Merge "audio: Allow vendors to configure hwbinder RPC buffer size"
diff --git a/atrace/1.0/Android.bp b/atrace/1.0/Android.bp
new file mode 100644
index 0000000..f7c9078
--- /dev/null
+++ b/atrace/1.0/Android.bp
@@ -0,0 +1,22 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.atrace@1.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IAtraceDevice.hal",
+    ],
+    interfaces: [
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "Status",
+        "TracingCategory",
+    ],
+    gen_java: true,
+}
+
diff --git a/atrace/1.0/IAtraceDevice.hal b/atrace/1.0/IAtraceDevice.hal
new file mode 100644
index 0000000..b6e78b4
--- /dev/null
+++ b/atrace/1.0/IAtraceDevice.hal
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.atrace@1.0;
+
+interface IAtraceDevice {
+    /**
+     * Get vendor extended atrace points.
+     *
+     *
+     * @return categories of tracing points the device extended.
+     */
+    listCategories() generates (vec<TracingCategory> categories);
+
+    /**
+     * A hook when atrace set to enable specific categories, so HAL
+     * can enable kernel tracing points and/or notify other things
+     * for userspace tracing turning on.
+     *
+     * @param categories A vector of strings of categories (corresponding to
+     *        TracingCategory.name) atrace needs to be enabled.
+     *
+     * @return status SUCCESS on success,
+     *         ERROR_TRACING_POINT on error with enabling categories,
+     *         ERROR_INVALID_ARGUMENT on invalid argument passed.
+     */
+    enableCategories(vec<string> categories) generates (Status status);
+
+    /**
+     * A hook when atrace set to clean up tracing categories, so HAL
+     * can disable all kernel tracing points and/or notify other things
+     * for userspace tracing turning off.
+     *
+     * @return status SUCCESS on success,
+     *         ERROR_TRACING_POINT on error with disabling categories.
+     */
+    disableAllCategories() generates (Status status);
+};
diff --git a/atrace/1.0/default/Android.bp b/atrace/1.0/default/Android.bp
new file mode 100644
index 0000000..bcaf064
--- /dev/null
+++ b/atrace/1.0/default/Android.bp
@@ -0,0 +1,35 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_binary {
+    name: "android.hardware.atrace@1.0-service",
+    defaults: ["hidl_defaults"],
+    relative_install_path: "hw",
+    vendor: true,
+    init_rc: ["android.hardware.atrace@1.0-service.rc"],
+    vintf_fragments: ["android.hardware.atrace@1.0-service.xml"],
+    srcs: [
+        "AtraceDevice.cpp",
+        "service.cpp",
+    ],
+    shared_libs: [
+        "liblog",
+        "libbase",
+        "libutils",
+        "libhidlbase",
+        "libhidltransport",
+        "android.hardware.atrace@1.0",
+    ],
+}
diff --git a/atrace/1.0/default/AtraceDevice.cpp b/atrace/1.0/default/AtraceDevice.cpp
new file mode 100644
index 0000000..43bcd9a
--- /dev/null
+++ b/atrace/1.0/default/AtraceDevice.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+
+#include "AtraceDevice.h"
+
+namespace android {
+namespace hardware {
+namespace atrace {
+namespace V1_0 {
+namespace implementation {
+
+using ::android::hardware::atrace::V1_0::Status;
+using ::android::hardware::atrace::V1_0::TracingCategory;
+
+struct TracingConfig {
+    std::string description;
+    std::vector<std::pair<std::string, bool>> paths;
+};
+
+// This is a map stores categories and their sysfs paths with required flags
+const std::map<std::string, TracingConfig> kTracingMap = {
+    // gfx
+    {
+        "gfx",
+        {"Graphics",
+         {{"/sys/kernel/debug/tracing/events/mdss/enable", false},
+          {"/sys/kernel/debug/tracing/events/sde/enable", false},
+          {"/sys/kernel/debug/tracing/events/mali_systrace/enable", false}}},
+    },
+    {
+        "ion",
+        {"ION allocation",
+         {{"/sys/kernel/debug/tracing/events/kmem/ion_alloc_buffer_start/enable", true}}},
+    },
+};
+
+// Methods from ::android::hardware::atrace::V1_0::IAtraceDevice follow.
+Return<void> AtraceDevice::listCategories(listCategories_cb _hidl_cb) {
+    hidl_vec<TracingCategory> categories;
+    categories.resize(kTracingMap.size());
+    std::size_t i = 0;
+    for (auto& c : kTracingMap) {
+        categories[i].name = c.first;
+        categories[i].description = c.second.description;
+        i++;
+    }
+    _hidl_cb(categories);
+    return Void();
+}
+
+Return<::android::hardware::atrace::V1_0::Status> AtraceDevice::enableCategories(
+    const hidl_vec<hidl_string>& categories) {
+    if (!categories.size()) {
+        return Status::ERROR_INVALID_ARGUMENT;
+    }
+    for (auto& c : categories) {
+        if (kTracingMap.count(c)) {
+            for (auto& p : kTracingMap.at(c).paths) {
+                if (!android::base::WriteStringToFile("1", p.first)) {
+                    LOG(ERROR) << "Failed to enable tracing on: " << p.first;
+                    if (p.second) {
+                        // disable before return
+                        disableAllCategories();
+                        return Status::ERROR_TRACING_POINT;
+                    }
+                }
+            }
+        } else {
+            return Status::ERROR_INVALID_ARGUMENT;
+        }
+    }
+    return Status::SUCCESS;
+}
+
+Return<::android::hardware::atrace::V1_0::Status> AtraceDevice::disableAllCategories() {
+    auto ret = Status::SUCCESS;
+    for (auto& c : kTracingMap) {
+        for (auto& p : c.second.paths) {
+            if (!android::base::WriteStringToFile("0", p.first)) {
+                LOG(ERROR) << "Failed to enable tracing on: " << p.first;
+                if (p.second) {
+                    ret = Status::ERROR_TRACING_POINT;
+                }
+            }
+        }
+    }
+    return ret;
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace atrace
+}  // namespace hardware
+}  // namespace android
diff --git a/atrace/1.0/default/AtraceDevice.h b/atrace/1.0/default/AtraceDevice.h
new file mode 100644
index 0000000..e700f89
--- /dev/null
+++ b/atrace/1.0/default/AtraceDevice.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_ATRACE_V1_0_ATRACEDEVICE_H
+#define ANDROID_HARDWARE_ATRACE_V1_0_ATRACEDEVICE_H
+
+#include <android/hardware/atrace/1.0/IAtraceDevice.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace atrace {
+namespace V1_0 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+
+struct AtraceDevice : public IAtraceDevice {
+    // Methods from ::android::hardware::atrace::V1_0::IAtraceDevice follow.
+    Return<void> listCategories(listCategories_cb _hidl_cb) override;
+    Return<::android::hardware::atrace::V1_0::Status> enableCategories(
+        const hidl_vec<hidl_string>& categories) override;
+    Return<::android::hardware::atrace::V1_0::Status> disableAllCategories() override;
+
+    // Methods from ::android::hidl::base::V1_0::IBase follow.
+};
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace atrace
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_ATRACE_V1_0_ATRACEDEVICE_H
diff --git a/atrace/1.0/default/android.hardware.atrace@1.0-service.rc b/atrace/1.0/default/android.hardware.atrace@1.0-service.rc
new file mode 100644
index 0000000..eb54c39
--- /dev/null
+++ b/atrace/1.0/default/android.hardware.atrace@1.0-service.rc
@@ -0,0 +1,13 @@
+on late-init
+    # vendor graphics trace points
+    chmod 0666 /sys/kernel/debug/tracing/events/sde/enable
+    chmod 0666 /sys/kernel/debug/tracing/events/mdss/enable
+    chmod 0666 /sys/kernel/debug/tracing/events/mali_systrace/enable
+    # ion allocation trace point
+    chmod 0666 /sys/kernel/debug/tracing/events/kmem/ion_alloc_buffer_start/enable
+
+service vendor.atrace-hal-1-0 /vendor/bin/hw/android.hardware.atrace@1.0-service
+    interface android.hardware.atrace@1.0::IAtraceDevice default
+    class early_hal
+    user system
+    group system
diff --git a/atrace/1.0/default/android.hardware.atrace@1.0-service.xml b/atrace/1.0/default/android.hardware.atrace@1.0-service.xml
new file mode 100644
index 0000000..fd3631c
--- /dev/null
+++ b/atrace/1.0/default/android.hardware.atrace@1.0-service.xml
@@ -0,0 +1,11 @@
+<manifest version="1.0" type="device">
+    <hal format="hidl">
+        <name>android.hardware.atrace</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>IAtraceDevice</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/atrace/1.0/default/service.cpp b/atrace/1.0/default/service.cpp
new file mode 100644
index 0000000..662fd73
--- /dev/null
+++ b/atrace/1.0/default/service.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.atrace@1.0-service"
+
+#include <hidl/HidlSupport.h>
+#include <hidl/HidlTransportSupport.h>
+
+#include "AtraceDevice.h"
+
+using ::android::OK;
+using ::android::sp;
+using ::android::hardware::configureRpcThreadpool;
+using ::android::hardware::joinRpcThreadpool;
+using ::android::hardware::atrace::V1_0::IAtraceDevice;
+using ::android::hardware::atrace::V1_0::Status;
+using ::android::hardware::atrace::V1_0::TracingCategory;
+using ::android::hardware::atrace::V1_0::implementation::AtraceDevice;
+
+int main(int /* argc */, char* /* argv */ []) {
+    sp<IAtraceDevice> atrace = new AtraceDevice;
+    configureRpcThreadpool(1, true /* will join */);
+    if (atrace->registerAsService() != OK) {
+        ALOGE("Could not register service.");
+        return 1;
+    }
+    joinRpcThreadpool();
+
+    ALOGE("Service exited!");
+    return 1;
+}
diff --git a/atrace/1.0/types.hal b/atrace/1.0/types.hal
new file mode 100644
index 0000000..f137ef6
--- /dev/null
+++ b/atrace/1.0/types.hal
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.atrace@1.0;
+
+enum Status : uint32_t {
+    /**
+     * Operation completed without errors.
+     */
+    SUCCESS = 0,
+    /**
+     * Operation failed with errors on enabling tracing point.
+     */
+    ERROR_TRACING_POINT = 1,
+    /**
+     * Operation failed because of invalid argument.
+     */
+    ERROR_INVALID_ARGUMENT = 2
+};
+
+struct TracingCategory {
+    /**
+     * Tracing category name, unique to frameworks's category.
+     */
+    string name;
+    /**
+     * Tracing category description.
+     */
+    string description;
+};
diff --git a/atrace/1.0/vts/functional/Android.bp b/atrace/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..6b50fb5
--- /dev/null
+++ b/atrace/1.0/vts/functional/Android.bp
@@ -0,0 +1,22 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalAtraceV1_0TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: ["VtsHalAtraceV1_0TargetTest.cpp"],
+    static_libs: ["android.hardware.atrace@1.0"],
+}
diff --git a/atrace/1.0/vts/functional/VtsHalAtraceV1_0TargetTest.cpp b/atrace/1.0/vts/functional/VtsHalAtraceV1_0TargetTest.cpp
new file mode 100644
index 0000000..c62c2f0
--- /dev/null
+++ b/atrace/1.0/vts/functional/VtsHalAtraceV1_0TargetTest.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <unordered_set>
+
+#include <android/hardware/atrace/1.0/IAtraceDevice.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::atrace::V1_0::IAtraceDevice;
+using ::android::hardware::atrace::V1_0::Status;
+
+// Test environment for Boot HIDL HAL.
+class AtraceHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static AtraceHidlEnvironment* Instance() {
+        static AtraceHidlEnvironment* instance = new AtraceHidlEnvironment;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<IAtraceDevice>(); }
+
+   private:
+    AtraceHidlEnvironment() {}
+};
+
+/**
+ * There is no expected behaviour that can be tested so these tests check the
+ * HAL doesn't crash with different execution orders.
+ */
+struct AtraceHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+    virtual void SetUp() override {
+        atrace = ::testing::VtsHalHidlTargetTestBase::getService<IAtraceDevice>(
+            AtraceHidlEnvironment::Instance()->getServiceName<IAtraceDevice>());
+        ASSERT_NE(atrace, nullptr);
+    }
+
+    sp<IAtraceDevice> atrace;
+};
+
+hidl_vec<hidl_string> getVendorCategoryName(sp<IAtraceDevice> atrace) {
+    std::unordered_set<std::string> categories_set;
+    Return<void> ret = atrace->listCategories([&](const auto& list) {
+        for (const auto& category : list) {
+            std::string name = category.name;
+            if (categories_set.count(name)) {
+                ADD_FAILURE() << "Duplicate category: " << name;
+            } else {
+                categories_set.emplace(name);
+            }
+        }
+    });
+    if (!ret.isOk()) {
+        ADD_FAILURE();
+    }
+    hidl_vec<hidl_string> categories;
+    categories.resize(categories_set.size());
+    std::size_t i = 0;
+    for (auto& c : categories_set) {
+        categories[i++] = c;
+    }
+    return categories;
+}
+
+/* list categories from vendors. */
+TEST_F(AtraceHidlTest, listCategories) {
+    hidl_vec<hidl_string> vnd_categories = getVendorCategoryName(atrace);
+    EXPECT_NE(0, vnd_categories.size());
+}
+
+/* enable categories. */
+TEST_F(AtraceHidlTest, enableCategories) {
+    hidl_vec<hidl_string> vnd_categories = getVendorCategoryName(atrace);
+    // empty Category with ERROR_INVALID_ARGUMENT
+    hidl_vec<hidl_string> empty_categories;
+    auto ret = atrace->enableCategories(empty_categories);
+    ASSERT_TRUE(ret.isOk());
+    EXPECT_EQ(Status::ERROR_INVALID_ARGUMENT, ret);
+    // non-empty categories SUCCESS
+    ret = atrace->enableCategories(vnd_categories);
+    ASSERT_TRUE(ret.isOk());
+    EXPECT_EQ(Status::SUCCESS, ret);
+}
+
+/* enable categories. */
+TEST_F(AtraceHidlTest, disableAllCategories) {
+    auto ret = atrace->disableAllCategories();
+    ASSERT_TRUE(ret.isOk());
+    EXPECT_EQ(Status::SUCCESS, ret);
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(AtraceHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    AtraceHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
+}
diff --git a/biometrics/face/1.0/IBiometricsFace.hal b/biometrics/face/1.0/IBiometricsFace.hal
index f39eaeb..1c7bfb9 100644
--- a/biometrics/face/1.0/IBiometricsFace.hal
+++ b/biometrics/face/1.0/IBiometricsFace.hal
@@ -78,11 +78,15 @@
      * template if the operation was preceded by some kind of strong credential
      * confirmation (e.g. device password).
      *
+     * @param challengeTimeoutSec A timeout in seconds, after which the driver
+     *     must invalidate the challenge. This is to prevent bugs or crashes in
+     *     the system from leaving a challenge enabled indefinitely.
      * @return result, with its "value" parameter representing a "challenge": a
      *     unique and cryptographically secure random token.
      */
     @callflow(next={"enroll", "revokeChallenge", "setRequireAttention"})
-    generateChallenge() generates (OptionalUint64 result);
+    generateChallenge(uint32_t challengeTimeoutSec)
+        generates (OptionalUint64 result);
 
     /**
      * Enrolls a user's face.
diff --git a/camera/device/3.2/ICameraDevice.hal b/camera/device/3.2/ICameraDevice.hal
index 1f523e4..5236bb1 100644
--- a/camera/device/3.2/ICameraDevice.hal
+++ b/camera/device/3.2/ICameraDevice.hal
@@ -148,7 +148,9 @@
      * session handle for active operations.
      *
      * @param callback Interface to invoke by the HAL for device asynchronous
-     *     events.
+     *     events. For HALs newer than version 3.2, HAL must use castFrom
+     *     method to check the exact version of callback sent by camera service.
+     *
      * @return status Status code for the operation, one of:
      *     OK:
      *         On a successful open of the camera device.
diff --git a/camera/device/3.2/ICameraDeviceSession.hal b/camera/device/3.2/ICameraDeviceSession.hal
index 477a3cc..225e52b 100644
--- a/camera/device/3.2/ICameraDeviceSession.hal
+++ b/camera/device/3.2/ICameraDeviceSession.hal
@@ -149,9 +149,8 @@
      *           - Including too many output streams of a certain format.
      *           - Unsupported rotation configuration
      *           - Stream sizes/formats don't satisfy the
-     *             camera3_stream_configuration_t->operation_mode requirements
-     *             for non-NORMAL mode, or the requested operation_mode is not
-     *             supported by the HAL.
+     *             StreamConfigurationMode requirements for non-NORMAL mode, or
+     *             the requested operation_mode is not supported by the HAL.
      *           - Unsupported usage flag
      *         The camera service cannot filter out all possible illegal stream
      *         configurations, since some devices may support more simultaneous
diff --git a/camera/device/3.4/ICameraDeviceSession.hal b/camera/device/3.4/ICameraDeviceSession.hal
index c41d90e..e1663e6 100644
--- a/camera/device/3.4/ICameraDeviceSession.hal
+++ b/camera/device/3.4/ICameraDeviceSession.hal
@@ -54,7 +54,7 @@
      *           - Including too many output streams of a certain format.
      *           - Unsupported rotation configuration
      *           - Stream sizes/formats don't satisfy the
-     *             camera3_stream_configuration_t->operation_mode requirements
+     *             StreamConfigurationMode requirements
      *             for non-NORMAL mode, or the requested operation_mode is not
      *             supported by the HAL.
      *           - Unsupported usage flag
diff --git a/camera/device/3.5/Android.bp b/camera/device/3.5/Android.bp
index a4e9ee2..2a9ba05 100644
--- a/camera/device/3.5/Android.bp
+++ b/camera/device/3.5/Android.bp
@@ -7,7 +7,9 @@
         enabled: true,
     },
     srcs: [
+        "types.hal",
         "ICameraDevice.hal",
+        "ICameraDeviceCallback.hal",
         "ICameraDeviceSession.hal",
     ],
     interfaces: [
@@ -18,6 +20,14 @@
         "android.hardware.graphics.common@1.0",
         "android.hidl.base@1.0",
     ],
+    types: [
+        "BufferRequest",
+        "BufferRequestStatus",
+        "StreamBufferRequestError",
+        "StreamBufferRet",
+        "StreamBuffersVal",
+        "StreamConfiguration",
+    ],
     gen_java: false,
 }
 
diff --git a/camera/device/3.5/ICameraDeviceCallback.hal b/camera/device/3.5/ICameraDeviceCallback.hal
new file mode 100644
index 0000000..aa4ad22
--- /dev/null
+++ b/camera/device/3.5/ICameraDeviceCallback.hal
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.camera.device@3.5;
+
+import @3.2::StreamBuffer;
+import @3.4::ICameraDeviceCallback;
+
+/**
+ * Callback methods for the HAL to call into the framework.
+ */
+interface ICameraDeviceCallback extends @3.4::ICameraDeviceCallback {
+
+    /**
+     * requestStreamBuffers:
+     *
+     * Synchronous callback for HAL to ask for output buffers from camera service.
+     *
+     * This call may be serialized in camera service so it is strongly
+     * recommended to only call this method from one thread.
+     *
+     * When camera device advertises
+     * (CameraMetadataEnumAndroidInfoSupportedBufferManagementVersion ==
+     * ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION_HIDL_DEVICE_3_5), HAL
+     * can use this method to request buffers from camera service.
+     *
+     * @return status Status code for the operation, one of:
+     *     OK: all requested buffers are returned
+     *     FAILED_PARTIAL: some streams failed while some succeeds. Check
+     *             individual StreamBufferRet for details.
+     *     FAILED_CONFIGURING: the request failed because camera servicve is
+     *             performing configureStreams and no buffers are returned.
+     *     FAILED_UNKNOWN: the request failed for unknown reason and no buffers
+     *             are returned.
+     *
+     * Performance requirements:
+     * This is a blocking call that takes more time with more buffers requested.
+     * HAL must not request large amount of buffers on a latency critical code
+     * path. It is highly recommended to use a dedicated thread to perform
+     * all requestStreamBuffers calls, and adjust the thread priority and/or
+     * timing of making the call in order for buffers to arrive before HAL is
+     * ready to fill the buffer.
+     */
+    requestStreamBuffers(vec<BufferRequest> bufReqs)
+            generates (BufferRequestStatus st, vec<StreamBufferRet> buffers);
+
+    /**
+     * returnStreamBuffers:
+     *
+     * Synchronous callback for HAL to return output buffers to camera service.
+     *
+     * If this method is called during a configureStreams call, it must be blocked
+     * until camera service finishes the ongoing configureStreams call.
+     */
+    returnStreamBuffers(vec<StreamBuffer> buffers);
+
+};
diff --git a/camera/device/3.5/ICameraDeviceSession.hal b/camera/device/3.5/ICameraDeviceSession.hal
index 8406685..b2b71cd 100644
--- a/camera/device/3.5/ICameraDeviceSession.hal
+++ b/camera/device/3.5/ICameraDeviceSession.hal
@@ -18,6 +18,7 @@
 
 import android.hardware.camera.common@1.0::Status;
 import @3.4::ICameraDeviceSession;
+import @3.4::HalStreamConfiguration;
 
 /**
  * Camera device active session interface.
@@ -26,4 +27,76 @@
  * configure and request captures from an active camera device.
  */
 interface ICameraDeviceSession extends @3.4::ICameraDeviceSession {
+
+    /**
+     * configureStreams_3_5:
+     *
+     * Identical to @3.4::ICameraDeviceSession.configureStreams, except that:
+     *
+     * - a streamConfigCounter counter is provided to check for race condition
+     *   between configureStreams_3_5 and signalStreamFlush call.
+     *
+     * @return status Status code for the operation, one of:
+     *     OK:
+     *         On successful stream configuration.
+     *     INTERNAL_ERROR:
+     *         If there has been a fatal error and the device is no longer
+     *         operational. Only close() can be called successfully by the
+     *         framework after this error is returned.
+     *     ILLEGAL_ARGUMENT:
+     *         If the requested stream configuration is invalid. Some examples
+     *         of invalid stream configurations include:
+     *           - Including more than 1 INPUT stream
+     *           - Not including any OUTPUT streams
+     *           - Including streams with unsupported formats, or an unsupported
+     *             size for that format.
+     *           - Including too many output streams of a certain format.
+     *           - Unsupported rotation configuration
+     *           - Stream sizes/formats don't satisfy the
+     *             StreamConfigurationMode requirements
+     *             for non-NORMAL mode, or the requested operation_mode is not
+     *             supported by the HAL.
+     *           - Unsupported usage flag
+     *         The camera service cannot filter out all possible illegal stream
+     *         configurations, since some devices may support more simultaneous
+     *         streams or larger stream resolutions than the minimum required
+     *         for a given camera device hardware level. The HAL must return an
+     *         ILLEGAL_ARGUMENT for any unsupported stream set, and then be
+     *         ready to accept a future valid stream configuration in a later
+     *         configureStreams call.
+     * @return halConfiguration The stream parameters desired by the HAL for
+     *     each stream, including maximum buffers, the usage flags, and the
+     *     override format.
+     */
+    configureStreams_3_5(@3.5::StreamConfiguration requestedConfiguration)
+            generates (Status status,
+                       @3.4::HalStreamConfiguration halConfiguration);
+
+
+    /**
+     * signalStreamFlush:
+     *
+     * Signaling HAL camera service is about to perform configureStreams_3_5 and
+     * HAL must return all buffers of designated streams. HAL must finish
+     * inflight requests normally and return all buffers that belongs to the
+     * designated streams through processCaptureResult or returnStreamBuffer
+     * API in a timely manner, or camera service will run into a fatal error.
+     *
+     * Note that this call serves as an optional hint and camera service may
+     * skip sending this call if all buffers are already returned.
+     *
+     * @param streamIds The ID of streams camera service need all of its
+     *     buffers returned.
+     *
+     * @param streamConfigCounter Note that due to concurrency nature, it is
+     *     possible the signalStreamFlush call arrives later than the
+     *     corresponding configureStreams_3_5 call, HAL must check
+     *     streamConfigCounter for such race condition. If the counter is less
+     *     than the counter in the last configureStreams_3_5 call HAL last
+     *     received, the call is stale and HAL should just return this call.
+     */
+    oneway signalStreamFlush(
+        vec<int32_t> streamIds,
+        uint32_t streamConfigCounter
+    );
 };
diff --git a/camera/device/3.5/default/Android.bp b/camera/device/3.5/default/Android.bp
index 341f573..09cf3a4 100644
--- a/camera/device/3.5/default/Android.bp
+++ b/camera/device/3.5/default/Android.bp
@@ -27,6 +27,7 @@
     vendor: true,
     srcs: [
         "CameraDevice.cpp",
+        "CameraDeviceSession.cpp",
     ],
     shared_libs: [
         "libhidlbase",
diff --git a/camera/device/3.5/default/CameraDevice.cpp b/camera/device/3.5/default/CameraDevice.cpp
index fcd1c96..c5d6c57 100644
--- a/camera/device/3.5/default/CameraDevice.cpp
+++ b/camera/device/3.5/default/CameraDevice.cpp
@@ -39,6 +39,22 @@
 CameraDevice::~CameraDevice() {
 }
 
+sp<V3_2::implementation::CameraDeviceSession> CameraDevice::createSession(camera3_device_t* device,
+        const camera_metadata_t* deviceInfo,
+        const sp<V3_2::ICameraDeviceCallback>& callback) {
+    sp<CameraDeviceSession> session = new CameraDeviceSession(device, deviceInfo, callback);
+    IF_ALOGV() {
+        session->getInterface()->interfaceChain([](
+            ::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
+                ALOGV("Session interface chain:");
+                for (auto iface : interfaceChain) {
+                    ALOGV("  %s", iface.c_str());
+                }
+            });
+    }
+    return session;
+}
+
 Return<void> CameraDevice::getPhysicalCameraCharacteristics(const hidl_string& physicalCameraId,
         V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb) {
     Status status = initStatus();
diff --git a/camera/device/3.5/default/CameraDeviceSession.cpp b/camera/device/3.5/default/CameraDeviceSession.cpp
new file mode 100644
index 0000000..5336ca9
--- /dev/null
+++ b/camera/device/3.5/default/CameraDeviceSession.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "CamDevSession@3.5-impl"
+#include <android/log.h>
+
+#include <utils/Trace.h>
+#include "CameraDeviceSession.h"
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+CameraDeviceSession::CameraDeviceSession(
+    camera3_device_t* device,
+    const camera_metadata_t* deviceInfo,
+    const sp<V3_2::ICameraDeviceCallback>& callback) :
+        V3_4::implementation::CameraDeviceSession(device, deviceInfo, callback) {
+
+    mHasCallback_3_5 = false;
+
+    auto castResult = ICameraDeviceCallback::castFrom(callback);
+    if (castResult.isOk()) {
+        sp<ICameraDeviceCallback> callback3_5 = castResult;
+        if (callback3_5 != nullptr) {
+            mHasCallback_3_5 = true;
+        }
+    }
+}
+
+CameraDeviceSession::~CameraDeviceSession() {
+}
+
+Return<void> CameraDeviceSession::configureStreams_3_5(
+        const StreamConfiguration& /*requestedConfiguration*/,
+        ICameraDeviceSession::configureStreams_3_5_cb _hidl_cb)  {
+    HalStreamConfiguration outStreams;
+    _hidl_cb(Status::OPERATION_NOT_SUPPORTED, outStreams);
+    return Void();
+}
+
+Return<void> CameraDeviceSession::signalStreamFlush(
+        const hidl_vec<int32_t>& /*requests*/, uint32_t /*streamConfigCounter*/) {
+    return Void();
+}
+
+} // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
diff --git a/camera/device/3.5/default/include/device_v3_5_impl/CameraDeviceSession.h b/camera/device/3.5/default/include/device_v3_5_impl/CameraDeviceSession.h
new file mode 100644
index 0000000..ec34769
--- /dev/null
+++ b/camera/device/3.5/default/include/device_v3_5_impl/CameraDeviceSession.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE3SESSION_H
+#define ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE3SESSION_H
+
+#include <android/hardware/camera/device/3.5/ICameraDevice.h>
+#include <android/hardware/camera/device/3.5/ICameraDeviceSession.h>
+#include <android/hardware/camera/device/3.5/ICameraDeviceCallback.h>
+#include <../../3.4/default/include/device_v3_4_impl/CameraDeviceSession.h>
+
+namespace android {
+namespace hardware {
+namespace camera {
+namespace device {
+namespace V3_5 {
+namespace implementation {
+
+using namespace ::android::hardware::camera::device;
+using ::android::hardware::camera::device::V3_2::CaptureRequest;
+using ::android::hardware::camera::device::V3_5::StreamConfiguration;
+using ::android::hardware::camera::device::V3_4::HalStreamConfiguration;
+using ::android::hardware::camera::device::V3_5::ICameraDeviceSession;
+using ::android::hardware::camera::device::V3_5::ICameraDeviceCallback;
+using ::android::hardware::camera::common::V1_0::Status;
+using ::android::hardware::camera::common::V1_0::helper::HandleImporter;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::hidl_string;
+using ::android::sp;
+using ::android::Mutex;
+
+struct CameraDeviceSession : public V3_4::implementation::CameraDeviceSession {
+
+    CameraDeviceSession(camera3_device_t*,
+            const camera_metadata_t* deviceInfo,
+            const sp<V3_2::ICameraDeviceCallback>&);
+    virtual ~CameraDeviceSession();
+
+    virtual sp<V3_2::ICameraDeviceSession> getInterface() override {
+        return new TrampolineSessionInterface_3_5(this);
+    }
+
+protected:
+    // Methods from v3.4 and earlier will trampoline to inherited implementation
+    Return<void> configureStreams_3_5(
+            const StreamConfiguration& requestedConfiguration,
+            ICameraDeviceSession::configureStreams_3_5_cb _hidl_cb);
+
+    Return<void> signalStreamFlush(
+            const hidl_vec<int32_t>& requests,
+            uint32_t streamConfigCounter);
+
+
+    // Whether this camera device session is created with version 3.5 callback.
+    bool mHasCallback_3_5;
+
+private:
+
+    struct TrampolineSessionInterface_3_5 : public ICameraDeviceSession {
+        TrampolineSessionInterface_3_5(sp<CameraDeviceSession> parent) :
+                mParent(parent) {}
+
+        virtual Return<void> constructDefaultRequestSettings(
+                V3_2::RequestTemplate type,
+                V3_3::ICameraDeviceSession::constructDefaultRequestSettings_cb _hidl_cb) override {
+            return mParent->constructDefaultRequestSettings(type, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams(
+                const V3_2::StreamConfiguration& requestedConfiguration,
+                V3_3::ICameraDeviceSession::configureStreams_cb _hidl_cb) override {
+            return mParent->configureStreams(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> processCaptureRequest_3_4(
+                const hidl_vec<V3_4::CaptureRequest>& requests,
+                const hidl_vec<V3_2::BufferCache>& cachesToRemove,
+                ICameraDeviceSession::processCaptureRequest_3_4_cb _hidl_cb) override {
+            return mParent->processCaptureRequest_3_4(requests, cachesToRemove, _hidl_cb);
+        }
+
+        virtual Return<void> processCaptureRequest(const hidl_vec<V3_2::CaptureRequest>& requests,
+                const hidl_vec<V3_2::BufferCache>& cachesToRemove,
+                V3_3::ICameraDeviceSession::processCaptureRequest_cb _hidl_cb) override {
+            return mParent->processCaptureRequest(requests, cachesToRemove, _hidl_cb);
+        }
+
+        virtual Return<void> getCaptureRequestMetadataQueue(
+                V3_3::ICameraDeviceSession::getCaptureRequestMetadataQueue_cb _hidl_cb) override  {
+            return mParent->getCaptureRequestMetadataQueue(_hidl_cb);
+        }
+
+        virtual Return<void> getCaptureResultMetadataQueue(
+                V3_3::ICameraDeviceSession::getCaptureResultMetadataQueue_cb _hidl_cb) override  {
+            return mParent->getCaptureResultMetadataQueue(_hidl_cb);
+        }
+
+        virtual Return<Status> flush() override {
+            return mParent->flush();
+        }
+
+        virtual Return<void> close() override {
+            return mParent->close();
+        }
+
+        virtual Return<void> configureStreams_3_3(
+                const V3_2::StreamConfiguration& requestedConfiguration,
+                configureStreams_3_3_cb _hidl_cb) override {
+            return mParent->configureStreams_3_3(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams_3_4(
+                const V3_4::StreamConfiguration& requestedConfiguration,
+                configureStreams_3_4_cb _hidl_cb) override {
+            return mParent->configureStreams_3_4(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> configureStreams_3_5(
+                const StreamConfiguration& requestedConfiguration,
+                configureStreams_3_5_cb _hidl_cb) override {
+            return mParent->configureStreams_3_5(requestedConfiguration, _hidl_cb);
+        }
+
+        virtual Return<void> signalStreamFlush(
+                const hidl_vec<int32_t>& requests,
+                uint32_t streamConfigCounter) override {
+            return mParent->signalStreamFlush(requests, streamConfigCounter);
+        }
+
+    private:
+        sp<CameraDeviceSession> mParent;
+    };
+};
+
+}  // namespace implementation
+}  // namespace V3_5
+}  // namespace device
+}  // namespace camera
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE3SESSION_H
diff --git a/camera/device/3.5/default/include/device_v3_5_impl/CameraDevice_3_5.h b/camera/device/3.5/default/include/device_v3_5_impl/CameraDevice_3_5.h
index f250bc9..6bdc60f 100644
--- a/camera/device/3.5/default/include/device_v3_5_impl/CameraDevice_3_5.h
+++ b/camera/device/3.5/default/include/device_v3_5_impl/CameraDevice_3_5.h
@@ -17,7 +17,7 @@
 #ifndef ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE_H
 #define ANDROID_HARDWARE_CAMERA_DEVICE_V3_5_CAMERADEVICE_H
 
-#include "CameraModule.h"
+#include "CameraDeviceSession.h"
 #include <../../../../3.4/default/include/device_v3_4_impl/CameraDevice_3_4.h>
 
 #include <android/hardware/camera/device/3.5/ICameraDevice.h>
@@ -57,6 +57,10 @@
     }
 
 protected:
+    virtual sp<V3_2::implementation::CameraDeviceSession> createSession(camera3_device_t*,
+            const camera_metadata_t* deviceInfo,
+            const sp<V3_2::ICameraDeviceCallback>&) override;
+
     Return<void> getPhysicalCameraCharacteristics(const hidl_string& physicalCameraId,
             V3_5::ICameraDevice::getPhysicalCameraCharacteristics_cb _hidl_cb);
 
diff --git a/camera/device/3.5/types.hal b/camera/device/3.5/types.hal
new file mode 100644
index 0000000..613187d
--- /dev/null
+++ b/camera/device/3.5/types.hal
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.camera.device@3.5;
+
+import @3.2::StreamBuffer;
+import @3.4::StreamConfiguration;
+
+/**
+ * StreamConfiguration:
+ *
+ * Identical to @3.4::StreamConfiguration, except that it contains streamConfigCounter
+ */
+struct StreamConfiguration {
+    @3.4::StreamConfiguration v3_4;
+
+    /**
+     * An incrementing counter used for HAL to keep track of the stream
+     * configuration and the paired oneway signalStreamFlush call. When the
+     * counter in signalStreamFlush call is less than the counter here, that
+     * signalStreamFlush call is stale.
+     */
+    uint32_t streamConfigCounter;
+};
+
+enum StreamBufferRequestError : uint32_t {
+    /**
+     * Get buffer failed due to timeout waiting for an available buffer. This is
+     * likely due to the client application holding too many buffers, or the
+     * system is under memory pressure.
+     * This is not a fatal error. HAL may try to request buffer for this stream
+     * later. If HAL cannot get a buffer for certain capture request in time
+     * due to this error, HAL can send an ERROR_REQUEST to camera service and
+     * drop processing that request.
+     */
+    NO_BUFFER_AVAILABLE = 1,
+
+    /**
+     * Get buffer failed due to HAL has reached its maxBuffer count. This is not
+     * a fatal error. HAL may try to request buffer for this stream again after
+     * it returns at least one buffer of that stream to camera service.
+     */
+    MAX_BUFFER_EXCEEDED = 2,
+
+    /**
+     * Get buffer failed due to the stream is disconnected by client
+     * application, has been removed, or not recognized by camera service.
+     * This means application is no longer interested in this stream.
+     * Requesting buffer for this stream must never succeed after this error is
+     * returned. HAL must safely return all buffers of this stream after
+     * getting this error. If HAL gets another capture request later targeting
+     * a disconnected stream, HAL must send an ERROR_REQUEST to camera service
+     * and drop processing that request.
+     */
+    STREAM_DISCONNECTED = 3,
+
+    /**
+     * Get buffer failed for unknown reasons. This is a fatal error and HAL must
+     * send ERROR_DEVICE to camera service and be ready to be closed.
+     */
+    UNKNOWN_ERROR = 4
+};
+
+/**
+ * Per-stream return value for requestStreamBuffers.
+ * For each stream, either an StreamBufferRequestError error code, or all
+ * requested buffers for this stream is returned, so buffers.size() must be
+ * equal to BufferRequest::numBuffersRequested of corresponding stream.
+ */
+safe_union StreamBuffersVal {
+    StreamBufferRequestError error;
+    vec<@3.2::StreamBuffer> buffers;
+};
+
+struct StreamBufferRet {
+    int32_t streamId;
+    StreamBuffersVal val;
+};
+
+enum BufferRequestStatus : uint32_t {
+    /**
+     * Method call succeeded and all requested buffers are returned.
+     */
+    OK = 0,
+
+    /**
+     * Method call failed for some streams. Check per stream status for each
+     * returned StreamBufferRet.
+     */
+    FAILED_PARTIAL = 1,
+
+    /**
+     * Method call failed for all streams and no buffers are returned at all.
+     * Camera service is about to or is performing configureStreams. HAL must
+     * wait until next configureStreams call is finished before requesting
+     * buffers again.
+     */
+    FAILED_CONFIGURING = 2,
+
+    /**
+     * Method call failed for all streams and no buffers are returned at all.
+     * Failure due to bad BufferRequest input, eg: unknown streamId or repeated
+     * streamId.
+     */
+    FAILED_ILLEGAL_ARGUMENTS = 3,
+
+    /**
+     * Method call failed for all streams and no buffers are returned at all.
+     * Failure due to unknown reason.
+     */
+    FAILED_UNKNOWN = 4,
+};
+
+struct BufferRequest {
+    int32_t streamId;
+    uint32_t numBuffersRequested;
+};
+
diff --git a/camera/metadata/3.4/Android.bp b/camera/metadata/3.4/Android.bp
index 04a00ef..388df68 100644
--- a/camera/metadata/3.4/Android.bp
+++ b/camera/metadata/3.4/Android.bp
@@ -14,6 +14,7 @@
         "android.hardware.camera.metadata@3.3",
     ],
     types: [
+        "CameraMetadataEnumAndroidInfoSupportedBufferManagementVersion",
         "CameraMetadataTag",
     ],
     gen_java: true,
diff --git a/camera/metadata/3.4/types.hal b/camera/metadata/3.4/types.hal
index 0088087..b228de8 100644
--- a/camera/metadata/3.4/types.hal
+++ b/camera/metadata/3.4/types.hal
@@ -44,8 +44,23 @@
 
     ANDROID_REQUEST_END_3_4,
 
+    /** android.info.supportedBufferManagementVersion [static, enum, system]
+     *
+     * <p>The version of buffer management API this camera device supports and opts into.</p>
+     */
+    ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION = android.hardware.camera.metadata@3.3::CameraMetadataTag:ANDROID_INFO_END_3_3,
+
+    ANDROID_INFO_END_3_4,
+
 };
 
 /*
  * Enumeration definitions for the various entries that need them
  */
+
+/** android.info.supportedBufferManagementVersion enumeration values
+ * @see ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION
+ */
+enum CameraMetadataEnumAndroidInfoSupportedBufferManagementVersion : uint32_t {
+    ANDROID_INFO_SUPPORTED_BUFFER_MANAGEMENT_VERSION_HIDL_DEVICE_3_5,
+};
diff --git a/camera/provider/2.4/Android.bp b/camera/provider/2.4/Android.bp
index 27329f3..63d7fd5 100644
--- a/camera/provider/2.4/Android.bp
+++ b/camera/provider/2.4/Android.bp
@@ -14,7 +14,6 @@
         "android.hardware.camera.common@1.0",
         "android.hardware.camera.device@1.0",
         "android.hardware.camera.device@3.2",
-        "android.hardware.camera.device@3.5",
         "android.hidl.base@1.0",
     ],
     gen_java: false,
diff --git a/camera/provider/2.4/default/CameraProvider.cpp b/camera/provider/2.4/default/CameraProvider.cpp
index b69fe1a..488b9af 100644
--- a/camera/provider/2.4/default/CameraProvider.cpp
+++ b/camera/provider/2.4/default/CameraProvider.cpp
@@ -552,6 +552,7 @@
         return Void();
     }
 
+    // ICameraDevice 3.4 or upper
     sp<android::hardware::camera::device::V3_2::implementation::CameraDevice> deviceImpl;
     if (deviceVersion >= kHAL3_4) {
         ALOGV("Constructing v3.4 camera device");
@@ -580,6 +581,7 @@
         return Void();
     }
 
+    // ICameraDevice 3.2 and 3.3
     // Since some Treble HAL revisions can map to the same legacy HAL version(s), we default
     // to the newest possible Treble HAL revision, but allow for override if needed via
     // system property.
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index 439333d..f2a7836 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -2080,6 +2080,14 @@
                     } else {
                         ADD_FAILURE() << "Get camera hardware level failed!";
                     }
+
+                    entry.count = 0;
+                    retcode = find_camera_metadata_ro_entry(metadata,
+                            ANDROID_REQUEST_CHARACTERISTIC_KEYS_NEEDING_PERMISSION, &entry);
+                    if ((0 == retcode) || (entry.count > 0)) {
+                        ADD_FAILURE() << "ANDROID_REQUEST_CHARACTERISTIC_KEYS_NEEDING_PERMISSION "
+                            << " per API contract should never be set by Hal!";
+                    }
                 });
                 ASSERT_TRUE(ret.isOk());
             }
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 88d1151..ff5b3e8 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -1,5 +1,13 @@
 <compatibility-matrix version="1.0" type="framework" level="4">
     <hal format="hidl" optional="false">
+        <name>android.hardware.atrace</name>
+        <version>1.0</version>
+        <interface>
+            <name>IAtraceDevice</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
         <name>android.hardware.audio</name>
         <version>4.0</version>
         <interface>
diff --git a/configstore/1.0/ISurfaceFlingerConfigs.hal b/configstore/1.0/ISurfaceFlingerConfigs.hal
index 0790905..1de7570 100644
--- a/configstore/1.0/ISurfaceFlingerConfigs.hal
+++ b/configstore/1.0/ISurfaceFlingerConfigs.hal
@@ -61,7 +61,7 @@
     hasWideColorDisplay() generates (OptionalBool value);
 
     /**
-     * hwHdrDisplay indicates that the device has an High Dynamic Range display.
+     * hwHDRDisplay indicates that the device has an High Dynamic Range display.
      * A display is considered High Dynamic Range if it
      *
      *     1. is a wide color gamut display, typically DCI-P3 or lager
diff --git a/current.txt b/current.txt
index d41d8d3..4709ab3 100644
--- a/current.txt
+++ b/current.txt
@@ -385,13 +385,15 @@
 10ff2fae516346b86121368ce5790d5accdfcb73983246b813f3d488b66db45a android.hardware.wifi.supplicant@1.1::ISupplicantStaNetwork
 
 # ABI preserving changes to HALs during Android Q
+2a55e224aa9bc62c0387cd85ad3c97e33f0c33a4e1489cbae86b2523e6f9df35 android.hardware.camera.device@3.2::ICameraDevice
+f61b616732d8f374e030f90575d7eba3ecc99d209a05b945949ba892bcb81e1d android.hardware.camera.device@3.2::ICameraDeviceSession
+684702a60deef03a1e8093961dc0a18c555c857ad5a77ba7340b0635ae01eb70 android.hardware.camera.device@3.4::ICameraDeviceSession
 a95745bbf76aea16a76518bd7efe70cabc5886d09eaeffc993c2e1787a22ed23 android.hardware.camera.metadata@3.3::types
-5f936a5befde7af8d2a683670f80a836b4741e94d84b7b39026da3ed78be9906 android.hardware.configstore@1.0::ISurfaceFlingerConfigs
+da33234403ff5d60f3473711917b9948e6484a4260b5247acdafb111193a9de2 android.hardware.configstore@1.0::ISurfaceFlingerConfigs
+b7ecf29927055ec422ec44bf776223f07d79ad9f92ccf9becf167e62c2607e7a android.hardware.keymaster@4.0::IKeymasterDevice
 574e8f1499436fb4075894dcae0b36682427956ecb114f17f1fe22d116a83c6b android.hardware.neuralnetworks@1.0::IPreparedModel
 1fb32361286b938d48a55c2539c846732afce0b99fe08590f556643125bc13d3 android.hardware.neuralnetworks@1.0::types
 e22e8135d061d0e9c4c1a70c25c19fdba10f4d3cda9795ef25b6392fc520317c android.hardware.neuralnetworks@1.1::types
-810b03825c633b21982871a8aa690db94285947fca71881de71bf293ad0aa9c5 android.hardware.neuralnetworks@1.2::types
-79f3820a02f37bb0f84bca1a07900fd5bd819ec5a60ed14b205e1dc5e24a51b2 android.hardware.neuralnetworks@1.2::IDevice
 1d4a5776614c08b5d794a5ec5ab04697260cbd4b3441d5935cd53ee71d19da02 android.hardware.radio@1.0::IRadioResponse
 271187e261b30c01a33011aea257c07a2d2f05b72943ebee89e973e997849973 android.hardware.radio@1.0::types
 1d19720d4fd38b1095f0f555a4bd92b3b12c9b1d0f560b0e9a474cd6dcc20db6 android.hardware.radio@1.2::IRadio
diff --git a/fastboot/1.0/IFastboot.hal b/fastboot/1.0/IFastboot.hal
index 653fd79..a96755e 100644
--- a/fastboot/1.0/IFastboot.hal
+++ b/fastboot/1.0/IFastboot.hal
@@ -29,4 +29,34 @@
      *     reformatting.
      */
     getPartitionType(string partitionName) generates (FileSystemType type, Result result);
+
+    /**
+     * Executes a fastboot OEM command.
+     *
+     * @param oemCmdArgs The oem command that is passed to the fastboot HAL.
+     * @response result Returns the status SUCCESS if the operation is successful,
+     *     INVALID_ARGUMENT for bad arguments,
+     *     FAILURE_UNKNOWN for an invalid/unsupported command.
+     */
+    doOemCommand(string oemCmd) generates (Result result);
+
+    /**
+     * Returns an OEM-defined string indicating the variant of the device, for
+     * example, US and ROW.
+     *
+     * @response variant Indicates the device variant.
+     * @response result Returns the status SUCCESS if the operation is successful,
+     *     FAILURE_UNKNOWN otherwise.
+     */
+    getVariant() generates (string variant, Result result);
+
+    /**
+     * Returns whether off-mode-charging is enabled. If enabled, the device
+     * autoboots into a special mode when power is applied.
+     *
+     * @response state Returns whether off mode charging is enabled.
+     * @response result Returns the status SUCCESS if the operation is successful,
+     *     FAILURE_UNKNOWN otherwise.
+     */
+    getOffModeChargeState() generates (bool state, Result result);
 };
diff --git a/fastboot/1.0/types.hal b/fastboot/1.0/types.hal
index 8453deb..3fbe639 100644
--- a/fastboot/1.0/types.hal
+++ b/fastboot/1.0/types.hal
@@ -53,9 +53,9 @@
 struct Result {
     Status status;
     /**
-     * Error message pertaining to the status. It must be a failure message for
+     * Message pertaining to the status. It must be a failure message for
      * Status FAILURE_UNKNOWN/NOT_SUPPORTED or an informative message for
      * Status SUCCESS.
      */
-    string error;
+    string message;
 };
diff --git a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
index c9f840e..2d901f3 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
@@ -119,6 +119,11 @@
     struct ComparableBlacklistedSource {
         IGnssConfiguration::BlacklistedSource id;
 
+        ComparableBlacklistedSource() {
+            id.constellation = GnssConstellationType::UNKNOWN;
+            id.svid = 0;
+        }
+
         bool operator<(const ComparableBlacklistedSource& compare) const {
             return ((id.svid < compare.id.svid) || ((id.svid == compare.id.svid) &&
                                                     (id.constellation < compare.id.constellation)));
@@ -191,18 +196,21 @@
  * 3) Restart location, wait for 3 locations, ensuring they are valid, and checks corresponding
  * GnssStatus does not use those satellites.
  * 4a & b) Turns off location, and send in empty blacklist.
- * 5) Restart location, wait for 3 locations, ensuring they are valid, and checks corresponding
+ * 5a) Restart location, wait for 3 locations, ensuring they are valid, and checks corresponding
  * GnssStatus does re-use at least the previously strongest satellite
+ * 5b) Retry a few times, in case GNSS search strategy takes a while to reacquire even the
+ * formerly strongest satellite
  */
 TEST_F(GnssHalTest, BlacklistIndividualSatellites) {
     const int kLocationsToAwait = 3;
+    const int kRetriesToUnBlacklist = 10;
 
     StartAndCheckLocations(kLocationsToAwait);
 
     // Tolerate 1 less sv status to handle edge cases in reporting.
     EXPECT_GE((int)list_gnss_sv_status_.size() + 1, kLocationsToAwait);
-    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
-          kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations (%d received)",
+          (int)list_gnss_sv_status_.size(), kLocationsToAwait, location_called_count_);
 
     /*
      * Identify strongest SV seen at least kLocationsToAwait -1 times
@@ -237,13 +245,18 @@
     // retry and ensure satellite not used
     list_gnss_sv_status_.clear();
 
-    location_called_count_ = 0;
     StartAndCheckLocations(kLocationsToAwait);
 
+    // early exit if test is being run with insufficient signal
+    if (location_called_count_ == 0) {
+        ALOGE("0 Gnss locations received - ensure sufficient signal and retry");
+    }
+    ASSERT_TRUE(location_called_count_ > 0);
+
     // Tolerate 1 less sv status to handle edge cases in reporting.
     EXPECT_GE((int)list_gnss_sv_status_.size() + 1, kLocationsToAwait);
-    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
-          kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations (%d received)",
+          (int)list_gnss_sv_status_.size(), kLocationsToAwait, location_called_count_);
     for (const auto& gnss_sv_status : list_gnss_sv_status_) {
         for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
             const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
@@ -260,28 +273,40 @@
     ASSERT_TRUE(result.isOk());
     EXPECT_TRUE(result);
 
-    StopAndClearLocations();
-    list_gnss_sv_status_.clear();
-
-    StartAndCheckLocations(kLocationsToAwait);
-
-    // Tolerate 1 less sv status to handle edge cases in reporting.
-    EXPECT_GE((int)list_gnss_sv_status_.size() + 1, kLocationsToAwait);
-    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
-          kLocationsToAwait);
-
     bool strongest_sv_is_reobserved = false;
-    for (const auto& gnss_sv_status : list_gnss_sv_status_) {
-        for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
-            const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
-            if ((gnss_sv.svid == source_to_blacklist.svid) &&
-                (gnss_sv.constellation == source_to_blacklist.constellation) &&
-                (gnss_sv.svFlag & IGnssCallback::GnssSvFlags::USED_IN_FIX)) {
-                strongest_sv_is_reobserved = true;
-                break;
-            }
+    // do several loops awaiting a few locations, allowing non-immediate reacquisition strategies
+    int unblacklist_loops_remaining = kRetriesToUnBlacklist;
+    while (!strongest_sv_is_reobserved && (unblacklist_loops_remaining-- > 0)) {
+        StopAndClearLocations();
+        list_gnss_sv_status_.clear();
+
+        StartAndCheckLocations(kLocationsToAwait);
+
+        // early exit loop if test is being run with insufficient signal
+        if (location_called_count_ == 0) {
+            ALOGE("0 Gnss locations received - ensure sufficient signal and retry");
         }
-        if (strongest_sv_is_reobserved) break;
+        ASSERT_TRUE(location_called_count_ > 0);
+
+        // Tolerate 1 less sv status to handle edge cases in reporting.
+        EXPECT_GE((int)list_gnss_sv_status_.size() + 1, kLocationsToAwait);
+        ALOGD(
+            "Clear blacklist, observed %d GnssSvStatus, while awaiting %d Locations"
+            ", tries remaining %d",
+            (int)list_gnss_sv_status_.size(), kLocationsToAwait, unblacklist_loops_remaining);
+
+        for (const auto& gnss_sv_status : list_gnss_sv_status_) {
+            for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
+                const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
+                if ((gnss_sv.svid == source_to_blacklist.svid) &&
+                    (gnss_sv.constellation == source_to_blacklist.constellation) &&
+                    (gnss_sv.svFlag & IGnssCallback::GnssSvFlags::USED_IN_FIX)) {
+                    strongest_sv_is_reobserved = true;
+                    break;
+                }
+            }
+            if (strongest_sv_is_reobserved) break;
+        }
     }
     EXPECT_TRUE(strongest_sv_is_reobserved);
     StopAndClearLocations();
@@ -304,8 +329,8 @@
 
     // Tolerate 1 less sv status to handle edge cases in reporting.
     EXPECT_GE((int)list_gnss_sv_status_.size() + 1, kLocationsToAwait);
-    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
-          kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations (%d received)",
+          (int)list_gnss_sv_status_.size(), kLocationsToAwait, location_called_count_);
 
     // Find first non-GPS constellation to blacklist
     GnssConstellationType constellation_to_blacklist = GnssConstellationType::UNKNOWN;
diff --git a/keymaster/4.0/IKeymasterDevice.hal b/keymaster/4.0/IKeymasterDevice.hal
index 85a25c6..c867ab0 100644
--- a/keymaster/4.0/IKeymasterDevice.hal
+++ b/keymaster/4.0/IKeymasterDevice.hal
@@ -168,7 +168,7 @@
  * startup, preferably by the bootloader.  This bitstring must be cryptographically bound to every
  * key managed by the IKeymasterDevice.  As above, the recommended mechanism for this cryptographic
  * binding is to include the Root of Trust data in the input to the key derivation function used to
- * derive a key that is used to encryp the private/secret key material.
+ * derive a key that is used to encrypt the private/secret key material.
  *
  * The root of trust consists of a bitstring that must be derived from the public key used by
  * Verified Boot to verify the signature on the boot image and from the the lock state of the
@@ -386,7 +386,7 @@
      * Generates a new cryptographic key, specifying associated parameters, which must be
      * cryptographically bound to the key.  IKeymasterDevice implementations must disallow any use
      * of a key in any way inconsistent with the authorizations specified at generation time.  With
-     * respect to parameters that the secure environment cannot enforce, the secure envionment's
+     * respect to parameters that the secure environment cannot enforce, the secure environment's
      * obligation is limited to ensuring that the unenforceable parameters associated with the key
      * cannot be modified, so that every call to getKeyCharacteristics returns the original
      * values.  In addition, the characteristics returned by generateKey places parameters correctly
@@ -433,7 +433,7 @@
      *   supported for RSA keys.
      *
      * o Tag::DIGEST specifies digest algorithms that may be used with the new key.  TEE
-     *   IKeymasterDevice implementatiosn must support all Digest values (see types.hal) for RSA
+     *   IKeymasterDevice implementations must support all Digest values (see types.hal) for RSA
      *   keys.  StrongBox IKeymasterDevice implementations must support SHA_2_256.
      *
      * o Tag::PADDING specifies the padding modes that may be used with the new
@@ -495,13 +495,13 @@
      *
      * @param keyFormat The format of the key material to import.  See KeyFormat in types.hal.
      *
-     * @pram keyData The key material to import, in the format specifed in keyFormat.
+     * @pram keyData The key material to import, in the format specified in keyFormat.
      *
      * @return keyBlob Opaque descriptor of the imported key.  The recommended implementation
      *         strategy is to include an encrypted copy of the key material, wrapped in a key
      *         unavailable outside secure hardware.
      *
-     * @return keyCharacteristics Decription of the generated key.  See the getKeyCharacteristics
+     * @return keyCharacteristics Description of the generated key.  See the getKeyCharacteristics
      *         method below.
      */
     importKey(vec<KeyParameter> keyParams, KeyFormat keyFormat, vec<uint8_t> keyData)
@@ -615,7 +615,7 @@
      *        value, it must be computationally infeasible for the secure hardware to obtain the key
      *        material.
      *
-     * @return keyCharacteristics Decription of the generated key.  See KeyCharacteristics in
+     * @return keyCharacteristics Description of the generated key.  See KeyCharacteristics in
      *         types.hal.
      */
     getKeyCharacteristics(vec<uint8_t> keyBlob, vec<uint8_t> clientId, vec<uint8_t> appData)
@@ -815,7 +815,7 @@
      * any one of them is higher than the corresponding current device value upgradeKey() must
      * return ErrorCode::INVALID_ARGUMENT.  There is one exception: it is always permissible to
      * "downgrade" from any OS_VERSION number to OS_VERSION 0.  For example, if the key has
-     * OS_VERSION 080001, it is permisible to upgrade the key if the current system version is
+     * OS_VERSION 080001, it is permissible to upgrade the key if the current system version is
      * 080100, because the new version is larger, or if the current system version is 0, because
      * upgrades to 0 are always allowed.  If the system version were 080000, however, keymaster must
      * return ErrorCode::INVALID_ARGUMENT because that value is smaller than 080001.  Values other
@@ -1040,7 +1040,7 @@
      * authorizations contain Tag::CALLER_NONCE, then the caller may provide an IV/nonce with
      * Tag::NONCE in inParams.  If a nonce is provided when Tag::CALLER_NONCE is not authorized,
      * begin() must return ErrorCode::CALLER_NONCE_PROHIBITED.  If a nonce is not provided when
-     * Tag::CALLER_NONCE is authorized, IKeymasterDevice msut generate a random IV/nonce.
+     * Tag::CALLER_NONCE is authorized, IKeymasterDevice must generate a random IV/nonce.
      *
      * -- HMAC keys --
      *
@@ -1082,7 +1082,7 @@
 
     /**
      * Provides data to, and possibly receives output from, an ongoing cryptographic operation begun
-     * with begin().  The operation is specified by the operationHandle paramater.
+     * with begin().  The operation is specified by the operationHandle parameter.
      *
      * If operationHandle is invalid, update() must return ErrorCode::INVALID_OPERATION_HANDLE.
      *
diff --git a/keymaster/4.0/support/authorization_set.cpp b/keymaster/4.0/support/authorization_set.cpp
index bf77420..afbcdac 100644
--- a/keymaster/4.0/support/authorization_set.cpp
+++ b/keymaster/4.0/support/authorization_set.cpp
@@ -523,8 +523,7 @@
     return *this;
 }
 
-AuthorizationSetBuilder& AuthorizationSetBuilder::Digest(
-    std::initializer_list<V4_0::Digest> digests) {
+AuthorizationSetBuilder& AuthorizationSetBuilder::Digest(std::vector<V4_0::Digest> digests) {
     for (auto digest : digests) {
         push_back(TAG_DIGEST, digest);
     }
diff --git a/keymaster/4.0/support/include/keymasterV4_0/authorization_set.h b/keymaster/4.0/support/include/keymasterV4_0/authorization_set.h
index 6c7fd35..1869682 100644
--- a/keymaster/4.0/support/include/keymasterV4_0/authorization_set.h
+++ b/keymaster/4.0/support/include/keymasterV4_0/authorization_set.h
@@ -278,7 +278,7 @@
     AuthorizationSetBuilder& GcmModeMacLen(uint32_t macLength);
 
     AuthorizationSetBuilder& BlockMode(std::initializer_list<BlockMode> blockModes);
-    AuthorizationSetBuilder& Digest(std::initializer_list<Digest> digests);
+    AuthorizationSetBuilder& Digest(std::vector<Digest> digests);
     AuthorizationSetBuilder& Padding(std::initializer_list<PaddingMode> paddings);
 
     template <typename... T>
diff --git a/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp b/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
index 6ed61da..995ae4f 100644
--- a/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
+++ b/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
@@ -672,8 +672,7 @@
     return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521};
 }
 
-std::initializer_list<Digest> KeymasterHidlTest::ValidDigests(bool withNone, bool withMD5) {
-    std::vector<Digest> result;
+std::vector<Digest> KeymasterHidlTest::ValidDigests(bool withNone, bool withMD5) {
     switch (SecLevel()) {
         case SecurityLevel::TRUSTED_ENVIRONMENT:
             if (withNone) {
diff --git a/keymaster/4.0/vts/functional/KeymasterHidlTest.h b/keymaster/4.0/vts/functional/KeymasterHidlTest.h
index 94beb21..4cd6a5b 100644
--- a/keymaster/4.0/vts/functional/KeymasterHidlTest.h
+++ b/keymaster/4.0/vts/functional/KeymasterHidlTest.h
@@ -214,7 +214,7 @@
     std::vector<EcCurve> ValidCurves();
     std::vector<EcCurve> InvalidCurves();
 
-    std::initializer_list<Digest> ValidDigests(bool withNone, bool withMD5);
+    std::vector<Digest> ValidDigests(bool withNone, bool withMD5);
     std::vector<Digest> InvalidDigests();
 
     HidlBuf key_blob_;
diff --git a/media/bufferpool/2.0/IAccessor.hal b/media/bufferpool/2.0/IAccessor.hal
index bd70945..ab7c02d 100644
--- a/media/bufferpool/2.0/IAccessor.hal
+++ b/media/bufferpool/2.0/IAccessor.hal
@@ -68,5 +68,5 @@
         generates (ResultStatus status, IConnection connection,
                    int64_t connectionId,
                    fmq_sync<BufferStatusMessage> toFmqDesc,
-                   fmq_sync<BufferInvalidationMessage> fromFmqDesc);
+                   fmq_unsync<BufferInvalidationMessage> fromFmqDesc);
 };
diff --git a/media/bufferpool/2.0/types.hal b/media/bufferpool/2.0/types.hal
index 7ce53b1..456e4aa 100644
--- a/media/bufferpool/2.0/types.hal
+++ b/media/bufferpool/2.0/types.hal
@@ -100,7 +100,7 @@
 struct BufferInvalidationMessage {
     /**
      * Buffers from fromBufferId to toBufferId must be invalidated.
-     * Both of fromBufferId and toBufferId are inclusive.
+     * fromBufferId is inclusive, but toBufferId is not inclusive.
      * If fromBufferId > toBufferID, wrap happens. In that case
      * the wrap is based on UINT32_MAX.
      */
diff --git a/neuralnetworks/1.2/types.hal b/neuralnetworks/1.2/types.hal
index 61970f0..4377131 100644
--- a/neuralnetworks/1.2/types.hal
+++ b/neuralnetworks/1.2/types.hal
@@ -26,7 +26,56 @@
  * The type of an operation in a model.
  */
 enum OperationType : @1.1::OperationType {
-
+    // TODO(b/116445845): Sync docs when all ops are implemented.
+    ARGMAX = 38,
+    ARGMIN = 39,
+    PAD_V2 = 40,
+    BBOX_TRANSFORM = 41,
+    BIDIRECTIONAL_SEQUENCE_LSTM = 42,
+    BIDIRECTIONAL_SEQUENCE_RNN = 43,
+    BOX_WITH_NMS_LIMIT = 44,
+    CAST = 45,
+    CHANNEL_SHUFFLE = 46,
+    DETECTION_OUTPUT = 47,
+    EMBEDDING_LOOKUP_SPARSE = 48,
+    EXP = 49,
+    EXPAND_DIMS = 50,
+    GATHER = 51,
+    GENERATE_PROPOSALS = 52,
+    GREATER = 53,
+    GREATER_EQUAL = 54,
+    GROUPED_CONV_2D = 55,
+    HEATMAP_MAX_KEYPOINT = 56,
+    LESS = 57,
+    LESS_EQUAL = 58,
+    LOG = 59,
+    LOGICAL_AND = 60,
+    LOGICAL_NOT = 61,
+    LOGICAL_OR = 62,
+    LOG_SOFTMAX = 63,
+    MAXIMUM = 64,
+    MINIMUM = 65,
+    NEG = 66,
+    POW = 67,
+    PRELU = 68,
+    PRIOR_BOX = 69,
+    QUANTIZE = 70,
+    QUANTIZED_16BIT_LSTM = 71,
+    RANDOM_MULTINOMIAL = 72,
+    REDUCE = 73,
+    ROI_ALIGN = 74,
+    RSQRT = 75,
+    SELECT = 76,
+    SIN = 77,
+    SLICE = 78,
+    SPARSE_TO_DENSE = 79,
+    SPLIT = 80,
+    SQRT = 81,
+    TILE = 82,
+    TOPK_V2 = 83,
+    TRANSPOSE_CONV_2D = 84,
+    UNIDIRECTIONAL_SEQUENCE_LSTM = 85,
+    UNIDIRECTIONAL_SEQUENCE_RNN = 86,
 };
 
 /**
diff --git a/sensors/2.0/Android.bp b/sensors/2.0/Android.bp
index 20bc4e1..3b948a9 100644
--- a/sensors/2.0/Android.bp
+++ b/sensors/2.0/Android.bp
@@ -9,12 +9,14 @@
     srcs: [
         "types.hal",
         "ISensors.hal",
+        "ISensorsCallback.hal",
     ],
     interfaces: [
         "android.hardware.sensors@1.0",
         "android.hidl.base@1.0",
     ],
     types: [
+        "EventQueueFlagBits",
         "SensorTimeout",
     ],
     gen_java: false,
diff --git a/sensors/2.0/ISensors.hal b/sensors/2.0/ISensors.hal
index 32092ef..2a57251 100644
--- a/sensors/2.0/ISensors.hal
+++ b/sensors/2.0/ISensors.hal
@@ -22,6 +22,7 @@
 import @1.0::Result;
 import @1.0::SensorInfo;
 import @1.0::SharedMemInfo;
+import @2.0::ISensorsCallback;
 
 interface ISensors {
     /**
@@ -59,14 +60,21 @@
     activate(int32_t sensorHandle, bool enabled) generates (Result result);
 
     /**
-     * Initialize the Fast Message Queues (FMQ) that are used to send data
-     * between the framework and the HAL.
+     * Initialize the Sensors HAL's Fast Message Queues (FMQ) and callback.
+     *
+     * The Fast Message Queues (FMQ) that are used to send data between the
+     * framework and the HAL. The callback is used by the HAL to notify the
+     * framework of asynchronous events, such as a dynamic sensor connection.
      *
      * The Event FMQ is used to transport sensor events from the HAL to the
      * framework. The Event FMQ is created using the eventQueueDescriptor.
      * Data may only be written to the Event FMQ. Data must not be read from
      * the Event FMQ since the framework is the only reader. Upon receiving
      * sensor events, the HAL should write the sensor events to the Event FMQ.
+     * Once the HAL is finished writing sensor events to the Event FMQ, the HAL
+     * must call the Event FMQ's EventFlag wake() function with the
+     * EventQueueFlagBits::READ_AND_PROCESS mask which notifies the framework
+     * that sensor events are available to be read and processed.
      *
      * The Wake Lock FMQ is used by the framework to notify the HAL when it is
      * safe to release its wake_lock. When the framework receives WAKE_UP events
@@ -77,6 +85,9 @@
      * unprocessed WAKE_UP events and release its wake_lock if the current
      * count of unprocessed WAKE_UP events is zero.
      *
+     * The ISensorsCallback is used by the HAL to notify the framework of
+     * asynchronous events, such as a dynamic sensor connection.
+     *
      * The name of any wake_lock acquired by the Sensors HAL for WAKE_UP events
      * must begin with "SensorsHAL_WAKEUP".
      *
@@ -86,14 +97,14 @@
      * released.
      *
      * If either the Event FMQ or the Wake Lock FMQ is already initialized when
-     * initializeMessageQueues is invoked, then both existing FMQs must be
-     * discarded and the new descriptors must be used to create new FMQs within
-     * the HAL. The number of outstanding WAKE_UP events should also be reset to
-     * zero, and any outstanding wake_locks held as a result of WAKE_UP events
-     * should be released.
+     * initialize is invoked, then both existing FMQs must be discarded and the
+     * new descriptors must be used to create new FMQs within the HAL. The
+     * number of outstanding WAKE_UP events should also be reset to zero, and
+     * any outstanding wake_locks held as a result of WAKE_UP events should be
+     * released.
      *
-     * initializeMessageQueues must be thread safe and prevent concurrent calls
-     * to initializeMessageQueues from simultaneously modifying state.
+     * initialize must be thread safe and prevent concurrent calls
+     * to initialize from simultaneously modifying state.
      *
      * @param eventQueueDescriptor Fast Message Queue descriptor that is used to
      *     create the Event FMQ which is where sensor events are written. The
@@ -103,14 +114,18 @@
      *     create the Wake Lock FMQ which is where wake_lock events are read
      *     from. The descriptor is obtained from the framework's FMQ that is
      *     used to write wake_lock events.
+     * @param sensorsCallback sensors callback that receives asynchronous data
+     *     from the Sensors HAL.
      * @return result OK on success; BAD_VALUE if descriptor is invalid (such
      *     as null)
      */
     @entry
     @callflow(next = {"getSensorsList"})
-    initializeMessageQueues(fmq_sync<Event> eventQueueDescriptor,
-                            fmq_sync<uint32_t> wakeLockDescriptor)
-                 generates (Result result);
+    initialize(fmq_sync<Event> eventQueueDescriptor,
+               fmq_sync<uint32_t> wakeLockDescriptor,
+               ISensorsCallback sensorsCallback)
+        generates
+              (Result result);
 
     /**
      * Sets a sensor’s parameters, including sampling frequency and maximum
diff --git a/sensors/2.0/ISensorsCallback.hal b/sensors/2.0/ISensorsCallback.hal
new file mode 100644
index 0000000..e0bd98f
--- /dev/null
+++ b/sensors/2.0/ISensorsCallback.hal
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.sensors@2.0;
+
+import @1.0::SensorInfo;
+
+interface ISensorsCallback {
+    /**
+     * Notify the framework that new dynamic sensors have been connected.
+     *
+     * If a dynamic sensor was previously connected and has not been
+     * disconnected, then that sensor must not be included in sensorInfos.
+     *
+     * @param sensorInfos vector of SensorInfo for each dynamic sensor that
+     *     was connected.
+     */
+    oneway onDynamicSensorsConnected(vec<SensorInfo> sensorInfos);
+
+    /**
+     * Notify the framework that previously connected dynamic sensors have been
+     * disconnected.
+     *
+     * If a dynamic sensor was previously disconnected and has not been
+     * reconnected, then that sensor must not be included in sensorHandles.
+     *
+     * The HAL must ensure that all sensor events from departing dynamic
+     * sensors have been written to the Event FMQ before calling
+     * onDynamicSensorsDisconnected.
+     *
+     * @param sensorHandles vector of sensor handles for each dynamic sensors
+     *     that was disconnected.
+     */
+    oneway onDynamicSensorsDisconnected(vec<int32_t> sensorHandles);
+};
diff --git a/sensors/2.0/types.hal b/sensors/2.0/types.hal
index 16e1c03..e1a029a 100644
--- a/sensors/2.0/types.hal
+++ b/sensors/2.0/types.hal
@@ -23,3 +23,10 @@
      */
     WAKE_LOCK_SECONDS = 1,
 };
+
+enum EventQueueFlagBits : uint32_t {
+    /**
+     * Used to notify the Event FMQ that events should be read and processed.
+     */
+    READ_AND_PROCESS = 1 << 0,
+};