diff --git a/audio/2.0/IStream.hal b/audio/2.0/IStream.hal
index dc43346..5c88a69 100644
--- a/audio/2.0/IStream.hal
+++ b/audio/2.0/IStream.hal
@@ -227,4 +227,56 @@
      * @param fd dump file descriptor.
      */
     debugDump(handle fd);
+
+    /*
+     * Called by the framework to start a stream operating in mmap mode.
+     * createMmapBuffer() must be called before calling start().
+     * Function only implemented by streams operating in mmap mode.
+     *
+     * @return retval OK in case the success.
+     *                NOT_SUPPORTED on non mmap mode streams
+     *                INVALID_STATE if called out of sequence
+     */
+    start() generates (Result retval);
+
+    /**
+     * Called by the framework to stop a stream operating in mmap mode.
+     * Function only implemented by streams operating in mmap mode.
+     *
+     * @return retval OK in case the succes.
+     *                NOT_SUPPORTED on non mmap mode streams
+     *                INVALID_STATE if called out of sequence
+     */
+    stop() generates (Result retval) ;
+
+    /*
+     * Called by the framework to retrieve information on the mmap buffer used for audio
+     * samples transfer.
+     * Function only implemented by streams operating in mmap mode.
+     *
+     * @param minSizeFrames minimum buffer size requested. The actual buffer
+     *                     size returned in struct MmapBufferInfo can be larger.
+     * @return retval OK in case the success.
+     *                NOT_SUPPORTED on non mmap mode streams
+     *                NOT_INITIALIZED in case of memory allocation error
+     *                INVALID_ARGUMENTS if the requested buffer size is too large
+     *                INVALID_STATE if called out of sequence
+     * @return info    a MmapBufferInfo struct containing information on the MMMAP buffer created.
+     */
+    createMmapBuffer(int32_t minSizeFrames)
+            generates (Result retval, MmapBufferInfo info);
+
+    /*
+     * Called by the framework to read current read/write position in the mmap buffer
+     * with associated time stamp.
+     * Function only implemented by streams operating in mmap mode.
+     *
+     * @return retval OK in case the success.
+     *                NOT_SUPPORTED on non mmap mode streams
+     *                INVALID_STATE if called out of sequence
+     * @return position a MmapPosition struct containing current HW read/write position in frames
+     *                  with associated time stamp.
+     */
+    getMmapPosition()
+            generates (Result retval, MmapPosition position);
 };
diff --git a/audio/2.0/default/Android.mk b/audio/2.0/default/Android.mk
index 2b1aa4f..c3cfd69 100644
--- a/audio/2.0/default/Android.mk
+++ b/audio/2.0/default/Android.mk
@@ -33,6 +33,7 @@
     libhidlbase \
     libhidltransport \
     libhwbinder \
+    libcutils \
     libutils \
     libhardware \
     liblog \
diff --git a/audio/2.0/default/Stream.cpp b/audio/2.0/default/Stream.cpp
index 40f67f0..f214eed 100644
--- a/audio/2.0/default/Stream.cpp
+++ b/audio/2.0/default/Stream.cpp
@@ -43,9 +43,10 @@
     mStream = nullptr;
 }
 
+// static
 Result Stream::analyzeStatus(const char* funcName, int status, int ignoreError) {
     if (status != 0 && status != -ignoreError) {
-        ALOGW("Stream %p %s: %s", mStream, funcName, strerror(-status));
+        ALOGW("Error from HAL stream in function %s: %s", funcName, strerror(-status));
     }
     switch (status) {
         case 0: return Result::OK;
@@ -229,6 +230,29 @@
     return Void();
 }
 
+Return<Result>  Stream::start() {
+    return Result::NOT_SUPPORTED;
+}
+
+Return<Result>  Stream::stop() {
+    return Result::NOT_SUPPORTED;
+}
+
+Return<void>  Stream::createMmapBuffer(int32_t minSizeFrames __unused,
+                                       createMmapBuffer_cb _hidl_cb) {
+    Result retval(Result::NOT_SUPPORTED);
+    MmapBufferInfo info;
+    _hidl_cb(retval, info);
+    return Void();
+}
+
+Return<void>  Stream::getMmapPosition(getMmapPosition_cb _hidl_cb) {
+    Result retval(Result::NOT_SUPPORTED);
+    MmapPosition position;
+    _hidl_cb(retval, position);
+    return Void();
+}
+
 } // namespace implementation
 }  // namespace V2_0
 }  // namespace audio
diff --git a/audio/2.0/default/Stream.h b/audio/2.0/default/Stream.h
index 0ebd723..819bbf7 100644
--- a/audio/2.0/default/Stream.h
+++ b/audio/2.0/default/Stream.h
@@ -18,6 +18,7 @@
 #define ANDROID_HARDWARE_AUDIO_V2_0_STREAM_H
 
 #include <android/hardware/audio/2.0/IStream.h>
+#include <hardware/audio.h>
 #include <hidl/Status.h>
 
 #include <hidl/MQDescriptor.h>
@@ -71,9 +72,13 @@
             const hidl_vec<hidl_string>& keys, getParameters_cb _hidl_cb)  override;
     Return<Result> setParameters(const hidl_vec<ParameterValue>& parameters)  override;
     Return<void> debugDump(const hidl_handle& fd)  override;
+    Return<Result> start() override;
+    Return<Result> stop() override;
+    Return<void> createMmapBuffer(int32_t minSizeFrames, createMmapBuffer_cb _hidl_cb) override;
+    Return<void> getMmapPosition(getMmapPosition_cb _hidl_cb) override;
 
     // Utility methods for extending interfaces.
-    Result analyzeStatus(const char* funcName, int status, int ignoreError = OK);
+    static Result analyzeStatus(const char* funcName, int status, int ignoreError = OK);
 
   private:
     audio_stream_t *mStream;
@@ -85,6 +90,80 @@
     int halSetParameters(const char* keysAndValues) override;
 };
 
+
+template <typename T>
+struct StreamMmap : public RefBase {
+    explicit StreamMmap(T* stream) : mStream(stream) {}
+
+    Return<Result> start();
+    Return<Result> stop();
+    Return<void> createMmapBuffer(
+            int32_t minSizeFrames, size_t frameSize, IStream::createMmapBuffer_cb _hidl_cb);
+    Return<void> getMmapPosition(IStream::getMmapPosition_cb _hidl_cb);
+
+ private:
+   StreamMmap() {}
+
+   T *mStream;
+};
+
+template <typename T>
+Return<Result> StreamMmap<T>::start() {
+    if (mStream->start == NULL) return Result::NOT_SUPPORTED;
+    int result = mStream->start(mStream);
+    return Stream::analyzeStatus("start", result);
+}
+
+template <typename T>
+Return<Result> StreamMmap<T>::stop() {
+    if (mStream->stop == NULL) return Result::NOT_SUPPORTED;
+    int result = mStream->stop(mStream);
+    return Stream::analyzeStatus("stop", result);
+}
+
+template <typename T>
+Return<void> StreamMmap<T>::createMmapBuffer(int32_t minSizeFrames, size_t frameSize,
+                                             IStream::createMmapBuffer_cb _hidl_cb) {
+    Result retval(Result::NOT_SUPPORTED);
+    MmapBufferInfo info;
+
+    if (mStream->create_mmap_buffer != NULL) {
+        struct audio_mmap_buffer_info halInfo;
+        retval = Stream::analyzeStatus(
+                "create_mmap_buffer",
+                mStream->create_mmap_buffer(mStream, minSizeFrames, &halInfo));
+        if (retval == Result::OK) {
+            native_handle_t* hidlHandle = native_handle_create(1, 0);
+            hidlHandle->data[0] = halInfo.shared_memory_fd;
+            info.sharedMemory = hidl_memory("audio_buffer", hidlHandle,
+                                            frameSize *halInfo.buffer_size_frames);
+            info.bufferSizeFrames = halInfo.buffer_size_frames;
+            info.burstSizeFrames = halInfo.burst_size_frames;
+        }
+    }
+    _hidl_cb(retval, info);
+    return Void();
+}
+
+template <typename T>
+Return<void> StreamMmap<T>::getMmapPosition(IStream::getMmapPosition_cb _hidl_cb) {
+    Result retval(Result::NOT_SUPPORTED);
+    MmapPosition position;
+
+    if (mStream->get_mmap_position != NULL) {
+        struct audio_mmap_position halPosition;
+        retval = Stream::analyzeStatus(
+                "get_mmap_position",
+                mStream->get_mmap_position(mStream, &halPosition));
+        if (retval == Result::OK) {
+            position.timeNanoseconds = halPosition.time_nanoseconds;
+            position.positionFrames = halPosition.position_frames;
+        }
+    }
+    _hidl_cb(retval, position);
+    return Void();
+}
+
 }  // namespace implementation
 }  // namespace V2_0
 }  // namespace audio
diff --git a/audio/2.0/default/StreamIn.cpp b/audio/2.0/default/StreamIn.cpp
index 1bc9dfb..1441e74 100644
--- a/audio/2.0/default/StreamIn.cpp
+++ b/audio/2.0/default/StreamIn.cpp
@@ -28,7 +28,9 @@
 namespace implementation {
 
 StreamIn::StreamIn(audio_hw_device_t* device, audio_stream_in_t* stream)
-        : mDevice(device), mStream(stream), mStreamCommon(new Stream(&stream->common)) {
+        : mDevice(device), mStream(stream),
+          mStreamCommon(new Stream(&stream->common)),
+          mStreamMmap(new StreamMmap<audio_stream_in_t>(stream)) {
 }
 
 StreamIn::~StreamIn() {
@@ -130,6 +132,22 @@
     return mStreamCommon->debugDump(fd);
 }
 
+Return<Result> StreamIn::start() {
+    return mStreamMmap->start();
+}
+
+Return<Result> StreamIn::stop() {
+    return mStreamMmap->stop();
+}
+
+Return<void> StreamIn::createMmapBuffer(int32_t minSizeFrames, createMmapBuffer_cb _hidl_cb) {
+    return mStreamMmap->createMmapBuffer(
+            minSizeFrames, audio_stream_in_frame_size(mStream), _hidl_cb);
+}
+
+Return<void> StreamIn::getMmapPosition(getMmapPosition_cb _hidl_cb) {
+    return mStreamMmap->getMmapPosition(_hidl_cb);
+}
 
 // Methods from ::android::hardware::audio::V2_0::IStreamIn follow.
 Return<void> StreamIn::getAudioSource(getAudioSource_cb _hidl_cb)  {
@@ -144,7 +162,7 @@
 }
 
 Return<Result> StreamIn::setGain(float gain)  {
-    return mStreamCommon->analyzeStatus("set_gain", mStream->set_gain(mStream, gain));
+    return Stream::analyzeStatus("set_gain", mStream->set_gain(mStream, gain));
 }
 
 Return<void> StreamIn::read(uint64_t size, read_cb _hidl_cb)  {
@@ -157,7 +175,7 @@
         data.resize(readResult);
     } else if (readResult < 0) {
         data.resize(0);
-        retval = mStreamCommon->analyzeStatus("read", readResult);
+        retval = Stream::analyzeStatus("read", readResult);
     }
     _hidl_cb(retval, data);
     return Void();
@@ -172,7 +190,7 @@
     uint64_t frames = 0, time = 0;
     if (mStream->get_capture_position != NULL) {
         int64_t halFrames, halTime;
-        retval = mStreamCommon->analyzeStatus(
+        retval = Stream::analyzeStatus(
                 "get_capture_position",
                 mStream->get_capture_position(mStream, &halFrames, &halTime));
         if (retval == Result::OK) {
diff --git a/audio/2.0/default/StreamIn.h b/audio/2.0/default/StreamIn.h
index f7c17b7..65e94bb 100644
--- a/audio/2.0/default/StreamIn.h
+++ b/audio/2.0/default/StreamIn.h
@@ -80,11 +80,17 @@
     Return<void> read(uint64_t size, read_cb _hidl_cb)  override;
     Return<uint32_t> getInputFramesLost()  override;
     Return<void> getCapturePosition(getCapturePosition_cb _hidl_cb)  override;
+    Return<Result> start() override;
+    Return<Result> stop() override;
+    Return<void> createMmapBuffer(int32_t minSizeFrames, createMmapBuffer_cb _hidl_cb) override;
+    Return<void> getMmapPosition(getMmapPosition_cb _hidl_cb) override;
 
   private:
     audio_hw_device_t *mDevice;
     audio_stream_in_t *mStream;
     sp<Stream> mStreamCommon;
+    sp<StreamMmap<audio_stream_in_t>> mStreamMmap;
+
 
     virtual ~StreamIn();
 };
diff --git a/audio/2.0/default/StreamOut.cpp b/audio/2.0/default/StreamOut.cpp
index 805734b..3d20d11 100644
--- a/audio/2.0/default/StreamOut.cpp
+++ b/audio/2.0/default/StreamOut.cpp
@@ -29,7 +29,9 @@
 namespace implementation {
 
 StreamOut::StreamOut(audio_hw_device_t* device, audio_stream_out_t* stream)
-        : mDevice(device), mStream(stream), mStreamCommon(new Stream(&stream->common)) {
+        : mDevice(device), mStream(stream),
+          mStreamCommon(new Stream(&stream->common)),
+          mStreamMmap(new StreamMmap<audio_stream_out_t>(stream)) {
 }
 
 StreamOut::~StreamOut() {
@@ -133,7 +135,6 @@
     return mStreamCommon->debugDump(fd);
 }
 
-
 // Methods from ::android::hardware::audio::V2_0::IStreamOut follow.
 Return<uint32_t> StreamOut::getLatency()  {
     return mStream->get_latency(mStream);
@@ -142,7 +143,7 @@
 Return<Result> StreamOut::setVolume(float left, float right)  {
     Result retval(Result::NOT_SUPPORTED);
     if (mStream->set_volume != NULL) {
-        retval = mStreamCommon->analyzeStatus(
+        retval = Stream::analyzeStatus(
                 "set_volume", mStream->set_volume(mStream, left, right));
     }
     return retval;
@@ -156,7 +157,7 @@
     if (writeResult >= 0) {
         written = writeResult;
     } else {
-        retval = mStreamCommon->analyzeStatus("write", writeResult);
+        retval = Stream::analyzeStatus("write", writeResult);
         written = 0;
     }
     _hidl_cb(retval, written);
@@ -165,7 +166,7 @@
 
 Return<void> StreamOut::getRenderPosition(getRenderPosition_cb _hidl_cb)  {
     uint32_t halDspFrames;
-    Result retval = mStreamCommon->analyzeStatus(
+    Result retval = Stream::analyzeStatus(
             "get_render_position", mStream->get_render_position(mStream, &halDspFrames));
     _hidl_cb(retval, halDspFrames);
     return Void();
@@ -175,7 +176,7 @@
     Result retval(Result::NOT_SUPPORTED);
     int64_t timestampUs = 0;
     if (mStream->get_next_write_timestamp != NULL) {
-        retval = mStreamCommon->analyzeStatus(
+        retval = Stream::analyzeStatus(
                 "get_next_write_timestamp",
                 mStream->get_next_write_timestamp(mStream, &timestampUs));
     }
@@ -189,7 +190,7 @@
     if (result == 0) {
         mCallback = callback;
     }
-    return mStreamCommon->analyzeStatus("set_callback", result);
+    return Stream::analyzeStatus("set_callback", result);
 }
 
 Return<Result> StreamOut::clearCallback()  {
@@ -228,13 +229,13 @@
 
 Return<Result> StreamOut::pause()  {
     return mStream->pause != NULL ?
-            mStreamCommon->analyzeStatus("pause", mStream->pause(mStream)) :
+            Stream::analyzeStatus("pause", mStream->pause(mStream)) :
             Result::NOT_SUPPORTED;
 }
 
 Return<Result> StreamOut::resume()  {
     return mStream->resume != NULL ?
-            mStreamCommon->analyzeStatus("resume", mStream->resume(mStream)) :
+            Stream::analyzeStatus("resume", mStream->resume(mStream)) :
             Result::NOT_SUPPORTED;
 }
 
@@ -244,14 +245,14 @@
 
 Return<Result> StreamOut::drain(AudioDrain type)  {
     return mStream->drain != NULL ?
-            mStreamCommon->analyzeStatus(
+            Stream::analyzeStatus(
                     "drain", mStream->drain(mStream, static_cast<audio_drain_type_t>(type))) :
             Result::NOT_SUPPORTED;
 }
 
 Return<Result> StreamOut::flush()  {
     return mStream->flush != NULL ?
-            mStreamCommon->analyzeStatus("flush", mStream->flush(mStream)) :
+            Stream::analyzeStatus("flush", mStream->flush(mStream)) :
             Result::NOT_SUPPORTED;
 }
 
@@ -261,7 +262,7 @@
     TimeSpec timeStamp = { 0, 0 };
     if (mStream->get_presentation_position != NULL) {
         struct timespec halTimeStamp;
-        retval = mStreamCommon->analyzeStatus(
+        retval = Stream::analyzeStatus(
                 "get_presentation_position",
                 mStream->get_presentation_position(mStream, &frames, &halTimeStamp),
                 // Don't logspam on EINVAL--it's normal for get_presentation_position
@@ -276,6 +277,23 @@
     return Void();
 }
 
+Return<Result> StreamOut::start() {
+    return mStreamMmap->start();
+}
+
+Return<Result> StreamOut::stop() {
+    return mStreamMmap->stop();
+}
+
+Return<void> StreamOut::createMmapBuffer(int32_t minSizeFrames, createMmapBuffer_cb _hidl_cb) {
+    return mStreamMmap->createMmapBuffer(
+            minSizeFrames, audio_stream_out_frame_size(mStream), _hidl_cb);
+}
+
+Return<void> StreamOut::getMmapPosition(getMmapPosition_cb _hidl_cb) {
+    return mStreamMmap->getMmapPosition(_hidl_cb);
+}
+
 }  // namespace implementation
 }  // namespace V2_0
 }  // namespace audio
diff --git a/audio/2.0/default/StreamOut.h b/audio/2.0/default/StreamOut.h
index dc9a604..9b7f9f8 100644
--- a/audio/2.0/default/StreamOut.h
+++ b/audio/2.0/default/StreamOut.h
@@ -91,11 +91,16 @@
     Return<Result> drain(AudioDrain type)  override;
     Return<Result> flush()  override;
     Return<void> getPresentationPosition(getPresentationPosition_cb _hidl_cb)  override;
+    Return<Result> start() override;
+    Return<Result> stop() override;
+    Return<void> createMmapBuffer(int32_t minSizeFrames, createMmapBuffer_cb _hidl_cb) override;
+    Return<void> getMmapPosition(getMmapPosition_cb _hidl_cb) override;
 
   private:
     audio_hw_device_t *mDevice;
     audio_stream_out_t *mStream;
     sp<Stream> mStreamCommon;
+    sp<StreamMmap<audio_stream_out_t>> mStreamMmap;
     sp<IStreamOutCallback> mCallback;
 
     virtual ~StreamOut();
diff --git a/audio/2.0/types.hal b/audio/2.0/types.hal
index 7002f38..37c39e4 100644
--- a/audio/2.0/types.hal
+++ b/audio/2.0/types.hal
@@ -70,3 +70,22 @@
     string busAddress;      // used for BUS
     string rSubmixAddress;  // used for REMOTE_SUBMIX
 };
+
+/*
+ * Mmap buffer descriptor returned by IStream.createMmapBuffer().
+ * Used by streams opened in mmap mode.
+ */
+struct MmapBufferInfo {
+    memory  sharedMemory;         // mmap memory buffer
+    int32_t bufferSizeFrames;     // total buffer size in frames
+    int32_t burstSizeFrames;      // transfer size granularity in frames
+};
+
+/*
+ * Mmap buffer read/write position returned by IStream.getMmapPosition().
+ * Used by streams opened in mmap mode.
+ */
+struct MmapPosition {
+    int64_t  timeNanoseconds; // time stamp in ns, CLOCK_MONOTONIC
+    int32_t  positionFrames;  // increasing 32 bit frame count reset when IStream.stop() is called
+};
diff --git a/boot/1.0/vts/functional/vts/testcases/hal/boot/hidl/target/AndroidTest.xml b/boot/1.0/vts/functional/vts/testcases/hal/boot/hidl/target/AndroidTest.xml
index 6c7809c..bc759bf 100644
--- a/boot/1.0/vts/functional/vts/testcases/hal/boot/hidl/target/AndroidTest.xml
+++ b/boot/1.0/vts/functional/vts/testcases/hal/boot/hidl/target/AndroidTest.xml
@@ -24,6 +24,7 @@
             _32bit::DATA/nativetest/boot_hidl_hal_test/boot_hidl_hal_test,
             _64bit::DATA/nativetest64/boot_hidl_hal_test/boot_hidl_hal_test,
             "/>
+        <option name="test-config-path" value="vts/testcases/hal/boot/hidl/target/HalBootHidlTargetTest.config" />
         <option name="binary-test-type" value="gtest" />
         <option name="test-timeout" value="1m" />
     </test>
diff --git a/boot/1.0/vts/functional/vts/testcases/hal/boot/hidl/target/HalBootHidlTargetTest.config b/boot/1.0/vts/functional/vts/testcases/hal/boot/hidl/target/HalBootHidlTargetTest.config
new file mode 100644
index 0000000..ebb4d1b
--- /dev/null
+++ b/boot/1.0/vts/functional/vts/testcases/hal/boot/hidl/target/HalBootHidlTargetTest.config
@@ -0,0 +1,20 @@
+{
+    "use_gae_db": true,
+    "coverage": true,
+    "modules": [
+        {
+            "module_name": "system/lib64/hw/bootctrl.msm8996",
+            "git_project": {
+                "name": "platform/hardware/qcom/bootctrl",
+                "path": "hardware/qcom/bootctrl"
+            }
+        },
+        {
+            "module_name": "system/lib64/hw/android.hardware.boot@1.0-impl",
+            "git_project": {
+                "name": "platform/hardware/interfaces",
+                "path": "hardware/interfaces"
+            }
+        }
+    ]
+}
diff --git a/camera/device/3.2/types.hal b/camera/device/3.2/types.hal
index 3ce5037..ed6ef7d 100644
--- a/camera/device/3.2/types.hal
+++ b/camera/device/3.2/types.hal
@@ -20,6 +20,9 @@
 import android.hardware.graphics.common@1.0::types;
 
 typedef vec<uint8_t> CameraMetadata;
+typedef bitfield<ProducerUsage> ProducerUsageFlags;
+typedef bitfield<ConsumerUsage> ConsumerUsageFlags;
+typedef bitfield<Dataspace> DataspaceFlags;
 
 /**
  * StreamType:
@@ -221,24 +224,12 @@
      * together and then passed to the platform gralloc HAL module for
      * allocating the gralloc buffers for each stream.
      *
-     * For streamType OUTPUT, when passed via
-     * configureStreams(), the initial value of this is the consumer's usage
-     * flags. The HAL may use these consumer flags to decide stream
-     * configuration. For streamType INPUT, when passed via
-     * configureStreams(), the initial value of this is 0. For all streams
-     * passed via configureStreams(), the HAL must set its desired producer
-     * usage flags in the final stream configuration.
+     * The HAL may use these consumer flags to decide stream configuration. For
+     * streamType INPUT, the value of this field is always 0. For all streams
+     * passed via configureStreams(), the HAL must set its own
+     * additional usage flags in its output HalStreamConfiguration.
      */
-    ConsumerUsage usage;
-
-    /**
-     * The maximum number of buffers the HAL device may need to have dequeued at
-     * the same time. The HAL device may not have more buffers in-flight from
-     * this stream than this value. For all streams passed via
-     * configureStreams(), the HAL must set its desired max buffer count in the
-     * final stream configuration.
-     */
-    uint32_t maxBuffers;
+    ConsumerUsageFlags usage;
 
     /**
      * A field that describes the contents of the buffer. The format and buffer
@@ -256,7 +247,7 @@
      * supported. The dataspace values are set using the V0 dataspace
      * definitions.
      */
-    Dataspace dataSpace;
+    DataspaceFlags dataSpace;
 
     /**
      * The required output rotation of the stream.
@@ -328,18 +319,18 @@
     int32_t id;
 
     /**
-     * The pixel format for the buffers in this stream.
-     *
-     * If HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED is used, then the platform
-     * gralloc module must select a format based on the usage flags provided by
-     * the camera device and the other endpoint of the stream.
+     * An override pixel format for the buffers in this stream.
      *
      * The HAL must respect the requested format in Stream unless it is
      * IMPLEMENTATION_DEFINED, in which case the override format here must be
-     * used instead. This allows cross-platform HALs to use a standard format
-     * since IMPLEMENTATION_DEFINED formats often require device-specific
-     * information. In all other cases, the overrideFormat must match the
-     * requested format.
+     * used by the client instead, for this stream. This allows cross-platform
+     * HALs to use a standard format since IMPLEMENTATION_DEFINED formats often
+     * require device-specific information. In all other cases, the
+     * overrideFormat must match the requested format.
+     *
+     * When HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED is used, then the platform
+     * gralloc module must select a format based on the usage flags provided by
+     * the camera device and the other endpoint of the stream.
      */
     android.hardware.graphics.common@1.0::PixelFormat overrideFormat;
 
@@ -356,8 +347,8 @@
      * consumerUsage must be set. For other types, producerUsage must be set,
      * and consumerUsage must be 0.
      */
-    ProducerUsage producerUsage;
-    ConsumerUsage consumerUsage;
+    ProducerUsageFlags producerUsage;
+    ConsumerUsageFlags consumerUsage;
 
     /**
      * The maximum number of buffers the HAL device may need to have dequeued at
@@ -635,7 +626,7 @@
          * Shutter message contents. Valid if type is MsgType::SHUTTER
          */
         ShutterMsg shutter;
-    };
+    } msg;
 
 };
 
diff --git a/contexthub/1.0/IContexthub.hal b/contexthub/1.0/IContexthub.hal
index 8d19aeb..8c792fd 100644
--- a/contexthub/1.0/IContexthub.hal
+++ b/contexthub/1.0/IContexthub.hal
@@ -60,9 +60,11 @@
      * After the init method for nanoApp returns success, this must be indicated
      * to the service by an asynchronous call to handleTxnResult.
      *
+     * Loading a nanoapp must not take more than 30 seconds.
+     *
      * @param hubId identifer of the contextHub
-     *        appBinary binary for the nanoApp
-     *        msg   message to be sent
+     *        appBinary serialized NanoApppBinary for the nanoApp
+     *        transactionId transactionId for this call
      *
      * @return result OK if transation started
      *                BAD_VALUE if parameters are not sane
@@ -71,7 +73,9 @@
      *                TRANSACTION_FAILED if load failed synchronously
      *
      */
-    loadNanoApp(uint32_t hubId, NanoAppBinary appBinary, uint32_t transactionId)
+    loadNanoApp(uint32_t hubId,
+                vec<uint8_t> appBinary,
+                uint32_t transactionId)
             generates (Result result);
 
     /**
@@ -79,6 +83,8 @@
      * After this, success must be indicated to the service through an
      * asynchronous call to handleTxnResult.
      *
+     * Unloading a nanoapp must not take more than 5 seconds.
+     *
      * @param hubId identifer of the contextHub
      *        appId appIdentifier returned by the HAL
      *        msg   message to be sent
@@ -98,6 +104,8 @@
      * After this, success must be indicated to the service through an
      * asynchronous message.
      *
+     * Enabling a nanoapp must not take more than 5 seconds.
+     *
      * @param hubId identifer of the contextHub
      *        appId appIdentifier returned by the HAL
      *        msg   message to be sent
@@ -117,6 +125,8 @@
      * After this, success must be indicated to the service through an
      * asynchronous message.
      *
+     * Disabling a nanoapp must not take more than 5 seconds.
+     *
      * @param hubId identifer of the contextHub
      *        appId appIdentifier returned by the HAL
      *        msg   message to be sent
@@ -136,7 +146,11 @@
      *
      * @param hubId identifer of the contextHub
      *
-     * @return apps all nanoApps on the hub
+     * @return apps all nanoApps on the hub.
+     *              All nanoApps that can be modified by the service must
+     *              be returned. A non-modifiable nanoapps must not be
+     *              returned. A modifiable nanoApp is one that can be
+     *              unloaded/disabled/enabled by the service.
      *
      */
     queryApps(uint32_t hubId) generates (Result result);
diff --git a/contexthub/1.0/IContexthubCallback.hal b/contexthub/1.0/IContexthubCallback.hal
index 29c41ce..9e9cf27 100644
--- a/contexthub/1.0/IContexthubCallback.hal
+++ b/contexthub/1.0/IContexthubCallback.hal
@@ -22,41 +22,44 @@
      * implementation to allow the HAL to send asynchronous messages back
      * to the service and registered clients of the ContextHub service.
      *
-     * @params hubId : identifier of the hub calling callback
-     *         msg   : message
+     * @params msg : message
      *
      */
-     handleClientMsg(uint32_t hubId, ContextHubMsg msg);
+     handleClientMsg(ContextHubMsg msg);
 
     /*
      * This callback is passed by the Contexthub service to the HAL
      * implementation to allow the HAL to send the response for a
      * transaction.
      *
-     * @params hubId : identifier of the hub calling callback
-     *         txnId : transaction id whose result is being sent
+     * @params txnId : transaction id whose result is being sent
      *                 passed in by the service at start of transacation.
      *         result: result of transaction.
      *
      */
-     handleTxnResult(uint32_t hubId, uint32_t txnId,
-             TransactionResult result);
+     handleTxnResult(uint32_t txnId, TransactionResult result);
 
     /*
      * This callback is passed by the Contexthub service to the HAL
      * implementation to allow the HAL to send an asynchronous event
      * to the ContextHub service.
      *
-     * @params hubId : identifier of the hub calling callback
-     *         msg   : message
+     * @params msg : message
      *
      */
-     handleHubEvent(uint32_t hubId, AsyncEventType evt);
+     handleHubEvent(AsyncEventType evt);
 
      /*
       * This callback is passed by the Contexthub service to the HAL
       * implementation to allow the HAL to send information about the
       * currently loaded and active nanoapps on the hub.
+      *
+      * @params appInfo : vector of HubAppinfo structure for each nanoApp
+      *                   on the hub that can be enabled, disabled and
+      *                   unloaded by the service. Any nanoApps that cannot
+      *                   be controlled by the service must not be reported.
+      *                   All nanoApps that can be controlled by the service
+      *                   must be reported.
       */
-      handleAppsInfo(uint32_t hubId, vec<HubAppInfo> appInfo);
+      handleAppsInfo(vec<HubAppInfo> appInfo);
 };
diff --git a/contexthub/1.0/default/Android.bp b/contexthub/1.0/default/Android.bp
new file mode 100644
index 0000000..7c5f79d
--- /dev/null
+++ b/contexthub/1.0/default/Android.bp
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+cc_library_shared {
+    name: "android.hardware.contexthub@1.0-impl",
+    relative_install_path: "hw",
+    srcs: ["Contexthub.cpp"],
+    shared_libs: [
+        "liblog",
+        "libcutils",
+        "libhardware",
+        "libhwbinder",
+        "libbase",
+        "libcutils",
+        "libutils",
+        "libhidlbase",
+        "libhidltransport",
+        "android.hardware.contexthub@1.0",
+    ],
+}
diff --git a/contexthub/1.0/default/Android.mk b/contexthub/1.0/default/Android.mk
new file mode 100644
index 0000000..ad40878
--- /dev/null
+++ b/contexthub/1.0/default/Android.mk
@@ -0,0 +1,23 @@
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_MODULE := android.hardware.contexthub@1.0-service
+LOCAL_INIT_RC := android.hardware.contexthub@1.0-service.rc
+LOCAL_SRC_FILES := \
+        service.cpp \
+
+LOCAL_SHARED_LIBRARIES := \
+        libbase \
+        libcutils \
+        libdl \
+        libhardware \
+        libhardware_legacy \
+        libhidlbase \
+        libhidltransport \
+        libhwbinder \
+        liblog \
+        libutils \
+        android.hardware.contexthub@1.0 \
+
+include $(BUILD_EXECUTABLE)
diff --git a/contexthub/1.0/default/Contexthub.cpp b/contexthub/1.0/default/Contexthub.cpp
new file mode 100644
index 0000000..d530a87
--- /dev/null
+++ b/contexthub/1.0/default/Contexthub.cpp
@@ -0,0 +1,528 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Contexthub.h"
+
+#include <inttypes.h>
+
+#include <android/log.h>
+#include <android/hardware/contexthub/1.0/IContexthub.h>
+#include <hardware/context_hub.h>
+
+#undef LOG_TAG
+#define LOG_TAG "ContextHubHalAdapter"
+
+namespace android {
+namespace hardware {
+namespace contexthub {
+namespace V1_0 {
+namespace implementation {
+
+static constexpr uint64_t ALL_APPS = UINT64_C(0xFFFFFFFFFFFFFFFF);
+
+Contexthub::Contexthub()
+        : mInitCheck(NO_INIT),
+          mContextHubModule(nullptr),
+          mIsTransactionPending(false) {
+    const hw_module_t *module;
+
+    mInitCheck = hw_get_module(CONTEXT_HUB_MODULE_ID, &module);
+
+    if (mInitCheck != OK) {
+        ALOGE("Could not load %s module: %s", CONTEXT_HUB_MODULE_ID, strerror(-mInitCheck));
+    } else if (module == nullptr) {
+        ALOGE("hal returned succes but a null module!");
+        // Assign an error, this should not really happen...
+        mInitCheck = UNKNOWN_ERROR;
+    } else {
+        ALOGI("Loaded Context Hub module");
+        mContextHubModule = reinterpret_cast<const context_hub_module_t *>(module);
+    }
+}
+
+bool Contexthub::setOsAppAsDestination(hub_message_t *msg, int hubId) {
+    if (!isValidHubId(hubId)) {
+        ALOGW("%s: Hub information is null for hubHandle %d",
+              __FUNCTION__,
+              hubId);
+        return false;
+    } else {
+        msg->app_name = mCachedHubInfo[hubId].osAppName;
+        return true;
+    }
+}
+
+Return<void> Contexthub::getHubs(getHubs_cb _hidl_cb) {
+    std::vector<ContextHub> hubs;
+    if (isInitialized()) {
+        const context_hub_t *hubArray = nullptr;
+        size_t numHubs;
+
+        // Explicitly discarding const. HAL method discards it.
+        numHubs = mContextHubModule->get_hubs(const_cast<context_hub_module_t *>(mContextHubModule),
+                                              &hubArray);
+        ALOGI("Context Hub Hal Adapter reports %zu hubs", numHubs);
+
+        mCachedHubInfo.clear();
+
+        for (size_t i = 0; i < numHubs; i++) {
+            CachedHubInformation info;
+            ContextHub c;
+
+            c.hubId = hubArray[i].hub_id;
+            c.name = hubArray[i].name;
+            c.vendor = hubArray[i].vendor;
+            c.toolchain = hubArray[i].toolchain;
+            c.toolchainVersion = hubArray[i].toolchain_version;
+            c.platformVersion = hubArray[i].platform_version;
+            c.maxSupportedMsgLen = hubArray[i].max_supported_msg_len;
+            c.peakMips = hubArray[i].peak_mips;
+            c.peakPowerDrawMw = hubArray[i].peak_power_draw_mw;
+            c.stoppedPowerDrawMw = hubArray[i].stopped_power_draw_mw;
+            c.sleepPowerDrawMw = hubArray[i].sleep_power_draw_mw;
+
+            info.callBack = nullptr;
+            info.osAppName = hubArray[i].os_app_name;
+            mCachedHubInfo[hubArray[i].hub_id] = info;
+
+            hubs.push_back(c);
+        }
+    } else {
+        ALOGW("Context Hub Hal Adapter not initialized");
+    }
+
+    _hidl_cb(hubs);
+    return Void();
+}
+
+bool Contexthub::isValidHubId(uint32_t hubId) {
+    if (!mCachedHubInfo.count(hubId)) {
+        ALOGW("Hub information not found for hubId %" PRIu32, hubId);
+        return false;
+    } else {
+        return true;
+    }
+}
+
+sp<IContexthubCallback> Contexthub::getCallBackForHubId(uint32_t hubId) {
+    if (!isValidHubId(hubId)) {
+        return nullptr;
+    } else {
+        return mCachedHubInfo[hubId].callBack;
+    }
+}
+
+Return<Result> Contexthub::sendMessageToHub(uint32_t hubId,
+                                            const ContextHubMsg &msg) {
+    if (!isInitialized()) {
+        return Result::NOT_INIT;
+    }
+
+    if (!isValidHubId(hubId) || msg.msg.size() > UINT32_MAX) {
+        return Result::BAD_PARAMS;
+    }
+
+    hub_message_t txMsg = {
+        .app_name.id = msg.appName,
+        .message_type = msg.msgType,
+        .message_len = static_cast<uint32_t>(msg.msg.size()), // Note the check above
+        .message = static_cast<const uint8_t *>(msg.msg.data()),
+    };
+
+    ALOGI("Sending msg of type %" PRIu32 ", size %" PRIu32 " to app 0x%" PRIx64,
+          txMsg.message_type,
+          txMsg.message_len,
+          txMsg.app_name.id);
+
+    if(mContextHubModule->send_message(hubId, &txMsg) != 0) {
+        return Result::TRANSACTION_FAILED;
+    }
+
+    return Result::OK;
+}
+
+Return<Result> Contexthub::reboot(uint32_t hubId) {
+    if (!isInitialized()) {
+      return Result::NOT_INIT;
+    }
+
+    hub_message_t msg;
+
+    if (setOsAppAsDestination(&msg, hubId) == false) {
+        return Result::BAD_PARAMS;
+    }
+
+    msg.message_type = CONTEXT_HUB_OS_REBOOT;
+    msg.message_len = 0;
+    msg.message = nullptr;
+
+    if(mContextHubModule->send_message(hubId, &msg) != 0) {
+        return Result::TRANSACTION_FAILED;
+    } else {
+        return Result::OK;
+    }
+}
+
+Return<Result> Contexthub::registerCallback(uint32_t hubId,
+                                            const sp<IContexthubCallback> &cb) {
+    Return<Result> retVal = Result::BAD_PARAMS;
+
+    if (!isInitialized()) {
+        // Not initilalized
+        ALOGW("Context hub not initialized successfully");
+        retVal = Result::NOT_INIT;
+    } else if (!isValidHubId(hubId)) {
+        // Initialized, but hubId is  not valid
+        retVal = Result::BAD_PARAMS;
+    } else if (mContextHubModule->subscribe_messages(hubId,
+                                                     contextHubCb,
+                                                     this) == 0) {
+        // Initialized && valid hub && subscription successful
+        retVal = Result::OK;
+        mCachedHubInfo[hubId].callBack = cb;
+    } else {
+        // Initalized && valid hubId - but subscription unsuccessful
+        // This is likely an internal error in the HAL implementation, but we
+        // cannot add more information.
+        ALOGW("Could not subscribe to the hub for callback");
+        retVal = Result::UNKNOWN_FAILURE;
+    }
+
+    return retVal;
+}
+
+static bool isValidOsStatus(const uint8_t *msg,
+                            size_t msgLen,
+                            status_response_t *rsp) {
+    // Workaround a bug in some HALs
+    if (msgLen == 1) {
+        rsp->result = msg[0];
+        return true;
+    }
+
+    if (msg == nullptr || msgLen != sizeof(*rsp)) {
+        ALOGI("Received invalid response (is null : %d, size %zu)",
+              msg == nullptr ? 1 : 0,
+              msgLen);
+        return false;
+    }
+
+    memcpy(rsp, msg, sizeof(*rsp));
+
+    // No sanity checks on return values
+    return true;
+}
+
+int Contexthub::handleOsMessage(sp<IContexthubCallback> cb,
+                                uint32_t msgType,
+                                const uint8_t *msg,
+                                int msgLen) {
+    int retVal = -1;
+
+
+    switch(msgType) {
+        case CONTEXT_HUB_APPS_ENABLE:
+        case CONTEXT_HUB_APPS_DISABLE:
+        case CONTEXT_HUB_LOAD_APP:
+        case CONTEXT_HUB_UNLOAD_APP:
+        {
+            struct status_response_t rsp;
+            TransactionResult result;
+            if (isValidOsStatus(msg, msgLen, &rsp) && rsp.result == 0) {
+                retVal = 0;
+                result = TransactionResult::SUCCESS;
+            } else {
+                result = TransactionResult::FAILURE;
+            }
+
+            if (cb != nullptr) {
+                cb->handleTxnResult(mTransactionId, result);
+            }
+            retVal = 0;
+            mIsTransactionPending = false;
+            break;
+        }
+
+        case CONTEXT_HUB_QUERY_APPS:
+        {
+            std::vector<HubAppInfo> apps;
+            int numApps = msgLen / sizeof(hub_app_info);
+            const hub_app_info *unalignedInfoAddr = reinterpret_cast<const hub_app_info *>(msg);
+
+            for (int i = 0; i < numApps; i++) {
+                hub_app_info query_info;
+                memcpy(&query_info, &unalignedInfoAddr[i], sizeof(query_info));
+                HubAppInfo app;
+                app.appId = query_info.app_name.id;
+                app.version = query_info.version;
+                // TODO :: Add memory ranges
+
+                apps.push_back(app);
+            }
+
+            if (cb != nullptr) {
+                cb->handleAppsInfo(apps);
+            }
+            retVal = 0;
+            break;
+        }
+
+        case CONTEXT_HUB_QUERY_MEMORY:
+        {
+            // Deferring this use
+            retVal = 0;
+            break;
+        }
+
+        case CONTEXT_HUB_OS_REBOOT:
+        {
+            mIsTransactionPending = false;
+            if (cb != nullptr) {
+                cb->handleHubEvent(AsyncEventType::RESTARTED);
+            }
+            retVal = 0;
+            break;
+        }
+
+        default:
+        {
+            retVal = -1;
+            break;
+        }
+      }
+
+      return retVal;
+}
+
+int Contexthub::contextHubCb(uint32_t hubId,
+                             const struct hub_message_t *rxMsg,
+                             void *cookie) {
+    Contexthub *obj = static_cast<Contexthub *>(cookie);
+
+    if (rxMsg == nullptr) {
+        ALOGW("Ignoring NULL message");
+        return -1;
+    }
+
+    if (!obj->isValidHubId(hubId)) {
+        ALOGW("Invalid hub Id %" PRIu32, hubId);
+        return -1;
+    }
+
+    sp<IContexthubCallback> cb = obj->getCallBackForHubId(hubId);
+
+    if (cb == nullptr) {
+        // This should not ever happen
+        ALOGW("No callback registered, returning");
+        return -1;
+    }
+
+    if (rxMsg->message_type < CONTEXT_HUB_TYPE_PRIVATE_MSG_BASE) {
+        obj->handleOsMessage(cb,
+                             rxMsg->message_type,
+                             static_cast<const uint8_t *>(rxMsg->message),
+                             rxMsg->message_len);
+    } else {
+        ContextHubMsg msg;
+
+        msg.appName = rxMsg->app_name.id;
+        msg.msgType = rxMsg->message_type;
+        msg.msg = std::vector<uint8_t>(static_cast<const uint8_t *>(rxMsg->message),
+                                       static_cast<const uint8_t *>(rxMsg->message) +
+                                       rxMsg->message_len);
+
+        cb->handleClientMsg(msg);
+    }
+
+    return 0;
+}
+
+Return<Result> Contexthub::unloadNanoApp(uint32_t hubId,
+                                         uint64_t appId,
+                                         uint32_t transactionId) {
+    if (!isInitialized()) {
+      return Result::NOT_INIT;
+    }
+
+    if (mIsTransactionPending) {
+        return Result::TRANSACTION_PENDING;
+    }
+
+    hub_message_t msg;
+
+    if (setOsAppAsDestination(&msg, hubId) == false) {
+        return Result::BAD_PARAMS;
+    }
+
+    struct apps_disable_request_t req;
+
+    msg.message_type = CONTEXT_HUB_UNLOAD_APP;
+    msg.message_len = sizeof(req);
+    msg.message = &req;
+    req.app_name.id = appId;
+
+    if(mContextHubModule->send_message(hubId, &msg) != 0) {
+        return Result::TRANSACTION_FAILED;
+    } else {
+        mTransactionId = transactionId;
+        mIsTransactionPending = true;
+        return Result::OK;
+    }
+}
+
+Return<Result> Contexthub::loadNanoApp(uint32_t hubId,
+                                       const ::android::hardware::hidl_vec<uint8_t>& appBinary,
+                                       uint32_t transactionId) {
+    if (!isInitialized()) {
+      return Result::NOT_INIT;
+    }
+
+    if (mIsTransactionPending) {
+        return Result::TRANSACTION_PENDING;
+    }
+
+    hub_message_t hubMsg;
+
+    if (setOsAppAsDestination(&hubMsg, hubId) == false) {
+        return Result::BAD_PARAMS;
+    }
+
+    hubMsg.message_type = CONTEXT_HUB_LOAD_APP;
+    hubMsg.message_len = appBinary.size();
+    hubMsg.message = appBinary.data();
+
+    if(mContextHubModule->send_message(hubId, &hubMsg) != 0) {
+        return Result::TRANSACTION_FAILED;
+    } else {
+        mTransactionId = transactionId;
+        mIsTransactionPending = true;
+        return Result::OK;
+    }
+}
+
+Return<Result> Contexthub::enableNanoApp(uint32_t hubId,
+                                         uint64_t appId,
+                                         uint32_t transactionId) {
+    if (!isInitialized()) {
+      return Result::NOT_INIT;
+    }
+
+    if (mIsTransactionPending) {
+        return Result::TRANSACTION_PENDING;
+    }
+
+    hub_message_t msg;
+
+    if (setOsAppAsDestination(&msg, hubId) == false) {
+        return Result::BAD_PARAMS;
+    }
+
+    struct apps_enable_request_t req;
+
+    msg.message_type = CONTEXT_HUB_APPS_ENABLE;
+    msg.message_len = sizeof(req);
+    req.app_name.id = appId;
+    msg.message = &req;
+
+    if(mContextHubModule->send_message(hubId, &msg) != 0) {
+        return Result::TRANSACTION_FAILED;
+    } else {
+        mTransactionId = transactionId;
+        mIsTransactionPending = true;
+        return Result::OK;
+    }
+}
+
+Return<Result> Contexthub::disableNanoApp(uint32_t hubId,
+                                          uint64_t appId,
+                                          uint32_t transactionId) {
+    if (!isInitialized()) {
+      return Result::NOT_INIT;
+    }
+
+    if (mIsTransactionPending) {
+        return Result::TRANSACTION_PENDING;
+    }
+
+    hub_message_t msg;
+
+    if (setOsAppAsDestination(&msg, hubId) == false) {
+        return Result::BAD_PARAMS;
+    }
+
+    struct apps_disable_request_t req;
+
+    msg.message_type = CONTEXT_HUB_APPS_DISABLE;
+    msg.message_len = sizeof(req);
+    req.app_name.id = appId;
+    msg.message = &req;
+
+    if(mContextHubModule->send_message(hubId, &msg) != 0) {
+        return Result::TRANSACTION_FAILED;
+    } else {
+        mTransactionId = transactionId;
+        mIsTransactionPending = true;
+        return Result::OK;
+    }
+}
+
+Return<Result> Contexthub::queryApps(uint32_t hubId) {
+    if (!isInitialized()) {
+      return Result::NOT_INIT;
+    }
+
+    hub_message_t msg;
+
+    if (setOsAppAsDestination(&msg, hubId) == false) {
+        ALOGW("Could not find hubId %" PRIu32, hubId);
+        return Result::BAD_PARAMS;
+    }
+
+    query_apps_request_t payload;
+    payload.app_name.id = ALL_APPS; // TODO : Pass this in as a parameter
+    msg.message = &payload;
+    msg.message_len = sizeof(payload);
+    msg.message_type = CONTEXT_HUB_QUERY_APPS;
+
+    if(mContextHubModule->send_message(hubId, &msg) != 0) {
+        ALOGW("Query Apps sendMessage failed");
+        return Result::TRANSACTION_FAILED;
+    }
+
+    return Result::OK;
+}
+
+bool Contexthub::isInitialized() {
+    return (mInitCheck == OK && mContextHubModule != nullptr);
+}
+
+IContexthub *HIDL_FETCH_IContexthub(const char * halName) {
+    ALOGI("%s Called for %s", __FUNCTION__, halName);
+    Contexthub *contexthub = new Contexthub;
+
+    if (!contexthub->isInitialized()) {
+        delete contexthub;
+        contexthub = nullptr;
+    }
+
+    return contexthub;
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace contexthub
+}  // namespace hardware
+}  // namespace android
diff --git a/contexthub/1.0/default/Contexthub.h b/contexthub/1.0/default/Contexthub.h
new file mode 100644
index 0000000..0883ce8
--- /dev/null
+++ b/contexthub/1.0/default/Contexthub.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CONTEXTHUB_V1_0_CONTEXTHUB_H_
+#define ANDROID_HARDWARE_CONTEXTHUB_V1_0_CONTEXTHUB_H_
+
+#include <unordered_map>
+
+#include <android/hardware/contexthub/1.0/IContexthub.h>
+#include <hardware/context_hub.h>
+
+namespace android {
+namespace hardware {
+namespace contexthub {
+namespace V1_0 {
+namespace implementation {
+
+struct Contexthub : public ::android::hardware::contexthub::V1_0::IContexthub {
+    Contexthub();
+
+    Return<void> getHubs(getHubs_cb _hidl_cb) override;
+
+    Return<Result> registerCallback(uint32_t hubId,
+                                    const sp<IContexthubCallback> &cb) override;
+
+    Return<Result> sendMessageToHub(uint32_t hubId,
+                                    const ContextHubMsg &msg) override;
+
+    Return<Result> loadNanoApp(uint32_t hubId,
+                               const ::android::hardware::hidl_vec<uint8_t>& appBinary,
+                               uint32_t transactionId) override;
+
+    Return<Result> unloadNanoApp(uint32_t hubId,
+                                 uint64_t appId,
+                                 uint32_t transactionId) override;
+
+    Return<Result> enableNanoApp(uint32_t hubId,
+                                 uint64_t appId,
+                                 uint32_t transactionId) override;
+
+    Return<Result> disableNanoApp(uint32_t hubId,
+                                  uint64_t appId,
+                                  uint32_t transactionId) override;
+
+    Return<Result> queryApps(uint32_t hubId) override;
+
+    Return<Result> reboot(uint32_t hubId);
+
+    bool isInitialized();
+
+private:
+
+    struct CachedHubInformation{
+        struct hub_app_name_t osAppName;
+        sp<IContexthubCallback> callBack;
+    };
+
+    status_t mInitCheck;
+    const struct context_hub_module_t *mContextHubModule;
+    std::unordered_map<uint32_t, CachedHubInformation> mCachedHubInfo;
+
+    sp<IContexthubCallback> mCb;
+    bool mIsTransactionPending;
+    uint32_t mTransactionId;
+
+    bool isValidHubId(uint32_t hubId);
+
+    sp<IContexthubCallback> getCallBackForHubId(uint32_t hubId);
+
+    int handleOsMessage(sp<IContexthubCallback> cb,
+                        uint32_t msgType,
+                        const uint8_t *msg,
+                        int msgLen);
+
+    static int contextHubCb(uint32_t hubId,
+                            const struct hub_message_t *rxMsg,
+                            void *cookie);
+
+    bool setOsAppAsDestination(hub_message_t *msg, int hubId);
+
+    DISALLOW_COPY_AND_ASSIGN(Contexthub);
+};
+
+extern "C" IContexthub *HIDL_FETCH_IContexthub(const char *name);
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace contexthub
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_CONTEXTHUB_V1_0_CONTEXTHUB_H_
diff --git a/contexthub/1.0/default/android.hardware.contexthub@1.0-service.rc b/contexthub/1.0/default/android.hardware.contexthub@1.0-service.rc
new file mode 100644
index 0000000..8dba85f
--- /dev/null
+++ b/contexthub/1.0/default/android.hardware.contexthub@1.0-service.rc
@@ -0,0 +1,4 @@
+service contexthub-hal-1-0 /system/bin/hw/android.hardware.contexthub@1.0-service
+    class hal
+    user system
+    group system
diff --git a/contexthub/1.0/default/service.cpp b/contexthub/1.0/default/service.cpp
new file mode 100644
index 0000000..db9a4e7
--- /dev/null
+++ b/contexthub/1.0/default/service.cpp
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.contexthub@1.0-service"
+
+#include <android/hardware/contexthub/1.0/IContexthub.h>
+#include <hidl/LegacySupport.h>
+
+using android::hardware::contexthub::V1_0::IContexthub;
+using android::hardware::defaultPassthroughServiceImplementation;
+
+int main() {
+    return defaultPassthroughServiceImplementation<IContexthub>("context_hub");
+}
diff --git a/contexthub/1.0/types.hal b/contexthub/1.0/types.hal
index b9f014b..043bb39 100644
--- a/contexthub/1.0/types.hal
+++ b/contexthub/1.0/types.hal
@@ -18,6 +18,7 @@
 
 enum Result : uint32_t {
     OK,                  // Success
+    UNKNOWN_FAILURE,     // Failure, unknown reason
     BAD_PARAMS,          // Parameters not sane
     NOT_INIT,            // not initialized
     TRANSACTION_FAILED,  // transaction failed
diff --git a/contexthub/Android.bp b/contexthub/Android.bp
index bbb3e4b..ba90f2c 100644
--- a/contexthub/Android.bp
+++ b/contexthub/Android.bp
@@ -1,4 +1,5 @@
 // This is an autogenerated file, do not edit.
 subdirs = [
     "1.0",
+    "1.0/default",
 ]
diff --git a/drm/crypto/1.0/ICryptoFactory.hal b/drm/crypto/1.0/ICryptoFactory.hal
index 58f86df..c1ff31f 100644
--- a/drm/crypto/1.0/ICryptoFactory.hal
+++ b/drm/crypto/1.0/ICryptoFactory.hal
@@ -25,7 +25,7 @@
  * which are used by a codec to decrypt protected video content.
  */
 interface ICryptoFactory {
-    /*
+    /**
      * Determine if a crypto scheme is supported by this HAL
      *
      * @param uuid identifies the crypto scheme in question
@@ -33,20 +33,21 @@
      */
     isCryptoSchemeSupported(uint8_t[16] uuid) generates(bool isSupported);
 
-    /*
+    /**
      * Create a crypto plugin for the specified uuid and scheme-specific
      * initialization data.
      *
      * @param uuid uniquely identifies the drm scheme. See
      * http://dashif.org/identifiers/protection for uuid assignments
      * @param initData scheme-specific init data.
-     * @return the status of the call
-     * @return the created ICryptoPlugin
-    */
+     * @return status the status of the call. If the plugin can't
+     * be created, the HAL implementation must return ERROR_DRM_CANNOT_HANDLE.
+     * @return cryptoPlugin the created ICryptoPlugin
+     */
     createPlugin(uint8_t[16] uuid, vec<uint8_t> initData)
         generates (Status status, ICryptoPlugin cryptoPlugin);
 
-    /*
+    /**
      * Destroy a previously created crypto plugin
      *
      * @return status the status of the call
diff --git a/drm/crypto/1.0/ICryptoPlugin.hal b/drm/crypto/1.0/ICryptoPlugin.hal
index 1255fdb..ee4c1dc 100644
--- a/drm/crypto/1.0/ICryptoPlugin.hal
+++ b/drm/crypto/1.0/ICryptoPlugin.hal
@@ -25,7 +25,7 @@
  * load crypto keys for a codec to decrypt protected video content.
  */
 interface ICryptoPlugin {
-    /*
+    /**
      * Check if the specified mime-type requires a secure decoder
      * component.
      *
@@ -36,7 +36,7 @@
     requiresSecureDecoderComponent(string mime)
         generates(bool secureRequired);
 
-    /*
+    /**
      * Notify a plugin of the currently configured resolution
      *
      * @param width - the display resolutions's width
@@ -44,16 +44,19 @@
      */
     notifyResolution(uint32_t width, uint32_t height);
 
-    /*
+    /**
      * Associate a mediadrm session with this crypto session
      *
      * @param sessionId the MediaDrm session ID to associate with this crypto
      * session
-     * @return the status of the call
+     * @return the status of the call, status must be
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened, or
+     * ERROR_DRM_CANNOT_HANDLE if the operation is not supported by the drm
+     * scheme.
      */
     setMediaDrmSession(vec<uint8_t> sessionId) generates(Status status);
 
-    /*
+    /**
      * Decrypt an array of subsamples from the source memory buffer to the
      * destination memory buffer.
      *
@@ -71,7 +74,14 @@
      * call to operate on a range of subsamples in a single call
      * @param source the input buffer for the decryption
      * @param destination the output buffer for the decryption
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * the following: ERROR_DRM_NO_LICENSE if no license keys have been
+     * loaded, ERROR_DRM_LICENSE_EXPIRED if the license keys have expired,
+     * ERROR_DRM_RESOURCE_BUSY if the resources required to perform the
+     * decryption are not available, ERROR_DRM_INSUFFICIENT_OUTPUT_PROTECTION
+     * if required output protections are not active,
+     * ERROR_DRM_SESSION_NOT_OPENED if the decrypt session is not opened, or
+     * ERROR_DRM_CANNOT_HANDLE in other failure cases.
      * @return bytesWritten the number of bytes output from the decryption
      * @return detailedError if the error is a vendor-specific error, the
      * vendor's crypto HAL may provide a detailed error string to help
diff --git a/drm/drm/1.0/IDrmFactory.hal b/drm/drm/1.0/IDrmFactory.hal
index a4ee0f1..80cb941 100644
--- a/drm/drm/1.0/IDrmFactory.hal
+++ b/drm/drm/1.0/IDrmFactory.hal
@@ -27,7 +27,7 @@
  */
 
 interface IDrmFactory {
-    /*
+    /**
      * Determine if a crypto scheme is supported by this HAL
      *
      * @param uuid identifies the crypto scheme in question
@@ -35,20 +35,21 @@
      */
     isCryptoSchemeSupported(uint8_t[16] uuid) generates(bool isSupported);
 
-    /*
+    /**
      * Create a drm plugin instance for the specified uuid and scheme-specific
      * initialization data.
      *
      * @param uuid uniquely identifies the drm scheme. See
      * http://dashif.org/identifiers/protection for uuid assignments
      * @param initData scheme-specific init data.
-     * @return the status of the call
+     * @return status the status of the call. If the plugin can't
+     * be created, the HAL implementation must return ERROR_DRM_CANNOT_HANDLE.
      * @return the created IDrmPlugin
      */
     createPlugin(uint8_t[16] uuid, vec<uint8_t> initData)
         generates (Status status, IDrmPlugin drmPlugin);
 
-    /*
+    /**
      * Destroy a previously created drm plugin
      * @return status the status of the call
      */
diff --git a/drm/drm/1.0/IDrmPlugin.hal b/drm/drm/1.0/IDrmPlugin.hal
index 7f396d9..cc15cfd 100644
--- a/drm/drm/1.0/IDrmPlugin.hal
+++ b/drm/drm/1.0/IDrmPlugin.hal
@@ -30,7 +30,13 @@
     /**
      * Open a new session with the DrmPlugin object. A session ID is returned
      * in the sessionId parameter.
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_NOT_PROVISIONED if the device requires provisioning before
+     * it can open a session, ERROR_DRM_RESOURCE_BUSY if there are insufficent
+     * resources available to open a session, ERROR_DRM_CANNOT_HANDLE,
+     * if openSession is not supported at the time of the call or
+     * ERROR_DRM_INVALID_STATE if the HAL is in a state where a session cannot
+     * be opened.
      */
     openSession() generates (SessionId sessionId, Status status);
 
@@ -38,7 +44,10 @@
      * Close a session on the DrmPlugin object
      *
      * @param sessionId the session id the call applies to
-     * @return status the status of the call
+     * @return status the status of the call.  The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if the sessionId is invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the session cannot be closed.
      */
     closeSession(SessionId sessionId) generates (Status status);
 
@@ -72,7 +81,13 @@
      * subsequent key request used to refresh the keys in a license. RELEASE
      * corresponds to a keyType of RELEASE, which indicates keys are being
      * released.
-     * @return status the status of the call
+     * @return status the status of the call.  The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * ERROR_DRM_NOT_PROVISIONED if the device requires provisioning before
+     * it can generate a key request, ERROR_DRM_CANNOT_HANDLE if keyKeyRequest
+     * is not supported at the time of the call, BAD_VALUE if any parameters
+     * are invalid or ERROR_DRM_INVALID_STATE if the HAL is in a state where
+     * a key request cannot be generated.
      * @return defaultUrl the URL that the request may be sent to, if
      * provided by the drm HAL. The app may choose to override this
      * URL.
@@ -98,8 +113,14 @@
      * to later restore the keys to a new session with the method restoreKeys.
      * When the response is for a streaming or release request, no keySetId is
      * returned.
-     *
-     * @return status the status of the call
+     * @return status the status of the call.  The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * ERROR_DRM_NOT_PROVISIONED if the device requires provisioning before
+     * it can handle the key response, ERROR_DRM_DEVICE_REVOKED if the device
+     * has been disabled by the license policy, ERROR_DRM_CANNOT_HANDLE if
+     * provideKeyResponse is not supported at the time of the call, BAD_VALUE
+     * if any parameters are invalid or ERROR_DRM_INVALID_STATE if the HAL is
+     * in a state where a key response cannot be handled.
      */
     provideKeyResponse(vec<uint8_t> scope,
         vec<uint8_t> response) generates (vec<uint8_t> keySetId, Status status);
@@ -108,7 +129,10 @@
      * Remove the current keys from a session
      *
      * @param sessionId the session id the call applies to
-     * @return status the status of the call
+     * @return status the status of the call.  The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if the sessionId is invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the keys cannot be removed.
      */
     removeKeys(SessionId sessionId) generates (Status status);
 
@@ -118,12 +142,15 @@
      * @param sessionId the session id the call applies to
      * @param keySetId identifies the keys to load, obtained from a prior
      * call to provideKeyResponse().
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where keys cannot be restored.
      */
     restoreKeys(SessionId sessionId,
         vec<uint8_t> keySetId) generates (Status status);
 
-    /*
+    /**
      * Request an informative description of the license for the session. The
      * status is in the form of {name, value} pairs. Since DRM license policies
      * vary by vendor, the specific status field names are determined by each
@@ -132,7 +159,10 @@
      *
      * @param sessionId the session id the call applies to
      * @return infoList a list of name value pairs describing the license
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if the sessionId is invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where key status cannot be queried.
      */
     queryKeyStatus(SessionId sessionId)
         generates (KeyedVector infoList, Status status);
@@ -148,7 +178,10 @@
      * certificate authority (CA) is an entity which issues digital certificates
      * for use by other parties. It is an example of a trusted third party
      * @return if successful the opaque certirequest blob is returned
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * BAD_VALUE if the sessionId is invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the provision request cannot be
+     * generated.
      */
     getProvisionRequest(string certificateType, string certificateAuthority)
         generates (vec<uint8_t> request, string defaultUrl, Status status);
@@ -165,7 +198,11 @@
      * @return wrappedKey an opaque object containing encrypted private key
      * material to be used by signRSA when computing an RSA signature on a
      * message, see the signRSA method.
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_DEVICE_REVOKED if the device has been disabled by the license
+     * policy, BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the provision response cannot be
+     * handled.
      */
     provideProvisionResponse(vec<uint8_t> response)
         generates (vec<uint8_t> certificate, vec<uint8_t> wrappedKey,
@@ -194,40 +231,48 @@
      * Get all secure stops on the device
      *
      * @return secureStops a list of the secure stop opaque objects
-     * @return status the status of the call
+     * @return status the status of the call. The status must be
+     * ERROR_DRM_INVALID_STATE if the HAL is in a state where the secure stops
+     * cannot be returned.
      */
     getSecureStops() generates
         (vec<SecureStop> secureStops, Status status);
 
     /**
-    * Get all secure stops by secure stop ID
-    *
-    * @param secureStopId the ID of the secure stop to return. The
-    * secure stop ID is delivered by the key server as part of the key
-    * response and must also be known by the app.
-    *
-    * @return the secure stop opaque object
-    * @return status the status of the call
-    */
+     * Get all secure stops by secure stop ID
+     *
+     * @param secureStopId the ID of the secure stop to return. The
+     * secure stop ID is delivered by the key server as part of the key
+     * response and must also be known by the app.
+     *
+     * @return secureStop the secure stop opaque object
+     * @return status the status of the call. The status must be one of
+     * BAD_VALUE if the secureStopId is invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the secure stop cannot be returned.
+     */
     getSecureStop(SecureStopId secureStopId)
         generates (SecureStop secureStop, Status status);
 
     /**
      * Release all secure stops on the device
      *
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_INVALID_STATE if the HAL is in a state where the secure
+     * stops cannot be released.
      */
     releaseAllSecureStops() generates (Status status);
 
     /**
-    * Release a secure stop by secure stop ID
-    *
-    * @param secureStopId the ID of the secure stop to release. The
-    * secure stop ID is delivered by the key server as part of the key
-    * response and must also be known by the app.
-    *
-    * @return status the status of the call
-    */
+     * Release a secure stop by secure stop ID
+     *
+     * @param secureStopId the ID of the secure stop to release. The
+     * secure stop ID is delivered by the key server as part of the key
+     * response and must also be known by the app.
+     *
+     * @return status the status of the call. The status must be one of
+     * BAD_VALUE if the secureStopId is invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the secure stop cannot be released.
+     */
     releaseSecureStop(vec<uint8_t> secureStopId) generates (Status status);
 
     /**
@@ -252,8 +297,11 @@
      * Read a string property value given the property name.
      *
      * @param propertyName the name of the property
-     * @return the property value string
-     * @return status the status of the call
+     * @return value the property value string
+     * @return status the status of the call. The status must be one of
+     * BAD_VALUE if the property name is invalid, ERROR_DRM_CANNOT_HANDLE
+     * if the property is not supported, or ERROR_DRM_INVALID_STATE if the
+     * HAL is in a state where the property cannot be obtained.
      */
     getPropertyString(string propertyName)
         generates (string value, Status status);
@@ -262,8 +310,11 @@
      * Read a byte array property value given the property name.
      *
      * @param propertyName the name of the property
-     * @return the property value byte array
-     * @return status the status of the call
+     * @return value the property value byte array
+     * @return status the status of the call. The status must be one of
+     * BAD_VALUE if the property name is invalid, ERROR_DRM_CANNOT_HANDLE
+     * if the property is not supported, or ERROR_DRM_INVALID_STATE if the
+     * HAL is in a state where the property cannot be obtained.
      */
     getPropertyByteArray(string propertyName)
         generates (vec<uint8_t> value, Status status);
@@ -273,7 +324,10 @@
      *
      * @param propertyName the name of the property
      * @param value the value to write
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * BAD_VALUE if the property name is invalid, ERROR_DRM_CANNOT_HANDLE
+     * if the property is not supported, or ERROR_DRM_INVALID_STATE if the
+     * HAL is in a state where the property cannot be set.
      */
     setPropertyString(string propertyName, string value )
         generates (Status status);
@@ -283,7 +337,10 @@
      *
      * @param propertyName the name of the property
      * @param value the value to write
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * BAD_VALUE if the property name is invalid, ERROR_DRM_CANNOT_HANDLE
+     * if the property is not supported, or ERROR_DRM_INVALID_STATE if the
+     * HAL is in a state where the property cannot be set.
      */
     setPropertyByteArray(string propertyName, vec<uint8_t> value )
         generates (Status status);
@@ -301,7 +358,10 @@
      * @param algorithm the algorithm to use. The string conforms to JCA
      * Standard Names for Cipher Transforms and is case insensitive. An
      * example algorithm is "AES/CBC/PKCS5Padding".
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the algorithm cannot be set.
      */
     setCipherAlgorithm(SessionId sessionId, string algorithm)
         generates (Status status);
@@ -313,7 +373,10 @@
      * @param algorithm the algorithm to use. The string conforms to JCA
      * Standard Names for Mac Algorithms and is case insensitive. An example MAC
      * algorithm string is "HmacSHA256".
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the algorithm cannot be set.
      */
     setMacAlgorithm(SessionId sessionId, string algorithm)
         generates (Status status);
@@ -328,7 +391,11 @@
      * @param input the input data to encrypt
      * @param iv the initialization vector to use for encryption
      * @return output the decrypted data
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the encrypt operation cannot be
+     * performed.
      */
     encrypt(SessionId sessionId, vec<uint8_t> keyId, vec<uint8_t> input,
         vec<uint8_t> iv)
@@ -344,7 +411,11 @@
      * @param input the input data to decrypt
      * @param iv the initialization vector to use for decryption
      * @return output the decrypted data
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the decrypt operation cannot be
+     * performed.
      */
     decrypt(SessionId sessionId, vec<uint8_t> keyId, vec<uint8_t> input,
         vec<uint8_t> iv) generates (vec<uint8_t> output, Status status);
@@ -357,8 +428,12 @@
      * @param sessionId the session id the call applies to
      * @param keyId the ID of the key to use for decryption
      * @param message the message to compute a signature over
-     * @return the computed signature
-     * @return status the status of the call
+     * @return signature the computed signature
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the sign operation cannot be
+     * performed.
      */
     sign(SessionId sessionId, vec<uint8_t> keyId, vec<uint8_t> message)
         generates (vec<uint8_t> signature, Status status);
@@ -371,7 +446,11 @@
      * @param sessionId the session id the call applies to
      * @param keyId the ID of the key to use for decryption
      * @param message the message to compute a hash of
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the verify operation cannot be
+     * performed.
      */
     verify(SessionId sessionId, vec<uint8_t> keyId, vec<uint8_t> message,
         vec<uint8_t> signature) generates (bool match, Status status);
@@ -383,10 +462,14 @@
      * @param algorithm the signing algorithm, such as "RSASSA-PSS-SHA1"
      * or "PKCS1-BlockType1"
      * @param sessionId the session id the call applies to
-     * @param wrappedKey the private key returned during provisioning
-     * as returned by provideProvisionResponse.
+     * @param wrappedKey the private key returned during provisioning as
+     * returned by provideProvisionResponse.
      * @return signature the RSA signature computed over the message
-     * @return status the status of the call
+     * @return status the status of the call. The status must be one of
+     * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
+     * BAD_VALUE if any parameters are invalid or ERROR_DRM_INVALID_STATE
+     * if the HAL is in a state where the signRSA operation cannot be
+     * performed.
      */
     signRSA(SessionId sessionId, string algorithm, vec<uint8_t> message,
         vec<uint8_t> wrappedkey)
diff --git a/graphics/composer/2.1/default/HwcClient.cpp b/graphics/composer/2.1/default/HwcClient.cpp
index 16af94c..5599959 100644
--- a/graphics/composer/2.1/default/HwcClient.cpp
+++ b/graphics/composer/2.1/default/HwcClient.cpp
@@ -934,7 +934,7 @@
         return false;
     }
 
-    auto err = mHal.setLayerPlaneAlpha(mDisplay, mLayer, read());
+    auto err = mHal.setLayerPlaneAlpha(mDisplay, mLayer, readFloat());
     if (err != Error::NONE) {
         mWriter.setError(getCommandLoc(), err);
     }
diff --git a/graphics/composer/2.1/default/IComposerCommandBuffer.h b/graphics/composer/2.1/default/IComposerCommandBuffer.h
index 030db88..199a744 100644
--- a/graphics/composer/2.1/default/IComposerCommandBuffer.h
+++ b/graphics/composer/2.1/default/IComposerCommandBuffer.h
@@ -35,7 +35,7 @@
 #include <android/hardware/graphics/composer/2.1/IComposer.h>
 #include <log/log.h>
 #include <sync/sync.h>
-#include <MessageQueue.h>
+#include <fmq/MessageQueue.h>
 
 namespace android {
 namespace hardware {
diff --git a/ir/1.0/IConsumerIr.hal b/ir/1.0/IConsumerIr.hal
index f928c0e..f9e6316 100644
--- a/ir/1.0/IConsumerIr.hal
+++ b/ir/1.0/IConsumerIr.hal
@@ -28,7 +28,7 @@
      *
      * returns: true on success, false on error.
      */
-    transmit(int32_t carrierFreq, vec<int32_t> pattern, int32_t patternLen) generates (bool success);
+    transmit(int32_t carrierFreq, vec<int32_t> pattern) generates (bool success);
 
     /*
      * getCarrierFreqs() enumerates which frequencies the IR transmitter supports.
diff --git a/ir/1.0/default/ConsumerIr.cpp b/ir/1.0/default/ConsumerIr.cpp
index 763e09a..8cfb2e8 100644
--- a/ir/1.0/default/ConsumerIr.cpp
+++ b/ir/1.0/default/ConsumerIr.cpp
@@ -32,8 +32,8 @@
 }
 
 // Methods from ::android::hardware::consumerir::V1_0::IConsumerIr follow.
-Return<bool> ConsumerIr::transmit(int32_t carrierFreq, const hidl_vec<int32_t>& pattern, int32_t patternLen) {
-    return mDevice->transmit(mDevice, carrierFreq, pattern.data(), patternLen) == 0;
+Return<bool> ConsumerIr::transmit(int32_t carrierFreq, const hidl_vec<int32_t>& pattern) {
+    return mDevice->transmit(mDevice, carrierFreq, pattern.data(), pattern.size()) == 0;
 }
 
 Return<void> ConsumerIr::getCarrierFreqs(getCarrierFreqs_cb _hidl_cb) {
diff --git a/ir/1.0/default/ConsumerIr.h b/ir/1.0/default/ConsumerIr.h
index 527c577..1532183 100644
--- a/ir/1.0/default/ConsumerIr.h
+++ b/ir/1.0/default/ConsumerIr.h
@@ -40,7 +40,7 @@
 struct ConsumerIr : public IConsumerIr {
     ConsumerIr(consumerir_device_t *device);
     // Methods from ::android::hardware::ir::V1_0::IConsumerIr follow.
-    Return<bool> transmit(int32_t carrierFreq, const hidl_vec<int32_t>& pattern, int32_t patternLen) override;
+    Return<bool> transmit(int32_t carrierFreq, const hidl_vec<int32_t>& pattern) override;
     Return<void> getCarrierFreqs(getCarrierFreqs_cb _hidl_cb) override;
 private:
     consumerir_device_t *mDevice;
diff --git a/media/1.0/types.hal b/media/1.0/types.hal
index 98dfe14..89b7fa2 100644
--- a/media/1.0/types.hal
+++ b/media/1.0/types.hal
@@ -27,28 +27,28 @@
 
 /**
  * Ref: frameworks/native/include/ui/GraphicBuffer.h
- * Ref: system/core/include/system/window.h
+ * Ref: system/core/include/system/window.h: ANativeWindowBuffer
  */
 
 /**
  * This struct contains attributes for a gralloc buffer that can be put into a
  * union.
  */
-struct GraphicBufferAttributes {
+struct AnwBufferAttributes {
     uint32_t width;
     uint32_t height;
     uint32_t stride;
     PixelFormat format;
     uint32_t usage; // TODO: convert to an enum
-    uint32_t generationNumber;
+    uint64_t layerCount;
 };
 
 /**
- * A GraphicBuffer is simply GraphicBufferAttributes plus a native handle.
+ * An AnwBuffer is simply AnwBufferAttributes plus a native handle.
  */
-struct GraphicBuffer {
+struct AnwBuffer {
     handle nativeHandle;
-    GraphicBufferAttributes attr;
+    AnwBufferAttributes attr;
 };
 
 /**
diff --git a/media/omx/1.0/IGraphicBufferSource.hal b/media/omx/1.0/IGraphicBufferSource.hal
index a5b5813..9b3ab0c 100644
--- a/media/omx/1.0/IGraphicBufferSource.hal
+++ b/media/omx/1.0/IGraphicBufferSource.hal
@@ -29,32 +29,23 @@
  */
 interface IGraphicBufferSource {
 
-    configure(IOmxNode omxNode, Dataspace dataspace)
-        generates (Status status);
+    configure(IOmxNode omxNode, Dataspace dataspace);
 
-    setSuspend(bool suspend)
-        generates (Status status);
+    setSuspend(bool suspend);
 
-    setRepeatPreviousFrameDelayUs(int64_t repeatAfterUs)
-        generates (Status status);
+    setRepeatPreviousFrameDelayUs(int64_t repeatAfterUs);
 
-    setMaxFps(float maxFps)
-        generates (Status status);
+    setMaxFps(float maxFps);
 
-    setTimeLapseConfig(int64_t timePerFrameUs, int64_t timePerCaptureUs)
-        generates (Status status);
+    setTimeLapseConfig(int64_t timePerFrameUs, int64_t timePerCaptureUs);
 
-    setStartTimeUs(int64_t startTimeUs)
-        generates (Status status);
+    setStartTimeUs(int64_t startTimeUs);
 
-    setColorAspects(ColorAspects aspects)
-        generates (Status status);
+    setColorAspects(ColorAspects aspects);
 
-    setTimeOffsetUs(int64_t timeOffsetUs)
-        generates (Status status);
+    setTimeOffsetUs(int64_t timeOffsetUs);
 
-    signalEndOfInputStream()
-        generates (Status status);
+    signalEndOfInputStream();
 
 };
 
diff --git a/media/omx/1.0/IOmxNode.hal b/media/omx/1.0/IOmxNode.hal
index 9483be4..5945b44 100644
--- a/media/omx/1.0/IOmxNode.hal
+++ b/media/omx/1.0/IOmxNode.hal
@@ -46,14 +46,14 @@
      * Invoke a command on the node.
      *
      * @param[in] cmd indicates the type of the command.
-     * @param[in] info holds information about the command.
+     * @param[in] param is a parameter for the command.
      * @param[out] status will be the status of the call.
      *
      * @see OMX_SendCommand() in the OpenMax IL standard.
      */
     sendCommand(
             uint32_t cmd,
-            Bytes info // TODO: describe structure better or point at standard
+            int32_t param
         ) generates (
             Status status
         );
diff --git a/media/omx/1.0/types.hal b/media/omx/1.0/types.hal
index 79c3a44..ccb2ddf 100644
--- a/media/omx/1.0/types.hal
+++ b/media/omx/1.0/types.hal
@@ -34,6 +34,7 @@
 
     NAME_NOT_FOUND          = -2,
     NO_MEMORY               = -12,
+    BAD_VALUE               = -22,
     ERROR_UNSUPPORTED       = -1010,
     UNKNOWN_ERROR           = -2147483648,
 };
@@ -149,7 +150,7 @@
         SharedMemoryAttributes sharedMem;
 
         // if bufferType == ANW_BUFFER
-        GraphicBufferAttributes anwBuffer;
+        AnwBufferAttributes anwBuffer;
 
         // if bufferType == NATIVE_HANDLE
         // No additional attributes.
diff --git a/memtrack/1.0/vts/Android.mk b/memtrack/1.0/vts/Android.mk
index 4a5ca4f..7b2400f 100644
--- a/memtrack/1.0/vts/Android.mk
+++ b/memtrack/1.0/vts/Android.mk
@@ -48,3 +48,4 @@
 
 include $(BUILD_SHARED_LIBRARY)
 
+include $(LOCAL_PATH)/functional/vts/testcases/hal/memtrack/hidl/target/Android.mk
diff --git a/memtrack/1.0/vts/functional/Android.bp b/memtrack/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..b3e560a
--- /dev/null
+++ b/memtrack/1.0/vts/functional/Android.bp
@@ -0,0 +1,40 @@
+//
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "memtrack_hidl_hal_test",
+    gtest: true,
+    srcs: ["memtrack_hidl_hal_test.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhardware",
+        "libhidlbase",
+        "libhwbinder",
+        "libutils",
+        "android.hardware.memtrack@1.0",
+    ],
+    static_libs: ["libgtest"],
+    cflags: [
+        "--coverage",
+        "-O0",
+        "-g",
+    ],
+    ldflags: [
+        "--coverage"
+    ]
+}
diff --git a/memtrack/1.0/vts/functional/memtrack_hidl_hal_test.cpp b/memtrack/1.0/vts/functional/memtrack_hidl_hal_test.cpp
new file mode 100644
index 0000000..597b5da
--- /dev/null
+++ b/memtrack/1.0/vts/functional/memtrack_hidl_hal_test.cpp
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "memtrack_hidl_hal_test"
+#include <android-base/logging.h>
+#include <android/hardware/memtrack/1.0/IMemtrack.h>
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <vector>
+
+using ::android::hardware::memtrack::V1_0::IMemtrack;
+using ::android::hardware::memtrack::V1_0::MemtrackRecord;
+using ::android::hardware::memtrack::V1_0::MemtrackFlag;
+using ::android::hardware::memtrack::V1_0::MemtrackType;
+using ::android::hardware::memtrack::V1_0::MemtrackStatus;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::sp;
+using std::vector;
+using std::count_if;
+
+class MemtrackHidlTest : public ::testing::Test {
+ public:
+  virtual void SetUp() override {
+    memtrack = IMemtrack::getService("memtrack");
+    ASSERT_NE(memtrack, nullptr);
+  }
+
+  virtual void TearDown() override {}
+
+  sp<IMemtrack> memtrack;
+};
+
+/* Returns true if flags contains at least min, and no more than max,
+ * of the flags in flagSet. Returns false otherwise.
+ */
+bool rightFlagCount(uint32_t flags, vector<MemtrackFlag> flagSet, uint32_t min,
+                    uint32_t max) {
+  uint32_t count =
+      count_if(flagSet.begin(), flagSet.end(),
+               [&](MemtrackFlag f) { return flags & (uint32_t)f; });
+  return (min <= count && count <= max);
+}
+
+/* Returns true when passed a valid, defined status, false otherwise.
+ */
+bool validStatus(MemtrackStatus s) {
+  vector<MemtrackStatus> statusVec = {
+      MemtrackStatus::SUCCESS, MemtrackStatus::MEMORY_TRACKING_NOT_SUPPORTED,
+      MemtrackStatus::TYPE_NOT_SUPPORTED};
+  return std::find(statusVec.begin(), statusVec.end(), s) != statusVec.end();
+}
+
+/* Returns a pid found in /proc for which the string read from
+ * /proc/[pid]/cmdline matches cmd, or -1 if no such pid exists.
+ */
+pid_t getPidFromCmd(const char cmd[], uint32_t len) {
+  const char procs[] = "/proc/";
+  DIR *dir = opendir(procs);
+  if (!dir) {
+    return -1;
+  }
+
+  struct dirent *proc;
+  while ((proc = readdir(dir)) != NULL) {
+    if (!isdigit(proc->d_name[0])) {
+      continue;
+    }
+    char line[len];
+    char fname[PATH_MAX];
+    snprintf(fname, PATH_MAX, "/proc/%s/cmdline", proc->d_name);
+
+    FILE *file = fopen(fname, "r");
+    if (!file) {
+      continue;
+    }
+    char *str = fgets(line, len, file);
+    fclose(file);
+    if (!str || strcmp(str, cmd)) {
+      continue;
+    } else {
+      closedir(dir);
+      return atoi(proc->d_name);
+    }
+  }
+  closedir(dir);
+  return -1;
+}
+
+auto generate_cb(MemtrackStatus *s, hidl_vec<MemtrackRecord> *v) {
+  return [=](MemtrackStatus status, hidl_vec<MemtrackRecord> vec) {
+    *s = status;
+    *v = vec;
+  };
+}
+
+/* Sanity check results when getMemory() is passed a negative PID
+ */
+TEST_F(MemtrackHidlTest, BadPidTest) {
+  MemtrackStatus s;
+  hidl_vec<MemtrackRecord> v;
+  auto cb = generate_cb(&s, &v);
+  for (uint32_t i = 0; i < static_cast<uint32_t>(MemtrackType::NUM_TYPES);
+       i++) {
+    Return<void> ret =
+        memtrack->getMemory(-1, static_cast<MemtrackType>(i), cb);
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_TRUE(validStatus(s));
+  }
+}
+
+/* Sanity check results when getMemory() is passed a bad memory usage type
+ */
+TEST_F(MemtrackHidlTest, BadTypeTest) {
+  MemtrackStatus s;
+  hidl_vec<MemtrackRecord> v;
+  auto cb = generate_cb(&s, &v);
+  Return<void> ret = memtrack->getMemory(getpid(), MemtrackType::NUM_TYPES, cb);
+  ASSERT_TRUE(ret.isOk());
+  ASSERT_TRUE(validStatus(s));
+}
+
+/* Call memtrack on the surfaceflinger process and check that the results are
+ * reasonable for all memory types, including valid flag combinations for
+ * every MemtrackRecord returned.
+ */
+TEST_F(MemtrackHidlTest, SurfaceflingerTest) {
+  const char cmd[] = "/system/bin/surfaceflinger";
+  const uint32_t len = sizeof(cmd);
+  pid_t pid = getPidFromCmd(cmd, len);
+  ASSERT_LE(0, pid) << "Surfaceflinger process not found";
+
+  MemtrackStatus s;
+  hidl_vec<MemtrackRecord> v;
+  auto cb = generate_cb(&s, &v);
+  uint32_t unsupportedCount = 0;
+  for (uint32_t i = 0; i < static_cast<uint32_t>(MemtrackType::NUM_TYPES);
+       i++) {
+    Return<void> ret =
+        memtrack->getMemory(pid, static_cast<MemtrackType>(i), cb);
+    ASSERT_TRUE(ret.isOk());
+
+    switch (s) {
+      case MemtrackStatus::MEMORY_TRACKING_NOT_SUPPORTED:
+        unsupportedCount++;
+        break;
+      case MemtrackStatus::TYPE_NOT_SUPPORTED:
+        break;
+      case MemtrackStatus::SUCCESS: {
+        for (uint32_t j = 0; j < v.size(); j++) {
+          // Enforce flag constraints
+          vector<MemtrackFlag> smapFlags = {MemtrackFlag::SMAPS_ACCOUNTED,
+                                            MemtrackFlag::SMAPS_UNACCOUNTED};
+          EXPECT_TRUE(rightFlagCount(v[j].flags, smapFlags, 1, 1));
+          vector<MemtrackFlag> shareFlags = {MemtrackFlag::SHARED,
+                                             MemtrackFlag::SHARED_PSS,
+                                             MemtrackFlag::PRIVATE};
+          EXPECT_TRUE(rightFlagCount(v[j].flags, shareFlags, 0, 1));
+          vector<MemtrackFlag> systemFlags = {MemtrackFlag::SYSTEM,
+                                              MemtrackFlag::DEDICATED};
+          EXPECT_TRUE(rightFlagCount(v[j].flags, systemFlags, 0, 1));
+          vector<MemtrackFlag> secureFlags = {MemtrackFlag::SECURE,
+                                              MemtrackFlag::NONSECURE};
+          EXPECT_TRUE(rightFlagCount(v[j].flags, secureFlags, 0, 1));
+        }
+        break;
+      }
+      default:
+        FAIL();
+    }
+  }
+  // If tracking is not supported this should be returned for all types.
+  ASSERT_TRUE(unsupportedCount == 0 ||
+              unsupportedCount ==
+                  static_cast<uint32_t>(MemtrackType::NUM_TYPES));
+}
+
+int main(int argc, char **argv) {
+  ::testing::InitGoogleTest(&argc, argv);
+  int status = RUN_ALL_TESTS();
+  LOG(INFO) << "Test result = " << status;
+  return status;
+}
diff --git a/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/Android.mk b/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/Android.mk
new file mode 100644
index 0000000..8dcaabb
--- /dev/null
+++ b/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/Android.mk
@@ -0,0 +1,25 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := HalMemtrackHidlTargetTest
+VTS_CONFIG_SRC_DIR := testcases/hal/memtrack/hidl/target
+include test/vts/tools/build/Android.host_config.mk
diff --git a/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/AndroidTest.xml b/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/AndroidTest.xml
new file mode 100644
index 0000000..7fb286b
--- /dev/null
+++ b/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/AndroidTest.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2016 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS Memtrack HIDL HAL's target-side test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer" />
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="HalMemtrackHidlTargetTest"/>
+        <option name="binary-test-sources" value="
+            _32bit::DATA/nativetest/memtrack_hidl_hal_test/memtrack_hidl_hal_test,
+            _64bit::DATA/nativetest64/memtrack_hidl_hal_test/memtrack_hidl_hal_test,
+            "/>
+        <option name="test-config-path" value="vts/testcases/hal/memtrack/hidl/target/HalMemtrackHidlTargetTest.config" />
+        <option name="binary-test-type" value="gtest" />
+        <option name="test-timeout" value="5m" />
+    </test>
+</configuration>
diff --git a/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/HalMemtrackHidlTargetTest.config b/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/HalMemtrackHidlTargetTest.config
new file mode 100644
index 0000000..d2597a2
--- /dev/null
+++ b/memtrack/1.0/vts/functional/vts/testcases/hal/memtrack/hidl/target/HalMemtrackHidlTargetTest.config
@@ -0,0 +1,20 @@
+{
+    "use_gae_db": true,
+    "coverage": true,
+    "modules": [
+        {
+            "module_name": "system/lib64/hw/memtrack.msm8992",
+            "git_project": {
+                "name": "platform/hardware/qcom/display",
+                "path": "hardware/qcom/display"
+            }
+        },
+        {
+            "module_name": "system/lib64/hw/android.hardware.memtrack@1.0-impl",
+            "git_project": {
+                "name": "platform/hardware/interfaces",
+                "path": "hardware/interfaces"
+            }
+        }
+    ]
+}
diff --git a/memtrack/Android.bp b/memtrack/Android.bp
index ba90f2c..ed19a37 100644
--- a/memtrack/Android.bp
+++ b/memtrack/Android.bp
@@ -2,4 +2,5 @@
 subdirs = [
     "1.0",
     "1.0/default",
+    "1.0/vts/functional",
 ]
diff --git a/power/1.0/vts/functional/power_hidl_hal_test.cpp b/power/1.0/vts/functional/power_hidl_hal_test.cpp
index 8833c04..045a34b 100644
--- a/power/1.0/vts/functional/power_hidl_hal_test.cpp
+++ b/power/1.0/vts/functional/power_hidl_hal_test.cpp
@@ -35,18 +35,8 @@
 class PowerHidlTest : public ::testing::Test {
  public:
   virtual void SetUp() override {
-    // TODO(b/33385836) Delete copied code
-    bool getStub = false;
-    char getSubProperty[PROPERTY_VALUE_MAX];
-    if (property_get("vts.hidl.get_stub", getSubProperty, "") > 0) {
-        if (!strcmp(getSubProperty, "true") || !strcmp(getSubProperty, "True") ||
-            !strcmp(getSubProperty, "1")) {
-            getStub = true;
-        }
-    }
-    power = IPower::getService("power", getStub);
+    power = IPower::getService("power");
     ASSERT_NE(power, nullptr);
-    ASSERT_EQ(!getStub, power->isRemote());
   }
 
   virtual void TearDown() override {}
diff --git a/power/1.0/vts/functional/vts/testcases/hal/power/hidl/target/AndroidTest.xml b/power/1.0/vts/functional/vts/testcases/hal/power/hidl/target/AndroidTest.xml
index bb80de2..0eb2142 100644
--- a/power/1.0/vts/functional/vts/testcases/hal/power/hidl/target/AndroidTest.xml
+++ b/power/1.0/vts/functional/vts/testcases/hal/power/hidl/target/AndroidTest.xml
@@ -24,6 +24,7 @@
             _32bit::DATA/nativetest/power_hidl_hal_test/power_hidl_hal_test,
             _64bit::DATA/nativetest64/power_hidl_hal_test/power_hidl_hal_test,
             "/>
+        <option name="test-config-path" value="vts/testcases/hal/power/hidl/target/HalPowerHidlTargetTest.config" />
         <option name="binary-test-type" value="gtest" />
         <option name="test-timeout" value="1m" />
     </test>
diff --git a/power/1.0/vts/functional/vts/testcases/hal/power/hidl/target/HalPowerHidlTargetTest.config b/power/1.0/vts/functional/vts/testcases/hal/power/hidl/target/HalPowerHidlTargetTest.config
new file mode 100644
index 0000000..54c0175
--- /dev/null
+++ b/power/1.0/vts/functional/vts/testcases/hal/power/hidl/target/HalPowerHidlTargetTest.config
@@ -0,0 +1,34 @@
+{
+    "use_gae_db": true,
+    "coverage": true,
+    "modules": [
+        {
+            "module_name": "system/lib64/hw/power.bullhead",
+            "git_project": {
+                "name": "device/lge/bullhead",
+                "path": "device/lge/bullhead"
+            }
+        },
+        {
+            "module_name": "system/lib64/hw/power.marlin",
+            "git_project": {
+                "name": "device/google/marlin",
+                "path": "device/google/marlin"
+            }
+        },
+        {
+            "module_name": "system/lib64/hw/power.sailfish",
+            "git_project": {
+                "name": "device/google/marlin",
+                "path": "device/google/marlin"
+            }
+        },
+        {
+            "module_name": "system/lib64/hw/android.hardware.power@1.0-impl",
+            "git_project": {
+                "name": "platform/hardware/interfaces",
+                "path": "hardware/interfaces"
+            }
+        }
+    ]
+}
diff --git a/sensors/1.0/Android.bp b/sensors/1.0/Android.bp
index ed65265..437b545 100644
--- a/sensors/1.0/Android.bp
+++ b/sensors/1.0/Android.bp
@@ -54,3 +54,61 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.sensors.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.sensors@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/sensors/1.0/ $(genDir)/android/hardware/sensors/1.0/",
+    srcs: [
+        "types.hal",
+        "ISensors.hal",
+    ],
+    out: [
+        "android/hardware/sensors/1.0/types.vts.cpp",
+        "android/hardware/sensors/1.0/Sensors.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.sensors.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.sensors@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/sensors/1.0/ $(genDir)/android/hardware/sensors/1.0/",
+    srcs: [
+        "types.hal",
+        "ISensors.hal",
+    ],
+    out: [
+        "android/hardware/sensors/1.0/types.vts.h",
+        "android/hardware/sensors/1.0/Sensors.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.sensors.vts.driver@1.0",
+    generated_sources: ["android.hardware.sensors.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.sensors.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.sensors.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hidl.base@1.0",
+        "android.hardware.sensors@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/sensors/1.0/vts/Android.mk b/sensors/1.0/vts/Android.mk
index df8d66f..93bbd96 100644
--- a/sensors/1.0/vts/Android.mk
+++ b/sensors/1.0/vts/Android.mk
@@ -16,36 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Sensors v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_sensors@1.0
-
-LOCAL_SRC_FILES := \
-  Sensors.vts \
-  types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.sensors@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for sensors.
 include $(CLEAR_VARS)
 
diff --git a/tests/bar/1.0/Android.bp b/tests/bar/1.0/Android.bp
index 6ef8ac2..e4c79fa 100644
--- a/tests/bar/1.0/Android.bp
+++ b/tests/bar/1.0/Android.bp
@@ -6,10 +6,12 @@
     cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tests.bar@1.0",
     srcs: [
         "IBar.hal",
+        "IComplicated.hal",
         "IImportTypes.hal",
     ],
     out: [
         "android/hardware/tests/bar/1.0/BarAll.cpp",
+        "android/hardware/tests/bar/1.0/ComplicatedAll.cpp",
         "android/hardware/tests/bar/1.0/ImportTypesAll.cpp",
     ],
 }
@@ -20,6 +22,7 @@
     cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tests.bar@1.0",
     srcs: [
         "IBar.hal",
+        "IComplicated.hal",
         "IImportTypes.hal",
     ],
     out: [
@@ -28,6 +31,11 @@
         "android/hardware/tests/bar/1.0/BnBar.h",
         "android/hardware/tests/bar/1.0/BpBar.h",
         "android/hardware/tests/bar/1.0/BsBar.h",
+        "android/hardware/tests/bar/1.0/IComplicated.h",
+        "android/hardware/tests/bar/1.0/IHwComplicated.h",
+        "android/hardware/tests/bar/1.0/BnComplicated.h",
+        "android/hardware/tests/bar/1.0/BpComplicated.h",
+        "android/hardware/tests/bar/1.0/BsComplicated.h",
         "android/hardware/tests/bar/1.0/IImportTypes.h",
         "android/hardware/tests/bar/1.0/IHwImportTypes.h",
         "android/hardware/tests/bar/1.0/BnImportTypes.h",
diff --git a/tests/bar/1.0/IBar.hal b/tests/bar/1.0/IBar.hal
index 21c3473..5f94d07 100644
--- a/tests/bar/1.0/IBar.hal
+++ b/tests/bar/1.0/IBar.hal
@@ -17,9 +17,12 @@
 package android.hardware.tests.bar@1.0;
 
 import android.hardware.tests.foo@1.0::IFoo;
+import android.hardware.tests.foo@1.0::ISimple;
 import android.hardware.tests.foo@1.0::Abc;
 import android.hardware.tests.foo@1.0::Unrelated;
 
+import IComplicated;
+
 interface IBar extends android.hardware.tests.foo@1.0::IFoo {
 
     typedef android.hardware.tests.foo@1.0::IFoo FunkyAlias;
@@ -33,4 +36,6 @@
     expectNullHandle(handle h, Abc xyz) generates (bool hIsNull, bool xyzHasNull);
     takeAMask(BitField bf, bitfield<BitField> first, MyMask second, Mask third)
             generates (BitField bf, uint8_t first, uint8_t second, uint8_t third);
+
+    haveAInterface(ISimple i) generates (ISimple i);
 };
diff --git a/tests/bar/1.0/IComplicated.hal b/tests/bar/1.0/IComplicated.hal
new file mode 100644
index 0000000..deaef8d
--- /dev/null
+++ b/tests/bar/1.0/IComplicated.hal
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tests.bar@1.0;
+
+import android.hardware.tests.foo@1.0::ISimple;
+
+interface IComplicated extends ISimple {
+};
diff --git a/tests/bar/1.0/default/Bar.cpp b/tests/bar/1.0/default/Bar.cpp
index a750fe4..4152bb9 100644
--- a/tests/bar/1.0/default/Bar.cpp
+++ b/tests/bar/1.0/default/Bar.cpp
@@ -165,6 +165,13 @@
     return Void();
 }
 
+Return<void> Bar::haveAInterface(const sp<ISimple> &in,
+            haveAInterface_cb _hidl_cb) {
+    _hidl_cb(in);
+    return Void();
+}
+
+
 IBar* HIDL_FETCH_IBar(const char* /* name */) {
     return new Bar();
 }
diff --git a/tests/bar/1.0/default/Bar.h b/tests/bar/1.0/default/Bar.h
index 71737fe..70bffe7 100644
--- a/tests/bar/1.0/default/Bar.h
+++ b/tests/bar/1.0/default/Bar.h
@@ -71,6 +71,8 @@
 
     Return<void> takeAMask(BitField bf, uint8_t first, const MyMask& second, uint8_t third,
             takeAMask_cb _hidl_cb) override;
+    Return<void> haveAInterface(const sp<ISimple> &in,
+            haveAInterface_cb _hidl_cb) override;
 
 private:
     sp<IFoo> mFoo;
diff --git a/tests/baz/1.0/IBaz.hal b/tests/baz/1.0/IBaz.hal
index 3e1e2b9..7c5d63a 100644
--- a/tests/baz/1.0/IBaz.hal
+++ b/tests/baz/1.0/IBaz.hal
@@ -49,6 +49,10 @@
     doStuffAndReturnAString() generates (string something);
     mapThisVector(vec<int32_t> param) generates (vec<int32_t> something);
     callMe(IBazCallback cb);
+
+    callMeLater(IBazCallback cb);
+    iAmFreeNow();
+
     useAnEnum(SomeEnum zzz) generates (SomeEnum kkk);
 
     haveSomeStrings(string[3] array) generates (string[2] result);
diff --git a/tests/baz/1.0/IBazCallback.hal b/tests/baz/1.0/IBazCallback.hal
index b59a107..503b970 100644
--- a/tests/baz/1.0/IBazCallback.hal
+++ b/tests/baz/1.0/IBazCallback.hal
@@ -18,4 +18,5 @@
 
 interface IBazCallback {
     heyItsMe(IBazCallback cb);
+    hey();
 };
diff --git a/tests/foo/1.0/ISimple.hal b/tests/foo/1.0/ISimple.hal
index 92e9d95..0d45835 100644
--- a/tests/foo/1.0/ISimple.hal
+++ b/tests/foo/1.0/ISimple.hal
@@ -18,4 +18,8 @@
 
 interface ISimple {
     getCookie() generates (int32_t cookie);
+    customVecInt() generates (vec<int32_t> chain);
+    customVecStr() generates (vec<string> chain);
+    mystr() generates (string str);
+    myhandle() generates (handle str);
 };
diff --git a/thermal/1.0/vts/Android.mk b/thermal/1.0/vts/Android.mk
index ef926fe..644b2ed 100644
--- a/thermal/1.0/vts/Android.mk
+++ b/thermal/1.0/vts/Android.mk
@@ -16,43 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for Thermal v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_thermal@1.0
-
-LOCAL_SRC_FILES := \
-  Thermal.vts \
-  types.vts \
-
-LOCAL_C_INCLUDES := \
-  android.hardware.thermal@1.0 \
-  system/core/base/include \
-  system/core/include \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.thermal@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_STATIC_LIBRARIES := \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
 # build profiler for thermal.
 include $(CLEAR_VARS)
 
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
index ba062d9..cd2374a 100644
--- a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
@@ -34,11 +34,15 @@
         self.dut.shell.InvokeTerminal("one")
         self.dut.shell.one.Execute("setenforce 0")  # SELinux permissive mode
 
+        self.dut.shell.one.Execute(
+            "setprop vts.hal.vts.hidl.get_stub true")
+
         self.dut.hal.InitHidlHal(target_type="tv_cec",
                                  target_basepaths=["/system/lib64"],
                                  target_version=1.0,
                                  target_package="android.hardware.tv.cec",
                                  target_component_name="IHdmiCec",
+                                 hw_binder_service_name="tv.cec",
                                  bits=64)
 
     def testGetCecVersion1(self):
diff --git a/tv/input/1.0/vts/Android.mk b/tv/input/1.0/vts/Android.mk
index f8610dd..5a60edc 100644
--- a/tv/input/1.0/vts/Android.mk
+++ b/tv/input/1.0/vts/Android.mk
@@ -16,39 +16,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS driver for TvInput v1.0.
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_driver_hidl_tv_input@1.0
-
-LOCAL_SRC_FILES := \
-  TvInput.vts \
-  TvInputCallback.vts \
-  types.vts \
-  ../../../../audio/common/2.0/vts/types.vts \
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.tv.input@1.0 \
-  libbase \
-  libutils \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_datatype \
-  libvts_measurement \
-  libvts_multidevice_proto \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
-
 # build VTS profiler for TvInput
 include $(CLEAR_VARS)
 
diff --git a/vehicle/2.0/Android.mk b/vehicle/2.0/Android.mk
index 3393dac..71b587b 100644
--- a/vehicle/2.0/Android.mk
+++ b/vehicle/2.0/Android.mk
@@ -701,25 +701,6 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (VehiclePermissionModel)
-#
-GEN := $(intermediates)/android/hardware/vehicle/V2_0/VehiclePermissionModel.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.vehicle@2.0::types.VehiclePermissionModel
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
 # Build types.hal (VehiclePropConfig)
 #
 GEN := $(intermediates)/android/hardware/vehicle/V2_0/VehiclePropConfig.java
@@ -1673,25 +1654,6 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (VehiclePermissionModel)
-#
-GEN := $(intermediates)/android/hardware/vehicle/V2_0/VehiclePermissionModel.java
-$(GEN): $(HIDL)
-$(GEN): PRIVATE_HIDL := $(HIDL)
-$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
-$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
-$(GEN): PRIVATE_CUSTOM_TOOL = \
-        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
-        -Ljava \
-        -randroid.hardware:hardware/interfaces \
-        -randroid.hidl:system/libhidl/transport \
-        android.hardware.vehicle@2.0::types.VehiclePermissionModel
-
-$(GEN): $(LOCAL_PATH)/types.hal
-	$(transform-generated-source)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
-#
 # Build types.hal (VehiclePropConfig)
 #
 GEN := $(intermediates)/android/hardware/vehicle/V2_0/VehiclePropConfig.java
diff --git a/vehicle/2.0/default/impl/DefaultConfig.h b/vehicle/2.0/default/impl/DefaultConfig.h
index 5b6a9b7..77ee9d4 100644
--- a/vehicle/2.0/default/impl/DefaultConfig.h
+++ b/vehicle/2.0/default/impl/DefaultConfig.h
@@ -32,14 +32,12 @@
         .prop = VehicleProperty::INFO_MAKE,
         .access = VehiclePropertyAccess::READ,
         .changeMode = VehiclePropertyChangeMode::STATIC,
-        .permissionModel = VehiclePermissionModel::OEM_ONLY,
     },
 
     {
         .prop = VehicleProperty::HVAC_POWER_ON,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = toInt(VehicleAreaZone::ROW_1)
     },
 
@@ -47,7 +45,6 @@
         .prop = VehicleProperty::HVAC_DEFROSTER,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas =
                 VehicleAreaWindow::FRONT_WINDSHIELD
                 | VehicleAreaWindow::REAR_WINDSHIELD
@@ -57,7 +54,6 @@
         .prop = VehicleProperty::HVAC_RECIRC_ON,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = toInt(VehicleAreaZone::ROW_1)
     },
 
@@ -65,7 +61,6 @@
         .prop = VehicleProperty::HVAC_AC_ON,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = toInt(VehicleAreaZone::ROW_1)
     },
 
@@ -73,7 +68,6 @@
         .prop = VehicleProperty::HVAC_AUTO_ON,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = toInt(VehicleAreaZone::ROW_1)
     },
 
@@ -81,7 +75,6 @@
         .prop = VehicleProperty::HVAC_FAN_SPEED,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = toInt(VehicleAreaZone::ROW_1),
         .areaConfigs = {
             VehicleAreaConfig {
@@ -96,7 +89,6 @@
         .prop = VehicleProperty::HVAC_FAN_DIRECTION,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = toInt(VehicleAreaZone::ROW_1),
     },
 
@@ -104,7 +96,6 @@
         .prop = VehicleProperty::HVAC_TEMPERATURE_SET,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas =
                 VehicleAreaZone::ROW_1_LEFT
                 | VehicleAreaZone::ROW_1_RIGHT,
@@ -126,28 +117,24 @@
         .prop = VehicleProperty::NIGHT_MODE,
         .access = VehiclePropertyAccess::READ,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
     },
 
     {
         .prop = VehicleProperty::DRIVING_STATUS,
         .access = VehiclePropertyAccess::READ,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
     },
 
     {
         .prop = VehicleProperty::GEAR_SELECTION,
         .access = VehiclePropertyAccess::READ,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
     },
 
     {
         .prop = VehicleProperty::INFO_FUEL_CAPACITY,
         .access = VehiclePropertyAccess::READ,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::OEM_ONLY,
         .areaConfigs = {
             VehicleAreaConfig {
                 .minFloatValue = 0,
@@ -160,7 +147,6 @@
         .prop = VehicleProperty::DISPLAY_BRIGHTNESS,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::OEM_ONLY,
         .areaConfigs = {
             VehicleAreaConfig {
                 .minInt32Value = 0,
diff --git a/vehicle/2.0/default/tests/VehicleHalTestUtils.h b/vehicle/2.0/default/tests/VehicleHalTestUtils.h
index 586b5ab..77541fc 100644
--- a/vehicle/2.0/default/tests/VehicleHalTestUtils.h
+++ b/vehicle/2.0/default/tests/VehicleHalTestUtils.h
@@ -32,7 +32,6 @@
         .prop = VehicleProperty::INFO_MAKE,
         .access = VehiclePropertyAccess::READ,
         .changeMode = VehiclePropertyChangeMode::STATIC,
-        .permissionModel = VehiclePermissionModel::OEM_ONLY,
         .configString = "Some=config,options=if,you=have_any",
     },
 
@@ -40,7 +39,6 @@
         .prop = VehicleProperty::HVAC_FAN_SPEED,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = static_cast<int32_t>(
             VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT),
         .areaConfigs = {
@@ -61,7 +59,6 @@
         .prop = VehicleProperty::HVAC_SEAT_TEMPERATURE,
         .access = VehiclePropertyAccess::WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_SET,
-        .permissionModel = VehiclePermissionModel::NO_RESTRICTION,
         .supportedAreas = static_cast<int32_t>(
             VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT),
         .areaConfigs = {
@@ -81,7 +78,6 @@
         .prop = VehicleProperty::INFO_FUEL_CAPACITY,
         .access = VehiclePropertyAccess::READ,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::OEM_ONLY,
         .areaConfigs = {
             VehicleAreaConfig {
                 .minFloatValue = 0,
@@ -94,7 +90,6 @@
         .prop = VehicleProperty::DISPLAY_BRIGHTNESS,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::OEM_ONLY,
         .areaConfigs = {
             VehicleAreaConfig {
                 .minInt32Value = 0,
@@ -107,7 +102,6 @@
         .prop = VehicleProperty::MIRROR_FOLD,
         .access = VehiclePropertyAccess::READ_WRITE,
         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .permissionModel = VehiclePermissionModel::OEM_ONLY,
 
     }
 };
@@ -238,7 +232,6 @@
        << "  prop: " << enumToHexString(config.prop) << ",\n"
        << "  supportedAreas: " << hexString(config.supportedAreas) << ",\n"
        << "  access: " << enumToHexString(config.access) << ",\n"
-       << "  permissionModel: " << enumToHexString(config.permissionModel) << ",\n"
        << "  changeMode: " << enumToHexString(config.changeMode) << ",\n"
        << "  configFlags: " << hexString(config.configFlags) << ",\n"
        << "  minSampleRate: " << config.minSampleRate << ",\n"
diff --git a/vehicle/2.0/types.hal b/vehicle/2.0/types.hal
index 7f6eb7e..850efa7 100644
--- a/vehicle/2.0/types.hal
+++ b/vehicle/2.0/types.hal
@@ -1626,6 +1626,20 @@
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
         | VehicleArea:GLOBAL),
+
+    /*
+     * Vehicle Maps Data Service
+     *
+     * A VMDS message.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     */
+    VEHICLE_MAPS_DATA_SERVICE = (
+        0x0C00
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:BYTES
+        | VehicleArea:GLOBAL),
 };
 
 /*
@@ -2156,30 +2170,6 @@
 };
 
 /*
- * These permissions define how the OEMs want to distribute their information
- * and security they want to apply. On top of these restrictions, android will
- * have additional 'app-level' permissions that the apps will need to ask the
- * user before the apps have the information.
- * This information must be kept in VehiclePropConfig#permissionModel.
- */
-enum VehiclePermissionModel : int32_t {
-  /*
-   * No special restriction, but each property can still require specific
-   * android app-level permission.
-   */
-  NO_RESTRICTION = 0,
-
-  /* Signature only. Only APKs signed with OEM keys are allowed. */
-  OEM_ONLY = 0x1,
-
-  /* System only. APKs built-in to system  can access the property. */
-  SYSTEM_APP_ONLY = 0x2,
-
-  /* Equivalent to “system|signature” */
-  OEM_OR_SYSTEM_APP = 0x3,
-};
-
-/*
  * Car states.
  *
  * The driving states determine what features of the UI will be accessible.
@@ -2323,11 +2313,6 @@
     VehiclePropertyChangeMode changeMode;
 
     /*
-     * Defines permission model to access the data.
-     */
-    VehiclePermissionModel permissionModel;
-
-    /*
      * Some of the properties may have associated areas (for example, some hvac
      * properties are associated with VehicleAreaZone), in these
      * cases the config may contain an ORed value for the associated areas.
diff --git a/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py b/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
index bc37e59..8da36d1 100644
--- a/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
+++ b/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
@@ -33,6 +33,7 @@
         self.dut = self.registerController(android_device)[0]
 
         self.dut.shell.InvokeTerminal("one")
+        self.dut.shell.one.Execute("setenforce 0")  # SELinux permissive mode
 
         if self.enable_profiling:
             profiling_utils.EnableVTSProfiling(self.dut.shell.one)
@@ -55,25 +56,13 @@
             self.ProcessAndUploadTraceData(self.dut, profiling_trace_path)
             profiling_utils.DisableVTSProfiling(self.dut.shell.one)
 
-    def testEcho1(self):
-        """A simple testcase which sends a command."""
-        self.dut.shell.InvokeTerminal("my_shell1")  # creates a remote shell instance.
-        results = self.dut.shell.my_shell1.Execute("echo hello_world")  # runs a shell command.
-        logging.info(str(results[const.STDOUT]))  # prints the stdout
-        asserts.assertEqual(results[const.STDOUT][0].strip(), "hello_world")  # checks the stdout
-        asserts.assertEqual(results[const.EXIT_CODE][0], 0)  # checks the exit code
+    def testListProperties(self):
+        logging.info("vehicle_types")
+        vehicle_types = self.dut.hal.vehicle.GetHidlTypeInterface("types")
+        logging.info("vehicle_types: %s", vehicle_types)
 
-    def testEcho2(self):
-        """A simple testcase which sends two commands."""
-        self.dut.shell.InvokeTerminal("my_shell2")
-        my_shell = getattr(self.dut.shell, "my_shell2")
-        results = my_shell.Execute(["echo hello", "echo world"])
-        logging.info(str(results[const.STDOUT]))
-        asserts.assertEqual(len(results[const.STDOUT]), 2)  # check the number of processed commands
-        asserts.assertEqual(results[const.STDOUT][0].strip(), "hello")
-        asserts.assertEqual(results[const.STDOUT][1].strip(), "world")
-        asserts.assertEqual(results[const.EXIT_CODE][0], 0)
-        asserts.assertEqual(results[const.EXIT_CODE][1], 0)
+        allConfigs = self.dut.hal.vehicle.getAllPropConfigs()
+        logging.info("all supported properties: %s", allConfigs)
 
 if __name__ == "__main__":
     test_runner.main()
diff --git a/vehicle/2.0/vts/types.vts b/vehicle/2.0/vts/types.vts
index fc63add..99fa6e7 100644
--- a/vehicle/2.0/vts/types.vts
+++ b/vehicle/2.0/vts/types.vts
@@ -1149,6 +1149,10 @@
     enum_value: {
         scalar_type: "int32_t"
 
+        enumerator: "NONE"
+        scalar_value: {
+            int32_t: 0
+        }
         enumerator: "READ"
         scalar_value: {
             int32_t: 1
@@ -1165,31 +1169,6 @@
 }
 
 attribute: {
-    name: "::android::hardware::vehicle::V2_0::VehiclePermissionModel"
-    type: TYPE_ENUM
-    enum_value: {
-        scalar_type: "int32_t"
-
-        enumerator: "NO_RESTRICTION"
-        scalar_value: {
-            int32_t: 0
-        }
-        enumerator: "OEM_ONLY"
-        scalar_value: {
-            int32_t: 1
-        }
-        enumerator: "SYSTEM_APP_ONLY"
-        scalar_value: {
-            int32_t: 2
-        }
-        enumerator: "OEM_OR_SYSTEM_APP"
-        scalar_value: {
-            int32_t: 3
-        }
-    }
-}
-
-attribute: {
     name: "::android::hardware::vehicle::V2_0::VehicleDrivingStatus"
     type: TYPE_ENUM
     enum_value: {
@@ -1600,11 +1579,6 @@
         predefined_type: "::android::hardware::vehicle::V2_0::VehiclePropertyChangeMode"
     }
     struct_value: {
-        name: "permissionModel"
-        type: TYPE_ENUM
-        predefined_type: "::android::hardware::vehicle::V2_0::VehiclePermissionModel"
-    }
-    struct_value: {
         name: "supportedAreas"
         type: TYPE_SCALAR
         scalar_type: "int32_t"
diff --git a/wifi/1.0/vts/functional/Android.bp b/wifi/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..422eec5
--- /dev/null
+++ b/wifi/1.0/vts/functional/Android.bp
@@ -0,0 +1,50 @@
+//
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "wifi_hidl_test",
+    gtest: true,
+    srcs: [
+        "main.cpp",
+        "wifi_ap_iface_hidl_test.cpp",
+        "wifi_chip_hidl_test.cpp",
+        "wifi_hidl_test.cpp",
+        "wifi_hidl_test_utils.cpp",
+        "wifi_nan_iface_hidl_test.cpp",
+        "wifi_p2p_iface_hidl_test.cpp",
+        "wifi_rtt_controller_hidl_test.cpp",
+        "wifi_sta_iface_hidl_test.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libnativehelper",
+        "libutils",
+        "android.hardware.wifi@1.0",
+    ],
+    static_libs: ["libgtest"],
+    cflags: [
+        "--coverage",
+        "-O0",
+        "-g",
+    ],
+    ldflags: [
+        "--coverage"
+    ]
+}
diff --git a/wifi/1.0/vts/functional/Android.mk b/wifi/1.0/vts/functional/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/wifi/1.0/vts/functional/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/wifi/1.0/vts/functional/main.cpp b/wifi/1.0/vts/functional/main.cpp
new file mode 100644
index 0000000..b33b5eb
--- /dev/null
+++ b/wifi/1.0/vts/functional/main.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+class WifiHidlEnvironment : public ::testing::Environment {
+   public:
+    virtual void SetUp() override { stopFramework(); }
+    virtual void TearDown() override { startFramework(); }
+
+   private:
+};
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(new WifiHidlEnvironment);
+    ::testing::InitGoogleTest(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    return status;
+}
diff --git a/wifi/1.0/vts/functional/wifi_ap_iface_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_ap_iface_hidl_test.cpp
new file mode 100644
index 0000000..dc7b0b9
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_ap_iface_hidl_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.0/IWifiApIface.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifiApIface;
+using ::android::sp;
+
+/**
+ * Fixture to use for all AP Iface HIDL interface tests.
+ */
+class WifiApIfaceHidlTest : public ::testing::Test {
+   public:
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifiApIface proxy object is
+ * successfully created.
+ */
+TEST(WifiApIfaceHidlTestNoFixture, Create) {
+    EXPECT_NE(nullptr, getWifiApIface().get());
+    stopWifi();
+}
diff --git a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
new file mode 100644
index 0000000..b6ecd8b
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.0/IWifiChip.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifiChip;
+using ::android::sp;
+
+/**
+ * Fixture to use for all Wifi chip HIDL interface tests.
+ */
+class WifiChipHidlTest : public ::testing::Test {
+   public:
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifiChip proxy object is
+ * successfully created.
+ */
+TEST(WifiChipHidlTestNoFixture, Create) {
+    EXPECT_NE(nullptr, getWifiChip().get());
+    stopWifi();
+}
diff --git a/wifi/1.0/vts/functional/wifi_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_hidl_test.cpp
new file mode 100644
index 0000000..3e350e5
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_hidl_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.0/IWifi.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifi;
+using ::android::sp;
+
+/**
+ * Fixture to use for all root Wifi HIDL interface tests.
+ */
+class WifiHidlTest : public ::testing::Test {
+   public:
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifi proxy object is
+ * successfully created.
+ */
+TEST(WifiHidlTestNoFixture, Create) {
+    EXPECT_NE(nullptr, getWifi().get());
+    stopWifi();
+}
diff --git a/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp b/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
new file mode 100644
index 0000000..f88b866
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
@@ -0,0 +1,278 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifi;
+using ::android::hardware::wifi::V1_0::IWifiApIface;
+using ::android::hardware::wifi::V1_0::IWifiChip;
+using ::android::hardware::wifi::V1_0::IWifiNanIface;
+using ::android::hardware::wifi::V1_0::IWifiP2pIface;
+using ::android::hardware::wifi::V1_0::IWifiRttController;
+using ::android::hardware::wifi::V1_0::IWifiStaIface;
+using ::android::hardware::wifi::V1_0::ChipModeId;
+using ::android::hardware::wifi::V1_0::ChipId;
+using ::android::hardware::wifi::V1_0::IfaceType;
+using ::android::hardware::wifi::V1_0::WifiStatus;
+using ::android::hardware::wifi::V1_0::WifiStatusCode;
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+
+const char kWifiServiceName[] = "wifi";
+
+void stopFramework() {
+    ASSERT_EQ(std::system("svc wifi disable"), 0);
+    sleep(5);
+}
+
+void startFramework() { ASSERT_EQ(std::system("svc wifi enable"), 0); }
+
+sp<IWifi> getWifi() {
+    sp<IWifi> wifi = IWifi::getService(kWifiServiceName);
+    return wifi;
+}
+
+sp<IWifiChip> getWifiChip() {
+    sp<IWifi> wifi = getWifi();
+    if (!wifi.get()) {
+        return nullptr;
+    }
+
+    bool operation_failed = false;
+    wifi->start([&](WifiStatus status) {
+        if (status.code != WifiStatusCode::SUCCESS) {
+            operation_failed = true;
+        }
+    });
+    if (operation_failed) {
+        return nullptr;
+    }
+
+    std::vector<ChipId> wifi_chip_ids;
+    wifi->getChipIds(
+        [&](const WifiStatus& status, const hidl_vec<ChipId>& chip_ids) {
+            if (status.code != WifiStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+            wifi_chip_ids = chip_ids;
+        });
+    // We don't expect more than 1 chip currently.
+    if (operation_failed || wifi_chip_ids.size() != 1) {
+        return nullptr;
+    }
+
+    sp<IWifiChip> wifi_chip;
+    wifi->getChip(wifi_chip_ids[0],
+                  [&](const WifiStatus& status, const sp<IWifiChip>& chip) {
+                      if (status.code != WifiStatusCode::SUCCESS) {
+                          operation_failed = true;
+                      }
+                      wifi_chip = chip;
+                  });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return wifi_chip;
+}
+
+// Since we currently only support one iface of each type. Just iterate thru the
+// modes of operation and find the mode ID to use for that iface type.
+bool findModeToSupportIfaceType(IfaceType type,
+                                const std::vector<IWifiChip::ChipMode>& modes,
+                                ChipModeId* mode_id) {
+    for (const auto& mode : modes) {
+        std::vector<IWifiChip::ChipIfaceCombination> combinations =
+            mode.availableCombinations;
+        for (const auto& combination : combinations) {
+            std::vector<IWifiChip::ChipIfaceCombinationLimit> iface_limits =
+                combination.limits;
+            for (const auto& iface_limit : iface_limits) {
+                std::vector<IfaceType> iface_types = iface_limit.types;
+                for (const auto& iface_type : iface_types) {
+                    if (iface_type == type) {
+                        *mode_id = mode.id;
+                        return true;
+                    }
+                }
+            }
+        }
+    }
+    return false;
+}
+
+bool configureChipToSupportIfaceType(const sp<IWifiChip>& wifi_chip,
+                                     IfaceType type) {
+    bool operation_failed = false;
+    std::vector<IWifiChip::ChipMode> chip_modes;
+    wifi_chip->getAvailableModes(
+        [&](WifiStatus status, const hidl_vec<IWifiChip::ChipMode>& modes) {
+            if (status.code != WifiStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+            chip_modes = modes;
+        });
+    if (operation_failed) {
+        return false;
+    }
+
+    ChipModeId mode_id;
+    if (!findModeToSupportIfaceType(type, chip_modes, &mode_id)) {
+        return false;
+    }
+
+    wifi_chip->configureChip(mode_id, [&](WifiStatus status) {
+        if (status.code != WifiStatusCode::SUCCESS) {
+            operation_failed = true;
+        }
+    });
+    if (operation_failed) {
+        return false;
+    }
+    return true;
+}
+
+sp<IWifiApIface> getWifiApIface() {
+    sp<IWifiChip> wifi_chip = getWifiChip();
+    if (!wifi_chip.get()) {
+        return nullptr;
+    }
+    if (!configureChipToSupportIfaceType(wifi_chip, IfaceType::AP)) {
+        return nullptr;
+    }
+
+    bool operation_failed = false;
+    sp<IWifiApIface> wifi_ap_iface;
+    wifi_chip->createApIface(
+        [&](const WifiStatus& status, const sp<IWifiApIface>& iface) {
+            if (status.code != WifiStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+            wifi_ap_iface = iface;
+        });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return wifi_ap_iface;
+}
+
+sp<IWifiNanIface> getWifiNanIface() {
+    sp<IWifiChip> wifi_chip = getWifiChip();
+    if (!wifi_chip.get()) {
+        return nullptr;
+    }
+    if (!configureChipToSupportIfaceType(wifi_chip, IfaceType::NAN)) {
+        return nullptr;
+    }
+
+    bool operation_failed = false;
+    sp<IWifiNanIface> wifi_nan_iface;
+    wifi_chip->createNanIface(
+        [&](const WifiStatus& status, const sp<IWifiNanIface>& iface) {
+            if (status.code != WifiStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+            wifi_nan_iface = iface;
+        });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return wifi_nan_iface;
+}
+
+sp<IWifiP2pIface> getWifiP2pIface() {
+    sp<IWifiChip> wifi_chip = getWifiChip();
+    if (!wifi_chip.get()) {
+        return nullptr;
+    }
+    if (!configureChipToSupportIfaceType(wifi_chip, IfaceType::P2P)) {
+        return nullptr;
+    }
+
+    bool operation_failed = false;
+    sp<IWifiP2pIface> wifi_p2p_iface;
+    wifi_chip->createP2pIface(
+        [&](const WifiStatus& status, const sp<IWifiP2pIface>& iface) {
+            if (status.code != WifiStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+            wifi_p2p_iface = iface;
+        });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return wifi_p2p_iface;
+}
+
+sp<IWifiStaIface> getWifiStaIface() {
+    sp<IWifiChip> wifi_chip = getWifiChip();
+    if (!wifi_chip.get()) {
+        return nullptr;
+    }
+    if (!configureChipToSupportIfaceType(wifi_chip, IfaceType::STA)) {
+        return nullptr;
+    }
+
+    bool operation_failed = false;
+    sp<IWifiStaIface> wifi_sta_iface;
+    wifi_chip->createStaIface(
+        [&](const WifiStatus& status, const sp<IWifiStaIface>& iface) {
+            if (status.code != WifiStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+            wifi_sta_iface = iface;
+        });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return wifi_sta_iface;
+}
+
+sp<IWifiRttController> getWifiRttController() {
+    sp<IWifiChip> wifi_chip = getWifiChip();
+    if (!wifi_chip.get()) {
+        return nullptr;
+    }
+    sp<IWifiStaIface> wifi_sta_iface = getWifiStaIface();
+    if (!wifi_sta_iface.get()) {
+        return nullptr;
+    }
+
+    bool operation_failed = false;
+    sp<IWifiRttController> wifi_rtt_controller;
+    wifi_chip->createRttController(
+        wifi_sta_iface, [&](const WifiStatus& status,
+                            const sp<IWifiRttController>& controller) {
+            if (status.code != WifiStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+            wifi_rtt_controller = controller;
+        });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return wifi_rtt_controller;
+}
+
+void stopWifi() {
+    sp<IWifi> wifi = getWifi();
+    ASSERT_NE(wifi, nullptr);
+    wifi->stop([](const WifiStatus& status) {
+        ASSERT_EQ(status.code, WifiStatusCode::SUCCESS);
+    });
+}
diff --git a/wifi/1.0/vts/functional/wifi_hidl_test_utils.h b/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
new file mode 100644
index 0000000..08933d9
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/hardware/wifi/1.0/IWifi.h>
+#include <android/hardware/wifi/1.0/IWifiApIface.h>
+#include <android/hardware/wifi/1.0/IWifiChip.h>
+#include <android/hardware/wifi/1.0/IWifiNanIface.h>
+#include <android/hardware/wifi/1.0/IWifiP2pIface.h>
+#include <android/hardware/wifi/1.0/IWifiRttController.h>
+#include <android/hardware/wifi/1.0/IWifiStaIface.h>
+
+// Used to stop the android framework (wifi service) before every
+// test.
+void stopFramework();
+void startFramework();
+
+// Helper functions to obtain references to the various HIDL interface objects.
+// Note: We only have a single instance of each of these objects currently.
+// These helper functions should be modified to return vectors if we support
+// multiple instances.
+android::sp<android::hardware::wifi::V1_0::IWifi> getWifi();
+android::sp<android::hardware::wifi::V1_0::IWifiChip> getWifiChip();
+android::sp<android::hardware::wifi::V1_0::IWifiApIface> getWifiApIface();
+android::sp<android::hardware::wifi::V1_0::IWifiNanIface> getWifiNanIface();
+android::sp<android::hardware::wifi::V1_0::IWifiP2pIface> getWifiP2pIface();
+android::sp<android::hardware::wifi::V1_0::IWifiStaIface> getWifiStaIface();
+android::sp<android::hardware::wifi::V1_0::IWifiRttController>
+getWifiRttController();
+// Used to trigger IWifi.stop() at the end of every test.
+void stopWifi();
diff --git a/wifi/1.0/vts/functional/wifi_nan_iface_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_nan_iface_hidl_test.cpp
new file mode 100644
index 0000000..a8be48c
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_nan_iface_hidl_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Nanache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.0/IWifiNanIface.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifiNanIface;
+using ::android::sp;
+
+/**
+ * Fixture to use for all NAN Iface HIDL interface tests.
+ */
+class WifiNanIfaceHidlTest : public ::testing::Test {
+   public:
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifiNanIface proxy object is
+ * successfully created.
+ */
+TEST(WifiNanIfaceHidlTestNoFixture, Create) {
+    EXPECT_NE(nullptr, getWifiNanIface().get());
+    stopWifi();
+}
diff --git a/wifi/1.0/vts/functional/wifi_p2p_iface_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_p2p_iface_hidl_test.cpp
new file mode 100644
index 0000000..e29226d
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_p2p_iface_hidl_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the P2pache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.0/IWifiP2pIface.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifiP2pIface;
+using ::android::sp;
+
+/**
+ * Fixture to use for all P2P Iface HIDL interface tests.
+ */
+class WifiP2pIfaceHidlTest : public ::testing::Test {
+   public:
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifiP2pIface proxy object is
+ * successfully created.
+ */
+TEST(WifiP2pIfaceHidlTestNoFixture, Create) {
+    EXPECT_NE(nullptr, getWifiP2pIface().get());
+    stopWifi();
+}
diff --git a/wifi/1.0/vts/functional/wifi_rtt_controller_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_rtt_controller_hidl_test.cpp
new file mode 100644
index 0000000..7aee761
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_rtt_controller_hidl_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.0/IWifiRttController.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifiRttController;
+using ::android::sp;
+
+/**
+ * Fixture to use for all RTT controller HIDL interface tests.
+ */
+class WifiRttControllerHidlTest : public ::testing::Test {
+   public:
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifiRttController proxy object is
+ * successfully created.
+ */
+TEST(WifiRttControllerHidlTestNoFixture, Create) {
+    EXPECT_NE(nullptr, getWifiRttController().get());
+    stopWifi();
+}
diff --git a/wifi/1.0/vts/functional/wifi_sta_iface_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_sta_iface_hidl_test.cpp
new file mode 100644
index 0000000..770763c
--- /dev/null
+++ b/wifi/1.0/vts/functional/wifi_sta_iface_hidl_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Staache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.0/IWifiStaIface.h>
+
+#include <gtest/gtest.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_0::IWifiStaIface;
+using ::android::sp;
+
+/**
+ * Fixture to use for all STA Iface HIDL interface tests.
+ */
+class WifiStaIfaceHidlTest : public ::testing::Test {
+   public:
+    virtual void SetUp() override {}
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifiStaIface proxy object is
+ * successfully created.
+ */
+TEST(WifiStaIfaceHidlTestNoFixture, Create) {
+    EXPECT_NE(nullptr, getWifiStaIface().get());
+    stopWifi();
+}
diff --git a/wifi/Android.bp b/wifi/Android.bp
index ea43db4..d4e0fda 100644
--- a/wifi/Android.bp
+++ b/wifi/Android.bp
@@ -1,5 +1,6 @@
 // This is an autogenerated file, do not edit.
 subdirs = [
     "1.0",
+    "1.0/vts/functional",
     "supplicant/1.0",
 ]