Merge "VTS for Bluetooth A2DP HAL" into pi-dev
diff --git a/audio/4.0/config/audio_policy_configuration.xsd b/audio/4.0/config/audio_policy_configuration.xsd
index 34c2b11..14e4fd6 100644
--- a/audio/4.0/config/audio_policy_configuration.xsd
+++ b/audio/4.0/config/audio_policy_configuration.xsd
@@ -218,24 +218,20 @@
 
             <xs:enumeration value="AUDIO_DEVICE_OUT_EARPIECE"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_SPEAKER"/>
-            <xs:enumeration value="AUDIO_DEVICE_OUT_SPEAKER_SAFE"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_WIRED_HEADSET"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_WIRED_HEADPHONE"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT"/>
-            <xs:enumeration value="AUDIO_DEVICE_OUT_ALL_SCO"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_HEADPHONES"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_BLUETOOTH_A2DP_SPEAKER"/>
-            <xs:enumeration value="AUDIO_DEVICE_OUT_ALL_A2DP"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_AUX_DIGITAL"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_HDMI"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_ANLG_DOCK_HEADSET"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_DGTL_DOCK_HEADSET"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_USB_ACCESSORY"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_USB_DEVICE"/>
-            <xs:enumeration value="AUDIO_DEVICE_OUT_ALL_USB"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_REMOTE_SUBMIX"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_TELEPHONY_TX"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_LINE"/>
@@ -243,10 +239,13 @@
             <xs:enumeration value="AUDIO_DEVICE_OUT_SPDIF"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_FM"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_AUX_LINE"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_SPEAKER_SAFE"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_IP"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_BUS"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_PROXY"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_USB_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_HEARING_AID"/>
+            <xs:enumeration value="AUDIO_DEVICE_OUT_ECHO_CANCELLER"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_DEFAULT"/>
             <xs:enumeration value="AUDIO_DEVICE_OUT_STUB"/>
 
@@ -255,19 +254,17 @@
             <xs:enumeration value="AUDIO_DEVICE_IN_AMBIENT"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_BUILTIN_MIC"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET"/>
-            <xs:enumeration value="AUDIO_DEVICE_IN_ALL_SCO"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_WIRED_HEADSET"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_AUX_DIGITAL"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_HDMI"/>
-            <xs:enumeration value="AUDIO_DEVICE_IN_TELEPHONY_RX"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_VOICE_CALL"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_TELEPHONY_RX"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_BACK_MIC"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_REMOTE_SUBMIX"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_ANLG_DOCK_HEADSET"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_DGTL_DOCK_HEADSET"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_USB_ACCESSORY"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_USB_DEVICE"/>
-            <xs:enumeration value="AUDIO_DEVICE_IN_ALL_USB"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_FM_TUNER"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_TV_TUNER"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_LINE"/>
@@ -278,6 +275,7 @@
             <xs:enumeration value="AUDIO_DEVICE_IN_BUS"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_PROXY"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_USB_HEADSET"/>
+            <xs:enumeration value="AUDIO_DEVICE_IN_BLUETOOTH_BLE"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_DEFAULT"/>
             <xs:enumeration value="AUDIO_DEVICE_IN_STUB"/>
         </xs:restriction>
diff --git a/audio/effect/4.0/types.hal b/audio/effect/4.0/types.hal
index 0f76601..2a8f4b8 100644
--- a/audio/effect/4.0/types.hal
+++ b/audio/effect/4.0/types.hal
@@ -200,16 +200,16 @@
  * enumeration of the effect engines present in a library.
  */
 struct EffectDescriptor {
-    Uuid type;             // UUID of to the OpenSL ES interface implemented
-                           // by this effect
-    Uuid uuid;             // UUID for this particular implementation
-    EffectFlags flags;     // effect engine capabilities/requirements flags
-    uint16_t cpuLoad;      // CPU load indication expressed in 0.1 MIPS units
-                           // as estimated on an ARM9E core (ARMv5TE) with 0 WS
-    uint16_t memoryUsage;  // data memory usage expressed in KB and includes
-                           // only dynamically allocated memory
-    uint8_t[64] name;      // human readable effect name
-    uint8_t[64] implementor;  // human readable effect implementor name
+    Uuid type;                   // UUID of to the OpenSL ES interface implemented
+                                 // by this effect
+    Uuid uuid;                   // UUID for this particular implementation
+    bitfield<EffectFlags> flags; // effect engine capabilities/requirements flags
+    uint16_t cpuLoad;            // CPU load indication expressed in 0.1 MIPS units
+                                 // as estimated on an ARM9E core (ARMv5TE) with 0 WS
+    uint16_t memoryUsage;        // data memory usage expressed in KB and includes
+                                 // only dynamically allocated memory
+    uint8_t[64] name;            // human readable effect name
+    uint8_t[64] implementor;     // human readable effect implementor name
 };
 
 /**
diff --git a/audio/effect/all-versions/default/include/effect/all-versions/default/Conversions.impl.h b/audio/effect/all-versions/default/include/effect/all-versions/default/Conversions.impl.h
index 44adf4b..de67d89 100644
--- a/audio/effect/all-versions/default/include/effect/all-versions/default/Conversions.impl.h
+++ b/audio/effect/all-versions/default/include/effect/all-versions/default/Conversions.impl.h
@@ -19,7 +19,10 @@
 #include <memory.h>
 #include <stdio.h>
 
+#include <common/all-versions/VersionUtils.h>
+
 using ::android::hardware::audio::common::AUDIO_HAL_VERSION::HidlUtils;
+using ::android::hardware::audio::common::utils::mkEnumConverter;
 
 namespace android {
 namespace hardware {
@@ -32,7 +35,7 @@
                              EffectDescriptor* descriptor) {
     HidlUtils::uuidFromHal(halDescriptor.type, &descriptor->type);
     HidlUtils::uuidFromHal(halDescriptor.uuid, &descriptor->uuid);
-    descriptor->flags = EffectFlags(halDescriptor.flags);
+    descriptor->flags = mkEnumConverter<EffectFlags>(halDescriptor.flags);
     descriptor->cpuLoad = halDescriptor.cpuLoad;
     descriptor->memoryUsage = halDescriptor.memoryUsage;
     memcpy(descriptor->name.data(), halDescriptor.name, descriptor->name.size());
diff --git a/camera/device/3.2/default/CameraDeviceSession.cpp b/camera/device/3.2/default/CameraDeviceSession.cpp
index 5f89cde..60a57cd 100644
--- a/camera/device/3.2/default/CameraDeviceSession.cpp
+++ b/camera/device/3.2/default/CameraDeviceSession.cpp
@@ -645,7 +645,10 @@
                     result.fmqResultSize = result.result.size();
                     result.result.resize(0);
                 } else {
-                    ALOGW("%s: couldn't utilize fmq, fall back to hwbinder", __FUNCTION__);
+                    ALOGW("%s: couldn't utilize fmq, fall back to hwbinder, result size: %zu,"
+                    "shared message queue available size: %zu",
+                        __FUNCTION__, result.result.size(),
+                        mResultMetadataQueue->availableToWrite());
                     result.fmqResultSize = 0;
                 }
             }
diff --git a/camera/device/3.4/default/ExternalCameraDevice.cpp b/camera/device/3.4/default/ExternalCameraDevice.cpp
index 6b05d4a..ee7ffaa 100644
--- a/camera/device/3.4/default/ExternalCameraDevice.cpp
+++ b/camera/device/3.4/default/ExternalCameraDevice.cpp
@@ -42,6 +42,9 @@
     V4L2_PIX_FMT_MJPEG
 }}; // double braces required in C++11
 
+constexpr int MAX_RETRY = 5; // Allow retry v4l2 open failures a few times.
+constexpr int OPEN_RETRY_SLEEP_US = 100000; // 100ms * MAX_RETRY = 0.5 seconds
+
 } // anonymous namespace
 
 ExternalCameraDevice::ExternalCameraDevice(
@@ -122,11 +125,22 @@
 
     unique_fd fd(::open(mCameraId.c_str(), O_RDWR));
     if (fd.get() < 0) {
-        ALOGE("%s: v4l2 device open %s failed: %s",
-                __FUNCTION__, mCameraId.c_str(), strerror(errno));
-        mLock.unlock();
-        _hidl_cb(Status::INTERNAL_ERROR, nullptr);
-        return Void();
+        int numAttempt = 0;
+        do {
+            ALOGW("%s: v4l2 device %s open failed, wait 33ms and try again",
+                    __FUNCTION__, mCameraId.c_str());
+            usleep(OPEN_RETRY_SLEEP_US); // sleep and try again
+            fd.reset(::open(mCameraId.c_str(), O_RDWR));
+            numAttempt++;
+        } while (fd.get() < 0 && numAttempt <= MAX_RETRY);
+
+        if (fd.get() < 0) {
+            ALOGE("%s: v4l2 device open %s failed: %s",
+                    __FUNCTION__, mCameraId.c_str(), strerror(errno));
+            mLock.unlock();
+            _hidl_cb(Status::INTERNAL_ERROR, nullptr);
+            return Void();
+        }
     }
 
     session = new ExternalCameraDeviceSession(
diff --git a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
index bb11d7c..1af3f39 100644
--- a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
+++ b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
@@ -49,7 +49,7 @@
                                        // method
 constexpr int MAX_RETRY = 15; // Allow retry some ioctl failures a few times to account for some
                              // webcam showing temporarily ioctl failures.
-constexpr int IOCTL_RETRY_SLEEP_US = 33000; // 33ms * MAX_RETRY = 5 seconds
+constexpr int IOCTL_RETRY_SLEEP_US = 33000; // 33ms * MAX_RETRY = 0.5 seconds
 
 // Constants for tryLock during dumpstate
 static constexpr int kDumpLockRetries = 50;
@@ -115,6 +115,35 @@
         return true;
     }
 
+    struct v4l2_capability capability;
+    int ret = ioctl(mV4l2Fd.get(), VIDIOC_QUERYCAP, &capability);
+    std::string make, model;
+    if (ret < 0) {
+        ALOGW("%s v4l2 QUERYCAP failed", __FUNCTION__);
+        make = "Generic UVC webcam";
+        model = "Generic UVC webcam";
+    } else {
+        // capability.card is UTF-8 encoded
+        char card[32];
+        int j = 0;
+        for (int i = 0; i < 32; i++) {
+            if (capability.card[i] < 128) {
+                card[j++] = capability.card[i];
+            }
+            if (capability.card[i] == '\0') {
+                break;
+            }
+        }
+        if (j == 0 || card[j - 1] != '\0') {
+            make = "Generic UVC webcam";
+            model = "Generic UVC webcam";
+        } else {
+            make = card;
+            model = card;
+        }
+    }
+    mOutputThread->setExifMakeModel(make, model);
+
     status_t status = initDefaultRequests();
     if (status != OK) {
         ALOGE("%s: init default requests failed!", __FUNCTION__);
@@ -826,6 +855,12 @@
 
 ExternalCameraDeviceSession::OutputThread::~OutputThread() {}
 
+void ExternalCameraDeviceSession::OutputThread::setExifMakeModel(
+        const std::string& make, const std::string& model) {
+    mExifMake = make;
+    mExifModel = model;
+}
+
 uint32_t ExternalCameraDeviceSession::OutputThread::getFourCcFromLayout(
         const YCbCrLayout& layout) {
     intptr_t cb = reinterpret_cast<intptr_t>(layout.cb);
@@ -1611,6 +1646,8 @@
     utils->initialize();
 
     utils->setFromMetadata(meta, jpegSize.width, jpegSize.height);
+    utils->setMake(mExifMake);
+    utils->setModel(mExifModel);
 
     ret = utils->generateApp1(outputThumbnail ? &thumbCode[0] : 0, thumbCodeSize);
 
@@ -2150,7 +2187,7 @@
         int numAttempt = 0;
         while (ret < 0) {
             ALOGW("%s: VIDIOC_S_FMT failed, wait 33ms and try again", __FUNCTION__);
-            usleep(IOCTL_RETRY_SLEEP_US); // sleep 100 ms and try again
+            usleep(IOCTL_RETRY_SLEEP_US); // sleep and try again
             ret = TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_S_FMT, &fmt));
             if (numAttempt == MAX_RETRY) {
                 break;
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
index 14e5c9a..0b94c11 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
@@ -231,6 +231,7 @@
         void dump(int fd);
         virtual bool threadLoop() override;
 
+        void setExifMakeModel(const std::string& make, const std::string& model);
     private:
         static const uint32_t FLEX_YUV_GENERIC = static_cast<uint32_t>('F') |
                 static_cast<uint32_t>('L') << 8 | static_cast<uint32_t>('E') << 16 |
@@ -288,6 +289,9 @@
         std::unordered_map<Size, sp<AllocatedFrame>, SizeHasher> mScaledYu12Frames;
         YCbCrLayout mYu12FrameLayout;
         YCbCrLayout mYu12ThumbFrameLayout;
+
+        std::string mExifMake;
+        std::string mExifModel;
     };
 
     // Protect (most of) HIDL interface methods from synchronized-entering
diff --git a/camera/provider/2.4/default/ExternalCameraProvider.cpp b/camera/provider/2.4/default/ExternalCameraProvider.cpp
index 285e96b..a4046d0 100644
--- a/camera/provider/2.4/default/ExternalCameraProvider.cpp
+++ b/camera/provider/2.4/default/ExternalCameraProvider.cpp
@@ -164,29 +164,35 @@
 }
 
 void ExternalCameraProvider::deviceAdded(const char* devName) {
-    int fd = -1;
-    if ((fd = ::open(devName, O_RDWR)) < 0) {
-        ALOGE("%s open v4l2 device %s failed:%s", __FUNCTION__, devName, strerror(errno));
-        return;
-    }
+    {
+        base::unique_fd fd(::open(devName, O_RDWR));
+        if (fd.get() < 0) {
+            ALOGE("%s open v4l2 device %s failed:%s", __FUNCTION__, devName, strerror(errno));
+            return;
+        }
 
-    do {
         struct v4l2_capability capability;
-        int ret = ioctl(fd, VIDIOC_QUERYCAP, &capability);
+        int ret = ioctl(fd.get(), VIDIOC_QUERYCAP, &capability);
         if (ret < 0) {
             ALOGE("%s v4l2 QUERYCAP %s failed", __FUNCTION__, devName);
-            break;
+            return;
         }
 
         if (!(capability.device_caps & V4L2_CAP_VIDEO_CAPTURE)) {
             ALOGW("%s device %s does not support VIDEO_CAPTURE", __FUNCTION__, devName);
-            break;
+            return;
         }
+    }
+    // See if we can initialize ExternalCameraDevice correctly
+    sp<device::V3_4::implementation::ExternalCameraDevice> deviceImpl =
+            new device::V3_4::implementation::ExternalCameraDevice(devName, mCfg);
+    if (deviceImpl == nullptr || deviceImpl->isInitFailed()) {
+        ALOGW("%s: Attempt to init camera device %s failed!", __FUNCTION__, devName);
+        return;
+    }
+    deviceImpl.clear();
 
-        addExternalCamera(devName);
-    } while (0);
-
-    close(fd);
+    addExternalCamera(devName);
     return;
 }
 
diff --git a/camera/provider/2.4/vts/functional/Android.bp b/camera/provider/2.4/vts/functional/Android.bp
index 08b9222..ead4083 100644
--- a/camera/provider/2.4/vts/functional/Android.bp
+++ b/camera/provider/2.4/vts/functional/Android.bp
@@ -38,8 +38,11 @@
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
         "android.hardware.camera.provider@2.4",
+        "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.common@1.0",
         "android.hardware.graphics.mapper@2.0",
+        "android.hidl.allocator@1.0",
         "libgrallocusage",
+        "libhidlmemory",
     ],
 }
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index 5feec87..637e280 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -48,6 +48,13 @@
 #include <system/camera_metadata.h>
 #include <ui/GraphicBuffer.h>
 
+#include <android/hardware/graphics/allocator/2.0/IAllocator.h>
+#include <android/hardware/graphics/mapper/2.0/IMapper.h>
+#include <android/hardware/graphics/mapper/2.0/types.h>
+#include <android/hidl/allocator/1.0/IAllocator.h>
+#include <android/hidl/memory/1.0/IMapper.h>
+#include <android/hidl/memory/1.0/IMemory.h>
+
 #include <VtsHalHidlTargetTestBase.h>
 #include <VtsHalHidlTargetTestEnvBase.h>
 
@@ -105,6 +112,9 @@
 using ::android::hardware::camera::device::V1_0::HandleTimestampMessage;
 using ::android::hardware::MessageQueue;
 using ::android::hardware::kSynchronizedReadWrite;
+using ::android::hidl::allocator::V1_0::IAllocator;
+using ::android::hidl::memory::V1_0::IMemory;
+using ::android::hidl::memory::V1_0::IMapper;
 using ResultMetadataQueue = MessageQueue<uint8_t, kSynchronizedReadWrite>;
 using ::android::hidl::manager::V1_0::IServiceManager;
 
@@ -621,6 +631,8 @@
     void setParameters(
             const sp<::android::hardware::camera::device::V1_0::ICameraDevice> &device,
             const CameraParameters &cameraParams);
+    void allocateGraphicBuffer(uint32_t width, uint32_t height, uint64_t usage,
+            PixelFormat format, hidl_handle *buffer_handle /*out*/);
     void waitForFrameLocked(DataCallbackMsg msgFrame,
             std::unique_lock<std::mutex> &l);
     void openEmptyDeviceSession(const std::string &name,
@@ -3297,15 +3309,15 @@
                                                        });
         ASSERT_TRUE(ret.isOk());
 
-        sp<GraphicBuffer> gb = new GraphicBuffer(
-            previewStream.width, previewStream.height,
-            static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-            android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
-                                            halStreamConfig.streams[0].consumerUsage));
-        ASSERT_NE(nullptr, gb.get());
+        hidl_handle buffer_handle;
+        allocateGraphicBuffer(previewStream.width, previewStream.height,
+                android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                    halStreamConfig.streams[0].consumerUsage),
+                halStreamConfig.streams[0].overrideFormat, &buffer_handle);
+
         StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                                      bufferId,
-                                     hidl_handle(gb->getNativeBuffer()->handle),
+                                     buffer_handle,
                                      BufferStatus::OK,
                                      nullptr,
                                      nullptr};
@@ -3497,20 +3509,20 @@
         InFlightRequest inflightReq = {static_cast<ssize_t> (halStreamConfig.streams.size()), false,
             supportsPartialResults, partialResultCount, resultQueue};
 
-        std::vector<sp<GraphicBuffer>> graphicBuffers;
+        std::vector<hidl_handle> graphicBuffers;
         graphicBuffers.reserve(halStreamConfig.streams.size());
         ::android::hardware::hidl_vec<StreamBuffer> outputBuffers;
         outputBuffers.resize(halStreamConfig.streams.size());
         size_t k = 0;
         for (const auto& halStream : halStreamConfig.streams) {
-            sp<GraphicBuffer> gb = new GraphicBuffer(previewStream.width, previewStream.height,
-                    static_cast<int32_t>(halStream.v3_3.v3_2.overrideFormat), 1,
-                    android_convertGralloc1To0Usage(
-                        halStream.v3_3.v3_2.producerUsage, halStream.v3_3.v3_2.consumerUsage));
-            ASSERT_NE(nullptr, gb.get());
-            graphicBuffers.push_back(gb);
-            outputBuffers[k] = {halStream.v3_3.v3_2.id, bufferId,
-                hidl_handle(gb->getNativeBuffer()->handle), BufferStatus::OK, nullptr, nullptr};
+            hidl_handle buffer_handle;
+            allocateGraphicBuffer(previewStream.width, previewStream.height,
+                    android_convertGralloc1To0Usage(halStream.v3_3.v3_2.producerUsage,
+                        halStream.v3_3.v3_2.consumerUsage),
+                    halStream.v3_3.v3_2.overrideFormat, &buffer_handle);
+            graphicBuffers.push_back(buffer_handle);
+            outputBuffers[k] = {halStream.v3_3.v3_2.id, bufferId, buffer_handle,
+                BufferStatus::OK, nullptr, nullptr};
             bufferId++;
             k++;
         }
@@ -3689,7 +3701,7 @@
 
         ::android::hardware::camera::common::V1_0::helper::CameraMetadata requestMeta;
         StreamBuffer emptyInputBuffer = {-1, 0, nullptr, BufferStatus::ERROR, nullptr, nullptr};
-        sp<GraphicBuffer> buffers[kBurstFrameCount];
+        hidl_handle buffers[kBurstFrameCount];
         StreamBuffer outputBuffers[kBurstFrameCount];
         CaptureRequest requests[kBurstFrameCount];
         InFlightRequest inflightReqs[kBurstFrameCount];
@@ -3699,15 +3711,13 @@
             std::unique_lock<std::mutex> l(mLock);
 
             isoValues[i] = ((i % 2) == 0) ? isoRange.data.i32[0] : isoRange.data.i32[1];
-            buffers[i] = new GraphicBuffer( previewStream.width, previewStream.height,
-                static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-                android_convertGralloc1To0Usage( halStreamConfig.streams[0].producerUsage,
-                    halStreamConfig.streams[0].consumerUsage));
-            ASSERT_NE(nullptr, buffers[i].get());
+            allocateGraphicBuffer(previewStream.width, previewStream.height,
+                    android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                        halStreamConfig.streams[0].consumerUsage),
+                    halStreamConfig.streams[0].overrideFormat, &buffers[i]);
 
             outputBuffers[i] = {halStreamConfig.streams[0].id, bufferId + i,
-                hidl_handle( buffers[i]->getNativeBuffer()->handle), BufferStatus::OK, nullptr,
-                nullptr};
+                buffers[i], BufferStatus::OK, nullptr, nullptr};
             requestMeta.append(reinterpret_cast<camera_metadata_t *> (settings.data()));
 
             // Disable all 3A routines
@@ -3795,15 +3805,15 @@
                 &supportsPartialResults /*out*/,
                 &partialResultCount /*out*/);
 
-        sp<GraphicBuffer> gb = new GraphicBuffer(
-            previewStream.width, previewStream.height,
-            static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-            android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
-                                            halStreamConfig.streams[0].consumerUsage));
+        hidl_handle buffer_handle;
+        allocateGraphicBuffer(previewStream.width, previewStream.height,
+                android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                    halStreamConfig.streams[0].consumerUsage),
+                halStreamConfig.streams[0].overrideFormat, &buffer_handle);
 
         StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                                      bufferId,
-                                     hidl_handle(gb->getNativeBuffer()->handle),
+                                     buffer_handle,
                                      BufferStatus::OK,
                                      nullptr,
                                      nullptr};
@@ -3953,15 +3963,15 @@
                                                        });
         ASSERT_TRUE(ret.isOk());
 
-        sp<GraphicBuffer> gb = new GraphicBuffer(
-            previewStream.width, previewStream.height,
-            static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-            android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
-                                            halStreamConfig.streams[0].consumerUsage));
-        ASSERT_NE(nullptr, gb.get());
+        hidl_handle buffer_handle;
+        allocateGraphicBuffer(previewStream.width, previewStream.height,
+                android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                    halStreamConfig.streams[0].consumerUsage),
+                halStreamConfig.streams[0].overrideFormat, &buffer_handle);
+
         StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                                      bufferId,
-                                     hidl_handle(gb->getNativeBuffer()->handle),
+                                     buffer_handle,
                                      BufferStatus::OK,
                                      nullptr,
                                      nullptr};
@@ -4794,6 +4804,44 @@
     ASSERT_EQ(Status::OK, returnStatus);
 }
 
+void CameraHidlTest::allocateGraphicBuffer(uint32_t width, uint32_t height, uint64_t usage,
+        PixelFormat format, hidl_handle *buffer_handle /*out*/) {
+    ASSERT_NE(buffer_handle, nullptr);
+
+    sp<android::hardware::graphics::allocator::V2_0::IAllocator> allocator =
+        android::hardware::graphics::allocator::V2_0::IAllocator::getService();
+    ASSERT_NE(nullptr, allocator.get());
+
+    sp<android::hardware::graphics::mapper::V2_0::IMapper> mapper =
+        android::hardware::graphics::mapper::V2_0::IMapper::getService();
+    ASSERT_NE(mapper.get(), nullptr);
+
+    android::hardware::graphics::mapper::V2_0::IMapper::BufferDescriptorInfo descriptorInfo {};
+    descriptorInfo.width = width;
+    descriptorInfo.height = height;
+    descriptorInfo.layerCount = 1;
+    descriptorInfo.format = format;
+    descriptorInfo.usage = usage;
+
+    ::android::hardware::hidl_vec<uint32_t> descriptor;
+    auto ret = mapper->createDescriptor(
+        descriptorInfo, [&descriptor](android::hardware::graphics::mapper::V2_0::Error err,
+                            ::android::hardware::hidl_vec<uint32_t> desc) {
+            ASSERT_EQ(err, android::hardware::graphics::mapper::V2_0::Error::NONE);
+            descriptor = desc;
+        });
+    ASSERT_TRUE(ret.isOk());
+
+    ret = allocator->allocate(descriptor, 1u,
+        [&](android::hardware::graphics::mapper::V2_0::Error err, uint32_t /*stride*/,
+            const ::android::hardware::hidl_vec<::android::hardware::hidl_handle>& buffers) {
+            ASSERT_EQ(android::hardware::graphics::mapper::V2_0::Error::NONE, err);
+            ASSERT_EQ(buffers.size(), 1u);
+            *buffer_handle = buffers[0];
+        });
+    ASSERT_TRUE(ret.isOk());
+}
+
 int main(int argc, char **argv) {
   ::testing::AddGlobalTestEnvironment(CameraHidlEnvironment::Instance());
   ::testing::InitGoogleTest(&argc, argv);
diff --git a/cas/1.0/default/CasImpl.cpp b/cas/1.0/default/CasImpl.cpp
index 2ac1c4f..178020e 100644
--- a/cas/1.0/default/CasImpl.cpp
+++ b/cas/1.0/default/CasImpl.cpp
@@ -31,19 +31,8 @@
 namespace V1_0 {
 namespace implementation {
 
-struct CasImpl::PluginHolder : public RefBase {
-public:
-    explicit PluginHolder(CasPlugin *plugin) : mPlugin(plugin) {}
-    ~PluginHolder() { if (mPlugin != NULL) delete mPlugin; }
-    CasPlugin* get() { return mPlugin; }
-
-private:
-    CasPlugin *mPlugin;
-    DISALLOW_EVIL_CONSTRUCTORS(PluginHolder);
-};
-
 CasImpl::CasImpl(const sp<ICasListener> &listener)
-    : mPluginHolder(NULL), mListener(listener) {
+    : mListener(listener) {
     ALOGV("CTOR");
 }
 
@@ -69,7 +58,8 @@
 
 void CasImpl::init(const sp<SharedLibrary>& library, CasPlugin *plugin) {
     mLibrary = library;
-    mPluginHolder = new PluginHolder(plugin);
+    std::shared_ptr<CasPlugin> holder(plugin);
+    std::atomic_store(&mPluginHolder, holder);
 }
 
 void CasImpl::onEvent(
@@ -88,22 +78,22 @@
 
 Return<Status> CasImpl::setPrivateData(const HidlCasData& pvtData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(holder->get()->setPrivateData(pvtData));
+    return toStatus(holder->setPrivateData(pvtData));
 }
 
 Return<void> CasImpl::openSession(openSession_cb _hidl_cb) {
     ALOGV("%s", __FUNCTION__);
     CasSessionId sessionId;
 
-    sp<PluginHolder> holder = mPluginHolder;
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     status_t err = INVALID_OPERATION;
-    if (holder != NULL) {
-        err = holder->get()->openSession(&sessionId);
-        holder.clear();
+    if (holder.get() != nullptr) {
+        err = holder->openSession(&sessionId);
+        holder.reset();
     }
 
     _hidl_cb(toStatus(err), sessionId);
@@ -115,87 +105,87 @@
         const HidlCasSessionId &sessionId, const HidlCasData& pvtData) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(
-            holder->get()->setSessionPrivateData(
-                    sessionId, pvtData));
+    return toStatus(holder->setSessionPrivateData(sessionId, pvtData));
 }
 
 Return<Status> CasImpl::closeSession(const HidlCasSessionId &sessionId) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(holder->get()->closeSession(sessionId));
+    return toStatus(holder->closeSession(sessionId));
 }
 
 Return<Status> CasImpl::processEcm(
         const HidlCasSessionId &sessionId, const HidlCasData& ecm) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->processEcm(sessionId, ecm));
+    return toStatus(holder->processEcm(sessionId, ecm));
 }
 
 Return<Status> CasImpl::processEmm(const HidlCasData& emm) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->processEmm(emm));
+    return toStatus(holder->processEmm(emm));
 }
 
 Return<Status> CasImpl::sendEvent(
         int32_t event, int32_t arg,
         const HidlCasData& eventData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    status_t err = holder->get()->sendEvent(event, arg, eventData);
+    status_t err = holder->sendEvent(event, arg, eventData);
     return toStatus(err);
 }
 
 Return<Status> CasImpl::provision(const hidl_string& provisionString) {
     ALOGV("%s: provisionString=%s", __FUNCTION__, provisionString.c_str());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->provision(String8(provisionString.c_str())));
+    return toStatus(holder->provision(String8(provisionString.c_str())));
 }
 
 Return<Status> CasImpl::refreshEntitlements(
         int32_t refreshType,
         const HidlCasData& refreshData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    status_t err = holder->get()->refreshEntitlements(refreshType, refreshData);
+    status_t err = holder->refreshEntitlements(refreshType, refreshData);
     return toStatus(err);
 }
 
 Return<Status> CasImpl::release() {
-    ALOGV("%s: plugin=%p", __FUNCTION__,
-            mPluginHolder != NULL ? mPluginHolder->get() : NULL);
-    mPluginHolder.clear();
+    ALOGV("%s: plugin=%p", __FUNCTION__, mPluginHolder.get());
+
+    std::shared_ptr<CasPlugin> holder(nullptr);
+    std::atomic_store(&mPluginHolder, holder);
+
     return Status::OK;
 }
 
diff --git a/cas/1.0/default/CasImpl.h b/cas/1.0/default/CasImpl.h
index 841d64e..d792838 100644
--- a/cas/1.0/default/CasImpl.h
+++ b/cas/1.0/default/CasImpl.h
@@ -88,7 +88,7 @@
 private:
     struct PluginHolder;
     sp<SharedLibrary> mLibrary;
-    sp<PluginHolder> mPluginHolder;
+    std::shared_ptr<CasPlugin> mPluginHolder;
     sp<ICasListener> mListener;
 
     DISALLOW_EVIL_CONSTRUCTORS(CasImpl);
diff --git a/cas/1.0/default/DescramblerImpl.cpp b/cas/1.0/default/DescramblerImpl.cpp
index 36699ba..1f89933 100644
--- a/cas/1.0/default/DescramblerImpl.cpp
+++ b/cas/1.0/default/DescramblerImpl.cpp
@@ -50,12 +50,12 @@
 
 DescramblerImpl::DescramblerImpl(
         const sp<SharedLibrary>& library, DescramblerPlugin *plugin) :
-        mLibrary(library), mPlugin(plugin) {
-    ALOGV("CTOR: mPlugin=%p", mPlugin);
+        mLibrary(library), mPluginHolder(plugin) {
+    ALOGV("CTOR: plugin=%p", mPluginHolder.get());
 }
 
 DescramblerImpl::~DescramblerImpl() {
-    ALOGV("DTOR: mPlugin=%p", mPlugin);
+    ALOGV("DTOR: plugin=%p", mPluginHolder.get());
     release();
 }
 
@@ -63,12 +63,22 @@
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
 
-    return toStatus(mPlugin->setMediaCasSession(sessionId));
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    return toStatus(holder->setMediaCasSession(sessionId));
 }
 
 Return<bool> DescramblerImpl::requiresSecureDecoderComponent(
         const hidl_string& mime) {
-    return mPlugin->requiresSecureDecoderComponent(String8(mime.c_str()));
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        return false;
+    }
+
+    return holder->requiresSecureDecoderComponent(String8(mime.c_str()));
 }
 
 static inline bool validateRangeForSize(
@@ -86,12 +96,23 @@
         descramble_cb _hidl_cb) {
     ALOGV("%s", __FUNCTION__);
 
+    // Get a local copy of the shared_ptr for the plugin. Note that before
+    // calling the HIDL callback, this shared_ptr must be manually reset,
+    // since the client side could proceed as soon as the callback is called
+    // without waiting for this method to go out of scope.
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        _hidl_cb(toStatus(INVALID_OPERATION), 0, NULL);
+        return Void();
+    }
+
     sp<IMemory> srcMem = mapMemory(srcBuffer.heapBase);
 
     // Validate if the offset and size in the SharedBuffer is consistent with the
     // mapped ashmem, since the offset and size is controlled by client.
     if (srcMem == NULL) {
         ALOGE("Failed to map src buffer.");
+        holder.reset();
         _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
         return Void();
     }
@@ -100,6 +121,7 @@
         ALOGE("Invalid src buffer range: offset %llu, size %llu, srcMem size %llu",
                 srcBuffer.offset, srcBuffer.size, (uint64_t)srcMem->getSize());
         android_errorWriteLog(0x534e4554, "67962232");
+        holder.reset();
         _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
         return Void();
     }
@@ -117,6 +139,7 @@
                 "srcOffset %llu, totalBytesInSubSamples %llu, srcBuffer size %llu",
                 srcOffset, totalBytesInSubSamples, srcBuffer.size);
         android_errorWriteLog(0x534e4554, "67962232");
+        holder.reset();
         _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
         return Void();
     }
@@ -135,6 +158,7 @@
                     "dstOffset %llu, totalBytesInSubSamples %llu, srcBuffer size %llu",
                     dstOffset, totalBytesInSubSamples, srcBuffer.size);
             android_errorWriteLog(0x534e4554, "67962232");
+            holder.reset();
             _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
             return Void();
         }
@@ -146,7 +170,7 @@
     // Casting hidl SubSample to DescramblerPlugin::SubSample, but need
     // to ensure structs are actually idential
 
-    int32_t result = mPlugin->descramble(
+    int32_t result = holder->descramble(
             dstBuffer.type != BufferType::SHARED_MEMORY,
             (DescramblerPlugin::ScramblingControl)scramblingControl,
             subSamples.size(),
@@ -157,17 +181,17 @@
             dstOffset,
             NULL);
 
+    holder.reset();
     _hidl_cb(toStatus(result >= 0 ? OK : result), result, NULL);
     return Void();
 }
 
 Return<Status> DescramblerImpl::release() {
-    ALOGV("%s: mPlugin=%p", __FUNCTION__, mPlugin);
+    ALOGV("%s: plugin=%p", __FUNCTION__, mPluginHolder.get());
 
-    if (mPlugin != NULL) {
-        delete mPlugin;
-        mPlugin = NULL;
-    }
+    std::shared_ptr<DescramblerPlugin> holder(nullptr);
+    std::atomic_store(&mPluginHolder, holder);
+
     return Status::OK;
 }
 
diff --git a/cas/1.0/default/DescramblerImpl.h b/cas/1.0/default/DescramblerImpl.h
index d3b146e..305f115 100644
--- a/cas/1.0/default/DescramblerImpl.h
+++ b/cas/1.0/default/DescramblerImpl.h
@@ -55,7 +55,7 @@
 
 private:
     sp<SharedLibrary> mLibrary;
-    DescramblerPlugin *mPlugin;
+    std::shared_ptr<DescramblerPlugin> mPluginHolder;
 
     DISALLOW_EVIL_CONSTRUCTORS(DescramblerImpl);
 };
diff --git a/cas/1.0/default/MediaCasService.cpp b/cas/1.0/default/MediaCasService.cpp
index ca43224..dbdd008 100644
--- a/cas/1.0/default/MediaCasService.cpp
+++ b/cas/1.0/default/MediaCasService.cpp
@@ -69,7 +69,7 @@
     if (mCasLoader.findFactoryForScheme(CA_system_id, &library, &factory)) {
         CasPlugin *plugin = NULL;
         sp<CasImpl> casImpl = new CasImpl(listener);
-        if (factory->createPlugin(CA_system_id, (uint64_t)casImpl.get(),
+        if (factory->createPlugin(CA_system_id, casImpl.get(),
                 &CasImpl::OnEvent, &plugin) == OK && plugin != NULL) {
             casImpl->init(library, plugin);
             result = casImpl;
diff --git a/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy b/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
index f2dd892..d523a1a 100644
--- a/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
+++ b/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
@@ -42,6 +42,7 @@
 rt_sigreturn: 1
 getrlimit: 1
 madvise: 1
+getdents64: 1
 clock_gettime: 1
 
 # used during process crash by crash_dump to dump process info
diff --git a/current.txt b/current.txt
index 5aa6259..ddbca36 100644
--- a/current.txt
+++ b/current.txt
@@ -258,7 +258,8 @@
 fb92e2b40f8e9d494e8fd3b4ac18499a3216342e7cff160714c3bbf3660b6e79 android.hardware.gnss@1.0::IGnssConfiguration
 251594ea9b27447bfa005ebd806e58fb0ae4aad84a69938129c9800ec0c64eda android.hardware.gnss@1.0::IGnssMeasurementCallback
 4e7169919d24fbe5573e5bcd683d0bd7abf553a4e6c34c41f9dfc1e12050db07 android.hardware.gnss@1.0::IGnssNavigationMessageCallback
-08ae9fc24f21f809e9b8501dfbc803662fcd6a8d8e1fb71d9dd7c0c4c6f5d556 android.hardware.neuralnetworks@1.0::types
+5804ca86611d72e5481f022b3a0c1b334217f2e4988dad25730c42af2d1f4d1c android.hardware.neuralnetworks@1.0::IDevice
+6721fc5b64d997f3eda15b762a0dd9f3fa414926219dbca58312972d565b4bee android.hardware.neuralnetworks@1.0::types
 d4840db8efabdf1e4b344fc981cd36e5fe81a39aff6e199f6d06c1c8da413efd android.hardware.radio@1.0::types
 b280c4704dfcc548a9bf127b59b7c3578f460c50cce70a06b66fe0df8b27cff0 android.hardware.wifi@1.0::types
 
@@ -286,7 +287,7 @@
 3661fa0623056922fdc4235ac5a9c91a2d066ab6f1ab4297e3b240fe302ba500 android.hardware.audio.effect@4.0::IPresetReverbEffect
 e88e520f8c98a62fccd8d5316c6687808f775de145d1405a7a9a66587ee6a001 android.hardware.audio.effect@4.0::IVirtualizerEffect
 fe28829dab10d171783b79ac9cc45412739f8ff275e90228d7c6370ef189b859 android.hardware.audio.effect@4.0::IVisualizerEffect
-5d92f6fd58d40c56611bb12f03be6af9bcf2bb73dfb35b77a99bbf2c3ea5439b android.hardware.audio.effect@4.0::types
+21c8a702579356480236c6851b5b2c16b9bd369ce12bdd6ffdc4626a89f34f73  android.hardware.audio.effect@4.0::types
 42a06dc288f61b0690580f3d37b30b663c31d74d50bb58d0772386b550d5faab android.hardware.authsecret@1.0::IAuthSecret
 a0f93c768c353cecee6237fe479bce47404eb10b629fafe07e32a054fd67f2af android.hardware.automotive.audiocontrol@1.0::IAudioControl
 ca515ff4b63c80cf5ad7b3395c997c57d6c56157361f6c367d1c96f23cc4860a android.hardware.automotive.audiocontrol@1.0::types
@@ -336,7 +337,7 @@
 b8c7ed58aa8740361e63d0ce9e7c94227572a629f356958840b34809d2393a7c android.hardware.media.bufferpool@1.0::IClientManager
 4a2c0dc82780e6c90731725a103feab8ab6ecf85a64e049b9cbd2b2c61620fe1 android.hardware.media.bufferpool@1.0::IConnection
 6aef1218e5949f867b0104752ac536c1b707222a403341720de90141df129e3e android.hardware.media.bufferpool@1.0::types
-1529409ed76ae87facab152b770495e9e62544fcc5215daabf146c28d588bab9 android.hardware.neuralnetworks@1.1::IDevice
+3e4d8e0085ebe8549efb8ad4b8b400a141a3fa3f47ae23696b3e05a1612eb003 android.hardware.neuralnetworks@1.1::IDevice
 e808a6f61cd7b47887c599d8843e67a2dcbf4ec5aadd5d22fdce93020070ef1b android.hardware.neuralnetworks@1.1::types
 8d3d86da0bfa4bf070970d8303c659f67f35d670c287d45a3f542e4fedadd578 android.hardware.nfc@1.1::INfc
 e85f566698d2a2c28100e264fcf2c691a066756ddf8dd341d009ff50cfe10614 android.hardware.nfc@1.1::INfcClientCallback
diff --git a/health/2.0/README b/health/2.0/README
index 2281f98..11e6a7a 100644
--- a/health/2.0/README
+++ b/health/2.0/README
@@ -71,6 +71,7 @@
     class hal
     user system
     group system
+    file /dev/kmsg w
 
 5. Create device/<manufacturer>/<device>/health/HealthService.cpp:
 
diff --git a/health/2.0/vts/functional/VtsHalHealthV2_0TargetTest.cpp b/health/2.0/vts/functional/VtsHalHealthV2_0TargetTest.cpp
index 972bc7f..c5431e4 100644
--- a/health/2.0/vts/functional/VtsHalHealthV2_0TargetTest.cpp
+++ b/health/2.0/vts/functional/VtsHalHealthV2_0TargetTest.cpp
@@ -190,18 +190,6 @@
     return true;
 }
 
-bool verifyDiskStats(const hidl_vec<struct DiskStats>& stats) {
-    for (size_t i = 0; i < stats.size(); i++) {
-        if (!(stats[i].reads > 0 && stats[i].readMerges > 0 && stats[i].readSectors > 0 &&
-              stats[i].readTicks > 0 && stats[i].writes > 0 && stats[i].writeMerges > 0 &&
-              stats[i].writeSectors > 0 && stats[i].writeTicks > 0 && stats[i].ioTicks > 0)) {
-            return false;
-        }
-    }
-
-    return true;
-}
-
 template <typename T>
 bool verifyEnum(T value) {
     for (auto it : hidl_enum_iterator<T>()) {
@@ -214,7 +202,7 @@
 }
 
 bool verifyHealthInfo(const HealthInfo& health_info) {
-    if (!verifyStorageInfo(health_info.storageInfos) || !verifyDiskStats(health_info.diskStats)) {
+    if (!verifyStorageInfo(health_info.storageInfos)) {
         return false;
     }
 
@@ -264,7 +252,7 @@
         EXPECT_VALID_OR_UNSUPPORTED_PROP(result, toString(value), verifyStorageInfo(value));
     }));
     EXPECT_OK(mHealth->getDiskStats([](auto result, auto& value) {
-        EXPECT_VALID_OR_UNSUPPORTED_PROP(result, toString(value), verifyDiskStats(value));
+        EXPECT_VALID_OR_UNSUPPORTED_PROP(result, toString(value), true);
     }));
     EXPECT_OK(mHealth->getHealthInfo([](auto result, auto& value) {
         EXPECT_VALID_OR_UNSUPPORTED_PROP(result, toString(value), verifyHealthInfo(value));
diff --git a/keymaster/4.0/vts/functional/HmacKeySharingTest.cpp b/keymaster/4.0/vts/functional/HmacKeySharingTest.cpp
index 96c47a8..f159796 100644
--- a/keymaster/4.0/vts/functional/HmacKeySharingTest.cpp
+++ b/keymaster/4.0/vts/functional/HmacKeySharingTest.cpp
@@ -136,6 +136,7 @@
 
     responses = computeSharedHmac(all_keymasters(), params);
     ASSERT_GT(responses.size(), 0U);
+    ASSERT_EQ(32U, responses[0].sharing_check.size());
     verifyResponses(responses[0].sharing_check, responses);
 }
 
@@ -216,7 +217,11 @@
     // matter what value is in the additional byte; it changes the seed regardless.
     auto param_to_tweak = rand() % params.size();
     auto& to_tweak = params[param_to_tweak].seed;
-    to_tweak.resize(to_tweak.size() + 1);
+    ASSERT_TRUE(to_tweak.size() == 32 || to_tweak.size() == 0);
+    if (!to_tweak.size()) {
+        to_tweak.resize(32);  // Contents don't matter; a little randomization is nice.
+    }
+    to_tweak[0]++;
 
     responses = computeSharedHmac(all_keymasters(), params);
     for (size_t i = 0; i < responses.size(); ++i) {
diff --git a/neuralnetworks/1.0/IDevice.hal b/neuralnetworks/1.0/IDevice.hal
index 49c2967..62fb2ba 100644
--- a/neuralnetworks/1.0/IDevice.hal
+++ b/neuralnetworks/1.0/IDevice.hal
@@ -36,7 +36,7 @@
     /**
      * Gets the supported operations in a model.
      *
-     * getSupportedSubgraph indicates which operations of a model are fully
+     * getSupportedOperations indicates which operations of a model are fully
      * supported by the vendor driver. If an operation may not be supported for
      * any reason, getSupportedOperations must return false for that operation.
      *
diff --git a/neuralnetworks/1.0/types.hal b/neuralnetworks/1.0/types.hal
index c97a00b..5b8f22c 100644
--- a/neuralnetworks/1.0/types.hal
+++ b/neuralnetworks/1.0/types.hal
@@ -44,7 +44,7 @@
      *
      * Attached to this tensor are two numbers that can be used to convert the
      * 8 bit integer to the real value and vice versa. These two numbers are:
-     * - scale: a 32 bit floating point value
+     * - scale: a 32 bit floating point value greater than zero
      * - zero_value: a 32 bit integer
      *
      * The formula is:
@@ -1081,7 +1081,11 @@
     vec<uint32_t> dimensions;
 
     /**
-     * The number of operations that use this operand as input.
+     * The number of times this operand appears as an operation input.
+     *
+     * (For example, if this operand appears once in one operation's
+     * input list, and three times in another operation's input list,
+     * then numberOfConsumers = 4.)
      */
     uint32_t numberOfConsumers;
 
diff --git a/neuralnetworks/1.0/vts/functional/Callbacks.h b/neuralnetworks/1.0/vts/functional/Callbacks.h
index 2ac6130..570a4fb 100644
--- a/neuralnetworks/1.0/vts/functional/Callbacks.h
+++ b/neuralnetworks/1.0/vts/functional/Callbacks.h
@@ -30,10 +30,6 @@
  * "notify". This "notify" call awakens any client threads waiting on the
  * callback object.
  *
- * callback object. When the asynchronous task has finished its workload or has
- * failed to launch, it must immediately call "notify", awakening any client
- * threads waiting on the callback object.
- *
  * The CallbackBase class implements some of the base synchronization common to
  * both PrepareModelCallback and ExecutionCallback. For consistency, any HIDL
  * callback class must inherit from CallbackBase as well as the HIDL callback
diff --git a/neuralnetworks/1.1/IDevice.hal b/neuralnetworks/1.1/IDevice.hal
index ca22555..d2c4843 100644
--- a/neuralnetworks/1.1/IDevice.hal
+++ b/neuralnetworks/1.1/IDevice.hal
@@ -41,7 +41,7 @@
     /**
      * Gets the supported operations in a model.
      *
-     * getSupportedSubgraph indicates which operations of a model are fully
+     * getSupportedOperations indicates which operations of a model are fully
      * supported by the vendor driver. If an operation may not be supported for
      * any reason, getSupportedOperations must return false for that operation.
      *
diff --git a/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp b/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
index 24b58a7..c18eedd 100644
--- a/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
+++ b/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
@@ -956,6 +956,7 @@
                                              std::chrono::seconds duration,
                                              const SensorEventsChecker &checker) {
   std::vector<Event> events;
+  std::vector<Event> sensorEvents;
 
   const int64_t samplingPeriodInNs = samplingPeriod.count();
   const int64_t batchingPeriodInNs = 0; // no batching
@@ -985,7 +986,6 @@
 
   ASSERT_GT(events.size(), 0u);
 
-  size_t nRealEvent = 0;
   bool handleMismatchReported = false;
   bool metaSensorTypeErrorReported = false;
   for (auto & e : events) {
@@ -996,7 +996,7 @@
             << (handleMismatchReported = true,
                 "Event of the same type must come from the sensor registered");
       }
-      ++ nRealEvent;
+      sensorEvents.push_back(e);
     } else {
       // avoid generating hundreds of error
       if (!metaSensorTypeErrorReported) {
@@ -1008,9 +1008,10 @@
   }
 
   std::string s;
-  EXPECT_TRUE(checker.check(events, &s)) << s;
+  EXPECT_TRUE(checker.check(sensorEvents, &s)) << s;
 
-  EXPECT_GE(nRealEvent, minNEvent / 2); // make sure returned events are not all meta
+  EXPECT_GE(sensorEvents.size(),
+            minNEvent / 2);  // make sure returned events are not all meta
 }
 
 // Test if sensor hal can do UI speed accelerometer streaming properly
@@ -1367,16 +1368,24 @@
   bool typeErrorReported = false;
   bool tokenErrorReported = false;
   bool timestampErrorReported = false;
+  std::vector<Event> sensorEvents;
   for (auto &e : events) {
-    if (!typeErrorReported) {
-      EXPECT_EQ(type, e.sensorType)
-          << (typeErrorReported = true, "Type in event does not match type of sensor registered.");
-    }
     if (!tokenErrorReported) {
       EXPECT_EQ(eventToken, e.sensorHandle)
           << (tokenErrorReported = true,
             "Event token does not match that retured from configDirectReport");
     }
+
+    if (isMetaSensorType(e.sensorType)) {
+        continue;
+    }
+    sensorEvents.push_back(e);
+
+    if (!typeErrorReported) {
+      EXPECT_EQ(type, e.sensorType)
+          << (typeErrorReported = true,
+              "Type in event does not match type of sensor registered.");
+    }
     if (!timestampErrorReported) {
       EXPECT_GT(e.timestamp, lastTimestamp)
           << (timestampErrorReported = true, "Timestamp not monotonically increasing");
@@ -1385,7 +1394,7 @@
   }
 
   std::string s;
-  EXPECT_TRUE(checker.check(events, &s)) << s;
+  EXPECT_TRUE(checker.check(sensorEvents, &s)) << s;
 
   // stop sensor and unregister channel
   configDirectReport(sensor.sensorHandle, channelHandle, RateLevel::STOP,
diff --git a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
index 0c5bd45..d16f1e7 100644
--- a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
+++ b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
@@ -88,7 +88,10 @@
     uint32_t configureChipForStaIfaceAndGetCapabilities() {
         configureChipForIfaceType(IfaceType::STA, true);
         const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
-        EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
+        if (status_and_caps.first.code != WifiStatusCode::SUCCESS) {
+            EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED, status_and_caps.first.code);
+            return 0;
+        }
         return status_and_caps.second;
     }
 
@@ -193,7 +196,10 @@
 TEST_F(WifiChipHidlTest, GetCapabilities) {
     configureChipForIfaceType(IfaceType::STA, true);
     const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
-    EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
+    if (status_and_caps.first.code != WifiStatusCode::SUCCESS) {
+        EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED, status_and_caps.first.code);
+        return;
+    }
     EXPECT_NE(0u, status_and_caps.second);
 }
 
diff --git a/wifi/1.2/default/wifi_nan_iface.cpp b/wifi/1.2/default/wifi_nan_iface.cpp
index 535e3d3..566d36e 100644
--- a/wifi/1.2/default/wifi_nan_iface.cpp
+++ b/wifi/1.2/default/wifi_nan_iface.cpp
@@ -427,7 +427,8 @@
                 return;
             }
 
-            for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
+            for (const auto& callback :
+                 shared_ptr_this->getEventCallbacks_1_2()) {
                 if (!callback->eventDataPathConfirm_1_2(hidl_struct).isOk()) {
                     LOG(ERROR) << "Failed to invoke the callback";
                 }
@@ -483,7 +484,7 @@
             return;
         }
 
-        for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
+        for (const auto& callback : shared_ptr_this->getEventCallbacks_1_2()) {
             if (!callback->eventDataPathScheduleUpdate(hidl_struct).isOk()) {
                 LOG(ERROR) << "Failed to invoke the callback";
             }
@@ -507,6 +508,7 @@
 
     legacy_hal_.reset();
     event_cb_handler_.invalidate();
+    event_cb_handler_1_2_.invalidate();
     is_valid_ = false;
 }
 
@@ -514,10 +516,16 @@
 
 std::string WifiNanIface::getName() { return ifname_; }
 
-std::set<sp<IWifiNanIfaceEventCallback>> WifiNanIface::getEventCallbacks() {
+std::set<sp<V1_0::IWifiNanIfaceEventCallback>>
+WifiNanIface::getEventCallbacks() {
     return event_cb_handler_.getCallbacks();
 }
 
+std::set<sp<V1_2::IWifiNanIfaceEventCallback>>
+WifiNanIface::getEventCallbacks_1_2() {
+    return event_cb_handler_1_2_.getCallbacks();
+}
+
 Return<void> WifiNanIface::getName(getName_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::getNameInternal, hidl_status_cb);
@@ -681,8 +689,11 @@
 }
 
 WifiStatus WifiNanIface::registerEventCallbackInternal(
-    const sp<V1_0::IWifiNanIfaceEventCallback>& /*callback*/) {
-    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+    const sp<V1_0::IWifiNanIfaceEventCallback>& callback) {
+    if (!event_cb_handler_.addCallback(callback)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
 WifiStatus WifiNanIface::getCapabilitiesRequestInternal(uint16_t cmd_id) {
@@ -808,8 +819,12 @@
 }
 
 WifiStatus WifiNanIface::registerEventCallback_1_2Internal(
-    const sp<IWifiNanIfaceEventCallback>& callback) {
-    if (!event_cb_handler_.addCallback(callback)) {
+    const sp<V1_2::IWifiNanIfaceEventCallback>& callback) {
+    sp<V1_0::IWifiNanIfaceEventCallback> callback_1_0 = callback;
+    if (!event_cb_handler_.addCallback(callback_1_0)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    if (!event_cb_handler_1_2_.addCallback(callback)) {
         return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
     }
     return createWifiStatus(WifiStatusCode::SUCCESS);
diff --git a/wifi/1.2/default/wifi_nan_iface.h b/wifi/1.2/default/wifi_nan_iface.h
index a2dcf3a..dba527b 100644
--- a/wifi/1.2/default/wifi_nan_iface.h
+++ b/wifi/1.2/default/wifi_nan_iface.h
@@ -132,7 +132,7 @@
                                                 uint32_t ndpInstanceId);
 
     WifiStatus registerEventCallback_1_2Internal(
-        const sp<IWifiNanIfaceEventCallback>& callback);
+        const sp<V1_2::IWifiNanIfaceEventCallback>& callback);
     WifiStatus enableRequest_1_2Internal(
         uint16_t cmd_id, const NanEnableRequest& msg1,
         const NanConfigRequestSupplemental& msg2);
@@ -140,13 +140,18 @@
         uint16_t cmd_id, const NanConfigRequest& msg,
         const NanConfigRequestSupplemental& msg2);
 
-    std::set<sp<IWifiNanIfaceEventCallback>> getEventCallbacks();
+    // all 1_0 and descendant callbacks
+    std::set<sp<V1_0::IWifiNanIfaceEventCallback>> getEventCallbacks();
+    // all 1_2 and descendant callbacks
+    std::set<sp<V1_2::IWifiNanIfaceEventCallback>> getEventCallbacks_1_2();
 
     std::string ifname_;
     std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
     bool is_valid_;
-    hidl_callback_util::HidlCallbackHandler<IWifiNanIfaceEventCallback>
+    hidl_callback_util::HidlCallbackHandler<V1_0::IWifiNanIfaceEventCallback>
         event_cb_handler_;
+    hidl_callback_util::HidlCallbackHandler<V1_2::IWifiNanIfaceEventCallback>
+        event_cb_handler_1_2_;
 
     DISALLOW_COPY_AND_ASSIGN(WifiNanIface);
 };
diff --git a/wifi/1.2/vts/functional/Android.bp b/wifi/1.2/vts/functional/Android.bp
index 918e4a4..c5a6e84 100644
--- a/wifi/1.2/vts/functional/Android.bp
+++ b/wifi/1.2/vts/functional/Android.bp
@@ -29,3 +29,18 @@
         "android.hardware.wifi@1.2",
     ],
 }
+
+cc_test {
+    name: "VtsHalWifiNanV1_2TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: [
+        "VtsHalWifiV1_2TargetTest.cpp",
+        "wifi_nan_iface_hidl_test.cpp",
+    ],
+    static_libs: [
+        "VtsHalWifiV1_0TargetTestUtil",
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+    ],
+}
diff --git a/wifi/1.2/vts/functional/wifi_nan_iface_hidl_test.cpp b/wifi/1.2/vts/functional/wifi_nan_iface_hidl_test.cpp
new file mode 100644
index 0000000..cc36fae
--- /dev/null
+++ b/wifi/1.2/vts/functional/wifi_nan_iface_hidl_test.cpp
@@ -0,0 +1,538 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Nanache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.2/IWifiNanIface.h>
+#include <android/hardware/wifi/1.2/IWifiNanIfaceEventCallback.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+#include "wifi_hidl_call_util.h"
+#include "wifi_hidl_test_utils.h"
+
+using namespace ::android::hardware::wifi::V1_0;
+using namespace ::android::hardware::wifi::V1_2;
+
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::sp;
+
+#define TIMEOUT_PERIOD 10
+
+android::sp<android::hardware::wifi::V1_2::IWifiNanIface>
+getWifiNanIface_1_2() {
+    return android::hardware::wifi::V1_2::IWifiNanIface::castFrom(
+        getWifiNanIface());
+}
+
+/**
+ * Fixture to use for all NAN Iface HIDL interface tests.
+ */
+class WifiNanIfaceHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        iwifiNanIface = getWifiNanIface_1_2();
+        ASSERT_NE(nullptr, iwifiNanIface.get());
+        ASSERT_EQ(WifiStatusCode::SUCCESS,
+                  HIDL_INVOKE(iwifiNanIface, registerEventCallback_1_2,
+                              new WifiNanIfaceEventCallback(*this))
+                      .code);
+    }
+
+    virtual void TearDown() override { stopWifi(); }
+
+    /* Used as a mechanism to inform the test about data/event callback */
+    inline void notify() {
+        std::unique_lock<std::mutex> lock(mtx_);
+        count_++;
+        cv_.notify_one();
+    }
+
+    enum CallbackType {
+        INVALID = -2,
+        ANY_CALLBACK = -1,
+
+        NOTIFY_CAPABILITIES_RESPONSE = 0,
+        NOTIFY_ENABLE_RESPONSE,
+        NOTIFY_CONFIG_RESPONSE,
+        NOTIFY_DISABLE_RESPONSE,
+        NOTIFY_START_PUBLISH_RESPONSE,
+        NOTIFY_STOP_PUBLISH_RESPONSE,
+        NOTIFY_START_SUBSCRIBE_RESPONSE,
+        NOTIFY_STOP_SUBSCRIBE_RESPONSE,
+        NOTIFY_TRANSMIT_FOLLOWUP_RESPONSE,
+        NOTIFY_CREATE_DATA_INTERFACE_RESPONSE,
+        NOTIFY_DELETE_DATA_INTERFACE_RESPONSE,
+        NOTIFY_INITIATE_DATA_PATH_RESPONSE,
+        NOTIFY_RESPOND_TO_DATA_PATH_INDICATION_RESPONSE,
+        NOTIFY_TERMINATE_DATA_PATH_RESPONSE,
+
+        EVENT_CLUSTER_EVENT,
+        EVENT_DISABLED,
+        EVENT_PUBLISH_TERMINATED,
+        EVENT_SUBSCRIBE_TERMINATED,
+        EVENT_MATCH,
+        EVENT_MATCH_EXPIRED,
+        EVENT_FOLLOWUP_RECEIVED,
+        EVENT_TRANSMIT_FOLLOWUP,
+        EVENT_DATA_PATH_REQUEST,
+        EVENT_DATA_PATH_CONFIRM,
+        EVENT_DATA_PATH_TERMINATED,
+        EVENT_DATA_PATH_CONFIRM_1_2,
+        EVENT_DATA_PATH_SCHEDULE_UPDATE
+    };
+
+    /* Test code calls this function to wait for data/event callback */
+    inline std::cv_status wait(CallbackType waitForCallbackType) {
+        std::unique_lock<std::mutex> lock(mtx_);
+
+        EXPECT_NE(INVALID, waitForCallbackType);  // can't ASSERT in a
+                                                  // non-void-returning method
+
+        callbackType = INVALID;
+        std::cv_status status = std::cv_status::no_timeout;
+        auto now = std::chrono::system_clock::now();
+        while (count_ == 0) {
+            status = cv_.wait_until(lock,
+                                    now + std::chrono::seconds(TIMEOUT_PERIOD));
+            if (status == std::cv_status::timeout) return status;
+            if (waitForCallbackType != ANY_CALLBACK &&
+                callbackType != INVALID &&
+                callbackType != waitForCallbackType) {
+                count_--;
+            }
+        }
+        count_--;
+        return status;
+    }
+
+    class WifiNanIfaceEventCallback
+        : public ::android::hardware::wifi::V1_2::IWifiNanIfaceEventCallback {
+        WifiNanIfaceHidlTest& parent_;
+
+       public:
+        WifiNanIfaceEventCallback(WifiNanIfaceHidlTest& parent)
+            : parent_(parent){};
+
+        virtual ~WifiNanIfaceEventCallback() = default;
+
+        Return<void> notifyCapabilitiesResponse(
+            uint16_t id, const WifiNanStatus& status,
+            const NanCapabilities& capabilities) override {
+            parent_.callbackType = NOTIFY_CAPABILITIES_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+            parent_.capabilities = capabilities;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyEnableResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_ENABLE_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyConfigResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_CONFIG_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyDisableResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_DISABLE_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyStartPublishResponse(uint16_t id,
+                                                const WifiNanStatus& status,
+                                                uint8_t sessionId) override {
+            parent_.callbackType = NOTIFY_START_PUBLISH_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+            parent_.sessionId = sessionId;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyStopPublishResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_STOP_PUBLISH_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyStartSubscribeResponse(uint16_t id,
+                                                  const WifiNanStatus& status,
+                                                  uint8_t sessionId) override {
+            parent_.callbackType = NOTIFY_START_SUBSCRIBE_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+            parent_.sessionId = sessionId;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyStopSubscribeResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_STOP_SUBSCRIBE_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyTransmitFollowupResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_TRANSMIT_FOLLOWUP_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyCreateDataInterfaceResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_CREATE_DATA_INTERFACE_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyDeleteDataInterfaceResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_DELETE_DATA_INTERFACE_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyInitiateDataPathResponse(
+            uint16_t id, const WifiNanStatus& status,
+            uint32_t ndpInstanceId) override {
+            parent_.callbackType = NOTIFY_INITIATE_DATA_PATH_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+            parent_.ndpInstanceId = ndpInstanceId;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyRespondToDataPathIndicationResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType =
+                NOTIFY_RESPOND_TO_DATA_PATH_INDICATION_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> notifyTerminateDataPathResponse(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = NOTIFY_TERMINATE_DATA_PATH_RESPONSE;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventClusterEvent(
+            const NanClusterEventInd& event) override {
+            parent_.callbackType = EVENT_CLUSTER_EVENT;
+
+            parent_.nanClusterEventInd = event;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventDisabled(const WifiNanStatus& status) override {
+            parent_.callbackType = EVENT_DISABLED;
+
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventPublishTerminated(
+            uint8_t sessionId, const WifiNanStatus& status) override {
+            parent_.callbackType = EVENT_PUBLISH_TERMINATED;
+
+            parent_.sessionId = sessionId;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventSubscribeTerminated(
+            uint8_t sessionId, const WifiNanStatus& status) override {
+            parent_.callbackType = EVENT_SUBSCRIBE_TERMINATED;
+
+            parent_.sessionId = sessionId;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventMatch(const NanMatchInd& event) override {
+            parent_.callbackType = EVENT_MATCH;
+
+            parent_.nanMatchInd = event;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventMatchExpired(uint8_t discoverySessionId,
+                                       uint32_t peerId) override {
+            parent_.callbackType = EVENT_MATCH_EXPIRED;
+
+            parent_.sessionId = discoverySessionId;
+            parent_.peerId = peerId;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventFollowupReceived(
+            const NanFollowupReceivedInd& event) override {
+            parent_.callbackType = EVENT_FOLLOWUP_RECEIVED;
+
+            parent_.nanFollowupReceivedInd = event;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventTransmitFollowup(
+            uint16_t id, const WifiNanStatus& status) override {
+            parent_.callbackType = EVENT_TRANSMIT_FOLLOWUP;
+
+            parent_.id = id;
+            parent_.status = status;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventDataPathRequest(
+            const NanDataPathRequestInd& event) override {
+            parent_.callbackType = EVENT_DATA_PATH_REQUEST;
+
+            parent_.nanDataPathRequestInd = event;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventDataPathConfirm(
+            const ::android::hardware::wifi::V1_0::NanDataPathConfirmInd& event)
+            override {
+            parent_.callbackType = EVENT_DATA_PATH_CONFIRM;
+
+            parent_.nanDataPathConfirmInd = event;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventDataPathTerminated(uint32_t ndpInstanceId) override {
+            parent_.callbackType = EVENT_DATA_PATH_TERMINATED;
+
+            parent_.ndpInstanceId = ndpInstanceId;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventDataPathConfirm_1_2(
+            const ::android::hardware::wifi::V1_2::NanDataPathConfirmInd& event)
+            override {
+            parent_.callbackType = EVENT_DATA_PATH_CONFIRM_1_2;
+
+            parent_.nanDataPathConfirmInd_1_2 = event;
+
+            parent_.notify();
+            return Void();
+        }
+
+        Return<void> eventDataPathScheduleUpdate(
+            const NanDataPathScheduleUpdateInd& event) override {
+            parent_.callbackType = EVENT_DATA_PATH_SCHEDULE_UPDATE;
+
+            parent_.nanDataPathScheduleUpdateInd = event;
+
+            parent_.notify();
+            return Void();
+        }
+    };
+
+   private:
+    // synchronization objects
+    std::mutex mtx_;
+    std::condition_variable cv_;
+    int count_;
+
+   protected:
+    android::sp<::android::hardware::wifi::V1_2::IWifiNanIface> iwifiNanIface;
+
+    // Data from IWifiNanIfaceEventCallback callbacks: this is the collection of
+    // all arguments to all callbacks. They are set by the callback
+    // (notifications or events) and can be retrieved by tests.
+    CallbackType callbackType;
+    uint16_t id;
+    WifiNanStatus status;
+    NanCapabilities capabilities;
+    uint8_t sessionId;
+    uint32_t ndpInstanceId;
+    NanClusterEventInd nanClusterEventInd;
+    NanMatchInd nanMatchInd;
+    uint32_t peerId;
+    NanFollowupReceivedInd nanFollowupReceivedInd;
+    NanDataPathRequestInd nanDataPathRequestInd;
+    ::android::hardware::wifi::V1_0::NanDataPathConfirmInd
+        nanDataPathConfirmInd;
+    ::android::hardware::wifi::V1_2::NanDataPathConfirmInd
+        nanDataPathConfirmInd_1_2;
+    NanDataPathScheduleUpdateInd nanDataPathScheduleUpdateInd;
+};
+
+/*
+ * Create:
+ * Ensures that an instance of the IWifiNanIface proxy object is
+ * successfully created.
+ */
+TEST(WifiNanIfaceHidlTestNoFixture, Create) {
+    ASSERT_NE(nullptr, getWifiNanIface_1_2().get());
+    stopWifi();
+}
+
+/*
+ * enableRequest_1_2InvalidArgs: validate that fails with invalid arguments
+ */
+TEST_F(WifiNanIfaceHidlTest, enableRequest_1_2InvalidArgs) {
+    uint16_t inputCmdId = 10;
+    NanEnableRequest nanEnableRequest = {};
+    NanConfigRequestSupplemental nanConfigRequestSupp = {};
+    ASSERT_EQ(WifiStatusCode::SUCCESS,
+              HIDL_INVOKE(iwifiNanIface, enableRequest_1_2, inputCmdId,
+                          nanEnableRequest, nanConfigRequestSupp)
+                  .code);
+    // wait for a callback
+    ASSERT_EQ(std::cv_status::no_timeout, wait(NOTIFY_ENABLE_RESPONSE));
+    ASSERT_EQ(NOTIFY_ENABLE_RESPONSE, callbackType);
+    ASSERT_EQ(id, inputCmdId);
+    ASSERT_EQ(status.status, NanStatusType::INVALID_ARGS);
+}
+
+/*
+ * enableRequest_1_2ShimInvalidArgs: validate that fails with invalid arguments
+ * to the shim
+ */
+TEST_F(WifiNanIfaceHidlTest, enableRequest_1_2ShimInvalidArgs) {
+    uint16_t inputCmdId = 10;
+    NanEnableRequest nanEnableRequest = {};
+    nanEnableRequest.configParams.numberOfPublishServiceIdsInBeacon =
+        128;  // must be <= 127
+    NanConfigRequestSupplemental nanConfigRequestSupp = {};
+    ASSERT_EQ(WifiStatusCode::ERROR_INVALID_ARGS,
+              HIDL_INVOKE(iwifiNanIface, enableRequest_1_2, inputCmdId,
+                          nanEnableRequest, nanConfigRequestSupp)
+                  .code);
+}
+
+/*
+ * configRequest_1_2InvalidArgs: validate that fails with invalid arguments
+ */
+TEST_F(WifiNanIfaceHidlTest, configRequest_1_2InvalidArgs) {
+    uint16_t inputCmdId = 10;
+    NanConfigRequest nanConfigRequest = {};
+    NanConfigRequestSupplemental nanConfigRequestSupp = {};
+    ASSERT_EQ(WifiStatusCode::SUCCESS,
+              HIDL_INVOKE(iwifiNanIface, configRequest_1_2, inputCmdId,
+                          nanConfigRequest, nanConfigRequestSupp)
+                  .code);
+    // wait for a callback
+    ASSERT_EQ(std::cv_status::no_timeout, wait(NOTIFY_CONFIG_RESPONSE));
+    ASSERT_EQ(NOTIFY_CONFIG_RESPONSE, callbackType);
+    ASSERT_EQ(id, inputCmdId);
+    ASSERT_EQ(status.status, NanStatusType::INVALID_ARGS);
+}
+
+/*
+ * configRequest_1_2ShimInvalidArgs: validate that fails with invalid arguments
+ * to the shim
+ */
+TEST_F(WifiNanIfaceHidlTest, configRequest_1_2ShimInvalidArgs) {
+    uint16_t inputCmdId = 10;
+    NanConfigRequest nanConfigRequest = {};
+    nanConfigRequest.numberOfPublishServiceIdsInBeacon = 128;  // must be <= 127
+    NanConfigRequestSupplemental nanConfigRequestSupp = {};
+    ASSERT_EQ(WifiStatusCode::ERROR_INVALID_ARGS,
+              HIDL_INVOKE(iwifiNanIface, configRequest_1_2, inputCmdId,
+                          nanConfigRequest, nanConfigRequestSupp)
+                  .code);
+}