs = {};
 }
diff --git a/gnss/aidl/android/hardware/gnss/IAGnssCallback.aidl b/gnss/aidl/android/hardware/gnss/IAGnssCallback.aidl
index 7c25937..8f881b7 100644
--- a/gnss/aidl/android/hardware/gnss/IAGnssCallback.aidl
+++ b/gnss/aidl/android/hardware/gnss/IAGnssCallback.aidl
@@ -23,9 +23,13 @@
     @VintfStability
     @Backing(type="int")
     enum AGnssType {
+        // Secure User Plane Location
         SUPL = 1,
+        // CDMA2000
         C2K = 2,
+        // SUPL, Emergency call over IP Multimedia Subsystem
         SUPL_EIMS = 3,
+        // SUPL, IP Multimedia Subsystem
         SUPL_IMS = 4,
     }
 
diff --git a/gnss/aidl/android/hardware/gnss/IAGnssRil.aidl b/gnss/aidl/android/hardware/gnss/IAGnssRil.aidl
index c506b04..b505d81 100644
--- a/gnss/aidl/android/hardware/gnss/IAGnssRil.aidl
+++ b/gnss/aidl/android/hardware/gnss/IAGnssRil.aidl
@@ -17,7 +17,6 @@
 package android.hardware.gnss;
 
 import android.hardware.gnss.IAGnssRilCallback;
-import android.hardware.gnss.IAGnssRilCallback.SetIDType;
 
 /**
  * Extended interface for AGNSS RIL support. An Assisted GNSS Radio Interface
@@ -46,7 +45,7 @@
     /** SET ID type*/
     @VintfStability
     @Backing(type="int")
-    enum SetIDType {
+    enum SetIdType {
         NONE = 0,
         IMSI = 1,
         MSISDM = 2,
@@ -100,7 +99,7 @@
     /** Represents network connection status and capabilities. */
     @VintfStability
     parcelable NetworkAttributes {
-        /** Network handle of the network for use with the NDK API. */
+        /** A handle representing this Network. */
         long networkHandle;
 
         /**
@@ -151,7 +150,7 @@
      * If the type is NONE, then the string must be empty.
      *
      */
-    void setSetId(in SetIDType type, in @utf8InCpp String setid);
+    void setSetId(in SetIdType type, in @utf8InCpp String setid);
 
     /**
      * Notifies GNSS of network status changes.
diff --git a/gnss/aidl/android/hardware/gnss/IAGnssRilCallback.aidl b/gnss/aidl/android/hardware/gnss/IAGnssRilCallback.aidl
index 6fb093e..485626d 100644
--- a/gnss/aidl/android/hardware/gnss/IAGnssRilCallback.aidl
+++ b/gnss/aidl/android/hardware/gnss/IAGnssRilCallback.aidl
@@ -25,7 +25,7 @@
     /**
      * The Hal uses this API to request a SET ID.
      *
-     * @param setIdflag A bitfield of IAGnssRil.SetIDType that is required by
+     * @param setIdflag A bitfield of IAGnssRil.SetIdType that is required by
      * the HAL. The framework will inject an empty SET ID if the flag is NONE.
      *
      */
diff --git a/gnss/aidl/android/hardware/gnss/IGnss.aidl b/gnss/aidl/android/hardware/gnss/IGnss.aidl
index 99f2ee4..79950ad 100644
--- a/gnss/aidl/android/hardware/gnss/IGnss.aidl
+++ b/gnss/aidl/android/hardware/gnss/IGnss.aidl
@@ -81,19 +81,19 @@
     @VintfStability
     @Backing(type="int")
     enum GnssAidingData {
-        DELETE_EPHEMERIS = 0x0001,
-        DELETE_ALMANAC = 0x0002,
-        DELETE_POSITION = 0x0004,
-        DELETE_TIME = 0x0008,
-        DELETE_IONO = 0x0010,
-        DELETE_UTC = 0x0020,
-        DELETE_HEALTH = 0x0040,
-        DELETE_SVDIR = 0x0080,
-        DELETE_SVSTEER = 0x0100,
-        DELETE_SADATA = 0x0200,
-        DELETE_RTI = 0x0400,
-        DELETE_CELLDB_INFO = 0x8000,
-        DELETE_ALL = 0xFFFF
+        EPHEMERIS = 0x0001,
+        ALMANAC = 0x0002,
+        POSITION = 0x0004,
+        TIME = 0x0008,
+        IONO = 0x0010,
+        UTC = 0x0020,
+        HEALTH = 0x0040,
+        SVDIR = 0x0080,
+        SVSTEER = 0x0100,
+        SADATA = 0x0200,
+        RTI = 0x0400,
+        CELLDB_INFO = 0x8000,
+        ALL = 0xFFFF
     }
 
     /**
@@ -256,37 +256,56 @@
 
     /**
      * Specifies that the next call to start will not use the information defined in the flags.
-     * GnssAidingData value of DELETE_ALL is passed for a cold start.
+     * GnssAidingData value of GnssAidingData::ALL is passed for a cold start.
      *
      * @param aidingDataFlags Flags specifying the aiding data to be deleted.
      */
     void deleteAidingData(in GnssAidingData aidingDataFlags);
 
     /**
+     * Options used in the setPositionMode() call for specifying the GNSS engine behavior.
+     */
+    @VintfStability
+    parcelable PositionModeOptions {
+        /**
+         * Must be one of MS_BASED or STANDALONE. It is allowed by the platform (and it is
+         * recommended) to fallback to MS_BASED if MS_ASSISTED is passed in, and MS_BASED is
+         * supported.
+         */
+        GnssPositionMode mode;
+
+        /* Recurrence GNSS position recurrence value, either periodic or single. */
+        GnssPositionRecurrence recurrence;
+
+        /* Represents the time between fixes in milliseconds. */
+        int minIntervalMs;
+
+        /* Represents the requested fix accuracy in meters. */
+        int preferredAccuracyMeters;
+
+        /* Represents the requested time to first fix in milliseconds. */
+        int preferredTimeMs;
+
+        /**
+         * When true, and IGnss is the only client to the GNSS hardware, the GNSS hardware must make
+         * strong tradeoffs to substantially restrict power use. Specifically, in the case of a
+         * several second long minIntervalMs, the GNSS hardware must not, on average, run power
+         * hungry operations like RF and signal searches for more than one second per interval, and
+         * must make exactly one call to gnssSvStatusCb(), and either zero or one call to
+         * GnssLocationCb() at each interval. When false, HAL must operate in the nominal mode and
+         * is expected to make power and performance tradoffs such as duty-cycling when signal
+         * conditions are good and more active searches to reacquire GNSS signals when no signals
+         * are present. When there are additional clients using the GNSS hardware other than IGnss,
+         * the GNSS hardware may operate in a higher power mode, on behalf of those clients.
+         */
+        boolean lowPowerMode;
+    }
+
+    /**
      * Sets the GnssPositionMode parameter, its associated recurrence value, the time between fixes,
      * requested fix accuracy, time to first fix.
-     *
-     * @param mode Parameter must be one of MS_BASED or STANDALONE. It is allowed by the platform
-     *     (and it is recommended) to fallback to MS_BASED if MS_ASSISTED is passed in, and MS_BASED
-     *     is supported.
-     * @param recurrence GNSS position recurrence value, either periodic or single.
-     * @param minIntervalMs Represents the time between fixes in milliseconds.
-     * @param preferredAccuracyMeters Represents the requested fix accuracy in meters.
-     * @param preferredTimeMs Represents the requested time to first fix in milliseconds.
-     * @param lowPowerMode When true, and IGnss is the only client to the GNSS hardware, the GNSS
-     *     hardware must make strong tradeoffs to substantially restrict power use. Specifically, in
-     *     the case of a several second long minIntervalMs, the GNSS hardware must not, on average,
-     *     run power hungry operations like RF and signal searches for more than one second per
-     *     interval, and must make exactly one call to gnssSvStatusCb(), and either zero or one call
-     *     to GnssLocationCb() at each interval. When false, HAL must operate in the nominal mode
-     *     and is expected to make power and performance tradoffs such as duty-cycling when signal
-     *     conditions are good and more active searches to reacquire GNSS signals when no signals
-     *     are present. When there are additional clients using the GNSS hardware other than IGnss,
-     *     the GNSS hardware may operate in a higher power mode, on behalf of those clients.
      */
-    void setPositionMode(in GnssPositionMode mode, in GnssPositionRecurrence recurrence,
-            in int minIntervalMs, in int preferredAccuracyMeters, in int preferredTimeMs,
-            in boolean lowPowerMode);
+    void setPositionMode(in PositionModeOptions options);
 
     /*
      * This method returns the IGnssAntennaInfo.
diff --git a/gnss/aidl/default/AGnssRil.cpp b/gnss/aidl/default/AGnssRil.cpp
index afe0039..2aa1abc 100644
--- a/gnss/aidl/default/AGnssRil.cpp
+++ b/gnss/aidl/default/AGnssRil.cpp
@@ -41,7 +41,7 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus AGnssRil::setSetId(SetIDType type, const std::string& setid) {
+ndk::ScopedAStatus AGnssRil::setSetId(SetIdType type, const std::string& setid) {
     ALOGD("AGnssRil::setSetId: type:%s, setid: %s", toString(type).c_str(), setid.c_str());
     return ndk::ScopedAStatus::ok();
 }
diff --git a/gnss/aidl/default/AGnssRil.h b/gnss/aidl/default/AGnssRil.h
index 7e429ee..e205b69 100644
--- a/gnss/aidl/default/AGnssRil.h
+++ b/gnss/aidl/default/AGnssRil.h
@@ -24,7 +24,7 @@
   public:
     ndk::ScopedAStatus setCallback(const std::shared_ptr<IAGnssRilCallback>& callback) override;
     ndk::ScopedAStatus setRefLocation(const AGnssRefLocation& agnssReflocation) override;
-    ndk::ScopedAStatus setSetId(SetIDType type, const std::string& setid) override;
+    ndk::ScopedAStatus setSetId(SetIdType type, const std::string& setid) override;
     ndk::ScopedAStatus updateNetworkState(const NetworkAttributes& attributes) override;
 
   private:
diff --git a/gnss/aidl/default/Gnss.cpp b/gnss/aidl/default/Gnss.cpp
index 6331dfd..eb17bbf 100644
--- a/gnss/aidl/default/Gnss.cpp
+++ b/gnss/aidl/default/Gnss.cpp
@@ -22,6 +22,7 @@
 #include "AGnss.h"
 #include "AGnssRil.h"
 #include "DeviceFileReader.h"
+#include "FixLocationParser.h"
 #include "GnssAntennaInfo.h"
 #include "GnssBatching.h"
 #include "GnssConfiguration.h"
@@ -32,11 +33,9 @@
 #include "GnssPsds.h"
 #include "GnssVisibilityControl.h"
 #include "MeasurementCorrectionsInterface.h"
-#include "NmeaFixInfo.h"
 #include "Utils.h"
 
 namespace aidl::android::hardware::gnss {
-using ::android::hardware::gnss::common::NmeaFixInfo;
 using ::android::hardware::gnss::common::Utils;
 
 using ndk::ScopedAStatus;
@@ -70,9 +69,12 @@
 }
 
 std::unique_ptr<GnssLocation> Gnss::getLocationFromHW() {
+    if (!::android::hardware::gnss::common::ReplayUtils::hasFixedLocationDeviceFile()) {
+        return nullptr;
+    }
     std::string inputStr =
             ::android::hardware::gnss::common::DeviceFileReader::Instance().getLocationData();
-    return ::android::hardware::gnss::common::NmeaFixInfo::getAidlLocationFromInputStr(inputStr);
+    return ::android::hardware::gnss::common::FixLocationParser::getLocationFromInputStr(inputStr);
 }
 
 ScopedAStatus Gnss::start() {
@@ -208,11 +210,10 @@
     return ScopedAStatus::ok();
 }
 
-ScopedAStatus Gnss::setPositionMode(GnssPositionMode, GnssPositionRecurrence, int minIntervalMs,
-                                    int /* preferredAccuracyMeters */, int /* preferredTimeMs */,
-                                    bool lowPowerMode) {
-    ALOGD("setPositionMode. minIntervalMs:%d, lowPowerMode:%d", minIntervalMs, (int)lowPowerMode);
-    mMinIntervalMs = minIntervalMs;
+ScopedAStatus Gnss::setPositionMode(const PositionModeOptions& options) {
+    ALOGD("setPositionMode. minIntervalMs:%d, lowPowerMode:%d", options.minIntervalMs,
+          (int)options.lowPowerMode);
+    mMinIntervalMs = options.minIntervalMs;
     return ScopedAStatus::ok();
 }
 
diff --git a/gnss/aidl/default/Gnss.h b/gnss/aidl/default/Gnss.h
index 36874b8..b50a1ae 100644
--- a/gnss/aidl/default/Gnss.h
+++ b/gnss/aidl/default/Gnss.h
@@ -50,9 +50,7 @@
     ndk::ScopedAStatus injectLocation(const GnssLocation& location) override;
     ndk::ScopedAStatus injectBestLocation(const GnssLocation& location) override;
     ndk::ScopedAStatus deleteAidingData(GnssAidingData aidingDataFlags) override;
-    ndk::ScopedAStatus setPositionMode(GnssPositionMode mode, GnssPositionRecurrence recurrence,
-                                       int minIntervalMs, int preferredAccuracyMeters,
-                                       int preferredTimeMs, bool lowPowerMode) override;
+    ndk::ScopedAStatus setPositionMode(const PositionModeOptions& options) override;
 
     ndk::ScopedAStatus getExtensionPsds(std::shared_ptr<IGnssPsds>* iGnssPsds) override;
     ndk::ScopedAStatus getExtensionGnssConfiguration(
diff --git a/gnss/aidl/vts/gnss_hal_test.cpp b/gnss/aidl/vts/gnss_hal_test.cpp
index 13c32ee..4828f19 100644
--- a/gnss/aidl/vts/gnss_hal_test.cpp
+++ b/gnss/aidl/vts/gnss_hal_test.cpp
@@ -79,9 +79,14 @@
     const int kPreferredAccuracy = 0;  // Ideally perfect (matches GnssLocationProvider)
     const int kPreferredTimeMsec = 0;  // Ideally immediate
 
-    auto status = aidl_gnss_hal_->setPositionMode(
-            IGnss::GnssPositionMode::MS_BASED, IGnss::GnssPositionRecurrence::RECURRENCE_PERIODIC,
-            min_interval_msec, kPreferredAccuracy, kPreferredTimeMsec, low_power_mode);
+    IGnss::PositionModeOptions options;
+    options.mode = IGnss::GnssPositionMode::MS_BASED;
+    options.recurrence = IGnss::GnssPositionRecurrence::RECURRENCE_PERIODIC;
+    options.minIntervalMs = min_interval_msec;
+    options.preferredAccuracyMeters = kPreferredAccuracy;
+    options.preferredTimeMs = kPreferredTimeMsec;
+    options.lowPowerMode = low_power_mode;
+    auto status = aidl_gnss_hal_->setPositionMode(options);
 
     ASSERT_TRUE(status.isOk());
 }
diff --git a/gnss/aidl/vts/gnss_hal_test_cases.cpp b/gnss/aidl/vts/gnss_hal_test_cases.cpp
index cbd9d8e..a4a0044 100644
--- a/gnss/aidl/vts/gnss_hal_test_cases.cpp
+++ b/gnss/aidl/vts/gnss_hal_test_cases.cpp
@@ -1058,10 +1058,9 @@
         // Validity check GnssData fields
         CheckGnssMeasurementClockFields(lastMeasurement);
 
-        ASSERT_TRUE(lastMeasurement.gnssAgcs.has_value());
-        for (const auto& gnssAgc : lastMeasurement.gnssAgcs.value()) {
-            ASSERT_TRUE(gnssAgc.has_value());
-            ASSERT_TRUE(gnssAgc.value().carrierFrequencyHz >= 0);
+        ASSERT_TRUE(lastMeasurement.gnssAgcs.size() > 0);
+        for (const auto& gnssAgc : lastMeasurement.gnssAgcs) {
+            ASSERT_TRUE(gnssAgc.carrierFrequencyHz >= 0);
         }
     }
 
diff --git a/gnss/common/utils/default/DeviceFileReader.cpp b/gnss/common/utils/default/DeviceFileReader.cpp
index 7d4fb04..dfc086a 100644
--- a/gnss/common/utils/default/DeviceFileReader.cpp
+++ b/gnss/common/utils/default/DeviceFileReader.cpp
@@ -22,8 +22,17 @@
 
 void DeviceFileReader::getDataFromDeviceFile(const std::string& command, int mMinIntervalMs) {
     char inputBuffer[INPUT_BUFFER_SIZE];
-    int mGnssFd = open(ReplayUtils::getGnssPath().c_str(),
-                       O_RDWR | O_NONBLOCK);
+    std::string deviceFilePath = "";
+    if (command == CMD_GET_LOCATION) {
+        deviceFilePath = ReplayUtils::getFixedLocationPath();
+    } else if (command == CMD_GET_RAWMEASUREMENT) {
+        deviceFilePath = ReplayUtils::getGnssPath();
+    } else {
+        // Invalid command
+        return;
+    }
+
+    int mGnssFd = open(deviceFilePath.c_str(), O_RDWR | O_NONBLOCK);
 
     if (mGnssFd == -1) {
         return;
@@ -68,10 +77,13 @@
     }
 
     // Cache the injected data.
-    if (ReplayUtils::isGnssRawMeasurement(inputStr)) {
-        data_[CMD_GET_RAWMEASUREMENT] = inputStr;
-    } else if (ReplayUtils::isNMEA(inputStr)) {
+    if (command == CMD_GET_LOCATION) {
+        // TODO validate data
         data_[CMD_GET_LOCATION] = inputStr;
+    } else if (command == CMD_GET_RAWMEASUREMENT) {
+        if (ReplayUtils::isGnssRawMeasurement(inputStr)) {
+            data_[CMD_GET_RAWMEASUREMENT] = inputStr;
+        }
     }
 }
 
diff --git a/gnss/common/utils/default/GnssReplayUtils.cpp b/gnss/common/utils/default/GnssReplayUtils.cpp
index 5356477..37da571 100644
--- a/gnss/common/utils/default/GnssReplayUtils.cpp
+++ b/gnss/common/utils/default/GnssReplayUtils.cpp
@@ -29,11 +29,24 @@
     return GNSS_PATH;
 }
 
+std::string ReplayUtils::getFixedLocationPath() {
+    char devname_value[PROPERTY_VALUE_MAX] = "";
+    if (property_get("debug.location.fixedlocation.devname", devname_value, NULL) > 0) {
+        return devname_value;
+    }
+    return FIXED_LOCATION_PATH;
+}
+
 bool ReplayUtils::hasGnssDeviceFile() {
     struct stat sb;
     return stat(getGnssPath().c_str(), &sb) != -1;
 }
 
+bool ReplayUtils::hasFixedLocationDeviceFile() {
+    struct stat sb;
+    return stat(getFixedLocationPath().c_str(), &sb) != -1;
+}
+
 bool ReplayUtils::isGnssRawMeasurement(const std::string& inputStr) {
     // TODO: add more logic check to by pass invalid data.
     return !inputStr.empty() && (inputStr.find("Raw") != std::string::npos);
diff --git a/gnss/common/utils/default/Utils.cpp b/gnss/common/utils/default/Utils.cpp
index 65b62a9..4e6a718 100644
--- a/gnss/common/utils/default/Utils.cpp
+++ b/gnss/common/utils/default/Utils.cpp
@@ -257,8 +257,7 @@
     GnssData gnssData = {.measurements = {measurement},
                          .clock = clock,
                          .elapsedRealtime = timestamp,
-                         .gnssAgcs = std::make_optional(std::vector(
-                                 {std::make_optional(gnssAgc1), std::make_optional(gnssAgc2)}))};
+                         .gnssAgcs = std::vector({gnssAgc1, gnssAgc2})};
     return gnssData;
 }
 
diff --git a/gnss/common/utils/default/include/Constants.h b/gnss/common/utils/default/include/Constants.h
index f205ba6..489413e 100644
--- a/gnss/common/utils/default/include/Constants.h
+++ b/gnss/common/utils/default/include/Constants.h
@@ -36,6 +36,7 @@
 
 // Location replay constants
 constexpr char GNSS_PATH[] = "/dev/gnss0";
+constexpr char FIXED_LOCATION_PATH[] = "/dev/gnss1";
 constexpr int INPUT_BUFFER_SIZE = 256;
 constexpr char CMD_GET_LOCATION[] = "CMD_GET_LOCATION";
 constexpr char CMD_GET_RAWMEASUREMENT[] = "CMD_GET_RAWMEASUREMENT";
diff --git a/gnss/common/utils/default/include/GnssReplayUtils.h b/gnss/common/utils/default/include/GnssReplayUtils.h
index 32c0e58..d1bbed4 100644
--- a/gnss/common/utils/default/include/GnssReplayUtils.h
+++ b/gnss/common/utils/default/include/GnssReplayUtils.h
@@ -37,10 +37,14 @@
 struct ReplayUtils {
     static std::string getGnssPath();
 
+    static std::string getFixedLocationPath();
+
     static std::string getDataFromDeviceFile(const std::string& command, int mMinIntervalMs);
 
     static bool hasGnssDeviceFile();
 
+    static bool hasFixedLocationDeviceFile();
+
     static bool isGnssRawMeasurement(const std::string& inputStr);
 
     static bool isNMEA(const std::string& inputStr);
diff --git a/graphics/allocator/aidl/Android.bp b/graphics/allocator/aidl/Android.bp
new file mode 100644
index 0000000..ea8a599
--- /dev/null
+++ b/graphics/allocator/aidl/Android.bp
@@ -0,0 +1,40 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+aidl_interface {
+    name: "android.hardware.graphics.allocator",
+    vendor_available: true,
+    vndk: {
+        enabled: true,
+        support_system_process: true,
+    },
+    srcs: ["android/hardware/graphics/allocator/*.aidl"],
+    imports: [
+        "android.hardware.common-V2",
+    ],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            enabled: false,
+        },
+        ndk: {
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.media.swcodec",
+            ],
+            vndk: {
+                enabled: true,
+            },
+            min_sdk_version: "29",
+        },
+    },
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/AllocationError.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/AllocationError.aidl
index 5395b11..6e7b739 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/AllocationError.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,13 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
+package android.hardware.graphics.allocator;
 @Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+enum AllocationError {
+  BAD_DESCRIPTOR = 0,
+  NO_RESOURCES = 1,
+  UNSUPPORTED = 2,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/AllocationResult.aidl
similarity index 89%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/AllocationResult.aidl
index 4f29c0b..73cfeb5 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/AllocationResult.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.graphics.allocator;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+parcelable AllocationResult {
+  int stride;
+  android.hardware.common.NativeHandle[] buffers;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/IAllocator.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/IAllocator.aidl
index 4f29c0b..fe0b0a2 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/graphics/allocator/aidl/aidl_api/android.hardware.graphics.allocator/current/android/hardware/graphics/allocator/IAllocator.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.graphics.allocator;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+interface IAllocator {
+  android.hardware.graphics.allocator.AllocationResult allocate(in byte[] descriptor, in int count);
 }
diff --git a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl b/graphics/allocator/aidl/android/hardware/graphics/allocator/AllocationError.aidl
similarity index 61%
copy from radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
copy to graphics/allocator/aidl/android/hardware/graphics/allocator/AllocationError.aidl
index 270bdee..c6b77b9 100644
--- a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
+++ b/graphics/allocator/aidl/android/hardware/graphics/allocator/AllocationError.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,17 +14,23 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.network;
+package android.hardware.graphics.allocator;
 
 @VintfStability
-parcelable NeighboringCell {
+@Backing(type="int")
+enum AllocationError {
     /**
-     * Combination of LAC and cell ID in 32 bits in GSM. Upper 16 bits is LAC and lower 16 bits is
-     * CID (as described in TS 27.005).
+     * Invalid BufferDescriptor.
      */
-    String cid;
+    BAD_DESCRIPTOR,
+
     /**
-     * Received RSSI in GSM, level index of CPICH Received Signal Code Power in UMTS
+     * Resource unavailable.
      */
-    int rssi;
-}
+    NO_RESOURCES,
+
+    /**
+     * Permanent failure.
+     */
+    UNSUPPORTED
+}
\ No newline at end of file
diff --git a/graphics/allocator/aidl/android/hardware/graphics/allocator/AllocationResult.aidl b/graphics/allocator/aidl/android/hardware/graphics/allocator/AllocationResult.aidl
new file mode 100644
index 0000000..0774e25
--- /dev/null
+++ b/graphics/allocator/aidl/android/hardware/graphics/allocator/AllocationResult.aidl
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.allocator;
+
+import android.hardware.common.NativeHandle;
+
+ /**
+ * Result of an IAllocator::allocate call.
+ *
+ * @sa +ndk libnativewindow#AHardwareBuffer_Desc
+ */
+@VintfStability
+parcelable AllocationResult {
+    int stride;
+    NativeHandle[] buffers;
+}
\ No newline at end of file
diff --git a/graphics/allocator/aidl/android/hardware/graphics/allocator/IAllocator.aidl b/graphics/allocator/aidl/android/hardware/graphics/allocator/IAllocator.aidl
new file mode 100644
index 0000000..8c3ca96
--- /dev/null
+++ b/graphics/allocator/aidl/android/hardware/graphics/allocator/IAllocator.aidl
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.allocator;
+
+import android.hardware.graphics.allocator.AllocationResult;
+
+@VintfStability
+interface IAllocator {
+    /**
+     * Allocates buffers with the properties specified by the descriptor.
+     *
+     * Allocations should be optimized for usage bits provided in the
+     * descriptor.
+     *
+     * @param descriptor Properties of the buffers to allocate. This must be
+     *     obtained from IMapper::createDescriptor().
+     * @param count The number of buffers to allocate.
+     * @return An AllocationResult containing the result of an error, or
+     *         an AllocationError status
+     */
+    AllocationResult allocate(in byte[] descriptor, in int count);
+}
diff --git a/graphics/bufferqueue/1.0/Android.bp b/graphics/bufferqueue/1.0/Android.bp
index eda80d7..c3d38d0 100644
--- a/graphics/bufferqueue/1.0/Android.bp
+++ b/graphics/bufferqueue/1.0/Android.bp
@@ -25,4 +25,9 @@
         "android.hidl.base@1.0",
     ],
     gen_java: true,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media",
+        "com.android.media.swcodec",
+    ],
 }
diff --git a/graphics/bufferqueue/2.0/Android.bp b/graphics/bufferqueue/2.0/Android.bp
index 13feeb1..33d9104 100644
--- a/graphics/bufferqueue/2.0/Android.bp
+++ b/graphics/bufferqueue/2.0/Android.bp
@@ -27,4 +27,9 @@
         "android.hidl.base@1.0",
     ],
     gen_java: true,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media",
+        "com.android.media.swcodec",
+    ],
 }
diff --git a/graphics/common/OWNERS b/graphics/common/OWNERS
new file mode 100644
index 0000000..94999ea
--- /dev/null
+++ b/graphics/common/OWNERS
@@ -0,0 +1,5 @@
+# Bug component: 1075130
+adyabr@google.com
+alecmouri@google.com
+jreck@google.com
+scroggo@google.com
diff --git a/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/BufferUsage.aidl b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/BufferUsage.aidl
index b4ef451..e1edb17 100644
--- a/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/BufferUsage.aidl
+++ b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/BufferUsage.aidl
@@ -54,10 +54,11 @@
   RENDERSCRIPT = 1048576,
   VIDEO_DECODER = 4194304,
   SENSOR_DIRECT_DATA = 8388608,
+  GPU_DATA_BUFFER = 16777216,
   GPU_CUBE_MAP = 33554432,
   GPU_MIPMAP_COMPLETE = 67108864,
   HW_IMAGE_ENCODER = 134217728,
-  GPU_DATA_BUFFER = 16777216,
+  FRONT_BUFFER = 4294967296,
   VENDOR_MASK = -268435456,
   VENDOR_MASK_HI = -281474976710656,
 }
diff --git a/graphics/common/aidl/android/hardware/graphics/common/BufferUsage.aidl b/graphics/common/aidl/android/hardware/graphics/common/BufferUsage.aidl
index d978f46..60dfbfb 100644
--- a/graphics/common/aidl/android/hardware/graphics/common/BufferUsage.aidl
+++ b/graphics/common/aidl/android/hardware/graphics/common/BufferUsage.aidl
@@ -87,6 +87,12 @@
     /** buffer is used as a sensor direct report output */
     SENSOR_DIRECT_DATA                 = 1 << 23,
 
+    /**
+     * buffer is used as as an OpenGL shader storage or uniform
+     * buffer object
+     */
+    GPU_DATA_BUFFER                    = 1 << 24,
+
     /** buffer is used as a cube map texture */
     GPU_CUBE_MAP                       = 1 << 25,
 
@@ -98,17 +104,34 @@
      */
     HW_IMAGE_ENCODER                   = 1 << 27,
 
-    /**
-     * buffer is used as as an OpenGL shader storage or uniform
-     * buffer object
-     */
-    GPU_DATA_BUFFER                    = 1 << 24,
+    /* Bits 28-31 are reserved for vendor usage */
 
-    /** bits 25-27 must be zero and are reserved for future versions */
+    /**
+    * Buffer is used for front-buffer rendering.
+    *
+    * To satisfy an allocation with this usage, the resulting buffer
+    * must operate as equivalent to shared memory for all targets.
+    *
+    * For CPU_USAGE_* other than NEVER, this means the buffer must
+    * "lock in place". The buffers must be directly accessible via mapping.
+    *
+    * For GPU_RENDER_TARGET the buffer must behave equivalent to a
+    * single-buffered EGL surface. For example glFlush must perform
+    * a flush, same as if the default framebuffer was single-buffered.
+    *
+    * For COMPOSER_* the HWC must not perform any caching for this buffer
+    * when submitted for composition. HWCs do not need to do any form
+    * of auto-refresh, and they are allowed to cache composition results between
+    * presents from SF (such as for panel self-refresh), but for any given
+    * present the buffer must be composited from even if it otherwise appears
+    * to be the same as a previous composition.
+    */
+    FRONT_BUFFER                       = 1L << 32,
+
     /** bits 28-31 are reserved for vendor extensions */
     VENDOR_MASK                        = 0xf << 28,
 
-    /** bits 32-47 must be zero and are reserved for future versions */
+    /** bits 33-47 must be zero and are reserved for future versions */
     /** bits 48-63 are reserved for vendor extensions */
     VENDOR_MASK_HI                     = (1L * 0xffff) << 48,
 }
diff --git a/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl b/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl
index 7719d6e..74a9ce3 100644
--- a/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl
+++ b/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl
@@ -22,8 +22,9 @@
  * This is an enum that defines the common types of gralloc 4 buffer metadata. The comments for
  * each enum include a description of the metadata that is associated with the type.
  *
- * IMapper@4.x must support getting the following standard buffer metadata types. IMapper@4.x may
- * support setting these standard buffer metadata types as well.
+ * IMapper@4.x must support getting the following standard buffer metadata types, with the exception
+ * of SMPTE 2094-10 metadata. IMapper@4.x may support setting these standard buffer metadata types
+ * as well.
  *
  * When encoding these StandardMetadataTypes into a byte stream, the associated MetadataType is
  * is first encoded followed by the StandardMetadataType value. The MetadataType is encoded by
diff --git a/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp b/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp
index b071f71..fa294ff 100644
--- a/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp
+++ b/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp
@@ -161,7 +161,8 @@
         return mGralloc->allocate(
                 width, height, /*layerCount*/ 1,
                 static_cast<common::V1_1::PixelFormat>(PixelFormat::RGBA_8888),
-                static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN));
+                static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN |
+                                      BufferUsage::COMPOSER_OVERLAY));
     }
 
     struct TestParameters {
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/BufferAheadResult.aidl
similarity index 81%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/BufferAheadResult.aidl
index 4f29c0b..94fd91b 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/BufferAheadResult.aidl
@@ -1,11 +1,11 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
+/**
+ * Copyright (c) 2022, The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *      http://www.apache.org/licenses/LICENSE-2.0
+ *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -31,9 +31,14 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.graphics.composer3;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+parcelable BufferAheadResult {
+  long display;
+  android.hardware.graphics.composer3.BufferAheadResult.Layer[] layers;
+  @VintfStability
+  parcelable Layer {
+    long layer;
+    boolean presented;
+  }
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl
index 9c49583..e989b6c 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl
@@ -39,4 +39,5 @@
   SKIP_CLIENT_COLOR_TRANSFORM = 2,
   PRESENT_FENCE_IS_NOT_RELIABLE = 3,
   SKIP_VALIDATE = 4,
+  BUFFER_AHEAD = 5,
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/CommandResultPayload.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/CommandResultPayload.aidl
index ebbb31e..fb39172 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/CommandResultPayload.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/CommandResultPayload.aidl
@@ -39,6 +39,7 @@
   android.hardware.graphics.composer3.DisplayRequest displayRequest;
   android.hardware.graphics.composer3.PresentFence presentFence;
   android.hardware.graphics.composer3.ReleaseFences releaseFences;
+  android.hardware.graphics.composer3.BufferAheadResult bufferAheadResult;
   android.hardware.graphics.composer3.PresentOrValidate presentOrValidateResult;
   android.hardware.graphics.composer3.ClientTargetPropertyWithNits clientTargetProperty;
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayCapability.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayCapability.aidl
index fdf1100..b41ac8a 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayCapability.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayCapability.aidl
@@ -42,4 +42,5 @@
   AUTO_LOW_LATENCY_MODE = 5,
   SUSPEND = 6,
   DISPLAY_DECORATION = 7,
+  DISPLAY_IDLE_TIMER = 8,
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerCallback.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerCallback.aidl
index f82d02e..21620e7 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerCallback.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerCallback.aidl
@@ -39,4 +39,5 @@
   oneway void onSeamlessPossible(long display);
   oneway void onVsync(long display, long timestamp, int vsyncPeriodNanos);
   oneway void onVsyncPeriodTimingChanged(long display, in android.hardware.graphics.composer3.VsyncPeriodChangeTimeline updatedTimeline);
+  oneway void onVsyncIdle(long display);
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
index 5593c57..2de699b 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
@@ -73,6 +73,7 @@
   void setPowerMode(long display, android.hardware.graphics.composer3.PowerMode mode);
   void setReadbackBuffer(long display, in android.hardware.common.NativeHandle buffer, in @nullable ParcelFileDescriptor releaseFence);
   void setVsyncEnabled(long display, boolean enabled);
+  void setIdleTimerEnabled(long display, int timeoutMs);
   const int EX_BAD_CONFIG = 1;
   const int EX_BAD_DISPLAY = 2;
   const int EX_BAD_LAYER = 3;
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/LayerCommand.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/LayerCommand.aidl
index c1c0117..1429c35 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/LayerCommand.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/LayerCommand.aidl
@@ -37,6 +37,7 @@
   long layer;
   @nullable android.hardware.graphics.common.Point cursorPosition;
   @nullable android.hardware.graphics.composer3.Buffer buffer;
+  @nullable android.hardware.graphics.composer3.Buffer bufferAhead;
   @nullable android.hardware.graphics.common.Rect[] damage;
   @nullable android.hardware.graphics.composer3.ParcelableBlendMode blendMode;
   @nullable android.hardware.graphics.composer3.Color color;
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/BufferAheadResult.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/BufferAheadResult.aidl
new file mode 100644
index 0000000..7ca4578
--- /dev/null
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/BufferAheadResult.aidl
@@ -0,0 +1,46 @@
+/**
+ * Copyright (c) 2022, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.composer3;
+
+@VintfStability
+parcelable BufferAheadResult {
+    /**
+     * The display which this commands refers to.
+     * @see IComposer.createDisplay
+     */
+    long display;
+
+    @VintfStability
+    parcelable Layer {
+        /**
+         * The layer which this commands refers to.
+         * @see IComposer.createLayer
+         */
+        long layer;
+
+        /**
+         * Represents whether BufferAhead was presented as part of the last
+         * present or not.
+         */
+        boolean presented;
+    }
+
+    /**
+     * The layers which has BufferAheadResult populated.
+     */
+    Layer[] layers;
+}
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl
index ea619ae..77ad1e0 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl
@@ -57,4 +57,9 @@
      * validateDisplay step is needed.
      */
     SKIP_VALIDATE = 4,
+    /**
+     * Specifies that a device is able to use the LayerCommand.bufferAhead
+     * when provided.
+     */
+    BUFFER_AHEAD = 5
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/CommandResultPayload.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/CommandResultPayload.aidl
index f2de68e..fd1e4cc 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/CommandResultPayload.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/CommandResultPayload.aidl
@@ -16,6 +16,7 @@
 
 package android.hardware.graphics.composer3;
 
+import android.hardware.graphics.composer3.BufferAheadResult;
 import android.hardware.graphics.composer3.ChangedCompositionTypes;
 import android.hardware.graphics.composer3.ClientTargetPropertyWithNits;
 import android.hardware.graphics.composer3.CommandError;
@@ -78,6 +79,13 @@
     ReleaseFences releaseFences;
 
     /**
+     * Represents the result of the LayerCommand.bufferAhead that was
+     * sent in the last presentDisplay call. That is, the presentDisplay
+     * call prior to this presentDisplay.
+     */
+    BufferAheadResult bufferAheadResult;
+
+    /**
      * Sets the state of PRESENT_OR_VALIDATE_DISPLAY command.
      */
     PresentOrValidate presentOrValidateResult;
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/DisplayCapability.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/DisplayCapability.aidl
index 249fed0..85136c4 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/DisplayCapability.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/DisplayCapability.aidl
@@ -79,4 +79,9 @@
      * Indicates that the display supports Composition.DISPLAY_DECORATION.
      */
     DISPLAY_DECORATION = 7,
+    /**
+     * Indicates that the display supports IComposerClient.setIdleTimerEnabled and
+     * IComposerCallback.onVsyncIdle.
+     */
+    DISPLAY_IDLE_TIMER = 8,
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerCallback.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerCallback.aidl
index ac95b41..67954d4 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerCallback.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerCallback.aidl
@@ -86,4 +86,14 @@
      */
     oneway void onVsyncPeriodTimingChanged(
             long display, in VsyncPeriodChangeTimeline updatedTimeline);
+
+    /**
+     * Notifies the client that the display is idle, the refresh rate changed to a lower setting to
+     * preserve power and vsync cadence changed. When a new frame is queued for presentation, the
+     * client is expected to enable vsync callbacks to learn the new vsync cadence before sending
+     * a new frame.
+     *
+     * @param display is the display whose vsync cadence changed due to panel idle mode.
+     */
+    oneway void onVsyncIdle(long display);
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
index c86b9bd..2fe6656 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
@@ -779,4 +779,25 @@
      * @exception EX_BAD_PARAMETER when enabled was an invalid value.
      */
     void setVsyncEnabled(long display, boolean enabled);
+
+    /**
+     * Enables or disables the idle timer on this display.
+     *
+     * Idle timer is used to allow the display to go into a panel idle mode after some
+     * idle period.
+     *
+     * This function should only be called if the display reports support for
+     * DisplayCapability.DISPLAY_IDLE from getDisplayCapabilities.
+     *
+     * @param display is the display to which the idle timer is set.
+     * @param timeoutMs is the minimum requirements of idle period in milliseconds. Panel
+     *                should not go into the idle state within the minimum requirement after
+     *                idle for a while. 0 means disabled, panel should not go into idle state.
+     *
+     * @exception EX_BAD_DISPLAY when an invalid display handle was passed in.
+     * @exception EX_BAD_PARAMETER when timeout is a negative number.
+     * @exception EX_UNSUPPORTED when idle is not supported on this display.
+     *
+     */
+    void setIdleTimerEnabled(long display, int timeoutMs);
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/LayerCommand.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/LayerCommand.aidl
index 0a2711b..ab93794 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/LayerCommand.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/LayerCommand.aidl
@@ -41,20 +41,11 @@
     long layer;
 
     /**
-     * Asynchronously sets the position of a cursor layer.
+     * Sets the position of a cursor layer.
      *
-     * Prior to validateDisplay, a layer may be marked as Composition.CURSOR.
-     * If validation succeeds (i.e., the device does not request a composition
-     * change for that layer), then once a buffer has been set for the layer
-     * and it has been presented, its position may be set by this function at
-     * any time between presentDisplay and any subsequent validateDisplay
-     * calls for this display.
-     *
-     * Once validateDisplay is called, this function must not be called again
-     * until the validate/present sequence is completed.
-     *
-     * May be called from any thread so long as it is not interleaved with the
-     * validate/present sequence as described above.
+     * The position of a cursor layer can be updated without a validate/present display
+     * sequence if that layer was marked as Composition.CURSOR and validation previously succeeded
+     * (i.e., the device didn't request a composition).
      */
     @nullable Point cursorPosition;
 
@@ -79,6 +70,30 @@
     @nullable Buffer buffer;
 
     /**
+     * Sets a buffer handle to be displayed for this layer and a file descriptor
+     * referring to an acquire sync fence object, which must be signaled when it is
+     * safe to read from the given buffer.
+     *
+     * When bufferAhead is provided, the implementation should try to
+     * present it on the next scanout as long as its acquire sync fence
+     * is signaled by that time. Otherwise the bufferAhead should be dropped.
+     * This allows the client to set an
+     * unsignaled buffer on the layer without causing the entire display to miss
+     * an update if the buffer is not ready by the next scanout time.
+     *
+     * In case bufferAhead is dropped and LayerCommand.buffer is provided, LayerCommand.buffer
+     * should be used as the next layer buffer.
+     *
+     * The implementation is expected to populate the CommandResultPayload.bufferAheadResult
+     * with information about whether bufferAhead was presented or dropped.
+     * Since this information is not known at the current presentDisplay call
+     * of frame N (as the scanout happens after the call returns),
+     * the implementation should populate it when presentDisplay is
+     * called for frame N+1.
+     */
+    @nullable Buffer bufferAhead;
+
+    /**
      * Provides the region of the source buffer which has been modified since
      * the last frame. This region does not need to be validated before
      * calling presentDisplay.
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp
index 741572d..bd2c3b1 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp
@@ -50,6 +50,7 @@
         "libgui",
         "libhidlbase",
         "libprocessgroup",
+        "libtinyxml2",
         "android.hardware.graphics.mapper@2.0",
         "android.hardware.graphics.mapper@2.1",
         "android.hardware.graphics.mapper@3.0",
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp
index e519221..3f1e703 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp
@@ -24,10 +24,18 @@
 #include <composer-vts/include/ReadbackVts.h>
 #include <composer-vts/include/RenderEngineVts.h>
 #include <gtest/gtest.h>
+#include <ui/DisplayId.h>
+#include <ui/DisplayIdentification.h>
 #include <ui/GraphicBuffer.h>
 #include <ui/GraphicBufferAllocator.h>
 #include <ui/PixelFormat.h>
 #include <ui/Rect.h>
+
+// tinyxml2 does implicit conversions >:(
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wconversion"
+#include <tinyxml2.h>
+#pragma clang diagnostic pop
 #include "composer-vts/include/GraphicsComposerCallback.h"
 
 namespace aidl::android::hardware::graphics::composer3::vts {
@@ -124,6 +132,76 @@
                 /*layerCount*/ 1u, usage, "VtsHalGraphicsComposer3_ReadbackTest");
     }
 
+    uint64_t getStableDisplayId(int64_t display) {
+        DisplayIdentification identification;
+        const auto error = mComposerClient->getDisplayIdentificationData(display, &identification);
+        EXPECT_TRUE(error.isOk());
+
+        if (const auto info = ::android::parseDisplayIdentificationData(
+                    static_cast<uint8_t>(identification.port), identification.data)) {
+            return info->id.value;
+        }
+
+        return ::android::PhysicalDisplayId::fromPort(static_cast<uint8_t>(identification.port))
+                .value;
+    }
+
+    // Gets the per-display XML config
+    std::unique_ptr<tinyxml2::XMLDocument> getDisplayConfigXml(int64_t display) {
+        std::stringstream pathBuilder;
+        pathBuilder << "/vendor/etc/displayconfig/display_id_" << getStableDisplayId(display)
+                    << ".xml";
+        const std::string path = pathBuilder.str();
+        auto document = std::make_unique<tinyxml2::XMLDocument>();
+        const tinyxml2::XMLError error = document->LoadFile(path.c_str());
+        if (error == tinyxml2::XML_SUCCESS) {
+            return document;
+        } else {
+            return nullptr;
+        }
+    }
+
+    // Gets the max display brightness for this display.
+    // If the display config xml does not exist, then assume that the display is not well-configured
+    // enough to provide a display brightness, so return nullopt.
+    std::optional<float> getMaxDisplayBrightnessNits(int64_t display) {
+        const auto document = getDisplayConfigXml(display);
+        if (!document) {
+            // Assume the device doesn't support display brightness
+            return std::nullopt;
+        }
+
+        const auto root = document->RootElement();
+        if (!root) {
+            // If there's somehow no root element, then this isn't a valid config
+            return std::nullopt;
+        }
+
+        const auto screenBrightnessMap = root->FirstChildElement("screenBrightnessMap");
+        if (!screenBrightnessMap) {
+            // A valid display config must have a screen brightness map
+            return std::nullopt;
+        }
+
+        auto point = screenBrightnessMap->FirstChildElement("point");
+        float maxNits = -1.f;
+        while (point != nullptr) {
+            const auto nits = point->FirstChildElement("nits");
+            if (nits) {
+                maxNits = std::max(maxNits, nits->FloatText(-1.f));
+            }
+            point = point->NextSiblingElement("point");
+        }
+
+        if (maxNits < 0.f) {
+            // If we got here, then there were no point elements containing a nit value, so this
+            // config isn't valid
+            return std::nullopt;
+        }
+
+        return maxNits;
+    }
+
     void writeLayers(const std::vector<std::shared_ptr<TestLayer>>& layers) {
         for (auto layer : layers) {
             layer->write(mWriter);
@@ -250,8 +328,8 @@
         std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -286,8 +364,8 @@
             return;
         }
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
@@ -363,8 +441,8 @@
         std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mWriter.validateDisplay(mPrimaryDisplay, ComposerClientWriter::kNoTimestamp);
@@ -389,8 +467,8 @@
         return;
     }
 
-    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer, mDisplayWidth,
-                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth, mDisplayHeight,
+                                  mPixelFormat, mDataspace);
 
     ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 }
@@ -419,8 +497,13 @@
         return;
     }
 
-    aidl::android::hardware::common::NativeHandle bufferHandle =
-            ::android::dupToAidl(mGraphicBuffer->handle);
+    aidl::android::hardware::common::NativeHandle bufferHandle;
+    {
+        ::android::sp<::android::GraphicBuffer> buffer = allocate();
+        ASSERT_EQ(::android::OK, mGraphicBuffer->initCheck());
+        ::android::makeToAidl(mGraphicBuffer->handle);
+    }
+
     ndk::ScopedFileDescriptor releaseFence = ndk::ScopedFileDescriptor(-1);
     const auto error =
             mComposerClient->setReadbackBuffer(mPrimaryDisplay, bufferHandle, releaseFence);
@@ -438,8 +521,9 @@
     ndk::ScopedFileDescriptor releaseFence;
     const auto error = mComposerClient->getReadbackBufferFence(mPrimaryDisplay, &releaseFence);
 
-    EXPECT_TRUE(error.isOk());
+    ASSERT_FALSE(error.isOk());
     EXPECT_EQ(IComposerClient::EX_UNSUPPORTED, error.getServiceSpecificError());
+    EXPECT_EQ(-1, releaseFence.get());
 }
 
 TEST_P(GraphicsCompositionTest, ClientComposition) {
@@ -474,8 +558,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -553,8 +637,8 @@
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
                                        {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight}, RED);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         auto deviceLayer = std::make_shared<TestBufferLayer>(
@@ -657,8 +741,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -720,8 +804,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
 
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
@@ -781,8 +865,8 @@
         // update expected colors to match crop
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
                                        {0, 0, mDisplayWidth, mDisplayHeight}, BLUE);
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -834,8 +918,8 @@
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, blueRect, BLUE);
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -876,6 +960,90 @@
     }
 }
 
+TEST_P(GraphicsCompositionTest, SetLayerWhitePointDims) {
+    std::vector<DisplayCapability> capabilities;
+    const auto error = mComposerClient->getDisplayCapabilities(mPrimaryDisplay, &capabilities);
+    ASSERT_TRUE(error.isOk());
+
+    const bool brightnessSupport = std::find(capabilities.begin(), capabilities.end(),
+                                             DisplayCapability::BRIGHTNESS) != capabilities.end();
+
+    if (!brightnessSupport) {
+        GTEST_SUCCEED() << "Cannot verify dimming behavior without brightness support";
+        return;
+    }
+
+    const std::optional<float> maxBrightnessNitsOptional =
+            getMaxDisplayBrightnessNits(mPrimaryDisplay);
+
+    ASSERT_TRUE(maxBrightnessNitsOptional.has_value());
+
+    const float maxBrightnessNits = *maxBrightnessNitsOptional;
+
+    // Preconditions to successfully run are knowing the max brightness and successfully applying
+    // the max brightness
+    ASSERT_GT(maxBrightnessNits, 0.f);
+    mWriter.setDisplayBrightness(mPrimaryDisplay, 1.f);
+    execute();
+    ASSERT_TRUE(mReader.takeErrors().empty());
+
+    for (ColorMode mode : mTestColorModes) {
+        ASSERT_NO_FATAL_FAILURE(
+                mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
+
+        if (!getHasReadbackBuffer()) {
+            GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace for "
+                               "color mode: "
+                            << toString(mode);
+            continue;
+        }
+        const common::Rect redRect = {0, 0, mDisplayWidth, mDisplayHeight / 2};
+        const common::Rect dimmerRedRect = {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight};
+        const auto redLayer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+        redLayer->setColor(RED);
+        redLayer->setDisplayFrame(redRect);
+        redLayer->setWhitePointNits(maxBrightnessNits);
+
+        const auto dimmerRedLayer =
+                std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+        dimmerRedLayer->setColor(RED);
+        dimmerRedLayer->setDisplayFrame(dimmerRedRect);
+        // Intentionally use a small dimming ratio as some implementations may be more likely to
+        // kick into GPU composition to apply dithering when the dimming ratio is high.
+        static constexpr float kDimmingRatio = 0.9f;
+        dimmerRedLayer->setWhitePointNits(maxBrightnessNits * kDimmingRatio);
+
+        const std::vector<std::shared_ptr<TestLayer>> layers = {redLayer, dimmerRedLayer};
+        std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
+
+        ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
+        ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, dimmerRedRect, DIM_RED);
+
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
+        ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+        writeLayers(layers);
+        ASSERT_TRUE(mReader.takeErrors().empty());
+        mWriter.validateDisplay(mPrimaryDisplay, ComposerClientWriter::kNoTimestamp);
+        execute();
+        if (!mReader.takeChangedCompositionTypes(mPrimaryDisplay).empty()) {
+            GTEST_SUCCEED()
+                    << "Readback verification not supported for GPU composition for color mode: "
+                    << toString(mode);
+            continue;
+        }
+        mWriter.presentDisplay(mPrimaryDisplay);
+        execute();
+        ASSERT_TRUE(mReader.takeErrors().empty());
+
+        ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+        mTestRenderEngine->setRenderLayers(layers);
+        ASSERT_NO_FATAL_FAILURE(mTestRenderEngine->drawLayers());
+        ASSERT_NO_FATAL_FAILURE(mTestRenderEngine->checkColorBuffer(expectedColors));
+    }
+}
+
 class GraphicsBlendModeCompositionTest
     : public GraphicsCompositionTestBase,
       public testing::WithParamInterface<std::tuple<std::string, std::string>> {
@@ -973,8 +1141,8 @@
         setUpLayers(BlendMode::NONE);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1014,8 +1182,8 @@
         setUpLayers(BlendMode::COVERAGE);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1050,8 +1218,8 @@
         setUpLayers(BlendMode::PREMULTIPLIED);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1120,8 +1288,8 @@
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         mLayer->setTransform(Transform::FLIP_H);
         mLayer->setDataspace(ReadbackHelper::getDataspaceForColorMode(mode), mWriter);
@@ -1161,8 +1329,8 @@
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::FLIP_V);
@@ -1202,8 +1370,8 @@
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::ROT_180);
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp
index ff22817..026a431 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp
@@ -76,7 +76,10 @@
         ASSERT_NE(binder, nullptr);
         ASSERT_NO_FATAL_FAILURE(mComposer = IComposer::fromBinder(binder));
         ASSERT_NE(mComposer, nullptr);
-        ASSERT_NO_FATAL_FAILURE(mComposer->createClient(&mComposerClient));
+
+        ndk::ScopedAStatus status;
+        ASSERT_NO_FATAL_FAILURE(status = mComposer->createClient(&mComposerClient));
+        ASSERT_TRUE(status.isOk());
 
         mComposerCallback = ::ndk::SharedRefBase::make<GraphicsComposerCallback>();
         EXPECT_TRUE(mComposerClient->registerCallback(mComposerCallback).isOk());
@@ -188,6 +191,14 @@
         resourceIt->second.layers.erase(layer);
     }
 
+    bool hasCapability(Capability capability) {
+        std::vector<Capability> capabilities;
+        EXPECT_TRUE(mComposer->getCapabilities(&capabilities).isOk());
+        return std::any_of(
+                capabilities.begin(), capabilities.end(),
+                [&](const Capability& activeCapability) { return activeCapability == capability; });
+    }
+
     // returns an invalid display id (one that has not been registered to a
     // display.  Currently assuming that a device will never have close to
     // std::numeric_limit<uint64_t>::max() displays registered while running tests
@@ -1194,6 +1205,7 @@
         const auto errors = mReader.takeErrors();
         ASSERT_TRUE(mReader.takeErrors().empty());
         ASSERT_TRUE(mReader.takeChangedCompositionTypes(mPrimaryDisplay).empty());
+        ASSERT_TRUE(mReader.takeBufferAheadResultLayers(mPrimaryDisplay).empty());
 
         ASSERT_NO_FATAL_FAILURE(GraphicsComposerAidlTest::TearDown());
     }
@@ -1383,6 +1395,14 @@
         return layer;
     }
 
+    bool hasDisplayCapability(int64_t display, DisplayCapability cap) {
+        std::vector<DisplayCapability> capabilities;
+        const auto error = mComposerClient->getDisplayCapabilities(display, &capabilities);
+        EXPECT_TRUE(error.isOk());
+
+        return std::find(capabilities.begin(), capabilities.end(), cap) != capabilities.end();
+    }
+
     void Test_setActiveConfigWithConstraints(const TestParameters& params) {
         for (VtsDisplay& display : mDisplays) {
             forEachTwoConfigs(display.get(), [&](int32_t config1, int32_t config2) {
@@ -1474,6 +1494,11 @@
     }
 
     void Test_expectedPresentTime(std::optional<int> framesDelay) {
+        if (hasCapability(Capability::PRESENT_FENCE_IS_NOT_RELIABLE)) {
+            GTEST_SUCCEED() << "Device has unreliable present fences capability, skipping";
+            return;
+        }
+
         ASSERT_TRUE(mComposerClient->setPowerMode(mPrimaryDisplay, PowerMode::ON).isOk());
 
         const auto vsyncPeriod = getVsyncPeriod();
@@ -1538,7 +1563,7 @@
     execute();
 
     const auto errors = mReader.takeErrors();
-    if (errors.size() == 1 && errors[0].errorCode == EX_UNSUPPORTED_OPERATION) {
+    if (errors.size() == 1 && errors[0].errorCode == IComposerClient::EX_UNSUPPORTED) {
         GTEST_SUCCEED() << "setLayerColorTransform is not supported";
         return;
     }
@@ -1555,7 +1580,7 @@
         execute();
         const auto errors = mReader.takeErrors();
         EXPECT_EQ(1, errors.size());
-        EXPECT_EQ(EX_UNSUPPORTED_OPERATION, errors[0].errorCode);
+        EXPECT_EQ(IComposerClient::EX_UNSUPPORTED, errors[0].errorCode);
         GTEST_SUCCEED() << "SetDisplayBrightness is not supported";
         return;
     }
@@ -1650,10 +1675,7 @@
  */
 // TODO(b/208441745) fix the test failure
 TEST_P(GraphicsComposerAidlCommandTest, PRESENT_DISPLAY_NO_LAYER_STATE_CHANGES) {
-    std::vector<Capability> capabilities;
-    EXPECT_TRUE(mComposer->getCapabilities(&capabilities).isOk());
-    if (none_of(capabilities.begin(), capabilities.end(),
-                [&](auto item) { return item == Capability::SKIP_VALIDATE; })) {
+    if (!hasCapability(Capability::SKIP_VALIDATE)) {
         GTEST_SUCCEED() << "Device does not have skip validate capability, skipping";
         return;
     }
@@ -1881,10 +1903,7 @@
 }
 
 TEST_P(GraphicsComposerAidlCommandTest, SET_LAYER_SIDEBAND_STREAM) {
-    std::vector<Capability> capabilities;
-    EXPECT_TRUE(mComposer->getCapabilities(&capabilities).isOk());
-    if (none_of(capabilities.begin(), capabilities.end(),
-                [&](auto& item) { return item == Capability::SIDEBAND_STREAM; })) {
+    if (!hasCapability(Capability::SIDEBAND_STREAM)) {
         GTEST_SUCCEED() << "no sideband stream support";
         return;
     }
@@ -2155,6 +2174,74 @@
     ASSERT_NO_FATAL_FAILURE(Test_expectedPresentTime(5));
 }
 
+TEST_P(GraphicsComposerAidlCommandTest, setIdleTimerEnabled_Unsupported) {
+    const bool hasDisplayIdleTimerSupport = hasDisplayCapability(mPrimaryDisplay,
+                                        DisplayCapability::DISPLAY_IDLE_TIMER);
+    if (!hasDisplayIdleTimerSupport) {
+        const auto error = mComposerClient->setIdleTimerEnabled(mPrimaryDisplay, 0);
+        EXPECT_FALSE(error.isOk());
+        EXPECT_EQ(IComposerClient::EX_UNSUPPORTED, error.getServiceSpecificError());
+    }
+}
+
+TEST_P(GraphicsComposerAidlCommandTest, setIdleTimerEnabled_BadParameter) {
+    const bool hasDisplayIdleTimerSupport = hasDisplayCapability(mPrimaryDisplay,
+                                        DisplayCapability::DISPLAY_IDLE_TIMER);
+    if (!hasDisplayIdleTimerSupport) {
+        GTEST_SUCCEED() << "DisplayCapability::DISPLAY_IDLE_TIMER is not supported";
+        return;
+    }
+
+    const auto error = mComposerClient->setIdleTimerEnabled(mPrimaryDisplay, -1);
+    EXPECT_FALSE(error.isOk());
+    EXPECT_EQ(IComposerClient::EX_BAD_PARAMETER, error.getServiceSpecificError());
+}
+
+TEST_P(GraphicsComposerAidlCommandTest, setIdleTimerEnabled_Disable) {
+    const bool hasDisplayIdleTimerSupport = hasDisplayCapability(mPrimaryDisplay,
+                                        DisplayCapability::DISPLAY_IDLE_TIMER);
+    if (!hasDisplayIdleTimerSupport) {
+        GTEST_SUCCEED() << "DisplayCapability::DISPLAY_IDLE_TIMER is not supported";
+        return;
+    }
+
+    EXPECT_TRUE(mComposerClient->setIdleTimerEnabled(mPrimaryDisplay, 0).isOk());
+    std::this_thread::sleep_for(1s);
+    EXPECT_EQ(0, mComposerCallback->getVsyncIdleCount());
+}
+
+TEST_P(GraphicsComposerAidlCommandTest, setIdleTimerEnabled_Timeout_2) {
+    const bool hasDisplayIdleTimerSupport = hasDisplayCapability(mPrimaryDisplay,
+                                        DisplayCapability::DISPLAY_IDLE_TIMER);
+    if (!hasDisplayIdleTimerSupport) {
+        GTEST_SUCCEED() << "DisplayCapability::DISPLAY_IDLE_TIMER is not supported";
+        return;
+    }
+
+    EXPECT_TRUE(mComposerClient->setPowerMode(mPrimaryDisplay, PowerMode::ON).isOk());
+    EXPECT_TRUE(mComposerClient->setIdleTimerEnabled(mPrimaryDisplay, 0).isOk());
+
+    const auto buffer = allocate();
+    ASSERT_NE(nullptr, buffer->handle);
+
+    const auto layer = createOnScreenLayer();
+    mWriter.setLayerBuffer(mPrimaryDisplay, layer, 0, buffer->handle, -1);
+    int32_t vsyncIdleCount = mComposerCallback->getVsyncIdleCount();
+    auto earlyVsyncIdleTime = systemTime() + std::chrono::nanoseconds(2s).count();
+    EXPECT_TRUE(mComposerClient->setIdleTimerEnabled(mPrimaryDisplay, 2000).isOk());
+
+    const sp<::android::Fence> presentFence =
+        presentAndGetFence(ComposerClientWriter::kNoTimestamp);
+    presentFence->waitForever(LOG_TAG);
+
+    std::this_thread::sleep_for(3s);
+    if (vsyncIdleCount < mComposerCallback->getVsyncIdleCount()) {
+        EXPECT_GE(mComposerCallback->getVsyncIdleTime(), earlyVsyncIdleTime);
+    }
+
+    EXPECT_TRUE(mComposerClient->setPowerMode(mPrimaryDisplay, PowerMode::OFF).isOk());
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(GraphicsComposerAidlCommandTest);
 INSTANTIATE_TEST_SUITE_P(
         PerInstance, GraphicsComposerAidlCommandTest,
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/GraphicsComposerCallback.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/GraphicsComposerCallback.cpp
index 307fe15..22b5d79 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/GraphicsComposerCallback.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/GraphicsComposerCallback.cpp
@@ -16,6 +16,7 @@
 
 #include "include/GraphicsComposerCallback.h"
 #include <log/log_main.h>
+#include <utils/Timers.h>
 
 #pragma push_macro("LOG_TAG")
 #undef LOG_TAG
@@ -58,6 +59,16 @@
     return mInvalidSeamlessPossibleCount;
 }
 
+int32_t GraphicsComposerCallback::getVsyncIdleCount() const {
+    std::scoped_lock lock(mMutex);
+    return mVsyncIdleCount;
+}
+
+int64_t GraphicsComposerCallback::getVsyncIdleTime() const {
+    std::scoped_lock lock(mMutex);
+    return mVsyncIdleTime;
+}
+
 std::optional<VsyncPeriodChangeTimeline>
 GraphicsComposerCallback::takeLastVsyncPeriodChangeTimeline() {
     std::scoped_lock lock(mMutex);
@@ -125,4 +136,13 @@
     return ::ndk::ScopedAStatus::ok();
 }
 
+::ndk::ScopedAStatus GraphicsComposerCallback::onVsyncIdle(int64_t in_display) {
+    std::scoped_lock lock(mMutex);
+    if (mDisplays.count(in_display)) {
+        mVsyncIdleCount++;
+        mVsyncIdleTime = systemTime();
+    }
+    return ::ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::graphics::composer3::vts
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp
index ee597a1..587c523 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp
@@ -41,6 +41,7 @@
     writer.setLayerTransform(mDisplay, mLayer, mTransform);
     writer.setLayerPlaneAlpha(mDisplay, mLayer, mAlpha);
     writer.setLayerBlendMode(mDisplay, mLayer, mBlendMode);
+    writer.setLayerWhitePointNits(mDisplay, mLayer, mWhitePointNits);
 }
 
 std::string ReadbackHelper::getColorModeString(ColorMode mode) {
@@ -103,6 +104,7 @@
             1.0f, 1.0f));
 
     layerSettings.geometry.positionTransform = scale * translation;
+    layerSettings.whitePointNits = mWhitePointNits;
 
     return layerSettings;
 }
@@ -175,18 +177,17 @@
     return true;
 }
 
-void ReadbackHelper::compareColorBuffers(std::vector<Color>& expectedColors, void* bufferData,
-                                         const int32_t stride, const uint32_t width,
+void ReadbackHelper::compareColorBuffers(const std::vector<Color>& expectedColors, void* bufferData,
+                                         const uint32_t stride, const uint32_t width,
                                          const uint32_t height, common::PixelFormat pixelFormat) {
     const int32_t bytesPerPixel = ReadbackHelper::GetBytesPerPixel(pixelFormat);
     ASSERT_NE(-1, bytesPerPixel);
     for (int row = 0; row < height; row++) {
         for (int col = 0; col < width; col++) {
             auto pixel = row * static_cast<int32_t>(width) + col;
-            int offset = (row * stride + col) * bytesPerPixel;
+            int offset = (row * static_cast<int32_t>(stride) + col) * bytesPerPixel;
             uint8_t* pixelColor = (uint8_t*)bufferData + offset;
             const Color expectedColor = expectedColors[static_cast<size_t>(pixel)];
-
             ASSERT_EQ(std::round(255.0f * expectedColor.r), pixelColor[0]);
             ASSERT_EQ(std::round(255.0f * expectedColor.g), pixelColor[1]);
             ASSERT_EQ(std::round(255.0f * expectedColor.b), pixelColor[2]);
@@ -195,13 +196,11 @@
 }
 
 ReadbackBuffer::ReadbackBuffer(int64_t display, const std::shared_ptr<IComposerClient>& client,
-                               const ::android::sp<::android::GraphicBuffer>& graphicBuffer,
                                int32_t width, int32_t height, common::PixelFormat pixelFormat,
                                common::Dataspace dataspace) {
     mDisplay = display;
 
     mComposerClient = client;
-    mGraphicBuffer = graphicBuffer;
 
     mPixelFormat = pixelFormat;
     mDataspace = dataspace;
@@ -235,19 +234,24 @@
 }
 
 void ReadbackBuffer::checkReadbackBuffer(std::vector<Color> expectedColors) {
+    ASSERT_NE(nullptr, mGraphicBuffer);
     // lock buffer for reading
     ndk::ScopedFileDescriptor fenceHandle;
     EXPECT_TRUE(mComposerClient->getReadbackBufferFence(mDisplay, &fenceHandle).isOk());
 
-    int outBytesPerPixel;
-    int outBytesPerStride;
+    int bytesPerPixel = -1;
+    int bytesPerStride = -1;
     void* bufData = nullptr;
-    auto status = mGraphicBuffer->lockAsync(mUsage, mAccessRegion, &bufData, fenceHandle.get(),
-                                            &outBytesPerPixel, &outBytesPerStride);
+
+    auto status = mGraphicBuffer->lockAsync(mUsage, mAccessRegion, &bufData, dup(fenceHandle.get()),
+                                            &bytesPerPixel, &bytesPerStride);
     EXPECT_EQ(::android::OK, status);
     ASSERT_TRUE(mPixelFormat == PixelFormat::RGB_888 || mPixelFormat == PixelFormat::RGBA_8888);
-    ReadbackHelper::compareColorBuffers(expectedColors, bufData, static_cast<int32_t>(mStride),
-                                        mWidth, mHeight, mPixelFormat);
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
+    ReadbackHelper::compareColorBuffers(expectedColors, bufData, stride, mWidth, mHeight,
+                                        mPixelFormat);
     status = mGraphicBuffer->unlock();
     EXPECT_EQ(::android::OK, status);
 }
@@ -303,10 +307,7 @@
     LayerSettings layerSettings = TestLayer::toRenderEngineLayerSettings();
     layerSettings.source.buffer.buffer =
             std::make_shared<::android::renderengine::impl::ExternalTexture>(
-                    ::android::sp<::android::GraphicBuffer>::make(
-                            mGraphicBuffer->handle, ::android::GraphicBuffer::CLONE_HANDLE, mWidth,
-                            mHeight, static_cast<int32_t>(mPixelFormat), 1, mUsage, mStride),
-                    mRenderEngine.getInternalRenderEngine(),
+                    mGraphicBuffer, mRenderEngine.getInternalRenderEngine(),
                     ::android::renderengine::impl::ExternalTexture::Usage::READABLE);
 
     layerSettings.source.buffer.usePremultipliedAlpha = mBlendMode == BlendMode::PREMULTIPLIED;
@@ -317,7 +318,7 @@
     const float translateY = mSourceCrop.top / (static_cast<float>(mHeight));
 
     layerSettings.source.buffer.textureTransform =
-            ::android::mat4::translate(::android::vec4(translateX, translateY, 0, 1)) *
+            ::android::mat4::translate(::android::vec4(translateX, translateY, 0, 1.0)) *
             ::android::mat4::scale(::android::vec4(scaleX, scaleY, 1.0, 1.0));
 
     return layerSettings;
@@ -325,9 +326,14 @@
 
 void TestBufferLayer::fillBuffer(std::vector<Color>& expectedColors) {
     void* bufData;
-    auto status = mGraphicBuffer->lock(mUsage, &bufData);
+    int32_t bytesPerPixel = -1;
+    int32_t bytesPerStride = -1;
+    auto status = mGraphicBuffer->lock(mUsage, &bufData, &bytesPerPixel, &bytesPerStride);
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
     EXPECT_EQ(::android::OK, status);
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBuffer(mWidth, mHeight, mStride, bufData,
+    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBuffer(mWidth, mHeight, stride, bufData,
                                                        mPixelFormat, expectedColors));
     EXPECT_EQ(::android::OK, mGraphicBuffer->unlock());
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp
index 6ff064f..0a55484 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp
@@ -77,13 +77,18 @@
     }
 }
 
-void TestRenderEngine::checkColorBuffer(std::vector<Color>& expectedColors) {
+void TestRenderEngine::checkColorBuffer(const std::vector<Color>& expectedColors) {
     void* bufferData;
-    ASSERT_EQ(0,
-              mGraphicBuffer->lock(static_cast<uint32_t>(mGraphicBuffer->getUsage()), &bufferData));
-    ReadbackHelper::compareColorBuffers(
-            expectedColors, bufferData, static_cast<int32_t>(mGraphicBuffer->getStride()),
-            mGraphicBuffer->getWidth(), mGraphicBuffer->getHeight(), mFormat);
+    int32_t bytesPerPixel = -1;
+    int32_t bytesPerStride = -1;
+    ASSERT_EQ(0, mGraphicBuffer->lock(static_cast<uint32_t>(mGraphicBuffer->getUsage()),
+                                      &bufferData, &bytesPerPixel, &bytesPerStride));
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
+    ReadbackHelper::compareColorBuffers(expectedColors, bufferData, stride,
+                                        mGraphicBuffer->getWidth(), mGraphicBuffer->getHeight(),
+                                        mFormat);
     ASSERT_EQ(::android::OK, mGraphicBuffer->unlock());
 }
 
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/GraphicsComposerCallback.h b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/GraphicsComposerCallback.h
index c359d5e..f25f36d 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/GraphicsComposerCallback.h
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/GraphicsComposerCallback.h
@@ -45,6 +45,10 @@
 
     int32_t getInvalidSeamlessPossibleCount() const;
 
+    int32_t getVsyncIdleCount() const;
+
+    int64_t getVsyncIdleTime() const;
+
     std::optional<VsyncPeriodChangeTimeline> takeLastVsyncPeriodChangeTimeline();
 
   private:
@@ -57,6 +61,7 @@
             int64_t in_display,
             const ::aidl::android::hardware::graphics::composer3::VsyncPeriodChangeTimeline&
                     in_updatedTimeline) override;
+    virtual ::ndk::ScopedAStatus onVsyncIdle(int64_t in_display) override;
 
     mutable std::mutex mMutex;
     // the set of all currently connected displays
@@ -66,6 +71,9 @@
 
     std::optional<VsyncPeriodChangeTimeline> mTimeline GUARDED_BY(mMutex);
 
+    int32_t mVsyncIdleCount GUARDED_BY(mMutex) = 0;
+    int64_t mVsyncIdleTime GUARDED_BY(mMutex) = 0;
+
     // track invalid callbacks
     int32_t mInvalidHotplugCount GUARDED_BY(mMutex) = 0;
     int32_t mInvalidRefreshCount GUARDED_BY(mMutex) = 0;
@@ -74,4 +82,4 @@
     int32_t mInvalidSeamlessPossibleCount GUARDED_BY(mMutex) = 0;
 };
 
-}  // namespace aidl::android::hardware::graphics::composer3::vts
\ No newline at end of file
+}  // namespace aidl::android::hardware::graphics::composer3::vts
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h
index 0fac2b3..a3ce795 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h
@@ -43,6 +43,10 @@
 
 static const Color BLACK = {0.0f, 0.0f, 0.0f, 1.0f};
 static const Color RED = {1.0f, 0.0f, 0.0f, 1.0f};
+// DIM_RED is 90% dimmed from RED in linear space
+// hard-code as value 243 in 8-bit space here, as calculating it requires
+// oetf(eotf(value) * .9), which is a complex non-linear transformation
+static const Color DIM_RED = {243.f / 255.f, 0.0f, 0.0f, 1.0f};
 static const Color TRANSLUCENT_RED = {1.0f, 0.0f, 0.0f, 0.3f};
 static const Color GREEN = {0.0f, 1.0f, 0.0f, 1.0f};
 static const Color BLUE = {0.0f, 0.0f, 1.0f, 1.0f};
@@ -67,6 +71,7 @@
     void setDisplayFrame(Rect frame) { mDisplayFrame = frame; }
     void setSourceCrop(FRect crop) { mSourceCrop = crop; }
     void setZOrder(uint32_t z) { mZOrder = z; }
+    void setWhitePointNits(float whitePointNits) { mWhitePointNits = whitePointNits; }
 
     void setSurfaceDamage(std::vector<Rect> surfaceDamage) {
         mSurfaceDamage = std::move(surfaceDamage);
@@ -84,10 +89,13 @@
 
     int64_t getLayer() const { return mLayer; }
 
+    float getWhitePointNits() const { return mWhitePointNits; }
+
   protected:
     int64_t mDisplay;
     int64_t mLayer;
     Rect mDisplayFrame = {0, 0, 0, 0};
+    float mWhitePointNits = -1.f;
     std::vector<Rect> mSurfaceDamage;
     Transform mTransform = static_cast<Transform>(0);
     FRect mSourceCrop = {0, 0, 0, 0};
@@ -153,7 +161,6 @@
     uint32_t mLayerCount;
     PixelFormat mPixelFormat;
     uint32_t mUsage;
-    uint32_t mStride;
     ::android::Rect mAccessRegion;
 };
 
@@ -181,15 +188,14 @@
     static const std::vector<ColorMode> colorModes;
     static const std::vector<Dataspace> dataspaces;
 
-    static void compareColorBuffers(std::vector<Color>& expectedColors, void* bufferData,
-                                    const int32_t stride, const uint32_t width,
+    static void compareColorBuffers(const std::vector<Color>& expectedColors, void* bufferData,
+                                    const uint32_t stride, const uint32_t width,
                                     const uint32_t height, PixelFormat pixelFormat);
 };
 
 class ReadbackBuffer {
   public:
-    ReadbackBuffer(int64_t display, const std::shared_ptr<IComposerClient>& client,
-                   const ::android::sp<::android::GraphicBuffer>& graphicBuffer, int32_t width,
+    ReadbackBuffer(int64_t display, const std::shared_ptr<IComposerClient>& client, int32_t width,
                    int32_t height, common::PixelFormat pixelFormat, common::Dataspace dataspace);
 
     void setReadbackBuffer();
@@ -203,7 +209,6 @@
     uint32_t mHeight;
     uint32_t mLayerCount;
     uint32_t mUsage;
-    uint32_t mStride;
     PixelFormat mPixelFormat;
     Dataspace mDataspace;
     int64_t mDisplay;
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h
index 2798e09..a776a27 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h
@@ -54,7 +54,7 @@
         mDisplaySettings = displaySettings;
     };
     void drawLayers();
-    void checkColorBuffer(std::vector<Color>& expectedColors);
+    void checkColorBuffer(const std::vector<Color>& expectedColors);
 
     ::android::renderengine::RenderEngine& getInternalRenderEngine() { return *mRenderEngine; }
 
diff --git a/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientReader.h b/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientReader.h
index f9e35e9..8f8c98f 100644
--- a/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientReader.h
+++ b/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientReader.h
@@ -77,6 +77,10 @@
                     parseSetClientTargetProperty(std::move(
                             result.get<CommandResultPayload::Tag::clientTargetProperty>()));
                     break;
+                case CommandResultPayload::Tag::bufferAheadResult:
+                    parseSetBufferAheadResultLayers(
+                            result.get<CommandResultPayload::Tag::bufferAheadResult>());
+                    break;
             }
         }
     }
@@ -168,6 +172,16 @@
         return std::move(data.clientTargetProperty);
     }
 
+    std::vector<BufferAheadResult::Layer> takeBufferAheadResultLayers(int64_t display) {
+        const auto found = mReturnData.find(display);
+
+        if (found == mReturnData.end()) {
+            return {};
+        }
+
+        return std::move(found->second.bufferAheadResultLayers);
+    }
+
   private:
     void resetData() {
         mErrors.clear();
@@ -206,12 +220,18 @@
         data.clientTargetProperty = std::move(clientTargetProperty);
     }
 
+    void parseSetBufferAheadResultLayers(const BufferAheadResult& bufferAheadResult) {
+        auto& data = mReturnData[bufferAheadResult.display];
+        data.bufferAheadResultLayers = std::move(bufferAheadResult.layers);
+    }
+
     struct ReturnData {
         DisplayRequest displayRequests;
         std::vector<ChangedCompositionLayer> changedLayers;
         ndk::ScopedFileDescriptor presentFence;
         std::vector<ReleaseFences::Layer> releasedLayers;
         PresentOrValidate::Result presentOrValidateState;
+        std::vector<BufferAheadResult::Layer> bufferAheadResultLayers;
 
         ClientTargetPropertyWithNits clientTargetProperty = {
                 .clientTargetProperty = {common::PixelFormat::RGBA_8888, Dataspace::UNKNOWN},
diff --git a/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h b/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h
index d3266e7..d429b76 100644
--- a/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h
+++ b/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h
@@ -131,6 +131,11 @@
         getLayerCommand(display, layer).buffer = getBuffer(slot, buffer, acquireFence);
     }
 
+    void setLayerBufferAhead(int64_t display, int64_t layer, uint32_t slot,
+                             const native_handle_t* buffer, int acquireFence) {
+        getLayerCommand(display, layer).bufferAhead = getBuffer(slot, buffer, acquireFence);
+    }
+
     void setLayerSurfaceDamage(int64_t display, int64_t layer, const std::vector<Rect>& damage) {
         getLayerCommand(display, layer).damage.emplace(damage.begin(), damage.end());
     }
diff --git a/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp b/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
index 2ab9c01..5e012f6 100644
--- a/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
+++ b/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
@@ -21,6 +21,7 @@
 #include <thread>
 #include <vector>
 
+#include <aidl/android/hardware/graphics/common/PixelFormat.h>
 #include <aidl/android/hardware/graphics/common/PlaneLayoutComponentType.h>
 
 #include <android-base/logging.h>
@@ -92,7 +93,13 @@
         ASSERT_NO_FATAL_FAILURE(bufferHandle = mGralloc->allocate(descriptorInfo, true));
 
         hidl_vec<uint8_t> vec;
-        ASSERT_EQ(Error::NONE, mGralloc->get(bufferHandle, metadataType, &vec));
+        const auto result = mGralloc->get(bufferHandle, metadataType, &vec);
+
+        if (metadataType == gralloc4::MetadataType_Smpte2094_10 && result == Error::UNSUPPORTED) {
+            GTEST_SKIP() << "getting metadata for Smpte2094-10 is unsupported";
+        }
+
+        ASSERT_EQ(Error::NONE, result);
 
         ASSERT_NO_FATAL_FAILURE(decode(descriptorInfo, vec));
     }
@@ -1205,6 +1212,40 @@
 }
 
 /**
+ * Test IMapper::isSupported with optional format R_8
+ */
+TEST_P(GraphicsMapperHidlTest, IsSupportedR8) {
+    auto info = mDummyDescriptorInfo;
+    info.format = static_cast<android::hardware::graphics::common::V1_2::PixelFormat>(
+            aidl::android::hardware::graphics::common::PixelFormat::R_8);
+    bool supported = false;
+
+    ASSERT_NO_FATAL_FAILURE(supported = mGralloc->isSupported(info));
+
+    if (!supported) {
+        GTEST_SUCCEED() << "R_8 is optional; unsupported so skipping allocation test";
+        return;
+    }
+
+    BufferDescriptor descriptor;
+    ASSERT_NO_FATAL_FAILURE(descriptor = mGralloc->createDescriptor(info));
+
+    constexpr uint32_t count = 1;
+    std::vector<const native_handle_t*> bufferHandles;
+    uint32_t stride;
+    ASSERT_NO_FATAL_FAILURE(bufferHandles =
+                                    mGralloc->allocate(descriptor, count, false,
+                                                       Tolerance::kToleranceStrict, &stride));
+
+    EXPECT_LE(info.width, stride) << "invalid buffer stride";
+    EXPECT_EQ(1u, bufferHandles.size());
+
+    for (auto bufferHandle : bufferHandles) {
+        mGralloc->freeBuffer(bufferHandle);
+    }
+}
+
+/**
  * Test IMapper::get(BufferId)
  */
 TEST_P(GraphicsMapperHidlTest, GetBufferId) {
diff --git a/health/aidl/README.md b/health/aidl/README.md
index a64fe93..54d6758 100644
--- a/health/aidl/README.md
+++ b/health/aidl/README.md
@@ -60,7 +60,11 @@
 [android.hardware.health-service.example.rc](default/android.hardware.health-service.example.rc).
 Specifically:
 
-* You may ignore the `service` line. The name of the service does not matter.
+* For the `service` line, if the name of the service is **NOT**
+  `vendor.charger`, and there are actions
+  in the rc file triggered by `on property:init.svc.<name>=running` where
+  `<name>` is the name of your charger service, then you need a custom health
+  AIDL service.
 * If your service belongs to additional classes beside `charger`, you need a
   custom health AIDL service.
 * Modify the `seclabel` line. Replace `charger` with `charger_vendor`.
@@ -232,13 +236,19 @@
 It is recommended that you move the existing `service` entry with
 `class charger` to the `init.rc` file in your custom health service.
 
+If there are existing actions in the rc file triggered by
+`on property:init.svc.<name>=running`, where `<name>` is the name of your
+existing charger service (usually `vendor.charger`), then the name of the
+service must be kept as-is. If you modify the name of the service, the actions
+are not triggered properly.
+
 Modify the entry to invoke the health service binary with `--charger` argument.
 See
 [android.hardware.health-service.example.rc](default/android.hardware.health-service.example.rc)
 for an example:
 
 ```text
-service vendor.charger-tuna /vendor/bin/hw/android.hardware.health-service-tuna --charger
+service vendor.charger /vendor/bin/hw/android.hardware.health-service-tuna --charger
     class charger
     seclabel u:r:charger_vendor:s0
     # ...
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
index 34a87a6..97d9e84 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
@@ -37,6 +37,7 @@
   boolean chargerAcOnline;
   boolean chargerUsbOnline;
   boolean chargerWirelessOnline;
+  boolean chargerDockOnline;
   int maxChargingCurrentMicroamps;
   int maxChargingVoltageMicrovolts;
   android.hardware.health.BatteryStatus batteryStatus;
diff --git a/health/aidl/android/hardware/health/HealthInfo.aidl b/health/aidl/android/hardware/health/HealthInfo.aidl
index 504e218..5b98baf 100644
--- a/health/aidl/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/android/hardware/health/HealthInfo.aidl
@@ -40,6 +40,10 @@
      */
     boolean chargerWirelessOnline;
     /**
+     * Dock charger state - 'true' if online
+     */
+    boolean chargerDockOnline;
+    /**
      * Maximum charging current supported by charger in µA
      */
     int maxChargingCurrentMicroamps;
diff --git a/health/aidl/default/HalHealthLoop.cpp b/health/aidl/default/HalHealthLoop.cpp
index c9a081e..ec23c10 100644
--- a/health/aidl/default/HalHealthLoop.cpp
+++ b/health/aidl/default/HalHealthLoop.cpp
@@ -61,7 +61,7 @@
 
 void HalHealthLoop::set_charger_online(const HealthInfo& health_info) {
     charger_online_ = health_info.chargerAcOnline || health_info.chargerUsbOnline ||
-                      health_info.chargerWirelessOnline;
+                      health_info.chargerWirelessOnline || health_info.chargerDockOnline;
 }
 
 }  // namespace aidl::android::hardware::health
diff --git a/health/aidl/default/android.hardware.health-service.example.rc b/health/aidl/default/android.hardware.health-service.example.rc
index 4258890..e052024 100644
--- a/health/aidl/default/android.hardware.health-service.example.rc
+++ b/health/aidl/default/android.hardware.health-service.example.rc
@@ -5,7 +5,7 @@
     capabilities WAKE_ALARM BLOCK_SUSPEND
     file /dev/kmsg w
 
-service vendor.charger-default /vendor/bin/hw/android.hardware.health-service.example --charger
+service vendor.charger /vendor/bin/hw/android.hardware.health-service.example --charger
     class charger
     seclabel u:r:charger_vendor:s0
     user system
diff --git a/health/aidl/default/health-convert.cpp b/health/aidl/default/health-convert.cpp
index b5251f4..6118865 100644
--- a/health/aidl/default/health-convert.cpp
+++ b/health/aidl/default/health-convert.cpp
@@ -22,6 +22,7 @@
     p->chargerAcOnline = info.chargerAcOnline;
     p->chargerUsbOnline = info.chargerUsbOnline;
     p->chargerWirelessOnline = info.chargerWirelessOnline;
+    p->chargerDockOnline = info.chargerDockOnline;
     p->maxChargingCurrent = info.maxChargingCurrentMicroamps;
     p->maxChargingVoltage = info.maxChargingVoltageMicrovolts;
     p->batteryStatus = static_cast<int>(info.batteryStatus);
diff --git a/identity/aidl/Android.bp b/identity/aidl/Android.bp
index dad3b8d..e3b8191 100644
--- a/identity/aidl/Android.bp
+++ b/identity/aidl/Android.bp
@@ -15,6 +15,7 @@
     ],
     imports: [
         "android.hardware.keymaster",
+        "android.hardware.security.keymint",
     ],
     stability: "vintf",
     backend: {
@@ -25,6 +26,7 @@
             vndk: {
                 enabled: true,
             },
+            apps_enabled: false,
         },
     },
     versions: [
diff --git a/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/HardwareInformation.aidl b/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/HardwareInformation.aidl
index cd8d56b..9b96ea8 100644
--- a/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/HardwareInformation.aidl
+++ b/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/HardwareInformation.aidl
@@ -39,4 +39,5 @@
   int dataChunkSize;
   boolean isDirectAccess;
   @utf8InCpp String[] supportedDocTypes;
+  boolean isRemoteKeyProvisioningSupported = false;
 }
diff --git a/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IIdentityCredentialStore.aidl b/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IIdentityCredentialStore.aidl
index c912c52..31ca8b1 100644
--- a/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IIdentityCredentialStore.aidl
+++ b/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IIdentityCredentialStore.aidl
@@ -38,6 +38,7 @@
   android.hardware.identity.IWritableIdentityCredential createCredential(in @utf8InCpp String docType, in boolean testCredential);
   android.hardware.identity.IIdentityCredential getCredential(in android.hardware.identity.CipherSuite cipherSuite, in byte[] credentialData);
   android.hardware.identity.IPresentationSession createPresentationSession(in android.hardware.identity.CipherSuite cipherSuite);
+  android.hardware.security.keymint.IRemotelyProvisionedComponent getRemotelyProvisionedComponent();
   const int STATUS_OK = 0;
   const int STATUS_FAILED = 1;
   const int STATUS_CIPHER_SUITE_NOT_SUPPORTED = 2;
diff --git a/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IWritableIdentityCredential.aidl b/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IWritableIdentityCredential.aidl
index 9a0fa9e..5377349 100644
--- a/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IWritableIdentityCredential.aidl
+++ b/identity/aidl/aidl_api/android.hardware.identity/current/android/hardware/identity/IWritableIdentityCredential.aidl
@@ -41,4 +41,5 @@
   byte[] addEntryValue(in byte[] content);
   @SuppressWarnings(value={"out-array"}) void finishAddingEntries(out byte[] credentialData, out byte[] proofOfProvisioningSignature);
   void setExpectedProofOfProvisioningSize(in int expectedProofOfProvisioningSize);
+  void setRemotelyProvisionedAttestationKey(in byte[] attestationKeyBlob, in byte[] attestationCertificate);
 }
diff --git a/identity/aidl/android/hardware/identity/HardwareInformation.aidl b/identity/aidl/android/hardware/identity/HardwareInformation.aidl
index d67739d..acd13b6 100644
--- a/identity/aidl/android/hardware/identity/HardwareInformation.aidl
+++ b/identity/aidl/android/hardware/identity/HardwareInformation.aidl
@@ -51,4 +51,19 @@
      *
      */
     @utf8InCpp String[] supportedDocTypes;
+
+    /**
+     * isRemoteKeyProvisioningSupported indicates whether or not the underlying implementation
+     * supports a remotely provisioned key for attestation or not. If this field is false, then
+     * the implementation only uses a factory-installed, fixed attestation key. If this field is
+     * true, then an IRemotelyProvisionedComponent is associated with the IIdentityCredentialStore,
+     * and a remotely provisioned key blob may be provided for credential key attestation.
+     *
+     * Note that remote provisioning is not required, even when it is supported. Implementations
+     * MUST use a factory-installed attestation key as a fallback for when there are no
+     * remotely provisioned keys available. This behavior mirrors keystore key attestation.
+     *
+     * This field was added in API version 4.
+     */
+    boolean isRemoteKeyProvisioningSupported = false;
 }
diff --git a/identity/aidl/android/hardware/identity/IIdentityCredentialStore.aidl b/identity/aidl/android/hardware/identity/IIdentityCredentialStore.aidl
index 86be7f5..d3e4da0 100644
--- a/identity/aidl/android/hardware/identity/IIdentityCredentialStore.aidl
+++ b/identity/aidl/android/hardware/identity/IIdentityCredentialStore.aidl
@@ -21,6 +21,7 @@
 import android.hardware.identity.IIdentityCredential;
 import android.hardware.identity.IPresentationSession;
 import android.hardware.identity.IWritableIdentityCredential;
+import android.hardware.security.keymint.IRemotelyProvisionedComponent;
 
 /**
  * IIdentityCredentialStore provides an interface to a secure store for user identity documents.
@@ -215,16 +216,16 @@
      * @return an IWritableIdentityCredential interface that provides operations to
      *     provision a credential.
      */
-    IWritableIdentityCredential createCredential(in @utf8InCpp String docType,
-                                                 in boolean testCredential);
+    IWritableIdentityCredential createCredential(
+            in @utf8InCpp String docType, in boolean testCredential);
 
     /**
      * getCredential retrieves an IIdentityCredential interface which allows use of a stored
      * Credential.
      *
-     * The cipher suite used to communicate with the remote verifier must also be specified. Currently
-     * only a single cipher-suite is supported. Support for other cipher suites may be added in a
-     * future version of this HAL.
+     * The cipher suite used to communicate with the remote verifier must also be specified.
+     * Currently only a single cipher-suite is supported. Support for other cipher suites may be
+     * added in a future version of this HAL.
      *
      * This method fails with STATUS_INVALID_DATA if the passed in credentialData cannot be
      * decoded or decrypted.
@@ -263,4 +264,23 @@
      * @return an IPresentationSession interface.
      */
     IPresentationSession createPresentationSession(in CipherSuite cipherSuite);
+
+    /**
+     * Fetch the IRemotelyProvisionedComponent that is used to generate attestation keys for
+     * remote provisionining. Keys generated by this component are to be certified by a remote
+     * provisionined authority, then used to attest to credential keys via
+     * IWritableIdentityCredential.setRemotelyProvisionedAttestationKey.
+     *
+     * Support for this method is indicated by HardwareInformation. If the
+     * |isRemoteKeyProvisioningSupported| field is false, this method will fail with
+     * EX_UNSUPPORTED_OPERATION.
+     *
+     * This method was added in API version 4.
+     *
+     * @see
+     *         android.hardware.identity.IWritableIdentityCredential#setRemotelyProvisionedAttestationKey
+     *
+     * @return an IRemotelyProvisionedComponent that is used to generate attestation keys.
+     */
+    IRemotelyProvisionedComponent getRemotelyProvisionedComponent();
 }
diff --git a/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl b/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
index 22bcf61..756b008 100644
--- a/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
+++ b/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
@@ -131,7 +131,8 @@
      *
      * @return the X.509 certificate chain for the credentialKey
      */
-    Certificate[] getAttestationCertificate(in byte[] attestationApplicationId, in byte[] attestationChallenge);
+    Certificate[] getAttestationCertificate(
+            in byte[] attestationApplicationId, in byte[] attestationChallenge);
 
     /**
      * Start the personalization process.
@@ -183,11 +184,11 @@
      *     in the secure environment. If this requirement is not met the call fails with
      *     STATUS_INVALID_DATA.
      *
-     * @return a structure with the passed-in data and MAC created with storageKey for authenticating
-     *     the data at a later point in time.
+     * @return a structure with the passed-in data and MAC created with storageKey for
+     *     authenticating the data at a later point in time.
      */
     SecureAccessControlProfile addAccessControlProfile(in int id, in Certificate readerCertificate,
-        in boolean userAuthenticationRequired, in long timeoutMillis, in long secureUserId);
+            in boolean userAuthenticationRequired, in long timeoutMillis, in long secureUserId);
 
     /**
      * Begins the process of adding an entry to the credential.  All access control profiles must be
@@ -209,7 +210,7 @@
      *     is not met this method fails with STATUS_INVALID_DATA.
      */
     void beginAddEntry(in int[] accessControlProfileIds, in @utf8InCpp String nameSpace,
-        in @utf8InCpp String name, in int entrySize);
+            in @utf8InCpp String name, in int entrySize);
 
     /**
      * Continues the process of adding an entry, providing a value or part of a value.
@@ -221,8 +222,8 @@
      * chunk sizes must equal the value of the beginAddEntry() entrySize argument. If this
      * requirement is not met the call fails with STATUS_INVALID_DATA.
      *
-     * @param content is the entry value, encoded as CBOR. In the case the content exceeds gcmChunkSize,
-     *     this may be partial content up to gcmChunkSize bytes long.
+     * @param content is the entry value, encoded as CBOR. In the case the content exceeds
+     *     gcmChunkSize, this may be partial content up to gcmChunkSize bytes long.
      *
      * @return the encrypted and MACed content.  For directly-available credentials the contents are
      *     implementation-defined. For other credentials, the result contains
@@ -321,8 +322,7 @@
      *          }
      */
     @SuppressWarnings(value={"out-array"})
-    void finishAddingEntries(out byte[] credentialData,
-        out byte[] proofOfProvisioningSignature);
+    void finishAddingEntries(out byte[] credentialData, out byte[] proofOfProvisioningSignature);
 
     /**
      * Sets the expected size of the ProofOfProvisioning returned by finishAddingEntries(). This
@@ -336,4 +336,35 @@
      */
     void setExpectedProofOfProvisioningSize(in int expectedProofOfProvisioningSize);
 
+    /**
+     * Sets the attestation key used to sign the credentialKey certificate. This method is used to
+     * support remotely provisioned attestation keys, removing the credential's dependency on any
+     * factory-provisioned attestation key.
+     *
+     * This method must be called before getAttestationCertificate. After this method is called,
+     * the certificate chain returned by getAttestationCertificate will contain a leaf certificate
+     * signed by attestationKeyBlob and the chain in attestationCertificate will make up the rest
+     * of the returned chain.
+     *
+     * Returns EX_UNSUPPORTED_FUNCTION if remote provisioning is not supported
+     * (see IIdentityCredentialStore.getHardwareInformation()).
+     *
+     * This method was added in API version 4.
+     *
+     * @param attestationKeyBlob is a key blob generated by the IRemotelyProvisionedComponent that
+     *     is returned by ICredentialStore.getRemotelyProvisionedComponent. The format is vendor-
+     *     specified, and matches the key blob returned by IKeyMintDevice.generateKey.
+     *
+     * @param attestationCertificate contains the X.509 certificate chain that certifies the
+     *     attestationKeyBlob. This certificate is expected to have been remotely provisioned
+     *     by a trusted authority. This parameter must contain a concatenated chain of DER-encoded
+     *     X.509 certificates. The certificates must be ordered such that the attestation key
+     *     certificate is first (starting at byte 0). The issuer certificate for the attestation
+     *     certificate immediately follows, continuing this chain to the final, root certificate.
+     *
+     * @see getAttestationCertificate
+     * @see android.hardware.identity.ICredentialStore#getRemotelyProvisionedComponent
+     */
+    void setRemotelyProvisionedAttestationKey(
+            in byte[] attestationKeyBlob, in byte[] attestationCertificate);
 }
diff --git a/identity/aidl/default/Android.bp b/identity/aidl/default/Android.bp
index ca24afa..32b3543 100644
--- a/identity/aidl/default/Android.bp
+++ b/identity/aidl/default/Android.bp
@@ -42,6 +42,7 @@
         "android.hardware.identity-support-lib",
         "android.hardware.identity-V4-ndk",
         "android.hardware.keymaster-V4-ndk",
+        "android.hardware.security.keymint-V2-ndk",
     ],
 }
 
@@ -81,6 +82,9 @@
     init_rc: ["identity-default.rc"],
     vintf_fragments: ["identity-default.xml"],
     vendor: true,
+    defaults: [
+        "keymint_use_latest_hal_aidl_ndk_static",
+    ],
     cflags: [
         "-Wall",
         "-Wextra",
diff --git a/identity/aidl/default/EicOpsImpl.cc b/identity/aidl/default/EicOpsImpl.cc
index c98a91e..3fd9f1d 100644
--- a/identity/aidl/default/EicOpsImpl.cc
+++ b/identity/aidl/default/EicOpsImpl.cc
@@ -267,25 +267,42 @@
 
 bool eicOpsCreateCredentialKey(uint8_t privateKey[EIC_P256_PRIV_KEY_SIZE], const uint8_t* challenge,
                                size_t challengeSize, const uint8_t* applicationId,
-                               size_t applicationIdSize, bool testCredential, uint8_t* cert,
-                               size_t* certSize) {
-    vector<uint8_t> challengeVec(challengeSize);
-    memcpy(challengeVec.data(), challenge, challengeSize);
-
-    vector<uint8_t> applicationIdVec(applicationIdSize);
-    memcpy(applicationIdVec.data(), applicationId, applicationIdSize);
-
-    optional<std::pair<vector<uint8_t>, vector<vector<uint8_t>>>> ret =
-            android::hardware::identity::support::createEcKeyPairAndAttestation(
-                    challengeVec, applicationIdVec, testCredential);
-    if (!ret) {
-        eicDebug("Error generating CredentialKey and attestation");
-        return false;
+                               size_t applicationIdSize, bool testCredential,
+                               const uint8_t* attestationKeyBlob, size_t attestationKeyBlobSize,
+                               const uint8_t* attestationKeyCert, size_t attestationKeyCertSize,
+                               uint8_t* cert, size_t* certSize) {
+    vector<uint8_t> flatChain;
+    vector<uint8_t> keyPair;
+    vector<uint8_t> challengeVec(challenge, challenge + challengeSize);
+    vector<uint8_t> applicationIdVec(applicationId, applicationId + applicationIdSize);
+    if (attestationKeyBlob && attestationKeyBlobSize > 0 && attestationKeyCert &&
+        attestationKeyCertSize > 0) {
+        vector<uint8_t> attestationKeyBlobVec(attestationKeyBlob,
+                                              attestationKeyBlob + attestationKeyBlobSize);
+        vector<uint8_t> attestationKeyCertVec(attestationKeyCert,
+                                              attestationKeyCert + attestationKeyCertSize);
+        optional<std::pair<vector<uint8_t>, vector<uint8_t>>> keyAndCert =
+                android::hardware::identity::support::createEcKeyPairWithAttestationKey(
+                        challengeVec, applicationIdVec, attestationKeyBlobVec,
+                        attestationKeyCertVec, testCredential);
+        if (!keyAndCert) {
+            eicDebug("Error generating CredentialKey and attestation");
+            return false;
+        }
+        keyPair = std::move(keyAndCert->first);
+        flatChain = std::move(keyAndCert->second);
+    } else {
+        optional<std::pair<vector<uint8_t>, vector<vector<uint8_t>>>> ret =
+                android::hardware::identity::support::createEcKeyPairAndAttestation(
+                        challengeVec, applicationIdVec, testCredential);
+        if (!ret) {
+            eicDebug("Error generating CredentialKey and attestation");
+            return false;
+        }
+        keyPair = std::move(ret->first);
+        flatChain = android::hardware::identity::support::certificateChainJoin(ret->second);
     }
 
-    // Extract certificate chain.
-    vector<uint8_t> flatChain =
-            android::hardware::identity::support::certificateChainJoin(ret.value().second);
     if (*certSize < flatChain.size()) {
         eicDebug("Buffer for certificate is only %zd bytes long, need %zd bytes", *certSize,
                  flatChain.size());
@@ -296,7 +313,7 @@
 
     // Extract private key.
     optional<vector<uint8_t>> privKey =
-            android::hardware::identity::support::ecKeyPairGetPrivateKey(ret.value().first);
+            android::hardware::identity::support::ecKeyPairGetPrivateKey(keyPair);
     if (!privKey) {
         eicDebug("Error extracting private key");
         return false;
@@ -520,10 +537,12 @@
 #ifdef EIC_DEBUG
 
 void eicPrint(const char* format, ...) {
+    char buf[1024];
     va_list args;
     va_start(args, format);
-    vfprintf(stderr, format, args);
+    vsnprintf(buf, sizeof(buf), format, args);
     va_end(args);
+    LOG(INFO) << buf;
 }
 
 void eicHexdump(const char* message, const uint8_t* data, size_t dataSize) {
diff --git a/identity/aidl/default/FakeSecureHardwareProxy.cpp b/identity/aidl/default/FakeSecureHardwareProxy.cpp
index 91e634c..9b9a749 100644
--- a/identity/aidl/default/FakeSecureHardwareProxy.cpp
+++ b/identity/aidl/default/FakeSecureHardwareProxy.cpp
@@ -155,7 +155,11 @@
     size_t publicKeyCertSize = sizeof publicKeyCert;
     if (!eicProvisioningCreateCredentialKey(&ctx_, challenge.data(), challenge.size(),
                                             applicationId.data(), applicationId.size(),
-                                            publicKeyCert, &publicKeyCertSize)) {
+                                            /*attestationKeyBlob=*/nullptr,
+                                            /*attestationKeyBlobSize=*/0,
+                                            /*attestationKeyCert=*/nullptr,
+                                            /*attestationKeyCertSize=*/0, publicKeyCert,
+                                            &publicKeyCertSize)) {
         return std::nullopt;
     }
     vector<uint8_t> pubKeyCert(publicKeyCertSize);
@@ -163,6 +167,23 @@
     return pubKeyCert;
 }
 
+optional<vector<uint8_t>> FakeSecureHardwareProvisioningProxy::createCredentialKeyUsingRkp(
+        const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
+        const vector<uint8_t>& attestationKeyBlob, const vector<uint8_t>& attstationKeyCert) {
+    size_t publicKeyCertSize = 4096;
+    vector<uint8_t> publicKeyCert(publicKeyCertSize);
+    if (!eicProvisioningCreateCredentialKey(&ctx_, challenge.data(), challenge.size(),
+                                            applicationId.data(), applicationId.size(),
+                                            attestationKeyBlob.data(), attestationKeyBlob.size(),
+                                            attstationKeyCert.data(), attstationKeyCert.size(),
+                                            publicKeyCert.data(), &publicKeyCertSize)) {
+        LOG(ERROR) << "error creating credential key";
+        return std::nullopt;
+    }
+    publicKeyCert.resize(publicKeyCertSize);
+    return publicKeyCert;
+}
+
 bool FakeSecureHardwareProvisioningProxy::startPersonalization(
         int accessControlProfileCount, const vector<int>& entryCounts, const string& docType,
         size_t expectedProofOfProvisioningSize) {
diff --git a/identity/aidl/default/FakeSecureHardwareProxy.h b/identity/aidl/default/FakeSecureHardwareProxy.h
index df98c7a..2512074 100644
--- a/identity/aidl/default/FakeSecureHardwareProxy.h
+++ b/identity/aidl/default/FakeSecureHardwareProxy.h
@@ -43,6 +43,11 @@
     optional<vector<uint8_t>> createCredentialKey(const vector<uint8_t>& challenge,
                                                   const vector<uint8_t>& applicationId) override;
 
+    optional<vector<uint8_t>> createCredentialKeyUsingRkp(
+            const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
+            const vector<uint8_t>& attestationKeyBlob,
+            const vector<uint8_t>& attestationKeyCert) override;
+
     bool startPersonalization(int accessControlProfileCount, const vector<int>& entryCounts,
                               const string& docType,
                               size_t expectedProofOfProvisioningSize) override;
diff --git a/identity/aidl/default/common/IdentityCredential.cpp b/identity/aidl/default/common/IdentityCredential.cpp
index 7678ecb..ff80752 100644
--- a/identity/aidl/default/common/IdentityCredential.cpp
+++ b/identity/aidl/default/common/IdentityCredential.cpp
@@ -1012,8 +1012,8 @@
                 IIdentityCredentialStore::STATUS_FAILED, "Error creating provisioning proxy"));
     }
     shared_ptr<WritableIdentityCredential> wc =
-            ndk::SharedRefBase::make<WritableIdentityCredential>(provisioningHwProxy, docType_,
-                                                                 testCredential_);
+            ndk::SharedRefBase::make<WritableIdentityCredential>(
+                    provisioningHwProxy, docType_, testCredential_, hardwareInformation_);
     if (!wc->initializeForUpdate(encryptedCredentialKeys_)) {
         return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                 IIdentityCredentialStore::STATUS_FAILED,
diff --git a/identity/aidl/default/common/IdentityCredential.h b/identity/aidl/default/common/IdentityCredential.h
index 2935fb8..5929829 100644
--- a/identity/aidl/default/common/IdentityCredential.h
+++ b/identity/aidl/default/common/IdentityCredential.h
@@ -48,11 +48,13 @@
   public:
     IdentityCredential(sp<SecureHardwareProxyFactory> hwProxyFactory,
                        const vector<uint8_t>& credentialData,
-                       std::shared_ptr<PresentationSession> session)
+                       std::shared_ptr<PresentationSession> session,
+                       HardwareInformation hardwareInformation)
         : hwProxyFactory_(hwProxyFactory),
           credentialData_(credentialData),
           session_(std::move(session)),
           numStartRetrievalCalls_(0),
+          hardwareInformation_(std::move(hardwareInformation)),
           expectedDeviceNameSpacesSize_(0) {}
 
     // Parses and decrypts credentialData_, return a status code from
@@ -103,6 +105,7 @@
     vector<uint8_t> credentialData_;
     shared_ptr<PresentationSession> session_;
     int numStartRetrievalCalls_;
+    HardwareInformation hardwareInformation_;
 
     // Set by initialize()
     string docType_;
diff --git a/identity/aidl/default/common/IdentityCredentialStore.cpp b/identity/aidl/default/common/IdentityCredentialStore.cpp
index 4703ffe..bbc2cef 100644
--- a/identity/aidl/default/common/IdentityCredentialStore.cpp
+++ b/identity/aidl/default/common/IdentityCredentialStore.cpp
@@ -17,6 +17,7 @@
 #define LOG_TAG "IdentityCredentialStore"
 
 #include <android-base/logging.h>
+#include <android/binder_manager.h>
 
 #include "IdentityCredential.h"
 #include "IdentityCredentialStore.h"
@@ -25,15 +26,24 @@
 
 namespace aidl::android::hardware::identity {
 
+using ::aidl::android::hardware::security::keymint::IRemotelyProvisionedComponent;
+
+IdentityCredentialStore::IdentityCredentialStore(sp<SecureHardwareProxyFactory> hwProxyFactory,
+                                                 optional<string> remotelyProvisionedComponent)
+    : hwProxyFactory_(hwProxyFactory),
+      remotelyProvisionedComponentName_(remotelyProvisionedComponent) {
+    hardwareInformation_.credentialStoreName = "Identity Credential Reference Implementation";
+    hardwareInformation_.credentialStoreAuthorName = "Google";
+    hardwareInformation_.dataChunkSize = kGcmChunkSize;
+    hardwareInformation_.isDirectAccess = false;
+    hardwareInformation_.supportedDocTypes = {};
+    hardwareInformation_.isRemoteKeyProvisioningSupported =
+            remotelyProvisionedComponentName_.has_value();
+}
+
 ndk::ScopedAStatus IdentityCredentialStore::getHardwareInformation(
         HardwareInformation* hardwareInformation) {
-    HardwareInformation hw;
-    hw.credentialStoreName = "Identity Credential Reference Implementation";
-    hw.credentialStoreAuthorName = "Google";
-    hw.dataChunkSize = kGcmChunkSize;
-    hw.isDirectAccess = false;
-    hw.supportedDocTypes = {};
-    *hardwareInformation = hw;
+    *hardwareInformation = hardwareInformation_;
     return ndk::ScopedAStatus::ok();
 }
 
@@ -42,7 +52,8 @@
         shared_ptr<IWritableIdentityCredential>* outWritableCredential) {
     sp<SecureHardwareProvisioningProxy> hwProxy = hwProxyFactory_->createProvisioningProxy();
     shared_ptr<WritableIdentityCredential> wc =
-            ndk::SharedRefBase::make<WritableIdentityCredential>(hwProxy, docType, testCredential);
+            ndk::SharedRefBase::make<WritableIdentityCredential>(hwProxy, docType, testCredential,
+                                                                 hardwareInformation_);
     if (!wc->initialize()) {
         return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                 IIdentityCredentialStore::STATUS_FAILED,
@@ -63,7 +74,7 @@
     }
 
     shared_ptr<IdentityCredential> credential = ndk::SharedRefBase::make<IdentityCredential>(
-            hwProxyFactory_, credentialData, nullptr /* session */);
+            hwProxyFactory_, credentialData, nullptr /* session */, hardwareInformation_);
     auto ret = credential->initialize();
     if (ret != IIdentityCredentialStore::STATUS_OK) {
         return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
@@ -83,8 +94,8 @@
     }
 
     sp<SecureHardwareSessionProxy> hwProxy = hwProxyFactory_->createSessionProxy();
-    shared_ptr<PresentationSession> session =
-            ndk::SharedRefBase::make<PresentationSession>(hwProxyFactory_, hwProxy);
+    shared_ptr<PresentationSession> session = ndk::SharedRefBase::make<PresentationSession>(
+            hwProxyFactory_, hwProxy, hardwareInformation_);
     auto ret = session->initialize();
     if (ret != IIdentityCredentialStore::STATUS_OK) {
         return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
@@ -94,4 +105,23 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus IdentityCredentialStore::getRemotelyProvisionedComponent(
+        shared_ptr<IRemotelyProvisionedComponent>* outRemotelyProvisionedComponent) {
+    if (!remotelyProvisionedComponentName_) {
+        return ndk::ScopedAStatus(AStatus_fromExceptionCodeWithMessage(
+                EX_UNSUPPORTED_OPERATION, "Remote key provisioning is not supported"));
+    }
+
+    ndk::SpAIBinder binder(
+            AServiceManager_waitForService(remotelyProvisionedComponentName_->c_str()));
+    if (binder.get() == nullptr) {
+        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
+                IIdentityCredentialStore::STATUS_FAILED,
+                "Unable to get remotely provisioned component"));
+    }
+
+    *outRemotelyProvisionedComponent = IRemotelyProvisionedComponent::fromBinder(binder);
+    return ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::identity
diff --git a/identity/aidl/default/common/IdentityCredentialStore.h b/identity/aidl/default/common/IdentityCredentialStore.h
index 77b894d..dd1261b 100644
--- a/identity/aidl/default/common/IdentityCredentialStore.h
+++ b/identity/aidl/default/common/IdentityCredentialStore.h
@@ -18,6 +18,7 @@
 #define ANDROID_HARDWARE_IDENTITY_IDENTITYCREDENTIALSTORE_H
 
 #include <aidl/android/hardware/identity/BnIdentityCredentialStore.h>
+#include <aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.h>
 
 #include "SecureHardwareProxy.h"
 
@@ -25,14 +26,18 @@
 
 using ::android::sp;
 using ::android::hardware::identity::SecureHardwareProxyFactory;
+using ::std::optional;
 using ::std::shared_ptr;
 using ::std::string;
 using ::std::vector;
 
 class IdentityCredentialStore : public BnIdentityCredentialStore {
   public:
-    IdentityCredentialStore(sp<SecureHardwareProxyFactory> hwProxyFactory)
-        : hwProxyFactory_(hwProxyFactory) {}
+    // If remote key provisioning is supported, pass the service name for the correct
+    // IRemotelyProvisionedComponent to the remotelyProvisionedComponent parameter. Else
+    // pass std::nullopt to indicate remote key provisioning is not supported.
+    IdentityCredentialStore(sp<SecureHardwareProxyFactory> hwProxyFactory,
+                            optional<string> remotelyProvisionedComponent);
 
     // The GCM chunk size used by this implementation is 64 KiB.
     static constexpr size_t kGcmChunkSize = 64 * 1024;
@@ -50,8 +55,14 @@
     ndk::ScopedAStatus createPresentationSession(
             CipherSuite cipherSuite, shared_ptr<IPresentationSession>* outSession) override;
 
+    ndk::ScopedAStatus getRemotelyProvisionedComponent(
+            shared_ptr<::aidl::android::hardware::security::keymint::IRemotelyProvisionedComponent>*
+                    outRemotelyProvisionedComponent) override;
+
   private:
     sp<SecureHardwareProxyFactory> hwProxyFactory_;
+    optional<string> remotelyProvisionedComponentName_;
+    HardwareInformation hardwareInformation_;
 };
 
 }  // namespace aidl::android::hardware::identity
diff --git a/identity/aidl/default/common/PresentationSession.cpp b/identity/aidl/default/common/PresentationSession.cpp
index fbd8972..2eb7f2e 100644
--- a/identity/aidl/default/common/PresentationSession.cpp
+++ b/identity/aidl/default/common/PresentationSession.cpp
@@ -122,8 +122,8 @@
 ndk::ScopedAStatus PresentationSession::getCredential(
         const vector<uint8_t>& credentialData, shared_ptr<IIdentityCredential>* outCredential) {
     shared_ptr<PresentationSession> p = ref<PresentationSession>();
-    shared_ptr<IdentityCredential> credential =
-            ndk::SharedRefBase::make<IdentityCredential>(hwProxyFactory_, credentialData, p);
+    shared_ptr<IdentityCredential> credential = ndk::SharedRefBase::make<IdentityCredential>(
+            hwProxyFactory_, credentialData, p, hardwareInformation_);
     int ret = credential->initialize();
     if (ret != IIdentityCredentialStore::STATUS_OK) {
         return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
diff --git a/identity/aidl/default/common/PresentationSession.h b/identity/aidl/default/common/PresentationSession.h
index 76ca67b..4cb174a 100644
--- a/identity/aidl/default/common/PresentationSession.h
+++ b/identity/aidl/default/common/PresentationSession.h
@@ -38,8 +38,11 @@
 class PresentationSession : public BnPresentationSession {
   public:
     PresentationSession(sp<SecureHardwareProxyFactory> hwProxyFactory,
-                        sp<SecureHardwareSessionProxy> hwProxy)
-        : hwProxyFactory_(std::move(hwProxyFactory)), hwProxy_(std::move(hwProxy)) {}
+                        sp<SecureHardwareSessionProxy> hwProxy,
+                        HardwareInformation hardwareInformation)
+        : hwProxyFactory_(std::move(hwProxyFactory)),
+          hwProxy_(std::move(hwProxy)),
+          hardwareInformation_(std::move(hardwareInformation)) {}
 
     virtual ~PresentationSession();
 
@@ -65,6 +68,7 @@
     // Set by constructor
     sp<SecureHardwareProxyFactory> hwProxyFactory_;
     sp<SecureHardwareSessionProxy> hwProxy_;
+    HardwareInformation hardwareInformation_;
 
     // Set by initialize()
     uint64_t id_;
diff --git a/identity/aidl/default/common/SecureHardwareProxy.h b/identity/aidl/default/common/SecureHardwareProxy.h
index a580444..9f63ad8 100644
--- a/identity/aidl/default/common/SecureHardwareProxy.h
+++ b/identity/aidl/default/common/SecureHardwareProxy.h
@@ -82,6 +82,18 @@
     virtual optional<vector<uint8_t>> createCredentialKey(const vector<uint8_t>& challenge,
                                                           const vector<uint8_t>& applicationId) = 0;
 
+    // Returns public key certificate with a remotely provisioned attestation key.
+    //
+    // This returns a single certificate that is signed by the given |attestationKeyBlob|.
+    // The implementation of eicOpsCreateCredentialKey() on the TA side must coordinate
+    // with its corresponding keymint implementation to sign using the attestation key. The
+    // |attestationKeyCert| parameter is the certificates for |attestationKeyBlob|,
+    // formatted as concatenated, DER-encoded, X.509 certificates.
+    virtual optional<vector<uint8_t>> createCredentialKeyUsingRkp(
+            const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
+            const vector<uint8_t>& attestationKeyBlob,
+            const vector<uint8_t>& attestationKeyCert) = 0;
+
     virtual bool startPersonalization(int accessControlProfileCount, const vector<int>& entryCounts,
                                       const string& docType,
                                       size_t expectedProofOfProvisioningSize) = 0;
diff --git a/identity/aidl/default/common/WritableIdentityCredential.cpp b/identity/aidl/default/common/WritableIdentityCredential.cpp
index 200ee61..e420a7b 100644
--- a/identity/aidl/default/common/WritableIdentityCredential.cpp
+++ b/identity/aidl/default/common/WritableIdentityCredential.cpp
@@ -79,8 +79,15 @@
                 IIdentityCredentialStore::STATUS_INVALID_DATA, "Challenge can not be empty"));
     }
 
-    optional<vector<uint8_t>> certChain =
-            hwProxy_->createCredentialKey(attestationChallenge, attestationApplicationId);
+    optional<vector<uint8_t>> certChain;
+    if (attestationKeyBlob_ && attestationCertificateChain_) {
+        certChain = hwProxy_->createCredentialKeyUsingRkp(
+                attestationChallenge, attestationApplicationId, *attestationKeyBlob_,
+                attestationCertificateChain_->at(0));
+    } else {
+        certChain = hwProxy_->createCredentialKey(attestationChallenge, attestationApplicationId);
+    }
+
     if (!certChain) {
         return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                 IIdentityCredentialStore::STATUS_FAILED,
@@ -95,8 +102,14 @@
     }
 
     *outCertificateChain = vector<Certificate>();
-    for (const vector<uint8_t>& cert : certs.value()) {
-        Certificate c = Certificate();
+    for (vector<uint8_t>& cert : certs.value()) {
+        Certificate c;
+        c.encodedCertificate = std::move(cert);
+        outCertificateChain->push_back(std::move(c));
+    }
+
+    for (const vector<uint8_t>& cert : *attestationCertificateChain_) {
+        Certificate c;
         c.encodedCertificate = cert;
         outCertificateChain->push_back(std::move(c));
     }
@@ -402,4 +415,36 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus WritableIdentityCredential::setRemotelyProvisionedAttestationKey(
+        const vector<uint8_t>& attestationKeyBlob,
+        const vector<uint8_t>& attestationCertificateChain) {
+    if (!hardwareInformation_.isRemoteKeyProvisioningSupported) {
+        return ndk::ScopedAStatus(AStatus_fromExceptionCodeWithMessage(
+                EX_UNSUPPORTED_OPERATION, "Remote key provisioning is not supported"));
+    }
+
+    if (attestationKeyBlob.empty() || attestationCertificateChain.empty()) {
+        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
+                IIdentityCredentialStore::STATUS_FAILED,
+                "Empty data passed to setRemotlyProvisionedAttestationKey"));
+    }
+
+    if (attestationKeyBlob_.has_value()) {
+        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
+                IIdentityCredentialStore::STATUS_FAILED, "Attestation key already set"));
+    }
+
+    optional<vector<vector<uint8_t>>> certs =
+            support::certificateChainSplit(attestationCertificateChain);
+    if (!certs) {
+        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
+                IIdentityCredentialStore::STATUS_FAILED,
+                "Error splitting chain into separate certificates"));
+    }
+
+    attestationKeyBlob_ = attestationKeyBlob;
+    attestationCertificateChain_ = *certs;
+    return ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::identity
diff --git a/identity/aidl/default/common/WritableIdentityCredential.h b/identity/aidl/default/common/WritableIdentityCredential.h
index 36ad430..39d32c9 100644
--- a/identity/aidl/default/common/WritableIdentityCredential.h
+++ b/identity/aidl/default/common/WritableIdentityCredential.h
@@ -30,6 +30,7 @@
 
 using ::android::sp;
 using ::android::hardware::identity::SecureHardwareProvisioningProxy;
+using ::std::optional;
 using ::std::set;
 using ::std::string;
 using ::std::vector;
@@ -41,8 +42,11 @@
     // For an updated credential, call initializeForUpdate() right after construction.
     //
     WritableIdentityCredential(sp<SecureHardwareProvisioningProxy> hwProxy, const string& docType,
-                               bool testCredential)
-        : hwProxy_(hwProxy), docType_(docType), testCredential_(testCredential) {}
+                               bool testCredential, HardwareInformation hardwareInformation)
+        : hwProxy_(hwProxy),
+          docType_(docType),
+          testCredential_(testCredential),
+          hardwareInformation_(std::move(hardwareInformation)) {}
 
     ~WritableIdentityCredential();
 
@@ -78,11 +82,16 @@
             vector<uint8_t>* outCredentialData,
             vector<uint8_t>* outProofOfProvisioningSignature) override;
 
+    ndk::ScopedAStatus setRemotelyProvisionedAttestationKey(
+            const vector<uint8_t>& attestationKeyBlob,
+            const vector<uint8_t>& attestationCertificateChain) override;
+
   private:
     // Set by constructor.
     sp<SecureHardwareProvisioningProxy> hwProxy_;
     string docType_;
     bool testCredential_;
+    HardwareInformation hardwareInformation_;
 
     // This is set in initialize().
     bool startPersonalizationCalled_;
@@ -109,6 +118,10 @@
     vector<int32_t> entryAccessControlProfileIds_;
     vector<uint8_t> entryBytes_;
     set<string> allNameSpaces_;
+
+    // Remotely provisioned attestation data, set via setRemotelyProvisionedAttestationKey
+    optional<vector<uint8_t>> attestationKeyBlob_;
+    optional<vector<vector<uint8_t>>> attestationCertificateChain_;
 };
 
 }  // namespace aidl::android::hardware::identity
diff --git a/identity/aidl/default/libeic/EicOps.h b/identity/aidl/default/libeic/EicOps.h
index aa26e62..df96c7d 100644
--- a/identity/aidl/default/libeic/EicOps.h
+++ b/identity/aidl/default/libeic/EicOps.h
@@ -196,13 +196,19 @@
 
 // Generates CredentialKey plus an attestation certificate.
 //
-// The attestation certificate will be signed by the attestation keys the secure
-// area has been provisioned with. The given |challenge| and |applicationId|
-// will be used as will |testCredential|.
+// If |attestationKeyBlob| is non-NULL, the certificate must be signed by the
+// the provided attestation key. Else, the certificate must be signed by the
+// attestation key that the secure area has been factory provisioned with. The
+// given |challenge|, |applicationId|, and |testCredential| must be signed
+// into the attestation.
 //
-// The generated certificate will be in X.509 format and returned in |cert|
-// and |certSize| must be set to the size of this array and this function will
-// set it to the size of the certification chain on successfully return.
+// When |attestationKeyBlob| is non-NULL, then |attestationKeyCert| must
+// also be passed so that the underlying implementation can properly chain up
+// the newly-generated certificate to the existing chain.
+//
+// The generated certificate must be in X.509 format and returned in |cert|
+// and |certSize| must be set to the size of this array. This function must
+// set |certSize| to the size of the certification chain on successfully return.
 //
 // This may return either a single certificate or an entire certificate
 // chain. If it returns only a single certificate, the implementation of
@@ -211,8 +217,10 @@
 //
 bool eicOpsCreateCredentialKey(uint8_t privateKey[EIC_P256_PRIV_KEY_SIZE], const uint8_t* challenge,
                                size_t challengeSize, const uint8_t* applicationId,
-                               size_t applicationIdSize, bool testCredential, uint8_t* cert,
-                               size_t* certSize);  // inout
+                               size_t applicationIdSize, bool testCredential,
+                               const uint8_t* attestationKeyBlob, size_t attestationKeyBlobSize,
+                               const uint8_t* attestationKeyCert, size_t attestationKeyCertSize,
+                               uint8_t* /*out*/ cert, size_t* /*inout*/ certSize);
 
 // Generate an X.509 certificate for the key identified by |publicKey| which
 // must be of the form returned by eicOpsCreateEcKey().
diff --git a/identity/aidl/default/libeic/EicProvisioning.c b/identity/aidl/default/libeic/EicProvisioning.c
index a241b71..ff009dd 100644
--- a/identity/aidl/default/libeic/EicProvisioning.c
+++ b/identity/aidl/default/libeic/EicProvisioning.c
@@ -133,7 +133,10 @@
 
 bool eicProvisioningCreateCredentialKey(EicProvisioning* ctx, const uint8_t* challenge,
                                         size_t challengeSize, const uint8_t* applicationId,
-                                        size_t applicationIdSize, uint8_t* publicKeyCert,
+                                        size_t applicationIdSize, const uint8_t* attestationKeyBlob,
+                                        size_t attestationKeyBlobSize,
+                                        const uint8_t* attestationKeyCert,
+                                        size_t attestationKeyCertSize, uint8_t* publicKeyCert,
                                         size_t* publicKeyCertSize) {
     if (ctx->isUpdate) {
         eicDebug("Cannot create CredentialKey on update");
@@ -142,7 +145,9 @@
 
     if (!eicOpsCreateCredentialKey(ctx->credentialPrivateKey, challenge, challengeSize,
                                    applicationId, applicationIdSize, ctx->testCredential,
-                                   publicKeyCert, publicKeyCertSize)) {
+                                   attestationKeyBlob, attestationKeyBlobSize, attestationKeyCert,
+                                   attestationKeyCertSize, publicKeyCert, publicKeyCertSize)) {
+        eicDebug("Error creating credential key");
         return false;
     }
     return true;
diff --git a/identity/aidl/default/libeic/EicProvisioning.h b/identity/aidl/default/libeic/EicProvisioning.h
index d94f8f1..2619bfc 100644
--- a/identity/aidl/default/libeic/EicProvisioning.h
+++ b/identity/aidl/default/libeic/EicProvisioning.h
@@ -77,7 +77,10 @@
 
 bool eicProvisioningCreateCredentialKey(EicProvisioning* ctx, const uint8_t* challenge,
                                         size_t challengeSize, const uint8_t* applicationId,
-                                        size_t applicationIdSize, uint8_t* publicKeyCert,
+                                        size_t applicationIdSize, const uint8_t* attestationKeyBlob,
+                                        size_t attestationKeyBlobSize,
+                                        const uint8_t* attestationKeyCert,
+                                        size_t attestationKeyCertSize, uint8_t* publicKeyCert,
                                         size_t* publicKeyCertSize);
 
 bool eicProvisioningStartPersonalization(EicProvisioning* ctx, int accessControlProfileCount,
diff --git a/identity/aidl/default/service.cpp b/identity/aidl/default/service.cpp
index 78f4fbc..ed3c4cb 100644
--- a/identity/aidl/default/service.cpp
+++ b/identity/aidl/default/service.cpp
@@ -16,6 +16,7 @@
 
 #define LOG_TAG "android.hardware.identity-service"
 
+#include <aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.h>
 #include <android-base/logging.h>
 #include <android/binder_manager.h>
 #include <android/binder_process.h>
@@ -26,20 +27,35 @@
 
 using ::android::sp;
 using ::android::base::InitLogging;
+using ::android::base::LogdLogger;
+using ::android::base::LogId;
+using ::android::base::LogSeverity;
 using ::android::base::StderrLogger;
 
 using ::aidl::android::hardware::identity::IdentityCredentialStore;
+using ::aidl::android::hardware::security::keymint::IRemotelyProvisionedComponent;
 using ::android::hardware::identity::FakeSecureHardwareProxyFactory;
 using ::android::hardware::identity::SecureHardwareProxyFactory;
 
+void ComboLogger(LogId id, LogSeverity severity, const char* tag, const char* file,
+                 unsigned int line, const char* message) {
+    StderrLogger(id, severity, tag, file, line, message);
+
+    static LogdLogger logdLogger;
+    logdLogger(id, severity, tag, file, line, message);
+}
+
 int main(int /*argc*/, char* argv[]) {
-    InitLogging(argv, StderrLogger);
+    InitLogging(argv, ComboLogger);
 
     sp<SecureHardwareProxyFactory> hwProxyFactory = new FakeSecureHardwareProxyFactory();
+    const std::string remotelyProvisionedComponentName =
+            std::string(IRemotelyProvisionedComponent::descriptor) + "/default";
 
     ABinderProcess_setThreadPoolMaxThreadCount(0);
     std::shared_ptr<IdentityCredentialStore> store =
-            ndk::SharedRefBase::make<IdentityCredentialStore>(hwProxyFactory);
+            ndk::SharedRefBase::make<IdentityCredentialStore>(hwProxyFactory,
+                                                              remotelyProvisionedComponentName);
 
     const std::string instance = std::string() + IdentityCredentialStore::descriptor + "/default";
     binder_status_t status = AServiceManager_addService(store->asBinder().get(), instance.c_str());
diff --git a/identity/aidl/vts/Android.bp b/identity/aidl/vts/Android.bp
index 7b6f2c8..c5b84a1 100644
--- a/identity/aidl/vts/Android.bp
+++ b/identity/aidl/vts/Android.bp
@@ -11,6 +11,8 @@
     name: "VtsHalIdentityTargetTest",
     defaults: [
         "VtsHalTargetTestDefaults",
+        "keymint_use_latest_hal_aidl_cpp_static",
+        "keymint_use_latest_hal_aidl_ndk_static",
         "use_libaidlvintf_gtest_helper_static",
     ],
     cflags: [
@@ -32,12 +34,15 @@
     ],
     shared_libs: [
         "libbinder",
+        "libbinder_ndk",
         "libcrypto",
     ],
     static_libs: [
+        "android.hardware.security.secureclock-V1-ndk",
         "libcppbor_external",
         "libcppcose_rkp",
         "libkeymaster_portable",
+        "libkeymint_vts_test_utils",
         "libpuresoftkeymasterdevice",
         "android.hardware.keymaster@4.0",
         "android.hardware.identity-support-lib",
@@ -46,6 +51,7 @@
         "android.hardware.keymaster-V4-ndk",
         "libkeymaster4support",
         "libkeymaster4_1support",
+        "libkeymint_remote_prov_support",
     ],
     test_suites: [
         "general-tests",
diff --git a/identity/aidl/vts/Util.cpp b/identity/aidl/vts/Util.cpp
index 1148cb0..f3d7c30 100644
--- a/identity/aidl/vts/Util.cpp
+++ b/identity/aidl/vts/Util.cpp
@@ -20,12 +20,16 @@
 
 #include <android-base/logging.h>
 
+#include <KeyMintAidlTestBase.h>
 #include <aidl/Gtest.h>
+#include <aidl/android/hardware/security/keymint/MacedPublicKey.h>
 #include <android-base/stringprintf.h>
 #include <keymaster/km_openssl/openssl_utils.h>
 #include <keymasterV4_1/attestation_record.h>
-#include <charconv>
+#include <keymint_support/openssl_utils.h>
+#include <openssl/evp.h>
 
+#include <charconv>
 #include <map>
 
 namespace android::hardware::identity::test_utils {
@@ -36,10 +40,13 @@
 using std::string;
 using std::vector;
 
+using ::aidl::android::hardware::security::keymint::test::check_maced_pubkey;
+using ::aidl::android::hardware::security::keymint::test::p256_pub_key;
 using ::android::sp;
 using ::android::String16;
 using ::android::base::StringPrintf;
 using ::android::binder::Status;
+using ::android::hardware::security::keymint::MacedPublicKey;
 using ::keymaster::X509_Ptr;
 
 bool setupWritableCredential(sp<IWritableIdentityCredential>& writableCredential,
@@ -58,6 +65,77 @@
     }
 }
 
+optional<vector<vector<uint8_t>>> createFakeRemotelyProvisionedCertificateChain(
+        const MacedPublicKey& macedPublicKey) {
+    // The helper library uses the NDK symbols, so play a little trickery here to convert
+    // the data into the proper type so we can reuse the helper function to get the pubkey.
+    ::aidl::android::hardware::security::keymint::MacedPublicKey ndkMacedPublicKey;
+    ndkMacedPublicKey.macedKey = macedPublicKey.macedKey;
+
+    vector<uint8_t> publicKeyBits;
+    check_maced_pubkey(ndkMacedPublicKey, /*testMode=*/true, &publicKeyBits);
+
+    ::aidl::android::hardware::security::keymint::EVP_PKEY_Ptr publicKey;
+    p256_pub_key(publicKeyBits, &publicKey);
+
+    // Generate an arbitrary root key for our chain
+    bssl::UniquePtr<EC_KEY> ecRootKey(EC_KEY_new());
+    bssl::UniquePtr<EVP_PKEY> rootKey(EVP_PKEY_new());
+    if (ecRootKey.get() == nullptr || rootKey.get() == nullptr) {
+        LOG(ERROR) << "Memory allocation failed";
+        return {};
+    }
+
+    bssl::UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
+    if (group.get() == nullptr) {
+        LOG(ERROR) << "Error creating EC group by curve name";
+        return {};
+    }
+
+    if (EC_KEY_set_group(ecRootKey.get(), group.get()) != 1 ||
+        EC_KEY_generate_key(ecRootKey.get()) != 1 || EC_KEY_check_key(ecRootKey.get()) < 0) {
+        LOG(ERROR) << "Error generating key";
+        return {};
+    }
+
+    if (EVP_PKEY_set1_EC_KEY(rootKey.get(), ecRootKey.get()) != 1) {
+        LOG(ERROR) << "Error getting private key";
+        return {};
+    }
+
+    // The VTS test does not fully validate the chain, so we're ok without the proper CA extensions.
+    map<string, vector<uint8_t>> extensions;
+
+    // Now make a self-signed cert
+    optional<vector<uint8_t>> root = support::ecPublicKeyGenerateCertificate(
+            rootKey.get(), rootKey.get(),
+            /*serialDecimal=*/"31415",
+            /*subject=*/"Android IdentityCredential VTS Test Root Certificate",
+            /*subject=*/"Android IdentityCredential VTS Test Root Certificate",
+            /*validityNotBefore=*/time(nullptr),
+            /*validityNotAfter=*/time(nullptr) + 365 * 24 * 3600, extensions);
+    if (!root) {
+        LOG(ERROR) << "Error generating root cert";
+        return std::nullopt;
+    }
+
+    // Now sign a CA cert so that we have a chain that's good enough to satisfy
+    // the VTS tests.
+    optional<vector<uint8_t>> intermediate = support::ecPublicKeyGenerateCertificate(
+            publicKey.get(), rootKey.get(),
+            /*serialDecimal=*/"42",
+            /*subject=*/"Android IdentityCredential VTS Test Root Certificate",
+            /*subject=*/"Android IdentityCredential VTS Test Attestation Certificate",
+            /*validityNotBefore=*/time(nullptr),
+            /*validityNotAfter=*/time(nullptr) + 365 * 24 * 3600, extensions);
+    if (!intermediate) {
+        LOG(ERROR) << "Error generating intermediate cert";
+        return std::nullopt;
+    }
+
+    return vector<vector<uint8_t>>{std::move(*intermediate), std::move(*root)};
+}
+
 optional<vector<uint8_t>> generateReaderCertificate(string serialDecimal) {
     vector<uint8_t> privKey;
     return generateReaderCertificate(serialDecimal, &privKey);
diff --git a/identity/aidl/vts/Util.h b/identity/aidl/vts/Util.h
index 80e52a2..b120dc9 100644
--- a/identity/aidl/vts/Util.h
+++ b/identity/aidl/vts/Util.h
@@ -19,6 +19,7 @@
 
 #include <android/hardware/identity/IIdentityCredentialStore.h>
 #include <android/hardware/identity/support/IdentityCredentialSupport.h>
+#include <android/hardware/security/keymint/MacedPublicKey.h>
 #include <cppbor.h>
 #include <cppbor_parse.h>
 #include <gtest/gtest.h>
@@ -97,6 +98,9 @@
 bool setupWritableCredential(sp<IWritableIdentityCredential>& writableCredential,
                              sp<IIdentityCredentialStore>& credentialStore, bool testCredential);
 
+optional<vector<vector<uint8_t>>> createFakeRemotelyProvisionedCertificateChain(
+        const ::android::hardware::security::keymint::MacedPublicKey& macedPublicKey);
+
 optional<vector<uint8_t>> generateReaderCertificate(string serialDecimal);
 
 optional<vector<uint8_t>> generateReaderCertificate(string serialDecimal,
diff --git a/identity/aidl/vts/VtsIWritableIdentityCredentialTests.cpp b/identity/aidl/vts/VtsIWritableIdentityCredentialTests.cpp
index bc37020..94d4c88 100644
--- a/identity/aidl/vts/VtsIWritableIdentityCredentialTests.cpp
+++ b/identity/aidl/vts/VtsIWritableIdentityCredentialTests.cpp
@@ -18,6 +18,8 @@
 
 #include <aidl/Gtest.h>
 #include <aidl/Vintf.h>
+#include <aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.h>
+#include <aidl/android/hardware/security/keymint/MacedPublicKey.h>
 #include <android-base/logging.h>
 #include <android/hardware/identity/IIdentityCredentialStore.h>
 #include <android/hardware/identity/support/IdentityCredentialSupport.h>
@@ -42,6 +44,8 @@
 using ::android::sp;
 using ::android::String16;
 using ::android::binder::Status;
+using ::android::hardware::security::keymint::IRemotelyProvisionedComponent;
+using ::android::hardware::security::keymint::MacedPublicKey;
 
 class IdentityCredentialTests : public testing::TestWithParam<string> {
   public:
@@ -101,6 +105,103 @@
                                                attestationApplicationId, false);
 }
 
+TEST_P(IdentityCredentialTests, verifyAttestationSuccessWithRemoteProvisioning) {
+    HardwareInformation hwInfo;
+    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());
+
+    if (!hwInfo.isRemoteKeyProvisioningSupported) {
+        GTEST_SKIP() << "Remote provisioning is not supported";
+    }
+
+    Status result;
+
+    sp<IWritableIdentityCredential> writableCredential;
+    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_,
+                                                    false /* testCredential */));
+
+    sp<IRemotelyProvisionedComponent> rpc;
+    result = credentialStore_->getRemotelyProvisionedComponent(&rpc);
+    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage();
+
+    MacedPublicKey macedPublicKey;
+    std::vector<uint8_t> attestationKey;
+    result = rpc->generateEcdsaP256KeyPair(/*testMode=*/true, &macedPublicKey, &attestationKey);
+    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage();
+
+    optional<vector<vector<uint8_t>>> remotelyProvisionedCertChain =
+            test_utils::createFakeRemotelyProvisionedCertificateChain(macedPublicKey);
+    ASSERT_TRUE(remotelyProvisionedCertChain);
+
+    vector<uint8_t> concatenatedCerts;
+    for (const vector<uint8_t>& cert : *remotelyProvisionedCertChain) {
+        concatenatedCerts.insert(concatenatedCerts.end(), cert.begin(), cert.end());
+    }
+    result = writableCredential->setRemotelyProvisionedAttestationKey(attestationKey,
+                                                                      concatenatedCerts);
+    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage();
+
+    string challenge = "NotSoRandomChallenge1NotSoRandomChallenge1NotSoRandomChallenge1";
+    vector<uint8_t> attestationChallenge(challenge.begin(), challenge.end());
+    vector<Certificate> attestationCertificate;
+    vector<uint8_t> attestationApplicationId = {1};
+
+    result = writableCredential->getAttestationCertificate(
+            attestationApplicationId, attestationChallenge, &attestationCertificate);
+
+    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage();
+
+    test_utils::validateAttestationCertificate(attestationCertificate, attestationChallenge,
+                                               attestationApplicationId, false);
+
+    ASSERT_EQ(remotelyProvisionedCertChain->size() + 1, attestationCertificate.size());
+    for (size_t i = 0; i < remotelyProvisionedCertChain->size(); ++i) {
+        ASSERT_EQ(remotelyProvisionedCertChain->at(i),
+                  attestationCertificate[i + 1].encodedCertificate)
+                << "Certificate mismatch (cert index " << i + 1 << " out of "
+                << attestationCertificate.size() << " total certs)";
+    }
+}
+
+TEST_P(IdentityCredentialTests, verifyRemotelyProvisionedKeyMayOnlyBeSetOnce) {
+    HardwareInformation hwInfo;
+    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());
+
+    if (!hwInfo.isRemoteKeyProvisioningSupported) {
+        GTEST_SKIP() << "Remote provisioning is not supported";
+    }
+
+    sp<IRemotelyProvisionedComponent> rpc;
+    Status result = credentialStore_->getRemotelyProvisionedComponent(&rpc);
+    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage();
+
+    MacedPublicKey macedPublicKey;
+    std::vector<uint8_t> attestationKey;
+    result = rpc->generateEcdsaP256KeyPair(/*testMode=*/true, &macedPublicKey, &attestationKey);
+    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage();
+
+    optional<vector<vector<uint8_t>>> remotelyProvisionedCertChain =
+            test_utils::createFakeRemotelyProvisionedCertificateChain(macedPublicKey);
+    ASSERT_TRUE(remotelyProvisionedCertChain);
+
+    vector<uint8_t> concatenatedCerts;
+    for (const vector<uint8_t>& cert : *remotelyProvisionedCertChain) {
+        concatenatedCerts.insert(concatenatedCerts.end(), cert.begin(), cert.end());
+    }
+
+    sp<IWritableIdentityCredential> writableCredential;
+    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_,
+                                                    /*testCredential=*/false));
+
+    result = writableCredential->setRemotelyProvisionedAttestationKey(attestationKey,
+                                                                      concatenatedCerts);
+    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage();
+
+    // Now try again, and verify that the implementation rejects it.
+    result = writableCredential->setRemotelyProvisionedAttestationKey(attestationKey,
+                                                                      concatenatedCerts);
+    EXPECT_FALSE(result.isOk());
+}
+
 TEST_P(IdentityCredentialTests, verifyAttestationDoubleCallFails) {
     Status result;
 
diff --git a/identity/support/include/android/hardware/identity/support/IdentityCredentialSupport.h b/identity/support/include/android/hardware/identity/support/IdentityCredentialSupport.h
index 3b91de6..82746d6 100644
--- a/identity/support/include/android/hardware/identity/support/IdentityCredentialSupport.h
+++ b/identity/support/include/android/hardware/identity/support/IdentityCredentialSupport.h
@@ -17,6 +17,8 @@
 #ifndef IDENTITY_SUPPORT_INCLUDE_IDENTITY_CREDENTIAL_UTILS_H_
 #define IDENTITY_SUPPORT_INCLUDE_IDENTITY_CREDENTIAL_UTILS_H_
 
+#include <openssl/evp.h>
+
 #include <cstdint>
 #include <map>
 #include <optional>
@@ -128,6 +130,15 @@
         const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
         bool isTestCredential);
 
+// Alternate version of createEcKeyPairAndAttestation that accepts an attestation key
+// blob to sign the generated key. Only a single certificate is returned, rather than
+// a full chain.
+//
+optional<std::pair<vector<uint8_t>, vector<uint8_t>>> createEcKeyPairWithAttestationKey(
+        const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
+        const vector<uint8_t>& attestationKeyBlob, const vector<uint8_t>& attestationKeyCert,
+        bool isTestCredential);
+
 // (TODO: remove when no longer used by 3rd party.)
 optional<vector<vector<uint8_t>>> createAttestationForEcPublicKey(
         const vector<uint8_t>& publicKey, const vector<uint8_t>& challenge,
@@ -240,6 +251,13 @@
         time_t validityNotBefore, time_t validityNotAfter,
         const map<string, vector<uint8_t>>& extensions);
 
+// Identical behavior to the above version of ecPublicKeyGenerateCertificate, except this
+// overload takes OpenSSL key parameters instead of key bitstrings as inputs.
+optional<vector<uint8_t>> ecPublicKeyGenerateCertificate(
+        EVP_PKEY* publicKey, EVP_PKEY* signingKey, const string& serialDecimal,
+        const string& issuer, const string& subject, time_t validityNotBefore,
+        time_t validityNotAfter, const map<string, vector<uint8_t>>& extensions);
+
 // Performs Elliptic-curve Diffie-Helman using |publicKey| (which must be in the
 // format returned by ecKeyPairGetPublicKey()) and |privateKey| (which must be
 // in the format returned by ecKeyPairGetPrivateKey()).
diff --git a/identity/support/src/IdentityCredentialSupport.cpp b/identity/support/src/IdentityCredentialSupport.cpp
index 7f4674d..36ecdb0 100644
--- a/identity/support/src/IdentityCredentialSupport.cpp
+++ b/identity/support/src/IdentityCredentialSupport.cpp
@@ -54,6 +54,7 @@
 #include <keymaster/contexts/pure_soft_keymaster_context.h>
 #include <keymaster/contexts/soft_attestation_cert.h>
 #include <keymaster/keymaster_tags.h>
+#include <keymaster/km_openssl/asymmetric_key.h>
 #include <keymaster/km_openssl/attestation_utils.h>
 #include <keymaster/km_openssl/certificate_utils.h>
 
@@ -168,6 +169,286 @@
 using X509_NAME_Ptr = bssl::UniquePtr<X509_NAME>;
 using X509_EXTENSION_Ptr = bssl::UniquePtr<X509_EXTENSION>;
 
+namespace {
+
+EVP_PKEY_Ptr generateP256Key() {
+    EC_KEY_Ptr ec_key(EC_KEY_new());
+    EVP_PKEY_Ptr pkey(EVP_PKEY_new());
+    EC_GROUP_Ptr group(EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
+
+    if (ec_key.get() == nullptr || pkey.get() == nullptr) {
+        LOG(ERROR) << "Memory allocation failed";
+        return {};
+    }
+
+    if (EC_KEY_set_group(ec_key.get(), group.get()) != 1 ||
+        EC_KEY_generate_key(ec_key.get()) != 1 || EC_KEY_check_key(ec_key.get()) < 0) {
+        LOG(ERROR) << "Error generating key";
+        return {};
+    }
+
+    if (EVP_PKEY_set1_EC_KEY(pkey.get(), ec_key.get()) != 1) {
+        LOG(ERROR) << "Error getting private key";
+        return {};
+    }
+
+    return pkey;
+}
+
+optional<vector<uint8_t>> derEncodeKeyPair(const EVP_PKEY& pkey) {
+    int size = i2d_PrivateKey(&pkey, nullptr);
+    if (size == 0) {
+        LOG(ERROR) << "Error generating public key encoding";
+        return std::nullopt;
+    }
+
+    vector<uint8_t> keyPair(size);
+    unsigned char* p = keyPair.data();
+    i2d_PrivateKey(&pkey, &p);
+
+    return keyPair;
+}
+
+// Extract the issuer subject name from the leaf cert in the given chain,
+// returning it as DER-encoded bytes.
+optional<vector<uint8_t>> extractDerSubjectFromCertificate(const vector<uint8_t>& certificate) {
+    const uint8_t* input = certificate.data();
+    X509_Ptr cert(d2i_X509(/*cert=*/nullptr, &input, certificate.size()));
+    if (!cert) {
+        LOG(ERROR) << "Failed to parse certificate";
+        return std::nullopt;
+    }
+
+    X509_NAME* subject = X509_get_subject_name(cert.get());
+    if (!subject) {
+        LOG(ERROR) << "Failed to retrieve subject name";
+        return std::nullopt;
+    }
+
+    int encodedSubjectLength = i2d_X509_NAME(subject, /*out=*/nullptr);
+    if (encodedSubjectLength < 0) {
+        LOG(ERROR) << "Error obtaining encoded subject name length";
+        return std::nullopt;
+    }
+
+    vector<uint8_t> encodedSubject(encodedSubjectLength);
+    uint8_t* out = encodedSubject.data();
+    if (encodedSubjectLength != i2d_X509_NAME(subject, &out)) {
+        LOG(ERROR) << "Error encoding subject name";
+        return std::nullopt;
+    }
+
+    return encodedSubject;
+}
+
+// Generates the attestation certificate with the parameters passed in.  Note
+// that the passed in |activeTimeMilliSeconds| |expireTimeMilliSeconds| are in
+// milli seconds since epoch.  We are setting them to milliseconds due to
+// requirement in AuthorizationSet KM_DATE fields.  The certificate created is
+// actually in seconds.
+//
+optional<vector<vector<uint8_t>>> signAttestationCertificate(
+        const ::keymaster::PureSoftKeymasterContext& context, const EVP_PKEY* key,
+        const vector<uint8_t>& applicationId, const vector<uint8_t>& challenge,
+        const vector<uint8_t>& attestationKeyBlob,
+        const vector<uint8_t>& derAttestationCertSubjectName, uint64_t activeTimeMilliSeconds,
+        uint64_t expireTimeMilliSeconds, bool isTestCredential) {
+    ::keymaster::X509_NAME_Ptr subjectName;
+    if (KM_ERROR_OK !=
+        ::keymaster::make_name_from_str("Android Identity Credential Key", &subjectName)) {
+        LOG(ERROR) << "Cannot create attestation subject";
+        return {};
+    }
+
+    vector<uint8_t> subject(i2d_X509_NAME(subjectName.get(), NULL));
+    unsigned char* subjectPtr = subject.data();
+
+    i2d_X509_NAME(subjectName.get(), &subjectPtr);
+
+    ::keymaster::AuthorizationSet auth_set(
+            ::keymaster::AuthorizationSetBuilder()
+                    .Authorization(::keymaster::TAG_CERTIFICATE_NOT_BEFORE, activeTimeMilliSeconds)
+                    .Authorization(::keymaster::TAG_CERTIFICATE_NOT_AFTER, expireTimeMilliSeconds)
+                    .Authorization(::keymaster::TAG_ATTESTATION_CHALLENGE, challenge.data(),
+                                   challenge.size())
+                    .Authorization(::keymaster::TAG_ACTIVE_DATETIME, activeTimeMilliSeconds)
+                    // Even though identity attestation hal said the application
+                    // id should be in software enforced authentication set,
+                    // keymaster portable lib expect the input in this
+                    // parameter because the software enforced in input to keymaster
+                    // refers to the key software enforced properties. And this
+                    // parameter refers to properties of the attestation which
+                    // includes app id.
+                    .Authorization(::keymaster::TAG_ATTESTATION_APPLICATION_ID,
+                                   applicationId.data(), applicationId.size())
+                    .Authorization(::keymaster::TAG_CERTIFICATE_SUBJECT, subject.data(),
+                                   subject.size())
+                    .Authorization(::keymaster::TAG_USAGE_EXPIRE_DATETIME, expireTimeMilliSeconds));
+
+    // Unique id and device id is not applicable for identity credential attestation,
+    // so we don't need to set those or application id.
+    ::keymaster::AuthorizationSet swEnforced(::keymaster::AuthorizationSetBuilder().Authorization(
+            ::keymaster::TAG_CREATION_DATETIME, activeTimeMilliSeconds));
+
+    ::keymaster::AuthorizationSetBuilder hwEnforcedBuilder =
+            ::keymaster::AuthorizationSetBuilder()
+                    .Authorization(::keymaster::TAG_PURPOSE, KM_PURPOSE_SIGN)
+                    .Authorization(::keymaster::TAG_KEY_SIZE, 256)
+                    .Authorization(::keymaster::TAG_ALGORITHM, KM_ALGORITHM_EC)
+                    .Authorization(::keymaster::TAG_NO_AUTH_REQUIRED)
+                    .Authorization(::keymaster::TAG_DIGEST, KM_DIGEST_SHA_2_256)
+                    .Authorization(::keymaster::TAG_EC_CURVE, KM_EC_CURVE_P_256)
+                    .Authorization(::keymaster::TAG_OS_VERSION, 42)
+                    .Authorization(::keymaster::TAG_OS_PATCHLEVEL, 43);
+
+    // Only include TAG_IDENTITY_CREDENTIAL_KEY if it's not a test credential
+    if (!isTestCredential) {
+        hwEnforcedBuilder.Authorization(::keymaster::TAG_IDENTITY_CREDENTIAL_KEY);
+    }
+    ::keymaster::AuthorizationSet hwEnforced(hwEnforcedBuilder);
+
+    keymaster_error_t error;
+    ::keymaster::AttestKeyInfo attestKeyInfo;
+    ::keymaster::KeymasterBlob issuerSubjectNameBlob;
+    if (!attestationKeyBlob.empty()) {
+        ::keymaster::KeymasterKeyBlob blob(attestationKeyBlob.data(), attestationKeyBlob.size());
+        ::keymaster::UniquePtr<::keymaster::Key> parsedKey;
+        error = context.ParseKeyBlob(blob, /*additional_params=*/{}, &parsedKey);
+        if (error != KM_ERROR_OK) {
+            LOG(ERROR) << "Error loading attestation key: " << error;
+            return std::nullopt;
+        }
+
+        attestKeyInfo.signing_key =
+                static_cast<::keymaster::AsymmetricKey&>(*parsedKey).InternalToEvp();
+        issuerSubjectNameBlob = ::keymaster::KeymasterBlob(derAttestationCertSubjectName.data(),
+                                                           derAttestationCertSubjectName.size());
+        attestKeyInfo.issuer_subject = &issuerSubjectNameBlob;
+    }
+
+    ::keymaster::CertificateChain certChain = generate_attestation(
+            key, swEnforced, hwEnforced, auth_set, std::move(attestKeyInfo), context, &error);
+
+    if (KM_ERROR_OK != error) {
+        LOG(ERROR) << "Error generating attestation from EVP key: " << error;
+        return std::nullopt;
+    }
+
+    vector<vector<uint8_t>> vectors(certChain.entry_count);
+    for (std::size_t i = 0; i < certChain.entry_count; i++) {
+        vectors[i] = {certChain.entries[i].data,
+                      certChain.entries[i].data + certChain.entries[i].data_length};
+    }
+    return vectors;
+}
+
+int parseDigits(const char** s, int numDigits) {
+    int result;
+    auto [_, ec] = std::from_chars(*s, *s + numDigits, result);
+    if (ec != std::errc()) {
+        LOG(ERROR) << "Error parsing " << numDigits << " digits "
+                   << " from " << s;
+        return 0;
+    }
+    *s += numDigits;
+    return result;
+}
+
+bool parseAsn1Time(const ASN1_TIME* asn1Time, time_t* outTime) {
+    struct tm tm;
+
+    memset(&tm, '\0', sizeof(tm));
+    const char* timeStr = (const char*)asn1Time->data;
+    const char* s = timeStr;
+    if (asn1Time->type == V_ASN1_UTCTIME) {
+        tm.tm_year = parseDigits(&s, 2);
+        if (tm.tm_year < 70) {
+            tm.tm_year += 100;
+        }
+    } else if (asn1Time->type == V_ASN1_GENERALIZEDTIME) {
+        tm.tm_year = parseDigits(&s, 4) - 1900;
+        tm.tm_year -= 1900;
+    } else {
+        LOG(ERROR) << "Unsupported ASN1_TIME type " << asn1Time->type;
+        return false;
+    }
+    tm.tm_mon = parseDigits(&s, 2) - 1;
+    tm.tm_mday = parseDigits(&s, 2);
+    tm.tm_hour = parseDigits(&s, 2);
+    tm.tm_min = parseDigits(&s, 2);
+    tm.tm_sec = parseDigits(&s, 2);
+    // This may need to be updated if someone create certificates using +/- instead of Z.
+    //
+    if (*s != 'Z') {
+        LOG(ERROR) << "Expected Z in string '" << timeStr << "' at offset " << (s - timeStr);
+        return false;
+    }
+
+    time_t t = timegm(&tm);
+    if (t == -1) {
+        LOG(ERROR) << "Error converting broken-down time to time_t";
+        return false;
+    }
+    *outTime = t;
+    return true;
+}
+
+optional<uint64_t> getCertificateExpiryAsMillis(const uint8_t* derCert, size_t derCertSize) {
+    X509_Ptr x509Cert(d2i_X509(nullptr, &derCert, derCertSize));
+    if (!x509Cert) {
+        LOG(ERROR) << "Error parsing certificate";
+        return std::nullopt;
+    }
+
+    time_t notAfter;
+    if (!parseAsn1Time(X509_get0_notAfter(x509Cert.get()), &notAfter)) {
+        LOG(ERROR) << "Error getting notAfter from batch certificate";
+        return std::nullopt;
+    }
+
+    return notAfter * 1000;
+}
+
+optional<vector<vector<uint8_t>>> createAttestation(EVP_PKEY* pkey,
+                                                    const vector<uint8_t>& challenge,
+                                                    const vector<uint8_t>& applicationId,
+                                                    bool isTestCredential) {
+    // Pretend to be implemented in a trusted environment just so we can pass
+    // the VTS tests. Of course, this is a pretend-only game since hopefully no
+    // relying party is ever going to trust our batch key and those keys above
+    // it.
+    ::keymaster::PureSoftKeymasterContext context(::keymaster::KmVersion::KEYMINT_1,
+                                                  KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT);
+
+    keymaster_error_t error;
+    ::keymaster::CertificateChain attestation_chain =
+            context.GetAttestationChain(KM_ALGORITHM_EC, &error);
+    if (KM_ERROR_OK != error) {
+        LOG(ERROR) << "Error getting attestation chain " << error;
+        return std::nullopt;
+    }
+
+    if (attestation_chain.entry_count < 1) {
+        LOG(ERROR) << "Expected at least one entry in attestation chain";
+        return std::nullopt;
+    }
+
+    uint64_t activeTimeMs = time(nullptr) * 1000;
+    optional<uint64_t> expireTimeMs = getCertificateExpiryAsMillis(
+            attestation_chain.entries[0].data, attestation_chain.entries[0].data_length);
+    if (!expireTimeMs) {
+        LOG(ERROR) << "Error getting expiration time for batch cert";
+        return std::nullopt;
+    }
+
+    return signAttestationCertificate(context, pkey, applicationId, challenge,
+                                      /*attestationKeyBlob=*/{},
+                                      /*derAttestationCertSubjectName=*/{}, activeTimeMs,
+                                      *expireTimeMs, isTestCredential);
+}
+
+}  // namespace
+
 // bool getRandom(size_t numBytes, vector<uint8_t>& output) {
 optional<vector<uint8_t>> getRandom(size_t numBytes) {
     vector<uint8_t> output;
@@ -577,69 +858,30 @@
     return hmac;
 }
 
-int parseDigits(const char** s, int numDigits) {
-    int result;
-    auto [_, ec] = std::from_chars(*s, *s + numDigits, result);
-    if (ec != std::errc()) {
-        LOG(ERROR) << "Error parsing " << numDigits << " digits "
-                   << " from " << s;
-        return 0;
+optional<std::pair<vector<uint8_t>, vector<vector<uint8_t>>>> createEcKeyPairAndAttestation(
+        const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
+        bool isTestCredential) {
+    EVP_PKEY_Ptr pkey = generateP256Key();
+
+    optional<vector<vector<uint8_t>>> attestationCertChain =
+            createAttestation(pkey.get(), challenge, applicationId, isTestCredential);
+    if (!attestationCertChain) {
+        LOG(ERROR) << "Error create attestation from key and challenge";
+        return {};
     }
-    *s += numDigits;
-    return result;
+
+    optional<vector<uint8_t>> keyPair = derEncodeKeyPair(*pkey);
+    if (!keyPair) {
+        return std::nullopt;
+    }
+
+    return make_pair(*keyPair, *attestationCertChain);
 }
 
-bool parseAsn1Time(const ASN1_TIME* asn1Time, time_t* outTime) {
-    struct tm tm;
-
-    memset(&tm, '\0', sizeof(tm));
-    const char* timeStr = (const char*)asn1Time->data;
-    const char* s = timeStr;
-    if (asn1Time->type == V_ASN1_UTCTIME) {
-        tm.tm_year = parseDigits(&s, 2);
-        if (tm.tm_year < 70) {
-            tm.tm_year += 100;
-        }
-    } else if (asn1Time->type == V_ASN1_GENERALIZEDTIME) {
-        tm.tm_year = parseDigits(&s, 4) - 1900;
-        tm.tm_year -= 1900;
-    } else {
-        LOG(ERROR) << "Unsupported ASN1_TIME type " << asn1Time->type;
-        return false;
-    }
-    tm.tm_mon = parseDigits(&s, 2) - 1;
-    tm.tm_mday = parseDigits(&s, 2);
-    tm.tm_hour = parseDigits(&s, 2);
-    tm.tm_min = parseDigits(&s, 2);
-    tm.tm_sec = parseDigits(&s, 2);
-    // This may need to be updated if someone create certificates using +/- instead of Z.
-    //
-    if (*s != 'Z') {
-        LOG(ERROR) << "Expected Z in string '" << timeStr << "' at offset " << (s - timeStr);
-        return false;
-    }
-
-    time_t t = timegm(&tm);
-    if (t == -1) {
-        LOG(ERROR) << "Error converting broken-down time to time_t";
-        return false;
-    }
-    *outTime = t;
-    return true;
-}
-
-// Generates the attestation certificate with the parameters passed in.  Note
-// that the passed in |activeTimeMilliSeconds| |expireTimeMilliSeconds| are in
-// milli seconds since epoch.  We are setting them to milliseconds due to
-// requirement in AuthorizationSet KM_DATE fields.  The certificate created is
-// actually in seconds.
-//
-// If 0 is passed for expiration time, the expiration time from batch
-// certificate will be used.
-//
-optional<vector<vector<uint8_t>>> createAttestation(
-        const EVP_PKEY* key, const vector<uint8_t>& applicationId, const vector<uint8_t>& challenge,
-        uint64_t activeTimeMilliSeconds, uint64_t expireTimeMilliSeconds, bool isTestCredential) {
+optional<std::pair<vector<uint8_t>, vector<uint8_t>>> createEcKeyPairWithAttestationKey(
+        const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
+        const vector<uint8_t>& attestationKeyBlob, const vector<uint8_t>& attestationKeyCert,
+        bool isTestCredential) {
     // Pretend to be implemented in a trusted environment just so we can pass
     // the VTS tests. Of course, this is a pretend-only game since hopefully no
     // relying party is ever going to trust our batch key and those keys above
@@ -647,148 +889,45 @@
     ::keymaster::PureSoftKeymasterContext context(::keymaster::KmVersion::KEYMINT_1,
                                                   KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT);
 
-    keymaster_error_t error;
-    ::keymaster::CertificateChain attestation_chain =
-            context.GetAttestationChain(KM_ALGORITHM_EC, &error);
-    if (KM_ERROR_OK != error) {
-        LOG(ERROR) << "Error getting attestation chain " << error;
-        return {};
-    }
-    if (expireTimeMilliSeconds == 0) {
-        if (attestation_chain.entry_count < 1) {
-            LOG(ERROR) << "Expected at least one entry in attestation chain";
-            return {};
-        }
-        keymaster_blob_t* bcBlob = &(attestation_chain.entries[0]);
-        const uint8_t* bcData = bcBlob->data;
-        auto bc = X509_Ptr(d2i_X509(nullptr, &bcData, bcBlob->data_length));
-        time_t bcNotAfter;
-        if (!parseAsn1Time(X509_get0_notAfter(bc.get()), &bcNotAfter)) {
-            LOG(ERROR) << "Error getting notAfter from batch certificate";
-            return {};
-        }
-        expireTimeMilliSeconds = bcNotAfter * 1000;
+    EVP_PKEY_Ptr pkey = generateP256Key();
+
+    uint64_t validFromMs = time(nullptr) * 1000;
+    optional<uint64_t> notAfterMs =
+            getCertificateExpiryAsMillis(attestationKeyCert.data(), attestationKeyCert.size());
+    if (!notAfterMs) {
+        LOG(ERROR) << "Error getting expiration time for attestation cert";
+        return std::nullopt;
     }
 
-    ::keymaster::X509_NAME_Ptr subjectName;
-    if (KM_ERROR_OK !=
-        ::keymaster::make_name_from_str("Android Identity Credential Key", &subjectName)) {
-        LOG(ERROR) << "Cannot create attestation subject";
-        return {};
+    optional<vector<uint8_t>> derIssuerSubject =
+            extractDerSubjectFromCertificate(attestationKeyCert);
+    if (!derIssuerSubject) {
+        LOG(ERROR) << "Error error extracting issuer name from the given certificate chain";
+        return std::nullopt;
     }
 
-    vector<uint8_t> subject(i2d_X509_NAME(subjectName.get(), NULL));
-    unsigned char* subjectPtr = subject.data();
-
-    i2d_X509_NAME(subjectName.get(), &subjectPtr);
-
-    ::keymaster::AuthorizationSet auth_set(
-            ::keymaster::AuthorizationSetBuilder()
-                    .Authorization(::keymaster::TAG_CERTIFICATE_NOT_BEFORE, activeTimeMilliSeconds)
-                    .Authorization(::keymaster::TAG_CERTIFICATE_NOT_AFTER, expireTimeMilliSeconds)
-                    .Authorization(::keymaster::TAG_ATTESTATION_CHALLENGE, challenge.data(),
-                                   challenge.size())
-                    .Authorization(::keymaster::TAG_ACTIVE_DATETIME, activeTimeMilliSeconds)
-                    // Even though identity attestation hal said the application
-                    // id should be in software enforced authentication set,
-                    // keymaster portable lib expect the input in this
-                    // parameter because the software enforced in input to keymaster
-                    // refers to the key software enforced properties. And this
-                    // parameter refers to properties of the attestation which
-                    // includes app id.
-                    .Authorization(::keymaster::TAG_ATTESTATION_APPLICATION_ID,
-                                   applicationId.data(), applicationId.size())
-                    .Authorization(::keymaster::TAG_CERTIFICATE_SUBJECT, subject.data(),
-                                   subject.size())
-                    .Authorization(::keymaster::TAG_USAGE_EXPIRE_DATETIME, expireTimeMilliSeconds));
-
-    // Unique id and device id is not applicable for identity credential attestation,
-    // so we don't need to set those or application id.
-    ::keymaster::AuthorizationSet swEnforced(::keymaster::AuthorizationSetBuilder().Authorization(
-            ::keymaster::TAG_CREATION_DATETIME, activeTimeMilliSeconds));
-
-    ::keymaster::AuthorizationSetBuilder hwEnforcedBuilder =
-            ::keymaster::AuthorizationSetBuilder()
-                    .Authorization(::keymaster::TAG_PURPOSE, KM_PURPOSE_SIGN)
-                    .Authorization(::keymaster::TAG_KEY_SIZE, 256)
-                    .Authorization(::keymaster::TAG_ALGORITHM, KM_ALGORITHM_EC)
-                    .Authorization(::keymaster::TAG_NO_AUTH_REQUIRED)
-                    .Authorization(::keymaster::TAG_DIGEST, KM_DIGEST_SHA_2_256)
-                    .Authorization(::keymaster::TAG_EC_CURVE, KM_EC_CURVE_P_256)
-                    .Authorization(::keymaster::TAG_OS_VERSION, 42)
-                    .Authorization(::keymaster::TAG_OS_PATCHLEVEL, 43);
-
-    // Only include TAG_IDENTITY_CREDENTIAL_KEY if it's not a test credential
-    if (!isTestCredential) {
-        hwEnforcedBuilder.Authorization(::keymaster::TAG_IDENTITY_CREDENTIAL_KEY);
+    optional<vector<vector<uint8_t>>> attestationCertChain = signAttestationCertificate(
+            context, pkey.get(), applicationId, challenge, attestationKeyBlob, *derIssuerSubject,
+            validFromMs, *notAfterMs, isTestCredential);
+    if (!attestationCertChain) {
+        LOG(ERROR) << "Error signing attestation certificate";
+        return std::nullopt;
     }
-    ::keymaster::AuthorizationSet hwEnforced(hwEnforcedBuilder);
-
-    ::keymaster::CertificateChain cert_chain_out = generate_attestation(
-            key, swEnforced, hwEnforced, auth_set, {} /* attest_key */, context, &error);
-
-    if (KM_ERROR_OK != error) {
-        LOG(ERROR) << "Error generating attestation from EVP key: " << error;
-        return {};
-    }
-
-    // translate certificate format from keymaster_cert_chain_t to vector<vector<uint8_t>>.
-    vector<vector<uint8_t>> attestationCertificate;
-    for (std::size_t i = 0; i < cert_chain_out.entry_count; i++) {
-        attestationCertificate.insert(
-                attestationCertificate.end(),
-                vector<uint8_t>(
-                        cert_chain_out.entries[i].data,
-                        cert_chain_out.entries[i].data + cert_chain_out.entries[i].data_length));
-    }
-
-    return attestationCertificate;
-}
-
-optional<std::pair<vector<uint8_t>, vector<vector<uint8_t>>>> createEcKeyPairAndAttestation(
-        const vector<uint8_t>& challenge, const vector<uint8_t>& applicationId,
-        bool isTestCredential) {
-    auto ec_key = ::keymaster::EC_KEY_Ptr(EC_KEY_new());
-    auto pkey = ::keymaster::EVP_PKEY_Ptr(EVP_PKEY_new());
-    auto group = ::keymaster::EC_GROUP_Ptr(EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
-
-    if (ec_key.get() == nullptr || pkey.get() == nullptr) {
-        LOG(ERROR) << "Memory allocation failed";
-        return {};
-    }
-
-    if (EC_KEY_set_group(ec_key.get(), group.get()) != 1 ||
-        EC_KEY_generate_key(ec_key.get()) != 1 || EC_KEY_check_key(ec_key.get()) < 0) {
-        LOG(ERROR) << "Error generating key";
-        return {};
-    }
-
-    if (EVP_PKEY_set1_EC_KEY(pkey.get(), ec_key.get()) != 1) {
-        LOG(ERROR) << "Error getting private key";
-        return {};
-    }
-
-    uint64_t nowMs = time(nullptr) * 1000;
-    uint64_t expireTimeMs = 0;  // Set to same as batch certificate
-
-    optional<vector<vector<uint8_t>>> attestationCert = createAttestation(
-            pkey.get(), applicationId, challenge, nowMs, expireTimeMs, isTestCredential);
-    if (!attestationCert) {
+    if (!attestationCertChain) {
         LOG(ERROR) << "Error create attestation from key and challenge";
-        return {};
+        return std::nullopt;
+    }
+    if (attestationCertChain->size() != 1) {
+        LOG(ERROR) << "Expected exactly one attestation cert, got " << attestationCertChain->size();
+        return std::nullopt;
     }
 
-    int size = i2d_PrivateKey(pkey.get(), nullptr);
-    if (size == 0) {
-        LOG(ERROR) << "Error generating public key encoding";
-        return {};
+    optional<vector<uint8_t>> keyPair = derEncodeKeyPair(*pkey);
+    if (!keyPair) {
+        return std::nullopt;
     }
 
-    vector<uint8_t> keyPair(size);
-    unsigned char* p = keyPair.data();
-    i2d_PrivateKey(pkey.get(), &p);
-
-    return make_pair(keyPair, attestationCert.value());
+    return make_pair(*keyPair, attestationCertChain->at(0));
 }
 
 optional<vector<vector<uint8_t>>> createAttestationForEcPublicKey(
@@ -820,12 +959,8 @@
         return {};
     }
 
-    uint64_t nowMs = time(nullptr) * 1000;
-    uint64_t expireTimeMs = 0;  // Set to same as batch certificate
-
     optional<vector<vector<uint8_t>>> attestationCert =
-            createAttestation(pkey.get(), applicationId, challenge, nowMs, expireTimeMs,
-                              false /* isTestCredential */);
+            createAttestation(pkey.get(), applicationId, challenge, false /* isTestCredential */);
     if (!attestationCert) {
         LOG(ERROR) << "Error create attestation from key and challenge";
         return {};
@@ -1134,6 +1269,14 @@
         return {};
     }
 
+    return ecPublicKeyGenerateCertificate(pkey.get(), privPkey.get(), serialDecimal, issuer,
+                                          subject, validityNotBefore, validityNotAfter, extensions);
+}
+
+optional<vector<uint8_t>> ecPublicKeyGenerateCertificate(
+        EVP_PKEY* publicKey, EVP_PKEY* signingKey, const string& serialDecimal,
+        const string& issuer, const string& subject, time_t validityNotBefore,
+        time_t validityNotAfter, const map<string, vector<uint8_t>>& extensions) {
     auto x509 = X509_Ptr(X509_new());
     if (!x509.get()) {
         LOG(ERROR) << "Error creating X509 certificate";
@@ -1145,7 +1288,7 @@
         return {};
     }
 
-    if (X509_set_pubkey(x509.get(), pkey.get()) != 1) {
+    if (X509_set_pubkey(x509.get(), publicKey) != 1) {
         LOG(ERROR) << "Error setting public key";
         return {};
     }
@@ -1220,7 +1363,7 @@
         }
     }
 
-    if (X509_sign(x509.get(), privPkey.get(), EVP_sha256()) == 0) {
+    if (X509_sign(x509.get(), signingKey, EVP_sha256()) == 0) {
         LOG(ERROR) << "Error signing X509 certificate";
         return {};
     }
diff --git a/input/classifier/README.md b/input/classifier/README.md
new file mode 100644
index 0000000..a68d726
--- /dev/null
+++ b/input/classifier/README.md
@@ -0,0 +1 @@
+This HAL is deprecated. Do not use this HAL. Use IInputProcessor instead, located in `hardware/interfaces/input/processor`.
\ No newline at end of file
diff --git a/input/common/aidl/Android.bp b/input/common/aidl/Android.bp
index 6cf64a6..b96f4d0 100644
--- a/input/common/aidl/Android.bp
+++ b/input/common/aidl/Android.bp
@@ -9,6 +9,7 @@
 
 aidl_interface {
     name: "android.hardware.input.common",
+    vendor_available: true,
     srcs: ["android/hardware/input/common/*.aidl"],
     stability: "vintf",
     backend: {
diff --git a/input/common/aidl/aidl_api/android.hardware.input.common/current/android/hardware/input/common/Source.aidl b/input/common/aidl/aidl_api/android.hardware.input.common/current/android/hardware/input/common/Source.aidl
index 24d02cd..396e06d 100644
--- a/input/common/aidl/aidl_api/android.hardware.input.common/current/android/hardware/input/common/Source.aidl
+++ b/input/common/aidl/aidl_api/android.hardware.input.common/current/android/hardware/input/common/Source.aidl
@@ -48,6 +48,7 @@
   TOUCH_NAVIGATION = 2097152,
   ROTARY_ENCODER = 4194304,
   JOYSTICK = 16777232,
+  HDMI = 33554433,
   SENSOR = 67108864,
   ANY = -256,
 }
diff --git a/input/common/aidl/android/hardware/input/common/Source.aidl b/input/common/aidl/android/hardware/input/common/Source.aidl
index 7eb6d66..c6a825a 100644
--- a/input/common/aidl/android/hardware/input/common/Source.aidl
+++ b/input/common/aidl/android/hardware/input/common/Source.aidl
@@ -38,6 +38,11 @@
     TOUCH_NAVIGATION = (1 << 21) | SourceClass.NONE,
     ROTARY_ENCODER = (1 << 22) | SourceClass.NONE,
     JOYSTICK = (1 << 24) | SourceClass.JOYSTICK,
+    /**
+     * The input source is a device connected through HDMI-based bus.
+     * The keys come in through HDMI-CEC or MHL signal line.
+     */
+    HDMI = (1 << 25) | SourceClass.BUTTON,
     SENSOR = (1 << 26) | SourceClass.NONE,
     ANY = 0xFFFFFF00,
 }
diff --git a/input/processor/aidl/Android.bp b/input/processor/aidl/Android.bp
new file mode 100644
index 0000000..f848a57
--- /dev/null
+++ b/input/processor/aidl/Android.bp
@@ -0,0 +1,26 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+aidl_interface {
+    name: "android.hardware.input.processor",
+    vendor_available: true,
+    srcs: ["android/hardware/input/processor/*.aidl"],
+    imports: [
+        "android.hardware.input.common",
+    ],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            enabled: false,
+        },
+    },
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/input/processor/aidl/aidl_api/android.hardware.input.processor/current/android/hardware/input/processor/IInputProcessor.aidl
similarity index 84%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to input/processor/aidl/aidl_api/android.hardware.input.processor/current/android/hardware/input/processor/IInputProcessor.aidl
index 4f29c0b..9d00c70 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/input/processor/aidl/aidl_api/android.hardware.input.processor/current/android/hardware/input/processor/IInputProcessor.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright (C) 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.input.processor;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+interface IInputProcessor {
+  android.hardware.input.common.Classification classify(in android.hardware.input.common.MotionEvent event);
+  void reset();
+  void resetDevice(in int deviceId);
 }
diff --git a/input/processor/aidl/android/hardware/input/processor/IInputProcessor.aidl b/input/processor/aidl/android/hardware/input/processor/IInputProcessor.aidl
new file mode 100644
index 0000000..635ff0a
--- /dev/null
+++ b/input/processor/aidl/android/hardware/input/processor/IInputProcessor.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.input.processor;
+
+@VintfStability
+interface IInputProcessor {
+    /**
+     * Upon receiving the current motion event, return the classification based on the current
+     * sequence of motion events.
+     * Once the classification has been determined, it should not change until a new gesture is
+     * started.
+     */
+    android.hardware.input.common.Classification classify(
+            in android.hardware.input.common.MotionEvent event);
+
+    /**
+     * Reset the HAL internal state. The reset may be called to prevent an inconsistent
+     * stream of events to be sent to the HAL.
+     */
+    void reset();
+
+    /**
+     * Called when an input device has been reset.
+     */
+    void resetDevice(in int deviceId);
+}
diff --git a/input/processor/aidl/default/Android.bp b/input/processor/aidl/default/Android.bp
new file mode 100644
index 0000000..f485597
--- /dev/null
+++ b/input/processor/aidl/default/Android.bp
@@ -0,0 +1,54 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_library_static {
+    name: "libinputprocessorexampleimpl",
+    vendor: true,
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "liblog",
+        "libutils",
+        "android.hardware.input.common-V1-ndk",
+        "android.hardware.input.processor-V1-ndk",
+    ],
+    export_include_dirs: ["include"],
+    srcs: [
+        "InputProcessor.cpp",
+    ],
+    visibility: [
+        ":__subpackages__",
+        "//hardware/interfaces/tests/extension/input/processor:__subpackages__",
+    ],
+}
+
+filegroup {
+    name: "android.hardware.input.processor.xml",
+    srcs: ["android.hardware.input.processor.xml"],
+}
+
+cc_binary {
+    name: "android.hardware.input.processor-service.example",
+    relative_install_path: "hw",
+    init_rc: ["inputprocessor-default.rc"],
+    vintf_fragments: [":android.hardware.input.processor.xml"],
+    vendor: true,
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "liblog",
+        "libutils",
+        "android.hardware.input.common-V1-ndk",
+        "android.hardware.input.processor-V1-ndk",
+    ],
+    static_libs: [
+        "libinputprocessorexampleimpl",
+    ],
+    srcs: ["main.cpp"],
+}
diff --git a/input/processor/aidl/default/InputProcessor.cpp b/input/processor/aidl/default/InputProcessor.cpp
new file mode 100644
index 0000000..fb6bbd5
--- /dev/null
+++ b/input/processor/aidl/default/InputProcessor.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "inputprocessor-impl/InputProcessor.h"
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace input {
+namespace processor {
+
+using ::aidl::android::hardware::input::common::Classification;
+using aidl::android::hardware::input::common::MotionEvent;
+
+::ndk::ScopedAStatus InputProcessor::classify(const MotionEvent& /*in_event*/,
+                                              Classification* _aidl_return) {
+    *_aidl_return = Classification::NONE;
+    return ndk::ScopedAStatus::ok();
+}
+::ndk::ScopedAStatus InputProcessor::reset() {
+    return ndk::ScopedAStatus::ok();
+}
+::ndk::ScopedAStatus InputProcessor::resetDevice(int32_t /*in_deviceId*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+}  // namespace processor
+}  // namespace input
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
\ No newline at end of file
diff --git a/input/processor/aidl/default/android.hardware.input.processor.xml b/input/processor/aidl/default/android.hardware.input.processor.xml
new file mode 100644
index 0000000..5ecbd2a
--- /dev/null
+++ b/input/processor/aidl/default/android.hardware.input.processor.xml
@@ -0,0 +1,7 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.input.processor</name>
+        <version>1</version>
+        <fqname>IInputProcessor/default</fqname>
+    </hal>
+</manifest>
\ No newline at end of file
diff --git a/input/processor/aidl/default/include/inputprocessor-impl/InputProcessor.h b/input/processor/aidl/default/include/inputprocessor-impl/InputProcessor.h
new file mode 100644
index 0000000..0d6bc58
--- /dev/null
+++ b/input/processor/aidl/default/include/inputprocessor-impl/InputProcessor.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/input/processor/BnInputProcessor.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace input {
+namespace processor {
+
+class InputProcessor : public ::aidl::android::hardware::input::processor::BnInputProcessor {
+  public:
+    ::ndk::ScopedAStatus classify(
+            const ::aidl::android::hardware::input::common::MotionEvent& in_event,
+            ::aidl::android::hardware::input::common::Classification* _aidl_return) override;
+    ::ndk::ScopedAStatus reset() override;
+    ::ndk::ScopedAStatus resetDevice(int32_t in_deviceId) override;
+};
+
+}  // namespace processor
+}  // namespace input
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
\ No newline at end of file
diff --git a/input/processor/aidl/default/inputprocessor-default.rc b/input/processor/aidl/default/inputprocessor-default.rc
new file mode 100644
index 0000000..bcc6c02
--- /dev/null
+++ b/input/processor/aidl/default/inputprocessor-default.rc
@@ -0,0 +1,4 @@
+service vendor.inputprocessor-default /vendor/bin/hw/android.hardware.input.processor-service.example
+    class hal
+    user nobody
+    group nobody
\ No newline at end of file
diff --git a/input/processor/aidl/default/main.cpp b/input/processor/aidl/default/main.cpp
new file mode 100644
index 0000000..7b519dd
--- /dev/null
+++ b/input/processor/aidl/default/main.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "inputprocessor-impl/InputProcessor.h"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+using ::aidl::android::hardware::input::processor::IInputProcessor;
+using ::aidl::android::hardware::input::processor::InputProcessor;
+
+int main() {
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+
+    auto processor = ndk::SharedRefBase::make<InputProcessor>();
+    const std::string name = std::string() + InputProcessor::descriptor + "/default";
+    binder_status_t status = AServiceManager_addService(processor->asBinder().get(), name.c_str());
+    CHECK_EQ(status, STATUS_OK);
+
+    ABinderProcess_joinThreadPool();
+    return EXIT_FAILURE;  // should not reach
+}
\ No newline at end of file
diff --git a/keymaster/3.0/vts/functional/Android.bp b/keymaster/3.0/vts/functional/Android.bp
index e2ae803..39bec3f 100644
--- a/keymaster/3.0/vts/functional/Android.bp
+++ b/keymaster/3.0/vts/functional/Android.bp
@@ -38,5 +38,11 @@
         "libcrypto_static",
         "libsoftkeymasterdevice",
     ],
-    test_suites: ["general-tests", "vts"],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+    sanitize: {
+        cfi: false,
+    },
 }
diff --git a/keymaster/4.1/vts/functional/Android.bp b/keymaster/4.1/vts/functional/Android.bp
index c650bec..547ce38 100644
--- a/keymaster/4.1/vts/functional/Android.bp
+++ b/keymaster/4.1/vts/functional/Android.bp
@@ -48,4 +48,7 @@
         "general-tests",
         "vts",
     ],
+    sanitize: {
+        cfi: false,
+    },
 }
diff --git a/media/1.0/Android.bp b/media/1.0/Android.bp
index 6e823f6..22a6d59 100644
--- a/media/1.0/Android.bp
+++ b/media/1.0/Android.bp
@@ -22,4 +22,8 @@
         "android.hardware.graphics.common@1.0",
     ],
     gen_java: true,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media.swcodec",
+    ],
 }
diff --git a/media/bufferpool/2.0/Android.bp b/media/bufferpool/2.0/Android.bp
index 01273c1..56597db 100644
--- a/media/bufferpool/2.0/Android.bp
+++ b/media/bufferpool/2.0/Android.bp
@@ -26,4 +26,8 @@
         "android.hidl.base@1.0",
     ],
     gen_java: false,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media.swcodec",
+    ],
 }
diff --git a/media/c2/1.0/Android.bp b/media/c2/1.0/Android.bp
index dc56fef..a591dc7 100644
--- a/media/c2/1.0/Android.bp
+++ b/media/c2/1.0/Android.bp
@@ -36,4 +36,9 @@
         "android.hidl.safe_union@1.0",
     ],
     gen_java: false,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media.swcodec",
+        "test_com.android.media.swcodec",
+    ],
 }
diff --git a/media/c2/1.1/Android.bp b/media/c2/1.1/Android.bp
index 885a4c8..bec3a06 100644
--- a/media/c2/1.1/Android.bp
+++ b/media/c2/1.1/Android.bp
@@ -30,4 +30,9 @@
         "android.hidl.safe_union@1.0",
     ],
     gen_java: false,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media.swcodec",
+        "test_com.android.media.swcodec",
+    ],
 }
diff --git a/media/omx/1.0/Android.bp b/media/omx/1.0/Android.bp
index e33bab3..ea63467 100644
--- a/media/omx/1.0/Android.bp
+++ b/media/omx/1.0/Android.bp
@@ -31,4 +31,8 @@
         "android.hidl.base@1.0",
     ],
     gen_java: false,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.media.swcodec",
+    ],
 }
diff --git a/neuralnetworks/1.0/utils/Android.bp b/neuralnetworks/1.0/utils/Android.bp
index 31cdded..ad30e30 100644
--- a/neuralnetworks/1.0/utils/Android.bp
+++ b/neuralnetworks/1.0/utils/Android.bp
@@ -31,16 +31,11 @@
     export_include_dirs: ["include"],
     cflags: ["-Wthread-safety"],
     static_libs: [
+        "android.hardware.neuralnetworks@1.0",
         "libarect",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
     ],
-    shared_libs: [
-        "android.hardware.neuralnetworks@1.0",
-    ],
-    export_static_lib_headers: [
-        "neuralnetworks_utils_hal_common",
-    ],
     target: {
         android: {
             shared_libs: ["libnativewindow"],
@@ -55,19 +50,14 @@
     static_libs: [
         "android.hardware.neuralnetworks@1.0",
         "libgmock",
-        "libneuralnetworks_common",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
         "neuralnetworks_utils_hal_1_0",
     ],
     shared_libs: [
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
         "libbase",
         "libcutils",
-        "libfmq",
         "libhidlbase",
-        "libhidlmemory",
         "liblog",
         "libutils",
     ],
diff --git a/neuralnetworks/1.1/utils/Android.bp b/neuralnetworks/1.1/utils/Android.bp
index 737ff58..4b8999f 100644
--- a/neuralnetworks/1.1/utils/Android.bp
+++ b/neuralnetworks/1.1/utils/Android.bp
@@ -31,17 +31,12 @@
     export_include_dirs: ["include"],
     cflags: ["-Wthread-safety"],
     static_libs: [
+        "android.hardware.neuralnetworks@1.0",
+        "android.hardware.neuralnetworks@1.1",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
         "neuralnetworks_utils_hal_1_0",
     ],
-    shared_libs: [
-        "android.hardware.neuralnetworks@1.0",
-        "android.hardware.neuralnetworks@1.1",
-    ],
-    export_static_lib_headers: [
-        "neuralnetworks_utils_hal_common",
-    ],
 }
 
 cc_test {
@@ -52,20 +47,15 @@
         "android.hardware.neuralnetworks@1.0",
         "android.hardware.neuralnetworks@1.1",
         "libgmock",
-        "libneuralnetworks_common",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
         "neuralnetworks_utils_hal_1_0",
         "neuralnetworks_utils_hal_1_1",
     ],
     shared_libs: [
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
         "libbase",
         "libcutils",
-        "libfmq",
         "libhidlbase",
-        "libhidlmemory",
         "liblog",
         "libutils",
     ],
diff --git a/neuralnetworks/1.2/utils/Android.bp b/neuralnetworks/1.2/utils/Android.bp
index 4eefb0f..4c5f065 100644
--- a/neuralnetworks/1.2/utils/Android.bp
+++ b/neuralnetworks/1.2/utils/Android.bp
@@ -31,19 +31,14 @@
     export_include_dirs: ["include"],
     cflags: ["-Wthread-safety"],
     static_libs: [
-        "neuralnetworks_types",
-        "neuralnetworks_utils_hal_common",
-        "neuralnetworks_utils_hal_1_0",
-        "neuralnetworks_utils_hal_1_1",
-    ],
-    shared_libs: [
         "android.hardware.neuralnetworks@1.0",
         "android.hardware.neuralnetworks@1.1",
         "android.hardware.neuralnetworks@1.2",
         "libfmq",
-    ],
-    export_static_lib_headers: [
+        "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
+        "neuralnetworks_utils_hal_1_0",
+        "neuralnetworks_utils_hal_1_1",
     ],
     product_variables: {
         debuggable: { // eng and userdebug builds
@@ -71,7 +66,6 @@
         "android.hardware.neuralnetworks@1.1",
         "android.hardware.neuralnetworks@1.2",
         "libgmock",
-        "libneuralnetworks_common",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
         "neuralnetworks_utils_hal_1_0",
@@ -79,13 +73,10 @@
         "neuralnetworks_utils_hal_1_2",
     ],
     shared_libs: [
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
         "libbase",
         "libcutils",
         "libfmq",
         "libhidlbase",
-        "libhidlmemory",
         "liblog",
         "libutils",
     ],
diff --git a/neuralnetworks/1.3/utils/Android.bp b/neuralnetworks/1.3/utils/Android.bp
index 7acb4fc..c512dda 100644
--- a/neuralnetworks/1.3/utils/Android.bp
+++ b/neuralnetworks/1.3/utils/Android.bp
@@ -31,21 +31,16 @@
     export_include_dirs: ["include"],
     cflags: ["-Wthread-safety"],
     static_libs: [
-        "neuralnetworks_types",
-        "neuralnetworks_utils_hal_common",
-        "neuralnetworks_utils_hal_1_0",
-        "neuralnetworks_utils_hal_1_1",
-        "neuralnetworks_utils_hal_1_2",
-    ],
-    shared_libs: [
         "android.hardware.neuralnetworks@1.0",
         "android.hardware.neuralnetworks@1.1",
         "android.hardware.neuralnetworks@1.2",
         "android.hardware.neuralnetworks@1.3",
         "libfmq",
-    ],
-    export_static_lib_headers: [
+        "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
+        "neuralnetworks_utils_hal_1_0",
+        "neuralnetworks_utils_hal_1_1",
+        "neuralnetworks_utils_hal_1_2",
     ],
     target: {
         host: {
@@ -69,7 +64,6 @@
         "android.hardware.neuralnetworks@1.2",
         "android.hardware.neuralnetworks@1.3",
         "libgmock",
-        "libneuralnetworks_common",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
         "neuralnetworks_utils_hal_1_0",
@@ -78,13 +72,10 @@
         "neuralnetworks_utils_hal_1_3",
     ],
     shared_libs: [
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
         "libbase",
         "libcutils",
         "libfmq",
         "libhidlbase",
-        "libhidlmemory",
         "liblog",
         "libutils",
     ],
diff --git a/neuralnetworks/aidl/utils/Android.bp b/neuralnetworks/aidl/utils/Android.bp
index 3faa613..9148eac 100644
--- a/neuralnetworks/aidl/utils/Android.bp
+++ b/neuralnetworks/aidl/utils/Android.bp
@@ -111,19 +111,13 @@
     static_libs: [
         "libaidlcommonsupport",
         "libgmock",
-        "libneuralnetworks_common",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
     ],
     shared_libs: [
-        "android.hidl.allocator@1.0",
         "libbase",
         "libbinder_ndk",
         "libcutils",
-        "libhidlbase",
-        "libhidlmemory",
-        "liblog",
-        "libutils",
     ],
     target: {
         android: {
diff --git a/neuralnetworks/aidl/utils/test/MockBuffer.h b/neuralnetworks/aidl/utils/test/MockBuffer.h
index f77fa86..7a05a0f 100644
--- a/neuralnetworks/aidl/utils/test/MockBuffer.h
+++ b/neuralnetworks/aidl/utils/test/MockBuffer.h
@@ -21,7 +21,6 @@
 #include <android/binder_interface_utils.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
-#include <hidl/Status.h>
 
 namespace aidl::android::hardware::neuralnetworks::utils {
 
diff --git a/neuralnetworks/aidl/utils/test/MockBurst.h b/neuralnetworks/aidl/utils/test/MockBurst.h
index 4cf60b6..609bd30 100644
--- a/neuralnetworks/aidl/utils/test/MockBurst.h
+++ b/neuralnetworks/aidl/utils/test/MockBurst.h
@@ -21,7 +21,6 @@
 #include <android/binder_interface_utils.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
-#include <hidl/Status.h>
 
 namespace aidl::android::hardware::neuralnetworks::utils {
 
diff --git a/neuralnetworks/aidl/utils/test/MockExecution.h b/neuralnetworks/aidl/utils/test/MockExecution.h
index 216f569..782e54f 100644
--- a/neuralnetworks/aidl/utils/test/MockExecution.h
+++ b/neuralnetworks/aidl/utils/test/MockExecution.h
@@ -21,8 +21,6 @@
 #include <android/binder_interface_utils.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
-#include <hidl/HidlSupport.h>
-#include <hidl/Status.h>
 
 namespace aidl::android::hardware::neuralnetworks::utils {
 
diff --git a/neuralnetworks/aidl/utils/test/MockFencedExecutionCallback.h b/neuralnetworks/aidl/utils/test/MockFencedExecutionCallback.h
index 06f9ea2..29449bb 100644
--- a/neuralnetworks/aidl/utils/test/MockFencedExecutionCallback.h
+++ b/neuralnetworks/aidl/utils/test/MockFencedExecutionCallback.h
@@ -22,7 +22,6 @@
 #include <android/binder_interface_utils.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
-#include <hidl/Status.h>
 
 namespace aidl::android::hardware::neuralnetworks::utils {
 
diff --git a/neuralnetworks/aidl/utils/test/MockPreparedModel.h b/neuralnetworks/aidl/utils/test/MockPreparedModel.h
index 318acc2..a5b3b66 100644
--- a/neuralnetworks/aidl/utils/test/MockPreparedModel.h
+++ b/neuralnetworks/aidl/utils/test/MockPreparedModel.h
@@ -22,8 +22,6 @@
 #include <android/binder_interface_utils.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
-#include <hidl/HidlSupport.h>
-#include <hidl/Status.h>
 
 namespace aidl::android::hardware::neuralnetworks::utils {
 
diff --git a/neuralnetworks/aidl/vts/functional/Android.bp b/neuralnetworks/aidl/vts/functional/Android.bp
index 1ed15b8..356cdb0 100644
--- a/neuralnetworks/aidl/vts/functional/Android.bp
+++ b/neuralnetworks/aidl/vts/functional/Android.bp
@@ -30,6 +30,7 @@
         "neuralnetworks_vts_functional_defaults",
         "use_libaidlvintf_gtest_helper_static",
     ],
+    host_supported: true,
     srcs: [
         "BasicTests.cpp",
         "Callbacks.cpp",
@@ -46,18 +47,11 @@
     ],
     shared_libs: [
         "libbinder_ndk",
-        "libnativewindow",
-        "libvndksupport",
     ],
     static_libs: [
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
         "libaidlcommonsupport",
-        "libgmock",
-        "libhidlmemory",
         "libneuralnetworks_common",
         "libneuralnetworks_generated_test_harness",
-        "libsync",
     ],
     whole_static_libs: [
         "neuralnetworks_generated_AIDL_V3_example",
@@ -73,6 +67,34 @@
     ],
     test_suites: [
         "general-tests",
-        "vts",
     ],
+    target: {
+        android: {
+            shared_libs: [
+                "libnativewindow",
+                "libvndksupport",
+            ],
+            static_libs: [
+                "libsync",
+            ],
+            test_suites: [
+                "vts",
+            ],
+            test_config: "AndroidTestDevice.xml",
+        },
+        host: {
+            shared_libs: [
+                "libtextclassifier_hash",
+            ],
+            static_libs: [
+                "neuralnetworks_canonical_sample_driver",
+                "neuralnetworks_utils_hal_adapter_aidl",
+            ],
+            exclude_static_libs: [
+                "VtsHalHidlTestUtils",
+                "libaidlvintf_gtest_helper",
+            ],
+            test_config: "AndroidTestHost.xml",
+        },
+    },
 }
diff --git a/neuralnetworks/aidl/vts/functional/AndroidTest.xml b/neuralnetworks/aidl/vts/functional/AndroidTestDevice.xml
similarity index 100%
rename from neuralnetworks/aidl/vts/functional/AndroidTest.xml
rename to neuralnetworks/aidl/vts/functional/AndroidTestDevice.xml
diff --git a/neuralnetworks/aidl/vts/functional/AndroidTestHost.xml b/neuralnetworks/aidl/vts/functional/AndroidTestHost.xml
new file mode 100644
index 0000000..7372a31
--- /dev/null
+++ b/neuralnetworks/aidl/vts/functional/AndroidTestHost.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsHalNeuralnetworksTargetTest.">
+    <test class="com.android.tradefed.testtype.HostGTest" >
+        <option name="module-name" value="VtsHalNeuralnetworksTargetTest" />
+        <option name="native-test-timeout" value="15m" />
+    </test>
+</configuration>
+
diff --git a/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp b/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp
index 77208aa..7451f7e 100644
--- a/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp
+++ b/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp
@@ -23,7 +23,6 @@
 #include <fcntl.h>
 #include <ftw.h>
 #include <gtest/gtest.h>
-#include <hidlmemory/mapping.h>
 #include <unistd.h>
 
 #include <cstdio>
@@ -34,7 +33,6 @@
 
 #include "Callbacks.h"
 #include "GeneratedTestHarness.h"
-#include "MemoryUtils.h"
 #include "TestHarness.h"
 #include "Utils.h"
 #include "VtsHalNeuralnetworks.h"
@@ -229,7 +227,11 @@
 
         // Create cache directory. The cache directory and a temporary cache file is always created
         // to test the behavior of prepareModelFromCache, even when caching is not supported.
+#ifdef __ANDROID__
         char cacheDirTemp[] = "/data/local/tmp/TestCompilationCachingXXXXXX";
+#else   // __ANDROID__
+        char cacheDirTemp[] = "/tmp/TestCompilationCachingXXXXXX";
+#endif  // __ANDROID__
         char* cacheDir = mkdtemp(cacheDirTemp);
         ASSERT_NE(cacheDir, nullptr);
         mCacheDir = cacheDir;
diff --git a/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp b/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp
index 8c8a87a..40f6cd1 100644
--- a/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp
+++ b/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp
@@ -20,7 +20,6 @@
 #include <aidl/android/hardware/neuralnetworks/RequestMemoryPool.h>
 #include <android-base/logging.h>
 #include <android/binder_auto_utils.h>
-#include <android/sync.h>
 #include <gtest/gtest.h>
 
 #include <algorithm>
@@ -30,7 +29,6 @@
 #include <numeric>
 #include <vector>
 
-#include <MemoryUtils.h>
 #include <android/binder_status.h>
 #include <nnapi/Result.h>
 #include <nnapi/SharedMemory.h>
@@ -43,6 +41,10 @@
 #include "Utils.h"
 #include "VtsHalNeuralnetworks.h"
 
+#ifdef __ANDROID__
+#include <android/sync.h>
+#endif  // __ANDROID__
+
 namespace aidl::android::hardware::neuralnetworks::vts::functional {
 
 namespace nn = ::android::nn;
@@ -281,10 +283,14 @@
 }  // namespace
 
 void waitForSyncFence(int syncFd) {
-    constexpr int kInfiniteTimeout = -1;
     ASSERT_GT(syncFd, 0);
+#ifdef __ANDROID__
+    constexpr int kInfiniteTimeout = -1;
     int r = sync_wait(syncFd, kInfiniteTimeout);
     ASSERT_GE(r, 0);
+#else   // __ANDROID__
+    LOG(FATAL) << "waitForSyncFence not supported on host";
+#endif  // __ANDROID__
 }
 
 Model createModel(const TestModel& testModel) {
@@ -895,7 +901,11 @@
             outputTypesList = {OutputType::FULLY_SPECIFIED};
             measureTimingList = {false};
             executorList = {Executor::SYNC, Executor::BURST, Executor::FENCED};
+#ifdef __ANDROID__
             memoryTypeList = {MemoryType::BLOB_AHWB, MemoryType::DEVICE};
+#else   // __ANDROID__
+            memoryTypeList = {MemoryType::DEVICE};  // BLOB_AHWB is not supported on the host.
+#endif  // __ANDROID__
         } break;
         case TestKind::FENCED_COMPUTE: {
             outputTypesList = {OutputType::FULLY_SPECIFIED};
diff --git a/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp b/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp
index 97760ae..f8341b1 100644
--- a/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp
+++ b/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp
@@ -17,6 +17,7 @@
 #define LOG_TAG "neuralnetworks_aidl_hal_test"
 
 #include <aidl/android/hardware/graphics/common/PixelFormat.h>
+#include <aidl/android/hardware/neuralnetworks/IPreparedModel.h>
 #include <android-base/logging.h>
 #include <android/binder_auto_utils.h>
 #include <android/binder_interface_utils.h>
@@ -33,7 +34,6 @@
 
 #include "Callbacks.h"
 #include "GeneratedTestHarness.h"
-#include "MemoryUtils.h"
 #include "Utils.h"
 #include "VtsHalNeuralnetworks.h"
 
@@ -191,7 +191,7 @@
 }
 
 // A placeholder invalid IPreparedModel class for MemoryDomainAllocateTest.InvalidPreparedModel
-class InvalidPreparedModel : public BnPreparedModel {
+class InvalidPreparedModel final : public IPreparedModel {
   public:
     ndk::ScopedAStatus executeSynchronously(const Request&, bool, int64_t, int64_t,
                                             ExecutionResult*) override {
@@ -225,6 +225,16 @@
         return ndk::ScopedAStatus::fromServiceSpecificError(
                 static_cast<int32_t>(ErrorStatus::GENERAL_FAILURE));
     }
+    ndk::ScopedAStatus getInterfaceVersion(int32_t* /*interfaceVersion*/) {
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(ErrorStatus::GENERAL_FAILURE));
+    }
+    ndk::ScopedAStatus getInterfaceHash(std::string* /*interfaceHash*/) {
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(ErrorStatus::GENERAL_FAILURE));
+    }
+    ndk::SpAIBinder asBinder() override { return ::ndk::SpAIBinder{}; }
+    bool isRemote() override { return true; }
 };
 
 template <typename... Args>
diff --git a/neuralnetworks/aidl/vts/functional/Utils.cpp b/neuralnetworks/aidl/vts/functional/Utils.cpp
index efd5bca..1bc76f2 100644
--- a/neuralnetworks/aidl/vts/functional/Utils.cpp
+++ b/neuralnetworks/aidl/vts/functional/Utils.cpp
@@ -21,18 +21,20 @@
 #include <aidl/android/hardware/neuralnetworks/OperandType.h>
 #include <android-base/logging.h>
 #include <android/binder_status.h>
-#include <android/hardware_buffer.h>
 
 #include <sys/mman.h>
 #include <iostream>
 #include <limits>
 #include <numeric>
 
-#include <MemoryUtils.h>
 #include <nnapi/SharedMemory.h>
 #include <nnapi/hal/aidl/Conversions.h>
 #include <nnapi/hal/aidl/Utils.h>
 
+#ifdef __ANDROID__
+#include <android/hardware_buffer.h>
+#endif  // __ANDROID__
+
 namespace aidl::android::hardware::neuralnetworks {
 
 using test_helper::TestBuffer;
@@ -140,7 +142,8 @@
     return ahwb->mIsValid ? std::move(ahwb) : nullptr;
 }
 
-void TestBlobAHWB::initialize(uint32_t size) {
+void TestBlobAHWB::initialize([[maybe_unused]] uint32_t size) {
+#ifdef __ANDROID__
     mIsValid = false;
     ASSERT_GT(size, 0);
     const auto usage = AHARDWAREBUFFER_USAGE_CPU_READ_OFTEN | AHARDWAREBUFFER_USAGE_CPU_WRITE_OFTEN;
@@ -164,6 +167,9 @@
     mAidlMemory = utils::convert(mMemory).value();
 
     mIsValid = true;
+#else   // __ANDROID__
+    LOG(FATAL) << "TestBlobAHWB::initialize not supported on host";
+#endif  // __ANDROID__
 }
 
 std::string gtestCompliantName(std::string name) {
diff --git a/neuralnetworks/aidl/vts/functional/Utils.h b/neuralnetworks/aidl/vts/functional/Utils.h
index 0db3f8c..4e0a4aa 100644
--- a/neuralnetworks/aidl/vts/functional/Utils.h
+++ b/neuralnetworks/aidl/vts/functional/Utils.h
@@ -18,7 +18,6 @@
 #define ANDROID_HARDWARE_NEURALNETWORKS_AIDL_UTILS_H
 
 #include <android-base/logging.h>
-#include <android/hardware_buffer.h>
 #include <gtest/gtest.h>
 
 #include <algorithm>
diff --git a/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp b/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp
index ad93e6d..51b4805 100644
--- a/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp
+++ b/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp
@@ -15,6 +15,7 @@
  */
 
 #define LOG_TAG "neuralnetworks_aidl_hal_test"
+
 #include "VtsHalNeuralnetworks.h"
 
 #include <android-base/logging.h>
@@ -28,13 +29,19 @@
 #include <utility>
 
 #include <TestHarness.h>
-#include <aidl/Vintf.h>
 #include <nnapi/hal/aidl/Conversions.h>
 
 #include "Callbacks.h"
 #include "GeneratedTestHarness.h"
 #include "Utils.h"
 
+#ifdef __ANDROID__
+#include <aidl/Vintf.h>
+#else  // __ANDROID__
+#include <CanonicalDevice.h>
+#include <nnapi/hal/aidl/Adapter.h>
+#endif  // __ANDROID__
+
 namespace aidl::android::hardware::neuralnetworks::vts::functional {
 
 using implementation::PreparedModelCallback;
@@ -111,6 +118,7 @@
     ASSERT_TRUE(deviceIsResponsive);
 }
 
+#ifdef __ANDROID__
 static NamedDevice makeNamedDevice(const std::string& name) {
     ndk::SpAIBinder binder(AServiceManager_waitForService(name.c_str()));
     return {name, IDevice::fromBinder(binder)};
@@ -127,6 +135,14 @@
     std::transform(names.begin(), names.end(), std::back_inserter(namedDevices), makeNamedDevice);
     return namedDevices;
 }
+#else   // __ANDROID__
+static std::vector<NamedDevice> getNamedDevicesImpl() {
+    const std::string name = "nnapi-sample";
+    auto device = std::make_shared<const ::android::nn::sample::Device>(name);
+    auto aidlDevice = adapter::adapt(device);
+    return {{name, aidlDevice}};
+}
+#endif  // __ANDROID__
 
 const std::vector<NamedDevice>& getNamedDevices() {
     const static std::vector<NamedDevice> devices = getNamedDevicesImpl();
diff --git a/neuralnetworks/utils/adapter/hidl/Android.bp b/neuralnetworks/utils/adapter/hidl/Android.bp
index d073106..6875daa 100644
--- a/neuralnetworks/utils/adapter/hidl/Android.bp
+++ b/neuralnetworks/utils/adapter/hidl/Android.bp
@@ -30,17 +30,16 @@
     local_include_dirs: ["include/nnapi/hal"],
     export_include_dirs: ["include"],
     static_libs: [
-        "neuralnetworks_types",
-        "neuralnetworks_utils_hal_1_0",
-        "neuralnetworks_utils_hal_1_1",
-        "neuralnetworks_utils_hal_1_2",
-        "neuralnetworks_utils_hal_1_3",
-    ],
-    shared_libs: [
         "android.hardware.neuralnetworks@1.0",
         "android.hardware.neuralnetworks@1.1",
         "android.hardware.neuralnetworks@1.2",
         "android.hardware.neuralnetworks@1.3",
         "libfmq",
+        "neuralnetworks_types",
+        "neuralnetworks_utils_hal_1_0",
+        "neuralnetworks_utils_hal_1_1",
+        "neuralnetworks_utils_hal_1_2",
+        "neuralnetworks_utils_hal_1_3",
+        "neuralnetworks_utils_hal_common",
     ],
 }
diff --git a/neuralnetworks/utils/common/Android.bp b/neuralnetworks/utils/common/Android.bp
index 39927a3..bfba24f 100644
--- a/neuralnetworks/utils/common/Android.bp
+++ b/neuralnetworks/utils/common/Android.bp
@@ -39,20 +39,12 @@
     srcs: ["test/*.cpp"],
     static_libs: [
         "libgmock",
-        "libneuralnetworks_common",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_common",
     ],
     shared_libs: [
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
         "libbase",
         "libcutils",
-        "libfmq",
-        "libhidlbase",
-        "libhidlmemory",
-        "liblog",
-        "libutils",
     ],
     target: {
         android: {
diff --git a/neuralnetworks/utils/service/Android.bp b/neuralnetworks/utils/service/Android.bp
index c3272ae..452078b 100644
--- a/neuralnetworks/utils/service/Android.bp
+++ b/neuralnetworks/utils/service/Android.bp
@@ -33,6 +33,10 @@
     local_include_dirs: ["include/nnapi/hal"],
     export_include_dirs: ["include"],
     static_libs: [
+        "android.hardware.neuralnetworks@1.0",
+        "android.hardware.neuralnetworks@1.1",
+        "android.hardware.neuralnetworks@1.2",
+        "android.hardware.neuralnetworks@1.3",
         "neuralnetworks_types",
         "neuralnetworks_utils_hal_1_0",
         "neuralnetworks_utils_hal_1_1",
@@ -40,10 +44,4 @@
         "neuralnetworks_utils_hal_1_3",
         "neuralnetworks_utils_hal_common",
     ],
-    shared_libs: [
-        "android.hardware.neuralnetworks@1.0",
-        "android.hardware.neuralnetworks@1.1",
-        "android.hardware.neuralnetworks@1.2",
-        "android.hardware.neuralnetworks@1.3",
-    ],
 }
diff --git a/nfc/OWNERS b/nfc/OWNERS
new file mode 100644
index 0000000..7867204
--- /dev/null
+++ b/nfc/OWNERS
@@ -0,0 +1,6 @@
+# Bug component: 48448
+alisher@google.com
+georgekgchang@google.com
+jackcwyu@google.com
+
+
diff --git a/nfc/aidl/Android.bp b/nfc/aidl/Android.bp
new file mode 100644
index 0000000..30365f6
--- /dev/null
+++ b/nfc/aidl/Android.bp
@@ -0,0 +1,43 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+aidl_interface {
+    name: "android.hardware.nfc",
+    vendor_available: true,
+    srcs: ["android/hardware/nfc/*.aidl"],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            sdk_version: "module_current",
+            enabled: false,
+        },
+        ndk: {
+            vndk: {
+                enabled: true,
+            },
+        },
+    },
+}
diff --git a/nfc/aidl/TEST_MAPPING b/nfc/aidl/TEST_MAPPING
new file mode 100644
index 0000000..3a10084
--- /dev/null
+++ b/nfc/aidl/TEST_MAPPING
@@ -0,0 +1,7 @@
+{
+  "presubmit": [
+    {
+      "name": "VtsAidlHalNfcTargetTest"
+    }
+  ]
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfc.aidl
similarity index 79%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfc.aidl
index 4f29c0b..7a0ae54 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfc.aidl
@@ -31,9 +31,17 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.nfc;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+interface INfc {
+  void open(in android.hardware.nfc.INfcClientCallback clientCallback);
+  void close(in android.hardware.nfc.NfcCloseType type);
+  void coreInitialized();
+  void factoryReset();
+  android.hardware.nfc.NfcConfig getConfig();
+  void powerCycle();
+  void preDiscover();
+  int write(in byte[] data);
+  void setEnableVerboseLogging(in boolean enable);
+  boolean isVerboseLoggingEnabled();
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfcClientCallback.aidl
similarity index 89%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfcClientCallback.aidl
index 4f29c0b..8150e81 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfcClientCallback.aidl
@@ -31,9 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.nfc;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+interface INfcClientCallback {
+  void sendData(in byte[] data);
+  void sendEvent(in android.hardware.nfc.NfcEvent event, in android.hardware.nfc.NfcStatus status);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcCloseType.aidl
similarity index 92%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcCloseType.aidl
index 4f29c0b..7d44d48 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcCloseType.aidl
@@ -31,9 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
-@VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+package android.hardware.nfc;
+@Backing(type="int") @VintfStability
+enum NfcCloseType {
+  DISABLE = 0,
+  HOST_SWITCHED_OFF = 1,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
similarity index 74%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
index 5395b11..92e0a9a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
@@ -31,13 +31,22 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
-@Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+package android.hardware.nfc;
+@VintfStability
+parcelable NfcConfig {
+  boolean nfaPollBailOutMode;
+  android.hardware.nfc.PresenceCheckAlgorithm presenceCheckAlgorithm;
+  android.hardware.nfc.ProtocolDiscoveryConfig nfaProprietaryCfg;
+  byte defaultOffHostRoute;
+  byte defaultOffHostRouteFelica;
+  byte defaultSystemCodeRoute;
+  byte defaultSystemCodePowerState;
+  byte defaultRoute;
+  byte offHostESEPipeId;
+  byte offHostSIMPipeId;
+  int maxIsoDepTransceiveLength;
+  byte[] hostAllowlist;
+  byte[] offHostRouteUicc;
+  byte[] offHostRouteEse;
+  byte defaultIsoDepRoute;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcEvent.aidl
similarity index 90%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcEvent.aidl
index 5395b11..dda258e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcEvent.aidl
@@ -31,13 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
+package android.hardware.nfc;
 @Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+enum NfcEvent {
+  OPEN_CPLT = 0,
+  CLOSE_CPLT = 1,
+  POST_INIT_CPLT = 2,
+  PRE_DISCOVER_CPLT = 3,
+  HCI_NETWORK_RESET = 4,
+  ERROR = 5,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcStatus.aidl
similarity index 90%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcStatus.aidl
index 5395b11..2632480 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcStatus.aidl
@@ -31,13 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
+package android.hardware.nfc;
 @Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+enum NfcStatus {
+  OK = 0,
+  FAILED = 1,
+  ERR_TRANSPORT = 2,
+  ERR_CMD_TIMEOUT = 3,
+  REFUSED = 4,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/PresenceCheckAlgorithm.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/PresenceCheckAlgorithm.aidl
index 4f29c0b..9a9be21 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/PresenceCheckAlgorithm.aidl
@@ -31,9 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
-@VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+package android.hardware.nfc;
+@Backing(type="byte") @VintfStability
+enum PresenceCheckAlgorithm {
+  DEFAULT = 0,
+  I_BLOCK = 1,
+  ISO_DEP_NAK = 2,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
similarity index 84%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
index 4f29c0b..021dfe2 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
@@ -31,9 +31,16 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.nfc;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+parcelable ProtocolDiscoveryConfig {
+  byte protocol18092Active;
+  byte protocolBPrime;
+  byte protocolDual;
+  byte protocol15693;
+  byte protocolKovio;
+  byte protocolMifare;
+  byte discoveryPollKovio;
+  byte discoveryPollBPrime;
+  byte discoveryListenBPrime;
 }
diff --git a/nfc/aidl/android/hardware/nfc/INfc.aidl b/nfc/aidl/android/hardware/nfc/INfc.aidl
new file mode 100644
index 0000000..662f8d4
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/INfc.aidl
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+import android.hardware.nfc.INfcClientCallback;
+import android.hardware.nfc.NfcCloseType;
+import android.hardware.nfc.NfcConfig;
+import android.hardware.nfc.NfcStatus;
+
+@VintfStability
+interface INfc {
+    /**
+     * Opens the NFC controller device and performs initialization.
+     * This may include patch download and other vendor-specific initialization.
+     *
+     * If open completes successfully, the controller must be ready to perform NCI
+     * initialization - ie accept CORE_RESET and subsequent commands through the write()
+     * call.
+     *
+     * Returns ok() if initialization starts successfully.
+     * If open() returns ok(), the NCI stack must wait for a NfcEvent.OPEN_CPLT
+     * callback before continuing.
+     * If a NfcEvent.OPEN_CPLT callback received with status NfcStatus::OK, the controller
+     * must be ready to perform  NCI initialization - ie accept CORE_RESET and subsequent
+     * commands through the write() call.
+     */
+    void open(in INfcClientCallback clientCallback);
+
+    /**
+     * Close the NFC HAL and setup NFC controller close type.
+     * Associated resources such as clientCallback must be released.
+     * The clientCallback reference from open() must be invalid after close().
+     * If close() returns ok(), the NCI stack must wait for a NfcEvent.CLOSE_CPLT
+     * callback before continuing.
+     * Returns an error if close may be called more than once.
+     * Calls to any other method which expect a callback after this must return
+     * a service-specific error NfcStatus::FAILED.
+     * HAL close automatically if the client drops the reference to the HAL or
+     * crashes.
+     */
+    void close(in NfcCloseType type);
+
+    /**
+     * coreInitialized() is called after the CORE_INIT_RSP is received from the
+     * NFCC. At this time, the HAL can do any chip-specific configuration.
+     *
+     * If coreInitialized() returns ok(), the NCI stack must wait for a
+     * NfcEvent.POST_INIT_CPLT before continuing.
+     * If coreInitialized() returns an error, the NCI stack must continue immediately.
+     *
+     * coreInitialized() must be called after open() registers the clientCallback
+     * or return a service-specific error NfcStatus::FAILED directly.
+     *
+     */
+    void coreInitialized();
+
+    /**
+     * Clears the NFC chip.
+     *
+     * Must be called during factory reset and/or before the first time the HAL is
+     * initialized after a factory reset.
+     */
+    void factoryReset();
+
+    /**
+     * Fetches vendor specific configurations.
+     * @return NfcConfig indicates support for certain features and
+     * populates the vendor specific configs.
+     */
+    NfcConfig getConfig();
+
+    /**
+     * Restart controller by power cyle;
+     * It's similar to open but just reset the controller without initialize all the
+     * resources.
+     *
+     * If powerCycle() returns ok(), the NCI stack must wait for a NfcEvent.OPEN_CPLT
+     * before continuing.
+     *
+     * powerCycle() must be called after open() registers the clientCallback
+     * or return a service-specific error NfcStatus::FAILED directly.
+     */
+    void powerCycle();
+
+    /**
+     * preDiscover is called every time before starting RF discovery.
+     * It is a good place to do vendor-specific configuration that must be
+     * performed every time RF discovery is about to be started.
+     *
+     * If preDiscover() returns ok(), the NCI stack must wait for a
+     * NfcEvent.PREDISCOVER_CPLT before continuing.
+     *
+     * preDiscover() must be called after open() registers the clientCallback
+     * or return a service-specific error NfcStatus::FAILED directly.
+     *
+     * If preDiscover() reports an error, the NCI stack must start RF discovery immediately.
+     */
+    void preDiscover();
+
+    /**
+     * Performs an NCI write.
+     *
+     * This method may queue writes and return immediately. The only
+     * requirement is that the writes are executed in order.
+     *
+     * @param data
+     * Data packet to transmit NCI Commands and Data Messages over write.
+     * Detailed format is defined in NFC Controller Interface (NCI) Technical Specification.
+     * https://nfc-forum.org/our-work/specification-releases/
+     *
+     * @return number of bytes written to the NFCC.
+     */
+    int write(in byte[] data);
+
+    /**
+     * Set the logging flag for NFC HAL to enable it's verbose logging.
+     * If verbose logging is not supported, the call must not have any effect on logging verbosity.
+     * However, isVerboseLoggingEnabled() must still return the value set by the last call to
+     * setEnableVerboseLogging().
+     * @param enable for setting the verbose logging flag to HAL
+     */
+    void setEnableVerboseLogging(in boolean enable);
+
+    /**
+     * Get the verbose logging flag value from NFC HAL.
+     * @return true if verbose logging flag value is enabled, false if disabled.
+     */
+    boolean isVerboseLoggingEnabled();
+}
diff --git a/nfc/aidl/android/hardware/nfc/INfcClientCallback.aidl b/nfc/aidl/android/hardware/nfc/INfcClientCallback.aidl
new file mode 100644
index 0000000..43d4f5c
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/INfcClientCallback.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+import android.hardware.nfc.NfcEvent;
+import android.hardware.nfc.NfcStatus;
+
+@VintfStability
+interface INfcClientCallback {
+    /**
+     * The callback passed in from the NFC stack that the HAL
+     * can use to pass incomming response data to the stack.
+     *
+     * @param data
+     * Data packet to transmit NCI Responses, Notifications, and Data
+     * Messages over sendData.
+     * Detailed format is defined in NFC Controller Interface (NCI) Technical Specification.
+     * https://nfc-forum.org/our-work/specification-releases/
+     */
+    void sendData(in byte[] data);
+
+    /**
+     * The callback passed in from the NFC stack that the HAL
+     * can use to pass events back to the stack.
+     */
+    void sendEvent(in NfcEvent event, in NfcStatus status);
+}
diff --git a/nfc/aidl/android/hardware/nfc/NfcCloseType.aidl b/nfc/aidl/android/hardware/nfc/NfcCloseType.aidl
new file mode 100644
index 0000000..5160532
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/NfcCloseType.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/**
+ * Different closing types for NFC HAL.
+ */
+@VintfStability
+@Backing(type="int")
+enum NfcCloseType {
+    /**
+     * Close the NFC controller and free NFC HAL resources.
+     */
+    DISABLE = 0,
+
+    /**
+     * Switch the NFC controller operation mode and free NFC HAL resources.
+     * Enable NFC functionality for off host card emulation usecases in
+     * device(host) power off(switched off) state, if the device
+     * supports power off use cases. If the device doesn't support power
+     * off use cases, this call should be same as DISABLE.
+     */
+    HOST_SWITCHED_OFF = 1,
+}
diff --git a/nfc/aidl/android/hardware/nfc/NfcConfig.aidl b/nfc/aidl/android/hardware/nfc/NfcConfig.aidl
new file mode 100644
index 0000000..1b4fcfb
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/NfcConfig.aidl
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+import android.hardware.nfc.PresenceCheckAlgorithm;
+import android.hardware.nfc.ProtocolDiscoveryConfig;
+
+/**
+ * Define Nfc related configurations based on:
+ * NFC Controller Interface (NCI) Technical Specification
+ * https://nfc-forum.org/our-work/specification-releases/
+ */
+@VintfStability
+parcelable NfcConfig {
+    /**
+     * If true, NFCC is using bail out mode for either Type A or Type B poll
+     * based on: Nfc-Forum Activity Technical Specification
+     * https://nfc-forum.org/our-work/specification-releases/
+     */
+    boolean nfaPollBailOutMode;
+    PresenceCheckAlgorithm presenceCheckAlgorithm;
+    ProtocolDiscoveryConfig nfaProprietaryCfg;
+    /**
+     * Default off-host route. 0x00 if there aren't any. Refer to NCI spec.
+     */
+    byte defaultOffHostRoute;
+    /**
+     * Default off-host route for Felica. 0x00 if there aren't any. Refer to
+     * NCI spec.
+     */
+    byte defaultOffHostRouteFelica;
+    /**
+     * Default system code route. 0x00 if there aren't any. Refer NCI spec.
+     */
+    byte defaultSystemCodeRoute;
+    /**
+     * Default power state for system code route. 0x00 if there aren't any.
+     * Refer to NCI spec.
+     */
+    byte defaultSystemCodePowerState;
+    /**
+     * Default route for all remaining protocols and technology which haven't
+     * been configured.
+     * Device Host(0x00) is the default. Refer to NCI spec.
+     *
+     */
+    byte defaultRoute;
+    /**
+     * Pipe ID for eSE. 0x00 if there aren't any.
+     */
+    byte offHostESEPipeId;
+    /**
+     * Pipe ID for UICC. 0x00 if there aren't any.
+     */
+    byte offHostSIMPipeId;
+    /**
+     * Extended APDU length for ISO_DEP. If not supported default length is 261
+     */
+    int maxIsoDepTransceiveLength;
+    /**
+     * list of allowed host ids, as per ETSI TS 102 622
+     * https://www.etsi.org/
+     */
+    byte[] hostAllowlist;
+    /**
+     * NFCEE ID for offhost UICC & eSE secure element.
+     * 0x00 if there aren't any. Refer to NCI spec.
+     */
+    byte[] offHostRouteUicc;
+    byte[] offHostRouteEse;
+    /**
+     * Default IsoDep route. 0x00 if there aren't any. Refer to NCI spec.
+     */
+    byte defaultIsoDepRoute;
+}
diff --git a/nfc/aidl/android/hardware/nfc/NfcEvent.aidl b/nfc/aidl/android/hardware/nfc/NfcEvent.aidl
new file mode 100644
index 0000000..a78b1cd
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/NfcEvent.aidl
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/**
+ * Nfc event to notify nfc status change.
+ */
+@VintfStability
+@Backing(type="int")
+enum NfcEvent {
+    /**
+     * Open complete event to notify upper layer when NFC HAL and NFCC
+     * initialization complete.
+     */
+    OPEN_CPLT = 0,
+    /**
+     * Close complete event to notify upper layer when HAL close is done.
+     */
+    CLOSE_CPLT = 1,
+    /**
+     * Post init complete event to notify upper layer when post init operations
+     * are done.
+     */
+    POST_INIT_CPLT = 2,
+    /**
+     * Pre-discover complete event to notify upper layer when pre-discover
+     * operations are done.
+     */
+    PRE_DISCOVER_CPLT = 3,
+    /**
+     * HCI network reset event to notify upplayer when HCI network needs to
+     * be re-initialized in case of an error.
+     */
+    HCI_NETWORK_RESET = 4,
+    /**
+     * Error event to notify upper layer when there's an unknown error.
+     */
+    ERROR = 5,
+}
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/nfc/aidl/android/hardware/nfc/NfcStatus.aidl
similarity index 66%
copy from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
copy to nfc/aidl/android/hardware/nfc/NfcStatus.aidl
index c3c111e..a38d370 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/nfc/aidl/android/hardware/nfc/NfcStatus.aidl
@@ -14,33 +14,32 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.nfc;
 
+/**
+ * Used to specify the status of the NfcEvent
+ */
 @VintfStability
 @Backing(type="int")
-enum UssdModeType {
+enum NfcStatus {
     /**
-     * USSD-Notify
+     * Default status when NfcEvent with status OK.
      */
-    NOTIFY,
+    OK = 0,
     /**
-     * USSD-Request
+     * Generic error.
      */
-    REQUEST,
+    FAILED = 1,
     /**
-     * Session terminated by network
+     * Transport error.
      */
-    NW_RELEASE,
+    ERR_TRANSPORT = 2,
     /**
-     * Other local client (eg, SIM Toolkit) has responded
+     * Command timeout error.
      */
-    LOCAL_CLIENT,
+    ERR_CMD_TIMEOUT = 3,
     /**
-     * Operation not supported
+     * Refused error when command is rejected.
      */
-    NOT_SUPPORTED,
-    /**
-     * Network timeout
-     */
-    NW_TIMEOUT,
+    REFUSED = 4,
 }
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/nfc/aidl/android/hardware/nfc/PresenceCheckAlgorithm.aidl
similarity index 60%
copy from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
copy to nfc/aidl/android/hardware/nfc/PresenceCheckAlgorithm.aidl
index c3c111e..20e7bff 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/nfc/aidl/android/hardware/nfc/PresenceCheckAlgorithm.aidl
@@ -14,33 +14,26 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.nfc;
 
+/*
+ * Presence Check Algorithm as defined in ISO/IEC 14443-4:
+ * https://www.iso.org/standard/73599.html
+ */
 @VintfStability
-@Backing(type="int")
-enum UssdModeType {
+@Backing(type="byte")
+enum PresenceCheckAlgorithm {
     /**
-     * USSD-Notify
+     * Let the stack select an algorithm
      */
-    NOTIFY,
+    DEFAULT = 0,
     /**
-     * USSD-Request
+     * ISO-DEP protocol's empty I-block
      */
-    REQUEST,
+    I_BLOCK = 1,
     /**
-     * Session terminated by network
+     * Type - 4 tag protocol iso-dep nak presence check command is sent waiting for
+     * response and notification.
      */
-    NW_RELEASE,
-    /**
-     * Other local client (eg, SIM Toolkit) has responded
-     */
-    LOCAL_CLIENT,
-    /**
-     * Operation not supported
-     */
-    NOT_SUPPORTED,
-    /**
-     * Network timeout
-     */
-    NW_TIMEOUT,
+    ISO_DEP_NAK = 2,
 }
diff --git a/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl b/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
new file mode 100644
index 0000000..f8e3228
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/**
+ * Vendor Specific Proprietary Protocol & Discovery Configuration.
+ * Set to 0xFF if not supported.
+ * discovery* fields map to "RF Technology and Mode" in NCI Spec
+ * protocol* fields map to "RF protocols" in NCI Spec
+ */
+@VintfStability
+parcelable ProtocolDiscoveryConfig {
+    byte protocol18092Active;
+    byte protocolBPrime;
+    byte protocolDual;
+    byte protocol15693;
+    byte protocolKovio;
+    byte protocolMifare;
+    byte discoveryPollKovio;
+    byte discoveryPollBPrime;
+    byte discoveryListenBPrime;
+}
diff --git a/nfc/aidl/default/Android.bp b/nfc/aidl/default/Android.bp
new file mode 100644
index 0000000..6daebe5
--- /dev/null
+++ b/nfc/aidl/default/Android.bp
@@ -0,0 +1,32 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_binary {
+    name: "android.hardware.nfc-service.example",
+    relative_install_path: "hw",
+    init_rc: ["nfc-service-example.rc"],
+    vintf_fragments: ["nfc-service-example.xml"],
+    vendor: true,
+    cflags: [
+        "-Wall",
+        "-Wextra",
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libutils",
+        "libbinder_ndk",
+        "android.hardware.nfc-V1-ndk",
+    ],
+    srcs: [
+        "main.cpp",
+        "Nfc.cpp",
+        "Vendor_hal_api.cpp",
+    ],
+}
diff --git a/nfc/aidl/default/Nfc.cpp b/nfc/aidl/default/Nfc.cpp
new file mode 100644
index 0000000..4685b59
--- /dev/null
+++ b/nfc/aidl/default/Nfc.cpp
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Nfc.h"
+
+#include <android-base/logging.h>
+
+#include "Vendor_hal_api.h"
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace nfc {
+
+std::shared_ptr<INfcClientCallback> Nfc::mCallback = nullptr;
+AIBinder_DeathRecipient* clientDeathRecipient = nullptr;
+
+void OnDeath(void* cookie) {
+    if (Nfc::mCallback != nullptr && !AIBinder_isAlive(Nfc::mCallback->asBinder().get())) {
+        LOG(INFO) << __func__ << " Nfc service has died";
+        Nfc* nfc = static_cast<Nfc*>(cookie);
+        nfc->close(NfcCloseType::DISABLE);
+    }
+}
+
+::ndk::ScopedAStatus Nfc::open(const std::shared_ptr<INfcClientCallback>& clientCallback) {
+    LOG(INFO) << "open";
+    if (clientCallback == nullptr) {
+        LOG(INFO) << "Nfc::open null callback";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    Nfc::mCallback = clientCallback;
+
+    clientDeathRecipient = AIBinder_DeathRecipient_new(OnDeath);
+    auto linkRet = AIBinder_linkToDeath(clientCallback->asBinder().get(), clientDeathRecipient,
+                                        this /* cookie */);
+    if (linkRet != STATUS_OK) {
+        LOG(ERROR) << __func__ << ": linkToDeath failed: " << linkRet;
+        // Just ignore the error.
+    }
+
+    int ret = Vendor_hal_open(eventCallback, dataCallback);
+    return ret == 0 ? ndk::ScopedAStatus::ok()
+                    : ndk::ScopedAStatus::fromServiceSpecificError(
+                              static_cast<int32_t>(NfcStatus::FAILED));
+}
+
+::ndk::ScopedAStatus Nfc::close(NfcCloseType type) {
+    LOG(INFO) << "close";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    int ret = 0;
+    if (type == NfcCloseType::HOST_SWITCHED_OFF) {
+        ret = Vendor_hal_close_off();
+    } else {
+        ret = Vendor_hal_close();
+    }
+    Nfc::mCallback = nullptr;
+    AIBinder_DeathRecipient_delete(clientDeathRecipient);
+    clientDeathRecipient = nullptr;
+    return ret == 0 ? ndk::ScopedAStatus::ok()
+                    : ndk::ScopedAStatus::fromServiceSpecificError(
+                              static_cast<int32_t>(NfcStatus::FAILED));
+}
+
+::ndk::ScopedAStatus Nfc::coreInitialized() {
+    LOG(INFO) << "coreInitialized";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    int ret = Vendor_hal_core_initialized();
+
+    return ret == 0 ? ndk::ScopedAStatus::ok()
+                    : ndk::ScopedAStatus::fromServiceSpecificError(
+                              static_cast<int32_t>(NfcStatus::FAILED));
+}
+
+::ndk::ScopedAStatus Nfc::factoryReset() {
+    LOG(INFO) << "factoryReset";
+    Vendor_hal_factoryReset();
+    return ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::getConfig(NfcConfig* _aidl_return) {
+    LOG(INFO) << "getConfig";
+    NfcConfig nfcVendorConfig;
+    Vendor_hal_getConfig(nfcVendorConfig);
+
+    *_aidl_return = nfcVendorConfig;
+    return ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::powerCycle() {
+    LOG(INFO) << "powerCycle";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    return Vendor_hal_power_cycle() ? ndk::ScopedAStatus::fromServiceSpecificError(
+                                              static_cast<int32_t>(NfcStatus::FAILED))
+                                    : ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::preDiscover() {
+    LOG(INFO) << "preDiscover";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    return Vendor_hal_pre_discover() ? ndk::ScopedAStatus::fromServiceSpecificError(
+                                               static_cast<int32_t>(NfcStatus::FAILED))
+                                     : ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::write(const std::vector<uint8_t>& data, int32_t* _aidl_return) {
+    LOG(INFO) << "write";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    *_aidl_return = Vendor_hal_write(data.size(), &data[0]);
+    return ndk::ScopedAStatus::ok();
+}
+::ndk::ScopedAStatus Nfc::setEnableVerboseLogging(bool enable) {
+    LOG(INFO) << "setVerboseLogging";
+    Vendor_hal_setVerboseLogging(enable);
+    return ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::isVerboseLoggingEnabled(bool* _aidl_return) {
+    *_aidl_return = Vendor_hal_getVerboseLogging();
+    return ndk::ScopedAStatus::ok();
+}
+
+}  // namespace nfc
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/nfc/aidl/default/Nfc.h b/nfc/aidl/default/Nfc.h
new file mode 100644
index 0000000..1b14534
--- /dev/null
+++ b/nfc/aidl/default/Nfc.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/nfc/BnNfc.h>
+#include <aidl/android/hardware/nfc/INfcClientCallback.h>
+#include <android-base/logging.h>
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace nfc {
+
+using ::aidl::android::hardware::nfc::NfcCloseType;
+using ::aidl::android::hardware::nfc::NfcConfig;
+using ::aidl::android::hardware::nfc::NfcStatus;
+
+// Default implementation that reports no support NFC.
+struct Nfc : public BnNfc {
+  public:
+    Nfc() = default;
+
+    ::ndk::ScopedAStatus open(const std::shared_ptr<INfcClientCallback>& clientCallback) override;
+    ::ndk::ScopedAStatus close(NfcCloseType type) override;
+    ::ndk::ScopedAStatus coreInitialized() override;
+    ::ndk::ScopedAStatus factoryReset() override;
+    ::ndk::ScopedAStatus getConfig(NfcConfig* _aidl_return) override;
+    ::ndk::ScopedAStatus powerCycle() override;
+    ::ndk::ScopedAStatus preDiscover() override;
+    ::ndk::ScopedAStatus write(const std::vector<uint8_t>& data, int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus setEnableVerboseLogging(bool enable) override;
+    ::ndk::ScopedAStatus isVerboseLoggingEnabled(bool* _aidl_return) override;
+
+    static void eventCallback(uint8_t event, uint8_t status) {
+        if (mCallback != nullptr) {
+            auto ret = mCallback->sendEvent((NfcEvent)event, (NfcStatus)status);
+            if (!ret.isOk()) {
+                LOG(ERROR) << "Failed to send event!";
+            }
+        }
+    }
+
+    static void dataCallback(uint16_t data_len, uint8_t* p_data) {
+        std::vector<uint8_t> data(p_data, p_data + data_len);
+        if (mCallback != nullptr) {
+            auto ret = mCallback->sendData(data);
+            if (!ret.isOk()) {
+                LOG(ERROR) << "Failed to send data!";
+            }
+        }
+    }
+
+    static std::shared_ptr<INfcClientCallback> mCallback;
+};
+
+}  // namespace nfc
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/nfc/aidl/default/Vendor_hal_api.cpp b/nfc/aidl/default/Vendor_hal_api.cpp
new file mode 100644
index 0000000..66a2ebc
--- /dev/null
+++ b/nfc/aidl/default/Vendor_hal_api.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/properties.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <string.h>
+
+#include "Vendor_hal_api.h"
+
+bool logging = false;
+
+int Vendor_hal_open(nfc_stack_callback_t* p_cback, nfc_stack_data_callback_t* p_data_cback) {
+    (void)p_cback;
+    (void)p_data_cback;
+    // nothing to open in this example
+    return -1;
+}
+
+int Vendor_hal_write(uint16_t data_len, const uint8_t* p_data) {
+    (void)data_len;
+    (void)p_data;
+    return -1;
+}
+
+int Vendor_hal_core_initialized() {
+    return -1;
+}
+
+int Vendor_hal_pre_discover() {
+    return -1;
+}
+
+int Vendor_hal_close() {
+    return -1;
+}
+
+int Vendor_hal_close_off() {
+    return -1;
+}
+
+int Vendor_hal_power_cycle() {
+    return -1;
+}
+
+void Vendor_hal_factoryReset() {}
+
+void Vendor_hal_getConfig(NfcConfig& config) {
+    (void)config;
+}
+
+void Vendor_hal_setVerboseLogging(bool enable) {
+    logging = enable;
+}
+
+bool Vendor_hal_getVerboseLogging() {
+    return logging;
+}
diff --git a/nfc/aidl/default/Vendor_hal_api.h b/nfc/aidl/default/Vendor_hal_api.h
new file mode 100644
index 0000000..595c2dd
--- /dev/null
+++ b/nfc/aidl/default/Vendor_hal_api.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <aidl/android/hardware/nfc/INfc.h>
+#include <aidl/android/hardware/nfc/NfcConfig.h>
+#include <aidl/android/hardware/nfc/NfcEvent.h>
+#include <aidl/android/hardware/nfc/NfcStatus.h>
+#include <aidl/android/hardware/nfc/PresenceCheckAlgorithm.h>
+#include <aidl/android/hardware/nfc/ProtocolDiscoveryConfig.h>
+#include "hardware_nfc.h"
+
+using aidl::android::hardware::nfc::NfcConfig;
+using aidl::android::hardware::nfc::NfcEvent;
+using aidl::android::hardware::nfc::NfcStatus;
+using aidl::android::hardware::nfc::PresenceCheckAlgorithm;
+using aidl::android::hardware::nfc::ProtocolDiscoveryConfig;
+
+int Vendor_hal_open(nfc_stack_callback_t* p_cback, nfc_stack_data_callback_t* p_data_cback);
+int Vendor_hal_write(uint16_t data_len, const uint8_t* p_data);
+
+int Vendor_hal_core_initialized();
+
+int Vendor_hal_pre_discover();
+
+int Vendor_hal_close();
+
+int Vendor_hal_close_off();
+
+int Vendor_hal_power_cycle();
+
+void Vendor_hal_factoryReset();
+
+void Vendor_hal_getConfig(NfcConfig& config);
+
+void Vendor_hal_setVerboseLogging(bool enable);
+
+bool Vendor_hal_getVerboseLogging();
diff --git a/nfc/aidl/default/hardware_nfc.h b/nfc/aidl/default/hardware_nfc.h
new file mode 100644
index 0000000..0f856c5
--- /dev/null
+++ b/nfc/aidl/default/hardware_nfc.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+typedef uint8_t nfc_event_t;
+typedef uint8_t nfc_status_t;
+
+/*
+ * The callback passed in from the NFC stack that the HAL
+ * can use to pass events back to the stack.
+ */
+typedef void(nfc_stack_callback_t)(nfc_event_t event, nfc_status_t event_status);
+
+/*
+ * The callback passed in from the NFC stack that the HAL
+ * can use to pass incomming data to the stack.
+ */
+typedef void(nfc_stack_data_callback_t)(uint16_t data_len, uint8_t* p_data);
diff --git a/nfc/aidl/default/main.cpp b/nfc/aidl/default/main.cpp
new file mode 100644
index 0000000..0cc51e7
--- /dev/null
+++ b/nfc/aidl/default/main.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+#include "Nfc.h"
+using ::aidl::android::hardware::nfc::Nfc;
+
+int main() {
+    LOG(INFO) << "NFC HAL starting up";
+    if (!ABinderProcess_setThreadPoolMaxThreadCount(1)) {
+        LOG(INFO) << "failed to set thread pool max thread count";
+        return 1;
+    }
+    std::shared_ptr<Nfc> nfc_service = ndk::SharedRefBase::make<Nfc>();
+
+    const std::string instance = std::string() + Nfc::descriptor + "/default";
+    binder_status_t status =
+            AServiceManager_addService(nfc_service->asBinder().get(), instance.c_str());
+    CHECK(status == STATUS_OK);
+    ABinderProcess_joinThreadPool();
+    return 0;
+}
diff --git a/nfc/aidl/default/nfc-service-example.rc b/nfc/aidl/default/nfc-service-example.rc
new file mode 100644
index 0000000..7d7052e
--- /dev/null
+++ b/nfc/aidl/default/nfc-service-example.rc
@@ -0,0 +1,4 @@
+service nfc_hal_service /vendor/bin/hw/android.hardware.nfc-service.st
+    class hal
+    user nfc
+    group nfc
diff --git a/nfc/aidl/default/nfc-service-example.xml b/nfc/aidl/default/nfc-service-example.xml
new file mode 100644
index 0000000..70fed20
--- /dev/null
+++ b/nfc/aidl/default/nfc-service-example.xml
@@ -0,0 +1,6 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.nfc</name>
+        <fqname>INfc/default</fqname>
+    </hal>
+</manifest>
diff --git a/nfc/aidl/vts/functional/Android.bp b/nfc/aidl/vts/functional/Android.bp
new file mode 100644
index 0000000..99eecd0
--- /dev/null
+++ b/nfc/aidl/vts/functional/Android.bp
@@ -0,0 +1,46 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_test {
+    name: "VtsAidlHalNfcTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: [
+        "VtsAidlHalNfcTargetTest.cpp",
+    ],
+    shared_libs: [
+        "libbinder",
+        "libbinder_ndk",
+    ],
+    static_libs: [
+        "android.hardware.nfc-V1-ndk",
+    ],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+}
diff --git a/nfc/aidl/vts/functional/VtsAidlHalNfcTargetTest.cpp b/nfc/aidl/vts/functional/VtsAidlHalNfcTargetTest.cpp
new file mode 100644
index 0000000..977b25c
--- /dev/null
+++ b/nfc/aidl/vts/functional/VtsAidlHalNfcTargetTest.cpp
@@ -0,0 +1,458 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "nfc_aidl_hal_test"
+
+#include <aidl/Gtest.h>
+#include <aidl/Vintf.h>
+#include <aidl/android/hardware/nfc/BnNfc.h>
+#include <aidl/android/hardware/nfc/BnNfcClientCallback.h>
+#include <aidl/android/hardware/nfc/INfc.h>
+#include <android-base/logging.h>
+#include <android-base/stringprintf.h>
+#include <android/binder_auto_utils.h>
+#include <android/binder_enums.h>
+#include <android/binder_interface_utils.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+#include <chrono>
+#include <future>
+
+using aidl::android::hardware::nfc::INfc;
+using aidl::android::hardware::nfc::INfcClientCallback;
+using aidl::android::hardware::nfc::NfcCloseType;
+using aidl::android::hardware::nfc::NfcConfig;
+using aidl::android::hardware::nfc::NfcEvent;
+using aidl::android::hardware::nfc::NfcStatus;
+using aidl::android::hardware::nfc::PresenceCheckAlgorithm;
+
+using android::getAidlHalInstanceNames;
+using android::PrintInstanceNameToString;
+using android::base::StringPrintf;
+using ndk::enum_range;
+using ndk::ScopedAStatus;
+using ndk::SharedRefBase;
+using ndk::SpAIBinder;
+
+constexpr static int kCallbackTimeoutMs = 10000;
+
+// 261 bytes is the default and minimum transceive length
+constexpr unsigned int MIN_ISO_DEP_TRANSCEIVE_LENGTH = 261;
+
+// Range of valid off host route ids
+constexpr uint8_t MIN_OFFHOST_ROUTE_ID = 0x01;
+constexpr uint8_t MAX_OFFHOST_ROUTE_ID = 0xFE;
+
+class NfcClientCallback : public aidl::android::hardware::nfc::BnNfcClientCallback {
+  public:
+    NfcClientCallback(const std::function<void(NfcEvent, NfcStatus)>& on_hal_event_cb,
+                      const std::function<void(const std::vector<uint8_t>&)>& on_nci_data_cb)
+        : on_nci_data_cb_(on_nci_data_cb), on_hal_event_cb_(on_hal_event_cb) {}
+    virtual ~NfcClientCallback() = default;
+
+    ::ndk::ScopedAStatus sendEvent(NfcEvent event, NfcStatus event_status) override {
+        on_hal_event_cb_(event, event_status);
+        return ::ndk::ScopedAStatus::ok();
+    };
+    ::ndk::ScopedAStatus sendData(const std::vector<uint8_t>& data) override {
+        on_nci_data_cb_(data);
+        return ::ndk::ScopedAStatus::ok();
+    };
+
+  private:
+    std::function<void(const std::vector<uint8_t>&)> on_nci_data_cb_;
+    std::function<void(NfcEvent, NfcStatus)> on_hal_event_cb_;
+};
+
+class NfcAidl : public testing::TestWithParam<std::string> {
+  public:
+    void SetUp() override {
+        SpAIBinder binder(AServiceManager_waitForService(GetParam().c_str()));
+        infc_ = INfc::fromBinder(binder);
+        ASSERT_NE(infc_, nullptr);
+    }
+    std::shared_ptr<INfc> infc_;
+};
+
+/*
+ * OpenAndCloseForDisable:
+ * Makes an open call, waits for NfcEvent::OPEN_CPLT
+ * Immediately calls close(NfcCloseType::DISABLE) and
+ * waits for NfcEvent::CLOSE_CPLT
+ *
+ */
+TEST_P(NfcAidl, OpenAndCloseForDisable) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                LOG(INFO) << StringPrintf("%s,%d ", __func__, event);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close DISABLE";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    LOG(INFO) << "wait for close";
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * OpenAndCloseForHostSwitchedOff:
+ * Makes an open call, waits for NfcEvent::OPEN_CPLT
+ * Immediately calls close(NfcCloseType::HOST_SWITCHED_OFF) and
+ * waits for NfcEvent::CLOSE_CPLT
+ *
+ */
+TEST_P(NfcAidl, OpenAndCloseForHostSwitchedOff) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close HOST_SWITCHED_OFF";
+    EXPECT_TRUE(infc_->close(NfcCloseType::HOST_SWITCHED_OFF).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * OpenAfterOpen:
+ * Calls open() multiple times
+ * Checks status
+ */
+TEST_P(NfcAidl, OpenAfterOpen) {
+    int open_count = 0;
+    std::promise<void> open_cb_promise;
+    std::promise<void> open2_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto open2_cb_future = open2_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &open2_cb_promise, &open_count](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) {
+                    open_count == 0 ? open_cb_promise.set_value() : open2_cb_promise.set_value();
+                    open_count++;
+                }
+            },
+            [](auto) {});
+
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Open again and wait for OPEN_CPLT
+    LOG(INFO) << "open again";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open2_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * CloseAfterClose:
+ * Calls close() multiple times
+ * Checks status
+ */
+TEST_P(NfcAidl, CloseAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+    // Close again should fail.
+    LOG(INFO) << "close again";
+    EXPECT_TRUE(!(infc_->close(NfcCloseType::DISABLE).isOk()));
+}
+
+/*
+ * PowerCycleAfterOpen:
+ * Calls powerCycle() after open
+ * Waits for NfcEvent.OPEN_CPLT
+ * Checks status
+ */
+TEST_P(NfcAidl, PowerCycleAfterOpen) {
+    int open_cplt_count = 0;
+    std::promise<void> open_cb_promise;
+    std::promise<void> power_cycle_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto power_cycle_cb_future = power_cycle_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise, &power_cycle_cb_promise, &open_cplt_count](
+                    auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) {
+                    if (open_cplt_count == 0) {
+                        open_cplt_count++;
+                        open_cb_promise.set_value();
+                    } else {
+                        power_cycle_cb_promise.set_value();
+                    }
+                }
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // PowerCycle and wait for OPEN_CPLT
+    LOG(INFO) << "PowerCycle";
+    EXPECT_TRUE(infc_->powerCycle().isOk());
+    EXPECT_EQ(power_cycle_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * PowerCycleAfterClose:
+ * Calls powerCycle() after close
+ * PowerCycle should fail immediately
+ */
+TEST_P(NfcAidl, PowerCycleAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // PowerCycle should fail
+    LOG(INFO) << "PowerCycle";
+    EXPECT_TRUE(!(infc_->powerCycle().isOk()));
+}
+
+/*
+ * CoreInitializedAfterOpen:
+ * Calls coreInitialized() after open
+ * Waits for NfcEvent.POST_INIT_CPLT
+ */
+TEST_P(NfcAidl, CoreInitializedAfterOpen) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> core_init_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto core_init_cb_future = core_init_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise, &core_init_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::POST_INIT_CPLT) core_init_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // CoreInitialized and wait for POST_INIT_CPLT
+    LOG(INFO) << "coreInitialized";
+    EXPECT_TRUE(infc_->coreInitialized().isOk());
+    EXPECT_EQ(core_init_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * CoreInitializedAfterClose:
+ * Calls coreInitialized() after close
+ * coreInitialized() should fail immediately
+ */
+TEST_P(NfcAidl, CoreInitializedAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // coreInitialized should fail
+    LOG(INFO) << "CoreInitialized";
+    EXPECT_TRUE(!(infc_->coreInitialized().isOk()));
+}
+
+/*
+ * PreDiscoverAfterClose:
+ * Call preDiscover() after close
+ * preDiscover() should fail immediately
+ */
+TEST_P(NfcAidl, PreDiscoverAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // preDiscover should fail
+    LOG(INFO) << "preDiscover";
+    EXPECT_TRUE(!(infc_->preDiscover().isOk()));
+}
+
+/*
+ * checkGetConfigValues:
+ * Calls getConfig()
+ * checks if fields in NfcConfig are populated correctly
+ */
+TEST_P(NfcAidl, CheckGetConfigValues) {
+    NfcConfig configValue;
+    EXPECT_TRUE(infc_->getConfig(&configValue).isOk());
+    EXPECT_GE(configValue.maxIsoDepTransceiveLength, MIN_ISO_DEP_TRANSCEIVE_LENGTH);
+    LOG(INFO) << StringPrintf("configValue.maxIsoDepTransceiveLength = %x",
+                              configValue.maxIsoDepTransceiveLength);
+    for (auto uicc : configValue.offHostRouteUicc) {
+        LOG(INFO) << StringPrintf("offHostRouteUicc = %x", uicc);
+        EXPECT_GE(uicc, MIN_OFFHOST_ROUTE_ID);
+        EXPECT_LE(uicc, MAX_OFFHOST_ROUTE_ID);
+    }
+    for (auto ese : configValue.offHostRouteEse) {
+        LOG(INFO) << StringPrintf("offHostRouteEse = %x", ese);
+        EXPECT_GE(ese, MIN_OFFHOST_ROUTE_ID);
+        EXPECT_LE(ese, MAX_OFFHOST_ROUTE_ID);
+    }
+    if (configValue.defaultIsoDepRoute != 0) {
+        EXPECT_GE((uint8_t)configValue.defaultIsoDepRoute, MIN_OFFHOST_ROUTE_ID);
+        EXPECT_LE((uint8_t)configValue.defaultIsoDepRoute, MAX_OFFHOST_ROUTE_ID);
+    }
+}
+
+/*
+ * CheckisVerboseLoggingEnabledAfterSetEnableVerboseLogging:
+ * Calls setEnableVerboseLogging()
+ * checks the return value of isVerboseLoggingEnabled
+ */
+TEST_P(NfcAidl, CheckisVerboseLoggingEnabledAfterSetEnableVerboseLogging) {
+    bool enabled = false;
+    EXPECT_TRUE(infc_->setEnableVerboseLogging(true).isOk());
+    EXPECT_TRUE(infc_->isVerboseLoggingEnabled(&enabled).isOk());
+    EXPECT_TRUE(enabled);
+    EXPECT_TRUE(infc_->setEnableVerboseLogging(false).isOk());
+    EXPECT_TRUE(infc_->isVerboseLoggingEnabled(&enabled).isOk());
+    EXPECT_TRUE(!enabled);
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(NfcAidl);
+INSTANTIATE_TEST_SUITE_P(Nfc, NfcAidl,
+                         testing::ValuesIn(::android::getAidlHalInstanceNames(INfc::descriptor)),
+                         ::android::PrintInstanceNameToString);
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    ABinderProcess_startThreadPool();
+    std::system("/system/bin/svc nfc disable"); /* Turn off NFC */
+    sleep(5);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    std::system("/system/bin/svc nfc enable"); /* Turn on NFC */
+    sleep(5);
+    return status;
+}
diff --git a/power/aidl/vts/Android.bp b/power/aidl/vts/Android.bp
index eccd872..ea398ac 100644
--- a/power/aidl/vts/Android.bp
+++ b/power/aidl/vts/Android.bp
@@ -32,7 +32,7 @@
         "libbinder_ndk",
     ],
     static_libs: [
-        "android.hardware.power-V2-ndk",
+        "android.hardware.power-V3-ndk",
     ],
     test_suites: [
         "vts",
diff --git a/power/aidl/vts/VtsHalPowerTargetTest.cpp b/power/aidl/vts/VtsHalPowerTargetTest.cpp
index ffab66c..e0ca87f 100644
--- a/power/aidl/vts/VtsHalPowerTargetTest.cpp
+++ b/power/aidl/vts/VtsHalPowerTargetTest.cpp
@@ -201,10 +201,7 @@
 // FIXED_PERFORMANCE mode is required for all devices which ship on Android 11
 // or later
 TEST_P(PowerAidl, hasFixedPerformance) {
-    auto apiLevel = GetUintProperty<uint64_t>("ro.product.first_api_level", 0);
-    if (apiLevel == 0) {
-        apiLevel = GetUintProperty<uint64_t>("ro.build.version.sdk", 0);
-    }
+    auto apiLevel = GetUintProperty<uint64_t>("ro.vendor.api_level", 0);
     ASSERT_NE(apiLevel, 0);
 
     if (apiLevel >= 30) {
@@ -214,6 +211,19 @@
     }
 }
 
+// GAME_LOADING mode is required for all devices which ship on Android T
+// or later
+TEST_P(PowerAidl, hasGameLoading) {
+    auto apiLevel = GetUintProperty<uint64_t>("ro.vendor.api_level", 0);
+    ASSERT_NE(apiLevel, 0);
+
+    if (apiLevel >= 33) {
+        bool supported;
+        ASSERT_TRUE(power->isModeSupported(Mode::GAME_LOADING, &supported).isOk());
+        ASSERT_TRUE(supported);
+    }
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(PowerAidl);
 INSTANTIATE_TEST_SUITE_P(Power, PowerAidl,
                          testing::ValuesIn(::android::getAidlHalInstanceNames(IPower::descriptor)),
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
index c8efea0..02bbf21 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
@@ -53,7 +53,7 @@
   boolean preferred;
   boolean persistent;
   boolean alwaysOn;
-  @nullable android.hardware.radio.data.TrafficDescriptor trafficDescriptor;
+  android.hardware.radio.data.TrafficDescriptor trafficDescriptor;
   const int ID_DEFAULT = 0;
   const int ID_TETHERED = 1;
   const int ID_IMS = 2;
@@ -62,6 +62,6 @@
   const int ID_OEM_BASE = 1000;
   const int ID_INVALID = -1;
   const int TYPE_COMMON = 0;
-  const int TYPE_THREE_GPP = 1;
-  const int TYPE_THREE_GPP2 = 2;
+  const int TYPE_3GPP = 1;
+  const int TYPE_3GPP2 = 2;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/IRadioData.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/IRadioData.aidl
index dc6092a..7b572f1 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/IRadioData.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/IRadioData.aidl
@@ -44,7 +44,7 @@
   oneway void setDataAllowed(in int serial, in boolean allow);
   oneway void setDataProfile(in int serial, in android.hardware.radio.data.DataProfileInfo[] profiles);
   oneway void setDataThrottling(in int serial, in android.hardware.radio.data.DataThrottlingAction dataThrottlingAction, in long completionDurationMillis);
-  oneway void setInitialAttachApn(in int serial, in android.hardware.radio.data.DataProfileInfo dataProfileInfo);
+  oneway void setInitialAttachApn(in int serial, in @nullable android.hardware.radio.data.DataProfileInfo dataProfileInfo);
   oneway void setResponseFunctions(in android.hardware.radio.data.IRadioDataResponse radioDataResponse, in android.hardware.radio.data.IRadioDataIndication radioDataIndication);
   oneway void setupDataCall(in int serial, in android.hardware.radio.AccessNetwork accessNetwork, in android.hardware.radio.data.DataProfileInfo dataProfileInfo, in boolean roamingAllowed, in android.hardware.radio.data.DataRequestReason reason, in android.hardware.radio.data.LinkAddress[] addresses, in String[] dnses, in int pduSessionId, in @nullable android.hardware.radio.data.SliceInfo sliceInfo, in boolean matchAllRuleAllowed);
   oneway void startHandover(in int serial, in int callId);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl
index b0fc349..dfec59a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl
@@ -37,7 +37,6 @@
   oneway void acknowledgeIncomingGsmSmsWithPdu(in int serial, in boolean success, in String ackPdu);
   oneway void acknowledgeLastIncomingCdmaSms(in int serial, in android.hardware.radio.messaging.CdmaSmsAck smsAck);
   oneway void acknowledgeLastIncomingGsmSms(in int serial, in boolean success, in android.hardware.radio.messaging.SmsAcknowledgeFailCause cause);
-  oneway void cancelPendingUssd(in int serial);
   oneway void deleteSmsOnRuim(in int serial, in int index);
   oneway void deleteSmsOnSim(in int serial, in int index);
   oneway void getCdmaBroadcastConfig(in int serial);
@@ -50,7 +49,6 @@
   oneway void sendImsSms(in int serial, in android.hardware.radio.messaging.ImsSmsMessage message);
   oneway void sendSms(in int serial, in android.hardware.radio.messaging.GsmSmsMessage message);
   oneway void sendSmsExpectMore(in int serial, in android.hardware.radio.messaging.GsmSmsMessage message);
-  oneway void sendUssd(in int serial, in String ussd);
   oneway void setCdmaBroadcastActivation(in int serial, in boolean activate);
   oneway void setCdmaBroadcastConfig(in int serial, in android.hardware.radio.messaging.CdmaBroadcastSmsConfigInfo[] configInfo);
   oneway void setGsmBroadcastActivation(in int serial, in boolean activate);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
index 89a0f3b..8f7824f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
@@ -40,6 +40,5 @@
   oneway void newSms(in android.hardware.radio.RadioIndicationType type, in byte[] pdu);
   oneway void newSmsOnSim(in android.hardware.radio.RadioIndicationType type, in int recordNumber);
   oneway void newSmsStatusReport(in android.hardware.radio.RadioIndicationType type, in byte[] pdu);
-  oneway void onUssd(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.messaging.UssdModeType modeType, in String msg);
   oneway void simSmsStorageFull(in android.hardware.radio.RadioIndicationType type);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
index 156f24b..c3af7a6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
@@ -38,7 +38,6 @@
   oneway void acknowledgeLastIncomingCdmaSmsResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void acknowledgeLastIncomingGsmSmsResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void acknowledgeRequest(in int serial);
-  oneway void cancelPendingUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void deleteSmsOnRuimResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void deleteSmsOnSimResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void getCdmaBroadcastConfigResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.CdmaBroadcastSmsConfigInfo[] configs);
@@ -50,7 +49,6 @@
   oneway void sendImsSmsResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.SendSmsResult sms);
   oneway void sendSmsExpectMoreResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.SendSmsResult sms);
   oneway void sendSmsResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.SendSmsResult sms);
-  oneway void sendUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCdmaBroadcastActivationResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCdmaBroadcastConfigResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setGsmBroadcastActivationResponse(in android.hardware.radio.RadioResponseInfo info);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
index ef9c779..85cf86e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -36,6 +36,5 @@
 parcelable CarrierRestrictions {
   android.hardware.radio.sim.Carrier[] allowedCarriers;
   android.hardware.radio.sim.Carrier[] excludedCarriers;
-  boolean priority;
   boolean allowedCarriersPrioritized;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl
index 34d155a..603b1d6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl
@@ -35,6 +35,7 @@
 @VintfStability
 interface IRadioVoice {
   oneway void acceptCall(in int serial);
+  oneway void cancelPendingUssd(in int serial);
   oneway void conference(in int serial);
   oneway void dial(in int serial, in android.hardware.radio.voice.Dial dialInfo);
   oneway void emergencyDial(in int serial, in android.hardware.radio.voice.Dial dialInfo, in int categories, in String[] urns, in android.hardware.radio.voice.EmergencyCallRouting routing, in boolean hasKnownUserIntentEmergency, in boolean isTesting);
@@ -59,6 +60,7 @@
   oneway void sendBurstDtmf(in int serial, in String dtmf, in int on, in int off);
   oneway void sendCdmaFeatureCode(in int serial, in String featureCode);
   oneway void sendDtmf(in int serial, in String s);
+  oneway void sendUssd(in int serial, in String ussd);
   oneway void separateConnection(in int serial, in int gsmIndex);
   oneway void setCallForward(in int serial, in android.hardware.radio.voice.CallForwardInfo callInfo);
   oneway void setCallWaiting(in int serial, in boolean enable, in int serviceClass);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl
index af3417d..189ed43 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl
@@ -44,6 +44,7 @@
   oneway void exitEmergencyCallbackMode(in android.hardware.radio.RadioIndicationType type);
   oneway void indicateRingbackTone(in android.hardware.radio.RadioIndicationType type, in boolean start);
   oneway void onSupplementaryServiceIndication(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.voice.StkCcUnsolSsResult ss);
+  oneway void onUssd(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.voice.UssdModeType modeType, in String msg);
   oneway void resendIncallMute(in android.hardware.radio.RadioIndicationType type);
   oneway void srvccStateNotify(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.voice.SrvccState state);
   oneway void stkCallControlAlphaNotify(in android.hardware.radio.RadioIndicationType type, in String alpha);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl
index a3b5e58..7acc044 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl
@@ -36,6 +36,7 @@
 interface IRadioVoiceResponse {
   oneway void acceptCallResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void acknowledgeRequest(in int serial);
+  oneway void cancelPendingUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void conferenceResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void dialResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void emergencyDialResponse(in android.hardware.radio.RadioResponseInfo info);
@@ -59,6 +60,7 @@
   oneway void sendBurstDtmfResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void sendCdmaFeatureCodeResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void sendDtmfResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void sendUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void separateConnectionResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCallForwardResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCallWaitingResponse(in android.hardware.radio.RadioResponseInfo info);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
similarity index 97%
rename from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
rename to radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
index 5395b11..9a9d723 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
@@ -31,7 +31,7 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
+package android.hardware.radio.voice;
 @Backing(type="int") @VintfStability
 enum UssdModeType {
   NOTIFY = 0,
diff --git a/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl b/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
index 7360202..123b3ed 100644
--- a/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
+++ b/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
@@ -16,9 +16,7 @@
 
 package android.hardware.radio.data;
 
-import android.hardware.radio.RadioAccessFamily;
 import android.hardware.radio.data.ApnAuthType;
-import android.hardware.radio.data.ApnTypes;
 import android.hardware.radio.data.PdpProtocolType;
 import android.hardware.radio.data.TrafficDescriptor;
 
@@ -36,8 +34,8 @@
     const int ID_INVALID = 0xFFFFFFFF;
 
     const int TYPE_COMMON = 0;
-    const int TYPE_THREE_GPP = 1;
-    const int TYPE_THREE_GPP2 = 2;
+    const int TYPE_3GPP = 1;
+    const int TYPE_3GPP2 = 2;
 
     /**
      * ID of the data profile.
@@ -130,5 +128,5 @@
      * it does not specify the end point to be used for the data call. The end point is specified by
      * apn; apn must be used as the end point if one is not specified through URSP rules.
      */
-    @nullable TrafficDescriptor trafficDescriptor;
+    TrafficDescriptor trafficDescriptor;
 }
diff --git a/radio/aidl/android/hardware/radio/data/IRadioData.aidl b/radio/aidl/android/hardware/radio/data/IRadioData.aidl
index 54a045c..e1ba568 100644
--- a/radio/aidl/android/hardware/radio/data/IRadioData.aidl
+++ b/radio/aidl/android/hardware/radio/data/IRadioData.aidl
@@ -159,14 +159,15 @@
             in long completionDurationMillis);
 
     /**
-     * Set an APN to initial attach network.
+     * Set an APN to initial attach network or clear the existing initial attach APN.
      *
      * @param serial Serial number of request.
-     * @param dataProfileInfo data profile containing APN settings
+     * @param dataProfileInfo Data profile containing APN settings or null to clear the existing
+     *        initial attach APN.
      *
      * Response function is IRadioDataResponse.setInitialAttachApnResponse()
      */
-    void setInitialAttachApn(in int serial, in DataProfileInfo dataProfileInfo);
+    void setInitialAttachApn(in int serial, in @nullable DataProfileInfo dataProfileInfo);
 
     /**
      * Set response functions for data radio requests and indications.
diff --git a/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl b/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl
index 1dbaed3..8bd84a3 100644
--- a/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl
@@ -79,15 +79,6 @@
             in int serial, in boolean success, in SmsAcknowledgeFailCause cause);
 
     /**
-     * Cancel the current USSD session if one exists.
-     *
-     * @param serial Serial number of request.
-     *
-     * Response function is IRadioMessagingResponse.cancelPendingUssdResponse()
-     */
-    void cancelPendingUssd(in int serial);
-
-    /**
      * Deletes a CDMA SMS message from RUIM memory.
      *
      * @param serial Serial number of request.
@@ -212,23 +203,6 @@
     void sendSmsExpectMore(in int serial, in GsmSmsMessage message);
 
     /**
-     * Send a USSD message. If a USSD session already exists, the message must be sent in the
-     * context of that session. Otherwise, a new session must be created. The network reply must be
-     * reported via unsolOnUssd.
-     *
-     * Only one USSD session must exist at a time, and the session is assumed to exist until:
-     * a) The android system invokes cancelUssd()
-     * b) The implementation sends a unsolOnUssd() with a type code of
-     *    "0" (USSD-Notify/no further action) or "2" (session terminated)
-     *
-     * @param serial Serial number of request.
-     * @param ussd string containing the USSD request in UTF-8 format
-     *
-     * Response function is IRadioMessagingResponse.sendUssdResponse()
-     */
-    void sendUssd(in int serial, in String ussd);
-
-    /**
      * Enable or disable the reception of CDMA Cell Broadcast SMS
      *
      * @param serial Serial number of request.
diff --git a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
index 4b40bfb..8834cd9 100644
--- a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
@@ -18,7 +18,6 @@
 
 import android.hardware.radio.RadioIndicationType;
 import android.hardware.radio.messaging.CdmaSmsMessage;
-import android.hardware.radio.messaging.UssdModeType;
 
 /**
  * Interface declaring unsolicited radio indications for messaging APIs.
@@ -86,16 +85,6 @@
     void newSmsStatusReport(in RadioIndicationType type, in byte[] pdu);
 
     /**
-     * Indicates when a new USSD message is received. The USSD session is assumed to persist if the
-     * type code is REQUEST, otherwise the current session (if any) is assumed to have terminated.
-     *
-     * @param type Type of radio indication
-     * @param modeType USSD type code
-     * @param msg Message string in UTF-8, if applicable
-     */
-    void onUssd(in RadioIndicationType type, in UssdModeType modeType, in String msg);
-
-    /**
      * Indicates that SMS storage on the SIM is full. Sent when the network attempts to deliver a
      * new SMS message. Messages cannot be saved on the SIM until space is freed. In particular,
      * incoming Class 2 messages must not be stored.
diff --git a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
index 75fa390..492755f 100644
--- a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
@@ -92,27 +92,6 @@
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE
-     *   RadioError:SIM_BUSY
-     *   RadioError:OPERATION_NOT_ALLOWED
-     *   RadioError:MODEM_ERR
-     *   RadioError:INTERNAL_ERR
-     *   RadioError:NO_MEMORY
-     *   RadioError:INVALID_STATE
-     *   RadioError:INVALID_ARGUMENTS
-     *   RadioError:SYSTEM_ERR
-     *   RadioError:REQUEST_NOT_SUPPORTED
-     *   RadioError:INVALID_MODEM_STATE
-     *   RadioError:NO_RESOURCES
-     *   RadioError:CANCELLED
-     */
-    void cancelPendingUssdResponse(in RadioResponseInfo info);
-
-    /**
-     * @param info Response info struct containing response type, serial no. and error
-     *
-     * Valid errors returned:
-     *   RadioError:NONE
-     *   RadioError:RADIO_NOT_AVAILABLE
      *   RadioError:INVALID_ARGUMENTS
      *   RadioError:NO_MEMORY
      *   RadioError:SYSTEM_ERR
@@ -407,32 +386,6 @@
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE
-     *   RadioError:FDN_CHECK_FAILURE
-     *   RadioError:USSD_MODIFIED_TO_DIAL
-     *   RadioError:USSD_MODIFIED_TO_SS
-     *   RadioError:USSD_MODIFIED_TO_USSD
-     *   RadioError:SIM_BUSY
-     *   RadioError:OPERATION_NOT_ALLOWED
-     *   RadioError:INVALID_ARGUMENTS
-     *   RadioError:NO_MEMORY
-     *   RadioError:MODEM_ERR
-     *   RadioError:INTERNAL_ERR
-     *   RadioError:ABORTED
-     *   RadioError:SYSTEM_ERR
-     *   RadioError:INVALID_STATE
-     *   RadioError:REQUEST_NOT_SUPPORTED
-     *   RadioError:INVALID_MODEM_STATE
-     *   RadioError:NO_RESOURCES
-     *   RadioError:CANCELLED
-     */
-    void sendUssdResponse(in RadioResponseInfo info);
-
-    /**
-     * @param info Response info struct containing response type, serial no. and error
-     *
-     * Valid errors returned:
-     *   RadioError:NONE
-     *   RadioError:RADIO_NOT_AVAILABLE
      *   RadioError:INVALID_ARGUMENTS
      *   RadioError:INVALID_STATE
      *   RadioError:NO_MEMORY
diff --git a/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl b/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl
index 9bd5f21..96b9d0d 100644
--- a/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl
+++ b/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl
@@ -16,8 +16,6 @@
 
 package android.hardware.radio.modem;
 
-import android.hardware.radio.RadioAccessFamily;
-
 @VintfStability
 parcelable RadioCapability {
     /**
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
index 7a22a9a..cce52ff 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
@@ -17,7 +17,6 @@
 package android.hardware.radio.network;
 
 import android.hardware.radio.AccessNetwork;
-import android.hardware.radio.RadioAccessFamily;
 import android.hardware.radio.network.CdmaRoamingType;
 import android.hardware.radio.network.IRadioNetworkIndication;
 import android.hardware.radio.network.IRadioNetworkResponse;
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
index 6863ac3..f471433 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
@@ -21,7 +21,6 @@
 import android.hardware.radio.network.BarringInfo;
 import android.hardware.radio.network.CellIdentity;
 import android.hardware.radio.network.CellInfo;
-import android.hardware.radio.network.Domain;
 import android.hardware.radio.network.LinkCapacityEstimate;
 import android.hardware.radio.network.NetworkScanResult;
 import android.hardware.radio.network.PhoneRestrictedState;
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
index e650321..dcf0004 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
@@ -16,7 +16,6 @@
 
 package android.hardware.radio.network;
 
-import android.hardware.radio.RadioAccessFamily;
 import android.hardware.radio.RadioResponseInfo;
 import android.hardware.radio.RadioTechnology;
 import android.hardware.radio.RadioTechnologyFamily;
@@ -24,8 +23,6 @@
 import android.hardware.radio.network.CdmaRoamingType;
 import android.hardware.radio.network.CellIdentity;
 import android.hardware.radio.network.CellInfo;
-import android.hardware.radio.network.LceDataInfo;
-import android.hardware.radio.network.NeighboringCell;
 import android.hardware.radio.network.OperatorInfo;
 import android.hardware.radio.network.RadioAccessSpecifier;
 import android.hardware.radio.network.RadioBandMode;
diff --git a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
index 12df138..ef38fdc 100644
--- a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -31,11 +31,6 @@
      */
     Carrier[] excludedCarriers;
     /**
-     * Whether this is a carrier restriction with priority or not.
-     * If this is false, allowedCarriersPrioritized is not applicable.
-     */
-    boolean priority;
-    /**
      * True means that only carriers included in the allowed list and not in the excluded list
      * are permitted. Eg. allowedCarriers match mcc/mnc, excludedCarriers has same mcc/mnc and
      * gid1 is ABCD. It means except the carrier whose gid1 is ABCD, all carriers with the
diff --git a/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl b/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl
index ddc5d76..9fed78e 100644
--- a/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl
+++ b/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl
@@ -16,8 +16,6 @@
 
 package android.hardware.radio.voice;
 
-import android.hardware.radio.voice.EmergencyServiceCategory;
-
 /**
  * Emergency number contains information of number, one or more service category(s), zero or more
  * emergency uniform resource names, mobile country code (mcc), mobile network country (mnc) and
diff --git a/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl b/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl
index b25e63d..c05d237 100644
--- a/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl
+++ b/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl
@@ -19,7 +19,6 @@
 import android.hardware.radio.voice.CallForwardInfo;
 import android.hardware.radio.voice.Dial;
 import android.hardware.radio.voice.EmergencyCallRouting;
-import android.hardware.radio.voice.EmergencyServiceCategory;
 import android.hardware.radio.voice.IRadioVoiceIndication;
 import android.hardware.radio.voice.IRadioVoiceResponse;
 import android.hardware.radio.voice.TtyMode;
@@ -45,6 +44,15 @@
     void acceptCall(in int serial);
 
     /**
+     * Cancel the current USSD session if one exists.
+     *
+     * @param serial Serial number of request.
+     *
+     * Response function is IRadioVoiceResponse.cancelPendingUssdResponse()
+     */
+    void cancelPendingUssd(in int serial);
+
+    /**
      * Conference holding and active (like AT+CHLD=3)
      *
      * @param serial Serial number of request.
@@ -325,6 +333,23 @@
     void sendDtmf(in int serial, in String s);
 
     /**
+     * Send a USSD message. If a USSD session already exists, the message must be sent in the
+     * context of that session. Otherwise, a new session must be created. The network reply must be
+     * reported via unsolOnUssd.
+     *
+     * Only one USSD session must exist at a time, and the session is assumed to exist until:
+     * a) The android system invokes cancelUssd()
+     * b) The implementation sends a unsolOnUssd() with a type code of
+     *    "0" (USSD-Notify/no further action) or "2" (session terminated)
+     *
+     * @param serial Serial number of request.
+     * @param ussd string containing the USSD request in UTF-8 format
+     *
+     * Response function is IRadioVoiceResponse.sendUssdResponse()
+     */
+    void sendUssd(in int serial, in String ussd);
+
+    /**
      * Separate a party from a multiparty call placing the multiparty call (less the specified
      * party) on hold and leaving the specified party as the only other member of the current
      * (active) call. Like AT+CHLD=2x.
diff --git a/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl b/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl
index 25e87b3..437fef6 100644
--- a/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl
+++ b/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl
@@ -24,6 +24,7 @@
 import android.hardware.radio.voice.EmergencyNumber;
 import android.hardware.radio.voice.SrvccState;
 import android.hardware.radio.voice.StkCcUnsolSsResult;
+import android.hardware.radio.voice.UssdModeType;
 
 /**
  * Interface declaring unsolicited radio indications for voice APIs.
@@ -138,6 +139,16 @@
     void onSupplementaryServiceIndication(in RadioIndicationType type, in StkCcUnsolSsResult ss);
 
     /**
+     * Indicates when a new USSD message is received. The USSD session is assumed to persist if the
+     * type code is REQUEST, otherwise the current session (if any) is assumed to have terminated.
+     *
+     * @param type Type of radio indication
+     * @param modeType USSD type code
+     * @param msg Message string in UTF-8, if applicable
+     */
+    void onUssd(in RadioIndicationType type, in UssdModeType modeType, in String msg);
+
+    /**
      * Indicates that framework/application must reset the uplink mute state.
      *
      * @param type Type of radio indication
diff --git a/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl b/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl
index d126fc1..cf1b953 100644
--- a/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl
+++ b/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl
@@ -62,6 +62,27 @@
      *
      * Valid errors returned:
      *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:SIM_BUSY
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:MODEM_ERR
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:INVALID_STATE
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:NO_RESOURCES
+     *   RadioError:CANCELLED
+     */
+    void cancelPendingUssdResponse(in RadioResponseInfo info);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE (radio resetting)
      *   RadioError:NO_MEMORY
      *   RadioError:MODEM_ERR
@@ -569,6 +590,32 @@
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:FDN_CHECK_FAILURE
+     *   RadioError:USSD_MODIFIED_TO_DIAL
+     *   RadioError:USSD_MODIFIED_TO_SS
+     *   RadioError:USSD_MODIFIED_TO_USSD
+     *   RadioError:SIM_BUSY
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:NO_MEMORY
+     *   RadioError:MODEM_ERR
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:ABORTED
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:INVALID_STATE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:NO_RESOURCES
+     *   RadioError:CANCELLED
+     */
+    void sendUssdResponse(in RadioResponseInfo info);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
      *   RadioError:INVALID_ARGUMENTS
      *   RadioError:INVALID_STATE
      *   RadioError:NO_RESOURCES
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/radio/aidl/android/hardware/radio/voice/UssdModeType.aidl
similarity index 95%
rename from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
rename to radio/aidl/android/hardware/radio/voice/UssdModeType.aidl
index c3c111e..48d1fca 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/radio/aidl/android/hardware/radio/voice/UssdModeType.aidl
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.radio.voice;
 
 @VintfStability
 @Backing(type="int")
diff --git a/radio/aidl/compat/libradiocompat/data/RadioData.cpp b/radio/aidl/compat/libradiocompat/data/RadioData.cpp
index d2f3687..51f5543 100644
--- a/radio/aidl/compat/libradiocompat/data/RadioData.cpp
+++ b/radio/aidl/compat/libradiocompat/data/RadioData.cpp
@@ -122,9 +122,10 @@
     return ok();
 }
 
-ScopedAStatus RadioData::setInitialAttachApn(int32_t serial, const aidl::DataProfileInfo& info) {
+ScopedAStatus RadioData::setInitialAttachApn(int32_t serial,
+                                             const std::optional<aidl::DataProfileInfo>& info) {
     LOG_CALL << serial;
-    mHal1_5->setInitialAttachApn_1_5(serial, toHidl(info));
+    mHal1_5->setInitialAttachApn_1_5(serial, toHidl(info.value()));
     return ok();
 }
 
@@ -136,14 +137,15 @@
     return ok();
 }
 
-ScopedAStatus RadioData::setupDataCall(  //
-        int32_t serial, aidlCommon::AccessNetwork accessNetwork,
-        const aidl::DataProfileInfo& dataProfileInfo, bool roamingAllowed,
-        aidl::DataRequestReason reason, const std::vector<aidl::LinkAddress>& addresses,
-        const std::vector<std::string>& dnses, int32_t pduSessId,
-        const std::optional<aidl::SliceInfo>& sliceInfo, bool matchAllRuleAllowed) {
+ScopedAStatus RadioData::setupDataCall(int32_t serial, aidlCommon::AccessNetwork accessNetwork,
+                                       const aidl::DataProfileInfo& dataProfileInfo,
+                                       bool roamingAllowed, aidl::DataRequestReason reason,
+                                       const std::vector<aidl::LinkAddress>& addresses,
+                                       const std::vector<std::string>& dnses, int32_t pduSessId,
+                                       const std::optional<aidl::SliceInfo>& sliceInfo,
+                                       bool matchAllRuleAllowed) {
     if (mHal1_6) {
-        mHal1_6->setupDataCall_1_6(  //
+        mHal1_6->setupDataCall_1_6(
                 serial, V1_5::AccessNetwork(accessNetwork), toHidl(dataProfileInfo), roamingAllowed,
                 V1_2::DataRequestReason(reason), toHidl(addresses), toHidl(dnses), pduSessId,
                 toHidl<V1_6::OptionalSliceInfo>(sliceInfo),
@@ -151,7 +153,7 @@
                 matchAllRuleAllowed);
         mContext->addDataProfile(dataProfileInfo);
     } else {
-        mHal1_5->setupDataCall_1_5(  //
+        mHal1_5->setupDataCall_1_5(
                 serial, V1_5::AccessNetwork(accessNetwork), toHidl(dataProfileInfo), roamingAllowed,
                 V1_2::DataRequestReason(reason), toHidl(addresses), toHidl(dnses));
     }
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioData.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioData.h
index c617ec2..c2c0de3 100644
--- a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioData.h
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioData.h
@@ -44,7 +44,8 @@
             int64_t completionDurationMillis) override;
     ::ndk::ScopedAStatus setInitialAttachApn(
             int32_t serial,
-            const ::aidl::android::hardware::radio::data::DataProfileInfo& dpInfo) override;
+            const std::optional<::aidl::android::hardware::radio::data::DataProfileInfo>& dpInfo)
+            override;
     ::ndk::ScopedAStatus setResponseFunctions(
             const std::shared_ptr<::aidl::android::hardware::radio::data::IRadioDataResponse>&
                     radioDataResponse,
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h
index 419e9fb..047f836 100644
--- a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h
@@ -33,7 +33,6 @@
     ::ndk::ScopedAStatus acknowledgeLastIncomingGsmSms(
             int32_t serial, bool success,
             ::aidl::android::hardware::radio::messaging::SmsAcknowledgeFailCause cause) override;
-    ::ndk::ScopedAStatus cancelPendingUssd(int32_t serial) override;
     ::ndk::ScopedAStatus deleteSmsOnRuim(int32_t serial, int32_t index) override;
     ::ndk::ScopedAStatus deleteSmsOnSim(int32_t serial, int32_t index) override;
     ::ndk::ScopedAStatus getCdmaBroadcastConfig(int32_t serial) override;
@@ -56,7 +55,6 @@
     ::ndk::ScopedAStatus sendSmsExpectMore(
             int32_t serial,
             const ::aidl::android::hardware::radio::messaging::GsmSmsMessage& message) override;
-    ::ndk::ScopedAStatus sendUssd(int32_t serial, const std::string& ussd) override;
     ::ndk::ScopedAStatus setCdmaBroadcastActivation(int32_t serial, bool activate) override;
     ::ndk::ScopedAStatus setCdmaBroadcastConfig(
             int32_t serial,
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h
index a0e1e82..0f1d5fd 100644
--- a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h
@@ -26,6 +26,7 @@
     std::shared_ptr<::aidl::android::hardware::radio::voice::IRadioVoiceResponse> respond();
 
     ::ndk::ScopedAStatus acceptCall(int32_t serial) override;
+    ::ndk::ScopedAStatus cancelPendingUssd(int32_t serial) override;
     ::ndk::ScopedAStatus conference(int32_t serial) override;
     ::ndk::ScopedAStatus dial(
             int32_t serial, const ::aidl::android::hardware::radio::voice::Dial& dialInfo) override;
@@ -58,6 +59,7 @@
                                        int32_t off) override;
     ::ndk::ScopedAStatus sendCdmaFeatureCode(int32_t serial, const std::string& fcode) override;
     ::ndk::ScopedAStatus sendDtmf(int32_t serial, const std::string& s) override;
+    ::ndk::ScopedAStatus sendUssd(int32_t serial, const std::string& ussd) override;
     ::ndk::ScopedAStatus separateConnection(int32_t serial, int32_t gsmIndex) override;
     ::ndk::ScopedAStatus setCallForward(
             int32_t serial,
diff --git a/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp b/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp
index e5c33b3..eb87828 100644
--- a/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp
+++ b/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp
@@ -73,13 +73,6 @@
     return {};
 }
 
-Return<void> RadioIndication::onUssd(V1_0::RadioIndicationType type, V1_0::UssdModeType modeType,
-                                     const hidl_string& msg) {
-    LOG_CALL << type;
-    messagingCb()->onUssd(toAidl(type), aidl::UssdModeType(modeType), msg);
-    return {};
-}
-
 Return<void> RadioIndication::simSmsStorageFull(V1_0::RadioIndicationType type) {
     LOG_CALL << type;
     messagingCb()->simSmsStorageFull(toAidl(type));
diff --git a/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp b/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp
index 4d94e17..56d49f1 100644
--- a/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp
+++ b/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp
@@ -54,12 +54,6 @@
     return ok();
 }
 
-ScopedAStatus RadioMessaging::cancelPendingUssd(int32_t serial) {
-    LOG_CALL << serial;
-    mHal1_5->cancelPendingUssd(serial);
-    return ok();
-}
-
 ScopedAStatus RadioMessaging::deleteSmsOnRuim(int32_t serial, int32_t index) {
     LOG_CALL << serial << ' ' << index;
     mHal1_5->deleteSmsOnRuim(serial, index);
@@ -148,12 +142,6 @@
     return ok();
 }
 
-ScopedAStatus RadioMessaging::sendUssd(int32_t serial, const std::string& ussd) {
-    LOG_CALL << serial << ' ' << ussd;
-    mHal1_5->sendUssd(serial, ussd);
-    return ok();
-}
-
 ScopedAStatus RadioMessaging::setCdmaBroadcastActivation(int32_t serial, bool activate) {
     LOG_CALL << serial << ' ' << activate;
     mHal1_5->setCdmaBroadcastActivation(serial, activate);
diff --git a/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp b/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp
index 24ad3d7..7a9273f 100644
--- a/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp
+++ b/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp
@@ -57,12 +57,6 @@
     return {};
 }
 
-Return<void> RadioResponse::cancelPendingUssdResponse(const V1_0::RadioResponseInfo& info) {
-    LOG_CALL << info.serial;
-    messagingCb()->cancelPendingUssdResponse(toAidl(info));
-    return {};
-}
-
 Return<void> RadioResponse::deleteSmsOnRuimResponse(const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
     messagingCb()->deleteSmsOnRuimResponse(toAidl(info));
@@ -166,12 +160,6 @@
     return {};
 }
 
-Return<void> RadioResponse::sendUssdResponse(const V1_0::RadioResponseInfo& info) {
-    LOG_CALL << info.serial;
-    messagingCb()->sendUssdResponse(toAidl(info));
-    return {};
-}
-
 Return<void> RadioResponse::setCdmaBroadcastActivationResponse(
         const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
diff --git a/radio/aidl/compat/libradiocompat/network/structs.cpp b/radio/aidl/compat/libradiocompat/network/structs.cpp
index 87a021f..c1d9b35 100644
--- a/radio/aidl/compat/libradiocompat/network/structs.cpp
+++ b/radio/aidl/compat/libradiocompat/network/structs.cpp
@@ -650,13 +650,6 @@
     };
 }
 
-aidl::NeighboringCell toAidl(const V1_0::NeighboringCell& cell) {
-    return {
-            .cid = cell.cid,
-            .rssi = cell.rssi,
-    };
-}
-
 aidl::LceDataInfo toAidl(const V1_0::LceDataInfo& info) {
     return {
             .lastHopCapacityKbps = static_cast<int32_t>(info.lastHopCapacityKbps),
diff --git a/radio/aidl/compat/libradiocompat/network/structs.h b/radio/aidl/compat/libradiocompat/network/structs.h
index 854cb38..aaa49a0 100644
--- a/radio/aidl/compat/libradiocompat/network/structs.h
+++ b/radio/aidl/compat/libradiocompat/network/structs.h
@@ -20,7 +20,6 @@
 #include <aidl/android/hardware/radio/network/CellInfo.h>
 #include <aidl/android/hardware/radio/network/LceDataInfo.h>
 #include <aidl/android/hardware/radio/network/LinkCapacityEstimate.h>
-#include <aidl/android/hardware/radio/network/NeighboringCell.h>
 #include <aidl/android/hardware/radio/network/NetworkScanRequest.h>
 #include <aidl/android/hardware/radio/network/NetworkScanResult.h>
 #include <aidl/android/hardware/radio/network/OperatorInfo.h>
@@ -92,8 +91,6 @@
 ::aidl::android::hardware::radio::network::RegStateResult toAidl(const V1_5::RegStateResult& res);
 ::aidl::android::hardware::radio::network::RegStateResult toAidl(const V1_6::RegStateResult& res);
 
-::aidl::android::hardware::radio::network::NeighboringCell toAidl(const V1_0::NeighboringCell& c);
-
 ::aidl::android::hardware::radio::network::LceDataInfo toAidl(const V1_0::LceDataInfo& info);
 
 }  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp b/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp
index 359fce0..23878ed 100644
--- a/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp
+++ b/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp
@@ -102,6 +102,13 @@
     return {};
 }
 
+Return<void> RadioIndication::onUssd(V1_0::RadioIndicationType type, V1_0::UssdModeType modeType,
+                                     const hidl_string& msg) {
+    LOG_CALL << type;
+    voiceCb()->onUssd(toAidl(type), aidl::UssdModeType(modeType), msg);
+    return {};
+}
+
 Return<void> RadioIndication::resendIncallMute(V1_0::RadioIndicationType type) {
     LOG_CALL << type;
     voiceCb()->resendIncallMute(toAidl(type));
diff --git a/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp b/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp
index d233548..5307e11 100644
--- a/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp
+++ b/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp
@@ -42,6 +42,12 @@
     return {};
 }
 
+Return<void> RadioResponse::cancelPendingUssdResponse(const V1_0::RadioResponseInfo& info) {
+    LOG_CALL << info.serial;
+    voiceCb()->cancelPendingUssdResponse(toAidl(info));
+    return {};
+}
+
 Return<void> RadioResponse::conferenceResponse(const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
     voiceCb()->conferenceResponse(toAidl(info));
@@ -198,6 +204,12 @@
     return {};
 }
 
+Return<void> RadioResponse::sendUssdResponse(const V1_0::RadioResponseInfo& info) {
+    LOG_CALL << info.serial;
+    voiceCb()->sendUssdResponse(toAidl(info));
+    return {};
+}
+
 Return<void> RadioResponse::separateConnectionResponse(const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
     voiceCb()->separateConnectionResponse(toAidl(info));
diff --git a/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp b/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp
index 71d1a56..9088f01 100644
--- a/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp
+++ b/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp
@@ -40,6 +40,12 @@
     return ok();
 }
 
+ScopedAStatus RadioVoice::cancelPendingUssd(int32_t serial) {
+    LOG_CALL << serial;
+    mHal1_5->cancelPendingUssd(serial);
+    return ok();
+}
+
 ScopedAStatus RadioVoice::conference(int32_t serial) {
     LOG_CALL << serial;
     mHal1_5->conference(serial);
@@ -201,6 +207,12 @@
     return ok();
 }
 
+ScopedAStatus RadioVoice::sendUssd(int32_t serial, const std::string& ussd) {
+    LOG_CALL << serial << ' ' << ussd;
+    mHal1_5->sendUssd(serial, ussd);
+    return ok();
+}
+
 ScopedAStatus RadioVoice::separateConnection(int32_t serial, int32_t gsmIndex) {
     LOG_CALL << serial;
     mHal1_5->separateConnection(serial, gsmIndex);
diff --git a/radio/aidl/vts/OWNERS b/radio/aidl/vts/OWNERS
new file mode 100644
index 0000000..e75c6c8
--- /dev/null
+++ b/radio/aidl/vts/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 20868
+include ../../1.0/vts/OWNERS
+
diff --git a/radio/aidl/vts/radio_config_response.cpp b/radio/aidl/vts/radio_config_response.cpp
index 1a152fb..8d81605 100644
--- a/radio/aidl/vts/radio_config_response.cpp
+++ b/radio/aidl/vts/radio_config_response.cpp
@@ -19,12 +19,15 @@
 RadioConfigResponse::RadioConfigResponse(RadioServiceTest& parent) : parent_config(parent) {}
 
 ndk::ScopedAStatus RadioConfigResponse::getSimSlotsStatusResponse(
-        const RadioResponseInfo& /* info */, const std::vector<SimSlotStatus>& /* slotStatus */) {
+        const RadioResponseInfo& info, const std::vector<SimSlotStatus>& /* slotStatus */) {
+    rspInfo = info;
+    parent_config.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioConfigResponse::setSimSlotsMappingResponse(
-        const RadioResponseInfo& /* info */) {
+ndk::ScopedAStatus RadioConfigResponse::setSimSlotsMappingResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_config.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -37,22 +40,28 @@
 }
 
 ndk::ScopedAStatus RadioConfigResponse::setPreferredDataModemResponse(
-        const RadioResponseInfo& /* info */) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_config.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioConfigResponse::getNumOfLiveModemsResponse(
-        const RadioResponseInfo& /* info */, const int8_t /* numOfLiveModems */) {
+        const RadioResponseInfo& info, const int8_t /* numOfLiveModems */) {
+    rspInfo = info;
+    parent_config.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioConfigResponse::setNumOfLiveModemsResponse(
-        const RadioResponseInfo& /* info */) {
+ndk::ScopedAStatus RadioConfigResponse::setNumOfLiveModemsResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_config.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioConfigResponse::getHalDeviceCapabilitiesResponse(
         const RadioResponseInfo& info, bool modemReducedFeatures) {
+    rspInfo = info;
     modemReducedFeatureSet1 = modemReducedFeatures;
     parent_config.notify(info.serial);
     return ndk::ScopedAStatus::ok();
diff --git a/radio/aidl/vts/radio_config_test.cpp b/radio/aidl/vts/radio_config_test.cpp
index 2d7fe01..a271b8a 100644
--- a/radio/aidl/vts/radio_config_test.cpp
+++ b/radio/aidl/vts/radio_config_test.cpp
@@ -54,3 +54,102 @@
     ALOGI("getHalDeviceCapabilities, rspInfo.error = %s\n",
           toString(radioRsp_config->rspInfo.error).c_str());
 }
+
+/*
+ * Test IRadioConfig.getSimSlotsStatus() for the response returned.
+ */
+TEST_P(RadioConfigTest, getSimSlotsStatus) {
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = radio_config->getSimSlotsStatus(serial);
+    ASSERT_OK(res);
+    ALOGI("getSimSlotsStatus, rspInfo.error = %s\n",
+          toString(radioRsp_config->rspInfo.error).c_str());
+}
+
+/*
+ * Test IRadioConfig.getPhoneCapability() for the response returned.
+ */
+TEST_P(RadioConfigTest, getPhoneCapability) {
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = radio_config->getPhoneCapability(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_config->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_config->rspInfo.serial);
+    ALOGI("getPhoneCapability, rspInfo.error = %s\n",
+          toString(radioRsp_config->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            radioRsp_config->rspInfo.error,
+            {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INTERNAL_ERR}));
+
+    if (radioRsp_config->rspInfo.error == RadioError ::NONE) {
+        // maxActiveData should be greater than or equal to maxActiveInternetData.
+        EXPECT_GE(radioRsp_config->phoneCap.maxActiveData,
+                  radioRsp_config->phoneCap.maxActiveInternetData);
+        // maxActiveData and maxActiveInternetData should be 0 or positive numbers.
+        EXPECT_GE(radioRsp_config->phoneCap.maxActiveInternetData, 0);
+    }
+}
+
+/*
+ * Test IRadioConfig.setPreferredDataModem() for the response returned.
+ */
+TEST_P(RadioConfigTest, setPreferredDataModem) {
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = radio_config->getPhoneCapability(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_config->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_config->rspInfo.serial);
+    ALOGI("getPhoneCapability, rspInfo.error = %s\n",
+          toString(radioRsp_config->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            radioRsp_config->rspInfo.error,
+            {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INTERNAL_ERR}));
+
+    if (radioRsp_config->rspInfo.error != RadioError ::NONE) {
+        return;
+    }
+
+    if (radioRsp_config->phoneCap.logicalModemIds.size() == 0) {
+        return;
+    }
+
+    // We get phoneCapability. Send setPreferredDataModem command
+    serial = GetRandomSerialNumber();
+    uint8_t modemId = radioRsp_config->phoneCap.logicalModemIds[0];
+    res = radio_config->setPreferredDataModem(serial, modemId);
+
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_config->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_config->rspInfo.serial);
+    ALOGI("setPreferredDataModem, rspInfo.error = %s\n",
+          toString(radioRsp_config->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            radioRsp_config->rspInfo.error,
+            {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INTERNAL_ERR}));
+}
+
+/*
+ * Test IRadioConfig.setPreferredDataModem() with invalid arguments.
+ */
+TEST_P(RadioConfigTest, setPreferredDataModem_invalidArgument) {
+    serial = GetRandomSerialNumber();
+    uint8_t modemId = -1;
+    ndk::ScopedAStatus res = radio_config->setPreferredDataModem(serial, modemId);
+
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_config->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_config->rspInfo.serial);
+    ALOGI("setPreferredDataModem, rspInfo.error = %s\n",
+          toString(radioRsp_config->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_config->rspInfo.error,
+                                 {RadioError::INVALID_ARGUMENTS, RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::INTERNAL_ERR}));
+}
diff --git a/radio/aidl/vts/radio_data_response.cpp b/radio/aidl/vts/radio_data_response.cpp
index 9b17bfb..8d51760 100644
--- a/radio/aidl/vts/radio_data_response.cpp
+++ b/radio/aidl/vts/radio_data_response.cpp
@@ -36,8 +36,9 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioDataResponse::deactivateDataCallResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioDataResponse::deactivateDataCallResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_data.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -61,11 +62,15 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioDataResponse::setDataAllowedResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioDataResponse::setDataAllowedResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_data.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioDataResponse::setDataProfileResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioDataResponse::setDataProfileResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_data.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -75,8 +80,9 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioDataResponse::setInitialAttachApnResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioDataResponse::setInitialAttachApnResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_data.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -94,11 +100,15 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioDataResponse::startKeepaliveResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioDataResponse::startKeepaliveResponse(const RadioResponseInfo& info,
                                                              const KeepaliveStatus& /*status*/) {
+    rspInfo = info;
+    parent_data.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioDataResponse::stopKeepaliveResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioDataResponse::stopKeepaliveResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_data.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_data_test.cpp b/radio/aidl/vts/radio_data_test.cpp
index 8547e9d..f38a958 100644
--- a/radio/aidl/vts/radio_data_test.cpp
+++ b/radio/aidl/vts/radio_data_test.cpp
@@ -83,7 +83,7 @@
     dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
     dataProfileInfo.user = std::string("username");
     dataProfileInfo.password = std::string("password");
-    dataProfileInfo.type = DataProfileInfo::TYPE_THREE_GPP;
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
     dataProfileInfo.maxConnsTime = 300;
     dataProfileInfo.maxConns = 20;
     dataProfileInfo.waitTime = 0;
@@ -157,7 +157,7 @@
     dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
     dataProfileInfo.user = std::string("username");
     dataProfileInfo.password = std::string("password");
-    dataProfileInfo.type = DataProfileInfo::TYPE_THREE_GPP;
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
     dataProfileInfo.maxConnsTime = 300;
     dataProfileInfo.maxConns = 20;
     dataProfileInfo.waitTime = 0;
@@ -309,3 +309,280 @@
 
     sleep(1);
 }
+
+/*
+ * Test IRadioData.setInitialAttachApn() for the response returned.
+ */
+TEST_P(RadioDataTest, setInitialAttachApn) {
+    serial = GetRandomSerialNumber();
+
+    // Create a dataProfileInfo
+    DataProfileInfo dataProfileInfo;
+    memset(&dataProfileInfo, 0, sizeof(dataProfileInfo));
+    dataProfileInfo.profileId = DataProfileInfo::ID_DEFAULT;
+    dataProfileInfo.apn = std::string("internet");
+    dataProfileInfo.protocol = PdpProtocolType::IPV4V6;
+    dataProfileInfo.roamingProtocol = PdpProtocolType::IPV4V6;
+    dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
+    dataProfileInfo.user = std::string("username");
+    dataProfileInfo.password = std::string("password");
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
+    dataProfileInfo.maxConnsTime = 300;
+    dataProfileInfo.maxConns = 20;
+    dataProfileInfo.waitTime = 0;
+    dataProfileInfo.enabled = true;
+    dataProfileInfo.supportedApnTypesBitmap = 320;
+    dataProfileInfo.bearerBitmap = 161543;
+    dataProfileInfo.mtuV4 = 0;
+    dataProfileInfo.mtuV6 = 0;
+    dataProfileInfo.preferred = true;
+    dataProfileInfo.persistent = false;
+
+    radio_data->setInitialAttachApn(serial, dataProfileInfo);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_data->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_data->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_data->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::RADIO_NOT_AVAILABLE}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_data->rspInfo.error,
+                                     {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE}));
+    }
+}
+
+/*
+ * Test IRadioData.setDataProfile() for the response returned.
+ */
+TEST_P(RadioDataTest, setDataProfile) {
+    serial = GetRandomSerialNumber();
+
+    // Create a dataProfileInfo
+    DataProfileInfo dataProfileInfo;
+    memset(&dataProfileInfo, 0, sizeof(dataProfileInfo));
+    dataProfileInfo.profileId = DataProfileInfo::ID_DEFAULT;
+    dataProfileInfo.apn = std::string("internet");
+    dataProfileInfo.protocol = PdpProtocolType::IPV4V6;
+    dataProfileInfo.roamingProtocol = PdpProtocolType::IPV4V6;
+    dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
+    dataProfileInfo.user = std::string("username");
+    dataProfileInfo.password = std::string("password");
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
+    dataProfileInfo.maxConnsTime = 300;
+    dataProfileInfo.maxConns = 20;
+    dataProfileInfo.waitTime = 0;
+    dataProfileInfo.enabled = true;
+    dataProfileInfo.supportedApnTypesBitmap = 320;
+    dataProfileInfo.bearerBitmap = 161543;
+    dataProfileInfo.mtuV4 = 0;
+    dataProfileInfo.mtuV6 = 0;
+    dataProfileInfo.preferred = true;
+    dataProfileInfo.persistent = true;
+
+    // Create a dataProfileInfoList
+    std::vector<DataProfileInfo> dataProfileInfoList = {dataProfileInfo};
+
+    radio_data->setDataProfile(serial, dataProfileInfoList);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_data->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_data->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_data->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::RADIO_NOT_AVAILABLE}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_data->rspInfo.error,
+                                     {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE}));
+    }
+}
+
+/*
+ * Test IRadioData.deactivateDataCall() for the response returned.
+ */
+TEST_P(RadioDataTest, deactivateDataCall) {
+    serial = GetRandomSerialNumber();
+    int cid = 1;
+    DataRequestReason reason = DataRequestReason::NORMAL;
+
+    ndk::ScopedAStatus res = radio_data->deactivateDataCall(serial, cid, reason);
+    ASSERT_OK(res);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_data->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_data->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(
+                CheckAnyOfErrors(radioRsp_data->rspInfo.error,
+                                 {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::INVALID_CALL_ID, RadioError::INVALID_STATE,
+                                  RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED,
+                                  RadioError::CANCELLED, RadioError::SIM_ABSENT}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_data->rspInfo.error,
+                {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INVALID_CALL_ID,
+                 RadioError::INVALID_STATE, RadioError::INVALID_ARGUMENTS,
+                 RadioError::REQUEST_NOT_SUPPORTED, RadioError::CANCELLED}));
+    }
+}
+
+/*
+ * Test IRadioData.startKeepalive() for the response returned.
+ */
+TEST_P(RadioDataTest, startKeepalive) {
+    std::vector<KeepaliveRequest> requests = {
+            {
+                    // Invalid IPv4 source address
+                    KeepaliveRequest::TYPE_NATT_IPV4,
+                    {192, 168, 0 /*, 100*/},
+                    1234,
+                    {8, 8, 4, 4},
+                    4500,
+                    20000,
+                    0xBAD,
+            },
+            {
+                    // Invalid IPv4 destination address
+                    KeepaliveRequest::TYPE_NATT_IPV4,
+                    {192, 168, 0, 100},
+                    1234,
+                    {8, 8, 4, 4, 1, 2, 3, 4},
+                    4500,
+                    20000,
+                    0xBAD,
+            },
+            {
+                    // Invalid Keepalive Type
+                    -1,
+                    {192, 168, 0, 100},
+                    1234,
+                    {8, 8, 4, 4},
+                    4500,
+                    20000,
+                    0xBAD,
+            },
+            {
+                    // Invalid IPv6 source address
+                    KeepaliveRequest::TYPE_NATT_IPV6,
+                    {0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFE,
+                     0xED, 0xBE, 0xEF, 0xBD},
+                    1234,
+                    {0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                     0x00, 0x88, 0x44},
+                    4500,
+                    20000,
+                    0xBAD,
+            },
+            {
+                    // Invalid IPv6 destination address
+                    KeepaliveRequest::TYPE_NATT_IPV6,
+                    {0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFE,
+                     0xED, 0xBE, 0xEF},
+                    1234,
+                    {0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                     0x00, 0x88,
+                     /*0x44*/},
+                    4500,
+                    20000,
+                    0xBAD,
+            },
+            {
+                    // Invalid Context ID (cid), this should survive the initial
+                    // range checking and fail in the modem data layer
+                    KeepaliveRequest::TYPE_NATT_IPV4,
+                    {192, 168, 0, 100},
+                    1234,
+                    {8, 8, 4, 4},
+                    4500,
+                    20000,
+                    0xBAD,
+            },
+            {
+                    // Invalid Context ID (cid), this should survive the initial
+                    // range checking and fail in the modem data layer
+                    KeepaliveRequest::TYPE_NATT_IPV6,
+                    {0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFE,
+                     0xED, 0xBE, 0xEF},
+                    1234,
+                    {0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                     0x00, 0x88, 0x44},
+                    4500,
+                    20000,
+                    0xBAD,
+            }};
+
+    for (auto req = requests.begin(); req != requests.end(); req++) {
+        serial = GetRandomSerialNumber();
+        radio_data->startKeepalive(serial, *req);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_data->rspInfo.type);
+        EXPECT_EQ(serial, radioRsp_data->rspInfo.serial);
+
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_data->rspInfo.error,
+                {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INVALID_ARGUMENTS,
+                 RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioData.stopKeepalive() for the response returned.
+ */
+TEST_P(RadioDataTest, stopKeepalive) {
+    serial = GetRandomSerialNumber();
+
+    radio_data->stopKeepalive(serial, 0xBAD);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_data->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_data->rspInfo.serial);
+
+    ASSERT_TRUE(
+            CheckAnyOfErrors(radioRsp_data->rspInfo.error,
+                             {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
+                              RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioData.getDataCallList() for the response returned.
+ */
+TEST_P(RadioDataTest, getDataCallList) {
+    LOG(DEBUG) << "getDataCallList";
+    serial = GetRandomSerialNumber();
+
+    radio_data->getDataCallList(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_data->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_data->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_data->rspInfo.error,
+                {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::SIM_ABSENT}));
+    }
+    LOG(DEBUG) << "getDataCallList finished";
+}
+
+/*
+ * Test IRadioData.setDataAllowed() for the response returned.
+ */
+TEST_P(RadioDataTest, setDataAllowed) {
+    LOG(DEBUG) << "setDataAllowed";
+    serial = GetRandomSerialNumber();
+    bool allow = true;
+
+    radio_data->setDataAllowed(serial, allow);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_data->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_data->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_data->rspInfo.error);
+    }
+    LOG(DEBUG) << "setDataAllowed finished";
+}
diff --git a/radio/aidl/vts/radio_messaging_indication.cpp b/radio/aidl/vts/radio_messaging_indication.cpp
index c69611f..481239e 100644
--- a/radio/aidl/vts/radio_messaging_indication.cpp
+++ b/radio/aidl/vts/radio_messaging_indication.cpp
@@ -48,12 +48,6 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingIndication::onUssd(RadioIndicationType /*type*/,
-                                                    UssdModeType /*modeType*/,
-                                                    const std::string& /*msg*/) {
-    return ndk::ScopedAStatus::ok();
-}
-
 ndk::ScopedAStatus RadioMessagingIndication::simSmsStorageFull(RadioIndicationType /*type*/) {
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_messaging_response.cpp b/radio/aidl/vts/radio_messaging_response.cpp
index 718df7e..49c0806 100644
--- a/radio/aidl/vts/radio_messaging_response.cpp
+++ b/radio/aidl/vts/radio_messaging_response.cpp
@@ -20,17 +20,23 @@
     : parent_messaging(parent) {}
 
 ndk::ScopedAStatus RadioMessagingResponse::acknowledgeIncomingGsmSmsWithPduResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::acknowledgeLastIncomingCdmaSmsResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::acknowledgeLastIncomingGsmSmsResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -38,40 +44,43 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::cancelPendingUssdResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioMessagingResponse::deleteSmsOnRuimResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::deleteSmsOnRuimResponse(
-        const RadioResponseInfo& /*info*/) {
-    return ndk::ScopedAStatus::ok();
-}
-
-ndk::ScopedAStatus RadioMessagingResponse::deleteSmsOnSimResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioMessagingResponse::deleteSmsOnSimResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::getCdmaBroadcastConfigResponse(
-        const RadioResponseInfo& /*info*/,
-        const std::vector<CdmaBroadcastSmsConfigInfo>& /*configs*/) {
+        const RadioResponseInfo& info, const std::vector<CdmaBroadcastSmsConfigInfo>& /*configs*/) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::getGsmBroadcastConfigResponse(
-        const RadioResponseInfo& /*info*/,
-        const std::vector<GsmBroadcastSmsConfigInfo>& /*configs*/) {
+        const RadioResponseInfo& info, const std::vector<GsmBroadcastSmsConfigInfo>& /*configs*/) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::getSmscAddressResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioMessagingResponse::getSmscAddressResponse(const RadioResponseInfo& info,
                                                                   const std::string& /*smsc*/) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::reportSmsMemoryStatusResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -91,8 +100,10 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::sendImsSmsResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioMessagingResponse::sendImsSmsResponse(const RadioResponseInfo& info,
                                                               const SendSmsResult& /*sms*/) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -112,41 +123,50 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::sendUssdResponse(const RadioResponseInfo& /*info*/) {
-    return ndk::ScopedAStatus::ok();
-}
-
 ndk::ScopedAStatus RadioMessagingResponse::setCdmaBroadcastActivationResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::setCdmaBroadcastConfigResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::setGsmBroadcastActivationResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioMessagingResponse::setGsmBroadcastConfigResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::setSmscAddressResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioMessagingResponse::setSmscAddressResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::writeSmsToRuimResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioMessagingResponse::writeSmsToRuimResponse(const RadioResponseInfo& info,
                                                                   int32_t /*index*/) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::writeSmsToSimResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioMessagingResponse::writeSmsToSimResponse(const RadioResponseInfo& info,
                                                                  int32_t /*index*/) {
+    rspInfo = info;
+    parent_messaging.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_messaging_test.cpp b/radio/aidl/vts/radio_messaging_test.cpp
index 8abd91d..9f1718b 100644
--- a/radio/aidl/vts/radio_messaging_test.cpp
+++ b/radio/aidl/vts/radio_messaging_test.cpp
@@ -197,3 +197,535 @@
                 CHECK_GENERAL_ERROR));
     }
 }
+
+/*
+ * Test IRadioMessaging.setGsmBroadcastConfig() for the response returned.
+ */
+TEST_P(RadioMessagingTest, setGsmBroadcastConfig) {
+    LOG(DEBUG) << "setGsmBroadcastConfig";
+    serial = GetRandomSerialNumber();
+
+    // Create GsmBroadcastSmsConfigInfo #1
+    GsmBroadcastSmsConfigInfo gbSmsConfig1;
+    gbSmsConfig1.fromServiceId = 4352;
+    gbSmsConfig1.toServiceId = 4354;
+    gbSmsConfig1.fromCodeScheme = 0;
+    gbSmsConfig1.toCodeScheme = 255;
+    gbSmsConfig1.selected = true;
+
+    // Create GsmBroadcastSmsConfigInfo #2
+    GsmBroadcastSmsConfigInfo gbSmsConfig2;
+    gbSmsConfig2.fromServiceId = 4356;
+    gbSmsConfig2.toServiceId = 4356;
+    gbSmsConfig2.fromCodeScheme = 0;
+    gbSmsConfig2.toCodeScheme = 255;
+    gbSmsConfig2.selected = true;
+
+    // Create GsmBroadcastSmsConfigInfo #3
+    GsmBroadcastSmsConfigInfo gbSmsConfig3;
+    gbSmsConfig3.fromServiceId = 4370;
+    gbSmsConfig3.toServiceId = 4379;
+    gbSmsConfig3.fromCodeScheme = 0;
+    gbSmsConfig3.toCodeScheme = 255;
+    gbSmsConfig3.selected = true;
+
+    // Create GsmBroadcastSmsConfigInfo #4
+    GsmBroadcastSmsConfigInfo gbSmsConfig4;
+    gbSmsConfig4.fromServiceId = 4383;
+    gbSmsConfig4.toServiceId = 4391;
+    gbSmsConfig4.fromCodeScheme = 0;
+    gbSmsConfig4.toCodeScheme = 255;
+    gbSmsConfig4.selected = true;
+
+    // Create GsmBroadcastSmsConfigInfo #5
+    GsmBroadcastSmsConfigInfo gbSmsConfig5;
+    gbSmsConfig5.fromServiceId = 4392;
+    gbSmsConfig5.toServiceId = 4392;
+    gbSmsConfig5.fromCodeScheme = 0;
+    gbSmsConfig5.toCodeScheme = 255;
+    gbSmsConfig5.selected = true;
+
+    std::vector<GsmBroadcastSmsConfigInfo> gsmBroadcastSmsConfigsInfoList = {
+            gbSmsConfig1, gbSmsConfig2, gbSmsConfig3, gbSmsConfig4, gbSmsConfig5};
+
+    radio_messaging->setGsmBroadcastConfig(serial, gsmBroadcastSmsConfigsInfoList);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS,
+                                      RadioError::INVALID_MODEM_STATE, RadioError::INVALID_STATE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setGsmBroadcastConfig finished";
+}
+
+/*
+ * Test IRadioMessaging.getGsmBroadcastConfig() for the response returned.
+ */
+TEST_P(RadioMessagingTest, getGsmBroadcastConfig) {
+    LOG(DEBUG) << "getGsmBroadcastConfig";
+    serial = GetRandomSerialNumber();
+
+    radio_messaging->getGsmBroadcastConfig(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_messaging->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_MODEM_STATE, RadioError::INVALID_STATE},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getGsmBroadcastConfig finished";
+}
+
+/*
+ * Test IRadioMessaging.setCdmaBroadcastConfig() for the response returned.
+ */
+TEST_P(RadioMessagingTest, setCdmaBroadcastConfig) {
+    LOG(DEBUG) << "setCdmaBroadcastConfig";
+    serial = GetRandomSerialNumber();
+
+    CdmaBroadcastSmsConfigInfo cbSmsConfig;
+    cbSmsConfig.serviceCategory = 4096;
+    cbSmsConfig.language = 1;
+    cbSmsConfig.selected = true;
+
+    std::vector<CdmaBroadcastSmsConfigInfo> cdmaBroadcastSmsConfigInfoList = {cbSmsConfig};
+
+    radio_messaging->setCdmaBroadcastConfig(serial, cdmaBroadcastSmsConfigInfoList);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_MODEM_STATE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setCdmaBroadcastConfig finished";
+}
+
+/*
+ * Test IRadioMessaging.getCdmaBroadcastConfig() for the response returned.
+ */
+TEST_P(RadioMessagingTest, getCdmaBroadcastConfig) {
+    LOG(DEBUG) << "getCdmaBroadcastConfig";
+    serial = GetRandomSerialNumber();
+
+    radio_messaging->getCdmaBroadcastConfig(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getCdmaBroadcastConfig finished";
+}
+
+/*
+ * Test IRadioMessaging.setCdmaBroadcastActivation() for the response returned.
+ */
+TEST_P(RadioMessagingTest, setCdmaBroadcastActivation) {
+    LOG(DEBUG) << "setCdmaBroadcastActivation";
+    serial = GetRandomSerialNumber();
+    bool activate = false;
+
+    radio_messaging->setCdmaBroadcastActivation(serial, activate);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setCdmaBroadcastActivation finished";
+}
+
+/*
+ * Test IRadioMessaging.setGsmBroadcastActivation() for the response returned.
+ */
+TEST_P(RadioMessagingTest, setGsmBroadcastActivation) {
+    LOG(DEBUG) << "setGsmBroadcastActivation";
+    serial = GetRandomSerialNumber();
+    bool activate = false;
+
+    radio_messaging->setGsmBroadcastActivation(serial, activate);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_messaging->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::INVALID_MODEM_STATE,
+                 RadioError::INVALID_STATE, RadioError::OPERATION_NOT_ALLOWED},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setGsmBroadcastActivation finished";
+}
+
+/*
+ * Test IRadioMessaging.acknowledgeLastIncomingGsmSms() for the response returned.
+ */
+TEST_P(RadioMessagingTest, acknowledgeLastIncomingGsmSms) {
+    LOG(DEBUG) << "acknowledgeLastIncomingGsmSms";
+    serial = GetRandomSerialNumber();
+    bool success = true;
+
+    radio_messaging->acknowledgeLastIncomingGsmSms(
+            serial, success, SmsAcknowledgeFailCause::MEMORY_CAPACITY_EXCEEDED);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "acknowledgeLastIncomingGsmSms finished";
+}
+
+/*
+ * Test IRadioMessaging.acknowledgeIncomingGsmSmsWithPdu() for the response returned.
+ */
+TEST_P(RadioMessagingTest, acknowledgeIncomingGsmSmsWithPdu) {
+    LOG(DEBUG) << "acknowledgeIncomingGsmSmsWithPdu";
+    serial = GetRandomSerialNumber();
+    bool success = true;
+    std::string ackPdu = "";
+
+    radio_messaging->acknowledgeIncomingGsmSmsWithPdu(serial, success, ackPdu);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::NO_SMS_TO_ACK},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "acknowledgeIncomingGsmSmsWithPdu finished";
+}
+
+/*
+ * Test IRadioMessaging.acknowledgeLastIncomingCdmaSms() for the response returned.
+ */
+TEST_P(RadioMessagingTest, acknowledgeLastIncomingCdmaSms) {
+    LOG(DEBUG) << "acknowledgeLastIncomingCdmaSms";
+    serial = GetRandomSerialNumber();
+
+    // Create a CdmaSmsAck
+    CdmaSmsAck cdmaSmsAck;
+    cdmaSmsAck.errorClass = false;
+    cdmaSmsAck.smsCauseCode = 1;
+
+    radio_messaging->acknowledgeLastIncomingCdmaSms(serial, cdmaSmsAck);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::NO_SMS_TO_ACK},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "acknowledgeLastIncomingCdmaSms finished";
+}
+
+/*
+ * Test IRadioMessaging.sendImsSms() for the response returned.
+ */
+TEST_P(RadioMessagingTest, sendImsSms) {
+    LOG(DEBUG) << "sendImsSms";
+    serial = GetRandomSerialNumber();
+
+    // Create a CdmaSmsAddress
+    CdmaSmsAddress cdmaSmsAddress;
+    cdmaSmsAddress.digitMode = CdmaSmsAddress::DIGIT_MODE_FOUR_BIT;
+    cdmaSmsAddress.isNumberModeDataNetwork = false;
+    cdmaSmsAddress.numberType = CdmaSmsAddress::NUMBER_TYPE_UNKNOWN;
+    cdmaSmsAddress.numberPlan = CdmaSmsAddress::NUMBER_PLAN_UNKNOWN;
+    cdmaSmsAddress.digits = (std::vector<uint8_t>){11, 1, 6, 5, 10, 7, 7, 2, 10, 3, 10, 3};
+
+    // Create a CdmaSmsSubAddress
+    CdmaSmsSubaddress cdmaSmsSubaddress;
+    cdmaSmsSubaddress.subaddressType = CdmaSmsSubaddress::SUBADDRESS_TYPE_NSAP;
+    cdmaSmsSubaddress.odd = false;
+    cdmaSmsSubaddress.digits = (std::vector<uint8_t>){};
+
+    // Create a CdmaSmsMessage
+    CdmaSmsMessage cdmaSmsMessage;
+    cdmaSmsMessage.teleserviceId = 4098;
+    cdmaSmsMessage.isServicePresent = false;
+    cdmaSmsMessage.serviceCategory = 0;
+    cdmaSmsMessage.address = cdmaSmsAddress;
+    cdmaSmsMessage.subAddress = cdmaSmsSubaddress;
+    cdmaSmsMessage.bearerData =
+            (std::vector<uint8_t>){15, 0, 3, 32, 3, 16, 1, 8, 16, 53, 76, 68, 6, 51, 106, 0};
+
+    // Creata an ImsSmsMessage
+    ImsSmsMessage msg;
+    msg.tech = RadioTechnologyFamily::THREE_GPP2;
+    msg.retry = false;
+    msg.messageRef = 0;
+    msg.cdmaMessage = (std::vector<CdmaSmsMessage>){cdmaSmsMessage};
+    msg.gsmMessage = (std::vector<GsmSmsMessage>){};
+
+    radio_messaging->sendImsSms(serial, msg);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS}, CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendImsSms finished";
+}
+
+/*
+ * Test IRadioMessaging.getSmscAddress() for the response returned.
+ */
+TEST_P(RadioMessagingTest, getSmscAddress) {
+    LOG(DEBUG) << "getSmscAddress";
+    serial = GetRandomSerialNumber();
+
+    radio_messaging->getSmscAddress(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_MODEM_STATE, RadioError::INVALID_STATE,
+                                      RadioError::SIM_ABSENT},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getSmscAddress finished";
+}
+
+/*
+ * Test IRadioMessaging.setSmscAddress() for the response returned.
+ */
+TEST_P(RadioMessagingTest, setSmscAddress) {
+    LOG(DEBUG) << "setSmscAddress";
+    serial = GetRandomSerialNumber();
+    std::string address = std::string("smscAddress");
+
+    radio_messaging->setSmscAddress(serial, address);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_SMS_FORMAT,
+                                      RadioError::SIM_ABSENT},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setSmscAddress finished";
+}
+
+/*
+ * Test IRadioMessaging.writeSmsToSim() for the response returned.
+ */
+TEST_P(RadioMessagingTest, writeSmsToSim) {
+    LOG(DEBUG) << "writeSmsToSim";
+    serial = GetRandomSerialNumber();
+    SmsWriteArgs smsWriteArgs;
+    smsWriteArgs.status = SmsWriteArgs::STATUS_REC_UNREAD;
+    smsWriteArgs.smsc = "";
+    smsWriteArgs.pdu = "01000b916105770203f3000006d4f29c3e9b01";
+
+    radio_messaging->writeSmsToSim(serial, smsWriteArgs);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_messaging->rspInfo.error,
+                {RadioError::NONE, RadioError::ENCODING_ERR, RadioError::INVALID_ARGUMENTS,
+                 RadioError::INVALID_SMSC_ADDRESS, RadioError::MODEM_ERR,
+                 RadioError::NETWORK_NOT_READY, RadioError::NO_RESOURCES, RadioError::SIM_ABSENT},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "writeSmsToSim finished";
+}
+
+/*
+ * Test IRadioMessaging.deleteSmsOnSim() for the response returned.
+ */
+TEST_P(RadioMessagingTest, deleteSmsOnSim) {
+    LOG(DEBUG) << "deleteSmsOnSim";
+    serial = GetRandomSerialNumber();
+    int index = 1;
+
+    radio_messaging->deleteSmsOnSim(serial, index);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_messaging->rspInfo.error,
+                {RadioError::NONE, RadioError::ENCODING_ERR, RadioError::INVALID_ARGUMENTS,
+                 RadioError::INVALID_MODEM_STATE, RadioError::NO_SUCH_ENTRY, RadioError::MODEM_ERR,
+                 RadioError::SIM_ABSENT},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "deleteSmsOnSim finished";
+}
+
+/*
+ * Test IRadioMessaging.writeSmsToRuim() for the response returned.
+ */
+TEST_P(RadioMessagingTest, writeSmsToRuim) {
+    LOG(DEBUG) << "writeSmsToRuim";
+    serial = GetRandomSerialNumber();
+
+    // Create a CdmaSmsAddress
+    CdmaSmsAddress cdmaSmsAddress;
+    cdmaSmsAddress.digitMode = CdmaSmsAddress::DIGIT_MODE_FOUR_BIT;
+    cdmaSmsAddress.isNumberModeDataNetwork = false;
+    cdmaSmsAddress.numberType = CdmaSmsAddress::NUMBER_TYPE_UNKNOWN;
+    cdmaSmsAddress.numberPlan = CdmaSmsAddress::NUMBER_PLAN_UNKNOWN;
+    cdmaSmsAddress.digits = (std::vector<uint8_t>){11, 1, 6, 5, 10, 7, 7, 2, 10, 3, 10, 3};
+
+    // Create a CdmaSmsSubAddress
+    CdmaSmsSubaddress cdmaSmsSubaddress;
+    cdmaSmsSubaddress.subaddressType = CdmaSmsSubaddress::SUBADDRESS_TYPE_NSAP;
+    cdmaSmsSubaddress.odd = false;
+    cdmaSmsSubaddress.digits = (std::vector<uint8_t>){};
+
+    // Create a CdmaSmsMessage
+    CdmaSmsMessage cdmaSmsMessage;
+    cdmaSmsMessage.teleserviceId = 4098;
+    cdmaSmsMessage.isServicePresent = false;
+    cdmaSmsMessage.serviceCategory = 0;
+    cdmaSmsMessage.address = cdmaSmsAddress;
+    cdmaSmsMessage.subAddress = cdmaSmsSubaddress;
+    cdmaSmsMessage.bearerData =
+            (std::vector<uint8_t>){15, 0, 3, 32, 3, 16, 1, 8, 16, 53, 76, 68, 6, 51, 106, 0};
+
+    // Create a CdmaSmsWriteArgs
+    CdmaSmsWriteArgs cdmaSmsWriteArgs;
+    cdmaSmsWriteArgs.status = CdmaSmsWriteArgs::STATUS_REC_UNREAD;
+    cdmaSmsWriteArgs.message = cdmaSmsMessage;
+
+    radio_messaging->writeSmsToRuim(serial, cdmaSmsWriteArgs);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_messaging->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::INVALID_SMS_FORMAT,
+                 RadioError::INVALID_SMSC_ADDRESS, RadioError::INVALID_STATE, RadioError::MODEM_ERR,
+                 RadioError::NO_SUCH_ENTRY, RadioError::SIM_ABSENT},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "writeSmsToRuim finished";
+}
+
+/*
+ * Test IRadioMessaging.deleteSmsOnRuim() for the response returned.
+ */
+TEST_P(RadioMessagingTest, deleteSmsOnRuim) {
+    LOG(DEBUG) << "deleteSmsOnRuim";
+    serial = GetRandomSerialNumber();
+    int index = 1;
+
+    // Create a CdmaSmsAddress
+    CdmaSmsAddress cdmaSmsAddress;
+    cdmaSmsAddress.digitMode = CdmaSmsAddress::DIGIT_MODE_FOUR_BIT;
+    cdmaSmsAddress.isNumberModeDataNetwork = false;
+    cdmaSmsAddress.numberType = CdmaSmsAddress::NUMBER_TYPE_UNKNOWN;
+    cdmaSmsAddress.numberPlan = CdmaSmsAddress::NUMBER_PLAN_UNKNOWN;
+    cdmaSmsAddress.digits = (std::vector<uint8_t>){11, 1, 6, 5, 10, 7, 7, 2, 10, 3, 10, 3};
+
+    // Create a CdmaSmsSubAddress
+    CdmaSmsSubaddress cdmaSmsSubaddress;
+    cdmaSmsSubaddress.subaddressType = CdmaSmsSubaddress::SUBADDRESS_TYPE_NSAP;
+    cdmaSmsSubaddress.odd = false;
+    cdmaSmsSubaddress.digits = (std::vector<uint8_t>){};
+
+    // Create a CdmaSmsMessage
+    CdmaSmsMessage cdmaSmsMessage;
+    cdmaSmsMessage.teleserviceId = 4098;
+    cdmaSmsMessage.isServicePresent = false;
+    cdmaSmsMessage.serviceCategory = 0;
+    cdmaSmsMessage.address = cdmaSmsAddress;
+    cdmaSmsMessage.subAddress = cdmaSmsSubaddress;
+    cdmaSmsMessage.bearerData =
+            (std::vector<uint8_t>){15, 0, 3, 32, 3, 16, 1, 8, 16, 53, 76, 68, 6, 51, 106, 0};
+
+    // Create a CdmaSmsWriteArgs
+    CdmaSmsWriteArgs cdmaSmsWriteArgs;
+    cdmaSmsWriteArgs.status = CdmaSmsWriteArgs::STATUS_REC_UNREAD;
+    cdmaSmsWriteArgs.message = cdmaSmsMessage;
+
+    radio_messaging->deleteSmsOnRuim(serial, index);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_messaging->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::INVALID_MODEM_STATE,
+                 RadioError::MODEM_ERR, RadioError::NO_SUCH_ENTRY, RadioError::SIM_ABSENT},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "deleteSmsOnRuim finished";
+}
+
+/*
+ * Test IRadioMessaging.reportSmsMemoryStatus() for the response returned.
+ */
+TEST_P(RadioMessagingTest, reportSmsMemoryStatus) {
+    LOG(DEBUG) << "reportSmsMemoryStatus";
+    serial = GetRandomSerialNumber();
+    bool available = true;
+
+    radio_messaging->reportSmsMemoryStatus(serial, available);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE,
+                                      RadioError::MODEM_ERR, RadioError::SIM_ABSENT},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "reportSmsMemoryStatus finished";
+}
diff --git a/radio/aidl/vts/radio_messaging_utils.h b/radio/aidl/vts/radio_messaging_utils.h
index 7bb99cd..7b66192 100644
--- a/radio/aidl/vts/radio_messaging_utils.h
+++ b/radio/aidl/vts/radio_messaging_utils.h
@@ -49,8 +49,6 @@
 
     virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
 
-    virtual ndk::ScopedAStatus cancelPendingUssdResponse(const RadioResponseInfo& info) override;
-
     virtual ndk::ScopedAStatus deleteSmsOnRuimResponse(const RadioResponseInfo& info) override;
 
     virtual ndk::ScopedAStatus deleteSmsOnSimResponse(const RadioResponseInfo& info) override;
@@ -84,8 +82,6 @@
     virtual ndk::ScopedAStatus sendSmsResponse(const RadioResponseInfo& info,
                                                const SendSmsResult& sms) override;
 
-    virtual ndk::ScopedAStatus sendUssdResponse(const RadioResponseInfo& info) override;
-
     virtual ndk::ScopedAStatus setCdmaBroadcastActivationResponse(
             const RadioResponseInfo& info) override;
 
@@ -132,9 +128,6 @@
     virtual ndk::ScopedAStatus newSmsStatusReport(RadioIndicationType type,
                                                   const std::vector<uint8_t>& pdu) override;
 
-    virtual ndk::ScopedAStatus onUssd(RadioIndicationType type, UssdModeType modeType,
-                                      const std::string& msg) override;
-
     virtual ndk::ScopedAStatus simSmsStorageFull(RadioIndicationType type) override;
 };
 
diff --git a/radio/aidl/vts/radio_modem_response.cpp b/radio/aidl/vts/radio_modem_response.cpp
index 53bfab4..d2715a8 100644
--- a/radio/aidl/vts/radio_modem_response.cpp
+++ b/radio/aidl/vts/radio_modem_response.cpp
@@ -22,70 +22,99 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::enableModemResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioModemResponse::enableModemResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::getBasebandVersionResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioModemResponse::getBasebandVersionResponse(const RadioResponseInfo& info,
                                                                   const std::string& /*version*/) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::getDeviceIdentityResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioModemResponse::getDeviceIdentityResponse(const RadioResponseInfo& info,
                                                                  const std::string& /*imei*/,
                                                                  const std::string& /*imeisv*/,
                                                                  const std::string& /*esn*/,
                                                                  const std::string& /*meid*/) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioModemResponse::getHardwareConfigResponse(
-        const RadioResponseInfo& /*info*/, const std::vector<HardwareConfig>& /*config*/) {
+        const RadioResponseInfo& info, const std::vector<HardwareConfig>& /*config*/) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioModemResponse::getModemActivityInfoResponse(
-        const RadioResponseInfo& /*info*/, const ActivityStatsInfo& /*activityInfo*/) {
+        const RadioResponseInfo& info, const ActivityStatsInfo& /*activityInfo*/) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::getModemStackStatusResponse(
-        const RadioResponseInfo& /*info*/, const bool /*enabled*/) {
+ndk::ScopedAStatus RadioModemResponse::getModemStackStatusResponse(const RadioResponseInfo& info,
+                                                                   const bool enabled) {
+    rspInfo = info;
+    isModemEnabled = enabled;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::getRadioCapabilityResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioModemResponse::getRadioCapabilityResponse(const RadioResponseInfo& info,
                                                                   const RadioCapability& /*rc*/) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::nvReadItemResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioModemResponse::nvReadItemResponse(const RadioResponseInfo& info,
                                                           const std::string& /*result*/) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::nvResetConfigResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioModemResponse::nvResetConfigResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::nvWriteCdmaPrlResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioModemResponse::nvWriteCdmaPrlResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::nvWriteItemResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioModemResponse::nvWriteItemResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::requestShutdownResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioModemResponse::requestShutdownResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::sendDeviceStateResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioModemResponse::sendDeviceStateResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioModemResponse::setRadioCapabilityResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioModemResponse::setRadioCapabilityResponse(const RadioResponseInfo& info,
                                                                   const RadioCapability& /*rc*/) {
+    rspInfo = info;
+    parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
diff --git a/radio/aidl/vts/radio_modem_test.cpp b/radio/aidl/vts/radio_modem_test.cpp
index b40bb7b..f88da13 100644
--- a/radio/aidl/vts/radio_modem_test.cpp
+++ b/radio/aidl/vts/radio_modem_test.cpp
@@ -87,3 +87,301 @@
     EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
     EXPECT_EQ(RadioError::NONE, radioRsp_modem->rspInfo.error);
 }
+
+/*
+ * Test IRadioModem.enableModem() for the response returned.
+ */
+TEST_P(RadioModemTest, enableModem) {
+    serial = GetRandomSerialNumber();
+
+    if (isSsSsEnabled()) {
+        ALOGI("enableModem, no need to test in single SIM mode");
+        return;
+    }
+
+    bool responseToggle = radioRsp_modem->enableModemResponseToggle;
+    ndk::ScopedAStatus res = radio_modem->enableModem(serial, true);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+    ALOGI("getModemStackStatus, rspInfo.error = %s\n",
+          toString(radioRsp_modem->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
+                                 {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::MODEM_ERR, RadioError::INVALID_STATE}));
+
+    // checking if getModemStackStatus returns true, as modem was enabled above
+    if (RadioError::NONE == radioRsp_modem->rspInfo.error) {
+        // wait until modem enabling is finished
+        while (responseToggle == radioRsp_modem->enableModemResponseToggle) {
+            sleep(1);
+        }
+        ndk::ScopedAStatus resEnabled = radio_modem->getModemStackStatus(serial);
+        ASSERT_OK(resEnabled);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+        EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+        ALOGI("getModemStackStatus, rspInfo.error = %s\n",
+              toString(radioRsp_modem->rspInfo.error).c_str());
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
+                                     {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
+                                      RadioError::MODEM_ERR, RadioError::INVALID_STATE}));
+        // verify that enableModem did set isEnabled correctly
+        EXPECT_EQ(true, radioRsp_modem->isModemEnabled);
+    }
+}
+
+/*
+ * Test IRadioModem.getModemStackStatus() for the response returned.
+ */
+TEST_P(RadioModemTest, getModemStackStatus) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_modem->getModemStackStatus(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+    ALOGI("getModemStackStatus, rspInfo.error = %s\n",
+          toString(radioRsp_modem->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(
+            radioRsp_modem->rspInfo.error,
+            {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::MODEM_ERR}));
+}
+
+/*
+ * Test IRadioModem.getBasebandVersion() for the response returned.
+ */
+TEST_P(RadioModemTest, getBasebandVersion) {
+    LOG(DEBUG) << "getBasebandVersion";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->getBasebandVersion(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_modem->rspInfo.error);
+    }
+    LOG(DEBUG) << "getBasebandVersion finished";
+}
+
+/*
+ * Test IRadioModem.getDeviceIdentity() for the response returned.
+ */
+TEST_P(RadioModemTest, getDeviceIdentity) {
+    LOG(DEBUG) << "getDeviceIdentity";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->getDeviceIdentity(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
+                                     {RadioError::NONE, RadioError::EMPTY_RECORD}));
+    }
+    LOG(DEBUG) << "getDeviceIdentity finished";
+}
+
+/*
+ * Test IRadioModem.nvReadItem() for the response returned.
+ */
+TEST_P(RadioModemTest, nvReadItem) {
+    LOG(DEBUG) << "nvReadItem";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->nvReadItem(serial, NvItem::LTE_BAND_ENABLE_25);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "nvReadItem finished";
+}
+
+/*
+ * Test IRadioModem.nvWriteItem() for the response returned.
+ */
+TEST_P(RadioModemTest, nvWriteItem) {
+    LOG(DEBUG) << "nvWriteItem";
+    serial = GetRandomSerialNumber();
+    NvWriteItem item;
+    memset(&item, 0, sizeof(item));
+    item.value = std::string();
+
+    radio_modem->nvWriteItem(serial, item);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "nvWriteItem finished";
+}
+
+/*
+ * Test IRadioModem.nvWriteCdmaPrl() for the response returned.
+ */
+TEST_P(RadioModemTest, nvWriteCdmaPrl) {
+    LOG(DEBUG) << "nvWriteCdmaPrl";
+    serial = GetRandomSerialNumber();
+    std::vector<uint8_t> prl = {1, 2, 3, 4, 5};
+
+    radio_modem->nvWriteCdmaPrl(serial, std::vector<uint8_t>(prl));
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "nvWriteCdmaPrl finished";
+}
+
+/*
+ * Test IRadioModem.nvResetConfig() for the response returned.
+ */
+TEST_P(RadioModemTest, nvResetConfig) {
+    LOG(DEBUG) << "nvResetConfig";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->nvResetConfig(serial, ResetNvType::FACTORY_RESET);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
+                                     {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "nvResetConfig finished";
+}
+
+/*
+ * Test IRadioModem.getHardwareConfig() for the response returned.
+ */
+TEST_P(RadioModemTest, getHardwareConfig) {
+    LOG(DEBUG) << "getHardwareConfig";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->getHardwareConfig(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getHardwareConfig finished";
+}
+
+/*
+ * The following test is disabled due to b/64734869
+ *
+ * Test IRadioModem.requestShutdown() for the response returned.
+ */
+TEST_P(RadioModemTest, DISABLED_requestShutdown) {
+    serial = GetRandomSerialNumber();
+
+    radio_modem->requestShutdown(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioModem.getRadioCapability() for the response returned.
+ */
+TEST_P(RadioModemTest, getRadioCapability) {
+    LOG(DEBUG) << "getRadioCapability";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->getRadioCapability(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_modem->rspInfo.error);
+    }
+    LOG(DEBUG) << "getRadioCapability finished";
+}
+
+/*
+ * Test IRadioModem.setRadioCapability() for the response returned.
+ */
+TEST_P(RadioModemTest, setRadioCapability) {
+    LOG(DEBUG) << "setRadioCapability";
+    serial = GetRandomSerialNumber();
+    RadioCapability rc;
+    memset(&rc, 0, sizeof(rc));
+    rc.logicalModemUuid = std::string();
+
+    radio_modem->setRadioCapability(serial, rc);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setRadioCapability finished";
+}
+
+/*
+ * Test IRadioModem.getModemActivityInfo() for the response returned.
+ */
+TEST_P(RadioModemTest, getModemActivityInfo) {
+    LOG(DEBUG) << "getModemActivityInfo";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->getModemActivityInfo(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
+                                     {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "getModemActivityInfo finished";
+}
+
+/*
+ * Test IRadioModem.sendDeviceState() for the response returned.
+ */
+TEST_P(RadioModemTest, sendDeviceState) {
+    LOG(DEBUG) << "sendDeviceState";
+    serial = GetRandomSerialNumber();
+
+    radio_modem->sendDeviceState(serial, DeviceStateType::POWER_SAVE_MODE, true);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_modem->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_modem->rspInfo.serial);
+
+    std::cout << static_cast<int>(radioRsp_modem->rspInfo.error) << std::endl;
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
+                                     {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "sendDeviceState finished";
+}
diff --git a/radio/aidl/vts/radio_network_response.cpp b/radio/aidl/vts/radio_network_response.cpp
index ccae0f3..666d617 100644
--- a/radio/aidl/vts/radio_network_response.cpp
+++ b/radio/aidl/vts/radio_network_response.cpp
@@ -31,7 +31,10 @@
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::getAvailableBandModesResponse(
-        const RadioResponseInfo& /*info*/, const std::vector<RadioBandMode>& /*bandModes*/) {
+        const RadioResponseInfo& info, const std::vector<RadioBandMode>& bandModes) {
+    rspInfo = info;
+    radioBandModes = bandModes;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -44,48 +47,64 @@
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::getBarringInfoResponse(
-        const RadioResponseInfo& /*info*/, const CellIdentity& /*cellIdentity*/,
-        const std::vector<BarringInfo>& /*barringInfos*/) {
+        const RadioResponseInfo& info, const CellIdentity& cellIdentity,
+        const std::vector<BarringInfo>& barringInfos) {
+    rspInfo = info;
+    barringCellIdentity = cellIdentity;
+    barringInfoList = barringInfos;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::getCdmaRoamingPreferenceResponse(
-        const RadioResponseInfo& /*info*/, CdmaRoamingType /*type*/) {
-    return ndk::ScopedAStatus::ok();
-}
-
-ndk::ScopedAStatus RadioNetworkResponse::getCellInfoListResponse(
-        const RadioResponseInfo& /*info*/, const std::vector<CellInfo>& /*cellInfo*/) {
-    return ndk::ScopedAStatus::ok();
-}
-
-ndk::ScopedAStatus RadioNetworkResponse::getDataRegistrationStateResponse(
-        const RadioResponseInfo& info, const RegStateResult& /*regResponse*/) {
+        const RadioResponseInfo& info, CdmaRoamingType /*type*/) {
     rspInfo = info;
     parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus RadioNetworkResponse::getCellInfoListResponse(
+        const RadioResponseInfo& info, const std::vector<CellInfo>& /*cellInfo*/) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioNetworkResponse::getDataRegistrationStateResponse(
+        const RadioResponseInfo& info, const RegStateResult& regResponse) {
+    rspInfo = info;
+    dataRegResp = regResponse;
+    parent_network.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus RadioNetworkResponse::getImsRegistrationStateResponse(
-        const RadioResponseInfo& /*info*/, bool /*isRegistered*/,
-        RadioTechnologyFamily /*ratFamily*/) {
+        const RadioResponseInfo& info, bool /*isRegistered*/, RadioTechnologyFamily /*ratFamily*/) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::getNetworkSelectionModeResponse(
-        const RadioResponseInfo& /*info*/, bool /*manual*/) {
+        const RadioResponseInfo& info, bool /*manual*/) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioNetworkResponse::getOperatorResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioNetworkResponse::getOperatorResponse(const RadioResponseInfo& info,
                                                              const std::string& /*longName*/,
                                                              const std::string& /*shortName*/,
                                                              const std::string& /*numeric*/) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::getSignalStrengthResponse(
-        const RadioResponseInfo& /*info*/, const SignalStrength& /*sig_strength*/) {
+        const RadioResponseInfo& info, const SignalStrength& /*sig_strength*/) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -105,14 +124,16 @@
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::getVoiceRadioTechnologyResponse(
-        const RadioResponseInfo& /*info*/, RadioTechnology /*rat*/) {
+        const RadioResponseInfo& info, RadioTechnology /*rat*/) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::getVoiceRegistrationStateResponse(
         const RadioResponseInfo& info, const RegStateResult& regResponse) {
     rspInfo = info;
-    voiceRegResp.regState = regResponse.regState;
+    voiceRegResp = regResponse;
     parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
@@ -132,47 +153,63 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioNetworkResponse::setBandModeResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioNetworkResponse::setBandModeResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioNetworkResponse::setBarringPasswordResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioNetworkResponse::setBarringPasswordResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setCdmaRoamingPreferenceResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setCellInfoListRateResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setIndicationFilterResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setLinkCapacityReportingCriteriaResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioNetworkResponse::setLocationUpdatesResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioNetworkResponse::setLocationUpdatesResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setNetworkSelectionModeAutomaticResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setNetworkSelectionModeManualResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -184,17 +221,23 @@
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setSignalStrengthReportingCriteriaResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setSuppServiceNotificationsResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::setSystemSelectionChannelsResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -204,17 +247,21 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioNetworkResponse::startNetworkScanResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioNetworkResponse::startNetworkScanResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioNetworkResponse::stopNetworkScanResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioNetworkResponse::stopNetworkScanResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioNetworkResponse::supplyNetworkDepersonalizationResponse(
-        const RadioResponseInfo& /*info*/, int32_t /*remainingRetries*/) {
+        const RadioResponseInfo& info, int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_network.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_network_test.cpp b/radio/aidl/vts/radio_network_test.cpp
index 93c4c35..391d63c 100644
--- a/radio/aidl/vts/radio_network_test.cpp
+++ b/radio/aidl/vts/radio_network_test.cpp
@@ -16,6 +16,7 @@
 
 #include <aidl/android/hardware/radio/RadioAccessFamily.h>
 #include <aidl/android/hardware/radio/config/IRadioConfig.h>
+#include <aidl/android/hardware/radio/network/IndicationFilter.h>
 #include <android-base/logging.h>
 #include <android/binder_manager.h>
 
@@ -58,6 +59,12 @@
     ASSERT_NE(nullptr, radio_config.get());
 }
 
+void RadioNetworkTest::stopNetworkScan() {
+    serial = GetRandomSerialNumber();
+    radio_network->stopNetworkScan(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+}
+
 /*
  * Test IRadioNetwork.setAllowedNetworkTypesBitmap for the response returned.
  */
@@ -263,3 +270,1462 @@
     // Check that indeed the original setting was reset.
     ASSERT_TRUE(originalSetting == radioRsp_network->usageSetting);
 }
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() with invalid hysteresisDb
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_invalidHysteresisDb) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSSI;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 10;  // hysteresisDb too large given threshold list deltas
+    signalThresholdInfo.thresholds = {-109, -103, -97, -89};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::GERAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_invalidHysteresisDb, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::INVALID_ARGUMENTS}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() with empty thresholds
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_EmptyThresholds) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSSI;
+    signalThresholdInfo.hysteresisMs = 0;
+    signalThresholdInfo.hysteresisDb = 0;
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::GERAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_EmptyParams, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for GERAN
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_Geran) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSSI;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 2;
+    signalThresholdInfo.thresholds = {-109, -103, -97, -89};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::GERAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_Geran, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for UTRAN
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_Utran) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSCP;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 2;
+    signalThresholdInfo.thresholds = {-110, -97, -73, -49, -25};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::UTRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_Utran, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for EUTRAN
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_Eutran_RSRP) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSRP;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 2;
+    signalThresholdInfo.thresholds = {-128, -108, -88, -68};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::EUTRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_Eutran, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for EUTRAN
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_Eutran_RSRQ) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSRQ;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 2;
+    signalThresholdInfo.thresholds = {-27, -20, -13, -6};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::EUTRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_Eutran, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for EUTRAN
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_Eutran_RSSNR) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSSNR;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 2;
+    signalThresholdInfo.thresholds = {-10, 0, 10, 20};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::EUTRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for CDMA2000
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_Cdma2000) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSSI;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 2;
+    signalThresholdInfo.thresholds = {-105, -90, -75, -65};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::CDMA2000;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_Cdma2000, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for NGRAN_SSRSRP
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_NGRAN_SSRSRP) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_SSRSRP;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 0;
+    signalThresholdInfo.thresholds = {-105, -90, -75, -65};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::NGRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_NGRAN_SSRSRP, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+
+    // Allow REQUEST_NOT_SUPPORTED because some non-5G device may not support NGRAN for
+    // setSignalStrengthReportingCriteria()
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for NGRAN_SSRSRQ
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_NGRAN_SSRSRQ) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_SSRSRQ;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 0;
+    signalThresholdInfo.thresholds = {-43, -20, 0, 20};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::NGRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_NGRAN_SSRSRQ, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+
+    // Allow REQUEST_NOT_SUPPORTED because some non-5G device may not support NGRAN for
+    // setSignalStrengthReportingCriteria()
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for EUTRAN
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_Disable_RSSNR) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_RSSNR;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 2;
+    signalThresholdInfo.thresholds = {-10, 0, 10, 20};
+    signalThresholdInfo.isEnabled = false;
+    signalThresholdInfo.ran = AccessNetwork::EUTRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+}
+
+/*
+ * Test IRadioNetwork.setSignalStrengthReportingCriteria() for NGRAN_SSSINR
+ */
+TEST_P(RadioNetworkTest, setSignalStrengthReportingCriteria_NGRAN_SSSINR) {
+    serial = GetRandomSerialNumber();
+
+    SignalThresholdInfo signalThresholdInfo;
+    signalThresholdInfo.signalMeasurement = SignalThresholdInfo::SIGNAL_MEASUREMENT_TYPE_SSSINR;
+    signalThresholdInfo.hysteresisMs = 5000;
+    signalThresholdInfo.hysteresisDb = 0;
+    signalThresholdInfo.thresholds = {-10, 3, 16, 18};
+    signalThresholdInfo.isEnabled = true;
+    signalThresholdInfo.ran = AccessNetwork::NGRAN;
+
+    ndk::ScopedAStatus res =
+            radio_network->setSignalStrengthReportingCriteria(serial, {signalThresholdInfo});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setSignalStrengthReportingCriteria_NGRAN_SSSINR, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+
+    // Allow REQUEST_NOT_SUPPORTED because some non-5G device may not support NGRAN for
+    // setSignalStrengthReportingCriteria()
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioNetwork.setLinkCapacityReportingCriteria() invalid hysteresisDlKbps
+ */
+TEST_P(RadioNetworkTest, setLinkCapacityReportingCriteria_invalidHysteresisDlKbps) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->setLinkCapacityReportingCriteria(
+            serial, 5000,
+            5000,  // hysteresisDlKbps too big for thresholds delta
+            100, {1000, 5000, 10000, 20000}, {500, 1000, 5000, 10000}, AccessNetwork::GERAN);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setLinkCapacityReportingCriteria_invalidHysteresisDlKbps, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    // Allow REQUEST_NOT_SUPPORTED as setLinkCapacityReportingCriteria() may not be supported
+    // for GERAN
+    ASSERT_TRUE(
+            CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                             {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioNetwork.setLinkCapacityReportingCriteria() invalid hysteresisUlKbps
+ */
+TEST_P(RadioNetworkTest, setLinkCapacityReportingCriteria_invalidHysteresisUlKbps) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->setLinkCapacityReportingCriteria(
+            serial, 5000, 500, 1000,  // hysteresisUlKbps too big for thresholds delta
+            {1000, 5000, 10000, 20000}, {500, 1000, 5000, 10000}, AccessNetwork::GERAN);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setLinkCapacityReportingCriteria_invalidHysteresisUlKbps, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    // Allow REQUEST_NOT_SUPPORTED as setLinkCapacityReportingCriteria() may not be supported
+    // for GERAN
+    ASSERT_TRUE(
+            CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                             {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioNetwork.setLinkCapacityReportingCriteria() empty params
+ */
+TEST_P(RadioNetworkTest, setLinkCapacityReportingCriteria_emptyParams) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->setLinkCapacityReportingCriteria(
+            serial, 0, 0, 0, {}, {}, AccessNetwork::GERAN);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setLinkCapacityReportingCriteria_emptyParams, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    // Allow REQUEST_NOT_SUPPORTED as setLinkCapacityReportingCriteria() may not be supported
+    // for GERAN
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioNetwork.setLinkCapacityReportingCriteria() for GERAN
+ */
+TEST_P(RadioNetworkTest, setLinkCapacityReportingCriteria_Geran) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->setLinkCapacityReportingCriteria(
+            serial, 5000, 500, 100, {1000, 5000, 10000, 20000}, {500, 1000, 5000, 10000},
+            AccessNetwork::GERAN);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setLinkCapacityReportingCriteria_Geran, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    // Allow REQUEST_NOT_SUPPORTED as setLinkCapacityReportingCriteria() may not be supported
+    // for GERAN
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/*
+ * Test IRadioNetwork.setSystemSelectionChannels() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setSystemSelectionChannels) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    ndk::ScopedAStatus res =
+            radio_network->setSystemSelectionChannels(serial, true, {specifierP900, specifier850});
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("setSystemSelectionChannels, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(
+            radioRsp_network->rspInfo.error,
+            {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INTERNAL_ERR}));
+
+    if (radioRsp_network->rspInfo.error == RadioError::NONE) {
+        serial = GetRandomSerialNumber();
+        ndk::ScopedAStatus res = radio_network->setSystemSelectionChannels(
+                serial, false, {specifierP900, specifier850});
+        ASSERT_OK(res);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+        EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+        ALOGI("setSystemSelectionChannels, rspInfo.error = %s\n",
+              toString(radioRsp_network->rspInfo.error).c_str());
+        EXPECT_EQ(RadioError::NONE, radioRsp_network->rspInfo.error);
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() for the response returned.
+ */
+TEST_P(RadioNetworkTest, startNetworkScan) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 60,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 60,
+                                  .incrementalResults = false,
+                                  .incrementalResultsPeriodicity = 1};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::SIM_ABSENT}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        // OPERATION_NOT_ALLOWED should not be allowed; however, some vendors do
+        // not support the required manual GSM search functionality. This is
+        // tracked in b/112206766. Modems have "GSM" rat scan need to
+        // support scanning requests combined with some parameters.
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::OPERATION_NOT_ALLOWED}));
+    }
+
+    if (radioRsp_network->rspInfo.error == RadioError::NONE) {
+        ALOGI("Stop Network Scan");
+        stopNetworkScan();
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with invalid specifier.
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_InvalidArgument) {
+    serial = GetRandomSerialNumber();
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT, .interval = 60};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_InvalidArgument, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::INVALID_ARGUMENTS}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with invalid interval (lower boundary).
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_InvalidInterval1) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 4,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 60,
+                                  .incrementalResults = false,
+                                  .incrementalResultsPeriodicity = 1};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_InvalidInterval1, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::INVALID_ARGUMENTS}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with invalid interval (upper boundary).
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_InvalidInterval2) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 301,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 60,
+                                  .incrementalResults = false,
+                                  .incrementalResultsPeriodicity = 1};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_InvalidInterval2, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::INVALID_ARGUMENTS}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with invalid max search time (lower boundary).
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_InvalidMaxSearchTime1) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 60,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 59,
+                                  .incrementalResults = false,
+                                  .incrementalResultsPeriodicity = 1};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_InvalidMaxSearchTime1, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::INVALID_ARGUMENTS}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with invalid max search time (upper boundary).
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_InvalidMaxSearchTime2) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 60,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 3601,
+                                  .incrementalResults = false,
+                                  .incrementalResultsPeriodicity = 1};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_InvalidMaxSearchTime2, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::INVALID_ARGUMENTS}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with invalid periodicity (lower boundary).
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_InvalidPeriodicity1) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 60,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 600,
+                                  .incrementalResults = true,
+                                  .incrementalResultsPeriodicity = 0};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_InvalidPeriodicity1, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::INVALID_ARGUMENTS}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with invalid periodicity (upper boundary).
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_InvalidPeriodicity2) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 60,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 600,
+                                  .incrementalResults = true,
+                                  .incrementalResultsPeriodicity = 11};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_InvalidPeriodicity2, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::SIM_ABSENT, RadioError::INVALID_ARGUMENTS}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with valid periodicity
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_GoodRequest1) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 60,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 360,
+                                  .incrementalResults = false,
+                                  .incrementalResultsPeriodicity = 10};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_GoodRequest1, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::SIM_ABSENT}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS,
+                                      RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+
+    if (radioRsp_network->rspInfo.error == RadioError::NONE) {
+        ALOGI("Stop Network Scan");
+        stopNetworkScan();
+    }
+}
+
+/*
+ * Test IRadioNetwork.startNetworkScan() with valid periodicity and plmns
+ */
+TEST_P(RadioNetworkTest, startNetworkScan_GoodRequest2) {
+    serial = GetRandomSerialNumber();
+
+    RadioAccessSpecifierBands bandP900 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_P900});
+    RadioAccessSpecifierBands band850 =
+            RadioAccessSpecifierBands::make<RadioAccessSpecifierBands::geranBands>(
+                    {GeranBands::BAND_850});
+    RadioAccessSpecifier specifierP900 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = bandP900, .channels = {1, 2}};
+    RadioAccessSpecifier specifier850 = {
+            .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
+
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+                                  .interval = 60,
+                                  .specifiers = {specifierP900, specifier850},
+                                  .maxSearchTime = 360,
+                                  .incrementalResults = false,
+                                  .incrementalResultsPeriodicity = 10,
+                                  .mccMncs = {"310410"}};
+
+    ndk::ScopedAStatus res = radio_network->startNetworkScan(serial, request);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("startNetworkScan_GoodRequest2, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::SIM_ABSENT}));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS,
+                                      RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+
+    if (radioRsp_network->rspInfo.error == RadioError::NONE) {
+        ALOGI("Stop Network Scan");
+        stopNetworkScan();
+    }
+}
+
+/*
+ * Test IRadioNetwork.setNetworkSelectionModeManual() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setNetworkSelectionModeManual) {
+    serial = GetRandomSerialNumber();
+
+    // can't camp on nonexistent MCCMNC, so we expect this to fail.
+    ndk::ScopedAStatus res =
+            radio_network->setNetworkSelectionModeManual(serial, "123456", AccessNetwork::GERAN);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::ILLEGAL_SIM_OR_ME,
+                                      RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE},
+                                     CHECK_GENERAL_ERROR));
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
+                                      RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE},
+                                     CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioNetwork.getBarringInfo() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getBarringInfo) {
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = radio_network->getBarringInfo(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ASSERT_TRUE(radioRsp_network->barringInfoList.size() > 0);
+
+    std::set<int> reportedServices;
+
+    // validate that the service types are in range
+    for (const auto& info : radioRsp_network->barringInfoList) {
+        ASSERT_TRUE((info.serviceType >= BarringInfo::SERVICE_TYPE_CS_SERVICE &&
+                     info.serviceType <= BarringInfo::SERVICE_TYPE_SMS) ||
+                    (info.serviceType >= BarringInfo::SERVICE_TYPE_OPERATOR_1 &&
+                     info.serviceType <= BarringInfo::SERVICE_TYPE_OPERATOR_32));
+        reportedServices.insert(info.serviceType);
+
+        // Any type that is "conditional" must have valid values for conditional barring
+        // factor and time.
+        switch (info.barringType) {
+            case BarringInfo::BARRING_TYPE_NONE:  // fall through
+            case BarringInfo::BARRING_TYPE_UNCONDITIONAL:
+                break;
+            case BarringInfo::BARRING_TYPE_CONDITIONAL: {
+                const int32_t barringFactor = info.barringTypeSpecificInfo->factor;
+                ASSERT_TRUE(barringFactor >= 0 && barringFactor <= 100);
+                ASSERT_TRUE(info.barringTypeSpecificInfo->timeSeconds > 0);
+                break;
+            }
+            default:
+                FAIL();
+        }
+    }
+
+    // Certain types of barring are relevant for certain RANs. Ensure that only the right
+    // types are reported. Note that no types are required, simply that for a given technology
+    // only certain types are valid. This is one way to check that implementations are
+    // not providing information that they don't have.
+    static const std::set<int> UTRA_SERVICES{
+            BarringInfo::SERVICE_TYPE_CS_SERVICE, BarringInfo::SERVICE_TYPE_PS_SERVICE,
+            BarringInfo::SERVICE_TYPE_CS_VOICE,   BarringInfo::SERVICE_TYPE_EMERGENCY,
+            BarringInfo::SERVICE_TYPE_SMS,
+    };
+
+    static const std::set<int> EUTRA_SERVICES{
+            BarringInfo::SERVICE_TYPE_MO_SIGNALLING, BarringInfo::SERVICE_TYPE_MO_DATA,
+            BarringInfo::SERVICE_TYPE_CS_FALLBACK,   BarringInfo::SERVICE_TYPE_MMTEL_VOICE,
+            BarringInfo::SERVICE_TYPE_MMTEL_VIDEO,   BarringInfo::SERVICE_TYPE_EMERGENCY,
+            BarringInfo::SERVICE_TYPE_SMS,
+    };
+
+    static const std::set<int> NGRA_SERVICES = {
+            BarringInfo::SERVICE_TYPE_MO_SIGNALLING, BarringInfo::SERVICE_TYPE_MO_DATA,
+            BarringInfo::SERVICE_TYPE_CS_FALLBACK,   BarringInfo::SERVICE_TYPE_MMTEL_VOICE,
+            BarringInfo::SERVICE_TYPE_MMTEL_VIDEO,   BarringInfo::SERVICE_TYPE_EMERGENCY,
+            BarringInfo::SERVICE_TYPE_SMS,           BarringInfo::SERVICE_TYPE_OPERATOR_1,
+            BarringInfo::SERVICE_TYPE_OPERATOR_2,    BarringInfo::SERVICE_TYPE_OPERATOR_3,
+            BarringInfo::SERVICE_TYPE_OPERATOR_4,    BarringInfo::SERVICE_TYPE_OPERATOR_5,
+            BarringInfo::SERVICE_TYPE_OPERATOR_6,    BarringInfo::SERVICE_TYPE_OPERATOR_7,
+            BarringInfo::SERVICE_TYPE_OPERATOR_8,    BarringInfo::SERVICE_TYPE_OPERATOR_9,
+            BarringInfo::SERVICE_TYPE_OPERATOR_10,   BarringInfo::SERVICE_TYPE_OPERATOR_11,
+            BarringInfo::SERVICE_TYPE_OPERATOR_12,   BarringInfo::SERVICE_TYPE_OPERATOR_13,
+            BarringInfo::SERVICE_TYPE_OPERATOR_14,   BarringInfo::SERVICE_TYPE_OPERATOR_15,
+            BarringInfo::SERVICE_TYPE_OPERATOR_16,   BarringInfo::SERVICE_TYPE_OPERATOR_17,
+            BarringInfo::SERVICE_TYPE_OPERATOR_18,   BarringInfo::SERVICE_TYPE_OPERATOR_19,
+            BarringInfo::SERVICE_TYPE_OPERATOR_20,   BarringInfo::SERVICE_TYPE_OPERATOR_21,
+            BarringInfo::SERVICE_TYPE_OPERATOR_22,   BarringInfo::SERVICE_TYPE_OPERATOR_23,
+            BarringInfo::SERVICE_TYPE_OPERATOR_24,   BarringInfo::SERVICE_TYPE_OPERATOR_25,
+            BarringInfo::SERVICE_TYPE_OPERATOR_26,   BarringInfo::SERVICE_TYPE_OPERATOR_27,
+            BarringInfo::SERVICE_TYPE_OPERATOR_28,   BarringInfo::SERVICE_TYPE_OPERATOR_29,
+            BarringInfo::SERVICE_TYPE_OPERATOR_30,   BarringInfo::SERVICE_TYPE_OPERATOR_31,
+    };
+
+    const std::set<int>* compareTo = nullptr;
+
+    switch (radioRsp_network->barringCellIdentity.getTag()) {
+        case CellIdentity::Tag::wcdma:
+            // fall through
+        case CellIdentity::Tag::tdscdma:
+            compareTo = &UTRA_SERVICES;
+            break;
+        case CellIdentity::Tag::lte:
+            compareTo = &EUTRA_SERVICES;
+            break;
+        case CellIdentity::Tag::nr:
+            compareTo = &NGRA_SERVICES;
+            break;
+        case CellIdentity::Tag::cdma:
+            // fall through
+        default:
+            FAIL();
+            break;
+    }
+
+    std::set<int> diff;
+
+    std::set_difference(reportedServices.begin(), reportedServices.end(), compareTo->begin(),
+                        compareTo->end(), std::inserter(diff, diff.begin()));
+}
+
+/*
+ * Test IRadioNetwork.getSignalStrength() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getSignalStrength) {
+    serial = GetRandomSerialNumber();
+
+    radio_network->getSignalStrength(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_network->rspInfo.error);
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.getCellInfoList() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getCellInfoList) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->getCellInfoList(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("getCellInfoList, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::NO_NETWORK_FOUND}));
+}
+
+/*
+ * Test IRadioNetwork.getVoiceRegistrationState() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getVoiceRegistrationState) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->getVoiceRegistrationState(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("getVoiceRegistrationStateResponse, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE}));
+}
+
+/*
+ * Test IRadioNetwork.getDataRegistrationState() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getDataRegistrationState) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->getDataRegistrationState(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("getDataRegistrationStateResponse, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(
+            radioRsp_network->rspInfo.error,
+            {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::NOT_PROVISIONED}));
+
+    // Check the mcc [0, 999] and mnc [0, 999].
+    std::string mcc;
+    std::string mnc;
+    bool checkMccMnc = true;
+    CellIdentity cellIdentity = radioRsp_network->dataRegResp.cellIdentity;
+    switch (cellIdentity.getTag()) {
+        case CellIdentity::noinit: {
+            checkMccMnc = false;
+            break;
+        }
+        case CellIdentity::gsm: {
+            CellIdentityGsm cig = cellIdentity.get<CellIdentity::gsm>();
+            mcc = cig.mcc;
+            mnc = cig.mnc;
+            break;
+        }
+        case CellIdentity::wcdma: {
+            CellIdentityWcdma ciw = cellIdentity.get<CellIdentity::wcdma>();
+            mcc = ciw.mcc;
+            mnc = ciw.mnc;
+            break;
+        }
+        case CellIdentity::tdscdma: {
+            CellIdentityTdscdma cit = cellIdentity.get<CellIdentity::tdscdma>();
+            mcc = cit.mcc;
+            mnc = cit.mnc;
+            break;
+        }
+        case CellIdentity::cdma: {
+            // CellIdentityCdma has no mcc/mnc
+            CellIdentityCdma cic = cellIdentity.get<CellIdentity::cdma>();
+            checkMccMnc = false;
+            break;
+        }
+        case CellIdentity::lte: {
+            CellIdentityLte cil = cellIdentity.get<CellIdentity::lte>();
+            mcc = cil.mcc;
+            mnc = cil.mnc;
+            break;
+        }
+        case CellIdentity::nr: {
+            CellIdentityNr cin = cellIdentity.get<CellIdentity::nr>();
+            mcc = cin.mcc;
+            mnc = cin.mnc;
+            break;
+        }
+    }
+
+    // 32 bit system might return invalid mcc and mnc string "\xff\xff..."
+    if (checkMccMnc && mcc.size() < 4 && mnc.size() < 4) {
+        int mcc_int = stoi(mcc);
+        int mnc_int = stoi(mnc);
+        EXPECT_TRUE(mcc_int >= 0 && mcc_int <= 999);
+        EXPECT_TRUE(mnc_int >= 0 && mnc_int <= 999);
+    }
+
+    // Check for access technology specific info
+    AccessTechnologySpecificInfo info = radioRsp_network->dataRegResp.accessTechnologySpecificInfo;
+    RadioTechnology rat = radioRsp_network->dataRegResp.rat;
+    // TODO: add logic for cdmaInfo
+    if (rat == RadioTechnology::LTE || rat == RadioTechnology::LTE_CA) {
+        ASSERT_EQ(info.getTag(), AccessTechnologySpecificInfo::eutranInfo);
+    } else if (rat == RadioTechnology::NR) {
+        ASSERT_EQ(info.getTag(), AccessTechnologySpecificInfo::ngranNrVopsInfo);
+    }
+}
+
+/*
+ * Test IRadioNetwork.getAvailableBandModes() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getAvailableBandModes) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res = radio_network->getAvailableBandModes(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ALOGI("getAvailableBandModes, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::MODEM_ERR, RadioError::INTERNAL_ERR,
+                                  // If REQUEST_NOT_SUPPORTED is returned, then it should also be
+                                  // returned for setBandMode().
+                                  RadioError::REQUEST_NOT_SUPPORTED}));
+    bool hasUnspecifiedBandMode = false;
+    if (radioRsp_network->rspInfo.error == RadioError::NONE) {
+        for (const RadioBandMode& mode : radioRsp_network->radioBandModes) {
+            // Automatic mode selection must be supported
+            if (mode == RadioBandMode::BAND_MODE_UNSPECIFIED) hasUnspecifiedBandMode = true;
+        }
+        ASSERT_TRUE(hasUnspecifiedBandMode);
+    }
+}
+
+/*
+ * Test IRadioNetwork.setIndicationFilter()
+ */
+TEST_P(RadioNetworkTest, setIndicationFilter) {
+    serial = GetRandomSerialNumber();
+
+    ndk::ScopedAStatus res =
+            radio_network->setIndicationFilter(serial, static_cast<int>(IndicationFilter::ALL));
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    ALOGI("setIndicationFilter, rspInfo.error = %s\n",
+          toString(radioRsp_network->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE}));
+}
+
+/*
+ * Test IRadioNetwork.setBarringPassword() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setBarringPassword) {
+    serial = GetRandomSerialNumber();
+    std::string facility = "";
+    std::string oldPassword = "";
+    std::string newPassword = "";
+
+    radio_network->setBarringPassword(serial, facility, oldPassword, newPassword);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::FDN_CHECK_FAILURE,
+                                      RadioError::INVALID_ARGUMENTS, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioNetwork.setSuppServiceNotifications() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setSuppServiceNotifications) {
+    serial = GetRandomSerialNumber();
+    bool enable = false;
+
+    radio_network->setSuppServiceNotifications(serial, enable);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::SIM_ABSENT}));
+    }
+}
+
+/*
+ * Test IRadioNetwork.getImsRegistrationState() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getImsRegistrationState) {
+    serial = GetRandomSerialNumber();
+
+    radio_network->getImsRegistrationState(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::NONE, RadioError::MODEM_ERR, RadioError::INVALID_MODEM_STATE},
+                CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioNetwork.getOperator() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getOperator) {
+    LOG(DEBUG) << "getOperator";
+    serial = GetRandomSerialNumber();
+
+    radio_network->getOperator(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_network->rspInfo.error);
+    }
+    LOG(DEBUG) << "getOperator finished";
+}
+
+/*
+ * Test IRadioNetwork.getNetworkSelectionMode() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getNetworkSelectionMode) {
+    LOG(DEBUG) << "getNetworkSelectionMode";
+    serial = GetRandomSerialNumber();
+
+    radio_network->getNetworkSelectionMode(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_network->rspInfo.error);
+    }
+    LOG(DEBUG) << "getNetworkSelectionMode finished";
+}
+
+/*
+ * Test IRadioNetwork.setNetworkSelectionModeAutomatic() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setNetworkSelectionModeAutomatic) {
+    LOG(DEBUG) << "setNetworkSelectionModeAutomatic";
+    serial = GetRandomSerialNumber();
+
+    radio_network->setNetworkSelectionModeAutomatic(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::ILLEGAL_SIM_OR_ME,
+                                      RadioError::OPERATION_NOT_ALLOWED},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setNetworkSelectionModeAutomatic finished";
+}
+
+/*
+ * Test IRadioNetwork.getAvailableNetworks() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getAvailableNetworks) {
+    LOG(DEBUG) << "getAvailableNetworks";
+    serial = GetRandomSerialNumber();
+
+    radio_network->getAvailableNetworks(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+    ASSERT_TRUE(radioRsp_network->rspInfo.type == RadioResponseType::SOLICITED ||
+                radioRsp_network->rspInfo.type == RadioResponseType::SOLICITED_ACK_EXP);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::NONE, RadioError::CANCELLED, RadioError::DEVICE_IN_USE,
+                 RadioError::MODEM_ERR, RadioError::OPERATION_NOT_ALLOWED},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getAvailableNetworks finished";
+}
+
+/*
+ * Test IRadioNetwork.setBandMode() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setBandMode) {
+    LOG(DEBUG) << "setBandMode";
+    serial = GetRandomSerialNumber();
+
+    radio_network->setBandMode(serial, RadioBandMode::BAND_MODE_USA);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setBandMode finished";
+}
+
+/*
+ * Test IRadioNetwork.setLocationUpdates() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setLocationUpdates) {
+    LOG(DEBUG) << "setLocationUpdates";
+    serial = GetRandomSerialNumber();
+
+    radio_network->setLocationUpdates(serial, true);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::SIM_ABSENT}));
+    }
+    LOG(DEBUG) << "setLocationUpdates finished";
+}
+
+/*
+ * Test IRadioNetwork.setCdmaRoamingPreference() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setCdmaRoamingPreference) {
+    LOG(DEBUG) << "setCdmaRoamingPreference";
+    serial = GetRandomSerialNumber();
+
+    radio_network->setCdmaRoamingPreference(serial, CdmaRoamingType::HOME_NETWORK);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::NONE, RadioError::SIM_ABSENT, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "setCdmaRoamingPreference finished";
+}
+
+/*
+ * Test IRadioNetwork.getCdmaRoamingPreference() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getCdmaRoamingPreference) {
+    LOG(DEBUG) << "getCdmaRoamingPreference";
+    serial = GetRandomSerialNumber();
+
+    radio_network->getCdmaRoamingPreference(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(
+                CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                 {RadioError::NONE, RadioError::SIM_ABSENT, RadioError::MODEM_ERR},
+                                 CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getCdmaRoamingPreference finished";
+}
+
+/*
+ * Test IRadioNetwork.getVoiceRadioTechnology() for the response returned.
+ */
+TEST_P(RadioNetworkTest, getVoiceRadioTechnology) {
+    LOG(DEBUG) << "getVoiceRadioTechnology";
+    serial = GetRandomSerialNumber();
+
+    radio_network->getVoiceRadioTechnology(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_network->rspInfo.error);
+    }
+    LOG(DEBUG) << "getVoiceRadioTechnology finished";
+}
+
+/*
+ * Test IRadioNetwork.setCellInfoListRate() for the response returned.
+ */
+TEST_P(RadioNetworkTest, setCellInfoListRate) {
+    LOG(DEBUG) << "setCellInfoListRate";
+    serial = GetRandomSerialNumber();
+
+    radio_network->setCellInfoListRate(serial, 10);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
+                                     {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "setCellInfoListRate finished";
+}
+
+/*
+ * Test IRadioNetwork.supplyNetworkDepersonalization() for the response returned.
+ */
+TEST_P(RadioNetworkTest, supplyNetworkDepersonalization) {
+    LOG(DEBUG) << "supplyNetworkDepersonalization";
+    serial = GetRandomSerialNumber();
+
+    radio_network->supplyNetworkDepersonalization(serial, std::string("test"));
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_network->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::INTERNAL_ERR,
+                 RadioError::INVALID_SIM_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+                 RadioError::PASSWORD_INCORRECT, RadioError::SIM_ABSENT, RadioError::SYSTEM_ERR}));
+    }
+    LOG(DEBUG) << "supplyNetworkDepersonalization finished";
+}
\ No newline at end of file
diff --git a/radio/aidl/vts/radio_network_utils.h b/radio/aidl/vts/radio_network_utils.h
index 9f76769..29ba2f2 100644
--- a/radio/aidl/vts/radio_network_utils.h
+++ b/radio/aidl/vts/radio_network_utils.h
@@ -41,8 +41,9 @@
     bool isNrDualConnectivityEnabled;
     int networkTypeBitmapResponse;
     RegStateResult voiceRegResp;
+    RegStateResult dataRegResp;
     CellIdentity barringCellIdentity;
-    std::vector<BarringInfo> barringInfos;
+    std::vector<BarringInfo> barringInfoList;
     UsageSetting usageSetting;
 
     virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
@@ -218,4 +219,6 @@
 
     // Helper function to reduce copy+paste
     void testSetUsageSetting_InvalidValues(std::vector<RadioError> errors);
+
+    void stopNetworkScan();
 };
diff --git a/radio/aidl/vts/radio_sim_response.cpp b/radio/aidl/vts/radio_sim_response.cpp
index a783f43..391c9cb 100644
--- a/radio/aidl/vts/radio_sim_response.cpp
+++ b/radio/aidl/vts/radio_sim_response.cpp
@@ -23,44 +23,62 @@
 }
 
 ndk::ScopedAStatus RadioSimResponse::areUiccApplicationsEnabledResponse(
-        const RadioResponseInfo& /*info*/, bool /*enabled*/) {
+        const RadioResponseInfo& info, bool enabled) {
+    rspInfo = info;
+    areUiccApplicationsEnabled = enabled;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::changeIccPin2ForAppResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::changeIccPin2ForAppResponse(const RadioResponseInfo& info,
                                                                  int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::changeIccPinForAppResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::changeIccPinForAppResponse(const RadioResponseInfo& info,
                                                                 int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::enableUiccApplicationsResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioSimResponse::enableUiccApplicationsResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::getAllowedCarriersResponse(
-        const RadioResponseInfo& /*info*/, const CarrierRestrictions& /*carriers*/,
-        SimLockMultiSimPolicy /*multiSimPolicy*/) {
+        const RadioResponseInfo& info, const CarrierRestrictions& carriers,
+        SimLockMultiSimPolicy multiSimPolicy) {
+    rspInfo = info;
+    carrierRestrictionsResp = carriers;
+    multiSimPolicyResp = multiSimPolicy;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::getCdmaSubscriptionResponse(
-        const RadioResponseInfo& /*info*/, const std::string& /*mdn*/, const std::string& /*hSid*/,
+        const RadioResponseInfo& info, const std::string& /*mdn*/, const std::string& /*hSid*/,
         const std::string& /*hNid*/, const std::string& /*min*/, const std::string& /*prl*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::getCdmaSubscriptionSourceResponse(
-        const RadioResponseInfo& /*info*/, CdmaSubscriptionSource /*source*/) {
+        const RadioResponseInfo& info, CdmaSubscriptionSource /*source*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::getFacilityLockForAppResponse(
-        const RadioResponseInfo& /*info*/, int32_t /*response*/) {
+ndk::ScopedAStatus RadioSimResponse::getFacilityLockForAppResponse(const RadioResponseInfo& info,
+                                                                   int32_t /*response*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -72,8 +90,11 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::getImsiForAppResponse(const RadioResponseInfo& /*info*/,
-                                                           const std::string& /*imsi*/) {
+ndk::ScopedAStatus RadioSimResponse::getImsiForAppResponse(const RadioResponseInfo& info,
+                                                           const std::string& imsi_str) {
+    rspInfo = info;
+    imsi = imsi_str;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -91,58 +112,79 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::iccCloseLogicalChannelResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioSimResponse::iccCloseLogicalChannelResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::iccIoForAppResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::iccIoForAppResponse(const RadioResponseInfo& info,
                                                          const IccIoResult& /*iccIo*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::iccOpenLogicalChannelResponse(
-        const RadioResponseInfo& /*info*/, int32_t /*channelId*/,
+        const RadioResponseInfo& info, int32_t /*channelId*/,
         const std::vector<uint8_t>& /*selectResponse*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::iccTransmitApduBasicChannelResponse(
-        const RadioResponseInfo& /*info*/, const IccIoResult& /*result*/) {
+        const RadioResponseInfo& info, const IccIoResult& /*result*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::iccTransmitApduLogicalChannelResponse(
-        const RadioResponseInfo& /*info*/, const IccIoResult& /*result*/) {
+        const RadioResponseInfo& info, const IccIoResult& /*result*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::reportStkServiceIsRunningResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::requestIccSimAuthenticationResponse(
-        const RadioResponseInfo& /*info*/, const IccIoResult& /*result*/) {
+        const RadioResponseInfo& info, const IccIoResult& /*result*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::sendEnvelopeResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::sendEnvelopeResponse(const RadioResponseInfo& info,
                                                           const std::string& /*commandResponse*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::sendEnvelopeWithStatusResponse(
-        const RadioResponseInfo& /*info*/, const IccIoResult& /*iccIo*/) {
+ndk::ScopedAStatus RadioSimResponse::sendEnvelopeWithStatusResponse(const RadioResponseInfo& info,
+                                                                    const IccIoResult& /*iccIo*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::sendTerminalResponseToSimResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::setAllowedCarriersResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioSimResponse::setAllowedCarriersResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -154,12 +196,16 @@
 }
 
 ndk::ScopedAStatus RadioSimResponse::setCdmaSubscriptionSourceResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::setFacilityLockForAppResponse(
-        const RadioResponseInfo& /*info*/, int32_t /*retry*/) {
+ndk::ScopedAStatus RadioSimResponse::setFacilityLockForAppResponse(const RadioResponseInfo& info,
+                                                                   int32_t /*retry*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -169,34 +215,44 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::setUiccSubscriptionResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioSimResponse::setUiccSubscriptionResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::supplyIccPin2ForAppResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::supplyIccPin2ForAppResponse(const RadioResponseInfo& info,
                                                                  int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::supplyIccPinForAppResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::supplyIccPinForAppResponse(const RadioResponseInfo& info,
                                                                 int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::supplyIccPuk2ForAppResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::supplyIccPuk2ForAppResponse(const RadioResponseInfo& info,
                                                                  int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioSimResponse::supplyIccPukForAppResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioSimResponse::supplyIccPukForAppResponse(const RadioResponseInfo& info,
                                                                 int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioSimResponse::supplySimDepersonalizationResponse(
-        const RadioResponseInfo& /*info*/, PersoSubstate /*persoType*/,
-        int32_t /*remainingRetries*/) {
+        const RadioResponseInfo& info, PersoSubstate /*persoType*/, int32_t /*remainingRetries*/) {
+    rspInfo = info;
+    parent_sim.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
diff --git a/radio/aidl/vts/radio_sim_test.cpp b/radio/aidl/vts/radio_sim_test.cpp
index 5db77f6..64474c9 100644
--- a/radio/aidl/vts/radio_sim_test.cpp
+++ b/radio/aidl/vts/radio_sim_test.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <aidl/android/hardware/radio/RadioConst.h>
 #include <aidl/android/hardware/radio/config/IRadioConfig.h>
 #include <android-base/logging.h>
 #include <android/binder_manager.h>
@@ -260,3 +261,764 @@
         }
     }
 }
+
+/*
+ * Test IRadioSim.enableUiccApplications() for the response returned.
+ * For SIM ABSENT case.
+ */
+TEST_P(RadioSimTest, togglingUiccApplicationsSimAbsent) {
+    // This test case only test SIM ABSENT case.
+    if (cardStatus.cardState != CardStatus::STATE_ABSENT) return;
+
+    // Disable Uicc applications.
+    serial = GetRandomSerialNumber();
+    radio_sim->enableUiccApplications(serial, false);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    // As SIM is absent, RadioError::SIM_ABSENT should be thrown.
+    EXPECT_EQ(RadioError::SIM_ABSENT, radioRsp_sim->rspInfo.error);
+
+    // Query Uicc application enablement.
+    serial = GetRandomSerialNumber();
+    radio_sim->areUiccApplicationsEnabled(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    // As SIM is absent, RadioError::SIM_ABSENT should be thrown.
+    EXPECT_EQ(RadioError::SIM_ABSENT, radioRsp_sim->rspInfo.error);
+}
+
+/*
+ * Test IRadioSim.enableUiccApplications() for the response returned.
+ * For SIM PRESENT case.
+ */
+TEST_P(RadioSimTest, togglingUiccApplicationsSimPresent) {
+    // This test case only test SIM ABSENT case.
+    if (cardStatus.cardState != CardStatus::STATE_PRESENT) return;
+    if (cardStatus.applications.size() == 0) return;
+
+    // Disable Uicc applications.
+    serial = GetRandomSerialNumber();
+    radio_sim->enableUiccApplications(serial, false);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    // As SIM is present, there shouldn't be error.
+    EXPECT_EQ(RadioError::NONE, radioRsp_sim->rspInfo.error);
+
+    // Query Uicc application enablement.
+    serial = GetRandomSerialNumber();
+    radio_sim->areUiccApplicationsEnabled(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    // As SIM is present, there shouldn't be error.
+    EXPECT_EQ(RadioError::NONE, radioRsp_sim->rspInfo.error);
+    ASSERT_FALSE(radioRsp_sim->areUiccApplicationsEnabled);
+
+    // Enable Uicc applications.
+    serial = GetRandomSerialNumber();
+    radio_sim->enableUiccApplications(serial, true);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    // As SIM is present, there shouldn't be error.
+    EXPECT_EQ(RadioError::NONE, radioRsp_sim->rspInfo.error);
+
+    // Query Uicc application enablement.
+    serial = GetRandomSerialNumber();
+    radio_sim->areUiccApplicationsEnabled(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    // As SIM is present, there shouldn't be error.
+    EXPECT_EQ(RadioError::NONE, radioRsp_sim->rspInfo.error);
+    ASSERT_TRUE(radioRsp_sim->areUiccApplicationsEnabled);
+}
+
+/*
+ * Test IRadioSim.areUiccApplicationsEnabled() for the response returned.
+ */
+TEST_P(RadioSimTest, areUiccApplicationsEnabled) {
+    // Disable Uicc applications.
+    serial = GetRandomSerialNumber();
+    radio_sim->areUiccApplicationsEnabled(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    // If SIM is absent, RadioError::SIM_ABSENT should be thrown. Otherwise there shouldn't be any
+    // error.
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::SIM_ABSENT, radioRsp_sim->rspInfo.error);
+    } else if (cardStatus.cardState == CardStatus::STATE_PRESENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_sim->rspInfo.error);
+    }
+}
+
+/*
+ * Test IRadioSim.getAllowedCarriers() for the response returned.
+ */
+TEST_P(RadioSimTest, getAllowedCarriers) {
+    serial = GetRandomSerialNumber();
+
+    radio_sim->getAllowedCarriers(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                 {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+}
+
+/**
+ * Test IRadioSim.setAllowedCarriers() for the response returned.
+ */
+TEST_P(RadioSimTest, setAllowedCarriers) {
+    // TODO (b/210712359): remove once shim supports 1.4 or alternative is found
+    GTEST_SKIP();
+    serial = GetRandomSerialNumber();
+    CarrierRestrictions carrierRestrictions;
+    memset(&carrierRestrictions, 0, sizeof(carrierRestrictions));
+    carrierRestrictions.allowedCarriers.resize(1);
+    carrierRestrictions.excludedCarriers.resize(0);
+    carrierRestrictions.allowedCarriers[0].mcc = std::string("123");
+    carrierRestrictions.allowedCarriers[0].mnc = std::string("456");
+    carrierRestrictions.allowedCarriers[0].matchType = Carrier::MATCH_TYPE_ALL;
+    carrierRestrictions.allowedCarriers[0].matchData = std::string();
+    carrierRestrictions.allowedCarriersPrioritized = true;
+    SimLockMultiSimPolicy multisimPolicy = SimLockMultiSimPolicy::NO_MULTISIM_POLICY;
+
+    radio_sim->setAllowedCarriers(serial, carrierRestrictions, multisimPolicy);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                 {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+
+    if (radioRsp_sim->rspInfo.error == RadioError::NONE) {
+        /* Verify the update of the SIM status. This might need some time */
+        if (cardStatus.cardState != CardStatus::STATE_ABSENT) {
+            updateSimCardStatus();
+            auto startTime = std::chrono::system_clock::now();
+            while (cardStatus.cardState != CardStatus::STATE_RESTRICTED &&
+                   std::chrono::duration_cast<std::chrono::seconds>(
+                           std::chrono::system_clock::now() - startTime)
+                                   .count() < 30) {
+                /* Set 2 seconds as interval to check card status */
+                sleep(2);
+                updateSimCardStatus();
+            }
+            EXPECT_EQ(CardStatus::STATE_RESTRICTED, cardStatus.cardState);
+        }
+
+        /* Verify that configuration was set correctly, retrieving it from the modem */
+        serial = GetRandomSerialNumber();
+
+        radio_sim->getAllowedCarriers(serial);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+        EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+        EXPECT_EQ(RadioError::NONE, radioRsp_sim->rspInfo.error);
+
+        EXPECT_EQ(1, radioRsp_sim->carrierRestrictionsResp.allowedCarriers.size());
+        EXPECT_EQ(0, radioRsp_sim->carrierRestrictionsResp.excludedCarriers.size());
+        ASSERT_TRUE(std::string("123") ==
+                    radioRsp_sim->carrierRestrictionsResp.allowedCarriers[0].mcc);
+        ASSERT_TRUE(std::string("456") ==
+                    radioRsp_sim->carrierRestrictionsResp.allowedCarriers[0].mnc);
+        EXPECT_EQ(Carrier::MATCH_TYPE_ALL,
+                  radioRsp_sim->carrierRestrictionsResp.allowedCarriers[0].matchType);
+        ASSERT_TRUE(radioRsp_sim->carrierRestrictionsResp.allowedCarriersPrioritized);
+        EXPECT_EQ(SimLockMultiSimPolicy::NO_MULTISIM_POLICY, radioRsp_sim->multiSimPolicyResp);
+
+        sleep(10);
+
+        /**
+         * Another test case of the API to cover to allow carrier.
+         * If the API is supported, this is also used to reset to no carrier restriction
+         * status for cardStatus.
+         */
+        memset(&carrierRestrictions, 0, sizeof(carrierRestrictions));
+        carrierRestrictions.allowedCarriers.resize(0);
+        carrierRestrictions.excludedCarriers.resize(0);
+        carrierRestrictions.allowedCarriersPrioritized = false;
+
+        serial = GetRandomSerialNumber();
+        radio_sim->setAllowedCarriers(serial, carrierRestrictions, multisimPolicy);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+        EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+        EXPECT_EQ(RadioError::NONE, radioRsp_sim->rspInfo.error);
+
+        if (cardStatus.cardState != CardStatus::STATE_ABSENT) {
+            /* Resetting back to no carrier restriction needs some time */
+            updateSimCardStatus();
+            auto startTime = std::chrono::system_clock::now();
+            while (cardStatus.cardState == CardStatus::STATE_RESTRICTED &&
+                   std::chrono::duration_cast<std::chrono::seconds>(
+                           std::chrono::system_clock::now() - startTime)
+                                   .count() < 10) {
+                /* Set 2 seconds as interval to check card status */
+                sleep(2);
+                updateSimCardStatus();
+            }
+            EXPECT_NE(CardStatus::STATE_RESTRICTED, cardStatus.cardState);
+            sleep(10);
+        }
+    }
+}
+
+/*
+ * Test IRadioSim.getIccCardStatus() for the response returned.
+ */
+TEST_P(RadioSimTest, getIccCardStatus) {
+    LOG(DEBUG) << "getIccCardStatus";
+    EXPECT_LE(cardStatus.applications.size(), RadioConst::CARD_MAX_APPS);
+    EXPECT_LT(cardStatus.gsmUmtsSubscriptionAppIndex, RadioConst::CARD_MAX_APPS);
+    EXPECT_LT(cardStatus.cdmaSubscriptionAppIndex, RadioConst::CARD_MAX_APPS);
+    EXPECT_LT(cardStatus.imsSubscriptionAppIndex, RadioConst::CARD_MAX_APPS);
+    LOG(DEBUG) << "getIccCardStatus finished";
+}
+
+/*
+ * Test IRadioSim.supplyIccPinForApp() for the response returned
+ */
+TEST_P(RadioSimTest, supplyIccPinForApp) {
+    LOG(DEBUG) << "supplyIccPinForApp";
+    serial = GetRandomSerialNumber();
+
+    // Pass wrong password and check PASSWORD_INCORRECT returned for 3GPP and
+    // 3GPP2 apps only
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        if (cardStatus.applications[i].appType == AppStatus::APP_TYPE_SIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_USIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_RUIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_CSIM) {
+            radio_sim->supplyIccPinForApp(serial, std::string("test1"),
+                                          cardStatus.applications[i].aidPtr);
+            EXPECT_EQ(std::cv_status::no_timeout, wait());
+            EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+            EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+            ASSERT_TRUE(CheckAnyOfErrors(
+                    radioRsp_sim->rspInfo.error,
+                    {RadioError::PASSWORD_INCORRECT, RadioError::REQUEST_NOT_SUPPORTED}));
+        }
+    }
+    LOG(DEBUG) << "supplyIccPinForApp finished";
+}
+
+/*
+ * Test IRadioSim.supplyIccPukForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, supplyIccPukForApp) {
+    LOG(DEBUG) << "supplyIccPukForApp";
+    serial = GetRandomSerialNumber();
+
+    // Pass wrong password and check PASSWORD_INCORRECT returned for 3GPP and
+    // 3GPP2 apps only
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        if (cardStatus.applications[i].appType == AppStatus::APP_TYPE_SIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_USIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_RUIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_CSIM) {
+            radio_sim->supplyIccPukForApp(serial, std::string("test1"), std::string("test2"),
+                                          cardStatus.applications[i].aidPtr);
+            EXPECT_EQ(std::cv_status::no_timeout, wait());
+            EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+            EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+            ASSERT_TRUE(CheckAnyOfErrors(
+                    radioRsp_sim->rspInfo.error,
+                    {RadioError::PASSWORD_INCORRECT, RadioError::INVALID_SIM_STATE}));
+        }
+    }
+    LOG(DEBUG) << "supplyIccPukForApp finished";
+}
+
+/*
+ * Test IRadioSim.supplyIccPin2ForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, supplyIccPin2ForApp) {
+    LOG(DEBUG) << "supplyIccPin2ForApp";
+    serial = GetRandomSerialNumber();
+
+    // Pass wrong password and check PASSWORD_INCORRECT returned for 3GPP and
+    // 3GPP2 apps only
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        if (cardStatus.applications[i].appType == AppStatus::APP_TYPE_SIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_USIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_RUIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_CSIM) {
+            radio_sim->supplyIccPin2ForApp(serial, std::string("test1"),
+                                           cardStatus.applications[i].aidPtr);
+            EXPECT_EQ(std::cv_status::no_timeout, wait());
+            EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+            EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+            ASSERT_TRUE(
+                    CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                     {RadioError::PASSWORD_INCORRECT,
+                                      RadioError::REQUEST_NOT_SUPPORTED, RadioError::SIM_PUK2}));
+        }
+    }
+    LOG(DEBUG) << "supplyIccPin2ForApp finished";
+}
+
+/*
+ * Test IRadioSim.supplyIccPuk2ForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, supplyIccPuk2ForApp) {
+    LOG(DEBUG) << "supplyIccPuk2ForApp";
+    serial = GetRandomSerialNumber();
+
+    // Pass wrong password and check PASSWORD_INCORRECT returned for 3GPP and
+    // 3GPP2 apps only
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        if (cardStatus.applications[i].appType == AppStatus::APP_TYPE_SIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_USIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_RUIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_CSIM) {
+            radio_sim->supplyIccPuk2ForApp(serial, std::string("test1"), std::string("test2"),
+                                           cardStatus.applications[i].aidPtr);
+            EXPECT_EQ(std::cv_status::no_timeout, wait());
+            EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+            EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+            ASSERT_TRUE(CheckAnyOfErrors(
+                    radioRsp_sim->rspInfo.error,
+                    {RadioError::PASSWORD_INCORRECT, RadioError::INVALID_SIM_STATE}));
+        }
+    }
+    LOG(DEBUG) << "supplyIccPuk2ForApp finished";
+}
+
+/*
+ * Test IRadioSim.changeIccPinForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, changeIccPinForApp) {
+    LOG(DEBUG) << "changeIccPinForApp";
+    serial = GetRandomSerialNumber();
+
+    // Pass wrong password and check PASSWORD_INCORRECT returned for 3GPP and
+    // 3GPP2 apps only
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        if (cardStatus.applications[i].appType == AppStatus::APP_TYPE_SIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_USIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_RUIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_CSIM) {
+            radio_sim->changeIccPinForApp(serial, std::string("test1"), std::string("test2"),
+                                          cardStatus.applications[i].aidPtr);
+            EXPECT_EQ(std::cv_status::no_timeout, wait());
+            EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+            EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+            ASSERT_TRUE(CheckAnyOfErrors(
+                    radioRsp_sim->rspInfo.error,
+                    {RadioError::PASSWORD_INCORRECT, RadioError::REQUEST_NOT_SUPPORTED}));
+        }
+    }
+    LOG(DEBUG) << "changeIccPinForApp finished";
+}
+
+/*
+ * Test IRadioSim.changeIccPin2ForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, changeIccPin2ForApp) {
+    LOG(DEBUG) << "changeIccPin2ForApp";
+    serial = GetRandomSerialNumber();
+
+    // Pass wrong password and check PASSWORD_INCORRECT returned for 3GPP and
+    // 3GPP2 apps only
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        if (cardStatus.applications[i].appType == AppStatus::APP_TYPE_SIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_USIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_RUIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_CSIM) {
+            radio_sim->changeIccPin2ForApp(serial, std::string("test1"), std::string("test2"),
+                                           cardStatus.applications[i].aidPtr);
+            EXPECT_EQ(std::cv_status::no_timeout, wait());
+            EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+            EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+            ASSERT_TRUE(
+                    CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                     {RadioError::PASSWORD_INCORRECT,
+                                      RadioError::REQUEST_NOT_SUPPORTED, RadioError::SIM_PUK2}));
+        }
+    }
+    LOG(DEBUG) << "changeIccPin2ForApp finished";
+}
+
+/*
+ * Test IRadioSim.getImsiForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, getImsiForApp) {
+    LOG(DEBUG) << "getImsiForApp";
+    serial = GetRandomSerialNumber();
+
+    // Check success returned while getting imsi for 3GPP and 3GPP2 apps only
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        if (cardStatus.applications[i].appType == AppStatus::APP_TYPE_SIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_USIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_RUIM ||
+            cardStatus.applications[i].appType == AppStatus::APP_TYPE_CSIM) {
+            radio_sim->getImsiForApp(serial, cardStatus.applications[i].aidPtr);
+            EXPECT_EQ(std::cv_status::no_timeout, wait());
+            EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+            EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+            ASSERT_TRUE(CheckAnyOfErrors(radioRsp_sim->rspInfo.error, {RadioError::NONE},
+                                         CHECK_GENERAL_ERROR));
+
+            // IMSI (MCC+MNC+MSIN) is at least 6 digits, but not more than 15
+            if (radioRsp_sim->rspInfo.error == RadioError::NONE) {
+                EXPECT_NE(radioRsp_sim->imsi, std::string());
+                EXPECT_GE((int)(radioRsp_sim->imsi).size(), 6);
+                EXPECT_LE((int)(radioRsp_sim->imsi).size(), 15);
+            }
+        }
+    }
+    LOG(DEBUG) << "getImsiForApp finished";
+}
+
+/*
+ * Test IRadioSim.iccIoForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, iccIoForApp) {
+    LOG(DEBUG) << "iccIoForApp";
+    serial = GetRandomSerialNumber();
+
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        IccIo iccIo;
+        iccIo.command = 0xc0;
+        iccIo.fileId = 0x6f11;
+        iccIo.path = std::string("3F007FFF");
+        iccIo.p1 = 0;
+        iccIo.p2 = 0;
+        iccIo.p3 = 0;
+        iccIo.data = std::string();
+        iccIo.pin2 = std::string();
+        iccIo.aid = cardStatus.applications[i].aidPtr;
+
+        radio_sim->iccIoForApp(serial, iccIo);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+        EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    }
+    LOG(DEBUG) << "iccIoForApp finished";
+}
+
+/*
+ * Test IRadioSim.iccTransmitApduBasicChannel() for the response returned.
+ */
+TEST_P(RadioSimTest, iccTransmitApduBasicChannel) {
+    LOG(DEBUG) << "iccTransmitApduBasicChannel";
+    serial = GetRandomSerialNumber();
+    SimApdu msg;
+    memset(&msg, 0, sizeof(msg));
+    msg.data = std::string();
+
+    radio_sim->iccTransmitApduBasicChannel(serial, msg);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    LOG(DEBUG) << "iccTransmitApduBasicChannel finished";
+}
+
+/*
+ * Test IRadioSim.iccOpenLogicalChannel() for the response returned.
+ */
+TEST_P(RadioSimTest, iccOpenLogicalChannel) {
+    LOG(DEBUG) << "iccOpenLogicalChannel";
+    serial = GetRandomSerialNumber();
+    int p2 = 0x04;
+    // Specified in ISO 7816-4 clause 7.1.1 0x04 means that FCP template is requested.
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        radio_sim->iccOpenLogicalChannel(serial, cardStatus.applications[i].aidPtr, p2);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    }
+    LOG(DEBUG) << "iccOpenLogicalChannel finished";
+}
+
+/*
+ * Test IRadioSim.iccCloseLogicalChannel() for the response returned.
+ */
+TEST_P(RadioSimTest, iccCloseLogicalChannel) {
+    LOG(DEBUG) << "iccCloseLogicalChannel";
+    serial = GetRandomSerialNumber();
+    // Try closing invalid channel and check INVALID_ARGUMENTS returned as error
+    radio_sim->iccCloseLogicalChannel(serial, 0);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    EXPECT_EQ(RadioError::INVALID_ARGUMENTS, radioRsp_sim->rspInfo.error);
+    LOG(DEBUG) << "iccCloseLogicalChannel finished";
+}
+
+/*
+ * Test IRadioSim.iccTransmitApduLogicalChannel() for the response returned.
+ */
+TEST_P(RadioSimTest, iccTransmitApduLogicalChannel) {
+    LOG(DEBUG) << "iccTransmitApduLogicalChannel";
+    serial = GetRandomSerialNumber();
+    SimApdu msg;
+    memset(&msg, 0, sizeof(msg));
+    msg.data = std::string();
+
+    radio_sim->iccTransmitApduLogicalChannel(serial, msg);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+    LOG(DEBUG) << "iccTransmitApduLogicalChannel finished";
+}
+
+/*
+ * Test IRadioSim.requestIccSimAuthentication() for the response returned.
+ */
+TEST_P(RadioSimTest, requestIccSimAuthentication) {
+    LOG(DEBUG) << "requestIccSimAuthentication";
+    serial = GetRandomSerialNumber();
+
+    // Pass wrong challenge string and check RadioError::INVALID_ARGUMENTS
+    // or REQUEST_NOT_SUPPORTED returned as error.
+    for (int i = 0; i < (int)cardStatus.applications.size(); i++) {
+        radio_sim->requestIccSimAuthentication(serial, 0, std::string("test"),
+                                               cardStatus.applications[i].aidPtr);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_sim->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "requestIccSimAuthentication finished";
+}
+
+/*
+ * Test IRadioSim.getFacilityLockForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, getFacilityLockForApp) {
+    serial = GetRandomSerialNumber();
+    std::string facility = "";
+    std::string password = "";
+    int32_t serviceClass = 1;
+    std::string appId = "";
+
+    radio_sim->getFacilityLockForApp(serial, facility, password, serviceClass, appId);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioSim.setFacilityLockForApp() for the response returned.
+ */
+TEST_P(RadioSimTest, setFacilityLockForApp) {
+    serial = GetRandomSerialNumber();
+    std::string facility = "";
+    bool lockState = false;
+    std::string password = "";
+    int32_t serviceClass = 1;
+    std::string appId = "";
+
+    radio_sim->setFacilityLockForApp(serial, facility, lockState, password, serviceClass, appId);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioSim.getCdmaSubscription() for the response returned.
+ */
+TEST_P(RadioSimTest, getCdmaSubscription) {
+    LOG(DEBUG) << "getCdmaSubscription";
+    serial = GetRandomSerialNumber();
+
+    radio_sim->getCdmaSubscription(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_sim->rspInfo.error,
+                {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED, RadioError::SIM_ABSENT}));
+    }
+    LOG(DEBUG) << "getCdmaSubscription finished";
+}
+
+/*
+ * Test IRadioSim.getCdmaSubscriptionSource() for the response returned.
+ */
+TEST_P(RadioSimTest, getCdmaSubscriptionSource) {
+    LOG(DEBUG) << "getCdmaSubscriptionSource";
+    serial = GetRandomSerialNumber();
+
+    radio_sim->getCdmaSubscriptionSource(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_sim->rspInfo.error,
+                {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED, RadioError::SIM_ABSENT}));
+    }
+    LOG(DEBUG) << "getCdmaSubscriptionSource finished";
+}
+
+/*
+ * Test IRadioSim.setCdmaSubscriptionSource() for the response returned.
+ */
+TEST_P(RadioSimTest, setCdmaSubscriptionSource) {
+    LOG(DEBUG) << "setCdmaSubscriptionSource";
+    serial = GetRandomSerialNumber();
+
+    radio_sim->setCdmaSubscriptionSource(serial, CdmaSubscriptionSource::RUIM_SIM);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_sim->rspInfo.error,
+                {RadioError::NONE, RadioError::SIM_ABSENT, RadioError::SUBSCRIPTION_NOT_AVAILABLE},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setCdmaSubscriptionSource finished";
+}
+
+/*
+ * Test IRadioSim.setUiccSubscription() for the response returned.
+ */
+TEST_P(RadioSimTest, setUiccSubscription) {
+    LOG(DEBUG) << "setUiccSubscription";
+    serial = GetRandomSerialNumber();
+    SelectUiccSub item;
+    memset(&item, 0, sizeof(item));
+
+    radio_sim->setUiccSubscription(serial, item);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(
+                CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                 {RadioError::NONE, RadioError::INVALID_ARGUMENTS,
+                                  RadioError::MODEM_ERR, RadioError::SUBSCRIPTION_NOT_SUPPORTED},
+                                 CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setUiccSubscription finished";
+}
+
+/*
+ * Test IRadioSim.sendEnvelope() for the response returned.
+ */
+TEST_P(RadioSimTest, sendEnvelope) {
+    LOG(DEBUG) << "sendEnvelope";
+    serial = GetRandomSerialNumber();
+
+    // Test with sending empty string
+    std::string content = "";
+
+    radio_sim->sendEnvelope(serial, content);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_sim->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS,
+                                      RadioError::MODEM_ERR, RadioError::SIM_ABSENT},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendEnvelope finished";
+}
+
+/*
+ * Test IRadioSim.sendTerminalResponseToSim() for the response returned.
+ */
+TEST_P(RadioSimTest, sendTerminalResponseToSim) {
+    LOG(DEBUG) << "sendTerminalResponseToSim";
+    serial = GetRandomSerialNumber();
+
+    // Test with sending empty string
+    std::string commandResponse = "";
+
+    radio_sim->sendTerminalResponseToSim(serial, commandResponse);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_sim->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::SIM_ABSENT},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendTerminalResponseToSim finished";
+}
+
+/*
+ * Test IRadioSim.reportStkServiceIsRunning() for the response returned.
+ */
+TEST_P(RadioSimTest, reportStkServiceIsRunning) {
+    LOG(DEBUG) << "reportStkServiceIsRunning";
+    serial = GetRandomSerialNumber();
+
+    radio_sim->reportStkServiceIsRunning(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_sim->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "reportStkServiceIsRunning finished";
+}
+
+/*
+ * Test IRadioSim.sendEnvelopeWithStatus() for the response returned with empty
+ * string.
+ */
+TEST_P(RadioSimTest, sendEnvelopeWithStatus) {
+    LOG(DEBUG) << "sendEnvelopeWithStatus";
+    serial = GetRandomSerialNumber();
+
+    // Test with sending empty string
+    std::string contents = "";
+
+    radio_sim->sendEnvelopeWithStatus(serial, contents);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_sim->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::MODEM_ERR, RadioError::SIM_ABSENT},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendEnvelopeWithStatus finished";
+}
diff --git a/radio/aidl/vts/radio_sim_utils.h b/radio/aidl/vts/radio_sim_utils.h
index b5e365d..83f1cbc 100644
--- a/radio/aidl/vts/radio_sim_utils.h
+++ b/radio/aidl/vts/radio_sim_utils.h
@@ -42,6 +42,7 @@
     bool areUiccApplicationsEnabled;
     PhonebookCapacity capacity;
     int32_t updatedRecordIndex;
+    std::string imsi;
 
     virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
 
diff --git a/radio/aidl/vts/radio_voice_indication.cpp b/radio/aidl/vts/radio_voice_indication.cpp
index d814c18..3fee326 100644
--- a/radio/aidl/vts/radio_voice_indication.cpp
+++ b/radio/aidl/vts/radio_voice_indication.cpp
@@ -65,6 +65,12 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus RadioVoiceIndication::onUssd(RadioIndicationType /*type*/,
+                                                UssdModeType /*modeType*/,
+                                                const std::string& /*msg*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus RadioVoiceIndication::resendIncallMute(RadioIndicationType /*type*/) {
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_voice_response.cpp b/radio/aidl/vts/radio_voice_response.cpp
index a491613..dd7b1bf 100644
--- a/radio/aidl/vts/radio_voice_response.cpp
+++ b/radio/aidl/vts/radio_voice_response.cpp
@@ -18,7 +18,9 @@
 
 RadioVoiceResponse::RadioVoiceResponse(RadioServiceTest& parent) : parent_voice(parent) {}
 
-ndk::ScopedAStatus RadioVoiceResponse::acceptCallResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::acceptCallResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -26,11 +28,21 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::conferenceResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::cancelPendingUssdResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::dialResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::conferenceResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioVoiceResponse::dialResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -41,34 +53,44 @@
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::exitEmergencyCallbackModeResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::explicitCallTransferResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::explicitCallTransferResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::getCallForwardStatusResponse(
-        const RadioResponseInfo& /*info*/,
-        const std::vector<CallForwardInfo>& /*callForwardInfos*/) {
+        const RadioResponseInfo& info, const std::vector<CallForwardInfo>& /*callForwardInfos*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::getCallWaitingResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioVoiceResponse::getCallWaitingResponse(const RadioResponseInfo& info,
                                                               bool /*enable*/,
                                                               int32_t /*serviceClass*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::getClipResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioVoiceResponse::getClipResponse(const RadioResponseInfo& info,
                                                        ClipStatus /*status*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::getClirResponse(const RadioResponseInfo& /*info*/,
-                                                       int32_t /*n*/, int32_t /*m*/) {
+ndk::ScopedAStatus RadioVoiceResponse::getClirResponse(const RadioResponseInfo& info, int32_t /*n*/,
+                                                       int32_t /*m*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -81,27 +103,37 @@
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::getLastCallFailCauseResponse(
-        const RadioResponseInfo& /*info*/, const LastCallFailCauseInfo& /*failCauseInfo*/) {
+        const RadioResponseInfo& info, const LastCallFailCauseInfo& /*failCauseInfo*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::getMuteResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioVoiceResponse::getMuteResponse(const RadioResponseInfo& info,
                                                        bool /*enable*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::getPreferredVoicePrivacyResponse(
-        const RadioResponseInfo& /*info*/, bool /*enable*/) {
+        const RadioResponseInfo& info, bool /*enable*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::getTtyModeResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioVoiceResponse::getTtyModeResponse(const RadioResponseInfo& info,
                                                           TtyMode /*mode*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::handleStkCallSetupRequestFromSimResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -112,80 +144,120 @@
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::hangupForegroundResumeBackgroundResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::hangupWaitingOrBackgroundResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::isVoNrEnabledResponse(const RadioResponseInfo& /*info*/,
+ndk::ScopedAStatus RadioVoiceResponse::isVoNrEnabledResponse(const RadioResponseInfo& info,
                                                              bool /*enabled*/) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::rejectCallResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::rejectCallResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::sendBurstDtmfResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::sendBurstDtmfResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::sendCdmaFeatureCodeResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::sendCdmaFeatureCodeResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::sendDtmfResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::sendDtmfResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::separateConnectionResponse(
-        const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::sendUssdResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::setCallForwardResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::separateConnectionResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::setCallWaitingResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::setCallForwardResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::setClirResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::setCallWaitingResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::setMuteResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::setClirResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioVoiceResponse::setMuteResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::setPreferredVoicePrivacyResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::setTtyModeResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::setTtyModeResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::setVoNrEnabledResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::setVoNrEnabledResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::startDtmfResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::startDtmfResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioVoiceResponse::stopDtmfResponse(const RadioResponseInfo& /*info*/) {
+ndk::ScopedAStatus RadioVoiceResponse::stopDtmfResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus RadioVoiceResponse::switchWaitingOrHoldingAndActiveResponse(
-        const RadioResponseInfo& /*info*/) {
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_voice_test.cpp b/radio/aidl/vts/radio_voice_test.cpp
index 717f3f0..eec28b1 100644
--- a/radio/aidl/vts/radio_voice_test.cpp
+++ b/radio/aidl/vts/radio_voice_test.cpp
@@ -265,3 +265,681 @@
     EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
     EXPECT_EQ(RadioError::NONE, radioRsp_voice->rspInfo.error);
 }
+
+/*
+ * Test IRadioVoice.getClir() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getClir) {
+    serial = GetRandomSerialNumber();
+
+    radio_voice->getClir(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error, {RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioVoice.setClir() for the response returned.
+ */
+TEST_P(RadioVoiceTest, setClir) {
+    serial = GetRandomSerialNumber();
+    int32_t status = 1;
+
+    radio_voice->setClir(serial, status);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_voice->rspInfo.error);
+    }
+}
+
+/*
+ * Test IRadioVoice.getClip() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getClip) {
+    serial = GetRandomSerialNumber();
+
+    radio_voice->getClip(serial);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error, {RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+}
+
+/*
+ * Test IRadioVoice.getTtyMode() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getTtyMode) {
+    LOG(DEBUG) << "getTtyMode";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->getTtyMode(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_voice->rspInfo.error);
+    }
+    LOG(DEBUG) << "getTtyMode finished";
+}
+
+/*
+ * Test IRadioVoice.setTtyMode() for the response returned.
+ */
+TEST_P(RadioVoiceTest, setTtyMode) {
+    LOG(DEBUG) << "setTtyMode";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->setTtyMode(serial, TtyMode::OFF);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_voice->rspInfo.error);
+    }
+    LOG(DEBUG) << "setTtyMode finished";
+}
+
+/*
+ * Test IRadioVoice.setPreferredVoicePrivacy() for the response returned.
+ */
+TEST_P(RadioVoiceTest, setPreferredVoicePrivacy) {
+    LOG(DEBUG) << "setPreferredVoicePrivacy";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->setPreferredVoicePrivacy(serial, true);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "setPreferredVoicePrivacy finished";
+}
+
+/*
+ * Test IRadioVoice.getPreferredVoicePrivacy() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getPreferredVoicePrivacy) {
+    LOG(DEBUG) << "getPreferredVoicePrivacy";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->getPreferredVoicePrivacy(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
+    }
+    LOG(DEBUG) << "getPreferredVoicePrivacy finished";
+}
+
+/*
+ * Test IRadioVoice.exitEmergencyCallbackMode() for the response returned.
+ */
+TEST_P(RadioVoiceTest, exitEmergencyCallbackMode) {
+    LOG(DEBUG) << "exitEmergencyCallbackMode";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->exitEmergencyCallbackMode(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED, RadioError::SIM_ABSENT}));
+    }
+    LOG(DEBUG) << "exitEmergencyCallbackMode finished";
+}
+
+/*
+ * Test IRadioVoice.handleStkCallSetupRequestFromSim() for the response returned.
+ */
+TEST_P(RadioVoiceTest, handleStkCallSetupRequestFromSim) {
+    LOG(DEBUG) << "handleStkCallSetupRequestFromSim";
+    serial = GetRandomSerialNumber();
+    bool accept = false;
+
+    radio_voice->handleStkCallSetupRequestFromSim(serial, accept);
+
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS,
+                                      RadioError::MODEM_ERR, RadioError::SIM_ABSENT},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "handleStkCallSetupRequestFromSim finished";
+}
+
+/*
+ * Test IRadioVoice.dial() for the response returned.
+ */
+TEST_P(RadioVoiceTest, dial) {
+    LOG(DEBUG) << "dial";
+    serial = GetRandomSerialNumber();
+
+    Dial dialInfo;
+    memset(&dialInfo, 0, sizeof(dialInfo));
+    dialInfo.address = std::string("123456789");
+
+    radio_voice->dial(serial, dialInfo);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::CANCELLED, RadioError::DEVICE_IN_USE, RadioError::FDN_CHECK_FAILURE,
+                 RadioError::INVALID_ARGUMENTS, RadioError::INVALID_CALL_ID,
+                 RadioError::INVALID_MODEM_STATE, RadioError::INVALID_STATE, RadioError::MODEM_ERR,
+                 RadioError::NO_NETWORK_FOUND, RadioError::NO_SUBSCRIPTION,
+                 RadioError::OPERATION_NOT_ALLOWED},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "dial finished";
+}
+
+/*
+ * Test IRadioVoice.hangup() for the response returned.
+ */
+TEST_P(RadioVoiceTest, hangup) {
+    LOG(DEBUG) << "hangup";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->hangup(serial, 1);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "hangup finished";
+}
+
+/*
+ * Test IRadioVoice.hangupWaitingOrBackground() for the response returned.
+ */
+TEST_P(RadioVoiceTest, hangupWaitingOrBackground) {
+    LOG(DEBUG) << "hangupWaitingOrBackground";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->hangupWaitingOrBackground(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "hangupWaitingOrBackground finished";
+}
+
+/*
+ * Test IRadioVoice.hangupForegroundResumeBackground() for the response returned.
+ */
+TEST_P(RadioVoiceTest, hangupForegroundResumeBackground) {
+    LOG(DEBUG) << "hangupForegroundResumeBackground";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->hangupForegroundResumeBackground(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "hangupForegroundResumeBackground finished";
+}
+
+/*
+ * Test IRadioVoice.switchWaitingOrHoldingAndActive() for the response returned.
+ */
+TEST_P(RadioVoiceTest, switchWaitingOrHoldingAndActive) {
+    LOG(DEBUG) << "switchWaitingOrHoldingAndActive";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->switchWaitingOrHoldingAndActive(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "switchWaitingOrHoldingAndActive finished";
+}
+
+/*
+ * Test IRadioVoice.conference() for the response returned.
+ */
+TEST_P(RadioVoiceTest, conference) {
+    LOG(DEBUG) << "conference";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->conference(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "conference finished";
+}
+
+/*
+ * Test IRadioVoice.rejectCall() for the response returned.
+ */
+TEST_P(RadioVoiceTest, rejectCall) {
+    LOG(DEBUG) << "rejectCall";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->rejectCall(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "rejectCall finished";
+}
+
+/*
+ * Test IRadioVoice.getLastCallFailCause() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getLastCallFailCause) {
+    LOG(DEBUG) << "getLastCallFailCause";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->getLastCallFailCause(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error, {RadioError::NONE},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getLastCallFailCause finished";
+}
+
+/*
+ * Test IRadioVoice.getCallForwardStatus() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getCallForwardStatus) {
+    LOG(DEBUG) << "getCallForwardStatus";
+    serial = GetRandomSerialNumber();
+    CallForwardInfo callInfo;
+    memset(&callInfo, 0, sizeof(callInfo));
+    callInfo.number = std::string();
+
+    radio_voice->getCallForwardStatus(serial, callInfo);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getCallForwardStatus finished";
+}
+
+/*
+ * Test IRadioVoice.setCallForward() for the response returned.
+ */
+TEST_P(RadioVoiceTest, setCallForward) {
+    LOG(DEBUG) << "setCallForward";
+    serial = GetRandomSerialNumber();
+    CallForwardInfo callInfo;
+    memset(&callInfo, 0, sizeof(callInfo));
+    callInfo.number = std::string();
+
+    radio_voice->setCallForward(serial, callInfo);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setCallForward finished";
+}
+
+/*
+ * Test IRadioVoice.getCallWaiting() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getCallWaiting) {
+    LOG(DEBUG) << "getCallWaiting";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->getCallWaiting(serial, 1);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "getCallWaiting finished";
+}
+
+/*
+ * Test IRadioVoice.setCallWaiting() for the response returned.
+ */
+TEST_P(RadioVoiceTest, setCallWaiting) {
+    LOG(DEBUG) << "setCallWaiting";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->setCallWaiting(serial, true, 1);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setCallWaiting finished";
+}
+
+/*
+ * Test IRadioVoice.acceptCall() for the response returned.
+ */
+TEST_P(RadioVoiceTest, acceptCall) {
+    LOG(DEBUG) << "acceptCall";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->acceptCall(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "acceptCall finished";
+}
+
+/*
+ * Test IRadioVoice.separateConnection() for the response returned.
+ */
+TEST_P(RadioVoiceTest, separateConnection) {
+    LOG(DEBUG) << "separateConnection";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->separateConnection(serial, 1);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "separateConnection finished";
+}
+
+/*
+ * Test IRadioVoice.explicitCallTransfer() for the response returned.
+ */
+TEST_P(RadioVoiceTest, explicitCallTransfer) {
+    LOG(DEBUG) << "explicitCallTransfer";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->explicitCallTransfer(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "explicitCallTransfer finished";
+}
+
+/*
+ * Test IRadioVoice.sendCdmaFeatureCode() for the response returned.
+ */
+TEST_P(RadioVoiceTest, sendCdmaFeatureCode) {
+    LOG(DEBUG) << "sendCdmaFeatureCode";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->sendCdmaFeatureCode(serial, std::string());
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS,
+                                      RadioError::INVALID_CALL_ID, RadioError::INVALID_MODEM_STATE,
+                                      RadioError::MODEM_ERR, RadioError::OPERATION_NOT_ALLOWED},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendCdmaFeatureCode finished";
+}
+
+/*
+ * Test IRadioVoice.sendDtmf() for the response returned.
+ */
+TEST_P(RadioVoiceTest, sendDtmf) {
+    LOG(DEBUG) << "sendDtmf";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->sendDtmf(serial, "1");
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::INVALID_CALL_ID,
+                 RadioError::INVALID_MODEM_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendDtmf finished";
+}
+
+/*
+ * Test IRadioVoice.startDtmf() for the response returned.
+ */
+TEST_P(RadioVoiceTest, startDtmf) {
+    LOG(DEBUG) << "startDtmf";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->startDtmf(serial, "1");
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_ARGUMENTS, RadioError::INVALID_CALL_ID,
+                 RadioError::INVALID_MODEM_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "startDtmf finished";
+}
+
+/*
+ * Test IRadioVoice.stopDtmf() for the response returned.
+ */
+TEST_P(RadioVoiceTest, stopDtmf) {
+    LOG(DEBUG) << "stopDtmf";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->stopDtmf(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_CALL_ID,
+                                      RadioError::INVALID_MODEM_STATE, RadioError::MODEM_ERR},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "stopDtmf finished";
+}
+
+/*
+ * Test IRadioVoice.setMute() for the response returned.
+ */
+TEST_P(RadioVoiceTest, setMute) {
+    LOG(DEBUG) << "setMute";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->setMute(serial, true);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::NONE, RadioError::INVALID_ARGUMENTS},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "setMute finished";
+}
+
+/*
+ * Test IRadioVoice.getMute() for the response returned.
+ */
+TEST_P(RadioVoiceTest, getMute) {
+    LOG(DEBUG) << "getMute";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->getMute(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        EXPECT_EQ(RadioError::NONE, radioRsp_voice->rspInfo.error);
+    }
+    LOG(DEBUG) << "getMute finished";
+}
+
+/*
+ * Test IRadioVoice.sendBurstDtmf() for the response returned.
+ */
+TEST_P(RadioVoiceTest, sendBurstDtmf) {
+    LOG(DEBUG) << "sendBurstDtmf";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->sendBurstDtmf(serial, "1", 0, 0);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_voice->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE,
+                                      RadioError::MODEM_ERR, RadioError::OPERATION_NOT_ALLOWED},
+                                     CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendBurstDtmf finished";
+}
+
+/*
+ * Test IRadioVoice.sendUssd() for the response returned.
+ */
+TEST_P(RadioVoiceTest, sendUssd) {
+    LOG(DEBUG) << "sendUssd";
+    serial = GetRandomSerialNumber();
+    radio_voice->sendUssd(serial, std::string("test"));
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendUssd finished";
+}
+
+/*
+ * Test IRadioVoice.cancelPendingUssd() for the response returned.
+ */
+TEST_P(RadioVoiceTest, cancelPendingUssd) {
+    LOG(DEBUG) << "cancelPendingUssd";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->cancelPendingUssd(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "cancelPendingUssd finished";
+}
diff --git a/radio/aidl/vts/radio_voice_utils.h b/radio/aidl/vts/radio_voice_utils.h
index d61bf1e..0c3df7f 100644
--- a/radio/aidl/vts/radio_voice_utils.h
+++ b/radio/aidl/vts/radio_voice_utils.h
@@ -43,6 +43,8 @@
 
     virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
 
+    virtual ndk::ScopedAStatus cancelPendingUssdResponse(const RadioResponseInfo& info) override;
+
     virtual ndk::ScopedAStatus conferenceResponse(const RadioResponseInfo& info) override;
 
     virtual ndk::ScopedAStatus dialResponse(const RadioResponseInfo& info) override;
@@ -103,6 +105,8 @@
 
     virtual ndk::ScopedAStatus sendDtmfResponse(const RadioResponseInfo& info) override;
 
+    virtual ndk::ScopedAStatus sendUssdResponse(const RadioResponseInfo& info) override;
+
     virtual ndk::ScopedAStatus separateConnectionResponse(const RadioResponseInfo& info) override;
 
     virtual ndk::ScopedAStatus setCallForwardResponse(const RadioResponseInfo& info) override;
@@ -164,6 +168,9 @@
     virtual ndk::ScopedAStatus onSupplementaryServiceIndication(
             RadioIndicationType type, const StkCcUnsolSsResult& ss) override;
 
+    virtual ndk::ScopedAStatus onUssd(RadioIndicationType type, UssdModeType modeType,
+                                      const std::string& msg) override;
+
     virtual ndk::ScopedAStatus resendIncallMute(RadioIndicationType type) override;
 
     virtual ndk::ScopedAStatus srvccStateNotify(RadioIndicationType type,
diff --git a/security/keymint/aidl/Android.bp b/security/keymint/aidl/Android.bp
index dcbe9c1..c9ee1b3 100644
--- a/security/keymint/aidl/Android.bp
+++ b/security/keymint/aidl/Android.bp
@@ -20,7 +20,6 @@
     backend: {
         java: {
             platform_apis: true,
-            srcs_available: true,
         },
         ndk: {
             vndk: {
@@ -56,6 +55,13 @@
     ],
 }
 
+cc_defaults {
+    name: "keymint_use_latest_hal_aidl_cpp_static",
+    static_libs: [
+        "android.hardware.security.keymint-V2-cpp",
+    ],
+}
+
 // A rust_defaults that includes the latest KeyMint AIDL library.
 // Modules that depend on KeyMint directly can include this cc_defaults to avoid
 // managing dependency versions explicitly.
diff --git a/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/RpcHardwareInfo.aidl b/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/RpcHardwareInfo.aidl
index 06bce19..5ff45f8 100644
--- a/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/RpcHardwareInfo.aidl
+++ b/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/RpcHardwareInfo.aidl
@@ -38,6 +38,7 @@
   int versionNumber;
   @utf8InCpp String rpcAuthorName;
   int supportedEekCurve = 0;
+  @nullable @utf8InCpp String uniqueId;
   const int CURVE_NONE = 0;
   const int CURVE_P256 = 1;
   const int CURVE_25519 = 2;
diff --git a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
index 9846ee9..4b63799 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
@@ -96,7 +96,9 @@
  *      - TRUSTED_ENVRIONMENT IKeyMintDevices must support curve 25519 for Purpose::SIGN (Ed25519,
  *        as specified in RFC 8032), Purpose::ATTEST_KEY (Ed25519) or for KeyPurpose::AGREE_KEY
  *        (X25519, as specified in RFC 7748).  However, a key must have exactly one of these
- *        purpose values; the same key cannot be used for multiple purposes.
+ *        purpose values; the same key cannot be used for multiple purposes. Signing operations
+ *        (Purpose::SIGN) have a message size limit of 16 KiB; operations on messages longer than
+ *        this limit must fail with ErrorCode::INVALID_INPUT_LENGTH.
  *        STRONGBOX IKeyMintDevices do not support curve 25519.
  *
  * o   AES
diff --git a/security/keymint/aidl/android/hardware/security/keymint/RpcHardwareInfo.aidl b/security/keymint/aidl/android/hardware/security/keymint/RpcHardwareInfo.aidl
index d297f87..3a4c233 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/RpcHardwareInfo.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/RpcHardwareInfo.aidl
@@ -53,4 +53,21 @@
      * a passing implementation does not provide CURVE_NONE.
      */
     int supportedEekCurve = CURVE_NONE;
+
+    /**
+     * uniqueId is an opaque identifier for this IRemotelyProvisionedComponent implementation. The
+     * client should NOT interpret the content of the identifier in any way. The client can only
+     * compare identifiers to determine if two IRemotelyProvisionedComponents share the same
+     * implementation. Each IRemotelyProvisionedComponent implementation must have a distinct
+     * identifier from all other implementations on the same device.
+     *
+     * This identifier must be consistent across reboots, as it is used to store and track
+     * provisioned keys in a persistent, on-device database.
+     *
+     * uniqueId may not be empty, and must not be any longer than 32 characters.
+     *
+     * This field was added in API version 2.
+     *
+     */
+    @nullable @utf8InCpp String uniqueId;
 }
diff --git a/security/keymint/aidl/vts/functional/Android.bp b/security/keymint/aidl/vts/functional/Android.bp
index 2d2d701..91db3c8 100644
--- a/security/keymint/aidl/vts/functional/Android.bp
+++ b/security/keymint/aidl/vts/functional/Android.bp
@@ -75,6 +75,9 @@
     export_include_dirs: [
         ".",
     ],
+    export_static_lib_headers: [
+        "libkeymint_support",
+    ],
     static_libs: [
         "libgmock_ndk",
     ],
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 374f2da..146a527 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -25,6 +25,7 @@
 #include <cppbor_parse.h>
 #include <cutils/properties.h>
 #include <gmock/gmock.h>
+#include <openssl/evp.h>
 #include <openssl/mem.h>
 #include <remote_prov/remote_prov_utils.h>
 
@@ -206,6 +207,21 @@
     return boot_patch_level(key_characteristics_);
 }
 
+bool KeyMintAidlTestBase::Curve25519Supported() {
+    // Strongbox never supports curve 25519.
+    if (SecLevel() == SecurityLevel::STRONGBOX) {
+        return false;
+    }
+
+    // Curve 25519 was included in version 2 of the KeyMint interface.
+    int32_t version = 0;
+    auto status = keymint_->getInterfaceVersion(&version);
+    if (!status.isOk()) {
+        ADD_FAILURE() << "Failed to determine interface version";
+    }
+    return version >= 2;
+}
+
 ErrorCode KeyMintAidlTestBase::GetReturnErrorCode(const Status& result) {
     if (result.isOk()) return ErrorCode::OK;
 
@@ -543,7 +559,12 @@
     std::vector<uint8_t> o_put;
     result = op_->update(vector<uint8_t>(input.begin(), input.end()), {}, {}, &o_put);
 
-    if (result.isOk()) output->append(o_put.begin(), o_put.end());
+    if (result.isOk()) {
+        output->append(o_put.begin(), o_put.end());
+    } else {
+        // Failure always terminates the operation.
+        op_ = {};
+    }
 
     return GetReturnErrorCode(result);
 }
@@ -740,6 +761,19 @@
 
     if (digest == Digest::NONE) {
         switch (EVP_PKEY_id(pub_key.get())) {
+            case EVP_PKEY_ED25519: {
+                ASSERT_EQ(64, signature.size());
+                uint8_t pub_keydata[32];
+                size_t pub_len = sizeof(pub_keydata);
+                ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(pub_key.get(), pub_keydata, &pub_len));
+                ASSERT_EQ(sizeof(pub_keydata), pub_len);
+                ASSERT_EQ(1, ED25519_verify(reinterpret_cast<const uint8_t*>(message.data()),
+                                            message.size(),
+                                            reinterpret_cast<const uint8_t*>(signature.data()),
+                                            pub_keydata));
+                break;
+            }
+
             case EVP_PKEY_EC: {
                 vector<uint8_t> data((EVP_PKEY_bits(pub_key.get()) + 7) / 8);
                 size_t data_size = std::min(data.size(), message.size());
@@ -1166,16 +1200,31 @@
 vector<EcCurve> KeyMintAidlTestBase::ValidCurves() {
     if (securityLevel_ == SecurityLevel::STRONGBOX) {
         return {EcCurve::P_256};
+    } else if (Curve25519Supported()) {
+        return {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521,
+                EcCurve::CURVE_25519};
     } else {
-        return {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521};
+        return {
+                EcCurve::P_224,
+                EcCurve::P_256,
+                EcCurve::P_384,
+                EcCurve::P_521,
+        };
     }
 }
 
 vector<EcCurve> KeyMintAidlTestBase::InvalidCurves() {
     if (SecLevel() == SecurityLevel::STRONGBOX) {
-        return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521};
+        // Curve 25519 is not supported, either because:
+        // - KeyMint v1: it's an unknown enum value
+        // - KeyMint v2+: it's not supported by StrongBox.
+        return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521, EcCurve::CURVE_25519};
     } else {
-        return {};
+        if (Curve25519Supported()) {
+            return {};
+        } else {
+            return {EcCurve::CURVE_25519};
+        }
     }
 }
 
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
index 61f9d4d..27cb99c 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
@@ -80,6 +80,8 @@
     uint32_t boot_patch_level(const vector<KeyCharacteristics>& key_characteristics);
     uint32_t boot_patch_level();
 
+    bool Curve25519Supported();
+
     ErrorCode GetReturnErrorCode(const Status& result);
 
     ErrorCode GenerateKey(const AuthorizationSet& key_desc, vector<uint8_t>* key_blob,
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 340010f..7357ac7 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -22,6 +22,7 @@
 #include <algorithm>
 #include <iostream>
 
+#include <openssl/curve25519.h>
 #include <openssl/ec.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
@@ -69,6 +70,9 @@
 
 namespace {
 
+// Maximum supported Ed25519 message size.
+const size_t MAX_ED25519_MSG_SIZE = 16 * 1024;
+
 // Whether to check that BOOT_PATCHLEVEL is populated.
 bool check_boot_pl = true;
 
@@ -415,6 +419,126 @@
         // } end SEQUENCE (PrivateKeyInfo)
 );
 
+/**
+ * Ed25519 key pair generated as follows:
+ * ```
+ * % openssl req -x509 -newkey ED25519 -days 700 -nodes \
+ *  -keyout ed25519_priv.key -out ed25519.pem * -subj "/CN=fake.ed25519.com"
+ * Generating a ED25519 private key writing new private key to
+ * 'ed25519_priv.key'
+ * -----
+ * % cat ed25519_priv.key
+ * -----BEGIN PRIVATE KEY-----
+ * MC4CAQAwBQYDK2VwBCIEIKl3A5quNywcj1P+0XI9SBalFPIvO52NxceMLRH6dVmR
+ * -----END PRIVATE KEY-----
+ * % der2ascii -pem -i ed25519_priv.key
+ * SEQUENCE {
+ *   INTEGER { 0 }
+ *   SEQUENCE {
+ *     # ed25519
+ *     OBJECT_IDENTIFIER { 1.3.101.112 }
+ *   }
+ *   OCTET_STRING {
+ *     OCTET_STRING { `a977039aae372c1c8f53fed1723d4816a514f22f3b9d8dc5c78c2d11fa755991` }
+ *   }
+ * }
+ * % cat ed25519.pem
+ * -----BEGIN CERTIFICATE-----
+ * MIIBSjCB/aADAgECAhR0Jron3eKcdgqyecv/eEfGWAzn8DAFBgMrZXAwGzEZMBcG
+ * A1UEAwwQZmFrZS5lZDI1NTE5LmNvbTAeFw0yMTEwMjAwODI3NDJaFw0yMzA5MjAw
+ * ODI3NDJaMBsxGTAXBgNVBAMMEGZha2UuZWQyNTUxOS5jb20wKjAFBgMrZXADIQDv
+ * uwHz+3TaQ69D2digxlz0fFfsZg0rPqgQae3jBPRWkaNTMFEwHQYDVR0OBBYEFN9O
+ * od30SY4JTs66ZR403UPya+iXMB8GA1UdIwQYMBaAFN9Ood30SY4JTs66ZR403UPy
+ * a+iXMA8GA1UdEwEB/wQFMAMBAf8wBQYDK2VwA0EAKjVrYQjuE/gEL2j/ABpDbFjV
+ * Ilg5tJ6MN/P3psAv3Cs7f0X1lFqdlt15nJ/6aj2cmGCwNRXt5wcyYDKNu+v2Dw==
+ * -----END CERTIFICATE-----
+ * % openssl x509 -in ed25519.pem -text -noout
+ * Certificate:
+ *     Data:
+ *         Version: 3 (0x2)
+ *         Serial Number:
+ *             74:26:ba:27:dd:e2:9c:76:0a:b2:79:cb:ff:78:47:c6:58:0c:e7:f0
+ *         Signature Algorithm: ED25519
+ *         Issuer: CN = fake.ed25519.com
+ *         Validity
+ *             Not Before: Oct 20 08:27:42 2021 GMT
+ *             Not After : Sep 20 08:27:42 2023 GMT
+ *         Subject: CN = fake.ed25519.com
+ *         Subject Public Key Info:
+ *             Public Key Algorithm: ED25519
+ *                 ED25519 Public-Key:
+ *                 pub:
+ *                     ef:bb:01:f3:fb:74:da:43:af:43:d9:d8:a0:c6:5c:
+ *                     f4:7c:57:ec:66:0d:2b:3e:a8:10:69:ed:e3:04:f4:
+ *                     56:91
+ *         X509v3 extensions:
+ *             X509v3 Subject Key Identifier:
+ *                 DF:4E:A1:DD:F4:49:8E:09:4E:CE:BA:65:1E:34:DD:43:F2:6B:E8:97
+ *             X509v3 Authority Key Identifier:
+ *                 keyid:DF:4E:A1:DD:F4:49:8E:09:4E:CE:BA:65:1E:34:DD:43:F2:6B:E8:97
+ *
+ *             X509v3 Basic Constraints: critical
+ *                 CA:TRUE
+ *     Signature Algorithm: ED25519
+ *          2a:35:6b:61:08:ee:13:f8:04:2f:68:ff:00:1a:43:6c:58:d5:
+ *          22:58:39:b4:9e:8c:37:f3:f7:a6:c0:2f:dc:2b:3b:7f:45:f5:
+ *          94:5a:9d:96:dd:79:9c:9f:fa:6a:3d:9c:98:60:b0:35:15:ed:
+ *          e7:07:32:60:32:8d:bb:eb:f6:0f
+ * ```
+ */
+string ed25519_key = hex2str("a977039aae372c1c8f53fed1723d4816a514f22f3b9d8dc5c78c2d11fa755991");
+string ed25519_pkcs8_key = hex2str(
+        // RFC 5208 s5
+        "302e"    // SEQUENCE length 0x2e (PrivateKeyInfo) {
+        "0201"    // INTEGER length 1 (Version)
+        "00"      // version 0
+        "3005"    // SEQUENCE length 05 (AlgorithmIdentifier) {
+        "0603"    // OBJECT IDENTIFIER length 3 (algorithm)
+        "2b6570"  // 1.3.101.112 (id-Ed125519 RFC 8410 s3)
+        // } end SEQUENCE (AlgorithmIdentifier)
+        "0422"  // OCTET STRING length 0x22 (PrivateKey)
+        "0420"  // OCTET STRING length 0x20 (RFC 8410 s7)
+        "a977039aae372c1c8f53fed1723d4816a514f22f3b9d8dc5c78c2d11fa755991"
+        // } end SEQUENCE (PrivateKeyInfo)
+);
+string ed25519_pubkey = hex2str("efbb01f3fb74da43af43d9d8a0c65cf47c57ec660d2b3ea81069ede304f45691");
+
+/**
+ * X25519 key pair generated as follows:
+ * ```
+ * % openssl genpkey -algorithm X25519 > x25519_priv.key
+ * % cat x25519_priv.key
+ * -----BEGIN PRIVATE KEY-----
+ * MC4CAQAwBQYDK2VuBCIEIGgPwF3NLwQx/Sfwr2nfJvXitwlDNh3Skzh+TISN/y1C
+ * -----END PRIVATE KEY-----
+ * % der2ascii -pem -i x25519_priv.key
+ * SEQUENCE {
+ *   INTEGER { 0 }
+ *   SEQUENCE {
+ *     # x25519
+ *     OBJECT_IDENTIFIER { 1.3.101.110 }
+ *   }
+ *   OCTET_STRING {
+ *     OCTET_STRING { `680fc05dcd2f0431fd27f0af69df26f5e2b70943361dd293387e4c848dff2d42` }
+ *   }
+ * }
+ * ```
+ */
+
+string x25519_key = hex2str("680fc05dcd2f0431fd27f0af69df26f5e2b70943361dd293387e4c848dff2d42");
+string x25519_pkcs8_key = hex2str(
+        // RFC 5208 s5
+        "302e"    // SEQUENCE length 0x2e (PrivateKeyInfo) {
+        "0201"    // INTEGER length 1 (Version)
+        "00"      // version 0
+        "3005"    // SEQUENCE length 05 (AlgorithmIdentifier) {
+        "0603"    // OBJECT IDENTIFIER length 3 (algorithm)
+        "2b656e"  // 1.3.101.110 (id-X125519 RFC 8410 s3)
+        "0422"    // OCTET STRING length 0x22 (PrivateKey)
+        "0420"    // OCTET STRING length 0x20 (RFC 8410 s7)
+        "680fc05dcd2f0431fd27f0af69df26f5e2b70943361dd293387e4c848dff2d42");
+string x25519_pubkey = hex2str("be46925a857f17831d6d454b9d3d36a4a30166edf80eb82b684661c3e258f768");
+
 struct RSA_Delete {
     void operator()(RSA* p) { RSA_free(p); }
 };
@@ -1374,7 +1498,7 @@
 /*
  * NewKeyGenerationTest.Ecdsa
  *
- * Verifies that keymint can generate all required EC key sizes, and that the resulting keys
+ * Verifies that keymint can generate all required EC curves, and that the resulting keys
  * have correct characteristics.
  */
 TEST_P(NewKeyGenerationTest, Ecdsa) {
@@ -1400,6 +1524,65 @@
 }
 
 /*
+ * NewKeyGenerationTest.EcdsaCurve25519
+ *
+ * Verifies that keymint can generate a curve25519 key, and that the resulting key
+ * has correct characteristics.
+ */
+TEST_P(NewKeyGenerationTest, EcdsaCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    vector<uint8_t> key_blob;
+    vector<KeyCharacteristics> key_characteristics;
+    ErrorCode result = GenerateKey(AuthorizationSetBuilder()
+                                           .EcdsaSigningKey(curve)
+                                           .Digest(Digest::NONE)
+                                           .SetDefaultValidity(),
+                                   &key_blob, &key_characteristics);
+    ASSERT_EQ(result, ErrorCode::OK);
+    ASSERT_GT(key_blob.size(), 0U);
+
+    EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_));
+    ASSERT_GT(cert_chain_.size(), 0);
+
+    CheckBaseParams(key_characteristics);
+    CheckCharacteristics(key_blob, key_characteristics);
+
+    AuthorizationSet crypto_params = SecLevelAuthorizations(key_characteristics);
+
+    EXPECT_TRUE(crypto_params.Contains(TAG_ALGORITHM, Algorithm::EC));
+    EXPECT_TRUE(crypto_params.Contains(TAG_EC_CURVE, curve)) << "Curve " << curve << "missing";
+
+    CheckedDeleteKey(&key_blob);
+}
+
+/*
+ * NewKeyGenerationTest.EcCurve25519MultiPurposeFail
+ *
+ * Verifies that KeyMint rejects an attempt to generate a curve 25519 key for both
+ * SIGN and AGREE_KEY.
+ */
+TEST_P(NewKeyGenerationTest, EcdsaCurve25519MultiPurposeFail) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    vector<uint8_t> key_blob;
+    vector<KeyCharacteristics> key_characteristics;
+    ErrorCode result = GenerateKey(AuthorizationSetBuilder()
+                                           .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                           .EcdsaSigningKey(curve)
+                                           .Digest(Digest::NONE)
+                                           .SetDefaultValidity(),
+                                   &key_blob, &key_characteristics);
+    ASSERT_EQ(result, ErrorCode::INCOMPATIBLE_PURPOSE);
+}
+
+/*
  * NewKeyGenerationTest.EcdsaAttestation
  *
  * Verifies that for all Ecdsa key sizes, if challenge and app id is provided,
@@ -1453,6 +1636,62 @@
 }
 
 /*
+ * NewKeyGenerationTest.EcdsaAttestationCurve25519
+ *
+ * Verifies that for a curve 25519 key, if challenge and app id is provided,
+ * an attestation will be generated.
+ */
+TEST_P(NewKeyGenerationTest, EcdsaAttestationCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    auto challenge = "hello";
+    auto app_id = "foo";
+
+    auto subject = "cert subj 2";
+    vector<uint8_t> subject_der(make_name_from_str(subject));
+
+    uint64_t serial_int = 0xFFFFFFFFFFFFFFFF;
+    vector<uint8_t> serial_blob(build_serial_blob(serial_int));
+
+    vector<uint8_t> key_blob;
+    vector<KeyCharacteristics> key_characteristics;
+    ErrorCode result = GenerateKey(AuthorizationSetBuilder()
+                                           .Authorization(TAG_NO_AUTH_REQUIRED)
+                                           .EcdsaSigningKey(curve)
+                                           .Digest(Digest::NONE)
+                                           .AttestationChallenge(challenge)
+                                           .AttestationApplicationId(app_id)
+                                           .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)
+                                           .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)
+                                           .SetDefaultValidity(),
+                                   &key_blob, &key_characteristics);
+    ASSERT_EQ(ErrorCode::OK, result);
+    ASSERT_GT(key_blob.size(), 0U);
+    CheckBaseParams(key_characteristics);
+    CheckCharacteristics(key_blob, key_characteristics);
+
+    AuthorizationSet crypto_params = SecLevelAuthorizations(key_characteristics);
+
+    EXPECT_TRUE(crypto_params.Contains(TAG_ALGORITHM, Algorithm::EC));
+    EXPECT_TRUE(crypto_params.Contains(TAG_EC_CURVE, curve)) << "Curve " << curve << "missing";
+
+    EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_));
+    ASSERT_GT(cert_chain_.size(), 0);
+    verify_subject_and_serial(cert_chain_[0], serial_int, subject, false);
+
+    AuthorizationSet hw_enforced = HwEnforcedAuthorizations(key_characteristics);
+    AuthorizationSet sw_enforced = SwEnforcedAuthorizations(key_characteristics);
+    EXPECT_TRUE(verify_attestation_record(AidlVersion(), challenge, app_id,  //
+                                          sw_enforced, hw_enforced, SecLevel(),
+                                          cert_chain_[0].encodedCertificate));
+
+    CheckedDeleteKey(&key_blob);
+}
+
+/*
  * NewKeyGenerationTest.EcdsaAttestationTags
  *
  * Verifies that creation of an attested ECDSA key includes various tags in the
@@ -1984,20 +2223,22 @@
 }
 
 /*
- * NewKeyGenerationTest.EcdsaInvalidSize
+ * NewKeyGenerationTest.EcdsaInvalidCurve
  *
- * Verifies that specifying an invalid key size for EC key generation returns
+ * Verifies that specifying an invalid curve for EC key generation returns
  * UNSUPPORTED_KEY_SIZE.
  */
-TEST_P(NewKeyGenerationTest, EcdsaInvalidSize) {
+TEST_P(NewKeyGenerationTest, EcdsaInvalidCurve) {
     for (auto curve : InvalidCurves()) {
         vector<uint8_t> key_blob;
         vector<KeyCharacteristics> key_characteristics;
-        ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE, GenerateKey(AuthorizationSetBuilder()
-                                                                       .EcdsaSigningKey(curve)
-                                                                       .Digest(Digest::NONE)
-                                                                       .SetDefaultValidity(),
-                                                               &key_blob, &key_characteristics));
+        auto result = GenerateKey(AuthorizationSetBuilder()
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity(),
+                                  &key_blob, &key_characteristics);
+        ASSERT_TRUE(result == ErrorCode::UNSUPPORTED_KEY_SIZE ||
+                    result == ErrorCode::UNSUPPORTED_EC_CURVE);
     }
 
     ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE,
@@ -2808,15 +3049,19 @@
 /*
  * SigningOperationsTest.EcdsaAllDigestsAndCurves
  *
- * Verifies ECDSA signature/verification for all digests and curves.
+ * Verifies ECDSA signature/verification for all digests and required curves.
  */
 TEST_P(SigningOperationsTest, EcdsaAllDigestsAndCurves) {
-    auto digests = ValidDigests(true /* withNone */, false /* withMD5 */);
 
     string message = "1234567890";
     string corrupt_message = "2234567890";
     for (auto curve : ValidCurves()) {
         SCOPED_TRACE(testing::Message() << "Curve::" << curve);
+        // Ed25519 only allows Digest::NONE.
+        auto digests = (curve == EcCurve::CURVE_25519)
+                               ? std::vector<Digest>(1, Digest::NONE)
+                               : ValidDigests(true /* withNone */, false /* withMD5 */);
+
         ErrorCode error = GenerateKey(AuthorizationSetBuilder()
                                               .Authorization(TAG_NO_AUTH_REQUIRED)
                                               .EcdsaSigningKey(curve)
@@ -2841,25 +3086,141 @@
 /*
  * SigningOperationsTest.EcdsaAllCurves
  *
- * Verifies that ECDSA operations succeed with all possible curves.
+ * Verifies that ECDSA operations succeed with all required curves.
  */
 TEST_P(SigningOperationsTest, EcdsaAllCurves) {
     for (auto curve : ValidCurves()) {
+        Digest digest = (curve == EcCurve::CURVE_25519 ? Digest::NONE : Digest::SHA_2_256);
+        SCOPED_TRACE(testing::Message() << "Curve::" << curve);
         ErrorCode error = GenerateKey(AuthorizationSetBuilder()
                                               .Authorization(TAG_NO_AUTH_REQUIRED)
                                               .EcdsaSigningKey(curve)
-                                              .Digest(Digest::SHA_2_256)
+                                              .Digest(digest)
                                               .SetDefaultValidity());
         EXPECT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
         if (error != ErrorCode::OK) continue;
 
         string message(1024, 'a');
-        SignMessage(message, AuthorizationSetBuilder().Digest(Digest::SHA_2_256));
+        SignMessage(message, AuthorizationSetBuilder().Digest(digest));
         CheckedDeleteKey();
     }
 }
 
 /*
+ * SigningOperationsTest.EcdsaCurve25519
+ *
+ * Verifies that ECDSA operations succeed with curve25519.
+ */
+TEST_P(SigningOperationsTest, EcdsaCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    ErrorCode error = GenerateKey(AuthorizationSetBuilder()
+                                          .Authorization(TAG_NO_AUTH_REQUIRED)
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity());
+    ASSERT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
+
+    string message(1024, 'a');
+    SignMessage(message, AuthorizationSetBuilder().Digest(Digest::NONE));
+    CheckedDeleteKey();
+}
+
+/*
+ * SigningOperationsTest.EcdsaCurve25519MaxSize
+ *
+ * Verifies that EDDSA operations with curve25519 under the maximum message size succeed.
+ */
+TEST_P(SigningOperationsTest, EcdsaCurve25519MaxSize) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    ErrorCode error = GenerateKey(AuthorizationSetBuilder()
+                                          .Authorization(TAG_NO_AUTH_REQUIRED)
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity());
+    ASSERT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
+
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+
+    for (size_t msg_size : {MAX_ED25519_MSG_SIZE - 1, MAX_ED25519_MSG_SIZE}) {
+        SCOPED_TRACE(testing::Message() << "-msg-size=" << msg_size);
+        string message(msg_size, 'a');
+
+        // Attempt to sign via Begin+Finish.
+        AuthorizationSet out_params;
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string signature;
+        auto result = Finish(message, &signature);
+        EXPECT_EQ(result, ErrorCode::OK);
+        LocalVerifyMessage(message, signature, params);
+
+        // Attempt to sign via Begin+Update+Finish
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string output;
+        result = Update(message, &output);
+        EXPECT_EQ(result, ErrorCode::OK);
+        EXPECT_EQ(output.size(), 0);
+        string signature2;
+        EXPECT_EQ(ErrorCode::OK, Finish({}, &signature2));
+        LocalVerifyMessage(message, signature2, params);
+    }
+
+    CheckedDeleteKey();
+}
+
+/*
+ * SigningOperationsTest.EcdsaCurve25519MaxSizeFail
+ *
+ * Verifies that EDDSA operations with curve25519 fail when message size is too large.
+ */
+TEST_P(SigningOperationsTest, EcdsaCurve25519MaxSizeFail) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    ErrorCode error = GenerateKey(AuthorizationSetBuilder()
+                                          .Authorization(TAG_NO_AUTH_REQUIRED)
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity());
+    ASSERT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
+
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+
+    for (size_t msg_size : {MAX_ED25519_MSG_SIZE + 1, MAX_ED25519_MSG_SIZE * 2}) {
+        SCOPED_TRACE(testing::Message() << "-msg-size=" << msg_size);
+        string message(msg_size, 'a');
+
+        // Attempt to sign via Begin+Finish.
+        AuthorizationSet out_params;
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string signature;
+        auto result = Finish(message, &signature);
+        EXPECT_EQ(result, ErrorCode::INVALID_INPUT_LENGTH);
+
+        // Attempt to sign via Begin+Update (but never get to Finish)
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string output;
+        result = Update(message, &output);
+        EXPECT_EQ(result, ErrorCode::INVALID_INPUT_LENGTH);
+    }
+
+    CheckedDeleteKey();
+}
+
+/*
  * SigningOperationsTest.EcdsaNoDigestHugeData
  *
  * Verifies that ECDSA operations support very large messages, even without digesting.  This
@@ -3509,6 +3870,255 @@
 }
 
 /*
+ * ImportKeyTest.Ed25519RawSuccess
+ *
+ * Verifies that importing and using a raw Ed25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, Ed25519RawSuccess) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, ed25519_key));
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+
+    // The returned cert should hold the correct public key.
+    ASSERT_GT(cert_chain_.size(), 0);
+    X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+    ASSERT_NE(kmKeyCert, nullptr);
+    EVP_PKEY_Ptr kmPubKey(X509_get_pubkey(kmKeyCert.get()));
+    ASSERT_NE(kmPubKey.get(), nullptr);
+    size_t kmPubKeySize = 32;
+    uint8_t kmPubKeyData[32];
+    ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+    ASSERT_EQ(kmPubKeySize, 32);
+    EXPECT_EQ(string(kmPubKeyData, kmPubKeyData + 32), ed25519_pubkey);
+
+    string message(32, 'a');
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+    string signature = SignMessage(message, params);
+    LocalVerifyMessage(message, signature, params);
+}
+
+/*
+ * ImportKeyTest.Ed25519Pkcs8Success
+ *
+ * Verifies that importing and using a PKCS#8-encoded Ed25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, Ed25519Pkcs8Success) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, ed25519_pkcs8_key));
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+
+    // The returned cert should hold the correct public key.
+    ASSERT_GT(cert_chain_.size(), 0);
+    X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+    ASSERT_NE(kmKeyCert, nullptr);
+    EVP_PKEY_Ptr kmPubKey(X509_get_pubkey(kmKeyCert.get()));
+    ASSERT_NE(kmPubKey.get(), nullptr);
+    size_t kmPubKeySize = 32;
+    uint8_t kmPubKeyData[32];
+    ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+    ASSERT_EQ(kmPubKeySize, 32);
+    EXPECT_EQ(string(kmPubKeyData, kmPubKeyData + 32), ed25519_pubkey);
+
+    string message(32, 'a');
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+    string signature = SignMessage(message, params);
+    LocalVerifyMessage(message, signature, params);
+}
+
+/*
+ * ImportKeyTest.Ed25519CurveMismatch
+ *
+ * Verifies that importing an Ed25519 key pair with a curve that doesn't match the key fails in
+ * the correct way.
+ */
+TEST_P(ImportKeyTest, Ed25519CurveMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK,
+              ImportKey(AuthorizationSetBuilder()
+                                .EcdsaSigningKey(EcCurve::P_224 /* Doesn't match key */)
+                                .Digest(Digest::NONE)
+                                .SetDefaultValidity(),
+                        KeyFormat::RAW, ed25519_key));
+}
+
+/*
+ * ImportKeyTest.Ed25519FormatMismatch
+ *
+ * Verifies that importing an Ed25519 key pair with an invalid format fails.
+ */
+TEST_P(ImportKeyTest, Ed25519FormatMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, ed25519_key));
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, ed25519_pkcs8_key));
+}
+
+/*
+ * ImportKeyTest.Ed25519PurposeMismatch
+ *
+ * Verifies that importing an Ed25519 key pair with an invalid purpose fails.
+ */
+TEST_P(ImportKeyTest, Ed25519PurposeMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Can't have both SIGN and ATTEST_KEY
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::ATTEST_KEY)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, ed25519_key));
+    // AGREE_KEY is for X25519 (but can only tell the difference if the import key is in
+    // PKCS#8 format and so includes an OID).
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, ed25519_pkcs8_key));
+}
+
+/*
+ * ImportKeyTest.X25519RawSuccess
+ *
+ * Verifies that importing and using a raw X25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, X25519RawSuccess) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, x25519_key));
+
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+}
+
+/*
+ * ImportKeyTest.X25519Pkcs8Success
+ *
+ * Verifies that importing and using a PKCS#8-encoded X25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, X25519Pkcs8Success) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+}
+
+/*
+ * ImportKeyTest.X25519CurveMismatch
+ *
+ * Verifies that importing an X25519 key with a curve that doesn't match the key fails in
+ * the correct way.
+ */
+TEST_P(ImportKeyTest, X25519CurveMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::P_224 /* Doesn't match key */)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, x25519_key));
+}
+
+/*
+ * ImportKeyTest.X25519FormatMismatch
+ *
+ * Verifies that importing an X25519 key with an invalid format fails.
+ */
+TEST_P(ImportKeyTest, X25519FormatMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_key));
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, x25519_pkcs8_key));
+}
+
+/*
+ * ImportKeyTest.X25519PurposeMismatch
+ *
+ * Verifies that importing an X25519 key pair with an invalid format fails.
+ */
+TEST_P(ImportKeyTest, X25519PurposeMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::ATTEST_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+}
+
+/*
  * ImportKeyTest.AesSuccess
  *
  * Verifies that importing and using an AES key works.
@@ -6703,8 +7313,6 @@
 
 INSTANTIATE_KEYMINT_AIDL_TEST(TransportLimitTest);
 
-typedef KeyMintAidlTestBase KeyAgreementTest;
-
 static int EcdhCurveToOpenSslCurveName(EcCurve curve) {
     switch (curve) {
         case EcCurve::P_224:
@@ -6720,10 +7328,108 @@
     }
 }
 
+class KeyAgreementTest : public KeyMintAidlTestBase {
+  protected:
+    void GenerateLocalEcKey(EcCurve localCurve, EVP_PKEY_Ptr* localPrivKey,
+                            std::vector<uint8_t>* localPublicKey) {
+        // Generate EC key locally (with access to private key material)
+        if (localCurve == EcCurve::CURVE_25519) {
+            uint8_t privKeyData[32];
+            uint8_t pubKeyData[32];
+            X25519_keypair(pubKeyData, privKeyData);
+            *localPublicKey = vector<uint8_t>(pubKeyData, pubKeyData + 32);
+            *localPrivKey = EVP_PKEY_Ptr(EVP_PKEY_new_raw_private_key(
+                    EVP_PKEY_X25519, nullptr, privKeyData, sizeof(privKeyData)));
+        } else {
+            auto ecKey = EC_KEY_Ptr(EC_KEY_new());
+            int curveName = EcdhCurveToOpenSslCurveName(localCurve);
+            auto group = EC_GROUP_Ptr(EC_GROUP_new_by_curve_name(curveName));
+            ASSERT_NE(group, nullptr);
+            ASSERT_EQ(EC_KEY_set_group(ecKey.get(), group.get()), 1);
+            ASSERT_EQ(EC_KEY_generate_key(ecKey.get()), 1);
+            *localPrivKey = EVP_PKEY_Ptr(EVP_PKEY_new());
+            ASSERT_EQ(EVP_PKEY_set1_EC_KEY(localPrivKey->get(), ecKey.get()), 1);
+
+            // Get encoded form of the public part of the locally generated key...
+            unsigned char* p = nullptr;
+            int localPublicKeySize = i2d_PUBKEY(localPrivKey->get(), &p);
+            ASSERT_GT(localPublicKeySize, 0);
+            *localPublicKey =
+                    vector<uint8_t>(reinterpret_cast<const uint8_t*>(p),
+                                    reinterpret_cast<const uint8_t*>(p + localPublicKeySize));
+            OPENSSL_free(p);
+        }
+    }
+
+    void GenerateKeyMintEcKey(EcCurve curve, EVP_PKEY_Ptr* kmPubKey) {
+        vector<uint8_t> challenge = {0x41, 0x42};
+        ErrorCode result =
+                GenerateKey(AuthorizationSetBuilder()
+                                    .Authorization(TAG_NO_AUTH_REQUIRED)
+                                    .Authorization(TAG_EC_CURVE, curve)
+                                    .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                    .Authorization(TAG_ALGORITHM, Algorithm::EC)
+                                    .Authorization(TAG_ATTESTATION_APPLICATION_ID, {0x61, 0x62})
+                                    .Authorization(TAG_ATTESTATION_CHALLENGE, challenge)
+                                    .SetDefaultValidity());
+        ASSERT_EQ(ErrorCode::OK, result) << "Failed to generate key";
+        ASSERT_GT(cert_chain_.size(), 0);
+        X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+        ASSERT_NE(kmKeyCert, nullptr);
+        // Check that keyAgreement (bit 4) is set in KeyUsage
+        EXPECT_TRUE((X509_get_key_usage(kmKeyCert.get()) & X509v3_KU_KEY_AGREEMENT) != 0);
+        *kmPubKey = EVP_PKEY_Ptr(X509_get_pubkey(kmKeyCert.get()));
+        ASSERT_NE(*kmPubKey, nullptr);
+        if (dump_Attestations) {
+            for (size_t n = 0; n < cert_chain_.size(); n++) {
+                std::cout << bin2hex(cert_chain_[n].encodedCertificate) << std::endl;
+            }
+        }
+    }
+
+    void CheckAgreement(EVP_PKEY_Ptr kmPubKey, EVP_PKEY_Ptr localPrivKey,
+                        const std::vector<uint8_t>& localPublicKey) {
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
+        string ZabFromKeyMintStr;
+        ASSERT_EQ(ErrorCode::OK,
+                  Finish(string(localPublicKey.begin(), localPublicKey.end()), &ZabFromKeyMintStr));
+        vector<uint8_t> ZabFromKeyMint(ZabFromKeyMintStr.begin(), ZabFromKeyMintStr.end());
+        vector<uint8_t> ZabFromTest;
+
+        if (EVP_PKEY_id(kmPubKey.get()) == EVP_PKEY_X25519) {
+            size_t kmPubKeySize = 32;
+            uint8_t kmPubKeyData[32];
+            ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+            ASSERT_EQ(kmPubKeySize, 32);
+
+            uint8_t localPrivKeyData[32];
+            size_t localPrivKeySize = 32;
+            ASSERT_EQ(1, EVP_PKEY_get_raw_private_key(localPrivKey.get(), localPrivKeyData,
+                                                      &localPrivKeySize));
+            ASSERT_EQ(localPrivKeySize, 32);
+
+            uint8_t sharedKey[32];
+            ASSERT_EQ(1, X25519(sharedKey, localPrivKeyData, kmPubKeyData));
+            ZabFromTest = std::vector<uint8_t>(sharedKey, sharedKey + 32);
+        } else {
+            // Perform local ECDH between the two keys so we can check if we get the same Zab..
+            auto ctx = EVP_PKEY_CTX_Ptr(EVP_PKEY_CTX_new(localPrivKey.get(), nullptr));
+            ASSERT_NE(ctx, nullptr);
+            ASSERT_EQ(EVP_PKEY_derive_init(ctx.get()), 1);
+            ASSERT_EQ(EVP_PKEY_derive_set_peer(ctx.get(), kmPubKey.get()), 1);
+            size_t ZabFromTestLen = 0;
+            ASSERT_EQ(EVP_PKEY_derive(ctx.get(), nullptr, &ZabFromTestLen), 1);
+            ZabFromTest.resize(ZabFromTestLen);
+            ASSERT_EQ(EVP_PKEY_derive(ctx.get(), ZabFromTest.data(), &ZabFromTestLen), 1);
+        }
+        EXPECT_EQ(ZabFromKeyMint, ZabFromTest);
+    }
+};
+
 /*
  * KeyAgreementTest.Ecdh
  *
- * Verifies that ECDH works for all curves
+ * Verifies that ECDH works for all required curves
  */
 TEST_P(KeyAgreementTest, Ecdh) {
     // Because it's possible to use this API with keys on different curves, we
@@ -6737,49 +7443,13 @@
     for (auto curve : ValidCurves()) {
         for (auto localCurve : ValidCurves()) {
             // Generate EC key locally (with access to private key material)
-            auto ecKey = EC_KEY_Ptr(EC_KEY_new());
-            int curveName = EcdhCurveToOpenSslCurveName(localCurve);
-            auto group = EC_GROUP_Ptr(EC_GROUP_new_by_curve_name(curveName));
-            ASSERT_NE(group, nullptr);
-            ASSERT_EQ(EC_KEY_set_group(ecKey.get(), group.get()), 1);
-            ASSERT_EQ(EC_KEY_generate_key(ecKey.get()), 1);
-            auto pkey = EVP_PKEY_Ptr(EVP_PKEY_new());
-            ASSERT_EQ(EVP_PKEY_set1_EC_KEY(pkey.get(), ecKey.get()), 1);
-
-            // Get encoded form of the public part of the locally generated key...
-            unsigned char* p = nullptr;
-            int encodedPublicKeySize = i2d_PUBKEY(pkey.get(), &p);
-            ASSERT_GT(encodedPublicKeySize, 0);
-            vector<uint8_t> encodedPublicKey(
-                    reinterpret_cast<const uint8_t*>(p),
-                    reinterpret_cast<const uint8_t*>(p + encodedPublicKeySize));
-            OPENSSL_free(p);
+            EVP_PKEY_Ptr localPrivKey;
+            vector<uint8_t> localPublicKey;
+            GenerateLocalEcKey(localCurve, &localPrivKey, &localPublicKey);
 
             // Generate EC key in KeyMint (only access to public key material)
-            vector<uint8_t> challenge = {0x41, 0x42};
-            EXPECT_EQ(
-                    ErrorCode::OK,
-                    GenerateKey(AuthorizationSetBuilder()
-                                        .Authorization(TAG_NO_AUTH_REQUIRED)
-                                        .Authorization(TAG_EC_CURVE, curve)
-                                        .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
-                                        .Authorization(TAG_ALGORITHM, Algorithm::EC)
-                                        .Authorization(TAG_ATTESTATION_APPLICATION_ID, {0x61, 0x62})
-                                        .Authorization(TAG_ATTESTATION_CHALLENGE, challenge)
-                                        .SetDefaultValidity()))
-                    << "Failed to generate key";
-            ASSERT_GT(cert_chain_.size(), 0);
-            X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
-            ASSERT_NE(kmKeyCert, nullptr);
-            // Check that keyAgreement (bit 4) is set in KeyUsage
-            EXPECT_TRUE((X509_get_key_usage(kmKeyCert.get()) & X509v3_KU_KEY_AGREEMENT) != 0);
-            auto kmPkey = EVP_PKEY_Ptr(X509_get_pubkey(kmKeyCert.get()));
-            ASSERT_NE(kmPkey, nullptr);
-            if (dump_Attestations) {
-                for (size_t n = 0; n < cert_chain_.size(); n++) {
-                    std::cout << bin2hex(cert_chain_[n].encodedCertificate) << std::endl;
-                }
-            }
+            EVP_PKEY_Ptr kmPubKey;
+            GenerateKeyMintEcKey(curve, &kmPubKey);
 
             // Now that we have the two keys, we ask KeyMint to perform ECDH...
             if (curve != localCurve) {
@@ -6788,30 +7458,12 @@
                 EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
                 string ZabFromKeyMintStr;
                 EXPECT_EQ(ErrorCode::INVALID_ARGUMENT,
-                          Finish(string(encodedPublicKey.begin(), encodedPublicKey.end()),
+                          Finish(string(localPublicKey.begin(), localPublicKey.end()),
                                  &ZabFromKeyMintStr));
 
             } else {
                 // Otherwise if the keys are using the same curve, it should work.
-                EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
-                string ZabFromKeyMintStr;
-                EXPECT_EQ(ErrorCode::OK,
-                          Finish(string(encodedPublicKey.begin(), encodedPublicKey.end()),
-                                 &ZabFromKeyMintStr));
-                vector<uint8_t> ZabFromKeyMint(ZabFromKeyMintStr.begin(), ZabFromKeyMintStr.end());
-
-                // Perform local ECDH between the two keys so we can check if we get the same Zab..
-                auto ctx = EVP_PKEY_CTX_Ptr(EVP_PKEY_CTX_new(pkey.get(), nullptr));
-                ASSERT_NE(ctx, nullptr);
-                ASSERT_EQ(EVP_PKEY_derive_init(ctx.get()), 1);
-                ASSERT_EQ(EVP_PKEY_derive_set_peer(ctx.get(), kmPkey.get()), 1);
-                size_t ZabFromTestLen = 0;
-                ASSERT_EQ(EVP_PKEY_derive(ctx.get(), nullptr, &ZabFromTestLen), 1);
-                vector<uint8_t> ZabFromTest;
-                ZabFromTest.resize(ZabFromTestLen);
-                ASSERT_EQ(EVP_PKEY_derive(ctx.get(), ZabFromTest.data(), &ZabFromTestLen), 1);
-
-                EXPECT_EQ(ZabFromKeyMint, ZabFromTest);
+                CheckAgreement(std::move(kmPubKey), std::move(localPrivKey), localPublicKey);
             }
 
             CheckedDeleteKey();
@@ -6819,6 +7471,140 @@
     }
 }
 
+/*
+ * KeyAgreementTest.EcdhCurve25519
+ *
+ * Verifies that ECDH works for curve25519. This is also covered by the general
+ * KeyAgreementTest.Ecdh case, but is pulled out separately here because this curve was added after
+ * KeyMint 1.0.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Generate EC key in KeyMint (only access to public key material)
+    EcCurve curve = EcCurve::CURVE_25519;
+    EVP_PKEY_Ptr kmPubKey = nullptr;
+    GenerateKeyMintEcKey(curve, &kmPubKey);
+
+    // Generate EC key on same curve locally (with access to private key material).
+    EVP_PKEY_Ptr privKey;
+    vector<uint8_t> encodedPublicKey;
+    GenerateLocalEcKey(curve, &privKey, &encodedPublicKey);
+
+    // Agree on a key between local and KeyMint and check it.
+    CheckAgreement(std::move(kmPubKey), std::move(privKey), encodedPublicKey);
+
+    CheckedDeleteKey();
+}
+
+/*
+ * KeyAgreementTest.EcdhCurve25519Imported
+ *
+ * Verifies that ECDH works for an imported curve25519 key.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519Imported) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Import x25519 key into KeyMint.
+    EcCurve curve = EcCurve::CURVE_25519;
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+    ASSERT_GT(cert_chain_.size(), 0);
+    X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+    ASSERT_NE(kmKeyCert, nullptr);
+    EVP_PKEY_Ptr kmPubKey(X509_get_pubkey(kmKeyCert.get()));
+    ASSERT_NE(kmPubKey.get(), nullptr);
+
+    // Expect the import to emit corresponding public key data.
+    size_t kmPubKeySize = 32;
+    uint8_t kmPubKeyData[32];
+    ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+    ASSERT_EQ(kmPubKeySize, 32);
+    EXPECT_EQ(bin2hex(std::vector<uint8_t>(kmPubKeyData, kmPubKeyData + 32)),
+              bin2hex(std::vector<uint8_t>(x25519_pubkey.begin(), x25519_pubkey.end())));
+
+    // Generate EC key on same curve locally (with access to private key material).
+    EVP_PKEY_Ptr privKey;
+    vector<uint8_t> encodedPublicKey;
+    GenerateLocalEcKey(curve, &privKey, &encodedPublicKey);
+
+    // Agree on a key between local and KeyMint and check it.
+    CheckAgreement(std::move(kmPubKey), std::move(privKey), encodedPublicKey);
+
+    CheckedDeleteKey();
+}
+
+/*
+ * KeyAgreementTest.EcdhCurve25519InvalidSize
+ *
+ * Verifies that ECDH fails for curve25519 if the wrong size of public key is provided.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519InvalidSize) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Generate EC key in KeyMint (only access to public key material)
+    EcCurve curve = EcCurve::CURVE_25519;
+    EVP_PKEY_Ptr kmPubKey = nullptr;
+    GenerateKeyMintEcKey(curve, &kmPubKey);
+
+    // Generate EC key on same curve locally (with access to private key material).
+    EVP_PKEY_Ptr privKey;
+    vector<uint8_t> encodedPublicKey;
+    GenerateLocalEcKey(curve, &privKey, &encodedPublicKey);
+
+    ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
+    string ZabFromKeyMintStr;
+    // Send in an incomplete public key.
+    ASSERT_NE(ErrorCode::OK, Finish(string(encodedPublicKey.begin(), encodedPublicKey.end() - 1),
+                                    &ZabFromKeyMintStr));
+
+    CheckedDeleteKey();
+}
+
+/*
+ * KeyAgreementTest.EcdhCurve25519Mismatch
+ *
+ * Verifies that ECDH fails between curve25519 and other curves.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519Mismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Generate EC key in KeyMint (only access to public key material)
+    EcCurve curve = EcCurve::CURVE_25519;
+    EVP_PKEY_Ptr kmPubKey = nullptr;
+    GenerateKeyMintEcKey(curve, &kmPubKey);
+
+    for (auto localCurve : ValidCurves()) {
+        if (localCurve == curve) {
+            continue;
+        }
+        // Generate EC key on a different curve locally (with access to private key material).
+        EVP_PKEY_Ptr privKey;
+        vector<uint8_t> encodedPublicKey;
+        GenerateLocalEcKey(localCurve, &privKey, &encodedPublicKey);
+
+        EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
+        string ZabFromKeyMintStr;
+        EXPECT_EQ(ErrorCode::INVALID_ARGUMENT,
+                  Finish(string(encodedPublicKey.begin(), encodedPublicKey.end()),
+                         &ZabFromKeyMintStr));
+    }
+
+    CheckedDeleteKey();
+}
+
 INSTANTIATE_KEYMINT_AIDL_TEST(KeyAgreementTest);
 
 using DestroyAttestationIdsTest = KeyMintAidlTestBase;
diff --git a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index c9d506f..829780d 100644
--- a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -20,6 +20,7 @@
 #include <aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.h>
 #include <aidl/android/hardware/security/keymint/SecurityLevel.h>
 #include <android/binder_manager.h>
+#include <binder/IServiceManager.h>
 #include <cppbor_parse.h>
 #include <gmock/gmock.h>
 #include <keymaster/cppcose/cppcose.h>
@@ -29,6 +30,7 @@
 #include <openssl/ec_key.h>
 #include <openssl/x509.h>
 #include <remote_prov/remote_prov_utils.h>
+#include <set>
 #include <vector>
 
 #include "KeyMintAidlTestBase.h"
@@ -40,6 +42,8 @@
 
 namespace {
 
+constexpr int32_t VERSION_WITH_UNIQUE_ID_SUPPORT = 2;
+
 #define INSTANTIATE_REM_PROV_AIDL_TEST(name)                                         \
     GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(name);                             \
     INSTANTIATE_TEST_SUITE_P(                                                        \
@@ -47,6 +51,7 @@
             testing::ValuesIn(VtsRemotelyProvisionedComponentTests::build_params()), \
             ::android::PrintInstanceNameToString)
 
+using ::android::sp;
 using bytevec = std::vector<uint8_t>;
 using testing::MatchesRegex;
 using namespace remote_prov;
@@ -175,6 +180,67 @@
     std::shared_ptr<IRemotelyProvisionedComponent> provisionable_;
 };
 
+/**
+ * Verify that every implementation reports a different unique id.
+ */
+TEST(NonParameterizedTests, eachRpcHasAUniqueId) {
+    std::set<std::string> uniqueIds;
+    for (auto hal : ::android::getAidlHalInstanceNames(IRemotelyProvisionedComponent::descriptor)) {
+        ASSERT_TRUE(AServiceManager_isDeclared(hal.c_str()));
+        ::ndk::SpAIBinder binder(AServiceManager_waitForService(hal.c_str()));
+        std::shared_ptr<IRemotelyProvisionedComponent> rpc =
+                IRemotelyProvisionedComponent::fromBinder(binder);
+        ASSERT_NE(rpc, nullptr);
+
+        RpcHardwareInfo hwInfo;
+        ASSERT_TRUE(rpc->getHardwareInfo(&hwInfo).isOk());
+
+        int32_t version;
+        ASSERT_TRUE(rpc->getInterfaceVersion(&version).isOk());
+        if (version >= VERSION_WITH_UNIQUE_ID_SUPPORT) {
+            ASSERT_TRUE(hwInfo.uniqueId);
+            auto [_, wasInserted] = uniqueIds.insert(*hwInfo.uniqueId);
+            EXPECT_TRUE(wasInserted);
+        } else {
+            ASSERT_FALSE(hwInfo.uniqueId);
+        }
+    }
+}
+
+using GetHardwareInfoTests = VtsRemotelyProvisionedComponentTests;
+
+INSTANTIATE_REM_PROV_AIDL_TEST(GetHardwareInfoTests);
+
+/**
+ * Verify that a valid curve is reported by the implementation.
+ */
+TEST_P(GetHardwareInfoTests, supportsValidCurve) {
+    RpcHardwareInfo hwInfo;
+    ASSERT_TRUE(provisionable_->getHardwareInfo(&hwInfo).isOk());
+
+    const std::set<int> validCurves = {RpcHardwareInfo::CURVE_P256, RpcHardwareInfo::CURVE_25519};
+    ASSERT_EQ(validCurves.count(hwInfo.supportedEekCurve), 1)
+            << "Invalid curve: " << hwInfo.supportedEekCurve;
+}
+
+/**
+ * Verify that the unique id is within the length limits as described in RpcHardwareInfo.aidl.
+ */
+TEST_P(GetHardwareInfoTests, uniqueId) {
+    int32_t version;
+    ASSERT_TRUE(provisionable_->getInterfaceVersion(&version).isOk());
+
+    if (version < VERSION_WITH_UNIQUE_ID_SUPPORT) {
+        return;
+    }
+
+    RpcHardwareInfo hwInfo;
+    ASSERT_TRUE(provisionable_->getHardwareInfo(&hwInfo).isOk());
+    ASSERT_TRUE(hwInfo.uniqueId);
+    EXPECT_GE(hwInfo.uniqueId->size(), 1);
+    EXPECT_LE(hwInfo.uniqueId->size(), 32);
+}
+
 using GenerateKeyTests = VtsRemotelyProvisionedComponentTests;
 
 INSTANTIATE_REM_PROV_AIDL_TEST(GenerateKeyTests);
diff --git a/security/secureclock/aidl/Android.bp b/security/secureclock/aidl/Android.bp
index 5235dd5..00a6ba3 100644
--- a/security/secureclock/aidl/Android.bp
+++ b/security/secureclock/aidl/Android.bp
@@ -17,7 +17,6 @@
     backend: {
         java: {
             platform_apis: true,
-            srcs_available: true,
         },
         ndk: {
             vndk: {
diff --git a/sensors/1.0/default/convert.cpp b/sensors/1.0/default/convert.cpp
index 53ceb0d..43ee327 100644
--- a/sensors/1.0/default/convert.cpp
+++ b/sensors/1.0/default/convert.cpp
@@ -190,8 +190,6 @@
         }
 
         default: {
-            CHECK_GE((int32_t)dst->sensorType, (int32_t)SensorType::DEVICE_PRIVATE_BASE);
-
             memcpy(dst->u.data.data(), src.data, 16 * sizeof(float));
             break;
         }
@@ -330,9 +328,6 @@
         }
 
         default: {
-            CHECK_GE((int32_t)src.sensorType,
-                     (int32_t)SensorType::DEVICE_PRIVATE_BASE);
-
             memcpy(dst->data, src.u.data.data(), 16 * sizeof(float));
             break;
         }
diff --git a/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/Event.aidl b/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/Event.aidl
index c92ab1a..4f49002 100644
--- a/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/Event.aidl
+++ b/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/Event.aidl
@@ -52,6 +52,9 @@
     android.hardware.sensors.AdditionalInfo additional;
     android.hardware.sensors.Event.EventPayload.Data data;
     android.hardware.sensors.Event.EventPayload.HeadTracker headTracker;
+    android.hardware.sensors.Event.EventPayload.LimitedAxesImu limitedAxesImu;
+    android.hardware.sensors.Event.EventPayload.LimitedAxesImuUncal limitedAxesImuUncal;
+    android.hardware.sensors.Event.EventPayload.Heading heading;
     @FixedSize @VintfStability
     parcelable Vec4 {
       float x;
@@ -86,11 +89,37 @@
       int discontinuityCount;
     }
     @FixedSize @VintfStability
+    parcelable LimitedAxesImu {
+      float x;
+      float y;
+      float z;
+      float xSupported;
+      float ySupported;
+      float zSupported;
+    }
+    @FixedSize @VintfStability
+    parcelable LimitedAxesImuUncal {
+      float x;
+      float y;
+      float z;
+      float xBias;
+      float yBias;
+      float zBias;
+      float xSupported;
+      float ySupported;
+      float zSupported;
+    }
+    @FixedSize @VintfStability
     parcelable HeartRate {
       float bpm;
       android.hardware.sensors.SensorStatus status;
     }
     @FixedSize @VintfStability
+    parcelable Heading {
+      float heading;
+      float accuracy;
+    }
+    @FixedSize @VintfStability
     parcelable MetaData {
       android.hardware.sensors.Event.EventPayload.MetaData.MetaDataEventType what;
       @Backing(type="int") @VintfStability
diff --git a/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/SensorType.aidl b/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/SensorType.aidl
index 3d7ab45..8c864e9 100644
--- a/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/SensorType.aidl
+++ b/sensors/aidl/aidl_api/android.hardware.sensors/current/android/hardware/sensors/SensorType.aidl
@@ -71,5 +71,10 @@
   ACCELEROMETER_UNCALIBRATED = 35,
   HINGE_ANGLE = 36,
   HEAD_TRACKER = 37,
+  ACCELEROMETER_LIMITED_AXES = 38,
+  GYROSCOPE_LIMITED_AXES = 39,
+  ACCELEROMETER_LIMITED_AXES_UNCALIBRATED = 40,
+  GYROSCOPE_LIMITED_AXES_UNCALIBRATED = 41,
+  HEADING = 42,
   DEVICE_PRIVATE_BASE = 65536,
 }
diff --git a/sensors/aidl/android/hardware/sensors/Event.aidl b/sensors/aidl/android/hardware/sensors/Event.aidl
index fd6a8cc..e8550f1 100644
--- a/sensors/aidl/android/hardware/sensors/Event.aidl
+++ b/sensors/aidl/android/hardware/sensors/Event.aidl
@@ -132,6 +132,23 @@
          */
         HeadTracker headTracker;
 
+        /**
+         * SensorType::ACCELEROMETER_LIMITED_AXES
+         * SensorType::GYROSCOPE_LIMITED_AXES
+         */
+        LimitedAxesImu limitedAxesImu;
+
+        /**
+         * SensorType::ACCELEROMETER_LIMITED_AXES_UNCALIBRATED
+         * SensorType::GYROSCOPE_LIMITED_AXES_UNCALIBRATED
+         */
+        LimitedAxesImuUncal limitedAxesImuUncal;
+
+        /**
+         * SensorType::HEADING
+         */
+        Heading heading;
+
         @FixedSize
         @VintfStability
         parcelable Vec4 {
@@ -201,6 +218,70 @@
             int discontinuityCount;
         }
 
+        /**
+         * Payload of the ACCELEROMETER_LIMITED_AXES and GYROSCOPE_LIMITED_AXES
+         * sensor types.
+         */
+        @FixedSize
+        @VintfStability
+        parcelable LimitedAxesImu {
+            /**
+             * Acceleration or angular speed values.  If certain axes are not
+             * supported, the associated value must be set to 0.
+             */
+            float x;
+            float y;
+            float z;
+
+            /**
+             * Limited axes sensors must not be supported for all three axes.
+             * These values indicate which axes are supported with a 1.0 for
+             * supported, and a 0 for not supported. The supported axes should
+             * be determined at build time and these values must not change
+             * during runtime.
+             */
+            float xSupported;
+            float ySupported;
+            float zSupported;
+        }
+
+        /**
+         * Payload of the ACCELEROMETER_LIMITED_AXES_UNCALIBRATED and
+         * GYROSCOPE_LIMITED_AXES_UNCALIBRATED sensor types.
+         */
+        @FixedSize
+        @VintfStability
+        parcelable LimitedAxesImuUncal {
+            /**
+             * Acceleration (without bias compensation) or angular (speed
+             * (without drift compensation) values. If certain axes are not
+             * supported, the associated value must be set to 0.
+             */
+            float x;
+            float y;
+            float z;
+
+            /**
+             * Estimated bias values for uncalibrated accelerometer or
+             * estimated drift values for uncalibrated gyroscope. If certain
+             * axes are not supported, the associated value must be set to 0.
+             */
+            float xBias;
+            float yBias;
+            float zBias;
+
+            /**
+             * Limited axes sensors must not be supported for all three axes.
+             * These values indicate which axes are supported with a 1.0 for
+             * supported, and a 0 for not supported. The supported axes should
+             * be determined at build time and these values must not change
+             * during runtime.
+             */
+            float xSupported;
+            float ySupported;
+            float zSupported;
+        }
+
         @FixedSize
         @VintfStability
         parcelable HeartRate {
@@ -218,6 +299,27 @@
 
         @FixedSize
         @VintfStability
+        parcelable Heading {
+            /**
+             * The direction in which the device is pointing relative to true
+             * north in degrees. The value must be between 0.0 (inclusive) and
+             * 360.0 (exclusive), with 0 indicating north, 90 east, 180 south,
+             * and 270 west.
+             */
+            float heading;
+            /**
+             * Accuracy is defined at 68% confidence. In the case where the
+             * underlying distribution is assumed Gaussian normal, this would be
+             * considered one standard deviation. For example, if the heading
+             * returns 60 degrees, and accuracy returns 10 degrees, then there
+             * is a 68 percent probability of the true heading being between 50
+             * degrees and 70 degrees.
+             */
+            float accuracy;
+        }
+
+        @FixedSize
+        @VintfStability
         parcelable MetaData {
             MetaDataEventType what;
 
diff --git a/sensors/aidl/android/hardware/sensors/SensorType.aidl b/sensors/aidl/android/hardware/sensors/SensorType.aidl
index 01e6bee..9098894 100644
--- a/sensors/aidl/android/hardware/sensors/SensorType.aidl
+++ b/sensors/aidl/android/hardware/sensors/SensorType.aidl
@@ -667,6 +667,57 @@
     HEAD_TRACKER = 37,
 
     /**
+     * ACCELEROMETER_LIMITED_AXES
+     * reporting-mode: continuous
+     *
+     * Equivalent to ACCELEROMETER, but supporting cases where one or two axes
+     * are not supported.
+     */
+    ACCELEROMETER_LIMITED_AXES = 38,
+
+    /**
+     * GYROSCOPE_LIMITED_AXES
+     * reporting-mode: continuous
+     *
+     * Equivalent to GYROSCOPE, but supporting cases where one or two axes are
+     * not supported.
+     */
+    GYROSCOPE_LIMITED_AXES = 39,
+
+    /**
+     * ACCELEROMETER_LIMITED_AXES_UNCALIBRATED
+     * reporting-mode: continuous
+     *
+     * Equivalent to ACCELEROMETER_UNCALIBRATED, but supporting cases where one
+     * or two axes are not supported.
+     */
+    ACCELEROMETER_LIMITED_AXES_UNCALIBRATED = 40,
+
+    /**
+     * GYROSCOPE_LIMITED_AXES_UNCALIBRATED
+     * reporting-mode: continuous
+     *
+     * Equivalent to GYROSCOPE_UNCALIBRATED, but supporting cases where one or
+     * two axes are not supported.
+     */
+    GYROSCOPE_LIMITED_AXES_UNCALIBRATED = 41,
+
+    /**
+     * HEADING
+     * reporting-mode: continuous
+     *
+     * A sensor of this type measures the direction in which the device is
+     * pointing relative to true north in degrees.
+     *
+     * This sensor was added for automotive form factors. Other devices with a
+     * clear forward direction might find it useful as well. However, devices
+     * with a more ambiguous orientation such as phones or wearables might want
+     * to consider using other sensors such as Sensor.TYPE_ROTATION_VECTOR
+     * which might be more suitable.
+     */
+    HEADING = 42,
+
+    /**
      * Base for device manufacturers private sensor types.
      * These sensor types can't be exposed in the SDK.
      */
diff --git a/sensors/aidl/default/OWNERS b/sensors/aidl/default/OWNERS
new file mode 100644
index 0000000..e955670
--- /dev/null
+++ b/sensors/aidl/default/OWNERS
@@ -0,0 +1,3 @@
+arthuri@google.com
+bduddie@google.com
+stange@google.com
\ No newline at end of file
diff --git a/sensors/aidl/default/multihal/ConvertUtils.cpp b/sensors/aidl/default/multihal/ConvertUtils.cpp
index 509bbb0..7751fd2 100644
--- a/sensors/aidl/default/multihal/ConvertUtils.cpp
+++ b/sensors/aidl/default/multihal/ConvertUtils.cpp
@@ -58,6 +58,7 @@
 }
 
 void convertToHidlEvent(const AidlEvent& aidlEvent, V2_1Event* hidlEvent) {
+    static_assert(decltype(hidlEvent->u.data)::elementCount() == 16);
     hidlEvent->timestamp = aidlEvent.timestamp;
     hidlEvent->sensorHandle = aidlEvent.sensorHandle;
     hidlEvent->sensorType = (V2_1SensorType)aidlEvent.sensorType;
@@ -177,16 +178,33 @@
             }
             break;
         }
-        default:
+        case AidlSensorType::HEAD_TRACKER: {
+            const auto& ht = aidlEvent.payload.get<Event::EventPayload::headTracker>();
+            hidlEvent->u.data[0] = ht.rx;
+            hidlEvent->u.data[1] = ht.ry;
+            hidlEvent->u.data[2] = ht.rz;
+            hidlEvent->u.data[3] = ht.vx;
+            hidlEvent->u.data[4] = ht.vy;
+            hidlEvent->u.data[5] = ht.vz;
+
+            // IMPORTANT: Because we want to preserve the data range of discontinuityCount,
+            // we assume the data can be interpreted as an int32_t directly (e.g. the underlying
+            // HIDL HAL must be using memcpy or equivalent to store this value).
+            *(reinterpret_cast<int32_t*>(&hidlEvent->u.data[6])) = ht.discontinuityCount;
+            break;
+        }
+        default: {
             CHECK_GE((int32_t)aidlEvent.sensorType, (int32_t)SensorType::DEVICE_PRIVATE_BASE);
             std::copy(std::begin(aidlEvent.payload.get<AidlEvent::EventPayload::data>().values),
                       std::end(aidlEvent.payload.get<AidlEvent::EventPayload::data>().values),
                       hidlEvent->u.data.data());
             break;
+        }
     }
 }
 
 void convertToAidlEvent(const V2_1Event& hidlEvent, AidlEvent* aidlEvent) {
+    static_assert(decltype(hidlEvent.u.data)::elementCount() == 16);
     aidlEvent->timestamp = hidlEvent.timestamp;
     aidlEvent->sensorHandle = hidlEvent.sensorHandle;
     aidlEvent->sensorType = (AidlSensorType)hidlEvent.sensorType;
@@ -304,11 +322,32 @@
             break;
         }
         default: {
-            CHECK_GE((int32_t)hidlEvent.sensorType, (int32_t)V2_1SensorType::DEVICE_PRIVATE_BASE);
-            AidlEvent::EventPayload::Data data;
-            std::copy(hidlEvent.u.data.data(), hidlEvent.u.data.data() + hidlEvent.u.data.size(),
-                      std::begin(data.values));
-            aidlEvent->payload.set<Event::EventPayload::data>(data);
+            if (static_cast<int32_t>(hidlEvent.sensorType) ==
+                static_cast<int32_t>(AidlSensorType::HEAD_TRACKER)) {
+                Event::EventPayload::HeadTracker headTracker;
+                headTracker.rx = hidlEvent.u.data[0];
+                headTracker.ry = hidlEvent.u.data[1];
+                headTracker.rz = hidlEvent.u.data[2];
+                headTracker.vx = hidlEvent.u.data[3];
+                headTracker.vy = hidlEvent.u.data[4];
+                headTracker.vz = hidlEvent.u.data[5];
+
+                // IMPORTANT: Because we want to preserve the data range of discontinuityCount,
+                // we assume the data can be interpreted as an int32_t directly (e.g. the underlying
+                // HIDL HAL must be using memcpy or equivalent to store this value).
+                headTracker.discontinuityCount =
+                        *(reinterpret_cast<const int32_t*>(&hidlEvent.u.data[6]));
+
+                aidlEvent->payload.set<Event::EventPayload::Tag::headTracker>(headTracker);
+            } else {
+                CHECK_GE((int32_t)hidlEvent.sensorType,
+                         (int32_t)V2_1SensorType::DEVICE_PRIVATE_BASE);
+                AidlEvent::EventPayload::Data data;
+                std::copy(hidlEvent.u.data.data(),
+                          hidlEvent.u.data.data() + hidlEvent.u.data.size(),
+                          std::begin(data.values));
+                aidlEvent->payload.set<Event::EventPayload::data>(data);
+            }
             break;
         }
     }
diff --git a/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp b/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp
index 1bc7263..105cb97 100644
--- a/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp
+++ b/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp
@@ -60,6 +60,8 @@
         ASSERT_STREQ(SENSOR_STRING_TYPE_##type, stringType.c_str()); \
         break;
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER_LIMITED_AXES);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER_LIMITED_AXES_UNCALIBRATED);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ACCELEROMETER_UNCALIBRATED);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(ADDITIONAL_INFO);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(AMBIENT_TEMPERATURE);
@@ -70,6 +72,8 @@
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GLANCE_GESTURE);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GRAVITY);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_LIMITED_AXES);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_LIMITED_AXES_UNCALIBRATED);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_UNCALIBRATED);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_BEAT);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_RATE);
@@ -122,8 +126,11 @@
 int expectedReportModeForType(SensorType type) {
     switch (type) {
         case SensorType::ACCELEROMETER:
+        case SensorType::ACCELEROMETER_LIMITED_AXES:
         case SensorType::ACCELEROMETER_UNCALIBRATED:
+        case SensorType::ACCELEROMETER_LIMITED_AXES_UNCALIBRATED:
         case SensorType::GYROSCOPE:
+        case SensorType::GYROSCOPE_LIMITED_AXES:
         case SensorType::MAGNETIC_FIELD:
         case SensorType::ORIENTATION:
         case SensorType::PRESSURE:
@@ -133,6 +140,7 @@
         case SensorType::MAGNETIC_FIELD_UNCALIBRATED:
         case SensorType::GAME_ROTATION_VECTOR:
         case SensorType::GYROSCOPE_UNCALIBRATED:
+        case SensorType::GYROSCOPE_LIMITED_AXES_UNCALIBRATED:
         case SensorType::GEOMAGNETIC_ROTATION_VECTOR:
         case SensorType::POSE_6DOF:
         case SensorType::HEART_BEAT:
diff --git a/sensors/common/default/2.X/multihal/HalProxy.cpp b/sensors/common/default/2.X/multihal/HalProxy.cpp
index 73b0594..f44f5c4 100644
--- a/sensors/common/default/2.X/multihal/HalProxy.cpp
+++ b/sensors/common/default/2.X/multihal/HalProxy.cpp
@@ -261,8 +261,8 @@
         Result currRes = mSubHalList[i]->initialize(this, this, i);
         if (currRes != Result::OK) {
             result = currRes;
-            ALOGE("Subhal '%s' failed to initialize.", mSubHalList[i]->getName().c_str());
-            break;
+            ALOGE("Subhal '%s' failed to initialize with reason %" PRId32 ".",
+                  mSubHalList[i]->getName().c_str(), static_cast<int32_t>(currRes));
         }
     }
 
diff --git a/soundtrigger/aidl/Android.bp b/soundtrigger/aidl/Android.bp
index fcccc27..28e8090 100644
--- a/soundtrigger/aidl/Android.bp
+++ b/soundtrigger/aidl/Android.bp
@@ -10,6 +10,7 @@
 aidl_interface {
     name: "android.hardware.soundtrigger3",
     vendor_available: true,
+    host_supported: true,
     flags: ["-Werror", "-Weverything", ],
     srcs: [
         "android/hardware/soundtrigger3/ISoundTriggerHw.aidl",
diff --git a/soundtrigger/aidl/android/hardware/soundtrigger3/ISoundTriggerHw.aidl b/soundtrigger/aidl/android/hardware/soundtrigger3/ISoundTriggerHw.aidl
index 2a3fc64..618331b 100644
--- a/soundtrigger/aidl/android/hardware/soundtrigger3/ISoundTriggerHw.aidl
+++ b/soundtrigger/aidl/android/hardware/soundtrigger3/ISoundTriggerHw.aidl
@@ -18,15 +18,12 @@
 
 import android.hardware.soundtrigger3.ISoundTriggerHwCallback;
 import android.hardware.soundtrigger3.ISoundTriggerHwGlobalCallback;
-
+import android.media.soundtrigger.ModelParameter;
+import android.media.soundtrigger.ModelParameterRange;
 import android.media.soundtrigger.PhraseSoundModel;
 import android.media.soundtrigger.Properties;
 import android.media.soundtrigger.RecognitionConfig;
 import android.media.soundtrigger.SoundModel;
-import android.media.soundtrigger.ModelParameter;
-import android.media.soundtrigger.ModelParameterRange;
-import android.media.soundtrigger.Properties;
-import android.media.soundtrigger.RecognitionConfig;
 
 /**
  * SoundTrigger HAL interface. Used for hardware recognition of hotwords
@@ -196,12 +193,12 @@
      *     an audio stream associated with this recognition session.
      * @param config A RecognitionConfig structure containing attributes of the recognition to
      *     perform.
-      * @throws ServiceSpecificException(RESOURCE_CONTENTION) if the model cannot be started due
+     * @throws ServiceSpecificException(RESOURCE_CONTENTION) if the model cannot be started due
      *     to resource constraints. This is typically a temporary condition and the client may
      *     retry after the onResourcesAvailable() global callback is invoked.
-    */
-    void startRecognition(in int modelHandle, in int deviceHandle,
-                          in int ioHandle, in RecognitionConfig config);
+     */
+    void startRecognition(
+            in int modelHandle, in int deviceHandle, in int ioHandle, in RecognitionConfig config);
 
     /**
      * Stop recognition on a given model.
@@ -235,7 +232,8 @@
      * @return This structure indicates supported attributes of the parameter for the given model
      *      handle. If the parameter is not supported, null is returned.
      */
-    @nullable ModelParameterRange queryParameter(in int modelHandle, in ModelParameter modelParam);
+    @nullable ModelParameterRange queryParameter(
+            in int modelHandle, in ModelParameter modelParam);
 
     /**
      * Get a model specific parameter.
diff --git a/thermal/2.0/default/Android.bp b/thermal/2.0/default/Android.bp
index a63ffbc..f743ade 100644
--- a/thermal/2.0/default/Android.bp
+++ b/thermal/2.0/default/Android.bp
@@ -22,16 +22,26 @@
     default_applicable_licenses: ["hardware_interfaces_license"],
 }
 
+filegroup {
+    name: "android.hardware.thermal@2.0-service.xml",
+    srcs: ["android.hardware.thermal@2.0-service.xml"],
+}
+
+filegroup {
+    name: "android.hardware.thermal@2.0-service.rc",
+    srcs: ["android.hardware.thermal@2.0-service.rc"],
+}
+
 cc_binary {
     name: "android.hardware.thermal@2.0-service.mock",
     defaults: ["hidl_defaults"],
     relative_install_path: "hw",
     vendor: true,
-    init_rc: ["android.hardware.thermal@2.0-service.rc"],
-    vintf_fragments: ["android.hardware.thermal@2.0-service.xml"],
+    init_rc: [":android.hardware.thermal@2.0-service.rc"],
+    vintf_fragments: [":android.hardware.thermal@2.0-service.xml"],
     srcs: [
         "Thermal.cpp",
-        "service.cpp"
+        "service.cpp",
     ],
     shared_libs: [
         "libbase",
diff --git a/thermal/2.0/default/apex/Android.bp b/thermal/2.0/default/apex/Android.bp
new file mode 100644
index 0000000..914a3a8
--- /dev/null
+++ b/thermal/2.0/default/apex/Android.bp
@@ -0,0 +1,55 @@
+// Copyright (C) 2022 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+apex_key {
+    name: "com.android.hardware.thermal.key",
+    public_key: "com.android.hardware.thermal.avbpubkey",
+    private_key: "com.android.hardware.thermal.pem",
+}
+
+android_app_certificate {
+    name: "com.android.hardware.thermal.certificate",
+    certificate: "com.android.hardware.thermal",
+}
+
+genrule {
+    name: "com.android.hardware.thermal.rc-gen",
+    srcs: [":android.hardware.thermal@2.0-service.rc"],
+    out: ["com.android.hardware.thermal.rc"],
+    cmd: "sed -E 's/\\/vendor/\\/apex\\/com.android.hardware.thermal.mock/' $(in) > $(out)",
+}
+
+prebuilt_etc {
+    name: "com.android.hardware.thermal.rc",
+    src: ":com.android.hardware.thermal.rc-gen",
+    installable: false,
+}
+
+apex {
+    name: "com.android.hardware.thermal.mock",
+    manifest: "manifest.json",
+    file_contexts: "file_contexts",
+    key: "com.android.hardware.thermal.key",
+    certificate: ":com.android.hardware.thermal.certificate",
+    use_vndk_as_stable: true,
+    updatable: false,
+    soc_specific: true,
+    binaries: ["android.hardware.thermal@2.0-service.mock"],
+    prebuilts: ["com.android.hardware.thermal.rc"],
+    vintf_fragments: [":android.hardware.thermal@2.0-service.xml"],
+}
diff --git a/thermal/2.0/default/apex/com.android.hardware.thermal.avbpubkey b/thermal/2.0/default/apex/com.android.hardware.thermal.avbpubkey
new file mode 100644
index 0000000..8f7cf72
--- /dev/null
+++ b/thermal/2.0/default/apex/com.android.hardware.thermal.avbpubkey
Binary files differ
diff --git a/thermal/2.0/default/apex/com.android.hardware.thermal.pem b/thermal/2.0/default/apex/com.android.hardware.thermal.pem
new file mode 100644
index 0000000..4ea6e85
--- /dev/null
+++ b/thermal/2.0/default/apex/com.android.hardware.thermal.pem
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEApXL2prEKqnU/xHlYeZB55x5EOrVAsfBuyHN5xOgUY877UuDC
+xoX+DOYAkCDSwMPmBj/Q9E70lId1PXMeI3y0obgYpdFubqRsoGNcEq2zG811tr6J
+BAE/7mAI0a4VVFWtauBNTiP5G31hsRpZNTE/dyZxs20GEVQqdvtBlEAuebCt7VIb
+fCwXnPCXSiYQ9WyjU0dwHoZPuy02qBuq3v9NYt5J6lYiPDqTWmpYBFm+SIZvth/j
+HUcaU3p+BlUad0qLhA8HYTPPBwJq2uHbTXeFrWXngt+UPCdzYubyUjG4WmgHIfee
+zSvoTjud2Gaofnd4/PcE5jFTMYUJuz0D4E+8StZArw+xegfxGcvqFZ4gfKAO1Vha
+eQBhw94P2eieUfh9metQEyKZ+A24sxG0awtAUOgcwr/WNv2TgJoN8+56DhuPXOuO
+U2qeIZuIrmE5xmyzrzJsCx+5vRQA7A3kpxRo1ZCgbJlzMgdAQaRTe2rqxyyoeFQR
+HbxUdsM7ZwDLE62UlaTTZFoJ1wzvZmsIJdkdRg97zcc3R3kYnVehCxAZ1KdAKzq6
+bhrw/kNAVA0zUHhlhHWGDnJQ/rkGfjQ9GGhS51IJYgKEoQc5M9hSgZD3idic8hso
+63r/P2Wn4S78gwLigfpzsGD7RrusTbMIRkebwpHwAYpB8qIykrtUKfunLtMCAwEA
+AQKCAgEAjiKbv0ytaw9bfwD4f0cdUu5vkzgPok55/f8mh4ERs0UoKGUrL74BKTeX
+GDr6k9w4CvpcGuaRu+A7WlVBeR8zVxN/KUUo6CidoZR6jxlmm+YA0MQTlbs1Hyal
+rO0vKcqJNx4Hi6/f3Dv0519JcCck7Mm8OHbbFZwG9zyXdDNHOggNA6rcLer7Rjpy
+3qKhQxbXoT3oFnEwog8Pu5A5VWZjJyLswULKGo//81cU0nf+vvOvmPj/9jEVbs32
+4p3OJNmHziXTIzCNFOqAvhX2fzDFSNgY8hf9k0gZGshpOS+5vwFLz2SZqo2j/0G8
+MyLOcgdVi4zzSobpf8tZNuAOKnCVwxteV3Ddl0o+qAf4cQCAXtuEkJvFWpAxrX4m
+J7nDDuvcTjKMlnchlm6XxmP27YNTKA2w5uNfrJQV5LR3IDs77PFpNiKOwERka6MU
+WE1LnjAFTCDxujT29NfIjC9z0iOY45TYut4okesaK7woe6pfK2H0ouvE6mZ+Lb7Y
+qZphPb4e4DZZZAVoELVvWflm/VC/xmBMA9vtzpjuvRXD+iYjgxbHaiG2UANLWmTd
+vADLqBadlbp10AvyrjKxHUhAiZnJgaVKRXtw5qk8YrwZOwypEHCQjY41fJuRScWF
+pD58/PYOLtSdwewzTijXSVwwPeqL1JMdJ+KWFk5zI410DtmHwoECggEBANM5dHEj
+L4ZOCcgHVG7aCLah7f/0Za7BBiPsZFD0uRIzWFTd77st3v8ulMw1JQiO3+xmpL7e
+iOP+onuSEMKgNQqeX9WCnv6pL+mjg0of2IEcGnvCpmfUZRA2x/MlyJRrQ1vHGqkV
+oBIIWgCGmIAWuFbHPmkNYx7mAJymAfzShkVtMw29oiGYyubqx9cTjD0odeyScbhZ
+LuMt72O5QeNsPREX4SsSRAL+vZbz1+8iRI8Fon89csZym3hos3DA4QSml+FNHnLe
+YFD6AfU7pdn79YhhNkn4jE0BxLaEkXhMs8RRTU2Q3o990ZxrAZGQz4zqOm5sOIQT
+JaXFXxGvOwEysrMCggEBAMiFaTzkhJSLEmLEu0T3gNEC2d3jE9kt4Olv4mQmzD00
+AzDtkrkArLQCeG3CMn55oFcJRwr8gAEk7/f2mvJSoZQnw0J0tRI+QiHJG4zwdsQC
+UszqN89X8ef0yoobwVa31ZoWxK4/NvLO4GZQ6UUd9uni10jfYVWmwEwKBU61ihvT
+ntcZIXvROR6khxzLeXtglnsznnYcdYMPJUeN+cfK9/rL3V3jk1jes8y8XwYfxkUa
+99nEe1NkRCUznzKxvkRwnKunlMCEkZ5z4nNMlqEqiOlVEYgwKwNCP+qM7ZKUJg7t
+uOL91bqWFPj2qdzyUh0uP5V/dg2odnu0xSblKWhxI2ECggEBAKbZttJ8Idlsoath
+pt+d2c4yoadTLlNZ5HjSDfgpKFxpNLhtTCbGuGVJLX8V5/gXrGi4OCER9n5rMXx9
+SEIFfYCy1C77bI7rpI5hfJ88ArESOxVSEFLqYx7otw+p5AThqibAY533GCfGcxoB
+OEvOJrVd1D31tju9IfSb6ewFfM0w0mhjSMRTRswb39pUda4F3QkQMUaXJEOOkJBs
+0dBNOvvaqiJ03kajZa3tVsBuiEuV/uOV7ak29Pqrcjt6EQW0dzsgyRGh+eFda9iE
+0qEbt7uQVusdq+5UnEg09hhaNpK4SmEgM76Te9WcbXPIOTst9xQs5oPmABIvk8aL
+bgenPaMCggEAX9EAHIzFnYVm37NKGQZ7k2RdXt2nGlwF4QYJk/nGFmjILZUYSza7
+T7jueuQU5MKRj4VrYSCOuf1AfahlGe3KL9VgRF0oOPNu/l3uwEYXOkox7qDs0jMf
+8MrUDXJ9zEZD10GR8gFa7GNWbw2yqchLuC8g2D2FcTwhHzSanKW6vNk+SWJE0bmE
+JdRQi73e6smYnn5n9eBbdqjCE5MQDBw8qqbHvJmGSyz/lZFdhrugLl1YmcJ9e7ep
+qG0mYT71wBZfhtapCeVO//w39Qhf4dtFWNnBauY5Z3E8wYNd8nDATtnhQvYwLtyQ
+YPbc7CsOecsjrvgdHSGmnC4hFxjh1HpbgQKCAQBzEr35CFQpUfGsu06SqRrxp7mb
+BfQzLmqnt+ZLu21H/YjVbamMXNjbJFSdtFLxAK/s9vFGQzEWWEYia2pRZejlCXhQ
+RO+TREJ4rm4Erfdh+zS9z8MZlxe2ybIMs260XxjZ0gEltRtJ6P14zLBlChi/rQEY
+tGrOpfjvLc1Lryaucwj7snDLtMfyqvemAUmuJNn/6IEMuG4DcdtJ3Whh7t3xKfO0
+Hc71Oh7F30okQQ6Ctiwp1T77Y1EXlRJrUtpf1sLxeItP6/r3WXLNaiFdKqGJxiCM
+Gw11oUcBA9bvfAzeJIpVVbLtGPNOp4J1XpkgFcWzsTM+ZpxWwbj4yJL6rSN2
+-----END RSA PRIVATE KEY-----
diff --git a/thermal/2.0/default/apex/com.android.hardware.thermal.pk8 b/thermal/2.0/default/apex/com.android.hardware.thermal.pk8
new file mode 100644
index 0000000..3e5bf69
--- /dev/null
+++ b/thermal/2.0/default/apex/com.android.hardware.thermal.pk8
Binary files differ
diff --git a/thermal/2.0/default/apex/com.android.hardware.thermal.x509.pem b/thermal/2.0/default/apex/com.android.hardware.thermal.x509.pem
new file mode 100644
index 0000000..048e69a
--- /dev/null
+++ b/thermal/2.0/default/apex/com.android.hardware.thermal.x509.pem
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF3TCCA8UCFFWeg2KJX/fyAqZPcKaFS61/a3GiMA0GCSqGSIb3DQEBCwUAMIGp
+MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91
+bnRhaW4gVmlldzEQMA4GA1UECgwHQW5kcm9pZDEQMA4GA1UECwwHQW5kcm9pZDEi
+MCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTElMCMGA1UEAwwcY29t
+LmFuZHJvaWQuaGFyZHdhcmUudGhlcm1hbDAgFw0yMTExMTcxODE3MjRaGA80NzU5
+MTAxNDE4MTcyNFowgakxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh
+MRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRAwDgYDVQQKDAdBbmRyb2lkMRAwDgYD
+VQQLDAdBbmRyb2lkMSIwIAYJKoZIhvcNAQkBFhNhbmRyb2lkQGFuZHJvaWQuY29t
+MSUwIwYDVQQDDBxjb20uYW5kcm9pZC5oYXJkd2FyZS50aGVybWFsMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA2W8QhCKX0WoS5jhIWbWBoKulD6XhKASA
+CL0oU6Uci0U6id2m++ou/T0aHSlliS9kT1NEABNwbLeTDa9h1qg1lbajRzXbvzEz
+EvZYT+dlgYFNZ9zaVCIlMapoiN+nrM/Rs24UBjJrZu1B39+IcE5ciQz69PgrLKWF
+vFEdYzxWI246azOVr3fvdelQg+CyPgiGObVAGOHhAidvsjg4FssKnADzn+JNlTt6
+b9P65xUQErut8hz9YdLtfZ096iwe8eEpsMOQwCNdKNXVCcNjQWkOwRaU+0awHoH1
+4mArvF7yyvJxqzkNaR03BPqXAHPIAPu6xdfA19+HVIiz6bLEZ1mfCM6edXByCWZu
+K8o54OZph71r15ncv4DVd+cnBjNvBvfdlJSeGjSreFkUo5NkfAwqdmLfZx6CedHI
+sLx7X8vPYolQnR4UEvaX6yeNN0gs8Dd6ePMqOEiwWFVASD+cbpcUrp09uzlDStGV
+1DPx/9J2kw8eXPMqOSGThkLWuUMUFojyh7bNlL16oYmEeZW6/OOXCOXzAQgJ7NIs
+DA1/H2w1HMHWgSfF4y+Es2CiqcgVFOIU/07b31Edw4v56pjx1CUpRpJZjDA1JJNo
+A4YCnpA6JWTxzUTmv21fEYyY+poA3CuzvCfZ80z9h/UFW98oM9GawGvK0i2pLudS
+RaZXWeil08cCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAj2gpn/IpAHQLDlI52WwL
+IDc5uzlf1BGseLZ8M8uuMiwvN00nOjunQQZEIbhH7+03GYyMzRhTTI3nWwmX4Fnq
+vC5sR68yNlu9gOAMXaAHo/Rw73ak7sv8xGbb2FeQsHaMKDQ2nqxP17SWdQ0xWa1u
+5qNurPOdAPOw77noZcT7yYX7lcrOKxPIekPJxyeOlp4bQSmabSRgYr70B7GybPlv
+K1gkgCBxl5RiVjVxLo+7ESHSAaGLy0S7F2v6PJ9oj15TovWQ0py2iBKZ6HReB7s/
+umnQqkwXDLudlNmoXIsgIYn8vKFTYpy1GSNJqhRSLfvLR6NtuU0iCTvg/X7oPmS1
+dWUdjVeO7ZVvIpO3gLLEe4maBEYF2sOlt3bRmzIHydORJtkfTt5tiZ4wR9RfJbkj
+iBiDbNiX010bZPTAXmgMbuJzQXZEXCBy0qKeS1cHwf9M8FDoiLajXepfZIp+6syt
+D4lZk4eAV141JL5PfABfdZWwT3cTgFIqCYpqrMQJIu+GHEjUwD2yNPi0I1/ydFCW
+CPDnzWjYCi6yVB8hss3ZFbvhfyJzdm3LivNVbLGK0+TG0EOAz6d2aQ0UjESgMD1A
+U8hLzQt7MiFSG0bt2cVx6SgCHeYUqMntbFELEAURWrhAfPLMJtAvFgKbEiZEAkkW
+pdDVh603aIp4LjVCfTYp/mQ=
+-----END CERTIFICATE-----
diff --git a/thermal/2.0/default/apex/file_contexts b/thermal/2.0/default/apex/file_contexts
new file mode 100644
index 0000000..e0d87c7
--- /dev/null
+++ b/thermal/2.0/default/apex/file_contexts
@@ -0,0 +1,5 @@
+(/.*)?                                                    u:object_r:vendor_file:s0
+# Permission XMLs
+/etc/permissions(/.*)?                                    u:object_r:vendor_configs_file:s0
+# binary
+/bin/hw/android\.hardware\.thermal@2\.0-service\.mock     u:object_r:hal_thermal_default_exec:s0
diff --git a/thermal/2.0/default/apex/manifest.json b/thermal/2.0/default/apex/manifest.json
new file mode 100644
index 0000000..ee44dc1
--- /dev/null
+++ b/thermal/2.0/default/apex/manifest.json
@@ -0,0 +1,4 @@
+{
+  "name": "com.android.hardware.thermal.mock",
+  "version": 1
+}
diff --git a/tv/tuner/aidl/Android.bp b/tv/tuner/aidl/Android.bp
index c33572d..63f91ac 100644
--- a/tv/tuner/aidl/Android.bp
+++ b/tv/tuner/aidl/Android.bp
@@ -19,7 +19,6 @@
     backend: {
         java: {
             sdk_version: "module_current",
-            srcs_available: true,
         },
         cpp: {
             enabled: false,
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl
index fc0efc9..1e0f5f0 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl
@@ -76,4 +76,5 @@
   android.hardware.tv.tuner.FrontendIsdbtPartialReceptionFlag partialReceptionFlag;
   int[] streamIdList;
   int[] dvbtCellIds;
+  android.hardware.tv.tuner.FrontendScanAtsc3PlpInfo[] allPlpInfo;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusReadiness.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusReadiness.aidl
index 5395b11..41944ce 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusReadiness.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,13 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
+package android.hardware.tv.tuner;
+/* @hide */
 @Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+enum FrontendStatusReadiness {
+  UNDEFINED = 0,
+  UNAVAILABLE = 1,
+  UNSTABLE = 2,
+  STABLE = 3,
+  UNSUPPORTED = 4,
 }
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl
index 2cc62d5..cd6ccb3 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl
@@ -76,4 +76,5 @@
   ISDBT_PARTIAL_RECEPTION_FLAG = 38,
   STREAM_ID_LIST = 39,
   DVBT_CELL_IDS = 40,
+  ATSC3_ALL_PLP_INFO = 41,
 }
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/IFrontend.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/IFrontend.aidl
index e7aa070..3e3ff4f 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/IFrontend.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/IFrontend.aidl
@@ -46,4 +46,6 @@
   int linkCiCam(in int ciCamId);
   void unlinkCiCam(in int ciCamId);
   String getHardwareInfo();
+  void removeOutputPid(int pid);
+  android.hardware.tv.tuner.FrontendStatusReadiness[] getFrontendStatusReadiness(in android.hardware.tv.tuner.FrontendStatusType[] statusTypes);
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl
index ae6e46f..b5d0201 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl
@@ -27,6 +27,7 @@
 import android.hardware.tv.tuner.FrontendModulationStatus;
 import android.hardware.tv.tuner.FrontendRollOff;
 import android.hardware.tv.tuner.FrontendSpectralInversion;
+import android.hardware.tv.tuner.FrontendScanAtsc3PlpInfo;
 import android.hardware.tv.tuner.FrontendStatusAtsc3PlpInfo;
 import android.hardware.tv.tuner.FrontendTransmissionMode;
 import android.hardware.tv.tuner.LnbVoltage;
@@ -241,5 +242,9 @@
      */
     int[] dvbtCellIds;
 
-
+    /**
+     * A list of all PLPs in the frequency band for ATSC3 frontend, which includes both tuned
+     * and not tuned PLPs for currently watching service.
+     */
+    FrontendScanAtsc3PlpInfo[] allPlpInfo;
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusReadiness.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusReadiness.aidl
new file mode 100644
index 0000000..a9e3080
--- /dev/null
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusReadiness.aidl
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.tuner;
+
+/**
+ * FrontendStatus readiness status.
+ * @hide
+ */
+@VintfStability
+@Backing(type="int")
+enum FrontendStatusReadiness {
+    /**
+     * The FrontendStatus’ readiness status for the given FrontendStatusType is
+     * undefined.
+     */
+    UNDEFINED,
+
+    /**
+     * The FrontendStatus for the given FrontendStatusType is currently
+     * unavailable.
+     */
+    UNAVAILABLE,
+
+    /**
+     * The FrontendStatus for the given FrontendStatusType can be read, but it’s
+     * unstable.
+     */
+    UNSTABLE,
+
+    /**
+     * The FrontendStatus for the given FrontendStatusType can be ready, and it’s
+     * stable.
+     */
+    STABLE,
+
+    /**
+     * The FrontendStatus for the given FrontendStatusType is not supported.
+     */
+    UNSUPPORTED,
+}
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl
index e7da517..8f3f2c5 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl
@@ -130,7 +130,7 @@
     RF_LOCK,
 
     /**
-     * PLP information in a frequency band for ATSC3.0 frontend.
+     * Current tuned PLP information in a frequency band for ATSC3 frontend.
      */
     ATSC3_PLP_INFO,
 
@@ -222,10 +222,16 @@
     /**
      * Stream ID list included in a transponder.
      */
-   STREAM_ID_LIST,
+    STREAM_ID_LIST,
 
-   /**
-    * DVB-T Cell Id.
-    */
-   DVBT_CELL_IDS,
+    /**
+     * DVB-T Cell Id.
+     */
+    DVBT_CELL_IDS,
+
+    /**
+     * All PLP information in a frequency band for ATSC3 frontend, which includes both tuned
+     * and not tuned PLPs for currently watching service.
+     */
+    ATSC3_ALL_PLP_INFO,
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/IFrontend.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/IFrontend.aidl
index 5b3ce39..12f2692 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/IFrontend.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/IFrontend.aidl
@@ -19,6 +19,7 @@
 import android.hardware.tv.tuner.FrontendScanType;
 import android.hardware.tv.tuner.FrontendSettings;
 import android.hardware.tv.tuner.FrontendStatus;
+import android.hardware.tv.tuner.FrontendStatusReadiness;
 import android.hardware.tv.tuner.FrontendStatusType;
 import android.hardware.tv.tuner.IFrontendCallback;
 
@@ -146,4 +147,23 @@
      * @return the frontend hardware information.
      */
     String getHardwareInfo();
+
+    /**
+     * Filter out unnecessary PID from frontend output.
+     *
+     * @param pid specify the PID will be filtered out.
+     *
+     * @return UNAVAILABLE if the frontend doesn’t support PID filtering out.
+     */
+    void removeOutputPid(int pid);
+
+    /**
+     * Gets FrontendStatus’ readiness statuses for given status types.
+     *
+     * @param statusTypes an array of status types.
+     *
+     * @return an array of current readiness statuses. The ith readiness status in
+     *         the array presents fronted type statusTypes[i]’s readiness status.
+     */
+    FrontendStatusReadiness[] getFrontendStatusReadiness(in FrontendStatusType[] statusTypes);
 }
diff --git a/tv/tuner/aidl/default/Frontend.cpp b/tv/tuner/aidl/default/Frontend.cpp
index 714612d..3f7797c 100644
--- a/tv/tuner/aidl/default/Frontend.cpp
+++ b/tv/tuner/aidl/default/Frontend.cpp
@@ -34,6 +34,140 @@
     mTuner = tuner;
     // Init callback to nullptr
     mCallback = nullptr;
+
+    switch (mType) {
+        case FrontendType::ISDBS: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::isdbsCaps>(FrontendIsdbsCapabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::DEMOD_LOCK,
+                    FrontendStatusType::SNR,
+                    FrontendStatusType::FEC,
+                    FrontendStatusType::MODULATION,
+                    FrontendStatusType::MODULATIONS,
+                    FrontendStatusType::ROLL_OFF,
+                    FrontendStatusType::STREAM_ID_LIST,
+            };
+            break;
+        }
+        case FrontendType::ATSC3: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::atsc3Caps>(FrontendAtsc3Capabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::BER,
+                    FrontendStatusType::PER,
+                    FrontendStatusType::ATSC3_PLP_INFO,
+                    FrontendStatusType::MODULATIONS,
+                    FrontendStatusType::BERS,
+                    FrontendStatusType::INTERLEAVINGS,
+                    FrontendStatusType::BANDWIDTH,
+                    FrontendStatusType::ATSC3_ALL_PLP_INFO,
+            };
+            break;
+        }
+        case FrontendType::DVBC: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::dvbcCaps>(FrontendDvbcCapabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::PRE_BER,       FrontendStatusType::SIGNAL_QUALITY,
+                    FrontendStatusType::MODULATION,    FrontendStatusType::SPECTRAL,
+                    FrontendStatusType::MODULATIONS,   FrontendStatusType::CODERATES,
+                    FrontendStatusType::INTERLEAVINGS, FrontendStatusType::BANDWIDTH,
+            };
+            break;
+        }
+        case FrontendType::DVBS: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::dvbsCaps>(FrontendDvbsCapabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::SIGNAL_STRENGTH, FrontendStatusType::SYMBOL_RATE,
+                    FrontendStatusType::MODULATION,      FrontendStatusType::MODULATIONS,
+                    FrontendStatusType::ROLL_OFF,        FrontendStatusType::IS_MISO,
+            };
+            break;
+        }
+        case FrontendType::DVBT: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::dvbtCaps>(FrontendDvbtCapabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::EWBS,
+                    FrontendStatusType::PLP_ID,
+                    FrontendStatusType::HIERARCHY,
+                    FrontendStatusType::MODULATIONS,
+                    FrontendStatusType::BANDWIDTH,
+                    FrontendStatusType::GUARD_INTERVAL,
+                    FrontendStatusType::TRANSMISSION_MODE,
+                    FrontendStatusType::T2_SYSTEM_ID,
+                    FrontendStatusType::DVBT_CELL_IDS,
+            };
+            break;
+        }
+        case FrontendType::ISDBT: {
+            FrontendIsdbtCapabilities isdbtCaps{
+                    .modeCap = (int)FrontendIsdbtMode::MODE_1 | (int)FrontendIsdbtMode::MODE_2,
+                    .bandwidthCap = (int)FrontendIsdbtBandwidth::BANDWIDTH_6MHZ,
+                    .modulationCap = (int)FrontendIsdbtModulation::MOD_16QAM,
+                    .coderateCap = (int)FrontendIsdbtCoderate::CODERATE_4_5 |
+                                   (int)FrontendIsdbtCoderate::CODERATE_6_7,
+                    .guardIntervalCap = (int)FrontendIsdbtGuardInterval::INTERVAL_1_128,
+                    .timeInterleaveCap = (int)FrontendIsdbtTimeInterleaveMode::AUTO |
+                                         (int)FrontendIsdbtTimeInterleaveMode::INTERLEAVE_1_0,
+                    .isSegmentAuto = true,
+                    .isFullSegment = true,
+            };
+            mFrontendCaps.set<FrontendCapabilities::Tag::isdbtCaps>(isdbtCaps);
+            mFrontendStatusCaps = {
+                    FrontendStatusType::AGC,
+                    FrontendStatusType::LNA,
+                    FrontendStatusType::MODULATION,
+                    FrontendStatusType::MODULATIONS,
+                    FrontendStatusType::BANDWIDTH,
+                    FrontendStatusType::GUARD_INTERVAL,
+                    FrontendStatusType::TRANSMISSION_MODE,
+                    FrontendStatusType::ISDBT_SEGMENTS,
+                    FrontendStatusType::ISDBT_MODE,
+                    FrontendStatusType::ISDBT_PARTIAL_RECEPTION_FLAG,
+                    FrontendStatusType::INTERLEAVINGS,
+            };
+            break;
+        }
+        case FrontendType::ANALOG: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::analogCaps>(FrontendAnalogCapabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::LAYER_ERROR,
+                    FrontendStatusType::MER,
+                    FrontendStatusType::UEC,
+                    FrontendStatusType::TS_DATA_RATES,
+            };
+            break;
+        }
+        case FrontendType::ATSC: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::atscCaps>(FrontendAtscCapabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::FREQ_OFFSET,
+                    FrontendStatusType::RF_LOCK,
+                    FrontendStatusType::MODULATIONS,
+                    FrontendStatusType::IS_LINEAR,
+            };
+            break;
+        }
+        case FrontendType::ISDBS3: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::isdbs3Caps>(FrontendIsdbs3Capabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::DEMOD_LOCK,      FrontendStatusType::MODULATION,
+                    FrontendStatusType::MODULATIONS,     FrontendStatusType::ROLL_OFF,
+                    FrontendStatusType::IS_SHORT_FRAMES, FrontendStatusType::STREAM_ID_LIST,
+            };
+            break;
+        }
+        case FrontendType::DTMB: {
+            mFrontendCaps.set<FrontendCapabilities::Tag::dtmbCaps>(FrontendDtmbCapabilities());
+            mFrontendStatusCaps = {
+                    FrontendStatusType::MODULATIONS,       FrontendStatusType::INTERLEAVINGS,
+                    FrontendStatusType::BANDWIDTH,         FrontendStatusType::GUARD_INTERVAL,
+                    FrontendStatusType::TRANSMISSION_MODE,
+            };
+            break;
+        }
+        default: {
+            break;
+        }
+    }
 }
 
 Frontend::~Frontend() {}
@@ -259,6 +393,13 @@
 
     {
         FrontendScanMessage msg;
+        msg.set<FrontendScanMessage::Tag::isLocked>(false);
+        mCallback->onScanMessage(FrontendScanMessageType::LOCKED, msg);
+        mIsLocked = false;
+    }
+
+    {
+        FrontendScanMessage msg;
         msg.set<FrontendScanMessage::Tag::isLocked>(true);
         mCallback->onScanMessage(FrontendScanMessageType::LOCKED, msg);
         mIsLocked = true;
@@ -708,6 +849,20 @@
                 status.set<FrontendStatus::dvbtCellIds>(dvbtCellIds);
                 break;
             }
+            case FrontendStatusType::ATSC3_ALL_PLP_INFO: {
+                FrontendScanAtsc3PlpInfo info1;
+                info1.plpId = 1;
+                info1.bLlsFlag = false;
+                FrontendScanAtsc3PlpInfo info2;
+                info2.plpId = 2;
+                info2.bLlsFlag = true;
+                FrontendScanAtsc3PlpInfo info3;
+                info3.plpId = 3;
+                info3.bLlsFlag = false;
+                vector<FrontendScanAtsc3PlpInfo> infos = {info1, info2, info3};
+                status.set<FrontendStatus::allPlpInfo>(infos);
+                break;
+            }
             default: {
                 continue;
             }
@@ -749,6 +904,10 @@
     dprintf(fd, "    mType: %d\n", mType);
     dprintf(fd, "    mIsLocked: %d\n", mIsLocked);
     dprintf(fd, "    mCiCamId: %d\n", mCiCamId);
+    dprintf(fd, "    mFrontendStatusCaps:");
+    for (int i = 0; i < mFrontendStatusCaps.size(); i++) {
+        dprintf(fd, "        %d\n", mFrontendStatusCaps[i]);
+    }
     return STATUS_OK;
 }
 
@@ -759,6 +918,36 @@
     return ::ndk::ScopedAStatus::ok();
 }
 
+::ndk::ScopedAStatus Frontend::removeOutputPid(int32_t /* in_pid */) {
+    ALOGV("%s", __FUNCTION__);
+
+    return ::ndk::ScopedAStatus::fromServiceSpecificError(
+            static_cast<int32_t>(Result::UNAVAILABLE));
+}
+
+::ndk::ScopedAStatus Frontend::getFrontendStatusReadiness(
+        const std::vector<FrontendStatusType>& in_statusTypes,
+        std::vector<FrontendStatusReadiness>* _aidl_return) {
+    ALOGV("%s", __FUNCTION__);
+
+    _aidl_return->resize(in_statusTypes.size());
+    for (int i = 0; i < in_statusTypes.size(); i++) {
+        int j = 0;
+        while (j < mFrontendStatusCaps.size()) {
+            if (in_statusTypes[i] == mFrontendStatusCaps[j]) {
+                (*_aidl_return)[i] = FrontendStatusReadiness::STABLE;
+                break;
+            }
+            j++;
+        }
+        if (j >= mFrontendStatusCaps.size()) {
+            (*_aidl_return)[i] = FrontendStatusReadiness::UNSUPPORTED;
+        }
+    }
+
+    return ::ndk::ScopedAStatus::ok();
+}
+
 FrontendType Frontend::getFrontendType() {
     return mType;
 }
@@ -776,6 +965,21 @@
     return mIsLocked;
 }
 
+void Frontend::getFrontendInfo(FrontendInfo* _aidl_return) {
+    // assign randomly selected values for testing.
+    *_aidl_return = {
+            .type = mType,
+            .minFrequency = 139000000,
+            .maxFrequency = 1139000000,
+            .minSymbolRate = 45,
+            .maxSymbolRate = 1145,
+            .acquireRange = 30,
+            .exclusiveGroupId = 57,
+            .statusCaps = mFrontendStatusCaps,
+            .frontendCaps = mFrontendCaps,
+    };
+}
+
 }  // namespace tuner
 }  // namespace tv
 }  // namespace hardware
diff --git a/tv/tuner/aidl/default/Frontend.h b/tv/tuner/aidl/default/Frontend.h
index fdedf1e..1d9ab53 100644
--- a/tv/tuner/aidl/default/Frontend.h
+++ b/tv/tuner/aidl/default/Frontend.h
@@ -50,6 +50,10 @@
     ::ndk::ScopedAStatus linkCiCam(int32_t in_ciCamId, int32_t* _aidl_return) override;
     ::ndk::ScopedAStatus unlinkCiCam(int32_t in_ciCamId) override;
     ::ndk::ScopedAStatus getHardwareInfo(std::string* _aidl_return) override;
+    ::ndk::ScopedAStatus removeOutputPid(int32_t in_pid) override;
+    ::ndk::ScopedAStatus getFrontendStatusReadiness(
+            const std::vector<FrontendStatusType>& in_statusTypes,
+            std::vector<FrontendStatusReadiness>* _aidl_return) override;
 
     binder_status_t dump(int fd, const char** args, uint32_t numArgs) override;
 
@@ -57,6 +61,7 @@
     int32_t getFrontendId();
     string getSourceFile();
     bool isLocked();
+    void getFrontendInfo(FrontendInfo* _aidl_return);
 
   private:
     virtual ~Frontend();
@@ -73,6 +78,8 @@
     FrontendSettings mFrontendSettings;
     FrontendScanType mFrontendScanType;
     std::ifstream mFrontendData;
+    FrontendCapabilities mFrontendCaps;
+    vector<FrontendStatusType> mFrontendStatusCaps;
 };
 
 }  // namespace tuner
diff --git a/tv/tuner/aidl/default/Tuner.cpp b/tv/tuner/aidl/default/Tuner.cpp
index 48c1b66..fa74288 100644
--- a/tv/tuner/aidl/default/Tuner.cpp
+++ b/tv/tuner/aidl/default/Tuner.cpp
@@ -49,153 +49,15 @@
     mFrontends[8] = ndk::SharedRefBase::make<Frontend>(FrontendType::ISDBS3, 8, this->ref<Tuner>());
     mFrontends[9] = ndk::SharedRefBase::make<Frontend>(FrontendType::DTMB, 9, this->ref<Tuner>());
 
-    vector<FrontendStatusType> statusCaps;
-
-    FrontendCapabilities capsIsdbs;
-    capsIsdbs.set<FrontendCapabilities::Tag::isdbsCaps>(FrontendIsdbsCapabilities());
-    mFrontendCaps[0] = capsIsdbs;
-    statusCaps = {
-            FrontendStatusType::DEMOD_LOCK,
-            FrontendStatusType::SNR,
-            FrontendStatusType::FEC,
-            FrontendStatusType::MODULATION,
-            FrontendStatusType::MODULATIONS,
-            FrontendStatusType::ROLL_OFF,
-            FrontendStatusType::STREAM_ID_LIST,
-    };
-    mFrontendStatusCaps[0] = statusCaps;
     mMaxUsableFrontends[FrontendType::ISDBS] = 1;
-
-    FrontendCapabilities capsAtsc3;
-    capsAtsc3.set<FrontendCapabilities::Tag::atsc3Caps>(FrontendAtsc3Capabilities());
-    mFrontendCaps[1] = capsAtsc3;
-    statusCaps = {
-            FrontendStatusType::BER,
-            FrontendStatusType::PER,
-            FrontendStatusType::ATSC3_PLP_INFO,
-            FrontendStatusType::MODULATIONS,
-            FrontendStatusType::BERS,
-            FrontendStatusType::INTERLEAVINGS,
-            FrontendStatusType::BANDWIDTH,
-    };
-    mFrontendStatusCaps[1] = statusCaps;
     mMaxUsableFrontends[FrontendType::ATSC3] = 1;
-
-    FrontendCapabilities capsDvbc;
-    capsDvbc.set<FrontendCapabilities::Tag::dvbcCaps>(FrontendDvbcCapabilities());
-    mFrontendCaps[2] = capsDvbc;
-    statusCaps = {
-            FrontendStatusType::PRE_BER,       FrontendStatusType::SIGNAL_QUALITY,
-            FrontendStatusType::MODULATION,    FrontendStatusType::SPECTRAL,
-            FrontendStatusType::MODULATIONS,   FrontendStatusType::CODERATES,
-            FrontendStatusType::INTERLEAVINGS, FrontendStatusType::BANDWIDTH,
-    };
-    mFrontendStatusCaps[2] = statusCaps;
     mMaxUsableFrontends[FrontendType::DVBC] = 1;
-
-    FrontendCapabilities capsDvbs;
-    capsDvbs.set<FrontendCapabilities::Tag::dvbsCaps>(FrontendDvbsCapabilities());
-    mFrontendCaps[3] = capsDvbs;
-    statusCaps = {
-            FrontendStatusType::SIGNAL_STRENGTH, FrontendStatusType::SYMBOL_RATE,
-            FrontendStatusType::MODULATION,      FrontendStatusType::MODULATIONS,
-            FrontendStatusType::ROLL_OFF,        FrontendStatusType::IS_MISO,
-    };
-    mFrontendStatusCaps[3] = statusCaps;
     mMaxUsableFrontends[FrontendType::DVBS] = 1;
-
-    FrontendCapabilities capsDvbt;
-    capsDvbt.set<FrontendCapabilities::Tag::dvbtCaps>(FrontendDvbtCapabilities());
-    mFrontendCaps[4] = capsDvbt;
-    statusCaps = {
-            FrontendStatusType::EWBS,
-            FrontendStatusType::PLP_ID,
-            FrontendStatusType::HIERARCHY,
-            FrontendStatusType::MODULATIONS,
-            FrontendStatusType::BANDWIDTH,
-            FrontendStatusType::GUARD_INTERVAL,
-            FrontendStatusType::TRANSMISSION_MODE,
-            FrontendStatusType::T2_SYSTEM_ID,
-            FrontendStatusType::DVBT_CELL_IDS,
-    };
-    mFrontendStatusCaps[4] = statusCaps;
     mMaxUsableFrontends[FrontendType::DVBT] = 1;
-
-    FrontendCapabilities capsIsdbt;
-    FrontendIsdbtCapabilities isdbtCaps{
-            .modeCap = (int)FrontendIsdbtMode::MODE_1 | (int)FrontendIsdbtMode::MODE_2,
-            .bandwidthCap = (int)FrontendIsdbtBandwidth::BANDWIDTH_6MHZ,
-            .modulationCap = (int)FrontendIsdbtModulation::MOD_16QAM,
-            .coderateCap = (int)FrontendIsdbtCoderate::CODERATE_4_5 |
-                           (int)FrontendIsdbtCoderate::CODERATE_6_7,
-            .guardIntervalCap = (int)FrontendIsdbtGuardInterval::INTERVAL_1_128,
-            .timeInterleaveCap = (int)FrontendIsdbtTimeInterleaveMode::AUTO |
-                                 (int)FrontendIsdbtTimeInterleaveMode::INTERLEAVE_1_0,
-            .isSegmentAuto = true,
-            .isFullSegment = true,
-    };
-    capsIsdbt.set<FrontendCapabilities::Tag::isdbtCaps>(isdbtCaps);
-    mFrontendCaps[5] = capsIsdbt;
-    statusCaps = {
-            FrontendStatusType::AGC,
-            FrontendStatusType::LNA,
-            FrontendStatusType::MODULATION,
-            FrontendStatusType::MODULATIONS,
-            FrontendStatusType::BANDWIDTH,
-            FrontendStatusType::GUARD_INTERVAL,
-            FrontendStatusType::TRANSMISSION_MODE,
-            FrontendStatusType::ISDBT_SEGMENTS,
-            FrontendStatusType::ISDBT_MODE,
-            FrontendStatusType::ISDBT_PARTIAL_RECEPTION_FLAG,
-            FrontendStatusType::INTERLEAVINGS,
-    };
-    mFrontendStatusCaps[5] = statusCaps;
     mMaxUsableFrontends[FrontendType::ISDBT] = 1;
-
-    FrontendCapabilities capsAnalog;
-    capsAnalog.set<FrontendCapabilities::Tag::analogCaps>(FrontendAnalogCapabilities());
-    mFrontendCaps[6] = capsAnalog;
-    statusCaps = {
-            FrontendStatusType::LAYER_ERROR,
-            FrontendStatusType::MER,
-            FrontendStatusType::UEC,
-            FrontendStatusType::TS_DATA_RATES,
-    };
-    mFrontendStatusCaps[6] = statusCaps;
     mMaxUsableFrontends[FrontendType::ANALOG] = 1;
-
-    FrontendCapabilities capsAtsc;
-    capsAtsc.set<FrontendCapabilities::Tag::atscCaps>(FrontendAtscCapabilities());
-    mFrontendCaps[7] = capsAtsc;
-    statusCaps = {
-            FrontendStatusType::FREQ_OFFSET,
-            FrontendStatusType::RF_LOCK,
-            FrontendStatusType::MODULATIONS,
-            FrontendStatusType::IS_LINEAR,
-    };
-    mFrontendStatusCaps[7] = statusCaps;
     mMaxUsableFrontends[FrontendType::ATSC] = 1;
-
-    FrontendCapabilities capsIsdbs3;
-    capsIsdbs3.set<FrontendCapabilities::Tag::isdbs3Caps>(FrontendIsdbs3Capabilities());
-    mFrontendCaps[8] = capsIsdbs3;
-    statusCaps = {
-            FrontendStatusType::DEMOD_LOCK,      FrontendStatusType::MODULATION,
-            FrontendStatusType::MODULATIONS,     FrontendStatusType::ROLL_OFF,
-            FrontendStatusType::IS_SHORT_FRAMES, FrontendStatusType::STREAM_ID_LIST,
-    };
-    mFrontendStatusCaps[8] = statusCaps;
     mMaxUsableFrontends[FrontendType::ISDBS3] = 1;
-
-    FrontendCapabilities capsDtmb;
-    capsDtmb.set<FrontendCapabilities::Tag::dtmbCaps>(FrontendDtmbCapabilities());
-    mFrontendCaps[9] = capsDtmb;
-    statusCaps = {
-            FrontendStatusType::MODULATIONS,       FrontendStatusType::INTERLEAVINGS,
-            FrontendStatusType::BANDWIDTH,         FrontendStatusType::GUARD_INTERVAL,
-            FrontendStatusType::TRANSMISSION_MODE,
-    };
-    mFrontendStatusCaps[9] = statusCaps;
     mMaxUsableFrontends[FrontendType::DTMB] = 1;
 
     mLnbs.resize(2);
@@ -266,24 +128,12 @@
 ::ndk::ScopedAStatus Tuner::getFrontendInfo(int32_t in_frontendId, FrontendInfo* _aidl_return) {
     ALOGV("%s", __FUNCTION__);
 
-    if (in_frontendId >= mFrontendSize) {
+    if (in_frontendId < 0 || in_frontendId >= mFrontendSize) {
         return ::ndk::ScopedAStatus::fromServiceSpecificError(
                 static_cast<int32_t>(Result::INVALID_ARGUMENT));
     }
 
-    // assign randomly selected values for testing.
-    *_aidl_return = {
-            .type = mFrontends[in_frontendId]->getFrontendType(),
-            .minFrequency = 139000000,
-            .maxFrequency = 1139000000,
-            .minSymbolRate = 45,
-            .maxSymbolRate = 1145,
-            .acquireRange = 30,
-            .exclusiveGroupId = 57,
-            .statusCaps = mFrontendStatusCaps[in_frontendId],
-            .frontendCaps = mFrontendCaps[in_frontendId],
-    };
-
+    mFrontends[in_frontendId]->getFrontendInfo(_aidl_return);
     return ::ndk::ScopedAStatus::ok();
 }
 
@@ -359,9 +209,6 @@
         dprintf(fd, "Frontends:\n");
         for (int i = 0; i < mFrontendSize; i++) {
             mFrontends[i]->dump(fd, args, numArgs);
-            for (int j = 0; j < mFrontendStatusCaps[i].size(); j++) {
-                dprintf(fd, "    statusCap: %d\n", mFrontendStatusCaps[i][j]);
-            }
         }
     }
     {
diff --git a/tv/tuner/aidl/default/Tuner.h b/tv/tuner/aidl/default/Tuner.h
index 216a2b6..ad73003 100644
--- a/tv/tuner/aidl/default/Tuner.h
+++ b/tv/tuner/aidl/default/Tuner.h
@@ -75,8 +75,6 @@
   private:
     // Static mFrontends array to maintain local frontends information
     map<int32_t, std::shared_ptr<Frontend>> mFrontends;
-    map<int32_t, FrontendCapabilities> mFrontendCaps;
-    map<int32_t, vector<FrontendStatusType>> mFrontendStatusCaps;
     map<int32_t, int32_t> mFrontendToDemux;
     map<int32_t, std::shared_ptr<Demux>> mDemuxes;
     // To maintain how many Frontends we have
diff --git a/tv/tuner/aidl/vts/functional/FrontendTests.cpp b/tv/tuner/aidl/vts/functional/FrontendTests.cpp
index 41e98ea..a1f51df 100644
--- a/tv/tuner/aidl/vts/functional/FrontendTests.cpp
+++ b/tv/tuner/aidl/vts/functional/FrontendTests.cpp
@@ -298,6 +298,13 @@
     return AssertionResult(status.isOk());
 }
 
+AssertionResult FrontendTests::removeOutputPid(int32_t removePid) {
+    ndk::ScopedAStatus status;
+    status = mFrontend->removeOutputPid(removePid);
+    return AssertionResult(status.isOk() || status.getServiceSpecificError() ==
+                                                    static_cast<int32_t>(Result::UNAVAILABLE));
+}
+
 AssertionResult FrontendTests::unlinkCiCam(int32_t ciCamId) {
     ndk::ScopedAStatus status = mFrontend->unlinkCiCam(ciCamId);
     return AssertionResult(status.isOk());
@@ -414,6 +421,13 @@
                         expectStatuses[i].get<FrontendStatus::Tag::dvbtCellIds>().begin()));
                 break;
             }
+            case FrontendStatusType::ATSC3_ALL_PLP_INFO: {
+                ASSERT_TRUE(std::equal(
+                        realStatuses[i].get<FrontendStatus::Tag::allPlpInfo>().begin(),
+                        realStatuses[i].get<FrontendStatus::Tag::allPlpInfo>().end(),
+                        expectStatuses[i].get<FrontendStatus::Tag::allPlpInfo>().begin()));
+                break;
+            }
             default: {
                 continue;
             }
@@ -501,6 +515,7 @@
     ASSERT_TRUE(setFrontendCallback());
     if (frontendConf.canConnectToCiCam) {
         ASSERT_TRUE(linkCiCam(frontendConf.ciCamId));
+        ASSERT_TRUE(removeOutputPid(frontendConf.removePid));
         ASSERT_TRUE(unlinkCiCam(frontendConf.ciCamId));
     }
     ASSERT_TRUE(tuneFrontend(frontendConf, false /*testWithDemux*/));
@@ -566,3 +581,47 @@
     ASSERT_TRUE(stopScanFrontend());
     ASSERT_TRUE(closeFrontend());
 }
+
+void FrontendTests::statusReadinessTest(FrontendConfig frontendConf) {
+    int32_t feId;
+    vector<FrontendStatusType> allTypes;
+    vector<FrontendStatusReadiness> readiness;
+    getFrontendIdByType(frontendConf.type, feId);
+    ASSERT_TRUE(feId != INVALID_ID);
+    ASSERT_TRUE(openFrontendById(feId));
+    ASSERT_TRUE(setFrontendCallback());
+    if (frontendConf.canConnectToCiCam) {
+        ASSERT_TRUE(linkCiCam(frontendConf.ciCamId));
+        ASSERT_TRUE(removeOutputPid(frontendConf.removePid));
+        ASSERT_TRUE(unlinkCiCam(frontendConf.ciCamId));
+    }
+    ASSERT_TRUE(getFrontendInfo(feId));
+    ASSERT_TRUE(tuneFrontend(frontendConf, false /*testWithDemux*/));
+
+    // TODO: find a better way to push all frontend status types
+    for (int32_t i = 0; i < static_cast<int32_t>(FrontendStatusType::ATSC3_ALL_PLP_INFO); i++) {
+        allTypes.push_back(static_cast<FrontendStatusType>(i));
+    }
+    ndk::ScopedAStatus status = mFrontend->getFrontendStatusReadiness(allTypes, &readiness);
+    ASSERT_TRUE(status.isOk());
+    ASSERT_TRUE(readiness.size() == allTypes.size());
+    for (int32_t i = 0; i < readiness.size(); i++) {
+        int32_t j = 0;
+        while (j < mFrontendInfo.statusCaps.size()) {
+            if (allTypes[i] == mFrontendInfo.statusCaps[j]) {
+                ASSERT_TRUE(readiness[i] == FrontendStatusReadiness::UNAVAILABLE ||
+                            readiness[i] == FrontendStatusReadiness::UNSTABLE ||
+                            readiness[i] == FrontendStatusReadiness::STABLE);
+                break;
+            }
+            j++;
+        }
+
+        if (j >= mFrontendInfo.statusCaps.size()) {
+            ASSERT_TRUE(readiness[i] == FrontendStatusReadiness::UNSUPPORTED);
+        }
+    }
+
+    ASSERT_TRUE(stopTuneFrontend(false /*testWithDemux*/));
+    ASSERT_TRUE(closeFrontend());
+}
diff --git a/tv/tuner/aidl/vts/functional/FrontendTests.h b/tv/tuner/aidl/vts/functional/FrontendTests.h
index 1745f76..1746c8e 100644
--- a/tv/tuner/aidl/vts/functional/FrontendTests.h
+++ b/tv/tuner/aidl/vts/functional/FrontendTests.h
@@ -95,12 +95,14 @@
     AssertionResult linkCiCam(int32_t ciCamId);
     AssertionResult unlinkCiCam(int32_t ciCamId);
     AssertionResult verifyHardwareInfo();
+    AssertionResult removeOutputPid(int32_t removePid);
 
     void getFrontendIdByType(FrontendType feType, int32_t& feId);
     void tuneTest(FrontendConfig frontendConf);
     void scanTest(FrontendConfig frontend, FrontendScanType type);
     void debugInfoTest(FrontendConfig frontendConf);
     void maxNumberOfFrontendsTest();
+    void statusReadinessTest(FrontendConfig frontendConf);
 
     void setDvrTests(DvrTests* dvrTests) { mExternalDvrTests = dvrTests; }
     void setDemux(std::shared_ptr<IDemux> demux) { getDvrTests()->setDemux(demux); }
diff --git a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp
index 0566089..c99da41 100644
--- a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp
+++ b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp
@@ -907,6 +907,14 @@
     mFrontendTests.maxNumberOfFrontendsTest();
 }
 
+TEST_P(TunerFrontendAidlTest, statusReadinessTest) {
+    description("Test Max Frontend status readiness");
+    if (!live.hasFrontendConnection) {
+        return;
+    }
+    mFrontendTests.statusReadinessTest(frontendMap[live.frontendId]);
+}
+
 TEST_P(TunerBroadcastAidlTest, BroadcastDataFlowVideoFilterTest) {
     description("Test Video Filter functionality in Broadcast use case.");
     if (!live.hasFrontendConnection) {
diff --git a/tv/tuner/config/TunerTestingConfigAidlReaderV1_0.h b/tv/tuner/config/TunerTestingConfigAidlReaderV1_0.h
index b73d594..3009c4a 100644
--- a/tv/tuner/config/TunerTestingConfigAidlReaderV1_0.h
+++ b/tv/tuner/config/TunerTestingConfigAidlReaderV1_0.h
@@ -83,6 +83,7 @@
     FrontendType type;
     bool canConnectToCiCam;
     int32_t ciCamId;
+    int32_t removePid;
     FrontendSettings settings;
     vector<FrontendStatusType> tuneStatusTypes;
     vector<FrontendStatus> expectTuneStatuses;
@@ -304,7 +305,8 @@
                 // TODO: b/182519645 complete the tune status config
                 frontendMap[id].tuneStatusTypes = types;
                 frontendMap[id].expectTuneStatuses = statuses;
-                getCiCamInfo(feConfig, frontendMap[id].canConnectToCiCam, frontendMap[id].ciCamId);
+                getCiCamInfo(feConfig, frontendMap[id].canConnectToCiCam, frontendMap[id].ciCamId,
+                             frontendMap[id].removePid);
             }
         }
     }
@@ -1004,13 +1006,16 @@
         return recordSettings;
     }
 
-    static void getCiCamInfo(Frontend feConfig, bool& canConnectToCiCam, int32_t& ciCamId) {
+    static void getCiCamInfo(Frontend feConfig, bool& canConnectToCiCam, int32_t& ciCamId,
+                             int32_t& removePid) {
         if (!feConfig.hasConnectToCicamId()) {
             canConnectToCiCam = false;
             ciCamId = -1;
+            removePid = -1;
             return;
         }
         canConnectToCiCam = true;
         ciCamId = static_cast<int32_t>(feConfig.getConnectToCicamId());
+        removePid = static_cast<int32_t>(feConfig.getRemoveOutputPid());
     }
 };
diff --git a/tv/tuner/config/api/current.txt b/tv/tuner/config/api/current.txt
index 4d519d7..383d49f 100644
--- a/tv/tuner/config/api/current.txt
+++ b/tv/tuner/config/api/current.txt
@@ -317,6 +317,7 @@
     method @Nullable public java.math.BigInteger getFrequency();
     method @Nullable public String getId();
     method @Nullable public boolean getIsSoftwareFrontend();
+    method @Nullable public java.math.BigInteger getRemoveOutputPid();
     method @Nullable public android.media.tuner.testing.configuration.V1_0.FrontendTypeEnum getType();
     method public void setConnectToCicamId(@Nullable java.math.BigInteger);
     method public void setDvbsFrontendSettings_optional(@Nullable android.media.tuner.testing.configuration.V1_0.DvbsFrontendSettings);
@@ -325,6 +326,7 @@
     method public void setFrequency(@Nullable java.math.BigInteger);
     method public void setId(@Nullable String);
     method public void setIsSoftwareFrontend(@Nullable boolean);
+    method public void setRemoveOutputPid(@Nullable java.math.BigInteger);
     method public void setType(@Nullable android.media.tuner.testing.configuration.V1_0.FrontendTypeEnum);
   }
 
diff --git a/tv/tuner/config/sample_tuner_vts_config_aidl_V1.xml b/tv/tuner/config/sample_tuner_vts_config_aidl_V1.xml
index da77200..fefe86e 100644
--- a/tv/tuner/config/sample_tuner_vts_config_aidl_V1.xml
+++ b/tv/tuner/config/sample_tuner_vts_config_aidl_V1.xml
@@ -42,6 +42,8 @@
                 "softwareFeInputPath": used as the source of the software frontend.
                 "connectToCicamId": if the device supports frontend connecting to cicam, the target
                     cicam id needs to be configured here. Supported in Tuner 1.1 or higher.
+                "removeOutputPid": the unnecessary PID will be filtered out from frontend
+                    output. Supported in Tuner 2.0 or higher.
                 "frequency": the frequency used to configure tune and scan.
                 "endFrequency": the end frequency of scan. Supported in Tuner 1.1 or higher.
 
@@ -53,11 +55,13 @@
         -->
         <frontends>
             <frontend id="FE_DEFAULT" type="DVBT" isSoftwareFrontend="true"
-                      connectToCicamId="0" frequency="578000000" endFrequency="800000000">
+                      connectToCicamId="0" removeOutputPid="10" frequency="578000000"
+                      endFrequency="800000000">
                 <dvbtFrontendSettings bandwidth="8" transmissionMode="128" isHighPriority="1"/>
             </frontend>
             <frontend id="FE_DVBS_0" type="DVBS" isSoftwareFrontend="true"
-                      connectToCicamId="0" frequency="578000000" endFrequency="800000000">
+                      connectToCicamId="0" removeOutputPid="10" frequency="578000000"
+                      endFrequency="800000000">
             </frontend>
         </frontends>
         <!-- Filter section:
diff --git a/tv/tuner/config/tuner_testing_dynamic_configuration.xsd b/tv/tuner/config/tuner_testing_dynamic_configuration.xsd
index 94f108b..59abd9a 100644
--- a/tv/tuner/config/tuner_testing_dynamic_configuration.xsd
+++ b/tv/tuner/config/tuner_testing_dynamic_configuration.xsd
@@ -94,6 +94,8 @@
                     "connectToCicamId": if the device supports frontend connecting to cicam, the
                         target cicam id needs to be configured here. Supported in Tuner 1.1 or
                         higher.
+                    "removeOutputPid": the unnecessary PID will be filtered out from frontend
+                        output. Supported in Tuner 2.0 or higher.
                     "frequency": the frequency used to configure tune and scan.
                     "endFrequency": the end frequency of scan. Supported in Tuner 1.1 or higher.
 
@@ -125,6 +127,7 @@
         <xs:attribute name="isSoftwareFrontend" type="xs:boolean" use="required"/>
         <xs:attribute name="frequency" type="xs:nonNegativeInteger" use="required"/>
         <xs:attribute name="connectToCicamId" type="xs:nonNegativeInteger" use="optional"/>
+        <xs:attribute name="removeOutputPid" type="xs:nonNegativeInteger" use="optional"/>
         <xs:attribute name="endFrequency" type="xs:nonNegativeInteger" use="optional"/>
     </xs:complexType>
 
diff --git a/usb/aidl/Android.bp b/usb/aidl/Android.bp
new file mode 100644
index 0000000..d1e9e68
--- /dev/null
+++ b/usb/aidl/Android.bp
@@ -0,0 +1,33 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+aidl_interface {
+    name: "android.hardware.usb",
+    vendor_available: true,
+    srcs: ["android/hardware/usb/*.aidl"],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            sdk_version: "module_current",
+        },
+        ndk: {
+            vndk: {
+                enabled: true,
+            },
+        },
+    },
+}
diff --git a/usb/aidl/OWNERS b/usb/aidl/OWNERS
new file mode 100644
index 0000000..fefae56
--- /dev/null
+++ b/usb/aidl/OWNERS
@@ -0,0 +1 @@
+badhri@google.com
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantDetectionStatus.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantDetectionStatus.aidl
index 4f29c0b..24c6966 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantDetectionStatus.aidl
@@ -31,9 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+enum ContaminantDetectionStatus {
+  NOT_SUPPORTED = 0,
+  DISABLED = 1,
+  NOT_DETECTED = 2,
+  DETECTED = 3,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionMode.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionMode.aidl
index 4f29c0b..9979869 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionMode.aidl
@@ -31,9 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+enum ContaminantProtectionMode {
+  NONE = 0,
+  FORCE_SINK = 1,
+  FORCE_SOURCE = 2,
+  FORCE_DISABLE = 3,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionStatus.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionStatus.aidl
index 4f29c0b..9642261 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionStatus.aidl
@@ -31,9 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+enum ContaminantProtectionStatus {
+  NONE = 0,
+  FORCE_SINK = 1,
+  FORCE_SOURCE = 2,
+  FORCE_DISABLE = 3,
+  DISABLED = 4,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsb.aidl
similarity index 70%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsb.aidl
index 4f29c0b..f866c1e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsb.aidl
@@ -31,9 +31,15 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+interface IUsb {
+  oneway void enableContaminantPresenceDetection(in String portName, in boolean enable, long transactionId);
+  oneway void enableUsbData(in String portName, boolean enable, long transactionId);
+  oneway void enableUsbDataWhileDocked(in String portName, long transactionId);
+  oneway void queryPortStatus(long transactionId);
+  oneway void setCallback(in android.hardware.usb.IUsbCallback callback);
+  oneway void switchRole(in String portName, in android.hardware.usb.PortRole role, long transactionId);
+  oneway void limitPowerTransfer(in String portName, boolean limit, long transactionId);
+  oneway void resetUsbPort(in String portName,long transactionId);
 }
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsbCallback.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsbCallback.aidl
new file mode 100644
index 0000000..4abfaec
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsbCallback.aidl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+interface IUsbCallback {
+  oneway void notifyPortStatusChange(in android.hardware.usb.PortStatus[] currentPortStatus, in android.hardware.usb.Status retval);
+  oneway void notifyRoleSwitchStatus(in String portName, in android.hardware.usb.PortRole newRole, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyEnableUsbDataStatus(in String portName, boolean enable, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyEnableUsbDataWhileDockedStatus(in String portName, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyContaminantEnabledStatus(in String portName, boolean enable, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyQueryPortStatus(in String portName, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyLimitPowerTransferStatus(in String portName, boolean limit, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyResetUsbPortStatus(in String portName, in android.hardware.usb.Status retval, long transactionId);
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortDataRole.aidl
similarity index 93%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortDataRole.aidl
index 4f29c0b..105b316 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortDataRole.aidl
@@ -31,9 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+enum PortDataRole {
+  NONE = 0,
+  HOST = 1,
+  DEVICE = 2,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortMode.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortMode.aidl
index 4f29c0b..34e4334 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortMode.aidl
@@ -31,9 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+enum PortMode {
+  NONE = 0,
+  UFP = 1,
+  DFP = 2,
+  DRP = 3,
+  AUDIO_ACCESSORY = 4,
+  DEBUG_ACCESSORY = 5,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortPowerRole.aidl
similarity index 93%
copy from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortPowerRole.aidl
index 4f29c0b..0e6f3fb 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortPowerRole.aidl
@@ -31,9 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+enum PortPowerRole {
+  NONE = 0,
+  SOURCE = 1,
+  SINK = 2,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortRole.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortRole.aidl
index 5395b11..c66aecc 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortRole.aidl
@@ -31,13 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
-@Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+package android.hardware.usb;
+@VintfStability
+union PortRole {
+  android.hardware.usb.PortPowerRole powerRole = android.hardware.usb.PortPowerRole.NONE;
+  android.hardware.usb.PortDataRole dataRole;
+  android.hardware.usb.PortMode mode;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortStatus.aidl
similarity index 60%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortStatus.aidl
index 5395b11..dfd99fb 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortStatus.aidl
@@ -31,13 +31,23 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
-@Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+package android.hardware.usb;
+@VintfStability
+parcelable PortStatus {
+  String portName;
+  android.hardware.usb.PortDataRole currentDataRole = android.hardware.usb.PortDataRole.NONE;
+  android.hardware.usb.PortPowerRole currentPowerRole = android.hardware.usb.PortPowerRole.NONE;
+  android.hardware.usb.PortMode currentMode = android.hardware.usb.PortMode.NONE;
+  boolean canChangeMode;
+  boolean canChangeDataRole;
+  boolean canChangePowerRole;
+  android.hardware.usb.PortMode[] supportedModes;
+  android.hardware.usb.ContaminantProtectionMode[] supportedContaminantProtectionModes;
+  boolean supportsEnableContaminantPresenceProtection;
+  android.hardware.usb.ContaminantProtectionStatus contaminantProtectionStatus = android.hardware.usb.ContaminantProtectionStatus.NONE;
+  boolean supportsEnableContaminantPresenceDetection;
+  android.hardware.usb.ContaminantDetectionStatus contaminantDetectionStatus = android.hardware.usb.ContaminantDetectionStatus.NOT_SUPPORTED;
+  android.hardware.usb.UsbDataStatus[] usbDataStatus;
+  boolean powerTransferLimited;
+  android.hardware.usb.PowerBrickStatus powerBrickStatus;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PowerBrickStatus.aidl
similarity index 93%
rename from radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
rename to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PowerBrickStatus.aidl
index 4f29c0b..01d2fdd 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PowerBrickStatus.aidl
@@ -31,9 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 @VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
+enum PowerBrickStatus {
+  UNKNOWN = 0,
+  CONNECTED = 1,
+  NOT_CONNECTED = 2,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/Status.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/Status.aidl
index 5395b11..f28fc2a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/Status.aidl
@@ -31,13 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
+package android.hardware.usb;
 @Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
+enum Status {
+  SUCCESS = 0,
+  ERROR = 1,
+  INVALID_ARGUMENT = 2,
+  UNRECOGNIZED_ROLE = 3,
   NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/UsbDataStatus.aidl
similarity index 88%
copy from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/UsbDataStatus.aidl
index 5395b11..e2c0cfb 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/UsbDataStatus.aidl
@@ -31,13 +31,14 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
-@Backing(type="int") @VintfStability
-enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+package android.hardware.usb;
+@VintfStability
+enum UsbDataStatus {
+  UNKNOWN = 0,
+  ENABLED = 1,
+  DISABLED_OVERHEAT = 2,
+  DISABLED_CONTAMINANT = 3,
+  DISABLED_DOCK = 4,
+  DISABLED_FORCE = 5,
+  DISABLED_DEBUG = 6,
 }
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/android/hardware/usb/ContaminantDetectionStatus.aidl
similarity index 62%
copy from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/android/hardware/usb/ContaminantDetectionStatus.aidl
index c3c111e..d9bc576 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/android/hardware/usb/ContaminantDetectionStatus.aidl
@@ -14,33 +14,24 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.usb;
 
 @VintfStability
-@Backing(type="int")
-enum UssdModeType {
+enum ContaminantDetectionStatus {
     /**
-     * USSD-Notify
+     * Contaminant presence detection is not supported.
      */
-    NOTIFY,
+    NOT_SUPPORTED = 0,
     /**
-     * USSD-Request
+     * Contaminant presence detection is supported but disabled.
      */
-    REQUEST,
+    DISABLED = 1,
     /**
-     * Session terminated by network
+     * Contaminant presence detection is enabled and contaminant not detected.
      */
-    NW_RELEASE,
+    NOT_DETECTED = 2,
     /**
-     * Other local client (eg, SIM Toolkit) has responded
+     * Contaminant presence detection is enabled and contaminant detected.
      */
-    LOCAL_CLIENT,
-    /**
-     * Operation not supported
-     */
-    NOT_SUPPORTED,
-    /**
-     * Network timeout
-     */
-    NW_TIMEOUT,
+    DETECTED = 3,
 }
diff --git a/usb/aidl/android/hardware/usb/ContaminantProtectionMode.aidl b/usb/aidl/android/hardware/usb/ContaminantProtectionMode.aidl
new file mode 100644
index 0000000..47c073d
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/ContaminantProtectionMode.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum ContaminantProtectionMode {
+    /**
+     * No action performed upon detection of contaminant presence.
+     */
+    NONE = 0,
+    /**
+     * Upon detection of contaminant presence, Port is forced to sink only
+     * mode where a port shall only detect chargers until contaminant presence
+     * is no longer detected.
+     */
+    FORCE_SINK = 1,
+    /**
+     * Upon detection of contaminant presence, Port is forced to source only
+     * mode where a port shall only detect usb accessories such as headsets
+     * until contaminant presence is no longer detected.
+     */
+    FORCE_SOURCE = 2,
+    /**
+     * Upon detection of contaminant presence, port is disabled until contaminant
+     * presence is no longer detected. In the disabled state port will
+     * not respond to connection of chargers or usb accessories.
+     */
+    FORCE_DISABLE = 3,
+}
diff --git a/usb/aidl/android/hardware/usb/ContaminantProtectionStatus.aidl b/usb/aidl/android/hardware/usb/ContaminantProtectionStatus.aidl
new file mode 100644
index 0000000..c4fa979
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/ContaminantProtectionStatus.aidl
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.ContaminantProtectionMode;
+
+@VintfStability
+enum ContaminantProtectionStatus {
+    /**
+     * No action performed upon detection of contaminant presence.
+     */
+    NONE = 0,
+    /**
+     * Upon detection of contaminant presence, Port is forced to sink only
+     * mode where a port shall only detect chargers until contaminant presence
+     * is no longer detected.
+     */
+    FORCE_SINK = 1,
+    /**
+     * Upon detection of contaminant presence, Port is forced to source only
+     * mode where a port shall only detect usb accessories such as headsets
+     * until contaminant presence is no longer detected.
+     */
+    FORCE_SOURCE = 2,
+    /**
+     * Upon detection of contaminant presence, port is disabled until contaminant
+     * presence is no longer detected. In the disabled state port will
+     * not respond to connection of chargers or usb accessories.
+     */
+    FORCE_DISABLE = 3,
+    /**
+     * Client disabled cotaminant protection by calling
+     * enableContaminantPresencePortProtection set to false. Low level drivers should
+     * not autmomously take any corrective action when contaminant presence is detected.
+     */
+    DISABLED = 4,
+}
diff --git a/usb/aidl/android/hardware/usb/IUsb.aidl b/usb/aidl/android/hardware/usb/IUsb.aidl
new file mode 100644
index 0000000..90ad115
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/IUsb.aidl
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.IUsbCallback;
+import android.hardware.usb.PortRole;
+
+@VintfStability
+oneway interface IUsb {
+    /**
+     * When supportsEnableContaminantPresenceDetection is true,
+     * enableContaminantPresenceDetection enables/disables contaminant
+     * presence detection algorithm. Calling enableContaminantPresenceDetection
+     * when supportsEnableContaminantPresenceDetection is false does
+     * not have any effect.
+     * Change in contantaminant presence status should be notified to the
+     * client via notifyPortStatusChange through PortStatus.
+     *
+     * @param portName name of the port.
+     * @param enable true Enable contaminant presence detection algorithm.
+     *               false Disable contaminant presence detection algorithm.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void enableContaminantPresenceDetection(in String portName, in boolean enable, long transactionId);
+
+    /**
+     * This function is used to enable/disable USB data controller.
+     *
+     * @param portName Name of the port.
+     * @param enable   true Enable USB data signaling.
+     *                 false Disable USB data signaling.
+     * @param transactionId ID to be used when invoking the callback.
+     *
+     */
+    void enableUsbData(in String portName, boolean enable, long transactionId);
+
+    /**
+     * This function is used to enable USB controller if and when the controller
+     * disabled due to docking event.
+     *
+     * @param portName Name of the port.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void enableUsbDataWhileDocked(in String portName, long transactionId);
+
+    /**
+     * This functions is used to request the hal for the current status
+     * status of the Type-C ports. The result of the query would be sent
+     * through the IUsbCallback object's notifyRoleSwitchStatus
+     * to the caller. This api would would let the caller know of the number
+     * of type-c ports that are present and their connection status through the
+     * PortStatus type.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void queryPortStatus(long transactionId);
+
+    /**
+     * This function is used to register a callback function which is
+     * called by the HAL to inform the client of port status updates and
+     * result of the requested operation. Please refer IUsbCallback for
+     * complete description of when each of the IUsbCallback's interface
+     * methods is expected to be called.
+     *
+     * @param callback IUsbCallback object used to convey status to the
+     * userspace.
+     */
+    void setCallback(in IUsbCallback callback);
+
+    /**
+     * This function is used to change the port role of a specific port.
+     * For example, when DR_SWAP or PR_SWAP is supported.
+     * The status of the role switch will be informed through IUsbCallback
+     * object's notifyPortStatusChange method.
+     *
+     * @param portName name of the port for which the role has to be changed
+     * @param role the new port role.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void switchRole(in String portName, in PortRole role, long transactionId);
+
+    /**
+     * This function is used to limit power transfer in and out of the port.
+     * When limited, the port does not charge from the partner port.
+     * Also, the port limits sourcing power to the partner port when the USB
+     * specification allows it to do so.
+     *
+     * @param portName name of the port for which power transfer is being limited.
+     * @param limit true limit power transfer.
+     *              false relax limiting power transfer.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void limitPowerTransfer(in String portName, boolean limit, long transactionId);
+
+    /**
+     * This function is used to reset the port role of a specific port.
+     * For instance, when data transfer through the port fails.
+     *
+     * @param portName name of the port that is being reset
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void resetUsbPort(in String portName, long transactionId);
+}
diff --git a/usb/aidl/android/hardware/usb/IUsbCallback.aidl b/usb/aidl/android/hardware/usb/IUsbCallback.aidl
new file mode 100644
index 0000000..2ae10d9
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/IUsbCallback.aidl
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.usb;
+
+import android.hardware.usb.PortRole;
+import android.hardware.usb.PortStatus;
+import android.hardware.usb.Status;
+
+/**
+ * Callback object used for all the IUsb async methods which expects a result.
+ * Caller is expected to register the callback object using setCallback method
+ * to receive updates on the PortStatus.
+ */
+@VintfStability
+oneway interface IUsbCallback {
+    /**
+     * Used to convey the current port status to the caller.
+     * Must be called either when PortState changes due to the port partner or
+     * when caller requested for the PortStatus update through queryPortStatus.
+     *
+     * @param currentPortStatus describes the status of all the USB ports in the
+     *                          device.
+     * @param retval SUCCESS when the required information was enquired form
+     *               kernel and the PortStatus object was built.
+     *               ERROR otherwise.
+     */
+    void notifyPortStatusChange(in PortStatus[] currentPortStatus, in Status retval);
+
+    /**
+     * Used to notify the result of the switchRole call to the caller.
+     *
+     * @param portName name of the port for which the roleswap is requested.
+     * @param newRole the new role requested by the caller.
+     * @param retval SUCCESS if the role switch succeeded. FAILURE otherwise.
+     * @param transactionId  transactionId sent during switchRole request.
+     */
+    void notifyRoleSwitchStatus(in String portName, in PortRole newRole, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the result of notifyEnableUsbDataStatus call to the caller.
+     *
+     * @param portName name of the port for which the enableUsbData is requested.
+     * @param enable true when usb data is enabled.
+     *               false when usb data is disabled.
+     * @param retval SUCCESS if current request succeeded. FAILURE otherwise.
+     * @param transactionId transactionId sent during enableUsbData request.
+     */
+    void notifyEnableUsbDataStatus(in String portName, boolean enable, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the result of enableUsbDataWhileDocked call to the caller.
+     *
+     * @param portName name of the port for which the enableUsbDataWhileDocked is requested.
+     * @param retval SUCCESS if current request succeeded. FAILURE otherwise.
+     * @param transactionId transactionId sent during enableUsbDataWhileDocked request.
+     */
+    void notifyEnableUsbDataWhileDockedStatus(in String portName, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the result of enableContaminantPresenceDetection.
+     *
+     * @param portName name of the port for which contaminant detection is enabled/disabled.
+     * @param enable true when contaminant detection is enabled.
+     *               false when disabled.
+     * @param retval SUCCESS if the request for enabling/disabling contamiant detection succeeds.
+     *               FAILURE otherwise.
+     * @param transactionId transactionId sent during queryPortStatus request
+     */
+    void notifyContaminantEnabledStatus(in String portName, boolean enable, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the request to query port status.
+     *
+     * @param portName name of the port for which port status is queried.
+     * @param retval SUCCESS if the port query succeeded. FAILURE otherwise.
+     * @param transactionId transactionId sent during queryPortStatus request
+     */
+    void notifyQueryPortStatus(in String portName, in Status retval, long transactionId);
+
+    /**
+     * Used to notify the result of requesting limitPowerTransfer.
+     *
+     * @param portName name of the port for which power transfer is being limited.
+     * @param limit true limit power transfer.
+     *              false relax limiting power transfer.
+     * @param retval SUCCESS if the request to enable/disable limitPowerTransfer succeeds.
+     *               FAILURE otherwise.
+     * @param transactionId ID sent during limitPowerTransfer request.
+     */
+    void notifyLimitPowerTransferStatus(in String portName, boolean limit, in Status retval, long transactionId);
+
+    /**
+     * Used to notify the result of requesting resetUsbPort.
+     *
+     * @param portName name of the port that was being reset.
+     * @param retval SUCCESS if current request succeeded. FAILURE otherwise.
+     * @param transactionId current transactionId sent during resetUsbPort request.
+     */
+    void notifyResetUsbPortStatus(in String portName, in Status retval, long transactionId);
+}
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/android/hardware/usb/PortDataRole.aidl
similarity index 62%
copy from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/android/hardware/usb/PortDataRole.aidl
index c3c111e..a69f977 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/android/hardware/usb/PortDataRole.aidl
@@ -14,33 +14,22 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.usb;
 
 @VintfStability
-@Backing(type="int")
-enum UssdModeType {
+enum PortDataRole {
     /**
-     * USSD-Notify
+     * Indicates that the port does not have a data role.
+     * In case of DRP, the current data role of the port is only resolved
+     * when the type-c handshake happens.
      */
-    NOTIFY,
+    NONE = 0,
     /**
-     * USSD-Request
+     * Indicates that the port is acting as a host for data.
      */
-    REQUEST,
+    HOST = 1,
     /**
-     * Session terminated by network
+     * Indicated that the port is acting as a device for data.
      */
-    NW_RELEASE,
-    /**
-     * Other local client (eg, SIM Toolkit) has responded
-     */
-    LOCAL_CLIENT,
-    /**
-     * Operation not supported
-     */
-    NOT_SUPPORTED,
-    /**
-     * Network timeout
-     */
-    NW_TIMEOUT,
+    DEVICE = 2,
 }
diff --git a/usb/aidl/android/hardware/usb/PortMode.aidl b/usb/aidl/android/hardware/usb/PortMode.aidl
new file mode 100644
index 0000000..399f0eb
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PortMode.aidl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.PortMode;
+
+@VintfStability
+enum PortMode {
+    /**
+     * Indicates that the port does not have a mode.
+     * In case of DRP, the current mode of the port is only resolved
+     * when the type-c handshake happens.
+     */
+    NONE = 0,
+    /**
+     * Indicates that port can only act as device for data and sink for power.
+     */
+    UFP = 1,
+    /**
+     * Indicates the port can only act as host for data and source for power.
+     */
+    DFP = 2,
+    /**
+     * Indicates can either act as UFP or DFP at a given point of time.
+     */
+    DRP = 3,
+    /*
+     * Indicates that the port supports Audio Accessory mode.
+     */
+    AUDIO_ACCESSORY = 4,
+    /*
+     * Indicates that the port supports Debug Accessory mode.
+     */
+    DEBUG_ACCESSORY = 5,
+}
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/android/hardware/usb/PortPowerRole.aidl
similarity index 62%
copy from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/android/hardware/usb/PortPowerRole.aidl
index c3c111e..ae3dc47 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/android/hardware/usb/PortPowerRole.aidl
@@ -14,33 +14,22 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.usb;
 
 @VintfStability
-@Backing(type="int")
-enum UssdModeType {
+enum PortPowerRole {
     /**
-     * USSD-Notify
+     * Indicates that the port does not have a power role.
+     * In case of DRP, the current power role of the port is only resolved
+     * when the type-c handshake happens.
      */
-    NOTIFY,
+    NONE = 0,
     /**
-     * USSD-Request
+     * Indicates that the port is supplying power to the other port.
      */
-    REQUEST,
+    SOURCE = 1,
     /**
-     * Session terminated by network
+     * Indicates that the port is sinking power from the other port.
      */
-    NW_RELEASE,
-    /**
-     * Other local client (eg, SIM Toolkit) has responded
-     */
-    LOCAL_CLIENT,
-    /**
-     * Operation not supported
-     */
-    NOT_SUPPORTED,
-    /**
-     * Network timeout
-     */
-    NW_TIMEOUT,
+    SINK = 2,
 }
diff --git a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/android/hardware/usb/PortRole.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
copy to usb/aidl/android/hardware/usb/PortRole.aidl
index 270bdee..e0429c8 100644
--- a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/android/hardware/usb/PortRole.aidl
@@ -14,17 +14,18 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 
+import android.hardware.usb.PortDataRole;
+import android.hardware.usb.PortMode;
+import android.hardware.usb.PortPowerRole;
+
+/**
+ * Used as a container to send port role information.
+ */
 @VintfStability
-parcelable NeighboringCell {
-    /**
-     * Combination of LAC and cell ID in 32 bits in GSM. Upper 16 bits is LAC and lower 16 bits is
-     * CID (as described in TS 27.005).
-     */
-    String cid;
-    /**
-     * Received RSSI in GSM, level index of CPICH Received Signal Code Power in UMTS
-     */
-    int rssi;
+union PortRole {
+    PortPowerRole powerRole = PortPowerRole.NONE;
+    PortDataRole dataRole;
+    PortMode mode;
 }
diff --git a/usb/aidl/android/hardware/usb/PortStatus.aidl b/usb/aidl/android/hardware/usb/PortStatus.aidl
new file mode 100644
index 0000000..51bee71
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PortStatus.aidl
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.ContaminantDetectionStatus;
+import android.hardware.usb.ContaminantProtectionMode;
+import android.hardware.usb.ContaminantProtectionStatus;
+import android.hardware.usb.PortDataRole;
+import android.hardware.usb.PortMode;
+import android.hardware.usb.PortPowerRole;
+import android.hardware.usb.PowerBrickStatus;
+import android.hardware.usb.UsbDataStatus;
+
+@VintfStability
+parcelable PortStatus {
+    /**
+     * Name of the port.
+     * Used as the port's id by the caller.
+     */
+    String portName;
+    /**
+     * Data role of the port.
+     */
+    PortDataRole currentDataRole = PortDataRole.NONE;
+    /**
+     * Power Role of thte port.
+     */
+    PortPowerRole currentPowerRole = PortPowerRole.NONE;
+    /**
+     * Mode in which the port is connected.
+     * Can be UFP or DFP or AUDIO_ACCESSORY or
+     * DEBUG_ACCESSORY.
+     */
+    PortMode currentMode = PortMode.NONE;
+    /**
+     * True indicates that the port's mode can
+     * be changed. False otherwise.
+     */
+    boolean canChangeMode;
+    /**
+     * True indicates that the port's data role
+     * can be changed. False otherwise.
+     * For example, true if Type-C PD PD_SWAP
+     * is supported.
+     */
+    boolean canChangeDataRole;
+    /**
+     * True indicates that the port's power role
+     * can be changed. False otherwise.
+     * For example, true if Type-C PD PR_SWAP
+     * is supported.
+     */
+    boolean canChangePowerRole;
+    /**
+     * Identifies the type of the local port.
+     *
+     * UFP - Indicates that port can only act as device for
+     *       data and sink for power.
+     * DFP - Indicates the port can only act as host for data
+     *       and source for power.
+     * DRP - Indicates can either act as UFP or DFP at a
+     *       given point of time.
+     * AUDIO_ACCESSORY -  Indicates that the port supports
+     *                    Audio Accessory mode.
+     * DEBUG_ACCESSORY - Indicates that the port supports
+     *                   Debug Accessory mode.
+     */
+    PortMode[] supportedModes;
+    /**
+     * Contaminant presence protection modes supported by the port.
+     */
+    ContaminantProtectionMode[] supportedContaminantProtectionModes;
+    /**
+     * Client can enable/disable contaminant presence protection through
+     * enableContaminantPresenceProtection when true.
+     */
+    boolean supportsEnableContaminantPresenceProtection;
+    /**
+     * Contaminant presence protection modes currently active for the port.
+     */
+    ContaminantProtectionStatus contaminantProtectionStatus = ContaminantProtectionStatus.NONE;
+    /**
+     * Client can enable/disable contaminant presence detection through
+     * enableContaminantPresenceDetection when true.
+     */
+    boolean supportsEnableContaminantPresenceDetection;
+    /**
+     * Current status of contaminant detection algorithm.
+     */
+    ContaminantDetectionStatus contaminantDetectionStatus = ContaminantDetectionStatus.NOT_SUPPORTED;
+    /**
+     * UsbData status of the port.
+     * Lists reasons for USB data being disabled.
+     */
+    UsbDataStatus[] usbDataStatus;
+    /**
+     * Denoted whether power transfer is limited in the port.
+     */
+    boolean powerTransferLimited;
+    /**
+     * Denotes whether Power brick is connected.
+     */
+    PowerBrickStatus powerBrickStatus;
+}
diff --git a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl b/usb/aidl/android/hardware/usb/PowerBrickStatus.aidl
similarity index 66%
rename from radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
rename to usb/aidl/android/hardware/usb/PowerBrickStatus.aidl
index 270bdee..620fb25 100644
--- a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
+++ b/usb/aidl/android/hardware/usb/PowerBrickStatus.aidl
@@ -14,17 +14,20 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.network;
+package android.hardware.usb;
 
 @VintfStability
-parcelable NeighboringCell {
+enum PowerBrickStatus {
     /**
-     * Combination of LAC and cell ID in 32 bits in GSM. Upper 16 bits is LAC and lower 16 bits is
-     * CID (as described in TS 27.005).
+     * Status not known.
      */
-    String cid;
+    UNKNOWN = 0,
     /**
-     * Received RSSI in GSM, level index of CPICH Received Signal Code Power in UMTS
+     * Port partner is power brick.
      */
-    int rssi;
+    CONNECTED = 1,
+    /**
+     * Port partner is not power brick.
+     */
+    NOT_CONNECTED = 2,
 }
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/usb/aidl/android/hardware/usb/Status.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
copy to usb/aidl/android/hardware/usb/Status.aidl
index c3c111e..468ba4a 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/usb/aidl/android/hardware/usb/Status.aidl
@@ -14,33 +14,26 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.usb;
 
 @VintfStability
 @Backing(type="int")
-enum UssdModeType {
+enum Status {
+    SUCCESS = 0,
     /**
-     * USSD-Notify
+     * error value when the HAL operation fails for reasons not listed here.
      */
-    NOTIFY,
+    ERROR = 1,
     /**
-     * USSD-Request
+     * error value returned when input argument is invalid.
      */
-    REQUEST,
+    INVALID_ARGUMENT = 2,
     /**
-     * Session terminated by network
+     * error value returned when role string is unrecognized.
      */
-    NW_RELEASE,
+    UNRECOGNIZED_ROLE = 3,
     /**
-     * Other local client (eg, SIM Toolkit) has responded
+     * Error value returned when the operation is not supported.
      */
-    LOCAL_CLIENT,
-    /**
-     * Operation not supported
-     */
-    NOT_SUPPORTED,
-    /**
-     * Network timeout
-     */
-    NW_TIMEOUT,
+    NOT_SUPPORTED = 4,
 }
diff --git a/usb/aidl/android/hardware/usb/UsbDataStatus.aidl b/usb/aidl/android/hardware/usb/UsbDataStatus.aidl
new file mode 100644
index 0000000..4b6a41a
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/UsbDataStatus.aidl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum UsbDataStatus {
+    /**
+     * USB data status not known.
+     */
+    UNKNOWN = 0,
+    /**
+     * USB data is enabled.
+     */
+    ENABLED = 1,
+    /**
+     * USB data is disabled as the port is hot.
+     */
+    DISABLED_OVERHEAT = 2,
+    /**
+     * USB data is disabled as port is contaminated.
+     */
+    DISABLED_CONTAMINANT = 3,
+    /**
+     * USB data is disabled due to dock.
+     */
+    DISABLED_DOCK = 4,
+    /**
+     * USB data is disabled by USB Service.
+     */
+    DISABLED_FORCE = 5,
+    /**
+     * USB data disabled for debug.
+     */
+    DISABLED_DEBUG = 6
+}
diff --git a/usb/aidl/conversion.log b/usb/aidl/conversion.log
new file mode 100644
index 0000000..c090446
--- /dev/null
+++ b/usb/aidl/conversion.log
@@ -0,0 +1,11 @@
+Notes relating to hidl2aidl conversion of android.hardware.usb@1.3 to android.hardware.usb (if any) follow:
+Unhandled comments from android.hardware.usb@1.1::types follow. Consider using hidl-lint to locate these and fixup as many as possible.
+ // NOTE: suffix '_1_1' is for legacy ABI compatibility. It cannot be
+ // changed to 'PortMode' which the convention dictates.
+ // NOTE: suffix '_1_1' is for legacy ABI compatibility. It cannot be
+ // changed to 'PortStatus' which the convention dictates.
+
+An unknown named type was found in translation: android.hardware.usb@1.0::PortStatus
+An unknown named type was found in translation: android.hardware.usb@1.0::PortStatus
+An unknown named type was found in translation: android.hardware.usb@1.0::PortStatus
+END OF LOG
diff --git a/usb/aidl/default/Android.bp b/usb/aidl/default/Android.bp
new file mode 100644
index 0000000..da0cff2
--- /dev/null
+++ b/usb/aidl/default/Android.bp
@@ -0,0 +1,35 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_binary {
+    name: "android.hardware.usb-service.example",
+    relative_install_path: "hw",
+    init_rc: ["android.hardware.usb-service.example.rc"],
+    vintf_fragments: ["android.hardware.usb-service.example.xml"],
+    vendor: true,
+    srcs: [
+        "service.cpp",
+        "Usb.cpp",
+    ],
+    shared_libs: [
+        "android.hardware.usb-V1-ndk",
+        "libbase",
+        "libbinder_ndk",
+	"libcutils",
+        "liblog",
+        "libutils",
+    ],
+}
diff --git a/usb/aidl/default/Usb.cpp b/usb/aidl/default/Usb.cpp
new file mode 100644
index 0000000..7e738c4
--- /dev/null
+++ b/usb/aidl/default/Usb.cpp
@@ -0,0 +1,743 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.usb.aidl-service"
+
+#include <aidl/android/hardware/usb/PortRole.h>
+#include <android-base/logging.h>
+#include <android-base/properties.h>
+#include <android-base/strings.h>
+#include <assert.h>
+#include <dirent.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <chrono>
+#include <regex>
+#include <thread>
+#include <unordered_map>
+
+#include <cutils/uevent.h>
+#include <sys/epoll.h>
+#include <utils/Errors.h>
+#include <utils/StrongPointer.h>
+
+#include "Usb.h"
+
+using android::base::GetProperty;
+using android::base::Trim;
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace usb {
+
+constexpr char kTypecPath[] = "/sys/class/typec/";
+constexpr char kDataRoleNode[] = "/data_role";
+constexpr char kPowerRoleNode[] = "/power_role";
+
+// Set by the signal handler to destroy the thread
+volatile bool destroyThread;
+
+void queryVersionHelper(android::hardware::usb::Usb *usb,
+                        std::vector<PortStatus> *currentPortStatus);
+
+ScopedAStatus Usb::enableUsbData(const string& in_portName, bool in_enable, int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyEnableUsbDataStatus(
+            in_portName, true, in_enable ? Status::SUCCESS : Status::ERROR, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("notifyEnableUsbDataStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+    queryVersionHelper(this, &currentPortStatus);
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Usb::enableUsbDataWhileDocked(const string& in_portName, int64_t in_transactionId) {
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyEnableUsbDataWhileDockedStatus(
+            in_portName, Status::NOT_SUPPORTED, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("notifyEnableUsbDataWhileDockedStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Usb::resetUsbPort(const string& in_portName, int64_t in_transactionId) {
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyResetUsbPortStatus(
+            in_portName, Status::NOT_SUPPORTED, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("notifyResetUsbPortStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    return ScopedAStatus::ok();
+}
+
+Status queryMoistureDetectionStatus(std::vector<PortStatus> *currentPortStatus) {
+    string enabled, status, path, DetectedPath;
+
+    for (int i = 0; i < currentPortStatus->size(); i++) {
+        (*currentPortStatus)[i].supportedContaminantProtectionModes
+                .push_back(ContaminantProtectionMode::NONE);
+        (*currentPortStatus)[i].contaminantProtectionStatus
+                = ContaminantProtectionStatus::NONE;
+        (*currentPortStatus)[i].contaminantDetectionStatus
+                = ContaminantDetectionStatus::NOT_SUPPORTED;
+        (*currentPortStatus)[i].supportsEnableContaminantPresenceDetection = false;
+        (*currentPortStatus)[i].supportsEnableContaminantPresenceProtection = false;
+    }
+
+    return Status::SUCCESS;
+}
+
+string appendRoleNodeHelper(const string &portName, PortRole::Tag tag) {
+    string node(kTypecPath + portName);
+
+    switch (tag) {
+        case PortRole::dataRole:
+            return node + kDataRoleNode;
+        case PortRole::powerRole:
+            return node + kPowerRoleNode;
+        case PortRole::mode:
+            return node + "/port_type";
+        default:
+            return "";
+    }
+}
+
+string convertRoletoString(PortRole role) {
+    if (role.getTag() == PortRole::powerRole) {
+        if (role.get<PortRole::powerRole>() == PortPowerRole::SOURCE)
+            return "source";
+        else if (role.get<PortRole::powerRole>() == PortPowerRole::SINK)
+            return "sink";
+    } else if (role.getTag() == PortRole::dataRole) {
+        if (role.get<PortRole::dataRole>() == PortDataRole::HOST)
+            return "host";
+        if (role.get<PortRole::dataRole>() == PortDataRole::DEVICE)
+            return "device";
+    } else if (role.getTag() == PortRole::mode) {
+        if (role.get<PortRole::mode>() == PortMode::UFP)
+            return "sink";
+        if (role.get<PortRole::mode>() == PortMode::DFP)
+            return "source";
+    }
+    return "none";
+}
+
+void extractRole(string *roleName) {
+    std::size_t first, last;
+
+    first = roleName->find("[");
+    last = roleName->find("]");
+
+    if (first != string::npos && last != string::npos) {
+        *roleName = roleName->substr(first + 1, last - first - 1);
+    }
+}
+
+void switchToDrp(const string &portName) {
+    string filename = appendRoleNodeHelper(string(portName.c_str()), PortRole::mode);
+    FILE *fp;
+
+    if (filename != "") {
+        fp = fopen(filename.c_str(), "w");
+        if (fp != NULL) {
+            int ret = fputs("dual", fp);
+            fclose(fp);
+            if (ret == EOF)
+                ALOGE("Fatal: Error while switching back to drp");
+        } else {
+            ALOGE("Fatal: Cannot open file to switch back to drp");
+        }
+    } else {
+        ALOGE("Fatal: invalid node type");
+    }
+}
+
+bool switchMode(const string &portName, const PortRole &in_role, struct Usb *usb) {
+    string filename = appendRoleNodeHelper(string(portName.c_str()), in_role.getTag());
+    string written;
+    FILE *fp;
+    bool roleSwitch = false;
+
+    if (filename == "") {
+        ALOGE("Fatal: invalid node type");
+        return false;
+    }
+
+    fp = fopen(filename.c_str(), "w");
+    if (fp != NULL) {
+        // Hold the lock here to prevent loosing connected signals
+        // as once the file is written the partner added signal
+        // can arrive anytime.
+        pthread_mutex_lock(&usb->mPartnerLock);
+        usb->mPartnerUp = false;
+        int ret = fputs(convertRoletoString(in_role).c_str(), fp);
+        fclose(fp);
+
+        if (ret != EOF) {
+            struct timespec to;
+            struct timespec now;
+
+        wait_again:
+            clock_gettime(CLOCK_MONOTONIC, &now);
+            to.tv_sec = now.tv_sec + PORT_TYPE_TIMEOUT;
+            to.tv_nsec = now.tv_nsec;
+
+            int err = pthread_cond_timedwait(&usb->mPartnerCV, &usb->mPartnerLock, &to);
+            // There are no uevent signals which implies role swap timed out.
+            if (err == ETIMEDOUT) {
+                ALOGI("uevents wait timedout");
+                // Validity check.
+            } else if (!usb->mPartnerUp) {
+                goto wait_again;
+                // Role switch succeeded since usb->mPartnerUp is true.
+            } else {
+                roleSwitch = true;
+            }
+        } else {
+            ALOGI("Role switch failed while wrting to file");
+        }
+        pthread_mutex_unlock(&usb->mPartnerLock);
+    }
+
+    if (!roleSwitch)
+        switchToDrp(string(portName.c_str()));
+
+    return roleSwitch;
+}
+
+Usb::Usb()
+    : mLock(PTHREAD_MUTEX_INITIALIZER),
+      mRoleSwitchLock(PTHREAD_MUTEX_INITIALIZER),
+      mPartnerLock(PTHREAD_MUTEX_INITIALIZER),
+      mPartnerUp(false)
+{
+    pthread_condattr_t attr;
+    if (pthread_condattr_init(&attr)) {
+        ALOGE("pthread_condattr_init failed: %s", strerror(errno));
+        abort();
+    }
+    if (pthread_condattr_setclock(&attr, CLOCK_MONOTONIC)) {
+        ALOGE("pthread_condattr_setclock failed: %s", strerror(errno));
+        abort();
+    }
+    if (pthread_cond_init(&mPartnerCV, &attr)) {
+        ALOGE("pthread_cond_init failed: %s", strerror(errno));
+        abort();
+    }
+    if (pthread_condattr_destroy(&attr)) {
+        ALOGE("pthread_condattr_destroy failed: %s", strerror(errno));
+        abort();
+    }
+}
+
+ScopedAStatus Usb::switchRole(const string& in_portName,
+        const PortRole& in_role, int64_t in_transactionId) {
+    string filename = appendRoleNodeHelper(string(in_portName.c_str()), in_role.getTag());
+    string written;
+    FILE *fp;
+    bool roleSwitch = false;
+
+    if (filename == "") {
+        ALOGE("Fatal: invalid node type");
+        return ScopedAStatus::ok();
+    }
+
+    pthread_mutex_lock(&mRoleSwitchLock);
+
+    ALOGI("filename write: %s role:%s", filename.c_str(), convertRoletoString(in_role).c_str());
+
+    if (in_role.getTag() == PortRole::mode) {
+        roleSwitch = switchMode(in_portName, in_role, this);
+    } else {
+        fp = fopen(filename.c_str(), "w");
+        if (fp != NULL) {
+            int ret = fputs(convertRoletoString(in_role).c_str(), fp);
+            fclose(fp);
+            if ((ret != EOF) && ReadFileToString(filename, &written)) {
+                written = Trim(written);
+                extractRole(&written);
+                ALOGI("written: %s", written.c_str());
+                if (written == convertRoletoString(in_role)) {
+                    roleSwitch = true;
+                } else {
+                    ALOGE("Role switch failed");
+                }
+            } else {
+                ALOGE("failed to update the new role");
+            }
+        } else {
+            ALOGE("fopen failed");
+        }
+    }
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+         ScopedAStatus ret = mCallback->notifyRoleSwitchStatus(
+            in_portName, in_role, roleSwitch ? Status::SUCCESS : Status::ERROR, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("RoleSwitchStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+    pthread_mutex_unlock(&mRoleSwitchLock);
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Usb::limitPowerTransfer(const string& in_portName, bool /*in_limit*/,
+        int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL && in_transactionId >= 0) {
+        ScopedAStatus ret = mCallback->notifyLimitPowerTransferStatus(
+                in_portName, false, Status::NOT_SUPPORTED, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("limitPowerTransfer error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    return ScopedAStatus::ok();
+}
+
+Status getAccessoryConnected(const string &portName, string *accessory) {
+    string filename = kTypecPath + portName + "-partner/accessory_mode";
+
+    if (!ReadFileToString(filename, accessory)) {
+        ALOGE("getAccessoryConnected: Failed to open filesystem node: %s", filename.c_str());
+        return Status::ERROR;
+    }
+    *accessory = Trim(*accessory);
+
+    return Status::SUCCESS;
+}
+
+Status getCurrentRoleHelper(const string &portName, bool connected, PortRole *currentRole) {
+    string filename;
+    string roleName;
+    string accessory;
+
+    // Mode
+
+    if (currentRole->getTag() == PortRole::powerRole) {
+        filename = kTypecPath + portName + kPowerRoleNode;
+        currentRole->set<PortRole::powerRole>(PortPowerRole::NONE);
+    } else if (currentRole->getTag() == PortRole::dataRole) {
+        filename = kTypecPath + portName + kDataRoleNode;
+        currentRole->set<PortRole::dataRole>(PortDataRole::NONE);
+    } else if (currentRole->getTag() == PortRole::mode) {
+        filename = kTypecPath + portName + kDataRoleNode;
+        currentRole->set<PortRole::mode>(PortMode::NONE);
+    } else {
+        return Status::ERROR;
+    }
+
+    if (!connected)
+        return Status::SUCCESS;
+
+    if (currentRole->getTag() == PortRole::mode) {
+        if (getAccessoryConnected(portName, &accessory) != Status::SUCCESS) {
+            return Status::ERROR;
+        }
+        if (accessory == "analog_audio") {
+            currentRole->set<PortRole::mode>(PortMode::AUDIO_ACCESSORY);
+            return Status::SUCCESS;
+        } else if (accessory == "debug") {
+            currentRole->set<PortRole::mode>(PortMode::DEBUG_ACCESSORY);
+            return Status::SUCCESS;
+        }
+    }
+
+    if (!ReadFileToString(filename, &roleName)) {
+        ALOGE("getCurrentRole: Failed to open filesystem node: %s", filename.c_str());
+        return Status::ERROR;
+    }
+
+    roleName = Trim(roleName);
+    extractRole(&roleName);
+
+    if (roleName == "source") {
+        currentRole->set<PortRole::powerRole>(PortPowerRole::SOURCE);
+    } else if (roleName == "sink") {
+        currentRole->set<PortRole::powerRole>(PortPowerRole::SINK);
+    } else if (roleName == "host") {
+        if (currentRole->getTag() == PortRole::dataRole)
+            currentRole->set<PortRole::dataRole>(PortDataRole::HOST);
+        else
+            currentRole->set<PortRole::mode>(PortMode::DFP);
+    } else if (roleName == "device") {
+        if (currentRole->getTag() == PortRole::dataRole)
+            currentRole->set<PortRole::dataRole>(PortDataRole::DEVICE);
+        else
+            currentRole->set<PortRole::mode>(PortMode::UFP);
+    } else if (roleName != "none") {
+        /* case for none has already been addressed.
+         * so we check if the role isn't none.
+         */
+        return Status::UNRECOGNIZED_ROLE;
+    }
+
+    return Status::SUCCESS;
+}
+
+Status getTypeCPortNamesHelper(std::unordered_map<string, bool> *names) {
+    DIR *dp;
+
+    dp = opendir(kTypecPath);
+    if (dp != NULL) {
+        struct dirent *ep;
+
+        while ((ep = readdir(dp))) {
+            if (ep->d_type == DT_LNK) {
+                if (string::npos == string(ep->d_name).find("-partner")) {
+                    std::unordered_map<string, bool>::const_iterator portName =
+                        names->find(ep->d_name);
+                    if (portName == names->end()) {
+                        names->insert({ep->d_name, false});
+                    }
+                } else {
+                    (*names)[std::strtok(ep->d_name, "-")] = true;
+                }
+            }
+        }
+        closedir(dp);
+        return Status::SUCCESS;
+    }
+
+    ALOGE("Failed to open /sys/class/typec");
+    return Status::ERROR;
+}
+
+bool canSwitchRoleHelper(const string &portName) {
+    string filename = kTypecPath + portName + "-partner/supports_usb_power_delivery";
+    string supportsPD;
+
+    if (ReadFileToString(filename, &supportsPD)) {
+        supportsPD = Trim(supportsPD);
+        if (supportsPD == "yes") {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+Status getPortStatusHelper(std::vector<PortStatus> *currentPortStatus) {
+    std::unordered_map<string, bool> names;
+    Status result = getTypeCPortNamesHelper(&names);
+    int i = -1;
+
+    if (result == Status::SUCCESS) {
+        currentPortStatus->resize(names.size());
+        for (std::pair<string, bool> port : names) {
+            i++;
+            ALOGI("%s", port.first.c_str());
+            (*currentPortStatus)[i].portName = port.first;
+
+            PortRole currentRole;
+            currentRole.set<PortRole::powerRole>(PortPowerRole::NONE);
+            if (getCurrentRoleHelper(port.first, port.second, &currentRole) == Status::SUCCESS){
+                (*currentPortStatus)[i].currentPowerRole = currentRole.get<PortRole::powerRole>();
+            } else {
+                ALOGE("Error while retrieving portNames");
+                goto done;
+            }
+
+            currentRole.set<PortRole::dataRole>(PortDataRole::NONE);
+            if (getCurrentRoleHelper(port.first, port.second, &currentRole) == Status::SUCCESS) {
+                (*currentPortStatus)[i].currentDataRole = currentRole.get<PortRole::dataRole>();
+            } else {
+                ALOGE("Error while retrieving current port role");
+                goto done;
+            }
+
+            currentRole.set<PortRole::mode>(PortMode::NONE);
+            if (getCurrentRoleHelper(port.first, port.second, &currentRole) == Status::SUCCESS) {
+                (*currentPortStatus)[i].currentMode = currentRole.get<PortRole::mode>();
+            } else {
+                ALOGE("Error while retrieving current data role");
+                goto done;
+            }
+
+            (*currentPortStatus)[i].canChangeMode = true;
+            (*currentPortStatus)[i].canChangeDataRole =
+                port.second ? canSwitchRoleHelper(port.first) : false;
+            (*currentPortStatus)[i].canChangePowerRole =
+                port.second ? canSwitchRoleHelper(port.first) : false;
+
+            (*currentPortStatus)[i].supportedModes.push_back(PortMode::DRP);
+            (*currentPortStatus)[i].usbDataStatus.push_back(UsbDataStatus::ENABLED);
+
+            ALOGI("%d:%s connected:%d canChangeMode:%d canChagedata:%d canChangePower:%d "
+                "usbDataEnabled:%d",
+                i, port.first.c_str(), port.second,
+                (*currentPortStatus)[i].canChangeMode,
+                (*currentPortStatus)[i].canChangeDataRole,
+                (*currentPortStatus)[i].canChangePowerRole, 0);
+        }
+
+        return Status::SUCCESS;
+    }
+done:
+    return Status::ERROR;
+}
+
+void queryVersionHelper(android::hardware::usb::Usb *usb,
+                        std::vector<PortStatus> *currentPortStatus) {
+    Status status;
+    pthread_mutex_lock(&usb->mLock);
+    status = getPortStatusHelper(currentPortStatus);
+    queryMoistureDetectionStatus(currentPortStatus);
+    if (usb->mCallback != NULL) {
+        ScopedAStatus ret = usb->mCallback->notifyPortStatusChange(*currentPortStatus,
+            status);
+        if (!ret.isOk())
+            ALOGE("queryPortStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGI("Notifying userspace skipped. Callback is NULL");
+    }
+    pthread_mutex_unlock(&usb->mLock);
+}
+
+ScopedAStatus Usb::queryPortStatus(int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    queryVersionHelper(this, &currentPortStatus);
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyQueryPortStatus(
+            "all", Status::SUCCESS, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("notifyQueryPortStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Usb::enableContaminantPresenceDetection(const string& in_portName,
+        bool /*in_enable*/, int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyContaminantEnabledStatus(
+            in_portName, false, Status::ERROR, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("enableContaminantPresenceDetection  error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    queryVersionHelper(this, &currentPortStatus);
+    return ScopedAStatus::ok();
+}
+
+
+struct data {
+    int uevent_fd;
+    ::aidl::android::hardware::usb::Usb *usb;
+};
+
+static void uevent_event(uint32_t /*epevents*/, struct data *payload) {
+    char msg[UEVENT_MSG_LEN + 2];
+    char *cp;
+    int n;
+
+    n = uevent_kernel_multicast_recv(payload->uevent_fd, msg, UEVENT_MSG_LEN);
+    if (n <= 0)
+        return;
+    if (n >= UEVENT_MSG_LEN) /* overflow -- discard */
+        return;
+
+    msg[n] = '\0';
+    msg[n + 1] = '\0';
+    cp = msg;
+
+    while (*cp) {
+        if (std::regex_match(cp, std::regex("(add)(.*)(-partner)"))) {
+            ALOGI("partner added");
+            pthread_mutex_lock(&payload->usb->mPartnerLock);
+            payload->usb->mPartnerUp = true;
+            pthread_cond_signal(&payload->usb->mPartnerCV);
+            pthread_mutex_unlock(&payload->usb->mPartnerLock);
+        } else if (!strncmp(cp, "DEVTYPE=typec_", strlen("DEVTYPE=typec_"))) {
+            std::vector<PortStatus> currentPortStatus;
+            queryVersionHelper(payload->usb, &currentPortStatus);
+
+            // Role switch is not in progress and port is in disconnected state
+            if (!pthread_mutex_trylock(&payload->usb->mRoleSwitchLock)) {
+                for (unsigned long i = 0; i < currentPortStatus.size(); i++) {
+                    DIR *dp =
+                        opendir(string(kTypecPath +
+                                       string(currentPortStatus[i].portName.c_str()) +
+                                       "-partner").c_str());
+                    if (dp == NULL) {
+                        switchToDrp(currentPortStatus[i].portName);
+                    } else {
+                        closedir(dp);
+                    }
+                }
+                pthread_mutex_unlock(&payload->usb->mRoleSwitchLock);
+            }
+            break;
+        } /* advance to after the next \0 */
+        while (*cp++) {
+        }
+    }
+}
+
+void *work(void *param) {
+    int epoll_fd, uevent_fd;
+    struct epoll_event ev;
+    int nevents = 0;
+    struct data payload;
+
+    uevent_fd = uevent_open_socket(UEVENT_MAX_EVENTS * UEVENT_MSG_LEN, true);
+
+    if (uevent_fd < 0) {
+        ALOGE("uevent_init: uevent_open_socket failed\n");
+        return NULL;
+    }
+
+    payload.uevent_fd = uevent_fd;
+    payload.usb = (::aidl::android::hardware::usb::Usb *)param;
+
+    fcntl(uevent_fd, F_SETFL, O_NONBLOCK);
+
+    ev.events = EPOLLIN;
+    ev.data.ptr = (void *)uevent_event;
+
+    epoll_fd = epoll_create(UEVENT_MAX_EVENTS);
+    if (epoll_fd == -1) {
+        ALOGE("epoll_create failed; errno=%d", errno);
+        goto error;
+    }
+
+    if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, uevent_fd, &ev) == -1) {
+        ALOGE("epoll_ctl failed; errno=%d", errno);
+        goto error;
+    }
+
+    while (!destroyThread) {
+        struct epoll_event events[UEVENT_MAX_EVENTS];
+
+        nevents = epoll_wait(epoll_fd, events, UEVENT_MAX_EVENTS, -1);
+        if (nevents == -1) {
+            if (errno == EINTR)
+                continue;
+            ALOGE("usb epoll_wait failed; errno=%d", errno);
+            break;
+        }
+
+        for (int n = 0; n < nevents; ++n) {
+            if (events[n].data.ptr)
+                (*(void (*)(int, struct data *payload))events[n].data.ptr)(events[n].events,
+                                                                           &payload);
+        }
+    }
+
+    ALOGI("exiting worker thread");
+error:
+    close(uevent_fd);
+
+    if (epoll_fd >= 0)
+        close(epoll_fd);
+
+    return NULL;
+}
+
+void sighandler(int sig) {
+    if (sig == SIGUSR1) {
+        destroyThread = true;
+        ALOGI("destroy set");
+        return;
+    }
+    signal(SIGUSR1, sighandler);
+}
+
+ScopedAStatus Usb::setCallback(
+        const shared_ptr<IUsbCallback>& in_callback) {
+
+    pthread_mutex_lock(&mLock);
+    if ((mCallback == NULL && in_callback == NULL) ||
+            (mCallback != NULL && in_callback != NULL)) {
+        mCallback = in_callback;
+        pthread_mutex_unlock(&mLock);
+        return ScopedAStatus::ok();
+    }
+
+    mCallback = in_callback;
+    ALOGI("registering callback");
+
+    if (mCallback == NULL) {
+        if  (!pthread_kill(mPoll, SIGUSR1)) {
+            pthread_join(mPoll, NULL);
+            ALOGI("pthread destroyed");
+        }
+        pthread_mutex_unlock(&mLock);
+        return ScopedAStatus::ok();
+    }
+
+    destroyThread = false;
+    signal(SIGUSR1, sighandler);
+
+    /*
+     * Create a background thread if the old callback value is NULL
+     * and being updated with a new value.
+     */
+    if (pthread_create(&mPoll, NULL, work, this)) {
+        ALOGE("pthread creation failed %d", errno);
+        mCallback = NULL;
+    }
+
+    pthread_mutex_unlock(&mLock);
+    return ScopedAStatus::ok();
+}
+
+} // namespace usb
+} // namespace hardware
+} // namespace android
+} // aidl
diff --git a/usb/aidl/default/Usb.h b/usb/aidl/default/Usb.h
new file mode 100644
index 0000000..d507af6
--- /dev/null
+++ b/usb/aidl/default/Usb.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android-base/file.h>
+#include <aidl/android/hardware/usb/BnUsb.h>
+#include <aidl/android/hardware/usb/BnUsbCallback.h>
+#include <utils/Log.h>
+
+#define UEVENT_MSG_LEN     2048
+#define UEVENT_MAX_EVENTS  64
+// The type-c stack waits for 4.5 - 5.5 secs before declaring a port non-pd.
+// The -partner directory would not be created until this is done.
+// Having a margin of ~3 secs for the directory and other related bookeeping
+// structures created and uvent fired.
+#define PORT_TYPE_TIMEOUT 8
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace usb {
+
+using ::aidl::android::hardware::usb::IUsbCallback;
+using ::aidl::android::hardware::usb::PortRole;
+using ::android::base::ReadFileToString;
+using ::android::base::WriteStringToFile;
+using ::android::sp;
+using ::ndk::ScopedAStatus;
+using ::std::shared_ptr;
+using ::std::string;
+
+struct Usb : public BnUsb {
+    Usb();
+
+    ScopedAStatus enableContaminantPresenceDetection(const std::string& in_portName,
+            bool in_enable, int64_t in_transactionId) override;
+    ScopedAStatus queryPortStatus(int64_t in_transactionId) override;
+    ScopedAStatus setCallback(const shared_ptr<IUsbCallback>& in_callback) override;
+    ScopedAStatus switchRole(const string& in_portName, const PortRole& in_role,
+            int64_t in_transactionId) override;
+    ScopedAStatus enableUsbData(const string& in_portName, bool in_enable,
+            int64_t in_transactionId) override;
+    ScopedAStatus enableUsbDataWhileDocked(const string& in_portName,
+            int64_t in_transactionId) override;
+    ScopedAStatus limitPowerTransfer(const std::string& in_portName, bool in_limit,
+            int64_t in_transactionId)override;
+    ScopedAStatus resetUsbPort(const std::string& in_portName,
+            int64_t in_transactionId)override;
+
+    shared_ptr<IUsbCallback> mCallback;
+    // Protects mCallback variable
+    pthread_mutex_t mLock;
+    // Protects roleSwitch operation
+    pthread_mutex_t mRoleSwitchLock;
+    // Threads waiting for the partner to come back wait here
+    pthread_cond_t mPartnerCV;
+    // lock protecting mPartnerCV
+    pthread_mutex_t mPartnerLock;
+    // Variable to signal partner coming back online after type switch
+    bool mPartnerUp;
+  private:
+    pthread_t mPoll;
+};
+
+} // namespace usb
+} // namespace hardware
+} // namespace android
+} // aidl
diff --git a/usb/aidl/default/android.hardware.usb-service.example.rc b/usb/aidl/default/android.hardware.usb-service.example.rc
new file mode 100644
index 0000000..335bca7
--- /dev/null
+++ b/usb/aidl/default/android.hardware.usb-service.example.rc
@@ -0,0 +1,4 @@
+service vendor.usb_default /vendor/bin/hw/android.hardware.usb-service.example
+    class hal
+    user system
+    group system
diff --git a/usb/aidl/default/android.hardware.usb-service.example.xml b/usb/aidl/default/android.hardware.usb-service.example.xml
new file mode 100644
index 0000000..6088194
--- /dev/null
+++ b/usb/aidl/default/android.hardware.usb-service.example.xml
@@ -0,0 +1,10 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.usb</name>
+        <version>1</version>
+        <interface>
+            <name>IUsb</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/usb/aidl/default/service.cpp b/usb/aidl/default/service.cpp
new file mode 100644
index 0000000..398458a
--- /dev/null
+++ b/usb/aidl/default/service.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+#include "Usb.h"
+
+using ::aidl::android::hardware::usb::Usb;
+
+int main() {
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<Usb> usb = ndk::SharedRefBase::make<Usb>();
+
+    const std::string instance = std::string() + Usb::descriptor + "/default";
+    binder_status_t status = AServiceManager_addService(usb->asBinder().get(), instance.c_str());
+    CHECK(status == STATUS_OK);
+
+    ABinderProcess_joinThreadPool();
+    return -1; // Should never be reached
+}
diff --git a/usb/aidl/vts/Android.bp b/usb/aidl/vts/Android.bp
new file mode 100644
index 0000000..00a7c93
--- /dev/null
+++ b/usb/aidl/vts/Android.bp
@@ -0,0 +1,43 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_test {
+    name: "VtsAidlUsbTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: ["VtsAidlUsbTargetTest.cpp"],
+    shared_libs: [
+        "libbinder_ndk",
+    ],
+    static_libs: [
+        "android.hardware.usb-V1-ndk",
+    ],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+}
diff --git a/usb/aidl/vts/VtsAidlUsbTargetTest.cpp b/usb/aidl/vts/VtsAidlUsbTargetTest.cpp
new file mode 100644
index 0000000..ea2f985
--- /dev/null
+++ b/usb/aidl/vts/VtsAidlUsbTargetTest.cpp
@@ -0,0 +1,574 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Probject
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "UsbAidlTest"
+#include <android-base/logging.h>
+
+#include <aidl/android/hardware/usb/IUsb.h>
+#include <aidl/android/hardware/usb/IUsbCallback.h>
+#include <aidl/android/hardware/usb/BnUsbCallback.h>
+#include <aidl/android/hardware/usb/PortDataRole.h>
+#include <aidl/android/hardware/usb/PortMode.h>
+#include <aidl/android/hardware/usb/PortPowerRole.h>
+#include <aidl/android/hardware/usb/PortRole.h>
+#include <aidl/android/hardware/usb/PortStatus.h>
+#include <aidl/android/hardware/usb/Status.h>
+#include <aidl/Vintf.h>
+#include <aidl/Gtest.h>
+
+#include <android/binder_auto_utils.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <gtest/gtest.h>
+
+#include <log/log.h>
+#include <stdlib.h>
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+#define TIMEOUT_PERIOD 10
+
+using ::aidl::android::hardware::usb::BnUsbCallback;
+using ::aidl::android::hardware::usb::IUsb;
+using ::aidl::android::hardware::usb::IUsbCallback;
+using ::aidl::android::hardware::usb::PortDataRole;
+using ::aidl::android::hardware::usb::PortMode;
+using ::aidl::android::hardware::usb::PortPowerRole;
+using ::aidl::android::hardware::usb::PortRole;
+using ::aidl::android::hardware::usb::PortStatus;
+using ::aidl::android::hardware::usb::Status;
+
+using ::ndk::ScopedAStatus;
+using ::ndk::SpAIBinder;
+using std::vector;
+using std::shared_ptr;
+using std::string;
+
+// The main test class for the USB aidl hal
+class UsbAidlTest : public testing::TestWithParam<std::string> {
+ public:
+  // Callback class for the USB aidl hal.
+  // Usb Hal will call this object upon role switch or port query.
+  class UsbCallback : public BnUsbCallback {
+    UsbAidlTest& parent_;
+    int cookie;
+
+   public:
+    UsbCallback(UsbAidlTest& parent, int cookie)
+        : parent_(parent), cookie(cookie){};
+
+    virtual ~UsbCallback() = default;
+
+    // Callback method for the port status.
+    ScopedAStatus notifyPortStatusChange(const vector<PortStatus>& currentPortStatus,
+                                         Status retval) override {
+      if (retval == Status::SUCCESS && currentPortStatus.size() > 0) {
+        parent_.usb_last_port_status.portName =
+            currentPortStatus[0].portName.c_str();
+        parent_.usb_last_port_status.currentDataRole =
+            currentPortStatus[0].currentDataRole;
+        parent_.usb_last_port_status.currentPowerRole =
+            currentPortStatus[0].currentPowerRole;
+        parent_.usb_last_port_status.currentMode =
+            currentPortStatus[0].currentMode;
+      }
+      parent_.usb_last_cookie = cookie;
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of role switch operation.
+    ScopedAStatus notifyRoleSwitchStatus(const string& /*portName*/, const PortRole& newRole,
+                                         Status retval, int64_t transactionId) override {
+      parent_.usb_last_status = retval;
+      parent_.usb_last_cookie = cookie;
+      parent_.usb_last_port_role = newRole;
+      parent_.usb_role_switch_done = true;
+      parent_.last_transactionId = transactionId;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of enableUsbData operation
+    ScopedAStatus notifyEnableUsbDataStatus(const string& /*portName*/, bool /*enable*/,
+                                            Status /*retval*/, int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.enable_usb_data_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of enableUsbData operation
+    ScopedAStatus notifyEnableUsbDataWhileDockedStatus(const string& /*portName*/,
+                                                       Status /*retval*/,
+                                                       int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.enable_usb_data_while_docked_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of enableContaminantPresenceDetection
+    ScopedAStatus notifyContaminantEnabledStatus(const string& /*portName*/, bool /*enable*/,
+                                                 Status /*retval*/, int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.enable_contaminant_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of queryPortStatus operation
+    ScopedAStatus notifyQueryPortStatus(const string& /*portName*/, Status /*retval*/,
+                                        int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of limitPowerTransfer operation
+    ScopedAStatus notifyLimitPowerTransferStatus(const string& /*portName*/, bool /*limit*/,
+                                                 Status /*retval*/, int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.limit_power_transfer_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of resetUsbPortStatus operation
+    ScopedAStatus notifyResetUsbPortStatus(const string& /*portName*/, Status /*retval*/,
+                                        int64_t transactionId) override {
+      ALOGI("enter notifyResetUsbPortStatus");
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.reset_usb_port_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+  };
+
+  virtual void SetUp() override {
+    ALOGI("Setup");
+    usb = IUsb::fromBinder(
+                SpAIBinder(AServiceManager_waitForService(GetParam().c_str())));
+    ASSERT_NE(usb, nullptr);
+
+    usb_cb_2 = ::ndk::SharedRefBase::make<UsbCallback>(*this, 2);
+    ASSERT_NE(usb_cb_2, nullptr);
+    const auto& ret = usb->setCallback(usb_cb_2);
+    ASSERT_TRUE(ret.isOk());
+  }
+
+  virtual void TearDown() override { ALOGI("Teardown"); }
+
+  // Used as a mechanism to inform the test about data/event callback.
+  inline void notify() {
+    std::unique_lock<std::mutex> lock(usb_mtx);
+    usb_count++;
+    usb_cv.notify_one();
+  }
+
+  // Test code calls this function to wait for data/event callback.
+  inline std::cv_status wait() {
+    std::unique_lock<std::mutex> lock(usb_mtx);
+
+    std::cv_status status = std::cv_status::no_timeout;
+    auto now = std::chrono::system_clock::now();
+    while (usb_count == 0) {
+      status =
+          usb_cv.wait_until(lock, now + std::chrono::seconds(TIMEOUT_PERIOD));
+      if (status == std::cv_status::timeout) {
+        ALOGI("timeout");
+        return status;
+      }
+    }
+    usb_count--;
+    return status;
+  }
+
+  // USB aidl hal Proxy
+  shared_ptr<IUsb> usb;
+
+  // Callback objects for usb aidl
+  // Methods of these objects are called to notify port status updates.
+  shared_ptr<IUsbCallback> usb_cb_1, usb_cb_2;
+
+  // The last conveyed status of the USB ports.
+  // Stores information of currentt_data_role, power_role for all the USB ports
+  PortStatus usb_last_port_status;
+
+  // Status of the last role switch operation.
+  Status usb_last_status;
+
+  // Port role information of the last role switch operation.
+  PortRole usb_last_port_role;
+
+  // Flag to indicate the invocation of role switch callback.
+  bool usb_role_switch_done;
+
+  // Flag to indicate the invocation of notifyContaminantEnabledStatus callback.
+  bool enable_contaminant_done;
+
+  // Flag to indicate the invocation of notifyEnableUsbDataStatus callback.
+  bool enable_usb_data_done;
+
+  // Flag to indicate the invocation of notifyEnableUsbDataWhileDockedStatus callback.
+  bool enable_usb_data_while_docked_done;
+
+  // Flag to indicate the invocation of notifyLimitPowerTransferStatus callback.
+  bool limit_power_transfer_done;
+
+  // Flag to indicate the invocation of notifyResetUsbPort callback.
+  bool reset_usb_port_done;
+
+  // Stores the cookie of the last invoked usb callback object.
+  int usb_last_cookie;
+
+  // Last transaction ID that was recorded.
+  int64_t last_transactionId;
+  // synchronization primitives to coordinate between main test thread
+  // and the callback thread.
+  std::mutex usb_mtx;
+  std::condition_variable usb_cv;
+  int usb_count = 0;
+};
+
+/*
+ * Test to see if setCallback succeeds.
+ * Callback object is created and registered.
+ */
+TEST_P(UsbAidlTest, setCallback) {
+  ALOGI("UsbAidlTest setCallback start");
+  usb_cb_1 = ::ndk::SharedRefBase::make<UsbCallback>(*this, 1);
+  ASSERT_NE(usb_cb_1, nullptr);
+  const auto& ret = usb->setCallback(usb_cb_1);
+  ASSERT_TRUE(ret.isOk());
+  ALOGI("UsbAidlTest setCallback end");
+}
+
+/*
+ * Check to see if querying type-c
+ * port status succeeds.
+ * The callback parameters are checked to see if the transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, queryPortStatus) {
+  ALOGI("UsbAidlTest queryPortStatus start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+  ALOGI("UsbAidlTest queryPortStatus end: %s", usb_last_port_status.portName.c_str());
+}
+
+/*
+ * Trying to switch a non-existent port should fail.
+ * This test case tried to switch the port with empty
+ * name which is expected to fail.
+ * The callback parameters are checked to see if the transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, switchEmptyPort) {
+  ALOGI("UsbAidlTest switchEmptyPort start");
+  PortRole role;
+  role.set<PortRole::powerRole>(PortPowerRole::SOURCE);
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->switchRole("", role, transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(Status::ERROR, usb_last_status);
+  EXPECT_EQ(transactionId, last_transactionId);
+  EXPECT_EQ(2, usb_last_cookie);
+  ALOGI("UsbAidlTest switchEmptyPort end");
+}
+
+/*
+ * Test switching the power role of usb port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, a power role switch
+ * to SOURCE is attempted for the port.
+ * The callback parameters are checked to see if the transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, switchPowerRole) {
+  ALOGI("UsbAidlTest switchPowerRole start");
+  PortRole role;
+  role.set<PortRole::powerRole>(PortPowerRole::SOURCE);
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    string portBeingSwitched = usb_last_port_status.portName;
+    ALOGI("switchPower role portname:%s", portBeingSwitched.c_str());
+    usb_role_switch_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->switchRole(portBeingSwitched, role, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           usb_role_switch_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest switchPowerRole end");
+}
+
+/*
+ * Test switching the data role of usb port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, a data role switch
+ * to device is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, switchDataRole) {
+  ALOGI("UsbAidlTest switchDataRole start");
+  PortRole role;
+  role.set<PortRole::dataRole>(PortDataRole::DEVICE);
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    string portBeingSwitched = usb_last_port_status.portName;
+    ALOGI("portname:%s", portBeingSwitched.c_str());
+    usb_role_switch_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->switchRole(portBeingSwitched, role, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           usb_role_switch_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest switchDataRole end");
+}
+
+/*
+ * Test enabling contaminant presence detection of the port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, enabling contaminant detection
+ * is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, enableContaminantPresenceDetection) {
+  ALOGI("UsbAidlTest enableContaminantPresenceDetection start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    enable_contaminant_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->enableContaminantPresenceDetection(usb_last_port_status.portName,
+                                                              true, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           enable_contaminant_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest enableContaminantPresenceDetection end");
+}
+
+/*
+ * Test enabling Usb data of the port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, enabling Usb data is attempted
+ * for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, enableUsbData) {
+  ALOGI("UsbAidlTest enableUsbData start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    enable_usb_data_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->enableUsbData(usb_last_port_status.portName, true, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           enable_usb_data_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest enableUsbData end");
+}
+
+/*
+ * Test enabling Usb data while being docked.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, enabling Usb data while docked
+ * is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, enableUsbDataWhileDocked) {
+  ALOGI("UsbAidlTest enableUsbDataWhileDocked start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    enable_usb_data_while_docked_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->enableUsbDataWhileDocked(usb_last_port_status.portName, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           enable_usb_data_while_docked_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest enableUsbDataWhileDocked end");
+}
+
+/*
+ * Test enabling Usb data of the port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, relaxing limit power transfer
+ * is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, limitPowerTransfer) {
+  ALOGI("UsbAidlTest limitPowerTransfer start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    limit_power_transfer_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->limitPowerTransfer(usb_last_port_status.portName, false, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           limit_power_transfer_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest limitPowerTransfer end");
+}
+
+/*
+ * Test reset Usb data of the port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, reset Usb data for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, DISABLED_resetUsbPort) {
+  ALOGI("UsbAidlTest resetUsbPort start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    reset_usb_port_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->resetUsbPort(usb_last_port_status.portName, transactionId);
+    ASSERT_TRUE(ret.isOk());
+    ALOGI("UsbAidlTest resetUsbPort ret.isOk");
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           reset_usb_port_done == false)
+      waitStatus = wait();
+
+    ALOGI("UsbAidlTest resetUsbPort wait()");
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest resetUsbPort end");
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(UsbAidlTest);
+INSTANTIATE_TEST_SUITE_P(
+        PerInstance, UsbAidlTest,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IUsb::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    ABinderProcess_setThreadPoolMaxThreadCount(1);
+    ABinderProcess_startThreadPool();
+    return RUN_ALL_TESTS();
+}
diff --git a/uwb/aidl/Android.bp b/uwb/aidl/Android.bp
index 99fd094..2cc1e6a 100755
--- a/uwb/aidl/Android.bp
+++ b/uwb/aidl/Android.bp
@@ -16,7 +16,7 @@
     stability: "vintf",
     backend: {
         java: {
-            sdk_version: "module_current",
+            sdk_version: "module_Tiramisu",
             enabled: false,
         },
         ndk: {
@@ -27,7 +27,7 @@
                 "//apex_available:platform",
                 "com.android.uwb",
             ],
-            min_sdk_version: "current",
+            min_sdk_version: "Tiramisu",
         },
         rust: {
             enabled: true,
@@ -35,7 +35,7 @@
                 "//apex_available:platform",
                 "com.android.uwb",
             ],
-            min_sdk_version: "current",
+            min_sdk_version: "Tiramisu",
         },
     },
 }
@@ -47,7 +47,7 @@
     stability: "vintf",
     backend: {
         java: {
-            sdk_version: "module_current",
+            sdk_version: "module_Tiramisu",
             enabled: true,
             apex_available: [
                 "com.android.uwb",
@@ -58,7 +58,7 @@
                 "//apex_available:platform",
                 "com.android.uwb",
             ],
-            min_sdk_version: "current",
+            min_sdk_version: "Tiramisu",
         },
     },
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
similarity index 82%
copy from uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
copy to uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
index f449c60..bc73b89 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
@@ -33,12 +33,14 @@
 
 package android.hardware.uwb.fira_android;
 @Backing(type="int") @VintfStability
-enum UwbVendorSessionSetAppConfigCmdParams {
-  CCC_RANGING_PROTOCOL_VER = 163,
-  CCC_UWB_CONFIG_ID = 164,
-  CCC_PULSESHAPE_COMBO = 165,
-  CCC_URSK_TTL = 166,
-  NB_OF_RANGE_MEASUREMENTS = 227,
-  NB_OF_AZIMUTH_MEASUREMENTS = 228,
-  NB_OF_ELEVATION_MEASUREMENTS = 229,
+enum UwbVendorCapabilityTlvTypes {
+  CCC_SUPPORTED_VERSIONS = 160,
+  CCC_SUPPORTED_UWB_CONFIGS = 161,
+  CCC_SUPPORTED_PULSE_SHAPE_COMBOS = 162,
+  CCC_SUPPORTED_RAN_MULTIPLIER = 163,
+  CCC_SUPPORTED_CHAPS_PER_SLOT = 164,
+  CCC_SUPPORTED_SYNC_CODES = 165,
+  CCC_SUPPORTED_CHANNELS = 166,
+  CCC_SUPPORTED_HOPPING_SEQUENCES = 167,
+  CCC_SUPPORTED_HOPPING_CONFIG_MODES = 168,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
similarity index 75%
copy from uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
copy to uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
index f449c60..ee47a13 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
@@ -32,13 +32,23 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.uwb.fira_android;
-@Backing(type="int") @VintfStability
-enum UwbVendorSessionSetAppConfigCmdParams {
-  CCC_RANGING_PROTOCOL_VER = 163,
-  CCC_UWB_CONFIG_ID = 164,
-  CCC_PULSESHAPE_COMBO = 165,
-  CCC_URSK_TTL = 166,
-  NB_OF_RANGE_MEASUREMENTS = 227,
-  NB_OF_AZIMUTH_MEASUREMENTS = 228,
-  NB_OF_ELEVATION_MEASUREMENTS = 229,
+@Backing(type="long") @VintfStability
+enum UwbVendorCapabilityTlvValues {
+  UWB_CONFIG_0 = 0,
+  UWB_CONFIG_1 = 1,
+  PULSE_SHAPE_SYMMETRICAL_ROOT_RAISED_COSINE = 1,
+  PULSE_SHAPE_PRECURSOR_FREE = 2,
+  PULSE_SHAPE_PRECURSOR_FREE_SPECIAL = 3,
+  CHAPS_PER_SLOT_3 = 3,
+  CHAPS_PER_SLOT_4 = 4,
+  CHAPS_PER_SLOT_6 = 6,
+  CHAPS_PER_SLOT_8 = 8,
+  CHAPS_PER_SLOT_9 = 9,
+  CHAPS_PER_SLOT_12 = 12,
+  CHAPS_PER_SLOT_24 = 24,
+  HOPPING_SEQUENCE_DEFAULT = 0,
+  HOPPING_SEQUENCE_AES = 1,
+  HOPPING_CONFIG_MODE_NONE = 0,
+  HOPPING_CONFIG_MODE_CONTINUOUS = 1,
+  HOPPING_CONFIG_MODE_ADAPTIVE = 2,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
similarity index 95%
rename from uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
rename to uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
index f449c60..d35728f 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
@@ -33,7 +33,9 @@
 
 package android.hardware.uwb.fira_android;
 @Backing(type="int") @VintfStability
-enum UwbVendorSessionSetAppConfigCmdParams {
+enum UwbVendorSessionAppConfigTlvTypes {
+  CCC_HOP_MODE_KEY = 160,
+  CCC_UWB_TIME0 = 161,
   CCC_RANGING_PROTOCOL_VER = 163,
   CCC_UWB_CONFIG_ID = 164,
   CCC_PULSESHAPE_COMBO = 165,
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
new file mode 100644
index 0000000..968cd17
--- /dev/null
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.uwb.fira_android;
+
+/**
+ * Android specific capability TLV types in UCI command:
+ * GID: 0000b (UWB Core Group)
+ * OID: 000011b (CORE_GET_CAPS_INFO_CMD)
+ *
+ * For FIRA params, please refer to params mentioned in CR 287.
+ *
+ * Values expected for each type are mentioned in the docs below and the constants
+ * used are defined in UwbVendorCapabilityTlvValues enum.
+ */
+@VintfStability
+@Backing(type="int")
+enum UwbVendorCapabilityTlvTypes {
+    /*********************************************
+     * CCC specific
+     ********************************************/
+
+    /**
+     * 2 byte tuple {major_version (1 byte), minor_version (1 byte)} array with list of supported
+     * CCC versions
+     */
+    CCC_SUPPORTED_VERSIONS = 0xA0,
+    /**
+     * byte array with a list of supported UWB configs
+     * Values:
+     *  UWB_CONFIG_0 = 0
+     *  UWB_CONFIG_1 = 1
+     */
+    CCC_SUPPORTED_UWB_CONFIGS = 0xA1,
+    /**
+     * 1 byte tuple {initiator_tx (4 bits), responder_tx (4 bits)} array with list of supported
+     * pulse shape combos
+     * Values:
+     *  PULSE_SHAPE_SYMMETRICAL_ROOT_RAISED_COSINE = 1
+     *  PULSE_SHAPE_PRECURSOR_FREE = 2
+     *  PULSE_SHAPE_PRECURSOR_FREE_SPECIAL = 3
+     */
+    /**  */
+    CCC_SUPPORTED_PULSE_SHAPE_COMBOS = 0xA2,
+    /** Int value for indicating supported ran multiplier */
+    CCC_SUPPORTED_RAN_MULTIPLIER = 0xA3,
+    /**
+     * byte array with a list of supported chaps per slot
+     * Values:
+     *  CHAPS_PER_SLOT_3 = 3
+     *  CHAPS_PER_SLOT_4 = 4
+     *  CHAPS_PER_SLOT_6 = 6
+     *  CHAPS_PER_SLOT_8 = 8
+     *  CHAPS_PER_SLOT_9 = 9
+     *  CHAPS_PER_SLOT_12 = 12
+     *  CHAPS_PER_SLOT_24 = 24
+     */
+    CCC_SUPPORTED_CHAPS_PER_SLOT = 0xA4,
+    /**
+     * byte array with a list of supported sync codes
+     * Values: 1 - 32
+     */
+    CCC_SUPPORTED_SYNC_CODES = 0xA5,
+    /** byte array with list of supported channels */
+    CCC_SUPPORTED_CHANNELS = 0xA6,
+    /**
+     * byte array with a list of supported hopping sequences
+     * Values:
+        HOPPING_SEQUENCE_DEFAULT = 0
+        HOPPING_SEQUENCE_AES = 1
+     */
+    CCC_SUPPORTED_HOPPING_SEQUENCES = 0xA7,
+    /**
+     * byte array with a list of supported hopping config modes
+     * Values:
+     *  HOPPING_CONFIG_MODE_NONE = 0
+     *  HOPPING_CONFIG_MODE_CONTINUOUS = 1
+     *  HOPPING_CONFIG_MODE_ADAPTIVE = 2
+     */
+    CCC_SUPPORTED_HOPPING_CONFIG_MODES = 0xA8,
+}
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
new file mode 100644
index 0000000..380089f
--- /dev/null
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvValues.aidl
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.uwb.fira_android;
+
+/**
+ * Android specific capability TLV values expected in UCI command:
+ * GID: 0000b (UWB Core Group),
+ * OID: 000011b (CORE_GET_CAPS_INFO_CMD),
+ */
+@VintfStability
+@Backing(type="long")
+enum UwbVendorCapabilityTlvValues {
+    /*********************************************
+     * CCC specific
+     ********************************************/
+    UWB_CONFIG_0 = 0,
+    UWB_CONFIG_1 = 1,
+
+    PULSE_SHAPE_SYMMETRICAL_ROOT_RAISED_COSINE = 1,
+    PULSE_SHAPE_PRECURSOR_FREE = 2,
+    PULSE_SHAPE_PRECURSOR_FREE_SPECIAL = 3,
+
+    CHAPS_PER_SLOT_3 = 3,
+    CHAPS_PER_SLOT_4 = 4,
+    CHAPS_PER_SLOT_6 = 6,
+    CHAPS_PER_SLOT_8 = 8,
+    CHAPS_PER_SLOT_9 = 9,
+    CHAPS_PER_SLOT_12 = 12,
+    CHAPS_PER_SLOT_24 = 24,
+
+    HOPPING_SEQUENCE_DEFAULT = 0,
+    HOPPING_SEQUENCE_AES = 1,
+
+    HOPPING_CONFIG_MODE_NONE = 0,
+    HOPPING_CONFIG_MODE_CONTINUOUS = 1,
+    HOPPING_CONFIG_MODE_ADAPTIVE = 2,
+}
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
similarity index 81%
rename from uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
rename to uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
index f5e02c0..b770ee0 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionSetAppConfigCmdParams.aidl
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorSessionAppConfigTlvTypes.aidl
@@ -17,25 +17,34 @@
 package android.hardware.uwb.fira_android;
 
 /**
- * Android specific vendor app params set in UCI command:
+ * Android specific vendor app params set/expected in UCI command:
  * GID: 0001b (UWB Session config Group)
  * OID: 000011b (SESSION_SET_APP_CONFIG_CMD)
+ * OID: 000100b (SESSION_GET_APP_CONFIG_CMD)
  *
  * Note: Refer to Table 34 of the UCI specification for the other params
  * expected in this command.
  */
 @VintfStability
 @Backing(type="int")
-enum UwbVendorSessionSetAppConfigCmdParams {
+enum UwbVendorSessionAppConfigTlvTypes {
     /** CCC params for ranging start */
 
     /**
      * Added in vendor version 0.
      * Range 0xA0 - 0xDF reserved for CCC use.
      */
+    /** 16 byte data */
+    CCC_HOP_MODE_KEY = 0xA0,
+    /** 8 byte data */
+    CCC_UWB_TIME0 = 0xA1,
+    /** 2 byte data */
     CCC_RANGING_PROTOCOL_VER = 0xA3,
+    /** 2 byte data */
     CCC_UWB_CONFIG_ID = 0xA4,
+    /** 1 byte data */
     CCC_PULSESHAPE_COMBO = 0xA5,
+    /** 2 byte data */
     CCC_URSK_TTL = 0xA6,
 
     /**
@@ -51,7 +60,10 @@
      * Supported only if the value returned by getSupportedAndroidCapabilities()
      * has the bit of UwbAndroidCapabilities.ANTENNAE_INTERLEAVING set to 1.
      */
+    /** 2 byte data */
     NB_OF_RANGE_MEASUREMENTS = 0xE3,
+    /** 2 byte data */
     NB_OF_AZIMUTH_MEASUREMENTS = 0xE4,
+    /** 2 byte data */
     NB_OF_ELEVATION_MEASUREMENTS = 0xE5,
 }
diff --git a/wifi/1.6/Android.bp b/wifi/1.6/Android.bp
index d293c73..14cb2e0 100644
--- a/wifi/1.6/Android.bp
+++ b/wifi/1.6/Android.bp
@@ -14,6 +14,13 @@
     root: "android.hardware",
     srcs: [
         "IWifi.hal",
+        "IWifiChip.hal",
+        "IWifiNanIface.hal",
+        "IWifiNanIfaceEventCallback.hal",
+        "IWifiRttController.hal",
+        "IWifiRttControllerEventCallback.hal",
+        "IWifiStaIface.hal",
+        "types.hal",
     ],
     interfaces: [
         "android.hardware.wifi@1.0",
diff --git a/wifi/1.6/IWifiChip.hal b/wifi/1.6/IWifiChip.hal
new file mode 100644
index 0000000..555ec91
--- /dev/null
+++ b/wifi/1.6/IWifiChip.hal
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::IWifiIface;
+import @1.0::WifiStatus;
+import @1.5::WifiBand;
+import @1.5::IWifiChip;
+import @1.5::WifiIfaceMode;
+import IWifiRttController;
+
+/**
+ * Interface that represents a chip that must be configured as a single unit.
+ */
+interface IWifiChip extends @1.5::IWifiChip {
+    /**
+     * Usable Wifi channels filter masks.
+     */
+    enum UsableChannelFilter : @1.5::IWifiChip.UsableChannelFilter {
+        /**
+         * Filter Wifi channels that are supported for NAN3.1 Instant communication mode. This
+         * filter should only be applied to NAN interface.
+         * - If 5G is supported default discovery channel 149/44 is considered,
+         * - If 5G is not supported then channel 6 has to be considered.
+         */
+        NAN_INSTANT_MODE = 1 << 2,
+    };
+
+    /**
+     * Create a RTTController instance.
+     *
+     * RTT controller can be either:
+     * a) Bound to a specific iface by passing in the corresponding |IWifiIface|
+     * object in |iface| param, OR
+     * b) Let the implementation decide the iface to use for RTT operations by
+     * passing null in |iface| param.
+     *
+     * @param boundIface HIDL interface object representing the iface if
+     *        the responder must be bound to a specific iface, null otherwise.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_CHIP_INVALID|
+     */
+    createRttController_1_6(IWifiIface boundIface)
+        generates (WifiStatus status, IWifiRttController rtt);
+
+    /**
+     * Retrieve list of usable Wifi channels for the specified band &
+     * operational modes.
+     *
+     * The list of usable Wifi channels in a given band depends on factors
+     * like current country code, operational mode (e.g. STA, SAP, WFD-CLI,
+     * WFD-GO, TDLS, NAN) and other restrictons due to DFS, cellular coexistence
+     * and conncurency state of the device.
+     *
+     * @param band |WifiBand| for which list of usable channels is requested.
+     * @param ifaceModeMask Bitmask of the modes represented by |WifiIfaceMode|
+     *        Bitmask respresents all the modes that the caller is interested
+     *        in (e.g. STA, SAP, CLI, GO, TDLS, NAN). E.g. If the caller is
+     *        interested in knowing usable channels for P2P CLI, P2P GO & NAN,
+     *        ifaceModeMask would be set to
+     *        IFACE_MODE_P2P_CLIENT|IFACE_MODE_P2P_GO|IFACE_MODE_NAN.
+     * @param filterMask Bitmask of filters represented by
+     *        |UsableChannelFilter|. Specifies whether driver should filter
+     *        channels based on additional criteria. If no filter is specified
+     *        driver should return usable channels purely based on regulatory
+     *        constraints.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.FAILURE_UNKNOWN|
+     * @return channels List of channels represented by |WifiUsableChannel|
+     *         Each entry represents a channel frequency, bandwidth and
+     *         bitmask of modes (e.g. STA, SAP, CLI, GO, TDLS, NAN) that are
+     *         allowed on that channel. E.g. If only STA mode can be supported
+     *         on an indoor channel, only the IFACE_MODE_STA bit would be set
+     *         for that channel. If 5GHz SAP cannot be supported, then none of
+     *         the 5GHz channels will have IFACE_MODE_SOFTAP bit set.
+     *         Note: Bits do not represent concurrency state. Each bit only
+     *         represents whether particular mode is allowed on that channel.
+     */
+    getUsableChannels_1_6(WifiBand band, bitfield<WifiIfaceMode> ifaceModeMask,
+        bitfield<UsableChannelFilter> filterMask)
+        generates (WifiStatus status, vec<WifiUsableChannel> channels);
+
+    /**
+     * Retrieve the list of all the possible radio combinations supported by this
+     * chip.
+     *
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_CHIP_INVALID|,
+     *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *         |WifiStatusCode.FAILURE_UNKNOWN|
+     * @return radioCombinationMatrix
+     *         A list of all the possible radio combinations represented by
+     *         |WifiRadioCombinationMatrix|.
+     *         For Example in case of a chip which has two radios, where one radio is
+     *         capable of 2.4GHz 2X2 only and another radio which is capable of either
+     *         5GHz or 6GHz 2X2, number of possible radio combinations in this case
+     *         are 5 and possible combinations are
+     *         {{{2G 2X2}}, //Standalone 2G
+     *         {{5G 2X2}}, //Standalone 5G
+     *         {{6G 2X2}}, //Standalone 6G
+     *         {{2G 2X2}, {5G 2X2}}, //2G+5G DBS
+     *         {{2G 2X2}, {6G 2X2}}} //2G+6G DBS
+     *         Note: Since this chip doesn’t support 5G+6G simultaneous operation
+     *         as there is only one radio which can support both bands, So it can only
+     *         do MCC 5G+6G. This table should not get populated with possible MCC
+     *         configurations. This is only for simultaneous radio configurations
+     *         (such as standalone, multi band simultaneous or single band simultaneous).
+     */
+    getSupportedRadioCombinationsMatrix()
+        generates (WifiStatus status, WifiRadioCombinationMatrix radioCombinationMatrix);
+};
diff --git a/wifi/1.6/IWifiNanIface.hal b/wifi/1.6/IWifiNanIface.hal
new file mode 100644
index 0000000..7ffd278
--- /dev/null
+++ b/wifi/1.6/IWifiNanIface.hal
@@ -0,0 +1,155 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::WifiStatus;
+import @1.0::CommandIdShort;
+import @1.4::NanConfigRequest;
+import @1.4::NanEnableRequest;
+import @1.5::IWifiNanIface;
+import IWifiNanIfaceEventCallback;
+import NanConfigRequestSupplemental;
+import NanInitiateDataPathRequest;
+import NanPublishRequest;
+import NanRespondToDataPathIndicationRequest;
+
+/**
+ * Interface used to represent a single NAN (Neighbour Aware Network) iface.
+ *
+ * References to "NAN Spec" are to the Wi-Fi Alliance "Wi-Fi Neighbor Awareness
+ * Networking (NAN) Technical Specification".
+ */
+interface IWifiNanIface extends @1.5::IWifiNanIface {
+    /**
+     * Requests notifications of significant events on this iface. Multiple calls
+     * to this must register multiple callbacks each of which must receive all
+     * events.
+     *
+     * @param callback An instance of the |IWifiNanIfaceEventCallback| HIDL interface
+     *        object.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|
+     */
+    registerEventCallback_1_6(IWifiNanIfaceEventCallback callback) generates (WifiStatus status);
+
+    /**
+     * Initiate a data-path (NDP) setup operation: Initiator.
+     * Asynchronous response is with |IWifiNanIfaceEventCallback.notifyInitiateDataPathResponse|.
+     *
+     * Note: supersedes the @1.0::IWifiNanIface.respondToDataPathIndicationRequest() method which is
+     * deprecated as of HAL version 1.6.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @param msg Instance of |NanInitiateDataPathRequest|.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    initiateDataPathRequest_1_6(CommandIdShort cmdId, NanInitiateDataPathRequest msg)
+        generates (WifiStatus status);
+
+    /**
+     * Respond to a received data indication as part of a data-path (NDP) setup operation. An
+     * indication is received by the Responder from the Initiator.
+     * Asynchronous response is with
+     * |IWifiNanIfaceEventCallback.notifyRespondToDataPathIndicationResponse|.
+     *
+     * Note: supersedes the @1.0::IWifiNanIface.respondToDataPathIndicationRequest() method which is
+     * deprecated as of HAL version 1.6.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @param msg Instance of |NanRespondToDataPathIndicationRequest|.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    respondToDataPathIndicationRequest_1_6(CommandIdShort cmdId,
+        NanRespondToDataPathIndicationRequest msg) generates (WifiStatus status);
+
+    /**
+     * Enable NAN: configures and activates NAN clustering (does not start
+     * a discovery session or set up data-interfaces or data-paths). Use the
+     * |IWifiNanIface.configureRequest| method to change the configuration of an already enabled
+     * NAN interface.
+     * Asynchronous response is with |IWifiNanIfaceEventCallback.notifyEnableResponse|.
+     *
+     * Note: supersedes the @1.5::IWifiNanIface.enableRequest() method which is deprecated as of
+     * HAL version 1.6.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @param msg1 Instance of |NanEnableRequest|.
+     * @param msg2 Instance of |NanConfigRequestSupplemental|.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    enableRequest_1_6(CommandIdShort cmdId, NanEnableRequest msg1,
+        NanConfigRequestSupplemental msg2) generates (WifiStatus status);
+
+    /**
+     * Configure NAN: configures an existing NAN functionality (i.e. assumes
+     * |IWifiNanIface.enableRequest| already submitted and succeeded).
+     * Asynchronous response is with |IWifiNanIfaceEventCallback.notifyConfigResponse|.
+     *
+     * Note: supersedes the @1.5::IWifiNanIface.configRequest() method which is deprecated as of
+     * HAL version 1.6.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @param msg1 Instance of |NanConfigRequest|.
+     * @param msg2 Instance of |NanConfigRequestSupplemental|.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    configRequest_1_6(CommandIdShort cmdId, NanConfigRequest msg1,
+        NanConfigRequestSupplemental msg2) generates (WifiStatus status);
+
+    /**
+     * Publish request to start advertising a discovery service.
+     * Asynchronous response is with |IWifiNanIfaceEventCallback.notifyStartPublishResponse|.
+     *
+     * Note: supersedes the @1.0::IWifiNanIface.startPublishRequest() method which is deprecated as
+     * of HAL version 1.6.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @param msg Instance of |NanPublishRequest|.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    startPublishRequest_1_6(CommandIdShort cmdId, NanPublishRequest msg)
+        generates (WifiStatus status);
+};
diff --git a/wifi/1.6/IWifiNanIfaceEventCallback.hal b/wifi/1.6/IWifiNanIfaceEventCallback.hal
new file mode 100644
index 0000000..f19f900
--- /dev/null
+++ b/wifi/1.6/IWifiNanIfaceEventCallback.hal
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::CommandIdShort;
+import @1.0::WifiNanStatus;
+import @1.5::IWifiNanIfaceEventCallback;
+
+/**
+ * NAN Response and Asynchronous Event Callbacks.
+ *
+ * References to "NAN Spec" are to the Wi-Fi Alliance "Wi-Fi Neighbor Awareness
+ * Networking (NAN) Technical Specification".
+ */
+interface IWifiNanIfaceEventCallback extends @1.5::IWifiNanIfaceEventCallback {
+    /**
+     * Asynchronous callback indicating a data-path (NDP) setup has been completed: received by
+     * both Initiator and Responder.
+     *
+     * Note: supersedes the @1.0::IWifiNanIfaceEventCallback.eventDataPathConfirm() method which is
+     * deprecated as of HAL version 1.2.
+     *
+     * @param event: NanDataPathConfirmInd containing event details.
+     */
+    oneway eventDataPathConfirm_1_6(NanDataPathConfirmInd event);
+
+    /**
+     * Asynchronous callback indicating a data-path (NDP) schedule has been updated (e.g. channels
+     * have been changed).
+     *
+     * @param event: NanDataPathScheduleUpdateInd containing event details.
+     */
+    oneway eventDataPathScheduleUpdate_1_6(NanDataPathScheduleUpdateInd event);
+
+    /**
+     * Asynchronous callback indicating that a match has occurred: i.e. a service has been
+     * discovered.
+     *
+     * Note: supersedes the @1.0::IWifiNanIfaceEventCallback.eventMatch(NanMatchInd event) method
+     * which is deprecated as of HAL version 1.6.
+     *
+     * @param event: NanMatchInd containing event details.
+     */
+    oneway eventMatch_1_6(NanMatchInd event);
+
+    /**
+     * Asynchronous callback invoked in response to a capability request
+     * |IWifiNanIface.getCapabilitiesRequest|.
+     *
+     * Note: supersedes the @1.5::IWifiNanIfaceEventCallback.notifyCapabilitiesResponse() method
+     * which is deprecated as of HAL version 1.6.
+     *
+     * @param cmdId command Id corresponding to the original request.
+     * @param status WifiNanStatus of the operation. Possible status codes are:
+     *        |NanStatusType.SUCCESS|
+     * @param capabilities Capability data.
+     */
+    oneway notifyCapabilitiesResponse_1_6(CommandIdShort id, WifiNanStatus status,
+        NanCapabilities capabilities);
+};
diff --git a/wifi/1.6/IWifiRttController.hal b/wifi/1.6/IWifiRttController.hal
new file mode 100644
index 0000000..a08f7e4
--- /dev/null
+++ b/wifi/1.6/IWifiRttController.hal
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::CommandId;
+import @1.0::WifiStatus;
+import @1.4::IWifiRttController;
+import IWifiRttControllerEventCallback;
+
+/**
+ * Interface used to perform RTT(Round trip time) operations.
+ */
+interface IWifiRttController extends @1.4::IWifiRttController {
+    /**
+     * Requests notifications of significant events on this rtt controller.
+     * Multiple calls to this must register multiple callbacks each of which must
+     * receive all events.
+     *
+     * @param callback An instance of the |IWifiRttControllerEventCallback| HIDL
+     *        interface object.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|
+     */
+    registerEventCallback_1_6(IWifiRttControllerEventCallback callback)
+        generates (WifiStatus status);
+
+    /**
+     * API to request RTT measurement.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @param rttConfigs Vector of |RttConfig| parameters.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    rangeRequest_1_6(CommandId cmdId, vec<RttConfig> rttConfigs) generates (WifiStatus status);
+
+    /**
+     * Get RTT responder information e.g. WiFi channel to enable responder on.
+     *
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     * @return info Instance of |RttResponderInfo|.
+     */
+    getResponderInfo_1_6() generates (WifiStatus status, RttResponder info);
+
+    /**
+     * Enable RTT responder mode.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @parm channelHint Hint of the channel information where RTT responder must
+     *       be enabled on.
+     * @param maxDurationInSeconds Timeout of responder mode.
+     * @param info Instance of |RttResponderInfo|.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    enableResponder_1_6(CommandId cmdId, WifiChannelInfo channelHint,
+        uint32_t maxDurationInSeconds, RttResponder info) generates (WifiStatus status);
+
+    /**
+     * RTT capabilities of the device.
+     *
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     * @return capabilities Instance of |RttCapabilities|.
+     */
+    getCapabilities_1_6() generates (WifiStatus status, RttCapabilities capabilities);
+};
diff --git a/wifi/1.6/IWifiRttControllerEventCallback.hal b/wifi/1.6/IWifiRttControllerEventCallback.hal
new file mode 100644
index 0000000..0857b66
--- /dev/null
+++ b/wifi/1.6/IWifiRttControllerEventCallback.hal
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.4::IWifiRttControllerEventCallback;
+import @1.0::CommandId;
+
+/**
+ * RTT Response and Event Callbacks.
+ */
+interface IWifiRttControllerEventCallback extends @1.4::IWifiRttControllerEventCallback {
+    /*
+     * Invoked when an RTT result is available.
+     *
+     * @param cmdId command Id corresponding to the original request.
+     * @param results Vector of |RttResult| instances.
+     */
+    oneway onResults_1_6(CommandId cmdId, vec<RttResult> results);
+};
diff --git a/wifi/1.6/IWifiStaIface.hal b/wifi/1.6/IWifiStaIface.hal
new file mode 100644
index 0000000..c26e1a0
--- /dev/null
+++ b/wifi/1.6/IWifiStaIface.hal
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::WifiStatus;
+import @1.5::IWifiStaIface;
+
+/**
+ * Interface used to represent a single STA iface.
+ *
+ * IWifiChip.createStaIface() must return a @1.6::IWifiStaIface when supported.
+ */
+interface IWifiStaIface extends @1.5::IWifiStaIface {
+    /**
+     * Retrieve the latest link layer stats.
+     * Must fail if |StaIfaceCapabilityMask.LINK_LAYER_STATS| is not set or if
+     * link layer stats collection hasn't been explicitly enabled.
+     *
+     * @return status WifiStatus of the operation.
+     *     Possible status codes:
+     *     |WifiStatusCode.SUCCESS|,
+     *     |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *     |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *     |WifiStatusCode.ERROR_NOT_STARTED|,
+     *     |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *     |WifiStatusCode.ERROR_UNKNOWN|
+     * @return stats Instance of |LinkLayerStats|.
+     */
+    getLinkLayerStats_1_6() generates (WifiStatus status, StaLinkLayerStats stats);
+};
diff --git a/wifi/1.6/default/hidl_callback_util.h b/wifi/1.6/default/hidl_callback_util.h
index 3ac54c1..aab0ae5 100644
--- a/wifi/1.6/default/hidl_callback_util.h
+++ b/wifi/1.6/default/hidl_callback_util.h
@@ -20,6 +20,7 @@
 #include <set>
 
 #include <hidl/HidlSupport.h>
+#include <hidl/HidlTransportSupport.h>
 
 namespace {
 // Type of callback invoked by the death handler.
@@ -68,9 +69,11 @@
         // (callback proxy's raw pointer) to track the death of individual
         // clients.
         uint64_t cookie = reinterpret_cast<uint64_t>(cb.get());
-        if (cb_set_.find(cb) != cb_set_.end()) {
-            LOG(WARNING) << "Duplicate death notification registration";
-            return true;
+        for (const auto& s : cb_set_) {
+            if (interfacesEqual(cb, s)) {
+                LOG(ERROR) << "Duplicate death notification registration";
+                return true;
+            }
         }
         if (!cb->linkToDeath(death_handler_, cookie)) {
             LOG(ERROR) << "Failed to register death notification";
diff --git a/wifi/1.6/default/hidl_struct_util.cpp b/wifi/1.6/default/hidl_struct_util.cpp
index 3489c9e..45459e2 100644
--- a/wifi/1.6/default/hidl_struct_util.cpp
+++ b/wifi/1.6/default/hidl_struct_util.cpp
@@ -26,7 +26,7 @@
 namespace implementation {
 namespace hidl_struct_util {
 
-using V1_5::NanConfigRequestSupplemental;
+using V1_6::NanConfigRequestSupplemental;
 
 WifiChannelWidthInMhz convertLegacyWifiChannelWidthToHidl(legacy_hal::wifi_channel_width type);
 
@@ -367,6 +367,21 @@
     }
 }
 
+V1_5::WifiBand convertLegacyMacBandToHidlWifiBand(uint32_t band) {
+    switch (band) {
+        case legacy_hal::WLAN_MAC_2_4_BAND:
+            return V1_5::WifiBand::BAND_24GHZ;
+        case legacy_hal::WLAN_MAC_5_0_BAND:
+            return V1_5::WifiBand::BAND_5GHZ;
+        case legacy_hal::WLAN_MAC_6_0_BAND:
+            return V1_5::WifiBand::BAND_6GHZ;
+        case legacy_hal::WLAN_MAC_60_0_BAND:
+            return V1_5::WifiBand::BAND_60GHZ;
+        default:
+            return V1_5::WifiBand::BAND_UNSPECIFIED;
+    }
+}
+
 uint32_t convertHidlWifiIfaceModeToLegacy(uint32_t hidl_iface_mask) {
     uint32_t legacy_iface_mask = 0;
     if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_STA) {
@@ -433,12 +448,15 @@
     if (hidl_filter_mask & V1_5::IWifiChip::UsableChannelFilter::CONCURRENCY) {
         legacy_filter_mask |= legacy_hal::WIFI_USABLE_CHANNEL_FILTER_CONCURRENCY;
     }
+    if (hidl_filter_mask & V1_6::IWifiChip::UsableChannelFilter::NAN_INSTANT_MODE) {
+        legacy_filter_mask |= WIFI_USABLE_CHANNEL_FILTER_NAN_INSTANT_MODE;
+    }
     return legacy_filter_mask;
 }
 
 bool convertLegacyWifiUsableChannelToHidl(
         const legacy_hal::wifi_usable_channel& legacy_usable_channel,
-        V1_5::WifiUsableChannel* hidl_usable_channel) {
+        V1_6::WifiUsableChannel* hidl_usable_channel) {
     if (!hidl_usable_channel) {
         return false;
     }
@@ -454,13 +472,13 @@
 
 bool convertLegacyWifiUsableChannelsToHidl(
         const std::vector<legacy_hal::wifi_usable_channel>& legacy_usable_channels,
-        std::vector<V1_5::WifiUsableChannel>* hidl_usable_channels) {
+        std::vector<V1_6::WifiUsableChannel>* hidl_usable_channels) {
     if (!hidl_usable_channels) {
         return false;
     }
     *hidl_usable_channels = {};
     for (const auto& legacy_usable_channel : legacy_usable_channels) {
-        V1_5::WifiUsableChannel hidl_usable_channel;
+        V1_6::WifiUsableChannel hidl_usable_channel;
         if (!convertLegacyWifiUsableChannelToHidl(legacy_usable_channel, &hidl_usable_channel)) {
             return false;
         }
@@ -894,28 +912,28 @@
 
 bool convertLegacyLinkLayerRadioStatsToHidl(
         const legacy_hal::LinkLayerRadioStats& legacy_radio_stat,
-        V1_5::StaLinkLayerRadioStats* hidl_radio_stat) {
+        V1_6::StaLinkLayerRadioStats* hidl_radio_stat) {
     if (!hidl_radio_stat) {
         return false;
     }
     *hidl_radio_stat = {};
 
     hidl_radio_stat->radioId = legacy_radio_stat.stats.radio;
-    hidl_radio_stat->V1_3.V1_0.onTimeInMs = legacy_radio_stat.stats.on_time;
-    hidl_radio_stat->V1_3.V1_0.txTimeInMs = legacy_radio_stat.stats.tx_time;
-    hidl_radio_stat->V1_3.V1_0.rxTimeInMs = legacy_radio_stat.stats.rx_time;
-    hidl_radio_stat->V1_3.V1_0.onTimeInMsForScan = legacy_radio_stat.stats.on_time_scan;
-    hidl_radio_stat->V1_3.V1_0.txTimeInMsPerLevel = legacy_radio_stat.tx_time_per_levels;
-    hidl_radio_stat->V1_3.onTimeInMsForNanScan = legacy_radio_stat.stats.on_time_nbd;
-    hidl_radio_stat->V1_3.onTimeInMsForBgScan = legacy_radio_stat.stats.on_time_gscan;
-    hidl_radio_stat->V1_3.onTimeInMsForRoamScan = legacy_radio_stat.stats.on_time_roam_scan;
-    hidl_radio_stat->V1_3.onTimeInMsForPnoScan = legacy_radio_stat.stats.on_time_pno_scan;
-    hidl_radio_stat->V1_3.onTimeInMsForHs20Scan = legacy_radio_stat.stats.on_time_hs20;
+    hidl_radio_stat->V1_0.onTimeInMs = legacy_radio_stat.stats.on_time;
+    hidl_radio_stat->V1_0.txTimeInMs = legacy_radio_stat.stats.tx_time;
+    hidl_radio_stat->V1_0.rxTimeInMs = legacy_radio_stat.stats.rx_time;
+    hidl_radio_stat->V1_0.onTimeInMsForScan = legacy_radio_stat.stats.on_time_scan;
+    hidl_radio_stat->V1_0.txTimeInMsPerLevel = legacy_radio_stat.tx_time_per_levels;
+    hidl_radio_stat->onTimeInMsForNanScan = legacy_radio_stat.stats.on_time_nbd;
+    hidl_radio_stat->onTimeInMsForBgScan = legacy_radio_stat.stats.on_time_gscan;
+    hidl_radio_stat->onTimeInMsForRoamScan = legacy_radio_stat.stats.on_time_roam_scan;
+    hidl_radio_stat->onTimeInMsForPnoScan = legacy_radio_stat.stats.on_time_pno_scan;
+    hidl_radio_stat->onTimeInMsForHs20Scan = legacy_radio_stat.stats.on_time_hs20;
 
-    std::vector<V1_3::WifiChannelStats> hidl_channel_stats;
+    std::vector<V1_6::WifiChannelStats> hidl_channel_stats;
 
     for (const auto& channel_stat : legacy_radio_stat.channel_stats) {
-        V1_3::WifiChannelStats hidl_channel_stat;
+        V1_6::WifiChannelStats hidl_channel_stat;
         hidl_channel_stat.onTimeInMs = channel_stat.on_time;
         hidl_channel_stat.ccaBusyTimeInMs = channel_stat.cca_busy_time;
         /*
@@ -929,13 +947,13 @@
         hidl_channel_stats.push_back(hidl_channel_stat);
     }
 
-    hidl_radio_stat->V1_3.channelStats = hidl_channel_stats;
+    hidl_radio_stat->channelStats = hidl_channel_stats;
 
     return true;
 }
 
 bool convertLegacyLinkLayerStatsToHidl(const legacy_hal::LinkLayerStats& legacy_stats,
-                                       V1_5::StaLinkLayerStats* hidl_stats) {
+                                       V1_6::StaLinkLayerStats* hidl_stats) {
     if (!hidl_stats) {
         return false;
     }
@@ -1010,9 +1028,9 @@
     hidl_stats->iface.timeSliceDutyCycleInPercent =
             legacy_stats.iface.info.time_slicing_duty_cycle_percent;
     // peer info legacy_stats conversion.
-    std::vector<V1_5::StaPeerInfo> hidl_peers_info_stats;
+    std::vector<V1_6::StaPeerInfo> hidl_peers_info_stats;
     for (const auto& legacy_peer_info_stats : legacy_stats.peers) {
-        V1_5::StaPeerInfo hidl_peer_info_stats;
+        V1_6::StaPeerInfo hidl_peer_info_stats;
         if (!convertLegacyPeerInfoStatsToHidl(legacy_peer_info_stats, &hidl_peer_info_stats)) {
             return false;
         }
@@ -1020,9 +1038,9 @@
     }
     hidl_stats->iface.peers = hidl_peers_info_stats;
     // radio legacy_stats conversion.
-    std::vector<V1_5::StaLinkLayerRadioStats> hidl_radios_stats;
+    std::vector<V1_6::StaLinkLayerRadioStats> hidl_radios_stats;
     for (const auto& legacy_radio_stats : legacy_stats.radios) {
-        V1_5::StaLinkLayerRadioStats hidl_radio_stats;
+        V1_6::StaLinkLayerRadioStats hidl_radio_stats;
         if (!convertLegacyLinkLayerRadioStatsToHidl(legacy_radio_stats, &hidl_radio_stats)) {
             return false;
         }
@@ -1036,7 +1054,7 @@
 }
 
 bool convertLegacyPeerInfoStatsToHidl(const legacy_hal::WifiPeerInfo& legacy_peer_info_stats,
-                                      V1_5::StaPeerInfo* hidl_peer_info_stats) {
+                                      V1_6::StaPeerInfo* hidl_peer_info_stats) {
     if (!hidl_peer_info_stats) {
         return false;
     }
@@ -1044,9 +1062,9 @@
     hidl_peer_info_stats->staCount = legacy_peer_info_stats.peer_info.bssload.sta_count;
     hidl_peer_info_stats->chanUtil = legacy_peer_info_stats.peer_info.bssload.chan_util;
 
-    std::vector<V1_5::StaRateStat> hidlRateStats;
+    std::vector<V1_6::StaRateStat> hidlRateStats;
     for (const auto& legacy_rate_stats : legacy_peer_info_stats.rate_stats) {
-        V1_5::StaRateStat rateStat;
+        V1_6::StaRateStat rateStat;
         if (!convertLegacyWifiRateInfoToHidl(legacy_rate_stats.rate, &rateStat.rateInfo)) {
             return false;
         }
@@ -1363,11 +1381,11 @@
     return true;
 }
 
-bool convertHidlNanEnableRequest_1_4ToLegacy(const V1_4::NanEnableRequest& hidl_request1,
+bool convertHidlNanEnableRequest_1_6ToLegacy(const V1_4::NanEnableRequest& hidl_request1,
                                              const NanConfigRequestSupplemental& hidl_request2,
                                              legacy_hal::NanEnableRequest* legacy_request) {
     if (!legacy_request) {
-        LOG(ERROR) << "convertHidlNanEnableRequest_1_4ToLegacy: null legacy_request";
+        LOG(ERROR) << "convertHidlNanEnableRequest_1_6ToLegacy: null legacy_request";
         return false;
     }
 
@@ -1377,57 +1395,55 @@
     }
 
     legacy_request->config_discovery_beacon_int = 1;
-    legacy_request->discovery_beacon_interval = hidl_request2.V1_2.discoveryBeaconIntervalMs;
+    legacy_request->discovery_beacon_interval = hidl_request2.V1_5.V1_2.discoveryBeaconIntervalMs;
     legacy_request->config_nss = 1;
-    legacy_request->nss = hidl_request2.V1_2.numberOfSpatialStreamsInDiscovery;
+    legacy_request->nss = hidl_request2.V1_5.V1_2.numberOfSpatialStreamsInDiscovery;
     legacy_request->config_dw_early_termination = 1;
     legacy_request->enable_dw_termination =
-            hidl_request2.V1_2.enableDiscoveryWindowEarlyTermination;
+            hidl_request2.V1_5.V1_2.enableDiscoveryWindowEarlyTermination;
     legacy_request->config_enable_ranging = 1;
-    legacy_request->enable_ranging = hidl_request2.V1_2.enableRanging;
-
-    return true;
-}
-
-bool convertHidlNanEnableRequest_1_5ToLegacy(const V1_4::NanEnableRequest& hidl_request1,
-                                             const NanConfigRequestSupplemental& hidl_request2,
-                                             legacy_hal::NanEnableRequest* legacy_request) {
-    if (!legacy_request) {
-        LOG(ERROR) << "convertHidlNanEnableRequest_1_5ToLegacy: null legacy_request";
-        return false;
-    }
-
-    *legacy_request = {};
-    if (!convertHidlNanEnableRequest_1_4ToLegacy(hidl_request1, hidl_request2, legacy_request)) {
-        return false;
-    }
+    legacy_request->enable_ranging = hidl_request2.V1_5.V1_2.enableRanging;
 
     legacy_request->config_enable_instant_mode = 1;
-    legacy_request->enable_instant_mode = hidl_request2.enableInstantCommunicationMode;
+    legacy_request->enable_instant_mode = hidl_request2.V1_5.enableInstantCommunicationMode;
+    legacy_request->config_instant_mode_channel = 1;
+    legacy_request->instant_mode_channel = hidl_request2.instantModeChannel;
 
     return true;
 }
 
-bool convertHidlNanConfigRequest_1_5ToLegacy(const V1_4::NanConfigRequest& hidl_request1,
+bool convertHidlNanConfigRequest_1_6ToLegacy(const V1_4::NanConfigRequest& hidl_request1,
                                              const NanConfigRequestSupplemental& hidl_request2,
                                              legacy_hal::NanConfigRequest* legacy_request) {
     if (!legacy_request) {
-        LOG(ERROR) << "convertHidlNanConfigRequest_1_5ToLegacy: null legacy_request";
+        LOG(ERROR) << "convertHidlNanConfigRequest_1_6ToLegacy: null legacy_request";
         return false;
     }
 
     *legacy_request = {};
-    if (!convertHidlNanConfigRequest_1_4ToLegacy(hidl_request1, hidl_request2, legacy_request)) {
+    if (!convertHidlNanConfigRequestToLegacy(hidl_request1, legacy_request)) {
         return false;
     }
 
+    legacy_request->config_discovery_beacon_int = 1;
+    legacy_request->discovery_beacon_interval = hidl_request2.V1_5.V1_2.discoveryBeaconIntervalMs;
+    legacy_request->config_nss = 1;
+    legacy_request->nss = hidl_request2.V1_5.V1_2.numberOfSpatialStreamsInDiscovery;
+    legacy_request->config_dw_early_termination = 1;
+    legacy_request->enable_dw_termination =
+            hidl_request2.V1_5.V1_2.enableDiscoveryWindowEarlyTermination;
+    legacy_request->config_enable_ranging = 1;
+    legacy_request->enable_ranging = hidl_request2.V1_5.V1_2.enableRanging;
+
     legacy_request->config_enable_instant_mode = 1;
-    legacy_request->enable_instant_mode = hidl_request2.enableInstantCommunicationMode;
+    legacy_request->enable_instant_mode = hidl_request2.V1_5.enableInstantCommunicationMode;
+    legacy_request->config_instant_mode_channel = 1;
+    legacy_request->instant_mode_channel = hidl_request2.instantModeChannel;
 
     return true;
 }
 
-bool convertHidlNanPublishRequestToLegacy(const NanPublishRequest& hidl_request,
+bool convertHidlNanPublishRequestToLegacy(const V1_6::NanPublishRequest& hidl_request,
                                           legacy_hal::NanPublishRequest* legacy_request) {
     if (!legacy_request) {
         LOG(ERROR) << "convertHidlNanPublishRequestToLegacy: null legacy_request";
@@ -1494,6 +1510,15 @@
             hidl_request.baseConfigs.disableFollowupReceivedIndication ? 0x4 : 0x0;
     legacy_request->recv_indication_cfg |= 0x8;
     legacy_request->cipher_type = (unsigned int)hidl_request.baseConfigs.securityConfig.cipherType;
+
+    legacy_request->scid_len = hidl_request.baseConfigs.securityConfig.scid.size();
+    if (legacy_request->scid_len > NAN_MAX_SCID_BUF_LEN) {
+        LOG(ERROR) << "convertHidlNanPublishRequestToLegacy: scid_len too large";
+        return false;
+    }
+    memcpy(legacy_request->scid, hidl_request.baseConfigs.securityConfig.scid.data(),
+           legacy_request->scid_len);
+
     if (hidl_request.baseConfigs.securityConfig.securityType == NanDataPathSecurityType::PMK) {
         legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PMK;
         legacy_request->key_info.body.pmk_info.pmk_len =
@@ -1531,6 +1556,7 @@
             (hidl_request.baseConfigs.securityConfig.securityType != NanDataPathSecurityType::OPEN)
                     ? legacy_hal::NAN_DP_CONFIG_SECURITY
                     : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
+
     legacy_request->sdea_params.ranging_state = hidl_request.baseConfigs.rangingRequired
                                                         ? legacy_hal::NAN_RANGING_ENABLE
                                                         : legacy_hal::NAN_RANGING_DISABLE;
@@ -1554,7 +1580,7 @@
     return true;
 }
 
-bool convertHidlNanSubscribeRequestToLegacy(const NanSubscribeRequest& hidl_request,
+bool convertHidlNanSubscribeRequestToLegacy(const V1_0::NanSubscribeRequest& hidl_request,
                                             legacy_hal::NanSubscribeRequest* legacy_request) {
     if (!legacy_request) {
         LOG(ERROR) << "convertHidlNanSubscribeRequestToLegacy: legacy_request is null";
@@ -1835,35 +1861,8 @@
     return true;
 }
 
-bool convertHidlNanConfigRequest_1_4ToLegacy(const V1_4::NanConfigRequest& hidl_request1,
-                                             const NanConfigRequestSupplemental& hidl_request2,
-                                             legacy_hal::NanConfigRequest* legacy_request) {
-    if (!legacy_request) {
-        LOG(ERROR) << "convertHidlNanConfigRequest_1_4ToLegacy: legacy_request "
-                      "is null";
-        return false;
-    }
-
-    *legacy_request = {};
-    if (!convertHidlNanConfigRequestToLegacy(hidl_request1, legacy_request)) {
-        return false;
-    }
-
-    legacy_request->config_discovery_beacon_int = 1;
-    legacy_request->discovery_beacon_interval = hidl_request2.V1_2.discoveryBeaconIntervalMs;
-    legacy_request->config_nss = 1;
-    legacy_request->nss = hidl_request2.V1_2.numberOfSpatialStreamsInDiscovery;
-    legacy_request->config_dw_early_termination = 1;
-    legacy_request->enable_dw_termination =
-            hidl_request2.V1_2.enableDiscoveryWindowEarlyTermination;
-    legacy_request->config_enable_ranging = 1;
-    legacy_request->enable_ranging = hidl_request2.V1_2.enableRanging;
-
-    return true;
-}
-
 bool convertHidlNanDataPathInitiatorRequestToLegacy(
-        const NanInitiateDataPathRequest& hidl_request,
+        const V1_0::NanInitiateDataPathRequest& hidl_request,
         legacy_hal::NanDataPathInitiatorRequest* legacy_request) {
     if (!legacy_request) {
         LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: "
@@ -1939,8 +1938,91 @@
     return true;
 }
 
+bool convertHidlNanDataPathInitiatorRequest_1_6ToLegacy(
+        const V1_6::NanInitiateDataPathRequest& hidl_request,
+        legacy_hal::NanDataPathInitiatorRequest* legacy_request) {
+    if (!legacy_request) {
+        LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: "
+                      "legacy_request is null";
+        return false;
+    }
+    *legacy_request = {};
+
+    legacy_request->requestor_instance_id = hidl_request.peerId;
+    memcpy(legacy_request->peer_disc_mac_addr, hidl_request.peerDiscMacAddr.data(), 6);
+    legacy_request->channel_request_type =
+            convertHidlNanDataPathChannelCfgToLegacy(hidl_request.channelRequestType);
+    legacy_request->channel = hidl_request.channel;
+    if (strnlen(hidl_request.ifaceName.c_str(), IFNAMSIZ + 1) == IFNAMSIZ + 1) {
+        LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: "
+                      "ifaceName too long";
+        return false;
+    }
+    strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
+    legacy_request->ndp_cfg.security_cfg =
+            (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN)
+                    ? legacy_hal::NAN_DP_CONFIG_SECURITY
+                    : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
+    legacy_request->app_info.ndp_app_info_len = hidl_request.appInfo.size();
+    if (legacy_request->app_info.ndp_app_info_len > NAN_DP_MAX_APP_INFO_LEN) {
+        LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: "
+                      "ndp_app_info_len too large";
+        return false;
+    }
+    memcpy(legacy_request->app_info.ndp_app_info, hidl_request.appInfo.data(),
+           legacy_request->app_info.ndp_app_info_len);
+    legacy_request->cipher_type = (unsigned int)hidl_request.securityConfig.cipherType;
+    if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PMK) {
+        legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PMK;
+        legacy_request->key_info.body.pmk_info.pmk_len = hidl_request.securityConfig.pmk.size();
+        if (legacy_request->key_info.body.pmk_info.pmk_len != NAN_PMK_INFO_LEN) {
+            LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: "
+                          "invalid pmk_len";
+            return false;
+        }
+        memcpy(legacy_request->key_info.body.pmk_info.pmk, hidl_request.securityConfig.pmk.data(),
+               legacy_request->key_info.body.pmk_info.pmk_len);
+    }
+    if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PASSPHRASE) {
+        legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
+        legacy_request->key_info.body.passphrase_info.passphrase_len =
+                hidl_request.securityConfig.passphrase.size();
+        if (legacy_request->key_info.body.passphrase_info.passphrase_len <
+            NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+            LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: "
+                          "passphrase_len too small";
+            return false;
+        }
+        if (legacy_request->key_info.body.passphrase_info.passphrase_len >
+            NAN_SECURITY_MAX_PASSPHRASE_LEN) {
+            LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: "
+                          "passphrase_len too large";
+            return false;
+        }
+        memcpy(legacy_request->key_info.body.passphrase_info.passphrase,
+               hidl_request.securityConfig.passphrase.data(),
+               legacy_request->key_info.body.passphrase_info.passphrase_len);
+    }
+    legacy_request->service_name_len = hidl_request.serviceNameOutOfBand.size();
+    if (legacy_request->service_name_len > NAN_MAX_SERVICE_NAME_LEN) {
+        LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: "
+                      "service_name_len too large";
+        return false;
+    }
+    memcpy(legacy_request->service_name, hidl_request.serviceNameOutOfBand.data(),
+           legacy_request->service_name_len);
+    legacy_request->scid_len = hidl_request.securityConfig.scid.size();
+    if (legacy_request->scid_len > NAN_MAX_SCID_BUF_LEN) {
+        LOG(ERROR) << "convertHidlNanDataPathInitiatorRequest_1_6ToLegacy: scid_len too large";
+        return false;
+    }
+    memcpy(legacy_request->scid, hidl_request.securityConfig.scid.data(), legacy_request->scid_len);
+
+    return true;
+}
+
 bool convertHidlNanDataPathIndicationResponseToLegacy(
-        const NanRespondToDataPathIndicationRequest& hidl_request,
+        const V1_0::NanRespondToDataPathIndicationRequest& hidl_request,
         legacy_hal::NanDataPathIndicationResponse* legacy_request) {
     if (!legacy_request) {
         LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: "
@@ -2014,6 +2096,87 @@
     return true;
 }
 
+bool convertHidlNanDataPathIndicationResponse_1_6ToLegacy(
+        const V1_6::NanRespondToDataPathIndicationRequest& hidl_request,
+        legacy_hal::NanDataPathIndicationResponse* legacy_request) {
+    if (!legacy_request) {
+        LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: "
+                      "legacy_request is null";
+        return false;
+    }
+    *legacy_request = {};
+
+    legacy_request->rsp_code = hidl_request.acceptRequest ? legacy_hal::NAN_DP_REQUEST_ACCEPT
+                                                          : legacy_hal::NAN_DP_REQUEST_REJECT;
+    legacy_request->ndp_instance_id = hidl_request.ndpInstanceId;
+    if (strnlen(hidl_request.ifaceName.c_str(), IFNAMSIZ + 1) == IFNAMSIZ + 1) {
+        LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: "
+                      "ifaceName too long";
+        return false;
+    }
+    strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
+    legacy_request->ndp_cfg.security_cfg =
+            (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN)
+                    ? legacy_hal::NAN_DP_CONFIG_SECURITY
+                    : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
+    legacy_request->app_info.ndp_app_info_len = hidl_request.appInfo.size();
+    if (legacy_request->app_info.ndp_app_info_len > NAN_DP_MAX_APP_INFO_LEN) {
+        LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: "
+                      "ndp_app_info_len too large";
+        return false;
+    }
+    memcpy(legacy_request->app_info.ndp_app_info, hidl_request.appInfo.data(),
+           legacy_request->app_info.ndp_app_info_len);
+    legacy_request->cipher_type = (unsigned int)hidl_request.securityConfig.cipherType;
+    if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PMK) {
+        legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PMK;
+        legacy_request->key_info.body.pmk_info.pmk_len = hidl_request.securityConfig.pmk.size();
+        if (legacy_request->key_info.body.pmk_info.pmk_len != NAN_PMK_INFO_LEN) {
+            LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: "
+                          "invalid pmk_len";
+            return false;
+        }
+        memcpy(legacy_request->key_info.body.pmk_info.pmk, hidl_request.securityConfig.pmk.data(),
+               legacy_request->key_info.body.pmk_info.pmk_len);
+    }
+    if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PASSPHRASE) {
+        legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
+        legacy_request->key_info.body.passphrase_info.passphrase_len =
+                hidl_request.securityConfig.passphrase.size();
+        if (legacy_request->key_info.body.passphrase_info.passphrase_len <
+            NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+            LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: "
+                          "passphrase_len too small";
+            return false;
+        }
+        if (legacy_request->key_info.body.passphrase_info.passphrase_len >
+            NAN_SECURITY_MAX_PASSPHRASE_LEN) {
+            LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: "
+                          "passphrase_len too large";
+            return false;
+        }
+        memcpy(legacy_request->key_info.body.passphrase_info.passphrase,
+               hidl_request.securityConfig.passphrase.data(),
+               legacy_request->key_info.body.passphrase_info.passphrase_len);
+    }
+    legacy_request->service_name_len = hidl_request.serviceNameOutOfBand.size();
+    if (legacy_request->service_name_len > NAN_MAX_SERVICE_NAME_LEN) {
+        LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: "
+                      "service_name_len too large";
+        return false;
+    }
+    memcpy(legacy_request->service_name, hidl_request.serviceNameOutOfBand.data(),
+           legacy_request->service_name_len);
+    legacy_request->scid_len = hidl_request.securityConfig.scid.size();
+    if (legacy_request->scid_len > NAN_MAX_SCID_BUF_LEN) {
+        LOG(ERROR) << "convertHidlNanDataPathIndicationResponse_1_6ToLegacy: scid_len too large";
+        return false;
+    }
+    memcpy(legacy_request->scid, hidl_request.securityConfig.scid.data(), legacy_request->scid_len);
+
+    return true;
+}
+
 bool convertLegacyNanResponseHeaderToHidl(const legacy_hal::NanResponseMsg& legacy_response,
                                           WifiNanStatus* wifiNanStatus) {
     if (!wifiNanStatus) {
@@ -2028,7 +2191,7 @@
 }
 
 bool convertLegacyNanCapabilitiesResponseToHidl(const legacy_hal::NanCapabilities& legacy_response,
-                                                V1_5::NanCapabilities* hidl_response) {
+                                                V1_6::NanCapabilities* hidl_response) {
     if (!hidl_response) {
         LOG(ERROR) << "convertLegacyNanCapabilitiesResponseToHidl: "
                       "hidl_response is null";
@@ -2036,29 +2199,29 @@
     }
     *hidl_response = {};
 
-    hidl_response->V1_0.maxConcurrentClusters = legacy_response.max_concurrent_nan_clusters;
-    hidl_response->V1_0.maxPublishes = legacy_response.max_publishes;
-    hidl_response->V1_0.maxSubscribes = legacy_response.max_subscribes;
-    hidl_response->V1_0.maxServiceNameLen = legacy_response.max_service_name_len;
-    hidl_response->V1_0.maxMatchFilterLen = legacy_response.max_match_filter_len;
-    hidl_response->V1_0.maxTotalMatchFilterLen = legacy_response.max_total_match_filter_len;
-    hidl_response->V1_0.maxServiceSpecificInfoLen = legacy_response.max_service_specific_info_len;
-    hidl_response->V1_0.maxExtendedServiceSpecificInfoLen =
+    hidl_response->maxConcurrentClusters = legacy_response.max_concurrent_nan_clusters;
+    hidl_response->maxPublishes = legacy_response.max_publishes;
+    hidl_response->maxSubscribes = legacy_response.max_subscribes;
+    hidl_response->maxServiceNameLen = legacy_response.max_service_name_len;
+    hidl_response->maxMatchFilterLen = legacy_response.max_match_filter_len;
+    hidl_response->maxTotalMatchFilterLen = legacy_response.max_total_match_filter_len;
+    hidl_response->maxServiceSpecificInfoLen = legacy_response.max_service_specific_info_len;
+    hidl_response->maxExtendedServiceSpecificInfoLen =
             legacy_response.max_sdea_service_specific_info_len;
-    hidl_response->V1_0.maxNdiInterfaces = legacy_response.max_ndi_interfaces;
-    hidl_response->V1_0.maxNdpSessions = legacy_response.max_ndp_sessions;
-    hidl_response->V1_0.maxAppInfoLen = legacy_response.max_app_info_len;
-    hidl_response->V1_0.maxQueuedTransmitFollowupMsgs =
+    hidl_response->maxNdiInterfaces = legacy_response.max_ndi_interfaces;
+    hidl_response->maxNdpSessions = legacy_response.max_ndp_sessions;
+    hidl_response->maxAppInfoLen = legacy_response.max_app_info_len;
+    hidl_response->maxQueuedTransmitFollowupMsgs =
             legacy_response.max_queued_transmit_followup_msgs;
-    hidl_response->V1_0.maxSubscribeInterfaceAddresses = legacy_response.max_subscribe_address;
-    hidl_response->V1_0.supportedCipherSuites = legacy_response.cipher_suites_supported;
+    hidl_response->maxSubscribeInterfaceAddresses = legacy_response.max_subscribe_address;
+    hidl_response->supportedCipherSuites = legacy_response.cipher_suites_supported;
     hidl_response->instantCommunicationModeSupportFlag = legacy_response.is_instant_mode_supported;
 
     return true;
 }
 
 bool convertLegacyNanMatchIndToHidl(const legacy_hal::NanMatchInd& legacy_ind,
-                                    NanMatchInd* hidl_ind) {
+                                    V1_6::NanMatchInd* hidl_ind) {
     if (!hidl_ind) {
         LOG(ERROR) << "convertLegacyNanMatchIndToHidl: hidl_ind is null";
         return false;
@@ -2080,14 +2243,14 @@
     hidl_ind->matchOccuredInBeaconFlag = legacy_ind.match_occured_flag == 1;
     hidl_ind->outOfResourceFlag = legacy_ind.out_of_resource_flag == 1;
     hidl_ind->rssiValue = legacy_ind.rssi_value;
-    hidl_ind->peerCipherType = (NanCipherSuiteType)legacy_ind.peer_cipher_type;
+    hidl_ind->peerCipherType = (V1_6::NanCipherSuiteType)legacy_ind.peer_cipher_type;
     hidl_ind->peerRequiresSecurityEnabledInNdp =
             legacy_ind.peer_sdea_params.security_cfg == legacy_hal::NAN_DP_CONFIG_SECURITY;
     hidl_ind->peerRequiresRanging =
             legacy_ind.peer_sdea_params.ranging_state == legacy_hal::NAN_RANGING_ENABLE;
-    hidl_ind->rangingMeasurementInCm = legacy_ind.range_info.range_measurement_mm / 10;
+    hidl_ind->rangingMeasurementInMm = legacy_ind.range_info.range_measurement_mm;
     hidl_ind->rangingIndicationType = legacy_ind.range_info.ranging_event_type;
-
+    hidl_ind->scid = std::vector<uint8_t>(legacy_ind.scid, legacy_ind.scid + legacy_ind.scid_len);
     return true;
 }
 
@@ -2134,7 +2297,7 @@
 }
 
 bool convertLegacyNdpChannelInfoToHidl(const legacy_hal::NanChannelInfo& legacy_struct,
-                                       V1_2::NanDataPathChannelInfo* hidl_struct) {
+                                       V1_6::NanDataPathChannelInfo* hidl_struct) {
     if (!hidl_struct) {
         LOG(ERROR) << "convertLegacyNdpChannelInfoToHidl: hidl_struct is null";
         return false;
@@ -2150,7 +2313,7 @@
 }
 
 bool convertLegacyNanDataPathConfirmIndToHidl(const legacy_hal::NanDataPathConfirmInd& legacy_ind,
-                                              V1_2::NanDataPathConfirmInd* hidl_ind) {
+                                              V1_6::NanDataPathConfirmInd* hidl_ind) {
     if (!hidl_ind) {
         LOG(ERROR) << "convertLegacyNanDataPathConfirmIndToHidl: hidl_ind is null";
         return false;
@@ -2166,9 +2329,9 @@
     hidl_ind->V1_0.status.status = convertLegacyNanStatusTypeToHidl(legacy_ind.reason_code);
     hidl_ind->V1_0.status.description = "";  // TODO: b/34059183
 
-    std::vector<V1_2::NanDataPathChannelInfo> channelInfo;
+    std::vector<V1_6::NanDataPathChannelInfo> channelInfo;
     for (unsigned int i = 0; i < legacy_ind.num_channels; ++i) {
-        V1_2::NanDataPathChannelInfo hidl_struct;
+        V1_6::NanDataPathChannelInfo hidl_struct;
         if (!convertLegacyNdpChannelInfoToHidl(legacy_ind.channel_info[i], &hidl_struct)) {
             return false;
         }
@@ -2181,7 +2344,7 @@
 
 bool convertLegacyNanDataPathScheduleUpdateIndToHidl(
         const legacy_hal::NanDataPathScheduleUpdateInd& legacy_ind,
-        V1_2::NanDataPathScheduleUpdateInd* hidl_ind) {
+        V1_6::NanDataPathScheduleUpdateInd* hidl_ind) {
     if (!hidl_ind) {
         LOG(ERROR) << "convertLegacyNanDataPathScheduleUpdateIndToHidl: "
                       "hidl_ind is null";
@@ -2190,9 +2353,9 @@
     *hidl_ind = {};
 
     hidl_ind->peerDiscoveryAddress = hidl_array<uint8_t, 6>(legacy_ind.peer_mac_addr);
-    std::vector<V1_2::NanDataPathChannelInfo> channelInfo;
+    std::vector<V1_6::NanDataPathChannelInfo> channelInfo;
     for (unsigned int i = 0; i < legacy_ind.num_channels; ++i) {
-        V1_2::NanDataPathChannelInfo hidl_struct;
+        V1_6::NanDataPathChannelInfo hidl_struct;
         if (!convertLegacyNdpChannelInfoToHidl(legacy_ind.channel_info[i], &hidl_struct)) {
             return false;
         }
@@ -2260,13 +2423,16 @@
             return legacy_hal::WIFI_CHAN_WIDTH_5;
         case WifiChannelWidthInMhz::WIDTH_10:
             return legacy_hal::WIFI_CHAN_WIDTH_10;
+        case V1_6::WifiChannelWidthInMhz::WIDTH_320:
+            return legacy_hal::WIFI_CHAN_WIDTH_320;
         case WifiChannelWidthInMhz::WIDTH_INVALID:
             return legacy_hal::WIFI_CHAN_WIDTH_INVALID;
     };
     CHECK(false);
 }
 
-WifiChannelWidthInMhz convertLegacyWifiChannelWidthToHidl(legacy_hal::wifi_channel_width type) {
+V1_6::WifiChannelWidthInMhz convertLegacyWifiChannelWidthToHidl(
+        legacy_hal::wifi_channel_width type) {
     switch (type) {
         case legacy_hal::WIFI_CHAN_WIDTH_20:
             return WifiChannelWidthInMhz::WIDTH_20;
@@ -2282,35 +2448,41 @@
             return WifiChannelWidthInMhz::WIDTH_5;
         case legacy_hal::WIFI_CHAN_WIDTH_10:
             return WifiChannelWidthInMhz::WIDTH_10;
+        case legacy_hal::WIFI_CHAN_WIDTH_320:
+            return V1_6::WifiChannelWidthInMhz::WIDTH_320;
         default:
             return WifiChannelWidthInMhz::WIDTH_INVALID;
     };
 }
 
-legacy_hal::wifi_rtt_preamble convertHidlRttPreambleToLegacy(V1_4::RttPreamble type) {
+legacy_hal::wifi_rtt_preamble convertHidlRttPreambleToLegacy(V1_6::RttPreamble type) {
     switch (type) {
-        case V1_4::RttPreamble::LEGACY:
+        case V1_6::RttPreamble::LEGACY:
             return legacy_hal::WIFI_RTT_PREAMBLE_LEGACY;
-        case V1_4::RttPreamble::HT:
+        case V1_6::RttPreamble::HT:
             return legacy_hal::WIFI_RTT_PREAMBLE_HT;
-        case V1_4::RttPreamble::VHT:
+        case V1_6::RttPreamble::VHT:
             return legacy_hal::WIFI_RTT_PREAMBLE_VHT;
-        case V1_4::RttPreamble::HE:
+        case V1_6::RttPreamble::HE:
             return legacy_hal::WIFI_RTT_PREAMBLE_HE;
+        case V1_6::RttPreamble::EHT:
+            return legacy_hal::WIFI_RTT_PREAMBLE_EHT;
     };
     CHECK(false);
 }
 
-V1_4::RttPreamble convertLegacyRttPreambleToHidl(legacy_hal::wifi_rtt_preamble type) {
+V1_6::RttPreamble convertLegacyRttPreambleToHidl(legacy_hal::wifi_rtt_preamble type) {
     switch (type) {
         case legacy_hal::WIFI_RTT_PREAMBLE_LEGACY:
-            return V1_4::RttPreamble::LEGACY;
+            return V1_6::RttPreamble::LEGACY;
         case legacy_hal::WIFI_RTT_PREAMBLE_HT:
-            return V1_4::RttPreamble::HT;
+            return V1_6::RttPreamble::HT;
         case legacy_hal::WIFI_RTT_PREAMBLE_VHT:
-            return V1_4::RttPreamble::VHT;
+            return V1_6::RttPreamble::VHT;
         case legacy_hal::WIFI_RTT_PREAMBLE_HE:
-            return V1_4::RttPreamble::HE;
+            return V1_6::RttPreamble::HE;
+        case legacy_hal::WIFI_RTT_PREAMBLE_EHT:
+            return V1_6::RttPreamble::EHT;
     };
     CHECK(false) << "Unknown legacy type: " << type;
 }
@@ -2329,6 +2501,8 @@
             return legacy_hal::WIFI_RTT_BW_80;
         case RttBw::BW_160MHZ:
             return legacy_hal::WIFI_RTT_BW_160;
+        case RttBw::BW_320MHZ:
+            return legacy_hal::WIFI_RTT_BW_320;
     };
     CHECK(false);
 }
@@ -2347,6 +2521,8 @@
             return RttBw::BW_80MHZ;
         case legacy_hal::WIFI_RTT_BW_160:
             return RttBw::BW_160MHZ;
+        case legacy_hal::WIFI_RTT_BW_320:
+            return RttBw::BW_320MHZ;
     };
     CHECK(false) << "Unknown legacy type: " << type;
 }
@@ -2363,20 +2539,22 @@
     CHECK(false);
 }
 
-V1_4::WifiRatePreamble convertLegacyWifiRatePreambleToHidl(uint8_t preamble) {
+V1_6::WifiRatePreamble convertLegacyWifiRatePreambleToHidl(uint8_t preamble) {
     switch (preamble) {
         case 0:
-            return V1_4::WifiRatePreamble::OFDM;
+            return V1_6::WifiRatePreamble::OFDM;
         case 1:
-            return V1_4::WifiRatePreamble::CCK;
+            return V1_6::WifiRatePreamble::CCK;
         case 2:
-            return V1_4::WifiRatePreamble::HT;
+            return V1_6::WifiRatePreamble::HT;
         case 3:
-            return V1_4::WifiRatePreamble::VHT;
+            return V1_6::WifiRatePreamble::VHT;
         case 4:
-            return V1_4::WifiRatePreamble::HE;
+            return V1_6::WifiRatePreamble::HE;
+        case 5:
+            return V1_6::WifiRatePreamble::EHT;
         default:
-            return V1_4::WifiRatePreamble::RESERVED;
+            return V1_6::WifiRatePreamble::RESERVED;
     };
     CHECK(false) << "Unknown legacy preamble: " << preamble;
 }
@@ -2464,7 +2642,7 @@
     return true;
 }
 
-bool convertHidlRttConfigToLegacy(const V1_4::RttConfig& hidl_config,
+bool convertHidlRttConfigToLegacy(const V1_6::RttConfig& hidl_config,
                                   legacy_hal::wifi_rtt_config* legacy_config) {
     if (!legacy_config) {
         return false;
@@ -2491,7 +2669,7 @@
 }
 
 bool convertHidlVectorOfRttConfigToLegacy(
-        const std::vector<V1_4::RttConfig>& hidl_configs,
+        const std::vector<V1_6::RttConfig>& hidl_configs,
         std::vector<legacy_hal::wifi_rtt_config>* legacy_configs) {
     if (!legacy_configs) {
         return false;
@@ -2542,7 +2720,7 @@
     return true;
 }
 
-bool convertHidlRttResponderToLegacy(const V1_4::RttResponder& hidl_responder,
+bool convertHidlRttResponderToLegacy(const V1_6::RttResponder& hidl_responder,
                                      legacy_hal::wifi_rtt_responder* legacy_responder) {
     if (!legacy_responder) {
         return false;
@@ -2556,7 +2734,7 @@
 }
 
 bool convertLegacyRttResponderToHidl(const legacy_hal::wifi_rtt_responder& legacy_responder,
-                                     V1_4::RttResponder* hidl_responder) {
+                                     V1_6::RttResponder* hidl_responder) {
     if (!hidl_responder) {
         return false;
     }
@@ -2570,7 +2748,7 @@
 
 bool convertLegacyRttCapabilitiesToHidl(
         const legacy_hal::wifi_rtt_capabilities& legacy_capabilities,
-        V1_4::RttCapabilities* hidl_capabilities) {
+        V1_6::RttCapabilities* hidl_capabilities) {
     if (!hidl_capabilities) {
         return false;
     }
@@ -2582,17 +2760,19 @@
     hidl_capabilities->responderSupported = legacy_capabilities.responder_supported;
     hidl_capabilities->preambleSupport = 0;
     for (const auto flag : {legacy_hal::WIFI_RTT_PREAMBLE_LEGACY, legacy_hal::WIFI_RTT_PREAMBLE_HT,
-                            legacy_hal::WIFI_RTT_PREAMBLE_VHT, legacy_hal::WIFI_RTT_PREAMBLE_HE}) {
+                            legacy_hal::WIFI_RTT_PREAMBLE_VHT, legacy_hal::WIFI_RTT_PREAMBLE_HE,
+                            legacy_hal::WIFI_RTT_PREAMBLE_EHT}) {
         if (legacy_capabilities.preamble_support & flag) {
             hidl_capabilities->preambleSupport |=
-                    static_cast<std::underlying_type<V1_4::RttPreamble>::type>(
+                    static_cast<std::underlying_type<V1_6::RttPreamble>::type>(
                             convertLegacyRttPreambleToHidl(flag));
         }
     }
     hidl_capabilities->bwSupport = 0;
     for (const auto flag :
          {legacy_hal::WIFI_RTT_BW_5, legacy_hal::WIFI_RTT_BW_10, legacy_hal::WIFI_RTT_BW_20,
-          legacy_hal::WIFI_RTT_BW_40, legacy_hal::WIFI_RTT_BW_80, legacy_hal::WIFI_RTT_BW_160}) {
+          legacy_hal::WIFI_RTT_BW_40, legacy_hal::WIFI_RTT_BW_80, legacy_hal::WIFI_RTT_BW_160,
+          legacy_hal::WIFI_RTT_BW_320}) {
         if (legacy_capabilities.bw_support & flag) {
             hidl_capabilities->bwSupport |=
                     static_cast<std::underlying_type<RttBw>::type>(convertLegacyRttBwToHidl(flag));
@@ -2603,7 +2783,7 @@
 }
 
 bool convertLegacyWifiRateInfoToHidl(const legacy_hal::wifi_rate& legacy_rate,
-                                     V1_4::WifiRateInfo* hidl_rate) {
+                                     V1_6::WifiRateInfo* hidl_rate) {
     if (!hidl_rate) {
         return false;
     }
@@ -2618,7 +2798,7 @@
 }
 
 bool convertLegacyRttResultToHidl(const legacy_hal::wifi_rtt_result& legacy_result,
-                                  V1_4::RttResult* hidl_result) {
+                                  V1_6::RttResult* hidl_result) {
     if (!hidl_result) {
         return false;
     }
@@ -2660,13 +2840,13 @@
 
 bool convertLegacyVectorOfRttResultToHidl(
         const std::vector<const legacy_hal::wifi_rtt_result*>& legacy_results,
-        std::vector<V1_4::RttResult>* hidl_results) {
+        std::vector<V1_6::RttResult>* hidl_results) {
     if (!hidl_results) {
         return false;
     }
     *hidl_results = {};
     for (const auto legacy_result : legacy_results) {
-        V1_4::RttResult hidl_result;
+        V1_6::RttResult hidl_result;
         if (!convertLegacyRttResultToHidl(*legacy_result, &hidl_result)) {
             return false;
         }
@@ -2740,6 +2920,85 @@
     return true;
 }
 
+V1_6::WifiAntennaMode convertLegacyAntennaConfigurationToHidl(uint32_t antenna_cfg) {
+    switch (antenna_cfg) {
+        case legacy_hal::WIFI_ANTENNA_1X1:
+            return V1_6::WifiAntennaMode::WIFI_ANTENNA_MODE_1X1;
+        case legacy_hal::WIFI_ANTENNA_2X2:
+            return V1_6::WifiAntennaMode::WIFI_ANTENNA_MODE_2X2;
+        case legacy_hal::WIFI_ANTENNA_3X3:
+            return V1_6::WifiAntennaMode::WIFI_ANTENNA_MODE_3X3;
+        case legacy_hal::WIFI_ANTENNA_4X4:
+            return V1_6::WifiAntennaMode::WIFI_ANTENNA_MODE_4X4;
+        default:
+            return V1_6::WifiAntennaMode::WIFI_ANTENNA_MODE_UNSPECIFIED;
+    }
+}
+
+bool convertLegacyWifiRadioConfigurationToHidl(
+        legacy_hal::wifi_radio_configuration* radio_configuration,
+        V1_6::WifiRadioConfiguration* hidl_radio_configuration) {
+    if (!hidl_radio_configuration) {
+        return false;
+    }
+    *hidl_radio_configuration = {};
+    hidl_radio_configuration->bandInfo =
+            hidl_struct_util::convertLegacyMacBandToHidlWifiBand(radio_configuration->band);
+    if (hidl_radio_configuration->bandInfo == V1_5::WifiBand::BAND_UNSPECIFIED) {
+        LOG(ERROR) << "Unspecified band";
+        return false;
+    }
+    hidl_radio_configuration->antennaMode =
+            hidl_struct_util::convertLegacyAntennaConfigurationToHidl(
+                    radio_configuration->antenna_cfg);
+    return true;
+}
+
+bool convertLegacyRadioCombinationsMatrixToHidl(
+        legacy_hal::wifi_radio_combination_matrix* legacy_matrix,
+        WifiRadioCombinationMatrix* hidl_matrix) {
+    if (!hidl_matrix || !legacy_matrix) {
+        return false;
+    }
+    *hidl_matrix = {};
+
+    int num_combinations = legacy_matrix->num_radio_combinations;
+    std::vector<V1_6::WifiRadioCombination> radio_combinations_vec;
+    if (!num_combinations) {
+        LOG(ERROR) << "zero radio combinations";
+        return false;
+    }
+    wifi_radio_combination* l_radio_combinations_ptr = legacy_matrix->radio_combinations;
+    for (int i = 0; i < num_combinations; i++) {
+        int num_configurations = l_radio_combinations_ptr->num_radio_configurations;
+        WifiRadioCombination radioCombination;
+        std::vector<V1_6::WifiRadioConfiguration> radio_configurations_vec;
+        if (!num_configurations) {
+            LOG(ERROR) << "zero radio configurations";
+            return false;
+        }
+        for (int j = 0; j < num_configurations; j++) {
+            WifiRadioConfiguration radioConfiguration;
+            wifi_radio_configuration* l_radio_configurations_ptr =
+                    &l_radio_combinations_ptr->radio_configurations[j];
+            if (!hidl_struct_util::convertLegacyWifiRadioConfigurationToHidl(
+                        l_radio_configurations_ptr, &radioConfiguration)) {
+                LOG(ERROR) << "Error converting wifi radio configuration";
+                return false;
+            }
+            radio_configurations_vec.push_back(radioConfiguration);
+        }
+        radioCombination.radioConfigurations = radio_configurations_vec;
+        radio_combinations_vec.push_back(radioCombination);
+        l_radio_combinations_ptr =
+                (wifi_radio_combination*)((u8*)l_radio_combinations_ptr +
+                                          sizeof(wifi_radio_combination) +
+                                          (sizeof(wifi_radio_configuration) * num_configurations));
+    }
+    hidl_matrix->radioCombinations = radio_combinations_vec;
+    return true;
+}
+
 }  // namespace hidl_struct_util
 }  // namespace implementation
 }  // namespace V1_6
diff --git a/wifi/1.6/default/hidl_struct_util.h b/wifi/1.6/default/hidl_struct_util.h
index 15a3205..2d4a5f1 100644
--- a/wifi/1.6/default/hidl_struct_util.h
+++ b/wifi/1.6/default/hidl_struct_util.h
@@ -25,8 +25,8 @@
 #include <android/hardware/wifi/1.3/types.h>
 #include <android/hardware/wifi/1.4/IWifiChipEventCallback.h>
 #include <android/hardware/wifi/1.4/types.h>
-#include <android/hardware/wifi/1.5/IWifiChip.h>
-#include <android/hardware/wifi/1.5/types.h>
+#include <android/hardware/wifi/1.6/IWifiChip.h>
+#include <android/hardware/wifi/1.6/types.h>
 
 #include "wifi_legacy_hal.h"
 
@@ -74,6 +74,11 @@
 bool convertHidlVectorOfCoexUnsafeChannelToLegacy(
         const std::vector<V1_5::IWifiChip::CoexUnsafeChannel>& hidl_unsafe_channels,
         std::vector<legacy_hal::wifi_coex_unsafe_channel>* legacy_unsafe_channels);
+bool convertLegacyRadioCombinationsMatrixToHidl(
+        legacy_hal::wifi_radio_combination_matrix* legacy_matrix,
+        V1_6::WifiRadioCombinationMatrix* hidl_matrix);
+V1_5::WifiBand convertLegacyMacBandToHidlWifiBand(uint32_t band);
+V1_6::WifiAntennaMode convertLegacyAntennaConfigurationToHidl(uint32_t antenna_cfg);
 
 // STA iface conversion methods.
 bool convertLegacyFeaturesToHidlStaCapabilities(uint64_t legacy_feature_set,
@@ -95,7 +100,7 @@
         const std::vector<legacy_hal::wifi_cached_scan_results>& legacy_cached_scan_results,
         std::vector<StaScanData>* hidl_scan_datas);
 bool convertLegacyLinkLayerStatsToHidl(const legacy_hal::LinkLayerStats& legacy_stats,
-                                       V1_5::StaLinkLayerStats* hidl_stats);
+                                       V1_6::StaLinkLayerStats* hidl_stats);
 bool convertLegacyRoamingCapabilitiesToHidl(
         const legacy_hal::wifi_roaming_capabilities& legacy_caps,
         StaRoamingCapabilities* hidl_caps);
@@ -116,80 +121,79 @@
                                          legacy_hal::NanEnableRequest* legacy_request);
 bool convertHidlNanConfigRequestToLegacy(const V1_4::NanConfigRequest& hidl_request,
                                          legacy_hal::NanConfigRequest* legacy_request);
-bool convertHidlNanEnableRequest_1_4ToLegacy(
+bool convertHidlNanEnableRequest_1_6ToLegacy(
         const V1_4::NanEnableRequest& hidl_request1,
-        const V1_5::NanConfigRequestSupplemental& hidl_request2,
+        const V1_6::NanConfigRequestSupplemental& hidl_request2,
         legacy_hal::NanEnableRequest* legacy_request);
-bool convertHidlNanConfigRequest_1_4ToLegacy(
+bool convertHidlNanConfigRequest_1_6ToLegacy(
         const V1_4::NanConfigRequest& hidl_request1,
-        const V1_5::NanConfigRequestSupplemental& hidl_request2,
+        const V1_6::NanConfigRequestSupplemental& hidl_request2,
         legacy_hal::NanConfigRequest* legacy_request);
-bool convertHidlNanEnableRequest_1_5ToLegacy(
-        const V1_4::NanEnableRequest& hidl_request1,
-        const V1_5::NanConfigRequestSupplemental& hidl_request2,
-        legacy_hal::NanEnableRequest* legacy_request);
-bool convertHidlNanConfigRequest_1_5ToLegacy(
-        const V1_4::NanConfigRequest& hidl_request1,
-        const V1_5::NanConfigRequestSupplemental& hidl_request2,
-        legacy_hal::NanConfigRequest* legacy_request);
-bool convertHidlNanPublishRequestToLegacy(const NanPublishRequest& hidl_request,
+bool convertHidlNanPublishRequestToLegacy(const V1_6::NanPublishRequest& hidl_request,
                                           legacy_hal::NanPublishRequest* legacy_request);
-bool convertHidlNanSubscribeRequestToLegacy(const NanSubscribeRequest& hidl_request,
+bool convertHidlNanSubscribeRequestToLegacy(const V1_0::NanSubscribeRequest& hidl_request,
                                             legacy_hal::NanSubscribeRequest* legacy_request);
 bool convertHidlNanTransmitFollowupRequestToLegacy(
         const NanTransmitFollowupRequest& hidl_request,
         legacy_hal::NanTransmitFollowupRequest* legacy_request);
 bool convertHidlNanDataPathInitiatorRequestToLegacy(
-        const NanInitiateDataPathRequest& hidl_request,
+        const V1_0::NanInitiateDataPathRequest& hidl_request,
         legacy_hal::NanDataPathInitiatorRequest* legacy_request);
 bool convertHidlNanDataPathIndicationResponseToLegacy(
-        const NanRespondToDataPathIndicationRequest& hidl_response,
+        const V1_0::NanRespondToDataPathIndicationRequest& hidl_response,
         legacy_hal::NanDataPathIndicationResponse* legacy_response);
+bool convertHidlNanDataPathInitiatorRequest_1_6ToLegacy(
+        const V1_6::NanInitiateDataPathRequest& hidl_request,
+        legacy_hal::NanDataPathInitiatorRequest* legacy_request);
+bool convertHidlNanDataPathIndicationResponse_1_6ToLegacy(
+        const V1_6::NanRespondToDataPathIndicationRequest& hidl_response,
+        legacy_hal::NanDataPathIndicationResponse* legacy_response);
+
 bool convertLegacyNanResponseHeaderToHidl(const legacy_hal::NanResponseMsg& legacy_response,
                                           WifiNanStatus* wifiNanStatus);
 bool convertLegacyNanCapabilitiesResponseToHidl(const legacy_hal::NanCapabilities& legacy_response,
-                                                V1_5::NanCapabilities* hidl_response);
+                                                V1_6::NanCapabilities* hidl_response);
 bool convertLegacyNanMatchIndToHidl(const legacy_hal::NanMatchInd& legacy_ind,
-                                    NanMatchInd* hidl_ind);
+                                    V1_6::NanMatchInd* hidl_ind);
 bool convertLegacyNanFollowupIndToHidl(const legacy_hal::NanFollowupInd& legacy_ind,
                                        NanFollowupReceivedInd* hidl_ind);
 bool convertLegacyNanDataPathRequestIndToHidl(const legacy_hal::NanDataPathRequestInd& legacy_ind,
                                               NanDataPathRequestInd* hidl_ind);
 bool convertLegacyNanDataPathConfirmIndToHidl(const legacy_hal::NanDataPathConfirmInd& legacy_ind,
-                                              V1_2::NanDataPathConfirmInd* hidl_ind);
+                                              V1_6::NanDataPathConfirmInd* hidl_ind);
 bool convertLegacyNanDataPathScheduleUpdateIndToHidl(
         const legacy_hal::NanDataPathScheduleUpdateInd& legacy_ind,
-        V1_2::NanDataPathScheduleUpdateInd* hidl_ind);
+        V1_6::NanDataPathScheduleUpdateInd* hidl_ind);
 
 // RTT controller conversion methods.
-bool convertHidlVectorOfRttConfigToLegacy(const std::vector<V1_4::RttConfig>& hidl_configs,
+bool convertHidlVectorOfRttConfigToLegacy(const std::vector<V1_6::RttConfig>& hidl_configs,
                                           std::vector<legacy_hal::wifi_rtt_config>* legacy_configs);
 bool convertHidlRttLciInformationToLegacy(const RttLciInformation& hidl_info,
                                           legacy_hal::wifi_lci_information* legacy_info);
 bool convertHidlRttLcrInformationToLegacy(const RttLcrInformation& hidl_info,
                                           legacy_hal::wifi_lcr_information* legacy_info);
-bool convertHidlRttResponderToLegacy(const V1_4::RttResponder& hidl_responder,
+bool convertHidlRttResponderToLegacy(const V1_6::RttResponder& hidl_responder,
                                      legacy_hal::wifi_rtt_responder* legacy_responder);
-bool convertHidlWifiChannelInfoToLegacy(const WifiChannelInfo& hidl_info,
+bool convertHidlWifiChannelInfoToLegacy(const V1_6::WifiChannelInfo& hidl_info,
                                         legacy_hal::wifi_channel_info* legacy_info);
 bool convertLegacyRttResponderToHidl(const legacy_hal::wifi_rtt_responder& legacy_responder,
-                                     V1_4::RttResponder* hidl_responder);
+                                     V1_6::RttResponder* hidl_responder);
 bool convertLegacyRttCapabilitiesToHidl(
         const legacy_hal::wifi_rtt_capabilities& legacy_capabilities,
-        V1_4::RttCapabilities* hidl_capabilities);
+        V1_6::RttCapabilities* hidl_capabilities);
 bool convertLegacyVectorOfRttResultToHidl(
         const std::vector<const legacy_hal::wifi_rtt_result*>& legacy_results,
-        std::vector<V1_4::RttResult>* hidl_results);
+        std::vector<V1_6::RttResult>* hidl_results);
 uint32_t convertHidlWifiBandToLegacyMacBand(V1_5::WifiBand band);
 uint32_t convertHidlWifiIfaceModeToLegacy(uint32_t hidl_iface_mask);
 uint32_t convertHidlUsableChannelFilterToLegacy(uint32_t hidl_filter_mask);
 bool convertLegacyWifiUsableChannelsToHidl(
         const std::vector<legacy_hal::wifi_usable_channel>& legacy_usable_channels,
-        std::vector<V1_5::WifiUsableChannel>* hidl_usable_channels);
+        std::vector<V1_6::WifiUsableChannel>* hidl_usable_channels);
 bool convertLegacyPeerInfoStatsToHidl(const legacy_hal::WifiPeerInfo& legacy_peer_info_stats,
-                                      V1_5::StaPeerInfo* hidl_peer_info_stats);
+                                      V1_6::StaPeerInfo* hidl_peer_info_stats);
 bool convertLegacyWifiRateInfoToHidl(const legacy_hal::wifi_rate& legacy_rate,
-                                     V1_4::WifiRateInfo* hidl_rate);
+                                     V1_6::WifiRateInfo* hidl_rate);
 }  // namespace hidl_struct_util
 }  // namespace implementation
 }  // namespace V1_6
diff --git a/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp b/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp
index 1182a58..0dd0aa1 100644
--- a/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp
+++ b/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp
@@ -37,7 +37,7 @@
 namespace V1_6 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
-using ::android::hardware::wifi::V1_0::WifiChannelWidthInMhz;
+using ::android::hardware::wifi::V1_6::WifiChannelWidthInMhz;
 
 class HidlStructUtilTest : public Test {};
 
@@ -216,7 +216,7 @@
         peer.rate_stats.push_back(rate_stat2);
     }
 
-    V1_5::StaLinkLayerStats converted{};
+    V1_6::StaLinkLayerStats converted{};
     hidl_struct_util::convertLegacyLinkLayerStatsToHidl(legacy_stats, &converted);
     EXPECT_EQ(legacy_stats.iface.beacon_rx, converted.iface.V1_0.beaconRx);
     EXPECT_EQ(legacy_stats.iface.rssi_mgmt, converted.iface.V1_0.avgRssiMgmt);
@@ -294,43 +294,42 @@
     EXPECT_EQ(legacy_stats.radios.size(), converted.radios.size());
     for (size_t i = 0; i < legacy_stats.radios.size(); i++) {
         EXPECT_EQ(legacy_stats.radios[i].stats.radio, converted.radios[i].radioId);
-        EXPECT_EQ(legacy_stats.radios[i].stats.on_time, converted.radios[i].V1_3.V1_0.onTimeInMs);
-        EXPECT_EQ(legacy_stats.radios[i].stats.tx_time, converted.radios[i].V1_3.V1_0.txTimeInMs);
-        EXPECT_EQ(legacy_stats.radios[i].stats.rx_time, converted.radios[i].V1_3.V1_0.rxTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time, converted.radios[i].V1_0.onTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.tx_time, converted.radios[i].V1_0.txTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.rx_time, converted.radios[i].V1_0.rxTimeInMs);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_scan,
-                  converted.radios[i].V1_3.V1_0.onTimeInMsForScan);
+                  converted.radios[i].V1_0.onTimeInMsForScan);
         EXPECT_EQ(legacy_stats.radios[i].tx_time_per_levels.size(),
-                  converted.radios[i].V1_3.V1_0.txTimeInMsPerLevel.size());
+                  converted.radios[i].V1_0.txTimeInMsPerLevel.size());
         for (size_t j = 0; j < legacy_stats.radios[i].tx_time_per_levels.size(); j++) {
             EXPECT_EQ(legacy_stats.radios[i].tx_time_per_levels[j],
-                      converted.radios[i].V1_3.V1_0.txTimeInMsPerLevel[j]);
+                      converted.radios[i].V1_0.txTimeInMsPerLevel[j]);
         }
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_nbd,
-                  converted.radios[i].V1_3.onTimeInMsForNanScan);
+                  converted.radios[i].onTimeInMsForNanScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_gscan,
-                  converted.radios[i].V1_3.onTimeInMsForBgScan);
+                  converted.radios[i].onTimeInMsForBgScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_roam_scan,
-                  converted.radios[i].V1_3.onTimeInMsForRoamScan);
+                  converted.radios[i].onTimeInMsForRoamScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_pno_scan,
-                  converted.radios[i].V1_3.onTimeInMsForPnoScan);
+                  converted.radios[i].onTimeInMsForPnoScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_hs20,
-                  converted.radios[i].V1_3.onTimeInMsForHs20Scan);
+                  converted.radios[i].onTimeInMsForHs20Scan);
         EXPECT_EQ(legacy_stats.radios[i].channel_stats.size(),
-                  converted.radios[i].V1_3.channelStats.size());
+                  converted.radios[i].channelStats.size());
         for (size_t k = 0; k < legacy_stats.radios[i].channel_stats.size(); k++) {
             auto& legacy_channel_st = legacy_stats.radios[i].channel_stats[k];
             EXPECT_EQ(WifiChannelWidthInMhz::WIDTH_20,
-                      converted.radios[i].V1_3.channelStats[k].channel.width);
+                      converted.radios[i].channelStats[k].channel.width);
             EXPECT_EQ(WifiChannelInMhz(legacy_channel_st.channel.center_freq),
-                      converted.radios[i].V1_3.channelStats[k].channel.centerFreq);
+                      converted.radios[i].channelStats[k].channel.centerFreq);
             EXPECT_EQ(WifiChannelInMhz(legacy_channel_st.channel.center_freq0),
-                      converted.radios[i].V1_3.channelStats[k].channel.centerFreq0);
+                      converted.radios[i].channelStats[k].channel.centerFreq0);
             EXPECT_EQ(WifiChannelInMhz(legacy_channel_st.channel.center_freq1),
-                      converted.radios[i].V1_3.channelStats[k].channel.centerFreq1);
+                      converted.radios[i].channelStats[k].channel.centerFreq1);
             EXPECT_EQ(legacy_channel_st.cca_busy_time,
-                      converted.radios[i].V1_3.channelStats[k].ccaBusyTimeInMs);
-            EXPECT_EQ(legacy_channel_st.on_time,
-                      converted.radios[i].V1_3.channelStats[k].onTimeInMs);
+                      converted.radios[i].channelStats[k].ccaBusyTimeInMs);
+            EXPECT_EQ(legacy_channel_st.on_time, converted.radios[i].channelStats[k].onTimeInMs);
         }
     }
 
@@ -378,6 +377,108 @@
                       HidlChipCaps::SET_LATENCY_MODE | HidlChipCaps::DEBUG_MEMORY_DRIVER_DUMP,
               hidle_caps);
 }
+
+void insertRadioCombination(legacy_hal::wifi_radio_combination* dst_radio_combination_ptr,
+                            int num_radio_configurations,
+                            legacy_hal::wifi_radio_configuration* radio_configuration) {
+    dst_radio_combination_ptr->num_radio_configurations = num_radio_configurations;
+    memcpy(dst_radio_combination_ptr->radio_configurations, radio_configuration,
+           num_radio_configurations * sizeof(legacy_hal::wifi_radio_configuration));
+}
+
+void verifyRadioCombination(WifiRadioCombination* radioCombination, size_t num_radio_configurations,
+                            legacy_hal::wifi_radio_configuration* radio_configuration) {
+    EXPECT_EQ(num_radio_configurations, radioCombination->radioConfigurations.size());
+    for (size_t i = 0; i < num_radio_configurations; i++) {
+        EXPECT_EQ(hidl_struct_util::convertLegacyMacBandToHidlWifiBand(radio_configuration->band),
+                  radioCombination->radioConfigurations[i].bandInfo);
+        EXPECT_EQ(hidl_struct_util::convertLegacyAntennaConfigurationToHidl(
+                          radio_configuration->antenna_cfg),
+                  radioCombination->radioConfigurations[i].antennaMode);
+        radio_configuration++;
+    }
+}
+
+TEST_F(HidlStructUtilTest, canConvertLegacyRadioCombinationsMatrixToHidl) {
+    legacy_hal::wifi_radio_configuration radio_configurations_array1[] = {
+            {.band = legacy_hal::WLAN_MAC_2_4_BAND, .antenna_cfg = legacy_hal::WIFI_ANTENNA_1X1},
+    };
+    legacy_hal::wifi_radio_configuration radio_configurations_array2[] = {
+            {.band = legacy_hal::WLAN_MAC_2_4_BAND, .antenna_cfg = legacy_hal::WIFI_ANTENNA_2X2},
+            {.band = legacy_hal::WLAN_MAC_5_0_BAND, .antenna_cfg = legacy_hal::WIFI_ANTENNA_3X3},
+    };
+    legacy_hal::wifi_radio_configuration radio_configurations_array3[] = {
+            {.band = legacy_hal::WLAN_MAC_2_4_BAND, .antenna_cfg = legacy_hal::WIFI_ANTENNA_2X2},
+            {.band = legacy_hal::WLAN_MAC_6_0_BAND, .antenna_cfg = legacy_hal::WIFI_ANTENNA_1X1},
+            {.band = legacy_hal::WLAN_MAC_5_0_BAND, .antenna_cfg = legacy_hal::WIFI_ANTENNA_4X4},
+    };
+
+    int num_radio_configs = 0;
+    int num_combinations = 0;
+    std::array<char, 256> buffer;
+    buffer.fill(0);
+    legacy_hal::wifi_radio_combination_matrix* legacy_matrix =
+            reinterpret_cast<wifi_radio_combination_matrix*>(buffer.data());
+    legacy_hal::wifi_radio_combination* radio_combinations;
+
+    // Prepare a legacy wifi_radio_combination_matrix
+    legacy_matrix->num_radio_combinations = 3;
+    // Insert first combination
+    radio_combinations =
+            (legacy_hal::wifi_radio_combination*)((char*)legacy_matrix->radio_combinations);
+    insertRadioCombination(
+            radio_combinations,
+            sizeof(radio_configurations_array1) / sizeof(radio_configurations_array1[0]),
+            radio_configurations_array1);
+    num_combinations++;
+    num_radio_configs +=
+            sizeof(radio_configurations_array1) / sizeof(radio_configurations_array1[0]);
+
+    // Insert second combination
+    radio_combinations =
+            (legacy_hal::wifi_radio_combination*)((char*)legacy_matrix->radio_combinations +
+                                                  (num_combinations *
+                                                   sizeof(legacy_hal::wifi_radio_combination)) +
+                                                  (num_radio_configs *
+                                                   sizeof(wifi_radio_configuration)));
+    insertRadioCombination(
+            radio_combinations,
+            sizeof(radio_configurations_array2) / sizeof(radio_configurations_array2[0]),
+            radio_configurations_array2);
+    num_combinations++;
+    num_radio_configs +=
+            sizeof(radio_configurations_array2) / sizeof(radio_configurations_array2[0]);
+
+    // Insert third combination
+    radio_combinations =
+            (legacy_hal::wifi_radio_combination*)((char*)legacy_matrix->radio_combinations +
+                                                  (num_combinations *
+                                                   sizeof(legacy_hal::wifi_radio_combination)) +
+                                                  (num_radio_configs *
+                                                   sizeof(wifi_radio_configuration)));
+    insertRadioCombination(
+            radio_combinations,
+            sizeof(radio_configurations_array3) / sizeof(radio_configurations_array3[0]),
+            radio_configurations_array3);
+
+    V1_6::WifiRadioCombinationMatrix converted_matrix{};
+    hidl_struct_util::convertLegacyRadioCombinationsMatrixToHidl(legacy_matrix, &converted_matrix);
+
+    // Verify the conversion
+    EXPECT_EQ(legacy_matrix->num_radio_combinations, converted_matrix.radioCombinations.size());
+    verifyRadioCombination(
+            &converted_matrix.radioCombinations[0],
+            sizeof(radio_configurations_array1) / sizeof(radio_configurations_array1[0]),
+            radio_configurations_array1);
+    verifyRadioCombination(
+            &converted_matrix.radioCombinations[1],
+            sizeof(radio_configurations_array2) / sizeof(radio_configurations_array2[0]),
+            radio_configurations_array2);
+    verifyRadioCombination(
+            &converted_matrix.radioCombinations[2],
+            sizeof(radio_configurations_array3) / sizeof(radio_configurations_array3[0]),
+            radio_configurations_array3);
+}
 }  // namespace implementation
 }  // namespace V1_6
 }  // namespace wifi
diff --git a/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp b/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp
index 5390411..542b180 100644
--- a/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp
+++ b/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp
@@ -238,7 +238,7 @@
 
     bool createRttController() {
         bool success = false;
-        chip_->createRttController_1_4(
+        chip_->createRttController_1_6(
                 NULL, [&success](const WifiStatus& status, const sp<IWifiRttController>& rtt) {
                     if (WifiStatusCode::SUCCESS == status.code) {
                         ASSERT_NE(rtt.get(), nullptr);
@@ -716,7 +716,7 @@
 
     // Create RTT controller
     sp<IWifiRttController> rtt_controller;
-    chip_->createRttController_1_4(
+    chip_->createRttController_1_6(
             NULL, [&rtt_controller](const WifiStatus& status, const sp<IWifiRttController>& rtt) {
                 if (WifiStatusCode::SUCCESS == status.code) {
                     ASSERT_NE(rtt.get(), nullptr);
diff --git a/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp b/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp
index c7c566b..8a5ddcd 100644
--- a/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp
+++ b/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp
@@ -77,7 +77,8 @@
     MOCK_METHOD1(eventDisabled, Return<void>(const WifiNanStatus&));
     MOCK_METHOD2(eventPublishTerminated, Return<void>(uint8_t, const WifiNanStatus&));
     MOCK_METHOD2(eventSubscribeTerminated, Return<void>(uint8_t, const WifiNanStatus&));
-    MOCK_METHOD1(eventMatch, Return<void>(const NanMatchInd&));
+    MOCK_METHOD1(eventMatch, Return<void>(const V1_0::NanMatchInd&));
+    MOCK_METHOD1(eventMatch_1_6, Return<void>(const NanMatchInd&));
     MOCK_METHOD2(eventMatchExpired, Return<void>(uint8_t, uint32_t));
     MOCK_METHOD1(eventFollowupReceived, Return<void>(const NanFollowupReceivedInd&));
     MOCK_METHOD2(eventTransmitFollowup, Return<void>(uint16_t, const WifiNanStatus&));
@@ -85,8 +86,13 @@
     MOCK_METHOD1(eventDataPathConfirm,
                  Return<void>(const android::hardware::wifi::V1_0::NanDataPathConfirmInd&));
     MOCK_METHOD1(eventDataPathTerminated, Return<void>(uint32_t));
-    MOCK_METHOD1(eventDataPathConfirm_1_2, Return<void>(const NanDataPathConfirmInd&));
-    MOCK_METHOD1(eventDataPathScheduleUpdate, Return<void>(const NanDataPathScheduleUpdateInd&));
+    MOCK_METHOD1(eventDataPathConfirm_1_2,
+                 Return<void>(const android::hardware::wifi::V1_2::NanDataPathConfirmInd&));
+    MOCK_METHOD1(eventDataPathConfirm_1_6, Return<void>(const NanDataPathConfirmInd&));
+    MOCK_METHOD1(eventDataPathScheduleUpdate,
+                 Return<void>(const android::hardware::wifi::V1_2::NanDataPathScheduleUpdateInd&));
+    MOCK_METHOD1(eventDataPathScheduleUpdate_1_6,
+                 Return<void>(const NanDataPathScheduleUpdateInd&));
     MOCK_METHOD3(notifyCapabilitiesResponse_1_5,
                  Return<void>(uint16_t, const WifiNanStatus&, const V1_5::NanCapabilities&));
 };
diff --git a/wifi/1.6/default/wifi_chip.cpp b/wifi/1.6/default/wifi_chip.cpp
index c1ce766..4fff770 100644
--- a/wifi/1.6/default/wifi_chip.cpp
+++ b/wifi/1.6/default/wifi_chip.cpp
@@ -707,6 +707,27 @@
                            &WifiChip::triggerSubsystemRestartInternal, hidl_status_cb);
 }
 
+Return<void> WifiChip::createRttController_1_6(const sp<IWifiIface>& bound_iface,
+                                               createRttController_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                           &WifiChip::createRttControllerInternal_1_6, hidl_status_cb, bound_iface);
+}
+
+Return<void> WifiChip::getUsableChannels_1_6(
+        WifiBand band, hidl_bitfield<V1_5::WifiIfaceMode> ifaceModeMask,
+        hidl_bitfield<V1_6::IWifiChip::UsableChannelFilter> filterMask,
+        getUsableChannels_1_6_cb _hidl_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                           &WifiChip::getUsableChannelsInternal_1_6, _hidl_cb, band, ifaceModeMask,
+                           filterMask);
+}
+
+Return<void> WifiChip::getSupportedRadioCombinationsMatrix(
+        getSupportedRadioCombinationsMatrix_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                           &WifiChip::getSupportedRadioCombinationsMatrixInternal, hidl_status_cb);
+}
+
 void WifiChip::invalidateAndRemoveAllIfaces() {
     invalidateAndClearBridgedApAll();
     invalidateAndClearAll(ap_ifaces_);
@@ -1114,7 +1135,7 @@
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
-std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> WifiChip::createStaIfaceInternal() {
+std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> WifiChip::createStaIfaceInternal() {
     if (!canCurrentModeSupportIfaceOfTypeWithCurrentIfaces(IfaceType::STA)) {
         return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
     }
@@ -1144,7 +1165,7 @@
     return {createWifiStatus(WifiStatusCode::SUCCESS), getNames(sta_ifaces_)};
 }
 
-std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> WifiChip::getStaIfaceInternal(
+std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> WifiChip::getStaIfaceInternal(
         const std::string& ifname) {
     const auto iface = findUsingName(sta_ifaces_, ifname);
     if (!iface.get()) {
@@ -1351,16 +1372,9 @@
 }
 
 std::pair<WifiStatus, sp<V1_4::IWifiRttController>> WifiChip::createRttControllerInternal_1_4(
-        const sp<IWifiIface>& bound_iface) {
-    if (sta_ifaces_.size() == 0 && !canCurrentModeSupportIfaceOfType(IfaceType::STA)) {
-        LOG(ERROR) << "createRttControllerInternal_1_4: Chip cannot support STAs "
-                      "(and RTT by extension)";
-        return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
-    }
-    sp<WifiRttController> rtt =
-            new WifiRttController(getFirstActiveWlanIfaceName(), bound_iface, legacy_hal_);
-    rtt_controllers_.emplace_back(rtt);
-    return {createWifiStatus(WifiStatusCode::SUCCESS), rtt};
+        const sp<IWifiIface>& /*bound_iface*/) {
+    LOG(ERROR) << "createRttController_1_4 is not supported on this HAL";
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
 }
 
 WifiStatus WifiChip::registerEventCallbackInternal_1_4(
@@ -1409,7 +1423,31 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-std::pair<WifiStatus, std::vector<WifiUsableChannel>> WifiChip::getUsableChannelsInternal(
+std::pair<WifiStatus, std::vector<V1_5::WifiUsableChannel>> WifiChip::getUsableChannelsInternal(
+        WifiBand /*band*/, uint32_t /*ifaceModeMask*/, uint32_t /*filterMask*/) {
+    LOG(ERROR) << "getUsableChannels is not supported on this HAL";
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+WifiStatus WifiChip::triggerSubsystemRestartInternal() {
+    auto legacy_status = legacy_hal_.lock()->triggerSubsystemRestart();
+    return createWifiStatusFromLegacyError(legacy_status);
+}
+
+std::pair<WifiStatus, sp<V1_6::IWifiRttController>> WifiChip::createRttControllerInternal_1_6(
+        const sp<IWifiIface>& bound_iface) {
+    if (sta_ifaces_.size() == 0 && !canCurrentModeSupportIfaceOfType(IfaceType::STA)) {
+        LOG(ERROR) << "createRttControllerInternal_1_6: Chip cannot support STAs "
+                      "(and RTT by extension)";
+        return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
+    }
+    sp<WifiRttController> rtt =
+            new WifiRttController(getFirstActiveWlanIfaceName(), bound_iface, legacy_hal_);
+    rtt_controllers_.emplace_back(rtt);
+    return {createWifiStatus(WifiStatusCode::SUCCESS), rtt};
+}
+
+std::pair<WifiStatus, std::vector<V1_6::WifiUsableChannel>> WifiChip::getUsableChannelsInternal_1_6(
         WifiBand band, uint32_t ifaceModeMask, uint32_t filterMask) {
     legacy_hal::wifi_error legacy_status;
     std::vector<legacy_hal::wifi_usable_channel> legacy_usable_channels;
@@ -1421,7 +1459,7 @@
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    std::vector<WifiUsableChannel> hidl_usable_channels;
+    std::vector<V1_6::WifiUsableChannel> hidl_usable_channels;
     if (!hidl_struct_util::convertLegacyWifiUsableChannelsToHidl(legacy_usable_channels,
                                                                  &hidl_usable_channels)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
@@ -1429,9 +1467,26 @@
     return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_usable_channels};
 }
 
-WifiStatus WifiChip::triggerSubsystemRestartInternal() {
-    auto legacy_status = legacy_hal_.lock()->triggerSubsystemRestart();
-    return createWifiStatusFromLegacyError(legacy_status);
+std::pair<WifiStatus, V1_6::WifiRadioCombinationMatrix>
+WifiChip::getSupportedRadioCombinationsMatrixInternal() {
+    legacy_hal::wifi_error legacy_status;
+    legacy_hal::wifi_radio_combination_matrix* legacy_matrix;
+
+    std::tie(legacy_status, legacy_matrix) =
+            legacy_hal_.lock()->getSupportedRadioCombinationsMatrix();
+    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+        LOG(ERROR) << "Failed to get SupportedRadioCombinations matrix from legacy HAL: "
+                   << legacyErrorToString(legacy_status);
+        return {createWifiStatusFromLegacyError(legacy_status), {}};
+    }
+
+    V1_6::WifiRadioCombinationMatrix hidl_matrix;
+    if (!hidl_struct_util::convertLegacyRadioCombinationsMatrixToHidl(legacy_matrix,
+                                                                      &hidl_matrix)) {
+        LOG(ERROR) << "Failed convertLegacyRadioCombinationsMatrixToHidl() ";
+        return {createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS), {}};
+    }
+    return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_matrix};
 }
 
 WifiStatus WifiChip::handleChipConfiguration(
diff --git a/wifi/1.6/default/wifi_chip.h b/wifi/1.6/default/wifi_chip.h
index 8a06898..13d62fb 100644
--- a/wifi/1.6/default/wifi_chip.h
+++ b/wifi/1.6/default/wifi_chip.h
@@ -22,8 +22,9 @@
 #include <mutex>
 
 #include <android-base/macros.h>
-#include <android/hardware/wifi/1.4/IWifiRttController.h>
-#include <android/hardware/wifi/1.5/IWifiChip.h>
+#include <android/hardware/wifi/1.6/IWifiChip.h>
+#include <android/hardware/wifi/1.6/IWifiRttController.h>
+#include <android/hardware/wifi/1.6/IWifiStaIface.h>
 
 #include "hidl_callback_util.h"
 #include "ringbuffer.h"
@@ -43,14 +44,13 @@
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 using V1_5::WifiBand;
-using V1_5::WifiUsableChannel;
 
 /**
  * HIDL interface object used to control a Wifi HAL chip instance.
  * Since there is only a single chip instance used today, there is no
  * identifying handle information stored here.
  */
-class WifiChip : public V1_5::IWifiChip {
+class WifiChip : public V1_6::IWifiChip {
   public:
     WifiChip(ChipId chip_id, bool is_primary,
              const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal,
@@ -151,9 +151,17 @@
     Return<void> setCountryCode(const hidl_array<int8_t, 2>& code,
                                 setCountryCode_cb _hidl_cb) override;
     Return<void> getUsableChannels(WifiBand band, hidl_bitfield<V1_5::WifiIfaceMode> ifaceModeMask,
-                                   hidl_bitfield<UsableChannelFilter> filterMask,
+                                   hidl_bitfield<V1_5::IWifiChip::UsableChannelFilter> filterMask,
                                    getUsableChannels_cb _hidl_cb) override;
     Return<void> triggerSubsystemRestart(triggerSubsystemRestart_cb hidl_status_cb) override;
+    Return<void> createRttController_1_6(const sp<IWifiIface>& bound_iface,
+                                         createRttController_1_6_cb hidl_status_cb) override;
+    Return<void> getUsableChannels_1_6(WifiBand band,
+                                       hidl_bitfield<V1_5::WifiIfaceMode> ifaceModeMask,
+                                       hidl_bitfield<UsableChannelFilter> filterMask,
+                                       getUsableChannels_1_6_cb _hidl_cb) override;
+    Return<void> getSupportedRadioCombinationsMatrix(
+            getSupportedRadioCombinationsMatrix_cb hidl_status_cb) override;
 
   private:
     void invalidateAndRemoveAllIfaces();
@@ -191,9 +199,9 @@
     std::pair<WifiStatus, std::vector<hidl_string>> getP2pIfaceNamesInternal();
     std::pair<WifiStatus, sp<IWifiP2pIface>> getP2pIfaceInternal(const std::string& ifname);
     WifiStatus removeP2pIfaceInternal(const std::string& ifname);
-    std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> createStaIfaceInternal();
+    std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> createStaIfaceInternal();
     std::pair<WifiStatus, std::vector<hidl_string>> getStaIfaceNamesInternal();
-    std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> getStaIfaceInternal(const std::string& ifname);
+    std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> getStaIfaceInternal(const std::string& ifname);
     WifiStatus removeStaIfaceInternal(const std::string& ifname);
     std::pair<WifiStatus, sp<V1_0::IWifiRttController>> createRttControllerInternal(
             const sp<IWifiIface>& bound_iface);
@@ -225,13 +233,12 @@
     WifiStatus setCoexUnsafeChannelsInternal(std::vector<CoexUnsafeChannel> unsafe_channels,
                                              uint32_t restrictions);
     WifiStatus setCountryCodeInternal(const std::array<int8_t, 2>& code);
-    std::pair<WifiStatus, std::vector<WifiUsableChannel>> getUsableChannelsInternal(
+    std::pair<WifiStatus, std::vector<V1_5::WifiUsableChannel>> getUsableChannelsInternal(
             WifiBand band, uint32_t ifaceModeMask, uint32_t filterMask);
     WifiStatus handleChipConfiguration(std::unique_lock<std::recursive_mutex>* lock,
                                        ChipModeId mode_id);
     WifiStatus registerDebugRingBufferCallback();
     WifiStatus registerRadioModeChangeCallback();
-
     std::vector<V1_4::IWifiChip::ChipIfaceCombination> getCurrentModeIfaceCombinations();
     std::map<IfaceType, size_t> getCurrentIfaceCombination();
     std::vector<std::map<IfaceType, size_t>> expandIfaceCombinations(
@@ -258,6 +265,11 @@
     void invalidateAndClearBridgedAp(const std::string& br_name);
     bool findUsingNameFromBridgedApInstances(const std::string& name);
     WifiStatus triggerSubsystemRestartInternal();
+    std::pair<WifiStatus, sp<V1_6::IWifiRttController>> createRttControllerInternal_1_6(
+            const sp<IWifiIface>& bound_iface);
+    std::pair<WifiStatus, std::vector<V1_6::WifiUsableChannel>> getUsableChannelsInternal_1_6(
+            WifiBand band, uint32_t ifaceModeMask, uint32_t filterMask);
+    std::pair<WifiStatus, WifiRadioCombinationMatrix> getSupportedRadioCombinationsMatrixInternal();
 
     ChipId chip_id_;
     std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
diff --git a/wifi/1.6/default/wifi_legacy_hal.cpp b/wifi/1.6/default/wifi_legacy_hal.cpp
index e6e8141..8a75fd8 100644
--- a/wifi/1.6/default/wifi_legacy_hal.cpp
+++ b/wifi/1.6/default/wifi_legacy_hal.cpp
@@ -37,6 +37,7 @@
 static constexpr uint32_t kMaxWakeReasonStatsArraySize = 32;
 static constexpr uint32_t kMaxRingBuffers = 10;
 static constexpr uint32_t kMaxWifiUsableChannels = 256;
+static constexpr uint32_t kMaxSupportedRadioCombinationsMatrixLength = 256;
 // need a long timeout (1000ms) for chips that unload their driver.
 static constexpr uint32_t kMaxStopCompleteWaitMs = 1000;
 static constexpr char kDriverPropName[] = "wlan.driver.status";
@@ -356,6 +357,15 @@
     }
 }
 
+// Callback to report current CHRE NAN state
+std::function<void(chre_nan_rtt_state)> on_chre_nan_rtt_internal_callback;
+void onAsyncChreNanRttState(chre_nan_rtt_state state) {
+    const auto lock = hidl_sync_util::acquireGlobalLock();
+    if (on_chre_nan_rtt_internal_callback) {
+        on_chre_nan_rtt_internal_callback(state);
+    }
+}
+
 // End of the free-standing "C" style callbacks.
 
 WifiLegacyHal::WifiLegacyHal(const std::weak_ptr<wifi_system::InterfaceTool> iface_tool,
@@ -1533,6 +1543,47 @@
     return global_func_table_.wifi_trigger_subsystem_restart(global_handle_);
 }
 
+wifi_error WifiLegacyHal::setIndoorState(bool isIndoor) {
+    return global_func_table_.wifi_set_indoor_state(global_handle_, isIndoor);
+}
+
+std::pair<wifi_error, wifi_radio_combination_matrix*>
+WifiLegacyHal::getSupportedRadioCombinationsMatrix() {
+    std::array<char, kMaxSupportedRadioCombinationsMatrixLength> buffer;
+    buffer.fill(0);
+    uint32_t size = 0;
+    wifi_radio_combination_matrix* radio_combination_matrix_ptr =
+            reinterpret_cast<wifi_radio_combination_matrix*>(buffer.data());
+    wifi_error status = global_func_table_.wifi_get_supported_radio_combinations_matrix(
+            global_handle_, buffer.size(), &size, radio_combination_matrix_ptr);
+    CHECK(size >= 0 && size <= kMaxSupportedRadioCombinationsMatrixLength);
+    return {status, radio_combination_matrix_ptr};
+}
+
+wifi_error WifiLegacyHal::chreNanRttRequest(const std::string& iface_name, bool enable) {
+    if (enable)
+        return global_func_table_.wifi_nan_rtt_chre_enable_request(0, getIfaceHandle(iface_name),
+                                                                   NULL);
+    else
+        return global_func_table_.wifi_nan_rtt_chre_disable_request(0, getIfaceHandle(iface_name));
+}
+
+wifi_error WifiLegacyHal::chreRegisterHandler(const std::string& iface_name,
+                                              const ChreCallbackHandlers& handler) {
+    if (on_chre_nan_rtt_internal_callback) {
+        return WIFI_ERROR_NOT_AVAILABLE;
+    }
+
+    on_chre_nan_rtt_internal_callback = handler.on_wifi_chre_nan_rtt_state;
+
+    wifi_error status = global_func_table_.wifi_chre_register_handler(getIfaceHandle(iface_name),
+                                                                      {onAsyncChreNanRttState});
+    if (status != WIFI_SUCCESS) {
+        on_chre_nan_rtt_internal_callback = nullptr;
+    }
+    return status;
+}
+
 void WifiLegacyHal::invalidate() {
     global_handle_ = nullptr;
     iface_name_to_handle_.clear();
@@ -1568,6 +1619,7 @@
     on_twt_event_teardown_completion_callback = nullptr;
     on_twt_event_info_frame_received_callback = nullptr;
     on_twt_event_device_notify_callback = nullptr;
+    on_chre_nan_rtt_internal_callback = nullptr;
 }
 
 }  // namespace legacy_hal
diff --git a/wifi/1.6/default/wifi_legacy_hal.h b/wifi/1.6/default/wifi_legacy_hal.h
index d87242c..ab21e8e 100644
--- a/wifi/1.6/default/wifi_legacy_hal.h
+++ b/wifi/1.6/default/wifi_legacy_hal.h
@@ -36,6 +36,7 @@
 namespace legacy_hal {
 // Import all the types defined inside the legacy HAL header files into this
 // namespace.
+using ::chre_nan_rtt_state;
 using ::frame_info;
 using ::frame_type;
 using ::FRAME_TYPE_80211_MGMT;
@@ -204,6 +205,11 @@
 using ::WIFI_AC_BK;
 using ::WIFI_AC_VI;
 using ::WIFI_AC_VO;
+using ::WIFI_ANTENNA_1X1;
+using ::WIFI_ANTENNA_2X2;
+using ::WIFI_ANTENNA_3X3;
+using ::WIFI_ANTENNA_4X4;
+using ::WIFI_ANTENNA_UNSPECIFIED;
 using ::wifi_band;
 using ::WIFI_BAND_A;
 using ::WIFI_BAND_A_DFS;
@@ -216,6 +222,7 @@
 using ::WIFI_CHAN_WIDTH_10;
 using ::WIFI_CHAN_WIDTH_160;
 using ::WIFI_CHAN_WIDTH_20;
+using ::WIFI_CHAN_WIDTH_320;
 using ::WIFI_CHAN_WIDTH_40;
 using ::WIFI_CHAN_WIDTH_5;
 using ::WIFI_CHAN_WIDTH_80;
@@ -280,6 +287,9 @@
 using ::WIFI_POWER_SCENARIO_ON_HEAD_CELL_OFF;
 using ::WIFI_POWER_SCENARIO_ON_HEAD_CELL_ON;
 using ::WIFI_POWER_SCENARIO_VOICE_CALL;
+using ::wifi_radio_combination;
+using ::wifi_radio_combination_matrix;
+using ::wifi_radio_configuration;
 using ::wifi_rate;
 using ::wifi_request_id;
 using ::wifi_ring_buffer_status;
@@ -289,12 +299,14 @@
 using ::WIFI_RTT_BW_10;
 using ::WIFI_RTT_BW_160;
 using ::WIFI_RTT_BW_20;
+using ::WIFI_RTT_BW_320;
 using ::WIFI_RTT_BW_40;
 using ::WIFI_RTT_BW_5;
 using ::WIFI_RTT_BW_80;
 using ::wifi_rtt_capabilities;
 using ::wifi_rtt_config;
 using ::wifi_rtt_preamble;
+using ::WIFI_RTT_PREAMBLE_EHT;
 using ::WIFI_RTT_PREAMBLE_HE;
 using ::WIFI_RTT_PREAMBLE_HT;
 using ::WIFI_RTT_PREAMBLE_LEGACY;
@@ -447,6 +459,12 @@
     std::function<void(const TwtDeviceNotify&)> on_device_notify;
 };
 
+// CHRE response and event callbacks struct.
+struct ChreCallbackHandlers {
+    // Callback for CHRE NAN RTT
+    std::function<void(chre_nan_rtt_state)> on_wifi_chre_nan_rtt_state;
+};
+
 /**
  * Class that encapsulates all legacy HAL interactions.
  * This class manages the lifetime of the event loop thread used by legacy HAL.
@@ -655,6 +673,16 @@
 
     wifi_error triggerSubsystemRestart();
 
+    wifi_error setIndoorState(bool isIndoor);
+
+    std::pair<wifi_error, wifi_radio_combination_matrix*> getSupportedRadioCombinationsMatrix();
+
+    // CHRE NAN RTT function
+    wifi_error chreNanRttRequest(const std::string& iface_name, bool enable);
+
+    wifi_error chreRegisterHandler(const std::string& iface_name,
+                                   const ChreCallbackHandlers& handler);
+
   private:
     // Retrieve interface handles for all the available interfaces.
     wifi_error retrieveIfaceHandles();
diff --git a/wifi/1.6/default/wifi_legacy_hal_stubs.cpp b/wifi/1.6/default/wifi_legacy_hal_stubs.cpp
index e03e1ae..5ad22f5 100644
--- a/wifi/1.6/default/wifi_legacy_hal_stubs.cpp
+++ b/wifi/1.6/default/wifi_legacy_hal_stubs.cpp
@@ -161,6 +161,11 @@
     populateStubFor(&hal_fn->wifi_set_dtim_config);
     populateStubFor(&hal_fn->wifi_get_usable_channels);
     populateStubFor(&hal_fn->wifi_trigger_subsystem_restart);
+    populateStubFor(&hal_fn->wifi_set_indoor_state);
+    populateStubFor(&hal_fn->wifi_get_supported_radio_combinations_matrix);
+    populateStubFor(&hal_fn->wifi_nan_rtt_chre_enable_request);
+    populateStubFor(&hal_fn->wifi_nan_rtt_chre_disable_request);
+    populateStubFor(&hal_fn->wifi_chre_register_handler);
     return true;
 }
 }  // namespace legacy_hal
diff --git a/wifi/1.6/default/wifi_nan_iface.cpp b/wifi/1.6/default/wifi_nan_iface.cpp
index 236cb64..ac2ebc9 100644
--- a/wifi/1.6/default/wifi_nan_iface.cpp
+++ b/wifi/1.6/default/wifi_nan_iface.cpp
@@ -135,14 +135,14 @@
                 break;
             }
             case legacy_hal::NAN_GET_CAPABILITIES: {
-                V1_5::NanCapabilities hidl_struct;
+                V1_6::NanCapabilities hidl_struct;
                 if (!hidl_struct_util::convertLegacyNanCapabilitiesResponseToHidl(
                             msg.body.nan_capabilities, &hidl_struct)) {
                     LOG(ERROR) << "Failed to convert nan capabilities response";
                     return;
                 }
-                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_5()) {
-                    if (!callback->notifyCapabilitiesResponse_1_5(id, wifiNanStatus, hidl_struct)
+                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_6()) {
+                    if (!callback->notifyCapabilitiesResponse_1_6(id, wifiNanStatus, hidl_struct)
                                  .isOk()) {
                         LOG(ERROR) << "Failed to invoke the callback";
                     }
@@ -285,14 +285,14 @@
             LOG(ERROR) << "Callback invoked on an invalid object";
             return;
         }
-        NanMatchInd hidl_struct;
+        V1_6::NanMatchInd hidl_struct;
         if (!hidl_struct_util::convertLegacyNanMatchIndToHidl(msg, &hidl_struct)) {
             LOG(ERROR) << "Failed to convert nan capabilities response";
             return;
         }
 
-        for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
-            if (!callback->eventMatch(hidl_struct).isOk()) {
+        for (const auto& callback : shared_ptr_this->getEventCallbacks_1_6()) {
+            if (!callback->eventMatch_1_6(hidl_struct).isOk()) {
                 LOG(ERROR) << "Failed to invoke the callback";
             }
         }
@@ -378,15 +378,15 @@
                     LOG(ERROR) << "Callback invoked on an invalid object";
                     return;
                 }
-                V1_2::NanDataPathConfirmInd hidl_struct;
+                V1_6::NanDataPathConfirmInd hidl_struct;
                 if (!hidl_struct_util::convertLegacyNanDataPathConfirmIndToHidl(msg,
                                                                                 &hidl_struct)) {
                     LOG(ERROR) << "Failed to convert nan capabilities response";
                     return;
                 }
 
-                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_2()) {
-                    if (!callback->eventDataPathConfirm_1_2(hidl_struct).isOk()) {
+                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_6()) {
+                    if (!callback->eventDataPathConfirm_1_6(hidl_struct).isOk()) {
                         LOG(ERROR) << "Failed to invoke the callback";
                     }
                 }
@@ -430,15 +430,15 @@
                     LOG(ERROR) << "Callback invoked on an invalid object";
                     return;
                 }
-                V1_2::NanDataPathScheduleUpdateInd hidl_struct;
+                V1_6::NanDataPathScheduleUpdateInd hidl_struct;
                 if (!hidl_struct_util::convertLegacyNanDataPathScheduleUpdateIndToHidl(
                             msg, &hidl_struct)) {
                     LOG(ERROR) << "Failed to convert nan capabilities response";
                     return;
                 }
 
-                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_2()) {
-                    if (!callback->eventDataPathScheduleUpdate(hidl_struct).isOk()) {
+                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_6()) {
+                    if (!callback->eventDataPathScheduleUpdate_1_6(hidl_struct).isOk()) {
                         LOG(ERROR) << "Failed to invoke the callback";
                     }
                 }
@@ -510,6 +510,10 @@
     return event_cb_handler_1_5_.getCallbacks();
 }
 
+std::set<sp<V1_6::IWifiNanIfaceEventCallback>> WifiNanIface::getEventCallbacks_1_6() {
+    return event_cb_handler_1_6_.getCallbacks();
+}
+
 Return<void> WifiNanIface::getName(getName_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::getNameInternal, hidl_status_cb);
@@ -550,7 +554,7 @@
                            &WifiNanIface::disableRequestInternal, hidl_status_cb, cmd_id);
 }
 
-Return<void> WifiNanIface::startPublishRequest(uint16_t cmd_id, const NanPublishRequest& msg,
+Return<void> WifiNanIface::startPublishRequest(uint16_t cmd_id, const V1_0::NanPublishRequest& msg,
                                                startPublishRequest_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::startPublishRequestInternal, hidl_status_cb, cmd_id, msg);
@@ -563,7 +567,8 @@
                            sessionId);
 }
 
-Return<void> WifiNanIface::startSubscribeRequest(uint16_t cmd_id, const NanSubscribeRequest& msg,
+Return<void> WifiNanIface::startSubscribeRequest(uint16_t cmd_id,
+                                                 const V1_0::NanSubscribeRequest& msg,
                                                  startSubscribeRequest_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::startSubscribeRequestInternal, hidl_status_cb, cmd_id,
@@ -602,7 +607,7 @@
 }
 
 Return<void> WifiNanIface::initiateDataPathRequest(uint16_t cmd_id,
-                                                   const NanInitiateDataPathRequest& msg,
+                                                   const V1_0::NanInitiateDataPathRequest& msg,
                                                    initiateDataPathRequest_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::initiateDataPathRequestInternal, hidl_status_cb, cmd_id,
@@ -610,7 +615,7 @@
 }
 
 Return<void> WifiNanIface::respondToDataPathIndicationRequest(
-        uint16_t cmd_id, const NanRespondToDataPathIndicationRequest& msg,
+        uint16_t cmd_id, const V1_0::NanRespondToDataPathIndicationRequest& msg,
         respondToDataPathIndicationRequest_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::respondToDataPathIndicationRequestInternal,
@@ -695,6 +700,46 @@
                            cmd_id);
 }
 
+Return<void> WifiNanIface::enableRequest_1_6(uint16_t cmd_id, const V1_4::NanEnableRequest& msg1,
+                                             const V1_6::NanConfigRequestSupplemental& msg2,
+                                             enableRequest_1_5_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiNanIface::enableRequest_1_6Internal, hidl_status_cb, cmd_id, msg1,
+                           msg2);
+}
+
+Return<void> WifiNanIface::configRequest_1_6(uint16_t cmd_id, const V1_4::NanConfigRequest& msg1,
+                                             const V1_6::NanConfigRequestSupplemental& msg2,
+                                             configRequest_1_5_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiNanIface::configRequest_1_6Internal, hidl_status_cb, cmd_id, msg1,
+                           msg2);
+}
+
+Return<void> WifiNanIface::initiateDataPathRequest_1_6(uint16_t cmd_id,
+                                                       const V1_6::NanInitiateDataPathRequest& msg,
+                                                       initiateDataPathRequest_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiNanIface::initiateDataPathRequest_1_6Internal, hidl_status_cb,
+                           cmd_id, msg);
+}
+
+Return<void> WifiNanIface::respondToDataPathIndicationRequest_1_6(
+        uint16_t cmd_id, const V1_6::NanRespondToDataPathIndicationRequest& msg,
+        respondToDataPathIndicationRequest_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiNanIface::respondToDataPathIndicationRequest_1_6Internal,
+                           hidl_status_cb, cmd_id, msg);
+}
+
+Return<void> WifiNanIface::startPublishRequest_1_6(uint16_t cmd_id,
+                                                   const V1_6::NanPublishRequest& msg,
+                                                   startPublishRequest_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiNanIface::startPublishRequest_1_6Internal, hidl_status_cb, cmd_id,
+                           msg);
+}
+
 std::pair<WifiStatus, std::string> WifiNanIface::getNameInternal() {
     return {createWifiStatus(WifiStatusCode::SUCCESS), ifname_};
 }
@@ -703,6 +748,14 @@
     return {createWifiStatus(WifiStatusCode::SUCCESS), IfaceType::NAN};
 }
 
+Return<void> WifiNanIface::registerEventCallback_1_6(
+        const sp<V1_6::IWifiNanIfaceEventCallback>& callback,
+        registerEventCallback_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiNanIface::registerEventCallback_1_6Internal, hidl_status_cb,
+                           callback);
+}
+
 WifiStatus WifiNanIface::registerEventCallbackInternal(
         const sp<V1_0::IWifiNanIfaceEventCallback>& callback) {
     if (!event_cb_handler_.addCallback(callback)) {
@@ -730,15 +783,9 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-WifiStatus WifiNanIface::startPublishRequestInternal(uint16_t cmd_id,
-                                                     const NanPublishRequest& msg) {
-    legacy_hal::NanPublishRequest legacy_msg;
-    if (!hidl_struct_util::convertHidlNanPublishRequestToLegacy(msg, &legacy_msg)) {
-        return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
-    }
-    legacy_hal::wifi_error legacy_status =
-            legacy_hal_.lock()->nanPublishRequest(ifname_, cmd_id, legacy_msg);
-    return createWifiStatusFromLegacyError(legacy_status);
+WifiStatus WifiNanIface::startPublishRequestInternal(uint16_t /* cmd_id */,
+                                                     const V1_0::NanPublishRequest& /* msg */) {
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
 }
 
 WifiStatus WifiNanIface::stopPublishRequestInternal(uint16_t cmd_id, uint8_t sessionId) {
@@ -750,7 +797,7 @@
 }
 
 WifiStatus WifiNanIface::startSubscribeRequestInternal(uint16_t cmd_id,
-                                                       const NanSubscribeRequest& msg) {
+                                                       const V1_0::NanSubscribeRequest& msg) {
     legacy_hal::NanSubscribeRequest legacy_msg;
     if (!hidl_struct_util::convertHidlNanSubscribeRequestToLegacy(msg, &legacy_msg)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
@@ -791,8 +838,8 @@
             legacy_hal_.lock()->nanDataInterfaceDelete(ifname_, cmd_id, iface_name);
     return createWifiStatusFromLegacyError(legacy_status);
 }
-WifiStatus WifiNanIface::initiateDataPathRequestInternal(uint16_t cmd_id,
-                                                         const NanInitiateDataPathRequest& msg) {
+WifiStatus WifiNanIface::initiateDataPathRequestInternal(
+        uint16_t cmd_id, const V1_0::NanInitiateDataPathRequest& msg) {
     legacy_hal::NanDataPathInitiatorRequest legacy_msg;
     if (!hidl_struct_util::convertHidlNanDataPathInitiatorRequestToLegacy(msg, &legacy_msg)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
@@ -802,7 +849,7 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 WifiStatus WifiNanIface::respondToDataPathIndicationRequestInternal(
-        uint16_t cmd_id, const NanRespondToDataPathIndicationRequest& msg) {
+        uint16_t cmd_id, const V1_0::NanRespondToDataPathIndicationRequest& msg) {
     legacy_hal::NanDataPathIndicationResponse legacy_msg;
     if (!hidl_struct_util::convertHidlNanDataPathIndicationResponseToLegacy(msg, &legacy_msg)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
@@ -874,11 +921,23 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-WifiStatus WifiNanIface::enableRequest_1_5Internal(uint16_t cmd_id,
+WifiStatus WifiNanIface::enableRequest_1_5Internal(
+        uint16_t /* cmd_id */, const V1_4::NanEnableRequest& /* msg1 */,
+        const V1_5::NanConfigRequestSupplemental& /* msg2 */) {
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+}
+
+WifiStatus WifiNanIface::configRequest_1_5Internal(
+        uint16_t /* cmd_id */, const V1_4::NanConfigRequest& /* msg1 */,
+        const V1_5::NanConfigRequestSupplemental& /* msg2 */) {
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+}
+
+WifiStatus WifiNanIface::enableRequest_1_6Internal(uint16_t cmd_id,
                                                    const V1_4::NanEnableRequest& msg1,
-                                                   const V1_5::NanConfigRequestSupplemental& msg2) {
+                                                   const V1_6::NanConfigRequestSupplemental& msg2) {
     legacy_hal::NanEnableRequest legacy_msg;
-    if (!hidl_struct_util::convertHidlNanEnableRequest_1_5ToLegacy(msg1, msg2, &legacy_msg)) {
+    if (!hidl_struct_util::convertHidlNanEnableRequest_1_6ToLegacy(msg1, msg2, &legacy_msg)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
     }
     legacy_hal::wifi_error legacy_status =
@@ -886,11 +945,11 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-WifiStatus WifiNanIface::configRequest_1_5Internal(uint16_t cmd_id,
+WifiStatus WifiNanIface::configRequest_1_6Internal(uint16_t cmd_id,
                                                    const V1_4::NanConfigRequest& msg1,
-                                                   const V1_5::NanConfigRequestSupplemental& msg2) {
+                                                   const V1_6::NanConfigRequestSupplemental& msg2) {
     legacy_hal::NanConfigRequest legacy_msg;
-    if (!hidl_struct_util::convertHidlNanConfigRequest_1_5ToLegacy(msg1, msg2, &legacy_msg)) {
+    if (!hidl_struct_util::convertHidlNanConfigRequest_1_6ToLegacy(msg1, msg2, &legacy_msg)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
     }
     legacy_hal::wifi_error legacy_status =
@@ -898,6 +957,58 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
+WifiStatus WifiNanIface::initiateDataPathRequest_1_6Internal(
+        uint16_t cmd_id, const V1_6::NanInitiateDataPathRequest& msg) {
+    legacy_hal::NanDataPathInitiatorRequest legacy_msg;
+    if (!hidl_struct_util::convertHidlNanDataPathInitiatorRequest_1_6ToLegacy(msg, &legacy_msg)) {
+        return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
+    }
+    legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->nanDataRequestInitiator(ifname_, cmd_id, legacy_msg);
+    return createWifiStatusFromLegacyError(legacy_status);
+}
+
+WifiStatus WifiNanIface::respondToDataPathIndicationRequest_1_6Internal(
+        uint16_t cmd_id, const V1_6::NanRespondToDataPathIndicationRequest& msg) {
+    legacy_hal::NanDataPathIndicationResponse legacy_msg;
+    if (!hidl_struct_util::convertHidlNanDataPathIndicationResponse_1_6ToLegacy(msg, &legacy_msg)) {
+        return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
+    }
+    legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->nanDataIndicationResponse(ifname_, cmd_id, legacy_msg);
+    return createWifiStatusFromLegacyError(legacy_status);
+}
+
+WifiStatus WifiNanIface::startPublishRequest_1_6Internal(uint16_t cmd_id,
+                                                         const V1_6::NanPublishRequest& msg) {
+    legacy_hal::NanPublishRequest legacy_msg;
+    if (!hidl_struct_util::convertHidlNanPublishRequestToLegacy(msg, &legacy_msg)) {
+        return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
+    }
+    legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->nanPublishRequest(ifname_, cmd_id, legacy_msg);
+    return createWifiStatusFromLegacyError(legacy_status);
+}
+
+WifiStatus WifiNanIface::registerEventCallback_1_6Internal(
+        const sp<V1_6::IWifiNanIfaceEventCallback>& callback) {
+    sp<V1_0::IWifiNanIfaceEventCallback> callback_1_0 = callback;
+    if (!event_cb_handler_.addCallback(callback_1_0)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    sp<V1_2::IWifiNanIfaceEventCallback> callback_1_2 = callback;
+    if (!event_cb_handler_1_2_.addCallback(callback_1_2)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    sp<V1_5::IWifiNanIfaceEventCallback> callback_1_5 = callback;
+    if (!event_cb_handler_1_5_.addCallback(callback_1_5)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    if (!event_cb_handler_1_6_.addCallback(callback)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    return createWifiStatus(WifiStatusCode::SUCCESS);
+}
 }  // namespace implementation
 }  // namespace V1_6
 }  // namespace wifi
diff --git a/wifi/1.6/default/wifi_nan_iface.h b/wifi/1.6/default/wifi_nan_iface.h
index c445afc..15bf572 100644
--- a/wifi/1.6/default/wifi_nan_iface.h
+++ b/wifi/1.6/default/wifi_nan_iface.h
@@ -18,8 +18,8 @@
 #define WIFI_NAN_IFACE_H_
 
 #include <android-base/macros.h>
-#include <android/hardware/wifi/1.5/IWifiNanIface.h>
-#include <android/hardware/wifi/1.5/IWifiNanIfaceEventCallback.h>
+#include <android/hardware/wifi/1.6/IWifiNanIface.h>
+#include <android/hardware/wifi/1.6/IWifiNanIfaceEventCallback.h>
 
 #include "hidl_callback_util.h"
 #include "wifi_iface_util.h"
@@ -32,11 +32,13 @@
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 using namespace android::hardware::wifi::V1_2;
+using namespace android::hardware::wifi::V1_4;
+using namespace android::hardware::wifi::V1_6;
 
 /**
  * HIDL interface object used to control a NAN Iface instance.
  */
-class WifiNanIface : public V1_5::IWifiNanIface {
+class WifiNanIface : public V1_6::IWifiNanIface {
   public:
     WifiNanIface(const std::string& ifname, bool is_dedicated_iface,
                  const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal,
@@ -58,11 +60,11 @@
     Return<void> configRequest(uint16_t cmd_id, const V1_0::NanConfigRequest& msg,
                                configRequest_cb hidl_status_cb) override;
     Return<void> disableRequest(uint16_t cmd_id, disableRequest_cb hidl_status_cb) override;
-    Return<void> startPublishRequest(uint16_t cmd_id, const NanPublishRequest& msg,
+    Return<void> startPublishRequest(uint16_t cmd_id, const V1_0::NanPublishRequest& msg,
                                      startPublishRequest_cb hidl_status_cb) override;
     Return<void> stopPublishRequest(uint16_t cmd_id, uint8_t sessionId,
                                     stopPublishRequest_cb hidl_status_cb) override;
-    Return<void> startSubscribeRequest(uint16_t cmd_id, const NanSubscribeRequest& msg,
+    Return<void> startSubscribeRequest(uint16_t cmd_id, const V1_0::NanSubscribeRequest& msg,
                                        startSubscribeRequest_cb hidl_status_cb) override;
     Return<void> stopSubscribeRequest(uint16_t cmd_id, uint8_t sessionId,
                                       stopSubscribeRequest_cb hidl_status_cb) override;
@@ -72,10 +74,11 @@
                                             createDataInterfaceRequest_cb hidl_status_cb) override;
     Return<void> deleteDataInterfaceRequest(uint16_t cmd_id, const hidl_string& iface_name,
                                             deleteDataInterfaceRequest_cb hidl_status_cb) override;
-    Return<void> initiateDataPathRequest(uint16_t cmd_id, const NanInitiateDataPathRequest& msg,
+    Return<void> initiateDataPathRequest(uint16_t cmd_id,
+                                         const V1_0::NanInitiateDataPathRequest& msg,
                                          initiateDataPathRequest_cb hidl_status_cb) override;
     Return<void> respondToDataPathIndicationRequest(
-            uint16_t cmd_id, const NanRespondToDataPathIndicationRequest& msg,
+            uint16_t cmd_id, const V1_0::NanRespondToDataPathIndicationRequest& msg,
             respondToDataPathIndicationRequest_cb hidl_status_cb) override;
     Return<void> terminateDataPathRequest(uint16_t cmd_id, uint32_t ndpInstanceId,
                                           terminateDataPathRequest_cb hidl_status_cb) override;
@@ -98,12 +101,28 @@
                                            registerEventCallback_1_5_cb hidl_status_cb) override;
     Return<void> enableRequest_1_5(uint16_t cmd_id, const V1_4::NanEnableRequest& msg1,
                                    const V1_5::NanConfigRequestSupplemental& msg2,
-                                   enableRequest_1_4_cb hidl_status_cb) override;
+                                   enableRequest_1_5_cb hidl_status_cb) override;
     Return<void> configRequest_1_5(uint16_t cmd_id, const V1_4::NanConfigRequest& msg1,
                                    const V1_5::NanConfigRequestSupplemental& msg2,
-                                   configRequest_1_4_cb hidl_status_cb) override;
+                                   configRequest_1_5_cb hidl_status_cb) override;
     Return<void> getCapabilitiesRequest_1_5(uint16_t cmd_id,
                                             getCapabilitiesRequest_cb hidl_status_cb) override;
+    Return<void> registerEventCallback_1_6(const sp<V1_6::IWifiNanIfaceEventCallback>& callback,
+                                           registerEventCallback_1_6_cb hidl_status_cb) override;
+    Return<void> initiateDataPathRequest_1_6(
+            uint16_t cmd_id, const V1_6::NanInitiateDataPathRequest& msg,
+            initiateDataPathRequest_1_6_cb hidl_status_cb) override;
+    Return<void> respondToDataPathIndicationRequest_1_6(
+            uint16_t cmd_id, const V1_6::NanRespondToDataPathIndicationRequest& msg,
+            respondToDataPathIndicationRequest_1_6_cb hidl_status_cb) override;
+    Return<void> enableRequest_1_6(uint16_t cmd_id, const V1_4::NanEnableRequest& msg1,
+                                   const V1_6::NanConfigRequestSupplemental& msg2,
+                                   enableRequest_1_6_cb hidl_status_cb) override;
+    Return<void> configRequest_1_6(uint16_t cmd_id, const V1_4::NanConfigRequest& msg1,
+                                   const V1_6::NanConfigRequestSupplemental& msg2,
+                                   configRequest_1_6_cb hidl_status_cb) override;
+    Return<void> startPublishRequest_1_6(uint16_t cmd_id, const V1_6::NanPublishRequest& msg,
+                                         startPublishRequest_cb hidl_status_cb) override;
 
   private:
     // Corresponding worker functions for the HIDL methods.
@@ -114,18 +133,18 @@
     WifiStatus enableRequestInternal(uint16_t cmd_id, const V1_0::NanEnableRequest& msg);
     WifiStatus configRequestInternal(uint16_t cmd_id, const V1_0::NanConfigRequest& msg);
     WifiStatus disableRequestInternal(uint16_t cmd_id);
-    WifiStatus startPublishRequestInternal(uint16_t cmd_id, const NanPublishRequest& msg);
+    WifiStatus startPublishRequestInternal(uint16_t cmd_id, const V1_0::NanPublishRequest& msg);
     WifiStatus stopPublishRequestInternal(uint16_t cmd_id, uint8_t sessionId);
-    WifiStatus startSubscribeRequestInternal(uint16_t cmd_id, const NanSubscribeRequest& msg);
+    WifiStatus startSubscribeRequestInternal(uint16_t cmd_id, const V1_0::NanSubscribeRequest& msg);
     WifiStatus stopSubscribeRequestInternal(uint16_t cmd_id, uint8_t sessionId);
     WifiStatus transmitFollowupRequestInternal(uint16_t cmd_id,
                                                const NanTransmitFollowupRequest& msg);
     WifiStatus createDataInterfaceRequestInternal(uint16_t cmd_id, const std::string& iface_name);
     WifiStatus deleteDataInterfaceRequestInternal(uint16_t cmd_id, const std::string& iface_name);
     WifiStatus initiateDataPathRequestInternal(uint16_t cmd_id,
-                                               const NanInitiateDataPathRequest& msg);
+                                               const V1_0::NanInitiateDataPathRequest& msg);
     WifiStatus respondToDataPathIndicationRequestInternal(
-            uint16_t cmd_id, const NanRespondToDataPathIndicationRequest& msg);
+            uint16_t cmd_id, const V1_0::NanRespondToDataPathIndicationRequest& msg);
     WifiStatus terminateDataPathRequestInternal(uint16_t cmd_id, uint32_t ndpInstanceId);
 
     WifiStatus registerEventCallback_1_2Internal(
@@ -145,6 +164,18 @@
     WifiStatus configRequest_1_5Internal(uint16_t cmd_id, const V1_4::NanConfigRequest& msg,
                                          const V1_5::NanConfigRequestSupplemental& msg2);
     WifiStatus getCapabilitiesRequest_1_5Internal(uint16_t cmd_id);
+    WifiStatus registerEventCallback_1_6Internal(
+            const sp<V1_6::IWifiNanIfaceEventCallback>& callback);
+
+    WifiStatus enableRequest_1_6Internal(uint16_t cmd_id, const V1_4::NanEnableRequest& msg1,
+                                         const V1_6::NanConfigRequestSupplemental& msg2);
+    WifiStatus configRequest_1_6Internal(uint16_t cmd_id, const V1_4::NanConfigRequest& msg,
+                                         const V1_6::NanConfigRequestSupplemental& msg2);
+    WifiStatus startPublishRequest_1_6Internal(uint16_t cmd_id, const V1_6::NanPublishRequest& msg);
+    WifiStatus initiateDataPathRequest_1_6Internal(uint16_t cmd_id,
+                                                   const V1_6::NanInitiateDataPathRequest& msg);
+    WifiStatus respondToDataPathIndicationRequest_1_6Internal(
+            uint16_t cmd_id, const V1_6::NanRespondToDataPathIndicationRequest& msg);
 
     // all 1_0 and descendant callbacks
     std::set<sp<V1_0::IWifiNanIfaceEventCallback>> getEventCallbacks();
@@ -152,6 +183,8 @@
     std::set<sp<V1_2::IWifiNanIfaceEventCallback>> getEventCallbacks_1_2();
     // all 1_5 and descendant callbacks
     std::set<sp<V1_5::IWifiNanIfaceEventCallback>> getEventCallbacks_1_5();
+    // all 1_6 and descendant callbacks
+    std::set<sp<V1_6::IWifiNanIfaceEventCallback>> getEventCallbacks_1_6();
 
     std::string ifname_;
     bool is_dedicated_iface_;
@@ -161,6 +194,7 @@
     hidl_callback_util::HidlCallbackHandler<V1_0::IWifiNanIfaceEventCallback> event_cb_handler_;
     hidl_callback_util::HidlCallbackHandler<V1_2::IWifiNanIfaceEventCallback> event_cb_handler_1_2_;
     hidl_callback_util::HidlCallbackHandler<V1_5::IWifiNanIfaceEventCallback> event_cb_handler_1_5_;
+    hidl_callback_util::HidlCallbackHandler<V1_6::IWifiNanIfaceEventCallback> event_cb_handler_1_6_;
 
     DISALLOW_COPY_AND_ASSIGN(WifiNanIface);
 };
diff --git a/wifi/1.6/default/wifi_rtt_controller.cpp b/wifi/1.6/default/wifi_rtt_controller.cpp
index f5e1d5a..b328f31 100644
--- a/wifi/1.6/default/wifi_rtt_controller.cpp
+++ b/wifi/1.6/default/wifi_rtt_controller.cpp
@@ -43,7 +43,7 @@
     return is_valid_;
 }
 
-std::vector<sp<V1_4::IWifiRttControllerEventCallback>> WifiRttController::getEventCallbacks() {
+std::vector<sp<V1_6::IWifiRttControllerEventCallback>> WifiRttController::getEventCallbacks() {
     return event_callbacks_;
 }
 
@@ -102,7 +102,7 @@
 }
 
 Return<void> WifiRttController::enableResponder(uint32_t cmd_id,
-                                                const WifiChannelInfo& channel_hint,
+                                                const V1_0::WifiChannelInfo& channel_hint,
                                                 uint32_t max_duration_seconds,
                                                 const V1_0::RttResponder& info,
                                                 enableResponder_cb hidl_status_cb) {
@@ -144,7 +144,7 @@
 }
 
 Return<void> WifiRttController::enableResponder_1_4(uint32_t cmd_id,
-                                                    const WifiChannelInfo& channel_hint,
+                                                    const V1_0::WifiChannelInfo& channel_hint,
                                                     uint32_t max_duration_seconds,
                                                     const V1_4::RttResponder& info,
                                                     enableResponder_1_4_cb hidl_status_cb) {
@@ -153,6 +153,42 @@
                            channel_hint, max_duration_seconds, info);
 }
 
+Return<void> WifiRttController::registerEventCallback_1_6(
+        const sp<V1_6::IWifiRttControllerEventCallback>& callback,
+        registerEventCallback_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::registerEventCallbackInternal_1_6, hidl_status_cb,
+                           callback);
+}
+
+Return<void> WifiRttController::rangeRequest_1_6(uint32_t cmd_id,
+                                                 const hidl_vec<V1_6::RttConfig>& rtt_configs,
+                                                 rangeRequest_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::rangeRequestInternal_1_6, hidl_status_cb, cmd_id,
+                           rtt_configs);
+}
+
+Return<void> WifiRttController::getCapabilities_1_6(getCapabilities_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::getCapabilitiesInternal_1_6, hidl_status_cb);
+}
+
+Return<void> WifiRttController::getResponderInfo_1_6(getResponderInfo_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::getResponderInfoInternal_1_6, hidl_status_cb);
+}
+
+Return<void> WifiRttController::enableResponder_1_6(uint32_t cmd_id,
+                                                    const V1_6::WifiChannelInfo& channel_hint,
+                                                    uint32_t max_duration_seconds,
+                                                    const V1_6::RttResponder& info,
+                                                    enableResponder_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::enableResponderInternal_1_6, hidl_status_cb, cmd_id,
+                           channel_hint, max_duration_seconds, info);
+}
+
 std::pair<WifiStatus, sp<IWifiIface>> WifiRttController::getBoundIfaceInternal() {
     return {createWifiStatus(WifiStatusCode::SUCCESS), bound_iface_};
 }
@@ -210,10 +246,9 @@
     return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
 }
 
-WifiStatus WifiRttController::enableResponderInternal(uint32_t /* cmd_id */,
-                                                      const WifiChannelInfo& /* channel_hint */,
-                                                      uint32_t /* max_duration_seconds */,
-                                                      const V1_0::RttResponder& /* info */) {
+WifiStatus WifiRttController::enableResponderInternal(
+        uint32_t /* cmd_id */, const V1_0::WifiChannelInfo& /* channel_hint */,
+        uint32_t /* max_duration_seconds */, const V1_0::RttResponder& /* info */) {
     // Deprecated support for this api
     return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED)};
 }
@@ -224,14 +259,43 @@
 }
 
 WifiStatus WifiRttController::registerEventCallbackInternal_1_4(
-        const sp<V1_4::IWifiRttControllerEventCallback>& callback) {
+        const sp<V1_4::IWifiRttControllerEventCallback>& /* callback */) {
+    // Deprecated support for this api
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+}
+
+WifiStatus WifiRttController::rangeRequestInternal_1_4(
+        uint32_t /* cmd_id */, const std::vector<V1_4::RttConfig>& /* rtt_configs */) {
+    // Deprecated support for this api
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+}
+
+std::pair<WifiStatus, V1_4::RttCapabilities> WifiRttController::getCapabilitiesInternal_1_4() {
+    // Deprecated support for this api
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+std::pair<WifiStatus, V1_4::RttResponder> WifiRttController::getResponderInfoInternal_1_4() {
+    // Deprecated support for this api
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+WifiStatus WifiRttController::enableResponderInternal_1_4(
+        uint32_t /* cmd_id */, const V1_0::WifiChannelInfo& /* channel_hint */,
+        uint32_t /* max_duration_seconds */, const V1_4::RttResponder& /* info */) {
+    // Deprecated support for this api
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED)};
+}
+
+WifiStatus WifiRttController::registerEventCallbackInternal_1_6(
+        const sp<V1_6::IWifiRttControllerEventCallback>& callback) {
     // TODO(b/31632518): remove the callback when the client is destroyed
     event_callbacks_.emplace_back(callback);
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
-WifiStatus WifiRttController::rangeRequestInternal_1_4(
-        uint32_t cmd_id, const std::vector<V1_4::RttConfig>& rtt_configs) {
+WifiStatus WifiRttController::rangeRequestInternal_1_6(
+        uint32_t cmd_id, const std::vector<V1_6::RttConfig>& rtt_configs) {
     std::vector<legacy_hal::wifi_rtt_config> legacy_configs;
     if (!hidl_struct_util::convertHidlVectorOfRttConfigToLegacy(rtt_configs, &legacy_configs)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
@@ -245,14 +309,14 @@
                     LOG(ERROR) << "Callback invoked on an invalid object";
                     return;
                 }
-                std::vector<V1_4::RttResult> hidl_results;
+                std::vector<V1_6::RttResult> hidl_results;
                 if (!hidl_struct_util::convertLegacyVectorOfRttResultToHidl(results,
                                                                             &hidl_results)) {
                     LOG(ERROR) << "Failed to convert rtt results to HIDL structs";
                     return;
                 }
                 for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
-                    callback->onResults_1_4(id, hidl_results);
+                    callback->onResults_1_6(id, hidl_results);
                 }
             };
     legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->startRttRangeRequest(
@@ -260,38 +324,38 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-std::pair<WifiStatus, V1_4::RttCapabilities> WifiRttController::getCapabilitiesInternal_1_4() {
+std::pair<WifiStatus, V1_6::RttCapabilities> WifiRttController::getCapabilitiesInternal_1_6() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::wifi_rtt_capabilities legacy_caps;
     std::tie(legacy_status, legacy_caps) = legacy_hal_.lock()->getRttCapabilities(ifname_);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    V1_4::RttCapabilities hidl_caps;
+    V1_6::RttCapabilities hidl_caps;
     if (!hidl_struct_util::convertLegacyRttCapabilitiesToHidl(legacy_caps, &hidl_caps)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
     }
     return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_caps};
 }
 
-std::pair<WifiStatus, V1_4::RttResponder> WifiRttController::getResponderInfoInternal_1_4() {
+std::pair<WifiStatus, V1_6::RttResponder> WifiRttController::getResponderInfoInternal_1_6() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::wifi_rtt_responder legacy_responder;
     std::tie(legacy_status, legacy_responder) = legacy_hal_.lock()->getRttResponderInfo(ifname_);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    V1_4::RttResponder hidl_responder;
+    V1_6::RttResponder hidl_responder;
     if (!hidl_struct_util::convertLegacyRttResponderToHidl(legacy_responder, &hidl_responder)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
     }
     return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_responder};
 }
 
-WifiStatus WifiRttController::enableResponderInternal_1_4(uint32_t cmd_id,
-                                                          const WifiChannelInfo& channel_hint,
+WifiStatus WifiRttController::enableResponderInternal_1_6(uint32_t cmd_id,
+                                                          const V1_6::WifiChannelInfo& channel_hint,
                                                           uint32_t max_duration_seconds,
-                                                          const V1_4::RttResponder& info) {
+                                                          const V1_6::RttResponder& info) {
     legacy_hal::wifi_channel_info legacy_channel_info;
     if (!hidl_struct_util::convertHidlWifiChannelInfoToLegacy(channel_hint, &legacy_channel_info)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
diff --git a/wifi/1.6/default/wifi_rtt_controller.h b/wifi/1.6/default/wifi_rtt_controller.h
index b4a2116..fd5f68b 100644
--- a/wifi/1.6/default/wifi_rtt_controller.h
+++ b/wifi/1.6/default/wifi_rtt_controller.h
@@ -19,8 +19,8 @@
 
 #include <android-base/macros.h>
 #include <android/hardware/wifi/1.0/IWifiIface.h>
-#include <android/hardware/wifi/1.4/IWifiRttController.h>
-#include <android/hardware/wifi/1.4/IWifiRttControllerEventCallback.h>
+#include <android/hardware/wifi/1.6/IWifiRttController.h>
+#include <android/hardware/wifi/1.6/IWifiRttControllerEventCallback.h>
 
 #include "wifi_legacy_hal.h"
 
@@ -33,14 +33,14 @@
 /**
  * HIDL interface object used to control all RTT operations.
  */
-class WifiRttController : public V1_4::IWifiRttController {
+class WifiRttController : public V1_6::IWifiRttController {
   public:
     WifiRttController(const std::string& iface_name, const sp<IWifiIface>& bound_iface,
                       const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal);
     // Refer to |WifiChip::invalidate()|.
     void invalidate();
     bool isValid();
-    std::vector<sp<V1_4::IWifiRttControllerEventCallback>> getEventCallbacks();
+    std::vector<sp<V1_6::IWifiRttControllerEventCallback>> getEventCallbacks();
     std::string getIfaceName();
 
     // HIDL methods exposed.
@@ -57,7 +57,7 @@
     Return<void> setLcr(uint32_t cmd_id, const RttLcrInformation& lcr,
                         setLcr_cb hidl_status_cb) override;
     Return<void> getResponderInfo(getResponderInfo_cb hidl_status_cb) override;
-    Return<void> enableResponder(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    Return<void> enableResponder(uint32_t cmd_id, const V1_0::WifiChannelInfo& channel_hint,
                                  uint32_t max_duration_seconds, const V1_0::RttResponder& info,
                                  enableResponder_cb hidl_status_cb) override;
     Return<void> disableResponder(uint32_t cmd_id, disableResponder_cb hidl_status_cb) override;
@@ -68,9 +68,19 @@
                                   rangeRequest_1_4_cb hidl_status_cb) override;
     Return<void> getCapabilities_1_4(getCapabilities_1_4_cb hidl_status_cb) override;
     Return<void> getResponderInfo_1_4(getResponderInfo_1_4_cb hidl_status_cb) override;
-    Return<void> enableResponder_1_4(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    Return<void> enableResponder_1_4(uint32_t cmd_id, const V1_0::WifiChannelInfo& channel_hint,
                                      uint32_t max_duration_seconds, const V1_4::RttResponder& info,
                                      enableResponder_1_4_cb hidl_status_cb) override;
+    Return<void> registerEventCallback_1_6(
+            const sp<V1_6::IWifiRttControllerEventCallback>& callback,
+            registerEventCallback_1_6_cb hidl_status_cb) override;
+    Return<void> rangeRequest_1_6(uint32_t cmd_id, const hidl_vec<V1_6::RttConfig>& rtt_configs,
+                                  rangeRequest_1_6_cb hidl_status_cb) override;
+    Return<void> getCapabilities_1_6(getCapabilities_1_6_cb hidl_status_cb) override;
+    Return<void> getResponderInfo_1_6(getResponderInfo_1_6_cb hidl_status_cb) override;
+    Return<void> enableResponder_1_6(uint32_t cmd_id, const V1_6::WifiChannelInfo& channel_hint,
+                                     uint32_t max_duration_seconds, const V1_6::RttResponder& info,
+                                     enableResponder_1_6_cb hidl_status_cb) override;
 
   private:
     // Corresponding worker functions for the HIDL methods.
@@ -85,7 +95,7 @@
     WifiStatus setLciInternal(uint32_t cmd_id, const RttLciInformation& lci);
     WifiStatus setLcrInternal(uint32_t cmd_id, const RttLcrInformation& lcr);
     std::pair<WifiStatus, V1_0::RttResponder> getResponderInfoInternal();
-    WifiStatus enableResponderInternal(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    WifiStatus enableResponderInternal(uint32_t cmd_id, const V1_0::WifiChannelInfo& channel_hint,
                                        uint32_t max_duration_seconds,
                                        const V1_0::RttResponder& info);
     WifiStatus disableResponderInternal(uint32_t cmd_id);
@@ -95,14 +105,25 @@
                                         const std::vector<V1_4::RttConfig>& rtt_configs);
     std::pair<WifiStatus, V1_4::RttCapabilities> getCapabilitiesInternal_1_4();
     std::pair<WifiStatus, V1_4::RttResponder> getResponderInfoInternal_1_4();
-    WifiStatus enableResponderInternal_1_4(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    WifiStatus enableResponderInternal_1_4(uint32_t cmd_id,
+                                           const V1_0::WifiChannelInfo& channel_hint,
                                            uint32_t max_duration_seconds,
                                            const V1_4::RttResponder& info);
+    WifiStatus registerEventCallbackInternal_1_6(
+            const sp<V1_6::IWifiRttControllerEventCallback>& callback);
+    WifiStatus rangeRequestInternal_1_6(uint32_t cmd_id,
+                                        const std::vector<V1_6::RttConfig>& rtt_configs);
+    std::pair<WifiStatus, V1_6::RttCapabilities> getCapabilitiesInternal_1_6();
+    std::pair<WifiStatus, V1_6::RttResponder> getResponderInfoInternal_1_6();
+    WifiStatus enableResponderInternal_1_6(uint32_t cmd_id,
+                                           const V1_6::WifiChannelInfo& channel_hint,
+                                           uint32_t max_duration_seconds,
+                                           const V1_6::RttResponder& info);
 
     std::string ifname_;
     sp<IWifiIface> bound_iface_;
     std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
-    std::vector<sp<V1_4::IWifiRttControllerEventCallback>> event_callbacks_;
+    std::vector<sp<V1_6::IWifiRttControllerEventCallback>> event_callbacks_;
     bool is_valid_;
 
     DISALLOW_COPY_AND_ASSIGN(WifiRttController);
diff --git a/wifi/1.6/default/wifi_sta_iface.cpp b/wifi/1.6/default/wifi_sta_iface.cpp
index f852d36..dd11839 100644
--- a/wifi/1.6/default/wifi_sta_iface.cpp
+++ b/wifi/1.6/default/wifi_sta_iface.cpp
@@ -150,6 +150,11 @@
                            &WifiStaIface::getLinkLayerStatsInternal_1_5, hidl_status_cb);
 }
 
+Return<void> WifiStaIface::getLinkLayerStats_1_6(getLinkLayerStats_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiStaIface::getLinkLayerStatsInternal_1_6, hidl_status_cb);
+}
+
 Return<void> WifiStaIface::startRssiMonitoring(uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi,
                                                startRssiMonitoring_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
@@ -422,13 +427,17 @@
 }
 
 std::pair<WifiStatus, V1_5::StaLinkLayerStats> WifiStaIface::getLinkLayerStatsInternal_1_5() {
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+std::pair<WifiStatus, V1_6::StaLinkLayerStats> WifiStaIface::getLinkLayerStatsInternal_1_6() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::LinkLayerStats legacy_stats;
     std::tie(legacy_status, legacy_stats) = legacy_hal_.lock()->getLinkLayerStats(ifname_);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    V1_5::StaLinkLayerStats hidl_stats;
+    V1_6::StaLinkLayerStats hidl_stats;
     if (!hidl_struct_util::convertLegacyLinkLayerStatsToHidl(legacy_stats, &hidl_stats)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
     }
diff --git a/wifi/1.6/default/wifi_sta_iface.h b/wifi/1.6/default/wifi_sta_iface.h
index 37358a5..c01c50b 100644
--- a/wifi/1.6/default/wifi_sta_iface.h
+++ b/wifi/1.6/default/wifi_sta_iface.h
@@ -19,7 +19,7 @@
 
 #include <android-base/macros.h>
 #include <android/hardware/wifi/1.0/IWifiStaIfaceEventCallback.h>
-#include <android/hardware/wifi/1.5/IWifiStaIface.h>
+#include <android/hardware/wifi/1.6/IWifiStaIface.h>
 
 #include "hidl_callback_util.h"
 #include "wifi_iface_util.h"
@@ -35,7 +35,7 @@
 /**
  * HIDL interface object used to control a STA Iface instance.
  */
-class WifiStaIface : public V1_5::IWifiStaIface {
+class WifiStaIface : public V1_6::IWifiStaIface {
   public:
     WifiStaIface(const std::string& ifname,
                  const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal,
@@ -71,6 +71,7 @@
     Return<void> getLinkLayerStats(getLinkLayerStats_cb hidl_status_cb) override;
     Return<void> getLinkLayerStats_1_3(getLinkLayerStats_1_3_cb hidl_status_cb) override;
     Return<void> getLinkLayerStats_1_5(getLinkLayerStats_1_5_cb hidl_status_cb) override;
+    Return<void> getLinkLayerStats_1_6(getLinkLayerStats_1_6_cb hidl_status_cb) override;
     Return<void> startRssiMonitoring(uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi,
                                      startRssiMonitoring_cb hidl_status_cb) override;
     Return<void> stopRssiMonitoring(uint32_t cmd_id, stopRssiMonitoring_cb hidl_status_cb) override;
@@ -116,6 +117,7 @@
     std::pair<WifiStatus, V1_0::StaLinkLayerStats> getLinkLayerStatsInternal();
     std::pair<WifiStatus, V1_3::StaLinkLayerStats> getLinkLayerStatsInternal_1_3();
     std::pair<WifiStatus, V1_5::StaLinkLayerStats> getLinkLayerStatsInternal_1_5();
+    std::pair<WifiStatus, V1_6::StaLinkLayerStats> getLinkLayerStatsInternal_1_6();
     WifiStatus startRssiMonitoringInternal(uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi);
     WifiStatus stopRssiMonitoringInternal(uint32_t cmd_id);
     std::pair<WifiStatus, StaRoamingCapabilities> getRoamingCapabilitiesInternal();
diff --git a/wifi/1.6/types.hal b/wifi/1.6/types.hal
new file mode 100644
index 0000000..80fdbd1
--- /dev/null
+++ b/wifi/1.6/types.hal
@@ -0,0 +1,1314 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::MacAddress;
+import @1.0::NanCipherSuiteType;
+import @1.0::NanDataPathChannelCfg;
+import @1.0::NanDataPathConfirmInd;
+import @1.0::NanDataPathSecurityConfig;
+import @1.0::NanDataPathSecurityType;
+import @1.0::NanDiscoveryCommonConfig;
+import @1.0::NanInitiateDataPathRequest;
+import @1.0::NanMatchAlg;
+import @1.0::NanRangingIndication;
+import @1.0::NanRespondToDataPathIndicationRequest;
+import @1.0::NanPublishType;
+import @1.0::NanTxType;
+import @1.0::Rssi;
+import @1.0::RttBw;
+import @1.0::RttPeerType;
+import @1.0::RttStatus;
+import @1.0::RttType;
+import @1.0::StaLinkLayerIfaceStats;
+import @1.0::StaLinkLayerRadioStats;
+import @1.0::TimeSpanInPs;
+import @1.0::TimeStampInUs;
+import @1.0::TimeStampInMs;
+import @1.0::WifiChannelInMhz;
+import @1.0::WifiChannelWidthInMhz;
+import @1.0::WifiInformationElement;
+import @1.0::WifiRateNss;
+import @1.4::RttPreamble;
+import @1.4::WifiRatePreamble;
+import @1.5::NanConfigRequestSupplemental;
+import @1.5::WifiBand;
+import @1.5::StaLinkLayerIfaceContentionTimeStats;
+import @1.5::WifiIfaceMode;
+
+/**
+ * Channel operating width in Mhz.
+ */
+enum WifiChannelWidthInMhz : @1.0::WifiChannelWidthInMhz {
+    /**
+     * 320 MHz
+     */
+    WIDTH_320 = 7,
+};
+
+/**
+ * RTT Measurement Bandwidth.
+ */
+enum RttBw : @1.0::RttBw {
+    BW_320MHZ = 0x40,
+};
+
+/**
+ * RTT Measurement Preamble.
+ */
+enum RttPreamble : @1.4::RttPreamble {
+    /**
+     * Preamble type for 11be
+     */
+    EHT = 0x10,
+};
+
+/**
+ * Wifi Rate Preamble
+ */
+enum WifiRatePreamble : @1.4::WifiRatePreamble {
+    /**
+     * Preamble type for 11be
+     */
+    EHT = 6,
+};
+
+/**
+ * Antenna configuration
+ */
+enum WifiAntennaMode : uint32_t {
+  WIFI_ANTENNA_MODE_UNSPECIFIED    = 0,
+  WIFI_ANTENNA_MODE_1X1        = 1,
+  WIFI_ANTENNA_MODE_2X2        = 2,
+  WIFI_ANTENNA_MODE_3X3        = 3,
+  WIFI_ANTENNA_MODE_4X4        = 4,
+};
+
+/**
+ * Channel information.
+ */
+struct WifiChannelInfo {
+    /**
+     * Channel width (20, 40, 80, 80+80, 160, 320).
+     */
+    WifiChannelWidthInMhz width;
+
+    /**
+     * Primary 20 MHz channel.
+     */
+    WifiChannelInMhz centerFreq;
+
+    /**
+     * Center frequency (MHz) first segment.
+     */
+    WifiChannelInMhz centerFreq0;
+
+    /**
+     * Center frequency (MHz) second segment.
+     */
+    WifiChannelInMhz centerFreq1;
+};
+
+/**
+ * RTT configuration.
+ */
+struct RttConfig {
+    /**
+     * Peer device mac address.
+     */
+    MacAddress addr;
+
+    /**
+     * 1-sided or 2-sided RTT.
+     */
+    RttType type;
+
+    /**
+     * Optional - peer device hint (STA, P2P, AP).
+     */
+    RttPeerType peer;
+
+    /**
+     * Required for STA-AP mode, optional for P2P, NBD etc.
+     */
+    WifiChannelInfo channel;
+
+    /**
+     * Time interval between bursts (units: 100 ms).
+     * Applies to 1-sided and 2-sided RTT multi-burst requests.
+     * Range: 0-31, 0: no preference by initiator (2-sided RTT).
+     */
+    uint32_t burstPeriod;
+
+    /**
+     * Total number of RTT bursts to be executed. It will be
+     * specified in the same way as the parameter "Number of
+     * Burst Exponent" found in the FTM frame format. It
+     * applies to both: 1-sided RTT and 2-sided RTT. Valid
+     * values are 0 to 15 as defined in 802.11mc std.
+     * 0 means single shot
+     * The implication of this parameter on the maximum
+     * number of RTT results is the following:
+     * for 1-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst)
+     * for 2-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst - 1)
+     */
+    uint32_t numBurst;
+
+    /**
+     * Num of frames per burst.
+     * Minimum value = 1, Maximum value = 31
+     * For 2-sided this equals the number of FTM frames
+     * to be attempted in a single burst. This also
+     * equals the number of FTM frames that the
+     * initiator will request that the responder send
+     * in a single frame.
+     */
+    uint32_t numFramesPerBurst;
+
+    /**
+     * Number of retries for a failed RTT frame.
+     * Applies to 1-sided RTT only. Minimum value = 0, Maximum value = 3
+     */
+    uint32_t numRetriesPerRttFrame;
+
+    /**
+     * Following fields are only valid for 2-side RTT.
+     *
+     *
+     * Maximum number of retries that the initiator can
+     * retry an FTMR frame.
+     * Minimum value = 0, Maximum value = 3
+     */
+    uint32_t numRetriesPerFtmr;
+
+    /**
+     * Whether to request location civic info or not.
+     */
+    bool mustRequestLci;
+
+    /**
+     * Whether to request location civic records or not.
+     */
+    bool mustRequestLcr;
+
+    /**
+     * Applies to 1-sided and 2-sided RTT. Valid values will
+     * be 2-11 and 15 as specified by the 802.11mc std for
+     * the FTM parameter burst duration. In a multi-burst
+     * request, if responder overrides with larger value,
+     * the initiator will return failure. In a single-burst
+     * request if responder overrides with larger value,
+     * the initiator will sent TMR_STOP to terminate RTT
+     * at the end of the burst_duration it requested.
+     */
+    uint32_t burstDuration;
+
+    /**
+     * RTT preamble to be used in the RTT frames.
+     */
+    RttPreamble preamble;
+
+    /**
+     * RTT BW to be used in the RTT frames.
+     */
+    RttBw bw;
+};
+
+/**
+ * RTT Responder information
+ */
+struct RttResponder {
+    WifiChannelInfo channel;
+
+    RttPreamble preamble;
+};
+
+struct WifiChannelStats {
+    /**
+     * Channel information.
+     */
+    WifiChannelInfo channel;
+
+    /**
+     * Total time for which the radio is awake on this channel.
+     */
+    uint32_t onTimeInMs;
+
+    /**
+     * Total time for which CCA is held busy on this channel.
+     */
+    uint32_t ccaBusyTimeInMs;
+};
+
+struct StaLinkLayerRadioStats {
+    /**
+     * Baseline information as defined in HAL 1.0.
+     */
+    @1.0::StaLinkLayerRadioStats V1_0;
+
+    /**
+     * Total time for which the radio is awake due to NAN scan since boot or crash.
+     */
+    uint32_t onTimeInMsForNanScan;
+
+    /**
+     * Total time for which the radio is awake due to background scan since boot or crash.
+     */
+    uint32_t onTimeInMsForBgScan;
+
+    /**
+     * Total time for which the radio is awake due to roam scan since boot or crash.
+     */
+    uint32_t onTimeInMsForRoamScan;
+
+    /**
+     * Total time for which the radio is awake due to PNO scan since boot or crash.
+     */
+    uint32_t onTimeInMsForPnoScan;
+
+    /**
+     * Total time for which the radio is awake due to Hotspot 2.0 scans and GAS exchange since boot
+     * or crash.
+     */
+    uint32_t onTimeInMsForHs20Scan;
+
+    /**
+     * List of channel stats associated with this radio
+     */
+    vec<WifiChannelStats> channelStats;
+
+    /**
+     * Radio ID: An implementation specific value identifying the radio interface for which the
+     * stats are produced. Framework must not interpret this value. It must use this value for
+     * persistently identifying the statistics between calls,
+     * e.g. if the HAL provides them in different order.
+     */
+    int32_t radioId;
+};
+
+/**
+ * Per peer statistics.  The types of peer include the Access Point (AP), the Tunneled Direct Link
+ * Setup (TDLS), the Group Owner (GO), the Neighbor Awareness Networking (NAN), etc.
+ */
+struct StaPeerInfo {
+    /**
+     * Station count: The total number of stations currently associated with the peer.
+     */
+    uint16_t staCount;
+
+    /**
+     * Channel utilization: The percentage of time (normalized to 255, i.e., x% corresponds to
+     * (int) x * 255 / 100) that the medium is sensed as busy measured by either physical or
+     * virtual carrier sense (CS) mechanism.
+     */
+    uint16_t chanUtil;
+
+    /**
+     * Per rate statistics
+     */
+    vec<StaRateStat> rateStats;
+};
+
+/**
+ * Iface statistics for the current connection.
+ */
+struct StaLinkLayerIfaceStats {
+    /**
+     * Baseline information as defined in HAL 1.0.
+     */
+    @1.0::StaLinkLayerIfaceStats V1_0;
+
+    /**
+     * Duty cycle for the iface.
+     * if this iface is being served using time slicing on a radio with one or more ifaces
+     * (i.e MCC), then the duty cycle assigned to this iface in %.
+     * If not using time slicing (i.e SCC or DBS), set to 100.
+     */
+    uint8_t timeSliceDutyCycleInPercent;
+
+    /**
+     * WME Best Effort (BE) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeBeContentionTimeStats;
+
+    /**
+     * WME Background (BK) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeBkContentionTimeStats;
+
+    /**
+     * WME Video (VI) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeViContentionTimeStats;
+
+    /**
+     * WME Voice (VO) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeVoContentionTimeStats;
+
+    /**
+     * Per peer statistics.
+     */
+    vec<StaPeerInfo> peers;
+};
+
+/**
+ * Link layer stats retrieved via |getLinkLayerStats|.
+ */
+struct StaLinkLayerStats {
+    StaLinkLayerIfaceStats iface;
+
+    vec<StaLinkLayerRadioStats> radios;
+
+    /**
+     * TimeStamp for each stats sample.
+     * This is the absolute milliseconds from boot when these stats were
+     * sampled.
+     */
+    TimeStampInMs timeStampInMs;
+};
+
+/**
+ * Wifi rate info.
+ */
+struct WifiRateInfo {
+    /**
+     * Preamble used for RTT measurements.
+     */
+    WifiRatePreamble preamble;
+
+    /**
+     * Number of spatial streams.
+     */
+    WifiRateNss nss;
+
+    /**
+     * Bandwidth of channel.
+     */
+    WifiChannelWidthInMhz bw;
+
+    /**
+     * OFDM/CCK rate code would be as per ieee std in the units of 0.5mbps.
+     * HT/VHT/HE/EHT it would be mcs index.
+     */
+    uint8_t rateMcsIdx;
+
+    /**
+     * Bitrate in units of 100 Kbps.
+     */
+    uint32_t bitRateInKbps;
+};
+
+/**
+ * Per rate statistics.  The rate is characterized by the combination of preamble, number of spatial
+ * streams, transmission bandwidth, and modulation and coding scheme (MCS).
+ */
+struct StaRateStat {
+    /**
+     * Wifi rate information: preamble, number of spatial streams, bandwidth, MCS, etc.
+     */
+    WifiRateInfo rateInfo;
+
+    /**
+     * Number of successfully transmitted data packets (ACK received)
+     */
+    uint32_t txMpdu;
+
+    /**
+     * Number of received data packets
+     */
+    uint32_t rxMpdu;
+
+    /**
+     * Number of data packet losses (no ACK)
+     */
+    uint32_t mpduLost;
+
+    /**
+     * Number of data packet retries
+     */
+    uint32_t retries;
+};
+
+/**
+ * RTT results.
+ */
+struct RttResult {
+    /**
+     * Peer device mac address.
+     */
+    MacAddress addr;
+
+    /**
+     * Burst number in a multi-burst request.
+     */
+    uint32_t burstNum;
+
+    /**
+     * Total RTT measurement frames attempted.
+     */
+    uint32_t measurementNumber;
+
+    /**
+     * Total successful RTT measurement frames.
+     */
+    uint32_t successNumber;
+
+    /**
+     * Maximum number of "FTM frames per burst" supported by
+     * the responder STA. Applies to 2-sided RTT only.
+     * If reponder overrides with larger value:
+     * - for single-burst request initiator will truncate the
+     * larger value and send a TMR_STOP after receiving as
+     * many frames as originally requested.
+     * - for multi-burst request, initiator will return
+     * failure right away.
+     */
+    uint8_t numberPerBurstPeer;
+
+    /**
+     * Ranging status.
+     */
+    RttStatus status;
+
+    /**
+     * When status == RTT_STATUS_FAIL_BUSY_TRY_LATER,
+     * this will be the time provided by the responder as to
+     * when the request can be tried again. Applies to 2-sided
+     * RTT only. In sec, 1-31sec.
+     */
+    uint8_t retryAfterDuration;
+
+    /**
+     * RTT type.
+     */
+    RttType type;
+
+    /**
+     * Average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB.
+     */
+    Rssi rssi;
+
+    /**
+     * Rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional).
+     */
+    Rssi rssiSpread;
+
+    /**
+     * 1-sided RTT: TX rate of RTT frame.
+     * 2-sided RTT: TX rate of initiator's Ack in response to FTM frame.
+     */
+    WifiRateInfo txRate;
+
+    /**
+     * 1-sided RTT: TX rate of Ack from other side.
+     * 2-sided RTT: TX rate of FTM frame coming from responder.
+     */
+    WifiRateInfo rxRate;
+
+    /**
+     * Round trip time in picoseconds
+     */
+    TimeSpanInPs rtt;
+
+    /**
+     * Rtt standard deviation in picoseconds.
+     */
+    TimeSpanInPs rttSd;
+
+    /**
+     * Difference between max and min rtt times recorded in picoseconds.
+     */
+    TimeSpanInPs rttSpread;
+
+    /**
+     * Distance in mm (optional).
+     */
+    int32_t distanceInMm;
+
+    /**
+     * Standard deviation in mm (optional).
+     */
+    int32_t distanceSdInMm;
+
+    /**
+     * Difference between max and min distance recorded in mm (optional).
+     */
+    int32_t distanceSpreadInMm;
+
+    /**
+     * Time of the measurement (in microseconds since boot).
+     */
+    TimeStampInUs timeStampInUs;
+
+    /**
+     * in ms, actual time taken by the FW to finish one burst
+     * measurement. Applies to 1-sided and 2-sided RTT.
+     */
+    uint32_t burstDurationInMs;
+
+    /**
+     * Number of bursts allowed by the responder. Applies
+     * to 2-sided RTT only.
+     */
+    uint32_t negotiatedBurstNum;
+
+    /**
+     * for 11mc only.
+     */
+    WifiInformationElement lci;
+
+    /**
+     * for 11mc only.
+     */
+    WifiInformationElement lcr;
+};
+
+/**
+ * NAN data path channel information provided to the framework.
+ */
+struct NanDataPathChannelInfo {
+    /**
+     * Channel frequency in MHz.
+     */
+    WifiChannelInMhz channelFreq;
+
+    /**
+     * Channel bandwidth in MHz.
+     */
+    WifiChannelWidthInMhz channelBandwidth;
+
+    /**
+     * Number of spatial streams used in the channel.
+     */
+    uint32_t numSpatialStreams;
+};
+
+/**
+ * NAN Data path confirmation Indication structure.
+ * Event indication is received on both initiator and responder side when negotiation for a
+ * data-path finish: on success or failure.
+ */
+struct NanDataPathConfirmInd {
+    /**
+     * Baseline information as defined in HAL 1.0.
+     */
+    @1.0::NanDataPathConfirmInd V1_0;
+
+    /**
+     * The channel(s) on which the NDP is scheduled to operate.
+     * Updates to the operational channels are provided using the |eventDataPathScheduleUpdate|
+     * event.
+     */
+    vec<NanDataPathChannelInfo> channelInfo;
+};
+
+/**
+ * NAN data path channel information update indication structure.
+ * Event indication is received by all NDP owners whenever the channels on which the NDP operates
+ * are updated.
+ * Note: multiple NDPs may share the same schedule, the indication specifies all NDPs to which it
+ * applies.
+ */
+struct NanDataPathScheduleUpdateInd {
+    /**
+     * The discovery address (NMI) of the peer to which the NDP is connected.
+     */
+    MacAddress peerDiscoveryAddress;
+
+    /**
+     * The updated channel(s) information.
+     */
+    vec<NanDataPathChannelInfo> channelInfo;
+
+    /**
+     * The list of NDPs to which this update applies.
+     */
+    vec<uint32_t> ndpInstanceIds;
+};
+
+/**
+ * Wifi usable channel information.
+ */
+struct WifiUsableChannel {
+    /**
+     * Wifi channel freqeuncy in MHz.
+     */
+    WifiChannelInMhz channel;
+
+    /**
+     * Wifi channel bandwidth in MHz.
+     */
+    WifiChannelWidthInMhz channelBandwidth;
+
+    /**
+     * Iface modes feasible on this channel.
+     */
+    bitfield<WifiIfaceMode> ifaceModeMask;
+};
+
+/**
+ * RTT Capabilities.
+ */
+struct RttCapabilities {
+    /**
+     * if 1-sided rtt data collection is supported.
+     */
+    bool rttOneSidedSupported;
+
+    /**
+     * if ftm rtt data collection is supported.
+     */
+    bool rttFtmSupported;
+
+    /**
+     * if initiator supports LCI request. Applies to 2-sided RTT.
+     */
+    bool lciSupported;
+
+    /**
+     * if initiator supports LCR request. Applies to 2-sided RTT.
+     */
+    bool lcrSupported;
+
+    /**
+     * if 11mc responder mode is supported.
+     */
+    bool responderSupported;
+
+    /**
+     * Bit mask indicates what preamble is supported by initiator.
+     * Combination of |RttPreamble| values.
+     */
+    bitfield<RttPreamble> preambleSupport;
+
+    /**
+     * Bit mask indicates what BW is supported by initiator.
+     * Combination of |RttBw| values.
+     */
+    bitfield<RttBw> bwSupport;
+
+    /**
+     * Draft 11mc spec version supported by chip.
+     * For instance, version 4.0 must be 40 and version 4.3 must be 43 etc.
+     */
+    uint8_t mcVersion;
+};
+
+/**
+ * Cipher suite flags.
+ */
+enum NanCipherSuiteType : @1.0::NanCipherSuiteType {
+    /**
+     *  NCS-PK-128
+     */
+    PUBLIC_KEY_128_MASK = 1 << 2,
+    /**
+     *  NCS-PK-256
+     */
+    PUBLIC_KEY_256_MASK = 1 << 3,
+};
+
+/**
+ * NAN configuration request parameters added in the 1.2 HAL. These are supplemental to previous
+ * versions.
+ */
+struct NanConfigRequestSupplemental {
+    /**
+     * Baseline information as defined in HAL 1.5.
+     */
+    @1.5::NanConfigRequestSupplemental V1_5;
+
+    /**
+     * Controls NAN instant communication mode operate on which channel
+     */
+    uint32_t instantModeChannel;
+};
+
+/**
+ * Configuration of NAN data-path security.
+ */
+struct NanDataPathSecurityConfig {
+    /**
+     * Security configuration of the data-path (NDP). Security is enabled if not equal to
+     * |NanDataPathSecurityType.OPEN|.
+     * NAN Spec: Service Discovery Extension Attribute (SDEA) / Control / Security Required
+     */
+    NanDataPathSecurityType securityType;
+
+    /**
+     * Cipher type for data-paths. If |securityType| is |NanDataPathSecurityType.OPEN| then must
+     * be set to |NanCipherSuiteType.NONE|, otherwise a non-|NanCipherSuiteType.NONE| cipher suite
+     * must be specified.
+     */
+    NanCipherSuiteType cipherType;
+
+    /**
+     * Optional Pairwise Master Key (PMK). Must be specified (and is only used) if |securityType| is
+     * set to |NanDataPathSecurityType.PMK|.
+     * Ref: IEEE 802.11i
+     */
+    uint8_t[32] pmk;
+
+    /**
+     * Optional Passphrase. Must be specified (and is only used) if |securityType| is set to
+     * |NanDataPathSecurityType.PASSPHRASE|.
+     * Min length: |MIN_PASSPHRASE_LENGTH|
+     * Max length: |MAX_PASSPHRASE_LENGTH|
+     * NAN Spec: Appendix: Mapping passphrase to PMK for NCS-SK Cipher Suites
+     */
+    vec<uint8_t> passphrase;
+
+    /**
+     * Security Context Identifier attribute contains PMKID shall be included in NDP setup and
+     * response messages. Security Context Identifier, Identifies the Security Context. When
+     * security is enabled this field contains the 16 octet PMKID identifying the PMK used for
+     * setting up the Secure Data Path.
+     */
+    uint8_t[16] scid;
+};
+
+/**
+ * Response to a data-path request from a peer.
+ */
+struct NanRespondToDataPathIndicationRequest {
+    /**
+     * Accept (true) or reject (false) the request.
+     * NAN Spec: Data Path Attributes / NDP Attribute / Type and Status
+     */
+    bool acceptRequest;
+
+    /**
+     * ID of the data-path (NDP) for which we're responding - obtained as part of the request in
+     * |IWifiNanIfaceEventCallback.eventDataPathRequest|.
+     */
+    uint32_t ndpInstanceId;
+
+    /**
+     * NAN data interface name on which this data-path session is to be started.
+     * This must be an interface created using |IWifiNanIface.createDataInterfaceRequest|.
+     */
+    string ifaceName;
+
+    /**
+     * Security configuration of the requested data-path.
+     */
+    NanDataPathSecurityConfig securityConfig;
+
+    /**
+     * Arbitrary information communicated to the peer as part of the data-path setup process - there
+     * is no semantic meaning to these bytes. They are passed-through from sender to receiver as-is
+     * with no parsing.
+     * Max length: |NanCapabilities.maxAppInfoLen|.
+     * NAN Spec: Data Path Attributes / NDP Attribute / NDP Specific Info
+     */
+    vec<uint8_t> appInfo;
+
+    /**
+     * A service name to be used with |passphrase| to construct a Pairwise Master Key (PMK) for the
+     * data-path. Only relevant when a data-path is requested which is not associated with a NAN
+     * discovery session - e.g. using out-of-band discovery.
+     * Constraints: same as |NanDiscoveryCommonConfig.serviceName|
+     * NAN Spec: Appendix: Mapping pass-phrase to PMK for NCS-SK Cipher Suites
+     */
+    vec<uint8_t> serviceNameOutOfBand;
+};
+
+/**
+ *  Data Path Initiator requesting a data-path.
+ */
+struct NanInitiateDataPathRequest {
+    /**
+     * ID of the peer. Obtained as part of an earlier |IWifiNanIfaceEventCallback.eventMatch| or
+     * |IWifiNanIfaceEventCallback.eventFollowupReceived|.
+     */
+    uint32_t peerId;
+
+    /**
+     * NAN management interface MAC address of the peer. Obtained as part of an earlier
+     * |IWifiNanIfaceEventCallback.eventMatch| or |IWifiNanIfaceEventCallback.eventFollowupReceived|.
+     */
+    MacAddress peerDiscMacAddr;
+
+    /**
+     * Config flag for channel request.
+     */
+    NanDataPathChannelCfg channelRequestType;
+
+    /**
+     * Channel frequency in MHz to start data-path. Not relevant if |channelRequestType| is
+     * |NanDataPathChannelCfg.CHANNEL_NOT_REQUESTED|.
+     */
+    WifiChannelInMhz channel;
+
+    /**
+     * NAN data interface name on which this data-path session is to be initiated.
+     * This must be an interface created using |IWifiNanIface.createDataInterfaceRequest|.
+     */
+    string ifaceName;
+
+    /**
+     * Security configuration of the requested data-path.
+     */
+    NanDataPathSecurityConfig securityConfig;
+
+    /**
+     * Arbitrary information communicated to the peer as part of the data-path setup process - there
+     * is no semantic meaning to these bytes. They are passed-through from sender to receiver as-is
+     * with no parsing.
+     * Max length: |NanCapabilities.maxAppInfoLen|.
+     * NAN Spec: Data Path Attributes / NDP Attribute / NDP Specific Info
+     */
+    vec<uint8_t> appInfo;
+
+    /**
+     * A service name to be used with |passphrase| to construct a Pairwise Master Key (PMK) for the
+     * data-path. Only relevant when a data-path is requested which is not associated with a NAN
+     * discovery session - e.g. using out-of-band discovery.
+     * Constraints: same as |NanDiscoveryCommonConfig.serviceName|
+     * NAN Spec: Appendix: Mapping pass-phrase to PMK for NCS-SK Cipher Suites
+     */
+    vec<uint8_t> serviceNameOutOfBand;
+};
+
+/**
+ * Configurations of NAN discovery sessions: common to publish and subscribe discovery.
+ */
+struct NanDiscoveryCommonConfig {
+    /**
+     * The ID of the discovery session being configured. A value of 0 specifies a request to create
+     * a new discovery session. The new discovery session ID is returned with
+     * |IWifiNanIfaceEventCallback.notifyStartPublishResponse| or
+     * |IWifiNanIfaceEventCallback.notifyStartSubscribeResponse|.
+     * NAN Spec: Service Descriptor Attribute (SDA) / Instance ID
+     */
+    uint8_t sessionId;
+
+    /**
+     * The lifetime of the discovery session in seconds. A value of 0 means run forever or until
+     * canceled using |IWifiIface.stopPublishRequest| or |IWifiIface.stopSubscribeRequest|.
+     */
+    uint16_t ttlSec;
+
+    /**
+     * Indicates the interval between two Discovery Windows in which the device supporting the
+     * service is awake to transmit or receive the Service Discovery frames. Valid values of Awake
+     * DW Interval are: 1, 2, 4, 8 and 16. A value of 0 will default to 1. Does not override
+     * |NanBandSpecificConfig.discoveryWindowIntervalVal| configurations if those are specified.
+     */
+    uint16_t discoveryWindowPeriod;
+
+    /**
+     * The lifetime of the discovery session in number of transmitted SDF discovery packets. A value
+     * of 0 means forever or until canceled using |IWifiIface.stopPublishRequest| or
+     * |IWifiIface.stopSubscribeRequest|.
+     */
+    uint8_t discoveryCount;
+
+    /**
+     * UTF-8 encoded string identifying the service.
+     * Max length: |NanCapabilities.maxServiceNameLen|.
+     * NAN Spec: The only acceptable single-byte UTF-8 symbols for a Service Name are alphanumeric
+     * values (A-Z, a-z, 0-9), the hyphen ('-'), and the period ('.'). All valid multi-byte UTF-8
+     * characters are acceptable in a Service Name.
+     */
+    vec<uint8_t> serviceName;
+
+    /**
+     * Specifies how often to trigger |IWifiNanIfaceEventCallback.eventMatch| when continuously
+     * discovering the same discovery session (with no changes).
+     */
+    NanMatchAlg discoveryMatchIndicator;
+
+    /**
+     * Arbitrary information communicated in discovery packets - there is no semantic meaning to these
+     * bytes. They are passed-through from publisher to subscriber as-is with no parsing.
+     * Max length: |NanCapabilities.maxServiceSpecificInfoLen|.
+     * NAN Spec: Service Descriptor Attribute (SDA) / Service Info
+     */
+    vec<uint8_t> serviceSpecificInfo;
+
+    /**
+     * Arbitrary information communicated in discovery packets - there is no semantic meaning to these
+     * bytes. They are passed-through from publisher to subscriber as-is with no parsing.
+     * Max length: |NanCapabilities.maxExtendedServiceSpecificInfoLen|.
+     * Spec: Service Descriptor Extension Attribute (SDEA) / Service Info
+     */
+    vec<uint8_t> extendedServiceSpecificInfo;
+
+    /**
+     * Ordered sequence of <length, value> pairs (|length| uses 1 byte and contains the number of
+     * bytes in the |value| field) which specify further match criteria (beyond the service name).
+     * The match behavior is specified in details in the NAN spec.
+     * Publisher: used in SOLICITED or SOLICITED_UNSOLICITED sessions.
+     * Subscriber: used in ACTIVE or PASSIVE sessions.
+     * Max length: |NanCapabilities.maxMatchFilterLen|.
+     * NAN Spec: matching_filter_rx
+     */
+    vec<uint8_t> rxMatchFilter;
+
+    /**
+     * Ordered sequence of <length, value> pairs (|length| uses 1 byte and contains the number of
+     * bytes in the |value| field) which specify further match criteria (beyond the service name).
+     * The match behavior is specified in details in the NAN spec.
+     * Publisher: used if provided.
+     * Subscriber: used (if provided) only in ACTIVE sessions.
+     * Max length: |NanCapabilities.maxMatchFilterLen|.
+     * NAN Spec: matching_filter_tx and Service Descriptor Attribute (SDA) / Matching Filter
+     */
+    vec<uint8_t> txMatchFilter;
+
+    /**
+     * Specifies whether or not the discovery session uses the
+     * |NanBandSpecificConfig.rssiCloseProximity| value (configured in enable/configure requests) to
+     * filter out matched discovered peers.
+     * NAN Spec: Service Descriptor Attribute / Service Control / Discovery Range Limited.
+     */
+    bool useRssiThreshold;
+
+    /**
+     * Controls whether or not the |IWifiNanIfaceEventCallback.eventPublishTerminated| (for publish
+     * discovery sessions) or |IWifiNanIfaceEventCallback.eventSubscribeTerminated| (for subscribe
+     * discovery sessions) will be delivered.
+     */
+    bool disableDiscoveryTerminationIndication;
+
+    /**
+     * Controls whether or not the |IWifiNanIfaceEventCallback.eventMatchExpired| will be delivered.
+     */
+    bool disableMatchExpirationIndication;
+
+    /**
+     * Controls whether or not the |IWifiNanIfaceEventCallback.eventFollowupReceived| will be
+     * delivered.
+     */
+    bool disableFollowupReceivedIndication;
+
+    /**
+     * Security configuration of data-paths created in the context of this discovery session. Security
+     * parameters can be overridden during the actual construction of the data-path - allowing
+     * individual data-paths to have unique PMKs or Passphrases.
+     */
+    NanDataPathSecurityConfig securityConfig;
+
+    /**
+     * Specifies whether or not there is a ranging requirement in this discovery session.
+     * Ranging is only performed if all other match criteria with the peer are met. Ranging must
+     * be performed if both peers in the discovery session (publisher and subscriber) set this
+     * flag to true. Otherwise, if either peer sets this flag to false, ranging must not be performed
+     * and must not impact discovery decisions.
+     * Note: specifying that ranging is required also implies that this device must automatically
+     * accept ranging requests from peers.
+     * NAN Spec: Service Discovery Extension Attribute (SDEA) / Control / Ranging Require.
+     */
+    bool rangingRequired;
+
+    /**
+     * Interval in msec between two ranging measurements. Only relevant if |rangingRequired| is true.
+     * If the Awake DW interval specified either in |discoveryWindowPeriod| or in
+     * |NanBandSpecificConfig.discoveryWindowIntervalVal| is larger than the ranging interval then
+     * priority is given to Awake DW interval.
+     */
+    uint32_t rangingIntervalMsec;
+
+    /**
+     * The type of ranging feedback to be provided by discovery session matches
+     * |IWifiNanIfaceEventCallback.eventMatch|. Only relevant if |rangingRequired| is true.
+     */
+    bitfield<NanRangingIndication> configRangingIndications;
+
+    /**
+     * The ingress and egress distance in cm. If ranging is enabled (|rangingEnabled| is true) then
+     * |configRangingIndications| is used to determine whether ingress and/or egress (or neither)
+     * are used to determine whether a match has occurred.
+     * NAN Spec: Service Discovery Extension Attribute (SDEA) / Ingress & Egress Range Limit
+     */
+    uint16_t distanceIngressCm;
+
+    uint16_t distanceEgressCm;
+};
+
+/**
+ * Publish request: specifies a publish discovery operation.
+ */
+struct NanPublishRequest {
+    /**
+     * Common configuration of discovery sessions.
+     */
+    NanDiscoveryCommonConfig baseConfigs;
+
+    /**
+     * The type of the publish discovery session.
+     */
+    NanPublishType publishType;
+
+    /**
+     * For publishType of |NanPublishType.SOLICITED| or |NanPublishType.UNSOLICITED_SOLICITED|
+     * specifies the type of transmission used for responding to the probing subscribe discovery
+     * peer.
+     */
+    NanTxType txType;
+
+    /**
+     * Specifies whether data-path requests |IWifiNanIfaceEventCallback.eventDataPathRequest| (in
+     * the context of this discovery session) are automatically accepted (if true) - in which case
+     * the Responder must not call the |IWifiNanIface.respondToDataPathIndicationRequest| method and
+     * the device must automatically accept the data-path request and complete the negotiation.
+     */
+    bool autoAcceptDataPathRequests;
+};
+
+/**
+ * Match indication structure
+ */
+struct NanMatchInd {
+    /**
+     * Publish or subscribe discovery session ID of an existing discovery session.
+     * NAN Spec: Service Descriptor Attribute (SDA) / Instance ID
+     */
+    uint8_t discoverySessionId;
+
+    /**
+     * A unique ID of the peer. Can be subsequently used in |IWifiNanIface.transmitFollowupRequest| or
+     * to set up a data-path.
+     */
+    uint32_t peerId;
+
+    /**
+     * The NAN Discovery (management) MAC address of the peer.
+     */
+    MacAddress addr;
+
+    /**
+     * The arbitrary information contained in the |NanDiscoveryCommonConfig.serviceSpecificInfo| of
+     * the peer's discovery session configuration.
+     * Max length: |NanCapabilities.maxServiceSpecificInfoLen|.
+     * NAN Spec: Service Descriptor Attribute (SDA) / Service Info
+     */
+    vec<uint8_t> serviceSpecificInfo;
+
+    /**
+     * Arbitrary information communicated in discovery packets - there is no semantic meaning to these
+     * bytes. They are passed-through from publisher to subscriber as-is with no parsing.
+     * Max length: |NanCapabilities.maxExtendedServiceSpecificInfoLen|.
+     * Spec: Service Descriptor Extension Attribute (SDEA) / Service Info
+     */
+    vec<uint8_t> extendedServiceSpecificInfo;
+
+    /**
+     * The match filter from the discovery packet (publish or subscribe) which caused service
+     * discovery. Matches the |NanDiscoveryCommonConfig.txMatchFilter| of the peer's Unsolicited
+     * publish message or of the local device's Active subscribe message.
+     * Max length: |NanCapabilities.maxMatchFilterLen|.
+     * NAN Spec: Service Descriptor Attribute (SDA) / Matching Filter
+     */
+    vec<uint8_t> matchFilter;
+
+    /**
+     * Indicates the type of discovery: true if match occurred on a Beacon frame, false if the match
+     * occurred on a Service Discovery Frames (SDF).
+     */
+    bool matchOccuredInBeaconFlag;
+
+    /**
+     * Flag to indicate firmware is out of resource and that it can no longer track this Service Name.
+     * Indicates that while |IWifiNanIfaceEventCallback.eventMatch| will be received, the
+     * |NanDiscoveryCommonConfig.discoveryMatchIndicator| configuration will not be honored.
+     */
+    bool outOfResourceFlag;
+
+    /**
+     * If RSSI filtering was enabled using |NanDiscoveryCommonConfig.useRssiThreshold| in discovery
+     * session setup then this field contains the received RSSI value. It will contain 0 if RSSI
+     * filtering was not enabled.
+     * RSSI values are returned without sign, e.g. -70dBm will be returned as 70.
+     */
+    uint8_t rssiValue;
+
+    /**
+     * Cipher type for data-paths constructed in the context of this discovery session. Valid if
+     * |peerRequiresSecurityEnabledInNdp| is true.
+     */
+    NanCipherSuiteType peerCipherType;
+
+    /**
+     * Indicates whether or not the peer requires security enabled in any data-path (NDP) constructed
+     * in the context of this discovery session. The |cipherType| specifies the cipher type for such
+     * data-paths.
+     * NAN Spec: Service Discovery Extension Attribute (SDEA) / Control / Security Required
+     */
+    bool peerRequiresSecurityEnabledInNdp;
+
+    /**
+     * Indicates whether or not the peer requires (and hence allows) ranging in the context of this
+     * discovery session.
+     * Note that ranging is only performed if all other match criteria with the peer are met.
+     * NAN Spec: Service Discovery Extension Attribute (SDEA) / Control / Ranging Require.
+     */
+    bool peerRequiresRanging;
+
+    /**
+     * Ranging indication supersedes the NanMatchAlg specification.
+     * Ex: If NanMatchAlg is MATCH_ONCE, but ranging indications is continuous then continuous
+     * match notifications will be received (with ranging information).
+     * Ranging indication data is provided if Ranging required is enabled in the discovery
+     * specification and:
+     *   1) continuous ranging specified.
+     *   2) ingress/egress specified and:
+     *       - notify once for ingress >= ingress_distance and egress <= egress_distance,
+     *       - same for ingress_egress_both
+     * If the Awake DW intervals are larger than the ranging intervals then priority is given to the
+     * device DW intervals.
+     *
+     * If ranging was required and executed contains the distance to the peer in MM. The
+     * |rangingIndicationType| field specifies the event which triggered ranging.
+     */
+    uint32_t rangingMeasurementInMm;
+
+    /**
+     * The ranging event(s) which triggered the ranging. E.g. can indicate that continuous ranging was
+     * requested, or else that an ingress event occurred.
+     */
+    bitfield<NanRangingIndication> rangingIndicationType;
+
+    /**
+     * Security Context Identifier attribute contains PMKID shall be included in NDP setup and
+     * response messages. Security Context Identifier, Identifies the Security Context. For NAN
+     * Shared Key Cipher Suite, this field contains the 16 octet PMKID identifying the PMK used for
+     * setting up the Secure Data Path.
+     */
+    vec<uint8_t> scid;
+};
+
+/**
+ * NDP Capabilities response.
+ */
+struct NanCapabilities {
+    /**
+     * Maximum number of clusters which the device can join concurrently.
+     */
+    uint32_t maxConcurrentClusters;
+
+    /**
+     * Maximum number of concurrent publish discovery sessions.
+     */
+    uint32_t maxPublishes;
+
+    /**
+     * Maximum number of concurrent subscribe discovery sessions.
+     */
+    uint32_t maxSubscribes;
+
+    /**
+     * Maximum length (in bytes) of service name.
+     */
+    uint32_t maxServiceNameLen;
+
+    /**
+     * Maximum length (in bytes) of individual match filters.
+     */
+    uint32_t maxMatchFilterLen;
+
+    /**
+     * Maximum length (in bytes) of aggregate match filters across all active sessions.
+     */
+    uint32_t maxTotalMatchFilterLen;
+
+    /**
+     * Maximum length (in bytes) of the service specific info field.
+     */
+    uint32_t maxServiceSpecificInfoLen;
+
+    /**
+     * Maximum length (in bytes) of the extended service specific info field.
+     */
+    uint32_t maxExtendedServiceSpecificInfoLen;
+
+    /**
+     * Maximum number of data interfaces (NDI) which can be created concurrently on the device.
+     */
+    uint32_t maxNdiInterfaces;
+
+    /**
+     * Maximum number of data paths (NDP) which can be created concurrently on the device, across all
+     * data interfaces (NDI).
+     */
+    uint32_t maxNdpSessions;
+
+    /**
+     * Maximum length (in bytes) of application info field (used in data-path negotiations).
+     */
+    uint32_t maxAppInfoLen;
+
+    /**
+     * Maximum number of transmitted followup messages which can be queued by the firmware.
+     */
+    uint32_t maxQueuedTransmitFollowupMsgs;
+
+    /**
+     * Maximum number MAC interface addresses which can be specified to a subscribe discovery session.
+     */
+    uint32_t maxSubscribeInterfaceAddresses;
+
+    /**
+     * The set of supported Cipher suites. The |NanCipherSuiteType| bit fields are used.
+     */
+    bitfield<NanCipherSuiteType> supportedCipherSuites;
+
+    /**
+     * Flag to indicate id instant communication mode is supported.
+     */
+    bool instantCommunicationModeSupportFlag;
+};
+
+/**
+ * Wifi radio configuration
+ */
+struct WifiRadioConfiguration {
+    /**
+     * Band on which this radio chain is operating.
+     * Valid values of bandInfo are: BAND_24GHZ, BAND_5GHZ, BAND_6GHZ and
+     * BAND_60GHZ.
+     *
+     */
+    WifiBand bandInfo;
+
+    /**
+     * Wifi Antenna configuration.
+     */
+    WifiAntennaMode antennaMode;
+};
+
+/**
+ * Wifi radio combination
+ */
+struct WifiRadioCombination {
+    /**
+     * A list of radio configurations in this combination.
+     */
+    vec<WifiRadioConfiguration> radioConfigurations;
+};
+
+/**
+ * Wifi radio combinations matrix retrieved via |getSupportedRadioCombinationsMatrix|.
+ */
+struct WifiRadioCombinationMatrix {
+    /**
+     * A list of all the possible radio combinations that the chip can operate.
+     */
+    vec<WifiRadioCombination> radioCombinations;
+};
diff --git a/wifi/hostapd/aidl/aidl_api/android.hardware.wifi.hostapd/current/android/hardware/wifi/hostapd/EncryptionType.aidl b/wifi/hostapd/aidl/aidl_api/android.hardware.wifi.hostapd/current/android/hardware/wifi/hostapd/EncryptionType.aidl
index cec0c14..ae3dccb 100644
--- a/wifi/hostapd/aidl/aidl_api/android.hardware.wifi.hostapd/current/android/hardware/wifi/hostapd/EncryptionType.aidl
+++ b/wifi/hostapd/aidl/aidl_api/android.hardware.wifi.hostapd/current/android/hardware/wifi/hostapd/EncryptionType.aidl
@@ -39,4 +39,5 @@
   WPA2 = 2,
   WPA3_SAE_TRANSITION = 3,
   WPA3_SAE = 4,
+  OWE_TRANSITION = 5,
 }
diff --git a/wifi/hostapd/aidl/android/hardware/wifi/hostapd/EncryptionType.aidl b/wifi/hostapd/aidl/android/hardware/wifi/hostapd/EncryptionType.aidl
index bfc634d..a8f3252 100644
--- a/wifi/hostapd/aidl/android/hardware/wifi/hostapd/EncryptionType.aidl
+++ b/wifi/hostapd/aidl/android/hardware/wifi/hostapd/EncryptionType.aidl
@@ -29,4 +29,5 @@
     WPA2,
     WPA3_SAE_TRANSITION,
     WPA3_SAE,
+    OWE_TRANSITION,
 }
diff --git a/wifi/hostapd/aidl/vts/functional/Android.bp b/wifi/hostapd/aidl/vts/functional/Android.bp
index e58cf5e..e61d397 100644
--- a/wifi/hostapd/aidl/vts/functional/Android.bp
+++ b/wifi/hostapd/aidl/vts/functional/Android.bp
@@ -17,9 +17,23 @@
     shared_libs: [
         "libbinder",
         "libbinder_ndk",
+        "libvndksupport",
     ],
     static_libs: [
         "android.hardware.wifi.hostapd-V1-ndk",
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiHostapdV1_0TargetTestUtil",
+        "android.hardware.wifi.hostapd@1.0",
+        "android.hardware.wifi.hostapd@1.1",
+        "android.hardware.wifi.hostapd@1.2",
+        "android.hardware.wifi.hostapd@1.3",
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.4",
+        "android.hardware.wifi@1.5",
     ],
     test_suites: [
         "general-tests",
diff --git a/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp b/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
index cd7ff82..c1f2bb7 100644
--- a/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
+++ b/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
@@ -13,6 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+#include <android/hardware/wifi/1.0/IWifi.h>
+#include <android/hardware/wifi/hostapd/1.3/IHostapd.h>
+
 #include <VtsCoreUtil.h>
 #include <aidl/Gtest.h>
 #include <aidl/Vintf.h>
@@ -21,6 +24,11 @@
 #include <android/binder_manager.h>
 #include <binder/IServiceManager.h>
 #include <binder/ProcessState.h>
+#include <hidl/ServiceManagement.h>
+#include <hostapd_hidl_call_util.h>
+#include <hostapd_hidl_test_utils.h>
+#include <wifi_hidl_test_utils.h>
+#include <wifi_hidl_test_utils_1_5.h>
 
 using aidl::android::hardware::wifi::hostapd::BandMask;
 using aidl::android::hardware::wifi::hostapd::BnHostapdCallback;
@@ -69,19 +77,42 @@
         isBridgedSupport = testing::checkSubstringInCommandOutput(
             "/system/bin/cmd wifi get-softap-supported-features",
             "wifi_softap_bridged_ap_supported");
+        const std::vector<std::string> instances = android::hardware::getAllHalInstanceNames(
+                ::android::hardware::wifi::V1_0::IWifi::descriptor);
+        EXPECT_NE(0, instances.size());
+        wifiInstanceName = instances[0];
     }
 
     virtual void TearDown() override {
+        if (getWifi(wifiInstanceName) != nullptr) {
+            stopWifi(wifiInstanceName);
+        }
         hostapd->terminate();
         //  Wait 3 seconds to allow terminate to complete
         sleep(3);
     }
 
     std::shared_ptr<IHostapd> hostapd;
+    std::string wifiInstanceName;
     bool isAcsSupport;
     bool isWpa3SaeSupport;
     bool isBridgedSupport;
 
+    std::string setupApIfaceAndGetName(bool isBridged) {
+        android::sp<::android::hardware::wifi::V1_0::IWifiApIface> wifi_ap_iface;
+        if (isBridged) {
+            wifi_ap_iface = getBridgedWifiApIface_1_5(wifiInstanceName);
+        } else {
+            wifi_ap_iface = getWifiApIface_1_5(wifiInstanceName);
+        }
+        EXPECT_NE(nullptr, wifi_ap_iface.get());
+
+        const auto& status_and_name = HIDL_INVOKE(wifi_ap_iface, getName);
+        EXPECT_EQ(android::hardware::wifi::V1_0::WifiStatusCode::SUCCESS,
+                  status_and_name.first.code);
+        return status_and_name.second;
+    }
+
     IfaceParams getIfaceParamsWithoutAcs(std::string iface_name) {
         IfaceParams iface_params;
         ChannelParams channelParams;
@@ -426,8 +457,9 @@
  */
 TEST_P(HostapdAidl, AddAccessPointWithDualBandConfig) {
     if (!isBridgedSupport) GTEST_SKIP() << "Missing Bridged AP support";
-    auto status = hostapd->addAccessPoint(
-        getIfaceParamsWithBridgedModeACS(kIfaceName), getOpenNwParams());
+    std::string ifname = setupApIfaceAndGetName(true);
+    auto status =
+            hostapd->addAccessPoint(getIfaceParamsWithBridgedModeACS(ifname), getOpenNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl
index ca7be73..f709aef 100644
--- a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl
@@ -81,6 +81,7 @@
   void setSsidPostfix(in byte[] postfix);
   void setWfdDeviceInfo(in byte[] info);
   void setWfdR2DeviceInfo(in byte[] info);
+  void removeClient(in byte[] peerAddress, in boolean isLegacyClient);
   void setWpsConfigMethods(in android.hardware.wifi.supplicant.WpsConfigMethods configMethods);
   void setWpsDeviceName(in String name);
   void setWpsDeviceType(in byte[] type);
@@ -92,4 +93,6 @@
   String startWpsPinDisplay(in String groupIfName, in byte[] bssid);
   void startWpsPinKeypad(in String groupIfName, in String pin);
   void stopFind();
+  void findOnSocialChannels(in int timeoutInSec);
+  void findOnSpecificFrequency(in int freqInHz, in int timeoutInSec);
 }
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
index 18baea6..bdc5f34 100644
--- a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
@@ -125,6 +125,7 @@
   void setWapiCertSuite(in String suite);
   void setWepKey(in int keyIdx, in byte[] wepKey);
   void setWepTxKeyIdx(in int keyIdx);
+  void setRoamingConsortiumSelection(in byte[] selectedRcoi);
   const int SSID_MAX_LEN_IN_BYTES = 32;
   const int PSK_PASSPHRASE_MIN_LEN_IN_BYTES = 8;
   const int PSK_PASSPHRASE_MAX_LEN_IN_BYTES = 63;
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl
index 64839e7..7588c74 100644
--- a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantP2pIface.aidl
@@ -237,7 +237,7 @@
      * Initiate a P2P service discovery with an optional timeout.
      *
      * @param timeoutInSec Max time to be spent is performing discovery.
-     *        Set to 0 to indefinely continue discovery until an explicit
+     *        Set to 0 to indefinitely continue discovery until an explicit
      *        |stopFind| is sent.
      * @throws ServiceSpecificException with one of the following values:
      *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
@@ -643,6 +643,17 @@
     void setWfdR2DeviceInfo(in byte[] info);
 
     /**
+     * Remove the client with the MAC address from the group.
+     *
+     * @param peerAddress Mac address of the client.
+     * @param isLegacyClient Indicate if client is a legacy client or not.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+     */
+    void removeClient(in byte[/*6*/] peerAddress, in boolean isLegacyClient);
+
+    /**
      * Set the list of supported config methods for WPS operations.
      *
      * @param configMethods Mask of WPS configuration methods supported by the
@@ -767,4 +778,36 @@
      *         |SupplicantStatusCode.FAILURE_IFACE_DISABLED|
      */
     void stopFind();
+
+    /**
+     * Initiate a P2P device discovery only on social channels.
+     *
+     * Full P2P discovery is performed through |ISupplicantP2pIface.find| method.
+     *
+     * @param timeoutInSec The maximum amount of time that should be spent in performing device
+     *         discovery.
+     *        Set to 0 to indefinitely continue discovery until an explicit
+     *        |stopFind| is sent.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+     *         |SupplicantStatusCode.FAILURE_IFACE_DISABLED|
+     */
+    void findOnSocialChannels(in int timeoutInSec);
+
+    /**
+     * Initiate a P2P device discovery on a specific frequency.
+     *
+     * Full P2P discovery is performed through |ISupplicantP2pIface.find| method.
+     *
+     * @param freqInHz the frequency to be scanned.
+     * @param timeoutInSec Max time to be spent is performing discovery.
+     *        Set to 0 to indefinitely continue discovery until an explicit
+     *        |stopFind| is sent.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+     *         |SupplicantStatusCode.FAILURE_IFACE_DISABLED|
+     */
+    void findOnSpecificFrequency(in int freqInHz, in int timeoutInSec);
 }
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
index 603e2ad..1a2087d 100644
--- a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
@@ -1092,4 +1092,17 @@
      *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
      */
     void setWepTxKeyIdx(in int keyIdx);
+
+    /**
+     * Set the roaming consortium selection.
+     *
+     * @param selectedRcoi Indicates the roaming consortium selection. This is a
+     *            3 or 5-octet long byte array that indicates the selected RCOI
+     *            used for a Passpoint connection.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    void setRoamingConsortiumSelection(in byte[] selectedRcoi);
 }
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
index 10aab4d..470a9b0 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
@@ -481,6 +481,20 @@
 }
 
 /*
+ * FindSocialChannelsOnly
+ */
+TEST_P(SupplicantP2pIfaceAidlTest, FindSocialChannelsOnly) {
+    EXPECT_TRUE(p2p_iface_->findOnSocialChannels(kTestFindTimeout).isOk());
+}
+
+/*
+ * FindSpecificFrequency
+ */
+TEST_P(SupplicantP2pIfaceAidlTest, FindSpecificFrequency) {
+    EXPECT_TRUE(p2p_iface_->findOnSpecificFrequency(2412, kTestFindTimeout).isOk());
+}
+
+/*
  * StopFind
  */
 TEST_P(SupplicantP2pIfaceAidlTest, StopFind) {
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
index 0a35f66..c6dd981 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
@@ -784,6 +784,14 @@
     EXPECT_NE(retrievedToken.size(), 0);
 }
 
+/*
+ * SetRoamingConsortiumSelection
+ */
+TEST_P(SupplicantStaNetworkAidlTest, SetRoamingConsortiumSelection) {
+    const std::vector<uint8_t> testSelection = std::vector<uint8_t>({0x11, 0x21, 0x33, 0x44});
+    EXPECT_TRUE(sta_network_->setRoamingConsortiumSelection(testSelection).isOk());
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(SupplicantStaNetworkAidlTest);
 INSTANTIATE_TEST_SUITE_P(Supplicant, SupplicantStaNetworkAidlTest,
                          testing::ValuesIn(android::getAidlHalInstanceNames(