Merge "Vibrator: clarify the API"
diff --git a/hardware.c b/hardware.c
index 6713ea0..79d0a2f 100644
--- a/hardware.c
+++ b/hardware.c
@@ -67,9 +67,9 @@
         const char *path,
         const struct hw_module_t **pHmi)
 {
-    int status;
-    void *handle;
-    struct hw_module_t *hmi;
+    int status = -EINVAL;
+    void *handle = NULL;
+    struct hw_module_t *hmi = NULL;
 
     /*
      * load the symbols resolving undefined symbols before
@@ -145,11 +145,12 @@
 int hw_get_module_by_class(const char *class_id, const char *inst,
                            const struct hw_module_t **module)
 {
-    int i;
-    char prop[PATH_MAX];
-    char path[PATH_MAX];
-    char name[PATH_MAX];
-    char prop_name[PATH_MAX];
+    int i = 0;
+    char prop[PATH_MAX] = {0};
+    char path[PATH_MAX] = {0};
+    char name[PATH_MAX] = {0};
+    char prop_name[PATH_MAX] = {0};
+
 
     if (inst)
         snprintf(name, PATH_MAX, "%s.%s", class_id, inst);
diff --git a/include/hardware/activity_recognition.h b/include/hardware/activity_recognition.h
new file mode 100644
index 0000000..8f99459
--- /dev/null
+++ b/include/hardware/activity_recognition.h
@@ -0,0 +1,223 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * Activity Recognition HAL. The goal is to provide low power, low latency, always-on activity
+ * recognition implemented in hardware (i.e. these activity recognition algorithms/classifers
+ * should NOT be run on the AP). By low power we mean that this may be activated 24/7 without
+ * impacting the battery drain speed (goal in order of 1mW including the power for sensors).
+ * This HAL does not specify the input sources that are used towards detecting these activities.
+ * It has one monitor interface which can be used to batch activities for always-on
+ * activity_recognition and if the latency is zero, the same interface can be used for low latency
+ * detection.
+ */
+
+#ifndef ANDROID_ACTIVITY_RECOGNITION_INTERFACE_H
+#define ANDROID_ACTIVITY_RECOGNITION_INTERFACE_H
+
+#include <hardware/hardware.h>
+
+__BEGIN_DECLS
+
+#define ACTIVITY_RECOGNITION_HEADER_VERSION   1
+#define ACTIVITY_RECOGNITION_API_VERSION_0_1  HARDWARE_DEVICE_API_VERSION_2(0, 1, ACTIVITY_RECOGNITION_HEADER_VERSION)
+
+#define ACTIVITY_RECOGNITION_HARDWARE_MODULE_ID "activity_recognition"
+#define ACTIVITY_RECOGNITION_HARDWARE_INTERFACE "activity_recognition_hw_if"
+
+/*
+ * Define types for various activities. Multiple activities may be active at the same time and
+ * sometimes none of these activities may be active.
+ *
+ * Each activity has a corresponding type. Only activities that are defined here should use
+ * android.activity_recognition.* prefix. OEM defined activities should not use this prefix.
+ * Activity type of OEM-defined activities should start with the reverse domain name of the entity
+ * defining the activity.
+ *
+ * When android introduces a new activity type that can potentially replace an OEM-defined activity
+ * type, the OEM must use the official activity type on versions of the HAL that support this new
+ * official activity type.
+ *
+ * Example (made up): Suppose Google's Glass team wants to detect nodding activity.
+ *  - Such an activity is not officially supported in android L
+ *  - Glass devices launching on L can implement a custom activity with
+ *    type = "com.google.glass.nodding"
+ *  - In M android release, if android decides to define ACITIVITY_TYPE_NODDING, those types
+ *    should replace the Glass-team-specific types in all future launches.
+ *  - When launching glass on the M release, Google should now use the official activity type
+ *  - This way, other applications can use this activity.
+ */
+
+#define ACTIVITY_TYPE_IN_VEHICLE       "android.activity_recognition.in_vehicle"
+
+#define ACTIVITY_TYPE_ON_BICYCLE       "android.activity_recognition.on_bicycle"
+
+#define ACTIVITY_TYPE_WALKING          "android.activity_recognition.walking"
+
+#define ACTIVITY_TYPE_RUNNING          "android.activity_recognition.running"
+
+#define ACTIVITY_TYPE_STILL            "android.activity_recognition.still"
+
+#define ACTIVITY_TYPE_TILTING          "android.activity_recognition.tilting"
+
+/* Values for activity_event.event_types. */
+enum {
+    /*
+     * A flush_complete event which indicates that a flush() has been successfully completed. This
+     * does not correspond to any activity/event. An event of this type should be added to the end
+     * of a batch FIFO and it indicates that all the events in the batch FIFO have been successfully
+     * reported to the framework. An event of this type should be generated only if flush() has been
+     * explicitly called and if the FIFO is empty at the time flush() is called it should trivially
+     * return a flush_complete_event to indicate that the FIFO is empty.
+     *
+     * A flush complete event should have the following parameters set.
+     * activity_event_t.event_type = ACTIVITY_EVENT_FLUSH_COMPLETE
+     * activity_event_t.activity = 0
+     * activity_event_t.timestamp = 0
+     * activity_event_t.reserved = 0
+     * See (*flush)() for more details.
+     */
+    ACTIVITY_EVENT_FLUSH_COMPLETE = 0,
+
+    /* Signifies entering an activity. */
+    ACTIVITY_EVENT_ENTER = 1,
+
+    /* Signifies exiting an activity. */
+    ACTIVITY_EVENT_EXIT  = 2
+};
+
+/*
+ * Each event is a separate activity with event_type indicating whether this activity has started
+ * or ended. Eg event: (event_type="enter", activity="ON_FOOT", timestamp)
+ */
+typedef struct activity_event {
+    /* One of the ACTIVITY_EVENT_* constants defined above. */
+    uint32_t event_type;
+
+    /*
+     * Index of the activity in the list returned by get_supported_activities_list. If this event
+     * is a flush complete event, this should be set to zero.
+     */
+    uint32_t activity;
+
+    /* Time at which the transition/event has occurred in nanoseconds using elapsedRealTimeNano. */
+    int64_t timestamp;
+
+    /* Set to zero. */
+    int32_t reserved[4];
+} activity_event_t;
+
+typedef struct activity_recognition_module {
+    /**
+     * Common methods of the activity recognition module.  This *must* be the first member of
+     * activity_recognition_module as users of this structure will cast a hw_module_t to
+     * activity_recognition_module pointer in contexts where it's known the hw_module_t
+     * references an activity_recognition_module.
+     */
+    hw_module_t common;
+
+    /*
+     * List of all activities supported by this module including OEM defined activities. Each
+     * activity is represented using a string defined above. Each string should be null terminated.
+     * The index of the activity in this array is used as a "handle" for enabling/disabling and
+     * event delivery.
+     * Return value is the size of this list.
+     */
+    int (*get_supported_activities_list)(struct activity_recognition_module* module,
+            char const* const* *activity_list);
+} activity_recognition_module_t;
+
+struct activity_recognition_device;
+
+typedef struct activity_recognition_callback_procs {
+    // Callback for activity_data. This is guaranteed to not invoke any HAL methods.
+    // Memory allocated for the events can be reused after this method returns.
+    //    events - Array of activity_event_t s that are reported.
+    //    count  - size of the array.
+    void (*activity_callback)(const struct activity_recognition_callback_procs* procs,
+            const activity_event_t* events, int count);
+} activity_recognition_callback_procs_t;
+
+typedef struct activity_recognition_device {
+    /**
+     * Common methods of the activity recognition device.  This *must* be the first member of
+     * activity_recognition_device as users of this structure will cast a hw_device_t to
+     * activity_recognition_device pointer in contexts where it's known the hw_device_t
+     * references an activity_recognition_device.
+     */
+    hw_device_t common;
+
+    /*
+     * Sets the callback to invoke when there are events to report. This call overwrites the
+     * previously registered callback (if any).
+     */
+    void (*register_activity_callback)(const struct activity_recognition_device* dev,
+            const activity_recognition_callback_procs_t* callback);
+
+    /*
+     * Activates monitoring of activity transitions. Activities need not be reported as soon as they
+     * are detected. The detected activities are stored in a FIFO and reported in batches when the
+     * "max_batch_report_latency" expires or when the batch FIFO is full. The implementation should
+     * allow the AP to go into suspend mode while the activities are detected and stored in the
+     * batch FIFO. Whenever events need to be reported (like when the FIFO is full or when the
+     * max_batch_report_latency has expired for an activity, event pair), it should wake_up the AP
+     * so that no events are lost. Activities are stored as transitions and they are allowed to
+     * overlap with each other. Each (activity, event_type) pair can be activated or deactivated
+     * independently of the other. The HAL implementation needs to keep track of which pairs are
+     * currently active and needs to detect only those pairs.
+     *
+     * activity_handle - Index of the specific activity that needs to be detected in the list
+     *                   returned by get_supported_activities_list.
+     * event_type - Specific transition of the activity that needs to be detected.
+     * max_batch_report_latency_ns - a transition can be delayed by at most
+     *                               “max_batch_report_latency” nanoseconds.
+     * Return 0 on success, negative errno code otherwise.
+     */
+    int (*enable_activity_event)(const struct activity_recognition_device* dev,
+            uint32_t activity_handle, uint32_t event_type, int64_t max_batch_report_latency_ns);
+
+    /*
+     * Disables detection of a specific (activity, event_type) pair.
+     */
+    int (*disable_activity_event)(const struct activity_recognition_device* dev,
+            uint32_t activity_handle, uint32_t event_type);
+
+    /*
+     * Flush all the batch FIFOs. Report all the activities that were stored in the FIFO so far as
+     * if max_batch_report_latency had expired. This shouldn't change the latency in any way. Add
+     * a flush_complete_event to indicate the end of the FIFO after all events are delivered.
+     * See ACTIVITY_EVENT_FLUSH_COMPLETE for more details.
+     * Return 0 on success, negative errno code otherwise.
+     */
+    int (*flush)(const struct activity_recognition_device* dev);
+
+    // Must be set to NULL.
+    void (*reserved_procs[16 - 4])(void);
+} activity_recognition_device_t;
+
+static inline int activity_recognition_open(const hw_module_t* module,
+        activity_recognition_device_t** device) {
+    return module->methods->open(module,
+            ACTIVITY_RECOGNITION_HARDWARE_INTERFACE, (hw_device_t**)device);
+}
+
+static inline int activity_recognition_close(activity_recognition_device_t* device) {
+    return device->common.close(&device->common);
+}
+
+__END_DECLS
+
+#endif // ANDROID_ACTIVITY_RECOGNITION_INTERFACE_H
diff --git a/include/hardware/audio.h b/include/hardware/audio.h
index 6ba2544..2389c09 100644
--- a/include/hardware/audio.h
+++ b/include/hardware/audio.h
@@ -54,7 +54,10 @@
 #define AUDIO_DEVICE_API_VERSION_0_0 HARDWARE_DEVICE_API_VERSION(0, 0)
 #define AUDIO_DEVICE_API_VERSION_1_0 HARDWARE_DEVICE_API_VERSION(1, 0)
 #define AUDIO_DEVICE_API_VERSION_2_0 HARDWARE_DEVICE_API_VERSION(2, 0)
-#define AUDIO_DEVICE_API_VERSION_CURRENT AUDIO_DEVICE_API_VERSION_2_0
+#define AUDIO_DEVICE_API_VERSION_3_0 HARDWARE_DEVICE_API_VERSION(3, 0)
+#define AUDIO_DEVICE_API_VERSION_CURRENT AUDIO_DEVICE_API_VERSION_3_0
+/* Minimal audio HAL version supported by the audio framework */
+#define AUDIO_DEVICE_API_VERSION_MIN AUDIO_DEVICE_API_VERSION_2_0
 
 /**
  * List of known audio HAL modules. This is the base name of the audio HAL
@@ -91,22 +94,42 @@
 #define AUDIO_PARAMETER_VALUE_TTY_HCO "tty_hco"
 #define AUDIO_PARAMETER_VALUE_TTY_FULL "tty_full"
 
+/* Hearing Aid Compatibility - Telecoil (HAC-T) mode on/off
+   Strings must be in sync with CallFeaturesSetting.java */
+#define AUDIO_PARAMETER_KEY_HAC "HACSetting"
+#define AUDIO_PARAMETER_VALUE_HAC_ON "ON"
+#define AUDIO_PARAMETER_VALUE_HAC_OFF "OFF"
+
 /* A2DP sink address set by framework */
 #define AUDIO_PARAMETER_A2DP_SINK_ADDRESS "a2dp_sink_address"
 
+/* A2DP source address set by framework */
+#define AUDIO_PARAMETER_A2DP_SOURCE_ADDRESS "a2dp_source_address"
+
 /* Screen state */
 #define AUDIO_PARAMETER_KEY_SCREEN_STATE "screen_state"
 
+/* Bluetooth SCO wideband */
+#define AUDIO_PARAMETER_KEY_BT_SCO_WB "bt_wbs"
+
+/* Get a new HW synchronization source identifier.
+ * Return a valid source (positive integer) or AUDIO_HW_SYNC_INVALID if an error occurs
+ * or no HW sync is available. */
+#define AUDIO_PARAMETER_HW_AV_SYNC "hw_av_sync"
+
 /**
  *  audio stream parameters
  */
 
-#define AUDIO_PARAMETER_STREAM_ROUTING "routing"            // audio_devices_t
-#define AUDIO_PARAMETER_STREAM_FORMAT "format"              // audio_format_t
-#define AUDIO_PARAMETER_STREAM_CHANNELS "channels"          // audio_channel_mask_t
-#define AUDIO_PARAMETER_STREAM_FRAME_COUNT "frame_count"    // size_t
-#define AUDIO_PARAMETER_STREAM_INPUT_SOURCE "input_source"  // audio_source_t
-#define AUDIO_PARAMETER_STREAM_SAMPLING_RATE "sampling_rate" // uint32_t
+#define AUDIO_PARAMETER_STREAM_ROUTING "routing"             /* audio_devices_t */
+#define AUDIO_PARAMETER_STREAM_FORMAT "format"               /* audio_format_t */
+#define AUDIO_PARAMETER_STREAM_CHANNELS "channels"           /* audio_channel_mask_t */
+#define AUDIO_PARAMETER_STREAM_FRAME_COUNT "frame_count"     /* size_t */
+#define AUDIO_PARAMETER_STREAM_INPUT_SOURCE "input_source"   /* audio_source_t */
+#define AUDIO_PARAMETER_STREAM_SAMPLING_RATE "sampling_rate" /* uint32_t */
+
+#define AUDIO_PARAMETER_DEVICE_CONNECT "connect"            /* audio_devices_t */
+#define AUDIO_PARAMETER_DEVICE_DISCONNECT "disconnect"      /* audio_devices_t */
 
 /* Query supported formats. The response is a '|' separated list of strings from
  * audio_format_t enum e.g: "sup_formats=AUDIO_FORMAT_PCM_16_BIT" */
@@ -118,6 +141,9 @@
  * "sup_sampling_rates=44100|48000" */
 #define AUDIO_PARAMETER_STREAM_SUP_SAMPLING_RATES "sup_sampling_rates"
 
+/* Set the HW synchronization source for an output stream. */
+#define AUDIO_PARAMETER_STREAM_HW_AV_SYNC "hw_av_sync"
+
 /**
  * audio codec parameters
  */
@@ -137,18 +163,6 @@
 
 /**************************************/
 
-/* common audio stream configuration parameters
- * You should memset() the entire structure to zero before use to
- * ensure forward compatibility
- */
-struct audio_config {
-    uint32_t sample_rate;
-    audio_channel_mask_t channel_mask;
-    audio_format_t  format;
-    audio_offload_info_t offload_info;
-};
-typedef struct audio_config audio_config_t;
-
 /* common audio stream parameters and operations */
 struct audio_stream {
 
@@ -257,6 +271,11 @@
  */
 
 struct audio_stream_out {
+    /**
+     * Common methods of the audio stream out.  This *must* be the first member of audio_stream_out
+     * as users of this structure will cast a audio_stream to audio_stream_out pointer in contexts
+     * where it's known the audio_stream references an audio_stream_out.
+     */
     struct audio_stream common;
 
     /**
@@ -380,6 +399,11 @@
 typedef struct audio_stream_out audio_stream_out_t;
 
 struct audio_stream_in {
+    /**
+     * Common methods of the audio stream in.  This *must* be the first member of audio_stream_in
+     * as users of this structure will cast a audio_stream to audio_stream_in pointer in contexts
+     * where it's known the audio_stream references an audio_stream_in.
+     */
     struct audio_stream common;
 
     /** set the input gain for the audio driver. This method is for
@@ -409,7 +433,10 @@
 
 /**
  * return the frame size (number of bytes per sample).
+ *
+ * Deprecated: use audio_stream_out_frame_size() or audio_stream_in_frame_size() instead.
  */
+__attribute__((__deprecated__))
 static inline size_t audio_stream_frame_size(const struct audio_stream *s)
 {
     size_t chan_samp_sz;
@@ -423,6 +450,37 @@
     return sizeof(int8_t);
 }
 
+/**
+ * return the frame size (number of bytes per sample) of an output stream.
+ */
+static inline size_t audio_stream_out_frame_size(const struct audio_stream_out *s)
+{
+    size_t chan_samp_sz;
+    audio_format_t format = s->common.get_format(&s->common);
+
+    if (audio_is_linear_pcm(format)) {
+        chan_samp_sz = audio_bytes_per_sample(format);
+        return audio_channel_count_from_out_mask(s->common.get_channels(&s->common)) * chan_samp_sz;
+    }
+
+    return sizeof(int8_t);
+}
+
+/**
+ * return the frame size (number of bytes per sample) of an input stream.
+ */
+static inline size_t audio_stream_in_frame_size(const struct audio_stream_in *s)
+{
+    size_t chan_samp_sz;
+    audio_format_t format = s->common.get_format(&s->common);
+
+    if (audio_is_linear_pcm(format)) {
+        chan_samp_sz = audio_bytes_per_sample(format);
+        return audio_channel_count_from_in_mask(s->common.get_channels(&s->common)) * chan_samp_sz;
+    }
+
+    return sizeof(int8_t);
+}
 
 /**********************************************************************/
 
@@ -436,6 +494,11 @@
 };
 
 struct audio_hw_device {
+    /**
+     * Common methods of the audio device.  This *must* be the first member of audio_hw_device
+     * as users of this structure will cast a hw_device_t to audio_hw_device pointer in contexts
+     * where it's known the hw_device_t references an audio_hw_device.
+     */
     struct hw_device_t common;
 
     /**
@@ -505,13 +568,21 @@
     size_t (*get_input_buffer_size)(const struct audio_hw_device *dev,
                                     const struct audio_config *config);
 
-    /** This method creates and opens the audio hardware output stream */
+    /** This method creates and opens the audio hardware output stream.
+     * The "address" parameter qualifies the "devices" audio device type if needed.
+     * The format format depends on the device type:
+     * - Bluetooth devices use the MAC address of the device in the form "00:11:22:AA:BB:CC"
+     * - USB devices use the ALSA card and device numbers in the form  "card=X;device=Y"
+     * - Other devices may use a number or any other string.
+     */
+
     int (*open_output_stream)(struct audio_hw_device *dev,
                               audio_io_handle_t handle,
                               audio_devices_t devices,
                               audio_output_flags_t flags,
                               struct audio_config *config,
-                              struct audio_stream_out **stream_out);
+                              struct audio_stream_out **stream_out,
+                              const char *address);
 
     void (*close_output_stream)(struct audio_hw_device *dev,
                                 struct audio_stream_out* stream_out);
@@ -521,7 +592,10 @@
                              audio_io_handle_t handle,
                              audio_devices_t devices,
                              struct audio_config *config,
-                             struct audio_stream_in **stream_in);
+                             struct audio_stream_in **stream_in,
+                             audio_input_flags_t flags,
+                             const char *address,
+                             audio_source_t source);
 
     void (*close_input_stream)(struct audio_hw_device *dev,
                                struct audio_stream_in *stream_in);
@@ -543,6 +617,38 @@
      * method may leave it set to NULL.
      */
     int (*get_master_mute)(struct audio_hw_device *dev, bool *mute);
+
+    /**
+     * Routing control
+     */
+
+    /* Creates an audio patch between several source and sink ports.
+     * The handle is allocated by the HAL and should be unique for this
+     * audio HAL module. */
+    int (*create_audio_patch)(struct audio_hw_device *dev,
+                               unsigned int num_sources,
+                               const struct audio_port_config *sources,
+                               unsigned int num_sinks,
+                               const struct audio_port_config *sinks,
+                               audio_patch_handle_t *handle);
+
+    /* Release an audio patch */
+    int (*release_audio_patch)(struct audio_hw_device *dev,
+                               audio_patch_handle_t handle);
+
+    /* Fills the list of supported attributes for a given audio port.
+     * As input, "port" contains the information (type, role, address etc...)
+     * needed by the HAL to identify the port.
+     * As output, "port" contains possible attributes (sampling rates, formats,
+     * channel masks, gain controllers...) for this port.
+     */
+    int (*get_audio_port)(struct audio_hw_device *dev,
+                          struct audio_port *port);
+
+    /* Set audio port configuration */
+    int (*set_audio_port_config)(struct audio_hw_device *dev,
+                         const struct audio_port_config *config);
+
 };
 typedef struct audio_hw_device audio_hw_device_t;
 
diff --git a/include/hardware/audio_alsaops.h b/include/hardware/audio_alsaops.h
new file mode 100644
index 0000000..0d266ff
--- /dev/null
+++ b/include/hardware/audio_alsaops.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* This file contains shared utility functions to handle the tinyalsa
+ * implementation for Android internal audio, generally in the hardware layer.
+ * Some routines may log a fatal error on failure, as noted.
+ */
+
+#ifndef ANDROID_AUDIO_ALSAOPS_H
+#define ANDROID_AUDIO_ALSAOPS_H
+
+#include <cutils/log.h>
+#include <system/audio.h>
+#include <tinyalsa/asoundlib.h>
+
+__BEGIN_DECLS
+
+/* Converts audio_format to pcm_format.
+ * Parameters:
+ *  format  the audio_format_t to convert
+ *
+ * Logs a fatal error if format is not a valid convertible audio_format_t.
+ */
+static inline enum pcm_format pcm_format_from_audio_format(audio_format_t format)
+{
+    switch (format) {
+#ifdef HAVE_BIG_ENDIAN
+    case AUDIO_FORMAT_PCM_16_BIT:
+        return PCM_FORMAT_S16_BE;
+    case AUDIO_FORMAT_PCM_24_BIT_PACKED:
+        return PCM_FORMAT_S24_3BE;
+    case AUDIO_FORMAT_PCM_32_BIT:
+        return PCM_FORMAT_S32_BE;
+    case AUDIO_FORMAT_PCM_8_24_BIT:
+        return PCM_FORMAT_S24_BE;
+#else
+    case AUDIO_FORMAT_PCM_16_BIT:
+        return PCM_FORMAT_S16_LE;
+    case AUDIO_FORMAT_PCM_24_BIT_PACKED:
+        return PCM_FORMAT_S24_3LE;
+    case AUDIO_FORMAT_PCM_32_BIT:
+        return PCM_FORMAT_S32_LE;
+    case AUDIO_FORMAT_PCM_8_24_BIT:
+        return PCM_FORMAT_S24_LE;
+#endif
+    case AUDIO_FORMAT_PCM_FLOAT:  /* there is no equivalent for float */
+    default:
+        LOG_ALWAYS_FATAL("pcm_format_from_audio_format: invalid audio format %#x", format);
+        return 0;
+    }
+}
+
+/* Converts pcm_format to audio_format.
+ * Parameters:
+ *  format  the pcm_format to convert
+ *
+ * Logs a fatal error if format is not a valid convertible pcm_format.
+ */
+static inline audio_format_t audio_format_from_pcm_format(enum pcm_format format)
+{
+    switch (format) {
+#ifdef HAVE_BIG_ENDIAN
+    case PCM_FORMAT_S16_BE:
+        return AUDIO_FORMAT_PCM_16_BIT;
+    case PCM_FORMAT_S24_3BE:
+        return AUDIO_FORMAT_PCM_24_BIT_PACKED;
+    case PCM_FORMAT_S24_BE:
+        return AUDIO_FORMAT_PCM_8_24_BIT;
+    case PCM_FORMAT_S32_BE:
+        return AUDIO_FORMAT_PCM_32_BIT;
+#else
+    case PCM_FORMAT_S16_LE:
+        return AUDIO_FORMAT_PCM_16_BIT;
+    case PCM_FORMAT_S24_3LE:
+        return AUDIO_FORMAT_PCM_24_BIT_PACKED;
+    case PCM_FORMAT_S24_LE:
+        return AUDIO_FORMAT_PCM_8_24_BIT;
+    case PCM_FORMAT_S32_LE:
+        return AUDIO_FORMAT_PCM_32_BIT;
+#endif
+    default:
+        LOG_ALWAYS_FATAL("audio_format_from_pcm_format: invalid pcm format %#x", format);
+        return 0;
+    }
+}
+
+__END_DECLS
+
+#endif /* ANDROID_AUDIO_ALSAOPS_H */
diff --git a/include/hardware/audio_effect.h b/include/hardware/audio_effect.h
index b49d02d..41cd2e6 100644
--- a/include/hardware/audio_effect.h
+++ b/include/hardware/audio_effect.h
@@ -344,9 +344,10 @@
     //    Output:
     //          returned value: 0       successful operation
     //                          -EINVAL invalid interface handle or
-    //                                  invalid command/reply size or format according to command code
-    //              The return code should be restricted to indicate problems related to the this
-    //              API specification. Status related to the execution of a particular command should be
+    //                                  invalid command/reply size or format according to
+    //                                  command code
+    //              The return code should be restricted to indicate problems related to this API
+    //              specification. Status related to the execution of a particular command should be
     //              indicated as part of the reply field.
     //
     //          *pReplyData updated with command response
@@ -815,7 +816,7 @@
     uint32_t   samplingRate;    // sampling rate
     uint32_t   channels;        // channel mask (see audio_channel_mask_t in audio.h)
     buffer_provider_t bufferProvider;   // buffer provider
-    uint8_t    format;          // Audio format  (see see audio_format_t in audio.h)
+    uint8_t    format;          // Audio format (see audio_format_t in audio.h)
     uint8_t    accessMode;      // read/write or accumulate in buffer (effect_buffer_access_e)
     uint16_t   mask;            // indicates which of the above fields is valid
 } buffer_config_t;
@@ -937,11 +938,12 @@
     //
     //    Input:
     //          uuid:    pointer to the effect uuid.
-    //          sessionId:  audio session to which this effect instance will be attached. All effects
-    //              created with the same session ID are connected in series and process the same signal
-    //              stream. Knowing that two effects are part of the same effect chain can help the
-    //              library implement some kind of optimizations.
-    //          ioId:   identifies the output or input stream this effect is directed to at audio HAL.
+    //          sessionId:  audio session to which this effect instance will be attached.
+    //              All effects created with the same session ID are connected in series and process
+    //              the same signal stream. Knowing that two effects are part of the same effect
+    //              chain can help the library implement some kind of optimizations.
+    //          ioId:   identifies the output or input stream this effect is directed to in
+    //              audio HAL.
     //              For future use especially with tunneled HW accelerated effects
     //
     //    Input/Output:
diff --git a/include/hardware/audio_policy.h b/include/hardware/audio_policy.h
index 4e75e02..99cb044 100644
--- a/include/hardware/audio_policy.h
+++ b/include/hardware/audio_policy.h
@@ -248,9 +248,6 @@
                                 const audio_offload_info_t *info);
 };
 
-/* audio hw module handle used by load_hw_module(), open_output_on_module()
- * and open_input_on_module() */
-typedef int audio_module_handle_t;
 
 struct audio_policy_service_ops {
     /*
@@ -332,10 +329,9 @@
                              audio_io_handle_t output,
                              int delay_ms);
 
-    /* reroute a given stream type to the specified output */
-    int (*set_stream_output)(void *service,
-                             audio_stream_type_t stream,
-                             audio_io_handle_t output);
+    /* invalidate a stream type, causing a reroute to an unspecified new output */
+    int (*invalidate_stream)(void *service,
+                             audio_stream_type_t stream);
 
     /* function enabling to send proprietary informations directly from audio
      * policy manager to audio hardware interface. */
@@ -424,6 +420,12 @@
 } audio_policy_module_t;
 
 struct audio_policy_device {
+    /**
+     * Common methods of the audio policy device.  This *must* be the first member of
+     * audio_policy_device as users of this structure will cast a hw_device_t to
+     * audio_policy_device pointer in contexts where it's known the hw_device_t references an
+     * audio_policy_device.
+     */
     struct hw_device_t common;
 
     int (*create_audio_policy)(const struct audio_policy_device *device,
diff --git a/include/hardware/bluetooth.h b/include/hardware/bluetooth.h
index c00a8f7..3427213 100644
--- a/include/hardware/bluetooth.h
+++ b/include/hardware/bluetooth.h
@@ -17,6 +17,7 @@
 #ifndef ANDROID_INCLUDE_BLUETOOTH_H
 #define ANDROID_INCLUDE_BLUETOOTH_H
 
+#include <stdbool.h>
 #include <stdint.h>
 #include <sys/cdefs.h>
 #include <sys/types.h>
@@ -37,14 +38,18 @@
 /* Bluetooth profile interface IDs */
 
 #define BT_PROFILE_HANDSFREE_ID "handsfree"
+#define BT_PROFILE_HANDSFREE_CLIENT_ID "handsfree_client"
 #define BT_PROFILE_ADVANCED_AUDIO_ID "a2dp"
+#define BT_PROFILE_ADVANCED_AUDIO_SINK_ID "a2dp_sink"
 #define BT_PROFILE_HEALTH_ID "health"
 #define BT_PROFILE_SOCKETS_ID "socket"
 #define BT_PROFILE_HIDHOST_ID "hidhost"
 #define BT_PROFILE_PAN_ID "pan"
-
+#define BT_PROFILE_MAP_CLIENT_ID "map_client"
+#define BT_PROFILE_SDP_CLIENT_ID "sdp"
 #define BT_PROFILE_GATT_ID "gatt"
 #define BT_PROFILE_AV_RC_ID "avrcp"
+#define BT_PROFILE_AV_RC_CTRL_ID "avrcp_ctrl"
 
 /** Bluetooth Address */
 typedef struct {
@@ -83,7 +88,8 @@
     BT_STATUS_PARM_INVALID,
     BT_STATUS_UNHANDLED,
     BT_STATUS_AUTH_FAILURE,
-    BT_STATUS_RMT_DEV_DOWN
+    BT_STATUS_RMT_DEV_DOWN,
+    BT_STATUS_AUTH_REJECTED
 
 } bt_status_t;
 
@@ -92,6 +98,15 @@
     uint8_t pin[16];
 } __attribute__((packed))bt_pin_code_t;
 
+typedef struct {
+    uint8_t status;
+    uint8_t ctrl_state;     /* stack reported state */
+    uint64_t tx_time;       /* in ms */
+    uint64_t rx_time;       /* in ms */
+    uint64_t idle_time;     /* in ms */
+    uint64_t energy_used;   /* a product of mA, V and ms */
+} __attribute__((packed))bt_activity_energy_info;
+
 /** Bluetooth Adapter Discovery state */
 typedef enum {
     BT_DISCOVERY_STOPPED,
@@ -126,6 +141,21 @@
    int manufacturer;
 } bt_remote_version_t;
 
+typedef struct
+{
+    uint16_t version_supported;
+    uint8_t local_privacy_enabled;
+    uint8_t max_adv_instance;
+    uint8_t rpa_offload_supported;
+    uint8_t max_irk_list_size;
+    uint8_t max_adv_filter_supported;
+    uint8_t activity_energy_info_supported;
+    uint16_t scan_result_storage_size;
+    uint16_t total_trackable_advertisers;
+    bool extended_scan_support;
+    bool debug_logging_supported;
+}bt_local_le_features_t;
+
 /* Bluetooth Adapter and Remote Device property types */
 typedef enum {
     /* Properties common to both adapter and remote device */
@@ -208,6 +238,13 @@
 
     BT_PROPERTY_REMOTE_VERSION_INFO,
 
+    /**
+     * Description - Local LE features
+     * Access mode - GET.
+     * Data type   - bt_local_le_features_t.
+     */
+    BT_PROPERTY_LOCAL_LE_FEATURES,
+
     BT_PROPERTY_REMOTE_DEVICE_TIMESTAMP = 0xFF,
 } bt_property_type_t;
 
@@ -219,6 +256,7 @@
     void *val;
 } bt_property_t;
 
+
 /** Bluetooth Device Type */
 typedef enum {
     BT_DEVICE_DEVTYPE_BREDR = 0x1,
@@ -280,7 +318,7 @@
 
 /** Bluetooth Legacy PinKey Request callback */
 typedef void (*pin_request_callback)(bt_bdaddr_t *remote_bd_addr,
-                                        bt_bdname_t *bd_name, uint32_t cod);
+                                        bt_bdname_t *bd_name, uint32_t cod, bool min_16_digit);
 
 /** Bluetooth SSP Request callback - Just Works & Numeric Comparison*/
 /** pass_key - Shall be 0 for BT_SSP_PAIRING_VARIANT_CONSENT &
@@ -321,6 +359,15 @@
 * This callback shall be invoked whenever the le_tx_test, le_rx_test or le_test_end is invoked
 * The num_packets is valid only for le_test_end command */
 typedef void (*le_test_mode_callback)(bt_status_t status, uint16_t num_packets);
+
+/** Callback invoked when energy details are obtained */
+/* Ctrl_state-Current controller state-Active-1,scan-2,or idle-3 state as defined by HCI spec.
+ * If the ctrl_state value is 0, it means the API call failed
+ * Time values-In milliseconds as returned by the controller
+ * Energy used-Value as returned by the controller
+ * Status-Provides the status of the read_energy_info API call */
+typedef void (*energy_info_callback)(bt_activity_energy_info *energy_info);
+
 /** TODO: Add callbacks for Link Up/Down and other generic
   *  notifications/callbacks */
 
@@ -340,8 +387,27 @@
     callback_thread_event thread_evt_cb;
     dut_mode_recv_callback dut_mode_recv_cb;
     le_test_mode_callback le_test_mode_cb;
+    energy_info_callback energy_info_cb;
 } bt_callbacks_t;
 
+typedef void (*alarm_cb)(void *data);
+typedef bool (*set_wake_alarm_callout)(uint64_t delay_millis, bool should_wake, alarm_cb cb, void *data);
+typedef int (*acquire_wake_lock_callout)(const char *lock_name);
+typedef int (*release_wake_lock_callout)(const char *lock_name);
+
+/** The set of functions required by bluedroid to set wake alarms and
+  * grab wake locks. This struct is passed into the stack through the
+  * |set_os_callouts| function on |bt_interface_t|.
+  */
+typedef struct {
+  /* set to sizeof(bt_os_callouts_t) */
+  size_t size;
+
+  set_wake_alarm_callout set_wake_alarm;
+  acquire_wake_lock_callout acquire_wake_lock;
+  release_wake_lock_callout release_wake_lock;
+} bt_os_callouts_t;
+
 /** NOTE: By default, no profiles are initialized at the time of init/enable.
  *  Whenever the application invokes the 'init' API of a profile, then one of
  *  the following shall occur:
@@ -417,7 +483,7 @@
     int (*cancel_discovery)(void);
 
     /** Create Bluetooth Bonding */
-    int (*create_bond)(const bt_bdaddr_t *bd_addr);
+    int (*create_bond)(const bt_bdaddr_t *bd_addr, int transport);
 
     /** Remove Bond */
     int (*remove_bond)(const bt_bdaddr_t *bd_addr);
@@ -425,6 +491,13 @@
     /** Cancel Bond */
     int (*cancel_bond)(const bt_bdaddr_t *bd_addr);
 
+    /**
+     * Get the connection status for a given remote device.
+     * return value of 0 means the device is not connected,
+     * non-zero return status indicates an active connection.
+     */
+    int (*get_connection_state)(const bt_bdaddr_t *bd_addr);
+
     /** BT Legacy PinKey Reply */
     /** If accept==FALSE, then pin_len and pin_code shall be 0x0 */
     int (*pin_reply)(const bt_bdaddr_t *bd_addr, uint8_t accept,
@@ -453,6 +526,28 @@
 
     /* enable or disable bluetooth HCI snoop log */
     int (*config_hci_snoop_log)(uint8_t enable);
+
+    /** Sets the OS call-out functions that bluedroid needs for alarms and wake locks.
+      * This should be called immediately after a successful |init|.
+      */
+    int (*set_os_callouts)(bt_os_callouts_t *callouts);
+
+    /** Read Energy info details - return value indicates BT_STATUS_SUCCESS or BT_STATUS_NOT_READY
+      * Success indicates that the VSC command was sent to controller
+      */
+    int (*read_energy_info)();
+
+    /**
+     * Native support for dumpsys function
+     * Function is synchronous and |fd| is owned by caller.
+     */
+    void (*dump)(int fd);
+
+    /**
+     * Clear /data/misc/bt_config.conf and erase all stored connections
+     */
+    int (*config_clear)(void);
+
 } bt_interface_t;
 
 /** TODO: Need to add APIs for Service Discovery, Service authorization and
@@ -465,6 +560,8 @@
 } bluetooth_device_t;
 
 typedef bluetooth_device_t bluetooth_module_t;
+
+
 __END_DECLS
 
 #endif /* ANDROID_INCLUDE_BLUETOOTH_H */
diff --git a/include/hardware/boot_control.h b/include/hardware/boot_control.h
new file mode 100644
index 0000000..62d6918
--- /dev/null
+++ b/include/hardware/boot_control.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INCLUDE_HARDWARE_BOOT_CONTROL_H
+#define ANDROID_INCLUDE_HARDWARE_BOOT_CONTROL_H
+
+#include <hardware/hardware.h>
+
+__BEGIN_DECLS
+
+#define BOOT_CONTROL_MODULE_API_VERSION_0_1  HARDWARE_MODULE_API_VERSION(0, 1)
+
+/**
+ * The id of this module
+ */
+#define BOOT_CONTROL_HARDWARE_MODULE_ID "bootctrl"
+
+/*
+ * The Boot Control HAL is designed to allow for managing sets of redundant
+ * partitions, called slots, that can be booted from independantly. Slots
+ * are sets of partitions whose names differ only by a given suffix.
+ * They are identified here by a 0 indexed number, and associated with their
+ * suffix, which can be appended to the base name for any particular partition
+ * to find the one associated with that slot. The bootloader must pass the suffix
+ * of the currently active slot either through a kernel command line property at
+ * androidboot.slot_suffix, or the device tree at /firmware/android/slot_suffix.
+ * The primary use of this set up is to allow for background updates while the
+ * device is running, and to provide a fallback in the event that the update fails.
+ */
+
+
+/**
+ * Every hardware module must have a data structure named HAL_MODULE_INFO_SYM
+ * and the fields of this data structure must begin with hw_module_t
+ * followed by module specific information.
+ */
+typedef struct boot_control_module {
+    struct hw_module_t common;
+
+    /*
+     * (*init)() perform any initialization tasks needed for the HAL.
+     * This is called only once.
+     */
+    void (*init)(struct boot_control_module *module);
+
+    /*
+     * (*getNumberSlots)() returns the number of available slots.
+     * For instance, a system with a single set of partitions would return
+     * 1, a system with A/B would return 2, A/B/C -> 3...
+     */
+    unsigned (*getNumberSlots)(struct boot_control_module *module);
+
+    /*
+     * (*getCurrentSlot)() returns the value letting the system know
+     * whether the current slot is A or B. The meaning of A and B is
+     * left up to the implementer. It is assumed that if the current slot
+     * is A, then the block devices underlying B can be accessed directly
+     * without any risk of corruption.
+     * The returned value is always guaranteed to be strictly less than the
+     * value returned by getNumberSlots. Slots start at 0 and
+     * finish at getNumberSlots() - 1
+     */
+    unsigned (*getCurrentSlot)(struct boot_control_module *module);
+
+    /*
+     * (*markBootSuccessful)() marks the current slot
+     * as having booted successfully
+     *
+     * Returns 0 on success, -errno on error.
+     */
+    int (*markBootSuccessful)(struct boot_control_module *module);
+
+    /*
+     * (*setActiveBootSlot)() marks the slot passed in parameter as
+     * the active boot slot (see getCurrentSlot for an explanation
+     * of the "slot" parameter). This overrides any previous call to
+     * setSlotAsUnbootable.
+     * Returns 0 on success, -errno on error.
+     */
+    int (*setActiveBootSlot)(struct boot_control_module *module, unsigned slot);
+
+    /*
+     * (*setSlotAsUnbootable)() marks the slot passed in parameter as
+     * an unbootable. This can be used while updating the contents of the slot's
+     * partitions, so that the system will not attempt to boot a known bad set up.
+     * Returns 0 on success, -errno on error.
+     */
+    int (*setSlotAsUnbootable)(struct boot_control_module *module, unsigned slot);
+
+    /*
+     * (*isSlotBootable)() returns if the slot passed in parameter has
+     * booted successfully in the past.
+     * Returns 1 if the slot has booted successfully, 0 if it has not,
+     * and -errno on error.
+     */
+    int (*isSlotBootable)(struct boot_control_module *module, unsigned slot);
+
+    /*
+     * (*getSuffix)() returns the string suffix used by partitions that
+     * correspond to the slot number passed in parameter. The returned string
+     * is expected to be statically allocated and not need to be freed.
+     * Returns NULL if slot does not match an existing slot.
+     */
+    const char* (*getSuffix)(struct boot_control_module *module, unsigned slot);
+
+    void* reserved[32];
+} boot_control_module_t;
+
+
+__END_DECLS
+
+#endif  // ANDROID_INCLUDE_HARDWARE_BOOT_CONTROL_H
diff --git a/include/hardware/bt_av.h b/include/hardware/bt_av.h
index 2ec00c3..5252a17 100644
--- a/include/hardware/bt_av.h
+++ b/include/hardware/bt_av.h
@@ -47,12 +47,23 @@
 typedef void (* btav_audio_state_callback)(btav_audio_state_t state, 
                                                bt_bdaddr_t *bd_addr);
 
+/** Callback for audio configuration change.
+ *  Used only for the A2DP sink interface.
+ *  state will have one of the values from btav_audio_state_t
+ *  sample_rate: sample rate in Hz
+ *  channel_count: number of channels (1 for mono, 2 for stereo)
+ */
+typedef void (* btav_audio_config_callback)(bt_bdaddr_t *bd_addr,
+                                                uint32_t sample_rate,
+                                                uint8_t channel_count);
+
 /** BT-AV callback structure. */
 typedef struct {
     /** set to sizeof(btav_callbacks_t) */
     size_t      size;
     btav_connection_state_callback  connection_state_cb;
     btav_audio_state_callback audio_state_cb;
+    btav_audio_config_callback audio_config_cb;
 } btav_callbacks_t;
 
 /** 
@@ -65,7 +76,9 @@
  *    android_audio_hw library and the Bluetooth stack.
  * 
  */
-/** Represents the standard BT-AV interface. */
+/** Represents the standard BT-AV interface.
+ *  Used for both the A2DP source and sink interfaces.
+ */
 typedef struct {
 
     /** set to sizeof(btav_interface_t) */
diff --git a/include/hardware/bt_common_types.h b/include/hardware/bt_common_types.h
new file mode 100644
index 0000000..e30ac24
--- /dev/null
+++ b/include/hardware/bt_common_types.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/******************************************************************************
+ *
+ *  This file contains constants and definitions that can be used commonly between JNI and stack layer
+ *
+ ******************************************************************************/
+#ifndef ANDROID_INCLUDE_BT_COMMON_TYPES_H
+#define ANDROID_INCLUDE_BT_COMMON_TYPES_H
+
+#include "bluetooth.h"
+
+typedef struct
+{
+    uint8_t  client_if;
+    uint8_t  filt_index;
+    uint8_t  advertiser_state;
+    uint8_t  advertiser_info_present;
+    uint8_t  addr_type;
+    uint8_t  tx_power;
+    int8_t  rssi_value;
+    uint16_t time_stamp;
+    bt_bdaddr_t bd_addr;
+    uint8_t  adv_pkt_len;
+    uint8_t  *p_adv_pkt_data;
+    uint8_t  scan_rsp_len;
+    uint8_t  *p_scan_rsp_data;
+} btgatt_track_adv_info_t;
+
+#endif  /* ANDROID_INCLUDE_BT_COMMON_TYPES_H */
diff --git a/include/hardware/bt_gatt_client.h b/include/hardware/bt_gatt_client.h
index d6b0cb4..e7e8e82 100644
--- a/include/hardware/bt_gatt_client.h
+++ b/include/hardware/bt_gatt_client.h
@@ -20,6 +20,7 @@
 
 #include <stdint.h>
 #include "bt_gatt_types.h"
+#include "bt_common_types.h"
 
 __BEGIN_DECLS
 
@@ -69,6 +70,23 @@
 
 typedef struct
 {
+    uint8_t  client_if;
+    uint8_t  action;
+    uint8_t  filt_index;
+    uint16_t feat_seln;
+    uint16_t list_logic_type;
+    uint8_t  filt_logic_type;
+    uint8_t  rssi_high_thres;
+    uint8_t  rssi_low_thres;
+    uint8_t  dely_mode;
+    uint16_t found_timeout;
+    uint16_t lost_timeout;
+    uint8_t  found_timeout_cnt;
+    uint16_t  num_of_tracking_entries;
+} btgatt_filt_param_setup_t;
+
+typedef struct
+{
     bt_bdaddr_t        *bda1;
     bt_uuid_t          *uuid1;
     uint16_t            u1;
@@ -78,6 +96,25 @@
     uint16_t            u5;
 } btgatt_test_params_t;
 
+/* BT GATT client error codes */
+typedef enum
+{
+    BT_GATTC_COMMAND_SUCCESS = 0,    /* 0  Command succeeded                 */
+    BT_GATTC_COMMAND_STARTED,        /* 1  Command started OK.               */
+    BT_GATTC_COMMAND_BUSY,           /* 2  Device busy with another command  */
+    BT_GATTC_COMMAND_STORED,         /* 3 request is stored in control block */
+    BT_GATTC_NO_RESOURCES,           /* 4  No resources to issue command     */
+    BT_GATTC_MODE_UNSUPPORTED,       /* 5  Request for 1 or more unsupported modes */
+    BT_GATTC_ILLEGAL_VALUE,          /* 6  Illegal command /parameter value  */
+    BT_GATTC_INCORRECT_STATE,        /* 7  Device in wrong state for request  */
+    BT_GATTC_UNKNOWN_ADDR,           /* 8  Unknown remote BD address         */
+    BT_GATTC_DEVICE_TIMEOUT,         /* 9  Device timeout                    */
+    BT_GATTC_INVALID_CONTROLLER_OUTPUT,/* 10  An incorrect value was received from HCI */
+    BT_GATTC_SECURITY_ERROR,          /* 11 Authorization or security failure or not authorized  */
+    BT_GATTC_DELAYED_ENCRYPTION_CHECK, /*12 Delayed encryption check */
+    BT_GATTC_ERR_PROCESSING           /* 12 Generic error                     */
+} btgattc_error_t;
+
 /** BT-GATT Client callback structure. */
 
 /** Callback invoked in response to register_client */
@@ -152,10 +189,62 @@
                                           int rssi, int status);
 
 /**
- * Callback indicationg the status of a listen() operation
+ * Callback indicating the status of a listen() operation
  */
 typedef void (*listen_callback)(int status, int server_if);
 
+/** Callback invoked when the MTU for a given connection changes */
+typedef void (*configure_mtu_callback)(int conn_id, int status, int mtu);
+
+/** Callback invoked when a scan filter configuration command has completed */
+typedef void (*scan_filter_cfg_callback)(int action, int client_if, int status, int filt_type,
+                                         int avbl_space);
+
+/** Callback invoked when scan param has been added, cleared, or deleted */
+typedef void (*scan_filter_param_callback)(int action, int client_if, int status,
+                                         int avbl_space);
+
+/** Callback invoked when a scan filter configuration command has completed */
+typedef void (*scan_filter_status_callback)(int enable, int client_if, int status);
+
+/** Callback invoked when multi-adv enable operation has completed */
+typedef void (*multi_adv_enable_callback)(int client_if, int status);
+
+/** Callback invoked when multi-adv param update operation has completed */
+typedef void (*multi_adv_update_callback)(int client_if, int status);
+
+/** Callback invoked when multi-adv instance data set operation has completed */
+typedef void (*multi_adv_data_callback)(int client_if, int status);
+
+/** Callback invoked when multi-adv disable operation has completed */
+typedef void (*multi_adv_disable_callback)(int client_if, int status);
+
+/**
+ * Callback notifying an application that a remote device connection is currently congested
+ * and cannot receive any more data. An application should avoid sending more data until
+ * a further callback is received indicating the congestion status has been cleared.
+ */
+typedef void (*congestion_callback)(int conn_id, bool congested);
+/** Callback invoked when batchscan storage config operation has completed */
+typedef void (*batchscan_cfg_storage_callback)(int client_if, int status);
+
+/** Callback invoked when batchscan enable / disable operation has completed */
+typedef void (*batchscan_enable_disable_callback)(int action, int client_if, int status);
+
+/** Callback invoked when batchscan reports are obtained */
+typedef void (*batchscan_reports_callback)(int client_if, int status, int report_format,
+                                           int num_records, int data_len, uint8_t* rep_data);
+
+/** Callback invoked when batchscan storage threshold limit is crossed */
+typedef void (*batchscan_threshold_callback)(int client_if);
+
+/** Track ADV VSE callback invoked when tracked device is found or lost */
+typedef void (*track_adv_event_callback)(btgatt_track_adv_info_t *p_track_adv_info);
+
+/** Callback invoked when scan parameter setup has completed */
+typedef void (*scan_parameter_setup_completed_callback)(int client_if,
+                                                        btgattc_error_t status);
+
 typedef struct {
     register_client_callback            register_client_cb;
     scan_result_callback                scan_result_cb;
@@ -175,6 +264,21 @@
     execute_write_callback              execute_write_cb;
     read_remote_rssi_callback           read_remote_rssi_cb;
     listen_callback                     listen_cb;
+    configure_mtu_callback              configure_mtu_cb;
+    scan_filter_cfg_callback            scan_filter_cfg_cb;
+    scan_filter_param_callback          scan_filter_param_cb;
+    scan_filter_status_callback         scan_filter_status_cb;
+    multi_adv_enable_callback           multi_adv_enable_cb;
+    multi_adv_update_callback           multi_adv_update_cb;
+    multi_adv_data_callback             multi_adv_data_cb;
+    multi_adv_disable_callback          multi_adv_disable_cb;
+    congestion_callback                 congestion_cb;
+    batchscan_cfg_storage_callback      batchscan_cfg_storage_cb;
+    batchscan_enable_disable_callback   batchscan_enb_disable_cb;
+    batchscan_reports_callback          batchscan_reports_cb;
+    batchscan_threshold_callback        batchscan_threshold_cb;
+    track_adv_event_callback            track_adv_event_cb;
+    scan_parameter_setup_completed_callback scan_parameter_setup_completed_cb;
 } btgatt_client_callbacks_t;
 
 /** Represents the standard BT-GATT client interface. */
@@ -187,11 +291,11 @@
     bt_status_t (*unregister_client)(int client_if );
 
     /** Start or stop LE device scanning */
-    bt_status_t (*scan)( int client_if, bool start );
+    bt_status_t (*scan)( bool start );
 
     /** Create a connection to a remote LE or dual-mode device */
     bt_status_t (*connect)( int client_if, const bt_bdaddr_t *bd_addr,
-                         bool is_direct );
+                         bool is_direct, int transport );
 
     /** Disconnect a remote device or cancel a pending connection */
     bt_status_t (*disconnect)( int client_if, const bt_bdaddr_t *bd_addr,
@@ -272,16 +376,78 @@
     /** Request RSSI for a given remote device */
     bt_status_t (*read_remote_rssi)( int client_if, const bt_bdaddr_t *bd_addr);
 
+    /** Setup scan filter params */
+    bt_status_t (*scan_filter_param_setup)(btgatt_filt_param_setup_t filt_param);
+
+
+    /** Configure a scan filter condition  */
+    bt_status_t (*scan_filter_add_remove)(int client_if, int action, int filt_type,
+                                   int filt_index, int company_id,
+                                   int company_id_mask, const bt_uuid_t *p_uuid,
+                                   const bt_uuid_t *p_uuid_mask, const bt_bdaddr_t *bd_addr,
+                                   char addr_type, int data_len, char* p_data, int mask_len,
+                                   char* p_mask);
+
+    /** Clear all scan filter conditions for specific filter index*/
+    bt_status_t (*scan_filter_clear)(int client_if, int filt_index);
+
+    /** Enable / disable scan filter feature*/
+    bt_status_t (*scan_filter_enable)(int client_if, bool enable);
+
     /** Determine the type of the remote device (LE, BR/EDR, Dual-mode) */
     int (*get_device_type)( const bt_bdaddr_t *bd_addr );
 
     /** Set the advertising data or scan response data */
-    bt_status_t (*set_adv_data)(int server_if, bool set_scan_rsp, bool include_name,
+    bt_status_t (*set_adv_data)(int client_if, bool set_scan_rsp, bool include_name,
                     bool include_txpower, int min_interval, int max_interval, int appearance,
-                    uint16_t manufacturer_len, char* manufacturer_data);
+                    uint16_t manufacturer_len, char* manufacturer_data,
+                    uint16_t service_data_len, char* service_data,
+                    uint16_t service_uuid_len, char* service_uuid);
+
+    /** Configure the MTU for a given connection */
+    bt_status_t (*configure_mtu)(int conn_id, int mtu);
+
+    /** Request a connection parameter update */
+    bt_status_t (*conn_parameter_update)(const bt_bdaddr_t *bd_addr, int min_interval,
+                    int max_interval, int latency, int timeout);
+
+    /** Sets the LE scan interval and window in units of N*0.625 msec */
+    bt_status_t (*set_scan_parameters)(int client_if, int scan_interval, int scan_window);
+
+    /* Setup the parameters as per spec, user manual specified values and enable multi ADV */
+    bt_status_t (*multi_adv_enable)(int client_if, int min_interval,int max_interval,int adv_type,
+                 int chnl_map, int tx_power, int timeout_s);
+
+    /* Update the parameters as per spec, user manual specified values and restart multi ADV */
+    bt_status_t (*multi_adv_update)(int client_if, int min_interval,int max_interval,int adv_type,
+                 int chnl_map, int tx_power, int timeout_s);
+
+    /* Setup the data for the specified instance */
+    bt_status_t (*multi_adv_set_inst_data)(int client_if, bool set_scan_rsp, bool include_name,
+                    bool incl_txpower, int appearance, int manufacturer_len,
+                    char* manufacturer_data, int service_data_len,
+                    char* service_data, int service_uuid_len, char* service_uuid);
+
+    /* Disable the multi adv instance */
+    bt_status_t (*multi_adv_disable)(int client_if);
+
+    /* Configure the batchscan storage */
+    bt_status_t (*batchscan_cfg_storage)(int client_if, int batch_scan_full_max,
+        int batch_scan_trunc_max, int batch_scan_notify_threshold);
+
+    /* Enable batchscan */
+    bt_status_t (*batchscan_enb_batch_scan)(int client_if, int scan_mode,
+        int scan_interval, int scan_window, int addr_type, int discard_rule);
+
+    /* Disable batchscan */
+    bt_status_t (*batchscan_dis_batch_scan)(int client_if);
+
+    /* Read out batchscan reports */
+    bt_status_t (*batchscan_read_reports)(int client_if, int scan_mode);
 
     /** Test mode interface */
     bt_status_t (*test_command)( int command, btgatt_test_params_t* params);
+
 } btgatt_client_interface_t;
 
 __END_DECLS
diff --git a/include/hardware/bt_gatt_server.h b/include/hardware/bt_gatt_server.h
index 1a5a400..0d6cc1e 100644
--- a/include/hardware/bt_gatt_server.h
+++ b/include/hardware/bt_gatt_server.h
@@ -104,6 +104,22 @@
  */
 typedef void (*response_confirmation_callback)(int status, int handle);
 
+/**
+ * Callback confirming that a notification or indication has been sent
+ * to a remote device.
+ */
+typedef void (*indication_sent_callback)(int conn_id, int status);
+
+/**
+ * Callback notifying an application that a remote device connection is currently congested
+ * and cannot receive any more data. An application should avoid sending more data until
+ * a further callback is received indicating the congestion status has been cleared.
+ */
+typedef void (*congestion_callback)(int conn_id, bool congested);
+
+/** Callback invoked when the MTU for a given connection changes */
+typedef void (*mtu_changed_callback)(int conn_id, int mtu);
+
 typedef struct {
     register_server_callback        register_server_cb;
     connection_callback             connection_cb;
@@ -118,6 +134,9 @@
     request_write_callback          request_write_cb;
     request_exec_write_callback     request_exec_write_cb;
     response_confirmation_callback  response_confirmation_cb;
+    indication_sent_callback        indication_sent_cb;
+    congestion_callback             congestion_cb;
+    mtu_changed_callback            mtu_changed_cb;
 } btgatt_server_callbacks_t;
 
 /** Represents the standard BT-GATT server interface. */
@@ -129,7 +148,8 @@
     bt_status_t (*unregister_server)(int server_if );
 
     /** Create a connection to a remote peripheral */
-    bt_status_t (*connect)(int server_if, const bt_bdaddr_t *bd_addr, bool is_direct );
+    bt_status_t (*connect)(int server_if, const bt_bdaddr_t *bd_addr,
+                            bool is_direct, int transport);
 
     /** Disconnect an established connection or cancel a pending one */
     bt_status_t (*disconnect)(int server_if, const bt_bdaddr_t *bd_addr,
@@ -168,6 +188,7 @@
     /** Send a response to a read/write operation */
     bt_status_t (*send_response)(int conn_id, int trans_id,
                                  int status, btgatt_response_t *response);
+
 } btgatt_server_interface_t;
 
 __END_DECLS
diff --git a/include/hardware/bt_gatt_types.h b/include/hardware/bt_gatt_types.h
index 0ac217e..e037ddc 100644
--- a/include/hardware/bt_gatt_types.h
+++ b/include/hardware/bt_gatt_types.h
@@ -43,6 +43,14 @@
     uint8_t             is_primary;
 } btgatt_srvc_id_t;
 
+/** Preferred physical Transport for GATT connection */
+typedef enum
+{
+    GATT_TRANSPORT_AUTO,
+    GATT_TRANSPORT_BREDR,
+    GATT_TRANSPORT_LE
+} btgatt_transport_t;
+
 __END_DECLS
 
 #endif /* ANDROID_INCLUDE_BT_GATT_TYPES_H */
diff --git a/include/hardware/bt_hf.h b/include/hardware/bt_hf.h
index 6135ac4..7dcb40a 100644
--- a/include/hardware/bt_hf.h
+++ b/include/hardware/bt_hf.h
@@ -57,6 +57,14 @@
     BTHF_NREC_START
 } bthf_nrec_t;
 
+/* WBS codec setting */
+typedef enum
+{
+   BTHF_WBS_NONE,
+   BTHF_WBS_NO,
+   BTHF_WBS_YES
+}bthf_wbs_config_t;
+
 /* CHLD - Call held handling */
 typedef enum
 {
@@ -79,65 +87,70 @@
 /** Callback for VR connection state change.
  *  state will have one of the values from BtHfVRState
  */
-typedef void (* bthf_vr_cmd_callback)(bthf_vr_state_t state);
+typedef void (* bthf_vr_cmd_callback)(bthf_vr_state_t state, bt_bdaddr_t *bd_addr);
 
 /** Callback for answer incoming call (ATA)
  */
-typedef void (* bthf_answer_call_cmd_callback)();
+typedef void (* bthf_answer_call_cmd_callback)(bt_bdaddr_t *bd_addr);
 
 /** Callback for disconnect call (AT+CHUP)
  */
-typedef void (* bthf_hangup_call_cmd_callback)();
+typedef void (* bthf_hangup_call_cmd_callback)(bt_bdaddr_t *bd_addr);
 
 /** Callback for disconnect call (AT+CHUP)
  *  type will denote Speaker/Mic gain (BtHfVolumeControl).
  */
-typedef void (* bthf_volume_cmd_callback)(bthf_volume_type_t type, int volume);
+typedef void (* bthf_volume_cmd_callback)(bthf_volume_type_t type, int volume, bt_bdaddr_t *bd_addr);
 
 /** Callback for dialing an outgoing call
  *  If number is NULL, redial
  */
-typedef void (* bthf_dial_call_cmd_callback)(char *number);
+typedef void (* bthf_dial_call_cmd_callback)(char *number, bt_bdaddr_t *bd_addr);
 
 /** Callback for sending DTMF tones
  *  tone contains the dtmf character to be sent
  */
-typedef void (* bthf_dtmf_cmd_callback)(char tone);
+typedef void (* bthf_dtmf_cmd_callback)(char tone, bt_bdaddr_t *bd_addr);
 
 /** Callback for enabling/disabling noise reduction/echo cancellation
  *  value will be 1 to enable, 0 to disable
  */
-typedef void (* bthf_nrec_cmd_callback)(bthf_nrec_t nrec);
+typedef void (* bthf_nrec_cmd_callback)(bthf_nrec_t nrec, bt_bdaddr_t *bd_addr);
+
+/** Callback for AT+BCS and event from BAC
+ *  WBS enable, WBS disable
+ */
+typedef void (* bthf_wbs_callback)(bthf_wbs_config_t wbs, bt_bdaddr_t *bd_addr);
 
 /** Callback for call hold handling (AT+CHLD)
  *  value will contain the call hold command (0, 1, 2, 3)
  */
-typedef void (* bthf_chld_cmd_callback)(bthf_chld_type_t chld);
+typedef void (* bthf_chld_cmd_callback)(bthf_chld_type_t chld, bt_bdaddr_t *bd_addr);
 
 /** Callback for CNUM (subscriber number)
  */
-typedef void (* bthf_cnum_cmd_callback)();
+typedef void (* bthf_cnum_cmd_callback)(bt_bdaddr_t *bd_addr);
 
 /** Callback for indicators (CIND)
  */
-typedef void (* bthf_cind_cmd_callback)();
+typedef void (* bthf_cind_cmd_callback)(bt_bdaddr_t *bd_addr);
 
 /** Callback for operator selection (COPS)
  */
-typedef void (* bthf_cops_cmd_callback)();
+typedef void (* bthf_cops_cmd_callback)(bt_bdaddr_t *bd_addr);
 
 /** Callback for call list (AT+CLCC)
  */
-typedef void (* bthf_clcc_cmd_callback) ();
+typedef void (* bthf_clcc_cmd_callback) (bt_bdaddr_t *bd_addr);
 
 /** Callback for unknown AT command recd from HF
  *  at_string will contain the unparsed AT string
  */
-typedef void (* bthf_unknown_at_cmd_callback)(char *at_string);
+typedef void (* bthf_unknown_at_cmd_callback)(char *at_string, bt_bdaddr_t *bd_addr);
 
 /** Callback for keypressed (HSP) event.
  */
-typedef void (* bthf_key_pressed_cmd_callback)();
+typedef void (* bthf_key_pressed_cmd_callback)(bt_bdaddr_t *bd_addr);
 
 /** BT-HF callback structure. */
 typedef struct {
@@ -152,6 +165,7 @@
     bthf_dial_call_cmd_callback     dial_call_cmd_cb;
     bthf_dtmf_cmd_callback          dtmf_cmd_cb;
     bthf_nrec_cmd_callback          nrec_cmd_cb;
+    bthf_wbs_callback               wbs_cb;
     bthf_chld_cmd_callback          chld_cmd_cb;
     bthf_cnum_cmd_callback          cnum_cmd_cb;
     bthf_cind_cmd_callback          cind_cmd_cb;
@@ -213,7 +227,7 @@
     /**
      * Register the BtHf callbacks
      */
-    bt_status_t (*init)( bthf_callbacks_t* callbacks );
+    bt_status_t (*init)( bthf_callbacks_t* callbacks, int max_hf_clients);
 
     /** connect to headset */
     bt_status_t (*connect)( bt_bdaddr_t *bd_addr );
@@ -228,33 +242,33 @@
     bt_status_t (*disconnect_audio)( bt_bdaddr_t *bd_addr );
 
     /** start voice recognition */
-    bt_status_t (*start_voice_recognition)();
+    bt_status_t (*start_voice_recognition)( bt_bdaddr_t *bd_addr );
 
     /** stop voice recognition */
-    bt_status_t (*stop_voice_recognition)();
+    bt_status_t (*stop_voice_recognition)( bt_bdaddr_t *bd_addr );
 
     /** volume control */
-    bt_status_t (*volume_control) (bthf_volume_type_t type, int volume);
+    bt_status_t (*volume_control) (bthf_volume_type_t type, int volume, bt_bdaddr_t *bd_addr );
 
     /** Combined device status change notification */
     bt_status_t (*device_status_notification)(bthf_network_state_t ntk_state, bthf_service_type_t svc_type, int signal,
                            int batt_chg);
 
     /** Response for COPS command */
-    bt_status_t (*cops_response)(const char *cops);
+    bt_status_t (*cops_response)(const char *cops, bt_bdaddr_t *bd_addr );
 
     /** Response for CIND command */
     bt_status_t (*cind_response)(int svc, int num_active, int num_held, bthf_call_state_t call_setup_state,
-                                 int signal, int roam, int batt_chg);
+                                 int signal, int roam, int batt_chg, bt_bdaddr_t *bd_addr );
 
     /** Pre-formatted AT response, typically in response to unknown AT cmd */
-    bt_status_t (*formatted_at_response)(const char *rsp);
+    bt_status_t (*formatted_at_response)(const char *rsp, bt_bdaddr_t *bd_addr );
 
     /** ok/error response
      *  ERROR (0)
      *  OK    (1)
      */
-    bt_status_t (*at_response) (bthf_at_response_t response_code, int error_code);
+    bt_status_t (*at_response) (bthf_at_response_t response_code, int error_code, bt_bdaddr_t *bd_addr );
 
     /** response for CLCC command 
      *  Can be iteratively called for each call index
@@ -263,7 +277,7 @@
     bt_status_t (*clcc_response) (int index, bthf_call_direction_t dir,
                                 bthf_call_state_t state, bthf_call_mode_t mode,
                                 bthf_call_mpty_type_t mpty, const char *number,
-                                bthf_call_addrtype_t type);
+                                bthf_call_addrtype_t type, bt_bdaddr_t *bd_addr );
 
     /** notify of a call state change
      *  Each update notifies 
@@ -277,6 +291,9 @@
 
     /** Closes the interface. */
     void  (*cleanup)( void );
+
+    /** configureation for the SCO codec */
+    bt_status_t (*configure_wbs)( bt_bdaddr_t *bd_addr ,bthf_wbs_config_t config );
 } bthf_interface_t;
 
 __END_DECLS
diff --git a/include/hardware/bt_hf_client.h b/include/hardware/bt_hf_client.h
new file mode 100644
index 0000000..8acf1b2
--- /dev/null
+++ b/include/hardware/bt_hf_client.h
@@ -0,0 +1,363 @@
+/*
+ * Copyright (C) 2012-2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INCLUDE_BT_HF_CLIENT_H
+#define ANDROID_INCLUDE_BT_HF_CLIENT_H
+
+__BEGIN_DECLS
+
+typedef enum {
+    BTHF_CLIENT_CONNECTION_STATE_DISCONNECTED = 0,
+    BTHF_CLIENT_CONNECTION_STATE_CONNECTING,
+    BTHF_CLIENT_CONNECTION_STATE_CONNECTED,
+    BTHF_CLIENT_CONNECTION_STATE_SLC_CONNECTED,
+    BTHF_CLIENT_CONNECTION_STATE_DISCONNECTING
+} bthf_client_connection_state_t;
+
+typedef enum {
+    BTHF_CLIENT_AUDIO_STATE_DISCONNECTED = 0,
+    BTHF_CLIENT_AUDIO_STATE_CONNECTING,
+    BTHF_CLIENT_AUDIO_STATE_CONNECTED,
+    BTHF_CLIENT_AUDIO_STATE_CONNECTED_MSBC,
+} bthf_client_audio_state_t;
+
+typedef enum {
+    BTHF_CLIENT_VR_STATE_STOPPED = 0,
+    BTHF_CLIENT_VR_STATE_STARTED
+} bthf_client_vr_state_t;
+
+typedef enum {
+    BTHF_CLIENT_VOLUME_TYPE_SPK = 0,
+    BTHF_CLIENT_VOLUME_TYPE_MIC
+} bthf_client_volume_type_t;
+
+typedef enum
+{
+    BTHF_CLIENT_NETWORK_STATE_NOT_AVAILABLE = 0,
+    BTHF_CLIENT_NETWORK_STATE_AVAILABLE
+} bthf_client_network_state_t;
+
+typedef enum
+{
+    BTHF_CLIENT_SERVICE_TYPE_HOME = 0,
+    BTHF_CLIENT_SERVICE_TYPE_ROAMING
+} bthf_client_service_type_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_STATE_ACTIVE = 0,
+    BTHF_CLIENT_CALL_STATE_HELD,
+    BTHF_CLIENT_CALL_STATE_DIALING,
+    BTHF_CLIENT_CALL_STATE_ALERTING,
+    BTHF_CLIENT_CALL_STATE_INCOMING,
+    BTHF_CLIENT_CALL_STATE_WAITING,
+    BTHF_CLIENT_CALL_STATE_HELD_BY_RESP_HOLD,
+} bthf_client_call_state_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_NO_CALLS_IN_PROGRESS = 0,
+    BTHF_CLIENT_CALL_CALLS_IN_PROGRESS
+} bthf_client_call_t;
+
+typedef enum {
+    BTHF_CLIENT_CALLSETUP_NONE = 0,
+    BTHF_CLIENT_CALLSETUP_INCOMING,
+    BTHF_CLIENT_CALLSETUP_OUTGOING,
+    BTHF_CLIENT_CALLSETUP_ALERTING
+
+} bthf_client_callsetup_t;
+
+typedef enum {
+    BTHF_CLIENT_CALLHELD_NONE = 0,
+    BTHF_CLIENT_CALLHELD_HOLD_AND_ACTIVE,
+    BTHF_CLIENT_CALLHELD_HOLD,
+} bthf_client_callheld_t;
+
+typedef enum {
+    BTHF_CLIENT_RESP_AND_HOLD_HELD = 0,
+    BTRH_CLIENT_RESP_AND_HOLD_ACCEPT,
+    BTRH_CLIENT_RESP_AND_HOLD_REJECT,
+} bthf_client_resp_and_hold_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_DIRECTION_OUTGOING = 0,
+    BTHF_CLIENT_CALL_DIRECTION_INCOMING
+} bthf_client_call_direction_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_MPTY_TYPE_SINGLE = 0,
+    BTHF_CLIENT_CALL_MPTY_TYPE_MULTI
+} bthf_client_call_mpty_type_t;
+
+typedef enum {
+    BTHF_CLIENT_CMD_COMPLETE_OK = 0,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_NO_CARRIER,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_BUSY,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_NO_ANSWER,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_DELAYED,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_BLACKLISTED,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_CME
+} bthf_client_cmd_complete_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_ACTION_CHLD_0 = 0,
+    BTHF_CLIENT_CALL_ACTION_CHLD_1,
+    BTHF_CLIENT_CALL_ACTION_CHLD_2,
+    BTHF_CLIENT_CALL_ACTION_CHLD_3,
+    BTHF_CLIENT_CALL_ACTION_CHLD_4,
+    BTHF_CLIENT_CALL_ACTION_CHLD_1x,
+    BTHF_CLIENT_CALL_ACTION_CHLD_2x,
+    BTHF_CLIENT_CALL_ACTION_ATA,
+    BTHF_CLIENT_CALL_ACTION_CHUP,
+    BTHF_CLIENT_CALL_ACTION_BTRH_0,
+    BTHF_CLIENT_CALL_ACTION_BTRH_1,
+    BTHF_CLIENT_CALL_ACTION_BTRH_2,
+} bthf_client_call_action_t;
+
+typedef enum {
+    BTHF_CLIENT_SERVICE_UNKNOWN = 0,
+    BTHF_CLIENT_SERVICE_VOICE,
+    BTHF_CLIENT_SERVICE_FAX
+} bthf_client_subscriber_service_type_t;
+
+typedef enum {
+    BTHF_CLIENT_IN_BAND_RINGTONE_NOT_PROVIDED = 0,
+    BTHF_CLIENT_IN_BAND_RINGTONE_PROVIDED,
+} bthf_client_in_band_ring_state_t;
+
+/* Peer features masks */
+#define BTHF_CLIENT_PEER_FEAT_3WAY   0x00000001  /* Three-way calling */
+#define BTHF_CLIENT_PEER_FEAT_ECNR   0x00000002  /* Echo cancellation and/or noise reduction */
+#define BTHF_CLIENT_PEER_FEAT_VREC   0x00000004  /* Voice recognition */
+#define BTHF_CLIENT_PEER_FEAT_INBAND 0x00000008  /* In-band ring tone */
+#define BTHF_CLIENT_PEER_FEAT_VTAG   0x00000010  /* Attach a phone number to a voice tag */
+#define BTHF_CLIENT_PEER_FEAT_REJECT 0x00000020  /* Ability to reject incoming call */
+#define BTHF_CLIENT_PEER_FEAT_ECS    0x00000040  /* Enhanced Call Status */
+#define BTHF_CLIENT_PEER_FEAT_ECC    0x00000080  /* Enhanced Call Control */
+#define BTHF_CLIENT_PEER_FEAT_EXTERR 0x00000100  /* Extended error codes */
+#define BTHF_CLIENT_PEER_FEAT_CODEC  0x00000200  /* Codec Negotiation */
+
+/* Peer call handling features masks */
+#define BTHF_CLIENT_CHLD_FEAT_REL           0x00000001  /* 0  Release waiting call or held calls */
+#define BTHF_CLIENT_CHLD_FEAT_REL_ACC       0x00000002  /* 1  Release active calls and accept other
+                                                              (waiting or held) cal */
+#define BTHF_CLIENT_CHLD_FEAT_REL_X         0x00000004  /* 1x Release specified active call only */
+#define BTHF_CLIENT_CHLD_FEAT_HOLD_ACC      0x00000008  /* 2  Active calls on hold and accept other
+                                                              (waiting or held) call */
+#define BTHF_CLIENT_CHLD_FEAT_PRIV_X        0x00000010  /* 2x Request private mode with specified
+                                                              call (put the rest on hold) */
+#define BTHF_CLIENT_CHLD_FEAT_MERGE         0x00000020  /* 3  Add held call to multiparty */
+#define BTHF_CLIENT_CHLD_FEAT_MERGE_DETACH  0x00000040  /* 4  Connect two calls and leave
+                                                              (disconnect from) multiparty */
+
+/** Callback for connection state change.
+ *  state will have one of the values from BtHfConnectionState
+ *  peer/chld_features are valid only for BTHF_CLIENT_CONNECTION_STATE_SLC_CONNECTED state
+ */
+typedef void (* bthf_client_connection_state_callback)(bthf_client_connection_state_t state,
+                                                       unsigned int peer_feat,
+                                                       unsigned int chld_feat,
+                                                       bt_bdaddr_t *bd_addr);
+
+/** Callback for audio connection state change.
+ *  state will have one of the values from BtHfAudioState
+ */
+typedef void (* bthf_client_audio_state_callback)(bthf_client_audio_state_t state,
+                                                  bt_bdaddr_t *bd_addr);
+
+/** Callback for VR connection state change.
+ *  state will have one of the values from BtHfVRState
+ */
+typedef void (* bthf_client_vr_cmd_callback)(bthf_client_vr_state_t state);
+
+/** Callback for network state change
+ */
+typedef void (* bthf_client_network_state_callback) (bthf_client_network_state_t state);
+
+/** Callback for network roaming status change
+ */
+typedef void (* bthf_client_network_roaming_callback) (bthf_client_service_type_t type);
+
+/** Callback for signal strength indication
+ */
+typedef void (* bthf_client_network_signal_callback) (int signal_strength);
+
+/** Callback for battery level indication
+ */
+typedef void (* bthf_client_battery_level_callback) (int battery_level);
+
+/** Callback for current operator name
+ */
+typedef void (* bthf_client_current_operator_callback) (const char *name);
+
+/** Callback for call indicator
+ */
+typedef void (* bthf_client_call_callback) (bthf_client_call_t call);
+
+/** Callback for callsetup indicator
+ */
+typedef void (* bthf_client_callsetup_callback) (bthf_client_callsetup_t callsetup);
+
+/** Callback for callheld indicator
+ */
+typedef void (* bthf_client_callheld_callback) (bthf_client_callheld_t callheld);
+
+/** Callback for response and hold
+ */
+typedef void (* bthf_client_resp_and_hold_callback) (bthf_client_resp_and_hold_t resp_and_hold);
+
+/** Callback for Calling Line Identification notification
+ *  Will be called only when there is an incoming call and number is provided.
+ */
+typedef void (* bthf_client_clip_callback) (const char *number);
+
+/**
+ * Callback for Call Waiting notification
+ */
+typedef void (* bthf_client_call_waiting_callback) (const char *number);
+
+/**
+ *  Callback for listing current calls. Can be called multiple time.
+ *  If number is unknown NULL is passed.
+ */
+typedef void (*bthf_client_current_calls) (int index, bthf_client_call_direction_t dir,
+                                           bthf_client_call_state_t state,
+                                           bthf_client_call_mpty_type_t mpty,
+                                           const char *number);
+
+/** Callback for audio volume change
+ */
+typedef void (*bthf_client_volume_change_callback) (bthf_client_volume_type_t type, int volume);
+
+/** Callback for command complete event
+ *  cme is valid only for BTHF_CLIENT_CMD_COMPLETE_ERROR_CME type
+ */
+typedef void (*bthf_client_cmd_complete_callback) (bthf_client_cmd_complete_t type, int cme);
+
+/** Callback for subscriber information
+ */
+typedef void (* bthf_client_subscriber_info_callback) (const char *name,
+                                                       bthf_client_subscriber_service_type_t type);
+
+/** Callback for in-band ring tone settings
+ */
+typedef void (* bthf_client_in_band_ring_tone_callback) (bthf_client_in_band_ring_state_t state);
+
+/**
+ * Callback for requested number from AG
+ */
+typedef void (* bthf_client_last_voice_tag_number_callback) (const char *number);
+
+/**
+ * Callback for sending ring indication to app
+ */
+typedef void (* bthf_client_ring_indication_callback) (void);
+
+/** BT-HF callback structure. */
+typedef struct {
+    /** set to sizeof(BtHfClientCallbacks) */
+    size_t      size;
+    bthf_client_connection_state_callback  connection_state_cb;
+    bthf_client_audio_state_callback       audio_state_cb;
+    bthf_client_vr_cmd_callback            vr_cmd_cb;
+    bthf_client_network_state_callback     network_state_cb;
+    bthf_client_network_roaming_callback   network_roaming_cb;
+    bthf_client_network_signal_callback    network_signal_cb;
+    bthf_client_battery_level_callback     battery_level_cb;
+    bthf_client_current_operator_callback  current_operator_cb;
+    bthf_client_call_callback              call_cb;
+    bthf_client_callsetup_callback         callsetup_cb;
+    bthf_client_callheld_callback          callheld_cb;
+    bthf_client_resp_and_hold_callback     resp_and_hold_cb;
+    bthf_client_clip_callback              clip_cb;
+    bthf_client_call_waiting_callback      call_waiting_cb;
+    bthf_client_current_calls              current_calls_cb;
+    bthf_client_volume_change_callback     volume_change_cb;
+    bthf_client_cmd_complete_callback      cmd_complete_cb;
+    bthf_client_subscriber_info_callback   subscriber_info_cb;
+    bthf_client_in_band_ring_tone_callback in_band_ring_tone_cb;
+    bthf_client_last_voice_tag_number_callback last_voice_tag_number_callback;
+    bthf_client_ring_indication_callback   ring_indication_cb;
+} bthf_client_callbacks_t;
+
+/** Represents the standard BT-HF interface. */
+typedef struct {
+
+    /** set to sizeof(BtHfClientInterface) */
+    size_t size;
+    /**
+     * Register the BtHf callbacks
+     */
+    bt_status_t (*init)(bthf_client_callbacks_t* callbacks);
+
+    /** connect to audio gateway */
+    bt_status_t (*connect)(bt_bdaddr_t *bd_addr);
+
+    /** disconnect from audio gateway */
+    bt_status_t (*disconnect)(bt_bdaddr_t *bd_addr);
+
+    /** create an audio connection */
+    bt_status_t (*connect_audio)(bt_bdaddr_t *bd_addr);
+
+    /** close the audio connection */
+    bt_status_t (*disconnect_audio)(bt_bdaddr_t *bd_addr);
+
+    /** start voice recognition */
+    bt_status_t (*start_voice_recognition)(void);
+
+    /** stop voice recognition */
+    bt_status_t (*stop_voice_recognition)(void);
+
+    /** volume control */
+    bt_status_t (*volume_control) (bthf_client_volume_type_t type, int volume);
+
+    /** place a call with number a number
+     * if number is NULL last called number is called (aka re-dial)*/
+    bt_status_t (*dial) (const char *number);
+
+    /** place a call with number specified by location (speed dial) */
+    bt_status_t (*dial_memory) (int location);
+
+    /** perform specified call related action
+     * idx is limited only for enhanced call control related action
+     */
+    bt_status_t (*handle_call_action) (bthf_client_call_action_t action, int idx);
+
+    /** query list of current calls */
+    bt_status_t (*query_current_calls) (void);
+
+    /** query name of current selected operator */
+    bt_status_t (*query_current_operator_name) (void);
+
+    /** Retrieve subscriber information */
+    bt_status_t (*retrieve_subscriber_info) (void);
+
+    /** Send DTMF code*/
+    bt_status_t (*send_dtmf) (char code);
+
+    /** Request a phone number from AG corresponding to last voice tag recorded */
+    bt_status_t (*request_last_voice_tag_number) (void);
+
+    /** Closes the interface. */
+    void (*cleanup)(void);
+
+    /** Send AT Command. */
+    bt_status_t (*send_at_cmd) (int cmd, int val1, int val2, const char *arg);
+} bthf_client_interface_t;
+
+__END_DECLS
+
+#endif /* ANDROID_INCLUDE_BT_HF_CLIENT_H */
diff --git a/include/hardware/bt_hh.h b/include/hardware/bt_hh.h
index 09f547b..dad9586 100644
--- a/include/hardware/bt_hh.h
+++ b/include/hardware/bt_hh.h
@@ -99,10 +99,10 @@
  */
 typedef void (* bthh_hid_info_callback)(bt_bdaddr_t *bd_addr, bthh_hid_info_t hid_info);
 
-/** Callback for get/set protocal api.
+/** Callback for get protocol api.
  *  the protocol mode is one of the value from bthh_protocol_mode_t
  */
-typedef void (* bthh_protocol_mode_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status,bthh_protocol_mode_t mode);
+typedef void (* bthh_protocol_mode_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status, bthh_protocol_mode_t mode);
 
 /** Callback for get/set_idle_time api.
  */
@@ -114,6 +114,11 @@
  */
 typedef void (* bthh_get_report_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status, uint8_t* rpt_data, int rpt_size);
 
+/** Callback for set_report/set_protocol api and if error
+ *  occurs for get_report/get_protocol api.
+ */
+typedef void (* bthh_handshake_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status);
+
 
 /** BT-HH callback structure. */
 typedef struct {
@@ -125,6 +130,7 @@
     bthh_idle_time_callback         idle_time_cb;
     bthh_get_report_callback        get_report_cb;
     bthh_virtual_unplug_callback    virtual_unplug_cb;
+    bthh_handshake_callback         handshake_cb;
 
 } bthh_callbacks_t;
 
diff --git a/include/hardware/bt_mce.h b/include/hardware/bt_mce.h
new file mode 100644
index 0000000..5d159b3
--- /dev/null
+++ b/include/hardware/bt_mce.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INCLUDE_BT_MCE_H
+#define ANDROID_INCLUDE_BT_MCE_H
+
+__BEGIN_DECLS
+
+/** MAS instance description */
+typedef struct
+{
+    int  id;
+    int  scn;
+    int  msg_types;
+    char *p_name;
+} btmce_mas_instance_t;
+
+/** callback for get_remote_mas_instances */
+typedef void (*btmce_remote_mas_instances_callback)(bt_status_t status, bt_bdaddr_t *bd_addr,
+                                                    int num_instances, btmce_mas_instance_t *instances);
+
+typedef struct {
+    /** set to sizeof(btmce_callbacks_t) */
+    size_t      size;
+    btmce_remote_mas_instances_callback  remote_mas_instances_cb;
+} btmce_callbacks_t;
+
+typedef struct {
+    /** set to size of this struct */
+    size_t size;
+
+    /** register BT MCE callbacks */
+    bt_status_t (*init)(btmce_callbacks_t *callbacks);
+
+    /** search for MAS instances on remote device */
+    bt_status_t (*get_remote_mas_instances)(bt_bdaddr_t *bd_addr);
+} btmce_interface_t;
+
+__END_DECLS
+
+#endif /* ANDROID_INCLUDE_BT_MCE_H */
diff --git a/include/hardware/bt_rc.h b/include/hardware/bt_rc.h
index d455543..c565c48 100644
--- a/include/hardware/bt_rc.h
+++ b/include/hardware/bt_rc.h
@@ -171,7 +171,7 @@
 /** Callback for passthrough commands */
 typedef void (* btrc_passthrough_cmd_callback) (int id, int key_state);
 
-/** BT-RC callback structure. */
+/** BT-RC Target callback structure. */
 typedef struct {
     /** set to sizeof(BtRcCallbacks) */
     size_t      size;
@@ -189,7 +189,7 @@
     btrc_passthrough_cmd_callback               passthrough_cmd_cb;
 } btrc_callbacks_t;
 
-/** Represents the standard BT-RC interface. */
+/** Represents the standard BT-RC AVRCP Target interface. */
 typedef struct {
 
     /** set to sizeof(BtRcInterface) */
@@ -261,6 +261,36 @@
     void  (*cleanup)( void );
 } btrc_interface_t;
 
+
+typedef void (* btrc_passthrough_rsp_callback) (int id, int key_state);
+
+typedef void (* btrc_connection_state_callback) (bool state, bt_bdaddr_t *bd_addr);
+
+/** BT-RC Controller callback structure. */
+typedef struct {
+    /** set to sizeof(BtRcCallbacks) */
+    size_t      size;
+    btrc_passthrough_rsp_callback               passthrough_rsp_cb;
+    btrc_connection_state_callback              connection_state_cb;
+} btrc_ctrl_callbacks_t;
+
+/** Represents the standard BT-RC AVRCP Controller interface. */
+typedef struct {
+
+    /** set to sizeof(BtRcInterface) */
+    size_t          size;
+    /**
+     * Register the BtRc callbacks
+     */
+    bt_status_t (*init)( btrc_ctrl_callbacks_t* callbacks );
+
+    /** send pass through command to target */
+    bt_status_t (*send_pass_through_cmd) ( bt_bdaddr_t *bd_addr, uint8_t key_code, uint8_t key_state );
+
+    /** Closes the interface. */
+    void  (*cleanup)( void );
+} btrc_ctrl_interface_t;
+
 __END_DECLS
 
 #endif /* ANDROID_INCLUDE_BT_RC_H */
diff --git a/include/hardware/bt_sdp.h b/include/hardware/bt_sdp.h
new file mode 100644
index 0000000..8f39bc5
--- /dev/null
+++ b/include/hardware/bt_sdp.h
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "bluetooth.h"
+
+#define SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH 15
+
+__BEGIN_DECLS
+
+/**
+ * These events are handled by the state machine
+ */
+typedef enum {
+    SDP_TYPE_RAW,        // Used to carry raw SDP search data for unknown UUIDs
+    SDP_TYPE_MAP_MAS,    // Message Access Profile - Server
+    SDP_TYPE_MAP_MNS,    // Message Access Profile - Client (Notification Server)
+    SDP_TYPE_PBAP_PSE,   // Phone Book Profile - Server
+    SDP_TYPE_PBAP_PCE,   // Phone Book Profile - Client
+    SDP_TYPE_OPP_SERVER, // Object Push Profile
+    SDP_TYPE_SAP_SERVER  // SIM Access Profile
+} bluetooth_sdp_types;
+
+typedef struct _bluetooth_sdp_hdr {
+    bluetooth_sdp_types type;
+    bt_uuid_t   uuid;
+    uint32_t    service_name_length;
+    char       *service_name;
+    int32_t     rfcomm_channel_number;
+    int32_t     l2cap_psm;
+    int32_t     profile_version;
+} bluetooth_sdp_hdr;
+
+/**
+ * Some signals need additional pointers, hence we introduce a
+ * generic way to handle these pointers.
+ */
+typedef struct _bluetooth_sdp_hdr_overlay {
+    bluetooth_sdp_types type;
+    bt_uuid_t   uuid;
+    uint32_t    service_name_length;
+    char       *service_name;
+    int32_t     rfcomm_channel_number;
+    int32_t     l2cap_psm;
+    int32_t     profile_version;
+
+    // User pointers, only used for some signals - see bluetooth_sdp_ops_record
+    int         user1_ptr_len;
+    uint8_t    *user1_ptr;
+    int         user2_ptr_len;
+    uint8_t    *user2_ptr;
+} bluetooth_sdp_hdr_overlay;
+
+typedef struct _bluetooth_sdp_mas_record {
+    bluetooth_sdp_hdr_overlay hdr;
+    uint32_t    mas_instance_id;
+    uint32_t    supported_features;
+    uint32_t    supported_message_types;
+} bluetooth_sdp_mas_record;
+
+typedef struct _bluetooth_sdp_mns_record {
+    bluetooth_sdp_hdr_overlay hdr;
+    uint32_t    supported_features;
+} bluetooth_sdp_mns_record;
+
+typedef struct _bluetooth_sdp_pse_record {
+    bluetooth_sdp_hdr_overlay hdr;
+    uint32_t    supported_features;
+    uint32_t    supported_repositories;
+} bluetooth_sdp_pse_record;
+
+typedef struct _bluetooth_sdp_pce_record {
+    bluetooth_sdp_hdr_overlay hdr;
+} bluetooth_sdp_pce_record;
+
+typedef struct _bluetooth_sdp_ops_record {
+    bluetooth_sdp_hdr_overlay hdr;
+    int         supported_formats_list_len;
+    uint8_t     supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH];
+} bluetooth_sdp_ops_record;
+
+typedef struct _bluetooth_sdp_sap_record {
+    bluetooth_sdp_hdr_overlay hdr;
+} bluetooth_sdp_sap_record;
+
+typedef union {
+    bluetooth_sdp_hdr_overlay   hdr;
+    bluetooth_sdp_mas_record    mas;
+    bluetooth_sdp_mns_record    mns;
+    bluetooth_sdp_pse_record    pse;
+    bluetooth_sdp_pce_record    pce;
+    bluetooth_sdp_ops_record    ops;
+    bluetooth_sdp_sap_record    sap;
+} bluetooth_sdp_record;
+
+
+/** Callback for SDP search */
+typedef void (*btsdp_search_callback)(bt_status_t status, bt_bdaddr_t *bd_addr, uint8_t* uuid, int num_records, bluetooth_sdp_record *records);
+
+typedef struct {
+    /** Set to sizeof(btsdp_callbacks_t) */
+    size_t      size;
+    btsdp_search_callback  sdp_search_cb;
+} btsdp_callbacks_t;
+
+typedef struct {
+    /** Set to size of this struct */
+    size_t size;
+
+    /** Register BT SDP search callbacks */
+    bt_status_t (*init)(btsdp_callbacks_t *callbacks);
+
+    /** Unregister BT SDP */
+    bt_status_t (*deinit)();
+
+    /** Search for SDP records with specific uuid on remote device */
+    bt_status_t (*sdp_search)(bt_bdaddr_t *bd_addr,  const uint8_t* uuid);
+
+    /**
+     * Use listen in the socket interface to create rfcomm and/or l2cap PSM channels,
+     * (without UUID and service_name and set the BTSOCK_FLAG_NO_SDP flag in flags).
+     * Then use createSdpRecord to create the SDP record associated with the rfcomm/l2cap channels.
+     *
+     * Returns a handle to the SDP record, which can be parsed to remove_sdp_record.
+     *
+     * record           (in) The SDP record to create
+     * record_handle    (out)The corresponding record handle will be written to this pointer.
+     */
+    bt_status_t (*create_sdp_record)(bluetooth_sdp_record *record, int* record_handle);
+
+    /** Remove a SDP record created by createSdpRecord */
+    bt_status_t (*remove_sdp_record)(int sdp_handle);
+} btsdp_interface_t;
+
+__END_DECLS
+
diff --git a/include/hardware/bt_sock.h b/include/hardware/bt_sock.h
index a4aa046..5d206d7 100644
--- a/include/hardware/bt_sock.h
+++ b/include/hardware/bt_sock.h
@@ -14,13 +14,15 @@
  * limitations under the License.
  */
 
-#ifndef ANDROID_INCLUDE_BT_SOCK_H
-#define ANDROID_INCLUDE_BT_SOCK_H
+#pragma once
 
 __BEGIN_DECLS
 
 #define BTSOCK_FLAG_ENCRYPT 1
 #define BTSOCK_FLAG_AUTH (1 << 1)
+#define BTSOCK_FLAG_NO_SDP (1 << 2)
+#define BTSOCK_FLAG_AUTH_MITM (1 << 3)
+#define BTSOCK_FLAG_AUTH_16_DIGIT (1 << 4)
 
 typedef enum {
     BTSOCK_RFCOMM = 1,
@@ -34,25 +36,37 @@
     bt_bdaddr_t bd_addr;
     int channel;
     int status;
+
+    // The writer must make writes using a buffer of this maximum size
+    // to avoid loosing data. (L2CAP only)
+    unsigned short max_tx_packet_size;
+
+    // The reader must read using a buffer of at least this size to avoid
+    // loosing data. (L2CAP only)
+    unsigned short max_rx_packet_size;
 } __attribute__((packed)) sock_connect_signal_t;
 
 typedef struct {
-
     /** set to size of this struct*/
     size_t          size;
+
     /**
-     * listen to a rfcomm uuid or channel. It returns the socket fd from which
-     * btsock_connect_signal can be read out when a remote device connected
+     * Listen to a RFCOMM UUID or channel. It returns the socket fd from which
+     * btsock_connect_signal can be read out when a remote device connected.
+     * If neither a UUID nor a channel is provided, a channel will be allocated
+     * and a service record can be created providing the channel number to
+     * create_sdp_record(...) in bt_sdp.
      */
-    bt_status_t (*listen)(btsock_type_t type, const char* service_name, const uint8_t* service_uuid, int channel, int* sock_fd, int flags);
-    /*
-     * connect to a rfcomm uuid channel of remote device, It returns the socket fd from which
+    bt_status_t (*listen)(btsock_type_t type, const char* service_name,
+            const uint8_t* service_uuid, int channel, int* sock_fd, int flags);
+
+    /**
+     * Connect to a RFCOMM UUID channel of remote device, It returns the socket fd from which
      * the btsock_connect_signal and a new socket fd to be accepted can be read out when connected
      */
-    bt_status_t (*connect)(const bt_bdaddr_t *bd_addr, btsock_type_t type, const uint8_t* uuid, int channel, int* sock_fd, int flags);
-
+    bt_status_t (*connect)(const bt_bdaddr_t *bd_addr, btsock_type_t type, const uint8_t* uuid,
+            int channel, int* sock_fd, int flags);
 } btsock_interface_t;
 
 __END_DECLS
 
-#endif /* ANDROID_INCLUDE_BT_SOCK_H */
diff --git a/include/hardware/camera.h b/include/hardware/camera.h
index b7182f8..b1f18ff 100644
--- a/include/hardware/camera.h
+++ b/include/hardware/camera.h
@@ -22,7 +22,10 @@
 /**
  * Camera device HAL, initial version [ CAMERA_DEVICE_API_VERSION_1_0 ]
  *
- * Supports the android.hardware.Camera API.
+ * DEPRECATED. New devices should use Camera HAL v3.2 or newer.
+ *
+ * Supports the android.hardware.Camera API, and the android.hardware.camera2
+ * API in legacy mode only.
  *
  * Camera devices that support this version of the HAL must return a value in
  * the range HARDWARE_DEVICE_API_VERSION(0,0)-(1,FF) in
diff --git a/include/hardware/camera2.h b/include/hardware/camera2.h
index 5b182a8..d920d4b 100644
--- a/include/hardware/camera2.h
+++ b/include/hardware/camera2.h
@@ -23,9 +23,10 @@
 /**
  * Camera device HAL 2.1 [ CAMERA_DEVICE_API_VERSION_2_0, CAMERA_DEVICE_API_VERSION_2_1 ]
  *
- * EXPERIMENTAL.
+ * DEPRECATED. New devices should use Camera HAL v3.2 or newer.
  *
- * Supports the android.hardware.Camera APIs.
+ * Supports the android.hardware.Camera API, and the android.hardware.camera2
+ * API in legacy mode only.
  *
  * Camera devices that support this version of the HAL must return
  * CAMERA_DEVICE_API_VERSION_2_1 in camera_device_t.common.version and in
diff --git a/include/hardware/camera3.h b/include/hardware/camera3.h
index afc9d9f..3ef6d6f 100644
--- a/include/hardware/camera3.h
+++ b/include/hardware/camera3.h
@@ -21,19 +21,31 @@
 #include "camera_common.h"
 
 /**
- * Camera device HAL 3.1 [ CAMERA_DEVICE_API_VERSION_3_1 ]
+ * Camera device HAL 3.3 [ CAMERA_DEVICE_API_VERSION_3_3 ]
  *
- * EXPERIMENTAL.
+ * This is the current recommended version of the camera device HAL.
  *
- * Supports the android.hardware.Camera API.
+ * Supports the android.hardware.Camera API, and as of v3.2, the
+ * android.hardware.camera2 API in LIMITED or FULL modes.
  *
  * Camera devices that support this version of the HAL must return
- * CAMERA_DEVICE_API_VERSION_3_1 in camera_device_t.common.version and in
+ * CAMERA_DEVICE_API_VERSION_3_3 in camera_device_t.common.version and in
  * camera_info_t.device_version (from camera_module_t.get_camera_info).
  *
- * Camera modules that may contain version 3.1 devices must implement at least
- * version 2.0 of the camera module interface (as defined by
- * camera_module_t.common.module_api_version).
+ * CAMERA_DEVICE_API_VERSION_3_3:
+ *    Camera modules that may contain version 3.3 devices must implement at
+ *    least version 2.2 of the camera module interface (as defined by
+ *    camera_module_t.common.module_api_version).
+ *
+ * CAMERA_DEVICE_API_VERSION_3_2:
+ *    Camera modules that may contain version 3.2 devices must implement at
+ *    least version 2.2 of the camera module interface (as defined by
+ *    camera_module_t.common.module_api_version).
+ *
+ * <= CAMERA_DEVICE_API_VERSION_3_1:
+ *    Camera modules that may contain version 3.1 (or 3.0) devices must
+ *    implement at least version 2.0 of the camera module interface
+ *    (as defined by camera_module_t.common.module_api_version).
  *
  * See camera_common.h for more versioning details.
  *
@@ -44,6 +56,10 @@
  *   S4. 3A modes and state machines
  *   S5. Cropping
  *   S6. Error management
+ *   S7. Key Performance Indicator (KPI) glossary
+ *   S8. Sample Use Cases
+ *   S9. Notes on Controls and Metadata
+ *   S10. Reprocessing flow and controls
  */
 
 /**
@@ -88,6 +104,39 @@
  *   - configure_streams passes consumer usage flags to the HAL.
  *
  *   - flush call to drop all in-flight requests/buffers as fast as possible.
+ *
+ * 3.2: Minor revision of expanded-capability HAL:
+ *
+ *   - Deprecates get_metadata_vendor_tag_ops.  Please use get_vendor_tag_ops
+ *     in camera_common.h instead.
+ *
+ *   - register_stream_buffers deprecated. All gralloc buffers provided
+ *     by framework to HAL in process_capture_request may be new at any time.
+ *
+ *   - add partial result support. process_capture_result may be called
+ *     multiple times with a subset of the available result before the full
+ *     result is available.
+ *
+ *   - add manual template to camera3_request_template. The applications may
+ *     use this template to control the capture settings directly.
+ *
+ *   - Rework the bidirectional and input stream specifications.
+ *
+ *   - change the input buffer return path. The buffer is returned in
+ *     process_capture_result instead of process_capture_request.
+ *
+ * 3.3: Minor revision of expanded-capability HAL:
+ *
+ *   - OPAQUE and YUV reprocessing API updates.
+ *
+ *   - Basic support for depth output buffers.
+ *
+ *   - Addition of data_space field to camera3_stream_t.
+ *
+ *   - Addition of rotation field to camera3_stream_t.
+ *
+ *   - Addition of camera3 stream configuration operation mode to camera3_stream_configuration_t
+ *
  */
 
 /**
@@ -108,12 +157,19 @@
  * 4. The framework calls camera3_device_t->ops->configure_streams() with a list
  *    of input/output streams to the HAL device.
  *
- * 5. The framework allocates gralloc buffers and calls
+ * 5. <= CAMERA_DEVICE_API_VERSION_3_1:
+ *
+ *    The framework allocates gralloc buffers and calls
  *    camera3_device_t->ops->register_stream_buffers() for at least one of the
  *    output streams listed in configure_streams. The same stream is registered
  *    only once.
  *
- * 5. The framework requests default settings for some number of use cases with
+ *    >= CAMERA_DEVICE_API_VERSION_3_2:
+ *
+ *    camera3_device_t->ops->register_stream_buffers() is not called and must
+ *    be NULL.
+ *
+ * 6. The framework requests default settings for some number of use cases with
  *    calls to camera3_device_t->ops->construct_default_request_settings(). This
  *    may occur any time after step 3.
  *
@@ -124,23 +180,70 @@
  *    camera3_device_t->ops->process_capture_request(). The HAL must block the
  *    return of this call until it is ready for the next request to be sent.
  *
- * 8. The framework continues to submit requests, and possibly call
- *    register_stream_buffers() for not-yet-registered streams, and call
+ *    >= CAMERA_DEVICE_API_VERSION_3_2:
+ *
+ *    The buffer_handle_t provided in the camera3_stream_buffer_t array
+ *    in the camera3_capture_request_t may be new and never-before-seen
+ *    by the HAL on any given new request.
+ *
+ * 8. The framework continues to submit requests, and call
  *    construct_default_request_settings to get default settings buffers for
  *    other use cases.
  *
+ *    <= CAMERA_DEVICE_API_VERSION_3_1:
+ *
+ *    The framework may call register_stream_buffers() at this time for
+ *    not-yet-registered streams.
+ *
  * 9. When the capture of a request begins (sensor starts exposing for the
- *    capture), the HAL calls camera3_callback_ops_t->notify() with the SHUTTER
- *    event, including the frame number and the timestamp for start of exposure.
+ *    capture) or processing a reprocess request begins, the HAL
+ *    calls camera3_callback_ops_t->notify() with the SHUTTER event, including
+ *    the frame number and the timestamp for start of exposure. For a reprocess
+ *    request, the timestamp must be the start of exposure of the input image
+ *    which can be looked up with android.sensor.timestamp from
+ *    camera3_capture_request_t.settings when process_capture_request() is
+ *    called.
+ *
+ *    <= CAMERA_DEVICE_API_VERSION_3_1:
+ *
  *    This notify call must be made before the first call to
  *    process_capture_result() for that frame number.
  *
+ *    >= CAMERA_DEVICE_API_VERSION_3_2:
+ *
+ *    The camera3_callback_ops_t->notify() call with the SHUTTER event should
+ *    be made as early as possible since the framework will be unable to
+ *    deliver gralloc buffers to the application layer (for that frame) until
+ *    it has a valid timestamp for the start of exposure (or the input image's
+ *    start of exposure for a reprocess request).
+ *
+ *    Both partial metadata results and the gralloc buffers may be sent to the
+ *    framework at any time before or after the SHUTTER event.
+ *
  * 10. After some pipeline delay, the HAL begins to return completed captures to
  *    the framework with camera3_callback_ops_t->process_capture_result(). These
  *    are returned in the same order as the requests were submitted. Multiple
  *    requests can be in flight at once, depending on the pipeline depth of the
  *    camera HAL device.
  *
+ *    >= CAMERA_DEVICE_API_VERSION_3_2:
+ *
+ *    Once a buffer is returned by process_capture_result as part of the
+ *    camera3_stream_buffer_t array, and the fence specified by release_fence
+ *    has been signaled (this is a no-op for -1 fences), the ownership of that
+ *    buffer is considered to be transferred back to the framework. After that,
+ *    the HAL must no longer retain that particular buffer, and the
+ *    framework may clean up the memory for it immediately.
+ *
+ *    process_capture_result may be called multiple times for a single frame,
+ *    each time with a new disjoint piece of metadata and/or set of gralloc
+ *    buffers. The framework will accumulate these partial metadata results
+ *    into one result.
+ *
+ *    In particular, it is legal for a process_capture_result to be called
+ *    simultaneously for both a frame N and a frame N+1 as long as the
+ *    above rule holds for gralloc buffers (both input and output).
+ *
  * 11. After some time, the framework may stop submitting new requests, wait for
  *    the existing captures to complete (all buffers filled, all results
  *    returned), and then call configure_streams() again. This resets the camera
@@ -201,30 +304,26 @@
  *   for processing rate).
  *
  * - Limited-mode devices do not need to support most of the
- *   settings/result/static info metadata. Full-mode devices must support all
- *   metadata fields listed in TODO. Specifically, only the following settings
+ *   settings/result/static info metadata. Specifically, only the following settings
  *   are expected to be consumed or produced by a limited-mode HAL device:
  *
- *   android.control.aeAntibandingMode (controls)
- *   android.control.aeExposureCompensation (controls)
- *   android.control.aeLock (controls)
- *   android.control.aeMode (controls)
- *       [OFF means ON_FLASH_TORCH - TODO]
- *   android.control.aeRegions (controls)
- *   android.control.aeTargetFpsRange (controls)
- *   android.control.afMode (controls)
- *       [OFF means infinity focus]
- *   android.control.afRegions (controls)
- *   android.control.awbLock (controls)
- *   android.control.awbMode (controls)
- *       [OFF not supported]
- *   android.control.awbRegions (controls)
- *   android.control.captureIntent (controls)
- *   android.control.effectMode (controls)
- *   android.control.mode (controls)
- *       [OFF not supported]
- *   android.control.sceneMode (controls)
- *   android.control.videoStabilizationMode (controls)
+ *   android.control.aeAntibandingMode (controls and dynamic)
+ *   android.control.aeExposureCompensation (controls and dynamic)
+ *   android.control.aeLock (controls and dynamic)
+ *   android.control.aeMode (controls and dynamic)
+ *   android.control.aeRegions (controls and dynamic)
+ *   android.control.aeTargetFpsRange (controls and dynamic)
+ *   android.control.aePrecaptureTrigger (controls and dynamic)
+ *   android.control.afMode (controls and dynamic)
+ *   android.control.afRegions (controls and dynamic)
+ *   android.control.awbLock (controls and dynamic)
+ *   android.control.awbMode (controls and dynamic)
+ *   android.control.awbRegions (controls and dynamic)
+ *   android.control.captureIntent (controls and dynamic)
+ *   android.control.effectMode (controls and dynamic)
+ *   android.control.mode (controls and dynamic)
+ *   android.control.sceneMode (controls and dynamic)
+ *   android.control.videoStabilizationMode (controls and dynamic)
  *   android.control.aeAvailableAntibandingModes (static)
  *   android.control.aeAvailableModes (static)
  *   android.control.aeAvailableTargetFpsRanges (static)
@@ -237,67 +336,50 @@
  *   android.control.awbAvailableModes (static)
  *   android.control.maxRegions (static)
  *   android.control.sceneModeOverrides (static)
- *   android.control.aeRegions (dynamic)
  *   android.control.aeState (dynamic)
- *   android.control.afMode (dynamic)
- *   android.control.afRegions (dynamic)
  *   android.control.afState (dynamic)
- *   android.control.awbMode (dynamic)
- *   android.control.awbRegions (dynamic)
  *   android.control.awbState (dynamic)
- *   android.control.mode (dynamic)
  *
+ *   android.flash.mode (controls and dynamic)
  *   android.flash.info.available (static)
  *
  *   android.info.supportedHardwareLevel (static)
  *
- *   android.jpeg.gpsCoordinates (controls)
- *   android.jpeg.gpsProcessingMethod (controls)
- *   android.jpeg.gpsTimestamp (controls)
- *   android.jpeg.orientation (controls)
- *   android.jpeg.quality (controls)
- *   android.jpeg.thumbnailQuality (controls)
- *   android.jpeg.thumbnailSize (controls)
+ *   android.jpeg.gpsCoordinates (controls and dynamic)
+ *   android.jpeg.gpsProcessingMethod (controls and dynamic)
+ *   android.jpeg.gpsTimestamp (controls and dynamic)
+ *   android.jpeg.orientation (controls and dynamic)
+ *   android.jpeg.quality (controls and dynamic)
+ *   android.jpeg.thumbnailQuality (controls and dynamic)
+ *   android.jpeg.thumbnailSize (controls and dynamic)
  *   android.jpeg.availableThumbnailSizes (static)
  *   android.jpeg.maxSize (static)
- *   android.jpeg.gpsCoordinates (dynamic)
- *   android.jpeg.gpsProcessingMethod (dynamic)
- *   android.jpeg.gpsTimestamp (dynamic)
- *   android.jpeg.orientation (dynamic)
- *   android.jpeg.quality (dynamic)
- *   android.jpeg.size (dynamic)
- *   android.jpeg.thumbnailQuality (dynamic)
- *   android.jpeg.thumbnailSize (dynamic)
  *
  *   android.lens.info.minimumFocusDistance (static)
  *
- *   android.request.id (controls)
- *   android.request.id (dynamic)
+ *   android.request.id (controls and dynamic)
  *
- *   android.scaler.cropRegion (controls)
- *       [ignores (x,y), assumes center-zoom]
- *   android.scaler.availableFormats (static)
- *       [RAW not supported]
- *   android.scaler.availableJpegMinDurations (static)
- *   android.scaler.availableJpegSizes (static)
+ *   android.scaler.cropRegion (controls and dynamic)
+ *   android.scaler.availableStreamConfigurations (static)
+ *   android.scaler.availableMinFrameDurations (static)
+ *   android.scaler.availableStallDurations (static)
  *   android.scaler.availableMaxDigitalZoom (static)
- *   android.scaler.availableProcessedMinDurations (static)
- *   android.scaler.availableProcessedSizes (static)
- *       [full resolution not supported]
  *   android.scaler.maxDigitalZoom (static)
- *   android.scaler.cropRegion (dynamic)
+ *   android.scaler.croppingType (static)
  *
  *   android.sensor.orientation (static)
  *   android.sensor.timestamp (dynamic)
  *
- *   android.statistics.faceDetectMode (controls)
+ *   android.statistics.faceDetectMode (controls and dynamic)
  *   android.statistics.info.availableFaceDetectModes (static)
- *   android.statistics.faceDetectMode (dynamic)
  *   android.statistics.faceIds (dynamic)
  *   android.statistics.faceLandmarks (dynamic)
  *   android.statistics.faceRectangles (dynamic)
  *   android.statistics.faceScores (dynamic)
  *
+ *   android.sync.frameNumber (dynamic)
+ *   android.sync.maxLatency (static)
+ *
  * - Captures in limited mode that include high-resolution (> 1080p) output
  *   buffers may block in process_capture_request() until all the output buffers
  *   have been filled. A full-mode HAL device must process sequences of
@@ -308,6 +390,14 @@
  *   that request completes for high-resolution captures for limited-mode
  *   devices.
  *
+ * - Full-mode devices must support below additional capabilities:
+ *   - 30fps at maximum resolution is preferred, more than 20fps is required.
+ *   - Per frame control (android.sync.maxLatency == PER_FRAME_CONTROL).
+ *   - Sensor manual control metadata. See MANUAL_SENSOR defined in
+ *     android.request.availableCapabilities.
+ *   - Post-processing manual control metadata. See MANUAL_POST_PROCESSING defined
+ *     in android.request.availableCapabilities.
+ *
  */
 
 /**
@@ -816,7 +906,12 @@
  * view it is receiving based on the crop region, the dimensions of the image
  * sensor, and the lens focal length.
  *
- * Since the crop region applies to all streams, which may have different aspect
+ * It is assumed that the cropping is applied after raw to other color space
+ * conversion. Raw streams (RAW16 and RAW_OPAQUE) don't have this conversion stage,
+ * and are not croppable. Therefore, the crop region must be ignored by the HAL
+ * for raw streams.
+ *
+ * Since the crop region applies to all non-raw streams, which may have different aspect
  * ratios than the crop region, the exact sensor region used for each stream may
  * be smaller than the crop region. Specifically, each stream should maintain
  * square pixels and its aspect ratio by minimally further cropping the defined
@@ -963,15 +1058,253 @@
  *   ERROR_BUFFER for each failed buffer.
  *
  * In each of these transient failure cases, the HAL must still call
- * process_capture_result, with valid output buffer_handle_t. If the result
- * metadata could not be produced, it should be NULL. If some buffers could not
- * be filled, their sync fences must be set to the error state.
+ * process_capture_result, with valid output and input (if an input buffer was
+ * submitted) buffer_handle_t. If the result metadata could not be produced, it
+ * should be NULL. If some buffers could not be filled, they must be returned with
+ * process_capture_result in the error state, their release fences must be set to
+ * the acquire fences passed by the framework, or -1 if they have been waited on by
+ * the HAL already.
  *
  * Invalid input arguments result in -EINVAL from the appropriate methods. In
  * that case, the framework must act as if that call had never been made.
  *
  */
 
+/**
+ * S7. Key Performance Indicator (KPI) glossary:
+ *
+ * This includes some critical definitions that are used by KPI metrics.
+ *
+ * Pipeline Latency:
+ *  For a given capture request, the duration from the framework calling
+ *  process_capture_request to the HAL sending capture result and all buffers
+ *  back by process_capture_result call. To make the Pipeline Latency measure
+ *  independent of frame rate, it is measured by frame count.
+ *
+ *  For example, when frame rate is 30 (fps), the frame duration (time interval
+ *  between adjacent frame capture time) is 33 (ms).
+ *  If it takes 5 frames for framework to get the result and buffers back for
+ *  a given request, then the Pipeline Latency is 5 (frames), instead of
+ *  5 x 33 = 165 (ms).
+ *
+ *  The Pipeline Latency is determined by android.request.pipelineDepth and
+ *  android.request.pipelineMaxDepth, see their definitions for more details.
+ *
+ */
+
+/**
+ * S8. Sample Use Cases:
+ *
+ * This includes some typical use case examples the camera HAL may support.
+ *
+ * S8.1 Zero Shutter Lag (ZSL) with CAMERA3_STREAM_BIDIRECTIONAL stream.
+ *
+ *   For this use case, the bidirectional stream will be used by the framework as follows:
+ *
+ *   1. The framework includes a buffer from this stream as output buffer in a
+ *      request as normal.
+ *
+ *   2. Once the HAL device returns a filled output buffer to the framework,
+ *      the framework may do one of two things with the filled buffer:
+ *
+ *   2. a. The framework uses the filled data, and returns the now-used buffer
+ *         to the stream queue for reuse. This behavior exactly matches the
+ *         OUTPUT type of stream.
+ *
+ *   2. b. The framework wants to reprocess the filled data, and uses the
+ *         buffer as an input buffer for a request. Once the HAL device has
+ *         used the reprocessing buffer, it then returns it to the
+ *         framework. The framework then returns the now-used buffer to the
+ *         stream queue for reuse.
+ *
+ *   3. The HAL device will be given the buffer again as an output buffer for
+ *        a request at some future point.
+ *
+ *   For ZSL use case, the pixel format for bidirectional stream will be
+ *   HAL_PIXEL_FORMAT_RAW_OPAQUE or HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED if it
+ *   is listed in android.scaler.availableInputOutputFormatsMap. When
+ *   HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED is used, the gralloc
+ *   usage flags for the consumer endpoint will be set to GRALLOC_USAGE_HW_CAMERA_ZSL.
+ *   A configuration stream list that has BIDIRECTIONAL stream used as input, will
+ *   usually also have a distinct OUTPUT stream to get the reprocessing data. For example,
+ *   for the ZSL use case, the stream list might be configured with the following:
+ *
+ *     - A HAL_PIXEL_FORMAT_RAW_OPAQUE bidirectional stream is used
+ *       as input.
+ *     - And a HAL_PIXEL_FORMAT_BLOB (JPEG) output stream.
+ *
+ * S8.2 ZSL (OPAQUE) reprocessing with CAMERA3_STREAM_INPUT stream.
+ *
+ * CAMERA_DEVICE_API_VERSION_3_3:
+ *   When OPAQUE_REPROCESSING capability is supported by the camera device, the INPUT stream
+ *   can be used for application/framework implemented use case like Zero Shutter Lag (ZSL).
+ *   This kind of stream will be used by the framework as follows:
+ *
+ *   1. Application/framework configures an opaque (RAW or YUV based) format output stream that is
+ *      used to produce the ZSL output buffers. The stream pixel format will be
+ *      HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED.
+ *
+ *   2. Application/framework configures an opaque format input stream that is used to
+ *      send the reprocessing ZSL buffers to the HAL. The stream pixel format will
+ *      also be HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED.
+ *
+ *   3. Application/framework configures a YUV/JPEG output stream that is used to receive the
+ *      reprocessed data. The stream pixel format will be YCbCr_420/HAL_PIXEL_FORMAT_BLOB.
+ *
+ *   4. Application/framework picks a ZSL buffer from the ZSL output stream when a ZSL capture is
+ *      issued by the application, and sends the data back as an input buffer in a
+ *      reprocessing request, then sends to the HAL for reprocessing.
+ *
+ *   5. The HAL sends back the output YUV/JPEG result to framework.
+ *
+ *   The HAL can select the actual opaque buffer format and configure the ISP pipeline
+ *   appropriately based on the HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED format and
+ *   the gralloc usage flag GRALLOC_USAGE_HW_CAMERA_ZSL.
+
+ * S8.3 YUV reprocessing with CAMERA3_STREAM_INPUT stream.
+ *
+ *   When YUV reprocessing is supported by the HAL, the INPUT stream
+ *   can be used for the YUV reprocessing use cases like lucky-shot and image fusion.
+ *   This kind of stream will be used by the framework as follows:
+ *
+ *   1. Application/framework configures an YCbCr_420 format output stream that is
+ *      used to produce the output buffers.
+ *
+ *   2. Application/framework configures an YCbCr_420 format input stream that is used to
+ *      send the reprocessing YUV buffers to the HAL.
+ *
+ *   3. Application/framework configures a YUV/JPEG output stream that is used to receive the
+ *      reprocessed data. The stream pixel format will be YCbCr_420/HAL_PIXEL_FORMAT_BLOB.
+ *
+ *   4. Application/framework processes the output buffers (could be as simple as picking
+ *      an output buffer directly) from the output stream when a capture is issued, and sends
+ *      the data back as an input buffer in a reprocessing request, then sends to the HAL
+ *      for reprocessing.
+ *
+ *   5. The HAL sends back the output YUV/JPEG result to framework.
+ *
+ */
+
+/**
+ *   S9. Notes on Controls and Metadata
+ *
+ *   This section contains notes about the interpretation and usage of various metadata tags.
+ *
+ *   S9.1 HIGH_QUALITY and FAST modes.
+ *
+ *   Many camera post-processing blocks may be listed as having HIGH_QUALITY,
+ *   FAST, and OFF operating modes. These blocks will typically also have an
+ *   'available modes' tag representing which of these operating modes are
+ *   available on a given device. The general policy regarding implementing
+ *   these modes is as follows:
+ *
+ *   1. Operating mode controls of hardware blocks that cannot be disabled
+ *      must not list OFF in their corresponding 'available modes' tags.
+ *
+ *   2. OFF will always be included in their corresponding 'available modes'
+ *      tag if it is possible to disable that hardware block.
+ *
+ *   3. FAST must always be included in the 'available modes' tags for all
+ *      post-processing blocks supported on the device.  If a post-processing
+ *      block also has a slower and higher quality operating mode that does
+ *      not meet the framerate requirements for FAST mode, HIGH_QUALITY should
+ *      be included in the 'available modes' tag to represent this operating
+ *      mode.
+ */
+
+/**
+ *   S10. Reprocessing flow and controls
+ *
+ *   This section describes the OPAQUE and YUV reprocessing flow and controls. OPAQUE reprocessing
+ *   uses an opaque format that is not directly application-visible, and the application can
+ *   only select some of the output buffers and send back to HAL for reprocessing, while YUV
+ *   reprocessing gives the application opportunity to process the buffers before reprocessing.
+ *
+ *   S8 gives the stream configurations for the typical reprocessing uses cases,
+ *   this section specifies the buffer flow and controls in more details.
+ *
+ *   S10.1 OPAQUE (typically for ZSL use case) reprocessing flow and controls
+ *
+ *   For OPAQUE reprocessing (e.g. ZSL) use case, after the application creates the specific
+ *   output and input streams, runtime buffer flow and controls are specified as below:
+ *
+ *   1. Application starts output streaming by sending repeating requests for output
+ *      opaque buffers and preview. The buffers are held by an application
+ *      maintained circular buffer. The requests are based on CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG
+ *      capture template, which should have all necessary settings that guarantee output
+ *      frame rate is not slowed down relative to sensor output frame rate.
+ *
+ *   2. When a capture is issued, the application selects one output buffer based
+ *      on application buffer selection logic, e.g. good AE and AF statistics etc.
+ *      Application then creates an reprocess request based on the capture result associated
+ *      with this selected buffer. The selected output buffer is now added to this reprocess
+ *      request as an input buffer, the output buffer of this reprocess request should be
+ *      either JPEG output buffer or YUV output buffer, or both, depending on the application
+ *      choice.
+ *
+ *   3. Application then alters the reprocess settings to get best image quality. The HAL must
+ *      support and only support below controls if the HAL support OPAQUE_REPROCESSING capability:
+ *          - android.jpeg.* (if JPEG buffer is included as one of the output)
+ *          - android.noiseReduction.mode (change to HIGH_QUALITY if it is supported)
+ *          - android.edge.mode (change to HIGH_QUALITY if it is supported)
+ *       All other controls must be ignored by the HAL.
+ *   4. HAL processed the input buffer and return the output buffers in the capture results
+ *      as normal.
+ *
+ *   S10.2 YUV reprocessing flow and controls
+ *
+ *   The YUV reprocessing buffer flow is similar as OPAQUE reprocessing, with below difference:
+ *
+ *   1. Application may want to have finer granularity control of the intermediate YUV images
+ *      (before reprocessing). For example, application may choose
+ *          - android.noiseReduction.mode == MINIMAL
+ *      to make sure the no YUV domain noise reduction has applied to the output YUV buffers,
+ *      then it can do its own advanced noise reduction on them. For OPAQUE reprocessing case, this
+ *      doesn't matter, as long as the final reprocessed image has the best quality.
+ *   2. Application may modify the YUV output buffer data. For example, for image fusion use
+ *      case, where multiple output images are merged together to improve the signal-to-noise
+ *      ratio (SNR). The input buffer may be generated from multiple buffers by the application.
+ *      To avoid excessive amount of noise reduction and insufficient amount of edge enhancement
+ *      being applied to the input buffer, the application can hint the HAL  how much effective
+ *      exposure time improvement has been done by the application, then the HAL can adjust the
+ *      noise reduction and edge enhancement paramters to get best reprocessed image quality.
+ *      Below tag can be used for this purpose:
+ *          - android.reprocess.effectiveExposureFactor
+ *      The value would be exposure time increase factor applied to the original output image,
+ *      for example, if there are N image merged, the exposure time increase factor would be up
+ *      to sqrt(N). See this tag spec for more details.
+ *
+ *   S10.3 Reprocessing pipeline characteristics
+ *
+ *   Reprocessing pipeline has below different characteristics comparing with normal output
+ *   pipeline:
+ *
+ *   1. The reprocessing result can be returned ahead of the pending normal output results. But
+ *      the FIFO ordering must be maintained for all reprocessing results. For example, there are
+ *      below requests (A stands for output requests, B stands for reprocessing requests)
+ *      being processed by the HAL:
+ *          A1, A2, A3, A4, B1, A5, B2, A6...
+ *      result of B1 can be returned before A1-A4, but result of B2 must be returned after B1.
+ *   2. Single input rule: For a given reprocessing request, all output buffers must be from the
+ *      input buffer, rather than sensor output. For example, if a reprocess request include both
+ *      JPEG and preview buffers, all output buffers must be produced from the input buffer
+ *      included by the reprocessing request, rather than sensor. The HAL must not output preview
+ *      buffers from sensor, while output JPEG buffer from the input buffer.
+ *   3. Input buffer will be from camera output directly (ZSL case) or indirectly(image fusion
+ *      case). For the case where buffer is modified, the size will remain same. The HAL can
+ *      notify CAMERA3_MSG_ERROR_REQUEST if buffer from unknown source is sent.
+ *   4. Result as reprocessing request: The HAL can expect that a reprocessing request is a copy
+ *      of one of the output results with minor allowed setting changes. The HAL can notify
+ *      CAMERA3_MSG_ERROR_REQUEST if a request from unknown source is issued.
+ *   5. Output buffers may not be used as inputs across the configure stream boundary, This is
+ *      because an opaque stream like the ZSL output stream may have different actual image size
+ *      inside of the ZSL buffer to save power and bandwidth for smaller resolution JPEG capture.
+ *      The HAL may notify CAMERA3_MSG_ERROR_REQUEST if this case occurs.
+ *   6. HAL Reprocess requests error reporting during flush should follow the same rule specified
+ *      by flush() method.
+ *
+ */
+
 __BEGIN_DECLS
 
 struct camera3_device;
@@ -1006,6 +1339,22 @@
      * for reading buffers from this stream and sending them through the camera
      * processing pipeline, as if the buffer was a newly captured image from the
      * imager.
+     *
+     * The pixel format for input stream can be any format reported by
+     * android.scaler.availableInputOutputFormatsMap. The pixel format of the
+     * output stream that is used to produce the reprocessing data may be any
+     * format reported by android.scaler.availableStreamConfigurations. The
+     * supported input/output stream combinations depends the camera device
+     * capabilities, see android.scaler.availableInputOutputFormatsMap for
+     * stream map details.
+     *
+     * This kind of stream is generally used to reprocess data into higher
+     * quality images (that otherwise would cause a frame rate performance
+     * loss), or to do off-line reprocessing.
+     *
+     * CAMERA_DEVICE_API_VERSION_3_3:
+     *    The typical use cases are OPAQUE (typically ZSL) and YUV reprocessing,
+     *    see S8.2, S8.3 and S10 for more details.
      */
     CAMERA3_STREAM_INPUT = 1,
 
@@ -1014,29 +1363,9 @@
      * used as an output stream, but occasionally one already-filled buffer may
      * be sent back to the HAL device for reprocessing.
      *
-     * This kind of stream is meant generally for zero-shutter-lag features,
-     * where copying the captured image from the output buffer to the
-     * reprocessing input buffer would be expensive. The stream will be used by
-     * the framework as follows:
-     *
-     * 1. The framework includes a buffer from this stream as output buffer in a
-     *    request as normal.
-     *
-     * 2. Once the HAL device returns a filled output buffer to the framework,
-     *    the framework may do one of two things with the filled buffer:
-     *
-     * 2. a. The framework uses the filled data, and returns the now-used buffer
-     *       to the stream queue for reuse. This behavior exactly matches the
-     *       OUTPUT type of stream.
-     *
-     * 2. b. The framework wants to reprocess the filled data, and uses the
-     *       buffer as an input buffer for a request. Once the HAL device has
-     *       used the reprocessing buffer, it then returns it to the
-     *       framework. The framework then returns the now-used buffer to the
-     *       stream queue for reuse.
-     *
-     * 3. The HAL device will be given the buffer again as an output buffer for
-     *    a request at some future point.
+     * This kind of stream is meant generally for Zero Shutter Lag (ZSL)
+     * features, where copying the captured image from the output buffer to the
+     * reprocessing input buffer would be expensive. See S8.1 for more details.
      *
      * Note that the HAL will always be reprocessing data it produced.
      *
@@ -1051,6 +1380,102 @@
 } camera3_stream_type_t;
 
 /**
+ * camera3_stream_rotation_t:
+ *
+ * The required counterclockwise rotation of camera stream.
+ */
+typedef enum camera3_stream_rotation {
+    /* No rotation */
+    CAMERA3_STREAM_ROTATION_0 = 0,
+
+    /* Rotate by 90 degree counterclockwise */
+    CAMERA3_STREAM_ROTATION_90 = 1,
+
+    /* Rotate by 180 degree counterclockwise */
+    CAMERA3_STREAM_ROTATION_180 = 2,
+
+    /* Rotate by 270 degree counterclockwise */
+    CAMERA3_STREAM_ROTATION_270 = 3
+} camera3_stream_rotation_t;
+
+/**
+ * camera3_stream_configuration_mode_t:
+ *
+ * This defines the general operation mode for the HAL (for a given stream configuration), where
+ * modes besides NORMAL have different semantics, and usually limit the generality of the API in
+ * exchange for higher performance in some particular area.
+ */
+typedef enum camera3_stream_configuration_mode {
+    /**
+     * Normal stream configuration operation mode. This is the default camera operation mode,
+     * where all semantics of HAL APIs and metadata controls apply.
+     */
+    CAMERA3_STREAM_CONFIGURATION_NORMAL_MODE = 0,
+
+    /**
+     * Special constrained high speed operation mode for devices that can not support high
+     * speed output in NORMAL mode. All streams in this configuration are operating at high speed
+     * mode and have different characteristics and limitations to achieve high speed output.
+     * The NORMAL mode can still be used for high speed output if the HAL can support high speed
+     * output while satisfying all the semantics of HAL APIs and metadata controls. It is
+     * recommended for the HAL to support high speed output in NORMAL mode (by advertising the high
+     * speed FPS ranges in android.control.aeAvailableTargetFpsRanges) if possible.
+     *
+     * This mode has below limitations/requirements:
+     *
+     *   1. The HAL must support up to 2 streams with sizes reported by
+     *      android.control.availableHighSpeedVideoConfigurations.
+     *   2. In this mode, the HAL is expected to output up to 120fps or higher. This mode must
+     *      support the targeted FPS range and size configurations reported by
+     *      android.control.availableHighSpeedVideoConfigurations.
+     *   3. The HAL must support HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED output stream format.
+     *   4. To achieve efficient high speed streaming, the HAL may have to aggregate
+     *      multiple frames together and send to camera device for processing where the request
+     *      controls are same for all the frames in this batch (batch mode). The HAL must support
+     *      max batch size and the max batch size requirements defined by
+     *      android.control.availableHighSpeedVideoConfigurations.
+     *   5. In this mode, the HAL must override aeMode, awbMode, and afMode to ON, ON, and
+     *      CONTINUOUS_VIDEO, respectively. All post-processing block mode controls must be
+     *      overridden to be FAST. Therefore, no manual control of capture and post-processing
+     *      parameters is possible. All other controls operate the same as when
+     *      android.control.mode == AUTO. This means that all other android.control.* fields
+     *      must continue to work, such as
+     *
+     *      android.control.aeTargetFpsRange
+     *      android.control.aeExposureCompensation
+     *      android.control.aeLock
+     *      android.control.awbLock
+     *      android.control.effectMode
+     *      android.control.aeRegions
+     *      android.control.afRegions
+     *      android.control.awbRegions
+     *      android.control.afTrigger
+     *      android.control.aePrecaptureTrigger
+     *
+     *      Outside of android.control.*, the following controls must work:
+     *
+     *      android.flash.mode (TORCH mode only, automatic flash for still capture will not work
+     *      since aeMode is ON)
+     *      android.lens.opticalStabilizationMode (if it is supported)
+     *      android.scaler.cropRegion
+     *      android.statistics.faceDetectMode (if it is supported)
+     *
+     * For more details about high speed stream requirements, see
+     * android.control.availableHighSpeedVideoConfigurations and CONSTRAINED_HIGH_SPEED_VIDEO
+     * capability defined in android.request.availableCapabilities.
+     *
+     * This mode only needs to be supported by HALs that include CONSTRAINED_HIGH_SPEED_VIDEO in
+     * the android.request.availableCapabilities static metadata.
+     */
+    CAMERA3_STREAM_CONFIGURATION_CONSTRAINED_HIGH_SPEED_MODE = 1,
+
+    /**
+     * First value for vendor-defined stream configuration modes.
+     */
+    CAMERA3_VENDOR_STREAM_CONFIGURATION_MODE_START = 0x8000
+} camera3_stream_configuration_mode_t;
+
+/**
  * camera3_stream_t:
  *
  * A handle to a single camera input or output stream. A stream is defined by
@@ -1105,9 +1530,17 @@
      * gralloc module will select a format based on the usage flags provided by
      * the camera device and the other endpoint of the stream.
      *
+     * <= CAMERA_DEVICE_API_VERSION_3_1:
+     *
      * The camera HAL device must inspect the buffers handed to it in the
      * subsequent register_stream_buffers() call to obtain the
      * implementation-specific format details, if necessary.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * register_stream_buffers() won't be called by the framework, so the HAL
+     * should configure the ISP and sensor pipeline based purely on the sizes,
+     * usage flags, and formats for the configured streams.
      */
     int format;
 
@@ -1160,6 +1593,61 @@
      */
     void *priv;
 
+    /**
+     * A field that describes the contents of the buffer. The format and buffer
+     * dimensions define the memory layout and structure of the stream buffers,
+     * while dataSpace defines the meaning of the data within the buffer.
+     *
+     * For most formats, dataSpace defines the color space of the image data.
+     * In addition, for some formats, dataSpace indicates whether image- or
+     * depth-based data is requested.  See system/core/include/system/graphics.h
+     * for details of formats and valid dataSpace values for each format.
+     *
+     * Version information:
+     *
+     * < CAMERA_DEVICE_API_VERSION_3_3:
+     *
+     *   Not defined and should not be accessed. dataSpace should be assumed to
+     *   be HAL_DATASPACE_UNKNOWN, and the appropriate color space, etc, should
+     *   be determined from the usage flags and the format.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_3:
+     *
+     *   Always set by the camera service. HAL must use this dataSpace to
+     *   configure the stream to the correct colorspace, or to select between
+     *   color and depth outputs if supported.
+     */
+    android_dataspace_t data_space;
+
+    /**
+     * The required output rotation of the stream, one of
+     * the camera3_stream_rotation_t values. This must be inspected by HAL along
+     * with stream width and height. For example, if the rotation is 90 degree
+     * and the stream width and height is 720 and 1280 respectively, camera service
+     * will supply buffers of size 720x1280, and HAL should capture a 1280x720 image
+     * and rotate the image by 90 degree counterclockwise. The rotation field is
+     * no-op when the stream type is input. Camera HAL must ignore the rotation
+     * field for an input stream.
+     *
+     * <= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     *    Not defined and must not be accessed. HAL must not apply any rotation
+     *    on output images.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_3:
+     *
+     *    Always set by camera service. HAL must inspect this field during stream
+     *    configuration and returns -EINVAL if HAL cannot perform such rotation.
+     *    HAL must always support CAMERA3_STREAM_ROTATION_0, so a
+     *    configure_streams() call must not fail for unsupported rotation if
+     *    rotation field of all streams is CAMERA3_STREAM_ROTATION_0.
+     *
+     */
+    int rotation;
+
+    /* reserved for future use */
+    void *reserved[7];
+
 } camera3_stream_t;
 
 /**
@@ -1189,6 +1677,19 @@
      */
     camera3_stream_t **streams;
 
+    /**
+     * >= CAMERA_DEVICE_API_VERSION_3_3:
+     *
+     * The operation mode of streams in this configuration, one of the value defined in
+     * camera3_stream_configuration_mode_t.
+     * The HAL can use this mode as an indicator to set the stream property (e.g.,
+     * camera3_stream->max_buffers) appropriately. For example, if the configuration is
+     * CAMERA3_STREAM_CONFIGURATION_CONSTRAINED_HIGH_SPEED_MODE, the HAL may want to set aside more
+     * buffers for batch mode operation (see android.control.availableHighSpeedVideoConfigurations
+     * for batch mode definition).
+     *
+     */
+    uint32_t operation_mode;
 } camera3_stream_configuration_t;
 
 /**
@@ -1257,6 +1758,14 @@
      *
      * For input buffers, the HAL must not change the acquire_fence field during
      * the process_capture_request() call.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * When the HAL returns an input buffer to the framework with
+     * process_capture_result(), the acquire_fence must be set to -1. If the HAL
+     * never waits on input buffer acquire fence due to an error, the sync
+     * fences should be handled similarly to the way they are handled for output
+     * buffers.
      */
      int acquire_fence;
 
@@ -1265,10 +1774,25 @@
      * returning buffers to the framework, or write -1 to indicate that no
      * waiting is required for this buffer.
      *
-     * For the input buffer, the release fence must be set by the
-     * process_capture_request() call. For the output buffers, the fences must
-     * be set in the output_buffers array passed to process_capture_result().
+     * For the output buffers, the fences must be set in the output_buffers
+     * array passed to process_capture_result().
      *
+     * <= CAMERA_DEVICE_API_VERSION_3_1:
+     *
+     * For the input buffer, the release fence must be set by the
+     * process_capture_request() call.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * For the input buffer, the fences must be set in the input_buffer
+     * passed to process_capture_result().
+     *
+     * After signaling the release_fence for this buffer, the HAL
+     * should not make any further attempts to access this buffer as the
+     * ownership has been fully transferred back to the framework.
+     *
+     * If a fence of -1 was specified then the ownership of this buffer
+     * is transferred back immediately upon the call of process_capture_result.
      */
     int release_fence;
 
@@ -1280,6 +1804,12 @@
  * The complete set of gralloc buffers for a stream. This structure is given to
  * register_stream_buffers() to allow the camera HAL device to register/map/etc
  * newly allocated stream buffers.
+ *
+ * >= CAMERA_DEVICE_API_VERSION_3_2:
+ *
+ * Deprecated (and not used). In particular,
+ * register_stream_buffers is also deprecated and will never be invoked.
+ *
  */
 typedef struct camera3_stream_buffer_set {
     /**
@@ -1309,17 +1839,18 @@
  * Transport header for compressed JPEG buffers in output streams.
  *
  * To capture JPEG images, a stream is created using the pixel format
- * HAL_PIXEL_FORMAT_BLOB, and the static metadata field android.jpeg.maxSize is
- * used as the buffer size. Since compressed JPEG images are of variable size,
- * the HAL needs to include the final size of the compressed image using this
- * structure inside the output stream buffer. The JPEG blob ID field must be set
- * to CAMERA3_JPEG_BLOB_ID.
+ * HAL_PIXEL_FORMAT_BLOB. The buffer size for the stream is calculated by the
+ * framework, based on the static metadata field android.jpeg.maxSize. Since
+ * compressed JPEG images are of variable size, the HAL needs to include the
+ * final size of the compressed image using this structure inside the output
+ * stream buffer. The JPEG blob ID field must be set to CAMERA3_JPEG_BLOB_ID.
  *
- * Transport header should be at the end of the JPEG output stream buffer.  That
- * means the jpeg_blob_id must start at byte[android.jpeg.maxSize -
- * sizeof(camera3_jpeg_blob)].  Any HAL using this transport header must
- * account for it in android.jpeg.maxSize.  The JPEG data itself starts at
- * the beginning of the buffer and should be jpeg_size bytes long.
+ * Transport header should be at the end of the JPEG output stream buffer. That
+ * means the jpeg_blob_id must start at byte[buffer_size -
+ * sizeof(camera3_jpeg_blob)], where the buffer_size is the size of gralloc buffer.
+ * Any HAL using this transport header must account for it in android.jpeg.maxSize
+ * The JPEG data itself starts at the beginning of the buffer and should be
+ * jpeg_size bytes long.
  */
 typedef struct camera3_jpeg_blob {
     uint16_t jpeg_blob_id;
@@ -1354,7 +1885,7 @@
     CAMERA3_MSG_ERROR = 1,
 
     /**
-     * The exposure of a given request has
+     * The exposure of a given request or processing a reprocess request has
      * begun. camera3_notify_msg.message.shutter contains the information
      * the capture.
      */
@@ -1445,12 +1976,13 @@
  */
 typedef struct camera3_shutter_msg {
     /**
-     * Frame number of the request that has begun exposure
+     * Frame number of the request that has begun exposure or reprocessing.
      */
     uint32_t frame_number;
 
     /**
-     * Timestamp for the start of capture. This must match the capture result
+     * Timestamp for the start of capture. For a reprocess request, this must
+     * be input image's start of capture. This must match the capture result
      * metadata's sensor exposure start timestamp.
      */
     uint64_t timestamp;
@@ -1534,6 +2066,16 @@
      */
     CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG = 5,
 
+    /**
+     * A basic template for direct application control of capture
+     * parameters. All automatic control is disabled (auto-exposure, auto-white
+     * balance, auto-focus), and post-processing parameters are set to preview
+     * quality. The manual capture parameters (exposure, sensitivity, etc.)
+     * are set to reasonable defaults, but should be overridden by the
+     * application depending on the intended use case.
+     */
+    CAMERA3_TEMPLATE_MANUAL = 6,
+
     /* Total number of templates */
     CAMERA3_TEMPLATE_COUNT,
 
@@ -1592,8 +2134,15 @@
      * The HAL is required to wait on the acquire sync fence of the input buffer
      * before accessing it.
      *
+     * <= CAMERA_DEVICE_API_VERSION_3_1:
+     *
      * Any input buffer included here will have been registered with the HAL
      * through register_stream_buffers() before its inclusion in a request.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * The buffers will not have been pre-registered with the HAL.
+     * Subsequent requests may reuse buffers, or provide entirely new buffers.
      */
     camera3_stream_buffer_t *input_buffer;
 
@@ -1606,13 +2155,21 @@
     /**
      * An array of num_output_buffers stream buffers, to be filled with image
      * data from this capture/reprocess. The HAL must wait on the acquire fences
-     * of each stream buffer before writing to them. All the buffers included
-     * here will have been registered with the HAL through
-     * register_stream_buffers() before their inclusion in a request.
+     * of each stream buffer before writing to them.
      *
      * The HAL takes ownership of the actual buffer_handle_t entries in
      * output_buffers; the framework does not access them until they are
      * returned in a camera3_capture_result_t.
+     *
+     * <= CAMERA_DEVICE_API_VERSION_3_1:
+     *
+     * All the buffers included  here will have been registered with the HAL
+     * through register_stream_buffers() before their inclusion in a request.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * Any or all of the buffers included here may be brand new in this
+     * request (having never before seen by the HAL).
      */
     const camera3_stream_buffer_t *output_buffers;
 
@@ -1625,7 +2182,9 @@
  * sent to the framework asynchronously with process_capture_result(), in
  * response to a single capture request sent to the HAL with
  * process_capture_request(). Multiple process_capture_result() calls may be
- * performed by the HAL for each request. Each call, all with the same frame
+ * performed by the HAL for each request.
+ *
+ * Each call, all with the same frame
  * number, may contain some subset of the output buffers, and/or the result
  * metadata. The metadata may only be provided once for a given frame number;
  * all other calls must set the result metadata to NULL.
@@ -1635,6 +2194,29 @@
  * output buffer may come with a release sync fence that the framework will wait
  * on before reading, in case the buffer has not yet been filled by the HAL.
  *
+ * >= CAMERA_DEVICE_API_VERSION_3_2:
+ *
+ * The metadata may be provided multiple times for a single frame number. The
+ * framework will accumulate together the final result set by combining each
+ * partial result together into the total result set.
+ *
+ * If an input buffer is given in a request, the HAL must return it in one of
+ * the process_capture_result calls, and the call may be to just return the input
+ * buffer, without metadata and output buffers; the sync fences must be handled
+ * the same way they are done for output buffers.
+ *
+ *
+ * Performance considerations:
+ *
+ * Applications will also receive these partial results immediately, so sending
+ * partial results is a highly recommended performance optimization to avoid
+ * the total pipeline latency before sending the results for what is known very
+ * early on in the pipeline.
+ *
+ * A typical use case might be calculating the AF state halfway through the
+ * pipeline; by sending the state back to the framework immediately, we get a
+ * 50% performance increase and perceived responsiveness of the auto-focus.
+ *
  */
 typedef struct camera3_capture_result {
     /**
@@ -1657,6 +2239,18 @@
      *
      * If there was an error producing the result metadata, result must be an
      * empty metadata buffer, and notify() must be called with ERROR_RESULT.
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * Multiple calls to process_capture_result() with a given frame_number
+     * may include the result metadata.
+     *
+     * Partial metadata submitted should not include any metadata key returned
+     * in a previous partial result for a given frame. Each new partial result
+     * for that frame must also set a distinct partial_result value.
+     *
+     * If notify has been called with ERROR_RESULT, all further partial
+     * results for that frame are ignored by the framework.
      */
     const camera_metadata_t *result;
 
@@ -1666,7 +2260,8 @@
      * less than the buffer count in the capture request, at least one more call
      * to process_capture_result with the same frame_number must be made, to
      * return the remaining output buffers to the framework. This may only be
-     * zero if the structure includes valid result metadata.
+     * zero if the structure includes valid result metadata or an input buffer
+     * is returned in this result.
      */
     uint32_t num_output_buffers;
 
@@ -1690,9 +2285,71 @@
      * num_output_buffers is zero, this may be NULL. In that case, at least one
      * more process_capture_result call must be made by the HAL to provide the
      * output buffers.
+     *
+     * When process_capture_result is called with a new buffer for a frame,
+     * all previous frames' buffers for that corresponding stream must have been
+     * already delivered (the fences need not have yet been signaled).
+     *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * Gralloc buffers for a frame may be sent to framework before the
+     * corresponding SHUTTER-notify.
+     *
+     * Performance considerations:
+     *
+     * Buffers delivered to the framework will not be dispatched to the
+     * application layer until a start of exposure timestamp has been received
+     * via a SHUTTER notify() call. It is highly recommended to
+     * dispatch that call as early as possible.
      */
      const camera3_stream_buffer_t *output_buffers;
 
+     /**
+      * >= CAMERA_DEVICE_API_VERSION_3_2:
+      *
+      * The handle for the input stream buffer for this capture. It may not
+      * yet be consumed at the time the HAL calls process_capture_result(); the
+      * framework will wait on the release sync fences provided by the HAL before
+      * reusing the buffer.
+      *
+      * The HAL should handle the sync fences the same way they are done for
+      * output_buffers.
+      *
+      * Only one input buffer is allowed to be sent per request. Similarly to
+      * output buffers, the ordering of returned input buffers must be
+      * maintained by the HAL.
+      *
+      * Performance considerations:
+      *
+      * The input buffer should be returned as early as possible. If the HAL
+      * supports sync fences, it can call process_capture_result to hand it back
+      * with sync fences being set appropriately. If the sync fences are not
+      * supported, the buffer can only be returned when it is consumed, which
+      * may take long time; the HAL may choose to copy this input buffer to make
+      * the buffer return sooner.
+      */
+      const camera3_stream_buffer_t *input_buffer;
+
+     /**
+      * >= CAMERA_DEVICE_API_VERSION_3_2:
+      *
+      * In order to take advantage of partial results, the HAL must set the
+      * static metadata android.request.partialResultCount to the number of
+      * partial results it will send for each frame.
+      *
+      * Each new capture result with a partial result must set
+      * this field (partial_result) to a distinct inclusive value between
+      * 1 and android.request.partialResultCount.
+      *
+      * HALs not wishing to take advantage of this feature must not
+      * set an android.request.partialResultCount or partial_result to a value
+      * other than 1.
+      *
+      * This value must be set to 0 when a capture result contains buffers only
+      * and no metadata.
+      */
+     uint32_t partial_result;
+
 } camera3_capture_result_t;
 
 /**********************************************************************
@@ -1768,6 +2425,13 @@
      * message. In this case, individual ERROR_RESULT/ERROR_BUFFER messages
      * should not be sent.
      *
+     * Performance requirements:
+     *
+     * This is a non-blocking call. The framework will return this call in 5ms.
+     *
+     * The pipeline latency (see S7 for definition) should be less than or equal to
+     * 4 frame intervals, and must be less than or equal to 8 frame intervals.
+     *
      */
     void (*process_capture_result)(const struct camera3_callback_ops *,
             const camera3_capture_result_t *result);
@@ -1781,11 +2445,26 @@
      * with the HAL, and the msg only needs to be valid for the duration of this
      * call.
      *
+     * Multiple threads may call notify() simultaneously.
+     *
+     * <= CAMERA_DEVICE_API_VERSION_3_1:
+     *
      * The notification for the start of exposure for a given request must be
      * sent by the HAL before the first call to process_capture_result() for
      * that request is made.
      *
-     * Multiple threads may call notify() simultaneously.
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * Buffers delivered to the framework will not be dispatched to the
+     * application layer until a start of exposure timestamp (or input image's
+     * start of exposure timestamp for a reprocess request) has been received
+     * via a SHUTTER notify() call. It is highly recommended to dispatch this
+     * call as early as possible.
+     *
+     * ------------------------------------------------------------------------
+     * Performance requirements:
+     *
+     * This is a non-blocking call. The framework will return this call in 5ms.
      */
     void (*notify)(const struct camera3_callback_ops *,
             const camera3_notify_msg_t *msg);
@@ -1806,6 +2485,11 @@
      * the HAL. Will be called once after a successful open() call, before any
      * other functions are called on the camera3_device_ops structure.
      *
+     * Performance requirements:
+     *
+     * This should be a non-blocking call. The HAL should return from this call
+     * in 5ms, and must return from this call in 10ms.
+     *
      * Return values:
      *
      *  0:     On successful initialization
@@ -1823,6 +2507,8 @@
     /**
      * configure_streams:
      *
+     * CAMERA_DEVICE_API_VERSION_3_0 only:
+     *
      * Reset the HAL camera device processing pipeline and set up new input and
      * output streams. This call replaces any existing stream configuration with
      * the streams defined in the stream_list. This method will be called at
@@ -1835,16 +2521,19 @@
      * The stream_list may contain streams that are also in the currently-active
      * set of streams (from the previous call to configure_stream()). These
      * streams will already have valid values for usage, max_buffers, and the
-     * private pointer. If such a stream has already had its buffers registered,
+     * private pointer.
+     *
+     * If such a stream has already had its buffers registered,
      * register_stream_buffers() will not be called again for the stream, and
      * buffers from the stream can be immediately included in input requests.
      *
      * If the HAL needs to change the stream configuration for an existing
      * stream due to the new configuration, it may rewrite the values of usage
-     * and/or max_buffers during the configure call. The framework will detect
-     * such a change, and will then reallocate the stream buffers, and call
-     * register_stream_buffers() again before using buffers from that stream in
-     * a request.
+     * and/or max_buffers during the configure call.
+     *
+     * The framework will detect such a change, and will then reallocate the
+     * stream buffers, and call register_stream_buffers() again before using
+     * buffers from that stream in a request.
      *
      * If a currently-active stream is not included in stream_list, the HAL may
      * safely remove any references to that stream. It will not be reused in a
@@ -1873,6 +2562,115 @@
      * of (for example) a preview stream, with allocation for other streams
      * happening later or concurrently.
      *
+     * ------------------------------------------------------------------------
+     * CAMERA_DEVICE_API_VERSION_3_1 only:
+     *
+     * Reset the HAL camera device processing pipeline and set up new input and
+     * output streams. This call replaces any existing stream configuration with
+     * the streams defined in the stream_list. This method will be called at
+     * least once after initialize() before a request is submitted with
+     * process_capture_request().
+     *
+     * The stream_list must contain at least one output-capable stream, and may
+     * not contain more than one input-capable stream.
+     *
+     * The stream_list may contain streams that are also in the currently-active
+     * set of streams (from the previous call to configure_stream()). These
+     * streams will already have valid values for usage, max_buffers, and the
+     * private pointer.
+     *
+     * If such a stream has already had its buffers registered,
+     * register_stream_buffers() will not be called again for the stream, and
+     * buffers from the stream can be immediately included in input requests.
+     *
+     * If the HAL needs to change the stream configuration for an existing
+     * stream due to the new configuration, it may rewrite the values of usage
+     * and/or max_buffers during the configure call.
+     *
+     * The framework will detect such a change, and will then reallocate the
+     * stream buffers, and call register_stream_buffers() again before using
+     * buffers from that stream in a request.
+     *
+     * If a currently-active stream is not included in stream_list, the HAL may
+     * safely remove any references to that stream. It will not be reused in a
+     * later configure() call by the framework, and all the gralloc buffers for
+     * it will be freed after the configure_streams() call returns.
+     *
+     * The stream_list structure is owned by the framework, and may not be
+     * accessed once this call completes. The address of an individual
+     * camera3_stream_t structure will remain valid for access by the HAL until
+     * the end of the first configure_stream() call which no longer includes
+     * that camera3_stream_t in the stream_list argument. The HAL may not change
+     * values in the stream structure outside of the private pointer, except for
+     * the usage and max_buffers members during the configure_streams() call
+     * itself.
+     *
+     * If the stream is new, max_buffer, and private pointer fields of the
+     * stream structure will all be set to 0. The usage will be set to the
+     * consumer usage flags. The HAL device must set these fields before the
+     * configure_streams() call returns. These fields are then used by the
+     * framework and the platform gralloc module to allocate the gralloc
+     * buffers for each stream.
+     *
+     * Before such a new stream can have its buffers included in a capture
+     * request, the framework will call register_stream_buffers() with that
+     * stream. However, the framework is not required to register buffers for
+     * _all_ streams before submitting a request. This allows for quick startup
+     * of (for example) a preview stream, with allocation for other streams
+     * happening later or concurrently.
+     *
+     * ------------------------------------------------------------------------
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * Reset the HAL camera device processing pipeline and set up new input and
+     * output streams. This call replaces any existing stream configuration with
+     * the streams defined in the stream_list. This method will be called at
+     * least once after initialize() before a request is submitted with
+     * process_capture_request().
+     *
+     * The stream_list must contain at least one output-capable stream, and may
+     * not contain more than one input-capable stream.
+     *
+     * The stream_list may contain streams that are also in the currently-active
+     * set of streams (from the previous call to configure_stream()). These
+     * streams will already have valid values for usage, max_buffers, and the
+     * private pointer.
+     *
+     * If the HAL needs to change the stream configuration for an existing
+     * stream due to the new configuration, it may rewrite the values of usage
+     * and/or max_buffers during the configure call.
+     *
+     * The framework will detect such a change, and may then reallocate the
+     * stream buffers before using buffers from that stream in a request.
+     *
+     * If a currently-active stream is not included in stream_list, the HAL may
+     * safely remove any references to that stream. It will not be reused in a
+     * later configure() call by the framework, and all the gralloc buffers for
+     * it will be freed after the configure_streams() call returns.
+     *
+     * The stream_list structure is owned by the framework, and may not be
+     * accessed once this call completes. The address of an individual
+     * camera3_stream_t structure will remain valid for access by the HAL until
+     * the end of the first configure_stream() call which no longer includes
+     * that camera3_stream_t in the stream_list argument. The HAL may not change
+     * values in the stream structure outside of the private pointer, except for
+     * the usage and max_buffers members during the configure_streams() call
+     * itself.
+     *
+     * If the stream is new, max_buffer, and private pointer fields of the
+     * stream structure will all be set to 0. The usage will be set to the
+     * consumer usage flags. The HAL device must set these fields before the
+     * configure_streams() call returns. These fields are then used by the
+     * framework and the platform gralloc module to allocate the gralloc
+     * buffers for each stream.
+     *
+     * Newly allocated buffers may be included in a capture request at any time
+     * by the framework. Once a gralloc buffer is returned to the framework
+     * with process_capture_result (and its respective release_fence has been
+     * signaled) the framework may free or reuse it at any time.
+     *
+     * ------------------------------------------------------------------------
+     *
      * Preconditions:
      *
      * The framework will only call this method when no captures are being
@@ -1888,7 +2686,7 @@
      * frame rate given the sizes and formats of the output streams, as
      * documented in the camera device's static metadata.
      *
-     * Performance expectations:
+     * Performance requirements:
      *
      * This call is expected to be heavyweight and possibly take several hundred
      * milliseconds to complete, since it may require resetting and
@@ -1898,6 +2696,9 @@
      * application operational mode changes (such as switching from still
      * capture to video recording).
      *
+     * The HAL should return from this call in 500ms, and must return from this
+     * call in 1000ms.
+     *
      * Return values:
      *
      *  0:      On successful stream configuration
@@ -1916,6 +2717,14 @@
      *
      *          - Including too many output streams of a certain format.
      *
+     *          - Unsupported rotation configuration (only applies to
+     *            devices with version >= CAMERA_DEVICE_API_VERSION_3_3)
+     *
+     *          - Stream sizes/formats don't satisfy the
+     *            camera3_stream_configuration_t->operation_mode requirements for non-NORMAL mode,
+     *            or the requested operation_mode is not supported by the HAL.
+     *            (only applies to devices with version >= CAMERA_DEVICE_API_VERSION_3_3)
+     *
      *          Note that the framework submitting an invalid stream
      *          configuration is not normal operation, since stream
      *          configurations are checked before configure. An invalid
@@ -1933,6 +2742,12 @@
     /**
      * register_stream_buffers:
      *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * DEPRECATED. This will not be called and must be set to NULL.
+     *
+     * <= CAMERA_DEVICE_API_VERSION_3_1:
+     *
      * Register buffers for a given stream with the HAL device. This method is
      * called by the framework after a new stream is defined by
      * configure_streams, and before buffers from that stream are included in a
@@ -1955,6 +2770,11 @@
      * the camera HAL should inspect the passed-in buffers here to determine any
      * platform-private pixel format information.
      *
+     * Performance requirements:
+     *
+     * This should be a non-blocking call. The HAL should return from this call
+     * in 1ms, and must return from this call in 5ms.
+     *
      * Return values:
      *
      *  0:      On successful registration of the new stream buffers
@@ -1992,6 +2812,11 @@
      * buffer may be returned for subsequent calls for the same template, or for
      * other templates.
      *
+     * Performance requirements:
+     *
+     * This should be a non-blocking call. The HAL should return from this call
+     * in 1ms, and must return from this call in 5ms.
+     *
      * Return values:
      *
      *   Valid metadata: On successful creation of a default settings
@@ -2036,6 +2861,22 @@
      * framework will wait on the sync fence before refilling and reusing the
      * input buffer.
      *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *
+     * The input/output buffers provided by the framework in each request
+     * may be brand new (having never before seen by the HAL).
+     *
+     * ------------------------------------------------------------------------
+     * Performance considerations:
+     *
+     * Handling a new buffer should be extremely lightweight and there should be
+     * no frame rate degradation or frame jitter introduced.
+     *
+     * This call must return fast enough to ensure that the requested frame
+     * rate can be sustained, especially for streaming cases (post-processing
+     * quality settings set to FAST). The HAL should return this call in 1
+     * frame interval, and must return from this call in 4 frame intervals.
+     *
      * Return values:
      *
      *  0:      On a successful start to processing the capture request
@@ -2071,6 +2912,10 @@
      * The definition of vendor_tag_query_ops_t can be found in
      * system/media/camera/include/system/camera_metadata.h.
      *
+     * >= CAMERA_DEVICE_API_VERSION_3_2:
+     *    DEPRECATED. This function has been deprecated and should be set to
+     *    NULL by the HAL.  Please implement get_vendor_tag_ops in camera_common.h
+     *    instead.
      */
     void (*get_metadata_vendor_tag_ops)(const struct camera3_device*,
             vendor_tag_query_ops_t* ops);
@@ -2084,6 +2929,14 @@
      *
      * The passed-in file descriptor can be used to write debugging text using
      * dprintf() or write(). The text should be in ASCII encoding only.
+     *
+     * Performance requirements:
+     *
+     * This must be a non-blocking call. The HAL should return from this call
+     * in 1ms, must return from this call in 10ms. This call must avoid
+     * deadlocks, as it may be called at any point during camera operation.
+     * Any synchronization primitives used (such as mutex locks or semaphores)
+     * should be acquired with a timeout.
      */
     void (*dump)(const struct camera3_device *, int fd);
 
@@ -2095,22 +2948,87 @@
      * quickly as possible in order to prepare for a configure_streams() call.
      *
      * No buffers are required to be successfully returned, so every buffer
-     * held at the time of flush() (whether sucessfully filled or not) may be
+     * held at the time of flush() (whether successfully filled or not) may be
      * returned with CAMERA3_BUFFER_STATUS_ERROR. Note the HAL is still allowed
-     * to return valid (STATUS_OK) buffers during this call, provided they are
-     * succesfully filled.
+     * to return valid (CAMERA3_BUFFER_STATUS_OK) buffers during this call,
+     * provided they are successfully filled.
      *
      * All requests currently in the HAL are expected to be returned as soon as
      * possible.  Not-in-process requests should return errors immediately. Any
      * interruptible hardware blocks should be stopped, and any uninterruptible
      * blocks should be waited on.
      *
+     * flush() may be called concurrently to process_capture_request(), with the expectation that
+     * process_capture_request will return quickly and the request submitted in that
+     * process_capture_request call is treated like all other in-flight requests.  Due to
+     * concurrency issues, it is possible that from the HAL's point of view, a
+     * process_capture_request() call may be started after flush has been invoked but has not
+     * returned yet. If such a call happens before flush() returns, the HAL should treat the new
+     * capture request like other in-flight pending requests (see #4 below).
+     *
+     * More specifically, the HAL must follow below requirements for various cases:
+     *
+     * 1. For captures that are too late for the HAL to cancel/stop, and will be
+     *    completed normally by the HAL; i.e. the HAL can send shutter/notify and
+     *    process_capture_result and buffers as normal.
+     *
+     * 2. For pending requests that have not done any processing, the HAL must call notify
+     *    CAMERA3_MSG_ERROR_REQUEST, and return all the output buffers with
+     *    process_capture_result in the error state (CAMERA3_BUFFER_STATUS_ERROR).
+     *    The HAL must not place the release fence into an error state, instead,
+     *    the release fences must be set to the acquire fences passed by the framework,
+     *    or -1 if they have been waited on by the HAL already. This is also the path
+     *    to follow for any captures for which the HAL already called notify() with
+     *    CAMERA3_MSG_SHUTTER but won't be producing any metadata/valid buffers for.
+     *    After CAMERA3_MSG_ERROR_REQUEST, for a given frame, only process_capture_results with
+     *    buffers in CAMERA3_BUFFER_STATUS_ERROR are allowed. No further notifys or
+     *    process_capture_result with non-null metadata is allowed.
+     *
+     * 3. For partially completed pending requests that will not have all the output
+     *    buffers or perhaps missing metadata, the HAL should follow below:
+     *
+     *    3.1. Call notify with CAMERA3_MSG_ERROR_RESULT if some of the expected result
+     *    metadata (i.e. one or more partial metadata) won't be available for the capture.
+     *
+     *    3.2. Call notify with CAMERA3_MSG_ERROR_BUFFER for every buffer that won't
+     *         be produced for the capture.
+     *
+     *    3.3  Call notify with CAMERA3_MSG_SHUTTER with the capture timestamp before
+     *         any buffers/metadata are returned with process_capture_result.
+     *
+     *    3.4 For captures that will produce some results, the HAL must not call
+     *        CAMERA3_MSG_ERROR_REQUEST, since that indicates complete failure.
+     *
+     *    3.5. Valid buffers/metadata should be passed to the framework as normal.
+     *
+     *    3.6. Failed buffers should be returned to the framework as described for case 2.
+     *         But failed buffers do not have to follow the strict ordering valid buffers do,
+     *         and may be out-of-order with respect to valid buffers. For example, if buffers
+     *         A, B, C, D, E are sent, D and E are failed, then A, E, B, D, C is an acceptable
+     *         return order.
+     *
+     *    3.7. For fully-missing metadata, calling CAMERA3_MSG_ERROR_RESULT is sufficient, no
+     *         need to call process_capture_result with NULL metadata or equivalent.
+     *
+     * 4. If a flush() is invoked while a process_capture_request() invocation is active, that
+     *    process call should return as soon as possible. In addition, if a process_capture_request()
+     *    call is made after flush() has been invoked but before flush() has returned, the
+     *    capture request provided by the late process_capture_request call should be treated like
+     *    a pending request in case #2 above.
+     *
      * flush() should only return when there are no more outstanding buffers or
-     * requests left in the HAL.  The framework may call configure_streams (as
+     * requests left in the HAL. The framework may call configure_streams (as
      * the HAL state is now quiesced) or may issue new requests.
      *
-     * A flush() call should only take 100ms or less. The maximum time it can
-     * take is 1 second.
+     * Note that it's sufficient to only support fully-succeeded and fully-failed result cases.
+     * However, it is highly desirable to support the partial failure cases as well, as it
+     * could help improve the flush call overall performance.
+     *
+     * Performance requirements:
+     *
+     * The HAL should return from this call in 100ms, and must return from this
+     * call in 1000ms. And this call must not be blocked longer than pipeline
+     * latency (see S7 for definition).
      *
      * Version information:
      *
@@ -2141,6 +3059,13 @@
     /**
      * common.version must equal CAMERA_DEVICE_API_VERSION_3_0 to identify this
      * device as implementing version 3.0 of the camera device HAL.
+     *
+     * Performance requirements:
+     *
+     * Camera open (common.module->common.methods->open) should return in 200ms, and must return
+     * in 500ms.
+     * Camera close (common.close) should return in 200ms, and must return in 500ms.
+     *
      */
     hw_device_t common;
     camera3_device_ops_t *ops;
diff --git a/include/hardware/camera_common.h b/include/hardware/camera_common.h
index 3a1233f..7658dd4 100644
--- a/include/hardware/camera_common.h
+++ b/include/hardware/camera_common.h
@@ -20,10 +20,12 @@
 #define ANDROID_INCLUDE_CAMERA_COMMON_H
 
 #include <stdint.h>
+#include <stdbool.h>
 #include <sys/cdefs.h>
 #include <sys/types.h>
 #include <cutils/native_handle.h>
 #include <system/camera.h>
+#include <system/camera_vendor_tags.h>
 #include <hardware/hardware.h>
 #include <hardware/gralloc.h>
 
@@ -74,6 +76,47 @@
  *   This camera module version adds vendor tag support from the module, and
  *   deprecates the old vendor_tag_query_ops that were previously only
  *   accessible with a device open.
+ *
+ *******************************************************************************
+ * Version: 2.3 [CAMERA_MODULE_API_VERSION_2_3]
+ *
+ *   This camera module version adds open legacy camera HAL device support.
+ *   Framework can use it to open the camera device as lower device HAL version
+ *   HAL device if the same device can support multiple device API versions.
+ *   The standard hardware module open call (common.methods->open) continues
+ *   to open the camera device with the latest supported version, which is
+ *   also the version listed in camera_info_t.device_version.
+ *
+ *******************************************************************************
+ * Version: 2.4 [CAMERA_MODULE_API_VERSION_2_4]
+ *
+ * This camera module version adds below API changes:
+ *
+ * 1. Torch mode support. The framework can use it to turn on torch mode for
+ *    any camera device that has a flash unit, without opening a camera device. The
+ *    camera device has a higher priority accessing the flash unit than the camera
+ *    module; opening a camera device will turn off the torch if it had been enabled
+ *    through the module interface. When there are any resource conflicts, such as
+ *    open() is called to open a camera device, the camera HAL module must notify the
+ *    framework through the torch mode status callback that the torch mode has been
+ *    turned off.
+ *
+ * 2. External camera (e.g. USB hot-plug camera) support. The API updates specify that
+ *    the camera static info is only available when camera is connected and ready to
+ *    use for external hot-plug cameras. Calls to get static info will be invalid
+ *    calls when camera status is not CAMERA_DEVICE_STATUS_PRESENT. The frameworks
+ *    will only count on device status change callbacks to manage the available external
+ *    camera list.
+ *
+ * 3. Camera arbitration hints. This module version adds support for explicitly
+ *    indicating the number of camera devices that can be simultaneously opened and used.
+ *    To specify valid combinations of devices, the resource_cost and conflicting_devices
+ *    fields should always be set in the camera_info structure returned by the
+ *    get_camera_info call.
+ *
+ * 4. Module initialization method. This will be called by the camera service
+ *    right after the HAL module is loaded, to allow for one-time initialization
+ *    of the HAL. It is called before any other module methods are invoked.
  */
 
 /**
@@ -88,8 +131,10 @@
 #define CAMERA_MODULE_API_VERSION_2_0 HARDWARE_MODULE_API_VERSION(2, 0)
 #define CAMERA_MODULE_API_VERSION_2_1 HARDWARE_MODULE_API_VERSION(2, 1)
 #define CAMERA_MODULE_API_VERSION_2_2 HARDWARE_MODULE_API_VERSION(2, 2)
+#define CAMERA_MODULE_API_VERSION_2_3 HARDWARE_MODULE_API_VERSION(2, 3)
+#define CAMERA_MODULE_API_VERSION_2_4 HARDWARE_MODULE_API_VERSION(2, 4)
 
-#define CAMERA_MODULE_API_VERSION_CURRENT CAMERA_MODULE_API_VERSION_2_2
+#define CAMERA_MODULE_API_VERSION_CURRENT CAMERA_MODULE_API_VERSION_2_4
 
 /**
  * All device versions <= HARDWARE_DEVICE_API_VERSION(1, 0xFF) must be treated
@@ -100,9 +145,12 @@
 #define CAMERA_DEVICE_API_VERSION_2_1 HARDWARE_DEVICE_API_VERSION(2, 1)
 #define CAMERA_DEVICE_API_VERSION_3_0 HARDWARE_DEVICE_API_VERSION(3, 0)
 #define CAMERA_DEVICE_API_VERSION_3_1 HARDWARE_DEVICE_API_VERSION(3, 1)
+#define CAMERA_DEVICE_API_VERSION_3_2 HARDWARE_DEVICE_API_VERSION(3, 2)
+#define CAMERA_DEVICE_API_VERSION_3_3 HARDWARE_DEVICE_API_VERSION(3, 3)
 
-// Device version 2.x is outdated; device version 3.0 is experimental
-#define CAMERA_DEVICE_API_VERSION_CURRENT CAMERA_DEVICE_API_VERSION_1_0
+// Device version 3.3 is current, older HAL camera device versions are not
+// recommended for new devices.
+#define CAMERA_DEVICE_API_VERSION_CURRENT CAMERA_DEVICE_API_VERSION_3_3
 
 /**
  * Defined in /system/media/camera/include/system/camera_metadata.h
@@ -111,11 +159,19 @@
 
 typedef struct camera_info {
     /**
-     * The direction that the camera faces to. It should be CAMERA_FACING_BACK
-     * or CAMERA_FACING_FRONT.
+     * The direction that the camera faces to. See system/core/include/system/camera.h
+     * for camera facing definitions.
      *
-     * Version information:
-     *   Valid in all camera_module versions
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     * CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *   It should be CAMERA_FACING_BACK or CAMERA_FACING_FRONT.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4 or higher:
+     *
+     *   It should be CAMERA_FACING_BACK, CAMERA_FACING_FRONT or
+     *   CAMERA_FACING_EXTERNAL.
      */
     int facing;
 
@@ -131,8 +187,16 @@
      * top side of a front-facing camera sensor is aligned with the right of the
      * screen, the value should be 270.
      *
-     * Version information:
-     *   Valid in all camera_module versions
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     * CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *   Valid in all camera_module versions.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4 or higher:
+     *
+     *   Valid if camera facing is CAMERA_FACING_BACK or CAMERA_FACING_FRONT,
+     *   not valid if camera facing is CAMERA_FACING_EXTERNAL.
      */
     int orientation;
 
@@ -154,9 +218,9 @@
     uint32_t device_version;
 
     /**
-     * The camera's fixed characteristics, which include all camera metadata in
-     * the android.*.info.* sections. This should be a sorted metadata buffer,
-     * and may not be modified or freed by the caller. The pointer should remain
+     * The camera's fixed characteristics, which include all static camera metadata
+     * specified in system/media/camera/docs/docs.html. This should be a sorted metadata
+     * buffer, and may not be modified or freed by the caller. The pointer should remain
      * valid for the lifetime of the camera module, and values in it may not
      * change after it is returned by get_camera_info().
      *
@@ -174,6 +238,185 @@
      *
      */
     const camera_metadata_t *static_camera_characteristics;
+
+    /**
+     * The total resource "cost" of using this camera, represented as an integer
+     * value in the range [0, 100] where 100 represents total usage of the shared
+     * resource that is the limiting bottleneck of the camera subsystem.  This may
+     * be a very rough estimate, and is used as a hint to the camera service to
+     * determine when to disallow multiple applications from simultaneously
+     * opening different cameras advertised by the camera service.
+     *
+     * The camera service must be able to simultaneously open and use any
+     * combination of camera devices exposed by the HAL where the sum of
+     * the resource costs of these cameras is <= 100.  For determining cost,
+     * each camera device must be assumed to be configured and operating at
+     * the maximally resource-consuming framerate and stream size settings
+     * available in the configuration settings exposed for that device through
+     * the camera metadata.
+     *
+     * The camera service may still attempt to simultaneously open combinations
+     * of camera devices with a total resource cost > 100.  This may succeed or
+     * fail.  If this succeeds, combinations of configurations that are not
+     * supported due to resource constraints from having multiple open devices
+     * should fail during the configure calls.  If the total resource cost is
+     * <= 100, open and configure should never fail for any stream configuration
+     * settings or other device capabilities that would normally succeed for a
+     * device when it is the only open camera device.
+     *
+     * This field will be used to determine whether background applications are
+     * allowed to use this camera device while other applications are using other
+     * camera devices.  Note: multiple applications will never be allowed by the
+     * camera service to simultaneously open the same camera device.
+     *
+     * Example use cases:
+     *
+     * Ex. 1: Camera Device 0 = Back Camera
+     *        Camera Device 1 = Front Camera
+     *   - Using both camera devices causes a large framerate slowdown due to
+     *     limited ISP bandwidth.
+     *
+     *   Configuration:
+     *
+     *   Camera Device 0 - resource_cost = 51
+     *                     conflicting_devices = null
+     *   Camera Device 1 - resource_cost = 51
+     *                     conflicting_devices = null
+     *
+     *   Result:
+     *
+     *   Since the sum of the resource costs is > 100, if a higher-priority
+     *   application has either device open, no lower-priority applications will be
+     *   allowed by the camera service to open either device.  If a lower-priority
+     *   application is using a device that a higher-priority subsequently attempts
+     *   to open, the lower-priority application will be forced to disconnect the
+     *   the device.
+     *
+     *   If the highest-priority application chooses, it may still attempt to open
+     *   both devices (since these devices are not listed as conflicting in the
+     *   conflicting_devices fields), but usage of these devices may fail in the
+     *   open or configure calls.
+     *
+     * Ex. 2: Camera Device 0 = Left Back Camera
+     *        Camera Device 1 = Right Back Camera
+     *        Camera Device 2 = Combined stereo camera using both right and left
+     *                          back camera sensors used by devices 0, and 1
+     *        Camera Device 3 = Front Camera
+     *   - Due to do hardware constraints, up to two cameras may be open at once. The
+     *     combined stereo camera may never be used at the same time as either of the
+     *     two back camera devices (device 0, 1), and typically requires too much
+     *     bandwidth to use at the same time as the front camera (device 3).
+     *
+     *   Configuration:
+     *
+     *   Camera Device 0 - resource_cost = 50
+     *                     conflicting_devices = { 2 }
+     *   Camera Device 1 - resource_cost = 50
+     *                     conflicting_devices = { 2 }
+     *   Camera Device 2 - resource_cost = 100
+     *                     conflicting_devices = { 0, 1 }
+     *   Camera Device 3 - resource_cost = 50
+     *                     conflicting_devices = null
+     *
+     *   Result:
+     *
+     *   Based on the conflicting_devices fields, the camera service guarantees that
+     *   the following sets of open devices will never be allowed: { 1, 2 }, { 0, 2 }.
+     *
+     *   Based on the resource_cost fields, if a high-priority foreground application
+     *   is using camera device 0, a background application would be allowed to open
+     *   camera device 1 or 3 (but would be forced to disconnect it again if the
+     *   foreground application opened another device).
+     *
+     *   The highest priority application may still attempt to simultaneously open
+     *   devices 0, 2, and 3, but the HAL may fail in open or configure calls for
+     *   this combination.
+     *
+     * Ex. 3: Camera Device 0 = Back Camera
+     *        Camera Device 1 = Front Camera
+     *        Camera Device 2 = Low-power Front Camera that uses the same
+     *                          sensor as device 1, but only exposes image stream
+     *                          resolutions that can be used in low-power mode
+     *  - Using both front cameras (device 1, 2) at the same time is impossible due
+     *    a shared physical sensor.  Using the back and "high-power" front camera
+     *    (device 1) may be impossible for some stream configurations due to hardware
+     *    limitations, but the "low-power" front camera option may always be used as
+     *    it has special dedicated hardware.
+     *
+     *   Configuration:
+     *
+     *   Camera Device 0 - resource_cost = 100
+     *                     conflicting_devices = null
+     *   Camera Device 1 - resource_cost = 100
+     *                     conflicting_devices = { 2 }
+     *   Camera Device 2 - resource_cost = 0
+     *                     conflicting_devices = { 1 }
+     *   Result:
+     *
+     *   Based on the conflicting_devices fields, the camera service guarantees that
+     *   the following sets of open devices will never be allowed: { 1, 2 }.
+     *
+     *   Based on the resource_cost fields, only the highest priority application
+     *   may attempt to open both device 0 and 1 at the same time. If a higher-priority
+     *   application is not using device 1 or 2, a low-priority background application
+     *   may open device 2 (but will be forced to disconnect it if a higher-priority
+     *   application subsequently opens device 1 or 2).
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     *  CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *    Not valid.  Can be assumed to be 100.  Do not read this field.
+     *
+     *  CAMERA_MODULE_API_VERSION_2_4 or higher:
+     *
+     *    Always valid.
+     */
+    int resource_cost;
+
+    /**
+     * An array of camera device IDs represented as NULL-terminated strings
+     * indicating other devices that cannot be simultaneously opened while this
+     * camera device is in use.
+     *
+     * This field is intended to be used to indicate that this camera device
+     * is a composite of several other camera devices, or otherwise has
+     * hardware dependencies that prohibit simultaneous usage. If there are no
+     * dependencies, a NULL may be returned in this field to indicate this.
+     *
+     * The camera service will never simultaneously open any of the devices
+     * in this list while this camera device is open.
+     *
+     * The strings pointed to in this field will not be cleaned up by the camera
+     * service, and must remain while this device is plugged in.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     *  CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *    Not valid.  Can be assumed to be NULL.  Do not read this field.
+     *
+     *  CAMERA_MODULE_API_VERSION_2_4 or higher:
+     *
+     *    Always valid.
+     */
+    char** conflicting_devices;
+
+    /**
+     * The length of the array given in the conflicting_devices field.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     *  CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *    Not valid.  Can be assumed to be 0.  Do not read this field.
+     *
+     *  CAMERA_MODULE_API_VERSION_2_4 or higher:
+     *
+     *    Always valid.
+     */
+    size_t conflicting_devices_length;
+
 } camera_info_t;
 
 /**
@@ -197,33 +440,155 @@
 typedef enum camera_device_status {
     /**
      * The camera device is not currently connected, and opening it will return
-     * failure. Calls to get_camera_info must still succeed, and provide the
-     * same information it would if the camera were connected
+     * failure.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     * CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *   Calls to get_camera_info must still succeed, and provide the same information
+     *   it would if the camera were connected.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4:
+     *
+     *   The camera device at this status must return -EINVAL for get_camera_info call,
+     *   as the device is not connected.
      */
     CAMERA_DEVICE_STATUS_NOT_PRESENT = 0,
 
     /**
-     * The camera device is connected, and opening it will succeed. The
-     * information returned by get_camera_info cannot change due to this status
-     * change. By default, the framework will assume all devices are in this
-     * state.
+     * The camera device is connected, and opening it will succeed.
+     *
+     * CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *   The information returned by get_camera_info cannot change due to this status
+     *   change. By default, the framework will assume all devices are in this state.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4:
+     *
+     *   The information returned by get_camera_info will become valid after a device's
+     *   status changes to this. By default, the framework will assume all devices are in
+     *   this state.
      */
     CAMERA_DEVICE_STATUS_PRESENT = 1,
 
     /**
      * The camera device is connected, but it is undergoing an enumeration and
-     * so opening the device will return -EBUSY. Calls to get_camera_info
-     * must still succeed, as if the camera was in the PRESENT status.
+     * so opening the device will return -EBUSY.
+     *
+     * CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *   Calls to get_camera_info must still succeed, as if the camera was in the
+     *   PRESENT status.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4:
+     *
+     *   The camera device at this status must return -EINVAL for get_camera_info for call,
+     *   as the device is not ready.
      */
     CAMERA_DEVICE_STATUS_ENUMERATING = 2,
 
 } camera_device_status_t;
 
 /**
+ * torch_mode_status_t:
+ *
+ * The current status of the torch mode, as provided by the HAL through the
+ * camera_module_callbacks.torch_mode_status_change() call.
+ *
+ * The torch mode status of a camera device is applicable only when the camera
+ * device is present. The framework will not call set_torch_mode() to turn on
+ * torch mode of a camera device if the camera device is not present. At module
+ * load time, the framework will assume torch modes are in the
+ * TORCH_MODE_STATUS_AVAILABLE_OFF state if the camera device is present and
+ * android.flash.info.available is reported as true via get_camera_info() call.
+ *
+ * The behaviors of the camera HAL module that the framework expects in the
+ * following situations when a camera device's status changes:
+ *  1. A previously-disconnected camera device becomes connected.
+ *      After camera_module_callbacks::camera_device_status_change() is invoked
+ *      to inform the framework that the camera device is present, the framework
+ *      will assume the camera device's torch mode is in
+ *      TORCH_MODE_STATUS_AVAILABLE_OFF state. The camera HAL module does not need
+ *      to invoke camera_module_callbacks::torch_mode_status_change() unless the
+ *      flash unit is unavailable to use by set_torch_mode().
+ *
+ *  2. A previously-connected camera becomes disconnected.
+ *      After camera_module_callbacks::camera_device_status_change() is invoked
+ *      to inform the framework that the camera device is not present, the
+ *      framework will not call set_torch_mode() for the disconnected camera
+ *      device until its flash unit becomes available again. The camera HAL
+ *      module does not need to invoke
+ *      camera_module_callbacks::torch_mode_status_change() separately to inform
+ *      that the flash unit has become unavailable.
+ *
+ *  3. open() is called to open a camera device.
+ *      The camera HAL module must invoke
+ *      camera_module_callbacks::torch_mode_status_change() for all flash units
+ *      that have entered TORCH_MODE_STATUS_NOT_AVAILABLE state and can not be
+ *      turned on by calling set_torch_mode() anymore due to this open() call.
+ *      open() must not trigger TORCH_MODE_STATUS_AVAILABLE_OFF before
+ *      TORCH_MODE_STATUS_NOT_AVAILABLE for all flash units that have become
+ *      unavailable.
+ *
+ *  4. close() is called to close a camera device.
+ *      The camera HAL module must invoke
+ *      camera_module_callbacks::torch_mode_status_change() for all flash units
+ *      that have entered TORCH_MODE_STATUS_AVAILABLE_OFF state and can be turned
+ *      on by calling set_torch_mode() again because of enough resources freed
+ *      up by this close() call.
+ *
+ *  Note that the framework calling set_torch_mode() successfully must trigger
+ *  TORCH_MODE_STATUS_AVAILABLE_OFF or TORCH_MODE_STATUS_AVAILABLE_ON callback
+ *  for the given camera device. Additionally it must trigger
+ *  TORCH_MODE_STATUS_AVAILABLE_OFF callbacks for other previously-on torch
+ *  modes if HAL cannot keep multiple torch modes on simultaneously.
+ */
+typedef enum torch_mode_status {
+
+    /**
+     * The flash unit is no longer available and the torch mode can not be
+     * turned on by calling set_torch_mode(). If the torch mode is on, it
+     * will be turned off by HAL before HAL calls torch_mode_status_change().
+     */
+    TORCH_MODE_STATUS_NOT_AVAILABLE = 0,
+
+    /**
+     * A torch mode has become off and available to be turned on via
+     * set_torch_mode(). This may happen in the following
+     * cases:
+     *   1. After the resources to turn on the torch mode have become available.
+     *   2. After set_torch_mode() is called to turn off the torch mode.
+     *   3. After the framework turned on the torch mode of some other camera
+     *      device and HAL had to turn off the torch modes of any camera devices
+     *      that were previously on.
+     */
+    TORCH_MODE_STATUS_AVAILABLE_OFF = 1,
+
+    /**
+     * A torch mode has become on and available to be turned off via
+     * set_torch_mode(). This can happen only after set_torch_mode() is called
+     * to turn on the torch mode.
+     */
+    TORCH_MODE_STATUS_AVAILABLE_ON = 2,
+
+} torch_mode_status_t;
+
+/**
  * Callback functions for the camera HAL module to use to inform the framework
- * of changes to the camera subsystem. These are called only by HAL modules
- * implementing version CAMERA_MODULE_API_VERSION_2_1 or higher of the HAL
- * module API interface.
+ * of changes to the camera subsystem.
+ *
+ * Version information (based on camera_module_t.common.module_api_version):
+ *
+ * Each callback is called only by HAL modules implementing the indicated
+ * version or higher of the HAL module API interface.
+ *
+ *  CAMERA_MODULE_API_VERSION_2_1:
+ *    camera_device_status_change()
+ *
+ *  CAMERA_MODULE_API_VERSION_2_4:
+ *    torch_mode_status_change()
+
  */
 typedef struct camera_module_callbacks {
 
@@ -236,6 +601,8 @@
      * must call this method to inform the framework of any initially
      * NOT_PRESENT devices.
      *
+     * This callback is added for CAMERA_MODULE_API_VERSION_2_1.
+     *
      * camera_module_callbacks: The instance of camera_module_callbacks_t passed
      *   to the module with set_callbacks.
      *
@@ -249,68 +616,60 @@
             int camera_id,
             int new_status);
 
+    /**
+     * torch_mode_status_change:
+     *
+     * Callback to the framework to indicate that the state of the torch mode
+     * of the flash unit associated with a specific camera device has changed.
+     * At module load time, the framework will assume the torch modes are in
+     * the TORCH_MODE_STATUS_AVAILABLE_OFF state if android.flash.info.available
+     * is reported as true via get_camera_info() call.
+     *
+     * This callback is added for CAMERA_MODULE_API_VERSION_2_4.
+     *
+     * camera_module_callbacks: The instance of camera_module_callbacks_t
+     *   passed to the module with set_callbacks.
+     *
+     * camera_id: The ID of camera device whose flash unit has a new torch mode
+     *   status.
+     *
+     * new_status: The new status code, one of the torch_mode_status_t enums.
+     */
+    void (*torch_mode_status_change)(const struct camera_module_callbacks*,
+            const char* camera_id,
+            int new_status);
+
+
 } camera_module_callbacks_t;
 
-/**
- * Set up vendor-specific tag query methods. These are needed to properly query
- * entries with vendor-specified tags, potentially returned by get_camera_info.
- *
- * This should be used in place of vendor_tag_query_ops, which are deprecated.
- */
-typedef struct vendor_tag_ops vendor_tag_ops_t;
-struct vendor_tag_ops {
-    /**
-     * Get the number of vendor tags supported on this platform. Used to
-     * calculate the size of buffer needed for holding the array of all tags
-     * returned by get_all_tags().
-     */
-    int (*get_tag_count)(const vendor_tag_ops_t *v);
-
-    /**
-     * Fill an array with all the supported vendor tags on this platform.
-     * get_tag_count() returns the number of tags supported, and
-     * tag_array will be allocated with enough space to hold all of the tags.
-     */
-    void (*get_all_tags)(const vendor_tag_ops_t *v, uint32_t *tag_array);
-
-    /**
-     * Get vendor section name for a vendor-specified entry tag. Only called for
-     * vendor-defined tags. The section name must start with the name of the
-     * vendor in the Java package style. For example, CameraZoom Inc. must
-     * prefix their sections with "com.camerazoom." Must return NULL if the tag
-     * is outside the bounds of vendor-defined sections.
-     *
-     * There may be different vendor-defined tag sections, for example the
-     * phone maker, the chipset maker, and the camera module maker may each
-     * have their own "com.vendor."-prefixed section.
-     *
-     * The memory pointed to by the return value must remain valid for the
-     * lifetime that the module is loaded, and is owned by the module.
-     */
-    const char *(*get_section_name)(const vendor_tag_ops_t *v, uint32_t tag);
-
-    /**
-     * Get tag name for a vendor-specified entry tag. Only called for
-     * vendor-defined tags. Must return NULL if the it is not a vendor-defined
-     * tag.
-     *
-     * The memory pointed to by the return value must remain valid for the
-     * lifetime that the module is loaded, and is owned by the module.
-     */
-    const char *(*get_tag_name)(const vendor_tag_ops_t *v, uint32_t tag);
-
-    /**
-     * Get tag type for a vendor-specified entry tag. Only called for tags >=
-     * 0x80000000. Must return -1 if the tag is outside the bounds of
-     * vendor-defined sections.
-     */
-    int (*get_tag_type)(const vendor_tag_ops_t *v, uint32_t tag);
-
-    /* reserved for future use */
-    void* reserved[8];
-};
-
 typedef struct camera_module {
+    /**
+     * Common methods of the camera module.  This *must* be the first member of
+     * camera_module as users of this structure will cast a hw_module_t to
+     * camera_module pointer in contexts where it's known the hw_module_t
+     * references a camera_module.
+     *
+     * The return values for common.methods->open for camera_module are:
+     *
+     * 0:           On a successful open of the camera device.
+     *
+     * -ENODEV:     The camera device cannot be opened due to an internal
+     *              error.
+     *
+     * -EINVAL:     The input arguments are invalid, i.e. the id is invalid,
+     *              and/or the module is invalid.
+     *
+     * -EBUSY:      The camera device was already opened for this camera id
+     *              (by using this method or open_legacy),
+     *              regardless of the device HAL version it was opened as.
+     *
+     * -EUSERS:     The maximal number of camera devices that can be
+     *              opened concurrently were opened already, either by
+     *              this method or the open_legacy method.
+     *
+     * All other return values from common.methods->open will be treated as
+     * -ENODEV.
+     */
     hw_module_t common;
 
     /**
@@ -322,8 +681,21 @@
      * simply the number converted to a string. That is, "0" for camera ID 0,
      * "1" for camera ID 1.
      *
-     * The value here must be static, and cannot change after the first call to
-     * this method
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     * CAMERA_MODULE_API_VERSION_2_3 or lower:
+     *
+     *   The value here must be static, and cannot change after the first call
+     *   to this method.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4 or higher:
+     *
+     *   The value here must be static, and must count only built-in cameras,
+     *   which have CAMERA_FACING_BACK or CAMERA_FACING_FRONT camera facing values
+     *   (camera_info.facing). The HAL must not include the external cameras
+     *   (camera_info.facing == CAMERA_FACING_EXTERNAL) into the return value
+     *   of this call. Frameworks will use camera_device_status_change callback
+     *   to manage number of external cameras.
      */
     int (*get_number_of_cameras)(void);
 
@@ -333,6 +705,23 @@
      * Return the static camera information for a given camera device. This
      * information may not change for a camera device.
      *
+     * Return values:
+     *
+     * 0:           On a successful operation
+     *
+     * -ENODEV:     The information cannot be provided due to an internal
+     *              error.
+     *
+     * -EINVAL:     The input arguments are invalid, i.e. the id is invalid,
+     *              and/or the module is invalid.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     * CAMERA_MODULE_API_VERSION_2_4 or higher:
+     *
+     *   When a camera is disconnected, its camera id becomes invalid. Calling this
+     *   this method with this invalid camera id will get -EINVAL and NULL camera
+     *   static metadata (camera_info.static_camera_characteristics).
      */
     int (*get_camera_info)(int camera_id, struct camera_info *info);
 
@@ -355,6 +744,15 @@
      *
      *    Valid to be called by the framework.
      *
+     * Return values:
+     *
+     * 0:           On a successful operation
+     *
+     * -ENODEV:     The operation cannot be completed due to an internal
+     *              error.
+     *
+     * -EINVAL:     The input arguments are invalid, i.e. the callbacks are
+     *              null
      */
     int (*set_callbacks)(const camera_module_callbacks_t *callbacks);
 
@@ -365,6 +763,9 @@
      * HAL should fill in all the vendor tag operation methods, or leave ops
      * unchanged if no vendor tags are defined.
      *
+     * The vendor_tag_ops structure used here is defined in:
+     * system/media/camera/include/system/vendor_tags.h
+     *
      * Version information (based on camera_module_t.common.module_api_version):
      *
      *  CAMERA_MODULE_API_VERSION_1_x/2_0/2_1:
@@ -375,8 +776,139 @@
      */
     void (*get_vendor_tag_ops)(vendor_tag_ops_t* ops);
 
+    /**
+     * open_legacy:
+     *
+     * Open a specific legacy camera HAL device if multiple device HAL API
+     * versions are supported by this camera HAL module. For example, if the
+     * camera module supports both CAMERA_DEVICE_API_VERSION_1_0 and
+     * CAMERA_DEVICE_API_VERSION_3_2 device API for the same camera id,
+     * framework can call this function to open the camera device as
+     * CAMERA_DEVICE_API_VERSION_1_0 device.
+     *
+     * This is an optional method. A Camera HAL module does not need to support
+     * more than one device HAL version per device, and such modules may return
+     * -ENOSYS for all calls to this method. For all older HAL device API
+     * versions that are not supported, it may return -EOPNOTSUPP. When above
+     * cases occur, The normal open() method (common.methods->open) will be
+     * used by the framework instead.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     *  CAMERA_MODULE_API_VERSION_1_x/2_0/2_1/2_2:
+     *    Not provided by HAL module. Framework will not call this function.
+     *
+     *  CAMERA_MODULE_API_VERSION_2_3:
+     *    Valid to be called by the framework.
+     *
+     * Return values:
+     *
+     * 0:           On a successful open of the camera device.
+     *
+     * -ENOSYS      This method is not supported.
+     *
+     * -EOPNOTSUPP: The requested HAL version is not supported by this method.
+     *
+     * -EINVAL:     The input arguments are invalid, i.e. the id is invalid,
+     *              and/or the module is invalid.
+     *
+     * -EBUSY:      The camera device was already opened for this camera id
+     *              (by using this method or common.methods->open method),
+     *              regardless of the device HAL version it was opened as.
+     *
+     * -EUSERS:     The maximal number of camera devices that can be
+     *              opened concurrently were opened already, either by
+     *              this method or common.methods->open method.
+     */
+    int (*open_legacy)(const struct hw_module_t* module, const char* id,
+            uint32_t halVersion, struct hw_device_t** device);
+
+    /**
+     * set_torch_mode:
+     *
+     * Turn on or off the torch mode of the flash unit associated with a given
+     * camera ID. If the operation is successful, HAL must notify the framework
+     * torch state by invoking
+     * camera_module_callbacks.torch_mode_status_change() with the new state.
+     *
+     * The camera device has a higher priority accessing the flash unit. When
+     * there are any resource conflicts, such as open() is called to open a
+     * camera device, HAL module must notify the framework through
+     * camera_module_callbacks.torch_mode_status_change() that the
+     * torch mode has been turned off and the torch mode state has become
+     * TORCH_MODE_STATUS_NOT_AVAILABLE. When resources to turn on torch mode
+     * become available again, HAL module must notify the framework through
+     * camera_module_callbacks.torch_mode_status_change() that the torch mode
+     * state has become TORCH_MODE_STATUS_AVAILABLE_OFF for set_torch_mode() to
+     * be called.
+     *
+     * When the framework calls set_torch_mode() to turn on the torch mode of a
+     * flash unit, if HAL cannot keep multiple torch modes on simultaneously,
+     * HAL should turn off the torch mode that was turned on by
+     * a previous set_torch_mode() call and notify the framework that the torch
+     * mode state of that flash unit has become TORCH_MODE_STATUS_AVAILABLE_OFF.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     * CAMERA_MODULE_API_VERSION_1_x/2_0/2_1/2_2/2_3:
+     *   Not provided by HAL module. Framework will not call this function.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4:
+     *   Valid to be called by the framework.
+     *
+     * Return values:
+     *
+     * 0:           On a successful operation.
+     *
+     * -ENOSYS:     The camera device does not support this operation. It is
+     *              returned if and only if android.flash.info.available is
+     *              false.
+     *
+     * -EBUSY:      The camera device is already in use.
+     *
+     * -EUSERS:     The resources needed to turn on the torch mode are not
+     *              available, typically because other camera devices are
+     *              holding the resources to make using the flash unit not
+     *              possible.
+     *
+     * -EINVAL:     camera_id is invalid.
+     *
+     */
+    int (*set_torch_mode)(const char* camera_id, bool enabled);
+
+    /**
+     * init:
+     *
+     * This method is called by the camera service before any other methods
+     * are invoked, right after the camera HAL library has been successfully
+     * loaded. It may be left as NULL by the HAL module, if no initialization
+     * in needed.
+     *
+     * It can be used by HAL implementations to perform initialization and
+     * other one-time operations.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     * CAMERA_MODULE_API_VERSION_1_x/2_0/2_1/2_2/2_3:
+     *   Not provided by HAL module. Framework will not call this function.
+     *
+     * CAMERA_MODULE_API_VERSION_2_4:
+     *   If not NULL, will always be called by the framework once after the HAL
+     *   module is loaded, before any other HAL module method is called.
+     *
+     * Return values:
+     *
+     * 0:           On a successful operation.
+     *
+     * -ENODEV:     Initialization cannot be completed due to an internal
+     *              error. The HAL must be assumed to be in a nonfunctional
+     *              state.
+     *
+     */
+    int (*init)();
+
     /* reserved for future use */
-    void* reserved[8];
+    void* reserved[5];
 } camera_module_t;
 
 __END_DECLS
diff --git a/include/hardware/consumerir.h b/include/hardware/consumerir.h
index 5adf6be..15334c1 100644
--- a/include/hardware/consumerir.h
+++ b/include/hardware/consumerir.h
@@ -32,10 +32,22 @@
 } consumerir_freq_range_t;
 
 typedef struct consumerir_module {
+    /**
+     * Common methods of the consumer IR module.  This *must* be the first member of
+     * consumerir_module as users of this structure will cast a hw_module_t to
+     * consumerir_module pointer in contexts where it's known the hw_module_t references a
+     * consumerir_module.
+     */
     struct hw_module_t common;
 } consumerir_module_t;
 
 typedef struct consumerir_device {
+    /**
+     * Common methods of the consumer IR device.  This *must* be the first member of
+     * consumerir_device as users of this structure will cast a hw_device_t to
+     * consumerir_device pointer in contexts where it's known the hw_device_t references a
+     * consumerir_device.
+     */
     struct hw_device_t common;
 
     /*
diff --git a/include/hardware/fb.h b/include/hardware/fb.h
index 135e4aa..9df9416 100644
--- a/include/hardware/fb.h
+++ b/include/hardware/fb.h
@@ -36,6 +36,12 @@
 /*****************************************************************************/
 
 typedef struct framebuffer_device_t {
+    /**
+     * Common methods of the framebuffer device.  This *must* be the first member of
+     * framebuffer_device_t as users of this structure will cast a hw_device_t to
+     * framebuffer_device_t pointer in contexts where it's known the hw_device_t references a
+     * framebuffer_device_t.
+     */
     struct hw_device_t common;
 
     /* flags describing some attributes of the framebuffer */
diff --git a/include/hardware/fingerprint.h b/include/hardware/fingerprint.h
new file mode 100644
index 0000000..ac88c10
--- /dev/null
+++ b/include/hardware/fingerprint.h
@@ -0,0 +1,266 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INCLUDE_HARDWARE_FINGERPRINT_H
+#define ANDROID_INCLUDE_HARDWARE_FINGERPRINT_H
+
+#include <hardware/hw_auth_token.h>
+
+#define FINGERPRINT_MODULE_API_VERSION_1_0 HARDWARE_MODULE_API_VERSION(1, 0)
+#define FINGERPRINT_MODULE_API_VERSION_2_0 HARDWARE_MODULE_API_VERSION(2, 0)
+#define FINGERPRINT_HARDWARE_MODULE_ID "fingerprint"
+
+typedef enum fingerprint_msg_type {
+    FINGERPRINT_ERROR = -1,
+    FINGERPRINT_ACQUIRED = 1,
+    FINGERPRINT_TEMPLATE_ENROLLING = 3,
+    FINGERPRINT_TEMPLATE_REMOVED = 4,
+    FINGERPRINT_AUTHENTICATED = 5
+} fingerprint_msg_type_t;
+
+/*
+ * Fingerprint errors are meant to tell the framework to terminate the current operation and ask
+ * for the user to correct the situation. These will almost always result in messaging and user
+ * interaction to correct the problem.
+ *
+ * For example, FINGERPRINT_ERROR_CANCELED should follow any acquisition message that results in
+ * a situation where the current operation can't continue without user interaction. For example,
+ * if the sensor is dirty during enrollment and no further enrollment progress can be made,
+ * send FINGERPRINT_ACQUIRED_IMAGER_DIRTY followed by FINGERPRINT_ERROR_CANCELED.
+ */
+typedef enum fingerprint_error {
+    FINGERPRINT_ERROR_HW_UNAVAILABLE = 1, /* The hardware has an error that can't be resolved. */
+    FINGERPRINT_ERROR_UNABLE_TO_PROCESS = 2, /* Bad data; operation can't continue */
+    FINGERPRINT_ERROR_TIMEOUT = 3, /* The operation has timed out waiting for user input. */
+    FINGERPRINT_ERROR_NO_SPACE = 4, /* No space available to store a template */
+    FINGERPRINT_ERROR_CANCELED = 5, /* The current operation can't proceed. See above. */
+    FINGERPRINT_ERROR_UNABLE_TO_REMOVE = 6, /* fingerprint with given id can't be removed */
+    FINGERPRINT_ERROR_VENDOR_BASE = 1000 /* vendor-specific error messages start here */
+} fingerprint_error_t;
+
+/*
+ * Fingerprint acquisition info is meant as feedback for the current operation.  Anything but
+ * FINGERPRINT_ACQUIRED_GOOD will be shown to the user as feedback on how to take action on the
+ * current operation. For example, FINGERPRINT_ACQUIRED_IMAGER_DIRTY can be used to tell the user
+ * to clean the sensor.  If this will cause the current operation to fail, an additional
+ * FINGERPRINT_ERROR_CANCELED can be sent to stop the operation in progress (e.g. enrollment).
+ * In general, these messages will result in a "Try again" message.
+ */
+typedef enum fingerprint_acquired_info {
+    FINGERPRINT_ACQUIRED_GOOD = 0,
+    FINGERPRINT_ACQUIRED_PARTIAL = 1, /* sensor needs more data, i.e. longer swipe. */
+    FINGERPRINT_ACQUIRED_INSUFFICIENT = 2, /* image doesn't contain enough detail for recognition*/
+    FINGERPRINT_ACQUIRED_IMAGER_DIRTY = 3, /* sensor needs to be cleaned */
+    FINGERPRINT_ACQUIRED_TOO_SLOW = 4, /* mostly swipe-type sensors; not enough data collected */
+    FINGERPRINT_ACQUIRED_TOO_FAST = 5, /* for swipe and area sensors; tell user to slow down*/
+    FINGERPRINT_ACQUIRED_VENDOR_BASE = 1000 /* vendor-specific acquisition messages start here */
+} fingerprint_acquired_info_t;
+
+typedef struct fingerprint_finger_id {
+    uint32_t gid;
+    uint32_t fid;
+} fingerprint_finger_id_t;
+
+typedef struct fingerprint_enroll {
+    fingerprint_finger_id_t finger;
+    /* samples_remaining goes from N (no data collected, but N scans needed)
+     * to 0 (no more data is needed to build a template). */
+    uint32_t samples_remaining;
+    uint64_t msg; /* Vendor specific message. Used for user guidance */
+} fingerprint_enroll_t;
+
+typedef struct fingerprint_removed {
+    fingerprint_finger_id_t finger;
+} fingerprint_removed_t;
+
+typedef struct fingerprint_acquired {
+    fingerprint_acquired_info_t acquired_info; /* information about the image */
+} fingerprint_acquired_t;
+
+typedef struct fingerprint_authenticated {
+    fingerprint_finger_id_t finger;
+    hw_auth_token_t hat;
+} fingerprint_authenticated_t;
+
+typedef struct fingerprint_msg {
+    fingerprint_msg_type_t type;
+    union {
+        fingerprint_error_t error;
+        fingerprint_enroll_t enroll;
+        fingerprint_removed_t removed;
+        fingerprint_acquired_t acquired;
+        fingerprint_authenticated_t authenticated;
+    } data;
+} fingerprint_msg_t;
+
+/* Callback function type */
+typedef void (*fingerprint_notify_t)(const fingerprint_msg_t *msg);
+
+/* Synchronous operation */
+typedef struct fingerprint_device {
+    /**
+     * Common methods of the fingerprint device. This *must* be the first member
+     * of fingerprint_device as users of this structure will cast a hw_device_t
+     * to fingerprint_device pointer in contexts where it's known
+     * the hw_device_t references a fingerprint_device.
+     */
+    struct hw_device_t common;
+
+    /*
+     * Client provided callback function to receive notifications.
+     * Do not set by hand, use the function above instead.
+     */
+    fingerprint_notify_t notify;
+
+    /*
+     * Set notification callback:
+     * Registers a user function that would receive notifications from the HAL
+     * The call will block if the HAL state machine is in busy state until HAL
+     * leaves the busy state.
+     *
+     * Function return: 0 if callback function is successfuly registered
+     *                  or a negative number in case of error, generally from the errno.h set.
+     */
+    int (*set_notify)(struct fingerprint_device *dev, fingerprint_notify_t notify);
+
+    /*
+     * Fingerprint pre-enroll enroll request:
+     * Generates a unique token to upper layers to indicate the start of an enrollment transaction.
+     * This token will be wrapped by security for verification and passed to enroll() for
+     * verification before enrollment will be allowed. This is to ensure adding a new fingerprint
+     * template was preceded by some kind of credential confirmation (e.g. device password).
+     *
+     * Function return: 0 if function failed
+     *                  otherwise, a uint64_t of token
+     */
+    uint64_t (*pre_enroll)(struct fingerprint_device *dev);
+
+    /*
+     * Fingerprint enroll request:
+     * Switches the HAL state machine to collect and store a new fingerprint
+     * template. Switches back as soon as enroll is complete
+     * (fingerprint_msg.type == FINGERPRINT_TEMPLATE_ENROLLING &&
+     *  fingerprint_msg.data.enroll.samples_remaining == 0)
+     * or after timeout_sec seconds.
+     * The fingerprint template will be assigned to the group gid. User has a choice
+     * to supply the gid or set it to 0 in which case a unique group id will be generated.
+     *
+     * Function return: 0 if enrollment process can be successfully started
+     *                  or a negative number in case of error, generally from the errno.h set.
+     *                  A notify() function may be called indicating the error condition.
+     */
+    int (*enroll)(struct fingerprint_device *dev, const hw_auth_token_t *hat,
+                    uint32_t gid, uint32_t timeout_sec);
+
+    /*
+     * Finishes the enroll operation and invalidates the pre_enroll() generated challenge.
+     * This will be called at the end of a multi-finger enrollment session to indicate
+     * that no more fingers will be added.
+     *
+     * Function return: 0 if the request is accepted
+     *                  or a negative number in case of error, generally from the errno.h set.
+     */
+    int (*post_enroll)(struct fingerprint_device *dev);
+
+    /*
+     * get_authenticator_id:
+     * Returns a token associated with the current fingerprint set. This value will
+     * change whenever a new fingerprint is enrolled, thus creating a new fingerprint
+     * set.
+     *
+     * Function return: current authenticator id or 0 if function failed.
+     */
+    uint64_t (*get_authenticator_id)(struct fingerprint_device *dev);
+
+    /*
+     * Cancel pending enroll or authenticate, sending FINGERPRINT_ERROR_CANCELED
+     * to all running clients. Switches the HAL state machine back to the idle state.
+     * Unlike enroll_done() doesn't invalidate the pre_enroll() challenge.
+     *
+     * Function return: 0 if cancel request is accepted
+     *                  or a negative number in case of error, generally from the errno.h set.
+     */
+    int (*cancel)(struct fingerprint_device *dev);
+
+    /*
+     * Enumerate all the fingerprint templates found in the directory set by
+     * set_active_group()
+     * This is a synchronous call. The function takes:
+     * - A pointer to an array of fingerprint_finger_id_t.
+     * - The size of the array provided, in fingerprint_finger_id_t elements.
+     * Max_size is a bi-directional parameter and returns the actual number
+     * of elements copied to the caller supplied array.
+     * In the absence of errors the function returns the total number of templates
+     * in the user directory.
+     * If the caller has no good guess on the size of the array he should call this
+     * function witn *max_size == 0 and use the return value for the array allocation.
+     * The caller of this function has a complete list of the templates when *max_size
+     * is the same as the function return.
+     *
+     * Function return: Total number of fingerprint templates in the current storage directory.
+     *                  or a negative number in case of error, generally from the errno.h set.
+     */
+    int (*enumerate)(struct fingerprint_device *dev, fingerprint_finger_id_t *results,
+        uint32_t *max_size);
+
+    /*
+     * Fingerprint remove request:
+     * Deletes a fingerprint template.
+     * Works only within a path set by set_active_group().
+     * notify() will be called with details on the template deleted.
+     * fingerprint_msg.type == FINGERPRINT_TEMPLATE_REMOVED and
+     * fingerprint_msg.data.removed.id indicating the template id removed.
+     *
+     * Function return: 0 if fingerprint template(s) can be successfully deleted
+     *                  or a negative number in case of error, generally from the errno.h set.
+     */
+    int (*remove)(struct fingerprint_device *dev, uint32_t gid, uint32_t fid);
+
+    /*
+     * Restricts the HAL operation to a set of fingerprints belonging to a
+     * group provided.
+     * The caller must provide a path to a storage location within the user's
+     * data directory.
+     *
+     * Function return: 0 on success
+     *                  or a negative number in case of error, generally from the errno.h set.
+     */
+    int (*set_active_group)(struct fingerprint_device *dev, uint32_t gid,
+                            const char *store_path);
+
+    /*
+     * Authenticates an operation identifed by operation_id
+     *
+     * Function return: 0 on success
+     *                  or a negative number in case of error, generally from the errno.h set.
+     */
+    int (*authenticate)(struct fingerprint_device *dev, uint64_t operation_id, uint32_t gid);
+
+    /* Reserved for backward binary compatibility */
+    void *reserved[4];
+} fingerprint_device_t;
+
+typedef struct fingerprint_module {
+    /**
+     * Common methods of the fingerprint module. This *must* be the first member
+     * of fingerprint_module as users of this structure will cast a hw_module_t
+     * to fingerprint_module pointer in contexts where it's known
+     * the hw_module_t references a fingerprint_module.
+     */
+    struct hw_module_t common;
+} fingerprint_module_t;
+
+#endif  /* ANDROID_INCLUDE_HARDWARE_FINGERPRINT_H */
diff --git a/include/hardware/fused_location.h b/include/hardware/fused_location.h
index 5c7821c..73360a1 100644
--- a/include/hardware/fused_location.h
+++ b/include/hardware/fused_location.h
@@ -72,6 +72,37 @@
 #define FLP_TECH_MASK_BLUETOOTH (1U<<4)
 
 /**
+ * Set when your implementation can produce GNNS-derived locations,
+ * for use with flp_capabilities_callback.
+ *
+ * GNNS is a required capability for a particular feature to be used
+ * (batching or geofencing).  If not supported that particular feature
+ * won't be used by the upper layer.
+ */
+#define CAPABILITY_GNSS         (1U<<0)
+/**
+ * Set when your implementation can produce WiFi-derived locations, for
+ * use with flp_capabilities_callback.
+ */
+#define CAPABILITY_WIFI         (1U<<1)
+/**
+ * Set when your implementation can produce cell-derived locations, for
+ * use with flp_capabilities_callback.
+ */
+#define CAPABILITY_CELL         (1U<<3)
+
+/**
+ * Status to return in flp_status_callback when your implementation transitions
+ * from being unsuccessful in determining location to being successful.
+ */
+#define FLP_STATUS_LOCATION_AVAILABLE         0
+/**
+ * Status to return in flp_status_callback when your implementation transitions
+ * from being successful in determining location to being unsuccessful.
+ */
+#define FLP_STATUS_LOCATION_UNAVAILABLE       1
+
+/**
  * This constant is used with the batched locations
  * APIs. Batching is mandatory when FLP implementation
  * is supported. If the flag is set, the hardware implementation
@@ -183,6 +214,33 @@
  */
 typedef int (*flp_set_thread_event)(ThreadEvent event);
 
+/**
+ * Callback for technologies supported by this implementation.
+ *
+ * Parameters: capabilities is a bitmask of FLP_CAPABILITY_* values describing
+ * which features your implementation supports.  You should support
+ * CAPABILITY_GNSS at a minimum for your implementation to be utilized.  You can
+ * return 0 in FlpGeofenceCallbacks to indicate you don't support geofencing,
+ * or 0 in FlpCallbacks to indicate you don't support location batching.
+ */
+typedef void (*flp_capabilities_callback)(int capabilities);
+
+/**
+ * Callback with status information on the ability to compute location.
+ * To avoid waking up the application processor you should only send
+ * changes in status (you shouldn't call this method twice in a row
+ * with the same status value).  As a guideline you should not call this
+ * more frequently then the requested batch period set with period_ns
+ * in FlpBatchOptions.  For example if period_ns is set to 5 minutes and
+ * the status changes many times in that interval, you should only report
+ * one status change every 5 minutes.
+ *
+ * Parameters:
+ *     status is one of FLP_STATUS_LOCATION_AVAILABLE
+ *     or FLP_STATUS_LOCATION_UNAVAILABLE.
+ */
+typedef void (*flp_status_callback)(int32_t status);
+
 /** FLP callback structure. */
 typedef struct {
     /** set to sizeof(FlpCallbacks) */
@@ -191,6 +249,8 @@
     flp_acquire_wakelock acquire_wakelock_cb;
     flp_release_wakelock release_wakelock_cb;
     flp_set_thread_event set_thread_event_cb;
+    flp_capabilities_callback flp_capabilities_cb;
+    flp_status_callback flp_status_cb;
 } FlpCallbacks;
 
 
@@ -228,6 +288,23 @@
      * seconds.
      */
     int64_t period_ns;
+
+    /**
+     * The smallest displacement between reported locations in meters.
+     *
+     * If set to 0, then you should report locations at the requested
+     * interval even if the device is stationary.  If positive, you
+     * can use this parameter as a hint to save power (e.g. throttling
+     * location period if the user hasn't traveled close to the displacement
+     * threshold).  Even small positive values can be interpreted to mean
+     * that you don't have to compute location when the device is stationary.
+     *
+     * There is no need to filter location delivery based on this parameter.
+     * Locations can be delivered even if they have a displacement smaller than
+     * requested. This parameter can safely be ignored at the cost of potential
+     * power savings.
+     */
+    float smallest_displacement_meters;
 } FlpBatchOptions;
 
 #define FLP_RESULT_SUCCESS                       0
@@ -249,7 +326,9 @@
 
     /**
      * Opens the interface and provides the callback routines
-     * to the implemenation of this interface.
+     * to the implementation of this interface.  Once called you should respond
+     * by calling the flp_capabilities_callback in FlpCallbacks to
+     * specify the capabilities that your implementation supports.
      */
     int (*init)(FlpCallbacks* callbacks );
 
@@ -346,6 +425,15 @@
      * Get a pointer to extension information.
      */
     const void* (*get_extension)(const char* name);
+
+    /**
+     * Retrieve all batched locations currently stored and clear the buffer.
+     * flp_location_callback MUST be called in response, even if there are
+     * no locations to flush (in which case num_locations should be 0).
+     * Subsequent calls to get_batched_location or flush_batched_locations
+     * should not return any of the locations returned in this call.
+     */
+    void (*flush_batched_locations)();
 } FlpLocationInterface;
 
 struct flp_device_t {
@@ -598,6 +686,7 @@
     flp_geofence_pause_callback geofence_pause_callback;
     flp_geofence_resume_callback geofence_resume_callback;
     flp_set_thread_event set_thread_event_cb;
+    flp_capabilities_callback flp_capabilities_cb;
 } FlpGeofenceCallbacks;
 
 
@@ -678,7 +767,9 @@
 
    /**
     * Opens the geofence interface and provides the callback routines
-    * to the implemenation of this interface.
+    * to the implemenation of this interface.  Once called you should respond
+    * by calling the flp_capabilities_callback in FlpGeofenceCallbacks to
+    * specify the capabilities that your implementation supports.
     */
    void  (*init)( FlpGeofenceCallbacks* callbacks );
 
diff --git a/include/hardware/gatekeeper.h b/include/hardware/gatekeeper.h
new file mode 100644
index 0000000..2bb2b08
--- /dev/null
+++ b/include/hardware/gatekeeper.h
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_GATEKEEPER_H
+#define ANDROID_HARDWARE_GATEKEEPER_H
+
+#include <sys/cdefs.h>
+#include <sys/types.h>
+#include <hardware/hardware.h>
+
+__BEGIN_DECLS
+
+#define GATEKEEPER_HARDWARE_MODULE_ID "gatekeeper"
+
+#define GATEKEEPER_MODULE_API_VERSION_0_1 HARDWARE_MODULE_API_VERSION(0, 1)
+
+#define HARDWARE_GATEKEEPER "gatekeeper"
+
+struct gatekeeper_module {
+    /**
+     * Comon methods of the gatekeeper module. This *must* be the first member of
+     * gatekeeper_module as users of this structure will cast a hw_module_t to
+     * a gatekeeper_module pointer in the appropriate context.
+     */
+    hw_module_t common;
+};
+
+struct gatekeeper_device {
+    /**
+     * Common methods of the gatekeeper device. As above, this must be the first
+     * member of keymaster_device.
+     */
+    hw_device_t common;
+
+    /**
+     * Enrolls desired_password, which should be derived from a user selected pin or password,
+     * with the authentication factor private key used only for enrolling authentication
+     * factor data.
+     *
+     * If there was already a password enrolled, it should be provided in
+     * current_password_handle, along with the current password in current_password
+     * that should validate against current_password_handle.
+     *
+     * Parameters:
+     * - dev: pointer to gatekeeper_device acquired via calls to gatekeeper_open
+     * - uid: the Android user identifier
+     *
+     * - current_password_handle: the currently enrolled password handle the user
+     *   wants to replace. May be null if there's no currently enrolled password.
+     * - current_password_handle_length: the length in bytes of the buffer pointed
+     *   at by current_password_handle. Must be 0 if current_password_handle is NULL.
+     *
+     * - current_password: the user's current password in plain text. If presented,
+     *   it MUST verify against current_password_handle.
+     * - current_password_length: the size in bytes of the buffer pointed at by
+     *   current_password. Must be 0 if the current_password is NULL.
+     *
+     * - desired_password: the new password the user wishes to enroll in plain-text.
+     *   Cannot be NULL.
+     * - desired_password_length: the length in bytes of the buffer pointed at by
+     *   desired_password.
+     *
+     * - enrolled_password_handle: on success, a buffer will be allocated with the
+     *   new password handle referencing the password provided in desired_password.
+     *   This buffer can be used on subsequent calls to enroll or verify.
+     *   The caller is responsible for deallocating this buffer via a call to delete[]
+     * - enrolled_password_handle_length: pointer to the length in bytes of the buffer allocated
+     *   by this function and pointed to by *enrolled_password_handle_length.
+     *
+     * Returns:
+     * - 0 on success
+     * - An error code < 0 on failure, or
+     * - A timeout value T > 0 if the call should not be re-attempted until T milliseconds
+     *   have elapsed.
+     *
+     * On error, enrolled_password_handle will not be allocated.
+     */
+    int (*enroll)(const struct gatekeeper_device *dev, uint32_t uid,
+            const uint8_t *current_password_handle, uint32_t current_password_handle_length,
+            const uint8_t *current_password, uint32_t current_password_length,
+            const uint8_t *desired_password, uint32_t desired_password_length,
+            uint8_t **enrolled_password_handle, uint32_t *enrolled_password_handle_length);
+
+    /**
+     * Verifies provided_password matches enrolled_password_handle.
+     *
+     * Implementations of this module may retain the result of this call
+     * to attest to the recency of authentication.
+     *
+     * On success, writes the address of a verification token to auth_token,
+     * usable to attest password verification to other trusted services. Clients
+     * may pass NULL for this value.
+     *
+     * Parameters:
+     * - dev: pointer to gatekeeper_device acquired via calls to gatekeeper_open
+     * - uid: the Android user identifier
+     *
+     * - challenge: An optional challenge to authenticate against, or 0. Used when a separate
+     *              authenticator requests password verification, or for transactional
+     *              password authentication.
+     *
+     * - enrolled_password_handle: the currently enrolled password handle that the
+     *   user wishes to verify against.
+     * - enrolled_password_handle_length: the length in bytes of the buffer pointed
+     *   to by enrolled_password_handle
+     *
+     * - provided_password: the plaintext password to be verified against the
+     *   enrolled_password_handle
+     * - provided_password_length: the length in bytes of the buffer pointed to by
+     *   provided_password
+     *
+     * - auth_token: on success, a buffer containing the authentication token
+     *   resulting from this verification is assigned to *auth_token. The caller
+     *   is responsible for deallocating this memory via a call to delete[]
+     * - auth_token_length: on success, the length in bytes of the authentication
+     *   token assigned to *auth_token will be assigned to *auth_token_length
+     *
+     * - request_reenroll: a request to the upper layers to re-enroll the verified
+     *   password due to a version change. Not set if verification fails.
+     *
+     * Returns:
+     * - 0 on success
+     * - An error code < 0 on failure, or
+     * - A timeout value T > 0 if the call should not be re-attempted until T milliseconds
+     *   have elapsed.
+     * On error, auth token will not be allocated
+     */
+    int (*verify)(const struct gatekeeper_device *dev, uint32_t uid, uint64_t challenge,
+            const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length,
+            const uint8_t *provided_password, uint32_t provided_password_length,
+            uint8_t **auth_token, uint32_t *auth_token_length, bool *request_reenroll);
+
+    /*
+     * Deletes the enrolled_password_handle associated wth the uid. Once deleted
+     * the user cannot be verified anymore.
+     * This function is optional and should be set to NULL if it is not implemented.
+     *
+     * Parameters
+     * - dev: pointer to gatekeeper_device acquired via calls to gatekeeper_open
+     * - uid: the Android user identifier
+     *
+     * Returns:
+     * - 0 on success
+     * - An error code < 0 on failure
+     */
+    int (*delete_user)(const struct gatekeeper_device *dev,  uint32_t uid);
+
+    /*
+     * Deletes all the enrolled_password_handles for all uid's. Once called,
+     * no users will be enrolled on the device.
+     * This function is optional and should be set to NULL if it is not implemented.
+     *
+     * Parameters
+     * - dev: pointer to gatekeeper_device acquired via calls to gatekeeper_open
+     *
+     * Returns:
+     * - 0 on success
+     * - An error code < 0 on failure
+     */
+    int (*delete_all_users)(const struct gatekeeper_device *dev);
+};
+
+typedef struct gatekeeper_device gatekeeper_device_t;
+
+static inline int gatekeeper_open(const struct hw_module_t *module,
+        gatekeeper_device_t **device) {
+    return module->methods->open(module, HARDWARE_GATEKEEPER,
+            (struct hw_device_t **) device);
+}
+
+static inline int gatekeeper_close(gatekeeper_device_t *device) {
+    return device->common.close(&device->common);
+}
+
+__END_DECLS
+
+#endif // ANDROID_HARDWARE_GATEKEEPER_H
diff --git a/include/hardware/gps.h b/include/hardware/gps.h
index 458b5b4..76b6cb7 100644
--- a/include/hardware/gps.h
+++ b/include/hardware/gps.h
@@ -21,6 +21,8 @@
 #include <sys/cdefs.h>
 #include <sys/types.h>
 #include <pthread.h>
+#include <sys/socket.h>
+#include <stdbool.h>
 
 #include <hardware/hardware.h>
 
@@ -38,6 +40,9 @@
 /** Maximum number of SVs for gps_sv_status_callback(). */
 #define GPS_MAX_SVS 32
 
+/** Maximum number of Measurements in gps_measurement_callback(). */
+#define GPS_MAX_MEASUREMENT   32
+
 /** Requested operational mode for GPS operation. */
 typedef uint32_t GpsPositionMode;
 // IMPORTANT: Note that the following values must match
@@ -46,7 +51,10 @@
 #define GPS_POSITION_MODE_STANDALONE    0
 /** AGPS MS-Based mode. */
 #define GPS_POSITION_MODE_MS_BASED      1
-/** AGPS MS-Assisted mode. */
+/**
+ * AGPS MS-Assisted mode. This mode is not maintained by the platform anymore.
+ * It is strongly recommended to use GPS_POSITION_MODE_MS_BASE instead.
+ */
 #define GPS_POSITION_MODE_MS_ASSISTED   2
 
 /** Requested recurrence mode for GPS operation. */
@@ -105,6 +113,10 @@
 #define GPS_CAPABILITY_ON_DEMAND_TIME   0x0000010
 /** GPS supports Geofencing  */
 #define GPS_CAPABILITY_GEOFENCING       0x0000020
+/** GPS supports Measurements */
+#define GPS_CAPABILITY_MEASUREMENTS     0x0000040
+/** GPS supports Navigation Messages */
+#define GPS_CAPABILITY_NAV_MESSAGES     0x0000080
 
 /** Flags used to specify which aiding data to delete
     when calling delete_aiding_data(). */
@@ -135,6 +147,12 @@
 #define AGPS_SETID_TYPE_IMSI    1
 #define AGPS_SETID_TYPE_MSISDN  2
 
+typedef uint16_t ApnIpType;
+#define APN_IP_INVALID          0
+#define APN_IP_IPV4             1
+#define APN_IP_IPV6             2
+#define APN_IP_IPV4V6           3
+
 /**
  * String length constants
  */
@@ -206,6 +224,159 @@
 #define AGPS_RIL_NETWORK_TTYPE_WIMAX        6
 
 /**
+ * Flags to indicate what fields in GpsClock are valid.
+ */
+typedef uint16_t GpsClockFlags;
+/** A valid 'leap second' is stored in the data structure. */
+#define GPS_CLOCK_HAS_LEAP_SECOND               (1<<0)
+/** A valid 'time uncertainty' is stored in the data structure. */
+#define GPS_CLOCK_HAS_TIME_UNCERTAINTY          (1<<1)
+/** A valid 'full bias' is stored in the data structure. */
+#define GPS_CLOCK_HAS_FULL_BIAS                 (1<<2)
+/** A valid 'bias' is stored in the data structure. */
+#define GPS_CLOCK_HAS_BIAS                      (1<<3)
+/** A valid 'bias uncertainty' is stored in the data structure. */
+#define GPS_CLOCK_HAS_BIAS_UNCERTAINTY          (1<<4)
+/** A valid 'drift' is stored in the data structure. */
+#define GPS_CLOCK_HAS_DRIFT                     (1<<5)
+/** A valid 'drift uncertainty' is stored in the data structure. */
+#define GPS_CLOCK_HAS_DRIFT_UNCERTAINTY         (1<<6)
+
+/**
+ * Enumeration of the available values for the GPS Clock type.
+ */
+typedef uint8_t GpsClockType;
+/** The type is not available ot it is unknown. */
+#define GPS_CLOCK_TYPE_UNKNOWN                  0
+/** The source of the time value reported by GPS clock is the local hardware clock. */
+#define GPS_CLOCK_TYPE_LOCAL_HW_TIME            1
+/**
+ * The source of the time value reported by GPS clock is the GPS time derived from satellites
+ * (epoch = Jan 6, 1980)
+ */
+#define GPS_CLOCK_TYPE_GPS_TIME                 2
+
+/**
+ * Flags to indicate what fields in GpsMeasurement are valid.
+ */
+typedef uint32_t GpsMeasurementFlags;
+/** A valid 'snr' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_SNR                               (1<<0)
+/** A valid 'elevation' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_ELEVATION                         (1<<1)
+/** A valid 'elevation uncertainty' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_ELEVATION_UNCERTAINTY             (1<<2)
+/** A valid 'azimuth' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_AZIMUTH                           (1<<3)
+/** A valid 'azimuth uncertainty' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_AZIMUTH_UNCERTAINTY               (1<<4)
+/** A valid 'pseudorange' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_PSEUDORANGE                       (1<<5)
+/** A valid 'pseudorange uncertainty' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_PSEUDORANGE_UNCERTAINTY           (1<<6)
+/** A valid 'code phase' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_CODE_PHASE                        (1<<7)
+/** A valid 'code phase uncertainty' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_CODE_PHASE_UNCERTAINTY            (1<<8)
+/** A valid 'carrier frequency' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_CARRIER_FREQUENCY                 (1<<9)
+/** A valid 'carrier cycles' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_CARRIER_CYCLES                    (1<<10)
+/** A valid 'carrier phase' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_CARRIER_PHASE                     (1<<11)
+/** A valid 'carrier phase uncertainty' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_CARRIER_PHASE_UNCERTAINTY         (1<<12)
+/** A valid 'bit number' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_BIT_NUMBER                        (1<<13)
+/** A valid 'time from last bit' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_TIME_FROM_LAST_BIT                (1<<14)
+/** A valid 'doppler shift' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_DOPPLER_SHIFT                     (1<<15)
+/** A valid 'doppler shift uncertainty' is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_DOPPLER_SHIFT_UNCERTAINTY         (1<<16)
+/** A valid 'used in fix' flag is stored in the data structure. */
+#define GPS_MEASUREMENT_HAS_USED_IN_FIX                       (1<<17)
+/** The value of 'pseudorange rate' is uncorrected. */
+#define GPS_MEASUREMENT_HAS_UNCORRECTED_PSEUDORANGE_RATE      (1<<18)
+
+/**
+ * Enumeration of the available values for the GPS Measurement's loss of lock.
+ */
+typedef uint8_t GpsLossOfLock;
+/** The indicator is not available or it is unknown. */
+#define GPS_LOSS_OF_LOCK_UNKNOWN                            0
+/** The measurement does not present any indication of loss of lock. */
+#define GPS_LOSS_OF_LOCK_OK                                 1
+/** Loss of lock between previous and current observation: cycle slip possible. */
+#define GPS_LOSS_OF_LOCK_CYCLE_SLIP                         2
+
+/**
+ * Enumeration of available values for the GPS Measurement's multipath indicator.
+ */
+typedef uint8_t GpsMultipathIndicator;
+/** The indicator is not available or unknown. */
+#define GPS_MULTIPATH_INDICATOR_UNKNOWN                 0
+/** The measurement has been indicated to use multipath. */
+#define GPS_MULTIPATH_INDICATOR_DETECTED                1
+/** The measurement has been indicated Not to use multipath. */
+#define GPS_MULTIPATH_INDICATOR_NOT_USED                2
+
+/**
+ * Flags indicating the GPS measurement state.
+ * The expected behavior here is for GPS HAL to set all the flags that applies. For
+ * example, if the state for a satellite is only C/A code locked and bit synchronized,
+ * and there is still millisecond ambiguity, the state should be set as:
+ * GPS_MEASUREMENT_STATE_CODE_LOCK|GPS_MEASUREMENT_STATE_BIT_SYNC|GPS_MEASUREMENT_STATE_MSEC_AMBIGUOUS
+ * If GPS is still searching for a satellite, the corresponding state should be set to
+ * GPS_MEASUREMENT_STATE_UNKNOWN(0).
+ */
+typedef uint16_t GpsMeasurementState;
+#define GPS_MEASUREMENT_STATE_UNKNOWN                   0
+#define GPS_MEASUREMENT_STATE_CODE_LOCK             (1<<0)
+#define GPS_MEASUREMENT_STATE_BIT_SYNC              (1<<1)
+#define GPS_MEASUREMENT_STATE_SUBFRAME_SYNC         (1<<2)
+#define GPS_MEASUREMENT_STATE_TOW_DECODED           (1<<3)
+#define GPS_MEASUREMENT_STATE_MSEC_AMBIGUOUS        (1<<4)
+
+/**
+ * Flags indicating the Accumulated Delta Range's states.
+ */
+typedef uint16_t GpsAccumulatedDeltaRangeState;
+#define GPS_ADR_STATE_UNKNOWN                       0
+#define GPS_ADR_STATE_VALID                     (1<<0)
+#define GPS_ADR_STATE_RESET                     (1<<1)
+#define GPS_ADR_STATE_CYCLE_SLIP                (1<<2)
+
+/**
+ * Enumeration of available values to indicate the available GPS Navigation message types.
+ */
+typedef uint8_t GpsNavigationMessageType;
+/** The message type is unknown. */
+#define GPS_NAVIGATION_MESSAGE_TYPE_UNKNOWN         0
+/** L1 C/A message contained in the structure.  */
+#define GPS_NAVIGATION_MESSAGE_TYPE_L1CA            1
+/** L2-CNAV message contained in the structure. */
+#define GPS_NAVIGATION_MESSAGE_TYPE_L2CNAV          2
+/** L5-CNAV message contained in the structure. */
+#define GPS_NAVIGATION_MESSAGE_TYPE_L5CNAV          3
+/** CNAV-2 message contained in the structure. */
+#define GPS_NAVIGATION_MESSAGE_TYPE_CNAV2           4
+
+/**
+ * Status of Navigation Message
+ * When a message is received properly without any parity error in its navigation words, the
+ * status should be set to NAV_MESSAGE_STATUS_PARITY_PASSED. But if a message is received
+ * with words that failed parity check, but GPS is able to correct those words, the status
+ * should be set to NAV_MESSAGE_STATUS_PARITY_REBUILT.
+ * No need to send any navigation message that contains words with parity error and cannot be
+ * corrected.
+ */
+typedef uint16_t NavigationMessageStatus;
+#define NAV_MESSAGE_STATUS_UNKONW              0
+#define NAV_MESSAGE_STATUS_PARITY_PASSED   (1<<0)
+#define NAV_MESSAGE_STATUS_PARITY_REBUILT  (1<<1)
+
+/**
  * Name for the GPS XTRA interface.
  */
 #define GPS_XTRA_INTERFACE      "gps-xtra"
@@ -221,6 +392,11 @@
 #define AGPS_INTERFACE      "agps"
 
 /**
+ * Name of the Supl Certificate interface.
+ */
+#define SUPL_CERTIFICATE_INTERFACE  "supl-certificate"
+
+/**
  * Name for NI interface
  */
 #define GPS_NI_INTERFACE "gps-ni"
@@ -235,6 +411,21 @@
  */
 #define GPS_GEOFENCING_INTERFACE   "gps_geofencing"
 
+/**
+ * Name of the GPS Measurements interface.
+ */
+#define GPS_MEASUREMENT_INTERFACE   "gps_measurement"
+
+/**
+ * Name of the GPS navigation message interface.
+ */
+#define GPS_NAVIGATION_MESSAGE_INTERFACE     "gps_navigation_message"
+
+/**
+ * Name of the GNSS/GPS configuration interface.
+ */
+#define GNSS_CONFIGURATION_INTERFACE     "gnss_configuration"
+
 
 /** Represents a location. */
 typedef struct {
@@ -308,6 +499,7 @@
     uint32_t    used_in_fix_mask;
 } GpsSvStatus;
 
+
 /* 2G and 3G */
 /* In 3G lac is discarded */
 typedef struct {
@@ -341,8 +533,9 @@
  */
 typedef void (* gps_status_callback)(GpsStatus* status);
 
-/** Callback with SV status information.
- *  Can only be called from a thread created by create_thread_cb.
+/**
+ * Callback with SV status information.
+ * Can only be called from a thread created by create_thread_cb.
  */
 typedef void (* gps_sv_status_callback)(GpsSvStatus* sv_info);
 
@@ -394,7 +587,7 @@
     size_t          size;
     /**
      * Opens the interface and provides the callback routines
-     * to the implemenation of this interface.
+     * to the implementation of this interface.
      */
     int   (*init)( GpsCallbacks* callbacks );
 
@@ -429,6 +622,12 @@
      * min_interval represents the time between fixes in milliseconds.
      * preferred_accuracy represents the requested fix accuracy in meters.
      * preferred_time represents the requested time to first fix in milliseconds.
+     *
+     * 'mode' parameter should be one of GPS_POSITION_MODE_MS_BASE
+     * or GPS_POSITION_MODE_STANDALONE.
+     * It is allowed by the platform (and it is recommended) to fallback to
+     * GPS_POSITION_MODE_MS_BASE if GPS_POSITION_MODE_MS_ASSISTED is passed in, and
+     * GPS_POSITION_MODE_MS_BASED is supported.
      */
     int   (*set_position_mode)(GpsPositionMode mode, GpsPositionRecurrence recurrence,
             uint32_t min_interval, uint32_t preferred_accuracy, uint32_t preferred_time);
@@ -455,7 +654,7 @@
     size_t          size;
     /**
      * Opens the XTRA interface and provides the callback routines
-     * to the implemenation of this interface.
+     * to the implementation of this interface.
      */
     int  (*init)( GpsXtraCallbacks* callbacks );
     /** Injects XTRA data into the GPS. */
@@ -474,15 +673,55 @@
     size_t (*get_internal_state)(char* buffer, size_t bufferSize);
 } GpsDebugInterface;
 
+#pragma pack(push,4)
+// We need to keep the alignment of this data structure to 4-bytes, to ensure that in 64-bit
+// environments the size of this legacy definition does not collide with _v2. Implementations should
+// be using _v2 and _v3, so it's OK to pay the 'unaligned' penalty in 64-bit if an old
+// implementation is still in use.
+
 /** Represents the status of AGPS. */
 typedef struct {
-    /** set to sizeof(AGpsStatus) */
+    /** set to sizeof(AGpsStatus_v1) */
+    size_t          size;
+
+    AGpsType        type;
+    AGpsStatusValue status;
+} AGpsStatus_v1;
+
+#pragma pack(pop)
+
+/** Represents the status of AGPS augmented with a IPv4 address field. */
+typedef struct {
+    /** set to sizeof(AGpsStatus_v2) */
     size_t          size;
 
     AGpsType        type;
     AGpsStatusValue status;
     uint32_t        ipaddr;
-} AGpsStatus;
+} AGpsStatus_v2;
+
+/* Represents the status of AGPS augmented to support IPv4 and IPv6. */
+typedef struct {
+    /** set to sizeof(AGpsStatus_v3) */
+    size_t                  size;
+
+    AGpsType                type;
+    AGpsStatusValue         status;
+
+    /**
+     * Must be set to a valid IPv4 address if the field 'addr' contains an IPv4
+     * address, or set to INADDR_NONE otherwise.
+     */
+    uint32_t                ipaddr;
+
+    /**
+     * Must contain the IPv4 (AF_INET) or IPv6 (AF_INET6) address to report.
+     * Any other value of addr.ss_family will be rejected.
+     * */
+    struct sockaddr_storage addr;
+} AGpsStatus_v3;
+
+typedef AGpsStatus_v3     AGpsStatus;
 
 /** Callback with AGPS status information.
  *  Can only be called from a thread created by create_thread_cb.
@@ -498,16 +737,16 @@
 
 /** Extended interface for AGPS support. */
 typedef struct {
-    /** set to sizeof(AGpsInterface) */
+    /** set to sizeof(AGpsInterface_v1) */
     size_t          size;
 
     /**
      * Opens the AGPS interface and provides the callback routines
-     * to the implemenation of this interface.
+     * to the implementation of this interface.
      */
     void  (*init)( AGpsCallbacks* callbacks );
     /**
-     * Notifies that a data connection is available and sets 
+     * Notifies that a data connection is available and sets
      * the name of the APN to be used for SUPL.
      */
     int  (*data_conn_open)( const char* apn );
@@ -516,15 +755,124 @@
      */
     int  (*data_conn_closed)();
     /**
-     * Notifies that a data connection is not available for AGPS. 
+     * Notifies that a data connection is not available for AGPS.
      */
     int  (*data_conn_failed)();
     /**
      * Sets the hostname and port for the AGPS server.
      */
     int  (*set_server)( AGpsType type, const char* hostname, int port );
-} AGpsInterface;
+} AGpsInterface_v1;
 
+/**
+ * Extended interface for AGPS support, it is augmented to enable to pass
+ * extra APN data.
+ */
+typedef struct {
+    /** set to sizeof(AGpsInterface_v2) */
+    size_t size;
+
+    /**
+     * Opens the AGPS interface and provides the callback routines to the
+     * implementation of this interface.
+     */
+    void (*init)(AGpsCallbacks* callbacks);
+    /**
+     * Deprecated.
+     * If the HAL supports AGpsInterface_v2 this API will not be used, see
+     * data_conn_open_with_apn_ip_type for more information.
+     */
+    int (*data_conn_open)(const char* apn);
+    /**
+     * Notifies that the AGPS data connection has been closed.
+     */
+    int (*data_conn_closed)();
+    /**
+     * Notifies that a data connection is not available for AGPS.
+     */
+    int (*data_conn_failed)();
+    /**
+     * Sets the hostname and port for the AGPS server.
+     */
+    int (*set_server)(AGpsType type, const char* hostname, int port);
+
+    /**
+     * Notifies that a data connection is available and sets the name of the
+     * APN, and its IP type, to be used for SUPL connections.
+     */
+    int (*data_conn_open_with_apn_ip_type)(
+            const char* apn,
+            ApnIpType apnIpType);
+} AGpsInterface_v2;
+
+typedef AGpsInterface_v2    AGpsInterface;
+
+/** Error codes associated with certificate operations */
+#define AGPS_CERTIFICATE_OPERATION_SUCCESS               0
+#define AGPS_CERTIFICATE_ERROR_GENERIC                -100
+#define AGPS_CERTIFICATE_ERROR_TOO_MANY_CERTIFICATES  -101
+
+/** A data structure that represents an X.509 certificate using DER encoding */
+typedef struct {
+    size_t  length;
+    u_char* data;
+} DerEncodedCertificate;
+
+/**
+ * A type definition for SHA1 Fingerprints used to identify X.509 Certificates
+ * The Fingerprint is a digest of the DER Certificate that uniquely identifies it.
+ */
+typedef struct {
+    u_char data[20];
+} Sha1CertificateFingerprint;
+
+/** AGPS Interface to handle SUPL certificate operations */
+typedef struct {
+    /** set to sizeof(SuplCertificateInterface) */
+    size_t size;
+
+    /**
+     * Installs a set of Certificates used for SUPL connections to the AGPS server.
+     * If needed the HAL should find out internally any certificates that need to be removed to
+     * accommodate the certificates to install.
+     * The certificates installed represent a full set of valid certificates needed to connect to
+     * AGPS SUPL servers.
+     * The list of certificates is required, and all must be available at the same time, when trying
+     * to establish a connection with the AGPS Server.
+     *
+     * Parameters:
+     *      certificates - A pointer to an array of DER encoded certificates that are need to be
+     *                     installed in the HAL.
+     *      length - The number of certificates to install.
+     * Returns:
+     *      AGPS_CERTIFICATE_OPERATION_SUCCESS if the operation is completed successfully
+     *      AGPS_CERTIFICATE_ERROR_TOO_MANY_CERTIFICATES if the HAL cannot store the number of
+     *          certificates attempted to be installed, the state of the certificates stored should
+     *          remain the same as before on this error case.
+     *
+     * IMPORTANT:
+     *      If needed the HAL should find out internally the set of certificates that need to be
+     *      removed to accommodate the certificates to install.
+     */
+    int  (*install_certificates) ( const DerEncodedCertificate* certificates, size_t length );
+
+    /**
+     * Notifies the HAL that a list of certificates used for SUPL connections are revoked. It is
+     * expected that the given set of certificates is removed from the internal store of the HAL.
+     *
+     * Parameters:
+     *      fingerprints - A pointer to an array of SHA1 Fingerprints to identify the set of
+     *                     certificates to revoke.
+     *      length - The number of fingerprints provided.
+     * Returns:
+     *      AGPS_CERTIFICATE_OPERATION_SUCCESS if the operation is completed successfully.
+     *
+     * IMPORTANT:
+     *      If any of the certificates provided (through its fingerprint) is not known by the HAL,
+     *      it should be ignored and continue revoking/deleting the rest of them.
+     */
+    int  (*revoke_certificates) ( const Sha1CertificateFingerprint* fingerprints, size_t length );
+} SuplCertificateInterface;
 
 /** Represents an NI request */
 typedef struct {
@@ -650,7 +998,7 @@
     size_t          size;
     /**
      * Opens the AGPS interface and provides the callback routines
-     * to the implemenation of this interface.
+     * to the implementation of this interface.
      */
     void  (*init)( AGpsRilCallbacks* callbacks );
 
@@ -789,7 +1137,7 @@
         int32_t transition, GpsUtcTime timestamp);
 
 /**
- * The callback associated with the availablity of the GPS system for geofencing
+ * The callback associated with the availability of the GPS system for geofencing
  * monitoring. If the GPS system determines that it cannot monitor geofences
  * because of lack of reliability or unavailability of the GPS signals, it will
  * call this callback with GPS_GEOFENCE_UNAVAILABLE parameter.
@@ -867,7 +1215,7 @@
 
    /**
     * Opens the geofence interface and provides the callback routines
-    * to the implemenation of this interface.
+    * to the implementation of this interface.
     */
    void  (*init)( GpsGeofenceCallbacks* callbacks );
 
@@ -897,14 +1245,12 @@
     *       sampling the GPS for power-saving reasons; thus the rate of
     *       sampling may be faster or slower than this.
     *    unknown_timer_ms - The time limit after which the UNCERTAIN transition
-    *       should be triggered. This paramter is defined in milliseconds.
+    *       should be triggered. This parameter is defined in milliseconds.
     *       See above for a detailed explanation.
     */
-   void (*add_geofence_area) (int32_t geofence_id, double latitude,
-                                double longitude, double radius_meters,
-                                int last_transition, int monitor_transitions,
-                                int notification_responsiveness_ms,
-                                int unknown_timer_ms);
+   void (*add_geofence_area) (int32_t geofence_id, double latitude, double longitude,
+       double radius_meters, int last_transition, int monitor_transitions,
+       int notification_responsiveness_ms, int unknown_timer_ms);
 
    /**
     * Pause monitoring a particular geofence.
@@ -933,6 +1279,592 @@
     */
    void (*remove_geofence_area) (int32_t geofence_id);
 } GpsGeofencingInterface;
+
+
+/**
+ * Represents an estimate of the GPS clock time.
+ */
+typedef struct {
+    /** set to sizeof(GpsClock) */
+    size_t size;
+
+    /** A set of flags indicating the validity of the fields in this data structure. */
+    GpsClockFlags flags;
+
+    /**
+     * Leap second data.
+     * The sign of the value is defined by the following equation:
+     *      utc_time_ns = time_ns + (full_bias_ns + bias_ns) - leap_second * 1,000,000,000
+     *
+     * If the data is available 'flags' must contain GPS_CLOCK_HAS_LEAP_SECOND.
+     */
+    int16_t leap_second;
+
+    /**
+     * Indicates the type of time reported by the 'time_ns' field.
+     * This is a Mandatory field.
+     */
+    GpsClockType type;
+
+    /**
+     * The GPS receiver internal clock value. This can be either the local hardware clock value
+     * (GPS_CLOCK_TYPE_LOCAL_HW_TIME), or the current GPS time derived inside GPS receiver
+     * (GPS_CLOCK_TYPE_GPS_TIME). The field 'type' defines the time reported.
+     *
+     * For local hardware clock, this value is expected to be monotonically increasing during
+     * the reporting session. The real GPS time can be derived by compensating the 'full bias'
+     * (when it is available) from this value.
+     *
+     * For GPS time, this value is expected to be the best estimation of current GPS time that GPS
+     * receiver can achieve. Set the 'time uncertainty' appropriately when GPS time is specified.
+     *
+     * Sub-nanosecond accuracy can be provided by means of the 'bias' field.
+     * The value contains the 'time uncertainty' in it.
+     *
+     * This is a Mandatory field.
+     */
+    int64_t time_ns;
+
+    /**
+     * 1-Sigma uncertainty associated with the clock's time in nanoseconds.
+     * The uncertainty is represented as an absolute (single sided) value.
+     *
+     * This value should be set if GPS_CLOCK_TYPE_GPS_TIME is set.
+     * If the data is available 'flags' must contain GPS_CLOCK_HAS_TIME_UNCERTAINTY.
+     */
+    double time_uncertainty_ns;
+
+    /**
+     * The difference between hardware clock ('time' field) inside GPS receiver and the true GPS
+     * time since 0000Z, January 6, 1980, in nanoseconds.
+     * This value is used if and only if GPS_CLOCK_TYPE_LOCAL_HW_TIME is set, and GPS receiver
+     * has solved the clock for GPS time.
+     * The caller is responsible for using the 'bias uncertainty' field for quality check.
+     *
+     * The sign of the value is defined by the following equation:
+     *      true time (GPS time) = time_ns + (full_bias_ns + bias_ns)
+     *
+     * This value contains the 'bias uncertainty' in it.
+     * If the data is available 'flags' must contain GPS_CLOCK_HAS_FULL_BIAS.
+
+     */
+    int64_t full_bias_ns;
+
+    /**
+     * Sub-nanosecond bias.
+     * The value contains the 'bias uncertainty' in it.
+     *
+     * If the data is available 'flags' must contain GPS_CLOCK_HAS_BIAS.
+     */
+    double bias_ns;
+
+    /**
+     * 1-Sigma uncertainty associated with the clock's bias in nanoseconds.
+     * The uncertainty is represented as an absolute (single sided) value.
+     *
+     * If the data is available 'flags' must contain GPS_CLOCK_HAS_BIAS_UNCERTAINTY.
+     */
+    double bias_uncertainty_ns;
+
+    /**
+     * The clock's drift in nanoseconds (per second).
+     * A positive value means that the frequency is higher than the nominal frequency.
+     *
+     * The value contains the 'drift uncertainty' in it.
+     * If the data is available 'flags' must contain GPS_CLOCK_HAS_DRIFT.
+     *
+     * If GpsMeasurement's 'flags' field contains GPS_MEASUREMENT_HAS_UNCORRECTED_PSEUDORANGE_RATE,
+     * it is encouraged that this field is also provided.
+     */
+    double drift_nsps;
+
+    /**
+     * 1-Sigma uncertainty associated with the clock's drift in nanoseconds (per second).
+     * The uncertainty is represented as an absolute (single sided) value.
+     *
+     * If the data is available 'flags' must contain GPS_CLOCK_HAS_DRIFT_UNCERTAINTY.
+     */
+    double drift_uncertainty_nsps;
+} GpsClock;
+
+/**
+ * Represents a GPS Measurement, it contains raw and computed information.
+ */
+typedef struct {
+    /** set to sizeof(GpsMeasurement) */
+    size_t size;
+
+    /** A set of flags indicating the validity of the fields in this data structure. */
+    GpsMeasurementFlags flags;
+
+    /**
+     * Pseudo-random number in the range of [1, 32]
+     * This is a Mandatory value.
+     */
+    int8_t prn;
+
+    /**
+     * Time offset at which the measurement was taken in nanoseconds.
+     * The reference receiver's time is specified by GpsData::clock::time_ns and should be
+     * interpreted in the same way as indicated by GpsClock::type.
+     *
+     * The sign of time_offset_ns is given by the following equation:
+     *      measurement time = GpsClock::time_ns + time_offset_ns
+     *
+     * It provides an individual time-stamp for the measurement, and allows sub-nanosecond accuracy.
+     * This is a Mandatory value.
+     */
+    double time_offset_ns;
+
+    /**
+     * Per satellite sync state. It represents the current sync state for the associated satellite.
+     * Based on the sync state, the 'received GPS tow' field should be interpreted accordingly.
+     *
+     * This is a Mandatory value.
+     */
+    GpsMeasurementState state;
+
+    /**
+     * Received GPS Time-of-Week at the measurement time, in nanoseconds.
+     * The value is relative to the beginning of the current GPS week.
+     *
+     * Given the highest sync state that can be achieved, per each satellite, valid range for
+     * this field can be:
+     *     Searching       : [ 0       ]   : GPS_MEASUREMENT_STATE_UNKNOWN
+     *     C/A code lock   : [ 0   1ms ]   : GPS_MEASUREMENT_STATE_CODE_LOCK is set
+     *     Bit sync        : [ 0  20ms ]   : GPS_MEASUREMENT_STATE_BIT_SYNC is set
+     *     Subframe sync   : [ 0    6s ]   : GPS_MEASUREMENT_STATE_SUBFRAME_SYNC is set
+     *     TOW decoded     : [ 0 1week ]   : GPS_MEASUREMENT_STATE_TOW_DECODED is set
+     *
+     * However, if there is any ambiguity in integer millisecond,
+     * GPS_MEASUREMENT_STATE_MSEC_AMBIGUOUS should be set accordingly, in the 'state' field.
+     *
+     * This value must be populated if 'state' != GPS_MEASUREMENT_STATE_UNKNOWN.
+     */
+    int64_t received_gps_tow_ns;
+
+    /**
+     * 1-Sigma uncertainty of the Received GPS Time-of-Week in nanoseconds.
+     *
+     * This value must be populated if 'state' != GPS_MEASUREMENT_STATE_UNKNOWN.
+     */
+    int64_t received_gps_tow_uncertainty_ns;
+
+    /**
+     * Carrier-to-noise density in dB-Hz, in the range [0, 63].
+     * It contains the measured C/N0 value for the signal at the antenna input.
+     *
+     * This is a Mandatory value.
+     */
+    double c_n0_dbhz;
+
+    /**
+     * Pseudorange rate at the timestamp in m/s.
+     * The correction of a given Pseudorange Rate value includes corrections for receiver and
+     * satellite clock frequency errors.
+     *
+     * If GPS_MEASUREMENT_HAS_UNCORRECTED_PSEUDORANGE_RATE is set in 'flags' field, this field must
+     * be populated with the 'uncorrected' reading.
+     * If GPS_MEASUREMENT_HAS_UNCORRECTED_PSEUDORANGE_RATE is not set in 'flags' field, this field
+     * must be populated with the 'corrected' reading. This is the default behavior.
+     *
+     * It is encouraged to provide the 'uncorrected' 'pseudorange rate', and provide GpsClock's
+     * 'drift' field as well.
+     *
+     * The value includes the 'pseudorange rate uncertainty' in it.
+     * A positive 'uncorrected' value indicates that the SV is moving away from the receiver.
+     *
+     * The sign of the 'uncorrected' 'pseudorange rate' and its relation to the sign of 'doppler
+     * shift' is given by the equation:
+     *      pseudorange rate = -k * doppler shift   (where k is a constant)
+     *
+     * This is a Mandatory value.
+     */
+    double pseudorange_rate_mps;
+
+    /**
+     * 1-Sigma uncertainty of the pseudurange rate in m/s.
+     * The uncertainty is represented as an absolute (single sided) value.
+     *
+     * This is a Mandatory value.
+     */
+    double pseudorange_rate_uncertainty_mps;
+
+    /**
+     * Accumulated delta range's state. It indicates whether ADR is reset or there is a cycle slip
+     * (indicating loss of lock).
+     *
+     * This is a Mandatory value.
+     */
+    GpsAccumulatedDeltaRangeState accumulated_delta_range_state;
+
+    /**
+     * Accumulated delta range since the last channel reset in meters.
+     * A positive value indicates that the SV is moving away from the receiver.
+     *
+     * The sign of the 'accumulated delta range' and its relation to the sign of 'carrier phase'
+     * is given by the equation:
+     *          accumulated delta range = -k * carrier phase    (where k is a constant)
+     *
+     * This value must be populated if 'accumulated delta range state' != GPS_ADR_STATE_UNKNOWN.
+     * However, it is expected that the data is only accurate when:
+     *      'accumulated delta range state' == GPS_ADR_STATE_VALID.
+     */
+    double accumulated_delta_range_m;
+
+    /**
+     * 1-Sigma uncertainty of the accumulated delta range in meters.
+     * This value must be populated if 'accumulated delta range state' != GPS_ADR_STATE_UNKNOWN.
+     */
+    double accumulated_delta_range_uncertainty_m;
+
+    /**
+     * Best derived Pseudorange by the chip-set, in meters.
+     * The value contains the 'pseudorange uncertainty' in it.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_PSEUDORANGE.
+     */
+    double pseudorange_m;
+
+    /**
+     * 1-Sigma uncertainty of the pseudorange in meters.
+     * The value contains the 'pseudorange' and 'clock' uncertainty in it.
+     * The uncertainty is represented as an absolute (single sided) value.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_PSEUDORANGE_UNCERTAINTY.
+     */
+    double pseudorange_uncertainty_m;
+
+    /**
+     * A fraction of the current C/A code cycle, in the range [0.0, 1023.0]
+     * This value contains the time (in Chip units) since the last C/A code cycle (GPS Msec epoch).
+     *
+     * The reference frequency is given by the field 'carrier_frequency_hz'.
+     * The value contains the 'code-phase uncertainty' in it.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_CODE_PHASE.
+     */
+    double code_phase_chips;
+
+    /**
+     * 1-Sigma uncertainty of the code-phase, in a fraction of chips.
+     * The uncertainty is represented as an absolute (single sided) value.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_CODE_PHASE_UNCERTAINTY.
+     */
+    double code_phase_uncertainty_chips;
+
+    /**
+     * Carrier frequency at which codes and messages are modulated, it can be L1 or L2.
+     * If the field is not set, the carrier frequency is assumed to be L1.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_CARRIER_FREQUENCY.
+     */
+    float carrier_frequency_hz;
+
+    /**
+     * The number of full carrier cycles between the satellite and the receiver.
+     * The reference frequency is given by the field 'carrier_frequency_hz'.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_CARRIER_CYCLES.
+     */
+    int64_t carrier_cycles;
+
+    /**
+     * The RF phase detected by the receiver, in the range [0.0, 1.0].
+     * This is usually the fractional part of the complete carrier phase measurement.
+     *
+     * The reference frequency is given by the field 'carrier_frequency_hz'.
+     * The value contains the 'carrier-phase uncertainty' in it.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_CARRIER_PHASE.
+     */
+    double carrier_phase;
+
+    /**
+     * 1-Sigma uncertainty of the carrier-phase.
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_CARRIER_PHASE_UNCERTAINTY.
+     */
+    double carrier_phase_uncertainty;
+
+    /**
+     * An enumeration that indicates the 'loss of lock' state of the event.
+     */
+    GpsLossOfLock loss_of_lock;
+
+    /**
+     * The number of GPS bits transmitted since Sat-Sun midnight (GPS week).
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_BIT_NUMBER.
+     */
+    int32_t bit_number;
+
+    /**
+     * The elapsed time since the last received bit in milliseconds, in the range [0, 20]
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_TIME_FROM_LAST_BIT.
+     */
+    int16_t time_from_last_bit_ms;
+
+    /**
+     * Doppler shift in Hz.
+     * A positive value indicates that the SV is moving toward the receiver.
+     *
+     * The reference frequency is given by the field 'carrier_frequency_hz'.
+     * The value contains the 'doppler shift uncertainty' in it.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_DOPPLER_SHIFT.
+     */
+    double doppler_shift_hz;
+
+    /**
+     * 1-Sigma uncertainty of the doppler shift in Hz.
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_DOPPLER_SHIFT_UNCERTAINTY.
+     */
+    double doppler_shift_uncertainty_hz;
+
+    /**
+     * An enumeration that indicates the 'multipath' state of the event.
+     */
+    GpsMultipathIndicator multipath_indicator;
+
+    /**
+     * Signal-to-noise ratio in dB.
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_SNR.
+     */
+    double snr_db;
+
+    /**
+     * Elevation in degrees, the valid range is [-90, 90].
+     * The value contains the 'elevation uncertainty' in it.
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_ELEVATION.
+     */
+    double elevation_deg;
+
+    /**
+     * 1-Sigma uncertainty of the elevation in degrees, the valid range is [0, 90].
+     * The uncertainty is represented as the absolute (single sided) value.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_ELEVATION_UNCERTAINTY.
+     */
+    double elevation_uncertainty_deg;
+
+    /**
+     * Azimuth in degrees, in the range [0, 360).
+     * The value contains the 'azimuth uncertainty' in it.
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_AZIMUTH.
+     *  */
+    double azimuth_deg;
+
+    /**
+     * 1-Sigma uncertainty of the azimuth in degrees, the valid range is [0, 180].
+     * The uncertainty is represented as an absolute (single sided) value.
+     *
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_AZIMUTH_UNCERTAINTY.
+     */
+    double azimuth_uncertainty_deg;
+
+    /**
+     * Whether the GPS represented by the measurement was used for computing the most recent fix.
+     * If the data is available, 'flags' must contain GPS_MEASUREMENT_HAS_USED_IN_FIX.
+     */
+    bool used_in_fix;
+} GpsMeasurement;
+
+/** Represents a reading of GPS measurements. */
+typedef struct {
+    /** set to sizeof(GpsData) */
+    size_t size;
+
+    /** Number of measurements. */
+    size_t measurement_count;
+
+    /** The array of measurements. */
+    GpsMeasurement measurements[GPS_MAX_MEASUREMENT];
+
+    /** The GPS clock time reading. */
+    GpsClock clock;
+} GpsData;
+
+/**
+ * The callback for to report measurements from the HAL.
+ *
+ * Parameters:
+ *    data - A data structure containing the measurements.
+ */
+typedef void (*gps_measurement_callback) (GpsData* data);
+
+typedef struct {
+    /** set to sizeof(GpsMeasurementCallbacks) */
+    size_t size;
+    gps_measurement_callback measurement_callback;
+} GpsMeasurementCallbacks;
+
+#define GPS_MEASUREMENT_OPERATION_SUCCESS          0
+#define GPS_MEASUREMENT_ERROR_ALREADY_INIT      -100
+#define GPS_MEASUREMENT_ERROR_GENERIC           -101
+
+/**
+ * Extended interface for GPS Measurements support.
+ */
+typedef struct {
+    /** Set to sizeof(GpsMeasurementInterface) */
+    size_t size;
+
+    /**
+     * Initializes the interface and registers the callback routines with the HAL.
+     * After a successful call to 'init' the HAL must begin to provide updates at its own phase.
+     *
+     * Status:
+     *    GPS_MEASUREMENT_OPERATION_SUCCESS
+     *    GPS_MEASUREMENT_ERROR_ALREADY_INIT - if a callback has already been registered without a
+     *              corresponding call to 'close'
+     *    GPS_MEASUREMENT_ERROR_GENERIC - if any other error occurred, it is expected that the HAL
+     *              will not generate any updates upon returning this error code.
+     */
+    int (*init) (GpsMeasurementCallbacks* callbacks);
+
+    /**
+     * Stops updates from the HAL, and unregisters the callback routines.
+     * After a call to stop, the previously registered callbacks must be considered invalid by the
+     * HAL.
+     * If stop is invoked without a previous 'init', this function should perform no work.
+     */
+    void (*close) ();
+
+} GpsMeasurementInterface;
+
+
+/** Represents a GPS navigation message (or a fragment of it). */
+typedef struct {
+    /** set to sizeof(GpsNavigationMessage) */
+    size_t size;
+
+    /**
+     * Pseudo-random number in the range of [1, 32]
+     * This is a Mandatory value.
+     */
+    int8_t prn;
+
+    /**
+     * The type of message contained in the structure.
+     * This is a Mandatory value.
+     */
+    GpsNavigationMessageType type;
+
+    /**
+     * The status of the received navigation message.
+     * No need to send any navigation message that contains words with parity error and cannot be
+     * corrected.
+     */
+    NavigationMessageStatus status;
+
+    /**
+     * Message identifier.
+     * It provides an index so the complete Navigation Message can be assembled. i.e. fo L1 C/A
+     * subframe 4 and 5, this value corresponds to the 'frame id' of the navigation message.
+     * Subframe 1, 2, 3 does not contain a 'frame id' and this value can be set to -1.
+     */
+    int16_t message_id;
+
+    /**
+     * Sub-message identifier.
+     * If required by the message 'type', this value contains a sub-index within the current
+     * message (or frame) that is being transmitted.
+     * i.e. for L1 C/A the submessage id corresponds to the sub-frame id of the navigation message.
+     */
+    int16_t submessage_id;
+
+    /**
+     * The length of the data (in bytes) contained in the current message.
+     * If this value is different from zero, 'data' must point to an array of the same size.
+     * e.g. for L1 C/A the size of the sub-frame will be 40 bytes (10 words, 30 bits/word).
+     *
+     * This is a Mandatory value.
+     */
+    size_t data_length;
+
+    /**
+     * The data of the reported GPS message.
+     * The bytes (or words) specified using big endian format (MSB first).
+     *
+     * For L1 C/A, each subframe contains 10 30-bit GPS words. Each GPS word (30 bits) should be
+     * fitted into the last 30 bits in a 4-byte word (skip B31 and B32), with MSB first.
+     */
+    uint8_t* data;
+
+} GpsNavigationMessage;
+
+/**
+ * The callback to report an available fragment of a GPS navigation messages from the HAL.
+ *
+ * Parameters:
+ *      message - The GPS navigation submessage/subframe representation.
+ */
+typedef void (*gps_navigation_message_callback) (GpsNavigationMessage* message);
+
+typedef struct {
+    /** set to sizeof(GpsNavigationMessageCallbacks) */
+    size_t size;
+    gps_navigation_message_callback navigation_message_callback;
+} GpsNavigationMessageCallbacks;
+
+#define GPS_NAVIGATION_MESSAGE_OPERATION_SUCCESS             0
+#define GPS_NAVIGATION_MESSAGE_ERROR_ALREADY_INIT         -100
+#define GPS_NAVIGATION_MESSAGE_ERROR_GENERIC              -101
+
+/**
+ * Extended interface for GPS navigation message reporting support.
+ */
+typedef struct {
+    /** Set to sizeof(GpsNavigationMessageInterface) */
+    size_t size;
+
+    /**
+     * Initializes the interface and registers the callback routines with the HAL.
+     * After a successful call to 'init' the HAL must begin to provide updates as they become
+     * available.
+     *
+     * Status:
+     *      GPS_NAVIGATION_MESSAGE_OPERATION_SUCCESS
+     *      GPS_NAVIGATION_MESSAGE_ERROR_ALREADY_INIT - if a callback has already been registered
+     *              without a corresponding call to 'close'.
+     *      GPS_NAVIGATION_MESSAGE_ERROR_GENERIC - if any other error occurred, it is expected that
+     *              the HAL will not generate any updates upon returning this error code.
+     */
+    int (*init) (GpsNavigationMessageCallbacks* callbacks);
+
+    /**
+     * Stops updates from the HAL, and unregisters the callback routines.
+     * After a call to stop, the previously registered callbacks must be considered invalid by the
+     * HAL.
+     * If stop is invoked without a previous 'init', this function should perform no work.
+     */
+    void (*close) ();
+
+} GpsNavigationMessageInterface;
+
+/**
+ * Interface for passing GNSS configuration contents from platform to HAL.
+ */
+typedef struct {
+    /** Set to sizeof(GnssConfigurationInterface) */
+    size_t size;
+
+    /**
+     * Deliver GNSS configuration contents to HAL.
+     * Parameters:
+     *     config_data - a pointer to a char array which holds what usually is expected from
+                         file(/etc/gps.conf), i.e., a sequence of UTF8 strings separated by '\n'.
+     *     length - total number of UTF8 characters in configuraiton data.
+     *
+     * IMPORTANT:
+     *      GPS HAL should expect this function can be called multiple times. And it may be
+     *      called even when GpsLocationProvider is already constructed and enabled. GPS HAL
+     *      should maintain the existing requests for various callback regardless the change
+     *      in configuration data.
+     */
+    void (*configuration_update) (const char* config_data, int32_t length);
+} GnssConfigurationInterface;
+
 __END_DECLS
 
 #endif /* ANDROID_INCLUDE_HARDWARE_GPS_H */
diff --git a/include/hardware/gralloc.h b/include/hardware/gralloc.h
index 0dbebcf..ef86f90 100644
--- a/include/hardware/gralloc.h
+++ b/include/hardware/gralloc.h
@@ -44,10 +44,14 @@
  *
  * GRALLOC_MODULE_API_VERSION_0_2:
  * Add support for flexible YCbCr format with (*lock_ycbcr)() method.
+ *
+ * GRALLOC_MODULE_API_VERSION_0_3:
+ * Add support for fence passing to/from lock/unlock.
  */
 
 #define GRALLOC_MODULE_API_VERSION_0_1  HARDWARE_MODULE_API_VERSION(0, 1)
 #define GRALLOC_MODULE_API_VERSION_0_2  HARDWARE_MODULE_API_VERSION(0, 2)
+#define GRALLOC_MODULE_API_VERSION_0_3  HARDWARE_MODULE_API_VERSION(0, 3)
 
 #define GRALLOC_DEVICE_API_VERSION_0_1  HARDWARE_DEVICE_API_VERSION(0, 1)
 
@@ -71,7 +75,7 @@
     GRALLOC_USAGE_SW_READ_OFTEN         = 0x00000003,
     /* mask for the software read values */
     GRALLOC_USAGE_SW_READ_MASK          = 0x0000000F,
-    
+
     /* buffer is never written in software */
     GRALLOC_USAGE_SW_WRITE_NEVER        = 0x00000000,
     /* buffer is rarely written in software */
@@ -91,6 +95,21 @@
     GRALLOC_USAGE_HW_COMPOSER           = 0x00000800,
     /* buffer will be used with the framebuffer device */
     GRALLOC_USAGE_HW_FB                 = 0x00001000,
+
+    /* buffer should be displayed full-screen on an external display when
+     * possible */
+    GRALLOC_USAGE_EXTERNAL_DISP         = 0x00002000,
+
+    /* Must have a hardware-protected path to external display sink for
+     * this buffer.  If a hardware-protected path is not available, then
+     * either don't composite only this buffer (preferred) to the
+     * external sink, or (less desirable) do not route the entire
+     * composition to the external sink.  */
+    GRALLOC_USAGE_PROTECTED             = 0x00004000,
+
+    /* buffer may be used as a cursor */
+    GRALLOC_USAGE_CURSOR                = 0x00008000,
+
     /* buffer will be used with the HW video encoder */
     GRALLOC_USAGE_HW_VIDEO_ENCODER      = 0x00010000,
     /* buffer will be written by the HW camera pipeline */
@@ -107,18 +126,16 @@
     /* buffer will be used as a RenderScript Allocation */
     GRALLOC_USAGE_RENDERSCRIPT          = 0x00100000,
 
-    /* buffer should be displayed full-screen on an external display when
-     * possible
-     */
-    GRALLOC_USAGE_EXTERNAL_DISP         = 0x00002000,
+    /* Set by the consumer to indicate to the producer that they may attach a
+     * buffer that they did not detach from the BufferQueue. Will be filtered
+     * out by GRALLOC_USAGE_ALLOC_MASK, so gralloc modules will not need to
+     * handle this flag. */
+    GRALLOC_USAGE_FOREIGN_BUFFERS       = 0x00200000,
 
-    /* Must have a hardware-protected path to external display sink for
-     * this buffer.  If a hardware-protected path is not available, then
-     * either don't composite only this buffer (preferred) to the
-     * external sink, or (less desirable) do not route the entire
-     * composition to the external sink.
-     */
-    GRALLOC_USAGE_PROTECTED             = 0x00004000,
+    /* Mask of all flags which could be passed to a gralloc module for buffer
+     * allocation. Any flags not in this mask do not need to be handled by
+     * gralloc modules. */
+    GRALLOC_USAGE_ALLOC_MASK            = ~(GRALLOC_USAGE_FOREIGN_BUFFERS),
 
     /* implementation-specific private usage flags */
     GRALLOC_USAGE_PRIVATE_0             = 0x10000000,
@@ -230,8 +247,17 @@
      * difference that it fills a struct ycbcr with a description of the buffer
      * layout, and zeroes out the reserved fields.
      *
-     * This will only work on buffers with HAL_PIXEL_FORMAT_YCbCr_*_888, and
-     * will return -EINVAL on any other buffer formats.
+     * If the buffer format is not compatible with a flexible YUV format (e.g.
+     * the buffer layout cannot be represented with the ycbcr struct), it
+     * will return -EINVAL.
+     *
+     * This method must work on buffers with HAL_PIXEL_FORMAT_YCbCr_*_888
+     * if supported by the device, as well as with any other format that is
+     * requested by the multimedia codecs when they are configured with a
+     * flexible-YUV-compatible color-format with android native buffers.
+     *
+     * Note that this method may also be called on buffers of other formats,
+     * including non-YUV formats.
      *
      * Added in GRALLOC_MODULE_API_VERSION_0_2.
      */
@@ -241,8 +267,53 @@
             int l, int t, int w, int h,
             struct android_ycbcr *ycbcr);
 
+    /*
+     * The (*lockAsync)() method is like the (*lock)() method except
+     * that the buffer's sync fence object is passed into the lock
+     * call instead of requiring the caller to wait for completion.
+     *
+     * The gralloc implementation takes ownership of the fenceFd and
+     * is responsible for closing it when no longer needed.
+     *
+     * Added in GRALLOC_MODULE_API_VERSION_0_3.
+     */
+    int (*lockAsync)(struct gralloc_module_t const* module,
+            buffer_handle_t handle, int usage,
+            int l, int t, int w, int h,
+            void** vaddr, int fenceFd);
+
+    /*
+     * The (*unlockAsync)() method is like the (*unlock)() method
+     * except that a buffer sync fence object is returned from the
+     * lock call, representing the completion of any pending work
+     * performed by the gralloc implementation.
+     *
+     * The caller takes ownership of the fenceFd and is responsible
+     * for closing it when no longer needed.
+     *
+     * Added in GRALLOC_MODULE_API_VERSION_0_3.
+     */
+    int (*unlockAsync)(struct gralloc_module_t const* module,
+            buffer_handle_t handle, int* fenceFd);
+
+    /*
+     * The (*lockAsync_ycbcr)() method is like the (*lock_ycbcr)()
+     * method except that the buffer's sync fence object is passed
+     * into the lock call instead of requiring the caller to wait for
+     * completion.
+     *
+     * The gralloc implementation takes ownership of the fenceFd and
+     * is responsible for closing it when no longer needed.
+     *
+     * Added in GRALLOC_MODULE_API_VERSION_0_3.
+     */
+    int (*lockAsync_ycbcr)(struct gralloc_module_t const* module,
+            buffer_handle_t handle, int usage,
+            int l, int t, int w, int h,
+            struct android_ycbcr *ycbcr, int fenceFd);
+
     /* reserved for future use */
-    void* reserved_proc[6];
+    void* reserved_proc[3];
 } gralloc_module_t;
 
 /*****************************************************************************/
diff --git a/include/hardware/hardware.h b/include/hardware/hardware.h
index 416ae39..74f57aa 100644
--- a/include/hardware/hardware.h
+++ b/include/hardware/hardware.h
@@ -144,8 +144,12 @@
     /** module's dso */
     void* dso;
 
+#ifdef __LP64__
+    uint64_t reserved[32-7];
+#else
     /** padding to 128 bytes, reserved for future use */
     uint32_t reserved[32-7];
+#endif
 
 } hw_module_t;
 
@@ -186,7 +190,11 @@
     struct hw_module_t* module;
 
     /** padding reserved for future use */
+#ifdef __LP64__
+    uint64_t reserved[12];
+#else
     uint32_t reserved[12];
+#endif
 
     /** Close this device */
     int (*close)(struct hw_device_t* device);
diff --git a/include/hardware/hdmi_cec.h b/include/hardware/hdmi_cec.h
new file mode 100644
index 0000000..ab70f92
--- /dev/null
+++ b/include/hardware/hdmi_cec.h
@@ -0,0 +1,429 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INCLUDE_HARDWARE_HDMI_CEC_H
+#define ANDROID_INCLUDE_HARDWARE_HDMI_CEC_H
+
+#include <stdint.h>
+#include <sys/cdefs.h>
+
+#include <hardware/hardware.h>
+
+__BEGIN_DECLS
+
+#define HDMI_CEC_MODULE_API_VERSION_1_0 HARDWARE_MODULE_API_VERSION(1, 0)
+#define HDMI_CEC_MODULE_API_VERSION_CURRENT HDMI_MODULE_API_VERSION_1_0
+
+#define HDMI_CEC_DEVICE_API_VERSION_1_0 HARDWARE_DEVICE_API_VERSION(1, 0)
+#define HDMI_CEC_DEVICE_API_VERSION_CURRENT HDMI_DEVICE_API_VERSION_1_0
+
+#define HDMI_CEC_HARDWARE_MODULE_ID "hdmi_cec"
+#define HDMI_CEC_HARDWARE_INTERFACE "hdmi_cec_hw_if"
+
+typedef enum cec_device_type {
+    CEC_DEVICE_INACTIVE = -1,
+    CEC_DEVICE_TV = 0,
+    CEC_DEVICE_RECORDER = 1,
+    CEC_DEVICE_RESERVED = 2,
+    CEC_DEVICE_TUNER = 3,
+    CEC_DEVICE_PLAYBACK = 4,
+    CEC_DEVICE_AUDIO_SYSTEM = 5,
+    CEC_DEVICE_MAX = CEC_DEVICE_AUDIO_SYSTEM
+} cec_device_type_t;
+
+typedef enum cec_logical_address {
+    CEC_ADDR_TV = 0,
+    CEC_ADDR_RECORDER_1 = 1,
+    CEC_ADDR_RECORDER_2 = 2,
+    CEC_ADDR_TUNER_1 = 3,
+    CEC_ADDR_PLAYBACK_1 = 4,
+    CEC_ADDR_AUDIO_SYSTEM = 5,
+    CEC_ADDR_TUNER_2 = 6,
+    CEC_ADDR_TUNER_3 = 7,
+    CEC_ADDR_PLAYBACK_2 = 8,
+    CEC_ADDR_RECORDER_3 = 9,
+    CEC_ADDR_TUNER_4 = 10,
+    CEC_ADDR_PLAYBACK_3 = 11,
+    CEC_ADDR_RESERVED_1 = 12,
+    CEC_ADDR_RESERVED_2 = 13,
+    CEC_ADDR_FREE_USE = 14,
+    CEC_ADDR_UNREGISTERED = 15,
+    CEC_ADDR_BROADCAST = 15
+} cec_logical_address_t;
+
+/*
+ * HDMI CEC messages
+ */
+enum cec_message_type {
+    CEC_MESSAGE_FEATURE_ABORT = 0x00,
+    CEC_MESSAGE_IMAGE_VIEW_ON = 0x04,
+    CEC_MESSAGE_TUNER_STEP_INCREMENT = 0x05,
+    CEC_MESSAGE_TUNER_STEP_DECREMENT = 0x06,
+    CEC_MESSAGE_TUNER_DEVICE_STATUS = 0x07,
+    CEC_MESSAGE_GIVE_TUNER_DEVICE_STATUS = 0x08,
+    CEC_MESSAGE_RECORD_ON = 0x09,
+    CEC_MESSAGE_RECORD_STATUS = 0x0A,
+    CEC_MESSAGE_RECORD_OFF = 0x0B,
+    CEC_MESSAGE_TEXT_VIEW_ON = 0x0D,
+    CEC_MESSAGE_RECORD_TV_SCREEN = 0x0F,
+    CEC_MESSAGE_GIVE_DECK_STATUS = 0x1A,
+    CEC_MESSAGE_DECK_STATUS = 0x1B,
+    CEC_MESSAGE_SET_MENU_LANGUAGE = 0x32,
+    CEC_MESSAGE_CLEAR_ANALOG_TIMER = 0x33,
+    CEC_MESSAGE_SET_ANALOG_TIMER = 0x34,
+    CEC_MESSAGE_TIMER_STATUS = 0x35,
+    CEC_MESSAGE_STANDBY = 0x36,
+    CEC_MESSAGE_PLAY = 0x41,
+    CEC_MESSAGE_DECK_CONTROL = 0x42,
+    CEC_MESSAGE_TIMER_CLEARED_STATUS = 0x043,
+    CEC_MESSAGE_USER_CONTROL_PRESSED = 0x44,
+    CEC_MESSAGE_USER_CONTROL_RELEASED = 0x45,
+    CEC_MESSAGE_GIVE_OSD_NAME = 0x46,
+    CEC_MESSAGE_SET_OSD_NAME = 0x47,
+    CEC_MESSAGE_SET_OSD_STRING = 0x64,
+    CEC_MESSAGE_SET_TIMER_PROGRAM_TITLE = 0x67,
+    CEC_MESSAGE_SYSTEM_AUDIO_MODE_REQUEST = 0x70,
+    CEC_MESSAGE_GIVE_AUDIO_STATUS = 0x71,
+    CEC_MESSAGE_SET_SYSTEM_AUDIO_MODE = 0x72,
+    CEC_MESSAGE_REPORT_AUDIO_STATUS = 0x7A,
+    CEC_MESSAGE_GIVE_SYSTEM_AUDIO_MODE_STATUS = 0x7D,
+    CEC_MESSAGE_SYSTEM_AUDIO_MODE_STATUS = 0x7E,
+    CEC_MESSAGE_ROUTING_CHANGE = 0x80,
+    CEC_MESSAGE_ROUTING_INFORMATION = 0x81,
+    CEC_MESSAGE_ACTIVE_SOURCE = 0x82,
+    CEC_MESSAGE_GIVE_PHYSICAL_ADDRESS = 0x83,
+    CEC_MESSAGE_REPORT_PHYSICAL_ADDRESS = 0x84,
+    CEC_MESSAGE_REQUEST_ACTIVE_SOURCE = 0x85,
+    CEC_MESSAGE_SET_STREAM_PATH = 0x86,
+    CEC_MESSAGE_DEVICE_VENDOR_ID = 0x87,
+    CEC_MESSAGE_VENDOR_COMMAND = 0x89,
+    CEC_MESSAGE_VENDOR_REMOTE_BUTTON_DOWN = 0x8A,
+    CEC_MESSAGE_VENDOR_REMOTE_BUTTON_UP = 0x8B,
+    CEC_MESSAGE_GIVE_DEVICE_VENDOR_ID = 0x8C,
+    CEC_MESSAGE_MENU_REQUEST = 0x8D,
+    CEC_MESSAGE_MENU_STATUS = 0x8E,
+    CEC_MESSAGE_GIVE_DEVICE_POWER_STATUS = 0x8F,
+    CEC_MESSAGE_REPORT_POWER_STATUS = 0x90,
+    CEC_MESSAGE_GET_MENU_LANGUAGE = 0x91,
+    CEC_MESSAGE_SELECT_ANALOG_SERVICE = 0x92,
+    CEC_MESSAGE_SELECT_DIGITAL_SERVICE = 0x93,
+    CEC_MESSAGE_SET_DIGITAL_TIMER = 0x97,
+    CEC_MESSAGE_CLEAR_DIGITAL_TIMER = 0x99,
+    CEC_MESSAGE_SET_AUDIO_RATE = 0x9A,
+    CEC_MESSAGE_INACTIVE_SOURCE = 0x9D,
+    CEC_MESSAGE_CEC_VERSION = 0x9E,
+    CEC_MESSAGE_GET_CEC_VERSION = 0x9F,
+    CEC_MESSAGE_VENDOR_COMMAND_WITH_ID = 0xA0,
+    CEC_MESSAGE_CLEAR_EXTERNAL_TIMER = 0xA1,
+    CEC_MESSAGE_SET_EXTERNAL_TIMER = 0xA2,
+    CEC_MESSAGE_INITIATE_ARC = 0xC0,
+    CEC_MESSAGE_REPORT_ARC_INITIATED = 0xC1,
+    CEC_MESSAGE_REPORT_ARC_TERMINATED = 0xC2,
+    CEC_MESSAGE_REQUEST_ARC_INITIATION = 0xC3,
+    CEC_MESSAGE_REQUEST_ARC_TERMINATION = 0xC4,
+    CEC_MESSAGE_TERMINATE_ARC = 0xC5,
+    CEC_MESSAGE_ABORT = 0xFF
+};
+
+/*
+ * Operand description [Abort Reason]
+ */
+enum abort_reason {
+    ABORT_UNRECOGNIZED_MODE = 0,
+    ABORT_NOT_IN_CORRECT_MODE = 1,
+    ABORT_CANNOT_PROVIDE_SOURCE = 2,
+    ABORT_INVALID_OPERAND = 3,
+    ABORT_REFUSED = 4,
+    ABORT_UNABLE_TO_DETERMINE = 5
+};
+
+/*
+ * HDMI event type. used for hdmi_event_t.
+ */
+enum {
+    HDMI_EVENT_CEC_MESSAGE = 1,
+    HDMI_EVENT_HOT_PLUG = 2,
+};
+
+/*
+ * HDMI hotplug event type. Used when the event
+ * type is HDMI_EVENT_HOT_PLUG.
+ */
+enum {
+    HDMI_NOT_CONNECTED = 0,
+    HDMI_CONNECTED = 1
+};
+
+/*
+ * error code used for send_message.
+ */
+enum {
+    HDMI_RESULT_SUCCESS = 0,
+    HDMI_RESULT_NACK = 1,        /* not acknowledged */
+    HDMI_RESULT_BUSY = 2,        /* bus is busy */
+    HDMI_RESULT_FAIL = 3,
+};
+
+/*
+ * HDMI port type.
+ */
+typedef enum hdmi_port_type {
+    HDMI_INPUT = 0,
+    HDMI_OUTPUT = 1
+} hdmi_port_type_t;
+
+/*
+ * Flags used for set_option()
+ */
+enum {
+    /* When set to false, HAL does not wake up the system upon receiving
+     * <Image View On> or <Text View On>. Used when user changes the TV
+     * settings to disable the auto TV on functionality.
+     * True by default.
+     */
+    HDMI_OPTION_WAKEUP = 1,
+
+    /* When set to false, all the CEC commands are discarded. Used when
+     * user changes the TV settings to disable CEC functionality.
+     * True by default.
+     */
+    HDMI_OPTION_ENABLE_CEC = 2,
+
+    /* Setting this flag to false means Android system will stop handling
+     * CEC service and yield the control over to the microprocessor that is
+     * powered on through the standby mode. When set to true, the system
+     * will gain the control over, hence telling the microprocessor to stop
+     * handling the cec commands. This is called when system goes
+     * in and out of standby mode to notify the microprocessor that it should
+     * start/stop handling CEC commands on behalf of the system.
+     * False by default.
+     */
+    HDMI_OPTION_SYSTEM_CEC_CONTROL = 3,
+
+    /* Option 4 not used */
+
+    /* Passes the updated language information of Android system.
+     * Contains 3-byte ASCII code as defined in ISO/FDIS 639-2. Can be
+     * used for HAL to respond to <Get Menu Language> while in standby mode.
+     * English(eng), for example, is converted to 0x656e67.
+     */
+    HDMI_OPTION_SET_LANG = 5,
+};
+
+/*
+ * Maximum length in bytes of cec message body (exclude header block),
+ * should not exceed 16 (spec CEC 6 Frame Description)
+ */
+#define CEC_MESSAGE_BODY_MAX_LENGTH 16
+
+typedef struct cec_message {
+    /* logical address of sender */
+    cec_logical_address_t initiator;
+
+    /* logical address of receiver */
+    cec_logical_address_t destination;
+
+    /* Length in bytes of body, range [0, CEC_MESSAGE_BODY_MAX_LENGTH] */
+    size_t length;
+    unsigned char body[CEC_MESSAGE_BODY_MAX_LENGTH];
+} cec_message_t;
+
+typedef struct hotplug_event {
+    /*
+     * true if the cable is connected; otherwise false.
+     */
+    int connected;
+    int port_id;
+} hotplug_event_t;
+
+typedef struct tx_status_event {
+    int status;
+    int opcode;  /* CEC opcode */
+} tx_status_event_t;
+
+/*
+ * HDMI event generated from HAL.
+ */
+typedef struct hdmi_event {
+    int type;
+    struct hdmi_cec_device* dev;
+    union {
+        cec_message_t cec;
+        hotplug_event_t hotplug;
+    };
+} hdmi_event_t;
+
+/*
+ * HDMI port descriptor
+ */
+typedef struct hdmi_port_info {
+    hdmi_port_type_t type;
+    // Port ID should start from 1 which corresponds to HDMI "port 1".
+    int port_id;
+    int cec_supported;
+    int arc_supported;
+    uint16_t physical_address;
+} hdmi_port_info_t;
+
+/*
+ * Callback function type that will be called by HAL implementation.
+ * Services can not close/open the device in the callback.
+ */
+typedef void (*event_callback_t)(const hdmi_event_t* event, void* arg);
+
+typedef struct hdmi_cec_module {
+    /**
+     * Common methods of the HDMI CEC module.  This *must* be the first member of
+     * hdmi_cec_module as users of this structure will cast a hw_module_t to hdmi_cec_module
+     * pointer in contexts where it's known the hw_module_t references a hdmi_cec_module.
+     */
+    struct hw_module_t common;
+} hdmi_module_t;
+
+/*
+ * HDMI-CEC HAL interface definition.
+ */
+typedef struct hdmi_cec_device {
+    /**
+     * Common methods of the HDMI CEC device.  This *must* be the first member of
+     * hdmi_cec_device as users of this structure will cast a hw_device_t to hdmi_cec_device
+     * pointer in contexts where it's known the hw_device_t references a hdmi_cec_device.
+     */
+    struct hw_device_t common;
+
+    /*
+     * (*add_logical_address)() passes the logical address that will be used
+     * in this system.
+     *
+     * HAL may use it to configure the hardware so that the CEC commands addressed
+     * the given logical address can be filtered in. This method can be called
+     * as many times as necessary in order to support multiple logical devices.
+     * addr should be in the range of valid logical addresses for the call
+     * to succeed.
+     *
+     * Returns 0 on success or -errno on error.
+     */
+    int (*add_logical_address)(const struct hdmi_cec_device* dev, cec_logical_address_t addr);
+
+    /*
+     * (*clear_logical_address)() tells HAL to reset all the logical addresses.
+     *
+     * It is used when the system doesn't need to process CEC command any more,
+     * hence to tell HAL to stop receiving commands from the CEC bus, and change
+     * the state back to the beginning.
+     */
+    void (*clear_logical_address)(const struct hdmi_cec_device* dev);
+
+    /*
+     * (*get_physical_address)() returns the CEC physical address. The
+     * address is written to addr.
+     *
+     * The physical address depends on the topology of the network formed
+     * by connected HDMI devices. It is therefore likely to change if the cable
+     * is plugged off and on again. It is advised to call get_physical_address
+     * to get the updated address when hot plug event takes place.
+     *
+     * Returns 0 on success or -errno on error.
+     */
+    int (*get_physical_address)(const struct hdmi_cec_device* dev, uint16_t* addr);
+
+    /*
+     * (*send_message)() transmits HDMI-CEC message to other HDMI device.
+     *
+     * The method should be designed to return in a certain amount of time not
+     * hanging forever, which can happen if CEC signal line is pulled low for
+     * some reason. HAL implementation should take the situation into account
+     * so as not to wait forever for the message to get sent out.
+     *
+     * It should try retransmission at least once as specified in the standard.
+     *
+     * Returns error code. See HDMI_RESULT_SUCCESS, HDMI_RESULT_NACK, and
+     * HDMI_RESULT_BUSY.
+     */
+    int (*send_message)(const struct hdmi_cec_device* dev, const cec_message_t*);
+
+    /*
+     * (*register_event_callback)() registers a callback that HDMI-CEC HAL
+     * can later use for incoming CEC messages or internal HDMI events.
+     * When calling from C++, use the argument arg to pass the calling object.
+     * It will be passed back when the callback is invoked so that the context
+     * can be retrieved.
+     */
+    void (*register_event_callback)(const struct hdmi_cec_device* dev,
+            event_callback_t callback, void* arg);
+
+    /*
+     * (*get_version)() returns the CEC version supported by underlying hardware.
+     */
+    void (*get_version)(const struct hdmi_cec_device* dev, int* version);
+
+    /*
+     * (*get_vendor_id)() returns the identifier of the vendor. It is
+     * the 24-bit unique company ID obtained from the IEEE Registration
+     * Authority Committee (RAC).
+     */
+    void (*get_vendor_id)(const struct hdmi_cec_device* dev, uint32_t* vendor_id);
+
+    /*
+     * (*get_port_info)() returns the hdmi port information of underlying hardware.
+     * info is the list of HDMI port information, and 'total' is the number of
+     * HDMI ports in the system.
+     */
+    void (*get_port_info)(const struct hdmi_cec_device* dev,
+            struct hdmi_port_info* list[], int* total);
+
+    /*
+     * (*set_option)() passes flags controlling the way HDMI-CEC service works down
+     * to HAL implementation. Those flags will be used in case the feature needs
+     * update in HAL itself, firmware or microcontroller.
+     */
+    void (*set_option)(const struct hdmi_cec_device* dev, int flag, int value);
+
+    /*
+     * (*set_audio_return_channel)() configures ARC circuit in the hardware logic
+     * to start or stop the feature. Flag can be either 1 to start the feature
+     * or 0 to stop it.
+     *
+     * Returns 0 on success or -errno on error.
+     */
+    void (*set_audio_return_channel)(const struct hdmi_cec_device* dev, int port_id, int flag);
+
+    /*
+     * (*is_connected)() returns the connection status of the specified port.
+     * Returns HDMI_CONNECTED if a device is connected, otherwise HDMI_NOT_CONNECTED.
+     * The HAL should watch for +5V power signal to determine the status.
+     */
+    int (*is_connected)(const struct hdmi_cec_device* dev, int port_id);
+
+    /* Reserved for future use to maximum 16 functions. Must be NULL. */
+    void* reserved[16 - 11];
+} hdmi_cec_device_t;
+
+/** convenience API for opening and closing a device */
+
+static inline int hdmi_cec_open(const struct hw_module_t* module,
+        struct hdmi_cec_device** device) {
+    return module->methods->open(module,
+            HDMI_CEC_HARDWARE_INTERFACE, (struct hw_device_t**)device);
+}
+
+static inline int hdmi_cec_close(struct hdmi_cec_device* device) {
+    return device->common.close(&device->common);
+}
+
+__END_DECLS
+
+#endif /* ANDROID_INCLUDE_HARDWARE_HDMI_CEC_H */
diff --git a/include/hardware/hw_auth_token.h b/include/hardware/hw_auth_token.h
new file mode 100644
index 0000000..f471d1a
--- /dev/null
+++ b/include/hardware/hw_auth_token.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdint.h>
+
+#ifndef ANDROID_HARDWARE_HW_AUTH_TOKEN_H
+#define ANDROID_HARDWARE_HW_AUTH_TOKEN_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif  // __cplusplus
+
+const uint8_t HW_AUTH_TOKEN_VERSION = 0;
+
+typedef enum {
+    HW_AUTH_NONE = 0,
+    HW_AUTH_PASSWORD = 1 << 0,
+    HW_AUTH_FINGERPRINT = 1 << 1,
+    // Additional entries should be powers of 2.
+    HW_AUTH_ANY = UINT32_MAX,
+} hw_authenticator_type_t;
+
+/**
+ * Data format for an authentication record used to prove successful authentication.
+ */
+typedef struct __attribute__((__packed__)) {
+    uint8_t version;  // Current version is 0
+    uint64_t challenge;
+    uint64_t user_id;             // secure user ID, not Android user ID
+    uint64_t authenticator_id;    // secure authenticator ID
+    uint32_t authenticator_type;  // hw_authenticator_type_t, in network order
+    uint64_t timestamp;           // in network order
+    uint8_t hmac[32];
+} hw_auth_token_t;
+
+#ifdef __cplusplus
+}  // extern "C"
+#endif  // __cplusplus
+
+#endif  // ANDROID_HARDWARE_HW_AUTH_TOKEN_H
diff --git a/include/hardware/hwcomposer.h b/include/hardware/hwcomposer.h
index 86479d3..aa466b3 100644
--- a/include/hardware/hwcomposer.h
+++ b/include/hardware/hwcomposer.h
@@ -121,6 +121,33 @@
      *   that the layer will be handled by the HWC (ie: it must not be
      *   composited with OpenGL ES).
      *
+     *
+     * HWC_SIDEBAND
+     *   Set by the caller before calling (*prepare)(), this value indicates
+     *   the contents of this layer come from a sideband video stream.
+     *
+     *   The h/w composer is responsible for receiving new image buffers from
+     *   the stream at the appropriate time (e.g. synchronized to a separate
+     *   audio stream), compositing them with the current contents of other
+     *   layers, and displaying the resulting image. This happens
+     *   independently of the normal prepare/set cycle. The prepare/set calls
+     *   only happen when other layers change, or when properties of the
+     *   sideband layer such as position or size change.
+     *
+     *   If the h/w composer can't handle the layer as a sideband stream for
+     *   some reason (e.g. unsupported scaling/blending/rotation, or too many
+     *   sideband layers) it can set compositionType to HWC_FRAMEBUFFER in
+     *   (*prepare)(). However, doing so will result in the layer being shown
+     *   as a solid color since the platform is not currently able to composite
+     *   sideband layers with the GPU. This may be improved in future
+     *   versions of the platform.
+     *
+     *
+     * HWC_CURSOR_OVERLAY
+     *   Set by the HWC implementation during (*prepare)(), this value
+     *   indicates the layer's composition will now be handled by the HWC.
+     *   Additionally, the client can now asynchronously update the on-screen
+     *   position of this layer using the setCursorPositionAsync() api.
      */
     int32_t compositionType;
 
@@ -141,13 +168,21 @@
         hwc_color_t backgroundColor;
 
         struct {
-            /* handle of buffer to compose. This handle is guaranteed to have been
-             * allocated from gralloc using the GRALLOC_USAGE_HW_COMPOSER usage flag. If
-             * the layer's handle is unchanged across two consecutive prepare calls and
-             * the HWC_GEOMETRY_CHANGED flag is not set for the second call then the
-             * HWComposer implementation may assume that the contents of the buffer have
-             * not changed. */
-            buffer_handle_t handle;
+            union {
+                /* When compositionType is HWC_FRAMEBUFFER, HWC_OVERLAY,
+                 * HWC_FRAMEBUFFER_TARGET, this is the handle of the buffer to
+                 * compose. This handle is guaranteed to have been allocated
+                 * from gralloc using the GRALLOC_USAGE_HW_COMPOSER usage flag.
+                 * If the layer's handle is unchanged across two consecutive
+                 * prepare calls and the HWC_GEOMETRY_CHANGED flag is not set
+                 * for the second call then the HWComposer implementation may
+                 * assume that the contents of the buffer have not changed. */
+                buffer_handle_t handle;
+
+                /* When compositionType is HWC_SIDEBAND, this is the handle
+                 * of the sideband video stream to compose. */
+                const native_handle_t* sidebandStream;
+            };
 
             /* transformation to apply to the buffer during composition */
             uint32_t transform;
@@ -191,6 +226,10 @@
              * reads from them are complete before the framebuffer is ready for
              * display.
              *
+             * HWC_SIDEBAND layers will never have an acquire fence, since
+             * synchronization is handled through implementation-defined
+             * sideband mechanisms.
+             *
              * The HWC takes ownership of the acquireFenceFd and is responsible
              * for closing it when no longer needed.
              */
@@ -214,6 +253,10 @@
              * produce a release fence for them. The releaseFenceFd will be -1
              * for these layers when set() is called.
              *
+             * Since HWC_SIDEBAND buffers don't pass through the HWC client,
+             * the HWC shouldn't produce a release fence for them. The
+             * releaseFenceFd will be -1 for these layers when set() is called.
+             *
              * The HWC client taks ownership of the releaseFenceFd and is
              * responsible for closing it when no longer needed.
              */
@@ -256,15 +299,45 @@
              */
             uint8_t planeAlpha;
 
-            /* reserved for future use */
+            /* Pad to 32 bits */
             uint8_t _pad[3];
+
+            /*
+             * Availability: HWC_DEVICE_API_VERSION_1_5
+             *
+             * This defines the region of the source buffer that has been
+             * modified since the last frame.
+             *
+             * If surfaceDamage.numRects > 0, then it may be assumed that any
+             * portion of the source buffer not covered by one of the rects has
+             * not been modified this frame. If surfaceDamage.numRects == 0,
+             * then the whole source buffer must be treated as if it had been
+             * modified.
+             *
+             * If the layer's contents are not modified relative to the prior
+             * prepare/set cycle, surfaceDamage will contain exactly one empty
+             * rect ([0, 0, 0, 0]).
+             *
+             * The damage rects are relative to the pre-transformed buffer, and
+             * their origin is the top-left corner.
+             */
+            hwc_region_t surfaceDamage;
         };
     };
 
-    /* Allow for expansion w/o breaking binary compatibility.
-     * Pad layer to 96 bytes, assuming 32-bit pointers.
+#ifdef __LP64__
+    /*
+     * For 64-bit mode, this struct is 120 bytes (and 8-byte aligned), and needs
+     * to be padded as such to maintain binary compatibility.
      */
-    int32_t reserved[24 - 19];
+    uint8_t reserved[120 - 112];
+#else
+    /*
+     * For 32-bit mode, this struct is 96 bytes, and needs to be padded as such
+     * to maintain binary compatibility.
+     */
+    uint8_t reserved[96 - 84];
+#endif
 
 } hwc_layer_1_t;
 
@@ -435,10 +508,22 @@
 /*****************************************************************************/
 
 typedef struct hwc_module {
+    /**
+     * Common methods of the hardware composer module.  This *must* be the first member of
+     * hwc_module as users of this structure will cast a hw_module_t to
+     * hwc_module pointer in contexts where it's known the hw_module_t references a
+     * hwc_module.
+     */
     struct hw_module_t common;
 } hwc_module_t;
 
 typedef struct hwc_composer_device_1 {
+    /**
+     * Common methods of the hardware composer device.  This *must* be the first member of
+     * hwc_composer_device_1 as users of this structure will cast a hw_device_t to
+     * hwc_composer_device_1 pointer in contexts where it's known the hw_device_t references a
+     * hwc_composer_device_1.
+     */
     struct hw_device_t common;
 
     /*
@@ -448,11 +533,12 @@
      * (*prepare)() can be called more than once, the last call prevails.
      *
      * The HWC responds by setting the compositionType field in each layer to
-     * either HWC_FRAMEBUFFER or HWC_OVERLAY. In the former case, the
-     * composition for the layer is handled by SurfaceFlinger with OpenGL ES,
-     * in the later case, the HWC will have to handle the layer's composition.
-     * compositionType and hints are preserved between (*prepare)() calles
-     * unless the HWC_GEOMETRY_CHANGED flag is set.
+     * either HWC_FRAMEBUFFER, HWC_OVERLAY, or HWC_CURSOR_OVERLAY. For the
+     * HWC_FRAMEBUFFER type, composition for the layer is handled by
+     * SurfaceFlinger with OpenGL ES. For the latter two overlay types,
+     * the HWC will have to handle the layer's composition. compositionType
+     * and hints are preserved between (*prepare)() calles unless the
+     * HWC_GEOMETRY_CHANGED flag is set.
      *
      * (*prepare)() is called with HWC_GEOMETRY_CHANGED to indicate that the
      * list's geometry has changed, that is, when more than just the buffer's
@@ -538,18 +624,49 @@
     int (*eventControl)(struct hwc_composer_device_1* dev, int disp,
             int event, int enabled);
 
-    /*
-     * blank(..., blank)
-     * Blanks or unblanks a display's screen.
-     *
-     * Turns the screen off when blank is nonzero, on when blank is zero.
-     * Multiple sequential calls with the same blank value must be supported.
-     * The screen state transition must be be complete when the function
-     * returns.
-     *
-     * returns 0 on success, negative on error.
-     */
-    int (*blank)(struct hwc_composer_device_1* dev, int disp, int blank);
+    union {
+        /*
+         * For HWC 1.3 and earlier, the blank() interface is used.
+         *
+         * blank(..., blank)
+         * Blanks or unblanks a display's screen.
+         *
+         * Turns the screen off when blank is nonzero, on when blank is zero.
+         * Multiple sequential calls with the same blank value must be
+         * supported.
+         * The screen state transition must be be complete when the function
+         * returns.
+         *
+         * returns 0 on success, negative on error.
+         */
+        int (*blank)(struct hwc_composer_device_1* dev, int disp, int blank);
+
+        /*
+         * For HWC 1.4 and above, setPowerMode() will be used in place of
+         * blank().
+         *
+         * setPowerMode(..., mode)
+         * Sets the display screen's power state.
+         *
+         * Refer to the documentation of the HWC_POWER_MODE_* constants
+         * for information about each power mode.
+         *
+         * The functionality is similar to the blank() command in previous
+         * versions of HWC, but with support for more power states.
+         *
+         * The display driver is expected to retain and restore the low power
+         * state of the display while entering and exiting from suspend.
+         *
+         * Multiple sequential calls with the same mode value must be supported.
+         *
+         * The screen state transition must be be complete when the function
+         * returns.
+         *
+         * returns 0 on success, negative on error.
+         */
+        int (*setPowerMode)(struct hwc_composer_device_1* dev, int disp,
+                int mode);
+    };
 
     /*
      * Used to retrieve information about the h/w composer
@@ -586,16 +703,24 @@
      * total number of configurations available for the display is returned in
      * *numConfigs. If *numConfigs is zero on entry, then configs may be NULL.
      *
-     * HWC_DEVICE_API_VERSION_1_1 does not provide a way to choose a config.
-     * For displays that support multiple configurations, the h/w composer
-     * implementation should choose one and report it as the first config in
-     * the list. Reporting the not-chosen configs is not required.
+     * Hardware composers implementing HWC_DEVICE_API_VERSION_1_3 or prior
+     * shall choose one configuration to activate and report it as the first
+     * entry in the returned list. Reporting the inactive configurations is not
+     * required.
      *
-     * Returns 0 on success or -errno on error. If disp is a hotpluggable
-     * display type and no display is connected, an error should be returned.
+     * HWC_DEVICE_API_VERSION_1_4 and later provide configuration management
+     * through SurfaceFlinger, and hardware composers implementing these APIs
+     * must also provide getActiveConfig and setActiveConfig. Hardware composers
+     * implementing these API versions may choose not to activate any
+     * configuration, leaving configuration selection to higher levels of the
+     * framework.
+     *
+     * Returns 0 on success or a negative error code on error. If disp is a
+     * hotpluggable display type and no display is connected, an error shall be
+     * returned.
      *
      * This field is REQUIRED for HWC_DEVICE_API_VERSION_1_1 and later.
-     * It should be NULL for previous versions.
+     * It shall be NULL for previous versions.
      */
     int (*getDisplayConfigs)(struct hwc_composer_device_1* dev, int disp,
             uint32_t* configs, size_t* numConfigs);
@@ -612,19 +737,80 @@
      * array will have one less value than the attributes array.
      *
      * This field is REQUIRED for HWC_DEVICE_API_VERSION_1_1 and later.
-     * It should be NULL for previous versions.
+     * It shall be NULL for previous versions.
      *
      * If disp is a hotpluggable display type and no display is connected,
      * or if config is not a valid configuration for the display, a negative
-     * value should be returned.
+     * error code shall be returned.
      */
     int (*getDisplayAttributes)(struct hwc_composer_device_1* dev, int disp,
             uint32_t config, const uint32_t* attributes, int32_t* values);
 
     /*
+     * (*getActiveConfig)() returns the index of the configuration that is
+     * currently active on the connected display. The index is relative to
+     * the list of configuration handles returned by getDisplayConfigs. If there
+     * is no active configuration, -1 shall be returned.
+     *
+     * Returns the configuration index on success or -1 on error.
+     *
+     * This field is REQUIRED for HWC_DEVICE_API_VERSION_1_4 and later.
+     * It shall be NULL for previous versions.
+     */
+    int (*getActiveConfig)(struct hwc_composer_device_1* dev, int disp);
+
+    /*
+     * (*setActiveConfig)() instructs the hardware composer to switch to the
+     * display configuration at the given index in the list of configuration
+     * handles returned by getDisplayConfigs.
+     *
+     * If this function returns without error, any subsequent calls to
+     * getActiveConfig shall return the index set by this function until one
+     * of the following occurs:
+     *   1) Another successful call of this function
+     *   2) The display is disconnected
+     *
+     * Returns 0 on success or a negative error code on error. If disp is a
+     * hotpluggable display type and no display is connected, or if index is
+     * outside of the range of hardware configurations returned by
+     * getDisplayConfigs, an error shall be returned.
+     *
+     * This field is REQUIRED for HWC_DEVICE_API_VERSION_1_4 and later.
+     * It shall be NULL for previous versions.
+     */
+    int (*setActiveConfig)(struct hwc_composer_device_1* dev, int disp,
+            int index);
+    /*
+     * Asynchronously update the location of the cursor layer.
+     *
+     * Within the standard prepare()/set() composition loop, the client
+     * (surfaceflinger) can request that a given layer uses dedicated cursor
+     * composition hardware by specifiying the HWC_IS_CURSOR_LAYER flag. Only
+     * one layer per display can have this flag set. If the layer is suitable
+     * for the platform's cursor hardware, hwcomposer will return from prepare()
+     * a composition type of HWC_CURSOR_OVERLAY for that layer. This indicates
+     * not only that the client is not responsible for compositing that layer,
+     * but also that the client can continue to update the position of that layer
+     * after a call to set(). This can reduce the visible latency of mouse
+     * movement to visible, on-screen cursor updates. Calls to
+     * setCursorPositionAsync() may be made from a different thread doing the
+     * prepare()/set() composition loop, but care must be taken to not interleave
+     * calls of setCursorPositionAsync() between calls of set()/prepare().
+     *
+     * Notes:
+     * - Only one layer per display can be specified as a cursor layer with
+     *   HWC_IS_CURSOR_LAYER.
+     * - hwcomposer will only return one layer per display as HWC_CURSOR_OVERLAY
+     * - This returns 0 on success or -errno on error.
+     * - This field is optional for HWC_DEVICE_API_VERSION_1_4 and later. It
+     *   should be null for previous versions.
+     */
+    int (*setCursorPositionAsync)(struct hwc_composer_device_1 *dev, int disp, int x_pos, int y_pos);
+
+    /*
      * Reserved for future use. Must be NULL.
      */
-    void* reserved_proc[4];
+    void* reserved_proc[1];
 
 } hwc_composer_device_1_t;
 
diff --git a/include/hardware/hwcomposer_defs.h b/include/hardware/hwcomposer_defs.h
index c69a4bc..a19a26c 100644
--- a/include/hardware/hwcomposer_defs.h
+++ b/include/hardware/hwcomposer_defs.h
@@ -36,6 +36,8 @@
 #define HWC_DEVICE_API_VERSION_1_1  HARDWARE_DEVICE_API_VERSION_2(1, 1, HWC_HEADER_VERSION)
 #define HWC_DEVICE_API_VERSION_1_2  HARDWARE_DEVICE_API_VERSION_2(1, 2, HWC_HEADER_VERSION)
 #define HWC_DEVICE_API_VERSION_1_3  HARDWARE_DEVICE_API_VERSION_2(1, 3, HWC_HEADER_VERSION)
+#define HWC_DEVICE_API_VERSION_1_4  HARDWARE_DEVICE_API_VERSION_2(1, 4, HWC_HEADER_VERSION)
+#define HWC_DEVICE_API_VERSION_1_5  HARDWARE_DEVICE_API_VERSION_2(1, 5, HWC_HEADER_VERSION)
 
 enum {
     /* hwc_composer_device_t::set failed in EGL */
@@ -76,6 +78,16 @@
      * by SurfaceFlinger (just as if compositionType was set to HWC_OVERLAY).
      */
     HWC_SKIP_LAYER = 0x00000001,
+
+    /*
+     * HWC_IS_CURSOR_LAYER is set by surfaceflinger to indicate that this
+     * layer is being used as a cursor on this particular display, and that
+     * surfaceflinger can potentially perform asynchronous position updates for
+     * this layer. If a call to prepare() returns HWC_CURSOR_OVERLAY for the
+     * composition type of this layer, then the hwcomposer will allow async
+     * position updates to this layer via setCursorPositionAsync().
+     */
+    HWC_IS_CURSOR_LAYER = 0x00000002
 };
 
 /*
@@ -95,8 +107,17 @@
     /* this layer holds the result of compositing the HWC_FRAMEBUFFER layers.
      * Added in HWC_DEVICE_API_VERSION_1_1. */
     HWC_FRAMEBUFFER_TARGET = 3,
-};
 
+    /* this layer's contents are taken from a sideband buffer stream.
+     * Added in HWC_DEVICE_API_VERSION_1_4. */
+    HWC_SIDEBAND = 4,
+
+    /* this layer's composition will be handled by hwcomposer by dedicated
+       cursor overlay hardware. hwcomposer will also all async position updates
+       of this layer outside of the normal prepare()/set() loop. Added in
+       HWC_DEVICE_API_VERSION_1_4. */
+    HWC_CURSOR_OVERLAY =  5
+ };
 /*
  * hwc_layer_t::blending values
  */
@@ -171,6 +192,10 @@
      */
     HWC_DISPLAY_DPI_X                       = 4,
     HWC_DISPLAY_DPI_Y                       = 5,
+
+    /* Indicates which of the vendor-defined color transforms is provided by
+     * this configuration. */
+    HWC_DISPLAY_COLOR_TRANSFORM             = 6,
 };
 
 /* Allowed events for hwc_methods::eventControl() */
@@ -194,6 +219,32 @@
     HWC_DISPLAY_VIRTUAL_BIT     = 1 << HWC_DISPLAY_VIRTUAL,
 };
 
+/* Display power modes */
+enum {
+    /* The display is turned off (blanked). */
+    HWC_POWER_MODE_OFF      = 0,
+    /* The display is turned on and configured in a low power state
+     * that is suitable for presenting ambient information to the user,
+     * possibly with lower fidelity than normal but greater efficiency. */
+    HWC_POWER_MODE_DOZE     = 1,
+    /* The display is turned on normally. */
+    HWC_POWER_MODE_NORMAL   = 2,
+    /* The display is configured as in HWC_POWER_MODE_DOZE but may
+     * stop applying frame buffer updates from the graphics subsystem.
+     * This power mode is effectively a hint from the doze dream to
+     * tell the hardware that it is done drawing to the display for the
+     * time being and that the display should remain on in a low power
+     * state and continue showing its current contents indefinitely
+     * until the mode changes.
+     *
+     * This mode may also be used as a signal to enable hardware-based doze
+     * functionality.  In this case, the doze dream is effectively
+     * indicating that the hardware is free to take over the display
+     * and manage it autonomously to implement low power always-on display
+     * functionality. */
+    HWC_POWER_MODE_DOZE_SUSPEND  = 3,
+};
+
 /*****************************************************************************/
 
 __END_DECLS
diff --git a/include/hardware/input.h b/include/hardware/input.h
new file mode 100644
index 0000000..969b8ce
--- /dev/null
+++ b/include/hardware/input.h
@@ -0,0 +1,549 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INCLUDE_HARDWARE_INPUT_H
+#define ANDROID_INCLUDE_HARDWARE_INPUT_H
+
+#include <hardware/hardware.h>
+#include <stdint.h>
+
+__BEGIN_DECLS
+
+#define INPUT_MODULE_API_VERSION_1_0 HARDWARE_MODULE_API_VERSION(1, 0)
+#define INPUT_HARDWARE_MODULE_ID "input"
+
+#define INPUT_INSTANCE_EVDEV "evdev"
+
+typedef enum input_bus {
+    INPUT_BUS_BT,
+    INPUT_BUS_USB,
+    INPUT_BUS_SERIAL,
+    INPUT_BUS_BUILTIN
+} input_bus_t;
+
+typedef struct input_host input_host_t;
+
+typedef struct input_device_handle input_device_handle_t;
+
+typedef struct input_device_identifier input_device_identifier_t;
+
+typedef struct input_device_definition input_device_definition_t;
+
+typedef struct input_report_definition input_report_definition_t;
+
+typedef struct input_report input_report_t;
+
+typedef struct input_collection input_collection_t;
+
+typedef struct input_property_map input_property_map_t;
+
+typedef struct input_property input_property_t;
+
+typedef enum {
+    // keycodes
+    INPUT_USAGE_KEYCODE_UNKNOWN,
+    INPUT_USAGE_KEYCODE_SOFT_LEFT,
+    INPUT_USAGE_KEYCODE_SOFT_RIGHT,
+    INPUT_USAGE_KEYCODE_HOME,
+    INPUT_USAGE_KEYCODE_BACK,
+    INPUT_USAGE_KEYCODE_CALL,
+    INPUT_USAGE_KEYCODE_ENDCALL,
+    INPUT_USAGE_KEYCODE_0,
+    INPUT_USAGE_KEYCODE_1,
+    INPUT_USAGE_KEYCODE_2,
+    INPUT_USAGE_KEYCODE_3,
+    INPUT_USAGE_KEYCODE_4,
+    INPUT_USAGE_KEYCODE_5,
+    INPUT_USAGE_KEYCODE_6,
+    INPUT_USAGE_KEYCODE_7,
+    INPUT_USAGE_KEYCODE_8,
+    INPUT_USAGE_KEYCODE_9,
+    INPUT_USAGE_KEYCODE_STAR,
+    INPUT_USAGE_KEYCODE_POUND,
+    INPUT_USAGE_KEYCODE_DPAD_UP,
+    INPUT_USAGE_KEYCODE_DPAD_DOWN,
+    INPUT_USAGE_KEYCODE_DPAD_LEFT,
+    INPUT_USAGE_KEYCODE_DPAD_RIGHT,
+    INPUT_USAGE_KEYCODE_DPAD_CENTER,
+    INPUT_USAGE_KEYCODE_VOLUME_UP,
+    INPUT_USAGE_KEYCODE_VOLUME_DOWN,
+    INPUT_USAGE_KEYCODE_POWER,
+    INPUT_USAGE_KEYCODE_CAMERA,
+    INPUT_USAGE_KEYCODE_CLEAR,
+    INPUT_USAGE_KEYCODE_A,
+    INPUT_USAGE_KEYCODE_B,
+    INPUT_USAGE_KEYCODE_C,
+    INPUT_USAGE_KEYCODE_D,
+    INPUT_USAGE_KEYCODE_E,
+    INPUT_USAGE_KEYCODE_F,
+    INPUT_USAGE_KEYCODE_G,
+    INPUT_USAGE_KEYCODE_H,
+    INPUT_USAGE_KEYCODE_I,
+    INPUT_USAGE_KEYCODE_J,
+    INPUT_USAGE_KEYCODE_K,
+    INPUT_USAGE_KEYCODE_L,
+    INPUT_USAGE_KEYCODE_M,
+    INPUT_USAGE_KEYCODE_N,
+    INPUT_USAGE_KEYCODE_O,
+    INPUT_USAGE_KEYCODE_P,
+    INPUT_USAGE_KEYCODE_Q,
+    INPUT_USAGE_KEYCODE_R,
+    INPUT_USAGE_KEYCODE_S,
+    INPUT_USAGE_KEYCODE_T,
+    INPUT_USAGE_KEYCODE_U,
+    INPUT_USAGE_KEYCODE_V,
+    INPUT_USAGE_KEYCODE_W,
+    INPUT_USAGE_KEYCODE_X,
+    INPUT_USAGE_KEYCODE_Y,
+    INPUT_USAGE_KEYCODE_Z,
+    INPUT_USAGE_KEYCODE_COMMA,
+    INPUT_USAGE_KEYCODE_PERIOD,
+    INPUT_USAGE_KEYCODE_ALT_LEFT,
+    INPUT_USAGE_KEYCODE_ALT_RIGHT,
+    INPUT_USAGE_KEYCODE_SHIFT_LEFT,
+    INPUT_USAGE_KEYCODE_SHIFT_RIGHT,
+    INPUT_USAGE_KEYCODE_TAB,
+    INPUT_USAGE_KEYCODE_SPACE,
+    INPUT_USAGE_KEYCODE_SYM,
+    INPUT_USAGE_KEYCODE_EXPLORER,
+    INPUT_USAGE_KEYCODE_ENVELOPE,
+    INPUT_USAGE_KEYCODE_ENTER,
+    INPUT_USAGE_KEYCODE_DEL,
+    INPUT_USAGE_KEYCODE_GRAVE,
+    INPUT_USAGE_KEYCODE_MINUS,
+    INPUT_USAGE_KEYCODE_EQUALS,
+    INPUT_USAGE_KEYCODE_LEFT_BRACKET,
+    INPUT_USAGE_KEYCODE_RIGHT_BRACKET,
+    INPUT_USAGE_KEYCODE_BACKSLASH,
+    INPUT_USAGE_KEYCODE_SEMICOLON,
+    INPUT_USAGE_KEYCODE_APOSTROPHE,
+    INPUT_USAGE_KEYCODE_SLASH,
+    INPUT_USAGE_KEYCODE_AT,
+    INPUT_USAGE_KEYCODE_NUM,
+    INPUT_USAGE_KEYCODE_HEADSETHOOK,
+    INPUT_USAGE_KEYCODE_FOCUS,   // *Camera* focus
+    INPUT_USAGE_KEYCODE_PLUS,
+    INPUT_USAGE_KEYCODE_MENU,
+    INPUT_USAGE_KEYCODE_NOTIFICATION,
+    INPUT_USAGE_KEYCODE_SEARCH,
+    INPUT_USAGE_KEYCODE_MEDIA_PLAY_PAUSE,
+    INPUT_USAGE_KEYCODE_MEDIA_STOP,
+    INPUT_USAGE_KEYCODE_MEDIA_NEXT,
+    INPUT_USAGE_KEYCODE_MEDIA_PREVIOUS,
+    INPUT_USAGE_KEYCODE_MEDIA_REWIND,
+    INPUT_USAGE_KEYCODE_MEDIA_FAST_FORWARD,
+    INPUT_USAGE_KEYCODE_MUTE,
+    INPUT_USAGE_KEYCODE_PAGE_UP,
+    INPUT_USAGE_KEYCODE_PAGE_DOWN,
+    INPUT_USAGE_KEYCODE_PICTSYMBOLS,
+    INPUT_USAGE_KEYCODE_SWITCH_CHARSET,
+    INPUT_USAGE_KEYCODE_BUTTON_A,
+    INPUT_USAGE_KEYCODE_BUTTON_B,
+    INPUT_USAGE_KEYCODE_BUTTON_C,
+    INPUT_USAGE_KEYCODE_BUTTON_X,
+    INPUT_USAGE_KEYCODE_BUTTON_Y,
+    INPUT_USAGE_KEYCODE_BUTTON_Z,
+    INPUT_USAGE_KEYCODE_BUTTON_L1,
+    INPUT_USAGE_KEYCODE_BUTTON_R1,
+    INPUT_USAGE_KEYCODE_BUTTON_L2,
+    INPUT_USAGE_KEYCODE_BUTTON_R2,
+    INPUT_USAGE_KEYCODE_BUTTON_THUMBL,
+    INPUT_USAGE_KEYCODE_BUTTON_THUMBR,
+    INPUT_USAGE_KEYCODE_BUTTON_START,
+    INPUT_USAGE_KEYCODE_BUTTON_SELECT,
+    INPUT_USAGE_KEYCODE_BUTTON_MODE,
+    INPUT_USAGE_KEYCODE_ESCAPE,
+    INPUT_USAGE_KEYCODE_FORWARD_DEL,
+    INPUT_USAGE_KEYCODE_CTRL_LEFT,
+    INPUT_USAGE_KEYCODE_CTRL_RIGHT,
+    INPUT_USAGE_KEYCODE_CAPS_LOCK,
+    INPUT_USAGE_KEYCODE_SCROLL_LOCK,
+    INPUT_USAGE_KEYCODE_META_LEFT,
+    INPUT_USAGE_KEYCODE_META_RIGHT,
+    INPUT_USAGE_KEYCODE_FUNCTION,
+    INPUT_USAGE_KEYCODE_SYSRQ,
+    INPUT_USAGE_KEYCODE_BREAK,
+    INPUT_USAGE_KEYCODE_MOVE_HOME,
+    INPUT_USAGE_KEYCODE_MOVE_END,
+    INPUT_USAGE_KEYCODE_INSERT,
+    INPUT_USAGE_KEYCODE_FORWARD,
+    INPUT_USAGE_KEYCODE_MEDIA_PLAY,
+    INPUT_USAGE_KEYCODE_MEDIA_PAUSE,
+    INPUT_USAGE_KEYCODE_MEDIA_CLOSE,
+    INPUT_USAGE_KEYCODE_MEDIA_EJECT,
+    INPUT_USAGE_KEYCODE_MEDIA_RECORD,
+    INPUT_USAGE_KEYCODE_F1,
+    INPUT_USAGE_KEYCODE_F2,
+    INPUT_USAGE_KEYCODE_F3,
+    INPUT_USAGE_KEYCODE_F4,
+    INPUT_USAGE_KEYCODE_F5,
+    INPUT_USAGE_KEYCODE_F6,
+    INPUT_USAGE_KEYCODE_F7,
+    INPUT_USAGE_KEYCODE_F8,
+    INPUT_USAGE_KEYCODE_F9,
+    INPUT_USAGE_KEYCODE_F10,
+    INPUT_USAGE_KEYCODE_F11,
+    INPUT_USAGE_KEYCODE_F12,
+    INPUT_USAGE_KEYCODE_NUM_LOCK,
+    INPUT_USAGE_KEYCODE_NUMPAD_0,
+    INPUT_USAGE_KEYCODE_NUMPAD_1,
+    INPUT_USAGE_KEYCODE_NUMPAD_2,
+    INPUT_USAGE_KEYCODE_NUMPAD_3,
+    INPUT_USAGE_KEYCODE_NUMPAD_4,
+    INPUT_USAGE_KEYCODE_NUMPAD_5,
+    INPUT_USAGE_KEYCODE_NUMPAD_6,
+    INPUT_USAGE_KEYCODE_NUMPAD_7,
+    INPUT_USAGE_KEYCODE_NUMPAD_8,
+    INPUT_USAGE_KEYCODE_NUMPAD_9,
+    INPUT_USAGE_KEYCODE_NUMPAD_DIVIDE,
+    INPUT_USAGE_KEYCODE_NUMPAD_MULTIPLY,
+    INPUT_USAGE_KEYCODE_NUMPAD_SUBTRACT,
+    INPUT_USAGE_KEYCODE_NUMPAD_ADD,
+    INPUT_USAGE_KEYCODE_NUMPAD_DOT,
+    INPUT_USAGE_KEYCODE_NUMPAD_COMMA,
+    INPUT_USAGE_KEYCODE_NUMPAD_ENTER,
+    INPUT_USAGE_KEYCODE_NUMPAD_EQUALS,
+    INPUT_USAGE_KEYCODE_NUMPAD_LEFT_PAREN,
+    INPUT_USAGE_KEYCODE_NUMPAD_RIGHT_PAREN,
+    INPUT_USAGE_KEYCODE_VOLUME_MUTE,
+    INPUT_USAGE_KEYCODE_INFO,
+    INPUT_USAGE_KEYCODE_CHANNEL_UP,
+    INPUT_USAGE_KEYCODE_CHANNEL_DOWN,
+    INPUT_USAGE_KEYCODE_ZOOM_IN,
+    INPUT_USAGE_KEYCODE_ZOOM_OUT,
+    INPUT_USAGE_KEYCODE_TV,
+    INPUT_USAGE_KEYCODE_WINDOW,
+    INPUT_USAGE_KEYCODE_GUIDE,
+    INPUT_USAGE_KEYCODE_DVR,
+    INPUT_USAGE_KEYCODE_BOOKMARK,
+    INPUT_USAGE_KEYCODE_CAPTIONS,
+    INPUT_USAGE_KEYCODE_SETTINGS,
+    INPUT_USAGE_KEYCODE_TV_POWER,
+    INPUT_USAGE_KEYCODE_TV_INPUT,
+    INPUT_USAGE_KEYCODE_STB_POWER,
+    INPUT_USAGE_KEYCODE_STB_INPUT,
+    INPUT_USAGE_KEYCODE_AVR_POWER,
+    INPUT_USAGE_KEYCODE_AVR_INPUT,
+    INPUT_USAGE_KEYCODE_PROG_RED,
+    INPUT_USAGE_KEYCODE_PROG_GREEN,
+    INPUT_USAGE_KEYCODE_PROG_YELLOW,
+    INPUT_USAGE_KEYCODE_PROG_BLUE,
+    INPUT_USAGE_KEYCODE_APP_SWITCH,
+    INPUT_USAGE_KEYCODE_BUTTON_1,
+    INPUT_USAGE_KEYCODE_BUTTON_2,
+    INPUT_USAGE_KEYCODE_BUTTON_3,
+    INPUT_USAGE_KEYCODE_BUTTON_4,
+    INPUT_USAGE_KEYCODE_BUTTON_5,
+    INPUT_USAGE_KEYCODE_BUTTON_6,
+    INPUT_USAGE_KEYCODE_BUTTON_7,
+    INPUT_USAGE_KEYCODE_BUTTON_8,
+    INPUT_USAGE_KEYCODE_BUTTON_9,
+    INPUT_USAGE_KEYCODE_BUTTON_10,
+    INPUT_USAGE_KEYCODE_BUTTON_11,
+    INPUT_USAGE_KEYCODE_BUTTON_12,
+    INPUT_USAGE_KEYCODE_BUTTON_13,
+    INPUT_USAGE_KEYCODE_BUTTON_14,
+    INPUT_USAGE_KEYCODE_BUTTON_15,
+    INPUT_USAGE_KEYCODE_BUTTON_16,
+    INPUT_USAGE_KEYCODE_LANGUAGE_SWITCH,
+    INPUT_USAGE_KEYCODE_MANNER_MODE,
+    INPUT_USAGE_KEYCODE_3D_MODE,
+    INPUT_USAGE_KEYCODE_CONTACTS,
+    INPUT_USAGE_KEYCODE_CALENDAR,
+    INPUT_USAGE_KEYCODE_MUSIC,
+    INPUT_USAGE_KEYCODE_CALCULATOR,
+    INPUT_USAGE_KEYCODE_ZENKAKU_HANKAKU,
+    INPUT_USAGE_KEYCODE_EISU,
+    INPUT_USAGE_KEYCODE_MUHENKAN,
+    INPUT_USAGE_KEYCODE_HENKAN,
+    INPUT_USAGE_KEYCODE_KATAKANA_HIRAGANA,
+    INPUT_USAGE_KEYCODE_YEN,
+    INPUT_USAGE_KEYCODE_RO,
+    INPUT_USAGE_KEYCODE_KANA,
+    INPUT_USAGE_KEYCODE_ASSIST,
+    INPUT_USAGE_KEYCODE_BRIGHTNESS_DOWN,
+    INPUT_USAGE_KEYCODE_BRIGHTNESS_UP,
+    INPUT_USAGE_KEYCODE_MEDIA_AUDIO_TRACK,
+    INPUT_USAGE_KEYCODE_SLEEP,
+    INPUT_USAGE_KEYCODE_WAKEUP,
+    INPUT_USAGE_KEYCODE_PAIRING,
+    INPUT_USAGE_KEYCODE_MEDIA_TOP_MENU,
+    INPUT_USAGE_KEYCODE_11,
+    INPUT_USAGE_KEYCODE_12,
+    INPUT_USAGE_KEYCODE_LAST_CHANNEL,
+    INPUT_USAGE_KEYCODE_TV_DATA_SERVICE,
+    INPUT_USAGE_KEYCODE_VOICE_ASSIST,
+    INPUT_USAGE_KEYCODE_TV_RADIO_SERVICE,
+    INPUT_USAGE_KEYCODE_TV_TELETEXT,
+    INPUT_USAGE_KEYCODE_TV_NUMBER_ENTRY,
+    INPUT_USAGE_KEYCODE_TV_TERRESTRIAL_ANALOG,
+    INPUT_USAGE_KEYCODE_TV_TERRESTRIAL_DIGITAL,
+    INPUT_USAGE_KEYCODE_TV_SATELLITE,
+    INPUT_USAGE_KEYCODE_TV_SATELLITE_BS,
+    INPUT_USAGE_KEYCODE_TV_SATELLITE_CS,
+    INPUT_USAGE_KEYCODE_TV_SATELLITE_SERVICE,
+    INPUT_USAGE_KEYCODE_TV_NETWORK,
+    INPUT_USAGE_KEYCODE_TV_ANTENNA_CABLE,
+    INPUT_USAGE_KEYCODE_TV_INPUT_HDMI_1,
+    INPUT_USAGE_KEYCODE_TV_INPUT_HDMI_2,
+    INPUT_USAGE_KEYCODE_TV_INPUT_HDMI_3,
+    INPUT_USAGE_KEYCODE_TV_INPUT_HDMI_4,
+    INPUT_USAGE_KEYCODE_TV_INPUT_COMPOSITE_1,
+    INPUT_USAGE_KEYCODE_TV_INPUT_COMPOSITE_2,
+    INPUT_USAGE_KEYCODE_TV_INPUT_COMPONENT_1,
+    INPUT_USAGE_KEYCODE_TV_INPUT_COMPONENT_2,
+    INPUT_USAGE_KEYCODE_TV_INPUT_VGA_1,
+    INPUT_USAGE_KEYCODE_TV_AUDIO_DESCRIPTION,
+    INPUT_USAGE_KEYCODE_TV_AUDIO_DESCRIPTION_MIX_UP,
+    INPUT_USAGE_KEYCODE_TV_AUDIO_DESCRIPTION_MIX_DOWN,
+    INPUT_USAGE_KEYCODE_TV_ZOOM_MODE,
+    INPUT_USAGE_KEYCODE_TV_CONTENTS_MENU,
+    INPUT_USAGE_KEYCODE_TV_MEDIA_CONTEXT_MENU,
+    INPUT_USAGE_KEYCODE_TV_TIMER_PROGRAMMING,
+    INPUT_USAGE_KEYCODE_HELP,
+
+    // axes
+    INPUT_USAGE_AXIS_X,
+    INPUT_USAGE_AXIS_Y,
+    INPUT_USAGE_AXIS_PRESSURE,
+    INPUT_USAGE_AXIS_SIZE,
+    INPUT_USAGE_AXIS_TOUCH_MAJOR,
+    INPUT_USAGE_AXIS_TOUCH_MINOR,
+    INPUT_USAGE_AXIS_TOOL_MAJOR,
+    INPUT_USAGE_AXIS_TOOL_MINOR,
+    INPUT_USAGE_AXIS_ORIENTATION,
+    INPUT_USAGE_AXIS_VSCROLL,
+    INPUT_USAGE_AXIS_HSCROLL,
+    INPUT_USAGE_AXIS_Z,
+    INPUT_USAGE_AXIS_RX,
+    INPUT_USAGE_AXIS_RY,
+    INPUT_USAGE_AXIS_RZ,
+    INPUT_USAGE_AXIS_HAT_X,
+    INPUT_USAGE_AXIS_HAT_Y,
+    INPUT_USAGE_AXIS_LTRIGGER,
+    INPUT_USAGE_AXIS_RTRIGGER,
+    INPUT_USAGE_AXIS_THROTTLE,
+    INPUT_USAGE_AXIS_RUDDER,
+    INPUT_USAGE_AXIS_WHEEL,
+    INPUT_USAGE_AXIS_GAS,
+    INPUT_USAGE_AXIS_BRAKE,
+    INPUT_USAGE_AXIS_DISTANCE,
+    INPUT_USAGE_AXIS_TILT,
+    INPUT_USAGE_AXIS_GENERIC_1,
+    INPUT_USAGE_AXIS_GENERIC_2,
+    INPUT_USAGE_AXIS_GENERIC_3,
+    INPUT_USAGE_AXIS_GENERIC_4,
+    INPUT_USAGE_AXIS_GENERIC_5,
+    INPUT_USAGE_AXIS_GENERIC_6,
+    INPUT_USAGE_AXIS_GENERIC_7,
+    INPUT_USAGE_AXIS_GENERIC_8,
+    INPUT_USAGE_AXIS_GENERIC_9,
+    INPUT_USAGE_AXIS_GENERIC_10,
+    INPUT_USAGE_AXIS_GENERIC_11,
+    INPUT_USAGE_AXIS_GENERIC_12,
+    INPUT_USAGE_AXIS_GENERIC_13,
+    INPUT_USAGE_AXIS_GENERIC_14,
+    INPUT_USAGE_AXIS_GENERIC_15,
+    INPUT_USAGE_AXIS_GENERIC_16,
+
+    // leds
+    INPUT_USAGE_LED_NUM_LOCK,
+    INPUT_USAGE_LED_CAPS_LOCK,
+    INPUT_USAGE_LED_SCROLL_LOCK,
+    INPUT_USAGE_LED_COMPOSE,
+    INPUT_USAGE_LED_KANA,
+    INPUT_USAGE_LED_SLEEP,
+    INPUT_USAGE_LED_SUSPEND,
+    INPUT_USAGE_LED_MUTE,
+    INPUT_USAGE_LED_MISC,
+    INPUT_USAGE_LED_MAIL,
+    INPUT_USAGE_LED_CHARGING,
+    INPUT_USAGE_LED_CONTROLLER_1,
+    INPUT_USAGE_LED_CONTROLLER_2,
+    INPUT_USAGE_LED_CONTROLLER_3,
+    INPUT_USAGE_LED_CONTROLLER_4,
+} input_usage_t;
+
+typedef enum {
+    INPUT_COLLECTION_ID_TOUCH,
+    INPUT_COLLECTION_ID_KEYBOARD,
+    INPUT_COLLECTION_ID_MOUSE,
+    INPUT_COLLECTION_ID_TOUCHPAD,
+    // etc
+} input_collection_id_t;
+
+typedef struct input_message input_message_t;
+
+typedef struct input_host_callbacks {
+
+    /**
+     * Creates a device identifier with the given properties.
+     * The unique ID should be a string that precisely identifies a given piece of hardware. For
+     * example, an input device connected via Bluetooth could use its MAC address as its unique ID.
+     */
+    input_device_identifier_t* (*create_device_identifier)(input_host_t* host,
+            const char* name, int32_t product_id, int32_t vendor_id,
+            input_bus_t bus, const char* unique_id);
+
+    /**
+     * Allocates the device definition which will describe the input capabilities of a device. A
+     * device definition may be used to register as many devices as desired.
+     */
+    input_device_definition_t* (*create_device_definition)(input_host_t* host);
+
+    /**
+     * Allocate either an input report, which the HAL will use to tell the host of incoming input
+     * events, or an output report, which the host will use to tell the HAL of desired state
+     * changes (e.g. setting an LED).
+     */
+    input_report_definition_t* (*create_input_report_definition)(input_host_t* host);
+    input_report_definition_t* (*create_output_report_definition)(input_host_t* host);
+
+    /**
+     * Append the report to the given input device.
+     */
+    void (*input_device_definition_add_report)(input_host_t* host,
+            input_device_definition_t* d, input_report_definition_t* r);
+
+    /**
+     * Add a collection with the given arity and ID. A collection describes a set
+     * of logically grouped properties such as the X and Y coordinates of a single finger touch or
+     * the set of keys on a keyboard. The arity declares how many repeated instances of this
+     * collection will appear in whatever report it is attached to. The ID describes the type of
+     * grouping being represented by the collection. For example, a touchscreen capable of
+     * reporting up to 2 fingers simultaneously might have a collection with the X and Y
+     * coordinates, an arity of 2, and an ID of INPUT_COLLECTION_USAGE_TOUCHSCREEN. Any given ID
+     * may only be present once for a given report.
+     */
+    void (*input_report_definition_add_collection)(input_host_t* host,
+            input_report_definition_t* report, input_collection_id_t id, int32_t arity);
+
+    /**
+     * Declare an int usage with the given properties. The report and collection defines where the
+     * usage is being declared.
+     */
+    void (*input_report_definition_declare_usage_int)(input_host_t* host,
+            input_report_definition_t* report, input_collection_id_t id,
+            input_usage_t usage, int32_t min, int32_t max, float resolution);
+
+    /**
+     * Declare a set of boolean usages with the given properties.  The report and collection
+     * defines where the usages are being declared.
+     */
+    void (*input_report_definition_declare_usages_bool)(input_host_t* host,
+            input_report_definition_t* report, input_collection_id_t id,
+            input_usage_t* usage, size_t usage_count);
+
+
+    /**
+     * Register a given input device definition. This notifies the host that an input device has
+     * been connected and gives a description of all its capabilities.
+     */
+    input_device_handle_t* (*register_device)(input_host_t* host,
+            input_device_identifier_t* id, input_device_definition_t* d);
+
+    /** Unregister the given device */
+    void (*unregister_device)(input_host_t* host, input_device_handle_t* handle);
+
+    /**
+     * Allocate a report that will contain all of the state as described by the given report.
+     */
+    input_report_t* (*input_allocate_report)(input_host_t* host, input_report_definition_t* r);
+
+    /**
+     * Add an int usage value to a report.
+     */
+    void (*input_report_set_usage_int)(input_host_t* host, input_report_t* r,
+            input_collection_id_t id, input_usage_t usage, int32_t value, int32_t arity_index);
+
+    /**
+     * Add a boolean usage value to a report.
+     */
+    void (*input_report_set_usage_bool)(input_host_t* host, input_report_t* r,
+            input_collection_id_t id, input_usage_t usage, bool value, int32_t arity_index);
+
+    void (*report_event)(input_host_t* host, input_device_handle_t* d, input_report_t* report);
+
+    /**
+     * Retrieve the set of properties for the device. The returned
+     * input_property_map_t* may be used to query specific properties via the
+     * input_get_device_property callback.
+     */
+    input_property_map_t* (*input_get_device_property_map)(input_host_t* host,
+            input_device_identifier_t* id);
+    /**
+     * Retrieve a property for the device with the given key. Returns NULL if
+     * the key does not exist, or an input_property_t* that must be freed using
+     * input_free_device_property(). Using an input_property_t after the
+     * corresponding input_property_map_t is freed is undefined.
+     */
+    input_property_t* (*input_get_device_property)(input_host_t* host,
+            input_property_map_t* map, const char* key);
+
+    /**
+     * Get the key for the input property. Returns NULL if the property is NULL.
+     * The returned const char* is owned by the input_property_t.
+     */
+    const char* (*input_get_property_key)(input_host_t* host, input_property_t* property);
+
+    /**
+     * Get the value for the input property. Returns NULL if the property is
+     * NULL. The returned const char* is owned by the input_property_t.
+     */
+    const char* (*input_get_property_value)(input_host_t* host, input_property_t* property);
+
+    /**
+     * Frees the input_property_t*.
+     */
+    void (*input_free_device_property)(input_host_t* host, input_property_t* property);
+
+    /**
+     * Frees the input_property_map_t*.
+     */
+    void (*input_free_device_property_map)(input_host_t* host, input_property_map_t* map);
+} input_host_callbacks_t;
+
+typedef struct input_module input_module_t;
+
+struct input_module {
+    /**
+     * Common methods of the input module. This *must* be the first member
+     * of input_module as users of this structure will cast a hw_module_t
+     * to input_module pointer in contexts where it's known
+     * the hw_module_t references a input_module.
+     */
+    struct hw_module_t common;
+
+    /**
+     * Initialize the module with host callbacks. At this point the HAL should start up whatever
+     * infrastructure it needs to in order to process input events.
+     */
+    void (*init)(const input_module_t* module, input_host_t* host, input_host_callbacks_t cb);
+
+    /**
+     * Sends an output report with a new set of state the host would like the given device to
+     * assume.
+     */
+    void (*notify_report)(const input_module_t* module, input_report_t* report);
+};
+
+static inline int input_open(const struct hw_module_t** module, const char* type) {
+    return hw_get_module_by_class(INPUT_HARDWARE_MODULE_ID, type, module);
+}
+
+__END_DECLS
+
+#endif  /* ANDROID_INCLUDE_HARDWARE_INPUT_H */
diff --git a/include/hardware/keymaster.h b/include/hardware/keymaster.h
deleted file mode 100644
index 12158bf..0000000
--- a/include/hardware/keymaster.h
+++ /dev/null
@@ -1,285 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_HARDWARE_KEYMASTER_H
-#define ANDROID_HARDWARE_KEYMASTER_H
-
-#include <stdint.h>
-#include <sys/cdefs.h>
-#include <sys/types.h>
-
-#include <hardware/hardware.h>
-
-__BEGIN_DECLS
-
-/**
- * The id of this module
- */
-#define KEYSTORE_HARDWARE_MODULE_ID "keystore"
-
-#define KEYSTORE_KEYMASTER "keymaster"
-
-/**
- * Settings for "module_api_version" and "hal_api_version"
- * fields in the keymaster_module initialization.
- */
-#define KEYMASTER_HEADER_VERSION 3
-
-#define KEYMASTER_MODULE_API_VERSION_0_2  HARDWARE_MODULE_API_VERSION(0, 2)
-#define KEYMASTER_DEVICE_API_VERSION_0_2  HARDWARE_DEVICE_API_VERSION_2(0, 2, KEYMASTER_HEADER_VERSION)
-
-#define KEYMASTER_MODULE_API_VERSION_0_3  HARDWARE_MODULE_API_VERSION(0, 3)
-#define KEYMASTER_DEVICE_API_VERSION_0_3  HARDWARE_DEVICE_API_VERSION_2(0, 3, KEYMASTER_HEADER_VERSION)
-
-/**
- * Flags for keymaster_device::flags
- */
-enum {
-    /*
-     * Indicates this keymaster implementation does not have hardware that
-     * keeps private keys out of user space.
-     *
-     * This should not be implemented on anything other than the default
-     * implementation.
-     */
-    KEYMASTER_SOFTWARE_ONLY = 1 << 0,
-
-    /*
-     * This indicates that the key blobs returned via all the primitives
-     * are sufficient to operate on their own without the trusted OS
-     * querying userspace to retrieve some other data. Key blobs of
-     * this type are normally returned encrypted with a
-     * Key Encryption Key (KEK).
-     *
-     * This is currently used by "vold" to know whether the whole disk
-     * encryption secret can be unwrapped without having some external
-     * service started up beforehand since the "/data" partition will
-     * be unavailable at that point.
-     */
-    KEYMASTER_BLOBS_ARE_STANDALONE = 1 << 1,
-
-    /*
-     * Indicates that the keymaster module supports DSA keys.
-     */
-    KEYMASTER_SUPPORTS_DSA = 1 << 2,
-
-    /*
-     * Indicates that the keymaster module supports EC keys.
-     */
-    KEYMASTER_SUPPORTS_EC = 1 << 3,
-};
-
-struct keystore_module {
-    hw_module_t common;
-};
-
-/**
- * Asymmetric key pair types.
- */
-typedef enum {
-    TYPE_RSA = 1,
-    TYPE_DSA = 2,
-    TYPE_EC = 3,
-} keymaster_keypair_t;
-
-/**
- * Parameters needed to generate an RSA key.
- */
-typedef struct {
-    uint32_t modulus_size;
-    uint64_t public_exponent;
-} keymaster_rsa_keygen_params_t;
-
-/**
- * Parameters needed to generate a DSA key.
- */
-typedef struct {
-    uint32_t key_size;
-    uint32_t generator_len;
-    uint32_t prime_p_len;
-    uint32_t prime_q_len;
-    const uint8_t* generator;
-    const uint8_t* prime_p;
-    const uint8_t* prime_q;
-} keymaster_dsa_keygen_params_t;
-
-/**
- * Parameters needed to generate an EC key.
- *
- * Field size is the only parameter in version 2. The sizes correspond to these required curves:
- *
- * 192 = NIST P-192
- * 224 = NIST P-224
- * 256 = NIST P-256
- * 384 = NIST P-384
- * 521 = NIST P-521
- *
- * The parameters for these curves are available at: http://www.nsa.gov/ia/_files/nist-routines.pdf
- * in Chapter 4.
- */
-typedef struct {
-    uint32_t field_size;
-} keymaster_ec_keygen_params_t;
-
-/**
- * Digest type.
- */
-typedef enum {
-    DIGEST_NONE,
-} keymaster_digest_t;
-
-/**
- * Type of padding used for RSA operations.
- */
-typedef enum {
-    PADDING_NONE,
-} keymaster_rsa_padding_t;
-
-
-typedef struct {
-    keymaster_digest_t digest_type;
-} keymaster_dsa_sign_params_t;
-
-typedef struct {
-    keymaster_digest_t digest_type;
-} keymaster_ec_sign_params_t;
-
-typedef struct {
-    keymaster_digest_t digest_type;
-    keymaster_rsa_padding_t padding_type;
-} keymaster_rsa_sign_params_t;
-
-/**
- * The parameters that can be set for a given keymaster implementation.
- */
-struct keymaster_device {
-    struct hw_device_t common;
-
-    /**
-     * THIS IS DEPRECATED. Use the new "module_api_version" and "hal_api_version"
-     * fields in the keymaster_module initialization instead.
-     */
-    uint32_t client_version;
-
-    /**
-     * See flags defined for keymaster_device::flags above.
-     */
-    uint32_t flags;
-
-    void* context;
-
-    /**
-     * Generates a public and private key. The key-blob returned is opaque
-     * and must subsequently provided for signing and verification.
-     *
-     * Returns: 0 on success or an error code less than 0.
-     */
-    int (*generate_keypair)(const struct keymaster_device* dev,
-            const keymaster_keypair_t key_type, const void* key_params,
-            uint8_t** key_blob, size_t* key_blob_length);
-
-    /**
-     * Imports a public and private key pair. The imported keys will be in
-     * PKCS#8 format with DER encoding (Java standard). The key-blob
-     * returned is opaque and will be subsequently provided for signing
-     * and verification.
-     *
-     * Returns: 0 on success or an error code less than 0.
-     */
-    int (*import_keypair)(const struct keymaster_device* dev,
-            const uint8_t* key, const size_t key_length,
-            uint8_t** key_blob, size_t* key_blob_length);
-
-    /**
-     * Gets the public key part of a key pair. The public key must be in
-     * X.509 format (Java standard) encoded byte array.
-     *
-     * Returns: 0 on success or an error code less than 0.
-     * On error, x509_data should not be allocated.
-     */
-    int (*get_keypair_public)(const struct keymaster_device* dev,
-            const uint8_t* key_blob, const size_t key_blob_length,
-            uint8_t** x509_data, size_t* x509_data_length);
-
-    /**
-     * Deletes the key pair associated with the key blob.
-     *
-     * This function is optional and should be set to NULL if it is not
-     * implemented.
-     *
-     * Returns 0 on success or an error code less than 0.
-     */
-    int (*delete_keypair)(const struct keymaster_device* dev,
-            const uint8_t* key_blob, const size_t key_blob_length);
-
-    /**
-     * Deletes all keys in the hardware keystore. Used when keystore is
-     * reset completely.
-     *
-     * This function is optional and should be set to NULL if it is not
-     * implemented.
-     *
-     * Returns 0 on success or an error code less than 0.
-     */
-    int (*delete_all)(const struct keymaster_device* dev);
-
-    /**
-     * Signs data using a key-blob generated before. This can use either
-     * an asymmetric key or a secret key.
-     *
-     * Returns: 0 on success or an error code less than 0.
-     */
-    int (*sign_data)(const struct keymaster_device* dev,
-            const void* signing_params,
-            const uint8_t* key_blob, const size_t key_blob_length,
-            const uint8_t* data, const size_t data_length,
-            uint8_t** signed_data, size_t* signed_data_length);
-
-    /**
-     * Verifies data signed with a key-blob. This can use either
-     * an asymmetric key or a secret key.
-     *
-     * Returns: 0 on successful verification or an error code less than 0.
-     */
-    int (*verify_data)(const struct keymaster_device* dev,
-            const void* signing_params,
-            const uint8_t* key_blob, const size_t key_blob_length,
-            const uint8_t* signed_data, const size_t signed_data_length,
-            const uint8_t* signature, const size_t signature_length);
-};
-typedef struct keymaster_device keymaster_device_t;
-
-
-/* Convenience API for opening and closing keymaster devices */
-
-static inline int keymaster_open(const struct hw_module_t* module,
-        keymaster_device_t** device)
-{
-    int rc = module->methods->open(module, KEYSTORE_KEYMASTER,
-            (struct hw_device_t**) device);
-
-    return rc;
-}
-
-static inline int keymaster_close(keymaster_device_t* device)
-{
-    return device->common.close(&device->common);
-}
-
-__END_DECLS
-
-#endif  // ANDROID_HARDWARE_KEYMASTER_H
-
diff --git a/include/hardware/keymaster0.h b/include/hardware/keymaster0.h
new file mode 100644
index 0000000..f020e5b
--- /dev/null
+++ b/include/hardware/keymaster0.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2011 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_KEYMASTER_0_H
+#define ANDROID_HARDWARE_KEYMASTER_0_H
+
+#include <hardware/keymaster_common.h>
+
+__BEGIN_DECLS
+
+/**
+ * Keymaster0 device definition.
+ */
+struct keymaster0_device {
+    /**
+     * Common methods of the keymaster device.  This *must* be the first member of
+     * keymaster0_device as users of this structure will cast a hw_device_t to
+     * keymaster0_device pointer in contexts where it's known the hw_device_t references a
+     * keymaster0_device.
+     */
+    struct hw_device_t common;
+
+    /**
+     * THIS IS DEPRECATED. Use the new "module_api_version" and "hal_api_version"
+     * fields in the keymaster_module initialization instead.
+     */
+    uint32_t client_version;
+
+    /**
+     * See flags defined for keymaster0_device::flags in keymaster_common.h
+     */
+    uint32_t flags;
+
+    void* context;
+
+    /**
+     * Generates a public and private key. The key-blob returned is opaque
+     * and must subsequently provided for signing and verification.
+     *
+     * Returns: 0 on success or an error code less than 0.
+     */
+    int (*generate_keypair)(const struct keymaster0_device* dev,
+            const keymaster_keypair_t key_type, const void* key_params,
+            uint8_t** key_blob, size_t* key_blob_length);
+
+    /**
+     * Imports a public and private key pair. The imported keys will be in
+     * PKCS#8 format with DER encoding (Java standard). The key-blob
+     * returned is opaque and will be subsequently provided for signing
+     * and verification.
+     *
+     * Returns: 0 on success or an error code less than 0.
+     */
+    int (*import_keypair)(const struct keymaster0_device* dev,
+            const uint8_t* key, const size_t key_length,
+            uint8_t** key_blob, size_t* key_blob_length);
+
+    /**
+     * Gets the public key part of a key pair. The public key must be in
+     * X.509 format (Java standard) encoded byte array.
+     *
+     * Returns: 0 on success or an error code less than 0.
+     * On error, x509_data should not be allocated.
+     */
+    int (*get_keypair_public)(const struct keymaster0_device* dev,
+            const uint8_t* key_blob, const size_t key_blob_length,
+            uint8_t** x509_data, size_t* x509_data_length);
+
+    /**
+     * Deletes the key pair associated with the key blob.
+     *
+     * This function is optional and should be set to NULL if it is not
+     * implemented.
+     *
+     * Returns 0 on success or an error code less than 0.
+     */
+    int (*delete_keypair)(const struct keymaster0_device* dev,
+            const uint8_t* key_blob, const size_t key_blob_length);
+
+    /**
+     * Deletes all keys in the hardware keystore. Used when keystore is
+     * reset completely.
+     *
+     * This function is optional and should be set to NULL if it is not
+     * implemented.
+     *
+     * Returns 0 on success or an error code less than 0.
+     */
+    int (*delete_all)(const struct keymaster0_device* dev);
+
+    /**
+     * Signs data using a key-blob generated before. This can use either
+     * an asymmetric key or a secret key.
+     *
+     * Returns: 0 on success or an error code less than 0.
+     */
+    int (*sign_data)(const struct keymaster0_device* dev,
+            const void* signing_params,
+            const uint8_t* key_blob, const size_t key_blob_length,
+            const uint8_t* data, const size_t data_length,
+            uint8_t** signed_data, size_t* signed_data_length);
+
+    /**
+     * Verifies data signed with a key-blob. This can use either
+     * an asymmetric key or a secret key.
+     *
+     * Returns: 0 on successful verification or an error code less than 0.
+     */
+    int (*verify_data)(const struct keymaster0_device* dev,
+            const void* signing_params,
+            const uint8_t* key_blob, const size_t key_blob_length,
+            const uint8_t* signed_data, const size_t signed_data_length,
+            const uint8_t* signature, const size_t signature_length);
+};
+typedef struct keymaster0_device keymaster0_device_t;
+
+
+/* Convenience API for opening and closing keymaster devices */
+
+static inline int keymaster0_open(const struct hw_module_t* module,
+        keymaster0_device_t** device)
+{
+    int rc = module->methods->open(module, KEYSTORE_KEYMASTER,
+            (struct hw_device_t**) device);
+
+    return rc;
+}
+
+static inline int keymaster0_close(keymaster0_device_t* device)
+{
+    return device->common.close(&device->common);
+}
+
+__END_DECLS
+
+#endif  // ANDROID_HARDWARE_KEYMASTER_0_H
diff --git a/include/hardware/keymaster1.h b/include/hardware/keymaster1.h
new file mode 100644
index 0000000..afd202c
--- /dev/null
+++ b/include/hardware/keymaster1.h
@@ -0,0 +1,548 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_KEYMASTER1_H
+#define ANDROID_HARDWARE_KEYMASTER1_H
+
+#include <hardware/keymaster_common.h>
+#include <hardware/keymaster_defs.h>
+
+__BEGIN_DECLS
+
+/**
+ * Keymaster1 device definition
+ */
+struct keymaster1_device {
+    /**
+     * Common methods of the keymaster device.  This *must* be the first member of
+     * keymaster_device as users of this structure will cast a hw_device_t to
+     * keymaster_device pointer in contexts where it's known the hw_device_t references a
+     * keymaster_device.
+     */
+    struct hw_device_t common;
+
+    /**
+     * THIS IS DEPRECATED. Use the new "module_api_version" and "hal_api_version"
+     * fields in the keymaster_module initialization instead.
+     */
+    uint32_t client_version;
+
+    /**
+     * See flags defined for keymaster0_devices::flags in keymaster_common.h
+     */
+    uint32_t flags;
+
+    void* context;
+
+    /**
+     * \deprecated Generates a public and private key. The key-blob returned is opaque and must
+     * subsequently provided for signing and verification.
+     *
+     * Returns: 0 on success or an error code less than 0.
+     */
+    int (*generate_keypair)(const struct keymaster1_device* dev, const keymaster_keypair_t key_type,
+                            const void* key_params, uint8_t** key_blob, size_t* key_blob_length);
+
+    /**
+     * \deprecated Imports a public and private key pair. The imported keys will be in PKCS#8 format
+     * with DER encoding (Java standard). The key-blob returned is opaque and will be subsequently
+     * provided for signing and verification.
+     *
+     * Returns: 0 on success or an error code less than 0.
+     */
+    int (*import_keypair)(const struct keymaster1_device* dev, const uint8_t* key,
+                          const size_t key_length, uint8_t** key_blob, size_t* key_blob_length);
+
+    /**
+     * \deprecated Gets the public key part of a key pair. The public key must be in X.509 format
+     * (Java standard) encoded byte array.
+     *
+     * Returns: 0 on success or an error code less than 0.  On error, x509_data
+     * should not be allocated.
+     */
+    int (*get_keypair_public)(const struct keymaster1_device* dev, const uint8_t* key_blob,
+                              const size_t key_blob_length, uint8_t** x509_data,
+                              size_t* x509_data_length);
+
+    /**
+     * \deprecated Deletes the key pair associated with the key blob.
+     *
+     * This function is optional and should be set to NULL if it is not
+     * implemented.
+     *
+     * Returns 0 on success or an error code less than 0.
+     */
+    int (*delete_keypair)(const struct keymaster1_device* dev, const uint8_t* key_blob,
+                          const size_t key_blob_length);
+
+    /**
+     * \deprecated Deletes all keys in the hardware keystore. Used when keystore is reset
+     * completely.
+     *
+     * This function is optional and should be set to NULL if it is not
+     * implemented.
+     *
+     * Returns 0 on success or an error code less than 0.
+     */
+    int (*delete_all)(const struct keymaster1_device* dev);
+
+    /**
+     * \deprecated Signs data using a key-blob generated before. This can use either an asymmetric
+     * key or a secret key.
+     *
+     * Returns: 0 on success or an error code less than 0.
+     */
+    int (*sign_data)(const struct keymaster1_device* dev, const void* signing_params,
+                     const uint8_t* key_blob, const size_t key_blob_length, const uint8_t* data,
+                     const size_t data_length, uint8_t** signed_data, size_t* signed_data_length);
+
+    /**
+     * \deprecated Verifies data signed with a key-blob. This can use either an asymmetric key or a
+     * secret key.
+     *
+     * Returns: 0 on successful verification or an error code less than 0.
+     */
+    int (*verify_data)(const struct keymaster1_device* dev, const void* signing_params,
+                       const uint8_t* key_blob, const size_t key_blob_length,
+                       const uint8_t* signed_data, const size_t signed_data_length,
+                       const uint8_t* signature, const size_t signature_length);
+
+    /**
+     * Gets algorithms supported.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[out] algorithms Array of algorithms supported.  The caller takes ownership of the
+     * array and must free() it.
+     *
+     * \param[out] algorithms_length Length of \p algorithms.
+     */
+    keymaster_error_t (*get_supported_algorithms)(const struct keymaster1_device* dev,
+                                                  keymaster_algorithm_t** algorithms,
+                                                  size_t* algorithms_length);
+
+    /**
+     * Gets the block modes supported for the specified algorithm.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] algorithm The algorithm for which supported modes will be returned.
+     *
+     * \param[out] modes Array of modes supported.  The caller takes ownership of the array and must
+     * free() it.
+     *
+     * \param[out] modes_length Length of \p modes.
+     */
+    keymaster_error_t (*get_supported_block_modes)(const struct keymaster1_device* dev,
+                                                   keymaster_algorithm_t algorithm,
+                                                   keymaster_purpose_t purpose,
+                                                   keymaster_block_mode_t** modes,
+                                                   size_t* modes_length);
+
+    /**
+     * Gets the padding modes supported for the specified algorithm.  Caller assumes ownership of
+     * the allocated array.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] algorithm The algorithm for which supported padding modes will be returned.
+     *
+     * \param[out] modes Array of padding modes supported.  The caller takes ownership of the array
+     * and must free() it.
+     *
+     * \param[out] modes_length Length of \p modes.
+     */
+    keymaster_error_t (*get_supported_padding_modes)(const struct keymaster1_device* dev,
+                                                     keymaster_algorithm_t algorithm,
+                                                     keymaster_purpose_t purpose,
+                                                     keymaster_padding_t** modes,
+                                                     size_t* modes_length);
+
+    /**
+     * Gets the digests supported for the specified algorithm.  Caller assumes ownership of the
+     * allocated array.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] algorithm The algorithm for which supported digests will be returned.
+     *
+     * \param[out] digests Array of digests supported.  The caller takes ownership of the array and
+     * must free() it.
+     *
+     * \param[out] digests_length Length of \p digests.
+     */
+    keymaster_error_t (*get_supported_digests)(const struct keymaster1_device* dev,
+                                               keymaster_algorithm_t algorithm,
+                                               keymaster_purpose_t purpose,
+                                               keymaster_digest_t** digests,
+                                               size_t* digests_length);
+
+    /**
+     * Gets the key import formats supported for keys of the specified algorithm.  Caller assumes
+     * ownership of the allocated array.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] algorithm The algorithm for which supported formats will be returned.
+     *
+     * \param[out] formats Array of formats supported.  The caller takes ownership of the array and
+     * must free() it.
+     *
+     * \param[out] formats_length Length of \p formats.
+     */
+    keymaster_error_t (*get_supported_import_formats)(const struct keymaster1_device* dev,
+                                                      keymaster_algorithm_t algorithm,
+                                                      keymaster_key_format_t** formats,
+                                                      size_t* formats_length);
+
+    /**
+     * Gets the key export formats supported for keys of the specified algorithm.  Caller assumes
+     * ownership of the allocated array.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] algorithm The algorithm for which supported formats will be returned.
+     *
+     * \param[out] formats Array of formats supported.  The caller takes ownership of the array and
+     * must free() it.
+     *
+     * \param[out] formats_length Length of \p formats.
+     */
+    keymaster_error_t (*get_supported_export_formats)(const struct keymaster1_device* dev,
+                                                      keymaster_algorithm_t algorithm,
+                                                      keymaster_key_format_t** formats,
+                                                      size_t* formats_length);
+
+    /**
+     * Adds entropy to the RNG used by keymaster.  Entropy added through this method is guaranteed
+     * not to be the only source of entropy used, and the mixing function is required to be secure,
+     * in the sense that if the RNG is seeded (from any source) with any data the attacker cannot
+     * predict (or control), then the RNG output is indistinguishable from random.  Thus, if the
+     * entropy from any source is good, the output will be good.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] data Random data to be mixed in.
+     *
+     * \param[in] data_length Length of \p data.
+     */
+    keymaster_error_t (*add_rng_entropy)(const struct keymaster1_device* dev, const uint8_t* data,
+                                         size_t data_length);
+
+    /**
+     * Generates a key, or key pair, returning a key blob and/or a description of the key.
+     *
+     * Key generation parameters are defined as keymaster tag/value pairs, provided in \p params.
+     * See keymaster_tag_t for the full list.  Some values that are always required for generation
+     * of useful keys are:
+     *
+     * - KM_TAG_ALGORITHM;
+     * - KM_TAG_PURPOSE; and
+     * - (KM_TAG_USER_SECURE_ID and KM_TAG_USER_AUTH_TYPE) or KM_TAG_NO_AUTH_REQUIRED.
+     *
+     * KM_TAG_AUTH_TIMEOUT should generally be specified unless KM_TAG_NO_AUTH_REQUIRED is present,
+     * or the user will have to authenticate for every use.
+     *
+     * KM_TAG_BLOCK_MODE, KM_TAG_PADDING, KM_TAG_MAC_LENGTH and KM_TAG_DIGEST must be specified for
+     * algorithms that require them.
+     *
+     * The following tags may not be specified; their values will be provided by the implementation.
+     *
+     * - KM_TAG_ORIGIN,
+     * - KM_TAG_ROLLBACK_RESISTANT,
+     * - KM_TAG_CREATION_DATETIME
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] params Array of key generation parameters.
+     *
+     * \param[in] params_count Length of \p params.
+     *
+     * \param[out] key_blob returns the generated key. \p key_blob must not be NULL.  The caller
+     * assumes ownership key_blob->key_material and must free() it.
+     *
+     * \param[out] characteristics returns the characteristics of the key that was, generated, if
+     * non-NULL.  If non-NULL, the caller assumes ownership and must deallocate with
+     * keymaster_free_characteristics().  Note that KM_TAG_ROOT_OF_TRUST, KM_TAG_APPLICATION_ID and
+     * KM_TAG_APPLICATION_DATA are never returned.
+     */
+    keymaster_error_t (*generate_key)(const struct keymaster1_device* dev,
+                                      const keymaster_key_param_set_t* params,
+                                      keymaster_key_blob_t* key_blob,
+                                      keymaster_key_characteristics_t** characteristics);
+
+    /**
+     * Returns the characteristics of the specified key, or KM_ERROR_INVALID_KEY_BLOB if the
+     * key_blob is invalid (implementations must fully validate the integrity of the key).
+     * client_id and app_data must be the ID and data provided when the key was generated or
+     * imported, or empty if KM_TAG_APPLICATION_ID and/or KM_TAG_APPLICATION_DATA were not provided
+     * during generation.  Those values are not included in the returned characteristics.  The
+     * caller assumes ownership of the allocated characteristics object, which must be deallocated
+     * with keymaster_free_characteristics().
+     *
+     * Note that KM_TAG_ROOT_OF_TRUST, KM_TAG_APPLICATION_ID and KM_TAG_APPLICATION_DATA are never
+     * returned.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] key_blob The key to retreive characteristics from.
+     *
+     * \param[in] client_id The client ID data, or NULL if none associated.
+     *
+     * \param[in] app_id The app data, or NULL if none associated.
+     *
+     * \param[out] characteristics The key characteristics.
+     */
+    keymaster_error_t (*get_key_characteristics)(const struct keymaster1_device* dev,
+                                                 const keymaster_key_blob_t* key_blob,
+                                                 const keymaster_blob_t* client_id,
+                                                 const keymaster_blob_t* app_data,
+                                                 keymaster_key_characteristics_t** characteristics);
+
+    /**
+     * Imports a key, or key pair, returning a key blob and/or a description of the key.
+     *
+     * Most key import parameters are defined as keymaster tag/value pairs, provided in "params".
+     * See keymaster_tag_t for the full list.  Values that are always required for import of useful
+     * keys are:
+     *
+     * - KM_TAG_ALGORITHM;
+     * - KM_TAG_PURPOSE; and
+     * - (KM_TAG_USER_SECURE_ID and KM_TAG_USER_AUTH_TYPE) or KM_TAG_NO_AUTH_REQUIRED.
+     *
+     * KM_TAG_AUTH_TIMEOUT should generally be specified. If unspecified, the user will have to
+     * authenticate for every use.
+     *
+     * The following tags will take default values if unspecified:
+     *
+     * - KM_TAG_KEY_SIZE will default to the size of the key provided.
+     * - KM_TAG_RSA_PUBLIC_EXPONENT will default to the value in the key provided (for RSA keys)
+     *
+     * The following tags may not be specified; their values will be provided by the implementation.
+     *
+     * - KM_TAG_ORIGIN,
+     * - KM_TAG_ROLLBACK_RESISTANT,
+     * - KM_TAG_CREATION_DATETIME
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] params Parameters defining the imported key.
+     *
+     * \param[in] params_count The number of entries in \p params.
+     *
+     * \param[in] key_format specifies the format of the key data in key_data.
+     *
+     * \param[out] key_blob Used to return the opaque key blob.  Must be non-NULL.  The caller
+     * assumes ownership of the contained key_material.
+     *
+     * \param[out] characteristics Used to return the characteristics of the imported key.  May be
+     * NULL, in which case no characteristics will be returned.  If non-NULL, the caller assumes
+     * ownership and must deallocate with keymaster_free_characteristics().  Note that
+     * KM_TAG_ROOT_OF_TRUST, KM_TAG_APPLICATION_ID and
+     * KM_TAG_APPLICATION_DATA are never returned.
+     */
+    keymaster_error_t (*import_key)(const struct keymaster1_device* dev,
+                                    const keymaster_key_param_set_t* params,
+                                    keymaster_key_format_t key_format,
+                                    const keymaster_blob_t* key_data,
+                                    keymaster_key_blob_t* key_blob,
+                                    keymaster_key_characteristics_t** characteristics);
+
+    /**
+     * Exports a public key, returning a byte array in the specified format.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] export_format The format to be used for exporting the key.
+     *
+     * \param[in] key_to_export The key to export.
+     *
+     * \param[out] export_data The exported key material.  The caller assumes ownership.
+     *
+     * \param[out] export_data_length The length of \p export_data.
+     */
+    keymaster_error_t (*export_key)(const struct keymaster1_device* dev,
+                                    keymaster_key_format_t export_format,
+                                    const keymaster_key_blob_t* key_to_export,
+                                    const keymaster_blob_t* client_id,
+                                    const keymaster_blob_t* app_data,
+                                    keymaster_blob_t* export_data);
+
+    /**
+     * Deletes the key, or key pair, associated with the key blob.  After calling this function it
+     * will be impossible to use the key for any other operations.  May be applied to keys from
+     * foreign roots of trust (keys not usable under the current root of trust).
+     *
+     * This function is optional and should be set to NULL if it is not implemented.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] key The key to be deleted.
+     */
+    keymaster_error_t (*delete_key)(const struct keymaster1_device* dev,
+                                    const keymaster_key_blob_t* key);
+
+    /**
+     * Deletes all keys in the hardware keystore. Used when keystore is reset completely.  After
+     * calling this function it will be impossible to use any previously generated or imported key
+     * blobs for any operations.
+     *
+     * This function is optional and should be set to NULL if it is not implemented.
+     *
+     * \param[in] dev The keymaster device structure.
+     */
+    keymaster_error_t (*delete_all_keys)(const struct keymaster1_device* dev);
+
+    /**
+     * Begins a cryptographic operation using the specified key.  If all is well, begin() will
+     * return KM_ERROR_OK and create an operation handle which must be passed to subsequent calls to
+     * update(), finish() or abort().
+     *
+     * It is critical that each call to begin() be paired with a subsequent call to finish() or
+     * abort(), to allow the keymaster implementation to clean up any internal operation state.
+     * Failure to do this may leak internal state space or other internal resources and may
+     * eventually cause begin() to return KM_ERROR_TOO_MANY_OPERATIONS when it runs out of space for
+     * operations.  Any result other than KM_ERROR_OK from begin(), update() or finish() implicitly
+     * aborts the operation, in which case abort() need not be called (and will return
+     * KM_ERROR_INVALID_OPERATION_HANDLE if called).
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] purpose The purpose of the operation, one of KM_PURPOSE_ENCRYPT,
+     * KM_PURPOSE_DECRYPT, KM_PURPOSE_SIGN or KM_PURPOSE_VERIFY. Note that for AEAD modes,
+     * encryption and decryption imply signing and verification, respectively, but should be
+     * specified as KM_PURPOSE_ENCRYPT and KM_PURPOSE_DECRYPT.
+     *
+     * \param[in] key The key to be used for the operation. \p key must have a purpose compatible
+     * with \p purpose and all of its usage requirements must be satisfied, or begin() will return
+     * an appropriate error code.
+     *
+     * \param[in] in_params Additional parameters for the operation.  This is typically used to
+     * provide authentication data, with KM_TAG_AUTH_TOKEN.  If KM_TAG_APPLICATION_ID or
+     * KM_TAG_APPLICATION_DATA were provided during generation, they must be provided here, or the
+     * operation will fail with KM_ERROR_INVALID_KEY_BLOB.  For operations that require a nonce or
+     * IV, on keys that were generated with KM_TAG_CALLER_NONCE, in_params may contain a tag
+     * KM_TAG_NONCE.  For AEAD operations KM_TAG_CHUNK_SIZE is specified here.
+     *
+     * \param[out] out_params Output parameters.  Used to return additional data from the operation
+     * initialization, notably to return the IV or nonce from operations that generate an IV or
+     * nonce.  The caller takes ownership of the output parameters array and must free it with
+     * keymaster_free_param_set().  out_params may be set to NULL if no output parameters are
+     * expected.  If out_params is NULL, and output paramaters are generated, begin() will return
+     * KM_ERROR_OUTPUT_PARAMETER_NULL.
+     *
+     * \param[out] operation_handle The newly-created operation handle which must be passed to
+     * update(), finish() or abort().  If operation_handle is NULL, begin() will return
+     * KM_ERROR_OUTPUT_PARAMETER_NULL.
+     */
+    keymaster_error_t (*begin)(const struct keymaster1_device* dev, keymaster_purpose_t purpose,
+                               const keymaster_key_blob_t* key,
+                               const keymaster_key_param_set_t* in_params,
+                               keymaster_key_param_set_t* out_params,
+                               keymaster_operation_handle_t* operation_handle);
+
+    /**
+     * Provides data to, and possibly receives output from, an ongoing cryptographic operation begun
+     * with begin().
+     *
+     * If operation_handle is invalid, update() will return KM_ERROR_INVALID_OPERATION_HANDLE.
+     *
+     * update() may not consume all of the data provided in the data buffer.  update() will return
+     * the amount consumed in *data_consumed.  The caller should provide the unconsumed data in a
+     * subsequent call.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] operation_handle The operation handle returned by begin().
+     *
+     * \param[in] in_params Additional parameters for the operation.  For AEAD modes, this is used
+     * to specify KM_TAG_ADDITIONAL_DATA.  Note that additional data may be provided in multiple
+     * calls to update(), but only until input data has been provided.
+     *
+     * \param[in] input Data to be processed, per the parameters established in the call to begin().
+     * Note that update() may or may not consume all of the data provided.  See \p input_consumed.
+     *
+     * \param[out] input_consumed Amount of data that was consumed by update().  If this is less
+     * than the amount provided, the caller should provide the remainder in a subsequent call to
+     * update().
+     *
+     * \param[out] out_params Output parameters.  Used to return additional data from the operation
+     * The caller takes ownership of the output parameters array and must free it with
+     * keymaster_free_param_set().  out_params may be set to NULL if no output parameters are
+     * expected.  If out_params is NULL, and output paramaters are generated, begin() will return
+     * KM_ERROR_OUTPUT_PARAMETER_NULL.
+     *
+     * \param[out] output The output data, if any.  The caller assumes ownership of the allocated
+     * buffer.  output must not be NULL.
+     *
+     * Note that update() may not provide any output, in which case output->data_length will be
+     * zero, and output->data may be either NULL or zero-length (so the caller should always free()
+     * it).
+     */
+    keymaster_error_t (*update)(const struct keymaster1_device* dev,
+                                keymaster_operation_handle_t operation_handle,
+                                const keymaster_key_param_set_t* in_params,
+                                const keymaster_blob_t* input, size_t* input_consumed,
+                                keymaster_key_param_set_t* out_params, keymaster_blob_t* output);
+
+    /**
+     * Finalizes a cryptographic operation begun with begin() and invalidates \p operation_handle.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] operation_handle The operation handle returned by begin().  This handle will be
+     * invalidated.
+     *
+     * \param[in] params Additional parameters for the operation.  For AEAD modes, this is used to
+     * specify KM_TAG_ADDITIONAL_DATA, but only if no input data was provided to update().
+     *
+     * \param[in] signature The signature to be verified if the purpose specified in the begin()
+     * call was KM_PURPOSE_VERIFY.
+     *
+     * \param[out] output The output data, if any.  The caller assumes ownership of the allocated
+     * buffer.
+     *
+     * If the operation being finished is a signature verification or an AEAD-mode decryption and
+     * verification fails then finish() will return KM_ERROR_VERIFICATION_FAILED.
+     */
+    keymaster_error_t (*finish)(const struct keymaster1_device* dev,
+                                keymaster_operation_handle_t operation_handle,
+                                const keymaster_key_param_set_t* in_params,
+                                const keymaster_blob_t* signature,
+                                keymaster_key_param_set_t* out_params, keymaster_blob_t* output);
+
+    /**
+     * Aborts a cryptographic operation begun with begin(), freeing all internal resources and
+     * invalidating \p operation_handle.
+     */
+    keymaster_error_t (*abort)(const struct keymaster1_device* dev,
+                               keymaster_operation_handle_t operation_handle);
+};
+typedef struct keymaster1_device keymaster1_device_t;
+
+/* Convenience API for opening and closing keymaster devices */
+
+static inline int keymaster1_open(const struct hw_module_t* module, keymaster1_device_t** device) {
+    return module->methods->open(module, KEYSTORE_KEYMASTER, (struct hw_device_t**)device);
+}
+
+static inline int keymaster1_close(keymaster1_device_t* device) {
+    return device->common.close(&device->common);
+}
+
+__END_DECLS
+
+#endif  // ANDROID_HARDWARE_KEYMASTER1_H
diff --git a/include/hardware/keymaster_common.h b/include/hardware/keymaster_common.h
new file mode 100644
index 0000000..772d7e4
--- /dev/null
+++ b/include/hardware/keymaster_common.h
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_KEYMASTER_COMMON_H
+#define ANDROID_HARDWARE_KEYMASTER_COMMON_H
+
+#include <stdint.h>
+#include <sys/cdefs.h>
+#include <sys/types.h>
+
+#include <hardware/hardware.h>
+
+__BEGIN_DECLS
+
+/**
+ * The id of this module
+ */
+#define KEYSTORE_HARDWARE_MODULE_ID "keystore"
+
+#define KEYSTORE_KEYMASTER "keymaster"
+
+
+/**
+ * Settings for "module_api_version" and "hal_api_version"
+ * fields in the keymaster_module initialization.
+ */
+
+/**
+ * Keymaster 0.X module version provide the same APIs, but later versions add more options
+ * for algorithms and flags.
+ */
+#define KEYMASTER_MODULE_API_VERSION_0_2 HARDWARE_MODULE_API_VERSION(0, 2)
+#define KEYMASTER_DEVICE_API_VERSION_0_2 HARDWARE_DEVICE_API_VERSION(0, 2)
+
+#define KEYMASTER_MODULE_API_VERSION_0_3 HARDWARE_MODULE_API_VERSION(0, 3)
+#define KEYMASTER_DEVICE_API_VERSION_0_3 HARDWARE_DEVICE_API_VERSION(0, 3)
+
+/**
+ * Keymaster 1.0 module version provides a completely different API, incompatible with 0.X.
+ */
+#define KEYMASTER_MODULE_API_VERSION_1_0 HARDWARE_MODULE_API_VERSION(1, 0)
+#define KEYMASTER_DEVICE_API_VERSION_1_0 HARDWARE_DEVICE_API_VERSION(1, 0)
+
+struct keystore_module {
+    /**
+     * Common methods of the keystore module.  This *must* be the first member of keystore_module as
+     * users of this structure will cast a hw_module_t to keystore_module pointer in contexts where
+     * it's known the hw_module_t references a keystore_module.
+     */
+    hw_module_t common;
+
+    /* There are no keystore module methods other than the common ones. */
+};
+
+/**
+ * Flags for keymaster0_device::flags
+ */
+enum {
+    /*
+     * Indicates this keymaster implementation does not have hardware that
+     * keeps private keys out of user space.
+     *
+     * This should not be implemented on anything other than the default
+     * implementation.
+     */
+    KEYMASTER_SOFTWARE_ONLY = 1 << 0,
+
+    /*
+     * This indicates that the key blobs returned via all the primitives
+     * are sufficient to operate on their own without the trusted OS
+     * querying userspace to retrieve some other data. Key blobs of
+     * this type are normally returned encrypted with a
+     * Key Encryption Key (KEK).
+     *
+     * This is currently used by "vold" to know whether the whole disk
+     * encryption secret can be unwrapped without having some external
+     * service started up beforehand since the "/data" partition will
+     * be unavailable at that point.
+     */
+    KEYMASTER_BLOBS_ARE_STANDALONE = 1 << 1,
+
+    /*
+     * Indicates that the keymaster module supports DSA keys.
+     */
+    KEYMASTER_SUPPORTS_DSA = 1 << 2,
+
+    /*
+     * Indicates that the keymaster module supports EC keys.
+     */
+    KEYMASTER_SUPPORTS_EC = 1 << 3,
+};
+
+/**
+ * Asymmetric key pair types.
+ */
+typedef enum {
+    TYPE_RSA = 1,
+    TYPE_DSA = 2,
+    TYPE_EC = 3,
+} keymaster_keypair_t;
+
+/**
+ * Parameters needed to generate an RSA key.
+ */
+typedef struct {
+    uint32_t modulus_size;
+    uint64_t public_exponent;
+} keymaster_rsa_keygen_params_t;
+
+/**
+ * Parameters needed to generate a DSA key.
+ */
+typedef struct {
+    uint32_t key_size;
+    uint32_t generator_len;
+    uint32_t prime_p_len;
+    uint32_t prime_q_len;
+    const uint8_t* generator;
+    const uint8_t* prime_p;
+    const uint8_t* prime_q;
+} keymaster_dsa_keygen_params_t;
+
+/**
+ * Parameters needed to generate an EC key.
+ *
+ * Field size is the only parameter in version 2. The sizes correspond to these required curves:
+ *
+ * 192 = NIST P-192
+ * 224 = NIST P-224
+ * 256 = NIST P-256
+ * 384 = NIST P-384
+ * 521 = NIST P-521
+ *
+ * The parameters for these curves are available at: http://www.nsa.gov/ia/_files/nist-routines.pdf
+ * in Chapter 4.
+ */
+typedef struct {
+    uint32_t field_size;
+} keymaster_ec_keygen_params_t;
+
+
+/**
+ * Digest type.
+ */
+typedef enum {
+    DIGEST_NONE,
+} keymaster_digest_algorithm_t;
+
+/**
+ * Type of padding used for RSA operations.
+ */
+typedef enum {
+    PADDING_NONE,
+} keymaster_rsa_padding_t;
+
+
+typedef struct {
+    keymaster_digest_algorithm_t digest_type;
+} keymaster_dsa_sign_params_t;
+
+typedef struct {
+    keymaster_digest_algorithm_t digest_type;
+} keymaster_ec_sign_params_t;
+
+typedef struct {
+    keymaster_digest_algorithm_t digest_type;
+    keymaster_rsa_padding_t padding_type;
+} keymaster_rsa_sign_params_t;
+
+__END_DECLS
+
+#endif  // ANDROID_HARDWARE_KEYMASTER_COMMON_H
diff --git a/include/hardware/keymaster_defs.h b/include/hardware/keymaster_defs.h
new file mode 100644
index 0000000..5be956d
--- /dev/null
+++ b/include/hardware/keymaster_defs.h
@@ -0,0 +1,518 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_KEYMASTER_DEFS_H
+#define ANDROID_HARDWARE_KEYMASTER_DEFS_H
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif  // __cplusplus
+
+/**
+ * Authorization tags each have an associated type.  This enumeration facilitates tagging each with
+ * a type, by using the high four bits (of an implied 32-bit unsigned enum value) to specify up to
+ * 16 data types.  These values are ORed with tag IDs to generate the final tag ID values.
+ */
+typedef enum {
+    KM_INVALID = 0 << 28, /* Invalid type, used to designate a tag as uninitialized */
+    KM_ENUM = 1 << 28,
+    KM_ENUM_REP = 2 << 28, /* Repeatable enumeration value. */
+    KM_UINT = 3 << 28,
+    KM_UINT_REP = 4 << 28, /* Repeatable integer value */
+    KM_ULONG = 5 << 28,
+    KM_DATE = 6 << 28,
+    KM_BOOL = 7 << 28,
+    KM_BIGNUM = 8 << 28,
+    KM_BYTES = 9 << 28,
+    KM_ULONG_REP = 10 << 28, /* Repeatable long value */
+} keymaster_tag_type_t;
+
+typedef enum {
+    KM_TAG_INVALID = KM_INVALID | 0,
+
+    /*
+     * Tags that must be semantically enforced by hardware and software implementations.
+     */
+
+    /* Crypto parameters */
+    KM_TAG_PURPOSE = KM_ENUM_REP | 1,     /* keymaster_purpose_t. */
+    KM_TAG_ALGORITHM = KM_ENUM | 2,       /* keymaster_algorithm_t. */
+    KM_TAG_KEY_SIZE = KM_UINT | 3,        /* Key size in bits. */
+    KM_TAG_BLOCK_MODE = KM_ENUM_REP | 4,  /* keymaster_block_mode_t. */
+    KM_TAG_DIGEST = KM_ENUM_REP | 5,      /* keymaster_digest_t. */
+    KM_TAG_PADDING = KM_ENUM_REP | 6,     /* keymaster_padding_t. */
+    KM_TAG_CALLER_NONCE = KM_BOOL | 7,    /* Allow caller to specify nonce or IV. */
+    KM_TAG_MIN_MAC_LENGTH = KM_UINT | 8,  /* Minimum length of MAC or AEAD authentication tag in
+                                           * bits. */
+
+    /* Algorithm-specific. */
+    KM_TAG_RSA_PUBLIC_EXPONENT = KM_ULONG | 200,
+
+    /* Other hardware-enforced. */
+    KM_TAG_BLOB_USAGE_REQUIREMENTS = KM_ENUM | 301, /* keymaster_key_blob_usage_requirements_t */
+    KM_TAG_BOOTLOADER_ONLY = KM_BOOL | 302,         /* Usable only by bootloader */
+
+    /*
+     * Tags that should be semantically enforced by hardware if possible and will otherwise be
+     * enforced by software (keystore).
+     */
+
+    /* Key validity period */
+    KM_TAG_ACTIVE_DATETIME = KM_DATE | 400,             /* Start of validity */
+    KM_TAG_ORIGINATION_EXPIRE_DATETIME = KM_DATE | 401, /* Date when new "messages" should no
+                                                           longer be created. */
+    KM_TAG_USAGE_EXPIRE_DATETIME = KM_DATE | 402,       /* Date when existing "messages" should no
+                                                           longer be trusted. */
+    KM_TAG_MIN_SECONDS_BETWEEN_OPS = KM_UINT | 403,     /* Minimum elapsed time between
+                                                           cryptographic operations with the key. */
+    KM_TAG_MAX_USES_PER_BOOT = KM_UINT | 404,           /* Number of times the key can be used per
+                                                           boot. */
+
+    /* User authentication */
+    KM_TAG_ALL_USERS = KM_BOOL | 500,           /* Reserved for future use -- ignore */
+    KM_TAG_USER_ID = KM_UINT | 501,             /* Reserved for future use -- ignore */
+    KM_TAG_USER_SECURE_ID = KM_ULONG_REP | 502, /* Secure ID of authorized user or authenticator(s).
+                                                   Disallowed if KM_TAG_ALL_USERS or
+                                                   KM_TAG_NO_AUTH_REQUIRED is present. */
+    KM_TAG_NO_AUTH_REQUIRED = KM_BOOL | 503,    /* If key is usable without authentication. */
+    KM_TAG_USER_AUTH_TYPE = KM_ENUM | 504,      /* Bitmask of authenticator types allowed when
+                                                 * KM_TAG_USER_SECURE_ID contains a secure user ID,
+                                                 * rather than a secure authenticator ID.  Defined in
+                                                 * hw_authenticator_type_t in hw_auth_token.h. */
+    KM_TAG_AUTH_TIMEOUT = KM_UINT | 505,        /* Required freshness of user authentication for
+                                                   private/secret key operations, in seconds.
+                                                   Public key operations require no authentication.
+                                                   If absent, authentication is required for every
+                                                   use.  Authentication state is lost when the
+                                                   device is powered off. */
+
+    /* Application access control */
+    KM_TAG_ALL_APPLICATIONS = KM_BOOL | 600, /* Reserved for future use -- ignore */
+    KM_TAG_APPLICATION_ID = KM_BYTES | 601,  /* Reserved for fugure use -- ignore */
+
+    /*
+     * Semantically unenforceable tags, either because they have no specific meaning or because
+     * they're informational only.
+     */
+    KM_TAG_APPLICATION_DATA = KM_BYTES | 700,  /* Data provided by authorized application. */
+    KM_TAG_CREATION_DATETIME = KM_DATE | 701,  /* Key creation time */
+    KM_TAG_ORIGIN = KM_ENUM | 702,             /* keymaster_key_origin_t. */
+    KM_TAG_ROLLBACK_RESISTANT = KM_BOOL | 703, /* Whether key is rollback-resistant. */
+    KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704,     /* Root of trust ID. */
+
+    /* Tags used only to provide data to or receive data from operations */
+    KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000, /* Used to provide associated data for AEAD modes. */
+    KM_TAG_NONCE = KM_BYTES | 1001,           /* Nonce or Initialization Vector */
+    KM_TAG_AUTH_TOKEN = KM_BYTES | 1002,      /* Authentication token that proves secure user
+                                                 authentication has been performed.  Structure
+                                                 defined in hw_auth_token_t in hw_auth_token.h. */
+    KM_TAG_MAC_LENGTH = KM_UINT | 1003,       /* MAC or AEAD authentication tag length in bits. */
+} keymaster_tag_t;
+
+/**
+ * Algorithms that may be provided by keymaster implementations.  Those that must be provided by all
+ * implementations are tagged as "required".
+ */
+typedef enum {
+    /* Asymmetric algorithms. */
+    KM_ALGORITHM_RSA = 1,
+    // KM_ALGORITHM_DSA = 2, -- Removed, do not re-use value 2.
+    KM_ALGORITHM_EC = 3,
+
+    /* Block ciphers algorithms */
+    KM_ALGORITHM_AES = 32,
+
+    /* MAC algorithms */
+    KM_ALGORITHM_HMAC = 128,
+} keymaster_algorithm_t;
+
+/**
+ * Symmetric block cipher modes provided by keymaster implementations.
+ */
+typedef enum {
+    /* Unauthenticated modes, usable only for encryption/decryption and not generally recommended
+     * except for compatibility with existing other protocols. */
+    KM_MODE_ECB = 1,
+    KM_MODE_CBC = 2,
+    KM_MODE_CTR = 3,
+
+    /* Authenticated modes, usable for encryption/decryption and signing/verification.  Recommended
+     * over unauthenticated modes for all purposes. */
+    KM_MODE_GCM = 32,
+} keymaster_block_mode_t;
+
+/**
+ * Padding modes that may be applied to plaintext for encryption operations.  This list includes
+ * padding modes for both symmetric and asymmetric algorithms.  Note that implementations should not
+ * provide all possible combinations of algorithm and padding, only the
+ * cryptographically-appropriate pairs.
+ */
+typedef enum {
+    KM_PAD_NONE = 1, /* deprecated */
+    KM_PAD_RSA_OAEP = 2,
+    KM_PAD_RSA_PSS = 3,
+    KM_PAD_RSA_PKCS1_1_5_ENCRYPT = 4,
+    KM_PAD_RSA_PKCS1_1_5_SIGN = 5,
+    KM_PAD_PKCS7 = 64,
+} keymaster_padding_t;
+
+/**
+ * Digests provided by keymaster implementations.
+ */
+typedef enum {
+    KM_DIGEST_NONE = 0,
+    KM_DIGEST_MD5 = 1, /* Optional, may not be implemented in hardware, will be handled in software
+                        * if needed. */
+    KM_DIGEST_SHA1 = 2,
+    KM_DIGEST_SHA_2_224 = 3,
+    KM_DIGEST_SHA_2_256 = 4,
+    KM_DIGEST_SHA_2_384 = 5,
+    KM_DIGEST_SHA_2_512 = 6,
+} keymaster_digest_t;
+
+/**
+ * The origin of a key (or pair), i.e. where it was generated.  Note that KM_TAG_ORIGIN can be found
+ * in either the hardware-enforced or software-enforced list for a key, indicating whether the key
+ * is hardware or software-based.  Specifically, a key with KM_ORIGIN_GENERATED in the
+ * hardware-enforced list is guaranteed never to have existed outide the secure hardware.
+ */
+typedef enum {
+    KM_ORIGIN_GENERATED = 0, /* Generated in keymaster */
+    KM_ORIGIN_IMPORTED = 2,  /* Imported, origin unknown */
+    KM_ORIGIN_UNKNOWN = 3,   /* Keymaster did not record origin.  This value can only be seen on
+                              * keys in a keymaster0 implementation.  The keymaster0 adapter uses
+                              * this value to document the fact that it is unkown whether the key
+                              * was generated inside or imported into keymaster. */
+} keymaster_key_origin_t;
+
+/**
+ * Usability requirements of key blobs.  This defines what system functionality must be available
+ * for the key to function.  For example, key "blobs" which are actually handles referencing
+ * encrypted key material stored in the file system cannot be used until the file system is
+ * available, and should have BLOB_REQUIRES_FILE_SYSTEM.  Other requirements entries will be added
+ * as needed for implementations.  This type is new in 0_4.
+ */
+typedef enum {
+    KM_BLOB_STANDALONE = 0,
+    KM_BLOB_REQUIRES_FILE_SYSTEM = 1,
+} keymaster_key_blob_usage_requirements_t;
+
+/**
+ * Possible purposes of a key (or pair). This type is new in 0_4.
+ */
+typedef enum {
+    KM_PURPOSE_ENCRYPT = 0,
+    KM_PURPOSE_DECRYPT = 1,
+    KM_PURPOSE_SIGN = 2,
+    KM_PURPOSE_VERIFY = 3,
+} keymaster_purpose_t;
+
+typedef struct {
+    const uint8_t* data;
+    size_t data_length;
+} keymaster_blob_t;
+
+typedef struct {
+    keymaster_tag_t tag;
+    union {
+        uint32_t enumerated;   /* KM_ENUM and KM_ENUM_REP */
+        bool boolean;          /* KM_BOOL */
+        uint32_t integer;      /* KM_INT and KM_INT_REP */
+        uint64_t long_integer; /* KM_LONG */
+        uint64_t date_time;    /* KM_DATE */
+        keymaster_blob_t blob; /* KM_BIGNUM and KM_BYTES*/
+    };
+} keymaster_key_param_t;
+
+typedef struct {
+    keymaster_key_param_t* params; /* may be NULL if length == 0 */
+    size_t length;
+} keymaster_key_param_set_t;
+
+/**
+ * Parameters that define a key's characteristics, including authorized modes of usage and access
+ * control restrictions.  The parameters are divided into two categories, those that are enforced by
+ * secure hardware, and those that are not.  For a software-only keymaster implementation the
+ * enforced array must NULL.  Hardware implementations must enforce everything in the enforced
+ * array.
+ */
+typedef struct {
+    keymaster_key_param_set_t hw_enforced;
+    keymaster_key_param_set_t sw_enforced;
+} keymaster_key_characteristics_t;
+
+typedef struct {
+    const uint8_t* key_material;
+    size_t key_material_size;
+} keymaster_key_blob_t;
+
+/**
+ * Formats for key import and export.  At present, only asymmetric key import/export is supported.
+ * In the future this list will expand greatly to accommodate asymmetric key import/export.
+ */
+typedef enum {
+    KM_KEY_FORMAT_X509 = 0,  /* for public key export */
+    KM_KEY_FORMAT_PKCS8 = 1, /* for asymmetric key pair import */
+    KM_KEY_FORMAT_RAW = 3,   /* for symmetric key import */
+} keymaster_key_format_t;
+
+/**
+ * The keymaster operation API consists of begin, update, finish and abort. This is the type of the
+ * handle used to tie the sequence of calls together.  A 64-bit value is used because it's important
+ * that handles not be predictable.  Implementations must use strong random numbers for handle
+ * values.
+ */
+typedef uint64_t keymaster_operation_handle_t;
+
+typedef enum {
+    KM_ERROR_OK = 0,
+    KM_ERROR_ROOT_OF_TRUST_ALREADY_SET = -1,
+    KM_ERROR_UNSUPPORTED_PURPOSE = -2,
+    KM_ERROR_INCOMPATIBLE_PURPOSE = -3,
+    KM_ERROR_UNSUPPORTED_ALGORITHM = -4,
+    KM_ERROR_INCOMPATIBLE_ALGORITHM = -5,
+    KM_ERROR_UNSUPPORTED_KEY_SIZE = -6,
+    KM_ERROR_UNSUPPORTED_BLOCK_MODE = -7,
+    KM_ERROR_INCOMPATIBLE_BLOCK_MODE = -8,
+    KM_ERROR_UNSUPPORTED_MAC_LENGTH = -9,
+    KM_ERROR_UNSUPPORTED_PADDING_MODE = -10,
+    KM_ERROR_INCOMPATIBLE_PADDING_MODE = -11,
+    KM_ERROR_UNSUPPORTED_DIGEST = -12,
+    KM_ERROR_INCOMPATIBLE_DIGEST = -13,
+    KM_ERROR_INVALID_EXPIRATION_TIME = -14,
+    KM_ERROR_INVALID_USER_ID = -15,
+    KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT = -16,
+    KM_ERROR_UNSUPPORTED_KEY_FORMAT = -17,
+    KM_ERROR_INCOMPATIBLE_KEY_FORMAT = -18,
+    KM_ERROR_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = -19,   /* For PKCS8 & PKCS12 */
+    KM_ERROR_UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = -20, /* For PKCS8 & PKCS12 */
+    KM_ERROR_INVALID_INPUT_LENGTH = -21,
+    KM_ERROR_KEY_EXPORT_OPTIONS_INVALID = -22,
+    KM_ERROR_DELEGATION_NOT_ALLOWED = -23,
+    KM_ERROR_KEY_NOT_YET_VALID = -24,
+    KM_ERROR_KEY_EXPIRED = -25,
+    KM_ERROR_KEY_USER_NOT_AUTHENTICATED = -26,
+    KM_ERROR_OUTPUT_PARAMETER_NULL = -27,
+    KM_ERROR_INVALID_OPERATION_HANDLE = -28,
+    KM_ERROR_INSUFFICIENT_BUFFER_SPACE = -29,
+    KM_ERROR_VERIFICATION_FAILED = -30,
+    KM_ERROR_TOO_MANY_OPERATIONS = -31,
+    KM_ERROR_UNEXPECTED_NULL_POINTER = -32,
+    KM_ERROR_INVALID_KEY_BLOB = -33,
+    KM_ERROR_IMPORTED_KEY_NOT_ENCRYPTED = -34,
+    KM_ERROR_IMPORTED_KEY_DECRYPTION_FAILED = -35,
+    KM_ERROR_IMPORTED_KEY_NOT_SIGNED = -36,
+    KM_ERROR_IMPORTED_KEY_VERIFICATION_FAILED = -37,
+    KM_ERROR_INVALID_ARGUMENT = -38,
+    KM_ERROR_UNSUPPORTED_TAG = -39,
+    KM_ERROR_INVALID_TAG = -40,
+    KM_ERROR_MEMORY_ALLOCATION_FAILED = -41,
+    KM_ERROR_IMPORT_PARAMETER_MISMATCH = -44,
+    KM_ERROR_SECURE_HW_ACCESS_DENIED = -45,
+    KM_ERROR_OPERATION_CANCELLED = -46,
+    KM_ERROR_CONCURRENT_ACCESS_CONFLICT = -47,
+    KM_ERROR_SECURE_HW_BUSY = -48,
+    KM_ERROR_SECURE_HW_COMMUNICATION_FAILED = -49,
+    KM_ERROR_UNSUPPORTED_EC_FIELD = -50,
+    KM_ERROR_MISSING_NONCE = -51,
+    KM_ERROR_INVALID_NONCE = -52,
+    KM_ERROR_MISSING_MAC_LENGTH = -53,
+    KM_ERROR_KEY_RATE_LIMIT_EXCEEDED = -54,
+    KM_ERROR_CALLER_NONCE_PROHIBITED = -55,
+    KM_ERROR_KEY_MAX_OPS_EXCEEDED = -56,
+    KM_ERROR_INVALID_MAC_LENGTH = -57,
+    KM_ERROR_MISSING_MIN_MAC_LENGTH = -58,
+    KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH = -59,
+
+    KM_ERROR_UNIMPLEMENTED = -100,
+    KM_ERROR_VERSION_MISMATCH = -101,
+
+    /* Additional error codes may be added by implementations, but implementers should coordinate
+     * with Google to avoid code collision. */
+    KM_ERROR_UNKNOWN_ERROR = -1000,
+} keymaster_error_t;
+
+/* Convenience functions for manipulating keymaster tag types */
+
+static inline keymaster_tag_type_t keymaster_tag_get_type(keymaster_tag_t tag) {
+    return (keymaster_tag_type_t)(tag & (0xF << 28));
+}
+
+static inline uint32_t keymaster_tag_mask_type(keymaster_tag_t tag) {
+    return tag & 0x0FFFFFFF;
+}
+
+static inline bool keymaster_tag_type_repeatable(keymaster_tag_type_t type) {
+    switch (type) {
+    case KM_UINT_REP:
+    case KM_ENUM_REP:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static inline bool keymaster_tag_repeatable(keymaster_tag_t tag) {
+    return keymaster_tag_type_repeatable(keymaster_tag_get_type(tag));
+}
+
+/* Convenience functions for manipulating keymaster_key_param_t structs */
+
+inline keymaster_key_param_t keymaster_param_enum(keymaster_tag_t tag, uint32_t value) {
+    // assert(keymaster_tag_get_type(tag) == KM_ENUM || keymaster_tag_get_type(tag) == KM_ENUM_REP);
+    keymaster_key_param_t param;
+    memset(&param, 0, sizeof(param));
+    param.tag = tag;
+    param.enumerated = value;
+    return param;
+}
+
+inline keymaster_key_param_t keymaster_param_int(keymaster_tag_t tag, uint32_t value) {
+    // assert(keymaster_tag_get_type(tag) == KM_INT || keymaster_tag_get_type(tag) == KM_INT_REP);
+    keymaster_key_param_t param;
+    memset(&param, 0, sizeof(param));
+    param.tag = tag;
+    param.integer = value;
+    return param;
+}
+
+inline keymaster_key_param_t keymaster_param_long(keymaster_tag_t tag, uint64_t value) {
+    // assert(keymaster_tag_get_type(tag) == KM_LONG);
+    keymaster_key_param_t param;
+    memset(&param, 0, sizeof(param));
+    param.tag = tag;
+    param.long_integer = value;
+    return param;
+}
+
+inline keymaster_key_param_t keymaster_param_blob(keymaster_tag_t tag, const uint8_t* bytes,
+                                                  size_t bytes_len) {
+    // assert(keymaster_tag_get_type(tag) == KM_BYTES || keymaster_tag_get_type(tag) == KM_BIGNUM);
+    keymaster_key_param_t param;
+    memset(&param, 0, sizeof(param));
+    param.tag = tag;
+    param.blob.data = (uint8_t*)bytes;
+    param.blob.data_length = bytes_len;
+    return param;
+}
+
+inline keymaster_key_param_t keymaster_param_bool(keymaster_tag_t tag) {
+    // assert(keymaster_tag_get_type(tag) == KM_BOOL);
+    keymaster_key_param_t param;
+    memset(&param, 0, sizeof(param));
+    param.tag = tag;
+    param.boolean = true;
+    return param;
+}
+
+inline keymaster_key_param_t keymaster_param_date(keymaster_tag_t tag, uint64_t value) {
+    // assert(keymaster_tag_get_type(tag) == KM_DATE);
+    keymaster_key_param_t param;
+    memset(&param, 0, sizeof(param));
+    param.tag = tag;
+    param.date_time = value;
+    return param;
+}
+
+#define KEYMASTER_SIMPLE_COMPARE(a, b) (a < b) ? -1 : ((a > b) ? 1 : 0)
+inline int keymaster_param_compare(const keymaster_key_param_t* a, const keymaster_key_param_t* b) {
+    int retval = KEYMASTER_SIMPLE_COMPARE(a->tag, b->tag);
+    if (retval != 0)
+        return retval;
+
+    switch (keymaster_tag_get_type(a->tag)) {
+    case KM_INVALID:
+    case KM_BOOL:
+        return 0;
+    case KM_ENUM:
+    case KM_ENUM_REP:
+        return KEYMASTER_SIMPLE_COMPARE(a->enumerated, b->enumerated);
+    case KM_UINT:
+    case KM_UINT_REP:
+        return KEYMASTER_SIMPLE_COMPARE(a->integer, b->integer);
+    case KM_ULONG:
+    case KM_ULONG_REP:
+        return KEYMASTER_SIMPLE_COMPARE(a->long_integer, b->long_integer);
+    case KM_DATE:
+        return KEYMASTER_SIMPLE_COMPARE(a->date_time, b->date_time);
+    case KM_BIGNUM:
+    case KM_BYTES:
+        // Handle the empty cases.
+        if (a->blob.data_length != 0 && b->blob.data_length == 0)
+            return -1;
+        if (a->blob.data_length == 0 && b->blob.data_length == 0)
+            return 0;
+        if (a->blob.data_length == 0 && b->blob.data_length > 0)
+            return 1;
+
+        retval = memcmp(a->blob.data, b->blob.data, a->blob.data_length < b->blob.data_length
+                                                        ? a->blob.data_length
+                                                        : b->blob.data_length);
+        if (retval != 0)
+            return retval;
+        else if (a->blob.data_length != b->blob.data_length) {
+            // Equal up to the common length; longer one is larger.
+            if (a->blob.data_length < b->blob.data_length)
+                return -1;
+            if (a->blob.data_length > b->blob.data_length)
+                return 1;
+        };
+    }
+
+    return 0;
+}
+#undef KEYMASTER_SIMPLE_COMPARE
+
+inline void keymaster_free_param_values(keymaster_key_param_t* param, size_t param_count) {
+    while (param_count-- > 0) {
+        switch (keymaster_tag_get_type(param->tag)) {
+        case KM_BIGNUM:
+        case KM_BYTES:
+            free((void*)param->blob.data);
+            param->blob.data = NULL;
+            break;
+        default:
+            // NOP
+            break;
+        }
+        ++param;
+    }
+}
+
+inline void keymaster_free_param_set(keymaster_key_param_set_t* set) {
+    if (set) {
+        keymaster_free_param_values(set->params, set->length);
+        free(set->params);
+        set->params = NULL;
+    }
+}
+
+inline void keymaster_free_characteristics(keymaster_key_characteristics_t* characteristics) {
+    if (characteristics) {
+        keymaster_free_param_set(&characteristics->hw_enforced);
+        keymaster_free_param_set(&characteristics->sw_enforced);
+    }
+}
+
+#ifdef __cplusplus
+}  // extern "C"
+#endif  // __cplusplus
+
+#endif  // ANDROID_HARDWARE_KEYMASTER_DEFS_H
diff --git a/include/hardware/local_time_hal.h b/include/hardware/local_time_hal.h
index 6b6a317..946e799 100644
--- a/include/hardware/local_time_hal.h
+++ b/include/hardware/local_time_hal.h
@@ -55,6 +55,12 @@
 };
 
 struct local_time_hw_device {
+    /**
+     * Common methods of the local time hardware device.  This *must* be the first member of
+     * local_time_hw_device as users of this structure will cast a hw_device_t to
+     * local_time_hw_device pointer in contexts where it's known the hw_device_t references a
+     * local_time_hw_device.
+     */
     struct hw_device_t common;
 
     /**
diff --git a/include/hardware/nfc.h b/include/hardware/nfc.h
index 09523b3..58d33d9 100644
--- a/include/hardware/nfc.h
+++ b/include/hardware/nfc.h
@@ -53,12 +53,19 @@
  * 9) Core NCI stack calls close()
  */
 #define NFC_NCI_HARDWARE_MODULE_ID "nfc_nci"
+#define NFC_NCI_BCM2079X_HARDWARE_MODULE_ID "nfc_nci.bcm2079x"
 #define NFC_NCI_CONTROLLER "nci"
 
 /*
  *  nfc_nci_module_t should contain module-specific parameters
  */
 typedef struct nfc_nci_module_t {
+    /**
+     * Common methods of the NFC NCI module.  This *must* be the first member of
+     * nfc_nci_module_t as users of this structure will cast a hw_module_t to
+     * nfc_nci_module_t pointer in contexts where it's known the hw_module_t references a
+     * nfc_nci_module_t.
+     */
     struct hw_module_t common;
 } nfc_nci_module_t;
 
@@ -108,6 +115,12 @@
  * All methods in the NCI HAL are asynchronous.
  */
 typedef struct nfc_nci_device {
+    /**
+     * Common methods of the NFC NCI device.  This *must* be the first member of
+     * nfc_nci_device_t as users of this structure will cast a hw_device_t to
+     * nfc_nci_device_t pointer in contexts where it's known the hw_device_t references a
+     * nfc_nci_device_t.
+     */
     struct hw_device_t common;
     /*
      * (*open)() Opens the NFC controller device and performs initialization.
@@ -210,6 +223,12 @@
 #define NFC_PN544_CONTROLLER "pn544"
 
 typedef struct nfc_module_t {
+    /**
+     * Common methods of the NFC NXP PN544 module.  This *must* be the first member of
+     * nfc_module_t as users of this structure will cast a hw_module_t to
+     * nfc_module_t pointer in contexts where it's known the hw_module_t references a
+     * nfc_module_t.
+     */
     struct hw_module_t common;
 } nfc_module_t;
 
@@ -227,6 +246,12 @@
 } nfc_pn544_linktype;
 
 typedef struct {
+    /**
+     * Common methods of the NFC NXP PN544 device.  This *must* be the first member of
+     * nfc_pn544_device_t as users of this structure will cast a hw_device_t to
+     * nfc_pn544_device_t pointer in contexts where it's known the hw_device_t references a
+     * nfc_pn544_device_t.
+     */
     struct hw_device_t common;
 
     /* The number of EEPROM registers to write */
diff --git a/include/hardware/nfc_tag.h b/include/hardware/nfc_tag.h
new file mode 100644
index 0000000..040a07d
--- /dev/null
+++ b/include/hardware/nfc_tag.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_NFC_TAG_HAL_INTERFACE_H
+#define ANDROID_NFC_TAG_HAL_INTERFACE_H
+
+#include <stdint.h>
+
+#include <hardware/hardware.h>
+
+__BEGIN_DECLS
+
+/*
+ * HAL for programmable NFC tags.
+ *
+ */
+
+#define NFC_TAG_HARDWARE_MODULE_ID "nfc_tag"
+#define NFC_TAG_ID "tag"
+
+typedef struct nfc_tag_module_t {
+    /**
+     * Common methods of the NFC tag module.  This *must* be the first member of
+     * nfc_tag_module_t as users of this structure will cast a hw_module_t to
+     * nfc_tag_module_t pointer in contexts where it's known the hw_module_t references a
+     * nfc_tag_module_t.
+     */
+    struct hw_module_t common;
+} nfc_tag_module_t;
+
+typedef struct nfc_tag_device {
+    /**
+     * Common methods of the NFC tag device.  This *must* be the first member of
+     * nfc_tag_device_t as users of this structure will cast a hw_device_t to
+     * nfc_tag_device_t pointer in contexts where it's known the hw_device_t references a
+     * nfc_tag_device_t.
+     */
+    struct hw_device_t common;
+
+    /**
+     * Initialize the NFC tag.
+     *
+     * The driver must:
+     *   * Set the static lock bytes to read only
+     *   * Configure the Capability Container to disable write acess
+     *         eg: 0xE1 0x10 <size> 0x0F
+     *
+     * This function is called once before any calls to setContent().
+     *
+     * Return 0 on success or -errno on error.
+     */
+    int (*init)(const struct nfc_tag_device *dev);
+
+    /**
+     * Set the NFC tag content.
+     *
+     * The driver must write <data> in the data area of the tag starting at
+     * byte 0 of block 4 and zero the rest of the data area.
+     *
+     * Returns 0 on success or -errno on error.
+     */
+    int (*setContent)(const struct nfc_tag_device *dev, const uint8_t *data, size_t len);
+
+    /**
+     * Returns the memory size of the data area.
+     */
+    int (*getMemorySize)(const struct nfc_tag_device *dev);
+} nfc_tag_device_t;
+
+static inline int nfc_tag_open(const struct hw_module_t* module,
+                               nfc_tag_device_t** dev) {
+    return module->methods->open(module, NFC_TAG_ID,
+                                 (struct hw_device_t**)dev);
+}
+
+static inline int nfc_tag_close(nfc_tag_device_t* dev) {
+    return dev->common.close(&dev->common);
+}
+
+__END_DECLS
+
+#endif // ANDROID_NFC_TAG_HAL_INTERFACE_H
diff --git a/include/hardware/power.h b/include/hardware/power.h
index 89d57ed..10612f3 100644
--- a/include/hardware/power.h
+++ b/include/hardware/power.h
@@ -27,6 +27,7 @@
 
 #define POWER_MODULE_API_VERSION_0_1  HARDWARE_MODULE_API_VERSION(0, 1)
 #define POWER_MODULE_API_VERSION_0_2  HARDWARE_MODULE_API_VERSION(0, 2)
+#define POWER_MODULE_API_VERSION_0_3  HARDWARE_MODULE_API_VERSION(0, 3)
 
 /**
  * The id of this module
@@ -44,9 +45,14 @@
      * KLP.
      */
     POWER_HINT_VIDEO_ENCODE = 0x00000003,
-    POWER_HINT_VIDEO_DECODE = 0x00000004
+    POWER_HINT_VIDEO_DECODE = 0x00000004,
+    POWER_HINT_LOW_POWER = 0x00000005
 } power_hint_t;
 
+typedef enum {
+    POWER_FEATURE_DOUBLE_TAP_TO_WAKE = 0x00000001
+} feature_t;
+
 /**
  * Every hardware module must have a data structure named HAL_MODULE_INFO_SYM
  * and the fields of this data structure must begin with hw_module_t
@@ -110,7 +116,15 @@
      *     User is interacting with the device, for example, touchscreen
      *     events are incoming.  CPU and GPU load may be expected soon,
      *     and it may be appropriate to raise speeds of CPU, memory bus,
-     *     etc.  The data parameter is unused.
+     *     etc.  The data parameter is the estimated length of the interaction
+     *     in milliseconds, or 0 if unknown.
+     *
+     * POWER_HINT_LOW_POWER
+     *
+     *     Low power mode is activated or deactivated. Low power mode
+     *     is intended to save battery at the cost of performance. The data
+     *     parameter is non-zero when low power mode is activated, and zero
+     *     when deactivated.
      *
      * A particular platform may choose to ignore any hint.
      *
@@ -119,6 +133,21 @@
      */
     void (*powerHint)(struct power_module *module, power_hint_t hint,
                       void *data);
+
+    /*
+     * (*setFeature) is called to turn on or off a particular feature
+     * depending on the state parameter. The possible features are:
+     *
+     * FEATURE_DOUBLE_TAP_TO_WAKE
+     *
+     *    Enabling/Disabling this feature will allow/disallow the system
+     *    to wake up by tapping the screen twice.
+     *
+     * availability: version 0.3
+     *
+     */
+    void (*setFeature)(struct power_module *module, feature_t feature, int state);
+
 } power_module_t;
 
 
diff --git a/include/hardware/qemu_pipe.h b/include/hardware/qemu_pipe.h
index 814b20b..53aec97 100644
--- a/include/hardware/qemu_pipe.h
+++ b/include/hardware/qemu_pipe.h
@@ -23,6 +23,7 @@
 #include <pthread.h>  /* for pthread_once() */
 #include <stdlib.h>
 #include <stdio.h>
+#include <string.h>
 #include <errno.h>
 
 #ifndef D
diff --git a/include/hardware/radio.h b/include/hardware/radio.h
new file mode 100644
index 0000000..145deb5
--- /dev/null
+++ b/include/hardware/radio.h
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <system/radio.h>
+#include <hardware/hardware.h>
+
+#ifndef ANDROID_RADIO_HAL_H
+#define ANDROID_RADIO_HAL_H
+
+
+__BEGIN_DECLS
+
+/**
+ * The id of this module
+ */
+#define RADIO_HARDWARE_MODULE_ID "radio"
+
+/**
+ * Name of the audio devices to open
+ */
+#define RADIO_HARDWARE_DEVICE "radio_hw_device"
+
+#define RADIO_MODULE_API_VERSION_1_0 HARDWARE_MODULE_API_VERSION(1, 0)
+#define RADIO_MODULE_API_VERSION_CURRENT RADIO_MODULE_API_VERSION_1_0
+
+
+#define RADIO_DEVICE_API_VERSION_1_0 HARDWARE_DEVICE_API_VERSION(1, 0)
+#define RADIO_DEVICE_API_VERSION_CURRENT RADIO_DEVICE_API_VERSION_1_0
+
+/**
+ * List of known radio HAL modules. This is the base name of the radio HAL
+ * library composed of the "radio." prefix, one of the base names below and
+ * a suffix specific to the device.
+ * E.g: radio.fm.default.so
+ */
+
+#define RADIO_HARDWARE_MODULE_ID_FM "fm" /* corresponds to RADIO_CLASS_AM_FM */
+#define RADIO_HARDWARE_MODULE_ID_SAT "sat" /* corresponds to RADIO_CLASS_SAT */
+#define RADIO_HARDWARE_MODULE_ID_DT "dt" /* corresponds to RADIO_CLASS_DT */
+
+
+/**
+ * Every hardware module must have a data structure named HAL_MODULE_INFO_SYM
+ * and the fields of this data structure must begin with hw_module_t
+ * followed by module specific information.
+ */
+struct radio_module {
+    struct hw_module_t common;
+};
+
+/*
+ * Callback function called by the HAL when one of the following occurs:
+ * - event RADIO_EVENT_HW_FAILURE: radio chip of driver failure requiring
+ * closing and reopening of the tuner interface.
+ * - event RADIO_EVENT_CONFIG: new configuration applied in response to open_tuner(),
+ * or set_configuration(). The event status is 0 (no error) if the configuration has been applied,
+ * -EINVAL is not or -ETIMEDOUT in case of time out.
+ * - event RADIO_EVENT_TUNED: tune locked on new station/frequency following scan(),
+ * step(), tune() or auto AF switching. The event status is 0 (no error) if in tune,
+ * -EINVAL is not tuned and data in radio_program_info is not valid or -ETIMEDOUT if scan()
+ * timed out.
+ * - event RADIO_EVENT_TA: at the beginning and end of traffic announcement if current
+ * configuration enables TA.
+ * - event RADIO_EVENT_AF: after automatic switching to alternate frequency if current
+ * configuration enables AF switching.
+ * - event RADIO_EVENT_ANTENNA: when the antenna is connected or disconnected.
+ * - event RADIO_EVENT_METADATA: when new meta data are received from the tuned station.
+ * The callback MUST NOT be called synchronously while executing a HAL function but from
+ * a separate thread.
+ */
+typedef void (*radio_callback_t)(radio_hal_event_t *event, void *cookie);
+
+/* control interface for a radio tuner */
+struct radio_tuner {
+    /*
+     * Apply current radio band configuration (band, range, channel spacing ...).
+     *
+     * arguments:
+     * - config: the band configuration to apply
+     *
+     * returns:
+     *  0 if configuration could be applied
+     *  -EINVAL if configuration requested is invalid
+     *
+     * Automatically cancels pending scan, step or tune.
+     *
+     * Callback function with event RADIO_EVENT_CONFIG MUST be called once the
+     * configuration is applied or a failure occurs or after a time out.
+     */
+    int (*set_configuration)(const struct radio_tuner *tuner,
+                             const radio_hal_band_config_t *config);
+
+    /*
+     * Retrieve current radio band configuration.
+     *
+     * arguments:
+     * - config: where to return the band configuration
+     *
+     * returns:
+     *  0 if valid configuration is returned
+     *  -EINVAL if invalid arguments are passed
+     */
+    int (*get_configuration)(const struct radio_tuner *tuner,
+                             radio_hal_band_config_t *config);
+
+    /*
+     * Start scanning up to next valid station.
+     * Must be called when a valid configuration has been applied.
+     *
+     * arguments:
+     * - direction: RADIO_DIRECTION_UP or RADIO_DIRECTION_DOWN
+     * - skip_sub_channel: valid for HD radio or digital radios only: ignore sub channels
+     *  (e.g SPS for HD radio).
+     *
+     * returns:
+     *  0 if scan successfully started
+     *  -ENOSYS if called out of sequence
+     *  -ENODEV if another error occurs
+     *
+     * Automatically cancels pending scan, step or tune.
+     *
+     *  Callback function with event RADIO_EVENT_TUNED MUST be called once
+     *  locked on a station or after a time out or full frequency scan if
+     *  no station found. The event status should indicate if a valid station
+     *  is tuned or not.
+     */
+    int (*scan)(const struct radio_tuner *tuner,
+                radio_direction_t direction, bool skip_sub_channel);
+
+    /*
+     * Move one channel spacing up or down.
+     * Must be called when a valid configuration has been applied.
+     *
+     * arguments:
+     * - direction: RADIO_DIRECTION_UP or RADIO_DIRECTION_DOWN
+     * - skip_sub_channel: valid for HD radio or digital radios only: ignore sub channels
+     *  (e.g SPS for HD radio).
+     *
+     * returns:
+     *  0 if step successfully started
+     *  -ENOSYS if called out of sequence
+     *  -ENODEV if another error occurs
+     *
+     * Automatically cancels pending scan, step or tune.
+     *
+     * Callback function with event RADIO_EVENT_TUNED MUST be called once
+     * step completed or after a time out. The event status should indicate
+     * if a valid station is tuned or not.
+     */
+    int (*step)(const struct radio_tuner *tuner,
+                radio_direction_t direction, bool skip_sub_channel);
+
+    /*
+     * Tune to specified frequency.
+     * Must be called when a valid configuration has been applied.
+     *
+     * arguments:
+     * - channel: channel to tune to. A frequency in kHz for AM/FM/HD Radio bands.
+     * - sub_channel: valid for HD radio or digital radios only: (e.g SPS number for HD radio).
+     *
+     * returns:
+     *  0 if tune successfully started
+     *  -ENOSYS if called out of sequence
+     *  -EINVAL if invalid arguments are passed
+     *  -ENODEV if another error occurs
+     *
+     * Automatically cancels pending scan, step or tune.
+     *
+     * Callback function with event RADIO_EVENT_TUNED MUST be called once
+     * tuned or after a time out. The event status should indicate
+     * if a valid station is tuned or not.
+     */
+    int (*tune)(const struct radio_tuner *tuner,
+                unsigned int channel, unsigned int sub_channel);
+
+    /*
+     * Cancel a scan, step or tune operation.
+     * Must be called while a scan, step or tune operation is pending
+     * (callback not yet sent).
+     *
+     * returns:
+     *  0 if successful
+     *  -ENOSYS if called out of sequence
+     *  -ENODEV if another error occurs
+     *
+     * The callback is not sent.
+     */
+    int (*cancel)(const struct radio_tuner *tuner);
+
+    /*
+     * Retrieve current station information.
+     *
+     * arguments:
+     * - info: where to return the program info.
+     * If info->metadata is NULL. no meta data should be returned.
+     * If meta data must be returned, they should be added to or cloned to
+     * info->metadata, not passed from a newly created meta data buffer.
+     *
+     * returns:
+     *  0 if tuned and information available
+     *  -EINVAL if invalid arguments are passed
+     *  -ENODEV if another error occurs
+     */
+    int (*get_program_information)(const struct radio_tuner *tuner,
+                                   radio_program_info_t *info);
+};
+
+struct radio_hw_device {
+    struct hw_device_t common;
+
+    /*
+     * Retrieve implementation properties.
+     *
+     * arguments:
+     * - properties: where to return the module properties
+     *
+     * returns:
+     *  0 if no error
+     *  -EINVAL if invalid arguments are passed
+     */
+    int (*get_properties)(const struct radio_hw_device *dev,
+                          radio_hal_properties_t *properties);
+
+    /*
+     * Open a tuner interface for the requested configuration.
+     * If no other tuner is opened, this will activate the radio module.
+     *
+     * arguments:
+     * - config: the band configuration to apply
+     * - audio: this tuner will be used for live radio listening and should be connected to
+     * the radio audio source.
+     * - callback: the event callback
+     * - cookie: the cookie to pass when calling the callback
+     * - tuner: where to return the tuner interface
+     *
+     * returns:
+     *  0 if HW was powered up and configuration could be applied
+     *  -EINVAL if configuration requested is invalid
+     *  -ENOSYS if called out of sequence
+     *
+     * Callback function with event RADIO_EVENT_CONFIG MUST be called once the
+     * configuration is applied or a failure occurs or after a time out.
+     */
+    int (*open_tuner)(const struct radio_hw_device *dev,
+                    const radio_hal_band_config_t *config,
+                    bool audio,
+                    radio_callback_t callback,
+                    void *cookie,
+                    const struct radio_tuner **tuner);
+
+    /*
+     * Close a tuner interface.
+     * If the last tuner is closed, the radio module is deactivated.
+     *
+     * arguments:
+     * - tuner: the tuner interface to close
+     *
+     * returns:
+     *  0 if powered down successfully.
+     *  -EINVAL if an invalid argument is passed
+     *  -ENOSYS if called out of sequence
+     */
+    int (*close_tuner)(const struct radio_hw_device *dev, const struct radio_tuner *tuner);
+
+};
+
+typedef struct  radio_hw_device  radio_hw_device_t;
+
+/** convenience API for opening and closing a supported device */
+
+static inline int radio_hw_device_open(const struct hw_module_t* module,
+                                       struct radio_hw_device** device)
+{
+    return module->methods->open(module, RADIO_HARDWARE_DEVICE,
+                                 (struct hw_device_t**)device);
+}
+
+static inline int radio_hw_device_close(const struct radio_hw_device* device)
+{
+    return device->common.close((struct hw_device_t *)&device->common);
+}
+
+__END_DECLS
+
+#endif  // ANDROID_RADIO_HAL_H
diff --git a/include/hardware/sensors.h b/include/hardware/sensors.h
index 4c13848..b368ee6 100644
--- a/include/hardware/sensors.h
+++ b/include/hardware/sensors.h
@@ -33,6 +33,15 @@
 #define SENSORS_DEVICE_API_VERSION_0_1  HARDWARE_DEVICE_API_VERSION_2(0, 1, SENSORS_HEADER_VERSION)
 #define SENSORS_DEVICE_API_VERSION_1_0  HARDWARE_DEVICE_API_VERSION_2(1, 0, SENSORS_HEADER_VERSION)
 #define SENSORS_DEVICE_API_VERSION_1_1  HARDWARE_DEVICE_API_VERSION_2(1, 1, SENSORS_HEADER_VERSION)
+#define SENSORS_DEVICE_API_VERSION_1_2  HARDWARE_DEVICE_API_VERSION_2(1, 2, SENSORS_HEADER_VERSION)
+#define SENSORS_DEVICE_API_VERSION_1_3  HARDWARE_DEVICE_API_VERSION_2(1, 3, SENSORS_HEADER_VERSION)
+#define SENSORS_DEVICE_API_VERSION_1_4  HARDWARE_DEVICE_API_VERSION_2(1, 4, SENSORS_HEADER_VERSION)
+
+/**
+ * Please see the Sensors section of source.android.com for an
+ * introduction to and detailed descriptions of Android sensor types:
+ * http://source.android.com/devices/sensors/index.html
+ */
 
 /**
  * The id of this module
@@ -56,9 +65,12 @@
 
 
 /*
+ * **** Deprecated *****
  * flags for (*batch)()
  * Availability: SENSORS_DEVICE_API_VERSION_1_0
- * see (*batch)() documentation for details
+ * see (*batch)() documentation for details.
+ * Deprecated as of  SENSORS_DEVICE_API_VERSION_1_3.
+ * WAKE_UP_* sensors replace WAKE_UPON_FIFO_FULL concept.
  */
 enum {
     SENSORS_BATCH_DRY_RUN               = 0x00000001,
@@ -74,79 +86,127 @@
     META_DATA_VERSION   /* always last, leave auto-assigned */
 };
 
-/**
- * Definition of the axis used by the sensor HAL API
- *
- * This API is relative to the screen of the device in its default orientation,
- * that is, if the device can be used in portrait or landscape, this API
- * is only relative to the NATURAL orientation of the screen. In other words,
- * the axis are not swapped when the device's screen orientation changes.
- * Higher level services /may/ perform this transformation.
- *
- *   x<0         x>0
- *                ^
- *                |
- *    +-----------+-->  y>0
- *    |           |
- *    |           |
- *    |           |
- *    |           |   / z<0
- *    |           |  /
- *    |           | /
- *    O-----------+/
- *    |[]  [ ]  []/
- *    +----------/+     y<0
- *              /
- *             /
- *           |/ z>0 (toward the sky)
- *
- *    O: Origin (x=0,y=0,z=0)
- *
+/*
+ * The permission to use for body sensors (like heart rate monitors).
+ * See sensor types for more details on what sensors should require this
+ * permission.
  */
+#define SENSOR_PERMISSION_BODY_SENSORS "android.permission.BODY_SENSORS"
 
 /*
- * Interaction with suspend mode
- *
- * Unless otherwise noted, an enabled sensor shall not prevent the
- * SoC to go into suspend mode. It is the responsibility of applications
- * to keep a partial wake-lock should they wish to receive sensor
- * events while the screen is off. While in suspend mode, and unless
- * otherwise noted (batch mode, sensor particularities, ...), enabled sensors'
- * events are lost.
- *
- * Note that conceptually, the sensor itself is not de-activated while in
- * suspend mode -- it's just that the data it returns are lost. As soon as
- * the SoC gets out of suspend mode, operations resume as usual. Of course,
- * in practice sensors shall be disabled while in suspend mode to
- * save power, unless batch mode is active, in which case they must
- * continue fill their internal FIFO (see the documentation of batch() to
- * learn how suspend interacts with batch mode).
- *
- * In batch mode, and only when the flag SENSORS_BATCH_WAKE_UPON_FIFO_FULL is
- * set and supported, the specified sensor must be able to wake-up the SoC and
- * be able to buffer at least 10 seconds worth of the requested sensor events.
- *
- * There are notable exceptions to this behavior, which are sensor-dependent
- * (see sensor types definitions below)
- *
- *
- * The sensor type documentation below specifies the wake-up behavior of
- * each sensor:
- *   wake-up: yes     this sensor must wake-up the SoC to deliver events
- *   wake-up: no      this sensor shall not wake-up the SoC, events are dropped
- *
+ * Availability: SENSORS_DEVICE_API_VERSION_1_4
+ * Sensor HAL modes used in set_operation_mode method
  */
+enum {
+    /*
+     * Operating modes for the HAL.
+     */
+
+    /*
+     * Normal mode operation. This is the default state of operation.
+     * The HAL shall initialize into this mode on device startup.
+     */
+    SENSOR_HAL_NORMAL_MODE        = 0,
+
+    /*
+     * Data Injection mode. In this mode, the device shall not source data from the
+     * physical sensors as it would in normal mode. Instead sensor data is
+     * injected by the sensor service.
+     */
+    SENSOR_HAL_DATA_INJECTION_MODE      = 0x1
+};
+
+/*
+ * Availability: SENSORS_DEVICE_API_VERSION_1_3
+ * Sensor flags used in sensor_t.flags.
+ */
+enum {
+    /*
+     * Whether this sensor wakes up the AP from suspend mode when data is available.  Whenever
+     * sensor events are delivered from a wake_up sensor, the driver needs to hold a wake_lock till
+     * the events are read by the SensorService i.e till sensors_poll_device_t.poll() is called the
+     * next time. Once poll is called again it means events have been read by the SensorService, the
+     * driver can safely release the wake_lock. SensorService will continue to hold a wake_lock till
+     * the app actually reads the events.
+     */
+    SENSOR_FLAG_WAKE_UP = 1U << 0,
+    /*
+     * Reporting modes for various sensors. Each sensor will have exactly one of these modes set.
+     * The least significant 2nd, 3rd and 4th bits are used to represent four possible reporting
+     * modes.
+     */
+    SENSOR_FLAG_CONTINUOUS_MODE        = 0,    // 0000
+    SENSOR_FLAG_ON_CHANGE_MODE         = 0x2,  // 0010
+    SENSOR_FLAG_ONE_SHOT_MODE          = 0x4,  // 0100
+    SENSOR_FLAG_SPECIAL_REPORTING_MODE = 0x6,  // 0110
+
+    /*
+     * Set this flag if the sensor supports data_injection mode and allows data to be injected
+     * from the SensorService. When in data_injection ONLY sensors with this flag set are injected
+     * sensor data and only sensors with this flag set are activated. Eg: Accelerometer and Step
+     * Counter sensors can be set with this flag and SensorService will inject accelerometer data
+     * and read the corresponding step counts.
+     */
+    SENSOR_FLAG_SUPPORTS_DATA_INJECTION = 0x8  // 1000
+};
+
+/*
+ * Mask and shift for reporting mode sensor flags defined above.
+ */
+#define REPORTING_MODE_MASK              (0xE)
+#define REPORTING_MODE_SHIFT             (1)
+
+/*
+ * Mask and shift for data_injection mode sensor flags defined above.
+ */
+#define DATA_INJECTION_MASK              (0x10)
+#define DATA_INJECTION_SHIFT             (4)
 
 /*
  * Sensor type
  *
  * Each sensor has a type which defines what this sensor measures and how
- * measures are reported. All types are defined below.
+ * measures are reported. See the Base sensors and Composite sensors lists
+ * for complete descriptions:
+ * http://source.android.com/devices/sensors/base_triggers.html
+ * http://source.android.com/devices/sensors/composite_sensors.html
  *
  * Device manufacturers (OEMs) can define their own sensor types, for
  * their private use by applications or services provided by them. Such
  * sensor types are specific to an OEM and can't be exposed in the SDK.
  * These types must start at SENSOR_TYPE_DEVICE_PRIVATE_BASE.
+ *
+ * All sensors defined outside of the device private range must correspond to
+ * a type defined in this file, and must satisfy the characteristics listed in
+ * the description of the sensor type.
+ *
+ * Starting with version SENSORS_DEVICE_API_VERSION_1_2, each sensor also
+ * has a stringType.
+ *  - StringType of sensors inside of the device private range MUST be prefixed
+ *    by the sensor provider's or OEM reverse domain name. In particular, they
+ *    cannot use the "android.sensor" prefix.
+ *  - StringType of sensors outside of the device private range MUST correspond
+ *    to the one defined in this file (starting with "android.sensor").
+ *    For example, accelerometers must have
+ *      type=SENSOR_TYPE_ACCELEROMETER and
+ *      stringType=SENSOR_STRING_TYPE_ACCELEROMETER
+ *
+ * When android introduces a new sensor type that can replace an OEM-defined
+ * sensor type, the OEM must use the official sensor type and stringType on
+ * versions of the HAL that support this new official sensor type.
+ *
+ * Example (made up): Suppose Google's Glass team wants to surface a sensor
+ * detecting that Glass is on a head.
+ *  - Such a sensor is not officially supported in android KitKat
+ *  - Glass devices launching on KitKat can implement a sensor with
+ *    type = 0x10001 and stringType = "com.google.glass.onheaddetector"
+ *  - In L android release, if android decides to define
+ *    SENSOR_TYPE_ON_HEAD_DETECTOR and STRING_SENSOR_TYPE_ON_HEAD_DETECTOR,
+ *    those types should replace the Glass-team-specific types in all future
+ *    launches.
+ *  - When launching Glass on the L release, Google should now use the official
+ *    type (SENSOR_TYPE_ON_HEAD_DETECTOR) and stringType.
+ *  - This way, all applications can now use this sensor.
  */
 
 /*
@@ -156,49 +216,8 @@
 #define SENSOR_TYPE_DEVICE_PRIVATE_BASE     0x10000
 
 /*
- * Sensor fusion and virtual sensors
- *
- * Many sensor types are or can be implemented as virtual sensors from
- * physical sensors on the device. For instance the rotation vector sensor,
- * orientation sensor, step-detector, step-counter, etc...
- *
- * From the point of view of this API these virtual sensors MUST appear as
- * real, individual sensors. It is the responsibility of the driver and HAL
- * to make sure this is the case.
- *
- * In particular, all sensors must be able to function concurrently.
- * For example, if defining both an accelerometer and a step counter,
- * then both must be able to work concurrently.
- */
-
-/*
- * Trigger modes
- *
- * Sensors can report events in different ways called trigger modes,
- * each sensor type has one and only one trigger mode associated to it.
- * Currently there are four trigger modes defined:
- *
- * continuous: events are reported at a constant rate defined by setDelay().
- *             eg: accelerometers, gyroscopes.
- * on-change:  events are reported only if the sensor's value has changed.
- *             setDelay() is used to set a lower limit to the reporting
- *             period (minimum time between two events).
- *             The HAL must return an event immediately when an on-change
- *             sensor is activated.
- *             eg: proximity, light sensors
- * one-shot:   upon detection of an event, the sensor deactivates itself and
- *             then sends a single event. Order matters to avoid race
- *             conditions. No other event is sent until the sensor get
- *             reactivated. setDelay() is ignored.
- *             eg: significant motion sensor
- * special:    see details in the sensor type specification below
- *
- */
-
-
-/*
  * SENSOR_TYPE_META_DATA
- * trigger-mode: n/a
+ * reporting-mode: n/a
  * wake-up sensor: n/a
  *
  * NO SENSOR OF THAT TYPE MUST BE RETURNED (*get_sensors_list)()
@@ -227,511 +246,416 @@
  * must not be used.
  *
  */
-#define SENSOR_TYPE_META_DATA                           (0)
+#define SENSOR_TYPE_META_DATA                        (0)
+
+/*
+  * Wake up sensors.
+  * Each sensor may have either or both a wake-up and a non-wake variant.
+  * When registered in batch mode, wake-up sensors will wake up the AP when
+  * their FIFOs are full or when the batch timeout expires. A separate FIFO has
+  * to be maintained for wake up sensors and non wake up sensors. The non wake-up
+  * sensors need to overwrite their FIFOs when they are full till the AP wakes up
+  * and the wake-up sensors will wake-up the AP when their FIFOs are full or when
+  * the batch timeout expires without losing events. Wake-up and non wake-up variants
+  * of each sensor can be activated at different rates independently of each other.
+  *
+  * Note: Proximity sensor and significant motion sensor which were defined in previous
+  * releases are also wake-up sensors and should be treated as such. Wake-up one-shot
+  * sensors like SIGNIFICANT_MOTION cannot be batched, hence the text about batch above
+  * doesn't apply to them. See the definitions of SENSOR_TYPE_PROXIMITY and
+  * SENSOR_TYPE_SIGNIFICANT_MOTION for more info.
+  *
+  * Set SENSOR_FLAG_WAKE_UP flag for all wake-up sensors.
+  *
+  * For example, A device can have two sensors both of SENSOR_TYPE_ACCELEROMETER and
+  * one of them can be a wake_up sensor (with SENSOR_FLAG_WAKE_UP flag set) and the other
+  * can be a regular non wake_up sensor. Both of these sensors must be activated/deactivated
+  * independently of the other.
+  */
 
 /*
  * SENSOR_TYPE_ACCELEROMETER
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  *  All values are in SI units (m/s^2) and measure the acceleration of the
  *  device minus the force of gravity.
  *
- *  Acceleration sensors return sensor events for all 3 axes at a constant
- *  rate defined by setDelay().
- *
- *  x: Acceleration on the x-axis
- *  y: Acceleration on the y-axis
- *  z: Acceleration on the z-axis
- *
- * Note that the readings from the accelerometer include the acceleration
- * due to gravity (which is opposite to the direction of the gravity vector).
- *
- *  Examples:
- *    The norm of <x, y, z>  should be close to 0 when in free fall.
- *
- *    When the device lies flat on a table and is pushed on its left side
- *    toward the right, the x acceleration value is positive.
- *
- *    When the device lies flat on a table, the acceleration value is +9.81,
- *    which correspond to the acceleration of the device (0 m/s^2) minus the
- *    force of gravity (-9.81 m/s^2).
- *
- *    When the device lies flat on a table and is pushed toward the sky, the
- *    acceleration value is greater than +9.81, which correspond to the
- *    acceleration of the device (+A m/s^2) minus the force of
- *    gravity (-9.81 m/s^2).
+ *  Implement the non-wake-up version of this sensor and implement the wake-up
+ *  version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_ACCELEROMETER                    (1)
+#define SENSOR_STRING_TYPE_ACCELEROMETER             "android.sensor.accelerometer"
 
 /*
  * SENSOR_TYPE_GEOMAGNETIC_FIELD
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  *  All values are in micro-Tesla (uT) and measure the geomagnetic
  *  field in the X, Y and Z axis.
  *
- *  Returned values include calibration mechanisms such that the vector is
- *  aligned with the magnetic declination and heading of the earth's
- *  geomagnetic field.
- *
- *  Magnetic Field sensors return sensor events for all 3 axes at a constant
- *  rate defined by setDelay().
+ *  Implement the non-wake-up version of this sensor and implement the wake-up
+ *  version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_GEOMAGNETIC_FIELD                (2)
 #define SENSOR_TYPE_MAGNETIC_FIELD  SENSOR_TYPE_GEOMAGNETIC_FIELD
+#define SENSOR_STRING_TYPE_MAGNETIC_FIELD            "android.sensor.magnetic_field"
 
 /*
  * SENSOR_TYPE_ORIENTATION
- * trigger-mode: continuous
- * wake-up sensor: no
- * 
+ * reporting-mode: continuous
+ *
  * All values are angles in degrees.
- * 
+ *
  * Orientation sensors return sensor events for all 3 axes at a constant
  * rate defined by setDelay().
  *
- * azimuth: angle between the magnetic north direction and the Y axis, around 
- *  the Z axis (0<=azimuth<360).
- *      0=North, 90=East, 180=South, 270=West
- * 
- * pitch: Rotation around X axis (-180<=pitch<=180), with positive values when
- *  the z-axis moves toward the y-axis.
- *
- * roll: Rotation around Y axis (-90<=roll<=90), with positive values when
- *  the x-axis moves towards the z-axis.
- *
- * Note: For historical reasons the roll angle is positive in the clockwise
- *  direction (mathematically speaking, it should be positive in the
- *  counter-clockwise direction):
- *
- *                Z
- *                ^
- *  (+roll)  .--> |
- *          /     |
- *         |      |  roll: rotation around Y axis
- *     X <-------(.)
- *                 Y
- *       note that +Y == -roll
- *
- *
- *
- * Note: This definition is different from yaw, pitch and roll used in aviation
- *  where the X axis is along the long side of the plane (tail to nose).
+ * Implement the non-wake-up version of this sensor and implement the wake-up
+ * version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_ORIENTATION                      (3)
+#define SENSOR_STRING_TYPE_ORIENTATION               "android.sensor.orientation"
 
 /*
  * SENSOR_TYPE_GYROSCOPE
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  *  All values are in radians/second and measure the rate of rotation
- *  around the X, Y and Z axis.  The coordinate system is the same as is
- *  used for the acceleration sensor. Rotation is positive in the
- *  counter-clockwise direction (right-hand rule). That is, an observer
- *  looking from some positive location on the x, y or z axis at a device
- *  positioned on the origin would report positive rotation if the device
- *  appeared to be rotating counter clockwise. Note that this is the
- *  standard mathematical definition of positive rotation and does not agree
- *  with the definition of roll given earlier.
- *  The range should at least be 17.45 rad/s (ie: ~1000 deg/s).
+ *  around the X, Y and Z axis.
  *
- *  automatic gyro-drift compensation is allowed but not required.
+ *  Implement the non-wake-up version of this sensor and implement the wake-up
+ *  version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_GYROSCOPE                        (4)
+#define SENSOR_STRING_TYPE_GYROSCOPE                 "android.sensor.gyroscope"
 
 /*
  * SENSOR_TYPE_LIGHT
- * trigger-mode: on-change
- * wake-up sensor: no
+ * reporting-mode: on-change
  *
  * The light sensor value is returned in SI lux units.
+ *
+ * Both wake-up and non wake-up versions are useful.
  */
 #define SENSOR_TYPE_LIGHT                            (5)
+#define SENSOR_STRING_TYPE_LIGHT                     "android.sensor.light"
 
 /*
  * SENSOR_TYPE_PRESSURE
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  * The pressure sensor return the athmospheric pressure in hectopascal (hPa)
+ *
+ * Implement the non-wake-up version of this sensor and implement the wake-up
+ * version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_PRESSURE                         (6)
+#define SENSOR_STRING_TYPE_PRESSURE                  "android.sensor.pressure"
 
 /* SENSOR_TYPE_TEMPERATURE is deprecated in the HAL */
 #define SENSOR_TYPE_TEMPERATURE                      (7)
+#define SENSOR_STRING_TYPE_TEMPERATURE               "android.sensor.temperature"
 
 /*
  * SENSOR_TYPE_PROXIMITY
- * trigger-mode: on-change
- * wake-up sensor: yes
+ * reporting-mode: on-change
  *
- * The distance value is measured in centimeters.  Note that some proximity
- * sensors only support a binary "close" or "far" measurement.  In this case,
- * the sensor should report its maxRange value in the "far" state and a value
- * less than maxRange in the "near" state.
+ * The proximity sensor which turns the screen off and back on during calls is the
+ * wake-up proximity sensor. Implement wake-up proximity sensor before implementing
+ * a non wake-up proximity sensor. For the wake-up proximity sensor set the flag
+ * SENSOR_FLAG_WAKE_UP.
+ * The value corresponds to the distance to the nearest object in centimeters.
  */
 #define SENSOR_TYPE_PROXIMITY                        (8)
+#define SENSOR_STRING_TYPE_PROXIMITY                 "android.sensor.proximity"
 
 /*
  * SENSOR_TYPE_GRAVITY
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  * A gravity output indicates the direction of and magnitude of gravity in
- * the devices's coordinates.  On Earth, the magnitude is 9.8 m/s^2.
- * Units are m/s^2.  The coordinate system is the same as is used for the
- * acceleration sensor. When the device is at rest, the output of the
- * gravity sensor should be identical to that of the accelerometer.
+ * the devices's coordinates.
+ *
+ * Implement the non-wake-up version of this sensor and implement the wake-up
+ * version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_GRAVITY                          (9)
+#define SENSOR_STRING_TYPE_GRAVITY                   "android.sensor.gravity"
 
 /*
  * SENSOR_TYPE_LINEAR_ACCELERATION
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  * Indicates the linear acceleration of the device in device coordinates,
  * not including gravity.
  *
- * The output is conceptually:
- *    output of TYPE_ACCELERATION - output of TYPE_GRAVITY
- *
- * Readings on all axes should be close to 0 when device lies on a table.
- * Units are m/s^2.
- * The coordinate system is the same as is used for the acceleration sensor.
+ * Implement the non-wake-up version of this sensor and implement the wake-up
+ * version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_LINEAR_ACCELERATION             (10)
+#define SENSOR_STRING_TYPE_LINEAR_ACCELERATION      "android.sensor.linear_acceleration"
 
 
 /*
  * SENSOR_TYPE_ROTATION_VECTOR
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  * The rotation vector symbolizes the orientation of the device relative to the
- * East-North-Up coordinates frame. It is usually obtained by integration of
- * accelerometer, gyroscope and magnetometer readings.
+ * East-North-Up coordinates frame.
  *
- * The East-North-Up coordinate system is defined as a direct orthonormal basis
- * where:
- * - X points east and is tangential to the ground.
- * - Y points north and is tangential to the ground.
- * - Z points towards the sky and is perpendicular to the ground.
- *
- * The orientation of the phone is represented by the rotation necessary to
- * align the East-North-Up coordinates with the phone's coordinates. That is,
- * applying the rotation to the world frame (X,Y,Z) would align them with the
- * phone coordinates (x,y,z).
- *
- * The rotation can be seen as rotating the phone by an angle theta around
- * an axis rot_axis to go from the reference (East-North-Up aligned) device
- * orientation to the current device orientation.
- *
- * The rotation is encoded as the 4 (reordered) components of a unit quaternion:
- *   sensors_event_t.data[0] = rot_axis.x*sin(theta/2)
- *   sensors_event_t.data[1] = rot_axis.y*sin(theta/2)
- *   sensors_event_t.data[2] = rot_axis.z*sin(theta/2)
- *   sensors_event_t.data[3] = cos(theta/2)
- * where
- *   - rot_axis.x,y,z are the North-East-Up coordinates of a unit length vector
- *     representing the rotation axis
- *   - theta is the rotation angle
- *
- * The quaternion must be of norm 1 (it is a unit quaternion). Failure to ensure
- * this will cause erratic client behaviour.
- *
- * In addition, this sensor reports an estimated heading accuracy.
- *   sensors_event_t.data[4] = estimated_accuracy (in radians)
- * The heading error must be less than estimated_accuracy 95% of the time
- *
- * This sensor must use a gyroscope and an accelerometer as main orientation
- * change input.
- *
- * This sensor can also include magnetometer input to make up for gyro drift,
- * but it cannot be implemented using only a magnetometer.
+ * Implement the non-wake-up version of this sensor and implement the wake-up
+ * version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_ROTATION_VECTOR                 (11)
+#define SENSOR_STRING_TYPE_ROTATION_VECTOR          "android.sensor.rotation_vector"
 
 /*
  * SENSOR_TYPE_RELATIVE_HUMIDITY
- * trigger-mode: on-change
- * wake-up sensor: no
+ * reporting-mode: on-change
  *
  * A relative humidity sensor measures relative ambient air humidity and
  * returns a value in percent.
+ *
+ * Both wake-up and non wake-up versions are useful.
  */
 #define SENSOR_TYPE_RELATIVE_HUMIDITY               (12)
+#define SENSOR_STRING_TYPE_RELATIVE_HUMIDITY        "android.sensor.relative_humidity"
 
 /*
  * SENSOR_TYPE_AMBIENT_TEMPERATURE
- * trigger-mode: on-change
- * wake-up sensor: no
+ * reporting-mode: on-change
  *
  * The ambient (room) temperature in degree Celsius.
+ *
+ * Both wake-up and non wake-up versions are useful.
  */
 #define SENSOR_TYPE_AMBIENT_TEMPERATURE             (13)
+#define SENSOR_STRING_TYPE_AMBIENT_TEMPERATURE      "android.sensor.ambient_temperature"
 
 /*
  * SENSOR_TYPE_MAGNETIC_FIELD_UNCALIBRATED
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  *  Similar to SENSOR_TYPE_MAGNETIC_FIELD, but the hard iron calibration is
  *  reported separately instead of being included in the measurement.
- *  Factory calibration and temperature compensation should still be applied to
- *  the "uncalibrated" measurement.
- *  Separating away the hard iron calibration estimation allows the system to
- *  better recover from bad hard iron estimation.
  *
- *  All values are in micro-Tesla (uT) and measure the ambient magnetic
- *  field in the X, Y and Z axis. Assumptions that the the magnetic field
- *  is due to the Earth's poles should be avoided.
- *
- *  The uncalibrated_magnetic event contains
- *  - 3 fields for uncalibrated measurement: x_uncalib, y_uncalib, z_uncalib.
- *    Each is a component of the measured magnetic field, with soft iron
- *    and temperature compensation applied, but not hard iron calibration.
- *    These values should be continuous (no re-calibration should cause a jump).
- *  - 3 fields for hard iron bias estimates: x_bias, y_bias, z_bias.
- *    Each field is a component of the estimated hard iron calibration.
- *    They represent the offsets to apply to the calibrated readings to obtain
- *    uncalibrated readings (x_uncalib ~= x_calibrated + x_bias)
- *    These values are expected to jump as soon as the estimate of the hard iron
- *    changes, and they should be stable the rest of the time.
- *
- *  If this sensor is present, then the corresponding
- *  SENSOR_TYPE_MAGNETIC_FIELD must be present and both must return the
- *  same sensor_t::name and sensor_t::vendor.
- *
- *  Minimum filtering should be applied to this sensor. In particular, low pass
- *  filters should be avoided.
- *
- * See SENSOR_TYPE_MAGNETIC_FIELD for more information
+ *  Implement the non-wake-up version of this sensor and implement the wake-up
+ *  version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_MAGNETIC_FIELD_UNCALIBRATED     (14)
+#define SENSOR_STRING_TYPE_MAGNETIC_FIELD_UNCALIBRATED "android.sensor.magnetic_field_uncalibrated"
 
 /*
  * SENSOR_TYPE_GAME_ROTATION_VECTOR
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  *  Similar to SENSOR_TYPE_ROTATION_VECTOR, but not using the geomagnetic
- *  field. Therefore the Y axis doesn't point north, but instead to some other
- *  reference. That reference is allowed to drift by the same order of
- *  magnitude than the gyroscope drift around the Z axis.
+ *  field.
  *
- *  This sensor does not report an estimated heading accuracy:
- *    sensors_event_t.data[4] is reserved and should be set to 0
- *
- *  In the ideal case, a phone rotated and returning to the same real-world
- *  orientation should report the same game rotation vector
- *  (without using the earth's geomagnetic field).
- *
- *  This sensor must be based on a gyroscope. It cannot be implemented using
- *  a magnetometer.
- *
- * see SENSOR_TYPE_ROTATION_VECTOR for more details
+ *  Implement the non-wake-up version of this sensor and implement the wake-up
+ *  version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_GAME_ROTATION_VECTOR            (15)
+#define SENSOR_STRING_TYPE_GAME_ROTATION_VECTOR     "android.sensor.game_rotation_vector"
 
 /*
  * SENSOR_TYPE_GYROSCOPE_UNCALIBRATED
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  *  All values are in radians/second and measure the rate of rotation
- *  around the X, Y and Z axis. An estimation of the drift on each axis is
- *  reported as well.
+ *  around the X, Y and Z axis.
  *
- *  No gyro-drift compensation shall be performed.
- *  Factory calibration and temperature compensation should still be applied
- *  to the rate of rotation (angular speeds).
- *
- *  The coordinate system is the same as is
- *  used for the acceleration sensor. Rotation is positive in the
- *  counter-clockwise direction (right-hand rule). That is, an observer
- *  looking from some positive location on the x, y or z axis at a device
- *  positioned on the origin would report positive rotation if the device
- *  appeared to be rotating counter clockwise. Note that this is the
- *  standard mathematical definition of positive rotation and does not agree
- *  with the definition of roll given earlier.
- *  The range should at least be 17.45 rad/s (ie: ~1000 deg/s).
- *
- *  Content of an uncalibrated_gyro event: (units are rad/sec)
- *   x_uncalib : angular speed (w/o drift compensation) around the X axis
- *   y_uncalib : angular speed (w/o drift compensation) around the Y axis
- *   z_uncalib : angular speed (w/o drift compensation) around the Z axis
- *   x_bias : estimated drift around X axis in rad/s
- *   y_bias : estimated drift around Y axis in rad/s
- *   z_bias : estimated drift around Z axis in rad/s
- *
- *  IMPLEMENTATION NOTES:
- *
- *  If the implementation is not able to estimate the drift, then this
- *  sensor MUST NOT be reported by this HAL. Instead, the regular
- *  SENSOR_TYPE_GYROSCOPE is used without drift compensation.
- *
- *  If this sensor is present, then the corresponding
- *  SENSOR_TYPE_GYROSCOPE must be present and both must return the
- *  same sensor_t::name and sensor_t::vendor.
+ *  Implement the non-wake-up version of this sensor and implement the wake-up
+ *  version if the system possesses a wake up fifo.
  */
 #define SENSOR_TYPE_GYROSCOPE_UNCALIBRATED          (16)
-
+#define SENSOR_STRING_TYPE_GYROSCOPE_UNCALIBRATED   "android.sensor.gyroscope_uncalibrated"
 
 /*
  * SENSOR_TYPE_SIGNIFICANT_MOTION
- * trigger-mode: one-shot
- * wake-up sensor: yes
+ * reporting-mode: one-shot
  *
  * A sensor of this type triggers an event each time significant motion
  * is detected and automatically disables itself.
+ * For Significant Motion sensor to be useful, it must be defined as a
+ * wake-up sensor. (set SENSOR_FLAG_WAKE_UP). Implement the wake-up significant motion
+ * sensor. A non wake-up version is not useful.
  * The only allowed value to return is 1.0.
- *
- * A significant motion is a motion that might lead to a change in the user
- * location.
- * Examples of such motions are:
- *   walking, biking, sitting in a moving car, coach or train.
- * Examples of situations that should not trigger significant motion:
- * - phone in pocket and person is not moving
- * - phone is on a table, even if the table shakes a bit due to nearby traffic
- *   or washing machine
- *
- * A note on false positive / false negative / power consumption tradeoff
- *  - The goal of this sensor is to save power.
- *  - Triggering an event when the user is not moving (false positive) is costly
- *    in terms of power, so it should be avoided.
- *  - Not triggering an event when the user is moving (false negative) is
- *    acceptable as long as it is not done repeatedly. If the user has been
- *    walking for 10 seconds, not triggering an event within those 10 seconds
- *    is not acceptable.
- *
- *  IMPORTANT NOTE: this sensor type is very different from other types
- *  in that it must work when the screen is off without the need of
- *  holding a partial wake-lock and MUST allow the SoC to go into suspend.
- *  When significant motion is detected, the sensor must awaken the SoC and
- *  the event be reported.
- *
- *  If a particular hardware cannot support this mode of operation then this
- *  sensor type MUST NOT be reported by the HAL. ie: it is not acceptable
- *  to "emulate" this sensor in the HAL.
- *
- *  The whole point of this sensor type is to save power by keeping the
- *  SoC in suspend mode when the device is at rest.
- *
- *  When the sensor is not activated, it must also be deactivated in the
- *  hardware: it must not wake up the SoC anymore, even in case of
- *  significant motion.
- *
- *  setDelay() has no effect and is ignored.
- *  Once a "significant motion" event is returned, a sensor of this type
- *  must disables itself automatically, as if activate(..., 0) had been called.
  */
 
 #define SENSOR_TYPE_SIGNIFICANT_MOTION              (17)
-
+#define SENSOR_STRING_TYPE_SIGNIFICANT_MOTION       "android.sensor.significant_motion"
 
 /*
  * SENSOR_TYPE_STEP_DETECTOR
- * trigger-mode: special
- * wake-up sensor: no
+ * reporting-mode: special
  *
  * A sensor of this type triggers an event each time a step is taken
- * by the user. The only allowed value to return is 1.0 and an event is
- * generated for each step. Like with any other event, the timestamp
- * indicates when the event (here the step) occurred, this corresponds to when
- * the foot hit the ground, generating a high variation in acceleration.
+ * by the user. The only allowed value to return is 1.0 and an event
+ * is generated for each step.
  *
- * While this sensor operates, it shall not disrupt any other sensors, in
- * particular, but not limited to, the accelerometer; which might very well
- * be in use as well.
- *
- * This sensor must be low power. That is, if the step detection cannot be
- * done in hardware, this sensor should not be defined. Also, when the
- * step detector is activated and the accelerometer is not, only steps should
- * trigger interrupts (not accelerometer data).
- *
- * setDelay() has no impact on this sensor type
+ * Both wake-up and non wake-up versions are useful.
  */
 
 #define SENSOR_TYPE_STEP_DETECTOR                   (18)
+#define SENSOR_STRING_TYPE_STEP_DETECTOR            "android.sensor.step_detector"
 
 
 /*
  * SENSOR_TYPE_STEP_COUNTER
- * trigger-mode: on-change
- * wake-up sensor: no
+ * reporting-mode: on-change
  *
  * A sensor of this type returns the number of steps taken by the user since
  * the last reboot while activated. The value is returned as a uint64_t and is
  * reset to zero only on a system / android reboot.
  *
- * The timestamp of the event is set to the time when the first step
- * for that event was taken.
- * See SENSOR_TYPE_STEP_DETECTOR for the signification of the time of a step.
- *
- *  The minimum size of the hardware's internal counter shall be 16 bits
- *  (this restriction is here to avoid too frequent wake-ups when the
- *  delay is very large).
- *
- *  IMPORTANT NOTE: this sensor type is different from other types
- *  in that it must work when the screen is off without the need of
- *  holding a partial wake-lock and MUST allow the SoC to go into suspend.
- *  Unlike other sensors, while in suspend mode this sensor must stay active,
- *  no events are reported during that time but, steps continue to be
- *  accounted for; an event will be reported as soon as the SoC resumes if
- *  the timeout has expired.
- *
- *    In other words, when the screen is off and the device allowed to
- *    go into suspend mode, we don't want to be woken up, regardless of the
- *    setDelay() value, but the steps shall continue to be counted.
- *
- *    The driver must however ensure that the internal step count never
- *    overflows. It is allowed in this situation to wake the SoC up so the
- *    driver can do the counter maintenance.
- *
- *  While this sensor operates, it shall not disrupt any other sensors, in
- *  particular, but not limited to, the accelerometer; which might very well
- *  be in use as well.
- *
- *  If a particular hardware cannot support these modes of operation then this
- *  sensor type MUST NOT be reported by the HAL. ie: it is not acceptable
- *  to "emulate" this sensor in the HAL.
- *
- * This sensor must be low power. That is, if the step detection cannot be
- * done in hardware, this sensor should not be defined. Also, when the
- * step counter is activated and the accelerometer is not, only steps should
- * trigger interrupts (not accelerometer data).
- *
- *  The whole point of this sensor type is to save power by keeping the
- *  SoC in suspend mode when the device is at rest.
+ * Implement the non-wake-up version of this sensor and implement the wake-up
+ * version if the system possesses a wake up fifo.
  */
 
 #define SENSOR_TYPE_STEP_COUNTER                    (19)
+#define SENSOR_STRING_TYPE_STEP_COUNTER             "android.sensor.step_counter"
 
 /*
  * SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR
- * trigger-mode: continuous
- * wake-up sensor: no
+ * reporting-mode: continuous
  *
  *  Similar to SENSOR_TYPE_ROTATION_VECTOR, but using a magnetometer instead
  *  of using a gyroscope.
  *
- *  This sensor must be based on a magnetometer. It cannot be implemented using
- *  a gyroscope, and gyroscope input cannot be used by this sensor, as the
- *  goal of this sensor is to be low power.
- *  The accelerometer can be (and usually is) used.
- *
- *  Just like SENSOR_TYPE_ROTATION_VECTOR, this sensor reports an estimated
- *  heading accuracy:
- *    sensors_event_t.data[4] = estimated_accuracy (in radians)
- *  The heading error must be less than estimated_accuracy 95% of the time
- *
- * see SENSOR_TYPE_ROTATION_VECTOR for more details
+ * Implement the non-wake-up version of this sensor and implement the wake-up
+ * version if the system possesses a wake up fifo.
  */
-#define SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR            (20)
+#define SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR     (20)
+#define SENSOR_STRING_TYPE_GEOMAGNETIC_ROTATION_VECTOR "android.sensor.geomagnetic_rotation_vector"
+
+/*
+ * SENSOR_TYPE_HEART_RATE
+ * reporting-mode: on-change
+ *
+ *  A sensor of this type returns the current heart rate.
+ *  The events contain the current heart rate in beats per minute (BPM) and the
+ *  status of the sensor during the measurement. See heart_rate_event_t for more
+ *  details.
+ *
+ *  Because this sensor is on-change, events must be generated when and only
+ *  when heart_rate.bpm or heart_rate.status have changed since the last
+ *  event. In particular, upon the first activation, unless the device is known
+ *  to not be on the body, the status field of the first event must be set to
+ *  SENSOR_STATUS_UNRELIABLE. The event should be generated no faster than every
+ *  period_ns passed to setDelay() or to batch().
+ *  See the definition of the on-change reporting mode for more information.
+ *
+ *  sensor_t.requiredPermission must be set to SENSOR_PERMISSION_BODY_SENSORS.
+ *
+ *  Both wake-up and non wake-up versions are useful.
+ */
+#define SENSOR_TYPE_HEART_RATE                      (21)
+#define SENSOR_STRING_TYPE_HEART_RATE               "android.sensor.heart_rate"
+
+/*
+ * SENSOR_TYPE_WAKE_UP_TILT_DETECTOR
+ * reporting-mode: special (setDelay has no impact)
+ *
+ * A sensor of this type generates an event each time a tilt event is detected. A tilt event
+ * should be generated if the direction of the 2-seconds window average gravity changed by at least
+ * 35 degrees since the activation or the last trigger of the sensor.
+ *     reference_estimated_gravity = average of accelerometer measurements over the first
+ *                                 1 second after activation or the estimated gravity at the last
+ *                                 trigger.
+ *     current_estimated_gravity = average of accelerometer measurements over the last 2 seconds.
+ *     trigger when angle (reference_estimated_gravity, current_estimated_gravity) > 35 degrees
+ *
+ * Large accelerations without a change in phone orientation should not trigger a tilt event.
+ * For example, a sharp turn or strong acceleration while driving a car should not trigger a tilt
+ * event, even though the angle of the average acceleration might vary by more than 35 degrees.
+ *
+ * Typically, this sensor is implemented with the help of only an accelerometer. Other sensors can
+ * be used as well if they do not increase the power consumption significantly. This is a low power
+ * sensor that should allow the AP to go into suspend mode. Do not emulate this sensor in the HAL.
+ * Like other wake up sensors, the driver is expected to a hold a wake_lock with a timeout of 200 ms
+ * while reporting this event. The only allowed return value is 1.0.
+ *
+ * Implement only the wake-up version of this sensor.
+ */
+#define SENSOR_TYPE_TILT_DETECTOR                      (22)
+#define SENSOR_STRING_TYPE_TILT_DETECTOR               "android.sensor.tilt_detector"
+
+/*
+ * SENSOR_TYPE_WAKE_GESTURE
+ * reporting-mode: one-shot
+ *
+ * A sensor enabling waking up the device based on a device specific motion.
+ *
+ * When this sensor triggers, the device behaves as if the power button was
+ * pressed, turning the screen on. This behavior (turning on the screen when
+ * this sensor triggers) might be deactivated by the user in the device
+ * settings. Changes in settings do not impact the behavior of the sensor:
+ * only whether the framework turns the screen on when it triggers.
+ *
+ * The actual gesture to be detected is not specified, and can be chosen by
+ * the manufacturer of the device.
+ * This sensor must be low power, as it is likely to be activated 24/7.
+ * The only allowed value to return is 1.0.
+ *
+ * Implement only the wake-up version of this sensor.
+ */
+#define SENSOR_TYPE_WAKE_GESTURE                               (23)
+#define SENSOR_STRING_TYPE_WAKE_GESTURE                        "android.sensor.wake_gesture"
+
+/*
+ * SENSOR_TYPE_GLANCE_GESTURE
+ * reporting-mode: one-shot
+ *
+ * A sensor enabling briefly turning the screen on to enable the user to
+ * glance content on screen based on a specific motion.  The device should
+ * turn the screen off after a few moments.
+ *
+ * When this sensor triggers, the device turns the screen on momentarily
+ * to allow the user to glance notifications or other content while the
+ * device remains locked in a non-interactive state (dozing). This behavior
+ * (briefly turning on the screen when this sensor triggers) might be deactivated
+ * by the user in the device settings. Changes in settings do not impact the
+ * behavior of the sensor: only whether the framework briefly turns the screen on
+ * when it triggers.
+ *
+ * The actual gesture to be detected is not specified, and can be chosen by
+ * the manufacturer of the device.
+ * This sensor must be low power, as it is likely to be activated 24/7.
+ * The only allowed value to return is 1.0.
+ *
+ * Implement only the wake-up version of this sensor.
+ */
+#define SENSOR_TYPE_GLANCE_GESTURE                             (24)
+#define SENSOR_STRING_TYPE_GLANCE_GESTURE                      "android.sensor.glance_gesture"
+
+/**
+ * SENSOR_TYPE_PICK_UP_GESTURE
+ * reporting-mode: one-shot
+ *
+ * A sensor of this type triggers when the device is picked up regardless of wherever is was
+ * before (desk, pocket, bag). The only allowed return value is 1.0.
+ * This sensor de-activates itself immediately after it triggers.
+ *
+ * Implement only the wake-up version of this sensor.
+ */
+#define SENSOR_TYPE_PICK_UP_GESTURE                            (25)
+#define SENSOR_STRING_TYPE_PICK_UP_GESTURE                     "android.sensor.pick_up_gesture"
+
+/*
+ * SENSOR_TYPE_WRIST_TILT_GESTURE
+ * trigger-mode: special
+ * wake-up sensor: yes
+ *
+ * A sensor of this type triggers an event each time a tilt of the wrist-worn
+ * device is detected.
+ *
+ * This sensor must be low power, as it is likely to be activated 24/7.
+ * The only allowed value to return is 1.0.
+ *
+ * Implement only the wake-up version of this sensor.
+ */
+#define SENSOR_TYPE_WRIST_TILT_GESTURE                         (26)
+#define SENSOR_STRING_TYPE_WRIST_TILT_GESTURE                  "android.sensor.wrist_tilt_gesture"
 
 /**
  * Values returned by the accelerometer in various locations in the universe.
@@ -746,17 +670,15 @@
 /** Minimum magnetic field on Earth's surface */
 #define MAGNETIC_FIELD_EARTH_MIN    (30.0f)
 
-
 /**
- * status of orientation sensor
+ * Possible values of the status field of sensor events.
  */
-
+#define SENSOR_STATUS_NO_CONTACT        -1
 #define SENSOR_STATUS_UNRELIABLE        0
 #define SENSOR_STATUS_ACCURACY_LOW      1
 #define SENSOR_STATUS_ACCURACY_MEDIUM   2
 #define SENSOR_STATUS_ACCURACY_HIGH     3
 
-
 /**
  * sensor event data
  */
@@ -800,12 +722,29 @@
   };
 } uncalibrated_event_t;
 
+/**
+ * Meta data event data
+ */
 typedef struct meta_data_event {
     int32_t what;
     int32_t sensor;
 } meta_data_event_t;
 
 /**
+ * Heart rate event data
+ */
+typedef struct {
+  // Heart rate in beats per minute.
+  // Set to 0 when status is SENSOR_STATUS_UNRELIABLE or ..._NO_CONTACT
+  float bpm;
+  // Status of the sensor for this reading. Set to one SENSOR_STATUS_...
+  // Note that this value should only be set for sensors that explicitly define
+  // the meaning of this field. This field is not piped through the framework
+  // for other sensors.
+  int8_t status;
+} heart_rate_event_t;
+
+/**
  * Union of the various types of sensor data
  * that can be returned.
  */
@@ -862,6 +801,9 @@
             /* uncalibrated magnetometer values are in micro-Teslas */
             uncalibrated_event_t uncalibrated_magnetic;
 
+            /* heart rate data containing value in bpm and status */
+            heart_rate_event_t heart_rate;
+
             /* this is a special event. see SENSOR_TYPE_META_DATA above.
              * sensors_meta_data_event_t events are all reported with a type of
              * SENSOR_TYPE_META_DATA. The handle is ignored and must be zero.
@@ -876,7 +818,11 @@
             uint64_t        step_counter;
         } u64;
     };
-    uint32_t reserved1[4];
+
+    /* Reserved flags for internal use. Set to zero. */
+    uint32_t flags;
+
+    uint32_t reserved1[3];
 } sensors_event_t;
 
 
@@ -900,6 +846,18 @@
      */
     int (*get_sensors_list)(struct sensors_module_t* module,
             struct sensor_t const** list);
+
+    /**
+     *  Place the module in a specific mode. The following modes are defined
+     *
+     *  0 - Normal operation. Default state of the module.
+     *  1 - Loopback mode. Data is injected for the the supported
+     *      sensors by the sensor service in this mode.
+     * @return 0 on success
+     *         -EINVAL if requested mode is not supported
+     *         -EPERM if operation is not allowed
+     */
+    int (*set_operation_mode)(unsigned int mode);
 };
 
 struct sensor_t {
@@ -916,7 +874,7 @@
      * must increase when the driver is updated in a way that changes the
      * output of this sensor. This is important for fused sensors when the
      * fusion algorithm is updated.
-     */    
+     */
     int             version;
 
     /* handle that identifies this sensors. This handle is used to reference
@@ -936,7 +894,7 @@
     /* rough estimate of this sensor's power consumption in mA */
     float           power;
 
-    /* this value depends on the trigger mode:
+    /* this value depends on the reporting mode:
      *
      *   continuous: minimum sample period allowed in microseconds
      *   on-change : 0
@@ -958,28 +916,78 @@
      */
     uint32_t        fifoMaxEventCount;
 
+    /* type of this sensor as a string. Set to corresponding
+     * SENSOR_STRING_TYPE_*.
+     * When defining an OEM specific sensor or sensor manufacturer specific
+     * sensor, use your reserve domain name as a prefix.
+     * ex: com.google.glass.onheaddetector
+     * For sensors of known type, the android framework might overwrite this
+     * string automatically.
+     */
+    const char*    stringType;
+
+    /* permission required to see this sensor, register to it and receive data.
+     * Set to "" if no permission is required. Some sensor types like the
+     * heart rate monitor have a mandatory require_permission.
+     * For sensors that always require a specific permission, like the heart
+     * rate monitor, the android framework might overwrite this string
+     * automatically.
+     */
+    const char*    requiredPermission;
+
+    /* This value is defined only for continuous mode and on-change sensors. It is the delay between
+     * two sensor events corresponding to the lowest frequency that this sensor supports. When lower
+     * frequencies are requested through batch()/setDelay() the events will be generated at this
+     * frequency instead. It can be used by the framework or applications to estimate when the batch
+     * FIFO may be full.
+     *
+     * NOTE: 1) period_ns is in nanoseconds where as maxDelay/minDelay are in microseconds.
+     *              continuous, on-change: maximum sampling period allowed in microseconds.
+     *              one-shot, special : 0
+     *   2) maxDelay should always fit within a 32 bit signed integer. It is declared as 64 bit
+     *      on 64 bit architectures only for binary compatibility reasons.
+     * Availability: SENSORS_DEVICE_API_VERSION_1_3
+     */
+    #ifdef __LP64__
+       int64_t maxDelay;
+    #else
+       int32_t maxDelay;
+    #endif
+
+    /* Flags for sensor. See SENSOR_FLAG_* above. Only the least significant 32 bits are used here.
+     * It is declared as 64 bit on 64 bit architectures only for binary compatibility reasons.
+     * Availability: SENSORS_DEVICE_API_VERSION_1_3
+     */
+    #ifdef __LP64__
+       uint64_t flags;
+    #else
+       uint32_t flags;
+    #endif
+
     /* reserved fields, must be zero */
-    void*           reserved[6];
+    void*           reserved[2];
 };
 
 
 /*
  * sensors_poll_device_t is used with SENSORS_DEVICE_API_VERSION_0_1
  * and is present for backward binary and source compatibility.
- * (see documentation of the hooks in struct sensors_poll_device_1 below)
+ * See the Sensors HAL interface section for complete descriptions of the
+ * following functions:
+ * http://source.android.com/devices/sensors/index.html#hal
  */
 struct sensors_poll_device_t {
     struct hw_device_t common;
     int (*activate)(struct sensors_poll_device_t *dev,
-            int handle, int enabled);
+            int sensor_handle, int enabled);
     int (*setDelay)(struct sensors_poll_device_t *dev,
-            int handle, int64_t ns);
+            int sensor_handle, int64_t sampling_period_ns);
     int (*poll)(struct sensors_poll_device_t *dev,
             sensors_event_t* data, int count);
 };
 
 /*
- * struct sensors_poll_device_1 is used with SENSORS_DEVICE_API_VERSION_1_0
+ * struct sensors_poll_device_1 is used in HAL versions >= SENSORS_DEVICE_API_VERSION_1_0
  */
 typedef struct sensors_poll_device_1 {
     union {
@@ -991,70 +999,27 @@
         struct {
             struct hw_device_t common;
 
-            /* Activate/de-activate one sensor.
+            /* Activate/de-activate one sensor. Return 0 on success, negative
              *
-             * handle is the handle of the sensor to change.
+             * sensor_handle is the handle of the sensor to change.
              * enabled set to 1 to enable, or 0 to disable the sensor.
              *
-             * if enabled is set to 1, the sensor is activated even if
-             * setDelay() wasn't called before. In this case, a default rate
-             * should be used.
-             *
-             * unless otherwise noted in the sensor types definitions, an
-             * activated sensor never prevents the SoC to go into suspend
-             * mode; that is, the HAL shall not hold a partial wake-lock on
-             * behalf of applications.
-             *
-             * one-shot sensors de-activate themselves automatically upon
-             * receiving an event and they must still accept to be deactivated
-             * through a call to activate(..., ..., 0).
-             *
-             * if "enabled" is 1 and the sensor is already activated, this
-             * function is a no-op and succeeds.
-             *
-             * if "enabled" is 0 and the sensor is already de-activated,
-             * this function is a no-op and succeeds.
-             *
-             * return 0 on success, negative errno code otherwise
+             * Return 0 on success, negative errno code otherwise.
              */
             int (*activate)(struct sensors_poll_device_t *dev,
-                    int handle, int enabled);
+                    int sensor_handle, int enabled);
 
             /**
              * Set the events's period in nanoseconds for a given sensor.
-             *
-             * What the period_ns parameter means depends on the specified
-             * sensor's trigger mode:
-             *
-             * continuous: setDelay() sets the sampling rate.
-             * on-change: setDelay() limits the delivery rate of events
-             * one-shot: setDelay() is ignored. it has no effect.
-             * special: see specific sensor type definitions
-             *
-             * For continuous and on-change sensors, if the requested value is
-             * less than sensor_t::minDelay, then it's silently clamped to
-             * sensor_t::minDelay unless sensor_t::minDelay is 0, in which
-             * case it is clamped to >= 1ms.
-             *
-             * setDelay will not be called when the sensor is in batching mode.
-             * In this case, batch() will be called with the new period.
-             *
-             * @return 0 if successful, < 0 on error
+             * If sampling_period_ns > max_delay it will be truncated to
+             * max_delay and if sampling_period_ns < min_delay it will be
+             * replaced by min_delay.
              */
             int (*setDelay)(struct sensors_poll_device_t *dev,
-                    int handle, int64_t period_ns);
+                    int sensor_handle, int64_t sampling_period_ns);
 
             /**
              * Returns an array of sensor data.
-             * This function must block until events are available.
-             *
-             * return the number of events read on success, or -errno in case
-             * of an error.
-             *
-             * The number of events returned in data must be less or equal
-             * to the "count" argument.
-             *
-             * This function shall never return 0 (no event).
              */
             int (*poll)(struct sensors_poll_device_t *dev,
                     sensors_event_t* data, int count);
@@ -1063,239 +1028,47 @@
 
 
     /*
-     * Enables batch mode for the given sensor and sets the delay between events
-     *
-     * A timeout value of zero disables batch mode for the given sensor.
-     *
-     * The period_ns parameter is equivalent to calling setDelay() -- this
-     * function both enables or disables the batch mode AND sets the events's
-     * period in nanosecond. See setDelay() above for a detailed explanation of
-     * the period_ns parameter.
-     *
-     * BATCH MODE:
-     * -----------
-     * In non-batch mode, all sensor events must be reported as soon as they
-     * are detected. For example, an accelerometer activated at 50Hz will
-     * trigger interrupts 50 times per second.
-     * While in batch mode, sensor events do not need to be reported as soon
-     * as they are detected. They can be temporarily stored in batches and
-     * reported in batches, as long as no event is delayed by more than
-     * "timeout" nanoseconds. That is, all events since the previous batch
-     * are recorded and returned all at once. This allows to reduce the amount
-     * of interrupts sent to the SoC, and allow the SoC to switch to a lower
-     * power state (Idle) while the sensor is capturing and batching data.
-     *
-     * setDelay() is not affected and it behaves as usual.
-     *
-     * Each event has a timestamp associated with it, the timestamp
-     * must be accurate and correspond to the time at which the event
-     * physically happened.
-     *
-     * Batching does not modify the behavior of poll(): batches from different
-     * sensors can be interleaved and split. As usual, all events from the same
-     * sensor are time-ordered.
-     *
-     * BEHAVIOUR OUTSIDE OF SUSPEND MODE:
-     * ----------------------------------
-     *
-     * When the SoC is awake (not in suspend mode), events must be reported in
-     * batches at least every "timeout". No event shall be dropped or lost.
-     * If internal h/w FIFOs fill-up before the timeout, then events are
-     * reported at that point to ensure no event is lost.
-     *
-     *
-     * NORMAL BEHAVIOR IN SUSPEND MODE:
-     * ---------------------------------
-     *
-     * By default, batch mode doesn't significantly change the interaction with
-     * suspend mode. That is, sensors must continue to allow the SoC to
-     * go into suspend mode and sensors must stay active to fill their
-     * internal FIFO. In this mode, when the FIFO fills up, it shall wrap
-     * around (basically behave like a circular buffer, overwriting events).
-     * As soon as the SoC comes out of suspend mode, a batch is produced with
-     * as much as the recent history as possible, and batch operation
-     * resumes as usual.
-     *
-     * The behavior described above allows applications to record the recent
-     * history of a set of sensor while keeping the SoC into suspend. It
-     * also allows the hardware to not have to rely on a wake-up interrupt line.
-     *
-     * WAKE_UPON_FIFO_FULL BEHAVIOR IN SUSPEND MODE:
-     * ----------------------------------------------
-     *
-     * There are cases, however, where an application cannot afford to lose
-     * any events, even when the device goes into suspend mode.
-     * For a given rate, if a sensor has the capability to store at least 10
-     * seconds worth of events in its FIFO and is able to wake up the Soc, it
-     * can implement an optional secondary mode: the WAKE_UPON_FIFO_FULL mode.
-     *
-     * The caller will set the SENSORS_BATCH_WAKE_UPON_FIFO_FULL flag to
-     * activate this mode. If the sensor does not support this mode, batch()
-     * will fail when the flag is set.
-     *
-     * When running with the WAKE_UPON_FIFO_FULL flag set, no events can be
-     * lost. When the FIFO is getting full, the sensor must wake up the SoC from
-     * suspend and return a batch before the FIFO fills-up.
-     * Depending on the device, it might take a few miliseconds for the SoC to
-     * entirely come out of suspend and start flushing the FIFO. Enough head
-     * room must be allocated in the FIFO to allow the device to entirely come
-     * out of suspend without the FIFO overflowing (no events shall be lost).
-     *
-     *   Implementing the WAKE_UPON_FIFO_FULL mode is optional.
-     *   If the hardware cannot support this mode, or if the physical
-     *   FIFO is so small that the device would never be allowed to go into
-     *   suspend for at least 10 seconds, then this function MUST fail when
-     *   the flag SENSORS_BATCH_WAKE_UPON_FIFO_FULL is set, regardless of
-     *   the value of the timeout parameter.
-     *
-     *
-     * DRY RUN:
-     * --------
-     *
-     * If the flag SENSORS_BATCH_DRY_RUN is set, this function returns
-     * without modifying the batch mode or the event period and has no side
-     * effects, but returns errors as usual (as it would if this flag was
-     * not set). This flag is used to check if batch mode is available for a
-     * given configuration -- in particular for a given sensor at a given rate.
-     *
-     *
-     * Return values:
-     * --------------
-     *
-     * Because sensors must be independent, the return value must not depend
-     * on the state of the system (whether another sensor is on or not),
-     * nor on whether the flag SENSORS_BATCH_DRY_RUN is set (in other words,
-     * if a batch call with SENSORS_BATCH_DRY_RUN is successful,
-     * the same call without SENSORS_BATCH_DRY_RUN must succeed as well).
-     *
-     * When timeout is not 0:
-     *   If successful, 0 is returned.
-     *   If the specified sensor doesn't support batch mode, return -EINVAL.
-     *   If the specified sensor's trigger-mode is one-shot, return -EINVAL.
-     *   If WAKE_UPON_FIFO_FULL is specified and the specified sensor's internal
-     *   FIFO is too small to store at least 10 seconds worth of data at the
-     *   given rate, -EINVAL is returned. Note that as stated above, this has to
-     *   be determined at compile time, and not based on the state of the
-     *   system.
-     *   If some other constraints above cannot be satisfied, return -EINVAL.
-     *
-     * Note: the timeout parameter, when > 0, has no impact on whether this
-     *       function succeeds or fails.
-     *
-     * When timeout is 0:
-     *   The caller will never set the wake_upon_fifo_full flag.
-     *   The function must succeed, and batch mode must be deactivated.
-     *
-     * Independently of whether DRY_RUN is specified, When the call to batch()
-     * fails, no state should be changed. In particular, a failed call to
-     * batch() should not change the rate of the sensor. Example:
-     *   setDelay(..., 10ms)
-     *   batch(..., 20ms, ...) fails
-     *   rate should stay 10ms.
-     *
-     *
-     * IMPLEMENTATION NOTES:
-     * ---------------------
-     *
-     * Batch mode, if supported, should happen at the hardware level,
-     * typically using hardware FIFOs. In particular, it SHALL NOT be
-     * implemented in the HAL, as this would be counter productive.
-     * The goal here is to save significant amounts of power.
-     *
-     * In some implementations, events from several sensors can share the
-     * same physical FIFO. In that case, all events in the FIFO can be sent and
-     * processed by the HAL as soon as one batch must be reported.
-     * For example, if the following sensors are activated:
-     *  - accelerometer batched with timeout = 20s
-     *  - gyroscope batched with timeout = 5s
-     * then the accelerometer batches can be reported at the same time the
-     * gyroscope batches are reported (every 5 seconds)
-     *
-     * Batch mode can be enabled or disabled at any time, in particular
-     * while the specified sensor is already enabled, and this shall not
-     * result in the loss of events.
-     *
-     * COMPARATIVE IMPORTANCE OF BATCHING FOR DIFFERENT SENSORS:
-     * ---------------------------------------------------------
-     *
-     * On platforms on which hardware fifo size is limited, the system designers
-     * might have to choose how much fifo to reserve for each sensor. To help
-     * with this choice, here is a list of applications made possible when
-     * batching is implemented on the different sensors.
-     *
-     * High value: Low power pedestrian dead reckoning
-     *   Target batching time: 20 seconds to 1 minute
-     *   Sensors to batch:
-     *    - Step detector
-     *    - Rotation vector or game rotation vector at 5Hz
-     *   Gives us step and heading while letting the SoC go to Suspend.
-     *
-     * High value: Medium power activity/gesture recognition
-     *   Target batching time: 3 seconds
-     *   Sensors to batch: accelerometer between 20Hz and 50Hz
-     *   Allows recognizing arbitrary activities and gestures without having
-     *   to keep the SoC fully awake while the data is collected.
-     *
-     * Medium-high value: Interrupt load reduction
-     *   Target batching time: < 1 second
-     *   Sensors to batch: any high frequency sensor.
-     *   If the gyroscope is set at 800Hz, even batching just 10 gyro events can
-     *   reduce the number of interrupts from 800/second to 80/second.
-     *
-     * Medium value: Continuous low frequency data collection
-     *   Target batching time: > 1 minute
-     *   Sensors to batch: barometer, humidity sensor, other low frequency
-     *     sensors.
-     *   Allows creating monitoring applications at low power.
-     *
-     * Medium value: Continuous full-sensors collection
-     *   Target batching time: > 1 minute
-     *   Sensors to batch: all, at high frequencies
-     *   Allows full collection of sensor data while leaving the SoC in
-     *   suspend mode. Only to consider if fifo space is not an issue.
-     *
-     * In each of the cases above, if WAKE_UPON_FIFO_FULL is implemented, the
-     * applications might decide to let the SoC go to suspend, allowing for even
-     * more power savings.
+     * Sets a sensor’s parameters, including sampling frequency and maximum
+     * report latency. This function can be called while the sensor is
+     * activated, in which case it must not cause any sensor measurements to
+     * be lost: transitioning from one sampling rate to the other cannot cause
+     * lost events, nor can transitioning from a high maximum report latency to
+     * a low maximum report latency.
+     * See the Batching sensor results page for details:
+     * http://source.android.com/devices/sensors/batching.html
      */
     int (*batch)(struct sensors_poll_device_1* dev,
-            int handle, int flags, int64_t period_ns, int64_t timeout);
+            int sensor_handle, int flags, int64_t sampling_period_ns,
+            int64_t max_report_latency_ns);
 
     /*
      * Flush adds a META_DATA_FLUSH_COMPLETE event (sensors_event_meta_data_t)
      * to the end of the "batch mode" FIFO for the specified sensor and flushes
-     * the FIFO; those events are delivered as usual (i.e.: as if the batch
-     * timeout had expired) and removed from the FIFO.
-     *
-     * See the META_DATA_FLUSH_COMPLETE section for details about the
-     * META_DATA_FLUSH_COMPLETE event.
-     *
-     * The flush happens asynchronously (i.e.: this function must return
-     * immediately).
-     *
-     * If the implementation uses a single FIFO for several sensors, that
-     * FIFO is flushed and the META_DATA_FLUSH_COMPLETE event is added only
-     * for the specified sensor.
-     *
-     * If the specified sensor wasn't in batch mode, flush succeeds and
-     * promptly sends a META_DATA_FLUSH_COMPLETE event for that sensor.
-     *
-     * If the FIFO was empty at the time of the call, flush returns
-     * 0 (success) and promptly sends a META_DATA_FLUSH_COMPLETE event
-     * for that sensor.
-     *
-     * If the specified sensor wasn't enabled, flush returns -EINVAL.
-     *
-     * return 0 on success, negative errno code otherwise.
+     * the FIFO.
+     * If the FIFO is empty or if the sensor doesn't support batching (FIFO size zero),
+     * it should return SUCCESS along with a trivial META_DATA_FLUSH_COMPLETE event added to the
+     * event stream. This applies to all sensors other than one-shot sensors.
+     * If the sensor is a one-shot sensor, flush must return -EINVAL and not generate
+     * any flush complete metadata.
+     * If the sensor is not active at the time flush() is called, flush() should return
+     * -EINVAL.
      */
-    int (*flush)(struct sensors_poll_device_1* dev, int handle);
+    int (*flush)(struct sensors_poll_device_1* dev, int sensor_handle);
 
-    void (*reserved_procs[8])(void);
+    /*
+     * Inject a single sensor sample to be to this device.
+     * data points to the sensor event to be injected
+     * @return 0 on success
+     *         -EPERM if operation is not allowed
+     *         -EINVAL if sensor event cannot be injected
+     */
+    int (*inject_sensor_data)(struct sensors_poll_device_1 *dev, const sensors_event_t *data);
+
+    void (*reserved_procs[7])(void);
 
 } sensors_poll_device_1_t;
 
 
-
 /** convenience API for opening and closing a device */
 
 static inline int sensors_open(const struct hw_module_t* module,
diff --git a/include/hardware/sound_trigger.h b/include/hardware/sound_trigger.h
new file mode 100644
index 0000000..2a8db87
--- /dev/null
+++ b/include/hardware/sound_trigger.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <system/audio.h>
+#include <system/sound_trigger.h>
+#include <hardware/hardware.h>
+
+#ifndef ANDROID_SOUND_TRIGGER_HAL_H
+#define ANDROID_SOUND_TRIGGER_HAL_H
+
+
+__BEGIN_DECLS
+
+/**
+ * The id of this module
+ */
+#define SOUND_TRIGGER_HARDWARE_MODULE_ID "sound_trigger"
+
+/**
+ * Name of the audio devices to open
+ */
+#define SOUND_TRIGGER_HARDWARE_INTERFACE "sound_trigger_hw_if"
+
+#define SOUND_TRIGGER_MODULE_API_VERSION_1_0 HARDWARE_MODULE_API_VERSION(1, 0)
+#define SOUND_TRIGGER_MODULE_API_VERSION_CURRENT SOUND_TRIGGER_MODULE_API_VERSION_1_0
+
+
+#define SOUND_TRIGGER_DEVICE_API_VERSION_1_0 HARDWARE_DEVICE_API_VERSION(1, 0)
+#define SOUND_TRIGGER_DEVICE_API_VERSION_CURRENT SOUND_TRIGGER_DEVICE_API_VERSION_1_0
+
+/**
+ * List of known sound trigger HAL modules. This is the base name of the sound_trigger HAL
+ * library composed of the "sound_trigger." prefix, one of the base names below and
+ * a suffix specific to the device.
+ * e.g: sondtrigger.primary.goldfish.so or sound_trigger.primary.default.so
+ */
+
+#define SOUND_TRIGGER_HARDWARE_MODULE_ID_PRIMARY "primary"
+
+
+/**
+ * Every hardware module must have a data structure named HAL_MODULE_INFO_SYM
+ * and the fields of this data structure must begin with hw_module_t
+ * followed by module specific information.
+ */
+struct sound_trigger_module {
+    struct hw_module_t common;
+};
+
+typedef void (*recognition_callback_t)(struct sound_trigger_recognition_event *event, void *cookie);
+typedef void (*sound_model_callback_t)(struct sound_trigger_model_event *event, void *cookie);
+
+struct sound_trigger_hw_device {
+    struct hw_device_t common;
+
+    /*
+     * Retrieve implementation properties.
+     */
+    int (*get_properties)(const struct sound_trigger_hw_device *dev,
+                          struct sound_trigger_properties *properties);
+
+    /*
+     * Load a sound model. Once loaded, recognition of this model can be started and stopped.
+     * Only one active recognition per model at a time. The SoundTrigger service will handle
+     * concurrent recognition requests by different users/applications on the same model.
+     * The implementation returns a unique handle used by other functions (unload_sound_model(),
+     * start_recognition(), etc...
+     */
+    int (*load_sound_model)(const struct sound_trigger_hw_device *dev,
+                            struct sound_trigger_sound_model *sound_model,
+                            sound_model_callback_t callback,
+                            void *cookie,
+                            sound_model_handle_t *handle);
+
+    /*
+     * Unload a sound model. A sound model can be unloaded to make room for a new one to overcome
+     * implementation limitations.
+     */
+    int (*unload_sound_model)(const struct sound_trigger_hw_device *dev,
+                              sound_model_handle_t handle);
+
+    /* Start recognition on a given model. Only one recognition active at a time per model.
+     * Once recognition succeeds of fails, the callback is called.
+     * TODO: group recognition configuration parameters into one struct and add key phrase options.
+     */
+    int (*start_recognition)(const struct sound_trigger_hw_device *dev,
+                             sound_model_handle_t sound_model_handle,
+                             const struct sound_trigger_recognition_config *config,
+                             recognition_callback_t callback,
+                             void *cookie);
+
+    /* Stop recognition on a given model.
+     * The implementation does not have to call the callback when stopped via this method.
+     */
+    int (*stop_recognition)(const struct sound_trigger_hw_device *dev,
+                           sound_model_handle_t sound_model_handle);
+};
+
+typedef struct sound_trigger_hw_device sound_trigger_hw_device_t;
+
+/** convenience API for opening and closing a supported device */
+
+static inline int sound_trigger_hw_device_open(const struct hw_module_t* module,
+                                       struct sound_trigger_hw_device** device)
+{
+    return module->methods->open(module, SOUND_TRIGGER_HARDWARE_INTERFACE,
+                                 (struct hw_device_t**)device);
+}
+
+static inline int sound_trigger_hw_device_close(struct sound_trigger_hw_device* device)
+{
+    return device->common.close(&device->common);
+}
+
+__END_DECLS
+
+#endif  // ANDROID_SOUND_TRIGGER_HAL_H
diff --git a/include/hardware/tv_input.h b/include/hardware/tv_input.h
new file mode 100644
index 0000000..ed3fafb
--- /dev/null
+++ b/include/hardware/tv_input.h
@@ -0,0 +1,405 @@
+/*
+ * Copyright 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_TV_INPUT_INTERFACE_H
+#define ANDROID_TV_INPUT_INTERFACE_H
+
+#include <stdint.h>
+#include <sys/cdefs.h>
+#include <sys/types.h>
+
+#include <hardware/hardware.h>
+#include <system/audio.h>
+#include <system/window.h>
+
+__BEGIN_DECLS
+
+/*
+ * Module versioning information for the TV input hardware module, based on
+ * tv_input_module_t.common.module_api_version.
+ *
+ * Version History:
+ *
+ * TV_INPUT_MODULE_API_VERSION_0_1:
+ * Initial TV input hardware module API.
+ *
+ */
+
+#define TV_INPUT_MODULE_API_VERSION_0_1  HARDWARE_MODULE_API_VERSION(0, 1)
+
+#define TV_INPUT_DEVICE_API_VERSION_0_1  HARDWARE_DEVICE_API_VERSION(0, 1)
+
+/*
+ * The id of this module
+ */
+#define TV_INPUT_HARDWARE_MODULE_ID "tv_input"
+
+#define TV_INPUT_DEFAULT_DEVICE "default"
+
+/*****************************************************************************/
+
+/*
+ * Every hardware module must have a data structure named HAL_MODULE_INFO_SYM
+ * and the fields of this data structure must begin with hw_module_t
+ * followed by module specific information.
+ */
+typedef struct tv_input_module {
+    struct hw_module_t common;
+} tv_input_module_t;
+
+/*****************************************************************************/
+
+enum {
+    /* Generic hardware. */
+    TV_INPUT_TYPE_OTHER_HARDWARE = 1,
+    /* Tuner. (e.g. built-in terrestrial tuner) */
+    TV_INPUT_TYPE_TUNER = 2,
+    TV_INPUT_TYPE_COMPOSITE = 3,
+    TV_INPUT_TYPE_SVIDEO = 4,
+    TV_INPUT_TYPE_SCART = 5,
+    TV_INPUT_TYPE_COMPONENT = 6,
+    TV_INPUT_TYPE_VGA = 7,
+    TV_INPUT_TYPE_DVI = 8,
+    /* Physical HDMI port. (e.g. HDMI 1) */
+    TV_INPUT_TYPE_HDMI = 9,
+    TV_INPUT_TYPE_DISPLAY_PORT = 10,
+};
+typedef uint32_t tv_input_type_t;
+
+typedef struct tv_input_device_info {
+    /* Device ID */
+    int device_id;
+
+    /* Type of physical TV input. */
+    tv_input_type_t type;
+
+    union {
+        struct {
+            /* HDMI port ID number */
+            uint32_t port_id;
+        } hdmi;
+
+        /* TODO: add other type specific information. */
+
+        int32_t type_info_reserved[16];
+    };
+
+    /* TODO: Add capability if necessary. */
+
+    /*
+     * Audio info
+     *
+     * audio_type == AUDIO_DEVICE_NONE if this input has no audio.
+     */
+    audio_devices_t audio_type;
+    const char* audio_address;
+
+    int32_t reserved[16];
+} tv_input_device_info_t;
+
+/* See tv_input_event_t for more details. */
+enum {
+    /*
+     * Hardware notifies the framework that a device is available.
+     *
+     * Note that DEVICE_AVAILABLE and DEVICE_UNAVAILABLE events do not represent
+     * hotplug events (i.e. plugging cable into or out of the physical port).
+     * These events notify the framework whether the port is available or not.
+     * For a concrete example, when a user plugs in or pulls out the HDMI cable
+     * from a HDMI port, it does not generate DEVICE_AVAILABLE and/or
+     * DEVICE_UNAVAILABLE events. However, if a user inserts a pluggable USB
+     * tuner into the Android device, it will generate a DEVICE_AVAILABLE event
+     * and when the port is removed, it should generate a DEVICE_UNAVAILABLE
+     * event.
+     *
+     * For hotplug events, please see STREAM_CONFIGURATION_CHANGED for more
+     * details.
+     *
+     * HAL implementation should register devices by using this event when the
+     * device boots up. The framework will recognize device reported via this
+     * event only. In addition, the implementation could use this event to
+     * notify the framework that a removable TV input device (such as USB tuner
+     * as stated in the example above) is attached.
+     */
+    TV_INPUT_EVENT_DEVICE_AVAILABLE = 1,
+    /*
+     * Hardware notifies the framework that a device is unavailable.
+     *
+     * HAL implementation should generate this event when a device registered
+     * by TV_INPUT_EVENT_DEVICE_AVAILABLE is no longer available. For example,
+     * the event can indicate that a USB tuner is plugged out from the Android
+     * device.
+     *
+     * Note that this event is not for indicating cable plugged out of the port;
+     * for that purpose, the implementation should use
+     * STREAM_CONFIGURATION_CHANGED event. This event represents the port itself
+     * being no longer available.
+     */
+    TV_INPUT_EVENT_DEVICE_UNAVAILABLE = 2,
+    /*
+     * Stream configurations are changed. Client should regard all open streams
+     * at the specific device are closed, and should call
+     * get_stream_configurations() again, opening some of them if necessary.
+     *
+     * HAL implementation should generate this event when the available stream
+     * configurations change for any reason. A typical use case of this event
+     * would be to notify the framework that the input signal has changed
+     * resolution, or that the cable is plugged out so that the number of
+     * available streams is 0.
+     *
+     * The implementation may use this event to indicate hotplug status of the
+     * port. the framework regards input devices with no available streams as
+     * disconnected, so the implementation can generate this event with no
+     * available streams to indicate that this device is disconnected, and vice
+     * versa.
+     */
+    TV_INPUT_EVENT_STREAM_CONFIGURATIONS_CHANGED = 3,
+    /*
+     * Hardware is done with capture request with the buffer. Client can assume
+     * ownership of the buffer again.
+     *
+     * HAL implementation should generate this event after request_capture() if
+     * it succeeded. The event shall have the buffer with the captured image.
+     */
+    TV_INPUT_EVENT_CAPTURE_SUCCEEDED = 4,
+    /*
+     * Hardware met a failure while processing a capture request or client
+     * canceled the request. Client can assume ownership of the buffer again.
+     *
+     * The event is similar to TV_INPUT_EVENT_CAPTURE_SUCCEEDED, but HAL
+     * implementation generates this event upon a failure to process
+     * request_capture(), or a request cancellation.
+     */
+    TV_INPUT_EVENT_CAPTURE_FAILED = 5,
+};
+typedef uint32_t tv_input_event_type_t;
+
+typedef struct tv_input_capture_result {
+    /* Device ID */
+    int device_id;
+
+    /* Stream ID */
+    int stream_id;
+
+    /* Sequence number of the request */
+    uint32_t seq;
+
+    /*
+     * The buffer passed to hardware in request_capture(). The content of
+     * buffer is undefined (although buffer itself is valid) for
+     * TV_INPUT_CAPTURE_FAILED event.
+     */
+    buffer_handle_t buffer;
+
+    /*
+     * Error code for the request. -ECANCELED if request is cancelled; other
+     * error codes are unknown errors.
+     */
+    int error_code;
+} tv_input_capture_result_t;
+
+typedef struct tv_input_event {
+    tv_input_event_type_t type;
+
+    union {
+        /*
+         * TV_INPUT_EVENT_DEVICE_AVAILABLE: all fields are relevant
+         * TV_INPUT_EVENT_DEVICE_UNAVAILABLE: only device_id is relevant
+         * TV_INPUT_EVENT_STREAM_CONFIGURATIONS_CHANGED: only device_id is
+         *    relevant
+         */
+        tv_input_device_info_t device_info;
+        /*
+         * TV_INPUT_EVENT_CAPTURE_SUCCEEDED: error_code is not relevant
+         * TV_INPUT_EVENT_CAPTURE_FAILED: all fields are relevant
+         */
+        tv_input_capture_result_t capture_result;
+    };
+} tv_input_event_t;
+
+typedef struct tv_input_callback_ops {
+    /*
+     * event contains the type of the event and additional data if necessary.
+     * The event object is guaranteed to be valid only for the duration of the
+     * call.
+     *
+     * data is an object supplied at device initialization, opaque to the
+     * hardware.
+     */
+    void (*notify)(struct tv_input_device* dev,
+            tv_input_event_t* event, void* data);
+} tv_input_callback_ops_t;
+
+enum {
+    TV_STREAM_TYPE_INDEPENDENT_VIDEO_SOURCE = 1,
+    TV_STREAM_TYPE_BUFFER_PRODUCER = 2,
+};
+typedef uint32_t tv_stream_type_t;
+
+typedef struct tv_stream_config {
+    /*
+     * ID number of the stream. This value is used to identify the whole stream
+     * configuration.
+     */
+    int stream_id;
+
+    /* Type of the stream */
+    tv_stream_type_t type;
+
+    /* Max width/height of the stream. */
+    uint32_t max_video_width;
+    uint32_t max_video_height;
+} tv_stream_config_t;
+
+typedef struct buffer_producer_stream {
+    /*
+     * IN/OUT: Width / height of the stream. Client may request for specific
+     * size but hardware may change it. Client must allocate buffers with
+     * specified width and height.
+     */
+    uint32_t width;
+    uint32_t height;
+
+    /* OUT: Client must set this usage when allocating buffer. */
+    uint32_t usage;
+
+    /* OUT: Client must allocate a buffer with this format. */
+    uint32_t format;
+} buffer_producer_stream_t;
+
+typedef struct tv_stream {
+    /* IN: ID in the stream configuration */
+    int stream_id;
+
+    /* OUT: Type of the stream (for convenience) */
+    tv_stream_type_t type;
+
+    /* Data associated with the stream for client's use */
+    union {
+        /* OUT: A native handle describing the sideband stream source */
+        native_handle_t* sideband_stream_source_handle;
+
+        /* IN/OUT: Details are in buffer_producer_stream_t */
+        buffer_producer_stream_t buffer_producer;
+    };
+} tv_stream_t;
+
+/*
+ * Every device data structure must begin with hw_device_t
+ * followed by module specific public methods and attributes.
+ */
+typedef struct tv_input_device {
+    struct hw_device_t common;
+
+    /*
+     * initialize:
+     *
+     * Provide callbacks to the device and start operation. At first, no device
+     * is available and after initialize() completes, currently available
+     * devices including static devices should notify via callback.
+     *
+     * Framework owns callbacks object.
+     *
+     * data is a framework-owned object which would be sent back to the
+     * framework for each callback notifications.
+     *
+     * Return 0 on success.
+     */
+    int (*initialize)(struct tv_input_device* dev,
+            const tv_input_callback_ops_t* callback, void* data);
+
+    /*
+     * get_stream_configurations:
+     *
+     * Get stream configurations for a specific device. An input device may have
+     * multiple configurations.
+     *
+     * The configs object is guaranteed to be valid only until the next call to
+     * get_stream_configurations() or STREAM_CONFIGURATIONS_CHANGED event.
+     *
+     * Return 0 on success.
+     */
+    int (*get_stream_configurations)(const struct tv_input_device* dev,
+            int device_id, int* num_configurations,
+            const tv_stream_config_t** configs);
+
+    /*
+     * open_stream:
+     *
+     * Open a stream with given stream ID. Caller owns stream object, and the
+     * populated data is only valid until the stream is closed.
+     *
+     * Return 0 on success; -EBUSY if the client should close other streams to
+     * open the stream; -EEXIST if the stream with the given ID is already open;
+     * -EINVAL if device_id and/or stream_id are invalid; other non-zero value
+     * denotes unknown error.
+     */
+    int (*open_stream)(struct tv_input_device* dev, int device_id,
+            tv_stream_t* stream);
+
+    /*
+     * close_stream:
+     *
+     * Close a stream to a device. data in tv_stream_t* object associated with
+     * the stream_id is obsolete once this call finishes.
+     *
+     * Return 0 on success; -ENOENT if the stream is not open; -EINVAL if
+     * device_id and/or stream_id are invalid.
+     */
+    int (*close_stream)(struct tv_input_device* dev, int device_id,
+            int stream_id);
+
+    /*
+     * request_capture:
+     *
+     * Request buffer capture for a stream. This is only valid for buffer
+     * producer streams. The buffer should be created with size, format and
+     * usage specified in the stream. Framework provides seq in an
+     * increasing sequence per each stream. Hardware should provide the picture
+     * in a chronological order according to seq. For example, if two
+     * requests are being processed at the same time, the request with the
+     * smaller seq should get an earlier frame.
+     *
+     * The framework releases the ownership of the buffer upon calling this
+     * function. When the buffer is filled, hardware notifies the framework
+     * via TV_INPUT_EVENT_CAPTURE_FINISHED callback, and the ownership is
+     * transferred back to framework at that time.
+     *
+     * Return 0 on success; -ENOENT if the stream is not open; -EINVAL if
+     * device_id and/or stream_id are invalid; -EWOULDBLOCK if HAL cannot take
+     * additional requests until it releases a buffer.
+     */
+    int (*request_capture)(struct tv_input_device* dev, int device_id,
+            int stream_id, buffer_handle_t buffer, uint32_t seq);
+
+    /*
+     * cancel_capture:
+     *
+     * Cancel an ongoing capture. Hardware should release the buffer as soon as
+     * possible via TV_INPUT_EVENT_CAPTURE_FAILED callback.
+     *
+     * Return 0 on success; -ENOENT if the stream is not open; -EINVAL if
+     * device_id, stream_id, and/or seq are invalid.
+     */
+    int (*cancel_capture)(struct tv_input_device* dev, int device_id,
+            int stream_id, uint32_t seq);
+
+    void* reserved[16];
+} tv_input_device_t;
+
+__END_DECLS
+
+#endif  // ANDROID_TV_INPUT_INTERFACE_H
diff --git a/include/hardware/vibrator.h b/include/hardware/vibrator.h
index d1a300a..200adf0 100644
--- a/include/hardware/vibrator.h
+++ b/include/hardware/vibrator.h
@@ -35,7 +35,13 @@
 
 struct vibrator_device;
 typedef struct vibrator_device {
-  struct hw_device_t common;
+    /**
+     * Common methods of the vibrator device.  This *must* be the first member of
+     * vibrator_device as users of this structure will cast a hw_device_t to
+     * vibrator_device pointer in contexts where it's known the hw_device_t references a
+     * vibrator_device.
+     */
+    struct hw_device_t common;
 
     /** Turn on vibrator
      *
diff --git a/modules/Android.mk b/modules/Android.mk
index de41f6f..9f7e5f0 100644
--- a/modules/Android.mk
+++ b/modules/Android.mk
@@ -1,3 +1,4 @@
 hardware_modules := gralloc hwcomposer audio nfc nfc-nci local_time \
-	power usbaudio audio_remote_submix camera consumerir vibrator
+	power usbaudio audio_remote_submix camera usbcamera consumerir sensors vibrator \
+	tv_input fingerprint input
 include $(call all-named-subdir-makefiles,$(hardware_modules))
diff --git a/modules/audio/Android.mk b/modules/audio/Android.mk
index a31c85f..ef4b8f5 100644
--- a/modules/audio/Android.mk
+++ b/modules/audio/Android.mk
@@ -31,6 +31,23 @@
 
 include $(BUILD_SHARED_LIBRARY)
 
+# The stub audio HAL module, identical to the default audio hal, but with
+# different name to be loaded concurrently with other audio HALs if necessary.
+# This can also be used as skeleton for new implementations
+#
+# The format of the name is audio.<type>.<hardware/etc>.so where the only
+# required type is 'primary'. Other possibilites are 'a2dp', 'usb', etc.
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := audio.stub.default
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_SRC_FILES := audio_hw.c
+LOCAL_SHARED_LIBRARIES := liblog libcutils
+LOCAL_MODULE_TAGS := optional
+LOCAL_CFLAGS := -Wno-unused-parameter
+
+include $(BUILD_SHARED_LIBRARY)
+
 # The stub audio policy HAL module that can be used as a skeleton for
 # new implementations.
 include $(CLEAR_VARS)
diff --git a/modules/audio/audio_hw.c b/modules/audio/audio_hw.c
index 3051519..a1a322f 100644
--- a/modules/audio/audio_hw.c
+++ b/modules/audio/audio_hw.c
@@ -18,6 +18,7 @@
 //#define LOG_NDEBUG 0
 
 #include <errno.h>
+#include <malloc.h>
 #include <pthread.h>
 #include <stdint.h>
 #include <sys/time.h>
@@ -47,65 +48,78 @@
 
 static int out_set_sample_rate(struct audio_stream *stream, uint32_t rate)
 {
-    return 0;
+    ALOGV("out_set_sample_rate: %d", 0);
+    return -ENOSYS;
 }
 
 static size_t out_get_buffer_size(const struct audio_stream *stream)
 {
+    ALOGV("out_get_buffer_size: %d", 4096);
     return 4096;
 }
 
 static audio_channel_mask_t out_get_channels(const struct audio_stream *stream)
 {
+    ALOGV("out_get_channels");
     return AUDIO_CHANNEL_OUT_STEREO;
 }
 
 static audio_format_t out_get_format(const struct audio_stream *stream)
 {
+    ALOGV("out_get_format");
     return AUDIO_FORMAT_PCM_16_BIT;
 }
 
 static int out_set_format(struct audio_stream *stream, audio_format_t format)
 {
-    return 0;
+    ALOGV("out_set_format: %d",format);
+    return -ENOSYS;
 }
 
 static int out_standby(struct audio_stream *stream)
 {
+    ALOGV("out_standby");
+
     return 0;
 }
 
 static int out_dump(const struct audio_stream *stream, int fd)
 {
+    ALOGV("out_dump");
     return 0;
 }
 
 static int out_set_parameters(struct audio_stream *stream, const char *kvpairs)
 {
+    ALOGV("out_set_parameters");
     return 0;
 }
 
 static char * out_get_parameters(const struct audio_stream *stream, const char *keys)
 {
+    ALOGV("out_get_parameters");
     return strdup("");
 }
 
 static uint32_t out_get_latency(const struct audio_stream_out *stream)
 {
+    ALOGV("out_get_latency");
     return 0;
 }
 
 static int out_set_volume(struct audio_stream_out *stream, float left,
                           float right)
 {
+    ALOGV("out_set_volume: Left:%f Right:%f", left, right);
     return 0;
 }
 
 static ssize_t out_write(struct audio_stream_out *stream, const void* buffer,
                          size_t bytes)
 {
+    ALOGV("out_write: bytes: %d", bytes);
     /* XXX: fake timing for audio output */
-    usleep(bytes * 1000000 / audio_stream_frame_size(&stream->common) /
+    usleep((int64_t)bytes * 1000000 / audio_stream_out_frame_size(stream) /
            out_get_sample_rate(&stream->common));
     return bytes;
 }
@@ -113,43 +127,53 @@
 static int out_get_render_position(const struct audio_stream_out *stream,
                                    uint32_t *dsp_frames)
 {
+    *dsp_frames = 0;
+    ALOGV("out_get_render_position: dsp_frames: %p", dsp_frames);
     return -EINVAL;
 }
 
 static int out_add_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
 {
+    ALOGV("out_add_audio_effect: %p", effect);
     return 0;
 }
 
 static int out_remove_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
 {
+    ALOGV("out_remove_audio_effect: %p", effect);
     return 0;
 }
 
 static int out_get_next_write_timestamp(const struct audio_stream_out *stream,
                                         int64_t *timestamp)
 {
+    *timestamp = 0;
+    ALOGV("out_get_next_write_timestamp: %ld", (long int)(*timestamp));
     return -EINVAL;
 }
 
 /** audio_stream_in implementation **/
 static uint32_t in_get_sample_rate(const struct audio_stream *stream)
 {
+    ALOGV("in_get_sample_rate");
     return 8000;
 }
 
 static int in_set_sample_rate(struct audio_stream *stream, uint32_t rate)
 {
-    return 0;
+    ALOGV("in_set_sample_rate: %d", rate);
+    return -ENOSYS;
 }
 
 static size_t in_get_buffer_size(const struct audio_stream *stream)
 {
+    ALOGV("in_get_buffer_size: %d", 320);
     return 320;
 }
 
 static audio_channel_mask_t in_get_channels(const struct audio_stream *stream)
 {
+    ALOGV("in_get_channels: %d", AUDIO_CHANNEL_IN_MONO);
     return AUDIO_CHANNEL_IN_MONO;
 }
 
@@ -160,7 +184,7 @@
 
 static int in_set_format(struct audio_stream *stream, audio_format_t format)
 {
-    return 0;
+    return -ENOSYS;
 }
 
 static int in_standby(struct audio_stream *stream)
@@ -192,9 +216,11 @@
 static ssize_t in_read(struct audio_stream_in *stream, void* buffer,
                        size_t bytes)
 {
+    ALOGV("in_read: bytes %d", bytes);
     /* XXX: fake timing for audio input */
-    usleep(bytes * 1000000 / audio_stream_frame_size(&stream->common) /
+    usleep((int64_t)bytes * 1000000 / audio_stream_in_frame_size(stream) /
            in_get_sample_rate(&stream->common));
+    memset(buffer, 0, bytes);
     return bytes;
 }
 
@@ -218,8 +244,11 @@
                                    audio_devices_t devices,
                                    audio_output_flags_t flags,
                                    struct audio_config *config,
-                                   struct audio_stream_out **stream_out)
+                                   struct audio_stream_out **stream_out,
+                                   const char *address __unused)
 {
+    ALOGV("adev_open_output_stream...");
+
     struct stub_audio_device *ladev = (struct stub_audio_device *)dev;
     struct stub_stream_out *out;
     int ret;
@@ -258,68 +287,81 @@
 static void adev_close_output_stream(struct audio_hw_device *dev,
                                      struct audio_stream_out *stream)
 {
+    ALOGV("adev_close_output_stream...");
     free(stream);
 }
 
 static int adev_set_parameters(struct audio_hw_device *dev, const char *kvpairs)
 {
+    ALOGV("adev_set_parameters");
     return -ENOSYS;
 }
 
 static char * adev_get_parameters(const struct audio_hw_device *dev,
                                   const char *keys)
 {
-    return NULL;
+    ALOGV("adev_get_parameters");
+    return strdup("");
 }
 
 static int adev_init_check(const struct audio_hw_device *dev)
 {
+    ALOGV("adev_init_check");
     return 0;
 }
 
 static int adev_set_voice_volume(struct audio_hw_device *dev, float volume)
 {
+    ALOGV("adev_set_voice_volume: %f", volume);
     return -ENOSYS;
 }
 
 static int adev_set_master_volume(struct audio_hw_device *dev, float volume)
 {
+    ALOGV("adev_set_master_volume: %f", volume);
     return -ENOSYS;
 }
 
 static int adev_get_master_volume(struct audio_hw_device *dev, float *volume)
 {
+    ALOGV("adev_get_master_volume: %f", *volume);
     return -ENOSYS;
 }
 
 static int adev_set_master_mute(struct audio_hw_device *dev, bool muted)
 {
+    ALOGV("adev_set_master_mute: %d", muted);
     return -ENOSYS;
 }
 
 static int adev_get_master_mute(struct audio_hw_device *dev, bool *muted)
 {
+    ALOGV("adev_get_master_mute: %d", *muted);
     return -ENOSYS;
 }
 
 static int adev_set_mode(struct audio_hw_device *dev, audio_mode_t mode)
 {
+    ALOGV("adev_set_mode: %d", mode);
     return 0;
 }
 
 static int adev_set_mic_mute(struct audio_hw_device *dev, bool state)
 {
+    ALOGV("adev_set_mic_mute: %d",state);
     return -ENOSYS;
 }
 
 static int adev_get_mic_mute(const struct audio_hw_device *dev, bool *state)
 {
+    ALOGV("adev_get_mic_mute");
     return -ENOSYS;
 }
 
 static size_t adev_get_input_buffer_size(const struct audio_hw_device *dev,
                                          const struct audio_config *config)
 {
+    ALOGV("adev_get_input_buffer_size: %d", 320);
     return 320;
 }
 
@@ -327,8 +369,13 @@
                                   audio_io_handle_t handle,
                                   audio_devices_t devices,
                                   struct audio_config *config,
-                                  struct audio_stream_in **stream_in)
+                                  struct audio_stream_in **stream_in,
+                                  audio_input_flags_t flags __unused,
+                                  const char *address __unused,
+                                  audio_source_t source __unused)
 {
+    ALOGV("adev_open_input_stream...");
+
     struct stub_audio_device *ladev = (struct stub_audio_device *)dev;
     struct stub_stream_in *in;
     int ret;
@@ -365,16 +412,19 @@
 static void adev_close_input_stream(struct audio_hw_device *dev,
                                    struct audio_stream_in *in)
 {
+    ALOGV("adev_close_input_stream...");
     return;
 }
 
 static int adev_dump(const audio_hw_device_t *device, int fd)
 {
+    ALOGV("adev_dump");
     return 0;
 }
 
 static int adev_close(hw_device_t *device)
 {
+    ALOGV("adev_close");
     free(device);
     return 0;
 }
@@ -382,6 +432,8 @@
 static int adev_open(const hw_module_t* module, const char* name,
                      hw_device_t** device)
 {
+    ALOGV("adev_open: %s", name);
+
     struct stub_audio_device *adev;
     int ret;
 
diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index 433ef6c..20c0fab 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -20,50 +20,131 @@
 #include <errno.h>
 #include <pthread.h>
 #include <stdint.h>
-#include <sys/time.h>
 #include <stdlib.h>
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/limits.h>
 
+#include <cutils/compiler.h>
 #include <cutils/log.h>
-#include <cutils/str_parms.h>
 #include <cutils/properties.h>
+#include <cutils/str_parms.h>
 
+#include <hardware/audio.h>
 #include <hardware/hardware.h>
 #include <system/audio.h>
-#include <hardware/audio.h>
 
+#include <media/AudioParameter.h>
+#include <media/AudioBufferProvider.h>
 #include <media/nbaio/MonoPipe.h>
 #include <media/nbaio/MonoPipeReader.h>
-#include <media/AudioBufferProvider.h>
 
 #include <utils/String8.h>
-#include <media/AudioParameter.h>
+
+#define LOG_STREAMS_TO_FILES 0
+#if LOG_STREAMS_TO_FILES
+#include <fcntl.h>
+#include <stdio.h>
+#include <sys/stat.h>
+#endif // LOG_STREAMS_TO_FILES
 
 extern "C" {
 
 namespace android {
 
-#define MAX_PIPE_DEPTH_IN_FRAMES     (1024*8)
+// Set to 1 to enable extremely verbose logging in this module.
+#define SUBMIX_VERBOSE_LOGGING 0
+#if SUBMIX_VERBOSE_LOGGING
+#define SUBMIX_ALOGV(...) ALOGV(__VA_ARGS__)
+#define SUBMIX_ALOGE(...) ALOGE(__VA_ARGS__)
+#else
+#define SUBMIX_ALOGV(...)
+#define SUBMIX_ALOGE(...)
+#endif // SUBMIX_VERBOSE_LOGGING
+
+// NOTE: This value will be rounded up to the nearest power of 2 by MonoPipe().
+#define DEFAULT_PIPE_SIZE_IN_FRAMES  (1024*4)
+// Value used to divide the MonoPipe() buffer into segments that are written to the source and
+// read from the sink.  The maximum latency of the device is the size of the MonoPipe's buffer
+// the minimum latency is the MonoPipe buffer size divided by this value.
+#define DEFAULT_PIPE_PERIOD_COUNT    4
 // The duration of MAX_READ_ATTEMPTS * READ_ATTEMPT_SLEEP_MS must be stricly inferior to
 //   the duration of a record buffer at the current record sample rate (of the device, not of
 //   the recording itself). Here we have:
 //      3 * 5ms = 15ms < 1024 frames * 1000 / 48000 = 21.333ms
 #define MAX_READ_ATTEMPTS            3
 #define READ_ATTEMPT_SLEEP_MS        5 // 5ms between two read attempts when pipe is empty
-#define DEFAULT_RATE_HZ              48000 // default sample rate
+#define DEFAULT_SAMPLE_RATE_HZ       48000 // default sample rate
+// See NBAIO_Format frameworks/av/include/media/nbaio/NBAIO.h.
+#define DEFAULT_FORMAT               AUDIO_FORMAT_PCM_16_BIT
+// A legacy user of this device does not close the input stream when it shuts down, which
+// results in the application opening a new input stream before closing the old input stream
+// handle it was previously using.  Setting this value to 1 allows multiple clients to open
+// multiple input streams from this device.  If this option is enabled, each input stream returned
+// is *the same stream* which means that readers will race to read data from these streams.
+#define ENABLE_LEGACY_INPUT_OPEN     1
+// Whether channel conversion (16-bit signed PCM mono->stereo, stereo->mono) is enabled.
+#define ENABLE_CHANNEL_CONVERSION    1
+// Whether resampling is enabled.
+#define ENABLE_RESAMPLING            1
+#if LOG_STREAMS_TO_FILES
+// Folder to save stream log files to.
+#define LOG_STREAM_FOLDER "/data/misc/media"
+// Log filenames for input and output streams.
+#define LOG_STREAM_OUT_FILENAME LOG_STREAM_FOLDER "/r_submix_out.raw"
+#define LOG_STREAM_IN_FILENAME LOG_STREAM_FOLDER "/r_submix_in.raw"
+// File permissions for stream log files.
+#define LOG_STREAM_FILE_PERMISSIONS (S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)
+#endif // LOG_STREAMS_TO_FILES
+// limit for number of read error log entries to avoid spamming the logs
+#define MAX_READ_ERROR_LOGS 5
 
+// Common limits macros.
+#ifndef min
+#define min(a, b) ((a) < (b) ? (a) : (b))
+#endif // min
+#ifndef max
+#define max(a, b) ((a) > (b) ? (a) : (b))
+#endif // max
+
+// Set *result_variable_ptr to true if value_to_find is present in the array array_to_search,
+// otherwise set *result_variable_ptr to false.
+#define SUBMIX_VALUE_IN_SET(value_to_find, array_to_search, result_variable_ptr) \
+    { \
+        size_t i; \
+        *(result_variable_ptr) = false; \
+        for (i = 0; i < sizeof(array_to_search) / sizeof((array_to_search)[0]); i++) { \
+          if ((value_to_find) == (array_to_search)[i]) { \
+                *(result_variable_ptr) = true; \
+                break; \
+            } \
+        } \
+    }
+
+// Configuration of the submix pipe.
 struct submix_config {
-    audio_format_t format;
-    audio_channel_mask_t channel_mask;
-    unsigned int rate; // sample rate for the device
-    unsigned int period_size; // size of the audio pipe is period_size * period_count in frames
-    unsigned int period_count;
+    // Channel mask field in this data structure is set to either input_channel_mask or
+    // output_channel_mask depending upon the last stream to be opened on this device.
+    struct audio_config common;
+    // Input stream and output stream channel masks.  This is required since input and output
+    // channel bitfields are not equivalent.
+    audio_channel_mask_t input_channel_mask;
+    audio_channel_mask_t output_channel_mask;
+#if ENABLE_RESAMPLING
+    // Input stream and output stream sample rates.
+    uint32_t input_sample_rate;
+    uint32_t output_sample_rate;
+#endif // ENABLE_RESAMPLING
+    size_t pipe_frame_size;  // Number of bytes in each audio frame in the pipe.
+    size_t buffer_size_frames; // Size of the audio pipe in frames.
+    // Maximum number of frames buffered by the input and output streams.
+    size_t buffer_period_size_frames;
 };
 
-struct submix_audio_device {
-    struct audio_hw_device device;
-    bool output_standby;
-    bool input_standby;
-    submix_config config;
+#define MAX_ROUTES 10
+typedef struct route_config {
+    struct submix_config config;
+    char address[AUDIO_DEVICE_MAX_ADDRESS_LEN];
     // Pipe variables: they handle the ring buffer that "pipes" audio:
     //  - from the submix virtual audio output == what needs to be played
     //    remotely, seen as an output for AudioFlinger
@@ -72,105 +153,564 @@
     // A usecase example is one where the component capturing the audio is then sending it over
     // Wifi for presentation on a remote Wifi Display device (e.g. a dongle attached to a TV, or a
     // TV with Wifi Display capabilities), or to a wireless audio player.
-    sp<MonoPipe>       rsxSink;
+    sp<MonoPipe> rsxSink;
     sp<MonoPipeReader> rsxSource;
+    // Pointers to the current input and output stream instances.  rsxSink and rsxSource are
+    // destroyed if both and input and output streams are destroyed.
+    struct submix_stream_out *output;
+    struct submix_stream_in *input;
+#if ENABLE_RESAMPLING
+    // Buffer used as temporary storage for resampled data prior to returning data to the output
+    // stream.
+    int16_t resampler_buffer[DEFAULT_PIPE_SIZE_IN_FRAMES];
+#endif // ENABLE_RESAMPLING
+} route_config_t;
 
-    // device lock, also used to protect access to the audio pipe
+struct submix_audio_device {
+    struct audio_hw_device device;
+    route_config_t routes[MAX_ROUTES];
+    // Device lock, also used to protect access to submix_audio_device from the input and output
+    // streams.
     pthread_mutex_t lock;
 };
 
 struct submix_stream_out {
     struct audio_stream_out stream;
     struct submix_audio_device *dev;
+    int route_handle;
+    bool output_standby;
+    uint64_t write_counter_frames;
+#if LOG_STREAMS_TO_FILES
+    int log_fd;
+#endif // LOG_STREAMS_TO_FILES
 };
 
 struct submix_stream_in {
     struct audio_stream_in stream;
     struct submix_audio_device *dev;
-    bool output_standby; // output standby state as seen from record thread
-
+    int route_handle;
+    bool input_standby;
+    bool output_standby_rec_thr; // output standby state as seen from record thread
     // wall clock when recording starts
     struct timespec record_start_time;
     // how many frames have been requested to be read
-    int64_t read_counter_frames;
+    uint64_t read_counter_frames;
+
+#if ENABLE_LEGACY_INPUT_OPEN
+    // Number of references to this input stream.
+    volatile int32_t ref_count;
+#endif // ENABLE_LEGACY_INPUT_OPEN
+#if LOG_STREAMS_TO_FILES
+    int log_fd;
+#endif // LOG_STREAMS_TO_FILES
+
+    volatile int16_t read_error_count;
 };
 
+// Determine whether the specified sample rate is supported by the submix module.
+static bool sample_rate_supported(const uint32_t sample_rate)
+{
+    // Set of sample rates supported by Format_from_SR_C() frameworks/av/media/libnbaio/NAIO.cpp.
+    static const unsigned int supported_sample_rates[] = {
+        8000, 11025, 12000, 16000, 22050, 24000, 32000, 44100, 48000,
+    };
+    bool return_value;
+    SUBMIX_VALUE_IN_SET(sample_rate, supported_sample_rates, &return_value);
+    return return_value;
+}
+
+// Determine whether the specified sample rate is supported, if it is return the specified sample
+// rate, otherwise return the default sample rate for the submix module.
+static uint32_t get_supported_sample_rate(uint32_t sample_rate)
+{
+  return sample_rate_supported(sample_rate) ? sample_rate : DEFAULT_SAMPLE_RATE_HZ;
+}
+
+// Determine whether the specified channel in mask is supported by the submix module.
+static bool channel_in_mask_supported(const audio_channel_mask_t channel_in_mask)
+{
+    // Set of channel in masks supported by Format_from_SR_C()
+    // frameworks/av/media/libnbaio/NAIO.cpp.
+    static const audio_channel_mask_t supported_channel_in_masks[] = {
+        AUDIO_CHANNEL_IN_MONO, AUDIO_CHANNEL_IN_STEREO,
+    };
+    bool return_value;
+    SUBMIX_VALUE_IN_SET(channel_in_mask, supported_channel_in_masks, &return_value);
+    return return_value;
+}
+
+// Determine whether the specified channel in mask is supported, if it is return the specified
+// channel in mask, otherwise return the default channel in mask for the submix module.
+static audio_channel_mask_t get_supported_channel_in_mask(
+        const audio_channel_mask_t channel_in_mask)
+{
+    return channel_in_mask_supported(channel_in_mask) ? channel_in_mask :
+            static_cast<audio_channel_mask_t>(AUDIO_CHANNEL_IN_STEREO);
+}
+
+// Determine whether the specified channel out mask is supported by the submix module.
+static bool channel_out_mask_supported(const audio_channel_mask_t channel_out_mask)
+{
+    // Set of channel out masks supported by Format_from_SR_C()
+    // frameworks/av/media/libnbaio/NAIO.cpp.
+    static const audio_channel_mask_t supported_channel_out_masks[] = {
+        AUDIO_CHANNEL_OUT_MONO, AUDIO_CHANNEL_OUT_STEREO,
+    };
+    bool return_value;
+    SUBMIX_VALUE_IN_SET(channel_out_mask, supported_channel_out_masks, &return_value);
+    return return_value;
+}
+
+// Determine whether the specified channel out mask is supported, if it is return the specified
+// channel out mask, otherwise return the default channel out mask for the submix module.
+static audio_channel_mask_t get_supported_channel_out_mask(
+        const audio_channel_mask_t channel_out_mask)
+{
+    return channel_out_mask_supported(channel_out_mask) ? channel_out_mask :
+        static_cast<audio_channel_mask_t>(AUDIO_CHANNEL_OUT_STEREO);
+}
+
+// Get a pointer to submix_stream_out given an audio_stream_out that is embedded within the
+// structure.
+static struct submix_stream_out * audio_stream_out_get_submix_stream_out(
+        struct audio_stream_out * const stream)
+{
+    ALOG_ASSERT(stream);
+    return reinterpret_cast<struct submix_stream_out *>(reinterpret_cast<uint8_t *>(stream) -
+                offsetof(struct submix_stream_out, stream));
+}
+
+// Get a pointer to submix_stream_out given an audio_stream that is embedded within the structure.
+static struct submix_stream_out * audio_stream_get_submix_stream_out(
+        struct audio_stream * const stream)
+{
+    ALOG_ASSERT(stream);
+    return audio_stream_out_get_submix_stream_out(
+            reinterpret_cast<struct audio_stream_out *>(stream));
+}
+
+// Get a pointer to submix_stream_in given an audio_stream_in that is embedded within the
+// structure.
+static struct submix_stream_in * audio_stream_in_get_submix_stream_in(
+        struct audio_stream_in * const stream)
+{
+    ALOG_ASSERT(stream);
+    return reinterpret_cast<struct submix_stream_in *>(reinterpret_cast<uint8_t *>(stream) -
+            offsetof(struct submix_stream_in, stream));
+}
+
+// Get a pointer to submix_stream_in given an audio_stream that is embedded within the structure.
+static struct submix_stream_in * audio_stream_get_submix_stream_in(
+        struct audio_stream * const stream)
+{
+    ALOG_ASSERT(stream);
+    return audio_stream_in_get_submix_stream_in(
+            reinterpret_cast<struct audio_stream_in *>(stream));
+}
+
+// Get a pointer to submix_audio_device given a pointer to an audio_device that is embedded within
+// the structure.
+static struct submix_audio_device * audio_hw_device_get_submix_audio_device(
+        struct audio_hw_device *device)
+{
+    ALOG_ASSERT(device);
+    return reinterpret_cast<struct submix_audio_device *>(reinterpret_cast<uint8_t *>(device) -
+        offsetof(struct submix_audio_device, device));
+}
+
+// Compare an audio_config with input channel mask and an audio_config with output channel mask
+// returning false if they do *not* match, true otherwise.
+static bool audio_config_compare(const audio_config * const input_config,
+        const audio_config * const output_config)
+{
+#if !ENABLE_CHANNEL_CONVERSION
+    const uint32_t input_channels = audio_channel_count_from_in_mask(input_config->channel_mask);
+    const uint32_t output_channels = audio_channel_count_from_out_mask(output_config->channel_mask);
+    if (input_channels != output_channels) {
+        ALOGE("audio_config_compare() channel count mismatch input=%d vs. output=%d",
+              input_channels, output_channels);
+        return false;
+    }
+#endif // !ENABLE_CHANNEL_CONVERSION
+#if ENABLE_RESAMPLING
+    if (input_config->sample_rate != output_config->sample_rate &&
+            audio_channel_count_from_in_mask(input_config->channel_mask) != 1) {
+#else
+    if (input_config->sample_rate != output_config->sample_rate) {
+#endif // ENABLE_RESAMPLING
+        ALOGE("audio_config_compare() sample rate mismatch %ul vs. %ul",
+              input_config->sample_rate, output_config->sample_rate);
+        return false;
+    }
+    if (input_config->format != output_config->format) {
+        ALOGE("audio_config_compare() format mismatch %x vs. %x",
+              input_config->format, output_config->format);
+        return false;
+    }
+    // This purposely ignores offload_info as it's not required for the submix device.
+    return true;
+}
+
+// If one doesn't exist, create a pipe for the submix audio device rsxadev of size
+// buffer_size_frames and optionally associate "in" or "out" with the submix audio device.
+// Must be called with lock held on the submix_audio_device
+static void submix_audio_device_create_pipe_l(struct submix_audio_device * const rsxadev,
+                                            const struct audio_config * const config,
+                                            const size_t buffer_size_frames,
+                                            const uint32_t buffer_period_count,
+                                            struct submix_stream_in * const in,
+                                            struct submix_stream_out * const out,
+                                            const char *address,
+                                            int route_idx)
+{
+    ALOG_ASSERT(in || out);
+    ALOG_ASSERT(route_idx > -1);
+    ALOG_ASSERT(route_idx < MAX_ROUTES);
+    ALOGD("submix_audio_device_create_pipe_l(addr=%s, idx=%d)", address, route_idx);
+
+    // Save a reference to the specified input or output stream and the associated channel
+    // mask.
+    if (in) {
+        in->route_handle = route_idx;
+        rsxadev->routes[route_idx].input = in;
+        rsxadev->routes[route_idx].config.input_channel_mask = config->channel_mask;
+#if ENABLE_RESAMPLING
+        rsxadev->routes[route_idx].config.input_sample_rate = config->sample_rate;
+        // If the output isn't configured yet, set the output sample rate to the maximum supported
+        // sample rate such that the smallest possible input buffer is created, and put a default
+        // value for channel count
+        if (!rsxadev->routes[route_idx].output) {
+            rsxadev->routes[route_idx].config.output_sample_rate = 48000;
+            rsxadev->routes[route_idx].config.output_channel_mask = AUDIO_CHANNEL_OUT_STEREO;
+        }
+#endif // ENABLE_RESAMPLING
+    }
+    if (out) {
+        out->route_handle = route_idx;
+        rsxadev->routes[route_idx].output = out;
+        rsxadev->routes[route_idx].config.output_channel_mask = config->channel_mask;
+#if ENABLE_RESAMPLING
+        rsxadev->routes[route_idx].config.output_sample_rate = config->sample_rate;
+#endif // ENABLE_RESAMPLING
+    }
+    // Save the address
+    strncpy(rsxadev->routes[route_idx].address, address, AUDIO_DEVICE_MAX_ADDRESS_LEN);
+    ALOGD("  now using address %s for route %d", rsxadev->routes[route_idx].address, route_idx);
+    // If a pipe isn't associated with the device, create one.
+    if (rsxadev->routes[route_idx].rsxSink == NULL || rsxadev->routes[route_idx].rsxSource == NULL)
+    {
+        struct submix_config * const device_config = &rsxadev->routes[route_idx].config;
+        uint32_t channel_count;
+        if (out)
+            channel_count = audio_channel_count_from_out_mask(config->channel_mask);
+        else
+            channel_count = audio_channel_count_from_in_mask(config->channel_mask);
+#if ENABLE_CHANNEL_CONVERSION
+        // If channel conversion is enabled, allocate enough space for the maximum number of
+        // possible channels stored in the pipe for the situation when the number of channels in
+        // the output stream don't match the number in the input stream.
+        const uint32_t pipe_channel_count = max(channel_count, 2);
+#else
+        const uint32_t pipe_channel_count = channel_count;
+#endif // ENABLE_CHANNEL_CONVERSION
+        const NBAIO_Format format = Format_from_SR_C(config->sample_rate, pipe_channel_count,
+            config->format);
+        const NBAIO_Format offers[1] = {format};
+        size_t numCounterOffers = 0;
+        // Create a MonoPipe with optional blocking set to true.
+        MonoPipe* sink = new MonoPipe(buffer_size_frames, format, true /*writeCanBlock*/);
+        // Negotiation between the source and sink cannot fail as the device open operation
+        // creates both ends of the pipe using the same audio format.
+        ssize_t index = sink->negotiate(offers, 1, NULL, numCounterOffers);
+        ALOG_ASSERT(index == 0);
+        MonoPipeReader* source = new MonoPipeReader(sink);
+        numCounterOffers = 0;
+        index = source->negotiate(offers, 1, NULL, numCounterOffers);
+        ALOG_ASSERT(index == 0);
+        ALOGV("submix_audio_device_create_pipe_l(): created pipe");
+
+        // Save references to the source and sink.
+        ALOG_ASSERT(rsxadev->routes[route_idx].rsxSink == NULL);
+        ALOG_ASSERT(rsxadev->routes[route_idx].rsxSource == NULL);
+        rsxadev->routes[route_idx].rsxSink = sink;
+        rsxadev->routes[route_idx].rsxSource = source;
+        // Store the sanitized audio format in the device so that it's possible to determine
+        // the format of the pipe source when opening the input device.
+        memcpy(&device_config->common, config, sizeof(device_config->common));
+        device_config->buffer_size_frames = sink->maxFrames();
+        device_config->buffer_period_size_frames = device_config->buffer_size_frames /
+                buffer_period_count;
+        if (in) device_config->pipe_frame_size = audio_stream_in_frame_size(&in->stream);
+        if (out) device_config->pipe_frame_size = audio_stream_out_frame_size(&out->stream);
+#if ENABLE_CHANNEL_CONVERSION
+        // Calculate the pipe frame size based upon the number of channels.
+        device_config->pipe_frame_size = (device_config->pipe_frame_size * pipe_channel_count) /
+                channel_count;
+#endif // ENABLE_CHANNEL_CONVERSION
+        SUBMIX_ALOGV("submix_audio_device_create_pipe_l(): pipe frame size %zd, pipe size %zd, "
+                     "period size %zd", device_config->pipe_frame_size,
+                     device_config->buffer_size_frames, device_config->buffer_period_size_frames);
+    }
+}
+
+// Release references to the sink and source.  Input and output threads may maintain references
+// to these objects via StrongPointer (sp<MonoPipe> and sp<MonoPipeReader>) which they can use
+// before they shutdown.
+// Must be called with lock held on the submix_audio_device
+static void submix_audio_device_release_pipe_l(struct submix_audio_device * const rsxadev,
+        int route_idx)
+{
+    ALOG_ASSERT(route_idx > -1);
+    ALOG_ASSERT(route_idx < MAX_ROUTES);
+    ALOGD("submix_audio_device_release_pipe_l(idx=%d) addr=%s", route_idx,
+            rsxadev->routes[route_idx].address);
+    if (rsxadev->routes[route_idx].rsxSink != 0) {
+        rsxadev->routes[route_idx].rsxSink.clear();
+        rsxadev->routes[route_idx].rsxSink = 0;
+    }
+    if (rsxadev->routes[route_idx].rsxSource != 0) {
+        rsxadev->routes[route_idx].rsxSource.clear();
+        rsxadev->routes[route_idx].rsxSource = 0;
+    }
+    memset(rsxadev->routes[route_idx].address, 0, AUDIO_DEVICE_MAX_ADDRESS_LEN);
+#ifdef ENABLE_RESAMPLING
+    memset(rsxadev->routes[route_idx].resampler_buffer, 0,
+            sizeof(int16_t) * DEFAULT_PIPE_SIZE_IN_FRAMES);
+#endif
+}
+
+// Remove references to the specified input and output streams.  When the device no longer
+// references input and output streams destroy the associated pipe.
+// Must be called with lock held on the submix_audio_device
+static void submix_audio_device_destroy_pipe_l(struct submix_audio_device * const rsxadev,
+                                             const struct submix_stream_in * const in,
+                                             const struct submix_stream_out * const out)
+{
+    MonoPipe* sink;
+    ALOGV("submix_audio_device_destroy_pipe_l()");
+    int route_idx = -1;
+    if (in != NULL) {
+#if ENABLE_LEGACY_INPUT_OPEN
+        const_cast<struct submix_stream_in*>(in)->ref_count--;
+        route_idx = in->route_handle;
+        ALOG_ASSERT(rsxadev->routes[route_idx].input == in);
+        if (in->ref_count == 0) {
+            rsxadev->routes[route_idx].input = NULL;
+        }
+        ALOGV("submix_audio_device_destroy_pipe_l(): input ref_count %d", in->ref_count);
+#else
+        rsxadev->input = NULL;
+#endif // ENABLE_LEGACY_INPUT_OPEN
+    }
+    if (out != NULL) {
+        route_idx = out->route_handle;
+        ALOG_ASSERT(rsxadev->routes[route_idx].output == out);
+        rsxadev->routes[route_idx].output = NULL;
+    }
+    if (route_idx != -1 &&
+            rsxadev->routes[route_idx].input == NULL && rsxadev->routes[route_idx].output == NULL) {
+        submix_audio_device_release_pipe_l(rsxadev, route_idx);
+        ALOGD("submix_audio_device_destroy_pipe_l(): pipe destroyed");
+    }
+}
+
+// Sanitize the user specified audio config for a submix input / output stream.
+static void submix_sanitize_config(struct audio_config * const config, const bool is_input_format)
+{
+    config->channel_mask = is_input_format ? get_supported_channel_in_mask(config->channel_mask) :
+            get_supported_channel_out_mask(config->channel_mask);
+    config->sample_rate = get_supported_sample_rate(config->sample_rate);
+    config->format = DEFAULT_FORMAT;
+}
+
+// Verify a submix input or output stream can be opened.
+// Must be called with lock held on the submix_audio_device
+static bool submix_open_validate_l(const struct submix_audio_device * const rsxadev,
+                                 int route_idx,
+                                 const struct audio_config * const config,
+                                 const bool opening_input)
+{
+    bool input_open;
+    bool output_open;
+    audio_config pipe_config;
+
+    // Query the device for the current audio config and whether input and output streams are open.
+    output_open = rsxadev->routes[route_idx].output != NULL;
+    input_open = rsxadev->routes[route_idx].input != NULL;
+    memcpy(&pipe_config, &rsxadev->routes[route_idx].config.common, sizeof(pipe_config));
+
+    // If the stream is already open, don't open it again.
+    if (opening_input ? !ENABLE_LEGACY_INPUT_OPEN && input_open : output_open) {
+        ALOGE("submix_open_validate_l(): %s stream already open.", opening_input ? "Input" :
+                "Output");
+        return false;
+    }
+
+    SUBMIX_ALOGV("submix_open_validate_l(): sample rate=%d format=%x "
+                 "%s_channel_mask=%x", config->sample_rate, config->format,
+                 opening_input ? "in" : "out", config->channel_mask);
+
+    // If either stream is open, verify the existing audio config the pipe matches the user
+    // specified config.
+    if (input_open || output_open) {
+        const audio_config * const input_config = opening_input ? config : &pipe_config;
+        const audio_config * const output_config = opening_input ? &pipe_config : config;
+        // Get the channel mask of the open device.
+        pipe_config.channel_mask =
+            opening_input ? rsxadev->routes[route_idx].config.output_channel_mask :
+                rsxadev->routes[route_idx].config.input_channel_mask;
+        if (!audio_config_compare(input_config, output_config)) {
+            ALOGE("submix_open_validate_l(): Unsupported format.");
+            return false;
+        }
+    }
+    return true;
+}
+
+// Must be called with lock held on the submix_audio_device
+static status_t submix_get_route_idx_for_address_l(const struct submix_audio_device * const rsxadev,
+                                                 const char* address, /*in*/
+                                                 int *idx /*out*/)
+{
+    // Do we already have a route for this address
+    int route_idx = -1;
+    int route_empty_idx = -1; // index of an empty route slot that can be used if needed
+    for (int i=0 ; i < MAX_ROUTES ; i++) {
+        if (strcmp(rsxadev->routes[i].address, "") == 0) {
+            route_empty_idx = i;
+        }
+        if (strncmp(rsxadev->routes[i].address, address, AUDIO_DEVICE_MAX_ADDRESS_LEN) == 0) {
+            route_idx = i;
+            break;
+        }
+    }
+
+    if ((route_idx == -1) && (route_empty_idx == -1)) {
+        ALOGE("Cannot create new route for address %s, max number of routes reached", address);
+        return -ENOMEM;
+    }
+    if (route_idx == -1) {
+        route_idx = route_empty_idx;
+    }
+    *idx = route_idx;
+    return OK;
+}
+
+
+// Calculate the maximum size of the pipe buffer in frames for the specified stream.
+static size_t calculate_stream_pipe_size_in_frames(const struct audio_stream *stream,
+                                                   const struct submix_config *config,
+                                                   const size_t pipe_frames,
+                                                   const size_t stream_frame_size)
+{
+    const size_t pipe_frame_size = config->pipe_frame_size;
+    const size_t max_frame_size = max(stream_frame_size, pipe_frame_size);
+    return (pipe_frames * config->pipe_frame_size) / max_frame_size;
+}
 
 /* audio HAL functions */
 
 static uint32_t out_get_sample_rate(const struct audio_stream *stream)
 {
-    const struct submix_stream_out *out =
-            reinterpret_cast<const struct submix_stream_out *>(stream);
-    uint32_t out_rate = out->dev->config.rate;
-    //ALOGV("out_get_sample_rate() returns %u", out_rate);
+    const struct submix_stream_out * const out = audio_stream_get_submix_stream_out(
+            const_cast<struct audio_stream *>(stream));
+#if ENABLE_RESAMPLING
+    const uint32_t out_rate = out->dev->routes[out->route_handle].config.output_sample_rate;
+#else
+    const uint32_t out_rate = out->dev->routes[out->route_handle].config.common.sample_rate;
+#endif // ENABLE_RESAMPLING
+    SUBMIX_ALOGV("out_get_sample_rate() returns %u for addr %s",
+            out_rate, out->dev->routes[out->route_handle].address);
     return out_rate;
 }
 
 static int out_set_sample_rate(struct audio_stream *stream, uint32_t rate)
 {
-    if ((rate != 44100) && (rate != 48000)) {
+    struct submix_stream_out * const out = audio_stream_get_submix_stream_out(stream);
+#if ENABLE_RESAMPLING
+    // The sample rate of the stream can't be changed once it's set since this would change the
+    // output buffer size and hence break playback to the shared pipe.
+    if (rate != out->dev->routes[out->route_handle].config.output_sample_rate) {
+        ALOGE("out_set_sample_rate() resampling enabled can't change sample rate from "
+              "%u to %u for addr %s",
+              out->dev->routes[out->route_handle].config.output_sample_rate, rate,
+              out->dev->routes[out->route_handle].address);
+        return -ENOSYS;
+    }
+#endif // ENABLE_RESAMPLING
+    if (!sample_rate_supported(rate)) {
         ALOGE("out_set_sample_rate(rate=%u) rate unsupported", rate);
         return -ENOSYS;
     }
-    struct submix_stream_out *out = reinterpret_cast<struct submix_stream_out *>(stream);
-    //ALOGV("out_set_sample_rate(rate=%u)", rate);
-    out->dev->config.rate = rate;
+    SUBMIX_ALOGV("out_set_sample_rate(rate=%u)", rate);
+    out->dev->routes[out->route_handle].config.common.sample_rate = rate;
     return 0;
 }
 
 static size_t out_get_buffer_size(const struct audio_stream *stream)
 {
-    const struct submix_stream_out *out =
-            reinterpret_cast<const struct submix_stream_out *>(stream);
-    const struct submix_config& config_out = out->dev->config;
-    size_t buffer_size = config_out.period_size * popcount(config_out.channel_mask)
-                            * sizeof(int16_t); // only PCM 16bit
-    //ALOGV("out_get_buffer_size() returns %u, period size=%u",
-    //        buffer_size, config_out.period_size);
-    return buffer_size;
+    const struct submix_stream_out * const out = audio_stream_get_submix_stream_out(
+            const_cast<struct audio_stream *>(stream));
+    const struct submix_config * const config = &out->dev->routes[out->route_handle].config;
+    const size_t stream_frame_size =
+                            audio_stream_out_frame_size((const struct audio_stream_out *)stream);
+    const size_t buffer_size_frames = calculate_stream_pipe_size_in_frames(
+        stream, config, config->buffer_period_size_frames, stream_frame_size);
+    const size_t buffer_size_bytes = buffer_size_frames * stream_frame_size;
+    SUBMIX_ALOGV("out_get_buffer_size() returns %zu bytes, %zu frames",
+                 buffer_size_bytes, buffer_size_frames);
+    return buffer_size_bytes;
 }
 
 static audio_channel_mask_t out_get_channels(const struct audio_stream *stream)
 {
-    const struct submix_stream_out *out =
-            reinterpret_cast<const struct submix_stream_out *>(stream);
-    uint32_t channels = out->dev->config.channel_mask;
-    //ALOGV("out_get_channels() returns %08x", channels);
-    return channels;
+    const struct submix_stream_out * const out = audio_stream_get_submix_stream_out(
+            const_cast<struct audio_stream *>(stream));
+    uint32_t channel_mask = out->dev->routes[out->route_handle].config.output_channel_mask;
+    SUBMIX_ALOGV("out_get_channels() returns %08x", channel_mask);
+    return channel_mask;
 }
 
 static audio_format_t out_get_format(const struct audio_stream *stream)
 {
-    return AUDIO_FORMAT_PCM_16_BIT;
+    const struct submix_stream_out * const out = audio_stream_get_submix_stream_out(
+            const_cast<struct audio_stream *>(stream));
+    const audio_format_t format = out->dev->routes[out->route_handle].config.common.format;
+    SUBMIX_ALOGV("out_get_format() returns %x", format);
+    return format;
 }
 
 static int out_set_format(struct audio_stream *stream, audio_format_t format)
 {
-    if (format != AUDIO_FORMAT_PCM_16_BIT) {
+    const struct submix_stream_out * const out = audio_stream_get_submix_stream_out(stream);
+    if (format != out->dev->routes[out->route_handle].config.common.format) {
+        ALOGE("out_set_format(format=%x) format unsupported", format);
         return -ENOSYS;
-    } else {
-        return 0;
     }
+    SUBMIX_ALOGV("out_set_format(format=%x)", format);
+    return 0;
 }
 
 static int out_standby(struct audio_stream *stream)
 {
     ALOGI("out_standby()");
+    struct submix_stream_out * const out = audio_stream_get_submix_stream_out(stream);
+    struct submix_audio_device * const rsxadev = out->dev;
 
-    const struct submix_stream_out *out = reinterpret_cast<const struct submix_stream_out *>(stream);
+    pthread_mutex_lock(&rsxadev->lock);
 
-    pthread_mutex_lock(&out->dev->lock);
+    out->output_standby = true;
+    out->write_counter_frames = 0;
 
-    out->dev->output_standby = true;
-
-    pthread_mutex_unlock(&out->dev->lock);
+    pthread_mutex_unlock(&rsxadev->lock);
 
     return 0;
 }
 
 static int out_dump(const struct audio_stream *stream, int fd)
 {
+    (void)stream;
+    (void)fd;
     return 0;
 }
 
@@ -178,94 +718,130 @@
 {
     int exiting = -1;
     AudioParameter parms = AudioParameter(String8(kvpairs));
+    SUBMIX_ALOGV("out_set_parameters() kvpairs='%s'", kvpairs);
+
     // FIXME this is using hard-coded strings but in the future, this functionality will be
     //       converted to use audio HAL extensions required to support tunneling
     if ((parms.getInt(String8("exiting"), exiting) == NO_ERROR) && (exiting > 0)) {
-        const struct submix_stream_out *out =
-                reinterpret_cast<const struct submix_stream_out *>(stream);
-
-        pthread_mutex_lock(&out->dev->lock);
-
+        struct submix_audio_device * const rsxadev =
+                audio_stream_get_submix_stream_out(stream)->dev;
+        pthread_mutex_lock(&rsxadev->lock);
         { // using the sink
-            sp<MonoPipe> sink = out->dev->rsxSink.get();
-            if (sink == 0) {
-                pthread_mutex_unlock(&out->dev->lock);
+            sp<MonoPipe> sink =
+                    rsxadev->routes[audio_stream_get_submix_stream_out(stream)->route_handle]
+                                    .rsxSink;
+            if (sink == NULL) {
+                pthread_mutex_unlock(&rsxadev->lock);
                 return 0;
             }
 
-            ALOGI("shutdown");
+            ALOGD("out_set_parameters(): shutting down MonoPipe sink");
             sink->shutdown(true);
         } // done using the sink
-
-        pthread_mutex_unlock(&out->dev->lock);
+        pthread_mutex_unlock(&rsxadev->lock);
     }
-
     return 0;
 }
 
 static char * out_get_parameters(const struct audio_stream *stream, const char *keys)
 {
+    (void)stream;
+    (void)keys;
     return strdup("");
 }
 
 static uint32_t out_get_latency(const struct audio_stream_out *stream)
 {
-    const struct submix_stream_out *out =
-            reinterpret_cast<const struct submix_stream_out *>(stream);
-    const struct submix_config * config_out = &(out->dev->config);
-    uint32_t latency = (MAX_PIPE_DEPTH_IN_FRAMES * 1000) / config_out->rate;
-    ALOGV("out_get_latency() returns %u", latency);
-    return latency;
+    const struct submix_stream_out * const out = audio_stream_out_get_submix_stream_out(
+            const_cast<struct audio_stream_out *>(stream));
+    const struct submix_config * const config = &out->dev->routes[out->route_handle].config;
+    const size_t stream_frame_size =
+                            audio_stream_out_frame_size(stream);
+    const size_t buffer_size_frames = calculate_stream_pipe_size_in_frames(
+            &stream->common, config, config->buffer_size_frames, stream_frame_size);
+    const uint32_t sample_rate = out_get_sample_rate(&stream->common);
+    const uint32_t latency_ms = (buffer_size_frames * 1000) / sample_rate;
+    SUBMIX_ALOGV("out_get_latency() returns %u ms, size in frames %zu, sample rate %u",
+                 latency_ms, buffer_size_frames, sample_rate);
+    return latency_ms;
 }
 
 static int out_set_volume(struct audio_stream_out *stream, float left,
                           float right)
 {
+    (void)stream;
+    (void)left;
+    (void)right;
     return -ENOSYS;
 }
 
 static ssize_t out_write(struct audio_stream_out *stream, const void* buffer,
                          size_t bytes)
 {
-    //ALOGV("out_write(bytes=%d)", bytes);
+    SUBMIX_ALOGV("out_write(bytes=%zd)", bytes);
     ssize_t written_frames = 0;
-    struct submix_stream_out *out = reinterpret_cast<struct submix_stream_out *>(stream);
-
-    const size_t frame_size = audio_stream_frame_size(&stream->common);
+    const size_t frame_size = audio_stream_out_frame_size(stream);
+    struct submix_stream_out * const out = audio_stream_out_get_submix_stream_out(stream);
+    struct submix_audio_device * const rsxadev = out->dev;
     const size_t frames = bytes / frame_size;
 
-    pthread_mutex_lock(&out->dev->lock);
+    pthread_mutex_lock(&rsxadev->lock);
 
-    out->dev->output_standby = false;
+    out->output_standby = false;
 
-    sp<MonoPipe> sink = out->dev->rsxSink.get();
-    if (sink != 0) {
+    sp<MonoPipe> sink = rsxadev->routes[out->route_handle].rsxSink;
+    if (sink != NULL) {
         if (sink->isShutdown()) {
             sink.clear();
-            pthread_mutex_unlock(&out->dev->lock);
+            pthread_mutex_unlock(&rsxadev->lock);
+            SUBMIX_ALOGV("out_write(): pipe shutdown, ignoring the write.");
             // the pipe has already been shutdown, this buffer will be lost but we must
             //   simulate timing so we don't drain the output faster than realtime
             usleep(frames * 1000000 / out_get_sample_rate(&stream->common));
             return bytes;
         }
     } else {
-        pthread_mutex_unlock(&out->dev->lock);
+        pthread_mutex_unlock(&rsxadev->lock);
         ALOGE("out_write without a pipe!");
         ALOG_ASSERT("out_write without a pipe!");
         return 0;
     }
 
-    pthread_mutex_unlock(&out->dev->lock);
+    // If the write to the sink would block when no input stream is present, flush enough frames
+    // from the pipe to make space to write the most recent data.
+    {
+        const size_t availableToWrite = sink->availableToWrite();
+        sp<MonoPipeReader> source = rsxadev->routes[out->route_handle].rsxSource;
+        if (rsxadev->routes[out->route_handle].input == NULL && availableToWrite < frames) {
+            static uint8_t flush_buffer[64];
+            const size_t flushBufferSizeFrames = sizeof(flush_buffer) / frame_size;
+            size_t frames_to_flush_from_source = frames - availableToWrite;
+            SUBMIX_ALOGV("out_write(): flushing %d frames from the pipe to avoid blocking",
+                         frames_to_flush_from_source);
+            while (frames_to_flush_from_source) {
+                const size_t flush_size = min(frames_to_flush_from_source, flushBufferSizeFrames);
+                frames_to_flush_from_source -= flush_size;
+                // read does not block
+                source->read(flush_buffer, flush_size, AudioBufferProvider::kInvalidPTS);
+            }
+        }
+    }
+
+    pthread_mutex_unlock(&rsxadev->lock);
 
     written_frames = sink->write(buffer, frames);
 
+#if LOG_STREAMS_TO_FILES
+    if (out->log_fd >= 0) write(out->log_fd, buffer, written_frames * frame_size);
+#endif // LOG_STREAMS_TO_FILES
+
     if (written_frames < 0) {
         if (written_frames == (ssize_t)NEGOTIATE) {
             ALOGE("out_write() write to pipe returned NEGOTIATE");
 
-            pthread_mutex_lock(&out->dev->lock);
+            pthread_mutex_lock(&rsxadev->lock);
             sink.clear();
-            pthread_mutex_unlock(&out->dev->lock);
+            pthread_mutex_unlock(&rsxadev->lock);
 
             written_frames = 0;
             return 0;
@@ -276,132 +852,241 @@
         }
     }
 
-    pthread_mutex_lock(&out->dev->lock);
+    pthread_mutex_lock(&rsxadev->lock);
     sink.clear();
-    pthread_mutex_unlock(&out->dev->lock);
+    if (written_frames > 0) {
+        out->write_counter_frames += written_frames;
+    }
+    pthread_mutex_unlock(&rsxadev->lock);
 
     if (written_frames < 0) {
         ALOGE("out_write() failed writing to pipe with %zd", written_frames);
         return 0;
-    } else {
-        ALOGV("out_write() wrote %zu bytes)", written_frames * frame_size);
-        return written_frames * frame_size;
     }
+    const ssize_t written_bytes = written_frames * frame_size;
+    SUBMIX_ALOGV("out_write() wrote %zd bytes %zd frames", written_bytes, written_frames);
+    return written_bytes;
+}
+
+static int out_get_presentation_position(const struct audio_stream_out *stream,
+                                   uint64_t *frames, struct timespec *timestamp)
+{
+    const submix_stream_out * out = reinterpret_cast<const struct submix_stream_out *>
+            (reinterpret_cast<const uint8_t *>(stream) -
+                    offsetof(struct submix_stream_out, stream));
+    struct submix_audio_device * const rsxadev = out->dev;
+    int ret = 0;
+
+    pthread_mutex_lock(&rsxadev->lock);
+
+    if (frames) {
+        const ssize_t frames_in_pipe =
+                rsxadev->routes[out->route_handle].rsxSource->availableToRead();
+        if (CC_UNLIKELY(frames_in_pipe < 0)) {
+            *frames = out->write_counter_frames;
+        } else {
+            *frames = out->write_counter_frames > (uint64_t) frames_in_pipe ?
+                    out->write_counter_frames - frames_in_pipe : 0;
+        }
+    }
+    if (timestamp) {
+        clock_gettime(CLOCK_MONOTONIC, timestamp);
+    }
+
+    pthread_mutex_unlock(&rsxadev->lock);
+
+    SUBMIX_ALOGV("out_get_presentation_position() got frames=%llu timestamp sec=%llu",
+            frames ? *frames : -1, timestamp ? timestamp->tv_sec : -1);
+
+    return ret;
 }
 
 static int out_get_render_position(const struct audio_stream_out *stream,
                                    uint32_t *dsp_frames)
 {
-    return -EINVAL;
+    if (!dsp_frames) {
+        return -EINVAL;
+    }
+    uint64_t frames = 0;
+    int ret = out_get_presentation_position(stream, &frames, NULL);
+    if ((ret == 0) && dsp_frames) {
+        *dsp_frames = (uint32_t) frames;
+    }
+    return ret;
 }
 
 static int out_add_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
 {
+    (void)stream;
+    (void)effect;
     return 0;
 }
 
 static int out_remove_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
 {
+    (void)stream;
+    (void)effect;
     return 0;
 }
 
 static int out_get_next_write_timestamp(const struct audio_stream_out *stream,
                                         int64_t *timestamp)
 {
+    (void)stream;
+    (void)timestamp;
     return -EINVAL;
 }
 
 /** audio_stream_in implementation **/
 static uint32_t in_get_sample_rate(const struct audio_stream *stream)
 {
-    const struct submix_stream_in *in = reinterpret_cast<const struct submix_stream_in *>(stream);
-    //ALOGV("in_get_sample_rate() returns %u", in->dev->config.rate);
-    return in->dev->config.rate;
+    const struct submix_stream_in * const in = audio_stream_get_submix_stream_in(
+        const_cast<struct audio_stream*>(stream));
+#if ENABLE_RESAMPLING
+    const uint32_t rate = in->dev->routes[in->route_handle].config.input_sample_rate;
+#else
+    const uint32_t rate = in->dev->routes[in->route_handle].config.common.sample_rate;
+#endif // ENABLE_RESAMPLING
+    SUBMIX_ALOGV("in_get_sample_rate() returns %u", rate);
+    return rate;
 }
 
 static int in_set_sample_rate(struct audio_stream *stream, uint32_t rate)
 {
-    return -ENOSYS;
+    const struct submix_stream_in * const in = audio_stream_get_submix_stream_in(stream);
+#if ENABLE_RESAMPLING
+    // The sample rate of the stream can't be changed once it's set since this would change the
+    // input buffer size and hence break recording from the shared pipe.
+    if (rate != in->dev->routes[in->route_handle].config.input_sample_rate) {
+        ALOGE("in_set_sample_rate() resampling enabled can't change sample rate from "
+              "%u to %u", in->dev->routes[in->route_handle].config.input_sample_rate, rate);
+        return -ENOSYS;
+    }
+#endif // ENABLE_RESAMPLING
+    if (!sample_rate_supported(rate)) {
+        ALOGE("in_set_sample_rate(rate=%u) rate unsupported", rate);
+        return -ENOSYS;
+    }
+    in->dev->routes[in->route_handle].config.common.sample_rate = rate;
+    SUBMIX_ALOGV("in_set_sample_rate() set %u", rate);
+    return 0;
 }
 
 static size_t in_get_buffer_size(const struct audio_stream *stream)
 {
-    const struct submix_stream_in *in = reinterpret_cast<const struct submix_stream_in *>(stream);
-    ALOGV("in_get_buffer_size() returns %zu",
-            in->dev->config.period_size * audio_stream_frame_size(stream));
-    return in->dev->config.period_size * audio_stream_frame_size(stream);
+    const struct submix_stream_in * const in = audio_stream_get_submix_stream_in(
+            const_cast<struct audio_stream*>(stream));
+    const struct submix_config * const config = &in->dev->routes[in->route_handle].config;
+    const size_t stream_frame_size =
+                            audio_stream_in_frame_size((const struct audio_stream_in *)stream);
+    size_t buffer_size_frames = calculate_stream_pipe_size_in_frames(
+        stream, config, config->buffer_period_size_frames, stream_frame_size);
+#if ENABLE_RESAMPLING
+    // Scale the size of the buffer based upon the maximum number of frames that could be returned
+    // given the ratio of output to input sample rate.
+    buffer_size_frames = (size_t)(((float)buffer_size_frames *
+                                   (float)config->input_sample_rate) /
+                                  (float)config->output_sample_rate);
+#endif // ENABLE_RESAMPLING
+    const size_t buffer_size_bytes = buffer_size_frames * stream_frame_size;
+    SUBMIX_ALOGV("in_get_buffer_size() returns %zu bytes, %zu frames", buffer_size_bytes,
+                 buffer_size_frames);
+    return buffer_size_bytes;
 }
 
 static audio_channel_mask_t in_get_channels(const struct audio_stream *stream)
 {
-    return AUDIO_CHANNEL_IN_STEREO;
+    const struct submix_stream_in * const in = audio_stream_get_submix_stream_in(
+            const_cast<struct audio_stream*>(stream));
+    const audio_channel_mask_t channel_mask =
+            in->dev->routes[in->route_handle].config.input_channel_mask;
+    SUBMIX_ALOGV("in_get_channels() returns %x", channel_mask);
+    return channel_mask;
 }
 
 static audio_format_t in_get_format(const struct audio_stream *stream)
 {
-    return AUDIO_FORMAT_PCM_16_BIT;
+    const struct submix_stream_in * const in = audio_stream_get_submix_stream_in(
+            const_cast<struct audio_stream*>(stream));
+    const audio_format_t format = in->dev->routes[in->route_handle].config.common.format;
+    SUBMIX_ALOGV("in_get_format() returns %x", format);
+    return format;
 }
 
 static int in_set_format(struct audio_stream *stream, audio_format_t format)
 {
-    if (format != AUDIO_FORMAT_PCM_16_BIT) {
+    const struct submix_stream_in * const in = audio_stream_get_submix_stream_in(stream);
+    if (format != in->dev->routes[in->route_handle].config.common.format) {
+        ALOGE("in_set_format(format=%x) format unsupported", format);
         return -ENOSYS;
-    } else {
-        return 0;
     }
+    SUBMIX_ALOGV("in_set_format(format=%x)", format);
+    return 0;
 }
 
 static int in_standby(struct audio_stream *stream)
 {
     ALOGI("in_standby()");
-    const struct submix_stream_in *in = reinterpret_cast<const struct submix_stream_in *>(stream);
+    struct submix_stream_in * const in = audio_stream_get_submix_stream_in(stream);
+    struct submix_audio_device * const rsxadev = in->dev;
 
-    pthread_mutex_lock(&in->dev->lock);
+    pthread_mutex_lock(&rsxadev->lock);
 
-    in->dev->input_standby = true;
+    in->input_standby = true;
 
-    pthread_mutex_unlock(&in->dev->lock);
+    pthread_mutex_unlock(&rsxadev->lock);
 
     return 0;
 }
 
 static int in_dump(const struct audio_stream *stream, int fd)
 {
+    (void)stream;
+    (void)fd;
     return 0;
 }
 
 static int in_set_parameters(struct audio_stream *stream, const char *kvpairs)
 {
+    (void)stream;
+    (void)kvpairs;
     return 0;
 }
 
 static char * in_get_parameters(const struct audio_stream *stream,
                                 const char *keys)
 {
+    (void)stream;
+    (void)keys;
     return strdup("");
 }
 
 static int in_set_gain(struct audio_stream_in *stream, float gain)
 {
+    (void)stream;
+    (void)gain;
     return 0;
 }
 
 static ssize_t in_read(struct audio_stream_in *stream, void* buffer,
                        size_t bytes)
 {
-    //ALOGV("in_read bytes=%u", bytes);
-    ssize_t frames_read = -1977;
-    struct submix_stream_in *in = reinterpret_cast<struct submix_stream_in *>(stream);
-    const size_t frame_size = audio_stream_frame_size(&stream->common);
+    struct submix_stream_in * const in = audio_stream_in_get_submix_stream_in(stream);
+    struct submix_audio_device * const rsxadev = in->dev;
+    struct audio_config *format;
+    const size_t frame_size = audio_stream_in_frame_size(stream);
     const size_t frames_to_read = bytes / frame_size;
 
-    pthread_mutex_lock(&in->dev->lock);
+    SUBMIX_ALOGV("in_read bytes=%zu", bytes);
+    pthread_mutex_lock(&rsxadev->lock);
 
-    const bool output_standby_transition = (in->output_standby != in->dev->output_standby);
-    in->output_standby = in->dev->output_standby;
+    const bool output_standby = rsxadev->routes[in->route_handle].output == NULL
+            ? true : rsxadev->routes[in->route_handle].output->output_standby;
+    const bool output_standby_transition = (in->output_standby_rec_thr != output_standby);
+    in->output_standby_rec_thr = output_standby;
 
-    if (in->dev->input_standby || output_standby_transition) {
-        in->dev->input_standby = false;
+    if (in->input_standby || output_standby_transition) {
+        in->input_standby = false;
         // keep track of when we exit input standby (== first read == start "real recording")
         // or when we start recording silence, and reset projected time
         int rc = clock_gettime(CLOCK_MONOTONIC, &in->record_start_time);
@@ -415,43 +1100,163 @@
 
     {
         // about to read from audio source
-        sp<MonoPipeReader> source = in->dev->rsxSource.get();
-        if (source == 0) {
-            ALOGE("no audio pipe yet we're trying to read!");
-            pthread_mutex_unlock(&in->dev->lock);
-            usleep((bytes / frame_size) * 1000000 / in_get_sample_rate(&stream->common));
+        sp<MonoPipeReader> source = rsxadev->routes[in->route_handle].rsxSource;
+        if (source == NULL) {
+            in->read_error_count++;// ok if it rolls over
+            ALOGE_IF(in->read_error_count < MAX_READ_ERROR_LOGS,
+                    "no audio pipe yet we're trying to read! (not all errors will be logged)");
+            pthread_mutex_unlock(&rsxadev->lock);
+            usleep(frames_to_read * 1000000 / in_get_sample_rate(&stream->common));
             memset(buffer, 0, bytes);
             return bytes;
         }
 
-        pthread_mutex_unlock(&in->dev->lock);
+        pthread_mutex_unlock(&rsxadev->lock);
 
         // read the data from the pipe (it's non blocking)
         int attempts = 0;
         char* buff = (char*)buffer;
+#if ENABLE_CHANNEL_CONVERSION
+        // Determine whether channel conversion is required.
+        const uint32_t input_channels = audio_channel_count_from_in_mask(
+            rsxadev->routes[in->route_handle].config.input_channel_mask);
+        const uint32_t output_channels = audio_channel_count_from_out_mask(
+            rsxadev->routes[in->route_handle].config.output_channel_mask);
+        if (input_channels != output_channels) {
+            SUBMIX_ALOGV("in_read(): %d output channels will be converted to %d "
+                         "input channels", output_channels, input_channels);
+            // Only support 16-bit PCM channel conversion from mono to stereo or stereo to mono.
+            ALOG_ASSERT(rsxadev->routes[in->route_handle].config.common.format ==
+                    AUDIO_FORMAT_PCM_16_BIT);
+            ALOG_ASSERT((input_channels == 1 && output_channels == 2) ||
+                        (input_channels == 2 && output_channels == 1));
+        }
+#endif // ENABLE_CHANNEL_CONVERSION
+
+#if ENABLE_RESAMPLING
+        const uint32_t input_sample_rate = in_get_sample_rate(&stream->common);
+        const uint32_t output_sample_rate =
+                rsxadev->routes[in->route_handle].config.output_sample_rate;
+        const size_t resampler_buffer_size_frames =
+            sizeof(rsxadev->routes[in->route_handle].resampler_buffer) /
+                sizeof(rsxadev->routes[in->route_handle].resampler_buffer[0]);
+        float resampler_ratio = 1.0f;
+        // Determine whether resampling is required.
+        if (input_sample_rate != output_sample_rate) {
+            resampler_ratio = (float)output_sample_rate / (float)input_sample_rate;
+            // Only support 16-bit PCM mono resampling.
+            // NOTE: Resampling is performed after the channel conversion step.
+            ALOG_ASSERT(rsxadev->routes[in->route_handle].config.common.format ==
+                    AUDIO_FORMAT_PCM_16_BIT);
+            ALOG_ASSERT(audio_channel_count_from_in_mask(
+                    rsxadev->routes[in->route_handle].config.input_channel_mask) == 1);
+        }
+#endif // ENABLE_RESAMPLING
+
         while ((remaining_frames > 0) && (attempts < MAX_READ_ATTEMPTS)) {
-            attempts++;
-            frames_read = source->read(buff, remaining_frames, AudioBufferProvider::kInvalidPTS);
+            ssize_t frames_read = -1977;
+            size_t read_frames = remaining_frames;
+#if ENABLE_RESAMPLING
+            char* const saved_buff = buff;
+            if (resampler_ratio != 1.0f) {
+                // Calculate the number of frames from the pipe that need to be read to generate
+                // the data for the input stream read.
+                const size_t frames_required_for_resampler = (size_t)(
+                    (float)read_frames * (float)resampler_ratio);
+                read_frames = min(frames_required_for_resampler, resampler_buffer_size_frames);
+                // Read into the resampler buffer.
+                buff = (char*)rsxadev->routes[in->route_handle].resampler_buffer;
+            }
+#endif // ENABLE_RESAMPLING
+#if ENABLE_CHANNEL_CONVERSION
+            if (output_channels == 1 && input_channels == 2) {
+                // Need to read half the requested frames since the converted output
+                // data will take twice the space (mono->stereo).
+                read_frames /= 2;
+            }
+#endif // ENABLE_CHANNEL_CONVERSION
+
+            SUBMIX_ALOGV("in_read(): frames available to read %zd", source->availableToRead());
+
+            frames_read = source->read(buff, read_frames, AudioBufferProvider::kInvalidPTS);
+
+            SUBMIX_ALOGV("in_read(): frames read %zd", frames_read);
+
+#if ENABLE_CHANNEL_CONVERSION
+            // Perform in-place channel conversion.
+            // NOTE: In the following "input stream" refers to the data returned by this function
+            // and "output stream" refers to the data read from the pipe.
+            if (input_channels != output_channels && frames_read > 0) {
+                int16_t *data = (int16_t*)buff;
+                if (output_channels == 2 && input_channels == 1) {
+                    // Offset into the output stream data in samples.
+                    ssize_t output_stream_offset = 0;
+                    for (ssize_t input_stream_frame = 0; input_stream_frame < frames_read;
+                         input_stream_frame++, output_stream_offset += 2) {
+                        // Average the content from both channels.
+                        data[input_stream_frame] = ((int32_t)data[output_stream_offset] +
+                                                    (int32_t)data[output_stream_offset + 1]) / 2;
+                    }
+                } else if (output_channels == 1 && input_channels == 2) {
+                    // Offset into the input stream data in samples.
+                    ssize_t input_stream_offset = (frames_read - 1) * 2;
+                    for (ssize_t output_stream_frame = frames_read - 1; output_stream_frame >= 0;
+                         output_stream_frame--, input_stream_offset -= 2) {
+                        const short sample = data[output_stream_frame];
+                        data[input_stream_offset] = sample;
+                        data[input_stream_offset + 1] = sample;
+                    }
+                }
+            }
+#endif // ENABLE_CHANNEL_CONVERSION
+
+#if ENABLE_RESAMPLING
+            if (resampler_ratio != 1.0f) {
+                SUBMIX_ALOGV("in_read(): resampling %zd frames", frames_read);
+                const int16_t * const data = (int16_t*)buff;
+                int16_t * const resampled_buffer = (int16_t*)saved_buff;
+                // Resample with *no* filtering - if the data from the ouptut stream was really
+                // sampled at a different rate this will result in very nasty aliasing.
+                const float output_stream_frames = (float)frames_read;
+                size_t input_stream_frame = 0;
+                for (float output_stream_frame = 0.0f;
+                     output_stream_frame < output_stream_frames &&
+                     input_stream_frame < remaining_frames;
+                     output_stream_frame += resampler_ratio, input_stream_frame++) {
+                    resampled_buffer[input_stream_frame] = data[(size_t)output_stream_frame];
+                }
+                ALOG_ASSERT(input_stream_frame <= (ssize_t)resampler_buffer_size_frames);
+                SUBMIX_ALOGV("in_read(): resampler produced %zd frames", input_stream_frame);
+                frames_read = input_stream_frame;
+                buff = saved_buff;
+            }
+#endif // ENABLE_RESAMPLING
+
             if (frames_read > 0) {
+#if LOG_STREAMS_TO_FILES
+                if (in->log_fd >= 0) write(in->log_fd, buff, frames_read * frame_size);
+#endif // LOG_STREAMS_TO_FILES
+
                 remaining_frames -= frames_read;
                 buff += frames_read * frame_size;
-                //ALOGV("  in_read (att=%d) got %ld frames, remaining=%u",
-                //      attempts, frames_read, remaining_frames);
+                SUBMIX_ALOGV("  in_read (att=%d) got %zd frames, remaining=%zu",
+                             attempts, frames_read, remaining_frames);
             } else {
-                //ALOGE("  in_read read returned %ld", frames_read);
+                attempts++;
+                SUBMIX_ALOGE("  in_read read returned %zd", frames_read);
                 usleep(READ_ATTEMPT_SLEEP_MS * 1000);
             }
         }
         // done using the source
-        pthread_mutex_lock(&in->dev->lock);
+        pthread_mutex_lock(&rsxadev->lock);
         source.clear();
-        pthread_mutex_unlock(&in->dev->lock);
+        pthread_mutex_unlock(&rsxadev->lock);
     }
 
     if (remaining_frames > 0) {
-        ALOGV("  remaining_frames = %zu", remaining_frames);
-        memset(((char*)buffer)+ bytes - (remaining_frames * frame_size), 0,
-                remaining_frames * frame_size);
+        const size_t remaining_bytes = remaining_frames * frame_size;
+        SUBMIX_ALOGV("  clearing remaining_frames = %zu", remaining_frames);
+        memset(((char*)buffer)+ bytes - remaining_bytes, 0, remaining_bytes);
     }
 
     // compute how much we need to sleep after reading the data by comparing the wall clock with
@@ -469,17 +1274,17 @@
             record_duration.tv_nsec += 1000000000;
         }
 
-        // read_counter_frames contains the number of frames that have been read since the beginning
-        // of recording (including this call): it's converted to usec and compared to how long we've
-        // been recording for, which gives us how long we must wait to sync the projected recording
-        // time, and the observed recording time
+        // read_counter_frames contains the number of frames that have been read since the
+        // beginning of recording (including this call): it's converted to usec and compared to
+        // how long we've been recording for, which gives us how long we must wait to sync the
+        // projected recording time, and the observed recording time.
         long projected_vs_observed_offset_us =
                 ((int64_t)(in->read_counter_frames
                             - (record_duration.tv_sec*sample_rate)))
                         * 1000000 / sample_rate
                 - (record_duration.tv_nsec / 1000);
 
-        ALOGV("  record duration %5lds %3ldms, will wait: %7ldus",
+        SUBMIX_ALOGV("  record duration %5lds %3ldms, will wait: %7ldus",
                 record_duration.tv_sec, record_duration.tv_nsec/1000000,
                 projected_vs_observed_offset_us);
         if (projected_vs_observed_offset_us > 0) {
@@ -487,24 +1292,28 @@
         }
     }
 
-
-    ALOGV("in_read returns %zu", bytes);
+    SUBMIX_ALOGV("in_read returns %zu", bytes);
     return bytes;
 
 }
 
 static uint32_t in_get_input_frames_lost(struct audio_stream_in *stream)
 {
+    (void)stream;
     return 0;
 }
 
 static int in_add_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
 {
+    (void)stream;
+    (void)effect;
     return 0;
 }
 
 static int in_remove_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
 {
+    (void)stream;
+    (void)effect;
     return 0;
 }
 
@@ -513,21 +1322,46 @@
                                    audio_devices_t devices,
                                    audio_output_flags_t flags,
                                    struct audio_config *config,
-                                   struct audio_stream_out **stream_out)
+                                   struct audio_stream_out **stream_out,
+                                   const char *address)
 {
-    ALOGV("adev_open_output_stream()");
-    struct submix_audio_device *rsxadev = (struct submix_audio_device *)dev;
+    struct submix_audio_device * const rsxadev = audio_hw_device_get_submix_audio_device(dev);
+    ALOGD("adev_open_output_stream(address=%s)", address);
     struct submix_stream_out *out;
-    int ret;
+    bool force_pipe_creation = false;
+    (void)handle;
+    (void)devices;
+    (void)flags;
 
-    out = (struct submix_stream_out *)calloc(1, sizeof(struct submix_stream_out));
-    if (!out) {
-        ret = -ENOMEM;
-        goto err_open;
-    }
+    *stream_out = NULL;
+
+    // Make sure it's possible to open the device given the current audio config.
+    submix_sanitize_config(config, false);
+
+    int route_idx = -1;
 
     pthread_mutex_lock(&rsxadev->lock);
 
+    status_t res = submix_get_route_idx_for_address_l(rsxadev, address, &route_idx);
+    if (res != OK) {
+        ALOGE("Error %d looking for address=%s in adev_open_output_stream", res, address);
+        pthread_mutex_unlock(&rsxadev->lock);
+        return res;
+    }
+
+    if (!submix_open_validate_l(rsxadev, route_idx, config, false)) {
+        ALOGE("adev_open_output_stream(): Unable to open output stream for address %s", address);
+        pthread_mutex_unlock(&rsxadev->lock);
+        return -EINVAL;
+    }
+
+    out = (struct submix_stream_out *)calloc(1, sizeof(struct submix_stream_out));
+    if (!out) {
+        pthread_mutex_unlock(&rsxadev->lock);
+        return -ENOMEM;
+    }
+
+    // Initialize the function pointer tables (v-tables).
     out->stream.common.get_sample_rate = out_get_sample_rate;
     out->stream.common.set_sample_rate = out_set_sample_rate;
     out->stream.common.get_buffer_size = out_get_buffer_size;
@@ -545,217 +1379,318 @@
     out->stream.write = out_write;
     out->stream.get_render_position = out_get_render_position;
     out->stream.get_next_write_timestamp = out_get_next_write_timestamp;
+    out->stream.get_presentation_position = out_get_presentation_position;
 
-    config->channel_mask = AUDIO_CHANNEL_OUT_STEREO;
-    rsxadev->config.channel_mask = config->channel_mask;
+    out->write_counter_frames = 0;
 
-    if ((config->sample_rate != 48000) && (config->sample_rate != 44100)) {
-        config->sample_rate = DEFAULT_RATE_HZ;
+#if ENABLE_RESAMPLING
+    // Recreate the pipe with the correct sample rate so that MonoPipe.write() rate limits
+    // writes correctly.
+    force_pipe_creation = rsxadev->routes[route_idx].config.common.sample_rate
+            != config->sample_rate;
+#endif // ENABLE_RESAMPLING
+
+    // If the sink has been shutdown or pipe recreation is forced (see above), delete the pipe so
+    // that it's recreated.
+    if ((rsxadev->routes[route_idx].rsxSink != NULL
+            && rsxadev->routes[route_idx].rsxSink->isShutdown()) || force_pipe_creation) {
+        submix_audio_device_release_pipe_l(rsxadev, route_idx);
     }
-    rsxadev->config.rate = config->sample_rate;
 
-    config->format = AUDIO_FORMAT_PCM_16_BIT;
-    rsxadev->config.format = config->format;
-
-    rsxadev->config.period_size = 1024;
-    rsxadev->config.period_count = 4;
+    // Store a pointer to the device from the output stream.
     out->dev = rsxadev;
-
+    // Initialize the pipe.
+    ALOGV("adev_open_output_stream(): about to create pipe at index %d", route_idx);
+    submix_audio_device_create_pipe_l(rsxadev, config, DEFAULT_PIPE_SIZE_IN_FRAMES,
+            DEFAULT_PIPE_PERIOD_COUNT, NULL, out, address, route_idx);
+#if LOG_STREAMS_TO_FILES
+    out->log_fd = open(LOG_STREAM_OUT_FILENAME, O_CREAT | O_TRUNC | O_WRONLY,
+                       LOG_STREAM_FILE_PERMISSIONS);
+    ALOGE_IF(out->log_fd < 0, "adev_open_output_stream(): log file open failed %s",
+             strerror(errno));
+    ALOGV("adev_open_output_stream(): log_fd = %d", out->log_fd);
+#endif // LOG_STREAMS_TO_FILES
+    // Return the output stream.
     *stream_out = &out->stream;
 
-    // initialize pipe
-    {
-        ALOGV("  initializing pipe");
-        const NBAIO_Format format = Format_from_SR_C(config->sample_rate, 2);
-        const NBAIO_Format offers[1] = {format};
-        size_t numCounterOffers = 0;
-        // creating a MonoPipe with optional blocking set to true.
-        MonoPipe* sink = new MonoPipe(MAX_PIPE_DEPTH_IN_FRAMES, format, true/*writeCanBlock*/);
-        ssize_t index = sink->negotiate(offers, 1, NULL, numCounterOffers);
-        ALOG_ASSERT(index == 0);
-        MonoPipeReader* source = new MonoPipeReader(sink);
-        numCounterOffers = 0;
-        index = source->negotiate(offers, 1, NULL, numCounterOffers);
-        ALOG_ASSERT(index == 0);
-        rsxadev->rsxSink = sink;
-        rsxadev->rsxSource = source;
-    }
-
     pthread_mutex_unlock(&rsxadev->lock);
-
     return 0;
-
-err_open:
-    *stream_out = NULL;
-    return ret;
 }
 
 static void adev_close_output_stream(struct audio_hw_device *dev,
                                      struct audio_stream_out *stream)
 {
-    ALOGV("adev_close_output_stream()");
-    struct submix_audio_device *rsxadev = (struct submix_audio_device *)dev;
+    struct submix_audio_device * rsxadev = audio_hw_device_get_submix_audio_device(
+                    const_cast<struct audio_hw_device*>(dev));
+    struct submix_stream_out * const out = audio_stream_out_get_submix_stream_out(stream);
 
     pthread_mutex_lock(&rsxadev->lock);
-
-    rsxadev->rsxSink.clear();
-    rsxadev->rsxSource.clear();
-    free(stream);
+    ALOGD("adev_close_output_stream() addr = %s", rsxadev->routes[out->route_handle].address);
+    submix_audio_device_destroy_pipe_l(audio_hw_device_get_submix_audio_device(dev), NULL, out);
+#if LOG_STREAMS_TO_FILES
+    if (out->log_fd >= 0) close(out->log_fd);
+#endif // LOG_STREAMS_TO_FILES
 
     pthread_mutex_unlock(&rsxadev->lock);
+    free(out);
 }
 
 static int adev_set_parameters(struct audio_hw_device *dev, const char *kvpairs)
 {
+    (void)dev;
+    (void)kvpairs;
     return -ENOSYS;
 }
 
 static char * adev_get_parameters(const struct audio_hw_device *dev,
                                   const char *keys)
 {
+    (void)dev;
+    (void)keys;
     return strdup("");;
 }
 
 static int adev_init_check(const struct audio_hw_device *dev)
 {
     ALOGI("adev_init_check()");
+    (void)dev;
     return 0;
 }
 
 static int adev_set_voice_volume(struct audio_hw_device *dev, float volume)
 {
+    (void)dev;
+    (void)volume;
     return -ENOSYS;
 }
 
 static int adev_set_master_volume(struct audio_hw_device *dev, float volume)
 {
+    (void)dev;
+    (void)volume;
     return -ENOSYS;
 }
 
 static int adev_get_master_volume(struct audio_hw_device *dev, float *volume)
 {
+    (void)dev;
+    (void)volume;
     return -ENOSYS;
 }
 
 static int adev_set_master_mute(struct audio_hw_device *dev, bool muted)
 {
+    (void)dev;
+    (void)muted;
     return -ENOSYS;
 }
 
 static int adev_get_master_mute(struct audio_hw_device *dev, bool *muted)
 {
+    (void)dev;
+    (void)muted;
     return -ENOSYS;
 }
 
 static int adev_set_mode(struct audio_hw_device *dev, audio_mode_t mode)
 {
+    (void)dev;
+    (void)mode;
     return 0;
 }
 
 static int adev_set_mic_mute(struct audio_hw_device *dev, bool state)
 {
+    (void)dev;
+    (void)state;
     return -ENOSYS;
 }
 
 static int adev_get_mic_mute(const struct audio_hw_device *dev, bool *state)
 {
+    (void)dev;
+    (void)state;
     return -ENOSYS;
 }
 
 static size_t adev_get_input_buffer_size(const struct audio_hw_device *dev,
                                          const struct audio_config *config)
 {
-    //### TODO correlate this with pipe parameters
-    return 4096;
+    if (audio_is_linear_pcm(config->format)) {
+        size_t max_buffer_period_size_frames = 0;
+        struct submix_audio_device * rsxadev = audio_hw_device_get_submix_audio_device(
+                const_cast<struct audio_hw_device*>(dev));
+        // look for the largest buffer period size
+        for (int i = 0 ; i < MAX_ROUTES ; i++) {
+            if (rsxadev->routes[i].config.buffer_period_size_frames > max_buffer_period_size_frames)
+            {
+                max_buffer_period_size_frames = rsxadev->routes[i].config.buffer_period_size_frames;
+            }
+        }
+        const size_t frame_size_in_bytes = audio_channel_count_from_in_mask(config->channel_mask) *
+                audio_bytes_per_sample(config->format);
+        const size_t buffer_size = max_buffer_period_size_frames * frame_size_in_bytes;
+        SUBMIX_ALOGV("adev_get_input_buffer_size() returns %zu bytes, %zu frames",
+                 buffer_size, buffer_period_size_frames);
+        return buffer_size;
+    }
+    return 0;
 }
 
 static int adev_open_input_stream(struct audio_hw_device *dev,
                                   audio_io_handle_t handle,
                                   audio_devices_t devices,
                                   struct audio_config *config,
-                                  struct audio_stream_in **stream_in)
+                                  struct audio_stream_in **stream_in,
+                                  audio_input_flags_t flags __unused,
+                                  const char *address,
+                                  audio_source_t source __unused)
 {
-    ALOGI("adev_open_input_stream()");
-
-    struct submix_audio_device *rsxadev = (struct submix_audio_device *)dev;
+    struct submix_audio_device *rsxadev = audio_hw_device_get_submix_audio_device(dev);
     struct submix_stream_in *in;
-    int ret;
+    ALOGD("adev_open_input_stream(addr=%s)", address);
+    (void)handle;
+    (void)devices;
 
-    in = (struct submix_stream_in *)calloc(1, sizeof(struct submix_stream_in));
-    if (!in) {
-        ret = -ENOMEM;
-        goto err_open;
-    }
+    *stream_in = NULL;
+
+    // Do we already have a route for this address
+    int route_idx = -1;
 
     pthread_mutex_lock(&rsxadev->lock);
 
-    in->stream.common.get_sample_rate = in_get_sample_rate;
-    in->stream.common.set_sample_rate = in_set_sample_rate;
-    in->stream.common.get_buffer_size = in_get_buffer_size;
-    in->stream.common.get_channels = in_get_channels;
-    in->stream.common.get_format = in_get_format;
-    in->stream.common.set_format = in_set_format;
-    in->stream.common.standby = in_standby;
-    in->stream.common.dump = in_dump;
-    in->stream.common.set_parameters = in_set_parameters;
-    in->stream.common.get_parameters = in_get_parameters;
-    in->stream.common.add_audio_effect = in_add_audio_effect;
-    in->stream.common.remove_audio_effect = in_remove_audio_effect;
-    in->stream.set_gain = in_set_gain;
-    in->stream.read = in_read;
-    in->stream.get_input_frames_lost = in_get_input_frames_lost;
-
-    config->channel_mask = AUDIO_CHANNEL_IN_STEREO;
-    rsxadev->config.channel_mask = config->channel_mask;
-
-    if ((config->sample_rate != 48000) && (config->sample_rate != 44100)) {
-        config->sample_rate = DEFAULT_RATE_HZ;
+    status_t res = submix_get_route_idx_for_address_l(rsxadev, address, &route_idx);
+    if (res != OK) {
+        ALOGE("Error %d looking for address=%s in adev_open_output_stream", res, address);
+        pthread_mutex_unlock(&rsxadev->lock);
+        return res;
     }
-    rsxadev->config.rate = config->sample_rate;
 
-    config->format = AUDIO_FORMAT_PCM_16_BIT;
-    rsxadev->config.format = config->format;
+    // Make sure it's possible to open the device given the current audio config.
+    submix_sanitize_config(config, true);
+    if (!submix_open_validate_l(rsxadev, route_idx, config, true)) {
+        ALOGE("adev_open_input_stream(): Unable to open input stream.");
+        pthread_mutex_unlock(&rsxadev->lock);
+        return -EINVAL;
+    }
 
-    rsxadev->config.period_size = 1024;
-    rsxadev->config.period_count = 4;
+#if ENABLE_LEGACY_INPUT_OPEN
+    in = rsxadev->routes[route_idx].input;
+    if (in) {
+        in->ref_count++;
+        sp<MonoPipe> sink = rsxadev->routes[route_idx].rsxSink;
+        ALOG_ASSERT(sink != NULL);
+        // If the sink has been shutdown, delete the pipe.
+        if (sink != NULL) {
+            if (sink->isShutdown()) {
+                ALOGD(" Non-NULL shut down sink when opening input stream, releasing, refcount=%d",
+                        in->ref_count);
+                submix_audio_device_release_pipe_l(rsxadev, in->route_handle);
+            } else {
+                ALOGD(" Non-NULL sink when opening input stream, refcount=%d", in->ref_count);
+            }
+        } else {
+            ALOGE("NULL sink when opening input stream, refcount=%d", in->ref_count);
+        }
+    }
+#else
+    in = NULL;
+#endif // ENABLE_LEGACY_INPUT_OPEN
 
+    if (!in) {
+        in = (struct submix_stream_in *)calloc(1, sizeof(struct submix_stream_in));
+        if (!in) return -ENOMEM;
+        in->ref_count = 1;
+
+        // Initialize the function pointer tables (v-tables).
+        in->stream.common.get_sample_rate = in_get_sample_rate;
+        in->stream.common.set_sample_rate = in_set_sample_rate;
+        in->stream.common.get_buffer_size = in_get_buffer_size;
+        in->stream.common.get_channels = in_get_channels;
+        in->stream.common.get_format = in_get_format;
+        in->stream.common.set_format = in_set_format;
+        in->stream.common.standby = in_standby;
+        in->stream.common.dump = in_dump;
+        in->stream.common.set_parameters = in_set_parameters;
+        in->stream.common.get_parameters = in_get_parameters;
+        in->stream.common.add_audio_effect = in_add_audio_effect;
+        in->stream.common.remove_audio_effect = in_remove_audio_effect;
+        in->stream.set_gain = in_set_gain;
+        in->stream.read = in_read;
+        in->stream.get_input_frames_lost = in_get_input_frames_lost;
+
+        in->dev = rsxadev;
+#if LOG_STREAMS_TO_FILES
+        in->log_fd = -1;
+#endif
+    }
+
+    // Initialize the input stream.
+    in->read_counter_frames = 0;
+    in->input_standby = true;
+    if (rsxadev->routes[route_idx].output != NULL) {
+        in->output_standby_rec_thr = rsxadev->routes[route_idx].output->output_standby;
+    } else {
+        in->output_standby_rec_thr = true;
+    }
+
+    in->read_error_count = 0;
+    // Initialize the pipe.
+    ALOGV("adev_open_input_stream(): about to create pipe");
+    submix_audio_device_create_pipe_l(rsxadev, config, DEFAULT_PIPE_SIZE_IN_FRAMES,
+                                    DEFAULT_PIPE_PERIOD_COUNT, in, NULL, address, route_idx);
+#if LOG_STREAMS_TO_FILES
+    if (in->log_fd >= 0) close(in->log_fd);
+    in->log_fd = open(LOG_STREAM_IN_FILENAME, O_CREAT | O_TRUNC | O_WRONLY,
+                      LOG_STREAM_FILE_PERMISSIONS);
+    ALOGE_IF(in->log_fd < 0, "adev_open_input_stream(): log file open failed %s",
+             strerror(errno));
+    ALOGV("adev_open_input_stream(): log_fd = %d", in->log_fd);
+#endif // LOG_STREAMS_TO_FILES
+    // Return the input stream.
     *stream_in = &in->stream;
 
-    in->dev = rsxadev;
-
-    in->read_counter_frames = 0;
-    in->output_standby = rsxadev->output_standby;
-
     pthread_mutex_unlock(&rsxadev->lock);
-
     return 0;
-
-err_open:
-    *stream_in = NULL;
-    return ret;
 }
 
 static void adev_close_input_stream(struct audio_hw_device *dev,
-                                   struct audio_stream_in *stream)
+                                    struct audio_stream_in *stream)
 {
-    ALOGV("adev_close_input_stream()");
-    struct submix_audio_device *rsxadev = (struct submix_audio_device *)dev;
+    struct submix_audio_device * const rsxadev = audio_hw_device_get_submix_audio_device(dev);
 
+    struct submix_stream_in * const in = audio_stream_in_get_submix_stream_in(stream);
+    ALOGD("adev_close_input_stream()");
     pthread_mutex_lock(&rsxadev->lock);
-
-    MonoPipe* sink = rsxadev->rsxSink.get();
-    if (sink != NULL) {
-        ALOGI("shutdown");
-        sink->shutdown(true);
-    }
-
-    free(stream);
+    submix_audio_device_destroy_pipe_l(rsxadev, in, NULL);
+#if LOG_STREAMS_TO_FILES
+    if (in->log_fd >= 0) close(in->log_fd);
+#endif // LOG_STREAMS_TO_FILES
+#if ENABLE_LEGACY_INPUT_OPEN
+    if (in->ref_count == 0) free(in);
+#else
+    free(in);
+#endif // ENABLE_LEGACY_INPUT_OPEN
 
     pthread_mutex_unlock(&rsxadev->lock);
 }
 
 static int adev_dump(const audio_hw_device_t *device, int fd)
 {
+    const struct submix_audio_device * rsxadev = //audio_hw_device_get_submix_audio_device(device);
+            reinterpret_cast<const struct submix_audio_device *>(
+                    reinterpret_cast<const uint8_t *>(device) -
+                            offsetof(struct submix_audio_device, device));
+    char msg[100];
+    int n = sprintf(msg, "\nReroute submix audio module:\n");
+    write(fd, &msg, n);
+    for (int i=0 ; i < MAX_ROUTES ; i++) {
+        n = sprintf(msg, " route[%d] rate in=%d out=%d, addr=[%s]\n", i,
+                rsxadev->routes[i].config.input_sample_rate,
+                rsxadev->routes[i].config.output_sample_rate,
+                rsxadev->routes[i].address);
+        write(fd, &msg, n);
+    }
     return 0;
 }
 
@@ -802,8 +1737,10 @@
     rsxadev->device.close_input_stream = adev_close_input_stream;
     rsxadev->device.dump = adev_dump;
 
-    rsxadev->input_standby = true;
-    rsxadev->output_standby = true;
+    for (int i=0 ; i < MAX_ROUTES ; i++) {
+            memset(&rsxadev->routes[i], 0, sizeof(route_config));
+            strcpy(rsxadev->routes[i].address, "");
+        }
 
     *device = &rsxadev->device.common;
 
diff --git a/modules/camera/Android.mk b/modules/camera/Android.mk
index fbe44c5..ae68ed5 100644
--- a/modules/camera/Android.mk
+++ b/modules/camera/Android.mk
@@ -26,14 +26,17 @@
 LOCAL_SRC_FILES := \
 	CameraHAL.cpp \
 	Camera.cpp \
+	ExampleCamera.cpp \
 	Metadata.cpp \
 	Stream.cpp \
+	VendorTags.cpp \
 
 LOCAL_SHARED_LIBRARIES := \
 	libcamera_metadata \
 	libcutils \
 	liblog \
 	libsync \
+	libutils \
 
 LOCAL_CFLAGS += -Wall -Wextra -fvisibility=hidden
 
diff --git a/modules/camera/Camera.cpp b/modules/camera/Camera.cpp
index 973380e..de3ae78 100644
--- a/modules/camera/Camera.cpp
+++ b/modules/camera/Camera.cpp
@@ -15,11 +15,12 @@
  */
 
 #include <cstdlib>
-#include <pthread.h>
+#include <stdio.h>
 #include <hardware/camera3.h>
 #include <sync/sync.h>
 #include <system/camera_metadata.h>
 #include <system/graphics.h>
+#include <utils/Mutex.h>
 #include "CameraHAL.h"
 #include "Metadata.h"
 #include "Stream.h"
@@ -29,15 +30,12 @@
 #include <cutils/log.h>
 
 #define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
-#include <cutils/trace.h>
-#include "ScopedTrace.h"
+#include <utils/Trace.h>
 
 #include "Camera.h"
 
 #define CAMERA_SYNC_TIMEOUT 5000 // in msecs
 
-#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
-
 namespace default_camera_hal {
 
 extern "C" {
@@ -59,9 +57,7 @@
     mNumStreams(0),
     mSettings(NULL)
 {
-    pthread_mutex_init(&mMutex, NULL);
-    pthread_mutex_init(&mStaticInfoMutex, NULL);
-
+    memset(&mTemplates, 0, sizeof(mTemplates));
     memset(&mDevice, 0, sizeof(mDevice));
     mDevice.common.tag    = HARDWARE_DEVICE_TAG;
     mDevice.common.version = CAMERA_DEVICE_API_VERSION_3_0;
@@ -72,17 +68,18 @@
 
 Camera::~Camera()
 {
-    pthread_mutex_destroy(&mMutex);
-    pthread_mutex_destroy(&mStaticInfoMutex);
+    if (mStaticInfo != NULL) {
+        free_camera_metadata(mStaticInfo);
+    }
 }
 
 int Camera::open(const hw_module_t *module, hw_device_t **device)
 {
     ALOGI("%s:%d: Opening camera device", __func__, mId);
-    CAMTRACE_CALL();
-    pthread_mutex_lock(&mMutex);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
     if (mBusy) {
-        pthread_mutex_unlock(&mMutex);
         ALOGE("%s:%d: Error! Camera device already opened", __func__, mId);
         return -EBUSY;
     }
@@ -91,217 +88,62 @@
     mBusy = true;
     mDevice.common.module = const_cast<hw_module_t*>(module);
     *device = &mDevice.common;
-
-    pthread_mutex_unlock(&mMutex);
     return 0;
 }
 
 int Camera::getInfo(struct camera_info *info)
 {
+    android::Mutex::Autolock al(mStaticInfoLock);
+
     info->facing = CAMERA_FACING_FRONT;
     info->orientation = 0;
     info->device_version = mDevice.common.version;
-
-    pthread_mutex_lock(&mStaticInfoMutex);
     if (mStaticInfo == NULL) {
         mStaticInfo = initStaticInfo();
     }
-    pthread_mutex_unlock(&mStaticInfoMutex);
-
     info->static_camera_characteristics = mStaticInfo;
-
     return 0;
 }
 
 int Camera::close()
 {
     ALOGI("%s:%d: Closing camera device", __func__, mId);
-    CAMTRACE_CALL();
-    pthread_mutex_lock(&mMutex);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
     if (!mBusy) {
-        pthread_mutex_unlock(&mMutex);
         ALOGE("%s:%d: Error! Camera device not open", __func__, mId);
         return -EINVAL;
     }
 
     // TODO: close camera dev nodes, etc
     mBusy = false;
-
-    pthread_mutex_unlock(&mMutex);
     return 0;
 }
 
 int Camera::initialize(const camera3_callback_ops_t *callback_ops)
 {
+    int res;
+
     ALOGV("%s:%d: callback_ops=%p", __func__, mId, callback_ops);
     mCallbackOps = callback_ops;
-    // Create standard settings templates
-    // 0 is invalid as template
-    mTemplates[0] = NULL;
-    // CAMERA3_TEMPLATE_PREVIEW = 1
-    mTemplates[1] = new Metadata(ANDROID_CONTROL_MODE_OFF,
-            ANDROID_CONTROL_CAPTURE_INTENT_PREVIEW);
-    // CAMERA3_TEMPLATE_STILL_CAPTURE = 2
-    mTemplates[2] = new Metadata(ANDROID_CONTROL_MODE_OFF,
-            ANDROID_CONTROL_CAPTURE_INTENT_STILL_CAPTURE);
-    // CAMERA3_TEMPLATE_VIDEO_RECORD = 3
-    mTemplates[3] = new Metadata(ANDROID_CONTROL_MODE_OFF,
-            ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_RECORD);
-    // CAMERA3_TEMPLATE_VIDEO_SNAPSHOT = 4
-    mTemplates[4] = new Metadata(ANDROID_CONTROL_MODE_OFF,
-            ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_SNAPSHOT);
-    // CAMERA3_TEMPLATE_STILL_ZERO_SHUTTER_LAG = 5
-    mTemplates[5] = new Metadata(ANDROID_CONTROL_MODE_OFF,
-            ANDROID_CONTROL_CAPTURE_INTENT_ZERO_SHUTTER_LAG);
-    // Pre-generate metadata structures
-    for (int i = 1; i < CAMERA3_TEMPLATE_COUNT; i++) {
-        mTemplates[i]->generate();
+    // per-device specific initialization
+    res = initDevice();
+    if (res != 0) {
+        ALOGE("%s:%d: Failed to initialize device!", __func__, mId);
+        return res;
     }
-    // TODO: create vendor templates
     return 0;
 }
 
-camera_metadata_t *Camera::initStaticInfo()
-{
-    /*
-     * Setup static camera info.  This will have to customized per camera
-     * device.
-     */
-    Metadata m;
-
-    /* android.control */
-    int32_t android_control_ae_available_target_fps_ranges[] = {30, 30};
-    m.addInt32(ANDROID_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES,
-            ARRAY_SIZE(android_control_ae_available_target_fps_ranges),
-            android_control_ae_available_target_fps_ranges);
-
-    int32_t android_control_ae_compensation_range[] = {-4, 4};
-    m.addInt32(ANDROID_CONTROL_AE_COMPENSATION_RANGE,
-            ARRAY_SIZE(android_control_ae_compensation_range),
-            android_control_ae_compensation_range);
-
-    camera_metadata_rational_t android_control_ae_compensation_step[] = {{2,1}};
-    m.addRational(ANDROID_CONTROL_AE_COMPENSATION_STEP,
-            ARRAY_SIZE(android_control_ae_compensation_step),
-            android_control_ae_compensation_step);
-
-    int32_t android_control_max_regions[] = {1};
-    m.addInt32(ANDROID_CONTROL_MAX_REGIONS,
-            ARRAY_SIZE(android_control_max_regions),
-            android_control_max_regions);
-
-    /* android.jpeg */
-    int32_t android_jpeg_available_thumbnail_sizes[] = {0, 0, 128, 96};
-    m.addInt32(ANDROID_JPEG_AVAILABLE_THUMBNAIL_SIZES,
-            ARRAY_SIZE(android_jpeg_available_thumbnail_sizes),
-            android_jpeg_available_thumbnail_sizes);
-
-    /* android.lens */
-    float android_lens_info_available_focal_lengths[] = {1.0};
-    m.addFloat(ANDROID_LENS_INFO_AVAILABLE_FOCAL_LENGTHS,
-            ARRAY_SIZE(android_lens_info_available_focal_lengths),
-            android_lens_info_available_focal_lengths);
-
-    /* android.request */
-    int32_t android_request_max_num_output_streams[] = {0, 3, 1};
-    m.addInt32(ANDROID_REQUEST_MAX_NUM_OUTPUT_STREAMS,
-            ARRAY_SIZE(android_request_max_num_output_streams),
-            android_request_max_num_output_streams);
-
-    /* android.scaler */
-    int32_t android_scaler_available_formats[] = {
-            HAL_PIXEL_FORMAT_RAW_SENSOR,
-            HAL_PIXEL_FORMAT_BLOB,
-            HAL_PIXEL_FORMAT_RGBA_8888,
-            HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED,
-            // These are handled by YCbCr_420_888
-            //        HAL_PIXEL_FORMAT_YV12,
-            //        HAL_PIXEL_FORMAT_YCrCb_420_SP,
-            HAL_PIXEL_FORMAT_YCbCr_420_888};
-    m.addInt32(ANDROID_SCALER_AVAILABLE_FORMATS,
-            ARRAY_SIZE(android_scaler_available_formats),
-            android_scaler_available_formats);
-
-    int64_t android_scaler_available_jpeg_min_durations[] = {1};
-    m.addInt64(ANDROID_SCALER_AVAILABLE_JPEG_MIN_DURATIONS,
-            ARRAY_SIZE(android_scaler_available_jpeg_min_durations),
-            android_scaler_available_jpeg_min_durations);
-
-    int32_t android_scaler_available_jpeg_sizes[] = {640, 480};
-    m.addInt32(ANDROID_SCALER_AVAILABLE_JPEG_SIZES,
-            ARRAY_SIZE(android_scaler_available_jpeg_sizes),
-            android_scaler_available_jpeg_sizes);
-
-    float android_scaler_available_max_digital_zoom[] = {1};
-    m.addFloat(ANDROID_SCALER_AVAILABLE_MAX_DIGITAL_ZOOM,
-            ARRAY_SIZE(android_scaler_available_max_digital_zoom),
-            android_scaler_available_max_digital_zoom);
-
-    int64_t android_scaler_available_processed_min_durations[] = {1};
-    m.addInt64(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS,
-            ARRAY_SIZE(android_scaler_available_processed_min_durations),
-            android_scaler_available_processed_min_durations);
-
-    int32_t android_scaler_available_processed_sizes[] = {640, 480};
-    m.addInt32(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES,
-            ARRAY_SIZE(android_scaler_available_processed_sizes),
-            android_scaler_available_processed_sizes);
-
-    int64_t android_scaler_available_raw_min_durations[] = {1};
-    m.addInt64(ANDROID_SCALER_AVAILABLE_RAW_MIN_DURATIONS,
-            ARRAY_SIZE(android_scaler_available_raw_min_durations),
-            android_scaler_available_raw_min_durations);
-
-    int32_t android_scaler_available_raw_sizes[] = {640, 480};
-    m.addInt32(ANDROID_SCALER_AVAILABLE_RAW_SIZES,
-            ARRAY_SIZE(android_scaler_available_raw_sizes),
-            android_scaler_available_raw_sizes);
-
-    /* android.sensor */
-
-    int32_t android_sensor_info_active_array_size[] = {0, 0, 640, 480};
-    m.addInt32(ANDROID_SENSOR_INFO_ACTIVE_ARRAY_SIZE,
-            ARRAY_SIZE(android_sensor_info_active_array_size),
-            android_sensor_info_active_array_size);
-
-    int32_t android_sensor_info_sensitivity_range[] =
-            {100, 1600};
-    m.addInt32(ANDROID_SENSOR_INFO_SENSITIVITY_RANGE,
-            ARRAY_SIZE(android_sensor_info_sensitivity_range),
-            android_sensor_info_sensitivity_range);
-
-    int64_t android_sensor_info_max_frame_duration[] = {30000000000};
-    m.addInt64(ANDROID_SENSOR_INFO_MAX_FRAME_DURATION,
-            ARRAY_SIZE(android_sensor_info_max_frame_duration),
-            android_sensor_info_max_frame_duration);
-
-    float android_sensor_info_physical_size[] = {3.2, 2.4};
-    m.addFloat(ANDROID_SENSOR_INFO_PHYSICAL_SIZE,
-            ARRAY_SIZE(android_sensor_info_physical_size),
-            android_sensor_info_physical_size);
-
-    int32_t android_sensor_info_pixel_array_size[] = {640, 480};
-    m.addInt32(ANDROID_SENSOR_INFO_PIXEL_ARRAY_SIZE,
-            ARRAY_SIZE(android_sensor_info_pixel_array_size),
-            android_sensor_info_pixel_array_size);
-
-    int32_t android_sensor_orientation[] = {0};
-    m.addInt32(ANDROID_SENSOR_ORIENTATION,
-            ARRAY_SIZE(android_sensor_orientation),
-            android_sensor_orientation);
-
-    /* End of static camera characteristics */
-
-    return clone_camera_metadata(m.generate());
-}
-
 int Camera::configureStreams(camera3_stream_configuration_t *stream_config)
 {
     camera3_stream_t *astream;
     Stream **newStreams = NULL;
 
-    CAMTRACE_CALL();
     ALOGV("%s:%d: stream_config=%p", __func__, mId, stream_config);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
 
     if (stream_config == NULL) {
         ALOGE("%s:%d: NULL stream configuration array", __func__, mId);
@@ -317,8 +159,6 @@
     ALOGV("%s:%d: Number of Streams: %d", __func__, mId,
             stream_config->num_streams);
 
-    pthread_mutex_lock(&mMutex);
-
     // Mark all current streams unused for now
     for (int i = 0; i < mNumStreams; i++)
         mStreams[i]->mReuse = false;
@@ -356,14 +196,11 @@
 
     // Clear out last seen settings metadata
     setSettings(NULL);
-
-    pthread_mutex_unlock(&mMutex);
     return 0;
 
 err_out:
     // Clean up temporary streams, preserve existing mStreams/mNumStreams
     destroyStreams(newStreams, stream_config->num_streams);
-    pthread_mutex_unlock(&mMutex);
     return -EINVAL;
 }
 
@@ -469,15 +306,20 @@
     return stream->registerBuffers(buf_set);
 }
 
+bool Camera::isValidTemplateType(int type)
+{
+    return type < 1 || type >= CAMERA3_TEMPLATE_COUNT;
+}
+
 const camera_metadata_t* Camera::constructDefaultRequestSettings(int type)
 {
     ALOGV("%s:%d: type=%d", __func__, mId, type);
 
-    if (type < 1 || type >= CAMERA3_TEMPLATE_COUNT) {
+    if (!isValidTemplateType(type)) {
         ALOGE("%s:%d: Invalid template request type: %d", __func__, mId, type);
         return NULL;
     }
-    return mTemplates[type]->generate();
+    return mTemplates[type];
 }
 
 int Camera::processCaptureRequest(camera3_capture_request_t *request)
@@ -485,7 +327,7 @@
     camera3_capture_result result;
 
     ALOGV("%s:%d: request=%p", __func__, mId, request);
-    CAMTRACE_CALL();
+    ATRACE_CALL();
 
     if (request == NULL) {
         ALOGE("%s:%d: NULL request recieved", __func__, mId);
@@ -565,12 +407,6 @@
         mSettings = clone_camera_metadata(new_settings);
 }
 
-bool Camera::isValidCaptureSettings(const camera_metadata_t* /*settings*/)
-{
-    // TODO: reject settings that cannot be captured
-    return true;
-}
-
 bool Camera::isValidReprocessSettings(const camera_metadata_t* /*settings*/)
 {
     // TODO: reject settings that cannot be reprocessed
@@ -631,16 +467,65 @@
     mCallbackOps->notify(mCallbackOps, &m);
 }
 
-void Camera::getMetadataVendorTagOps(vendor_tag_query_ops_t *ops)
-{
-    ALOGV("%s:%d: ops=%p", __func__, mId, ops);
-    // TODO: return vendor tag ops
-}
-
 void Camera::dump(int fd)
 {
     ALOGV("%s:%d: Dumping to fd %d", __func__, mId, fd);
-    // TODO: dprintf all relevant state to fd
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
+    dprintf(fd, "Camera ID: %d (Busy: %d)\n", mId, mBusy);
+
+    // TODO: dump all settings
+    dprintf(fd, "Most Recent Settings: (%p)\n", mSettings);
+
+    dprintf(fd, "Number of streams: %d\n", mNumStreams);
+    for (int i = 0; i < mNumStreams; i++) {
+        dprintf(fd, "Stream %d/%d:\n", i, mNumStreams);
+        mStreams[i]->dump(fd);
+    }
+}
+
+const char* Camera::templateToString(int type)
+{
+    switch (type) {
+    case CAMERA3_TEMPLATE_PREVIEW:
+        return "CAMERA3_TEMPLATE_PREVIEW";
+    case CAMERA3_TEMPLATE_STILL_CAPTURE:
+        return "CAMERA3_TEMPLATE_STILL_CAPTURE";
+    case CAMERA3_TEMPLATE_VIDEO_RECORD:
+        return "CAMERA3_TEMPLATE_VIDEO_RECORD";
+    case CAMERA3_TEMPLATE_VIDEO_SNAPSHOT:
+        return "CAMERA3_TEMPLATE_VIDEO_SNAPSHOT";
+    case CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG:
+        return "CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG";
+    }
+    // TODO: support vendor templates
+    return "Invalid template type!";
+}
+
+int Camera::setTemplate(int type, camera_metadata_t *settings)
+{
+    android::Mutex::Autolock al(mDeviceLock);
+
+    if (!isValidTemplateType(type)) {
+        ALOGE("%s:%d: Invalid template request type: %d", __func__, mId, type);
+        return -EINVAL;
+    }
+
+    if (mTemplates[type] != NULL) {
+        ALOGE("%s:%d: Setting already constructed template type %s(%d)",
+                __func__, mId, templateToString(type), type);
+        return -EINVAL;
+    }
+
+    // Make a durable copy of the underlying metadata
+    mTemplates[type] = clone_camera_metadata(settings);
+    if (mTemplates[type] == NULL) {
+        ALOGE("%s:%d: Failed to clone metadata %p for template type %s(%d)",
+                __func__, mId, settings, templateToString(type), type);
+        return -EINVAL;
+    }
+    return 0;
 }
 
 extern "C" {
@@ -680,28 +565,30 @@
     return camdev_to_camera(dev)->processCaptureRequest(request);
 }
 
-static void get_metadata_vendor_tag_ops(const camera3_device_t *dev,
-        vendor_tag_query_ops_t *ops)
-{
-    camdev_to_camera(dev)->getMetadataVendorTagOps(ops);
-}
-
 static void dump(const camera3_device_t *dev, int fd)
 {
     camdev_to_camera(dev)->dump(fd);
 }
+
+static int flush(const camera3_device_t*)
+{
+    ALOGE("%s: unimplemented.", __func__);
+    return -1;
+}
+
 } // extern "C"
 
 const camera3_device_ops_t Camera::sOps = {
-    .initialize              = default_camera_hal::initialize,
-    .configure_streams       = default_camera_hal::configure_streams,
+    .initialize = default_camera_hal::initialize,
+    .configure_streams = default_camera_hal::configure_streams,
     .register_stream_buffers = default_camera_hal::register_stream_buffers,
-    .construct_default_request_settings =
-            default_camera_hal::construct_default_request_settings,
+    .construct_default_request_settings
+        = default_camera_hal::construct_default_request_settings,
     .process_capture_request = default_camera_hal::process_capture_request,
-    .get_metadata_vendor_tag_ops =
-            default_camera_hal::get_metadata_vendor_tag_ops,
-    .dump                    = default_camera_hal::dump
+    .get_metadata_vendor_tag_ops = NULL,
+    .dump = default_camera_hal::dump,
+    .flush = default_camera_hal::flush,
+    .reserved = {0},
 };
 
 } // namespace default_camera_hal
diff --git a/modules/camera/Camera.h b/modules/camera/Camera.h
index be672f9..0ceaf25 100644
--- a/modules/camera/Camera.h
+++ b/modules/camera/Camera.h
@@ -17,9 +17,9 @@
 #ifndef CAMERA_H_
 #define CAMERA_H_
 
-#include <pthread.h>
 #include <hardware/hardware.h>
 #include <hardware/camera3.h>
+#include <utils/Mutex.h>
 #include "Metadata.h"
 #include "Stream.h"
 
@@ -28,12 +28,14 @@
 // This is constructed when the HAL module is loaded, one per physical camera.
 // It is opened by the framework, and must be closed before it can be opened
 // again.
+// This is an abstract class, containing all logic and data shared between all
+// camera devices (front, back, etc) and common to the ISP.
 class Camera {
     public:
         // id is used to distinguish cameras. 0 <= id < NUM_CAMERAS.
         // module is a handle to the HAL module, used when the device is opened.
         Camera(int id);
-        ~Camera();
+        virtual ~Camera();
 
         // Common Camera Device Operations (see <hardware/camera_common.h>)
         int open(const hw_module_t *module, hw_device_t **device);
@@ -46,15 +48,24 @@
         int registerStreamBuffers(const camera3_stream_buffer_set_t *buf_set);
         const camera_metadata_t *constructDefaultRequestSettings(int type);
         int processCaptureRequest(camera3_capture_request_t *request);
-        void getMetadataVendorTagOps(vendor_tag_query_ops_t *ops);
         void dump(int fd);
 
-        // Camera device handle returned to framework for use
-        camera3_device_t mDevice;
+
+    protected:
+        // Initialize static camera characteristics for individual device
+        virtual camera_metadata_t *initStaticInfo() = 0;
+        // Verify settings are valid for a capture
+        virtual bool isValidCaptureSettings(const camera_metadata_t *) = 0;
+        // Separate initialization method for individual devices when opened
+        virtual int initDevice() = 0;
+        // Accessor used by initDevice() to set the templates' metadata
+        int setTemplate(int type, camera_metadata_t *static_info);
+        // Prettyprint template names
+        const char* templateToString(int type);
 
     private:
-        // Separate initialization method for static metadata
-        camera_metadata_t *initStaticInfo();
+        // Camera device handle returned to framework for use
+        camera3_device_t mDevice;
         // Reuse a stream already created by this device
         Stream *reuseStream(camera3_stream_t *astream);
         // Destroy all streams in a stream array, and the array itself
@@ -65,8 +76,6 @@
         void setupStreams(Stream **array, int count);
         // Copy new settings for re-use and clean up old settings.
         void setSettings(const camera_metadata_t *new_settings);
-        // Verify settings are valid for a capture
-        bool isValidCaptureSettings(const camera_metadata_t *settings);
         // Verify settings are valid for reprocessing an input buffer
         bool isValidReprocessSettings(const camera_metadata_t *settings);
         // Process an output buffer
@@ -74,6 +83,8 @@
                 camera3_stream_buffer_t *out);
         // Send a shutter notify message with start of exposure time
         void notifyShutter(uint32_t frame_number, uint64_t timestamp);
+        // Is type a valid template type (and valid index into mTemplates)
+        bool isValidTemplateType(int type);
 
         // Identifier used by framework to distinguish cameras
         const int mId;
@@ -88,16 +99,16 @@
         // Methods used to call back into the framework
         const camera3_callback_ops_t *mCallbackOps;
         // Lock protecting the Camera object for modifications
-        pthread_mutex_t mMutex;
+        android::Mutex mDeviceLock;
         // Lock protecting only static camera characteristics, which may
         // be accessed without the camera device open
-        pthread_mutex_t mStaticInfoMutex;
+        android::Mutex mStaticInfoLock;
         // Array of handles to streams currently in use by the device
         Stream **mStreams;
         // Number of streams in mStreams
         int mNumStreams;
         // Static array of standard camera settings templates
-        Metadata *mTemplates[CAMERA3_TEMPLATE_COUNT];
+        camera_metadata_t *mTemplates[CAMERA3_TEMPLATE_COUNT];
         // Most recent request settings seen, memoized to be reused
         camera_metadata_t *mSettings;
 };
diff --git a/modules/camera/CameraHAL.cpp b/modules/camera/CameraHAL.cpp
index dfbbe4c..62ee6d4 100644
--- a/modules/camera/CameraHAL.cpp
+++ b/modules/camera/CameraHAL.cpp
@@ -17,7 +17,8 @@
 #include <cstdlib>
 #include <hardware/camera_common.h>
 #include <hardware/hardware.h>
-#include "Camera.h"
+#include "ExampleCamera.h"
+#include "VendorTags.h"
 
 //#define LOG_NDEBUG 0
 #define LOG_TAG "DefaultCameraHAL"
@@ -38,25 +39,24 @@
 
 // Default Camera HAL has 2 cameras, front and rear.
 static CameraHAL gCameraHAL(2);
+// Handle containing vendor tag functionality
+static VendorTags gVendorTags;
 
 CameraHAL::CameraHAL(int num_cameras)
   : mNumberOfCameras(num_cameras),
     mCallbacks(NULL)
 {
-    int i;
-
     // Allocate camera array and instantiate camera devices
     mCameras = new Camera*[mNumberOfCameras];
-    for (i = 0; i < mNumberOfCameras; i++) {
-        mCameras[i] = new Camera(i);
-    }
+    // Rear camera
+    mCameras[0] = new ExampleCamera(0);
+    // Front camera
+    mCameras[1] = new ExampleCamera(1);
 }
 
 CameraHAL::~CameraHAL()
 {
-    int i;
-
-    for (i = 0; i < mNumberOfCameras; i++) {
+    for (int i = 0; i < mNumberOfCameras; i++) {
         delete mCameras[i];
     }
     delete [] mCameras;
@@ -124,6 +124,41 @@
     return gCameraHAL.setCallbacks(callbacks);
 }
 
+static int get_tag_count(const vendor_tag_ops_t* ops)
+{
+    return gVendorTags.getTagCount(ops);
+}
+
+static void get_all_tags(const vendor_tag_ops_t* ops, uint32_t* tag_array)
+{
+    gVendorTags.getAllTags(ops, tag_array);
+}
+
+static const char* get_section_name(const vendor_tag_ops_t* ops, uint32_t tag)
+{
+    return gVendorTags.getSectionName(ops, tag);
+}
+
+static const char* get_tag_name(const vendor_tag_ops_t* ops, uint32_t tag)
+{
+    return gVendorTags.getTagName(ops, tag);
+}
+
+static int get_tag_type(const vendor_tag_ops_t* ops, uint32_t tag)
+{
+    return gVendorTags.getTagType(ops, tag);
+}
+
+static void get_vendor_tag_ops(vendor_tag_ops_t* ops)
+{
+    ALOGV("%s : ops=%p", __func__, ops);
+    ops->get_tag_count      = get_tag_count;
+    ops->get_all_tags       = get_all_tags;
+    ops->get_section_name   = get_section_name;
+    ops->get_tag_name       = get_tag_name;
+    ops->get_tag_type       = get_tag_type;
+}
+
 static int open_dev(const hw_module_t* mod, const char* name, hw_device_t** dev)
 {
     return gCameraHAL.open(mod, name, dev);
@@ -136,7 +171,7 @@
 camera_module_t HAL_MODULE_INFO_SYM __attribute__ ((visibility("default"))) = {
     common : {
         tag                : HARDWARE_MODULE_TAG,
-        module_api_version : CAMERA_MODULE_API_VERSION_2_0,
+        module_api_version : CAMERA_MODULE_API_VERSION_2_2,
         hal_api_version    : HARDWARE_HAL_API_VERSION,
         id                 : CAMERA_HARDWARE_MODULE_ID,
         name               : "Default Camera HAL",
@@ -147,7 +182,12 @@
     },
     get_number_of_cameras : get_number_of_cameras,
     get_camera_info       : get_camera_info,
-    set_callbacks         : set_callbacks
+    set_callbacks         : set_callbacks,
+    get_vendor_tag_ops    : get_vendor_tag_ops,
+    open_legacy           : NULL,
+    set_torch_mode        : NULL,
+    init                  : NULL,
+    reserved              : {0},
 };
 } // extern "C"
 
diff --git a/modules/camera/CameraHAL.h b/modules/camera/CameraHAL.h
index ba0db4e..00c74e5 100644
--- a/modules/camera/CameraHAL.h
+++ b/modules/camera/CameraHAL.h
@@ -20,7 +20,9 @@
 #include <cutils/bitops.h>
 #include <hardware/hardware.h>
 #include <hardware/camera_common.h>
+#include <system/camera_vendor_tags.h>
 #include "Camera.h"
+#include "VendorTags.h"
 
 namespace default_camera_hal {
 // CameraHAL contains all module state that isn't specific to an individual
@@ -34,6 +36,7 @@
         int getNumberOfCameras();
         int getCameraInfo(int camera_id, struct camera_info *info);
         int setCallbacks(const camera_module_callbacks_t *callbacks);
+        void getVendorTagOps(vendor_tag_ops_t* ops);
 
         // Hardware Module Interface (see <hardware/hardware.h>)
         int open(const hw_module_t* mod, const char* name, hw_device_t** dev);
diff --git a/modules/camera/ExampleCamera.cpp b/modules/camera/ExampleCamera.cpp
new file mode 100644
index 0000000..d873321
--- /dev/null
+++ b/modules/camera/ExampleCamera.cpp
@@ -0,0 +1,273 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <system/camera_metadata.h>
+#include "Camera.h"
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "ExampleCamera"
+#include <cutils/log.h>
+
+#define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
+#include <utils/Trace.h>
+
+#include "ExampleCamera.h"
+
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
+
+namespace default_camera_hal {
+
+ExampleCamera::ExampleCamera(int id) : Camera(id)
+{
+}
+
+ExampleCamera::~ExampleCamera()
+{
+}
+
+camera_metadata_t *ExampleCamera::initStaticInfo()
+{
+    /*
+     * Setup static camera info.  This will have to customized per camera
+     * device.
+     */
+    Metadata m;
+
+    /* android.control */
+    int32_t android_control_ae_available_target_fps_ranges[] = {30, 30};
+    m.addInt32(ANDROID_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES,
+            ARRAY_SIZE(android_control_ae_available_target_fps_ranges),
+            android_control_ae_available_target_fps_ranges);
+
+    int32_t android_control_ae_compensation_range[] = {-4, 4};
+    m.addInt32(ANDROID_CONTROL_AE_COMPENSATION_RANGE,
+            ARRAY_SIZE(android_control_ae_compensation_range),
+            android_control_ae_compensation_range);
+
+    camera_metadata_rational_t android_control_ae_compensation_step[] = {{2,1}};
+    m.addRational(ANDROID_CONTROL_AE_COMPENSATION_STEP,
+            ARRAY_SIZE(android_control_ae_compensation_step),
+            android_control_ae_compensation_step);
+
+    int32_t android_control_max_regions[] = {/*AE*/ 1,/*AWB*/ 1,/*AF*/ 1};
+    m.addInt32(ANDROID_CONTROL_MAX_REGIONS,
+            ARRAY_SIZE(android_control_max_regions),
+            android_control_max_regions);
+
+    /* android.jpeg */
+    int32_t android_jpeg_available_thumbnail_sizes[] = {0, 0, 128, 96};
+    m.addInt32(ANDROID_JPEG_AVAILABLE_THUMBNAIL_SIZES,
+            ARRAY_SIZE(android_jpeg_available_thumbnail_sizes),
+            android_jpeg_available_thumbnail_sizes);
+
+    int32_t android_jpeg_max_size[] = {13 * 1024 * 1024}; // 13MB
+    m.addInt32(ANDROID_JPEG_MAX_SIZE,
+            ARRAY_SIZE(android_jpeg_max_size),
+            android_jpeg_max_size);
+
+    /* android.lens */
+    float android_lens_info_available_focal_lengths[] = {1.0};
+    m.addFloat(ANDROID_LENS_INFO_AVAILABLE_FOCAL_LENGTHS,
+            ARRAY_SIZE(android_lens_info_available_focal_lengths),
+            android_lens_info_available_focal_lengths);
+
+    /* android.request */
+    int32_t android_request_max_num_output_streams[] = {0, 3, 1};
+    m.addInt32(ANDROID_REQUEST_MAX_NUM_OUTPUT_STREAMS,
+            ARRAY_SIZE(android_request_max_num_output_streams),
+            android_request_max_num_output_streams);
+
+    /* android.scaler */
+    int32_t android_scaler_available_formats[] = {
+            HAL_PIXEL_FORMAT_RAW16,
+            HAL_PIXEL_FORMAT_BLOB,
+            HAL_PIXEL_FORMAT_RGBA_8888,
+            HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED,
+            // These are handled by YCbCr_420_888
+            //        HAL_PIXEL_FORMAT_YV12,
+            //        HAL_PIXEL_FORMAT_YCrCb_420_SP,
+            HAL_PIXEL_FORMAT_YCbCr_420_888};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_FORMATS,
+            ARRAY_SIZE(android_scaler_available_formats),
+            android_scaler_available_formats);
+
+    int64_t android_scaler_available_jpeg_min_durations[] = {1};
+    m.addInt64(ANDROID_SCALER_AVAILABLE_JPEG_MIN_DURATIONS,
+            ARRAY_SIZE(android_scaler_available_jpeg_min_durations),
+            android_scaler_available_jpeg_min_durations);
+
+    int32_t android_scaler_available_jpeg_sizes[] = {640, 480};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_JPEG_SIZES,
+            ARRAY_SIZE(android_scaler_available_jpeg_sizes),
+            android_scaler_available_jpeg_sizes);
+
+    float android_scaler_available_max_digital_zoom[] = {1};
+    m.addFloat(ANDROID_SCALER_AVAILABLE_MAX_DIGITAL_ZOOM,
+            ARRAY_SIZE(android_scaler_available_max_digital_zoom),
+            android_scaler_available_max_digital_zoom);
+
+    int64_t android_scaler_available_processed_min_durations[] = {1};
+    m.addInt64(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS,
+            ARRAY_SIZE(android_scaler_available_processed_min_durations),
+            android_scaler_available_processed_min_durations);
+
+    int32_t android_scaler_available_processed_sizes[] = {640, 480};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES,
+            ARRAY_SIZE(android_scaler_available_processed_sizes),
+            android_scaler_available_processed_sizes);
+
+    int64_t android_scaler_available_raw_min_durations[] = {1};
+    m.addInt64(ANDROID_SCALER_AVAILABLE_RAW_MIN_DURATIONS,
+            ARRAY_SIZE(android_scaler_available_raw_min_durations),
+            android_scaler_available_raw_min_durations);
+
+    int32_t android_scaler_available_raw_sizes[] = {640, 480};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_RAW_SIZES,
+            ARRAY_SIZE(android_scaler_available_raw_sizes),
+            android_scaler_available_raw_sizes);
+
+    /* android.sensor */
+
+    int32_t android_sensor_info_active_array_size[] = {0, 0, 640, 480};
+    m.addInt32(ANDROID_SENSOR_INFO_ACTIVE_ARRAY_SIZE,
+            ARRAY_SIZE(android_sensor_info_active_array_size),
+            android_sensor_info_active_array_size);
+
+    int32_t android_sensor_info_sensitivity_range[] =
+            {100, 1600};
+    m.addInt32(ANDROID_SENSOR_INFO_SENSITIVITY_RANGE,
+            ARRAY_SIZE(android_sensor_info_sensitivity_range),
+            android_sensor_info_sensitivity_range);
+
+    int64_t android_sensor_info_max_frame_duration[] = {30000000000};
+    m.addInt64(ANDROID_SENSOR_INFO_MAX_FRAME_DURATION,
+            ARRAY_SIZE(android_sensor_info_max_frame_duration),
+            android_sensor_info_max_frame_duration);
+
+    float android_sensor_info_physical_size[] = {3.2, 2.4};
+    m.addFloat(ANDROID_SENSOR_INFO_PHYSICAL_SIZE,
+            ARRAY_SIZE(android_sensor_info_physical_size),
+            android_sensor_info_physical_size);
+
+    int32_t android_sensor_info_pixel_array_size[] = {640, 480};
+    m.addInt32(ANDROID_SENSOR_INFO_PIXEL_ARRAY_SIZE,
+            ARRAY_SIZE(android_sensor_info_pixel_array_size),
+            android_sensor_info_pixel_array_size);
+
+    int32_t android_sensor_orientation[] = {0};
+    m.addInt32(ANDROID_SENSOR_ORIENTATION,
+            ARRAY_SIZE(android_sensor_orientation),
+            android_sensor_orientation);
+
+    /* End of static camera characteristics */
+
+    return clone_camera_metadata(m.get());
+}
+
+int ExampleCamera::initDevice()
+{
+    int res;
+    Metadata base;
+
+    // Create standard settings templates from copies of base metadata
+    // TODO: use vendor tags in base metadata
+    res = base.add1UInt8(ANDROID_CONTROL_MODE, ANDROID_CONTROL_MODE_OFF);
+    if (res)
+        return res;
+
+    // Use base settings to create all other templates and set them
+    res = setPreviewTemplate(base);
+    if (res)
+        return res;
+    res = setStillTemplate(base);
+    if (res)
+        return res;
+    res = setRecordTemplate(base);
+    if (res)
+        return res;
+    res = setSnapshotTemplate(base);
+    if (res)
+        return res;
+    res = setZslTemplate(base);
+    if (res)
+        return res;
+
+    return 0;
+}
+
+int ExampleCamera::setPreviewTemplate(Metadata m)
+{
+    // Setup default preview controls
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_PREVIEW);
+
+    if (res)
+        return res;
+    // TODO: set fast auto-focus, auto-whitebalance, auto-exposure, auto flash
+    return setTemplate(CAMERA3_TEMPLATE_PREVIEW, m.get());
+}
+
+int ExampleCamera::setStillTemplate(Metadata m)
+{
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_STILL_CAPTURE);
+    // Setup default still capture controls
+    if (res)
+        return res;
+    // TODO: set fast auto-focus, auto-whitebalance, auto-exposure, auto flash
+    return setTemplate(CAMERA3_TEMPLATE_STILL_CAPTURE, m.get());
+}
+
+int ExampleCamera::setRecordTemplate(Metadata m)
+{
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_RECORD);
+    // Setup default video record controls
+    if (res)
+        return res;
+    // TODO: set slow auto-focus, auto-whitebalance, auto-exposure, flash off
+    return setTemplate(CAMERA3_TEMPLATE_VIDEO_RECORD, m.get());
+}
+
+int ExampleCamera::setSnapshotTemplate(Metadata m)
+{
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_SNAPSHOT);
+    // Setup default video snapshot controls
+    if (res)
+        return res;
+    // TODO: set slow auto-focus, auto-whitebalance, auto-exposure, flash off
+    return setTemplate(CAMERA3_TEMPLATE_VIDEO_SNAPSHOT, m.get());
+}
+
+int ExampleCamera::setZslTemplate(Metadata m)
+{
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_ZERO_SHUTTER_LAG);
+    // Setup default zero shutter lag controls
+    if (res)
+        return res;
+    // TODO: set reprocessing parameters for zsl input queue
+    return setTemplate(CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG, m.get());
+}
+
+bool ExampleCamera::isValidCaptureSettings(const camera_metadata_t* settings)
+{
+    // TODO: reject settings that cannot be captured
+    return true;
+}
+
+} // namespace default_camera_hal
diff --git a/modules/camera/ExampleCamera.h b/modules/camera/ExampleCamera.h
new file mode 100644
index 0000000..45c4a94
--- /dev/null
+++ b/modules/camera/ExampleCamera.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef EXAMPLE_CAMERA_H_
+#define EXAMPLE_CAMERA_H_
+
+#include <system/camera_metadata.h>
+#include "Camera.h"
+
+namespace default_camera_hal {
+// ExampleCamera is an example for a specific camera device. The Camera object
+// contains all logic common between all cameras (e.g. front and back cameras),
+// while a specific camera device (e.g. ExampleCamera) holds all specific
+// metadata and logic about that device.
+class ExampleCamera : public Camera {
+    public:
+        ExampleCamera(int id);
+        ~ExampleCamera();
+
+    private:
+        // Initialize static camera characteristics for individual device
+        camera_metadata_t *initStaticInfo();
+        // Initialize whole device (templates/etc) when opened
+        int initDevice();
+        // Initialize each template metadata controls
+        int setPreviewTemplate(Metadata m);
+        int setStillTemplate(Metadata m);
+        int setRecordTemplate(Metadata m);
+        int setSnapshotTemplate(Metadata m);
+        int setZslTemplate(Metadata m);
+        // Verify settings are valid for a capture with this device
+        bool isValidCaptureSettings(const camera_metadata_t* settings);
+};
+} // namespace default_camera_hal
+
+#endif // CAMERA_H_
diff --git a/modules/camera/Metadata.cpp b/modules/camera/Metadata.cpp
index d5854f9..f195534 100644
--- a/modules/camera/Metadata.cpp
+++ b/modules/camera/Metadata.cpp
@@ -14,7 +14,6 @@
  * limitations under the License.
  */
 
-#include <pthread.h>
 #include <system/camera_metadata.h>
 
 //#define LOG_NDEBUG 0
@@ -22,102 +21,85 @@
 #include <cutils/log.h>
 
 #define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
-#include <cutils/trace.h>
-#include "ScopedTrace.h"
+#include <utils/Trace.h>
 
 #include "Metadata.h"
 
 namespace default_camera_hal {
 
-Metadata::Metadata()
-  : mHead(NULL),
-    mTail(NULL),
-    mEntryCount(0),
-    mDataCount(0),
-    mGenerated(NULL),
-    mDirty(true)
+Metadata::Metadata():
+    mData(NULL)
 {
-    // NULL (default) pthread mutex attributes
-    pthread_mutex_init(&mMutex, NULL);
 }
 
 Metadata::~Metadata()
 {
-    Entry *current = mHead;
-
-    while (current != NULL) {
-        Entry *tmp = current;
-        current = current->mNext;
-        delete tmp;
-    }
-
-    if (mGenerated != NULL)
-        free_camera_metadata(mGenerated);
-
-    pthread_mutex_destroy(&mMutex);
+    replace(NULL);
 }
 
-Metadata::Metadata(uint8_t mode, uint8_t intent)
-  : mHead(NULL),
-    mTail(NULL),
-    mEntryCount(0),
-    mDataCount(0),
-    mGenerated(NULL),
-    mDirty(true)
+void Metadata::replace(camera_metadata_t *m)
 {
-    pthread_mutex_init(&mMutex, NULL);
-
-    if (validate(ANDROID_CONTROL_MODE, TYPE_BYTE, 1)) {
-        int res = add(ANDROID_CONTROL_MODE, 1, &mode);
-        if (res != 0) {
-            ALOGE("%s: Unable to add mode to template!", __func__);
-        }
-    } else {
-        ALOGE("%s: Invalid mode constructing template!", __func__);
+    if (m == mData) {
+        ALOGE("%s: Replacing metadata with itself?!", __func__);
+        return;
     }
-
-    if (validate(ANDROID_CONTROL_CAPTURE_INTENT, TYPE_BYTE, 1)) {
-        int res = add(ANDROID_CONTROL_CAPTURE_INTENT, 1, &intent);
-        if (res != 0) {
-            ALOGE("%s: Unable to add capture intent to template!", __func__);
-        }
-    } else {
-        ALOGE("%s: Invalid capture intent constructing template!", __func__);
-    }
+    if (mData)
+        free_camera_metadata(mData);
+    mData = m;
 }
 
-int Metadata::addUInt8(uint32_t tag, int count, uint8_t *data)
+int Metadata::init(const camera_metadata_t *metadata)
+{
+    camera_metadata_t* tmp;
+
+    if (!validate_camera_metadata_structure(metadata, NULL))
+        return -EINVAL;
+
+    tmp = clone_camera_metadata(metadata);
+    if (tmp == NULL)
+        return -EINVAL;
+
+    replace(tmp);
+    return 0;
+}
+
+int Metadata::addUInt8(uint32_t tag, int count, const uint8_t *data)
 {
     if (!validate(tag, TYPE_BYTE, count)) return -EINVAL;
     return add(tag, count, data);
 }
 
-int Metadata::addInt32(uint32_t tag, int count, int32_t *data)
+int Metadata::add1UInt8(uint32_t tag, const uint8_t data)
+{
+    return addUInt8(tag, 1, &data);
+}
+
+int Metadata::addInt32(uint32_t tag, int count, const int32_t *data)
 {
     if (!validate(tag, TYPE_INT32, count)) return -EINVAL;
     return add(tag, count, data);
 }
 
-int Metadata::addFloat(uint32_t tag, int count, float *data)
+int Metadata::addFloat(uint32_t tag, int count, const float *data)
 {
     if (!validate(tag, TYPE_FLOAT, count)) return -EINVAL;
     return add(tag, count, data);
 }
 
-int Metadata::addInt64(uint32_t tag, int count, int64_t *data)
+int Metadata::addInt64(uint32_t tag, int count, const int64_t *data)
 {
     if (!validate(tag, TYPE_INT64, count)) return -EINVAL;
     return add(tag, count, data);
 }
 
-int Metadata::addDouble(uint32_t tag, int count, double *data)
+int Metadata::addDouble(uint32_t tag, int count, const double *data)
 {
     if (!validate(tag, TYPE_DOUBLE, count)) return -EINVAL;
     return add(tag, count, data);
 }
 
 int Metadata::addRational(uint32_t tag, int count,
-        camera_metadata_rational_t *data)
+        const camera_metadata_rational_t *data)
 {
     if (!validate(tag, TYPE_RATIONAL, count)) return -EINVAL;
     return add(tag, count, data);
@@ -145,102 +127,48 @@
     return true;
 }
 
-int Metadata::add(uint32_t tag, int count, void *tag_data)
+int Metadata::add(uint32_t tag, int count, const void *tag_data)
 {
+    int res;
+    camera_metadata_t* tmp;
     int tag_type = get_camera_metadata_tag_type(tag);
-    size_t type_sz = camera_metadata_type_size[tag_type];
+    size_t size = calculate_camera_metadata_entry_data_size(tag_type, count);
+    size_t entry_capacity = get_camera_metadata_entry_count(mData) + 1;
+    size_t data_capacity = get_camera_metadata_data_count(mData) + size;
 
-    // Allocate array to hold new metadata
-    void *data = malloc(count * type_sz);
-    if (data == NULL)
+    // Opportunistically attempt to add if metadata has room for it
+    if (!add_camera_metadata_entry(mData, tag, tag_data, count))
+        return 0;
+
+    // Double new dimensions to minimize future reallocations
+    tmp = allocate_camera_metadata(entry_capacity * 2, data_capacity * 2);
+    if (tmp == NULL) {
+        ALOGE("%s: Failed to allocate new metadata with %zu entries, %zu data",
+                __func__, entry_capacity, data_capacity);
         return -ENOMEM;
-    memcpy(data, tag_data, count * type_sz);
+    }
+    // Append the current metadata to the new (empty) metadata
+    res = append_camera_metadata(tmp, mData);
+    if (res) {
+        ALOGE("%s: Failed to append old metadata %p to new %p",
+                __func__, mData, tmp);
+        return res;
+    }
+    // Add the remaining new item
+    res = add_camera_metadata_entry(tmp, tag, tag_data, count);
+    if (res) {
+        ALOGE("%s: Failed to add new entry (%d, %p, %d) to metadata %p",
+                __func__, tag, tag_data, count, tmp);
+        return res;
+    }
 
-    pthread_mutex_lock(&mMutex);
-    mEntryCount++;
-    mDataCount += calculate_camera_metadata_entry_data_size(tag_type, count);
-    push(new Entry(tag, data, count));
-    mDirty = true;
-    pthread_mutex_unlock(&mMutex);
+    replace(tmp);
     return 0;
 }
 
-camera_metadata_t* Metadata::generate()
+camera_metadata_t* Metadata::get()
 {
-    pthread_mutex_lock(&mMutex);
-    // Reuse if old generated metadata still valid
-    if (!mDirty && mGenerated != NULL) {
-        ALOGV("%s: Reusing generated metadata at %p", __func__, mGenerated);
-        goto out;
-    }
-    // Destroy old metadata
-    if (mGenerated != NULL) {
-        ALOGV("%s: Freeing generated metadata at %p", __func__, mGenerated);
-        free_camera_metadata(mGenerated);
-        mGenerated = NULL;
-    }
-    // Generate new metadata structure
-    ALOGV("%s: Generating new camera metadata structure, Entries:%d Data:%d",
-            __func__, mEntryCount, mDataCount);
-    mGenerated = allocate_camera_metadata(mEntryCount, mDataCount);
-    if (mGenerated == NULL) {
-        ALOGE("%s: Failed to allocate metadata (%d entries %d data)",
-                __func__, mEntryCount, mDataCount);
-        goto out;
-    }
-    // Walk list of entries adding each one to newly allocated metadata
-    for (Entry *current = mHead; current != NULL; current = current->mNext) {
-        int res = add_camera_metadata_entry(mGenerated, current->mTag,
-                current->mData, current->mCount);
-        if (res != 0) {
-            ALOGE("%s: Failed to add camera metadata: %d", __func__, res);
-            free_camera_metadata(mGenerated);
-            mGenerated = NULL;
-            goto out;
-        }
-    }
-
-out:
-    pthread_mutex_unlock(&mMutex);
-    return mGenerated;
-}
-
-Metadata::Entry::Entry(uint32_t tag, void *data, int count)
-  : mNext(NULL),
-    mPrev(NULL),
-    mTag(tag),
-    mData(data),
-    mCount(count)
-{
-}
-
-void Metadata::push(Entry *e)
-{
-    if (mHead == NULL) {
-        mHead = mTail = e;
-    } else {
-        mTail->insertAfter(e);
-        mTail = e;
-    }
-}
-
-Metadata::Entry::~Entry()
-{
-    if (mNext != NULL)
-        mNext->mPrev = mPrev;
-    if (mPrev != NULL)
-        mPrev->mNext = mNext;
-}
-
-void Metadata::Entry::insertAfter(Entry *e)
-{
-    if (e == NULL)
-        return;
-    if (mNext != NULL)
-        mNext->mPrev = e;
-    e->mNext = mNext;
-    e->mPrev = this;
-    mNext = e;
+    return mData;
 }
 
 } // namespace default_camera_hal
diff --git a/modules/camera/Metadata.h b/modules/camera/Metadata.h
index 22d2f22..f432d04 100644
--- a/modules/camera/Metadata.h
+++ b/modules/camera/Metadata.h
@@ -17,10 +17,9 @@
 #ifndef METADATA_H_
 #define METADATA_H_
 
+#include <stdint.h>
 #include <hardware/camera3.h>
-#include <hardware/gralloc.h>
 #include <system/camera_metadata.h>
-#include <system/graphics.h>
 
 namespace default_camera_hal {
 // Metadata is a convenience class for dealing with libcamera_metadata
@@ -28,51 +27,32 @@
     public:
         Metadata();
         ~Metadata();
-        // Constructor used for request metadata templates
-        Metadata(uint8_t mode, uint8_t intent);
+        // Initialize with framework metadata
+        int init(const camera_metadata_t *metadata);
 
-        // Parse and add an entry
-        int addUInt8(uint32_t tag, int count, uint8_t *data);
-        int addInt32(uint32_t tag, int count, int32_t *data);
-        int addFloat(uint32_t tag, int count, float *data);
-        int addInt64(uint32_t tag, int count, int64_t *data);
-        int addDouble(uint32_t tag, int count, double *data);
+        // Parse and add an entry. Allocates and copies new storage for *data.
+        int addUInt8(uint32_t tag, int count, const uint8_t *data);
+        int add1UInt8(uint32_t tag, const uint8_t data);
+        int addInt32(uint32_t tag, int count, const int32_t *data);
+        int addFloat(uint32_t tag, int count, const float *data);
+        int addInt64(uint32_t tag, int count, const int64_t *data);
+        int addDouble(uint32_t tag, int count, const double *data);
         int addRational(uint32_t tag, int count,
-                camera_metadata_rational_t *data);
-        // Generate a camera_metadata structure and fill it with internal data
-        camera_metadata_t *generate();
+                const camera_metadata_rational_t *data);
+
+        // Get a handle to the current metadata
+        // This is not a durable handle, and may be destroyed by add*/init
+        camera_metadata_t* get();
 
     private:
+        // Actual internal storage
+        camera_metadata_t* mData;
+        // Destroy old metadata and replace with new
+        void replace(camera_metadata_t *m);
         // Validate the tag, type and count for a metadata entry
         bool validate(uint32_t tag, int tag_type, int count);
-        // Add a verified tag with data to this Metadata structure
-        int add(uint32_t tag, int count, void *tag_data);
-
-        class Entry {
-            public:
-                Entry(uint32_t tag, void *data, int count);
-                ~Entry();
-                Entry *mNext;
-                Entry *mPrev;
-                const uint32_t mTag;
-                const void *mData;
-                const int mCount;
-                void insertAfter(Entry *e);
-        };
-        // List ends
-        Entry *mHead;
-        Entry *mTail;
-        // Append entry to list
-        void push(Entry *e);
-        // Total of entries and entry data size
-        int mEntryCount;
-        int mDataCount;
-        // Save generated metadata, invalidated on update
-        camera_metadata_t *mGenerated;
-        // Flag to force metadata regeneration
-        bool mDirty;
-        // Lock protecting the Metadata object for modifications
-        pthread_mutex_t mMutex;
+        // Add a verified tag with data
+        int add(uint32_t tag, int count, const void *tag_data);
 };
 } // namespace default_camera_hal
 
diff --git a/modules/camera/ScopedTrace.h b/modules/camera/ScopedTrace.h
deleted file mode 100644
index ed00570..0000000
--- a/modules/camera/ScopedTrace.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2013 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef CAMERA_SCOPED_TRACE_H
-#define CAMERA_SCOPED_TRACE_H
-
-#include <stdint.h>
-#include <cutils/trace.h>
-
-// See <cutils/trace.h> for more tracing macros.
-
-// CAMTRACE_NAME traces the beginning and end of the current scope.  To trace
-// the correct start and end times this macro should be declared first in the
-// scope body.
-#define CAMTRACE_NAME(name) ScopedTrace ___tracer(ATRACE_TAG, name)
-// CAMTRACE_CALL is an ATRACE_NAME that uses the current function name.
-#define CAMTRACE_CALL() CAMTRACE_NAME(__FUNCTION__)
-
-namespace default_camera_hal {
-
-class ScopedTrace {
-public:
-inline ScopedTrace(uint64_t tag, const char* name)
-    : mTag(tag) {
-    atrace_begin(mTag,name);
-}
-
-inline ~ScopedTrace() {
-    atrace_end(mTag);
-}
-
-private:
-    uint64_t mTag;
-};
-
-}; // namespace default_camera_hal
-
-#endif // CAMERA_SCOPED_TRACE_H
diff --git a/modules/camera/Stream.cpp b/modules/camera/Stream.cpp
index aae7adb..e0099b6 100644
--- a/modules/camera/Stream.cpp
+++ b/modules/camera/Stream.cpp
@@ -14,18 +14,18 @@
  * limitations under the License.
  */
 
-#include <pthread.h>
+#include <stdio.h>
 #include <hardware/camera3.h>
 #include <hardware/gralloc.h>
 #include <system/graphics.h>
+#include <utils/Mutex.h>
 
 //#define LOG_NDEBUG 0
 #define LOG_TAG "Stream"
 #include <cutils/log.h>
 
 #define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
-#include <cutils/trace.h>
-#include "ScopedTrace.h"
+#include <utils/Trace.h>
 
 #include "Stream.h"
 
@@ -45,37 +45,32 @@
     mBuffers(0),
     mNumBuffers(0)
 {
-    // NULL (default) pthread mutex attributes
-    pthread_mutex_init(&mMutex, NULL);
 }
 
 Stream::~Stream()
 {
-    pthread_mutex_lock(&mMutex);
+    android::Mutex::Autolock al(mLock);
     unregisterBuffers_L();
-    pthread_mutex_unlock(&mMutex);
 }
 
 void Stream::setUsage(uint32_t usage)
 {
-    pthread_mutex_lock(&mMutex);
+    android::Mutex::Autolock al(mLock);
     if (usage != mUsage) {
         mUsage = usage;
         mStream->usage = usage;
         unregisterBuffers_L();
     }
-    pthread_mutex_unlock(&mMutex);
 }
 
 void Stream::setMaxBuffers(uint32_t max_buffers)
 {
-    pthread_mutex_lock(&mMutex);
+    android::Mutex::Autolock al(mLock);
     if (max_buffers != mMaxBuffers) {
         mMaxBuffers = max_buffers;
         mStream->max_buffers = max_buffers;
         unregisterBuffers_L();
     }
-    pthread_mutex_unlock(&mMutex);
 }
 
 int Stream::getType()
@@ -95,6 +90,59 @@
         mType == CAMERA3_STREAM_BIDIRECTIONAL;
 }
 
+const char* Stream::typeToString(int type)
+{
+    switch (type) {
+    case CAMERA3_STREAM_INPUT:
+        return "CAMERA3_STREAM_INPUT";
+    case CAMERA3_STREAM_OUTPUT:
+        return "CAMERA3_STREAM_OUTPUT";
+    case CAMERA3_STREAM_BIDIRECTIONAL:
+        return "CAMERA3_STREAM_BIDIRECTIONAL";
+    }
+    return "Invalid stream type!";
+}
+
+const char* Stream::formatToString(int format)
+{
+    // See <system/graphics.h> for full list
+    switch (format) {
+    case HAL_PIXEL_FORMAT_BGRA_8888:
+        return "BGRA 8888";
+    case HAL_PIXEL_FORMAT_RGBA_8888:
+        return "RGBA 8888";
+    case HAL_PIXEL_FORMAT_RGBX_8888:
+        return "RGBX 8888";
+    case HAL_PIXEL_FORMAT_RGB_888:
+        return "RGB 888";
+    case HAL_PIXEL_FORMAT_RGB_565:
+        return "RGB 565";
+    case HAL_PIXEL_FORMAT_Y8:
+        return "Y8";
+    case HAL_PIXEL_FORMAT_Y16:
+        return "Y16";
+    case HAL_PIXEL_FORMAT_YV12:
+        return "YV12";
+    case HAL_PIXEL_FORMAT_YCbCr_422_SP:
+        return "NV16";
+    case HAL_PIXEL_FORMAT_YCrCb_420_SP:
+        return "NV21";
+    case HAL_PIXEL_FORMAT_YCbCr_422_I:
+        return "YUY2";
+    case HAL_PIXEL_FORMAT_RAW10:
+        return "RAW10";
+    case HAL_PIXEL_FORMAT_RAW16:
+        return "RAW16";
+    case HAL_PIXEL_FORMAT_BLOB:
+        return "BLOB";
+    case HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED:
+        return "IMPLEMENTATION DEFINED";
+    case HAL_PIXEL_FORMAT_YCbCr_420_888:
+        return "FLEXIBLE YCbCr 420 888";
+    }
+    return "Invalid stream format!";
+}
+
 bool Stream::isRegistered()
 {
     return mRegistered;
@@ -113,15 +161,15 @@
         return false;
     }
     if (s->stream_type != mType) {
-        // TODO: prettyprint type string
-        ALOGE("%s:%d: Mismatched type in reused stream. Got %d expect %d",
-                __func__, mId, s->stream_type, mType);
+        ALOGE("%s:%d: Mismatched type in reused stream. Got %s(%d) "
+                "expect %s(%d)", __func__, mId, typeToString(s->stream_type),
+                s->stream_type, typeToString(mType), mType);
         return false;
     }
     if (s->format != mFormat) {
-        // TODO: prettyprint format string
-        ALOGE("%s:%d: Mismatched format in reused stream. Got %d expect %d",
-                __func__, mId, s->format, mFormat);
+        ALOGE("%s:%d: Mismatched format in reused stream. Got %s(%d) "
+                "expect %s(%d)", __func__, mId, formatToString(s->format),
+                s->format, formatToString(mFormat), mFormat);
         return false;
     }
     if (s->width != mWidth) {
@@ -139,7 +187,8 @@
 
 int Stream::registerBuffers(const camera3_stream_buffer_set_t *buf_set)
 {
-    CAMTRACE_CALL();
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mLock);
 
     if (buf_set->stream != mStream) {
         ALOGE("%s:%d: Buffer set for invalid stream. Got %p expect %p",
@@ -147,8 +196,6 @@
         return -EINVAL;
     }
 
-    pthread_mutex_lock(&mMutex);
-
     mNumBuffers = buf_set->num_buffers;
     mBuffers = new buffer_handle_t*[mNumBuffers];
 
@@ -160,12 +207,10 @@
     }
     mRegistered = true;
 
-    pthread_mutex_unlock(&mMutex);
-
     return 0;
 }
 
-// This must only be called with mMutex held
+// This must only be called with mLock held
 void Stream::unregisterBuffers_L()
 {
     mRegistered = false;
@@ -174,4 +219,23 @@
     // TODO: unregister buffers from hw
 }
 
+void Stream::dump(int fd)
+{
+    android::Mutex::Autolock al(mLock);
+
+    dprintf(fd, "Stream ID: %d (%p)\n", mId, mStream);
+    dprintf(fd, "Stream Type: %s (%d)\n", typeToString(mType), mType);
+    dprintf(fd, "Width: %" PRIu32 " Height: %" PRIu32 "\n", mWidth, mHeight);
+    dprintf(fd, "Stream Format: %s (%d)", formatToString(mFormat), mFormat);
+    // ToDo: prettyprint usage mask flags
+    dprintf(fd, "Gralloc Usage Mask: %#" PRIx32 "\n", mUsage);
+    dprintf(fd, "Max Buffer Count: %" PRIu32 "\n", mMaxBuffers);
+    dprintf(fd, "Buffers Registered: %s\n", mRegistered ? "true" : "false");
+    dprintf(fd, "Number of Buffers: %" PRIu32 "\n", mNumBuffers);
+    for (uint32_t i = 0; i < mNumBuffers; i++) {
+        dprintf(fd, "Buffer %" PRIu32 "/%" PRIu32 ": %p\n", i, mNumBuffers,
+                mBuffers[i]);
+    }
+}
+
 } // namespace default_camera_hal
diff --git a/modules/camera/Stream.h b/modules/camera/Stream.h
index 34abd95..5efbc52 100644
--- a/modules/camera/Stream.h
+++ b/modules/camera/Stream.h
@@ -20,6 +20,7 @@
 #include <hardware/camera3.h>
 #include <hardware/gralloc.h>
 #include <system/graphics.h>
+#include <utils/Mutex.h>
 
 namespace default_camera_hal {
 // Stream represents a single input or output stream for a camera device.
@@ -41,12 +42,15 @@
         bool isInputType();
         bool isOutputType();
         bool isRegistered();
+        const char* typeToString(int type);
+        const char* formatToString(int format);
+        void dump(int fd);
 
         // This stream is being reused. Used in stream configuration passes
         bool mReuse;
 
     private:
-        // Clean up buffer state. must be called with mMutex held.
+        // Clean up buffer state. must be called with mLock held.
         void unregisterBuffers_L();
 
         // The camera device id this stream belongs to
@@ -72,7 +76,7 @@
         // Number of buffers in mBuffers
         unsigned int mNumBuffers;
         // Lock protecting the Stream object for modifications
-        pthread_mutex_t mMutex;
+        android::Mutex mLock;
 };
 } // namespace default_camera_hal
 
diff --git a/modules/camera/VendorTags.cpp b/modules/camera/VendorTags.cpp
new file mode 100644
index 0000000..2c54648
--- /dev/null
+++ b/modules/camera/VendorTags.cpp
@@ -0,0 +1,188 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <system/camera_metadata.h>
+#include "Metadata.h"
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "VendorTags"
+#include <cutils/log.h>
+
+#define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
+#include <utils/Trace.h>
+
+#include "VendorTags.h"
+
+namespace default_camera_hal {
+
+// Internal representations of vendor tags for convenience.
+// Other classes must access this data via public interfaces.
+// Structured to be easy to extend and contain complexity.
+namespace {
+// Describes a single vendor tag entry
+struct Entry {
+    const char* name;
+    uint8_t     type;
+};
+// Describes a vendor tag section
+struct Section {
+    const char* name;
+    uint32_t start;
+    uint32_t end;
+    const Entry* tags;
+};
+
+// Entry arrays for each section
+const Entry DemoWizardry[demo_wizardry_end - demo_wizardry_start] = {
+    [demo_wizardry_dimension_size - demo_wizardry_start] =
+        {"dimensionSize",   TYPE_INT32},
+    [demo_wizardry_dimensions - demo_wizardry_start] =
+        {"dimensions",      TYPE_INT32},
+    [demo_wizardry_familiar - demo_wizardry_start] =
+        {"familiar",        TYPE_BYTE},
+    [demo_wizardry_fire - demo_wizardry_start] =
+        {"fire",            TYPE_RATIONAL}
+};
+
+const Entry DemoSorcery[demo_sorcery_end - demo_sorcery_start] = {
+    [demo_sorcery_difficulty - demo_sorcery_start] =
+        {"difficulty",      TYPE_INT64},
+    [demo_sorcery_light - demo_sorcery_start] =
+        {"light",           TYPE_BYTE}
+};
+
+const Entry DemoMagic[demo_magic_end - demo_magic_start] = {
+    [demo_magic_card_trick - demo_magic_start] =
+        {"cardTrick",       TYPE_DOUBLE},
+    [demo_magic_levitation - demo_magic_start] =
+        {"levitation",      TYPE_FLOAT}
+};
+
+// Array of all sections
+const Section DemoSections[DEMO_SECTION_COUNT] = {
+    [DEMO_WIZARDRY] = { "demo.wizardry",
+                        demo_wizardry_start,
+                        demo_wizardry_end,
+                        DemoWizardry },
+    [DEMO_SORCERY]  = { "demo.sorcery",
+                        demo_sorcery_start,
+                        demo_sorcery_end,
+                        DemoSorcery },
+    [DEMO_MAGIC]    = { "demo.magic",
+                        demo_magic_start,
+                        demo_magic_end,
+                        DemoMagic }
+};
+
+// Get a static handle to a specific vendor tag section
+const Section* getSection(uint32_t tag)
+{
+    uint32_t section = (tag - vendor_section_start) >> 16;
+
+    if (tag < vendor_section_start) {
+        ALOGE("%s: Tag 0x%x before vendor section", __func__, tag);
+        return NULL;
+    }
+
+    if (section >= DEMO_SECTION_COUNT) {
+        ALOGE("%s: Tag 0x%x after vendor section", __func__, tag);
+        return NULL;
+    }
+
+    return &DemoSections[section];
+}
+
+// Get a static handle to a specific vendor tag entry
+const Entry* getEntry(uint32_t tag)
+{
+    const Section* section = getSection(tag);
+    int index;
+
+    if (section == NULL)
+        return NULL;
+
+    if (tag >= section->end) {
+        ALOGE("%s: Tag 0x%x outside section", __func__, tag);
+        return NULL;
+    }
+
+    index = tag - section->start;
+    return &section->tags[index];
+}
+} // namespace
+
+VendorTags::VendorTags()
+  : mTagCount(0)
+{
+    for (int i = 0; i < DEMO_SECTION_COUNT; i++) {
+        mTagCount += DemoSections[i].end - DemoSections[i].start;
+    }
+}
+
+VendorTags::~VendorTags()
+{
+}
+
+int VendorTags::getTagCount(const vendor_tag_ops_t* ops)
+{
+    return mTagCount;
+}
+
+void VendorTags::getAllTags(const vendor_tag_ops_t* ops, uint32_t* tag_array)
+{
+    if (tag_array == NULL) {
+        ALOGE("%s: NULL tag_array", __func__);
+        return;
+    }
+
+    for (int i = 0; i < DEMO_SECTION_COUNT; i++) {
+        for (uint32_t tag = DemoSections[i].start;
+                tag < DemoSections[i].end; tag++) {
+            *tag_array++ = tag;
+        }
+    }
+}
+
+const char* VendorTags::getSectionName(const vendor_tag_ops_t* ops, uint32_t tag)
+{
+    const Section* section = getSection(tag);
+
+    if (section == NULL)
+        return NULL;
+
+    return section->name;
+}
+
+const char* VendorTags::getTagName(const vendor_tag_ops_t* ops, uint32_t tag)
+{
+    const Entry* entry = getEntry(tag);
+
+    if (entry == NULL)
+        return NULL;
+
+    return entry->name;
+}
+
+int VendorTags::getTagType(const vendor_tag_ops_t* ops, uint32_t tag)
+{
+    const Entry* entry = getEntry(tag);
+
+    if (entry == NULL)
+        return -1;
+
+    return entry->type;
+}
+} // namespace default_camera_hal
diff --git a/modules/camera/VendorTags.h b/modules/camera/VendorTags.h
new file mode 100644
index 0000000..ecf777e
--- /dev/null
+++ b/modules/camera/VendorTags.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef VENDOR_TAGS_H_
+#define VENDOR_TAGS_H_
+
+#include <hardware/camera_common.h>
+#include <system/camera_metadata.h>
+
+namespace default_camera_hal {
+
+// VendorTags contains all vendor-specific metadata tag functionality
+class VendorTags {
+    public:
+        VendorTags();
+        ~VendorTags();
+
+        // Vendor Tags Operations (see <hardware/camera_common.h>)
+        int getTagCount(const vendor_tag_ops_t* ops);
+        void getAllTags(const vendor_tag_ops_t* ops, uint32_t* tag_array);
+        const char* getSectionName(const vendor_tag_ops_t* ops, uint32_t tag);
+        const char* getTagName(const vendor_tag_ops_t* ops, uint32_t tag);
+        int getTagType(const vendor_tag_ops_t* ops, uint32_t tag);
+
+    private:
+        // Total number of vendor tags
+        int mTagCount;
+};
+
+// Tag sections start at the beginning of vendor tags (0x8000_0000)
+// See <system/camera_metadata.h>
+enum {
+    DEMO_WIZARDRY,
+    DEMO_SORCERY,
+    DEMO_MAGIC,
+    DEMO_SECTION_COUNT
+};
+
+const uint32_t vendor_section_start = VENDOR_SECTION_START;
+
+// Each section starts at increments of 0x1_0000
+const uint32_t demo_wizardry_start = (DEMO_WIZARDRY + VENDOR_SECTION) << 16;
+const uint32_t demo_sorcery_start  = (DEMO_SORCERY  + VENDOR_SECTION) << 16;
+const uint32_t demo_magic_start    = (DEMO_MAGIC    + VENDOR_SECTION) << 16;
+
+// Vendor Tag values, start value begins each section
+const uint32_t demo_wizardry_dimension_size = demo_wizardry_start;
+const uint32_t demo_wizardry_dimensions = demo_wizardry_start + 1;
+const uint32_t demo_wizardry_familiar = demo_wizardry_start + 2;
+const uint32_t demo_wizardry_fire = demo_wizardry_start + 3;
+const uint32_t demo_wizardry_end = demo_wizardry_start + 4;
+
+const uint32_t demo_sorcery_difficulty = demo_sorcery_start;
+const uint32_t demo_sorcery_light = demo_sorcery_start + 1;
+const uint32_t demo_sorcery_end = demo_sorcery_start + 2;
+
+const uint32_t demo_magic_card_trick = demo_magic_start;
+const uint32_t demo_magic_levitation = demo_magic_start + 1;
+const uint32_t demo_magic_end = demo_magic_start + 2;
+
+} // namespace default_camera_hal
+
+#endif // VENDOR_TAGS_H_
diff --git a/modules/consumerir/consumerir.c b/modules/consumerir/consumerir.c
index 83eba75..f3eac0b 100644
--- a/modules/consumerir/consumerir.c
+++ b/modules/consumerir/consumerir.c
@@ -16,6 +16,7 @@
 #define LOG_TAG "ConsumerIrHal"
 
 #include <errno.h>
+#include <malloc.h>
 #include <string.h>
 #include <cutils/log.h>
 #include <hardware/hardware.h>
@@ -32,8 +33,8 @@
     {.min = 56000, .max = 56000},
 };
 
-static int consumerir_transmit(struct consumerir_device *dev,
-   int carrier_freq, int pattern[], int pattern_len)
+static int consumerir_transmit(struct consumerir_device *dev __unused,
+   int carrier_freq, const int pattern[], int pattern_len)
 {
     int total_time = 0;
     long i;
@@ -48,12 +49,12 @@
     return 0;
 }
 
-static int consumerir_get_num_carrier_freqs(struct consumerir_device *dev)
+static int consumerir_get_num_carrier_freqs(struct consumerir_device *dev __unused)
 {
     return ARRAY_SIZE(consumerir_freqs);
 }
 
-static int consumerir_get_carrier_freqs(struct consumerir_device *dev,
+static int consumerir_get_carrier_freqs(struct consumerir_device *dev __unused,
     size_t len, consumerir_freq_range_t *ranges)
 {
     size_t to_copy = ARRAY_SIZE(consumerir_freqs);
diff --git a/modules/fingerprint/Android.mk b/modules/fingerprint/Android.mk
new file mode 100644
index 0000000..58c0a83
--- /dev/null
+++ b/modules/fingerprint/Android.mk
@@ -0,0 +1,25 @@
+# Copyright (C) 2013 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := fingerprint.default
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_SRC_FILES := fingerprint.c
+LOCAL_SHARED_LIBRARIES := liblog
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/fingerprint/fingerprint.c b/modules/fingerprint/fingerprint.c
new file mode 100644
index 0000000..08b112b
--- /dev/null
+++ b/modules/fingerprint/fingerprint.c
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "FingerprintHal"
+
+#include <errno.h>
+#include <malloc.h>
+#include <string.h>
+#include <cutils/log.h>
+#include <hardware/hardware.h>
+#include <hardware/fingerprint.h>
+
+static int fingerprint_close(hw_device_t *dev)
+{
+    if (dev) {
+        free(dev);
+        return 0;
+    } else {
+        return -1;
+    }
+}
+
+
+static uint64_t fingerprint_pre_enroll(struct fingerprint_device __unused *dev) {
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_enroll(struct fingerprint_device __unused *dev,
+                                const hw_auth_token_t __unused *hat,
+                                uint32_t __unused gid,
+                                uint32_t __unused timeout_sec) {
+    return FINGERPRINT_ERROR;
+}
+
+static uint64_t fingerprint_get_auth_id(struct fingerprint_device __unused *dev) {
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_cancel(struct fingerprint_device __unused *dev) {
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_remove(struct fingerprint_device __unused *dev,
+                                uint32_t __unused gid, uint32_t __unused fid) {
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_set_active_group(struct fingerprint_device __unused *dev,
+                                        uint32_t __unused gid, const char __unused *store_path) {
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_authenticate(struct fingerprint_device __unused *dev,
+                                    uint64_t __unused operation_id, __unused uint32_t gid) {
+    return FINGERPRINT_ERROR;
+}
+
+static int set_notify_callback(struct fingerprint_device *dev,
+                                fingerprint_notify_t notify) {
+    /* Decorate with locks */
+    dev->notify = notify;
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_open(const hw_module_t* module, const char __unused *id,
+                            hw_device_t** device)
+{
+    if (device == NULL) {
+        ALOGE("NULL device on open");
+        return -EINVAL;
+    }
+
+    fingerprint_device_t *dev = malloc(sizeof(fingerprint_device_t));
+    memset(dev, 0, sizeof(fingerprint_device_t));
+
+    dev->common.tag = HARDWARE_DEVICE_TAG;
+    dev->common.version = FINGERPRINT_MODULE_API_VERSION_2_0;
+    dev->common.module = (struct hw_module_t*) module;
+    dev->common.close = fingerprint_close;
+
+    dev->pre_enroll = fingerprint_pre_enroll;
+    dev->enroll = fingerprint_enroll;
+    dev->get_authenticator_id = fingerprint_get_auth_id;
+    dev->cancel = fingerprint_cancel;
+    dev->remove = fingerprint_remove;
+    dev->set_active_group = fingerprint_set_active_group;
+    dev->authenticate = fingerprint_authenticate;
+    dev->set_notify = set_notify_callback;
+    dev->notify = NULL;
+
+    *device = (hw_device_t*) dev;
+    return 0;
+}
+
+static struct hw_module_methods_t fingerprint_module_methods = {
+    .open = fingerprint_open,
+};
+
+fingerprint_module_t HAL_MODULE_INFO_SYM = {
+    .common = {
+        .tag                = HARDWARE_MODULE_TAG,
+        .module_api_version = FINGERPRINT_MODULE_API_VERSION_2_0,
+        .hal_api_version    = HARDWARE_HAL_API_VERSION,
+        .id                 = FINGERPRINT_HARDWARE_MODULE_ID,
+        .name               = "Demo Fingerprint HAL",
+        .author             = "The Android Open Source Project",
+        .methods            = &fingerprint_module_methods,
+    },
+};
diff --git a/modules/gralloc/Android.mk b/modules/gralloc/Android.mk
index a4ffd20..092e851 100644
--- a/modules/gralloc/Android.mk
+++ b/modules/gralloc/Android.mk
@@ -29,5 +29,8 @@
 
 LOCAL_MODULE := gralloc.default
 LOCAL_CFLAGS:= -DLOG_TAG=\"gralloc\" -Wno-missing-field-initializers
+ifeq ($(TARGET_USE_PAN_DISPLAY),true)
+LOCAL_CFLAGS += -DUSE_PAN_DISPLAY=1
+endif
 
 include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/gralloc/framebuffer.cpp b/modules/gralloc/framebuffer.cpp
index 9d8513a..eadcdaa 100644
--- a/modules/gralloc/framebuffer.cpp
+++ b/modules/gralloc/framebuffer.cpp
@@ -33,7 +33,7 @@
 #include <cutils/log.h>
 #include <cutils/atomic.h>
 
-#if HAVE_ANDROID_OS
+#ifdef __ANDROID__
 #include <linux/fb.h>
 #endif
 
@@ -42,6 +42,13 @@
 
 /*****************************************************************************/
 
+// Set TARGET_USE_PAN_DISPLAY to true at compile time if the
+// board uses FBIOPAN_DISPLAY to setup page flipping, otherwise
+// default ioctl to do page-flipping is FBIOPUT_VSCREENINFO.
+#ifndef USE_PAN_DISPLAY
+#define USE_PAN_DISPLAY 0
+#endif
+
 // numbers of buffers for page flipping
 #define NUM_BUFFERS 2
 
@@ -178,10 +185,15 @@
 
 
     uint32_t flags = PAGE_FLIP;
+#if USE_PAN_DISPLAY
+    if (ioctl(fd, FBIOPAN_DISPLAY, &info) == -1) {
+        ALOGW("FBIOPAN_DISPLAY failed, page flipping not supported");
+#else
     if (ioctl(fd, FBIOPUT_VSCREENINFO, &info) == -1) {
+        ALOGW("FBIOPUT_VSCREENINFO failed, page flipping not supported");
+#endif
         info.yres_virtual = info.yres;
         flags &= ~PAGE_FLIP;
-        ALOGW("FBIOPUT_VSCREENINFO failed, page flipping not supported");
     }
 
     if (info.yres_virtual < info.yres * 2) {
diff --git a/modules/gralloc/gralloc.cpp b/modules/gralloc/gralloc.cpp
index bdc789d..a9fbc80 100644
--- a/modules/gralloc/gralloc.cpp
+++ b/modules/gralloc/gralloc.cpp
@@ -217,7 +217,7 @@
             bpp = 3;
             break;
         case HAL_PIXEL_FORMAT_RGB_565:
-        case HAL_PIXEL_FORMAT_RAW_SENSOR:
+        case HAL_PIXEL_FORMAT_RAW16:
             bpp = 2;
             break;
         default:
diff --git a/modules/gralloc/mapper.cpp b/modules/gralloc/mapper.cpp
index 5a882e2..20d9841 100644
--- a/modules/gralloc/mapper.cpp
+++ b/modules/gralloc/mapper.cpp
@@ -33,14 +33,6 @@
 #include "gralloc_priv.h"
 
 
-/* desktop Linux needs a little help with gettid() */
-#if defined(ARCH_X86) && !defined(HAVE_ANDROID_OS)
-#define __KERNEL__
-# include <linux/unistd.h>
-pid_t gettid() { return syscall(__NR_gettid);}
-#undef __KERNEL__
-#endif
-
 /*****************************************************************************/
 
 static int gralloc_map(gralloc_module_t const* /*module*/,
diff --git a/modules/hwcomposer/hwcomposer.cpp b/modules/hwcomposer/hwcomposer.cpp
index f0a5512..9d1aa34 100644
--- a/modules/hwcomposer/hwcomposer.cpp
+++ b/modules/hwcomposer/hwcomposer.cpp
@@ -16,8 +16,9 @@
 
 #include <hardware/hardware.h>
 
-#include <fcntl.h>
 #include <errno.h>
+#include <fcntl.h>
+#include <malloc.h>
 
 #include <cutils/log.h>
 #include <cutils/atomic.h>
diff --git a/modules/input/Android.mk b/modules/input/Android.mk
new file mode 100644
index 0000000..3011b2e
--- /dev/null
+++ b/modules/input/Android.mk
@@ -0,0 +1,19 @@
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/modules/input/evdev/Android.mk b/modules/input/evdev/Android.mk
new file mode 100644
index 0000000..d3c49e7
--- /dev/null
+++ b/modules/input/evdev/Android.mk
@@ -0,0 +1,57 @@
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+# Evdev module implementation
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES := \
+    InputHub.cpp \
+    InputDevice.cpp \
+    InputDeviceManager.cpp \
+    InputHost.cpp
+
+LOCAL_SHARED_LIBRARIES := \
+    libhardware_legacy \
+    liblog \
+    libutils
+
+LOCAL_CLANG := true
+LOCAL_CPPFLAGS += -std=c++14 -Wno-unused-parameter
+
+LOCAL_MODULE := libinput_evdev
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SHARED_LIBRARY)
+
+# HAL module
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := input.evdev.default
+LOCAL_MODULE_RELATIVE_PATH := hw
+
+LOCAL_SRC_FILES := \
+    EvdevModule.cpp
+
+LOCAL_SHARED_LIBRARIES := \
+    libinput_evdev \
+    liblog
+
+LOCAL_CLANG := true
+LOCAL_CPPFLAGS += -std=c++14 -Wno-unused-parameter
+
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/input/evdev/EvdevModule.cpp b/modules/input/evdev/EvdevModule.cpp
new file mode 100644
index 0000000..e9c8222
--- /dev/null
+++ b/modules/input/evdev/EvdevModule.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_NDEBUG 0
+#define LOG_TAG "EvdevModule"
+
+#include <memory>
+#include <string>
+#include <thread>
+
+#include <assert.h>
+#include <hardware/hardware.h>
+#include <hardware/input.h>
+
+#include <utils/Log.h>
+
+#include "InputHub.h"
+#include "InputDeviceManager.h"
+#include "InputHost.h"
+
+namespace android {
+
+static const char kDevInput[] = "/dev/input";
+
+class EvdevModule {
+public:
+    explicit EvdevModule(InputHost inputHost);
+
+    void init();
+    void notifyReport(input_report_t* r);
+
+private:
+    void loop();
+
+    InputHost mInputHost;
+    std::shared_ptr<InputDeviceManager> mDeviceManager;
+    std::shared_ptr<InputHub> mInputHub;
+    std::thread mPollThread;
+};
+
+static std::shared_ptr<EvdevModule> gEvdevModule;
+
+EvdevModule::EvdevModule(InputHost inputHost) :
+    mInputHost(inputHost),
+    mDeviceManager(std::make_shared<InputDeviceManager>()),
+    mInputHub(std::make_shared<InputHub>(mDeviceManager)) {}
+
+void EvdevModule::init() {
+    ALOGV("%s", __func__);
+
+    mInputHub->registerDevicePath(kDevInput);
+    mPollThread = std::thread(&EvdevModule::loop, this);
+}
+
+void EvdevModule::notifyReport(input_report_t* r) {
+    ALOGV("%s", __func__);
+
+    // notifyReport() will be called from an arbitrary thread within the input
+    // host. Since InputHub is not threadsafe, this is how I expect this to
+    // work:
+    //   * notifyReport() will queue up the output report in the EvdevModule and
+    //     call wake() on the InputHub.
+    //   * In the main loop thread, after returning from poll(), the queue will
+    //     be processed with any pending work.
+}
+
+void EvdevModule::loop() {
+    ALOGV("%s", __func__);
+    for (;;) {
+        mInputHub->poll();
+
+        // TODO: process any pending work, like notify reports
+    }
+}
+
+extern "C" {
+
+static int dummy_open(const hw_module_t __unused *module, const char __unused *id,
+        hw_device_t __unused **device) {
+    ALOGW("open not implemented in the input HAL!");
+    return 0;
+}
+
+static void input_init(const input_module_t* module,
+        input_host_t* host, input_host_callbacks_t cb) {
+    LOG_ALWAYS_FATAL_IF(strcmp(module->common.id, INPUT_HARDWARE_MODULE_ID) != 0);
+    InputHost inputHost = {host, cb};
+    gEvdevModule = std::make_shared<EvdevModule>(inputHost);
+    gEvdevModule->init();
+}
+
+static void input_notify_report(const input_module_t* module, input_report_t* r) {
+    LOG_ALWAYS_FATAL_IF(strcmp(module->common.id, INPUT_HARDWARE_MODULE_ID) != 0);
+    LOG_ALWAYS_FATAL_IF(gEvdevModule == nullptr);
+    gEvdevModule->notifyReport(r);
+}
+
+static struct hw_module_methods_t input_module_methods = {
+    .open = dummy_open,
+};
+
+input_module_t HAL_MODULE_INFO_SYM = {
+    .common = {
+        .tag                = HARDWARE_MODULE_TAG,
+        .module_api_version = INPUT_MODULE_API_VERSION_1_0,
+        .hal_api_version    = HARDWARE_HAL_API_VERSION,
+        .id                 = INPUT_HARDWARE_MODULE_ID,
+        .name               = "Input evdev HAL",
+        .author             = "The Android Open Source Project",
+        .methods            = &input_module_methods,
+        .dso                = NULL,
+        .reserved           = {0},
+    },
+
+    .init = input_init,
+    .notify_report = input_notify_report,
+};
+
+}  // extern "C"
+
+}  // namespace input
diff --git a/modules/input/evdev/InputDevice.cpp b/modules/input/evdev/InputDevice.cpp
new file mode 100644
index 0000000..c0b59d7
--- /dev/null
+++ b/modules/input/evdev/InputDevice.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "InputDevice"
+#define LOG_NDEBUG 0
+
+#include <linux/input.h>
+
+#define __STDC_FORMAT_MACROS
+#include <cinttypes>
+#include <string>
+
+#include <utils/Log.h>
+#include <utils/Timers.h>
+
+#include "InputHub.h"
+#include "InputDevice.h"
+
+#define MSC_ANDROID_TIME_SEC  0x6
+#define MSC_ANDROID_TIME_USEC 0x7
+
+namespace android {
+
+EvdevDevice::EvdevDevice(std::shared_ptr<InputDeviceNode> node) :
+    mDeviceNode(node) {}
+
+void EvdevDevice::processInput(InputEvent& event, nsecs_t currentTime) {
+    std::string log;
+    log.append("---InputEvent for device %s---\n");
+    log.append("   when:  %" PRId64 "\n");
+    log.append("   type:  %d\n");
+    log.append("   code:  %d\n");
+    log.append("   value: %d\n");
+    ALOGV(log.c_str(), mDeviceNode->getPath().c_str(), event.when, event.type, event.code,
+            event.value);
+
+    if (event.type == EV_MSC) {
+        if (event.code == MSC_ANDROID_TIME_SEC) {
+            mOverrideSec = event.value;
+        } else if (event.code == MSC_ANDROID_TIME_USEC) {
+            mOverrideUsec = event.value;
+        }
+        return;
+    }
+
+    if (mOverrideSec || mOverrideUsec) {
+        event.when = s2ns(mOverrideSec) + us2ns(mOverrideUsec);
+        ALOGV("applied override time %d.%06d", mOverrideSec, mOverrideUsec);
+
+        if (event.type == EV_SYN && event.code == SYN_REPORT) {
+            mOverrideSec = 0;
+            mOverrideUsec = 0;
+        }
+    }
+
+    // Bug 7291243: Add a guard in case the kernel generates timestamps
+    // that appear to be far into the future because they were generated
+    // using the wrong clock source.
+    //
+    // This can happen because when the input device is initially opened
+    // it has a default clock source of CLOCK_REALTIME.  Any input events
+    // enqueued right after the device is opened will have timestamps
+    // generated using CLOCK_REALTIME.  We later set the clock source
+    // to CLOCK_MONOTONIC but it is already too late.
+    //
+    // Invalid input event timestamps can result in ANRs, crashes and
+    // and other issues that are hard to track down.  We must not let them
+    // propagate through the system.
+    //
+    // Log a warning so that we notice the problem and recover gracefully.
+    if (event.when >= currentTime + s2ns(10)) {
+        // Double-check. Time may have moved on.
+        auto time = systemTime(SYSTEM_TIME_MONOTONIC);
+        if (event.when > time) {
+            ALOGW("An input event from %s has a timestamp that appears to have "
+                    "been generated using the wrong clock source (expected "
+                    "CLOCK_MONOTONIC): event time %" PRId64 ", current time %" PRId64
+                    ", call time %" PRId64 ". Using current time instead.",
+                    mDeviceNode->getPath().c_str(), event.when, time, currentTime);
+            event.when = time;
+        } else {
+            ALOGV("Event time is ok but failed the fast path and required an extra "
+                    "call to systemTime: event time %" PRId64 ", current time %" PRId64
+                    ", call time %" PRId64 ".", event.when, time, currentTime);
+        }
+    }
+}
+
+}  // namespace android
diff --git a/modules/input/evdev/InputDevice.h b/modules/input/evdev/InputDevice.h
new file mode 100644
index 0000000..3aa16cc
--- /dev/null
+++ b/modules/input/evdev/InputDevice.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INPUT_DEVICE_H_
+#define ANDROID_INPUT_DEVICE_H_
+
+#include <memory>
+
+#include <utils/Timers.h>
+
+#include "InputHub.h"
+
+namespace android {
+
+/**
+ * InputDeviceInterface represents an input device in the HAL. It processes
+ * input events before passing them to the input host.
+ */
+class InputDeviceInterface {
+public:
+    virtual void processInput(InputEvent& event, nsecs_t currentTime) = 0;
+
+protected:
+    InputDeviceInterface() = default;
+    virtual ~InputDeviceInterface() = default;
+};
+
+/**
+ * EvdevDevice is an input device backed by a Linux evdev node.
+ */
+class EvdevDevice : public InputDeviceInterface {
+public:
+    explicit EvdevDevice(std::shared_ptr<InputDeviceNode> node);
+    virtual ~EvdevDevice() override = default;
+
+    virtual void processInput(InputEvent& event, nsecs_t currentTime) override;
+
+private:
+    std::shared_ptr<InputDeviceNode> mDeviceNode;
+
+    int32_t mOverrideSec = 0;
+    int32_t mOverrideUsec = 0;
+};
+
+}  // namespace android
+
+#endif  // ANDROID_INPUT_DEVICE_H_
diff --git a/modules/input/evdev/InputDeviceManager.cpp b/modules/input/evdev/InputDeviceManager.cpp
new file mode 100644
index 0000000..ceddd90
--- /dev/null
+++ b/modules/input/evdev/InputDeviceManager.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "InputDeviceManager"
+//#define LOG_NDEBUG 0
+
+#include <utils/Log.h>
+
+#include "InputDevice.h"
+#include "InputDeviceManager.h"
+
+namespace android {
+
+void InputDeviceManager::onInputEvent(std::shared_ptr<InputDeviceNode> node, InputEvent& event,
+        nsecs_t event_time) {
+    if (mDevices[node] == nullptr) {
+        ALOGE("got input event for unknown node %s", node->getPath().c_str());
+        return;
+    }
+    mDevices[node]->processInput(event, event_time);
+}
+
+void InputDeviceManager::onDeviceAdded(std::shared_ptr<InputDeviceNode> node) {
+    mDevices[node] = std::make_shared<EvdevDevice>(node);
+}
+
+void InputDeviceManager::onDeviceRemoved(std::shared_ptr<InputDeviceNode> node) {
+    if (mDevices[node] == nullptr) {
+        ALOGE("could not remove unknown node %s", node->getPath().c_str());
+        return;
+    }
+    // TODO: tell the InputDevice and InputDeviceNode that they are being
+    // removed so they can run any cleanup.
+    mDevices.erase(node);
+}
+
+}  // namespace android
diff --git a/modules/input/evdev/InputDeviceManager.h b/modules/input/evdev/InputDeviceManager.h
new file mode 100644
index 0000000..b652155
--- /dev/null
+++ b/modules/input/evdev/InputDeviceManager.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INPUT_DEVICE_MANAGER_H_
+#define ANDROID_INPUT_DEVICE_MANAGER_H_
+
+#include <memory>
+#include <unordered_map>
+
+#include <utils/Timers.h>
+
+#include "InputDevice.h"
+#include "InputHub.h"
+
+namespace android {
+
+/**
+ * InputDeviceManager keeps the mapping of InputDeviceNodes to
+ * InputDeviceInterfaces and handles the callbacks from the InputHub, delegating
+ * them to the appropriate InputDeviceInterface.
+ */
+class InputDeviceManager : public InputCallbackInterface {
+public:
+    virtual ~InputDeviceManager() override = default;
+
+    virtual void onInputEvent(std::shared_ptr<InputDeviceNode> node, InputEvent& event,
+            nsecs_t event_time) override;
+    virtual void onDeviceAdded(std::shared_ptr<InputDeviceNode> node) override;
+    virtual void onDeviceRemoved(std::shared_ptr<InputDeviceNode> node) override;
+
+private:
+    template<class T, class U>
+    using DeviceMap = std::unordered_map<std::shared_ptr<T>, std::shared_ptr<U>>;
+
+    DeviceMap<InputDeviceNode, InputDeviceInterface> mDevices;
+};
+
+}  // namespace android
+
+#endif  // ANDROID_INPUT_DEVICE_MANAGER_H_
diff --git a/modules/input/evdev/InputHost.cpp b/modules/input/evdev/InputHost.cpp
new file mode 100644
index 0000000..6a65fcd
--- /dev/null
+++ b/modules/input/evdev/InputHost.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "InputHost.h"
+
+namespace android {
+
+void InputReport::reportEvent(InputDeviceHandle d) {
+    mCallbacks.report_event(mHost, d, mReport);
+}
+
+void InputReportDefinition::addCollection(InputCollectionId id, int32_t arity) {
+    mCallbacks.input_report_definition_add_collection(mHost, mReportDefinition, id, arity);
+}
+
+void InputReportDefinition::declareUsage(InputCollectionId id, InputUsage usage,
+        int32_t min, int32_t max, float resolution) {
+    mCallbacks.input_report_definition_declare_usage_int(mHost, mReportDefinition,
+            id, usage, min, max, resolution);
+}
+
+void InputReportDefinition::declareUsage(InputCollectionId id, InputUsage* usage,
+        size_t usageCount) {
+    mCallbacks.input_report_definition_declare_usages_bool(mHost, mReportDefinition,
+            id, usage, usageCount);
+}
+
+InputReport InputReportDefinition::allocateReport() {
+    return InputReport(mHost, mCallbacks,
+            mCallbacks.input_allocate_report(mHost, mReportDefinition));
+}
+
+void InputDeviceDefinition::addReport(InputReportDefinition r) {
+    mCallbacks.input_device_definition_add_report(mHost, mDeviceDefinition, r);
+}
+
+InputProperty::~InputProperty() {
+    mCallbacks.input_free_device_property(mHost, mProperty);
+}
+
+const char* InputProperty::getKey() {
+    return mCallbacks.input_get_property_key(mHost, mProperty);
+}
+
+const char* InputProperty::getValue() {
+    return mCallbacks.input_get_property_value(mHost, mProperty);
+}
+
+InputPropertyMap::~InputPropertyMap() {
+    mCallbacks.input_free_device_property_map(mHost, mMap);
+}
+
+InputProperty InputPropertyMap::getDeviceProperty(const char* key) {
+    return InputProperty(mHost, mCallbacks,
+            mCallbacks.input_get_device_property(mHost, mMap, key));
+}
+
+InputDeviceIdentifier InputHost::createDeviceIdentifier(const char* name, int32_t productId,
+        int32_t vendorId, InputBus bus, const char* uniqueId) {
+    return mCallbacks.create_device_identifier(mHost, name, productId, vendorId, bus, uniqueId);
+}
+
+InputDeviceDefinition InputHost::createDeviceDefinition() {
+    return InputDeviceDefinition(mHost, mCallbacks, mCallbacks.create_device_definition(mHost));
+}
+
+InputReportDefinition InputHost::createInputReportDefinition() {
+    return InputReportDefinition(mHost, mCallbacks,
+            mCallbacks.create_input_report_definition(mHost));
+}
+
+InputReportDefinition InputHost::createOutputReportDefinition() {
+    return InputReportDefinition(mHost, mCallbacks,
+            mCallbacks.create_output_report_definition(mHost));
+}
+
+InputDeviceHandle InputHost::registerDevice(InputDeviceIdentifier id,
+        InputDeviceDefinition d) {
+    return mCallbacks.register_device(mHost, id, d);
+}
+
+void InputHost::unregisterDevice(InputDeviceHandle handle) {
+    return mCallbacks.unregister_device(mHost, handle);
+}
+
+InputPropertyMap InputHost::getDevicePropertyMap(InputDeviceIdentifier id) {
+    return InputPropertyMap(mHost, mCallbacks,
+            mCallbacks.input_get_device_property_map(mHost, id));
+}
+
+}  // namespace android
diff --git a/modules/input/evdev/InputHost.h b/modules/input/evdev/InputHost.h
new file mode 100644
index 0000000..98ce26f
--- /dev/null
+++ b/modules/input/evdev/InputHost.h
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INPUT_HOST_H_
+#define ANDROID_INPUT_HOST_H_
+
+#include <memory>
+
+#include <hardware/input.h>
+
+namespace android {
+
+/**
+ * Classes in this file wrap the corresponding interfaces in the Input HAL. They
+ * are intended to be lightweight and passed by value. It is still important not
+ * to use an object after a HAL-specific method has freed the underlying
+ * representation.
+ *
+ * See hardware/input.h for details about each of these methods.
+ */
+
+using InputBus = input_bus_t;
+using InputCollectionId = input_collection_id_t;
+using InputDeviceHandle = input_device_handle_t*;
+using InputDeviceIdentifier = input_device_identifier_t*;
+using InputUsage = input_usage_t;
+
+class InputHostBase {
+protected:
+    InputHostBase(input_host_t* host, input_host_callbacks_t cb) : mHost(host), mCallbacks(cb) {}
+    virtual ~InputHostBase() = default;
+
+    input_host_t* mHost;
+    input_host_callbacks_t mCallbacks;
+};
+
+class InputReport : private InputHostBase {
+public:
+    virtual ~InputReport() = default;
+
+    InputReport(const InputReport& rhs) = default;
+    InputReport& operator=(const InputReport& rhs) = default;
+    operator input_report_t*() const { return mReport; }
+
+    void reportEvent(InputDeviceHandle d);
+
+private:
+    friend class InputReportDefinition;
+
+    InputReport(input_host_t* host, input_host_callbacks_t cb, input_report_t* r) :
+        InputHostBase(host, cb), mReport(r) {}
+
+    input_report_t* mReport;
+};
+
+class InputReportDefinition : private InputHostBase {
+public:
+    virtual ~InputReportDefinition() = default;
+
+    InputReportDefinition(const InputReportDefinition& rhs) = default;
+    InputReportDefinition& operator=(const InputReportDefinition& rhs) = default;
+    operator input_report_definition_t*() { return mReportDefinition; }
+
+    void addCollection(InputCollectionId id, int32_t arity);
+    void declareUsage(InputCollectionId id, InputUsage usage, int32_t min, int32_t max,
+            float resolution);
+    void declareUsage(InputCollectionId id, InputUsage* usage, size_t usageCount);
+
+    InputReport allocateReport();
+
+private:
+    friend class InputHost;
+
+    InputReportDefinition(
+            input_host_t* host, input_host_callbacks_t cb, input_report_definition_t* r) :
+        InputHostBase(host, cb), mReportDefinition(r) {}
+
+    input_report_definition_t* mReportDefinition;
+};
+
+class InputDeviceDefinition : private InputHostBase {
+public:
+    virtual ~InputDeviceDefinition() = default;
+
+    InputDeviceDefinition(const InputDeviceDefinition& rhs) = default;
+    InputDeviceDefinition& operator=(const InputDeviceDefinition& rhs) = default;
+    operator input_device_definition_t*() { return mDeviceDefinition; }
+
+    void addReport(InputReportDefinition r);
+
+private:
+    friend class InputHost;
+
+    InputDeviceDefinition(
+            input_host_t* host, input_host_callbacks_t cb, input_device_definition_t* d) :
+        InputHostBase(host, cb), mDeviceDefinition(d) {}
+
+    input_device_definition_t* mDeviceDefinition;
+};
+
+class InputProperty : private InputHostBase {
+public:
+    virtual ~InputProperty();
+
+    operator input_property_t*() { return mProperty; }
+
+    const char* getKey();
+    const char* getValue();
+
+    // Default move constructor transfers ownership of the input_property_t
+    // pointer.
+    InputProperty(InputProperty&& rhs) = default;
+
+    // Prevent copy/assign because of the ownership of the underlying
+    // input_property_t pointer.
+    InputProperty(const InputProperty& rhs) = delete;
+    InputProperty& operator=(const InputProperty& rhs) = delete;
+
+private:
+    friend class InputPropertyMap;
+
+    InputProperty(
+            input_host_t* host, input_host_callbacks_t cb, input_property_t* p) :
+        InputHostBase(host, cb), mProperty(p) {}
+
+    input_property_t* mProperty;
+};
+
+class InputPropertyMap : private InputHostBase {
+public:
+    virtual ~InputPropertyMap();
+
+    operator input_property_map_t*() { return mMap; }
+
+    InputProperty getDeviceProperty(const char* key);
+
+    // Default move constructor transfers ownership of the input_property_map_t
+    // pointer.
+    InputPropertyMap(InputPropertyMap&& rhs) = default;
+
+    // Prevent copy/assign because of the ownership of the underlying
+    // input_property_map_t pointer.
+    InputPropertyMap(const InputPropertyMap& rhs) = delete;
+    InputPropertyMap& operator=(const InputPropertyMap& rhs) = delete;
+
+private:
+    friend class InputHost;
+
+    InputPropertyMap(
+            input_host_t* host, input_host_callbacks_t cb, input_property_map_t* m) :
+        InputHostBase(host, cb), mMap(m) {}
+
+    input_property_map_t* mMap;
+};
+
+class InputHost : private InputHostBase {
+public:
+    InputHost(input_host_t* host, input_host_callbacks_t cb) : InputHostBase(host, cb) {}
+    virtual ~InputHost() = default;
+
+    InputHost(const InputHost& rhs) = default;
+    InputHost& operator=(const InputHost& rhs) = default;
+
+    InputDeviceIdentifier createDeviceIdentifier(const char* name, int32_t productId,
+            int32_t vendorId, InputBus bus, const char* uniqueId);
+
+    InputDeviceDefinition createDeviceDefinition();
+    InputReportDefinition createInputReportDefinition();
+    InputReportDefinition createOutputReportDefinition();
+
+    InputDeviceHandle registerDevice(InputDeviceIdentifier id, InputDeviceDefinition d);
+    void unregisterDevice(InputDeviceHandle handle);
+
+    InputPropertyMap getDevicePropertyMap(InputDeviceIdentifier id);
+};
+
+}  // namespace android
+
+#endif  // ANDROID_INPUT_HOST_H_
diff --git a/modules/input/evdev/InputHub.cpp b/modules/input/evdev/InputHub.cpp
new file mode 100644
index 0000000..e72ac2e
--- /dev/null
+++ b/modules/input/evdev/InputHub.cpp
@@ -0,0 +1,802 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "InputHub"
+#define LOG_NDEBUG 0
+
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/capability.h>
+#include <sys/epoll.h>
+#include <sys/eventfd.h>
+#include <sys/inotify.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/utsname.h>
+#include <unistd.h>
+
+#include <vector>
+
+#include "InputHub.h"
+
+#include <android/input.h>
+#include <hardware_legacy/power.h>
+#include <linux/input.h>
+
+#include <utils/Log.h>
+
+namespace android {
+
+static const char WAKE_LOCK_ID[] = "KeyEvents";
+static const int NO_TIMEOUT = -1;
+static const int EPOLL_MAX_EVENTS = 16;
+static const int INPUT_MAX_EVENTS = 128;
+
+static constexpr bool testBit(int bit, const uint8_t arr[]) {
+    return arr[bit / 8] & (1 << (bit % 8));
+}
+
+static constexpr size_t sizeofBitArray(size_t bits) {
+    return (bits + 7) / 8;
+}
+
+static void getLinuxRelease(int* major, int* minor) {
+    struct utsname info;
+    if (uname(&info) || sscanf(info.release, "%d.%d", major, minor) <= 0) {
+        *major = 0, *minor = 0;
+        ALOGE("Could not get linux version: %s", strerror(errno));
+    }
+}
+
+static bool processHasCapability(int capability) {
+    LOG_ALWAYS_FATAL_IF(!cap_valid(capability), "invalid linux capability: %d", capability);
+    struct __user_cap_header_struct cap_header_data;
+    struct __user_cap_data_struct cap_data_data[2];
+    cap_user_header_t caphdr = &cap_header_data;
+    cap_user_data_t capdata = cap_data_data;
+    caphdr->pid = 0;
+    caphdr->version = _LINUX_CAPABILITY_VERSION_3;
+    LOG_ALWAYS_FATAL_IF(capget(caphdr, capdata) != 0,
+            "Could not get process capabilities. errno=%d", errno);
+    ALOGV("effective capabilities: %08x %08x", capdata[0].effective, capdata[1].effective);
+    int idx = CAP_TO_INDEX(capability);
+    return capdata[idx].effective & CAP_TO_MASK(capability);
+}
+
+class EvdevDeviceNode : public InputDeviceNode {
+public:
+    static EvdevDeviceNode* openDeviceNode(const std::string& path);
+
+    virtual ~EvdevDeviceNode() {
+        ALOGV("closing %s (fd=%d)", mPath.c_str(), mFd);
+        if (mFd >= 0) {
+            ::close(mFd);
+        }
+    }
+
+    virtual int getFd() const { return mFd; }
+    virtual const std::string& getPath() const override { return mPath; }
+    virtual const std::string& getName() const override { return mName; }
+    virtual const std::string& getLocation() const override { return mLocation; }
+    virtual const std::string& getUniqueId() const override { return mUniqueId; }
+
+    virtual uint16_t getBusType() const override { return mBusType; }
+    virtual uint16_t getVendorId() const override { return mVendorId; }
+    virtual uint16_t getProductId() const override { return mProductId; }
+    virtual uint16_t getVersion() const override { return mVersion; }
+
+    virtual bool hasKey(int32_t key) const override;
+    virtual bool hasRelativeAxis(int axis) const override;
+    virtual const AbsoluteAxisInfo* getAbsoluteAxisInfo(int32_t axis) const override;
+    virtual bool hasInputProperty(int property) const override;
+
+    virtual int32_t getKeyState(int32_t key) const override;
+    virtual int32_t getSwitchState(int32_t sw) const override;
+    virtual status_t getAbsoluteAxisValue(int32_t axis, int32_t* outValue) const override;
+
+    virtual void vibrate(nsecs_t duration) override;
+    virtual void cancelVibrate(int32_t deviceId) override;
+
+    virtual void disableDriverKeyRepeat() override;
+
+private:
+    EvdevDeviceNode(const std::string& path, int fd) :
+        mFd(fd), mPath(path) {}
+
+    status_t queryProperties();
+    void queryAxisInfo();
+
+    int mFd;
+    std::string mPath;
+
+    std::string mName;
+    std::string mLocation;
+    std::string mUniqueId;
+
+    uint16_t mBusType;
+    uint16_t mVendorId;
+    uint16_t mProductId;
+    uint16_t mVersion;
+
+    uint8_t mKeyBitmask[KEY_CNT / 8];
+    uint8_t mAbsBitmask[ABS_CNT / 8];
+    uint8_t mRelBitmask[REL_CNT / 8];
+    uint8_t mSwBitmask[SW_CNT / 8];
+    uint8_t mLedBitmask[LED_CNT / 8];
+    uint8_t mFfBitmask[FF_CNT / 8];
+    uint8_t mPropBitmask[INPUT_PROP_CNT / 8];
+
+    std::unordered_map<uint32_t, std::unique_ptr<AbsoluteAxisInfo>> mAbsInfo;
+
+    bool mFfEffectPlaying = false;
+    int16_t mFfEffectId = -1;
+};
+
+EvdevDeviceNode* EvdevDeviceNode::openDeviceNode(const std::string& path) {
+    auto fd = TEMP_FAILURE_RETRY(::open(path.c_str(), O_RDONLY | O_NONBLOCK | O_CLOEXEC));
+    if (fd < 0) {
+        ALOGE("could not open evdev device %s. err=%d", path.c_str(), errno);
+        return nullptr;
+    }
+
+    // Tell the kernel that we want to use the monotonic clock for reporting
+    // timestamps associated with input events. This is important because the
+    // input system uses the timestamps extensively and assumes they were
+    // recorded using the monotonic clock.
+    //
+    // The EVIOCSCLOCKID ioctl was introduced in Linux 3.4.
+    int clockId = CLOCK_MONOTONIC;
+    if (TEMP_FAILURE_RETRY(ioctl(fd, EVIOCSCLOCKID, &clockId)) < 0) {
+        ALOGW("Could not set input clock id to CLOCK_MONOTONIC. errno=%d", errno);
+    }
+
+    auto node = new EvdevDeviceNode(path, fd);
+    status_t ret = node->queryProperties();
+    if (ret != OK) {
+        ALOGE("could not open evdev device %s: failed to read properties. errno=%d",
+                path.c_str(), ret);
+        delete node;
+        return nullptr;
+    }
+    return node;
+}
+
+status_t EvdevDeviceNode::queryProperties() {
+    char buffer[80];
+
+    if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGNAME(sizeof(buffer) - 1), buffer)) < 1) {
+        ALOGV("could not get device name for %s.", mPath.c_str());
+    } else {
+        buffer[sizeof(buffer) - 1] = '\0';
+        mName = buffer;
+    }
+
+    int driverVersion;
+    if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGVERSION, &driverVersion))) {
+        ALOGE("could not get driver version for %s. err=%d", mPath.c_str(), errno);
+        return -errno;
+    }
+
+    struct input_id inputId;
+    if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGID, &inputId))) {
+        ALOGE("could not get device input id for %s. err=%d", mPath.c_str(), errno);
+        return -errno;
+    }
+    mBusType = inputId.bustype;
+    mVendorId = inputId.vendor;
+    mProductId = inputId.product;
+    mVersion = inputId.version;
+
+    if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGPHYS(sizeof(buffer) - 1), buffer)) < 1) {
+        ALOGV("could not get location for %s.", mPath.c_str());
+    } else {
+        buffer[sizeof(buffer) - 1] = '\0';
+        mLocation = buffer;
+    }
+
+    if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGUNIQ(sizeof(buffer) - 1), buffer)) < 1) {
+        ALOGV("could not get unique id for %s.", mPath.c_str());
+    } else {
+        buffer[sizeof(buffer) - 1] = '\0';
+        mUniqueId = buffer;
+    }
+
+    ALOGV("add device %s", mPath.c_str());
+    ALOGV("  bus:        %04x\n"
+          "  vendor:     %04x\n"
+          "  product:    %04x\n"
+          "  version:    %04x\n",
+        mBusType, mVendorId, mProductId, mVersion);
+    ALOGV("  name:       \"%s\"\n"
+          "  location:   \"%s\"\n"
+          "  unique_id:  \"%s\"\n"
+          "  descriptor: (TODO)\n"
+          "  driver:     v%d.%d.%d",
+        mName.c_str(), mLocation.c_str(), mUniqueId.c_str(),
+        driverVersion >> 16, (driverVersion >> 8) & 0xff, (driverVersion >> 16) & 0xff);
+
+    TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGBIT(EV_KEY, sizeof(mKeyBitmask)), mKeyBitmask));
+    TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGBIT(EV_ABS, sizeof(mAbsBitmask)), mAbsBitmask));
+    TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGBIT(EV_REL, sizeof(mRelBitmask)), mRelBitmask));
+    TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGBIT(EV_SW,  sizeof(mSwBitmask)),  mSwBitmask));
+    TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGBIT(EV_LED, sizeof(mLedBitmask)), mLedBitmask));
+    TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGBIT(EV_FF,  sizeof(mFfBitmask)),  mFfBitmask));
+    TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGPROP(sizeof(mPropBitmask)), mPropBitmask));
+
+    queryAxisInfo();
+
+    return OK;
+}
+
+void EvdevDeviceNode::queryAxisInfo() {
+    for (int32_t axis = 0; axis < ABS_MAX; ++axis) {
+        if (testBit(axis, mAbsBitmask)) {
+            struct input_absinfo info;
+            if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGABS(axis), &info))) {
+                ALOGW("Error reading absolute controller %d for device %s fd %d, errno=%d",
+                        axis, mPath.c_str(), mFd, errno);
+                continue;
+            }
+
+            mAbsInfo[axis] = std::unique_ptr<AbsoluteAxisInfo>(new AbsoluteAxisInfo{
+                    .minValue = info.minimum,
+                    .maxValue = info.maximum,
+                    .flat = info.flat,
+                    .fuzz = info.fuzz,
+                    .resolution = info.resolution
+                    });
+        }
+    }
+}
+
+bool EvdevDeviceNode::hasKey(int32_t key) const {
+    if (key >= 0 && key <= KEY_MAX) {
+        return testBit(key, mKeyBitmask);
+    }
+    return false;
+}
+
+bool EvdevDeviceNode::hasRelativeAxis(int axis) const {
+    if (axis >= 0 && axis <= REL_MAX) {
+        return testBit(axis, mRelBitmask);
+    }
+    return false;
+}
+
+const AbsoluteAxisInfo* EvdevDeviceNode::getAbsoluteAxisInfo(int32_t axis) const {
+    if (axis < 0 || axis > ABS_MAX) {
+        return nullptr;
+    }
+
+    const auto absInfo = mAbsInfo.find(axis);
+    if (absInfo != mAbsInfo.end()) {
+        return absInfo->second.get();
+    }
+    return nullptr;
+}
+
+bool EvdevDeviceNode::hasInputProperty(int property) const {
+    if (property >= 0 && property <= INPUT_PROP_MAX) {
+        return testBit(property, mPropBitmask);
+    }
+    return false;
+}
+
+int32_t EvdevDeviceNode::getKeyState(int32_t key) const {
+    if (key >= 0 && key <= KEY_MAX) {
+        if (testBit(key, mKeyBitmask)) {
+            uint8_t keyState[sizeofBitArray(KEY_CNT)];
+            memset(keyState, 0, sizeof(keyState));
+            if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGKEY(sizeof(keyState)), keyState)) >= 0) {
+                return testBit(key, keyState) ? AKEY_STATE_DOWN : AKEY_STATE_UP;
+            }
+        }
+    }
+    return AKEY_STATE_UNKNOWN;
+}
+
+int32_t EvdevDeviceNode::getSwitchState(int32_t sw) const {
+    if (sw >= 0 && sw <= SW_MAX) {
+        if (testBit(sw, mSwBitmask)) {
+            uint8_t swState[sizeofBitArray(SW_CNT)];
+            memset(swState, 0, sizeof(swState));
+            if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGSW(sizeof(swState)), swState)) >= 0) {
+                return testBit(sw, swState) ? AKEY_STATE_DOWN : AKEY_STATE_UP;
+            }
+        }
+    }
+    return AKEY_STATE_UNKNOWN;
+}
+
+status_t EvdevDeviceNode::getAbsoluteAxisValue(int32_t axis, int32_t* outValue) const {
+    *outValue = 0;
+
+    if (axis >= 0 && axis <= ABS_MAX) {
+        if (testBit(axis, mAbsBitmask)) {
+            struct input_absinfo info;
+            if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCGABS(axis), &info))) {
+                ALOGW("Error reading absolute controller %d for device %s fd %d, errno=%d",
+                        axis, mPath.c_str(), mFd, errno);
+                return -errno;
+            }
+
+            *outValue = info.value;
+            return OK;
+        }
+    }
+    return -1;
+}
+
+void EvdevDeviceNode::vibrate(nsecs_t duration) {
+    ff_effect effect{};
+    effect.type = FF_RUMBLE;
+    effect.id = mFfEffectId;
+    effect.u.rumble.strong_magnitude = 0xc000;
+    effect.u.rumble.weak_magnitude = 0xc000;
+    effect.replay.length = (duration + 999'999LL) / 1'000'000LL;
+    effect.replay.delay = 0;
+    if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCSFF, &effect))) {
+        ALOGW("Could not upload force feedback effect to device %s due to error %d.",
+                mPath.c_str(), errno);
+        return;
+    }
+    mFfEffectId = effect.id;
+
+    struct input_event ev{};
+    ev.type = EV_FF;
+    ev.code = mFfEffectId;
+    ev.value = 1;
+    size_t written = TEMP_FAILURE_RETRY(write(mFd, &ev, sizeof(ev)));
+    if (written != sizeof(ev)) {
+        ALOGW("Could not start force feedback effect on device %s due to error %d.",
+                mPath.c_str(), errno);
+        return;
+    }
+    mFfEffectPlaying = true;
+}
+
+void EvdevDeviceNode::cancelVibrate(int32_t deviceId) {
+    if (mFfEffectPlaying) {
+        mFfEffectPlaying = false;
+
+        struct input_event ev{};
+        ev.type = EV_FF;
+        ev.code = mFfEffectId;
+        ev.value = 0;
+        size_t written = TEMP_FAILURE_RETRY(write(mFd, &ev, sizeof(ev)));
+        if (written != sizeof(ev)) {
+            ALOGW("Could not stop force feedback effect on device %s due to error %d.",
+                    mPath.c_str(), errno);
+            return;
+        }
+    }
+}
+
+void EvdevDeviceNode::disableDriverKeyRepeat() {
+    unsigned int repeatRate[] = {0, 0};
+    if (TEMP_FAILURE_RETRY(ioctl(mFd, EVIOCSREP, repeatRate))) {
+        ALOGW("Unable to disable kernel key repeat for %s due to error %d.",
+                mPath.c_str(), errno);
+    }
+}
+
+InputHub::InputHub(std::shared_ptr<InputCallbackInterface> cb) :
+    mInputCallback(cb) {
+    // Determine the type of suspend blocking we can do on this device. There
+    // are 3 options, in decreasing order of preference:
+    //   1) EPOLLWAKEUP: introduced in Linux kernel 3.5, this flag can be set on
+    //   an epoll event to indicate that a wake lock should be held from the
+    //   time an fd has data until the next epoll_wait (or the epoll fd is
+    //   closed).
+    //   2) EVIOCSSUSPENDBLOCK: introduced into the Android kernel's evdev
+    //   driver, this ioctl blocks suspend while the event queue for the fd is
+    //   not empty. This was never accepted into the mainline kernel, and it was
+    //   replaced by EPOLLWAKEUP.
+    //   3) explicit wake locks: use acquire_wake_lock to manage suspend
+    //   blocking explicitly in the InputHub code.
+    //
+    // (1) can be checked by simply observing the Linux kernel version. (2)
+    // requires an fd from an evdev node, which cannot be done in the InputHub
+    // constructor. So we assume (3) unless (1) is true, and we can verify
+    // whether (2) is true once we have an evdev fd (and we're not in (1)).
+    int major, minor;
+    getLinuxRelease(&major, &minor);
+    if (major > 3 || (major == 3 && minor >= 5)) {
+        ALOGI("Using EPOLLWAKEUP to block suspend while processing input events.");
+        mWakeupMechanism = WakeMechanism::EPOLL_WAKEUP;
+        mNeedToCheckSuspendBlockIoctl = false;
+    }
+    if (manageWakeLocks()) {
+        acquire_wake_lock(PARTIAL_WAKE_LOCK, WAKE_LOCK_ID);
+    }
+
+    // epoll_create argument is ignored, but it must be > 0.
+    mEpollFd = epoll_create(1);
+    LOG_ALWAYS_FATAL_IF(mEpollFd < 0, "Could not create epoll instance. errno=%d", errno);
+
+    mINotifyFd = inotify_init();
+    LOG_ALWAYS_FATAL_IF(mINotifyFd < 0, "Could not create inotify instance. errno=%d", errno);
+
+    struct epoll_event eventItem;
+    memset(&eventItem, 0, sizeof(eventItem));
+    eventItem.events = EPOLLIN;
+    if (mWakeupMechanism == WakeMechanism::EPOLL_WAKEUP) {
+        eventItem.events |= EPOLLWAKEUP;
+    }
+    eventItem.data.u32 = mINotifyFd;
+    int result = epoll_ctl(mEpollFd, EPOLL_CTL_ADD, mINotifyFd, &eventItem);
+    LOG_ALWAYS_FATAL_IF(result != 0, "Could not add INotify to epoll instance. errno=%d", errno);
+
+    int wakeFds[2];
+    result = pipe(wakeFds);
+    LOG_ALWAYS_FATAL_IF(result != 0, "Could not create wake pipe. errno=%d", errno);
+
+    mWakeEventFd = eventfd(0, EFD_NONBLOCK);
+    LOG_ALWAYS_FATAL_IF(mWakeEventFd == -1, "Could not create wake event fd. errno=%d", errno);
+
+    eventItem.data.u32 = mWakeEventFd;
+    result = epoll_ctl(mEpollFd, EPOLL_CTL_ADD, mWakeEventFd, &eventItem);
+    LOG_ALWAYS_FATAL_IF(result != 0, "Could not add wake event fd to epoll instance. errno=%d", errno);
+}
+
+InputHub::~InputHub() {
+    ::close(mEpollFd);
+    ::close(mINotifyFd);
+    ::close(mWakeEventFd);
+
+    if (manageWakeLocks()) {
+        release_wake_lock(WAKE_LOCK_ID);
+    }
+}
+
+status_t InputHub::registerDevicePath(const std::string& path) {
+    ALOGV("registering device path %s", path.c_str());
+    int wd = inotify_add_watch(mINotifyFd, path.c_str(), IN_DELETE | IN_CREATE);
+    if (wd < 0) {
+        ALOGE("Could not add %s to INotify watch. errno=%d", path.c_str(), errno);
+        return -errno;
+    }
+    mWatchedPaths[wd] = path;
+    scanDir(path);
+    return OK;
+}
+
+status_t InputHub::unregisterDevicePath(const std::string& path) {
+    int wd = -1;
+    for (auto pair : mWatchedPaths) {
+        if (pair.second == path) {
+            wd = pair.first;
+            break;
+        }
+    }
+
+    if (wd == -1) {
+        return BAD_VALUE;
+    }
+    mWatchedPaths.erase(wd);
+    if (inotify_rm_watch(mINotifyFd, wd) != 0) {
+        return -errno;
+    }
+    return OK;
+}
+
+status_t InputHub::poll() {
+    bool deviceChange = false;
+
+    if (manageWakeLocks()) {
+        // Mind the wake lock dance!
+        // If we're relying on wake locks, we hold a wake lock at all times
+        // except during epoll_wait(). This works due to some subtle
+        // choreography. When a device driver has pending (unread) events, it
+        // acquires a kernel wake lock. However, once the last pending event
+        // has been read, the device driver will release the kernel wake lock.
+        // To prevent the system from going to sleep when this happens, the
+        // InputHub holds onto its own user wake lock while the client is
+        // processing events. Thus the system can only sleep if there are no
+        // events pending or currently being processed.
+        release_wake_lock(WAKE_LOCK_ID);
+    }
+
+    struct epoll_event pendingEventItems[EPOLL_MAX_EVENTS];
+    int pollResult = epoll_wait(mEpollFd, pendingEventItems, EPOLL_MAX_EVENTS, NO_TIMEOUT);
+
+    if (manageWakeLocks()) {
+        acquire_wake_lock(PARTIAL_WAKE_LOCK, WAKE_LOCK_ID);
+    }
+
+    if (pollResult == 0) {
+        ALOGW("epoll_wait should not return 0 with no timeout");
+        return UNKNOWN_ERROR;
+    }
+    if (pollResult < 0) {
+        // An error occurred. Return even if it's EINTR, and let the caller
+        // restart the poll.
+        ALOGE("epoll_wait returned with errno=%d", errno);
+        return -errno;
+    }
+
+    // pollResult > 0: there are events to process
+    nsecs_t now = systemTime(SYSTEM_TIME_MONOTONIC);
+    std::vector<int> removedDeviceFds;
+    int inputFd = -1;
+    std::shared_ptr<InputDeviceNode> deviceNode;
+    for (int i = 0; i < pollResult; ++i) {
+        const struct epoll_event& eventItem = pendingEventItems[i];
+
+        int dataFd = static_cast<int>(eventItem.data.u32);
+        if (dataFd == mINotifyFd) {
+            if (eventItem.events & EPOLLIN) {
+                deviceChange = true;
+            } else {
+                ALOGW("Received unexpected epoll event 0x%08x for INotify.", eventItem.events);
+            }
+            continue;
+        }
+
+        if (dataFd == mWakeEventFd) {
+            if (eventItem.events & EPOLLIN) {
+                ALOGV("awoken after wake()");
+                uint64_t u;
+                ssize_t nRead = TEMP_FAILURE_RETRY(read(mWakeEventFd, &u, sizeof(uint64_t)));
+                if (nRead != sizeof(uint64_t)) {
+                    ALOGW("Could not read event fd; waking anyway.");
+                }
+            } else {
+                ALOGW("Received unexpected epoll event 0x%08x for wake event.",
+                        eventItem.events);
+            }
+            continue;
+        }
+
+        // Update the fd and device node when the fd changes. When several
+        // events are read back-to-back with the same fd, this saves many reads
+        // from the hash table.
+        if (inputFd != dataFd) {
+            inputFd = dataFd;
+            deviceNode = mDeviceNodes[inputFd];
+        }
+        if (deviceNode == nullptr) {
+            ALOGE("could not find device node for fd %d", inputFd);
+            continue;
+        }
+        if (eventItem.events & EPOLLIN) {
+            struct input_event ievs[INPUT_MAX_EVENTS];
+            for (;;) {
+                ssize_t readSize = TEMP_FAILURE_RETRY(read(inputFd, ievs, sizeof(ievs)));
+                if (readSize == 0 || (readSize < 0 && errno == ENODEV)) {
+                    ALOGW("could not get event, removed? (fd: %d, size: %d errno: %d)",
+                            inputFd, readSize, errno);
+
+                    removedDeviceFds.push_back(inputFd);
+                    break;
+                } else if (readSize < 0) {
+                    if (errno != EAGAIN && errno != EINTR) {
+                        ALOGW("could not get event. errno=%d", errno);
+                    }
+                    break;
+                } else if (readSize % sizeof(input_event) != 0) {
+                    ALOGE("could not get event. wrong size=%d", readSize);
+                    break;
+                } else {
+                    size_t count = static_cast<size_t>(readSize) / sizeof(struct input_event);
+                    for (size_t i = 0; i < count; ++i) {
+                        auto& iev = ievs[i];
+                        auto when = s2ns(iev.time.tv_sec) + us2ns(iev.time.tv_usec);
+                        InputEvent inputEvent = { when, iev.type, iev.code, iev.value };
+                        mInputCallback->onInputEvent(deviceNode, inputEvent, now);
+                    }
+                }
+            }
+        } else if (eventItem.events & EPOLLHUP) {
+            ALOGI("Removing device fd %d due to epoll hangup event.", inputFd);
+            removedDeviceFds.push_back(inputFd);
+        } else {
+            ALOGW("Received unexpected epoll event 0x%08x for device fd %d",
+                    eventItem.events, inputFd);
+        }
+    }
+
+    if (removedDeviceFds.size()) {
+        for (auto deviceFd : removedDeviceFds) {
+            auto deviceNode = mDeviceNodes[deviceFd];
+            if (deviceNode != nullptr) {
+                status_t ret = closeNodeByFd(deviceFd);
+                if (ret != OK) {
+                    ALOGW("Could not close device with fd %d. errno=%d", deviceFd, ret);
+                } else {
+                    mInputCallback->onDeviceRemoved(deviceNode);
+                }
+            }
+        }
+    }
+
+    if (deviceChange) {
+        readNotify();
+    }
+
+    return OK;
+}
+
+status_t InputHub::wake() {
+    ALOGV("wake() called");
+
+    uint64_t u = 1;
+    ssize_t nWrite = TEMP_FAILURE_RETRY(write(mWakeEventFd, &u, sizeof(uint64_t)));
+
+    if (nWrite != sizeof(uint64_t) && errno != EAGAIN) {
+        ALOGW("Could not write wake signal, errno=%d", errno);
+        return -errno;
+    }
+    return OK;
+}
+
+void InputHub::dump(String8& dump) {
+    // TODO
+}
+
+status_t InputHub::readNotify() {
+    char event_buf[512];
+    struct inotify_event* event;
+
+    ssize_t res = TEMP_FAILURE_RETRY(read(mINotifyFd, event_buf, sizeof(event_buf)));
+    if (res < static_cast<int>(sizeof(*event))) {
+        ALOGW("could not get inotify event, %s\n", strerror(errno));
+        return -errno;
+    }
+
+    size_t event_pos = 0;
+    nsecs_t now = systemTime(SYSTEM_TIME_MONOTONIC);
+    while (res >= static_cast<int>(sizeof(*event))) {
+        event = reinterpret_cast<struct inotify_event*>(event_buf + event_pos);
+        if (event->len) {
+            std::string path = mWatchedPaths[event->wd];
+            path.append("/").append(event->name);
+            ALOGV("inotify event for path %s", path.c_str());
+
+            if (event->mask & IN_CREATE) {
+                std::shared_ptr<InputDeviceNode> deviceNode;
+                status_t res = openNode(path, &deviceNode);
+                if (res != OK) {
+                    ALOGE("could not open device node %s. err=%d", path.c_str(), res);
+                } else {
+                    mInputCallback->onDeviceAdded(deviceNode);
+                }
+            } else {
+                auto deviceNode = findNodeByPath(path);
+                if (deviceNode != nullptr) {
+                    status_t ret = closeNode(deviceNode);
+                    if (ret != OK) {
+                        ALOGW("Could not close device %s. errno=%d", path.c_str(), ret);
+                    } else {
+                        mInputCallback->onDeviceRemoved(deviceNode);
+                    }
+                } else {
+                    ALOGW("could not find device node for %s", path.c_str());
+                }
+            }
+        }
+        int event_size = sizeof(*event) + event->len;
+        res -= event_size;
+        event_pos += event_size;
+    }
+
+    return OK;
+}
+
+status_t InputHub::scanDir(const std::string& path) {
+    auto dir = ::opendir(path.c_str());
+    if (dir == nullptr) {
+        ALOGE("could not open device path %s to scan for devices. err=%d", path.c_str(), errno);
+        return -errno;
+    }
+
+    while (auto dirent = readdir(dir)) {
+        if (strcmp(dirent->d_name, ".") == 0 ||
+            strcmp(dirent->d_name, "..") == 0) {
+            continue;
+        }
+        std::string filename = path + "/" + dirent->d_name;
+        std::shared_ptr<InputDeviceNode> node;
+        if (openNode(filename, &node) != OK) {
+            ALOGE("could not open device node %s", filename.c_str());
+        } else {
+            mInputCallback->onDeviceAdded(node);
+        }
+    }
+    ::closedir(dir);
+    return OK;
+}
+
+status_t InputHub::openNode(const std::string& path,
+        std::shared_ptr<InputDeviceNode>* outNode) {
+    ALOGV("opening %s...", path.c_str());
+    auto evdevNode = std::shared_ptr<EvdevDeviceNode>(EvdevDeviceNode::openDeviceNode(path));
+    if (evdevNode == nullptr) {
+        return UNKNOWN_ERROR;
+    }
+
+    auto fd = evdevNode->getFd();
+    ALOGV("opened %s with fd %d", path.c_str(), fd);
+    *outNode = std::static_pointer_cast<InputDeviceNode>(evdevNode);
+    mDeviceNodes[fd] = *outNode;
+    struct epoll_event eventItem{};
+    eventItem.events = EPOLLIN;
+    if (mWakeupMechanism == WakeMechanism::EPOLL_WAKEUP) {
+        eventItem.events |= EPOLLWAKEUP;
+    }
+    eventItem.data.u32 = fd;
+    if (epoll_ctl(mEpollFd, EPOLL_CTL_ADD, fd, &eventItem)) {
+        ALOGE("Could not add device fd to epoll instance. errno=%d", errno);
+        return -errno;
+    }
+
+    if (mNeedToCheckSuspendBlockIoctl) {
+#ifndef EVIOCSSUSPENDBLOCK
+        // uapi headers don't include EVIOCSSUSPENDBLOCK, and future kernels
+        // will use an epoll flag instead, so as long as we want to support this
+        // feature, we need to be prepared to define the ioctl ourselves.
+#define EVIOCSSUSPENDBLOCK _IOW('E', 0x91, int)
+#endif
+        if (TEMP_FAILURE_RETRY(ioctl(fd, EVIOCSSUSPENDBLOCK, 1))) {
+            // no wake mechanism, continue using explicit wake locks
+            ALOGI("Using explicit wakelocks to block suspend while processing input events.");
+        } else {
+            mWakeupMechanism = WakeMechanism::LEGACY_EVDEV_SUSPENDBLOCK_IOCTL;
+            // release any held wakelocks since we won't need them anymore
+            release_wake_lock(WAKE_LOCK_ID);
+            ALOGI("Using EVIOCSSUSPENDBLOCK to block suspend while processing input events.");
+        }
+        mNeedToCheckSuspendBlockIoctl = false;
+    }
+
+    return OK;
+}
+
+status_t InputHub::closeNode(const std::shared_ptr<InputDeviceNode>& node) {
+    for (auto pair : mDeviceNodes) {
+        if (pair.second.get() == node.get()) {
+            return closeNodeByFd(pair.first);
+        }
+    }
+    return BAD_VALUE;
+}
+
+status_t InputHub::closeNodeByFd(int fd) {
+    status_t ret = OK;
+    if (epoll_ctl(mEpollFd, EPOLL_CTL_DEL, fd, NULL)) {
+        ALOGW("Could not remove device fd from epoll instance. errno=%d", errno);
+        ret = -errno;
+    }
+    mDeviceNodes.erase(fd);
+    ::close(fd);
+    return ret;
+}
+
+std::shared_ptr<InputDeviceNode> InputHub::findNodeByPath(const std::string& path) {
+    for (auto pair : mDeviceNodes) {
+        if (pair.second->getPath() == path) return pair.second;
+    }
+    return nullptr;
+}
+
+bool InputHub::manageWakeLocks() const {
+    return mWakeupMechanism != WakeMechanism::EPOLL_WAKEUP;
+}
+
+}  // namespace android
diff --git a/modules/input/evdev/InputHub.h b/modules/input/evdev/InputHub.h
new file mode 100644
index 0000000..bec327a
--- /dev/null
+++ b/modules/input/evdev/InputHub.h
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INPUT_HUB_H_
+#define ANDROID_INPUT_HUB_H_
+
+#include <memory>
+#include <string>
+#include <unordered_map>
+
+#include <utils/String8.h>
+#include <utils/Timers.h>
+
+namespace android {
+
+/**
+ * InputEvent represents an event from the kernel. The fields largely mirror
+ * those found in linux/input.h.
+ */
+struct InputEvent {
+    nsecs_t when;
+
+    int32_t type;
+    int32_t code;
+    int32_t value;
+};
+
+/** Describes an absolute axis. */
+struct AbsoluteAxisInfo {
+    int32_t minValue = 0;   // minimum value
+    int32_t maxValue = 0;   // maximum value
+    int32_t flat = 0;       // center flat position, e.g. flat == 8 means center is between -8 and 8
+    int32_t fuzz = 0;       // error tolerance, e.g. fuzz == 4 means value is +/- 4 due to noise
+    int32_t resolution = 0; // resolution in units per mm or radians per mm
+};
+
+/**
+ * An InputDeviceNode represents a device node in the Linux system. It can be
+ * used to interact with the device, setting and getting property values.
+ *
+ * An InputDeviceNode should only be used on the same thread that is polling for
+ * input events.
+ */
+class InputDeviceNode {
+public:
+    virtual const std::string& getPath() const = 0;
+
+    virtual const std::string& getName() const = 0;
+    virtual const std::string& getLocation() const = 0;
+    virtual const std::string& getUniqueId() const = 0;
+
+    virtual uint16_t getBusType() const = 0;
+    virtual uint16_t getVendorId() const = 0;
+    virtual uint16_t getProductId() const = 0;
+    virtual uint16_t getVersion() const = 0;
+
+    virtual bool hasKey(int32_t key) const = 0;
+    virtual bool hasRelativeAxis(int axis) const = 0;
+    virtual const AbsoluteAxisInfo* getAbsoluteAxisInfo(int32_t axis) const = 0;
+    virtual bool hasInputProperty(int property) const = 0;
+
+    virtual int32_t getKeyState(int32_t key) const = 0;
+    virtual int32_t getSwitchState(int32_t sw) const = 0;
+    virtual status_t getAbsoluteAxisValue(int32_t axis, int32_t* outValue) const = 0;
+
+    virtual void vibrate(nsecs_t duration) = 0;
+    virtual void cancelVibrate(int32_t deviceId) = 0;
+
+    virtual void disableDriverKeyRepeat() = 0;
+
+protected:
+    InputDeviceNode() = default;
+    virtual ~InputDeviceNode() = default;
+};
+
+/** Callback interface for receiving input events, including device changes. */
+class InputCallbackInterface {
+public:
+    virtual void onInputEvent(std::shared_ptr<InputDeviceNode> node, InputEvent& event,
+            nsecs_t event_time) = 0;
+    virtual void onDeviceAdded(std::shared_ptr<InputDeviceNode> node) = 0;
+    virtual void onDeviceRemoved(std::shared_ptr<InputDeviceNode> node) = 0;
+
+protected:
+    InputCallbackInterface() = default;
+    virtual ~InputCallbackInterface() = default;
+};
+
+/**
+ * InputHubInterface is responsible for monitoring a set of device paths and
+ * executing callbacks when events occur. Before calling poll(), you should set
+ * the device and input callbacks, and register your device path(s).
+ */
+class InputHubInterface {
+public:
+    virtual status_t registerDevicePath(const std::string& path) = 0;
+    virtual status_t unregisterDevicePath(const std::string& path) = 0;
+
+    virtual status_t poll() = 0;
+    virtual status_t wake() = 0;
+
+    virtual void dump(String8& dump) = 0;
+
+protected:
+    InputHubInterface() = default;
+    virtual ~InputHubInterface() = default;
+};
+
+/**
+ * An implementation of InputHubInterface that uses epoll to wait for events.
+ *
+ * This class is not threadsafe. Any functions called on the InputHub should be
+ * called on the same thread that is used to call poll(). The only exception is
+ * wake(), which may be used to return from poll() before an input or device
+ * event occurs.
+ */
+class InputHub : public InputHubInterface {
+public:
+    explicit InputHub(std::shared_ptr<InputCallbackInterface> cb);
+    virtual ~InputHub() override;
+
+    virtual status_t registerDevicePath(const std::string& path) override;
+    virtual status_t unregisterDevicePath(const std::string& path) override;
+
+    virtual status_t poll() override;
+    virtual status_t wake() override;
+
+    virtual void dump(String8& dump) override;
+
+private:
+    status_t readNotify();
+    status_t scanDir(const std::string& path);
+    status_t openNode(const std::string& path, std::shared_ptr<InputDeviceNode>* outNode);
+    status_t closeNode(const std::shared_ptr<InputDeviceNode>& node);
+    status_t closeNodeByFd(int fd);
+    std::shared_ptr<InputDeviceNode> findNodeByPath(const std::string& path);
+
+    enum class WakeMechanism {
+        /**
+         * The kernel supports the EPOLLWAKEUP flag for epoll_ctl.
+         *
+         * When using this mechanism, epoll_wait will internally acquire a wake
+         * lock whenever one of the FDs it is monitoring becomes ready. The wake
+         * lock is held automatically by the kernel until the next call to
+         * epoll_wait.
+         *
+         * This mechanism only exists in Linux kernel 3.5+.
+         */
+        EPOLL_WAKEUP,
+        /**
+         * The kernel evdev driver supports the EVIOCSSUSPENDBLOCK ioctl.
+         *
+         * When using this mechanism, the InputHub asks evdev to acquire and
+         * hold a wake lock whenever its buffer is non-empty. We must take care
+         * to acquire our own userspace wake lock before draining the buffer to
+         * prevent actually going back into suspend before we have fully
+         * processed all of the events.
+         *
+         * This mechanism only exists in older Android Linux kernels.
+         */
+        LEGACY_EVDEV_SUSPENDBLOCK_IOCTL,
+        /**
+         * The kernel doesn't seem to support any special wake mechanism.
+         *
+         * We explicitly acquire and release wake locks when processing input
+         * events.
+         */
+        LEGACY_EVDEV_EXPLICIT_WAKE_LOCKS,
+    };
+    WakeMechanism mWakeupMechanism = WakeMechanism::LEGACY_EVDEV_EXPLICIT_WAKE_LOCKS;
+    bool manageWakeLocks() const;
+    bool mNeedToCheckSuspendBlockIoctl = true;
+
+    int mEpollFd;
+    int mINotifyFd;
+    int mWakeEventFd;
+    int mWakeReadPipeFd;
+    int mWakeWritePipeFd;
+
+    // Callback for input events
+    std::shared_ptr<InputCallbackInterface> mInputCallback;
+
+    // Map from watch descriptors to watched paths
+    std::unordered_map<int, std::string> mWatchedPaths;
+    // Map from file descriptors to InputDeviceNodes
+    std::unordered_map<int, std::shared_ptr<InputDeviceNode>> mDeviceNodes;
+};
+
+}  // namespace android
+
+#endif  // ANDROID_INPUT_HUB_H_
diff --git a/modules/local_time/local_time_hw.c b/modules/local_time/local_time_hw.c
index 308f7d9..ac597f4 100644
--- a/modules/local_time/local_time_hw.c
+++ b/modules/local_time/local_time_hw.c
@@ -18,9 +18,10 @@
 //#define LOG_NDEBUG 0
 
 #include <errno.h>
+#include <malloc.h>
 #include <stdint.h>
+#include <string.h>
 #include <sys/time.h>
-#include <linux/time.h>
 
 #include <cutils/log.h>
 
diff --git a/modules/nfc-nci/nfc_nci_example.c b/modules/nfc-nci/nfc_nci_example.c
index 2514225..758c2b7 100644
--- a/modules/nfc-nci/nfc_nci_example.c
+++ b/modules/nfc-nci/nfc_nci_example.c
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 #include <errno.h>
+#include <malloc.h>
 #include <string.h>
 
 #include <cutils/log.h>
diff --git a/modules/nfc/nfc_pn544_example.c b/modules/nfc/nfc_pn544_example.c
index 54c9c56..71bfd6b 100644
--- a/modules/nfc/nfc_pn544_example.c
+++ b/modules/nfc/nfc_pn544_example.c
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 #include <errno.h>
+#include <malloc.h>
 #include <string.h>
 
 #include <hardware/hardware.h>
diff --git a/modules/radio/Android.mk b/modules/radio/Android.mk
new file mode 100644
index 0000000..f433c85
--- /dev/null
+++ b/modules/radio/Android.mk
@@ -0,0 +1,27 @@
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+# Stub radio HAL module, used for tests
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := radio.fm.default
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_SRC_FILES := radio_hw.c
+LOCAL_SHARED_LIBRARIES := liblog libcutils libradio_metadata
+LOCAL_MODULE_TAGS := optional
+LOCAL_32_BIT_ONLY := true
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/radio/radio_hw.c b/modules/radio/radio_hw.c
new file mode 100644
index 0000000..9c0f22c
--- /dev/null
+++ b/modules/radio/radio_hw.c
@@ -0,0 +1,744 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "radio_hw_stub"
+#define LOG_NDEBUG 0
+
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <pthread.h>
+#include <sys/prctl.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <cutils/log.h>
+#include <cutils/list.h>
+#include <system/radio.h>
+#include <system/radio_metadata.h>
+#include <hardware/hardware.h>
+#include <hardware/radio.h>
+
+static const radio_hal_properties_t hw_properties = {
+    .class_id = RADIO_CLASS_AM_FM,
+    .implementor = "The Android Open Source Project",
+    .product = "Radio stub HAL",
+    .version = "0.1",
+    .serial = "0123456789",
+    .num_tuners = 1,
+    .num_audio_sources = 1,
+    .supports_capture = false,
+    .num_bands = 2,
+    .bands = {
+        {
+            .type = RADIO_BAND_FM,
+            .antenna_connected = false,
+            .lower_limit = 87900,
+            .upper_limit = 107900,
+            .num_spacings = 1,
+            .spacings = { 200 },
+            .fm = {
+                .deemphasis = RADIO_DEEMPHASIS_75,
+                .stereo = true,
+                .rds = RADIO_RDS_US,
+                .ta = false,
+                .af = false,
+            }
+        },
+        {
+            .type = RADIO_BAND_AM,
+            .antenna_connected = true,
+            .lower_limit = 540,
+            .upper_limit = 1610,
+            .num_spacings = 1,
+            .spacings = { 10 },
+            .am = {
+                .stereo = true,
+            }
+        }
+    }
+};
+
+struct stub_radio_tuner {
+    struct radio_tuner interface;
+    struct stub_radio_device *dev;
+    radio_callback_t callback;
+    void *cookie;
+    radio_hal_band_config_t config;
+    radio_program_info_t program;
+    bool audio;
+    pthread_t callback_thread;
+    pthread_mutex_t lock;
+    pthread_cond_t  cond;
+    struct listnode command_list;
+};
+
+struct stub_radio_device {
+    struct radio_hw_device device;
+    struct stub_radio_tuner *tuner;
+    pthread_mutex_t lock;
+};
+
+
+typedef enum {
+    CMD_EXIT,
+    CMD_CONFIG,
+    CMD_STEP,
+    CMD_SCAN,
+    CMD_TUNE,
+    CMD_CANCEL,
+    CMD_METADATA,
+} thread_cmd_type_t;
+
+struct thread_command {
+    struct listnode node;
+    thread_cmd_type_t type;
+    struct timespec ts;
+    union {
+        unsigned int param;
+        radio_hal_band_config_t config;
+    };
+};
+
+/* must be called with out->lock locked */
+static int send_command_l(struct stub_radio_tuner *tuner,
+                          thread_cmd_type_t type,
+                          unsigned int delay_ms,
+                          void *param)
+{
+    struct thread_command *cmd = (struct thread_command *)calloc(1, sizeof(struct thread_command));
+    struct timespec ts;
+
+    if (cmd == NULL)
+        return -ENOMEM;
+
+    ALOGV("%s %d delay_ms %d", __func__, type, delay_ms);
+
+    cmd->type = type;
+    if (param != NULL) {
+        if (cmd->type == CMD_CONFIG) {
+            cmd->config = *(radio_hal_band_config_t *)param;
+            ALOGV("%s CMD_CONFIG type %d", __func__, cmd->config.type);
+        } else
+            cmd->param = *(unsigned int *)param;
+    }
+
+    clock_gettime(CLOCK_REALTIME, &ts);
+
+    ts.tv_sec  += delay_ms/1000;
+    ts.tv_nsec += (delay_ms%1000) * 1000000;
+    if (ts.tv_nsec >= 1000000000) {
+        ts.tv_nsec -= 1000000000;
+        ts.tv_sec  += 1;
+    }
+    cmd->ts = ts;
+    list_add_tail(&tuner->command_list, &cmd->node);
+    pthread_cond_signal(&tuner->cond);
+    return 0;
+}
+
+#define BITMAP_FILE_PATH "/data/misc/media/android.png"
+
+static int add_bitmap_metadata(radio_metadata_t **metadata, radio_metadata_key_t key,
+                               const char *source)
+{
+    int fd;
+    ssize_t ret = 0;
+    struct stat info;
+    void *data = NULL;
+    size_t size;
+
+    fd = open(source, O_RDONLY);
+    if (fd < 0)
+        return -EPIPE;
+
+    fstat(fd, &info);
+    size = info.st_size;
+    data = malloc(size);
+    if (data == NULL) {
+        ret = -ENOMEM;
+        goto exit;
+    }
+    ret = read(fd, data, size);
+    if (ret < 0)
+        goto exit;
+    ret = radio_metadata_add_raw(metadata, key, (const unsigned char *)data, size);
+
+exit:
+    close(fd);
+    free(data);
+    ALOGE_IF(ret != 0, "%s error %d", __func__, ret);
+    return (int)ret;
+}
+
+static int prepare_metadata(struct stub_radio_tuner *tuner,
+                            radio_metadata_t **metadata, bool program)
+{
+    int ret = 0;
+    char text[RADIO_STRING_LEN_MAX];
+    struct timespec ts;
+
+    if (metadata == NULL)
+        return -EINVAL;
+
+    if (*metadata != NULL)
+        radio_metadata_deallocate(*metadata);
+
+    *metadata = NULL;
+
+    ret = radio_metadata_allocate(metadata, tuner->program.channel, 0);
+    if (ret != 0)
+        return ret;
+
+    if (program) {
+        ret = radio_metadata_add_int(metadata, RADIO_METADATA_KEY_RBDS_PTY, 5);
+        if (ret != 0)
+            goto exit;
+        ret = radio_metadata_add_text(metadata, RADIO_METADATA_KEY_RDS_PS, "RockBand");
+        if (ret != 0)
+            goto exit;
+        ret = add_bitmap_metadata(metadata, RADIO_METADATA_KEY_ICON, BITMAP_FILE_PATH);
+        if (ret != 0)
+            goto exit;
+    } else {
+        ret = add_bitmap_metadata(metadata, RADIO_METADATA_KEY_ART, BITMAP_FILE_PATH);
+        if (ret != 0)
+            goto exit;
+    }
+
+    clock_gettime(CLOCK_REALTIME, &ts);
+    snprintf(text, RADIO_STRING_LEN_MAX, "Artist %ld", ts.tv_sec % 10);
+    ret = radio_metadata_add_text(metadata, RADIO_METADATA_KEY_ARTIST, text);
+    if (ret != 0)
+        goto exit;
+
+    snprintf(text, RADIO_STRING_LEN_MAX, "Song %ld", ts.tv_nsec % 10);
+    ret = radio_metadata_add_text(metadata, RADIO_METADATA_KEY_TITLE, text);
+    if (ret != 0)
+        goto exit;
+
+    return 0;
+
+exit:
+    radio_metadata_deallocate(*metadata);
+    *metadata = NULL;
+    return ret;
+}
+
+static void *callback_thread_loop(void *context)
+{
+    struct stub_radio_tuner *tuner = (struct stub_radio_tuner *)context;
+    struct timespec ts = {0, 0};
+
+    ALOGI("%s", __func__);
+
+    prctl(PR_SET_NAME, (unsigned long)"sound trigger callback", 0, 0, 0);
+
+    pthread_mutex_lock(&tuner->lock);
+
+    while (true) {
+        struct thread_command *cmd = NULL;
+        struct listnode *item;
+        struct listnode *tmp;
+        struct timespec cur_ts;
+        bool got_cancel = false;
+        bool send_meta_data = false;
+
+        if (list_empty(&tuner->command_list) || ts.tv_sec != 0) {
+            ALOGV("%s SLEEPING", __func__);
+            if (ts.tv_sec != 0) {
+                ALOGV("%s SLEEPING with timeout", __func__);
+                pthread_cond_timedwait(&tuner->cond, &tuner->lock, &ts);
+            } else {
+                ALOGV("%s SLEEPING forever", __func__);
+                pthread_cond_wait(&tuner->cond, &tuner->lock);
+            }
+            ts.tv_sec = 0;
+            ALOGV("%s RUNNING", __func__);
+        }
+
+        clock_gettime(CLOCK_REALTIME, &cur_ts);
+
+        list_for_each_safe(item, tmp, &tuner->command_list) {
+            cmd = node_to_item(item, struct thread_command, node);
+
+            if (got_cancel && (cmd->type == CMD_STEP || cmd->type == CMD_SCAN ||
+                    cmd->type == CMD_TUNE || cmd->type == CMD_METADATA)) {
+                 list_remove(item);
+                 free(cmd);
+                 continue;
+            }
+
+            if ((cmd->ts.tv_sec < cur_ts.tv_sec) ||
+                    ((cmd->ts.tv_sec == cur_ts.tv_sec) && (cmd->ts.tv_nsec < cur_ts.tv_nsec))) {
+                radio_hal_event_t event;
+                radio_metadata_t *metadata = NULL;
+
+                event.type = RADIO_EVENT_HW_FAILURE;
+                list_remove(item);
+
+                ALOGV("%s processing command %d time %ld.%ld", __func__, cmd->type, cmd->ts.tv_sec,
+                      cmd->ts.tv_nsec);
+
+                switch (cmd->type) {
+                default:
+                case CMD_EXIT:
+                    free(cmd);
+                    goto exit;
+
+                case CMD_CONFIG: {
+                    tuner->config = cmd->config;
+                    event.type = RADIO_EVENT_CONFIG;
+                    event.config = tuner->config;
+                    ALOGV("%s CMD_CONFIG type %d low %d up %d",
+                          __func__, tuner->config.type,
+                          tuner->config.lower_limit, tuner->config.upper_limit);
+                    if (tuner->config.type == RADIO_BAND_FM) {
+                        ALOGV("  - stereo %d\n  - rds %d\n  - ta %d\n  - af %d",
+                              tuner->config.fm.stereo, tuner->config.fm.rds,
+                              tuner->config.fm.ta, tuner->config.fm.af);
+                    } else {
+                        ALOGV("  - stereo %d", tuner->config.am.stereo);
+                    }
+                } break;
+
+                case CMD_STEP: {
+                    int frequency;
+                    frequency = tuner->program.channel;
+                    if (cmd->param == RADIO_DIRECTION_UP) {
+                        frequency += tuner->config.spacings[0];
+                    } else {
+                        frequency -= tuner->config.spacings[0];
+                    }
+                    if (frequency > (int)tuner->config.upper_limit) {
+                        frequency = tuner->config.lower_limit;
+                    }
+                    if (frequency < (int)tuner->config.lower_limit) {
+                        frequency = tuner->config.upper_limit;
+                    }
+                    tuner->program.channel = frequency;
+                    tuner->program.tuned  = (frequency / (tuner->config.spacings[0] * 5)) % 2;
+                    tuner->program.signal_strength = 20;
+                    if (tuner->config.type == RADIO_BAND_FM)
+                        tuner->program.stereo = false;
+                    else
+                        tuner->program.stereo = false;
+
+                    event.type = RADIO_EVENT_TUNED;
+                    event.info = tuner->program;
+                } break;
+
+                case CMD_SCAN: {
+                    int frequency;
+                    frequency = tuner->program.channel;
+                    if (cmd->param == RADIO_DIRECTION_UP) {
+                        frequency += tuner->config.spacings[0] * 25;
+                    } else {
+                        frequency -= tuner->config.spacings[0] * 25;
+                    }
+                    if (frequency > (int)tuner->config.upper_limit) {
+                        frequency = tuner->config.lower_limit;
+                    }
+                    if (frequency < (int)tuner->config.lower_limit) {
+                        frequency = tuner->config.upper_limit;
+                    }
+                    tuner->program.channel = (unsigned int)frequency;
+                    tuner->program.tuned  = true;
+                    if (tuner->config.type == RADIO_BAND_FM)
+                        tuner->program.stereo = tuner->config.fm.stereo;
+                    else
+                        tuner->program.stereo = tuner->config.am.stereo;
+                    tuner->program.signal_strength = 50;
+
+                    event.type = RADIO_EVENT_TUNED;
+                    event.info = tuner->program;
+                    send_meta_data = true;
+                } break;
+
+                case CMD_TUNE: {
+                    tuner->program.channel = cmd->param;
+                    tuner->program.tuned  = (tuner->program.channel /
+                                                (tuner->config.spacings[0] * 5)) % 2;
+
+                    if (tuner->program.tuned) {
+                        prepare_metadata(tuner, &tuner->program.metadata, true);
+                        send_command_l(tuner, CMD_METADATA, 5000, NULL);
+                    } else {
+                        if (tuner->program.metadata != NULL)
+                            radio_metadata_deallocate(tuner->program.metadata);
+                        tuner->program.metadata = NULL;
+                    }
+                    tuner->program.signal_strength = 100;
+                    if (tuner->config.type == RADIO_BAND_FM)
+                        tuner->program.stereo =
+                                tuner->program.tuned ? tuner->config.fm.stereo : false;
+                    else
+                        tuner->program.stereo =
+                            tuner->program.tuned ? tuner->config.am.stereo : false;
+                    event.type = RADIO_EVENT_TUNED;
+                    event.info = tuner->program;
+                    send_meta_data = true;
+                } break;
+
+                case CMD_METADATA: {
+                    int ret = prepare_metadata(tuner, &metadata, false);
+                    if (ret == 0) {
+                        event.type = RADIO_EVENT_METADATA;
+                        event.metadata = metadata;
+                    }
+                    send_meta_data = true;
+                } break;
+
+                case CMD_CANCEL: {
+                    got_cancel = true;
+                } break;
+
+                }
+                if (event.type != RADIO_EVENT_HW_FAILURE && tuner->callback != NULL) {
+                    pthread_mutex_unlock(&tuner->lock);
+                    tuner->callback(&event, tuner->cookie);
+                    pthread_mutex_lock(&tuner->lock);
+                    if (event.type == RADIO_EVENT_METADATA && metadata != NULL) {
+                        radio_metadata_deallocate(metadata);
+                        metadata = NULL;
+                    }
+                }
+                ALOGV("%s processed command %d", __func__, cmd->type);
+                free(cmd);
+            } else {
+                if ((ts.tv_sec == 0) ||
+                        (cmd->ts.tv_sec < ts.tv_sec) ||
+                        ((cmd->ts.tv_sec == ts.tv_sec) && (cmd->ts.tv_nsec < ts.tv_nsec))) {
+                    ts.tv_sec = cmd->ts.tv_sec;
+                    ts.tv_nsec = cmd->ts.tv_nsec;
+                }
+            }
+        }
+
+        if (send_meta_data) {
+            list_for_each_safe(item, tmp, &tuner->command_list) {
+                cmd = node_to_item(item, struct thread_command, node);
+                if (cmd->type == CMD_METADATA) {
+                    list_remove(item);
+                    free(cmd);
+                }
+            }
+            send_command_l(tuner, CMD_METADATA, 100, NULL);
+        }
+    }
+
+exit:
+    pthread_mutex_unlock(&tuner->lock);
+
+    ALOGV("%s Exiting", __func__);
+
+    return NULL;
+}
+
+
+static int tuner_set_configuration(const struct radio_tuner *tuner,
+                         const radio_hal_band_config_t *config)
+{
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+    int status = 0;
+
+    ALOGI("%s stub_tuner %p", __func__, stub_tuner);
+    pthread_mutex_lock(&stub_tuner->lock);
+    if (config == NULL) {
+        status = -EINVAL;
+        goto exit;
+    }
+    send_command_l(stub_tuner, CMD_CANCEL, 0, NULL);
+    send_command_l(stub_tuner, CMD_CONFIG, 500, (void *)config);
+
+exit:
+    pthread_mutex_unlock(&stub_tuner->lock);
+    return status;
+}
+
+static int tuner_get_configuration(const struct radio_tuner *tuner,
+                         radio_hal_band_config_t *config)
+{
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+    int status = 0;
+    struct listnode *item;
+    radio_hal_band_config_t *src_config;
+
+    ALOGI("%s stub_tuner %p", __func__, stub_tuner);
+    pthread_mutex_lock(&stub_tuner->lock);
+    src_config = &stub_tuner->config;
+
+    if (config == NULL) {
+        status = -EINVAL;
+        goto exit;
+    }
+    list_for_each(item, &stub_tuner->command_list) {
+        struct thread_command *cmd = node_to_item(item, struct thread_command, node);
+        if (cmd->type == CMD_CONFIG) {
+            src_config = &cmd->config;
+        }
+    }
+    *config = *src_config;
+
+exit:
+    pthread_mutex_unlock(&stub_tuner->lock);
+    return status;
+}
+
+static int tuner_step(const struct radio_tuner *tuner,
+                     radio_direction_t direction, bool skip_sub_channel)
+{
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+
+    ALOGI("%s stub_tuner %p direction %d, skip_sub_channel %d",
+          __func__, stub_tuner, direction, skip_sub_channel);
+
+    pthread_mutex_lock(&stub_tuner->lock);
+    send_command_l(stub_tuner, CMD_STEP, 20, &direction);
+    pthread_mutex_unlock(&stub_tuner->lock);
+    return 0;
+}
+
+static int tuner_scan(const struct radio_tuner *tuner,
+                     radio_direction_t direction, bool skip_sub_channel)
+{
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+
+    ALOGI("%s stub_tuner %p direction %d, skip_sub_channel %d",
+          __func__, stub_tuner, direction, skip_sub_channel);
+
+    pthread_mutex_lock(&stub_tuner->lock);
+    send_command_l(stub_tuner, CMD_SCAN, 200, &direction);
+    pthread_mutex_unlock(&stub_tuner->lock);
+    return 0;
+}
+
+static int tuner_tune(const struct radio_tuner *tuner,
+                     unsigned int channel, unsigned int sub_channel)
+{
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+
+    ALOGI("%s stub_tuner %p channel %d, sub_channel %d",
+          __func__, stub_tuner, channel, sub_channel);
+
+    pthread_mutex_lock(&stub_tuner->lock);
+    if (channel < stub_tuner->config.lower_limit || channel > stub_tuner->config.upper_limit) {
+        pthread_mutex_unlock(&stub_tuner->lock);
+        ALOGI("%s channel out of range", __func__);
+        return -EINVAL;
+    }
+    send_command_l(stub_tuner, CMD_TUNE, 100, &channel);
+    pthread_mutex_unlock(&stub_tuner->lock);
+    return 0;
+}
+
+static int tuner_cancel(const struct radio_tuner *tuner)
+{
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+
+    ALOGI("%s stub_tuner %p", __func__, stub_tuner);
+
+    pthread_mutex_lock(&stub_tuner->lock);
+    send_command_l(stub_tuner, CMD_CANCEL, 0, NULL);
+    pthread_mutex_unlock(&stub_tuner->lock);
+    return 0;
+}
+
+static int tuner_get_program_information(const struct radio_tuner *tuner,
+                                        radio_program_info_t *info)
+{
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+    int status = 0;
+    radio_metadata_t *metadata;
+
+    ALOGI("%s stub_tuner %p", __func__, stub_tuner);
+    pthread_mutex_lock(&stub_tuner->lock);
+    if (info == NULL) {
+        status = -EINVAL;
+        goto exit;
+    }
+    metadata = info->metadata;
+    *info = stub_tuner->program;
+    info->metadata = metadata;
+    if (metadata != NULL && stub_tuner->program.metadata != NULL)
+        radio_metadata_add_metadata(&info->metadata, stub_tuner->program.metadata);
+
+exit:
+    pthread_mutex_unlock(&stub_tuner->lock);
+    return status;
+}
+
+static int rdev_get_properties(const struct radio_hw_device *dev,
+                                radio_hal_properties_t *properties)
+{
+    struct stub_radio_device *rdev = (struct stub_radio_device *)dev;
+
+    ALOGI("%s", __func__);
+    if (properties == NULL)
+        return -EINVAL;
+    memcpy(properties, &hw_properties, sizeof(radio_hal_properties_t));
+    return 0;
+}
+
+static int rdev_open_tuner(const struct radio_hw_device *dev,
+                          const radio_hal_band_config_t *config,
+                          bool audio,
+                          radio_callback_t callback,
+                          void *cookie,
+                          const struct radio_tuner **tuner)
+{
+    struct stub_radio_device *rdev = (struct stub_radio_device *)dev;
+    int status = 0;
+
+    ALOGI("%s rdev %p", __func__, rdev);
+    pthread_mutex_lock(&rdev->lock);
+
+    if (rdev->tuner != NULL) {
+        status = -ENOSYS;
+        goto exit;
+    }
+
+    if (config == NULL || callback == NULL || tuner == NULL) {
+        status = -EINVAL;
+        goto exit;
+    }
+
+    rdev->tuner = (struct stub_radio_tuner *)calloc(1, sizeof(struct stub_radio_tuner));
+    if (rdev->tuner == NULL) {
+        status = -ENOMEM;
+        goto exit;
+    }
+
+    rdev->tuner->interface.set_configuration = tuner_set_configuration;
+    rdev->tuner->interface.get_configuration = tuner_get_configuration;
+    rdev->tuner->interface.scan = tuner_scan;
+    rdev->tuner->interface.step = tuner_step;
+    rdev->tuner->interface.tune = tuner_tune;
+    rdev->tuner->interface.cancel = tuner_cancel;
+    rdev->tuner->interface.get_program_information = tuner_get_program_information;
+
+    rdev->tuner->audio = audio;
+    rdev->tuner->callback = callback;
+    rdev->tuner->cookie = cookie;
+
+    rdev->tuner->dev = rdev;
+
+    pthread_mutex_init(&rdev->tuner->lock, (const pthread_mutexattr_t *) NULL);
+    pthread_cond_init(&rdev->tuner->cond, (const pthread_condattr_t *) NULL);
+    pthread_create(&rdev->tuner->callback_thread, (const pthread_attr_t *) NULL,
+                        callback_thread_loop, rdev->tuner);
+    list_init(&rdev->tuner->command_list);
+
+    pthread_mutex_lock(&rdev->tuner->lock);
+    send_command_l(rdev->tuner, CMD_CONFIG, 500, (void *)config);
+    pthread_mutex_unlock(&rdev->tuner->lock);
+
+    *tuner = &rdev->tuner->interface;
+
+exit:
+    pthread_mutex_unlock(&rdev->lock);
+    ALOGI("%s DONE", __func__);
+    return status;
+}
+
+static int rdev_close_tuner(const struct radio_hw_device *dev,
+                            const struct radio_tuner *tuner)
+{
+    struct stub_radio_device *rdev = (struct stub_radio_device *)dev;
+    struct stub_radio_tuner *stub_tuner = (struct stub_radio_tuner *)tuner;
+    int status = 0;
+
+    ALOGI("%s tuner %p", __func__, tuner);
+    pthread_mutex_lock(&rdev->lock);
+
+    if (tuner == NULL) {
+        status = -EINVAL;
+        goto exit;
+    }
+
+    pthread_mutex_lock(&stub_tuner->lock);
+    stub_tuner->callback = NULL;
+    send_command_l(stub_tuner, CMD_EXIT, 0, NULL);
+    pthread_mutex_unlock(&stub_tuner->lock);
+    pthread_join(stub_tuner->callback_thread, (void **) NULL);
+
+    if (stub_tuner->program.metadata != NULL)
+        radio_metadata_deallocate(stub_tuner->program.metadata);
+
+    free(stub_tuner);
+    rdev->tuner = NULL;
+
+exit:
+    pthread_mutex_unlock(&rdev->lock);
+    return status;
+}
+
+static int rdev_close(hw_device_t *device)
+{
+    struct stub_radio_device *rdev = (struct stub_radio_device *)device;
+    if (rdev != NULL) {
+        free(rdev->tuner);
+    }
+    free(rdev);
+    return 0;
+}
+
+static int rdev_open(const hw_module_t* module, const char* name,
+                     hw_device_t** device)
+{
+    struct stub_radio_device *rdev;
+    int ret;
+
+    if (strcmp(name, RADIO_HARDWARE_DEVICE) != 0)
+        return -EINVAL;
+
+    rdev = calloc(1, sizeof(struct stub_radio_device));
+    if (!rdev)
+        return -ENOMEM;
+
+    rdev->device.common.tag = HARDWARE_DEVICE_TAG;
+    rdev->device.common.version = RADIO_DEVICE_API_VERSION_1_0;
+    rdev->device.common.module = (struct hw_module_t *) module;
+    rdev->device.common.close = rdev_close;
+    rdev->device.get_properties = rdev_get_properties;
+    rdev->device.open_tuner = rdev_open_tuner;
+    rdev->device.close_tuner = rdev_close_tuner;
+
+    pthread_mutex_init(&rdev->lock, (const pthread_mutexattr_t *) NULL);
+
+    *device = &rdev->device.common;
+
+    return 0;
+}
+
+
+static struct hw_module_methods_t hal_module_methods = {
+    .open = rdev_open,
+};
+
+struct radio_module HAL_MODULE_INFO_SYM = {
+    .common = {
+        .tag = HARDWARE_MODULE_TAG,
+        .module_api_version = RADIO_MODULE_API_VERSION_1_0,
+        .hal_api_version = HARDWARE_HAL_API_VERSION,
+        .id = RADIO_HARDWARE_MODULE_ID,
+        .name = "Stub radio HAL",
+        .author = "The Android Open Source Project",
+        .methods = &hal_module_methods,
+    },
+};
diff --git a/modules/sensors/Android.mk b/modules/sensors/Android.mk
new file mode 100644
index 0000000..94d100b
--- /dev/null
+++ b/modules/sensors/Android.mk
@@ -0,0 +1,46 @@
+#
+# Copyright (C) 2013 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+ifeq ($(USE_SENSOR_MULTI_HAL),true)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := sensors.$(TARGET_BOARD_PLATFORM)
+
+LOCAL_MODULE_RELATIVE_PATH := hw
+
+LOCAL_CFLAGS := -DLOG_TAG=\"MultiHal\"
+
+LOCAL_SRC_FILES := \
+    multihal.cpp \
+    SensorEventQueue.h \
+    SensorEventQueue.cpp \
+
+LOCAL_SHARED_LIBRARIES := \
+    libcutils \
+    libdl \
+    liblog \
+    libutils \
+
+LOCAL_STRIP_MODULE := false
+
+include $(BUILD_SHARED_LIBRARY)
+
+endif # USE_SENSOR_MULTI_HAL
+
+include $(call all-makefiles-under, $(LOCAL_PATH))
diff --git a/modules/sensors/SensorEventQueue.cpp b/modules/sensors/SensorEventQueue.cpp
new file mode 100644
index 0000000..f6144f8
--- /dev/null
+++ b/modules/sensors/SensorEventQueue.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <hardware/sensors.h>
+#include <algorithm>
+#include <pthread.h>
+#include <cutils/log.h>
+
+#include "SensorEventQueue.h"
+
+SensorEventQueue::SensorEventQueue(int capacity) {
+    mCapacity = capacity;
+
+    mStart = 0;
+    mSize = 0;
+    mData = new sensors_event_t[mCapacity];
+    pthread_cond_init(&mSpaceAvailableCondition, NULL);
+}
+
+SensorEventQueue::~SensorEventQueue() {
+    delete[] mData;
+    mData = NULL;
+    pthread_cond_destroy(&mSpaceAvailableCondition);
+}
+
+int SensorEventQueue::getWritableRegion(int requestedLength, sensors_event_t** out) {
+    if (mSize == mCapacity || requestedLength <= 0) {
+        *out = NULL;
+        return 0;
+    }
+    // Start writing after the last readable record.
+    int firstWritable = (mStart + mSize) % mCapacity;
+
+    int lastWritable = firstWritable + requestedLength - 1;
+
+    // Don't go past the end of the data array.
+    if (lastWritable > mCapacity - 1) {
+        lastWritable = mCapacity - 1;
+    }
+    // Don't go into the readable region.
+    if (firstWritable < mStart && lastWritable >= mStart) {
+        lastWritable = mStart - 1;
+    }
+    *out = &mData[firstWritable];
+    return lastWritable - firstWritable + 1;
+}
+
+void SensorEventQueue::markAsWritten(int count) {
+    mSize += count;
+}
+
+int SensorEventQueue::getSize() {
+    return mSize;
+}
+
+sensors_event_t* SensorEventQueue::peek() {
+    if (mSize == 0) return NULL;
+    return &mData[mStart];
+}
+
+void SensorEventQueue::dequeue() {
+    if (mSize == 0) return;
+    if (mSize == mCapacity) {
+        pthread_cond_broadcast(&mSpaceAvailableCondition);
+    }
+    mSize--;
+    mStart = (mStart + 1) % mCapacity;
+}
+
+// returns true if it waited, or false if it was a no-op.
+bool SensorEventQueue::waitForSpace(pthread_mutex_t* mutex) {
+    bool waited = false;
+    while (mSize == mCapacity) {
+        waited = true;
+        pthread_cond_wait(&mSpaceAvailableCondition, mutex);
+    }
+    return waited;
+}
diff --git a/modules/sensors/SensorEventQueue.h b/modules/sensors/SensorEventQueue.h
new file mode 100644
index 0000000..11e1f41
--- /dev/null
+++ b/modules/sensors/SensorEventQueue.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SENSOREVENTQUEUE_H_
+#define SENSOREVENTQUEUE_H_
+
+#include <hardware/sensors.h>
+#include <pthread.h>
+
+/*
+ * Fixed-size circular queue, with an API developed around the sensor HAL poll() method.
+ * Poll() takes a pointer to a buffer, which is written by poll() before it returns.
+ * This class can provide a pointer to a spot in its internal buffer for poll() to
+ * write to, instead of using an intermediate buffer and a memcpy.
+ *
+ * Thread safety:
+ * Reading can be done safely after grabbing the mutex lock, while poll() writing in a separate
+ * thread without a mutex lock. But there can only be one writer at a time.
+ */
+class SensorEventQueue {
+    int mCapacity;
+    int mStart; // start of readable region
+    int mSize; // number of readable items
+    sensors_event_t* mData;
+    pthread_cond_t mSpaceAvailableCondition;
+
+public:
+    SensorEventQueue(int capacity);
+    ~SensorEventQueue();
+
+    // Returns length of region, between zero and min(capacity, requestedLength). If there is any
+    // writable space, it will return a region of at least one. Because it must return
+    // a pointer to a contiguous region, it may return smaller regions as we approach the end of
+    // the data array.
+    // Only call while holding the lock.
+    // The region is not marked internally in any way. Subsequent calls may return overlapping
+    // regions. This class expects there to be exactly one writer at a time.
+    int getWritableRegion(int requestedLength, sensors_event_t** out);
+
+    // After writing to the region returned by getWritableRegion(), call this to indicate how
+    // many records were actually written.
+    // This increases size() by count.
+    // Only call while holding the lock.
+    void markAsWritten(int count);
+
+    // Gets the number of readable records.
+    // Only call while holding the lock.
+    int getSize();
+
+    // Returns pointer to the first readable record, or NULL if size() is zero.
+    // Only call this while holding the lock.
+    sensors_event_t* peek();
+
+    // This will decrease the size by one, freeing up the oldest readable event's slot for writing.
+    // Only call while holding the lock.
+    void dequeue();
+
+    // Blocks until space is available. No-op if there is already space.
+    // Returns true if it had to wait.
+    bool waitForSpace(pthread_mutex_t* mutex);
+};
+
+#endif // SENSOREVENTQUEUE_H_
diff --git a/modules/sensors/multihal.cpp b/modules/sensors/multihal.cpp
new file mode 100644
index 0000000..8330ff3
--- /dev/null
+++ b/modules/sensors/multihal.cpp
@@ -0,0 +1,668 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <hardware/sensors.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <dirent.h>
+#include <math.h>
+#include <poll.h>
+#include <pthread.h>
+#include <cutils/atomic.h>
+
+#define LOG_NDEBUG 1
+#include <cutils/log.h>
+
+#include <vector>
+#include <string>
+#include <fstream>
+#include <map>
+#include <string>
+
+#include <stdio.h>
+#include <dlfcn.h>
+#include <SensorEventQueue.h>
+
+#include <limits.h>
+#include <stdlib.h>
+
+static const char* CONFIG_FILENAME = "/system/etc/sensors/hals.conf";
+static const int MAX_CONF_LINE_LENGTH = 1024;
+
+static pthread_mutex_t init_modules_mutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_mutex_t init_sensors_mutex = PTHREAD_MUTEX_INITIALIZER;
+
+// This mutex is shared by all queues
+static pthread_mutex_t queue_mutex = PTHREAD_MUTEX_INITIALIZER;
+
+// Used to pause the multihal poll(). Broadcasted by sub-polling tasks if waiting_for_data.
+static pthread_cond_t data_available_cond = PTHREAD_COND_INITIALIZER;
+bool waiting_for_data = false;
+
+/*
+ * Vector of sub modules, whose indexes are referred to in this file as module_index.
+ */
+static std::vector<hw_module_t *> *sub_hw_modules = NULL;
+
+/*
+ * Comparable class that globally identifies a sensor, by module index and local handle.
+ * A module index is the module's index in sub_hw_modules.
+ * A local handle is the handle the sub-module assigns to a sensor.
+ */
+struct FullHandle {
+    int moduleIndex;
+    int localHandle;
+
+    bool operator<(const FullHandle &that) const {
+        if (moduleIndex < that.moduleIndex) {
+            return true;
+        }
+        if (moduleIndex > that.moduleIndex) {
+            return false;
+        }
+        return localHandle < that.localHandle;
+    }
+
+    bool operator==(const FullHandle &that) const {
+        return moduleIndex == that.moduleIndex && localHandle == that.localHandle;
+    }
+};
+
+std::map<int, FullHandle> global_to_full;
+std::map<FullHandle, int> full_to_global;
+int next_global_handle = 1;
+
+static int assign_global_handle(int module_index, int local_handle) {
+    int global_handle = next_global_handle++;
+    FullHandle full_handle;
+    full_handle.moduleIndex = module_index;
+    full_handle.localHandle = local_handle;
+    full_to_global[full_handle] = global_handle;
+    global_to_full[global_handle] = full_handle;
+    return global_handle;
+}
+
+// Returns the local handle, or -1 if it does not exist.
+static int get_local_handle(int global_handle) {
+    if (global_to_full.count(global_handle) == 0) {
+        ALOGW("Unknown global_handle %d", global_handle);
+        return -1;
+    }
+    return global_to_full[global_handle].localHandle;
+}
+
+// Returns the sub_hw_modules index of the module that contains the sensor associates with this
+// global_handle, or -1 if that global_handle does not exist.
+static int get_module_index(int global_handle) {
+    if (global_to_full.count(global_handle) == 0) {
+        ALOGW("Unknown global_handle %d", global_handle);
+        return -1;
+    }
+    FullHandle f = global_to_full[global_handle];
+    ALOGV("FullHandle for global_handle %d: moduleIndex %d, localHandle %d",
+            global_handle, f.moduleIndex, f.localHandle);
+    return f.moduleIndex;
+}
+
+// Returns the global handle for this full_handle, or -1 if the full_handle is unknown.
+static int get_global_handle(FullHandle* full_handle) {
+    int global_handle = -1;
+    if (full_to_global.count(*full_handle)) {
+        global_handle = full_to_global[*full_handle];
+    } else {
+        ALOGW("Unknown FullHandle: moduleIndex %d, localHandle %d",
+            full_handle->moduleIndex, full_handle->localHandle);
+    }
+    return global_handle;
+}
+
+static const int SENSOR_EVENT_QUEUE_CAPACITY = 20;
+
+struct TaskContext {
+  sensors_poll_device_t* device;
+  SensorEventQueue* queue;
+};
+
+void *writerTask(void* ptr) {
+    ALOGV("writerTask STARTS");
+    TaskContext* ctx = (TaskContext*)ptr;
+    sensors_poll_device_t* device = ctx->device;
+    SensorEventQueue* queue = ctx->queue;
+    sensors_event_t* buffer;
+    int eventsPolled;
+    while (1) {
+        pthread_mutex_lock(&queue_mutex);
+        if (queue->waitForSpace(&queue_mutex)) {
+            ALOGV("writerTask waited for space");
+        }
+        int bufferSize = queue->getWritableRegion(SENSOR_EVENT_QUEUE_CAPACITY, &buffer);
+        // Do blocking poll outside of lock
+        pthread_mutex_unlock(&queue_mutex);
+
+        ALOGV("writerTask before poll() - bufferSize = %d", bufferSize);
+        eventsPolled = device->poll(device, buffer, bufferSize);
+        ALOGV("writerTask poll() got %d events.", eventsPolled);
+        if (eventsPolled == 0) {
+            continue;
+        }
+        pthread_mutex_lock(&queue_mutex);
+        queue->markAsWritten(eventsPolled);
+        ALOGV("writerTask wrote %d events", eventsPolled);
+        if (waiting_for_data) {
+            ALOGV("writerTask - broadcast data_available_cond");
+            pthread_cond_broadcast(&data_available_cond);
+        }
+        pthread_mutex_unlock(&queue_mutex);
+    }
+    // never actually returns
+    return NULL;
+}
+
+/*
+ * Cache of all sensors, with original handles replaced by global handles.
+ * This will be handled to get_sensors_list() callers.
+ */
+static struct sensor_t const* global_sensors_list = NULL;
+static int global_sensors_count = -1;
+
+/*
+ * Extends a sensors_poll_device_1 by including all the sub-module's devices.
+ */
+struct sensors_poll_context_t {
+    /*
+     * This is the device that SensorDevice.cpp uses to make API calls
+     * to the multihal, which fans them out to sub-HALs.
+     */
+    sensors_poll_device_1 proxy_device; // must be first
+
+    void addSubHwDevice(struct hw_device_t*);
+
+    int activate(int handle, int enabled);
+    int setDelay(int handle, int64_t ns);
+    int poll(sensors_event_t* data, int count);
+    int batch(int handle, int flags, int64_t period_ns, int64_t timeout);
+    int flush(int handle);
+    int close();
+
+    std::vector<hw_device_t*> sub_hw_devices;
+    std::vector<SensorEventQueue*> queues;
+    std::vector<pthread_t> threads;
+    int nextReadIndex;
+
+    sensors_poll_device_t* get_v0_device_by_handle(int global_handle);
+    sensors_poll_device_1_t* get_v1_device_by_handle(int global_handle);
+    int get_device_version_by_handle(int global_handle);
+
+    void copy_event_remap_handle(sensors_event_t* src, sensors_event_t* dest, int sub_index);
+};
+
+void sensors_poll_context_t::addSubHwDevice(struct hw_device_t* sub_hw_device) {
+    ALOGV("addSubHwDevice");
+    this->sub_hw_devices.push_back(sub_hw_device);
+
+    SensorEventQueue *queue = new SensorEventQueue(SENSOR_EVENT_QUEUE_CAPACITY);
+    this->queues.push_back(queue);
+
+    TaskContext* taskContext = new TaskContext();
+    taskContext->device = (sensors_poll_device_t*) sub_hw_device;
+    taskContext->queue = queue;
+
+    pthread_t writerThread;
+    pthread_create(&writerThread, NULL, writerTask, taskContext);
+    this->threads.push_back(writerThread);
+}
+
+// Returns the device pointer, or NULL if the global handle is invalid.
+sensors_poll_device_t* sensors_poll_context_t::get_v0_device_by_handle(int global_handle) {
+    int sub_index = get_module_index(global_handle);
+    if (sub_index < 0 || sub_index >= this->sub_hw_devices.size()) {
+        return NULL;
+    }
+    return (sensors_poll_device_t*) this->sub_hw_devices[sub_index];
+}
+
+// Returns the device pointer, or NULL if the global handle is invalid.
+sensors_poll_device_1_t* sensors_poll_context_t::get_v1_device_by_handle(int global_handle) {
+    int sub_index = get_module_index(global_handle);
+    if (sub_index < 0 || sub_index >= this->sub_hw_devices.size()) {
+        return NULL;
+    }
+    return (sensors_poll_device_1_t*) this->sub_hw_devices[sub_index];
+}
+
+// Returns the device version, or -1 if the handle is invalid.
+int sensors_poll_context_t::get_device_version_by_handle(int handle) {
+    sensors_poll_device_t* v0 = this->get_v0_device_by_handle(handle);
+    if (v0) {
+        return v0->common.version;
+    } else {
+        return -1;
+    }
+}
+
+// Android L requires sensor HALs to be either 1_0 or 1_3 compliant
+#define HAL_VERSION_IS_COMPLIANT(version)  \
+    (version == SENSORS_DEVICE_API_VERSION_1_0 || version >= SENSORS_DEVICE_API_VERSION_1_3)
+
+// Returns true if HAL is compliant, false if HAL is not compliant or if handle is invalid
+static bool halIsCompliant(sensors_poll_context_t *ctx, int handle) {
+    int version = ctx->get_device_version_by_handle(handle);
+    return version != -1 && HAL_VERSION_IS_COMPLIANT(version);
+}
+
+const char *apiNumToStr(int version) {
+    switch(version) {
+    case SENSORS_DEVICE_API_VERSION_1_0:
+        return "SENSORS_DEVICE_API_VERSION_1_0";
+    case SENSORS_DEVICE_API_VERSION_1_1:
+        return "SENSORS_DEVICE_API_VERSION_1_1";
+    case SENSORS_DEVICE_API_VERSION_1_2:
+        return "SENSORS_DEVICE_API_VERSION_1_2";
+    case SENSORS_DEVICE_API_VERSION_1_3:
+        return "SENSORS_DEVICE_API_VERSION_1_3";
+    default:
+        return "UNKNOWN";
+    }
+}
+
+int sensors_poll_context_t::activate(int handle, int enabled) {
+    int retval = -EINVAL;
+    ALOGV("activate");
+    int local_handle = get_local_handle(handle);
+    sensors_poll_device_t* v0 = this->get_v0_device_by_handle(handle);
+    if (halIsCompliant(this, handle) && local_handle >= 0 && v0) {
+        retval = v0->activate(v0, local_handle, enabled);
+    } else {
+        ALOGE("IGNORING activate(enable %d) call to non-API-compliant sensor handle=%d !",
+                enabled, handle);
+    }
+    ALOGV("retval %d", retval);
+    return retval;
+}
+
+int sensors_poll_context_t::setDelay(int handle, int64_t ns) {
+    int retval = -EINVAL;
+    ALOGV("setDelay");
+    int local_handle = get_local_handle(handle);
+    sensors_poll_device_t* v0 = this->get_v0_device_by_handle(handle);
+    if (halIsCompliant(this, handle) && local_handle >= 0 && v0) {
+        retval = v0->setDelay(v0, local_handle, ns);
+    } else {
+        ALOGE("IGNORING setDelay() call for non-API-compliant sensor handle=%d !", handle);
+    }
+    ALOGV("retval %d", retval);
+    return retval;
+}
+
+void sensors_poll_context_t::copy_event_remap_handle(sensors_event_t* dest, sensors_event_t* src,
+        int sub_index) {
+    memcpy(dest, src, sizeof(struct sensors_event_t));
+    // A normal event's "sensor" field is a local handle. Convert it to a global handle.
+    // A meta-data event must have its sensor set to 0, but it has a nested event
+    // with a local handle that needs to be converted to a global handle.
+    FullHandle full_handle;
+    full_handle.moduleIndex = sub_index;
+
+    // If it's a metadata event, rewrite the inner payload, not the sensor field.
+    // If the event's sensor field is unregistered for any reason, rewrite the sensor field
+    // with a -1, instead of writing an incorrect but plausible sensor number, because
+    // get_global_handle() returns -1 for unknown FullHandles.
+    if (dest->type == SENSOR_TYPE_META_DATA) {
+        full_handle.localHandle = dest->meta_data.sensor;
+        dest->meta_data.sensor = get_global_handle(&full_handle);
+    } else {
+        full_handle.localHandle = dest->sensor;
+        dest->sensor = get_global_handle(&full_handle);
+    }
+}
+
+int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) {
+    ALOGV("poll");
+    int empties = 0;
+    int queueCount = 0;
+    int eventsRead = 0;
+
+    pthread_mutex_lock(&queue_mutex);
+    queueCount = (int)this->queues.size();
+    while (eventsRead == 0) {
+        while (empties < queueCount && eventsRead < maxReads) {
+            SensorEventQueue* queue = this->queues.at(this->nextReadIndex);
+            sensors_event_t* event = queue->peek();
+            if (event == NULL) {
+                empties++;
+            } else {
+                empties = 0;
+                this->copy_event_remap_handle(&data[eventsRead], event, nextReadIndex);
+                if (data[eventsRead].sensor == -1) {
+                    // Bad handle, do not pass corrupted event upstream !
+                    ALOGW("Dropping bad local handle event packet on the floor");
+                } else {
+                    eventsRead++;
+                }
+                queue->dequeue();
+            }
+            this->nextReadIndex = (this->nextReadIndex + 1) % queueCount;
+        }
+        if (eventsRead == 0) {
+            // The queues have been scanned and none contain data, so wait.
+            ALOGV("poll stopping to wait for data");
+            waiting_for_data = true;
+            pthread_cond_wait(&data_available_cond, &queue_mutex);
+            waiting_for_data = false;
+            empties = 0;
+        }
+    }
+    pthread_mutex_unlock(&queue_mutex);
+    ALOGV("poll returning %d events.", eventsRead);
+
+    return eventsRead;
+}
+
+int sensors_poll_context_t::batch(int handle, int flags, int64_t period_ns, int64_t timeout) {
+    ALOGV("batch");
+    int retval = -EINVAL;
+    int local_handle = get_local_handle(handle);
+    sensors_poll_device_1_t* v1 = this->get_v1_device_by_handle(handle);
+    if (halIsCompliant(this, handle) && local_handle >= 0 && v1) {
+        retval = v1->batch(v1, local_handle, flags, period_ns, timeout);
+    } else {
+        ALOGE("IGNORING batch() call to non-API-compliant sensor handle=%d !", handle);
+    }
+    ALOGV("retval %d", retval);
+    return retval;
+}
+
+int sensors_poll_context_t::flush(int handle) {
+    ALOGV("flush");
+    int retval = -EINVAL;
+    int local_handle = get_local_handle(handle);
+    sensors_poll_device_1_t* v1 = this->get_v1_device_by_handle(handle);
+    if (halIsCompliant(this, handle) && local_handle >= 0 && v1) {
+        retval = v1->flush(v1, local_handle);
+    } else {
+        ALOGE("IGNORING flush() call to non-API-compliant sensor handle=%d !", handle);
+    }
+    ALOGV("retval %d", retval);
+    return retval;
+}
+
+int sensors_poll_context_t::close() {
+    ALOGV("close");
+    for (std::vector<hw_device_t*>::iterator it = this->sub_hw_devices.begin();
+            it != this->sub_hw_devices.end(); it++) {
+        hw_device_t* dev = *it;
+        int retval = dev->close(dev);
+        ALOGV("retval %d", retval);
+    }
+    return 0;
+}
+
+
+static int device__close(struct hw_device_t *dev) {
+    sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
+    if (ctx != NULL) {
+        int retval = ctx->close();
+        delete ctx;
+    }
+    return 0;
+}
+
+static int device__activate(struct sensors_poll_device_t *dev, int handle,
+        int enabled) {
+    sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
+    return ctx->activate(handle, enabled);
+}
+
+static int device__setDelay(struct sensors_poll_device_t *dev, int handle,
+        int64_t ns) {
+    sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
+    return ctx->setDelay(handle, ns);
+}
+
+static int device__poll(struct sensors_poll_device_t *dev, sensors_event_t* data,
+        int count) {
+    sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
+    return ctx->poll(data, count);
+}
+
+static int device__batch(struct sensors_poll_device_1 *dev, int handle,
+        int flags, int64_t period_ns, int64_t timeout) {
+    sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
+    return ctx->batch(handle, flags, period_ns, timeout);
+}
+
+static int device__flush(struct sensors_poll_device_1 *dev, int handle) {
+    sensors_poll_context_t* ctx = (sensors_poll_context_t*) dev;
+    return ctx->flush(handle);
+}
+
+static int open_sensors(const struct hw_module_t* module, const char* name,
+        struct hw_device_t** device);
+
+static bool starts_with(const char* s, const char* prefix) {
+    if (s == NULL || prefix == NULL) {
+        return false;
+    }
+    size_t s_size = strlen(s);
+    size_t prefix_size = strlen(prefix);
+    return s_size >= prefix_size && strncmp(s, prefix, prefix_size) == 0;
+}
+
+/*
+ * Adds valid paths from the config file to the vector passed in.
+ * The vector must not be null.
+ */
+static void get_so_paths(std::vector<std::string> *so_paths) {
+    std::string line;
+    std::ifstream conf_file(CONFIG_FILENAME);
+
+    if(!conf_file) {
+        ALOGW("No multihal config file found at %s", CONFIG_FILENAME);
+        return;
+    }
+    ALOGV("Multihal config file found at %s", CONFIG_FILENAME);
+    while (std::getline(conf_file, line)) {
+        ALOGV("config file line: '%s'", line.c_str());
+        so_paths->push_back(line);
+    }
+}
+
+/*
+ * Ensures that the sub-module array is initialized.
+ * This can be first called from get_sensors_list or from open_sensors.
+ */
+static void lazy_init_modules() {
+    pthread_mutex_lock(&init_modules_mutex);
+    if (sub_hw_modules != NULL) {
+        pthread_mutex_unlock(&init_modules_mutex);
+        return;
+    }
+    std::vector<std::string> *so_paths = new std::vector<std::string>();
+    get_so_paths(so_paths);
+
+    // dlopen the module files and cache their module symbols in sub_hw_modules
+    sub_hw_modules = new std::vector<hw_module_t *>();
+    dlerror(); // clear any old errors
+    const char* sym = HAL_MODULE_INFO_SYM_AS_STR;
+    for (std::vector<std::string>::iterator it = so_paths->begin(); it != so_paths->end(); it++) {
+        const char* path = it->c_str();
+        void* lib_handle = dlopen(path, RTLD_LAZY);
+        if (lib_handle == NULL) {
+            ALOGW("dlerror(): %s", dlerror());
+        } else {
+            ALOGI("Loaded library from %s", path);
+            ALOGV("Opening symbol \"%s\"", sym);
+            // clear old errors
+            dlerror();
+            struct hw_module_t* module = (hw_module_t*) dlsym(lib_handle, sym);
+            const char* error;
+            if ((error = dlerror()) != NULL) {
+                ALOGW("Error calling dlsym: %s", error);
+            } else if (module == NULL) {
+                ALOGW("module == NULL");
+            } else {
+                ALOGV("Loaded symbols from \"%s\"", sym);
+                sub_hw_modules->push_back(module);
+            }
+        }
+    }
+    pthread_mutex_unlock(&init_modules_mutex);
+}
+
+/*
+ * Lazy-initializes global_sensors_count, global_sensors_list, and module_sensor_handles.
+ */
+static void lazy_init_sensors_list() {
+    ALOGV("lazy_init_sensors_list");
+    pthread_mutex_lock(&init_sensors_mutex);
+    if (global_sensors_list != NULL) {
+        // already initialized
+        pthread_mutex_unlock(&init_sensors_mutex);
+        ALOGV("lazy_init_sensors_list - early return");
+        return;
+    }
+
+    ALOGV("lazy_init_sensors_list needs to do work");
+    lazy_init_modules();
+
+    // Count all the sensors, then allocate an array of blanks.
+    global_sensors_count = 0;
+    const struct sensor_t *subhal_sensors_list;
+    for (std::vector<hw_module_t*>::iterator it = sub_hw_modules->begin();
+            it != sub_hw_modules->end(); it++) {
+        struct sensors_module_t *module = (struct sensors_module_t*) *it;
+        global_sensors_count += module->get_sensors_list(module, &subhal_sensors_list);
+        ALOGV("increased global_sensors_count to %d", global_sensors_count);
+    }
+
+    // The global_sensors_list is full of consts.
+    // Manipulate this non-const list, and point the const one to it when we're done.
+    sensor_t* mutable_sensor_list = new sensor_t[global_sensors_count];
+
+    // index of the next sensor to set in mutable_sensor_list
+    int mutable_sensor_index = 0;
+    int module_index = 0;
+
+    for (std::vector<hw_module_t*>::iterator it = sub_hw_modules->begin();
+            it != sub_hw_modules->end(); it++) {
+        hw_module_t *hw_module = *it;
+        ALOGV("examine one module");
+        // Read the sub-module's sensor list.
+        struct sensors_module_t *module = (struct sensors_module_t*) hw_module;
+        int module_sensor_count = module->get_sensors_list(module, &subhal_sensors_list);
+        ALOGV("the module has %d sensors", module_sensor_count);
+
+        // Copy the HAL's sensor list into global_sensors_list,
+        // with the handle changed to be a global handle.
+        for (int i = 0; i < module_sensor_count; i++) {
+            ALOGV("examining one sensor");
+            const struct sensor_t *local_sensor = &subhal_sensors_list[i];
+            int local_handle = local_sensor->handle;
+            memcpy(&mutable_sensor_list[mutable_sensor_index], local_sensor,
+                sizeof(struct sensor_t));
+
+            // Overwrite the global version's handle with a global handle.
+            int global_handle = assign_global_handle(module_index, local_handle);
+
+            mutable_sensor_list[mutable_sensor_index].handle = global_handle;
+            ALOGV("module_index %d, local_handle %d, global_handle %d",
+                    module_index, local_handle, global_handle);
+
+            mutable_sensor_index++;
+        }
+        module_index++;
+    }
+    // Set the const static global_sensors_list to the mutable one allocated by this function.
+    global_sensors_list = mutable_sensor_list;
+
+    pthread_mutex_unlock(&init_sensors_mutex);
+    ALOGV("end lazy_init_sensors_list");
+}
+
+static int module__get_sensors_list(__unused struct sensors_module_t* module,
+        struct sensor_t const** list) {
+    ALOGV("module__get_sensors_list start");
+    lazy_init_sensors_list();
+    *list = global_sensors_list;
+    ALOGV("global_sensors_count: %d", global_sensors_count);
+    for (int i = 0; i < global_sensors_count; i++) {
+        ALOGV("sensor type: %d", global_sensors_list[i].type);
+    }
+    return global_sensors_count;
+}
+
+static struct hw_module_methods_t sensors_module_methods = {
+    open : open_sensors
+};
+
+struct sensors_module_t HAL_MODULE_INFO_SYM = {
+    common :{
+        tag : HARDWARE_MODULE_TAG,
+        version_major : 1,
+        version_minor : 1,
+        id : SENSORS_HARDWARE_MODULE_ID,
+        name : "MultiHal Sensor Module",
+        author : "Google, Inc",
+        methods : &sensors_module_methods,
+        dso : NULL,
+        reserved : {0},
+    },
+    get_sensors_list : module__get_sensors_list
+};
+
+static int open_sensors(const struct hw_module_t* hw_module, const char* name,
+        struct hw_device_t** hw_device_out) {
+    ALOGV("open_sensors begin...");
+
+    lazy_init_modules();
+
+    // Create proxy device, to return later.
+    sensors_poll_context_t *dev = new sensors_poll_context_t();
+    memset(dev, 0, sizeof(sensors_poll_device_1_t));
+    dev->proxy_device.common.tag = HARDWARE_DEVICE_TAG;
+    dev->proxy_device.common.version = SENSORS_DEVICE_API_VERSION_1_3;
+    dev->proxy_device.common.module = const_cast<hw_module_t*>(hw_module);
+    dev->proxy_device.common.close = device__close;
+    dev->proxy_device.activate = device__activate;
+    dev->proxy_device.setDelay = device__setDelay;
+    dev->proxy_device.poll = device__poll;
+    dev->proxy_device.batch = device__batch;
+    dev->proxy_device.flush = device__flush;
+
+    dev->nextReadIndex = 0;
+
+    // Open() the subhal modules. Remember their devices in a vector parallel to sub_hw_modules.
+    for (std::vector<hw_module_t*>::iterator it = sub_hw_modules->begin();
+            it != sub_hw_modules->end(); it++) {
+        sensors_module_t *sensors_module = (sensors_module_t*) *it;
+        struct hw_device_t* sub_hw_device;
+        int sub_open_result = sensors_module->common.methods->open(*it, name, &sub_hw_device);
+        if (!sub_open_result) {
+            if (!HAL_VERSION_IS_COMPLIANT(sub_hw_device->version)) {
+                ALOGE("SENSORS_DEVICE_API_VERSION_1_3 is required for all sensor HALs");
+                ALOGE("This HAL reports non-compliant API level : %s",
+                        apiNumToStr(sub_hw_device->version));
+                ALOGE("Sensors belonging to this HAL will get ignored !");
+            }
+            dev->addSubHwDevice(sub_hw_device);
+        }
+    }
+
+    // Prepare the output param and return
+    *hw_device_out = &dev->proxy_device.common;
+    ALOGV("...open_sensors end");
+    return 0;
+}
diff --git a/modules/sensors/tests/Android.mk b/modules/sensors/tests/Android.mk
new file mode 100644
index 0000000..010bb90
--- /dev/null
+++ b/modules/sensors/tests/Android.mk
@@ -0,0 +1,17 @@
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES := \
+	SensorEventQueue_test.cpp
+
+#LOCAL_CFLAGS := -g
+LOCAL_MODULE := sensorstests
+
+LOCAL_STATIC_LIBRARIES := libcutils libutils
+
+LOCAL_C_INCLUDES := $(LOCAL_PATH)/.. bionic
+
+LOCAL_LDLIBS += -lpthread
+
+include $(BUILD_HOST_EXECUTABLE)
diff --git a/modules/sensors/tests/SensorEventQueue_test.cpp b/modules/sensors/tests/SensorEventQueue_test.cpp
new file mode 100644
index 0000000..3218bb9
--- /dev/null
+++ b/modules/sensors/tests/SensorEventQueue_test.cpp
@@ -0,0 +1,199 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <hardware/sensors.h>
+#include <pthread.h>
+#include <cutils/atomic.h>
+
+#include "SensorEventQueue.cpp"
+
+// Unit tests for the SensorEventQueue.
+
+// Run it like this:
+//
+// make sensorstests -j32 && \
+// out/host/linux-x86/obj/EXECUTABLES/sensorstests_intermediates/sensorstests
+
+bool checkWritableBufferSize(SensorEventQueue* queue, int requested, int expected) {
+    sensors_event_t* buffer;
+    int actual = queue->getWritableRegion(requested, &buffer);
+    if (actual != expected) {
+        printf("Expected buffer size was %d; actual was %d\n", expected, actual);
+        return false;
+    }
+    return true;
+}
+
+bool checkSize(SensorEventQueue* queue, int expected) {
+    int actual = queue->getSize();
+    if (actual != expected) {
+        printf("Expected queue size was %d; actual was %d\n", expected, actual);
+        return false;
+    }
+    return true;
+}
+
+bool checkInt(char* msg, int expected, int actual) {
+    if (actual != expected) {
+        printf("%s; expected %d; actual was %d\n", msg, expected, actual);
+        return false;
+    }
+    return true;
+}
+
+bool testSimpleWriteSizeCounts() {
+    printf("testSimpleWriteSizeCounts\n");
+    SensorEventQueue* queue = new SensorEventQueue(10);
+    if (!checkSize(queue, 0)) return false;
+    if (!checkWritableBufferSize(queue, 11, 10)) return false;
+    if (!checkWritableBufferSize(queue, 10, 10)) return false;
+    if (!checkWritableBufferSize(queue, 9, 9)) return false;
+
+    queue->markAsWritten(7);
+    if (!checkSize(queue, 7)) return false;
+    if (!checkWritableBufferSize(queue, 4, 3)) return false;
+    if (!checkWritableBufferSize(queue, 3, 3)) return false;
+    if (!checkWritableBufferSize(queue, 2, 2)) return false;
+
+    queue->markAsWritten(3);
+    if (!checkSize(queue, 10)) return false;
+    if (!checkWritableBufferSize(queue, 1, 0)) return false;
+
+    printf("passed\n");
+    return true;
+}
+
+bool testWrappingWriteSizeCounts() {
+    printf("testWrappingWriteSizeCounts\n");
+    SensorEventQueue* queue = new SensorEventQueue(10);
+    queue->markAsWritten(9);
+    if (!checkSize(queue, 9)) return false;
+
+    // dequeue from the front
+    queue->dequeue();
+    queue->dequeue();
+    if (!checkSize(queue, 7)) return false;
+    if (!checkWritableBufferSize(queue, 100, 1)) return false;
+
+    // Write all the way to the end.
+    queue->markAsWritten(1);
+    if (!checkSize(queue, 8)) return false;
+    // Now the two free spots in the front are available.
+    if (!checkWritableBufferSize(queue, 100, 2)) return false;
+
+    // Fill the queue again
+    queue->markAsWritten(2);
+    if (!checkSize(queue, 10)) return false;
+
+    printf("passed\n");
+    return true;
+}
+
+
+
+struct TaskContext {
+  bool success;
+  SensorEventQueue* queue;
+};
+
+static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t dataAvailableCond = PTHREAD_COND_INITIALIZER;
+
+int FULL_QUEUE_CAPACITY = 5;
+int FULL_QUEUE_EVENT_COUNT = 31;
+
+void *fullQueueWriterTask(void* ptr) {
+    TaskContext* ctx = (TaskContext*)ptr;
+    SensorEventQueue* queue = ctx->queue;
+    ctx->success = true;
+    int totalWaits = 0;
+    int totalWrites = 0;
+    sensors_event_t* buffer;
+
+    while (totalWrites < FULL_QUEUE_EVENT_COUNT) {
+        pthread_mutex_lock(&mutex);
+        if (queue->waitForSpace(&mutex)) {
+            totalWaits++;
+            printf(".");
+        }
+        int writableSize = queue->getWritableRegion(FULL_QUEUE_CAPACITY, &buffer);
+        queue->markAsWritten(writableSize);
+        totalWrites += writableSize;
+        for (int i = 0; i < writableSize; i++) {
+            printf("w");
+        }
+        pthread_cond_broadcast(&dataAvailableCond);
+        pthread_mutex_unlock(&mutex);
+    }
+    printf("\n");
+
+    ctx->success =
+            checkInt("totalWrites", FULL_QUEUE_EVENT_COUNT, totalWrites) &&
+            checkInt("totalWaits", FULL_QUEUE_EVENT_COUNT - FULL_QUEUE_CAPACITY, totalWaits);
+    return NULL;
+}
+
+bool fullQueueReaderShouldRead(int queueSize, int totalReads) {
+    if (queueSize == 0) {
+        return false;
+    }
+    int totalWrites = totalReads + queueSize;
+    return queueSize == FULL_QUEUE_CAPACITY || totalWrites == FULL_QUEUE_EVENT_COUNT;
+}
+
+void* fullQueueReaderTask(void* ptr) {
+    TaskContext* ctx = (TaskContext*)ptr;
+    SensorEventQueue* queue = ctx->queue;
+    int totalReads = 0;
+    while (totalReads < FULL_QUEUE_EVENT_COUNT) {
+        pthread_mutex_lock(&mutex);
+        // Only read if there are events,
+        // and either the queue is full, or if we're reading the last few events.
+        while (!fullQueueReaderShouldRead(queue->getSize(), totalReads)) {
+            pthread_cond_wait(&dataAvailableCond, &mutex);
+        }
+        queue->dequeue();
+        totalReads++;
+        printf("r");
+        pthread_mutex_unlock(&mutex);
+    }
+    printf("\n");
+    ctx->success = ctx->success && checkInt("totalreads", FULL_QUEUE_EVENT_COUNT, totalReads);
+    return NULL;
+}
+
+// Test internal queue-full waiting and broadcasting.
+bool testFullQueueIo() {
+    printf("testFullQueueIo\n");
+    SensorEventQueue* queue = new SensorEventQueue(FULL_QUEUE_CAPACITY);
+
+    TaskContext readerCtx;
+    readerCtx.success = true;
+    readerCtx.queue = queue;
+
+    TaskContext writerCtx;
+    writerCtx.success = true;
+    writerCtx.queue = queue;
+
+    pthread_t writer, reader;
+    pthread_create(&reader, NULL, fullQueueReaderTask, &readerCtx);
+    pthread_create(&writer, NULL, fullQueueWriterTask, &writerCtx);
+
+    pthread_join(writer, NULL);
+    pthread_join(reader, NULL);
+
+    if (!readerCtx.success || !writerCtx.success) return false;
+    printf("passed\n");
+    return true;
+}
+
+
+int main(int argc, char **argv) {
+    if (testSimpleWriteSizeCounts() &&
+            testWrappingWriteSizeCounts() &&
+            testFullQueueIo()) {
+        printf("ALL PASSED\n");
+    } else {
+        printf("SOMETHING FAILED\n");
+    }
+    return EXIT_SUCCESS;
+}
diff --git a/modules/soundtrigger/Android.mk b/modules/soundtrigger/Android.mk
new file mode 100644
index 0000000..325980c
--- /dev/null
+++ b/modules/soundtrigger/Android.mk
@@ -0,0 +1,27 @@
+# Copyright (C) 2011 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+# Stub sound_trigger HAL module, used for tests
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := sound_trigger.stub.default
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_SRC_FILES := sound_trigger_hw.c
+LOCAL_SHARED_LIBRARIES := liblog libcutils
+LOCAL_MODULE_TAGS := optional
+LOCAL_32_BIT_ONLY := true
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/soundtrigger/sound_trigger_hw.c b/modules/soundtrigger/sound_trigger_hw.c
new file mode 100644
index 0000000..e7f9baf
--- /dev/null
+++ b/modules/soundtrigger/sound_trigger_hw.c
@@ -0,0 +1,296 @@
+/*
+ * Copyright (C) 2011 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "sound_trigger_hw_default"
+/*#define LOG_NDEBUG 0*/
+
+#include <errno.h>
+#include <pthread.h>
+#include <sys/prctl.h>
+#include <cutils/log.h>
+
+#include <hardware/hardware.h>
+#include <system/sound_trigger.h>
+#include <hardware/sound_trigger.h>
+
+static const struct sound_trigger_properties hw_properties = {
+        "The Android Open Source Project", // implementor
+        "Sound Trigger stub HAL", // description
+        1, // version
+        { 0xed7a7d60, 0xc65e, 0x11e3, 0x9be4, { 0x00, 0x02, 0xa5, 0xd5, 0xc5, 0x1b } }, // uuid
+        1, // max_sound_models
+        1, // max_key_phrases
+        1, // max_users
+        RECOGNITION_MODE_VOICE_TRIGGER, // recognition_modes
+        false, // capture_transition
+        0, // max_buffer_ms
+        false, // concurrent_capture
+        false, // trigger_in_event
+        0 // power_consumption_mw
+};
+
+struct stub_sound_trigger_device {
+    struct sound_trigger_hw_device device;
+    sound_model_handle_t model_handle;
+    recognition_callback_t recognition_callback;
+    void *recognition_cookie;
+    sound_model_callback_t sound_model_callback;
+    void *sound_model_cookie;
+    pthread_t callback_thread;
+    pthread_mutex_t lock;
+    pthread_cond_t  cond;
+};
+
+
+static void *callback_thread_loop(void *context)
+{
+    struct stub_sound_trigger_device *stdev = (struct stub_sound_trigger_device *)context;
+    ALOGI("%s", __func__);
+
+    prctl(PR_SET_NAME, (unsigned long)"sound trigger callback", 0, 0, 0);
+
+    pthread_mutex_lock(&stdev->lock);
+    if (stdev->recognition_callback == NULL) {
+        goto exit;
+    }
+    struct timespec ts;
+    clock_gettime(CLOCK_REALTIME, &ts);
+    ts.tv_sec += 3;
+    ALOGI("%s wait 3 sec", __func__);
+    int rc = pthread_cond_timedwait(&stdev->cond, &stdev->lock, &ts);
+    if (rc == ETIMEDOUT && stdev->recognition_callback != NULL) {
+        char *data = (char *)calloc(1, sizeof(struct sound_trigger_phrase_recognition_event) + 1);
+        struct sound_trigger_phrase_recognition_event *event =
+                (struct sound_trigger_phrase_recognition_event *)data;
+        event->common.status = RECOGNITION_STATUS_SUCCESS;
+        event->common.type = SOUND_MODEL_TYPE_KEYPHRASE;
+        event->common.model = stdev->model_handle;
+        event->num_phrases = 1;
+        event->phrase_extras[0].recognition_modes = RECOGNITION_MODE_VOICE_TRIGGER;
+        event->phrase_extras[0].confidence_level = 100;
+        event->phrase_extras[0].num_levels = 1;
+        event->phrase_extras[0].levels[0].level = 100;
+        event->phrase_extras[0].levels[0].user_id = 0;
+        event->common.data_offset = sizeof(struct sound_trigger_phrase_recognition_event);
+        event->common.data_size = 1;
+        data[event->common.data_offset] = 8;
+        ALOGI("%s send callback model %d", __func__, stdev->model_handle);
+        stdev->recognition_callback(&event->common, stdev->recognition_cookie);
+        free(data);
+    } else {
+        ALOGI("%s abort recognition model %d", __func__, stdev->model_handle);
+    }
+    stdev->recognition_callback = NULL;
+
+exit:
+    pthread_mutex_unlock(&stdev->lock);
+
+    return NULL;
+}
+
+static int stdev_get_properties(const struct sound_trigger_hw_device *dev,
+                                struct sound_trigger_properties *properties)
+{
+    struct stub_sound_trigger_device *stdev = (struct stub_sound_trigger_device *)dev;
+
+    ALOGI("%s", __func__);
+    if (properties == NULL)
+        return -EINVAL;
+    memcpy(properties, &hw_properties, sizeof(struct sound_trigger_properties));
+    return 0;
+}
+
+static int stdev_load_sound_model(const struct sound_trigger_hw_device *dev,
+                                  struct sound_trigger_sound_model *sound_model,
+                                  sound_model_callback_t callback,
+                                  void *cookie,
+                                  sound_model_handle_t *handle)
+{
+    struct stub_sound_trigger_device *stdev = (struct stub_sound_trigger_device *)dev;
+    int status = 0;
+
+    ALOGI("%s stdev %p", __func__, stdev);
+    pthread_mutex_lock(&stdev->lock);
+    if (handle == NULL || sound_model == NULL) {
+        status = -EINVAL;
+        goto exit;
+    }
+    if (sound_model->data_size == 0 ||
+            sound_model->data_offset < sizeof(struct sound_trigger_sound_model)) {
+        status = -EINVAL;
+        goto exit;
+    }
+
+    if (stdev->model_handle == 1) {
+        status = -ENOSYS;
+        goto exit;
+    }
+    char *data = (char *)sound_model + sound_model->data_offset;
+    ALOGI("%s data size %d data %d - %d", __func__,
+          sound_model->data_size, data[0], data[sound_model->data_size - 1]);
+    stdev->model_handle = 1;
+    stdev->sound_model_callback = callback;
+    stdev->sound_model_cookie = cookie;
+
+    *handle = stdev->model_handle;
+
+exit:
+    pthread_mutex_unlock(&stdev->lock);
+    return status;
+}
+
+static int stdev_unload_sound_model(const struct sound_trigger_hw_device *dev,
+                                    sound_model_handle_t handle)
+{
+    struct stub_sound_trigger_device *stdev = (struct stub_sound_trigger_device *)dev;
+    int status = 0;
+
+    ALOGI("%s handle %d", __func__, handle);
+    pthread_mutex_lock(&stdev->lock);
+    if (handle != 1) {
+        status = -EINVAL;
+        goto exit;
+    }
+    if (stdev->model_handle == 0) {
+        status = -ENOSYS;
+        goto exit;
+    }
+    stdev->model_handle = 0;
+    if (stdev->recognition_callback != NULL) {
+        stdev->recognition_callback = NULL;
+        pthread_cond_signal(&stdev->cond);
+        pthread_mutex_unlock(&stdev->lock);
+        pthread_join(stdev->callback_thread, (void **) NULL);
+        pthread_mutex_lock(&stdev->lock);
+    }
+
+exit:
+    pthread_mutex_unlock(&stdev->lock);
+    return status;
+}
+
+static int stdev_start_recognition(const struct sound_trigger_hw_device *dev,
+                                   sound_model_handle_t sound_model_handle,
+                                   const struct sound_trigger_recognition_config *config,
+                                   recognition_callback_t callback,
+                                   void *cookie)
+{
+    struct stub_sound_trigger_device *stdev = (struct stub_sound_trigger_device *)dev;
+    int status = 0;
+    ALOGI("%s sound model %d", __func__, sound_model_handle);
+    pthread_mutex_lock(&stdev->lock);
+    if (stdev->model_handle != sound_model_handle) {
+        status = -ENOSYS;
+        goto exit;
+    }
+    if (stdev->recognition_callback != NULL) {
+        status = -ENOSYS;
+        goto exit;
+    }
+    if (config->data_size != 0) {
+        char *data = (char *)config + config->data_offset;
+        ALOGI("%s data size %d data %d - %d", __func__,
+              config->data_size, data[0], data[config->data_size - 1]);
+    }
+
+    stdev->recognition_callback = callback;
+    stdev->recognition_cookie = cookie;
+    pthread_create(&stdev->callback_thread, (const pthread_attr_t *) NULL,
+                        callback_thread_loop, stdev);
+exit:
+    pthread_mutex_unlock(&stdev->lock);
+    return status;
+}
+
+static int stdev_stop_recognition(const struct sound_trigger_hw_device *dev,
+                                 sound_model_handle_t sound_model_handle)
+{
+    struct stub_sound_trigger_device *stdev = (struct stub_sound_trigger_device *)dev;
+    int status = 0;
+    ALOGI("%s sound model %d", __func__, sound_model_handle);
+    pthread_mutex_lock(&stdev->lock);
+    if (stdev->model_handle != sound_model_handle) {
+        status = -ENOSYS;
+        goto exit;
+    }
+    if (stdev->recognition_callback == NULL) {
+        status = -ENOSYS;
+        goto exit;
+    }
+    stdev->recognition_callback = NULL;
+    pthread_cond_signal(&stdev->cond);
+    pthread_mutex_unlock(&stdev->lock);
+    pthread_join(stdev->callback_thread, (void **) NULL);
+    pthread_mutex_lock(&stdev->lock);
+
+exit:
+    pthread_mutex_unlock(&stdev->lock);
+    return status;
+}
+
+
+static int stdev_close(hw_device_t *device)
+{
+    free(device);
+    return 0;
+}
+
+static int stdev_open(const hw_module_t* module, const char* name,
+                     hw_device_t** device)
+{
+    struct stub_sound_trigger_device *stdev;
+    int ret;
+
+    if (strcmp(name, SOUND_TRIGGER_HARDWARE_INTERFACE) != 0)
+        return -EINVAL;
+
+    stdev = calloc(1, sizeof(struct stub_sound_trigger_device));
+    if (!stdev)
+        return -ENOMEM;
+
+    stdev->device.common.tag = HARDWARE_DEVICE_TAG;
+    stdev->device.common.version = SOUND_TRIGGER_DEVICE_API_VERSION_1_0;
+    stdev->device.common.module = (struct hw_module_t *) module;
+    stdev->device.common.close = stdev_close;
+    stdev->device.get_properties = stdev_get_properties;
+    stdev->device.load_sound_model = stdev_load_sound_model;
+    stdev->device.unload_sound_model = stdev_unload_sound_model;
+    stdev->device.start_recognition = stdev_start_recognition;
+    stdev->device.stop_recognition = stdev_stop_recognition;
+
+    pthread_mutex_init(&stdev->lock, (const pthread_mutexattr_t *) NULL);
+    pthread_cond_init(&stdev->cond, (const pthread_condattr_t *) NULL);
+
+    *device = &stdev->device.common;
+
+    return 0;
+}
+
+static struct hw_module_methods_t hal_module_methods = {
+    .open = stdev_open,
+};
+
+struct sound_trigger_module HAL_MODULE_INFO_SYM = {
+    .common = {
+        .tag = HARDWARE_MODULE_TAG,
+        .module_api_version = SOUND_TRIGGER_MODULE_API_VERSION_1_0,
+        .hal_api_version = HARDWARE_HAL_API_VERSION,
+        .id = SOUND_TRIGGER_HARDWARE_MODULE_ID,
+        .name = "Default sound trigger HAL",
+        .author = "The Android Open Source Project",
+        .methods = &hal_module_methods,
+    },
+};
diff --git a/modules/tv_input/Android.mk b/modules/tv_input/Android.mk
new file mode 100644
index 0000000..e8aa7fc
--- /dev/null
+++ b/modules/tv_input/Android.mk
@@ -0,0 +1,24 @@
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_SHARED_LIBRARIES := libcutils liblog
+LOCAL_SRC_FILES := tv_input.cpp
+LOCAL_MODULE := tv_input.default
+LOCAL_MODULE_TAGS := optional
+include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/tv_input/tv_input.cpp b/modules/tv_input/tv_input.cpp
new file mode 100644
index 0000000..114e80e
--- /dev/null
+++ b/modules/tv_input/tv_input.cpp
@@ -0,0 +1,142 @@
+/*
+ * Copyright 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <malloc.h>
+
+#include <cutils/log.h>
+#include <cutils/native_handle.h>
+
+#include <hardware/tv_input.h>
+
+/*****************************************************************************/
+
+typedef struct tv_input_private {
+    tv_input_device_t device;
+
+    // Callback related data
+    const tv_input_callback_ops_t* callback;
+    void* callback_data;
+} tv_input_private_t;
+
+static int tv_input_device_open(const struct hw_module_t* module,
+        const char* name, struct hw_device_t** device);
+
+static struct hw_module_methods_t tv_input_module_methods = {
+    open: tv_input_device_open
+};
+
+tv_input_module_t HAL_MODULE_INFO_SYM = {
+    common: {
+        tag: HARDWARE_MODULE_TAG,
+        version_major: 0,
+        version_minor: 1,
+        id: TV_INPUT_HARDWARE_MODULE_ID,
+        name: "Sample TV input module",
+        author: "The Android Open Source Project",
+        methods: &tv_input_module_methods,
+    }
+};
+
+/*****************************************************************************/
+
+static int tv_input_initialize(struct tv_input_device* dev,
+        const tv_input_callback_ops_t* callback, void* data)
+{
+    if (dev == NULL || callback == NULL) {
+        return -EINVAL;
+    }
+    tv_input_private_t* priv = (tv_input_private_t*)dev;
+    if (priv->callback != NULL) {
+        return -EEXIST;
+    }
+
+    priv->callback = callback;
+    priv->callback_data = data;
+
+    return 0;
+}
+
+static int tv_input_get_stream_configurations(
+        const struct tv_input_device*, int, int*, const tv_stream_config_t**)
+{
+    return -EINVAL;
+}
+
+static int tv_input_open_stream(struct tv_input_device*, int, tv_stream_t*)
+{
+    return -EINVAL;
+}
+
+static int tv_input_close_stream(struct tv_input_device*, int, int)
+{
+    return -EINVAL;
+}
+
+static int tv_input_request_capture(
+        struct tv_input_device*, int, int, buffer_handle_t, uint32_t)
+{
+    return -EINVAL;
+}
+
+static int tv_input_cancel_capture(struct tv_input_device*, int, int, uint32_t)
+{
+    return -EINVAL;
+}
+
+/*****************************************************************************/
+
+static int tv_input_device_close(struct hw_device_t *dev)
+{
+    tv_input_private_t* priv = (tv_input_private_t*)dev;
+    if (priv) {
+        free(priv);
+    }
+    return 0;
+}
+
+/*****************************************************************************/
+
+static int tv_input_device_open(const struct hw_module_t* module,
+        const char* name, struct hw_device_t** device)
+{
+    int status = -EINVAL;
+    if (!strcmp(name, TV_INPUT_DEFAULT_DEVICE)) {
+        tv_input_private_t* dev = (tv_input_private_t*)malloc(sizeof(*dev));
+
+        /* initialize our state here */
+        memset(dev, 0, sizeof(*dev));
+
+        /* initialize the procs */
+        dev->device.common.tag = HARDWARE_DEVICE_TAG;
+        dev->device.common.version = TV_INPUT_DEVICE_API_VERSION_0_1;
+        dev->device.common.module = const_cast<hw_module_t*>(module);
+        dev->device.common.close = tv_input_device_close;
+
+        dev->device.initialize = tv_input_initialize;
+        dev->device.get_stream_configurations =
+                tv_input_get_stream_configurations;
+        dev->device.open_stream = tv_input_open_stream;
+        dev->device.close_stream = tv_input_close_stream;
+        dev->device.request_capture = tv_input_request_capture;
+        dev->device.cancel_capture = tv_input_cancel_capture;
+
+        *device = &dev->device.common;
+        status = 0;
+    }
+    return status;
+}
diff --git a/modules/usbaudio/Android.mk b/modules/usbaudio/Android.mk
index 2af7897..9df1e79 100644
--- a/modules/usbaudio/Android.mk
+++ b/modules/usbaudio/Android.mk
@@ -19,10 +19,12 @@
 LOCAL_MODULE := audio.usb.default
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_SRC_FILES := \
-	audio_hw.c
+	audio_hal.c
 LOCAL_C_INCLUDES += \
-	external/tinyalsa/include
-LOCAL_SHARED_LIBRARIES := liblog libcutils libtinyalsa
+	external/tinyalsa/include \
+	$(call include-path-for, audio-utils) \
+	$(call include-path-for, alsa-utils)
+LOCAL_SHARED_LIBRARIES := liblog libcutils libtinyalsa libaudioutils libalsautils
 LOCAL_MODULE_TAGS := optional
 LOCAL_CFLAGS := -Wno-unused-parameter
 
diff --git a/modules/usbaudio/audio_hal.c b/modules/usbaudio/audio_hal.c
new file mode 100644
index 0000000..38fea86
--- /dev/null
+++ b/modules/usbaudio/audio_hal.c
@@ -0,0 +1,1088 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "modules.usbaudio.audio_hal"
+/*#define LOG_NDEBUG 0*/
+
+#include <errno.h>
+#include <inttypes.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <sys/time.h>
+
+#include <log/log.h>
+#include <cutils/str_parms.h>
+#include <cutils/properties.h>
+
+#include <hardware/audio.h>
+#include <hardware/audio_alsaops.h>
+#include <hardware/hardware.h>
+
+#include <system/audio.h>
+
+#include <tinyalsa/asoundlib.h>
+
+#include <audio_utils/channels.h>
+
+/* FOR TESTING:
+ * Set k_force_channels to force the number of channels to present to AudioFlinger.
+ *   0 disables (this is default: present the device channels to AudioFlinger).
+ *   2 forces to legacy stereo mode.
+ *
+ * Others values can be tried (up to 8).
+ * TODO: AudioFlinger cannot support more than 8 active output channels
+ * at this time, so limiting logic needs to be put here or communicated from above.
+ */
+static const unsigned k_force_channels = 0;
+
+#include "alsa_device_profile.h"
+#include "alsa_device_proxy.h"
+#include "alsa_logging.h"
+
+#define DEFAULT_INPUT_BUFFER_SIZE_MS 20
+
+// stereo channel count
+#define FCC_2 2
+// fixed channel count of 8 limitation (for data processing in AudioFlinger)
+#define FCC_8 8
+
+struct audio_device {
+    struct audio_hw_device hw_device;
+
+    pthread_mutex_t lock; /* see note below on mutex acquisition order */
+
+    /* output */
+    alsa_device_profile out_profile;
+
+    /* input */
+    alsa_device_profile in_profile;
+
+    bool mic_muted;
+
+    bool standby;
+};
+
+struct stream_out {
+    struct audio_stream_out stream;
+
+    pthread_mutex_t lock;               /* see note below on mutex acquisition order */
+    pthread_mutex_t pre_lock;           /* acquire before lock to avoid DOS by playback thread */
+    bool standby;
+
+    struct audio_device *dev;           /* hardware information - only using this for the lock */
+
+    alsa_device_profile * profile;      /* Points to the alsa_device_profile in the audio_device */
+    alsa_device_proxy proxy;            /* state of the stream */
+
+    unsigned hal_channel_count;         /* channel count exposed to AudioFlinger.
+                                         * This may differ from the device channel count when
+                                         * the device is not compatible with AudioFlinger
+                                         * capabilities, e.g. exposes too many channels or
+                                         * too few channels. */
+    audio_channel_mask_t hal_channel_mask;   /* channel mask exposed to AudioFlinger. */
+
+    void * conversion_buffer;           /* any conversions are put into here
+                                         * they could come from here too if
+                                         * there was a previous conversion */
+    size_t conversion_buffer_size;      /* in bytes */
+};
+
+struct stream_in {
+    struct audio_stream_in stream;
+
+    pthread_mutex_t lock;               /* see note below on mutex acquisition order */
+    pthread_mutex_t pre_lock;           /* acquire before lock to avoid DOS by capture thread */
+    bool standby;
+
+    struct audio_device *dev;           /* hardware information - only using this for the lock */
+
+    alsa_device_profile * profile;      /* Points to the alsa_device_profile in the audio_device */
+    alsa_device_proxy proxy;            /* state of the stream */
+
+    unsigned hal_channel_count;         /* channel count exposed to AudioFlinger.
+                                         * This may differ from the device channel count when
+                                         * the device is not compatible with AudioFlinger
+                                         * capabilities, e.g. exposes too many channels or
+                                         * too few channels. */
+    audio_channel_mask_t hal_channel_mask;   /* channel mask exposed to AudioFlinger. */
+
+    /* We may need to read more data from the device in order to data reduce to 16bit, 4chan */
+    void * conversion_buffer;           /* any conversions are put into here
+                                         * they could come from here too if
+                                         * there was a previous conversion */
+    size_t conversion_buffer_size;      /* in bytes */
+};
+
+/*
+ * NOTE: when multiple mutexes have to be acquired, always take the
+ * stream_in or stream_out mutex first, followed by the audio_device mutex.
+ * stream pre_lock is always acquired before stream lock to prevent starvation of control thread by
+ * higher priority playback or capture thread.
+ */
+
+/*
+ * Extract the card and device numbers from the supplied key/value pairs.
+ *   kvpairs    A null-terminated string containing the key/value pairs or card and device.
+ *              i.e. "card=1;device=42"
+ *   card   A pointer to a variable to receive the parsed-out card number.
+ *   device A pointer to a variable to receive the parsed-out device number.
+ * NOTE: The variables pointed to by card and device return -1 (undefined) if the
+ *  associated key/value pair is not found in the provided string.
+ *  Return true if the kvpairs string contain a card/device spec, false otherwise.
+ */
+static bool parse_card_device_params(const char *kvpairs, int *card, int *device)
+{
+    struct str_parms * parms = str_parms_create_str(kvpairs);
+    char value[32];
+    int param_val;
+
+    // initialize to "undefined" state.
+    *card = -1;
+    *device = -1;
+
+    param_val = str_parms_get_str(parms, "card", value, sizeof(value));
+    if (param_val >= 0) {
+        *card = atoi(value);
+    }
+
+    param_val = str_parms_get_str(parms, "device", value, sizeof(value));
+    if (param_val >= 0) {
+        *device = atoi(value);
+    }
+
+    str_parms_destroy(parms);
+
+    return *card >= 0 && *device >= 0;
+}
+
+static char * device_get_parameters(alsa_device_profile * profile, const char * keys)
+{
+    if (profile->card < 0 || profile->device < 0) {
+        return strdup("");
+    }
+
+    struct str_parms *query = str_parms_create_str(keys);
+    struct str_parms *result = str_parms_create();
+
+    /* These keys are from hardware/libhardware/include/audio.h */
+    /* supported sample rates */
+    if (str_parms_has_key(query, AUDIO_PARAMETER_STREAM_SUP_SAMPLING_RATES)) {
+        char* rates_list = profile_get_sample_rate_strs(profile);
+        str_parms_add_str(result, AUDIO_PARAMETER_STREAM_SUP_SAMPLING_RATES,
+                          rates_list);
+        free(rates_list);
+    }
+
+    /* supported channel counts */
+    if (str_parms_has_key(query, AUDIO_PARAMETER_STREAM_SUP_CHANNELS)) {
+        char* channels_list = profile_get_channel_count_strs(profile);
+        str_parms_add_str(result, AUDIO_PARAMETER_STREAM_SUP_CHANNELS,
+                          channels_list);
+        free(channels_list);
+    }
+
+    /* supported sample formats */
+    if (str_parms_has_key(query, AUDIO_PARAMETER_STREAM_SUP_FORMATS)) {
+        char * format_params = profile_get_format_strs(profile);
+        str_parms_add_str(result, AUDIO_PARAMETER_STREAM_SUP_FORMATS,
+                          format_params);
+        free(format_params);
+    }
+    str_parms_destroy(query);
+
+    char* result_str = str_parms_to_str(result);
+    str_parms_destroy(result);
+
+    ALOGV("device_get_parameters = %s", result_str);
+
+    return result_str;
+}
+
+void lock_input_stream(struct stream_in *in)
+{
+    pthread_mutex_lock(&in->pre_lock);
+    pthread_mutex_lock(&in->lock);
+    pthread_mutex_unlock(&in->pre_lock);
+}
+
+void lock_output_stream(struct stream_out *out)
+{
+    pthread_mutex_lock(&out->pre_lock);
+    pthread_mutex_lock(&out->lock);
+    pthread_mutex_unlock(&out->pre_lock);
+}
+
+/*
+ * HAl Functions
+ */
+/**
+ * NOTE: when multiple mutexes have to be acquired, always respect the
+ * following order: hw device > out stream
+ */
+
+/*
+ * OUT functions
+ */
+static uint32_t out_get_sample_rate(const struct audio_stream *stream)
+{
+    uint32_t rate = proxy_get_sample_rate(&((struct stream_out*)stream)->proxy);
+    ALOGV("out_get_sample_rate() = %d", rate);
+    return rate;
+}
+
+static int out_set_sample_rate(struct audio_stream *stream, uint32_t rate)
+{
+    return 0;
+}
+
+static size_t out_get_buffer_size(const struct audio_stream *stream)
+{
+    const struct stream_out* out = (const struct stream_out*)stream;
+    size_t buffer_size =
+        proxy_get_period_size(&out->proxy) * audio_stream_out_frame_size(&(out->stream));
+    return buffer_size;
+}
+
+static uint32_t out_get_channels(const struct audio_stream *stream)
+{
+    const struct stream_out *out = (const struct stream_out*)stream;
+    return out->hal_channel_mask;
+}
+
+static audio_format_t out_get_format(const struct audio_stream *stream)
+{
+    /* Note: The HAL doesn't do any FORMAT conversion at this time. It
+     * Relies on the framework to provide data in the specified format.
+     * This could change in the future.
+     */
+    alsa_device_proxy * proxy = &((struct stream_out*)stream)->proxy;
+    audio_format_t format = audio_format_from_pcm_format(proxy_get_format(proxy));
+    return format;
+}
+
+static int out_set_format(struct audio_stream *stream, audio_format_t format)
+{
+    return 0;
+}
+
+static int out_standby(struct audio_stream *stream)
+{
+    struct stream_out *out = (struct stream_out *)stream;
+
+    lock_output_stream(out);
+    if (!out->standby) {
+        pthread_mutex_lock(&out->dev->lock);
+        proxy_close(&out->proxy);
+        pthread_mutex_unlock(&out->dev->lock);
+        out->standby = true;
+    }
+    pthread_mutex_unlock(&out->lock);
+
+    return 0;
+}
+
+static int out_dump(const struct audio_stream *stream, int fd)
+{
+    return 0;
+}
+
+static int out_set_parameters(struct audio_stream *stream, const char *kvpairs)
+{
+    ALOGV("out_set_parameters() keys:%s", kvpairs);
+
+    struct stream_out *out = (struct stream_out *)stream;
+
+    int routing = 0;
+    int ret_value = 0;
+    int card = -1;
+    int device = -1;
+
+    if (!parse_card_device_params(kvpairs, &card, &device)) {
+        // nothing to do
+        return ret_value;
+    }
+
+    lock_output_stream(out);
+    /* Lock the device because that is where the profile lives */
+    pthread_mutex_lock(&out->dev->lock);
+
+    if (!profile_is_cached_for(out->profile, card, device)) {
+        /* cannot read pcm device info if playback is active */
+        if (!out->standby)
+            ret_value = -ENOSYS;
+        else {
+            int saved_card = out->profile->card;
+            int saved_device = out->profile->device;
+            out->profile->card = card;
+            out->profile->device = device;
+            ret_value = profile_read_device_info(out->profile) ? 0 : -EINVAL;
+            if (ret_value != 0) {
+                out->profile->card = saved_card;
+                out->profile->device = saved_device;
+            }
+        }
+    }
+
+    pthread_mutex_unlock(&out->dev->lock);
+    pthread_mutex_unlock(&out->lock);
+
+    return ret_value;
+}
+
+static char * out_get_parameters(const struct audio_stream *stream, const char *keys)
+{
+    struct stream_out *out = (struct stream_out *)stream;
+    lock_output_stream(out);
+    pthread_mutex_lock(&out->dev->lock);
+
+    char * params_str =  device_get_parameters(out->profile, keys);
+
+    pthread_mutex_unlock(&out->lock);
+    pthread_mutex_unlock(&out->dev->lock);
+
+    return params_str;
+}
+
+static uint32_t out_get_latency(const struct audio_stream_out *stream)
+{
+    alsa_device_proxy * proxy = &((struct stream_out*)stream)->proxy;
+    return proxy_get_latency(proxy);
+}
+
+static int out_set_volume(struct audio_stream_out *stream, float left, float right)
+{
+    return -ENOSYS;
+}
+
+/* must be called with hw device and output stream mutexes locked */
+static int start_output_stream(struct stream_out *out)
+{
+    ALOGV("start_output_stream(card:%d device:%d)", out->profile->card, out->profile->device);
+
+    return proxy_open(&out->proxy);
+}
+
+static ssize_t out_write(struct audio_stream_out *stream, const void* buffer, size_t bytes)
+{
+    int ret;
+    struct stream_out *out = (struct stream_out *)stream;
+
+    lock_output_stream(out);
+    if (out->standby) {
+        pthread_mutex_lock(&out->dev->lock);
+        ret = start_output_stream(out);
+        pthread_mutex_unlock(&out->dev->lock);
+        if (ret != 0) {
+            goto err;
+        }
+        out->standby = false;
+    }
+
+    alsa_device_proxy* proxy = &out->proxy;
+    const void * write_buff = buffer;
+    int num_write_buff_bytes = bytes;
+    const int num_device_channels = proxy_get_channel_count(proxy); /* what we told alsa */
+    const int num_req_channels = out->hal_channel_count; /* what we told AudioFlinger */
+    if (num_device_channels != num_req_channels) {
+        /* allocate buffer */
+        const size_t required_conversion_buffer_size =
+                 bytes * num_device_channels / num_req_channels;
+        if (required_conversion_buffer_size > out->conversion_buffer_size) {
+            out->conversion_buffer_size = required_conversion_buffer_size;
+            out->conversion_buffer = realloc(out->conversion_buffer,
+                                             out->conversion_buffer_size);
+        }
+        /* convert data */
+        const audio_format_t audio_format = out_get_format(&(out->stream.common));
+        const unsigned sample_size_in_bytes = audio_bytes_per_sample(audio_format);
+        num_write_buff_bytes =
+                adjust_channels(write_buff, num_req_channels,
+                                out->conversion_buffer, num_device_channels,
+                                sample_size_in_bytes, num_write_buff_bytes);
+        write_buff = out->conversion_buffer;
+    }
+
+    if (write_buff != NULL && num_write_buff_bytes != 0) {
+        proxy_write(&out->proxy, write_buff, num_write_buff_bytes);
+    }
+
+    pthread_mutex_unlock(&out->lock);
+
+    return bytes;
+
+err:
+    pthread_mutex_unlock(&out->lock);
+    if (ret != 0) {
+        usleep(bytes * 1000000 / audio_stream_out_frame_size(stream) /
+               out_get_sample_rate(&stream->common));
+    }
+
+    return bytes;
+}
+
+static int out_get_render_position(const struct audio_stream_out *stream, uint32_t *dsp_frames)
+{
+    return -EINVAL;
+}
+
+static int out_get_presentation_position(const struct audio_stream_out *stream,
+                                         uint64_t *frames, struct timespec *timestamp)
+{
+    struct stream_out *out = (struct stream_out *)stream; // discard const qualifier
+    lock_output_stream(out);
+
+    const alsa_device_proxy *proxy = &out->proxy;
+    const int ret = proxy_get_presentation_position(proxy, frames, timestamp);
+
+    pthread_mutex_unlock(&out->lock);
+    ALOGV("out_get_presentation_position() status:%d  frames:%llu",
+            ret, (unsigned long long)*frames);
+    return ret;
+}
+
+static int out_add_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
+{
+    return 0;
+}
+
+static int out_remove_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
+{
+    return 0;
+}
+
+static int out_get_next_write_timestamp(const struct audio_stream_out *stream, int64_t *timestamp)
+{
+    return -EINVAL;
+}
+
+static int adev_open_output_stream(struct audio_hw_device *dev,
+                                   audio_io_handle_t handle,
+                                   audio_devices_t devices,
+                                   audio_output_flags_t flags,
+                                   struct audio_config *config,
+                                   struct audio_stream_out **stream_out,
+                                   const char *address /*__unused*/)
+{
+    ALOGV("adev_open_output_stream() handle:0x%X, device:0x%X, flags:0x%X, addr:%s",
+          handle, devices, flags, address);
+
+    struct audio_device *adev = (struct audio_device *)dev;
+
+    struct stream_out *out;
+
+    out = (struct stream_out *)calloc(1, sizeof(struct stream_out));
+    if (!out)
+        return -ENOMEM;
+
+    /* setup function pointers */
+    out->stream.common.get_sample_rate = out_get_sample_rate;
+    out->stream.common.set_sample_rate = out_set_sample_rate;
+    out->stream.common.get_buffer_size = out_get_buffer_size;
+    out->stream.common.get_channels = out_get_channels;
+    out->stream.common.get_format = out_get_format;
+    out->stream.common.set_format = out_set_format;
+    out->stream.common.standby = out_standby;
+    out->stream.common.dump = out_dump;
+    out->stream.common.set_parameters = out_set_parameters;
+    out->stream.common.get_parameters = out_get_parameters;
+    out->stream.common.add_audio_effect = out_add_audio_effect;
+    out->stream.common.remove_audio_effect = out_remove_audio_effect;
+    out->stream.get_latency = out_get_latency;
+    out->stream.set_volume = out_set_volume;
+    out->stream.write = out_write;
+    out->stream.get_render_position = out_get_render_position;
+    out->stream.get_presentation_position = out_get_presentation_position;
+    out->stream.get_next_write_timestamp = out_get_next_write_timestamp;
+
+    pthread_mutex_init(&out->lock, (const pthread_mutexattr_t *) NULL);
+    pthread_mutex_init(&out->pre_lock, (const pthread_mutexattr_t *) NULL);
+
+    out->dev = adev;
+    pthread_mutex_lock(&adev->lock);
+    out->profile = &adev->out_profile;
+
+    // build this to hand to the alsa_device_proxy
+    struct pcm_config proxy_config;
+    memset(&proxy_config, 0, sizeof(proxy_config));
+
+    /* Pull out the card/device pair */
+    parse_card_device_params(address, &(out->profile->card), &(out->profile->device));
+
+    profile_read_device_info(out->profile);
+
+    pthread_mutex_unlock(&adev->lock);
+
+    int ret = 0;
+
+    /* Rate */
+    if (config->sample_rate == 0) {
+        proxy_config.rate = config->sample_rate = profile_get_default_sample_rate(out->profile);
+    } else if (profile_is_sample_rate_valid(out->profile, config->sample_rate)) {
+        proxy_config.rate = config->sample_rate;
+    } else {
+        proxy_config.rate = config->sample_rate = profile_get_default_sample_rate(out->profile);
+        ret = -EINVAL;
+    }
+
+    /* Format */
+    if (config->format == AUDIO_FORMAT_DEFAULT) {
+        proxy_config.format = profile_get_default_format(out->profile);
+        config->format = audio_format_from_pcm_format(proxy_config.format);
+    } else {
+        enum pcm_format fmt = pcm_format_from_audio_format(config->format);
+        if (profile_is_format_valid(out->profile, fmt)) {
+            proxy_config.format = fmt;
+        } else {
+            proxy_config.format = profile_get_default_format(out->profile);
+            config->format = audio_format_from_pcm_format(proxy_config.format);
+            ret = -EINVAL;
+        }
+    }
+
+    /* Channels */
+    unsigned proposed_channel_count = 0;
+    if (k_force_channels) {
+        proposed_channel_count = k_force_channels;
+    } else if (config->channel_mask == AUDIO_CHANNEL_NONE) {
+        proposed_channel_count =  profile_get_default_channel_count(out->profile);
+    }
+    if (proposed_channel_count != 0) {
+        if (proposed_channel_count <= FCC_2) {
+            // use channel position mask for mono and stereo
+            config->channel_mask = audio_channel_out_mask_from_count(proposed_channel_count);
+        } else {
+            // use channel index mask for multichannel
+            config->channel_mask =
+                    audio_channel_mask_for_index_assignment_from_count(proposed_channel_count);
+        }
+        out->hal_channel_count = proposed_channel_count;
+    } else {
+        out->hal_channel_count = audio_channel_count_from_out_mask(config->channel_mask);
+    }
+    /* we can expose any channel mask, and emulate internally based on channel count. */
+    out->hal_channel_mask = config->channel_mask;
+
+    /* no validity checks are needed as proxy_prepare() forces channel_count to be valid.
+     * and we emulate any channel count discrepancies in out_write(). */
+    proxy_config.channels = proposed_channel_count;
+
+    proxy_prepare(&out->proxy, out->profile, &proxy_config);
+
+    /* TODO The retry mechanism isn't implemented in AudioPolicyManager/AudioFlinger. */
+    ret = 0;
+
+    out->conversion_buffer = NULL;
+    out->conversion_buffer_size = 0;
+
+    out->standby = true;
+
+    *stream_out = &out->stream;
+
+    return ret;
+
+err_open:
+    free(out);
+    *stream_out = NULL;
+    return -ENOSYS;
+}
+
+static void adev_close_output_stream(struct audio_hw_device *dev,
+                                     struct audio_stream_out *stream)
+{
+    struct stream_out *out = (struct stream_out *)stream;
+    ALOGV("adev_close_output_stream(c:%d d:%d)", out->profile->card, out->profile->device);
+
+    /* Close the pcm device */
+    out_standby(&stream->common);
+
+    free(out->conversion_buffer);
+
+    out->conversion_buffer = NULL;
+    out->conversion_buffer_size = 0;
+
+    free(stream);
+}
+
+static size_t adev_get_input_buffer_size(const struct audio_hw_device *dev,
+                                         const struct audio_config *config)
+{
+    /* TODO This needs to be calculated based on format/channels/rate */
+    return 320;
+}
+
+/*
+ * IN functions
+ */
+static uint32_t in_get_sample_rate(const struct audio_stream *stream)
+{
+    uint32_t rate = proxy_get_sample_rate(&((const struct stream_in *)stream)->proxy);
+    ALOGV("in_get_sample_rate() = %d", rate);
+    return rate;
+}
+
+static int in_set_sample_rate(struct audio_stream *stream, uint32_t rate)
+{
+    ALOGV("in_set_sample_rate(%d) - NOPE", rate);
+    return -ENOSYS;
+}
+
+static size_t in_get_buffer_size(const struct audio_stream *stream)
+{
+    const struct stream_in * in = ((const struct stream_in*)stream);
+    return proxy_get_period_size(&in->proxy) * audio_stream_in_frame_size(&(in->stream));
+}
+
+static uint32_t in_get_channels(const struct audio_stream *stream)
+{
+    const struct stream_in *in = (const struct stream_in*)stream;
+    return in->hal_channel_mask;
+}
+
+static audio_format_t in_get_format(const struct audio_stream *stream)
+{
+     alsa_device_proxy *proxy = &((struct stream_in*)stream)->proxy;
+     audio_format_t format = audio_format_from_pcm_format(proxy_get_format(proxy));
+     return format;
+}
+
+static int in_set_format(struct audio_stream *stream, audio_format_t format)
+{
+    ALOGV("in_set_format(%d) - NOPE", format);
+
+    return -ENOSYS;
+}
+
+static int in_standby(struct audio_stream *stream)
+{
+    struct stream_in *in = (struct stream_in *)stream;
+
+    lock_input_stream(in);
+    if (!in->standby) {
+        pthread_mutex_lock(&in->dev->lock);
+        proxy_close(&in->proxy);
+        pthread_mutex_unlock(&in->dev->lock);
+        in->standby = true;
+    }
+
+    pthread_mutex_unlock(&in->lock);
+
+    return 0;
+}
+
+static int in_dump(const struct audio_stream *stream, int fd)
+{
+    return 0;
+}
+
+static int in_set_parameters(struct audio_stream *stream, const char *kvpairs)
+{
+    ALOGV("in_set_parameters() keys:%s", kvpairs);
+
+    struct stream_in *in = (struct stream_in *)stream;
+
+    char value[32];
+    int param_val;
+    int routing = 0;
+    int ret_value = 0;
+    int card = -1;
+    int device = -1;
+
+    if (!parse_card_device_params(kvpairs, &card, &device)) {
+        // nothing to do
+        return ret_value;
+    }
+
+    lock_input_stream(in);
+    pthread_mutex_lock(&in->dev->lock);
+
+    if (card >= 0 && device >= 0 && !profile_is_cached_for(in->profile, card, device)) {
+        /* cannot read pcm device info if playback is active */
+        if (!in->standby)
+            ret_value = -ENOSYS;
+        else {
+            int saved_card = in->profile->card;
+            int saved_device = in->profile->device;
+            in->profile->card = card;
+            in->profile->device = device;
+            ret_value = profile_read_device_info(in->profile) ? 0 : -EINVAL;
+            if (ret_value != 0) {
+                in->profile->card = saved_card;
+                in->profile->device = saved_device;
+            }
+        }
+    }
+
+    pthread_mutex_unlock(&in->dev->lock);
+    pthread_mutex_unlock(&in->lock);
+
+    return ret_value;
+}
+
+static char * in_get_parameters(const struct audio_stream *stream, const char *keys)
+{
+    struct stream_in *in = (struct stream_in *)stream;
+
+    lock_input_stream(in);
+    pthread_mutex_lock(&in->dev->lock);
+
+    char * params_str =  device_get_parameters(in->profile, keys);
+
+    pthread_mutex_unlock(&in->dev->lock);
+    pthread_mutex_unlock(&in->lock);
+
+    return params_str;
+}
+
+static int in_add_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
+{
+    return 0;
+}
+
+static int in_remove_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
+{
+    return 0;
+}
+
+static int in_set_gain(struct audio_stream_in *stream, float gain)
+{
+    return 0;
+}
+
+/* must be called with hw device and output stream mutexes locked */
+static int start_input_stream(struct stream_in *in)
+{
+    ALOGV("ustart_input_stream(card:%d device:%d)", in->profile->card, in->profile->device);
+
+    return proxy_open(&in->proxy);
+}
+
+/* TODO mutex stuff here (see out_write) */
+static ssize_t in_read(struct audio_stream_in *stream, void* buffer, size_t bytes)
+{
+    size_t num_read_buff_bytes = 0;
+    void * read_buff = buffer;
+    void * out_buff = buffer;
+    int ret = 0;
+
+    struct stream_in * in = (struct stream_in *)stream;
+
+    lock_input_stream(in);
+    if (in->standby) {
+        pthread_mutex_lock(&in->dev->lock);
+        ret = start_input_stream(in);
+        pthread_mutex_unlock(&in->dev->lock);
+        if (ret != 0) {
+            goto err;
+        }
+        in->standby = false;
+    }
+
+    alsa_device_profile * profile = in->profile;
+
+    /*
+     * OK, we need to figure out how much data to read to be able to output the requested
+     * number of bytes in the HAL format (16-bit, stereo).
+     */
+    num_read_buff_bytes = bytes;
+    int num_device_channels = proxy_get_channel_count(&in->proxy); /* what we told Alsa */
+    int num_req_channels = in->hal_channel_count; /* what we told AudioFlinger */
+
+    if (num_device_channels != num_req_channels) {
+        num_read_buff_bytes = (num_device_channels * num_read_buff_bytes) / num_req_channels;
+    }
+
+    /* Setup/Realloc the conversion buffer (if necessary). */
+    if (num_read_buff_bytes != bytes) {
+        if (num_read_buff_bytes > in->conversion_buffer_size) {
+            /*TODO Remove this when AudioPolicyManger/AudioFlinger support arbitrary formats
+              (and do these conversions themselves) */
+            in->conversion_buffer_size = num_read_buff_bytes;
+            in->conversion_buffer = realloc(in->conversion_buffer, in->conversion_buffer_size);
+        }
+        read_buff = in->conversion_buffer;
+    }
+
+    ret = proxy_read(&in->proxy, read_buff, num_read_buff_bytes);
+    if (ret == 0) {
+        if (num_device_channels != num_req_channels) {
+            // ALOGV("chans dev:%d req:%d", num_device_channels, num_req_channels);
+
+            out_buff = buffer;
+            /* Num Channels conversion */
+            if (num_device_channels != num_req_channels) {
+                audio_format_t audio_format = in_get_format(&(in->stream.common));
+                unsigned sample_size_in_bytes = audio_bytes_per_sample(audio_format);
+
+                num_read_buff_bytes =
+                    adjust_channels(read_buff, num_device_channels,
+                                    out_buff, num_req_channels,
+                                    sample_size_in_bytes, num_read_buff_bytes);
+            }
+        }
+
+        /* no need to acquire in->dev->lock to read mic_muted here as we don't change its state */
+        if (num_read_buff_bytes > 0 && in->dev->mic_muted)
+            memset(buffer, 0, num_read_buff_bytes);
+    } else {
+        num_read_buff_bytes = 0; // reset the value after USB headset is unplugged
+    }
+
+err:
+    pthread_mutex_unlock(&in->lock);
+
+    return num_read_buff_bytes;
+}
+
+static uint32_t in_get_input_frames_lost(struct audio_stream_in *stream)
+{
+    return 0;
+}
+
+static int adev_open_input_stream(struct audio_hw_device *dev,
+                                  audio_io_handle_t handle,
+                                  audio_devices_t devices,
+                                  struct audio_config *config,
+                                  struct audio_stream_in **stream_in,
+                                  audio_input_flags_t flags __unused,
+                                  const char *address /*__unused*/,
+                                  audio_source_t source __unused)
+{
+    ALOGV("in adev_open_input_stream() rate:%" PRIu32 ", chanMask:0x%" PRIX32 ", fmt:%" PRIu8,
+          config->sample_rate, config->channel_mask, config->format);
+
+    struct stream_in *in = (struct stream_in *)calloc(1, sizeof(struct stream_in));
+    int ret = 0;
+
+    if (in == NULL)
+        return -ENOMEM;
+
+    /* setup function pointers */
+    in->stream.common.get_sample_rate = in_get_sample_rate;
+    in->stream.common.set_sample_rate = in_set_sample_rate;
+    in->stream.common.get_buffer_size = in_get_buffer_size;
+    in->stream.common.get_channels = in_get_channels;
+    in->stream.common.get_format = in_get_format;
+    in->stream.common.set_format = in_set_format;
+    in->stream.common.standby = in_standby;
+    in->stream.common.dump = in_dump;
+    in->stream.common.set_parameters = in_set_parameters;
+    in->stream.common.get_parameters = in_get_parameters;
+    in->stream.common.add_audio_effect = in_add_audio_effect;
+    in->stream.common.remove_audio_effect = in_remove_audio_effect;
+
+    in->stream.set_gain = in_set_gain;
+    in->stream.read = in_read;
+    in->stream.get_input_frames_lost = in_get_input_frames_lost;
+
+    pthread_mutex_init(&in->lock, (const pthread_mutexattr_t *) NULL);
+    pthread_mutex_init(&in->pre_lock, (const pthread_mutexattr_t *) NULL);
+
+    in->dev = (struct audio_device *)dev;
+    pthread_mutex_lock(&in->dev->lock);
+
+    in->profile = &in->dev->in_profile;
+
+    struct pcm_config proxy_config;
+    memset(&proxy_config, 0, sizeof(proxy_config));
+
+    /* Pull out the card/device pair */
+    parse_card_device_params(address, &(in->profile->card), &(in->profile->device));
+
+    profile_read_device_info(in->profile);
+    pthread_mutex_unlock(&in->dev->lock);
+
+    /* Rate */
+    if (config->sample_rate == 0) {
+        proxy_config.rate = config->sample_rate = profile_get_default_sample_rate(in->profile);
+    } else if (profile_is_sample_rate_valid(in->profile, config->sample_rate)) {
+        proxy_config.rate = config->sample_rate;
+    } else {
+        proxy_config.rate = config->sample_rate = profile_get_default_sample_rate(in->profile);
+        ret = -EINVAL;
+    }
+
+    /* Format */
+    if (config->format == AUDIO_FORMAT_DEFAULT) {
+        proxy_config.format = profile_get_default_format(in->profile);
+        config->format = audio_format_from_pcm_format(proxy_config.format);
+    } else {
+        enum pcm_format fmt = pcm_format_from_audio_format(config->format);
+        if (profile_is_format_valid(in->profile, fmt)) {
+            proxy_config.format = fmt;
+        } else {
+            proxy_config.format = profile_get_default_format(in->profile);
+            config->format = audio_format_from_pcm_format(proxy_config.format);
+            ret = -EINVAL;
+        }
+    }
+
+    /* Channels */
+    unsigned proposed_channel_count = 0;
+    if (k_force_channels) {
+        proposed_channel_count = k_force_channels;
+    } else if (config->channel_mask == AUDIO_CHANNEL_NONE) {
+        proposed_channel_count = profile_get_default_channel_count(in->profile);
+    }
+    if (proposed_channel_count != 0) {
+        config->channel_mask = audio_channel_in_mask_from_count(proposed_channel_count);
+        if (config->channel_mask == AUDIO_CHANNEL_INVALID)
+            config->channel_mask =
+                    audio_channel_mask_for_index_assignment_from_count(proposed_channel_count);
+        in->hal_channel_count = proposed_channel_count;
+    } else {
+        in->hal_channel_count = audio_channel_count_from_in_mask(config->channel_mask);
+    }
+    /* we can expose any channel mask, and emulate internally based on channel count. */
+    in->hal_channel_mask = config->channel_mask;
+
+    proxy_config.channels = profile_get_default_channel_count(in->profile);
+    proxy_prepare(&in->proxy, in->profile, &proxy_config);
+
+    in->standby = true;
+
+    in->conversion_buffer = NULL;
+    in->conversion_buffer_size = 0;
+
+    *stream_in = &in->stream;
+
+    return ret;
+}
+
+static void adev_close_input_stream(struct audio_hw_device *dev, struct audio_stream_in *stream)
+{
+    struct stream_in *in = (struct stream_in *)stream;
+
+    /* Close the pcm device */
+    in_standby(&stream->common);
+
+    free(in->conversion_buffer);
+
+    free(stream);
+}
+
+/*
+ * ADEV Functions
+ */
+static int adev_set_parameters(struct audio_hw_device *dev, const char *kvpairs)
+{
+    return 0;
+}
+
+static char * adev_get_parameters(const struct audio_hw_device *dev, const char *keys)
+{
+    return strdup("");
+}
+
+static int adev_init_check(const struct audio_hw_device *dev)
+{
+    return 0;
+}
+
+static int adev_set_voice_volume(struct audio_hw_device *dev, float volume)
+{
+    return -ENOSYS;
+}
+
+static int adev_set_master_volume(struct audio_hw_device *dev, float volume)
+{
+    return -ENOSYS;
+}
+
+static int adev_set_mode(struct audio_hw_device *dev, audio_mode_t mode)
+{
+    return 0;
+}
+
+static int adev_set_mic_mute(struct audio_hw_device *dev, bool state)
+{
+    struct audio_device * adev = (struct audio_device *)dev;
+    pthread_mutex_lock(&adev->lock);
+    adev->mic_muted = state;
+    pthread_mutex_unlock(&adev->lock);
+    return -ENOSYS;
+}
+
+static int adev_get_mic_mute(const struct audio_hw_device *dev, bool *state)
+{
+    return -ENOSYS;
+}
+
+static int adev_dump(const audio_hw_device_t *device, int fd)
+{
+    return 0;
+}
+
+static int adev_close(hw_device_t *device)
+{
+    struct audio_device *adev = (struct audio_device *)device;
+    free(device);
+
+    return 0;
+}
+
+static int adev_open(const hw_module_t* module, const char* name, hw_device_t** device)
+{
+    if (strcmp(name, AUDIO_HARDWARE_INTERFACE) != 0)
+        return -EINVAL;
+
+    struct audio_device *adev = calloc(1, sizeof(struct audio_device));
+    if (!adev)
+        return -ENOMEM;
+
+    profile_init(&adev->out_profile, PCM_OUT);
+    profile_init(&adev->in_profile, PCM_IN);
+
+    adev->hw_device.common.tag = HARDWARE_DEVICE_TAG;
+    adev->hw_device.common.version = AUDIO_DEVICE_API_VERSION_2_0;
+    adev->hw_device.common.module = (struct hw_module_t *)module;
+    adev->hw_device.common.close = adev_close;
+
+    adev->hw_device.init_check = adev_init_check;
+    adev->hw_device.set_voice_volume = adev_set_voice_volume;
+    adev->hw_device.set_master_volume = adev_set_master_volume;
+    adev->hw_device.set_mode = adev_set_mode;
+    adev->hw_device.set_mic_mute = adev_set_mic_mute;
+    adev->hw_device.get_mic_mute = adev_get_mic_mute;
+    adev->hw_device.set_parameters = adev_set_parameters;
+    adev->hw_device.get_parameters = adev_get_parameters;
+    adev->hw_device.get_input_buffer_size = adev_get_input_buffer_size;
+    adev->hw_device.open_output_stream = adev_open_output_stream;
+    adev->hw_device.close_output_stream = adev_close_output_stream;
+    adev->hw_device.open_input_stream = adev_open_input_stream;
+    adev->hw_device.close_input_stream = adev_close_input_stream;
+    adev->hw_device.dump = adev_dump;
+
+    *device = &adev->hw_device.common;
+
+    return 0;
+}
+
+static struct hw_module_methods_t hal_module_methods = {
+    .open = adev_open,
+};
+
+struct audio_module HAL_MODULE_INFO_SYM = {
+    .common = {
+        .tag = HARDWARE_MODULE_TAG,
+        .module_api_version = AUDIO_MODULE_API_VERSION_0_1,
+        .hal_api_version = HARDWARE_HAL_API_VERSION,
+        .id = AUDIO_HARDWARE_MODULE_ID,
+        .name = "USB audio HW HAL",
+        .author = "The Android Open Source Project",
+        .methods = &hal_module_methods,
+    },
+};
diff --git a/modules/usbaudio/audio_hw.c b/modules/usbaudio/audio_hw.c
deleted file mode 100644
index f33c343..0000000
--- a/modules/usbaudio/audio_hw.c
+++ /dev/null
@@ -1,434 +0,0 @@
-/*
- * Copyright (C) 2012 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "usb_audio_hw"
-/*#define LOG_NDEBUG 0*/
-
-#include <errno.h>
-#include <pthread.h>
-#include <stdint.h>
-#include <sys/time.h>
-#include <stdlib.h>
-
-#include <cutils/log.h>
-#include <cutils/str_parms.h>
-#include <cutils/properties.h>
-
-#include <hardware/hardware.h>
-#include <system/audio.h>
-#include <hardware/audio.h>
-
-#include <tinyalsa/asoundlib.h>
-
-struct pcm_config pcm_config = {
-    .channels = 2,
-    .rate = 44100,
-    .period_size = 1024,
-    .period_count = 4,
-    .format = PCM_FORMAT_S16_LE,
-};
-
-struct audio_device {
-    struct audio_hw_device hw_device;
-
-    pthread_mutex_t lock; /* see note below on mutex acquisition order */
-    int card;
-    int device;
-    bool standby;
-};
-
-struct stream_out {
-    struct audio_stream_out stream;
-
-    pthread_mutex_t lock; /* see note below on mutex acquisition order */
-    struct pcm *pcm;
-    bool standby;
-
-    struct audio_device *dev;
-};
-
-/**
- * NOTE: when multiple mutexes have to be acquired, always respect the
- * following order: hw device > out stream
- */
-
-/* Helper functions */
-
-/* must be called with hw device and output stream mutexes locked */
-static int start_output_stream(struct stream_out *out)
-{
-    struct audio_device *adev = out->dev;
-    int i;
-
-    if ((adev->card < 0) || (adev->device < 0))
-        return -EINVAL;
-
-    out->pcm = pcm_open(adev->card, adev->device, PCM_OUT, &pcm_config);
-
-    if (out->pcm && !pcm_is_ready(out->pcm)) {
-        ALOGE("pcm_open() failed: %s", pcm_get_error(out->pcm));
-        pcm_close(out->pcm);
-        return -ENOMEM;
-    }
-
-    return 0;
-}
-
-/* API functions */
-
-static uint32_t out_get_sample_rate(const struct audio_stream *stream)
-{
-    return pcm_config.rate;
-}
-
-static int out_set_sample_rate(struct audio_stream *stream, uint32_t rate)
-{
-    return 0;
-}
-
-static size_t out_get_buffer_size(const struct audio_stream *stream)
-{
-    return pcm_config.period_size *
-           audio_stream_frame_size((struct audio_stream *)stream);
-}
-
-static uint32_t out_get_channels(const struct audio_stream *stream)
-{
-    return AUDIO_CHANNEL_OUT_STEREO;
-}
-
-static audio_format_t out_get_format(const struct audio_stream *stream)
-{
-    return AUDIO_FORMAT_PCM_16_BIT;
-}
-
-static int out_set_format(struct audio_stream *stream, audio_format_t format)
-{
-    return 0;
-}
-
-static int out_standby(struct audio_stream *stream)
-{
-    struct stream_out *out = (struct stream_out *)stream;
-
-    pthread_mutex_lock(&out->dev->lock);
-    pthread_mutex_lock(&out->lock);
-
-    if (!out->standby) {
-        pcm_close(out->pcm);
-        out->pcm = NULL;
-        out->standby = true;
-    }
-
-    pthread_mutex_unlock(&out->lock);
-    pthread_mutex_unlock(&out->dev->lock);
-
-    return 0;
-}
-
-static int out_dump(const struct audio_stream *stream, int fd)
-{
-    return 0;
-}
-
-static int out_set_parameters(struct audio_stream *stream, const char *kvpairs)
-{
-    struct stream_out *out = (struct stream_out *)stream;
-    struct audio_device *adev = out->dev;
-    struct str_parms *parms;
-    char value[32];
-    int ret;
-    int routing = 0;
-
-    parms = str_parms_create_str(kvpairs);
-    pthread_mutex_lock(&adev->lock);
-
-    ret = str_parms_get_str(parms, "card", value, sizeof(value));
-    if (ret >= 0)
-        adev->card = atoi(value);
-
-    ret = str_parms_get_str(parms, "device", value, sizeof(value));
-    if (ret >= 0)
-        adev->device = atoi(value);
-
-    pthread_mutex_unlock(&adev->lock);
-    str_parms_destroy(parms);
-
-    return 0;
-}
-
-static char * out_get_parameters(const struct audio_stream *stream, const char *keys)
-{
-    return strdup("");
-}
-
-static uint32_t out_get_latency(const struct audio_stream_out *stream)
-{
-    return (pcm_config.period_size * pcm_config.period_count * 1000) /
-            out_get_sample_rate(&stream->common);
-}
-
-static int out_set_volume(struct audio_stream_out *stream, float left,
-                          float right)
-{
-    return -ENOSYS;
-}
-
-static ssize_t out_write(struct audio_stream_out *stream, const void* buffer,
-                         size_t bytes)
-{
-    int ret;
-    struct stream_out *out = (struct stream_out *)stream;
-
-    pthread_mutex_lock(&out->dev->lock);
-    pthread_mutex_lock(&out->lock);
-    if (out->standby) {
-        ret = start_output_stream(out);
-        if (ret != 0) {
-            goto err;
-        }
-        out->standby = false;
-    }
-
-    pcm_write(out->pcm, (void *)buffer, bytes);
-
-    pthread_mutex_unlock(&out->lock);
-    pthread_mutex_unlock(&out->dev->lock);
-
-    return bytes;
-
-err:
-    pthread_mutex_unlock(&out->lock);
-
-    if (ret != 0) {
-        usleep(bytes * 1000000 / audio_stream_frame_size(&stream->common) /
-               out_get_sample_rate(&stream->common));
-    }
-
-    return bytes;
-}
-
-static int out_get_render_position(const struct audio_stream_out *stream,
-                                   uint32_t *dsp_frames)
-{
-    return -EINVAL;
-}
-
-static int out_add_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
-{
-    return 0;
-}
-
-static int out_remove_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
-{
-    return 0;
-}
-
-static int out_get_next_write_timestamp(const struct audio_stream_out *stream,
-                                        int64_t *timestamp)
-{
-    return -EINVAL;
-}
-
-static int adev_open_output_stream(struct audio_hw_device *dev,
-                                   audio_io_handle_t handle,
-                                   audio_devices_t devices,
-                                   audio_output_flags_t flags,
-                                   struct audio_config *config,
-                                   struct audio_stream_out **stream_out)
-{
-    struct audio_device *adev = (struct audio_device *)dev;
-    struct stream_out *out;
-    int ret;
-
-    out = (struct stream_out *)calloc(1, sizeof(struct stream_out));
-    if (!out)
-        return -ENOMEM;
-
-    out->stream.common.get_sample_rate = out_get_sample_rate;
-    out->stream.common.set_sample_rate = out_set_sample_rate;
-    out->stream.common.get_buffer_size = out_get_buffer_size;
-    out->stream.common.get_channels = out_get_channels;
-    out->stream.common.get_format = out_get_format;
-    out->stream.common.set_format = out_set_format;
-    out->stream.common.standby = out_standby;
-    out->stream.common.dump = out_dump;
-    out->stream.common.set_parameters = out_set_parameters;
-    out->stream.common.get_parameters = out_get_parameters;
-    out->stream.common.add_audio_effect = out_add_audio_effect;
-    out->stream.common.remove_audio_effect = out_remove_audio_effect;
-    out->stream.get_latency = out_get_latency;
-    out->stream.set_volume = out_set_volume;
-    out->stream.write = out_write;
-    out->stream.get_render_position = out_get_render_position;
-    out->stream.get_next_write_timestamp = out_get_next_write_timestamp;
-
-    out->dev = adev;
-
-    config->format = out_get_format(&out->stream.common);
-    config->channel_mask = out_get_channels(&out->stream.common);
-    config->sample_rate = out_get_sample_rate(&out->stream.common);
-
-    out->standby = true;
-
-    adev->card = -1;
-    adev->device = -1;
-
-    *stream_out = &out->stream;
-    return 0;
-
-err_open:
-    free(out);
-    *stream_out = NULL;
-    return ret;
-}
-
-static void adev_close_output_stream(struct audio_hw_device *dev,
-                                     struct audio_stream_out *stream)
-{
-    struct stream_out *out = (struct stream_out *)stream;
-
-    out_standby(&stream->common);
-    free(stream);
-}
-
-static int adev_set_parameters(struct audio_hw_device *dev, const char *kvpairs)
-{
-    return 0;
-}
-
-static char * adev_get_parameters(const struct audio_hw_device *dev,
-                                  const char *keys)
-{
-    return strdup("");
-}
-
-static int adev_init_check(const struct audio_hw_device *dev)
-{
-    return 0;
-}
-
-static int adev_set_voice_volume(struct audio_hw_device *dev, float volume)
-{
-    return -ENOSYS;
-}
-
-static int adev_set_master_volume(struct audio_hw_device *dev, float volume)
-{
-    return -ENOSYS;
-}
-
-static int adev_set_mode(struct audio_hw_device *dev, audio_mode_t mode)
-{
-    return 0;
-}
-
-static int adev_set_mic_mute(struct audio_hw_device *dev, bool state)
-{
-    return -ENOSYS;
-}
-
-static int adev_get_mic_mute(const struct audio_hw_device *dev, bool *state)
-{
-    return -ENOSYS;
-}
-
-static size_t adev_get_input_buffer_size(const struct audio_hw_device *dev,
-                                         const struct audio_config *config)
-{
-    return 0;
-}
-
-static int adev_open_input_stream(struct audio_hw_device *dev,
-                                  audio_io_handle_t handle,
-                                  audio_devices_t devices,
-                                  struct audio_config *config,
-                                  struct audio_stream_in **stream_in)
-{
-    return -ENOSYS;
-}
-
-static void adev_close_input_stream(struct audio_hw_device *dev,
-                                   struct audio_stream_in *stream)
-{
-}
-
-static int adev_dump(const audio_hw_device_t *device, int fd)
-{
-    return 0;
-}
-
-static int adev_close(hw_device_t *device)
-{
-    struct audio_device *adev = (struct audio_device *)device;
-
-    free(device);
-    return 0;
-}
-
-static int adev_open(const hw_module_t* module, const char* name,
-                     hw_device_t** device)
-{
-    struct audio_device *adev;
-    int ret;
-
-    if (strcmp(name, AUDIO_HARDWARE_INTERFACE) != 0)
-        return -EINVAL;
-
-    adev = calloc(1, sizeof(struct audio_device));
-    if (!adev)
-        return -ENOMEM;
-
-    adev->hw_device.common.tag = HARDWARE_DEVICE_TAG;
-    adev->hw_device.common.version = AUDIO_DEVICE_API_VERSION_2_0;
-    adev->hw_device.common.module = (struct hw_module_t *) module;
-    adev->hw_device.common.close = adev_close;
-
-    adev->hw_device.init_check = adev_init_check;
-    adev->hw_device.set_voice_volume = adev_set_voice_volume;
-    adev->hw_device.set_master_volume = adev_set_master_volume;
-    adev->hw_device.set_mode = adev_set_mode;
-    adev->hw_device.set_mic_mute = adev_set_mic_mute;
-    adev->hw_device.get_mic_mute = adev_get_mic_mute;
-    adev->hw_device.set_parameters = adev_set_parameters;
-    adev->hw_device.get_parameters = adev_get_parameters;
-    adev->hw_device.get_input_buffer_size = adev_get_input_buffer_size;
-    adev->hw_device.open_output_stream = adev_open_output_stream;
-    adev->hw_device.close_output_stream = adev_close_output_stream;
-    adev->hw_device.open_input_stream = adev_open_input_stream;
-    adev->hw_device.close_input_stream = adev_close_input_stream;
-    adev->hw_device.dump = adev_dump;
-
-    *device = &adev->hw_device.common;
-
-    return 0;
-}
-
-static struct hw_module_methods_t hal_module_methods = {
-    .open = adev_open,
-};
-
-struct audio_module HAL_MODULE_INFO_SYM = {
-    .common = {
-        .tag = HARDWARE_MODULE_TAG,
-        .module_api_version = AUDIO_MODULE_API_VERSION_0_1,
-        .hal_api_version = HARDWARE_HAL_API_VERSION,
-        .id = AUDIO_HARDWARE_MODULE_ID,
-        .name = "USB audio HW HAL",
-        .author = "The Android Open Source Project",
-        .methods = &hal_module_methods,
-    },
-};
diff --git a/modules/usbcamera/Android.mk b/modules/usbcamera/Android.mk
new file mode 100644
index 0000000..162b158
--- /dev/null
+++ b/modules/usbcamera/Android.mk
@@ -0,0 +1,45 @@
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := camera.usb.default
+LOCAL_MODULE_RELATIVE_PATH := hw
+
+LOCAL_C_INCLUDES += \
+	system/core/include \
+	system/media/camera/include \
+
+LOCAL_SRC_FILES := \
+	CameraHAL.cpp \
+	Camera.cpp \
+	UsbCamera.cpp \
+	Metadata.cpp \
+	Stream.cpp \
+	HotplugThread.cpp \
+
+LOCAL_SHARED_LIBRARIES := \
+	libcamera_metadata \
+	libcutils \
+	liblog \
+	libsync \
+	libutils \
+
+LOCAL_CFLAGS += -Wall -Wextra -fvisibility=hidden
+
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/usbcamera/Camera.cpp b/modules/usbcamera/Camera.cpp
new file mode 100644
index 0000000..cf62f7f
--- /dev/null
+++ b/modules/usbcamera/Camera.cpp
@@ -0,0 +1,537 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "Camera"
+#include <cutils/log.h>
+
+#include <cstdlib>
+#include <stdio.h>
+#include <hardware/camera3.h>
+#include <system/camera_metadata.h>
+#include <system/graphics.h>
+#include <utils/Mutex.h>
+#include "CameraHAL.h"
+#include "Metadata.h"
+#include "Stream.h"
+
+#define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
+#include <utils/Trace.h>
+
+#include "Camera.h"
+
+namespace usb_camera_hal {
+
+extern "C" {
+// Shim passed to the framework to close an opened device.
+static int close_device(hw_device_t* dev) {
+    camera3_device_t* cam_dev = reinterpret_cast<camera3_device_t*>(dev);
+    Camera* cam = static_cast<Camera*>(cam_dev->priv);
+    return cam->close();
+}
+
+// Get handle to camera from device priv data
+static Camera *camdev_to_camera(const camera3_device_t *dev) {
+    return reinterpret_cast<Camera*>(dev->priv);
+}
+
+static int initialize(const camera3_device_t *dev,
+        const camera3_callback_ops_t *callback_ops) {
+    return camdev_to_camera(dev)->initialize(callback_ops);
+}
+
+static int configure_streams(const camera3_device_t *dev,
+        camera3_stream_configuration_t *stream_list) {
+    return camdev_to_camera(dev)->configureStreams(stream_list);
+}
+
+static const camera_metadata_t *construct_default_request_settings(
+        const camera3_device_t *dev, int type) {
+    return camdev_to_camera(dev)->constructDefaultRequestSettings(type);
+}
+
+static int process_capture_request(const camera3_device_t *dev,
+        camera3_capture_request_t *request) {
+    return camdev_to_camera(dev)->processCaptureRequest(request);
+}
+
+static void dump(const camera3_device_t *dev, int fd) {
+    camdev_to_camera(dev)->dump(fd);
+}
+
+static int flush(const camera3_device_t *dev) {
+    return camdev_to_camera(dev)->flush();
+}
+
+} // extern "C"
+
+const camera3_device_ops_t Camera::sOps = {
+    .initialize = usb_camera_hal::initialize,
+    .configure_streams = usb_camera_hal::configure_streams,
+    .register_stream_buffers = NULL,
+    .construct_default_request_settings
+        = usb_camera_hal::construct_default_request_settings,
+    .process_capture_request = usb_camera_hal::process_capture_request,
+    .get_metadata_vendor_tag_ops = NULL,
+    .dump = usb_camera_hal::dump,
+    .flush = usb_camera_hal::flush,
+    .reserved = {0},
+};
+
+Camera::Camera(int id)
+          : mId(id),
+            mStaticInfo(NULL),
+            mBusy(false),
+            mCallbackOps(NULL),
+            mSettings(NULL),
+            mIsInitialized(false) {
+    memset(&mTemplates, 0, sizeof(mTemplates));
+    memset(&mDevice, 0, sizeof(mDevice));
+    mDevice.common.tag    = HARDWARE_DEVICE_TAG;
+    // TODO: Upgrade to HAL3.3
+    mDevice.common.version = CAMERA_DEVICE_API_VERSION_3_2;
+    mDevice.common.close  = close_device;
+    mDevice.ops           = const_cast<camera3_device_ops_t*>(&sOps);
+    mDevice.priv          = this;
+}
+
+Camera::~Camera() {
+    if (mStaticInfo != NULL) {
+        free_camera_metadata(mStaticInfo);
+    }
+
+    for (int i = 0; i < CAMERA3_TEMPLATE_COUNT; i++) {
+        free_camera_metadata(mTemplates[i]);
+    }
+
+    if (mSettings != NULL) {
+        free_camera_metadata(mSettings);
+    }
+}
+
+int Camera::open(const hw_module_t *module, hw_device_t **device) {
+    ALOGI("%s:%d: Opening camera device", __func__, mId);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
+    if (mBusy) {
+        ALOGE("%s:%d: Error! Camera device already opened", __func__, mId);
+        return -EBUSY;
+    }
+
+    mBusy = true;
+    mDevice.common.module = const_cast<hw_module_t*>(module);
+    *device = &mDevice.common;
+    return openDevice();
+}
+
+int Camera::getInfo(struct camera_info *info) {
+    android::Mutex::Autolock al(mStaticInfoLock);
+
+    // TODO: update to CAMERA_FACING_EXTERNAL once the HAL API changes are merged.
+    info->facing = CAMERA_FACING_FRONT;
+    info->orientation = 0;
+    info->device_version = mDevice.common.version;
+    if (mStaticInfo == NULL) {
+        initStaticInfo();
+    }
+    info->static_camera_characteristics = mStaticInfo;
+    return 0;
+}
+
+void Camera::updateInfo() {
+    android::Mutex::Autolock al(mStaticInfoLock);
+    initStaticInfo();
+}
+
+int Camera::close() {
+    ALOGI("%s:%d: Closing camera device", __func__, mId);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
+    if (!mBusy) {
+        ALOGE("%s:%d: Error! Camera device not open", __func__, mId);
+        return -EINVAL;
+    }
+
+    mBusy = false;
+    mIsInitialized = false;
+    return closeDevice();
+}
+
+int Camera::initialize(const camera3_callback_ops_t *callback_ops) {
+    int res;
+
+    ALOGV("%s:%d: callback_ops=%p", __func__, mId, callback_ops);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
+    mCallbackOps = callback_ops;
+    // per-device specific initialization
+    res = initDevice();
+    if (res != 0) {
+        ALOGE("%s:%d: Failed to initialize device!", __func__, mId);
+        return res;
+    }
+
+    mIsInitialized = true;
+    return 0;
+}
+
+int Camera::configureStreams(camera3_stream_configuration_t *stream_config) {
+    camera3_stream_t *astream;
+    android::Vector<Stream *> newStreams;
+
+    ALOGV("%s:%d: stream_config=%p", __func__, mId, stream_config);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+    if (!mIsInitialized) {
+        ALOGE("Device is not initialized yet");
+        return -EINVAL;
+    }
+
+    if (stream_config == NULL) {
+        ALOGE("%s:%d: NULL stream configuration array", __func__, mId);
+        return -EINVAL;
+    }
+    if (stream_config->num_streams == 0) {
+        ALOGE("%s:%d: Empty stream configuration array", __func__, mId);
+        return -EINVAL;
+    }
+
+    ALOGV("%s:%d: Number of Streams: %d", __func__, mId,
+            stream_config->num_streams);
+    // Mark all current streams unused for now
+    for (size_t i = 0; i < mStreams.size(); i++) {
+        mStreams[i]->mReuse = false;
+    }
+    // Fill new stream array with reused streams and new streams
+    for (unsigned int i = 0; i < stream_config->num_streams; i++) {
+        astream = stream_config->streams[i];
+        if (astream->max_buffers > 0) {
+            ALOGV("%s:%d: Reusing stream %d", __func__, mId, i);
+            newStreams.add(reuseStreamLocked(astream));
+        } else {
+            ALOGV("%s:%d: Creating new stream %d", __func__, mId, i);
+            newStreams.add(new Stream(mId, astream));
+        }
+
+        if (newStreams[i] == NULL) {
+            ALOGE("%s:%d: Error processing stream %d", __func__, mId, i);
+            goto err_out;
+        }
+        astream->priv = reinterpret_cast<void *>(newStreams[i]);
+    }
+
+    // Verify the set of streams in aggregate
+    if (!isValidStreamSetLocked(newStreams)) {
+        ALOGE("%s:%d: Invalid stream set", __func__, mId);
+        goto err_out;
+    }
+
+    // Set up all streams (calculate usage/max_buffers for each)
+    setupStreamsLocked(newStreams);
+
+    // Destroy all old streams and replace stream array with new one
+    destroyStreamsLocked(mStreams);
+    mStreams = newStreams;
+
+    // Clear out last seen settings metadata
+    updateSettingsLocked(NULL);
+    return 0;
+
+err_out:
+    // Clean up temporary streams, preserve existing mStreams
+    destroyStreamsLocked(newStreams);
+    return -EINVAL;
+}
+
+void Camera::destroyStreamsLocked(android::Vector<Stream *> &streams) {
+    for (size_t i = 0; i < streams.size(); i++) {
+        delete streams[i];
+    }
+    streams.clear();
+}
+
+Stream *Camera::reuseStreamLocked(camera3_stream_t *astream) {
+    Stream *priv = reinterpret_cast<Stream*>(astream->priv);
+    // Verify the re-used stream's parameters match
+    if (!priv->isValidReuseStream(mId, astream)) {
+        ALOGE("%s:%d: Mismatched parameter in reused stream", __func__, mId);
+        return NULL;
+    }
+    // Mark stream to be reused
+    priv->mReuse = true;
+    return priv;
+}
+
+bool Camera::isValidStreamSetLocked(const android::Vector<Stream *> &streams) {
+    int inputs = 0;
+    int outputs = 0;
+
+    if (streams.isEmpty()) {
+        ALOGE("%s:%d: Zero count stream configuration streams", __func__, mId);
+        return false;
+    }
+    // Validate there is at most one input stream and at least one output stream
+    for (size_t i = 0; i < streams.size(); i++) {
+        // A stream may be both input and output (bidirectional)
+        if (streams[i]->isInputType())
+            inputs++;
+        if (streams[i]->isOutputType())
+            outputs++;
+    }
+    ALOGV("%s:%d: Configuring %d output streams and %d input streams",
+            __func__, mId, outputs, inputs);
+    if (outputs < 1) {
+        ALOGE("%s:%d: Stream config must have >= 1 output", __func__, mId);
+        return false;
+    }
+    if (inputs > 1) {
+        ALOGE("%s:%d: Stream config must have <= 1 input", __func__, mId);
+        return false;
+    }
+    // TODO: check for correct number of Bayer/YUV/JPEG/Encoder streams
+    return true;
+}
+
+void Camera::setupStreamsLocked(android::Vector<Stream *> &streams) {
+    /*
+     * This is where the HAL has to decide internally how to handle all of the
+     * streams, and then produce usage and max_buffer values for each stream.
+     * Note, the stream vector has been checked before this point for ALL invalid
+     * conditions, so it must find a successful configuration for this stream
+     * array.  The HAL may not return an error from this point.
+     *
+     * TODO: we just set all streams to be the same dummy values;
+     * real implementations will want to avoid USAGE_SW_{READ|WRITE}_OFTEN.
+     */
+    for (size_t i = 0; i < streams.size(); i++) {
+        uint32_t usage = 0;
+
+        if (streams[i]->isOutputType())
+            usage |= GRALLOC_USAGE_SW_WRITE_OFTEN |
+                     GRALLOC_USAGE_HW_CAMERA_WRITE;
+        if (streams[i]->isInputType())
+            usage |= GRALLOC_USAGE_SW_READ_OFTEN |
+                     GRALLOC_USAGE_HW_CAMERA_READ;
+
+        streams[i]->setUsage(usage);
+        streams[i]->setMaxBuffers(1);
+    }
+}
+
+bool Camera::isValidTemplateType(int type) {
+    return type >= 1 && type < CAMERA3_TEMPLATE_COUNT;
+}
+
+const camera_metadata_t* Camera::constructDefaultRequestSettings(int type) {
+    ALOGV("%s:%d: type=%d", __func__, mId, type);
+    android::Mutex::Autolock al(mDeviceLock);
+
+    if (!isValidTemplateType(type)) {
+        ALOGE("%s:%d: Invalid template request type: %d", __func__, mId, type);
+        return NULL;
+    }
+
+    // DO NOT try to initialize the device here, it will be guaranteed deadlock.
+    if (!mIsInitialized) {
+        ALOGE("Device is not initialized yet");
+        return NULL;
+    }
+
+    return mTemplates[type];
+}
+
+// This implementation is a copy-paste, probably we should override (or move) this to
+// device specific class.
+int Camera::processCaptureRequest(camera3_capture_request_t *request) {
+    camera3_capture_result result;
+    ALOGV("%s:%d: request=%p", __func__, mId, request);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
+    if (request == NULL) {
+        ALOGE("%s:%d: NULL request recieved", __func__, mId);
+        return -EINVAL;
+    }
+
+    ALOGV("%s:%d: Request Frame:%d Settings:%p", __func__, mId,
+            request->frame_number, request->settings);
+
+    // NULL indicates use last settings
+    if (request->settings == NULL) {
+        if (mSettings == NULL) {
+            ALOGE("%s:%d: NULL settings without previous set Frame:%d Req:%p",
+                    __func__, mId, request->frame_number, request);
+            return -EINVAL;
+        }
+    } else {
+        updateSettingsLocked(request->settings);
+    }
+
+    if (request->input_buffer != NULL) {
+        ALOGV("%s:%d: Reprocessing input buffer is not supported yet", __func__, mId);
+        return -EINVAL;
+    } else {
+        ALOGV("%s:%d: Capturing new frame.", __func__, mId);
+
+        if (!isValidCaptureSettings(request->settings)) {
+            ALOGE("%s:%d: Invalid settings for capture request: %p",
+                    __func__, mId, request->settings);
+            return -EINVAL;
+        }
+    }
+
+    if (request->num_output_buffers <= 0) {
+        ALOGE("%s:%d: Invalid number of output buffers: %d", __func__, mId,
+                request->num_output_buffers);
+        return -EINVAL;
+    }
+    result.num_output_buffers = request->num_output_buffers;
+    result.output_buffers = new camera3_stream_buffer_t[result.num_output_buffers];
+    for (unsigned int i = 0; i < request->num_output_buffers; i++) {
+        int res = processCaptureBuffer(&request->output_buffers[i],
+                const_cast<camera3_stream_buffer_t*>(&result.output_buffers[i]));
+        if (res) {
+            delete [] result.output_buffers;
+            // TODO: this should probably be a total device failure; transient for now
+            return -EINVAL;
+        }
+    }
+
+    result.frame_number = request->frame_number;
+    // TODO: return actual captured/reprocessed settings
+    result.result = request->settings;
+    // TODO: asynchronously return results
+    notifyShutter(request->frame_number, 0);
+    mCallbackOps->process_capture_result(mCallbackOps, &result);
+
+    // Free up capture result related resources, HAL owns the capture result, and it
+    // is only valid during the process_capture_result call.
+    delete[] result.output_buffers;
+
+    return 0;
+}
+
+int Camera::flush() {
+    int res;
+
+    ALOGV("%s:%d: flush device", __func__, mId);
+    // per-device specific flush
+    res = flushDevice();
+    if (res != 0) {
+        ALOGE("%s:%d: Failed to flush device!", __func__, mId);
+        return res;
+    }
+    return 0;
+}
+
+void Camera::updateSettingsLocked(const camera_metadata_t *new_settings) {
+    if (mSettings != NULL) {
+        free_camera_metadata(mSettings);
+        mSettings = NULL;
+    }
+
+    if (new_settings != NULL)
+        mSettings = clone_camera_metadata(new_settings);
+}
+
+void Camera::notifyShutter(uint32_t frame_number, uint64_t timestamp) {
+    int res;
+    struct timespec ts;
+
+    // If timestamp is 0, get timestamp from right now instead
+    if (timestamp == 0) {
+        ALOGW("%s:%d: No timestamp provided, using CLOCK_BOOTTIME",
+                __func__, mId);
+        res = clock_gettime(CLOCK_BOOTTIME, &ts);
+        if (res == 0) {
+            timestamp = ts.tv_sec * 1000000000ULL + ts.tv_nsec;
+        } else {
+            ALOGE("%s:%d: No timestamp and failed to get CLOCK_BOOTTIME %s(%d)",
+                    __func__, mId, strerror(errno), errno);
+        }
+    }
+    camera3_notify_msg_t m;
+    memset(&m, 0, sizeof(m));
+    m.type = CAMERA3_MSG_SHUTTER;
+    m.message.shutter.frame_number = frame_number;
+    m.message.shutter.timestamp = timestamp;
+    mCallbackOps->notify(mCallbackOps, &m);
+}
+
+void Camera::dump(int fd) {
+    ALOGV("%s:%d: Dumping to fd %d", __func__, mId, fd);
+    ATRACE_CALL();
+    android::Mutex::Autolock al(mDeviceLock);
+
+    dprintf(fd, "Camera ID: %d (Busy: %d)\n", mId, mBusy);
+
+    // TODO: dump all settings
+    dprintf(fd, "Most Recent Settings: (%p)\n", mSettings);
+
+    dprintf(fd, "Number of streams: %d\n", mStreams.size());
+    for (size_t i = 0; i < mStreams.size(); i++) {
+        dprintf(fd, "Stream %d/%d:\n", i, mStreams.size());
+        mStreams[i]->dump(fd);
+    }
+}
+
+const char* Camera::templateToString(int type) {
+    switch (type) {
+    case CAMERA3_TEMPLATE_PREVIEW:
+        return "CAMERA3_TEMPLATE_PREVIEW";
+    case CAMERA3_TEMPLATE_STILL_CAPTURE:
+        return "CAMERA3_TEMPLATE_STILL_CAPTURE";
+    case CAMERA3_TEMPLATE_VIDEO_RECORD:
+        return "CAMERA3_TEMPLATE_VIDEO_RECORD";
+    case CAMERA3_TEMPLATE_VIDEO_SNAPSHOT:
+        return "CAMERA3_TEMPLATE_VIDEO_SNAPSHOT";
+    case CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG:
+        return "CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG";
+    case CAMERA3_TEMPLATE_MANUAL:
+        return "CAMERA3_TEMPLATE_MANUAL";
+    }
+
+    return "Invalid template type!";
+}
+
+int Camera::setTemplate(int type, camera_metadata_t *settings) {
+    android::Mutex::Autolock al(mDeviceLock);
+
+    if (!isValidTemplateType(type)) {
+        ALOGE("%s:%d: Invalid template request type: %d", __func__, mId, type);
+        return -EINVAL;
+    }
+
+    if (mTemplates[type] != NULL) {
+        ALOGE("%s:%d: Setting already constructed template type %s(%d)",
+                __func__, mId, templateToString(type), type);
+        return -EINVAL;
+    }
+
+    // Make a durable copy of the underlying metadata
+    mTemplates[type] = clone_camera_metadata(settings);
+    if (mTemplates[type] == NULL) {
+        ALOGE("%s:%d: Failed to clone metadata %p for template type %s(%d)",
+                __func__, mId, settings, templateToString(type), type);
+        return -EINVAL;
+    }
+    return 0;
+}
+
+} // namespace usb_camera_hal
diff --git a/modules/usbcamera/Camera.h b/modules/usbcamera/Camera.h
new file mode 100644
index 0000000..6419c7d
--- /dev/null
+++ b/modules/usbcamera/Camera.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef CAMERA_H_
+#define CAMERA_H_
+
+#include <hardware/hardware.h>
+#include <hardware/camera3.h>
+#include <utils/Mutex.h>
+#include <utils/Vector.h>
+#include "Metadata.h"
+#include <sync/sync.h>
+#include "Stream.h"
+
+#define CAMERA_SYNC_TIMEOUT_MS 5000
+
+namespace usb_camera_hal {
+// Camera represents a physical camera on a device.
+// This is constructed when the HAL module is loaded, one per physical camera.
+// It is opened by the framework, and must be closed before it can be opened
+// again.
+// This is an abstract class, containing all logic and data shared between all
+// camera devices.
+class Camera {
+    public:
+        // id is used to distinguish cameras. 0 <= id < NUM_CAMERAS.
+        // module is a handle to the HAL module, used when the device is opened.
+        Camera(int id);
+        virtual ~Camera();
+
+        // Common Camera Device Operations (see <hardware/camera_common.h>)
+        int open(const hw_module_t *module, hw_device_t **device);
+        int getInfo(struct camera_info *info);
+        int close();
+
+        // Camera v3 Device Operations (see <hardware/camera3.h>)
+        int initialize(const camera3_callback_ops_t *callback_ops);
+        int configureStreams(camera3_stream_configuration_t *stream_list);
+        const camera_metadata_t *constructDefaultRequestSettings(int type);
+        int processCaptureRequest(camera3_capture_request_t *request);
+        int flush();
+        void dump(int fd);
+
+        // Update static camera characteristics. This method could be called by
+        // HAL hotplug thread when camera is plugged.
+        void updateInfo();
+
+    protected:
+        // Initialize static camera characteristics.
+        virtual int initStaticInfo() = 0;
+        // Verify settings are valid for a capture
+        virtual bool isValidCaptureSettings(const camera_metadata_t *) = 0;
+        // Separate open method for individual devices
+        virtual int openDevice() = 0;
+        // Separate initialization method for individual devices when opened
+        virtual int initDevice() = 0;
+        // Flush camera pipeline for each individual device
+        virtual int flushDevice() = 0;
+        // Separate close method for individual devices
+        virtual int closeDevice() = 0;
+        // Capture and file an output buffer for an input buffer.
+        virtual int processCaptureBuffer(const camera3_stream_buffer_t *in,
+                camera3_stream_buffer_t *out) = 0;
+        // Accessor method used by initDevice() to set the templates' metadata
+        int setTemplate(int type, camera_metadata_t *settings);
+        // Prettyprint template names
+        const char* templateToString(int type);
+        // Process an output buffer
+
+        // Identifier used by framework to distinguish cameras
+        const int mId;
+        // Metadata containing persistent camera characteristics
+        Metadata mMetadata;
+        // camera_metadata structure containing static characteristics
+        camera_metadata_t *mStaticInfo;
+
+    private:
+        // Camera device handle returned to framework for use
+        camera3_device_t mDevice;
+        // Reuse a stream already created by this device. Must be called with mDeviceLock held.
+        Stream *reuseStreamLocked(camera3_stream_t *astream);
+        // Destroy all streams in a stream array, and the array itself. Must be called with
+        // mDeviceLock held.
+        void destroyStreamsLocked(android::Vector<Stream *> &streams);
+        // Verify a set of streams is valid in aggregate. Must be called with mDeviceLock held.
+        bool isValidStreamSetLocked(const android::Vector<Stream *> &streams);
+        // Calculate usage and max_bufs of each stream. Must be called with mDeviceLock held.
+        void setupStreamsLocked(android::Vector<Stream *> &streams);
+        // Update new settings for re-use and clean up old settings. Must be called with
+        // mDeviceLock held.
+        void updateSettingsLocked(const camera_metadata_t *new_settings);
+        // Send a shutter notify message with start of exposure time
+        void notifyShutter(uint32_t frame_number, uint64_t timestamp);
+        // Is type a valid template type (and valid index into mTemplates)
+        bool isValidTemplateType(int type);
+
+        // Busy flag indicates camera is in use
+        bool mBusy;
+        // Camera device operations handle shared by all devices
+        const static camera3_device_ops_t sOps;
+        // Methods used to call back into the framework
+        const camera3_callback_ops_t *mCallbackOps;
+        // Lock protecting the Camera object for modifications
+        android::Mutex mDeviceLock;
+        // Lock protecting only static camera characteristics, which may
+        // be accessed without the camera device open
+        android::Mutex mStaticInfoLock;
+        // Array of handles to streams currently in use by the device
+        android::Vector<Stream *> mStreams;
+        // Static array of standard camera settings templates
+        camera_metadata_t *mTemplates[CAMERA3_TEMPLATE_COUNT];
+        // Most recent request settings seen, memoized to be reused
+        camera_metadata_t *mSettings;
+        bool mIsInitialized;
+};
+} // namespace usb_camera_hal
+
+#endif // CAMERA_H_
diff --git a/modules/usbcamera/CameraHAL.cpp b/modules/usbcamera/CameraHAL.cpp
new file mode 100644
index 0000000..652e937
--- /dev/null
+++ b/modules/usbcamera/CameraHAL.cpp
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "UsbCameraHAL"
+#include <cutils/log.h>
+
+#include <cstdlib>
+#include <hardware/camera_common.h>
+#include <hardware/hardware.h>
+#include "UsbCamera.h"
+#include "CameraHAL.h"
+
+/*
+ * This file serves as the entry point to the HAL.  It contains the module
+ * structure and functions used by the framework to load and interface to this
+ * HAL, as well as the handles to the individual camera devices.
+ */
+
+namespace usb_camera_hal {
+
+static CameraHAL gCameraHAL;
+
+CameraHAL::CameraHAL()
+  : mCallbacks(NULL) {
+    // Should not allocate the camera devices for now, as it is unclear if the device is plugged.
+
+    // Start hotplug thread
+    mHotplugThread = new HotplugThread(this);
+    mHotplugThread->run("usb-camera-hotplug");
+}
+
+CameraHAL::~CameraHAL() {
+    // Stop hotplug thread
+    {
+        android::Mutex::Autolock al(mModuleLock);
+        if (mHotplugThread != NULL) {
+            mHotplugThread->requestExit();
+        }
+
+        // Delete camera device from mCameras
+    }
+
+    // Joining done without holding mLock, otherwise deadlocks may ensue
+    // as the threads try to access parent states.
+    if (mHotplugThread != NULL) {
+        mHotplugThread->join();
+    }
+
+    delete mHotplugThread;
+}
+
+int CameraHAL::getNumberOfCameras() {
+    android::Mutex::Autolock al(mModuleLock);
+    ALOGV("%s: %d", __func__, mCameras.size());
+    return static_cast<int>(mCameras.size());
+}
+
+int CameraHAL::getCameraInfo(int id, struct camera_info* info) {
+    android::Mutex::Autolock al(mModuleLock);
+    ALOGV("%s: camera id %d: info=%p", __func__, id, info);
+    if (id < 0 || id >= static_cast<int>(mCameras.size())) {
+        ALOGE("%s: Invalid camera id %d", __func__, id);
+        return -ENODEV;
+    }
+
+    return mCameras[id]->getInfo(info);
+}
+
+int CameraHAL::setCallbacks(const camera_module_callbacks_t *callbacks) {
+    ALOGV("%s : callbacks=%p", __func__, callbacks);
+    mCallbacks = callbacks;
+    return 0;
+}
+
+int CameraHAL::open(const hw_module_t* mod, const char* name, hw_device_t** dev) {
+    int id;
+    char *nameEnd;
+
+    android::Mutex::Autolock al(mModuleLock);
+    ALOGV("%s: module=%p, name=%s, device=%p", __func__, mod, name, dev);
+    if (*name == '\0') {
+        ALOGE("%s: Invalid camera id name is NULL", __func__);
+        return -EINVAL;
+    }
+    id = strtol(name, &nameEnd, 10);
+    if (*nameEnd != '\0') {
+        ALOGE("%s: Invalid camera id name %s", __func__, name);
+        return -EINVAL;
+    } else if (id < 0 || id >= static_cast<int>(mCameras.size())) {
+        ALOGE("%s: Invalid camera id %d", __func__, id);
+        return -ENODEV;
+    }
+    return mCameras[id]->open(mod, dev);
+}
+
+extern "C" {
+
+static int get_number_of_cameras() {
+    return gCameraHAL.getNumberOfCameras();
+}
+
+static int get_camera_info(int id, struct camera_info* info) {
+    return gCameraHAL.getCameraInfo(id, info);
+}
+
+static int set_callbacks(const camera_module_callbacks_t *callbacks) {
+    return gCameraHAL.setCallbacks(callbacks);
+}
+
+static int open_dev(const hw_module_t* mod, const char* name, hw_device_t** dev) {
+    return gCameraHAL.open(mod, name, dev);
+}
+
+static hw_module_methods_t gCameraModuleMethods = {
+    open : open_dev
+};
+
+camera_module_t HAL_MODULE_INFO_SYM __attribute__ ((visibility("default"))) = {
+    common : {
+        tag                : HARDWARE_MODULE_TAG,
+        module_api_version : CAMERA_MODULE_API_VERSION_2_4,
+        hal_api_version    : HARDWARE_HAL_API_VERSION,
+        id                 : CAMERA_HARDWARE_MODULE_ID,
+        name               : "Default USB Camera HAL",
+        author             : "The Android Open Source Project",
+        methods            : &gCameraModuleMethods,
+        dso                : NULL,
+        reserved           : {0},
+    },
+    get_number_of_cameras : get_number_of_cameras,
+    get_camera_info       : get_camera_info,
+    set_callbacks         : set_callbacks,
+    get_vendor_tag_ops    : NULL,
+    open_legacy           : NULL,
+    set_torch_mode        : NULL,
+    init                  : NULL,
+    reserved              : {0},
+};
+} // extern "C"
+
+} // namespace usb_camera_hal
diff --git a/modules/usbcamera/CameraHAL.h b/modules/usbcamera/CameraHAL.h
new file mode 100644
index 0000000..1770d95
--- /dev/null
+++ b/modules/usbcamera/CameraHAL.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef CAMERA_HAL_H_
+#define CAMERA_HAL_H_
+
+#include <hardware/hardware.h>
+#include <hardware/camera_common.h>
+#include <utils/Vector.h>
+#include <utils/Mutex.h>
+#include "HotplugThread.h"
+#include "Camera.h"
+
+namespace usb_camera_hal {
+
+class HotplugThread;
+
+/**
+ * CameraHAL contains all module state that isn't specific to an individual camera device
+ */
+class CameraHAL {
+    public:
+        CameraHAL();
+        ~CameraHAL();
+
+        // Camera Module Interface (see <hardware/camera_common.h>)
+        int getNumberOfCameras();
+        int getCameraInfo(int camera_id, struct camera_info *info);
+        int setCallbacks(const camera_module_callbacks_t *callbacks);
+        void getVendorTagOps(vendor_tag_ops_t* ops);
+
+        // Hardware Module Interface (see <hardware/hardware.h>)
+        int open(const hw_module_t* mod, const char* name, hw_device_t** dev);
+
+    private:
+        // Callback handle
+        const camera_module_callbacks_t *mCallbacks;
+        android::Vector<Camera*> mCameras;
+        // Lock to protect the module method calls.
+        android::Mutex mModuleLock;
+        // Hot plug thread managing camera hot plug.
+        HotplugThread *mHotplugThread;
+
+};
+} // namespace usb_camera_hal
+
+#endif // CAMERA_HAL_H_
diff --git a/modules/usbcamera/HotplugThread.cpp b/modules/usbcamera/HotplugThread.cpp
new file mode 100644
index 0000000..6c65086
--- /dev/null
+++ b/modules/usbcamera/HotplugThread.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "HotplugThread"
+#include <cutils/log.h>
+
+#include "HotplugThread.h"
+
+namespace usb_camera_hal {
+
+HotplugThread::HotplugThread(CameraHAL *hal)
+    : mModule(hal) {
+
+}
+
+HotplugThread::~HotplugThread() {
+
+}
+
+void HotplugThread::requestExit() {
+    // Call parent to set up shutdown
+    Thread::requestExit();
+
+    // Cleanup other states?
+}
+
+bool HotplugThread::threadLoop() {
+
+    /**
+     * Check camera connection status change, if connected, do below:
+     * 1. Create camera device, add to mCameras.
+     * 2. Init static info (mCameras[id]->initStaticInfo())
+     * 3. Notify on_status_change callback
+     *
+     * If unconnected, similarly, do below:
+     * 1. Destroy camera device and remove it from mCameras.
+     * 2. Notify on_status_change callback
+     *
+     * DO NOT have a tight polling loop here, to avoid excessive CPU utilization.
+     */
+
+    return true;
+}
+
+} // namespace usb_camera_hal
diff --git a/modules/usbcamera/HotplugThread.h b/modules/usbcamera/HotplugThread.h
new file mode 100644
index 0000000..a13adb7
--- /dev/null
+++ b/modules/usbcamera/HotplugThread.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef HOTPLUG_THREAD_H_
+#define HOTPLUG_THREAD_H_
+
+#include <utils/Thread.h>
+#include "CameraHAL.h"
+
+namespace usb_camera_hal {
+/**
+ * Thread for managing usb camera hotplug. It does below:
+ * 1. Monitor camera hotplug status, and notify the status changes by calling
+ *    module callback methods.
+ * 2. When camera is plugged, create camera device instance, initialize the camera
+ *    static info. When camera is unplugged, destroy the camera device instance and
+ *    static metadata. As an optimization option, the camera device instance (including
+ *    the static info) could be cached when the same camera plugged/unplugged multiple
+ *    times.
+ */
+
+class CameraHAL;
+
+class HotplugThread : public android::Thread {
+
+    public:
+        HotplugThread(CameraHAL *hal);
+        ~HotplugThread();
+
+        // Override below two methods for proper cleanup.
+        virtual bool threadLoop();
+        virtual void requestExit();
+
+    private:
+        CameraHAL *mModule;
+};
+
+} // namespace usb_camera_hal
+
+#endif // HOTPLUG_THREAD_H_
diff --git a/modules/usbcamera/Metadata.cpp b/modules/usbcamera/Metadata.cpp
new file mode 100644
index 0000000..f243834
--- /dev/null
+++ b/modules/usbcamera/Metadata.cpp
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "Metadata"
+#include <cutils/log.h>
+
+#include <system/camera_metadata.h>
+
+#define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
+#include <utils/Trace.h>
+
+#include "Metadata.h"
+
+namespace usb_camera_hal {
+
+Metadata::Metadata():
+    mData(NULL) {
+}
+
+Metadata::~Metadata() {
+    replace(NULL);
+}
+
+void Metadata::replace(camera_metadata_t *m) {
+    if (m == mData) {
+        return;
+    }
+    if (mData)
+        free_camera_metadata(mData);
+    mData = m;
+}
+
+int Metadata::init(const camera_metadata_t *metadata) {
+    camera_metadata_t* tmp;
+
+    if (!validate_camera_metadata_structure(metadata, NULL))
+        return -EINVAL;
+
+    tmp = clone_camera_metadata(metadata);
+    if (tmp == NULL)
+        return -EINVAL;
+
+    replace(tmp);
+    return 0;
+}
+
+int Metadata::addUInt8(uint32_t tag, int count, const uint8_t *data) {
+    if (!validate(tag, TYPE_BYTE, count)) return -EINVAL;
+    return add(tag, count, data);
+}
+
+int Metadata::add1UInt8(uint32_t tag, const uint8_t data) {
+    return addUInt8(tag, 1, &data);
+}
+
+int Metadata::addInt32(uint32_t tag, int count, const int32_t *data) {
+    if (!validate(tag, TYPE_INT32, count)) return -EINVAL;
+    return add(tag, count, data);
+}
+
+int Metadata::addFloat(uint32_t tag, int count, const float *data) {
+    if (!validate(tag, TYPE_FLOAT, count)) return -EINVAL;
+    return add(tag, count, data);
+}
+
+int Metadata::addInt64(uint32_t tag, int count, const int64_t *data) {
+    if (!validate(tag, TYPE_INT64, count)) return -EINVAL;
+    return add(tag, count, data);
+}
+
+int Metadata::addDouble(uint32_t tag, int count, const double *data) {
+    if (!validate(tag, TYPE_DOUBLE, count)) return -EINVAL;
+    return add(tag, count, data);
+}
+
+int Metadata::addRational(uint32_t tag, int count,
+        const camera_metadata_rational_t *data) {
+    if (!validate(tag, TYPE_RATIONAL, count)) return -EINVAL;
+    return add(tag, count, data);
+}
+
+bool Metadata::validate(uint32_t tag, int tag_type, int count) {
+    if (get_camera_metadata_tag_type(tag) < 0) {
+        ALOGE("%s: Invalid metadata entry tag: %d", __func__, tag);
+        return false;
+    }
+    if (tag_type < 0 || tag_type >= NUM_TYPES) {
+        ALOGE("%s: Invalid metadata entry tag type: %d", __func__, tag_type);
+        return false;
+    }
+    if (tag_type != get_camera_metadata_tag_type(tag)) {
+        ALOGE("%s: Tag %d called with incorrect type: %s(%d)", __func__, tag,
+                camera_metadata_type_names[tag_type], tag_type);
+        return false;
+    }
+    if (count < 1) {
+        ALOGE("%s: Invalid metadata entry count: %d", __func__, count);
+        return false;
+    }
+    return true;
+}
+
+int Metadata::add(uint32_t tag, int count, const void *tag_data) {
+    // Opportunistically attempt to add if metadata has room for it
+    if (!add_camera_metadata_entry(mData, tag, tag_data, count)) {
+        return 0;
+    }
+
+    int res;
+    camera_metadata_t* tmp;
+    int tag_type = get_camera_metadata_tag_type(tag);
+    size_t size = calculate_camera_metadata_entry_data_size(tag_type, count);
+    size_t entry_capacity = get_camera_metadata_entry_count(mData) + 1;
+    size_t data_capacity = get_camera_metadata_data_count(mData) + size;
+
+    // Double new dimensions to minimize future reallocations
+    tmp = allocate_camera_metadata(entry_capacity * 2, data_capacity * 2);
+    if (tmp == NULL) {
+        ALOGE("%s: Failed to allocate new metadata with %zu entries, %zu data",
+                __func__, entry_capacity, data_capacity);
+        return -ENOMEM;
+    }
+    // Append the current metadata to the new (empty) metadata
+    res = append_camera_metadata(tmp, mData);
+    if (res) {
+        ALOGE("%s: Failed to append old metadata %p to new %p",
+                __func__, mData, tmp);
+        return res;
+    }
+    // Add the remaining new item
+    res = add_camera_metadata_entry(tmp, tag, tag_data, count);
+    if (res) {
+        ALOGE("%s: Failed to add new entry (%d, %p, %d) to metadata %p",
+                __func__, tag, tag_data, count, tmp);
+        return res;
+    }
+
+    replace(tmp);
+    return 0;
+}
+
+camera_metadata_t* Metadata::get() {
+    return mData;
+}
+
+} // namespace usb_camera_hal
diff --git a/modules/usbcamera/Metadata.h b/modules/usbcamera/Metadata.h
new file mode 100644
index 0000000..288db16
--- /dev/null
+++ b/modules/usbcamera/Metadata.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef METADATA_H_
+#define METADATA_H_
+
+#include <stdint.h>
+#include <hardware/camera3.h>
+#include <system/camera_metadata.h>
+
+namespace usb_camera_hal {
+// Metadata is a convenience class for dealing with libcamera_metadata
+class Metadata {
+    public:
+        Metadata();
+        ~Metadata();
+        // Initialize with framework metadata
+        int init(const camera_metadata_t *metadata);
+
+        // Parse and add an entry. Allocates and copies new storage for *data.
+        int addUInt8(uint32_t tag, int count, const uint8_t *data);
+        int add1UInt8(uint32_t tag, const uint8_t data);
+        int addInt32(uint32_t tag, int count, const int32_t *data);
+        int addFloat(uint32_t tag, int count, const float *data);
+        int addInt64(uint32_t tag, int count, const int64_t *data);
+        int addDouble(uint32_t tag, int count, const double *data);
+        int addRational(uint32_t tag, int count,
+                const camera_metadata_rational_t *data);
+
+        // Get a handle to the current metadata
+        // This is not a durable handle, and may be destroyed by add*/init
+        camera_metadata_t* get();
+
+    private:
+        // Actual internal storage
+        camera_metadata_t* mData;
+        // Destroy old metadata and replace with new
+        void replace(camera_metadata_t *m);
+        // Validate the tag, type and count for a metadata entry
+        bool validate(uint32_t tag, int tag_type, int count);
+        // Add a verified tag with data
+        int add(uint32_t tag, int count, const void *tag_data);
+};
+} // namespace usb_camera_hal
+
+#endif // METADATA_H_
diff --git a/modules/usbcamera/Stream.cpp b/modules/usbcamera/Stream.cpp
new file mode 100644
index 0000000..f56866e
--- /dev/null
+++ b/modules/usbcamera/Stream.cpp
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "Stream"
+#include <cutils/log.h>
+
+#include <stdio.h>
+#include <hardware/camera3.h>
+#include <hardware/gralloc.h>
+#include <system/graphics.h>
+#include <utils/Mutex.h>
+
+#define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
+#include <utils/Trace.h>
+
+#include "Stream.h"
+
+namespace usb_camera_hal {
+
+Stream::Stream(int id, camera3_stream_t *s)
+  : mReuse(false),
+    mId(id),
+    mStream(s){
+}
+
+Stream::~Stream() {
+    for (size_t i = 0; i < mBuffers.size(); i++) {
+        delete mBuffers[i];
+    }
+
+    mBuffers.clear();
+}
+
+void Stream::setUsage(uint32_t usage) {
+    android::Mutex::Autolock al(mLock);
+    if (usage != mStream->usage) {
+        mStream->usage = usage;
+    }
+}
+
+void Stream::setMaxBuffers(uint32_t max_buffers) {
+    android::Mutex::Autolock al(mLock);
+    if (max_buffers != mStream->max_buffers) {
+        mStream->max_buffers = max_buffers;
+    }
+}
+
+int Stream::getType() {
+    return mStream->stream_type;
+}
+
+bool Stream::isInputType() {
+    return mStream->stream_type == CAMERA3_STREAM_INPUT ||
+            mStream->stream_type == CAMERA3_STREAM_BIDIRECTIONAL;
+}
+
+bool Stream::isOutputType() {
+    return mStream->stream_type == CAMERA3_STREAM_OUTPUT ||
+            mStream->stream_type == CAMERA3_STREAM_BIDIRECTIONAL;
+}
+
+const char* Stream::typeToString(int type) {
+    switch (type) {
+    case CAMERA3_STREAM_INPUT:
+        return "CAMERA3_STREAM_INPUT";
+    case CAMERA3_STREAM_OUTPUT:
+        return "CAMERA3_STREAM_OUTPUT";
+    case CAMERA3_STREAM_BIDIRECTIONAL:
+        return "CAMERA3_STREAM_BIDIRECTIONAL";
+    }
+    return "Invalid stream type!";
+}
+
+const char* Stream::formatToString(int format) {
+    // See <system/graphics.h> for full list
+    switch (format) {
+    case HAL_PIXEL_FORMAT_BGRA_8888:
+        return "BGRA 8888";
+    case HAL_PIXEL_FORMAT_RGBA_8888:
+        return "RGBA 8888";
+    case HAL_PIXEL_FORMAT_RGBX_8888:
+        return "RGBX 8888";
+    case HAL_PIXEL_FORMAT_RGB_888:
+        return "RGB 888";
+    case HAL_PIXEL_FORMAT_RGB_565:
+        return "RGB 565";
+    case HAL_PIXEL_FORMAT_Y8:
+        return "Y8";
+    case HAL_PIXEL_FORMAT_Y16:
+        return "Y16";
+    case HAL_PIXEL_FORMAT_YV12:
+        return "YV12";
+    case HAL_PIXEL_FORMAT_YCbCr_422_SP:
+        return "NV16";
+    case HAL_PIXEL_FORMAT_YCrCb_420_SP:
+        return "NV21";
+    case HAL_PIXEL_FORMAT_YCbCr_422_I:
+        return "YUY2";
+    case HAL_PIXEL_FORMAT_RAW10:
+        return "RAW10";
+    case HAL_PIXEL_FORMAT_RAW16:
+        return "RAW16";
+    case HAL_PIXEL_FORMAT_BLOB:
+        return "BLOB";
+    case HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED:
+        return "IMPLEMENTATION DEFINED";
+    case HAL_PIXEL_FORMAT_YCbCr_420_888:
+        return "FLEXIBLE YCbCr 420 888";
+    }
+    return "Invalid stream format!";
+}
+
+bool Stream::isValidReuseStream(int id, camera3_stream_t *s) {
+    if (id != mId) {
+        ALOGE("%s:%d: Invalid camera id for reuse. Got %d expect %d",
+                __func__, mId, id, mId);
+        return false;
+    }
+    if (s != mStream) {
+        ALOGE("%s:%d: Invalid stream handle for reuse. Got %p expect %p",
+                __func__, mId, s, mStream);
+        return false;
+    }
+    if (s->stream_type != mStream->stream_type) {
+        ALOGE("%s:%d: Mismatched type in reused stream. Got %s(%d) "
+                "expect %s(%d)", __func__, mId, typeToString(s->stream_type),
+                s->stream_type, typeToString(mStream->stream_type), mStream->stream_type);
+        return false;
+    }
+    if (s->format != mStream->format) {
+        ALOGE("%s:%d: Mismatched format in reused stream. Got %s(%d) "
+                "expect %s(%d)", __func__, mId, formatToString(s->format),
+                s->format, formatToString(mStream->format), mStream->format);
+        return false;
+    }
+    if (s->width != mStream->width) {
+        ALOGE("%s:%d: Mismatched width in reused stream. Got %d expect %d",
+                __func__, mId, s->width, mStream->width);
+        return false;
+    }
+    if (s->height != mStream->height) {
+        ALOGE("%s:%d: Mismatched height in reused stream. Got %d expect %d",
+                __func__, mId, s->height, mStream->height);
+        return false;
+    }
+    return true;
+}
+
+void Stream::dump(int fd) {
+    android::Mutex::Autolock al(mLock);
+
+    dprintf(fd, "Stream ID: %d (%p)\n", mId, mStream);
+    dprintf(fd, "Stream Type: %s (%d)\n", typeToString(mStream->stream_type), mStream->stream_type);
+    dprintf(fd, "Width: %" PRIu32 " Height: %" PRIu32 "\n", mStream->width, mStream->height);
+    dprintf(fd, "Stream Format: %s (%d)", formatToString(mStream->format), mStream->format);
+    // ToDo: prettyprint usage mask flags
+    dprintf(fd, "Gralloc Usage Mask: %#" PRIx32 "\n", mStream->usage);
+    dprintf(fd, "Max Buffer Count: %" PRIu32 "\n", mStream->max_buffers);
+    dprintf(fd, "Number of Buffers in use by HAL: %" PRIu32 "\n", mBuffers.size());
+    for (size_t i = 0; i < mBuffers.size(); i++) {
+        dprintf(fd, "Buffer %" PRIu32 "/%" PRIu32 ": %p\n", i, mBuffers.size(),
+                mBuffers[i]);
+    }
+}
+
+} // namespace usb_camera_hal
diff --git a/modules/usbcamera/Stream.h b/modules/usbcamera/Stream.h
new file mode 100644
index 0000000..022ca9f
--- /dev/null
+++ b/modules/usbcamera/Stream.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef STREAM_H_
+#define STREAM_H_
+
+#include <hardware/camera3.h>
+#include <hardware/gralloc.h>
+#include <system/graphics.h>
+#include <utils/Mutex.h>
+#include <utils/Vector.h>
+
+namespace usb_camera_hal {
+// Stream represents a single input or output stream for a camera device.
+class Stream {
+    public:
+        Stream(int id, camera3_stream_t *s);
+        ~Stream();
+
+        // validate that a stream's parameters match this stream's parameters
+        bool isValidReuseStream(int id, camera3_stream_t *s);
+
+        void setUsage(uint32_t usage);
+        void setMaxBuffers(uint32_t max_buffers);
+
+        int getType();
+        bool isInputType();
+        bool isOutputType();
+        const char* typeToString(int type);
+        const char* formatToString(int format);
+        void dump(int fd);
+
+        // This stream is being reused. Used in stream configuration passes
+        bool mReuse;
+
+    private:
+        // The camera device id this stream belongs to
+        const int mId;
+        // Handle to framework's stream, used as a cookie for buffers
+        camera3_stream_t *mStream;
+        // Array of handles to buffers currently in use by the stream
+        android::Vector<buffer_handle_t *> mBuffers;
+        // Lock protecting the Stream object for modifications
+        android::Mutex mLock;
+};
+} // namespace usb_camera_hal
+
+#endif // STREAM_H_
diff --git a/modules/usbcamera/UsbCamera.cpp b/modules/usbcamera/UsbCamera.cpp
new file mode 100644
index 0000000..82a1145
--- /dev/null
+++ b/modules/usbcamera/UsbCamera.cpp
@@ -0,0 +1,321 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "UsbCameraDevice"
+#include <cutils/log.h>
+
+#include <system/camera_metadata.h>
+
+#define ATRACE_TAG (ATRACE_TAG_CAMERA | ATRACE_TAG_HAL)
+#include <utils/Trace.h>
+
+#include "Camera.h"
+#include "UsbCamera.h"
+
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
+
+namespace usb_camera_hal {
+
+UsbCamera::UsbCamera(int id) : Camera(id) {
+}
+
+UsbCamera::~UsbCamera() {
+}
+
+int UsbCamera::initStaticInfo() {
+    /*
+     * Setup static camera info.  This will have to customized per camera
+     * device.
+     * TODO: this is just some sample code, need tailor for USB cameras.
+     */
+    if (mStaticInfo != NULL) {
+        free_camera_metadata(mStaticInfo);
+    }
+
+    Metadata m;
+
+    /* android.control */
+    int32_t android_control_ae_available_target_fps_ranges[] = {30, 30};
+    m.addInt32(ANDROID_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES,
+            ARRAY_SIZE(android_control_ae_available_target_fps_ranges),
+            android_control_ae_available_target_fps_ranges);
+
+    int32_t android_control_ae_compensation_range[] = {-4, 4};
+    m.addInt32(ANDROID_CONTROL_AE_COMPENSATION_RANGE,
+            ARRAY_SIZE(android_control_ae_compensation_range),
+            android_control_ae_compensation_range);
+
+    camera_metadata_rational_t android_control_ae_compensation_step[] = {{2,1}};
+    m.addRational(ANDROID_CONTROL_AE_COMPENSATION_STEP,
+            ARRAY_SIZE(android_control_ae_compensation_step),
+            android_control_ae_compensation_step);
+
+    int32_t android_control_max_regions[] = {/*AE*/ 1,/*AWB*/ 1,/*AF*/ 1};
+    m.addInt32(ANDROID_CONTROL_MAX_REGIONS,
+            ARRAY_SIZE(android_control_max_regions),
+            android_control_max_regions);
+
+    /* android.jpeg */
+    int32_t android_jpeg_available_thumbnail_sizes[] = {0, 0, 128, 96};
+    m.addInt32(ANDROID_JPEG_AVAILABLE_THUMBNAIL_SIZES,
+            ARRAY_SIZE(android_jpeg_available_thumbnail_sizes),
+            android_jpeg_available_thumbnail_sizes);
+
+    int32_t android_jpeg_max_size[] = {13 * 1024 * 1024}; // 13MB
+    m.addInt32(ANDROID_JPEG_MAX_SIZE,
+            ARRAY_SIZE(android_jpeg_max_size),
+            android_jpeg_max_size);
+
+    /* android.lens */
+    float android_lens_info_available_focal_lengths[] = {1.0};
+    m.addFloat(ANDROID_LENS_INFO_AVAILABLE_FOCAL_LENGTHS,
+            ARRAY_SIZE(android_lens_info_available_focal_lengths),
+            android_lens_info_available_focal_lengths);
+
+    /* android.request */
+    int32_t android_request_max_num_output_streams[] = {0, 3, 1};
+    m.addInt32(ANDROID_REQUEST_MAX_NUM_OUTPUT_STREAMS,
+            ARRAY_SIZE(android_request_max_num_output_streams),
+            android_request_max_num_output_streams);
+
+    /* android.scaler */
+    int32_t android_scaler_available_formats[] = {
+            HAL_PIXEL_FORMAT_RAW16,
+            HAL_PIXEL_FORMAT_BLOB,
+            HAL_PIXEL_FORMAT_RGBA_8888,
+            HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED,
+            // These are handled by YCbCr_420_888
+            //        HAL_PIXEL_FORMAT_YV12,
+            //        HAL_PIXEL_FORMAT_YCrCb_420_SP,
+            HAL_PIXEL_FORMAT_YCbCr_420_888};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_FORMATS,
+            ARRAY_SIZE(android_scaler_available_formats),
+            android_scaler_available_formats);
+
+    int64_t android_scaler_available_jpeg_min_durations[] = {1};
+    m.addInt64(ANDROID_SCALER_AVAILABLE_JPEG_MIN_DURATIONS,
+            ARRAY_SIZE(android_scaler_available_jpeg_min_durations),
+            android_scaler_available_jpeg_min_durations);
+
+    int32_t android_scaler_available_jpeg_sizes[] = {640, 480};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_JPEG_SIZES,
+            ARRAY_SIZE(android_scaler_available_jpeg_sizes),
+            android_scaler_available_jpeg_sizes);
+
+    float android_scaler_available_max_digital_zoom[] = {1};
+    m.addFloat(ANDROID_SCALER_AVAILABLE_MAX_DIGITAL_ZOOM,
+            ARRAY_SIZE(android_scaler_available_max_digital_zoom),
+            android_scaler_available_max_digital_zoom);
+
+    int64_t android_scaler_available_processed_min_durations[] = {1};
+    m.addInt64(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS,
+            ARRAY_SIZE(android_scaler_available_processed_min_durations),
+            android_scaler_available_processed_min_durations);
+
+    int32_t android_scaler_available_processed_sizes[] = {640, 480};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES,
+            ARRAY_SIZE(android_scaler_available_processed_sizes),
+            android_scaler_available_processed_sizes);
+
+    int64_t android_scaler_available_raw_min_durations[] = {1};
+    m.addInt64(ANDROID_SCALER_AVAILABLE_RAW_MIN_DURATIONS,
+            ARRAY_SIZE(android_scaler_available_raw_min_durations),
+            android_scaler_available_raw_min_durations);
+
+    int32_t android_scaler_available_raw_sizes[] = {640, 480};
+    m.addInt32(ANDROID_SCALER_AVAILABLE_RAW_SIZES,
+            ARRAY_SIZE(android_scaler_available_raw_sizes),
+            android_scaler_available_raw_sizes);
+
+    /* android.sensor */
+
+    int32_t android_sensor_info_active_array_size[] = {0, 0, 640, 480};
+    m.addInt32(ANDROID_SENSOR_INFO_ACTIVE_ARRAY_SIZE,
+            ARRAY_SIZE(android_sensor_info_active_array_size),
+            android_sensor_info_active_array_size);
+
+    int32_t android_sensor_info_sensitivity_range[] =
+            {100, 1600};
+    m.addInt32(ANDROID_SENSOR_INFO_SENSITIVITY_RANGE,
+            ARRAY_SIZE(android_sensor_info_sensitivity_range),
+            android_sensor_info_sensitivity_range);
+
+    int64_t android_sensor_info_max_frame_duration[] = {30000000000};
+    m.addInt64(ANDROID_SENSOR_INFO_MAX_FRAME_DURATION,
+            ARRAY_SIZE(android_sensor_info_max_frame_duration),
+            android_sensor_info_max_frame_duration);
+
+    float android_sensor_info_physical_size[] = {3.2, 2.4};
+    m.addFloat(ANDROID_SENSOR_INFO_PHYSICAL_SIZE,
+            ARRAY_SIZE(android_sensor_info_physical_size),
+            android_sensor_info_physical_size);
+
+    int32_t android_sensor_info_pixel_array_size[] = {640, 480};
+    m.addInt32(ANDROID_SENSOR_INFO_PIXEL_ARRAY_SIZE,
+            ARRAY_SIZE(android_sensor_info_pixel_array_size),
+            android_sensor_info_pixel_array_size);
+
+    int32_t android_sensor_orientation[] = {0};
+    m.addInt32(ANDROID_SENSOR_ORIENTATION,
+            ARRAY_SIZE(android_sensor_orientation),
+            android_sensor_orientation);
+
+    /* End of static camera characteristics */
+
+    mStaticInfo = clone_camera_metadata(m.get());
+
+    return 0;
+}
+
+int UsbCamera::openDevice() {
+    // TODO: implement usb camera device open sequence: open device nodes etc.
+
+    return 0;
+}
+
+int UsbCamera::closeDevice() {
+    // TODO: implement usb camera device close sequence: close device nodes etc.
+
+    return 0;
+}
+
+int UsbCamera::processCaptureBuffer(const camera3_stream_buffer_t *in,
+        camera3_stream_buffer_t *out) {
+    if (in->acquire_fence != -1) {
+        int res = sync_wait(in->acquire_fence, CAMERA_SYNC_TIMEOUT_MS);
+        if (res == -ETIME) {
+            ALOGE("%s:%d: Timeout waiting on buffer acquire fence",
+                    __func__, mId);
+            return res;
+        } else if (res) {
+            ALOGE("%s:%d: Error waiting on buffer acquire fence: %s(%d)",
+                    __func__, mId, strerror(-res), res);
+            return res;
+        }
+    }
+
+    out->stream = in->stream;
+    out->buffer = in->buffer;
+    out->status = CAMERA3_BUFFER_STATUS_OK;
+    // TODO: use driver-backed release fences
+    out->acquire_fence = -1;
+    out->release_fence = -1;
+
+    // TODO: lock and software-paint buffer
+    return 0;
+}
+
+int UsbCamera::initDevice() {
+    int res;
+    Metadata base;
+
+    // Create standard settings templates from copies of base metadata
+    res = base.add1UInt8(ANDROID_CONTROL_MODE, ANDROID_CONTROL_MODE_OFF);
+    if (res)
+        return res;
+
+    // Use base settings to create all other templates and set them. This is just some samples,
+    // More initialization may be needed.
+    res = initPreviewTemplate(base);
+    if (res)
+        return res;
+    res = initStillTemplate(base);
+    if (res)
+        return res;
+    res = initRecordTemplate(base);
+    if (res)
+        return res;
+    res = initSnapshotTemplate(base);
+    if (res)
+        return res;
+    res = initZslTemplate(base);
+    if (res)
+        return res;
+    res = initManualTemplate(base);
+    if (res)
+        return res;
+
+    return 0;
+}
+
+int UsbCamera::initPreviewTemplate(Metadata m) {
+    // Setup default preview controls
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_PREVIEW);
+
+    if (res)
+        return res;
+    // TODO: set fast auto-focus, auto-whitebalance, auto-exposure, auto flash
+    return setTemplate(CAMERA3_TEMPLATE_PREVIEW, m.get());
+}
+
+int UsbCamera::initStillTemplate(Metadata m) {
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_STILL_CAPTURE);
+    // Setup default still capture controls
+    if (res)
+        return res;
+    // TODO: set fast auto-focus, auto-whitebalance, auto-exposure, auto flash
+    return setTemplate(CAMERA3_TEMPLATE_STILL_CAPTURE, m.get());
+}
+
+int UsbCamera::initRecordTemplate(Metadata m) {
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_RECORD);
+    // Setup default video record controls
+    if (res)
+        return res;
+    // TODO: set slow auto-focus, auto-whitebalance, auto-exposure, flash off
+    return setTemplate(CAMERA3_TEMPLATE_VIDEO_RECORD, m.get());
+}
+
+int UsbCamera::initSnapshotTemplate(Metadata m) {
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_SNAPSHOT);
+    // Setup default video snapshot controls
+    if (res)
+        return res;
+    // TODO: set slow auto-focus, auto-whitebalance, auto-exposure, flash off
+    return setTemplate(CAMERA3_TEMPLATE_VIDEO_SNAPSHOT, m.get());
+}
+
+int UsbCamera::initZslTemplate(Metadata m) {
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_ZERO_SHUTTER_LAG);
+    // Setup default zero shutter lag controls
+    if (res)
+        return res;
+    // TODO: set reprocessing parameters for zsl input queue
+    return setTemplate(CAMERA3_TEMPLATE_ZERO_SHUTTER_LAG, m.get());
+}
+
+int UsbCamera::initManualTemplate(Metadata m) {
+    int res = m.add1UInt8(ANDROID_CONTROL_CAPTURE_INTENT,
+                            ANDROID_CONTROL_CAPTURE_INTENT_MANUAL);
+    // Setup manual controls
+    if (res)
+        return res;
+    // TODO: set reprocessing parameters for zsl input queue
+    return setTemplate(CAMERA3_TEMPLATE_MANUAL, m.get());
+}
+
+bool UsbCamera::isValidCaptureSettings(const camera_metadata_t* settings) {
+    // TODO: reject settings that cannot be captured
+    return true;
+}
+
+} // namespace usb_camera_hal
diff --git a/modules/usbcamera/UsbCamera.h b/modules/usbcamera/UsbCamera.h
new file mode 100644
index 0000000..fe52ade
--- /dev/null
+++ b/modules/usbcamera/UsbCamera.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef EXAMPLE_CAMERA_H_
+#define EXAMPLE_CAMERA_H_
+
+#include <system/camera_metadata.h>
+#include "Camera.h"
+
+namespace usb_camera_hal {
+/**
+ * UsbCamera is an example for a specific camera device. The Camera instance contains
+ * a specific camera device (e.g. UsbCamera) holds all specific metadata and logic about
+ * that device.
+ */
+class UsbCamera : public Camera {
+    public:
+        UsbCamera(int id);
+        ~UsbCamera();
+
+    private:
+        // Initialize static camera characteristics for individual device
+        int initStaticInfo();
+        int openDevice();
+        // Initialize whole device (templates/etc) when opened
+        int initDevice();
+        int flushDevice();
+        int closeDevice();
+        int processCaptureBuffer(const camera3_stream_buffer_t *in, camera3_stream_buffer_t *out);
+        // Initialize each template metadata controls
+        int initPreviewTemplate(Metadata m);
+        int initStillTemplate(Metadata m);
+        int initRecordTemplate(Metadata m);
+        int initSnapshotTemplate(Metadata m);
+        int initZslTemplate(Metadata m);
+        int initManualTemplate(Metadata m);
+        // Verify settings are valid for a capture with this device
+        bool isValidCaptureSettings(const camera_metadata_t* settings);
+};
+} // namespace usb_camera_hal
+
+#endif // CAMERA_H_
diff --git a/modules/vibrator/vibrator.c b/modules/vibrator/vibrator.c
index ce4c03c..6b3ce57 100644
--- a/modules/vibrator/vibrator.c
+++ b/modules/vibrator/vibrator.c
@@ -19,6 +19,7 @@
 
 #include <cutils/log.h>
 
+#include <malloc.h>
 #include <stdio.h>
 #include <unistd.h>
 #include <fcntl.h>
diff --git a/tests/camera2/Android.mk b/tests/camera2/Android.mk
index 9efac0f..e45f467 100644
--- a/tests/camera2/Android.mk
+++ b/tests/camera2/Android.mk
@@ -2,7 +2,6 @@
 include $(CLEAR_VARS)
 
 LOCAL_SRC_FILES:= \
-	camera2.cpp \
 	camera2_utils.cpp \
 	main.cpp \
 	CameraMetadataTests.cpp \
@@ -19,7 +18,6 @@
 	liblog \
 	libutils \
 	libcutils \
-	libstlport \
 	libhardware \
 	libcamera_metadata \
 	libcameraservice \
@@ -29,22 +27,17 @@
 	libui \
 	libdl
 
-LOCAL_STATIC_LIBRARIES := \
-	libgtest
-
 LOCAL_C_INCLUDES += \
-	bionic \
-	bionic/libstdc++/include \
-	external/gtest/include \
-	external/stlport/stlport \
 	system/media/camera/include \
 	frameworks/av/include/ \
 	frameworks/av/services/camera/libcameraservice \
 	frameworks/native/include \
 
 LOCAL_CFLAGS += -Wall -Wextra
-
 LOCAL_MODULE:= camera2_test
+LOCAL_MODULE_STEM_32 := camera2_test
+LOCAL_MODULE_STEM_64 := camera2_test64
+LOCAL_MULTILIB := both
 LOCAL_MODULE_TAGS := tests
 
 include $(BUILD_NATIVE_TEST)
diff --git a/tests/camera2/CameraBurstTests.cpp b/tests/camera2/CameraBurstTests.cpp
index 7301fce..198c0c1 100644
--- a/tests/camera2/CameraBurstTests.cpp
+++ b/tests/camera2/CameraBurstTests.cpp
@@ -15,6 +15,7 @@
  */
 
 #include <gtest/gtest.h>
+#include <inttypes.h>
 
 #define LOG_TAG "CameraBurstTest"
 //#define LOG_NDEBUG 0
@@ -48,7 +49,7 @@
 #define dout if (0) std::cout
 #endif
 
-#define WARN_UNLESS(condition) (!(condition) ? (std::cerr) : (std::ostream(NULL)) << "Warning: ")
+#define WARN_UNLESS(condition) if(!(condition)) std::cerr << "Warning: "
 #define WARN_LE(exp, act) WARN_UNLESS((exp) <= (act))
 #define WARN_LT(exp, act) WARN_UNLESS((exp) < (act))
 #define WARN_GT(exp, act) WARN_UNLESS((exp) > (act))
@@ -218,7 +219,7 @@
         CameraMetadata tmpRequest = previewRequest;
         ASSERT_EQ(OK, tmpRequest.update(ANDROID_SENSOR_EXPOSURE_TIME,
                                         &exposures[i], 1));
-        ALOGV("Submitting capture request %d with exposure %lld", i,
+        ALOGV("Submitting capture request %d with exposure %" PRId64, i,
             exposures[i]);
         dout << "Capture request " << i << " exposure is "
              << (exposures[i]/1e6f) << std::endl;
@@ -230,11 +231,11 @@
     float brightnesses[CAMERA_FRAME_BURST_COUNT];
     // Get each frame (metadata) and then the buffer. Calculate brightness.
     for (int i = 0; i < CAMERA_FRAME_BURST_COUNT; ++i) {
-        ALOGV("Reading capture request %d with exposure %lld", i, exposures[i]);
+        ALOGV("Reading capture request %d with exposure %" PRId64, i, exposures[i]);
         ASSERT_EQ(OK, mDevice->waitForNextFrame(CAMERA_FRAME_TIMEOUT));
         ALOGV("Reading capture request-1 %d", i);
-        CameraMetadata frameMetadata;
-        ASSERT_EQ(OK, mDevice->getNextFrame(&frameMetadata));
+        CaptureResult result;
+        ASSERT_EQ(OK, mDevice->getNextResult(&result));
         ALOGV("Reading capture request-2 %d", i);
 
         ASSERT_EQ(OK, mFrameListener->waitForFrame(CAMERA_FRAME_TIMEOUT));
@@ -411,34 +412,38 @@
     dout << std::endl;
 
     {
-        camera_metadata_ro_entry availableProcessedSizes =
-                GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES);
+        if (getDeviceVersion() < CAMERA_DEVICE_API_VERSION_3_2) {
+            camera_metadata_ro_entry availableProcessedSizes =
+                    GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES);
 
-        camera_metadata_ro_entry availableProcessedMinFrameDurations =
-                GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS);
+            camera_metadata_ro_entry availableProcessedMinFrameDurations =
+                    GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS);
 
-        EXPECT_EQ(availableProcessedSizes.count,
-                availableProcessedMinFrameDurations.count * 2) <<
-                "The number of minimum frame durations doesn't match the number of "
-                "available sizes. Using fallback values";
+            EXPECT_EQ(availableProcessedSizes.count,
+                    availableProcessedMinFrameDurations.count * 2) <<
+                    "The number of minimum frame durations doesn't match the number of "
+                    "available sizes. Using fallback values";
 
-        if (availableProcessedSizes.count ==
-                availableProcessedMinFrameDurations.count * 2) {
-            bool gotSize = false;
-            for (size_t i = 0; i < availableProcessedSizes.count; i += 2) {
-                if (availableProcessedSizes.data.i32[i] == mWidth &&
-                        availableProcessedSizes.data.i32[i+1] == mHeight) {
-                    gotSize = true;
-                    minDuration = availableProcessedMinFrameDurations.data.i64[i/2];
+            if (availableProcessedSizes.count ==
+                    availableProcessedMinFrameDurations.count * 2) {
+                bool gotSize = false;
+                for (size_t i = 0; i < availableProcessedSizes.count; i += 2) {
+                    if (availableProcessedSizes.data.i32[i] == mWidth &&
+                            availableProcessedSizes.data.i32[i+1] == mHeight) {
+                        gotSize = true;
+                        minDuration = availableProcessedMinFrameDurations.data.i64[i/2];
+                    }
                 }
+                EXPECT_TRUE(gotSize) << "Can't find stream size in list of "
+                        "available sizes: " << mWidth << ", " << mHeight;
             }
-            EXPECT_TRUE(gotSize) << "Can't find stream size in list of "
-                    "available sizes: " << mWidth << ", " << mHeight;
+            if (minDuration == 0) {
+                minDuration = 1 * SEC / 30; // Fall back to 30 fps as minimum duration
+            }
+        } else {
+            minDuration = getMinFrameDurationFor(
+                    HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED, mWidth, mHeight);
         }
-        if (minDuration == 0) {
-            minDuration = 1 * SEC / 30; // Fall back to 30 fps as minimum duration
-        }
-
         ASSERT_LT(0, minDuration);
 
         camera_metadata_ro_entry maxFrameDuration =
@@ -613,7 +618,7 @@
                                         &durationList[i], 1));
         ASSERT_EQ(OK, tmpRequest.update(ANDROID_SENSOR_SENSITIVITY,
                                         &sensitivityList[i], 1));
-        ALOGV("Submitting capture %d with exposure %lld, frame duration %lld, sensitivity %d",
+        ALOGV("Submitting capture %zu with exposure %" PRId64 ", frame duration %" PRId64 ", sensitivity %d",
                 i, expList[i], durationList[i], sensitivityList[i]);
         dout << "Capture request " << i <<
                 ": exposure is " << (expList[i]/1e6f) << " ms" <<
@@ -631,7 +636,7 @@
     // Get each frame (metadata) and then the buffer. Calculate brightness.
     for (size_t i = 0; i < expList.size(); ++i) {
 
-        ALOGV("Reading request %d", i);
+        ALOGV("Reading request %zu", i);
         dout << "Waiting for capture " << i << ": " <<
                 " exposure " << (expList[i]/1e6f) << " ms," <<
                 " frame duration " << (durationList[i]/1e6f) << " ms," <<
@@ -644,10 +649,10 @@
         if (durationList[i] * 2 > waitLimit) waitLimit = durationList[i] * 2;
 
         ASSERT_EQ(OK, mDevice->waitForNextFrame(waitLimit));
-        ALOGV("Reading capture request-1 %d", i);
-        CameraMetadata frameMetadata;
-        ASSERT_EQ(OK, mDevice->getNextFrame(&frameMetadata));
-        ALOGV("Reading capture request-2 %d", i);
+        ALOGV("Reading capture request-1 %zu", i);
+        CaptureResult result;
+        ASSERT_EQ(OK, mDevice->getNextResult(&result));
+        ALOGV("Reading capture request-2 %zu", i);
 
         ASSERT_EQ(OK, mFrameListener->waitForFrame(CAMERA_FRAME_TIMEOUT));
         ALOGV("We got the frame now");
@@ -668,7 +673,7 @@
             avgBrightness = 255;
         }
 
-        ALOGV("Total brightness for frame %d was %lld (underexposed %d, "
+        ALOGV("Total brightness for frame %zu was %lld (underexposed %d, "
               "overexposed %d), avg %f", i, brightness, underexposed,
               overexposed, avgBrightness);
         dout << "Average brightness (frame " << i << ") was " << avgBrightness
@@ -711,7 +716,7 @@
 
         if (dumpFrames) {
             String8 dumpName =
-                    String8::format("/data/local/tmp/camera2_test_variable_burst_frame_%03d.yuv", i);
+                    String8::format("/data/local/tmp/camera2_test_variable_burst_frame_%03zu.yuv", i);
             dout << "  Writing YUV dump to " << dumpName << std::endl;
             DumpYuvToFile(dumpName, imgBuffer);
         }
diff --git a/tests/camera2/CameraFrameTests.cpp b/tests/camera2/CameraFrameTests.cpp
index e78a862..3c5abf7 100644
--- a/tests/camera2/CameraFrameTests.cpp
+++ b/tests/camera2/CameraFrameTests.cpp
@@ -115,8 +115,8 @@
         ALOGV("Reading capture request %d", i);
         ASSERT_EQ(OK, mDevice->waitForNextFrame(CAMERA_FRAME_TIMEOUT));
 
-        CameraMetadata frameMetadata;
-        ASSERT_EQ(OK, mDevice->getNextFrame(&frameMetadata));
+        CaptureResult result;
+        ASSERT_EQ(OK, mDevice->getNextResult(&result));
 
         // wait for buffer to be available
         ASSERT_EQ(OK, mFrameListener->waitForFrame(CAMERA_FRAME_TIMEOUT));
diff --git a/tests/camera2/CameraMetadataTests.cpp b/tests/camera2/CameraMetadataTests.cpp
index eddc593..da5b748 100644
--- a/tests/camera2/CameraMetadataTests.cpp
+++ b/tests/camera2/CameraMetadataTests.cpp
@@ -162,27 +162,34 @@
 TEST_F(CameraMetadataTest, SaneResolutions) {
     TEST_EXTENSION_FORKING_INIT;
 
-    // Iff there are listed raw resolutions, the format should be available
-    int rawResolutionsCount =
-            GetEntryCountFromStaticTag(ANDROID_SCALER_AVAILABLE_RAW_SIZES);
-    if (rawResolutionsCount > 0) {
-        EXPECT_TRUE(
-            HasElementInArrayFromStaticTag(ANDROID_SCALER_AVAILABLE_FORMATS,
-                    HAL_PIXEL_FORMAT_RAW_SENSOR));
+    if (getDeviceVersion() < CAMERA_DEVICE_API_VERSION_3_2) {
+        // Iff there are listed raw resolutions, the format should be available
+        int rawResolutionsCount =
+                GetEntryCountFromStaticTag(ANDROID_SCALER_AVAILABLE_RAW_SIZES);
+        if (rawResolutionsCount > 0) {
+            EXPECT_TRUE(
+                HasElementInArrayFromStaticTag(ANDROID_SCALER_AVAILABLE_FORMATS,
+                        HAL_PIXEL_FORMAT_RAW16));
+        }
+
+        // Required processed sizes.
+        int processedSizeCount =
+               GetEntryCountFromStaticTag(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES);
+        EXPECT_NE(0, processedSizeCount);
+        EXPECT_EQ(0, processedSizeCount % 2); // multiple of 2 (w,h)
+
+        // Required JPEG sizes
+        int jpegSizeCount =
+                GetEntryCountFromStaticTag(ANDROID_SCALER_AVAILABLE_JPEG_SIZES);
+        EXPECT_NE(0, jpegSizeCount);
+        EXPECT_EQ(0, jpegSizeCount % 2); // multiple of 2 (w,h)
+    } else {
+        int strmConfigCount =
+                GetEntryCountFromStaticTag(ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS);
+        EXPECT_NE(0, strmConfigCount);
+        EXPECT_EQ(0, strmConfigCount % 4); // multiple of 4 (format,w,h,output?)
     }
 
-    // Required processed sizes.
-    int processedSizeCount =
-           GetEntryCountFromStaticTag(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES);
-    EXPECT_NE(0, processedSizeCount);
-    EXPECT_EQ(0, processedSizeCount % 2); // multiple of 2 (w,h)
-
-    // Required JPEG sizes
-    int jpegSizeCount =
-            GetEntryCountFromStaticTag(ANDROID_SCALER_AVAILABLE_JPEG_SIZES);
-    EXPECT_NE(0, jpegSizeCount);
-    EXPECT_EQ(0, jpegSizeCount % 2); // multiple of 2 (w,h)
-
 }
 
 }
diff --git a/tests/camera2/CameraModuleFixture.h b/tests/camera2/CameraModuleFixture.h
index acf41e1..3a2df69 100644
--- a/tests/camera2/CameraModuleFixture.h
+++ b/tests/camera2/CameraModuleFixture.h
@@ -22,6 +22,7 @@
 #include "hardware/hardware.h"
 #include "hardware/camera2.h"
 
+#include <common/CameraModule.h>
 #include <device2/Camera2Device.h>
 #include <device3/Camera3Device.h>
 
@@ -54,15 +55,17 @@
     void SetUp() {
         TEST_EXTENSION_FORKING_SET_UP;
 
+        camera_module_t *rawModule;
         ASSERT_LE(0, hw_get_module(CAMERA_HARDWARE_MODULE_ID,
-            (const hw_module_t **)&mModule)) << "Could not load camera module";
-        ASSERT_NE((void*)0, mModule);
+            (const hw_module_t **)&rawModule)) << "Could not load camera module";
+        ASSERT_NE((void*)0, rawModule);
+        mModule = new CameraModule(rawModule);
 
-        mNumberOfCameras = mModule->get_number_of_cameras();
+        mNumberOfCameras = mModule->getNumberOfCameras();
         ASSERT_LE(0, mNumberOfCameras);
 
         ASSERT_LE(
-            CAMERA_MODULE_API_VERSION_2_0, mModule->common.module_api_version)
+            CAMERA_MODULE_API_VERSION_2_0, mModule->getModuleApiVersion())
             << "Wrong module API version";
 
         /* For using this fixture in other tests only */
@@ -72,6 +75,7 @@
     void TearDown() {
         TEST_EXTENSION_FORKING_TEAR_DOWN;
 
+        delete mModule;
         TearDownMixin();
 
         /* important: device must be destructed before closing module,
@@ -79,14 +83,14 @@
         mDevice.clear();
 
         if (!TEST_EXTENSION_FORKING_ENABLED) {
-            ASSERT_EQ(0, HWModuleHelpers::closeModule(&mModule->common))
+            ASSERT_EQ(0, HWModuleHelpers::closeModule(mModule->getDso()))
                 << "Failed to close camera HAL module";
         }
     }
 
     void CreateCamera(int cameraID, /*out*/ sp<CameraDeviceBase> *device) {
         struct camera_info info;
-        ASSERT_EQ(OK, mModule->get_camera_info(cameraID, &info));
+        ASSERT_EQ(OK, mModule->getCameraInfo(cameraID, &info));
 
         ASSERT_GE((int)info.device_version, CAMERA_DEVICE_API_VERSION_2_0) <<
                 "Device version too old for camera " << cameraID << ". Version: " <<
@@ -97,6 +101,8 @@
                 *device = new Camera2Device(cameraID);
                 break;
             case CAMERA_DEVICE_API_VERSION_3_0:
+            case CAMERA_DEVICE_API_VERSION_3_1:
+            case CAMERA_DEVICE_API_VERSION_3_2:
                 *device = new Camera3Device(cameraID);
                 break;
             default:
@@ -114,7 +120,7 @@
     int getDeviceVersion(int cameraId, status_t* status = NULL) {
         camera_info info;
         status_t res;
-        res = mModule->get_camera_info(cameraId, &info);
+        res = mModule->getCameraInfo(cameraId, &info);
         if (status != NULL) *status = res;
 
         return info.device_version;
@@ -145,7 +151,7 @@
 
 protected:
     int mNumberOfCameras;
-    camera_module_t *mModule;
+    CameraModule *mModule;
     sp<CameraDeviceBase> mDevice;
 
 private:
diff --git a/tests/camera2/CameraModuleTests.cpp b/tests/camera2/CameraModuleTests.cpp
index 828c56a..2b6c757 100644
--- a/tests/camera2/CameraModuleTests.cpp
+++ b/tests/camera2/CameraModuleTests.cpp
@@ -93,11 +93,7 @@
 
     for (unsigned i = 0; i < sizeof(idx)/sizeof(idx[0]); ++i) {
         String8 deviceName = String8::format("%d", idx[i]);
-        status_t res =
-                mModule->common.methods->open(
-                                             &mModule->common,
-                                             deviceName,
-                                             &device);
+        status_t res = mModule->open(deviceName, &device);
         EXPECT_NE(OK, res);
         EXPECT_EQ(-ENODEV, res)
             << "Incorrect error code when trying to open camera with invalid id "
@@ -111,7 +107,7 @@
 
     for (int i = 0; i < mNumberOfCameras; ++i) {
         struct camera_info info;
-        ASSERT_EQ(OK, mModule->get_camera_info(i, &info));
+        ASSERT_EQ(OK, mModule->getCameraInfo(i, &info));
     }
 
 }
@@ -123,8 +119,8 @@
     int idx[] = { -1, mNumberOfCameras, mNumberOfCameras + 1 };
     for (unsigned i = 0; i < sizeof(idx)/sizeof(idx[0]); ++i) {
         struct camera_info info;
-        EXPECT_NE(OK, mModule->get_camera_info(idx[i], &info));
-        EXPECT_EQ(-ENODEV, mModule->get_camera_info(idx[i], &info))
+        EXPECT_NE(OK, mModule->getCameraInfo(idx[i], &info));
+        EXPECT_EQ(-EINVAL, mModule->getCameraInfo(idx[i], &info))
             << "Incorrect error code for get_camera_info idx= "
             << idx[i];
     }
diff --git a/tests/camera2/CameraMultiStreamTests.cpp b/tests/camera2/CameraMultiStreamTests.cpp
index a78950c..3e29ad6 100644
--- a/tests/camera2/CameraMultiStreamTests.cpp
+++ b/tests/camera2/CameraMultiStreamTests.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <inttypes.h>
 #define LOG_TAG "CameraMultiStreamTest"
 //#define LOG_NDEBUG 0
 #include "CameraStreamFixture.h"
@@ -91,7 +92,7 @@
     sp<SurfaceComposerClient> mComposerClient;
     sp<SurfaceControl> mSurfaceControl;
 
-    void CreateOnScreenSurface(sp<ANativeWindow>& surface) {
+    void CreateOnScreenSurface(sp<Surface>& surface) {
         mComposerClient = new SurfaceComposerClient;
         ASSERT_EQ(NO_ERROR, mComposerClient->initCheck());
 
@@ -174,22 +175,24 @@
                 int width,
                 int height,
                 const sp<CameraDeviceBase>& device,
-                CameraStreamParams param, sp<ANativeWindow> surface,
+                CameraStreamParams param, sp<Surface> surface,
                 bool useCpuConsumer)
             : mDevice(device),
               mWidth(width),
               mHeight(height) {
             mFormat = param.mFormat;
             if (useCpuConsumer) {
-                sp<BufferQueue> bq = new BufferQueue();
-                mCpuConsumer = new CpuConsumer(bq, param.mHeapCount);
+                sp<IGraphicBufferProducer> producer;
+                sp<IGraphicBufferConsumer> consumer;
+                BufferQueue::createBufferQueue(&producer, &consumer);
+                mCpuConsumer = new CpuConsumer(consumer, param.mHeapCount);
                 mCpuConsumer->setName(String8(
                         "CameraMultiStreamTest::mCpuConsumer"));
-                mNativeWindow = new Surface(bq);
+                mSurface = new Surface(producer);
             } else {
                 // Render the stream to screen.
                 mCpuConsumer = NULL;
-                mNativeWindow = surface;
+                mSurface = surface;
             }
 
             mFrameListener = new FrameListener();
@@ -204,9 +207,9 @@
          */
         void SetUp() {
             ASSERT_EQ(OK,
-                mDevice->createStream(mNativeWindow,
-                    mWidth, mHeight, mFormat, /*size (for jpegs)*/0,
-                    &mStreamId));
+                mDevice->createStream(mSurface,
+                    mWidth, mHeight, mFormat, HAL_DATASPACE_UNKNOWN,
+                    CAMERA3_STREAM_ROTATION_0, &mStreamId));
 
             ASSERT_NE(-1, mStreamId);
         }
@@ -222,14 +225,14 @@
                 mDevice->deleteStream(mStreamId);
             }
             // Clear producer before consumer.
-            mNativeWindow.clear();
+            mSurface.clear();
             mCpuConsumer.clear();
         }
 
     private:
         sp<FrameListener>       mFrameListener;
         sp<CpuConsumer>         mCpuConsumer;
-        sp<ANativeWindow>       mNativeWindow;
+        sp<Surface>             mSurface;
         sp<CameraDeviceBase>    mDevice;
         int                     mStreamId;
         int                     mWidth;
@@ -331,7 +334,7 @@
             int height,
             const sp<CameraDeviceBase>& device,
             CameraStreamParams param = DEFAULT_STREAM_PARAMETERS,
-            sp<ANativeWindow> surface = NULL,
+            sp<Surface> surface = NULL,
             bool useCpuConsumer = true) {
         param.mFormat = MapAutoFormat(param.mFormat);
         return new CameraStream(width, height, device,
@@ -353,7 +356,7 @@
             ASSERT_EQ(OK, request.update(ANDROID_SENSOR_EXPOSURE_TIME, &exposures[i], 1));
             ASSERT_EQ(OK, request.update(ANDROID_SENSOR_SENSITIVITY, &sensitivities[i], 1));
             ASSERT_EQ(OK, mDevice->capture(request));
-            ALOGV("Submitting request with: id %d with exposure %lld, sensitivity %d",
+            ALOGV("Submitting request with: id %d with exposure %" PRId64 ", sensitivity %d",
                     *requestIdStart, exposures[i], sensitivities[i]);
             if (CAMERA_MULTI_STREAM_DEBUGGING) {
                 request.dump(STDOUT_FILENO);
@@ -368,7 +371,7 @@
         // Set wait limit based on expected frame duration.
         int64_t waitLimit = CAMERA_FRAME_TIMEOUT;
         for (size_t i = 0; i < requestCount; i++) {
-            ALOGV("Reading request result %d", i);
+            ALOGV("Reading request result %zu", i);
 
             /**
              * Raise the timeout to be at least twice as long as the exposure
@@ -378,11 +381,13 @@
                 waitLimit = exposures[i] * EXP_WAIT_MULTIPLIER;
             }
 
+            CaptureResult result;
             CameraMetadata frameMetadata;
             int32_t resultRequestId;
             do {
                 ASSERT_EQ(OK, mDevice->waitForNextFrame(waitLimit));
-                ASSERT_EQ(OK, mDevice->getNextFrame(&frameMetadata));
+                ASSERT_EQ(OK, mDevice->getNextResult(&result));
+                frameMetadata = result.mMetadata;
 
                 camera_metadata_entry_t resultEntry = frameMetadata.find(ANDROID_REQUEST_ID);
                 ASSERT_EQ(1u, resultEntry.count);
@@ -392,7 +397,7 @@
                 }
             } while (resultRequestId != targetRequestId);
             targetRequestId++;
-            ALOGV("Got capture burst result for request %d", i);
+            ALOGV("Got capture burst result for request %zu", i);
 
             // Validate capture result
             if (CAMERA_MULTI_STREAM_DEBUGGING) {
@@ -411,7 +416,7 @@
             captureBurstTimes.push_back(systemTime());
             CpuConsumer::LockedBuffer imgBuffer;
             ASSERT_EQ(OK, consumer->lockNextBuffer(&imgBuffer));
-            ALOGV("Got capture buffer for request %d", i);
+            ALOGV("Got capture buffer for request %zu", i);
 
             /**
              * TODO: Validate capture buffer. Current brightness calculation
@@ -462,23 +467,47 @@
  *
  * 2. Manual control(gain/exposure) of mutiple burst capture.
  */
-TEST_F(CameraMultiStreamTest, MultiBurst) {
+// Disable this test for now, as we need cleanup the usage of the deprecated tag quite a bit.
+TEST_F(CameraMultiStreamTest, DISABLED_MultiBurst) {
 
     TEST_EXTENSION_FORKING_INIT;
 
-    camera_metadata_ro_entry availableProcessedSizes =
-        GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES);
-    ASSERT_EQ(0u, availableProcessedSizes.count % 2);
-    ASSERT_GE(availableProcessedSizes.count, 2u);
-    camera_metadata_ro_entry availableProcessedMinFrameDurations =
-        GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS);
-    EXPECT_EQ(availableProcessedSizes.count,
-        availableProcessedMinFrameDurations.count * 2);
+    const int32_t* implDefData;
+    size_t implDefCount;
+    const int32_t* jpegData;
+    size_t jpegCount;
+    if (getDeviceVersion() < CAMERA_DEVICE_API_VERSION_3_2) {
+        camera_metadata_ro_entry availableProcessedSizes =
+            GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES);
+        ASSERT_EQ(0u, availableProcessedSizes.count % 2);
+        ASSERT_GE(availableProcessedSizes.count, 2u);
+        camera_metadata_ro_entry availableProcessedMinFrameDurations =
+            GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS);
+        EXPECT_EQ(availableProcessedSizes.count,
+            availableProcessedMinFrameDurations.count * 2);
 
-    camera_metadata_ro_entry availableJpegSizes =
-        GetStaticEntry(ANDROID_SCALER_AVAILABLE_JPEG_SIZES);
-    ASSERT_EQ(0u, availableJpegSizes.count % 2);
-    ASSERT_GE(availableJpegSizes.count, 2u);
+        camera_metadata_ro_entry availableJpegSizes =
+            GetStaticEntry(ANDROID_SCALER_AVAILABLE_JPEG_SIZES);
+        ASSERT_EQ(0u, availableJpegSizes.count % 2);
+        ASSERT_GE(availableJpegSizes.count, 2u);
+        implDefData = availableProcessedSizes.data.i32;
+        implDefCount = availableProcessedSizes.count;
+        jpegData = availableJpegSizes.data.i32;
+        jpegCount = availableJpegSizes.count;
+    } else {
+        const int32_t *implDefResolutions;
+        size_t   implDefResolutionsCount;
+
+        getResolutionList(HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED, &implDefData, &implDefCount);
+        ASSERT_NE(0u, implDefCount)
+            << "Missing implementation defined sizes";
+        ASSERT_EQ(0u, implDefCount % 2);
+        ASSERT_GE(implDefCount, 2u);
+
+        getResolutionList(HAL_PIXEL_FORMAT_BLOB, &jpegData, &jpegCount);
+        ASSERT_EQ(0u, jpegCount % 2);
+        ASSERT_GE(jpegCount, 2u);
+    }
 
     camera_metadata_ro_entry hardwareLevel =
         GetStaticEntry(ANDROID_INFO_SUPPORTED_HARDWARE_LEVEL);
@@ -498,23 +527,26 @@
     }
 
     // Find the right sizes for preview, metering, and capture streams
-    // assumes at least 2 entries in availableProcessedSizes.
     int64_t minFrameDuration = DEFAULT_FRAME_DURATION;
-    Size processedMinSize, processedMaxSize, jpegMaxSize;
-    const int32_t* data = availableProcessedSizes.data.i32;
-    size_t count = availableProcessedSizes.count;
+    Size processedMinSize = {0, 0}, processedMaxSize = {0, 0};
+    Size jpegMaxSize = {0, 0};
 
     int32_t minIdx, maxIdx;
-    GetMinSize(data, count, &processedMinSize, &minIdx);
-    GetMaxSize(data, count, &processedMaxSize, &maxIdx);
+    GetMinSize(implDefData, implDefCount, &processedMinSize, &minIdx);
+    GetMaxSize(implDefData, implDefCount, &processedMaxSize, &maxIdx);
     ALOGV("Found processed max size: %dx%d, min size = %dx%d",
             processedMaxSize.width, processedMaxSize.height,
             processedMinSize.width, processedMinSize.height);
 
-    if (availableProcessedSizes.count ==
-        availableProcessedMinFrameDurations.count * 2) {
+    if (getDeviceVersion() < CAMERA_DEVICE_API_VERSION_3_2) {
+        camera_metadata_ro_entry availableProcessedMinFrameDurations =
+            GetStaticEntry(ANDROID_SCALER_AVAILABLE_PROCESSED_MIN_DURATIONS);
         minFrameDuration =
             availableProcessedMinFrameDurations.data.i64[maxIdx / 2];
+    } else {
+        minFrameDuration = getMinFrameDurationFor(
+                HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED,
+                processedMaxSize.width, processedMaxSize.height);
     }
 
     EXPECT_GT(minFrameDuration, 0);
@@ -523,11 +555,9 @@
         minFrameDuration = DEFAULT_FRAME_DURATION;
     }
 
-    ALOGV("targeted minimal frame duration is: %lldns", minFrameDuration);
+    ALOGV("targeted minimal frame duration is: %" PRId64 "ns", minFrameDuration);
 
-    data = &(availableJpegSizes.data.i32[0]);
-    count = availableJpegSizes.count;
-    GetMaxSize(data, count, &jpegMaxSize, &maxIdx);
+    GetMaxSize(jpegData, jpegCount, &jpegMaxSize, &maxIdx);
     ALOGV("Found Jpeg size max idx = %d", maxIdx);
 
     // Max Jpeg size should be available in processed sizes. Use it for
@@ -553,7 +583,7 @@
     // Preview stream: small resolution, render on the screen.
     sp<CameraStream> previewStream;
     {
-        sp<ANativeWindow> surface;
+        sp<Surface> surface;
         ASSERT_NO_FATAL_FAILURE(CreateOnScreenSurface(/*out*/surface));
         previewStream = CreateStream(
                 previewSize.width,
@@ -621,7 +651,7 @@
     // purely by analog gain if possible.
     Vector<int32_t> sensitivities;
     Vector<int64_t> exposures;
-    count = (maxAnalogSensitivity - minSensitivity + 99) / 100;
+    size_t count = (maxAnalogSensitivity - minSensitivity + 99) / 100;
     sensitivities.push_back(minSensitivity);
     for (size_t i = 1; i < count; i++) {
         sensitivities.push_back(minSensitivity + i * 100);
@@ -643,7 +673,7 @@
         ASSERT_EQ(OK, previewRequest.update(
                 ANDROID_SENSOR_EXPOSURE_TIME,
                 &exposures[i], 1));
-        ALOGV("Submitting preview request %d with exposure %lld",
+        ALOGV("Submitting preview request %zu with exposure %" PRId64,
                 i, exposures[i]);
 
         ASSERT_EQ(OK, mDevice->setStreamingRequest(previewRequest));
diff --git a/tests/camera2/CameraStreamFixture.h b/tests/camera2/CameraStreamFixture.h
index a1f3aae..fc5fb36 100644
--- a/tests/camera2/CameraStreamFixture.h
+++ b/tests/camera2/CameraStreamFixture.h
@@ -96,7 +96,7 @@
         sp<CameraDeviceBase> device = mDevice;
 
         /* use an arbitrary w,h */
-        {
+        if (getDeviceVersion() < CAMERA_DEVICE_API_VERSION_3_2) {
             const int tag = ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES;
 
             const CameraMetadata& staticInfo = device->info();
@@ -106,9 +106,22 @@
 
             ASSERT_LE(2u, entry.count);
             /* this seems like it would always be the smallest w,h
-               but we actually make no contract that it's sorted asc */;
+               but we actually make no contract that it's sorted asc */
             mWidth = entry.data.i32[0];
             mHeight = entry.data.i32[1];
+        } else {
+            buildOutputResolutions();
+            const int32_t *implDefResolutions = NULL;
+            size_t   implDefResolutionsCount;
+
+            int format = HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED;
+
+            getResolutionList(format,
+                    &implDefResolutions, &implDefResolutionsCount);
+            ASSERT_NE(0u, implDefResolutionsCount)
+                << "Missing implementation defined sizes";
+            mWidth = implDefResolutions[0];
+            mHeight = implDefResolutions[1];
         }
     }
     void TearDown() {
@@ -117,12 +130,82 @@
         // important: shut down HAL before releasing streams
         CameraModuleFixture::TearDown();
 
-        mNativeWindow.clear();
+        deleteOutputResolutions();
+        mSurface.clear();
         mCpuConsumer.clear();
         mFrameListener.clear();
     }
 
 protected:
+
+    int64_t getMinFrameDurationFor(int32_t format, int32_t width, int32_t height) {
+        int64_t minFrameDuration = -1L;
+        const int tag = ANDROID_SCALER_AVAILABLE_MIN_FRAME_DURATIONS;
+        sp<CameraDeviceBase> device = mDevice;
+        const CameraMetadata& staticInfo = device->info();
+        camera_metadata_ro_entry_t availableMinDurations = staticInfo.find(tag);
+        for (uint32_t i = 0; i < availableMinDurations.count; i += 4) {
+            if (format == availableMinDurations.data.i64[i] &&
+                    width == availableMinDurations.data.i64[i + 1] &&
+                    height == availableMinDurations.data.i64[i + 2]) {
+                minFrameDuration = availableMinDurations.data.i64[i + 3];
+                break;
+            }
+        }
+        return minFrameDuration;
+    }
+
+    void buildOutputResolutions() {
+        if (getDeviceVersion() < CAMERA_DEVICE_API_VERSION_3_2) {
+            return;
+        }
+        if (mOutputResolutions.isEmpty()) {
+            const int tag = ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS;
+            const CameraMetadata& staticInfo = mDevice->info();
+            camera_metadata_ro_entry_t availableStrmConfigs = staticInfo.find(tag);
+            ASSERT_EQ(0u, availableStrmConfigs.count % 4);
+            for (uint32_t i = 0; i < availableStrmConfigs.count; i += 4) {
+                int32_t format = availableStrmConfigs.data.i32[i];
+                int32_t width = availableStrmConfigs.data.i32[i + 1];
+                int32_t height = availableStrmConfigs.data.i32[i + 2];
+                int32_t inOrOut = availableStrmConfigs.data.i32[i + 3];
+                if (inOrOut == ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS_OUTPUT) {
+                    int index = mOutputResolutions.indexOfKey(format);
+                    if (index < 0) {
+                        index = mOutputResolutions.add(format, new Vector<int32_t>());
+                        ASSERT_TRUE(index >= 0);
+                    }
+                    Vector<int32_t> *resolutions = mOutputResolutions.editValueAt(index);
+                    resolutions->add(width);
+                    resolutions->add(height);
+                }
+            }
+        }
+    }
+
+    void getResolutionList(int32_t format,
+            const int32_t **list,
+            size_t *count) {
+        status_t res;
+        ALOGV("Getting resolutions for format %x", format);
+        if (getDeviceVersion() < CAMERA_DEVICE_API_VERSION_3_2) {
+            return;
+        }
+        int index = mOutputResolutions.indexOfKey(format);
+        ASSERT_TRUE(index >= 0);
+        Vector<int32_t>* resolutions = mOutputResolutions.valueAt(index);
+        *list = resolutions->array();
+        *count = resolutions->size();
+    }
+
+    void deleteOutputResolutions() {
+        for (uint32_t i = 0; i < mOutputResolutions.size(); i++) {
+            Vector<int32_t>* resolutions = mOutputResolutions.editValueAt(i);
+            delete resolutions;
+        }
+        mOutputResolutions.clear();
+    }
+
     struct FrameListener : public ConsumerBase::FrameAvailableListener {
 
         FrameListener() {
@@ -130,7 +213,7 @@
         }
 
         // CpuConsumer::FrameAvailableListener implementation
-        virtual void onFrameAvailable() {
+        virtual void onFrameAvailable(const BufferItem& /* item */) {
             ALOGV("Frame now available (start)");
 
             Mutex::Autolock lock(mMutex);
@@ -161,17 +244,21 @@
         sp<CameraDeviceBase> device = mDevice;
         CameraStreamParams p = mParam;
 
-        sp<BufferQueue> bq = new BufferQueue();
-        mCpuConsumer = new CpuConsumer(bq, p.mHeapCount);
+        sp<IGraphicBufferProducer> producer;
+        sp<IGraphicBufferConsumer> consumer;
+        BufferQueue::createBufferQueue(&producer, &consumer);
+        mCpuConsumer = new CpuConsumer(consumer, p.mHeapCount);
         mCpuConsumer->setName(String8("CameraStreamTest::mCpuConsumer"));
 
-        mNativeWindow = new Surface(bq);
+        mSurface = new Surface(producer);
 
         int format = MapAutoFormat(p.mFormat);
 
         ASSERT_EQ(OK,
-            device->createStream(mNativeWindow,
-                mWidth, mHeight, format, /*size (for jpegs)*/0,
+            device->createStream(mSurface,
+                mWidth, mHeight, format,
+                HAL_DATASPACE_UNKNOWN,
+                CAMERA3_STREAM_ROTATION_0,
                 &mStreamId));
 
         ASSERT_NE(-1, mStreamId);
@@ -277,8 +364,8 @@
 
     android::sp<FrameListener>       mFrameListener;
     android::sp<CpuConsumer>         mCpuConsumer;
-    android::sp<ANativeWindow>       mNativeWindow;
-
+    android::sp<Surface>             mSurface;
+    KeyedVector<int32_t, Vector<int32_t>* > mOutputResolutions;
 
 private:
     CameraStreamParams mParam;
diff --git a/tests/camera2/CameraStreamTests.cpp b/tests/camera2/CameraStreamTests.cpp
index 69ee274..a3b8c47 100644
--- a/tests/camera2/CameraStreamTests.cpp
+++ b/tests/camera2/CameraStreamTests.cpp
@@ -166,15 +166,15 @@
         /*mHeapCount*/ 3
     },
     {
-        /*mFormat*/    HAL_PIXEL_FORMAT_RAW_SENSOR,
+        /*mFormat*/    HAL_PIXEL_FORMAT_RAW16,
         /*mHeapCount*/ 1
     },
     {
-        /*mFormat*/    HAL_PIXEL_FORMAT_RAW_SENSOR,
+        /*mFormat*/    HAL_PIXEL_FORMAT_RAW16,
         /*mHeapCount*/ 2
     },
     {
-        /*mFormat*/    HAL_PIXEL_FORMAT_RAW_SENSOR,
+        /*mFormat*/    HAL_PIXEL_FORMAT_RAW16,
         /*mHeapCount*/ 3
     },
 };
diff --git a/tests/camera2/ForkedTests.cpp b/tests/camera2/ForkedTests.cpp
index 315233e..39599da 100644
--- a/tests/camera2/ForkedTests.cpp
+++ b/tests/camera2/ForkedTests.cpp
@@ -16,6 +16,8 @@
 
 #include <gtest/gtest.h>
 
+#include <stdlib.h>
+
 #include "TestExtensions.h"
 
 namespace android {
@@ -37,9 +39,7 @@
 // intentionally fail
 TEST_F(DISABLED_ForkedTest, FailCrash) {
     TEST_EXTENSION_FORKING_INIT;
-
-    //intentionally crash
-    *(int*)0 = 0xDEADBEEF;
+    abort();
 }
 
 TEST_F(DISABLED_ForkedTest, SucceedNormal) {
diff --git a/tests/camera2/camera2.cpp b/tests/camera2/camera2.cpp
deleted file mode 100644
index 600d440..0000000
--- a/tests/camera2/camera2.cpp
+++ /dev/null
@@ -1,819 +0,0 @@
-/*
- * Copyright (C) 2012 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "Camera2_test"
-//#define LOG_NDEBUG 0
-
-#include <utils/Log.h>
-#include <gtest/gtest.h>
-#include <iostream>
-#include <fstream>
-
-#include <utils/Vector.h>
-#include <gui/CpuConsumer.h>
-#include <ui/PixelFormat.h>
-#include <system/camera_metadata.h>
-
-#include "camera2_utils.h"
-#include "TestExtensions.h"
-
-namespace android {
-namespace camera2 {
-namespace tests {
-
-class Camera2Test: public testing::Test {
-  public:
-    void SetUpModule() {
-        int res;
-
-        hw_module_t *module = NULL;
-        res = hw_get_module(CAMERA_HARDWARE_MODULE_ID,
-                (const hw_module_t **)&module);
-
-        ASSERT_EQ(0, res)
-                << "Failure opening camera hardware module: " << res;
-        ASSERT_TRUE(NULL != module)
-                << "No camera module was set by hw_get_module";
-
-        IF_ALOGV() {
-            std::cout << "  Camera module name: "
-                    << module->name << std::endl;
-            std::cout << "  Camera module author: "
-                    << module->author << std::endl;
-            std::cout << "  Camera module API version: 0x" << std::hex
-                    << module->module_api_version << std::endl;
-            std::cout << "  Camera module HAL API version: 0x" << std::hex
-                    << module->hal_api_version << std::endl;
-        }
-
-        int16_t version2_0 = CAMERA_MODULE_API_VERSION_2_0;
-        ASSERT_LE(version2_0, module->module_api_version)
-                << "Camera module version is 0x"
-                << std::hex << module->module_api_version
-                << ", should be at least 2.0. (0x"
-                << std::hex << CAMERA_MODULE_API_VERSION_2_0 << ")";
-
-        sCameraModule = reinterpret_cast<camera_module_t*>(module);
-
-        sNumCameras = sCameraModule->get_number_of_cameras();
-        ASSERT_LT(0, sNumCameras) << "No camera devices available!";
-
-        IF_ALOGV() {
-            std::cout << "  Camera device count: " << sNumCameras << std::endl;
-        }
-
-        sCameraSupportsHal2 = new bool[sNumCameras];
-
-        for (int i = 0; i < sNumCameras; i++) {
-            camera_info info;
-            res = sCameraModule->get_camera_info(i, &info);
-            ASSERT_EQ(0, res)
-                    << "Failure getting camera info for camera " << i;
-            IF_ALOGV() {
-                std::cout << "  Camera device: " << std::dec
-                          << i << std::endl;;
-                std::cout << "    Facing: " << std::dec
-                          << info.facing  << std::endl;
-                std::cout << "    Orientation: " << std::dec
-                          << info.orientation  << std::endl;
-                std::cout << "    Version: 0x" << std::hex <<
-                        info.device_version  << std::endl;
-            }
-            if (info.device_version >= CAMERA_DEVICE_API_VERSION_2_0 &&
-                    info.device_version < CAMERA_DEVICE_API_VERSION_3_0) {
-                sCameraSupportsHal2[i] = true;
-                ASSERT_TRUE(NULL != info.static_camera_characteristics);
-                IF_ALOGV() {
-                    std::cout << "    Static camera metadata:"  << std::endl;
-                    dump_indented_camera_metadata(info.static_camera_characteristics,
-                            0, 1, 6);
-                }
-            } else {
-                sCameraSupportsHal2[i] = false;
-            }
-        }
-    }
-
-    void TearDownModule() {
-        hw_module_t *module = reinterpret_cast<hw_module_t*>(sCameraModule);
-        ASSERT_EQ(0, HWModuleHelpers::closeModule(module));
-    }
-
-    static const camera_module_t *getCameraModule() {
-        return sCameraModule;
-    }
-
-    static int getNumCameras() {
-        return sNumCameras;
-    }
-
-    static bool isHal2Supported(int id) {
-        return sCameraSupportsHal2[id];
-    }
-
-    static camera2_device_t *openCameraDevice(int id) {
-        ALOGV("Opening camera %d", id);
-        if (NULL == sCameraSupportsHal2) return NULL;
-        if (id >= sNumCameras) return NULL;
-        if (!sCameraSupportsHal2[id]) return NULL;
-
-        hw_device_t *device = NULL;
-        const camera_module_t *cam_module = getCameraModule();
-        if (cam_module == NULL) {
-            return NULL;
-        }
-
-        char camId[10];
-        int res;
-
-        snprintf(camId, 10, "%d", id);
-        res = cam_module->common.methods->open(
-            (const hw_module_t*)cam_module,
-            camId,
-            &device);
-        if (res != NO_ERROR || device == NULL) {
-            return NULL;
-        }
-        camera2_device_t *cam_device =
-                reinterpret_cast<camera2_device_t*>(device);
-        return cam_device;
-    }
-
-    static status_t configureCameraDevice(camera2_device_t *dev,
-            MetadataQueue &requestQueue,
-            MetadataQueue  &frameQueue,
-            NotifierListener &listener) {
-
-        status_t err;
-
-        err = dev->ops->set_request_queue_src_ops(dev,
-                requestQueue.getToConsumerInterface());
-        if (err != OK) return err;
-
-        requestQueue.setFromConsumerInterface(dev);
-
-        err = dev->ops->set_frame_queue_dst_ops(dev,
-                frameQueue.getToProducerInterface());
-        if (err != OK) return err;
-
-        err = listener.getNotificationsFrom(dev);
-        if (err != OK) return err;
-
-        vendor_tag_query_ops_t *vendor_metadata_tag_ops;
-        err = dev->ops->get_metadata_vendor_tag_ops(dev, &vendor_metadata_tag_ops);
-        if (err != OK) return err;
-
-        err = set_camera_metadata_vendor_tag_ops(vendor_metadata_tag_ops);
-        if (err != OK) return err;
-
-        return OK;
-    }
-
-    static status_t closeCameraDevice(camera2_device_t **cam_dev) {
-        int res;
-        if (*cam_dev == NULL ) return OK;
-
-        ALOGV("Closing camera %p", cam_dev);
-
-        hw_device_t *dev = reinterpret_cast<hw_device_t *>(*cam_dev);
-        res = dev->close(dev);
-        *cam_dev = NULL;
-        return res;
-    }
-
-    void setUpCamera(int id) {
-        ASSERT_GT(sNumCameras, id);
-        status_t res;
-
-        if (mDevice != NULL) {
-            closeCameraDevice(&mDevice);
-        }
-        mId = id;
-        mDevice = openCameraDevice(mId);
-        ASSERT_TRUE(NULL != mDevice) << "Failed to open camera device";
-
-        camera_info info;
-        res = sCameraModule->get_camera_info(id, &info);
-        ASSERT_EQ(OK, res);
-
-        mStaticInfo = info.static_camera_characteristics;
-
-        res = configureCameraDevice(mDevice,
-                mRequests,
-                mFrames,
-                mNotifications);
-        ASSERT_EQ(OK, res) << "Failure to configure camera device";
-
-    }
-
-    void setUpStream(sp<IGraphicBufferProducer> consumer,
-            int width, int height, int format, int *id) {
-        status_t res;
-
-        StreamAdapter* stream = new StreamAdapter(consumer);
-
-        ALOGV("Creating stream, format 0x%x, %d x %d", format, width, height);
-        res = stream->connectToDevice(mDevice, width, height, format);
-        ASSERT_EQ(NO_ERROR, res) << "Failed to connect to stream: "
-                                 << strerror(-res);
-        mStreams.push_back(stream);
-
-        *id = stream->getId();
-    }
-
-    void disconnectStream(int id) {
-        status_t res;
-        unsigned int i=0;
-        for (; i < mStreams.size(); i++) {
-            if (mStreams[i]->getId() == id) {
-                res = mStreams[i]->disconnect();
-                ASSERT_EQ(NO_ERROR, res) <<
-                        "Failed to disconnect stream " << id;
-                break;
-            }
-        }
-        ASSERT_GT(mStreams.size(), i) << "Stream id not found:" << id;
-    }
-
-    void getResolutionList(int32_t format,
-            const int32_t **list,
-            size_t *count) {
-        ALOGV("Getting resolutions for format %x", format);
-        status_t res;
-        if (format != HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED) {
-            camera_metadata_ro_entry_t availableFormats;
-            res = find_camera_metadata_ro_entry(mStaticInfo,
-                    ANDROID_SCALER_AVAILABLE_FORMATS,
-                    &availableFormats);
-            ASSERT_EQ(OK, res);
-
-            uint32_t formatIdx;
-            for (formatIdx=0; formatIdx < availableFormats.count; formatIdx++) {
-                if (availableFormats.data.i32[formatIdx] == format) break;
-            }
-            ASSERT_NE(availableFormats.count, formatIdx)
-                << "No support found for format 0x" << std::hex << format;
-        }
-
-        camera_metadata_ro_entry_t availableSizes;
-        if (format == HAL_PIXEL_FORMAT_RAW_SENSOR) {
-            res = find_camera_metadata_ro_entry(mStaticInfo,
-                    ANDROID_SCALER_AVAILABLE_RAW_SIZES,
-                    &availableSizes);
-        } else if (format == HAL_PIXEL_FORMAT_BLOB) {
-            res = find_camera_metadata_ro_entry(mStaticInfo,
-                    ANDROID_SCALER_AVAILABLE_JPEG_SIZES,
-                    &availableSizes);
-        } else {
-            res = find_camera_metadata_ro_entry(mStaticInfo,
-                    ANDROID_SCALER_AVAILABLE_PROCESSED_SIZES,
-                    &availableSizes);
-        }
-        ASSERT_EQ(OK, res);
-
-        *list = availableSizes.data.i32;
-        *count = availableSizes.count;
-    }
-
-    status_t waitUntilDrained() {
-        static const uint32_t kSleepTime = 50000; // 50 ms
-        static const uint32_t kMaxSleepTime = 10000000; // 10 s
-        ALOGV("%s: Camera %d: Starting wait", __FUNCTION__, mId);
-
-        // TODO: Set up notifications from HAL, instead of sleeping here
-        uint32_t totalTime = 0;
-        while (mDevice->ops->get_in_progress_count(mDevice) > 0) {
-            usleep(kSleepTime);
-            totalTime += kSleepTime;
-            if (totalTime > kMaxSleepTime) {
-                ALOGE("%s: Waited %d us, %d requests still in flight", __FUNCTION__,
-                        mDevice->ops->get_in_progress_count(mDevice), totalTime);
-                return TIMED_OUT;
-            }
-        }
-        ALOGV("%s: Camera %d: HAL is idle", __FUNCTION__, mId);
-        return OK;
-    }
-
-    virtual void SetUp() {
-        TEST_EXTENSION_FORKING_SET_UP;
-
-        SetUpModule();
-
-        const ::testing::TestInfo* const testInfo =
-                ::testing::UnitTest::GetInstance()->current_test_info();
-        (void)testInfo;
-
-        ALOGV("*** Starting test %s in test case %s", testInfo->name(),
-              testInfo->test_case_name());
-        mDevice = NULL;
-    }
-
-    virtual void TearDown() {
-        TEST_EXTENSION_FORKING_TEAR_DOWN;
-
-        for (unsigned int i = 0; i < mStreams.size(); i++) {
-            delete mStreams[i];
-        }
-        if (mDevice != NULL) {
-            closeCameraDevice(&mDevice);
-        }
-
-        TearDownModule();
-    }
-
-    int mId;
-    camera2_device    *mDevice;
-    const camera_metadata_t *mStaticInfo;
-
-    MetadataQueue    mRequests;
-    MetadataQueue    mFrames;
-    NotifierListener mNotifications;
-
-    Vector<StreamAdapter*> mStreams;
-
-  private:
-    static camera_module_t *sCameraModule;
-    static int              sNumCameras;
-    static bool            *sCameraSupportsHal2;
-};
-
-camera_module_t *Camera2Test::sCameraModule = NULL;
-bool *Camera2Test::sCameraSupportsHal2      = NULL;
-int Camera2Test::sNumCameras                = 0;
-
-static const nsecs_t USEC = 1000;
-static const nsecs_t MSEC = 1000*USEC;
-static const nsecs_t SEC = 1000*MSEC;
-
-
-TEST_F(Camera2Test, OpenClose) {
-
-    TEST_EXTENSION_FORKING_INIT;
-
-    status_t res;
-
-    for (int id = 0; id < getNumCameras(); id++) {
-        if (!isHal2Supported(id)) continue;
-
-        camera2_device_t *d = openCameraDevice(id);
-        ASSERT_TRUE(NULL != d) << "Failed to open camera device";
-
-        res = closeCameraDevice(&d);
-        ASSERT_EQ(NO_ERROR, res) << "Failed to close camera device";
-    }
-}
-
-TEST_F(Camera2Test, Capture1Raw) {
-
-    TEST_EXTENSION_FORKING_INIT;
-
-    status_t res;
-
-    for (int id = 0; id < getNumCameras(); id++) {
-        if (!isHal2Supported(id)) continue;
-
-        ASSERT_NO_FATAL_FAILURE(setUpCamera(id));
-
-        sp<BufferQueue> bq = new BufferQueue();
-        sp<CpuConsumer> rawConsumer = new CpuConsumer(bq, 1);
-        sp<FrameWaiter> rawWaiter = new FrameWaiter();
-        rawConsumer->setFrameAvailableListener(rawWaiter);
-
-        const int32_t *rawResolutions;
-        size_t   rawResolutionsCount;
-
-        int format = HAL_PIXEL_FORMAT_RAW_SENSOR;
-
-        getResolutionList(format,
-                &rawResolutions, &rawResolutionsCount);
-
-        if (rawResolutionsCount <= 0) {
-            const ::testing::TestInfo* const test_info =
-                ::testing::UnitTest::GetInstance()->current_test_info();
-            std::cerr << "Skipping test "
-                      << test_info->test_case_name() << "."
-                      << test_info->name()
-                      << " because the optional format was not available: "
-                      << "RAW_SENSOR" << std::endl;
-            return;
-        }
-
-        ASSERT_LT((size_t)0, rawResolutionsCount);
-
-        // Pick first available raw resolution
-        int width = rawResolutions[0];
-        int height = rawResolutions[1];
-
-        int streamId;
-        ASSERT_NO_FATAL_FAILURE(
-            setUpStream(bq, width, height, format, &streamId) );
-
-        camera_metadata_t *request;
-        request = allocate_camera_metadata(20, 2000);
-
-        uint8_t metadataMode = ANDROID_REQUEST_METADATA_MODE_FULL;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_METADATA_MODE,
-                (void**)&metadataMode, 1);
-        uint32_t outputStreams = streamId;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_OUTPUT_STREAMS,
-                (void**)&outputStreams, 1);
-
-        uint64_t exposureTime = 10*MSEC;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_EXPOSURE_TIME,
-                (void**)&exposureTime, 1);
-        uint64_t frameDuration = 30*MSEC;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_FRAME_DURATION,
-                (void**)&frameDuration, 1);
-        uint32_t sensitivity = 100;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_SENSITIVITY,
-                (void**)&sensitivity, 1);
-        uint8_t requestType = ANDROID_REQUEST_TYPE_CAPTURE;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_TYPE,
-                (void**)&requestType, 1);
-
-        uint32_t hourOfDay = 12;
-        add_camera_metadata_entry(request,
-                0x80000000, // EMULATOR_HOUROFDAY
-                &hourOfDay, 1);
-
-        IF_ALOGV() {
-            std::cout << "Input request: " << std::endl;
-            dump_indented_camera_metadata(request, 0, 1, 2);
-        }
-
-        res = mRequests.enqueue(request);
-        ASSERT_EQ(NO_ERROR, res) << "Can't enqueue request: " << strerror(-res);
-
-        res = mFrames.waitForBuffer(exposureTime + SEC);
-        ASSERT_EQ(NO_ERROR, res) << "No frame to get: " << strerror(-res);
-
-        camera_metadata_t *frame;
-        res = mFrames.dequeue(&frame);
-        ASSERT_EQ(NO_ERROR, res);
-        ASSERT_TRUE(frame != NULL);
-
-        IF_ALOGV() {
-            std::cout << "Output frame:" << std::endl;
-            dump_indented_camera_metadata(frame, 0, 1, 2);
-        }
-
-        res = rawWaiter->waitForFrame(exposureTime + SEC);
-        ASSERT_EQ(NO_ERROR, res);
-
-        CpuConsumer::LockedBuffer buffer;
-        res = rawConsumer->lockNextBuffer(&buffer);
-        ASSERT_EQ(NO_ERROR, res);
-
-        IF_ALOGV() {
-            const char *dumpname =
-                    "/data/local/tmp/camera2_test-capture1raw-dump.raw";
-            ALOGV("Dumping raw buffer to %s", dumpname);
-            // Write to file
-            std::ofstream rawFile(dumpname);
-            size_t bpp = 2;
-            for (unsigned int y = 0; y < buffer.height; y++) {
-                rawFile.write(
-                        (const char *)(buffer.data + y * buffer.stride * bpp),
-                        buffer.width * bpp);
-            }
-            rawFile.close();
-        }
-
-        res = rawConsumer->unlockBuffer(buffer);
-        ASSERT_EQ(NO_ERROR, res);
-
-        ASSERT_EQ(OK, waitUntilDrained());
-        ASSERT_NO_FATAL_FAILURE(disconnectStream(streamId));
-
-        res = closeCameraDevice(&mDevice);
-        ASSERT_EQ(NO_ERROR, res) << "Failed to close camera device";
-
-    }
-}
-
-TEST_F(Camera2Test, CaptureBurstRaw) {
-
-    TEST_EXTENSION_FORKING_INIT;
-
-    status_t res;
-
-    for (int id = 0; id < getNumCameras(); id++) {
-        if (!isHal2Supported(id)) continue;
-
-        ASSERT_NO_FATAL_FAILURE(setUpCamera(id));
-
-        sp<BufferQueue> bq = new BufferQueue();
-        sp<CpuConsumer> rawConsumer = new CpuConsumer(bq, 1);
-        sp<FrameWaiter> rawWaiter = new FrameWaiter();
-        rawConsumer->setFrameAvailableListener(rawWaiter);
-
-        const int32_t *rawResolutions;
-        size_t    rawResolutionsCount;
-
-        int format = HAL_PIXEL_FORMAT_RAW_SENSOR;
-
-        getResolutionList(format,
-                &rawResolutions, &rawResolutionsCount);
-
-        if (rawResolutionsCount <= 0) {
-            const ::testing::TestInfo* const test_info =
-                ::testing::UnitTest::GetInstance()->current_test_info();
-            std::cerr << "Skipping test "
-                      << test_info->test_case_name() << "."
-                      << test_info->name()
-                      << " because the optional format was not available: "
-                      << "RAW_SENSOR" << std::endl;
-            return;
-        }
-
-        ASSERT_LT((uint32_t)0, rawResolutionsCount);
-
-        // Pick first available raw resolution
-        int width = rawResolutions[0];
-        int height = rawResolutions[1];
-
-        int streamId;
-        ASSERT_NO_FATAL_FAILURE(
-            setUpStream(bq, width, height, format, &streamId) );
-
-        camera_metadata_t *request;
-        request = allocate_camera_metadata(20, 2000);
-
-        uint8_t metadataMode = ANDROID_REQUEST_METADATA_MODE_FULL;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_METADATA_MODE,
-                (void**)&metadataMode, 1);
-        uint32_t outputStreams = streamId;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_OUTPUT_STREAMS,
-                (void**)&outputStreams, 1);
-
-        uint64_t frameDuration = 30*MSEC;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_FRAME_DURATION,
-                (void**)&frameDuration, 1);
-        uint32_t sensitivity = 100;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_SENSITIVITY,
-                (void**)&sensitivity, 1);
-        uint8_t requestType = ANDROID_REQUEST_TYPE_CAPTURE;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_TYPE,
-                (void**)&requestType, 1);
-
-        uint32_t hourOfDay = 12;
-        add_camera_metadata_entry(request,
-                0x80000000, // EMULATOR_HOUROFDAY
-                &hourOfDay, 1);
-
-        IF_ALOGV() {
-            std::cout << "Input request template: " << std::endl;
-            dump_indented_camera_metadata(request, 0, 1, 2);
-        }
-
-        int numCaptures = 10;
-
-        // Enqueue numCaptures requests with increasing exposure time
-
-        uint64_t exposureTime = 100 * USEC;
-        for (int reqCount = 0; reqCount < numCaptures; reqCount++ ) {
-            camera_metadata_t *req;
-            req = allocate_camera_metadata(20, 2000);
-            append_camera_metadata(req, request);
-
-            add_camera_metadata_entry(req,
-                    ANDROID_SENSOR_EXPOSURE_TIME,
-                    (void**)&exposureTime, 1);
-            exposureTime *= 2;
-
-            res = mRequests.enqueue(req);
-            ASSERT_EQ(NO_ERROR, res) << "Can't enqueue request: "
-                    << strerror(-res);
-        }
-
-        // Get frames and image buffers one by one
-        uint64_t expectedExposureTime = 100 * USEC;
-        for (int frameCount = 0; frameCount < 10; frameCount++) {
-            res = mFrames.waitForBuffer(SEC + expectedExposureTime);
-            ASSERT_EQ(NO_ERROR, res) << "No frame to get: " << strerror(-res);
-
-            camera_metadata_t *frame;
-            res = mFrames.dequeue(&frame);
-            ASSERT_EQ(NO_ERROR, res);
-            ASSERT_TRUE(frame != NULL);
-
-            camera_metadata_entry_t frameNumber;
-            res = find_camera_metadata_entry(frame,
-                    ANDROID_REQUEST_FRAME_COUNT,
-                    &frameNumber);
-            ASSERT_EQ(NO_ERROR, res);
-            ASSERT_EQ(frameCount, *frameNumber.data.i32);
-
-            res = rawWaiter->waitForFrame(SEC + expectedExposureTime);
-            ASSERT_EQ(NO_ERROR, res) <<
-                    "Never got raw data for capture " << frameCount;
-
-            CpuConsumer::LockedBuffer buffer;
-            res = rawConsumer->lockNextBuffer(&buffer);
-            ASSERT_EQ(NO_ERROR, res);
-
-            IF_ALOGV() {
-                char dumpname[60];
-                snprintf(dumpname, 60,
-                        "/data/local/tmp/camera2_test-"
-                        "captureBurstRaw-dump_%d.raw",
-                        frameCount);
-                ALOGV("Dumping raw buffer to %s", dumpname);
-                // Write to file
-                std::ofstream rawFile(dumpname);
-                for (unsigned int y = 0; y < buffer.height; y++) {
-                    rawFile.write(
-                            (const char *)(buffer.data + y * buffer.stride * 2),
-                            buffer.width * 2);
-                }
-                rawFile.close();
-            }
-
-            res = rawConsumer->unlockBuffer(buffer);
-            ASSERT_EQ(NO_ERROR, res);
-
-            expectedExposureTime *= 2;
-        }
-    }
-}
-
-TEST_F(Camera2Test, ConstructDefaultRequests) {
-
-    TEST_EXTENSION_FORKING_INIT;
-
-    status_t res;
-
-    for (int id = 0; id < getNumCameras(); id++) {
-        if (!isHal2Supported(id)) continue;
-
-        ASSERT_NO_FATAL_FAILURE(setUpCamera(id));
-
-        for (int i = CAMERA2_TEMPLATE_PREVIEW; i < CAMERA2_TEMPLATE_COUNT;
-             i++) {
-            camera_metadata_t *request = NULL;
-            res = mDevice->ops->construct_default_request(mDevice,
-                    i,
-                    &request);
-            EXPECT_EQ(NO_ERROR, res) <<
-                    "Unable to construct request from template type " << i;
-            EXPECT_TRUE(request != NULL);
-            EXPECT_LT((size_t)0, get_camera_metadata_entry_count(request));
-            EXPECT_LT((size_t)0, get_camera_metadata_data_count(request));
-
-            IF_ALOGV() {
-                std::cout << "  ** Template type " << i << ":"<<std::endl;
-                dump_indented_camera_metadata(request, 0, 2, 4);
-            }
-
-            free_camera_metadata(request);
-        }
-    }
-}
-
-TEST_F(Camera2Test, Capture1Jpeg) {
-    status_t res;
-
-    for (int id = 0; id < getNumCameras(); id++) {
-        if (!isHal2Supported(id)) continue;
-
-        ASSERT_NO_FATAL_FAILURE(setUpCamera(id));
-
-        sp<BufferQueue> bq = new BufferQueue();
-        sp<CpuConsumer> jpegConsumer = new CpuConsumer(bq, 1);
-        sp<FrameWaiter> jpegWaiter = new FrameWaiter();
-        jpegConsumer->setFrameAvailableListener(jpegWaiter);
-
-        const int32_t *jpegResolutions;
-        size_t   jpegResolutionsCount;
-
-        int format = HAL_PIXEL_FORMAT_BLOB;
-
-        getResolutionList(format,
-                &jpegResolutions, &jpegResolutionsCount);
-        ASSERT_LT((size_t)0, jpegResolutionsCount);
-
-        // Pick first available JPEG resolution
-        int width = jpegResolutions[0];
-        int height = jpegResolutions[1];
-
-        int streamId;
-        ASSERT_NO_FATAL_FAILURE(
-            setUpStream(bq, width, height, format, &streamId) );
-
-        camera_metadata_t *request;
-        request = allocate_camera_metadata(20, 2000);
-
-        uint8_t metadataMode = ANDROID_REQUEST_METADATA_MODE_FULL;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_METADATA_MODE,
-                (void**)&metadataMode, 1);
-        uint32_t outputStreams = streamId;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_OUTPUT_STREAMS,
-                (void**)&outputStreams, 1);
-
-        uint64_t exposureTime = 10*MSEC;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_EXPOSURE_TIME,
-                (void**)&exposureTime, 1);
-        uint64_t frameDuration = 30*MSEC;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_FRAME_DURATION,
-                (void**)&frameDuration, 1);
-        uint32_t sensitivity = 100;
-        add_camera_metadata_entry(request,
-                ANDROID_SENSOR_SENSITIVITY,
-                (void**)&sensitivity, 1);
-        uint8_t requestType = ANDROID_REQUEST_TYPE_CAPTURE;
-        add_camera_metadata_entry(request,
-                ANDROID_REQUEST_TYPE,
-                (void**)&requestType, 1);
-
-        uint32_t hourOfDay = 12;
-        add_camera_metadata_entry(request,
-                0x80000000, // EMULATOR_HOUROFDAY
-                &hourOfDay, 1);
-
-        IF_ALOGV() {
-            std::cout << "Input request: " << std::endl;
-            dump_indented_camera_metadata(request, 0, 1, 4);
-        }
-
-        res = mRequests.enqueue(request);
-        ASSERT_EQ(NO_ERROR, res) << "Can't enqueue request: " << strerror(-res);
-
-        res = mFrames.waitForBuffer(exposureTime + SEC);
-        ASSERT_EQ(NO_ERROR, res) << "No frame to get: " << strerror(-res);
-
-        camera_metadata_t *frame;
-        res = mFrames.dequeue(&frame);
-        ASSERT_EQ(NO_ERROR, res);
-        ASSERT_TRUE(frame != NULL);
-
-        IF_ALOGV() {
-            std::cout << "Output frame:" << std::endl;
-            dump_indented_camera_metadata(frame, 0, 1, 4);
-        }
-
-        res = jpegWaiter->waitForFrame(exposureTime + SEC);
-        ASSERT_EQ(NO_ERROR, res);
-
-        CpuConsumer::LockedBuffer buffer;
-        res = jpegConsumer->lockNextBuffer(&buffer);
-        ASSERT_EQ(NO_ERROR, res);
-
-        IF_ALOGV() {
-            const char *dumpname =
-                    "/data/local/tmp/camera2_test-capture1jpeg-dump.jpeg";
-            ALOGV("Dumping raw buffer to %s", dumpname);
-            // Write to file
-            std::ofstream jpegFile(dumpname);
-            size_t bpp = 1;
-            for (unsigned int y = 0; y < buffer.height; y++) {
-                jpegFile.write(
-                        (const char *)(buffer.data + y * buffer.stride * bpp),
-                        buffer.width * bpp);
-            }
-            jpegFile.close();
-        }
-
-        res = jpegConsumer->unlockBuffer(buffer);
-        ASSERT_EQ(NO_ERROR, res);
-
-        ASSERT_EQ(OK, waitUntilDrained());
-        ASSERT_NO_FATAL_FAILURE(disconnectStream(streamId));
-
-        res = closeCameraDevice(&mDevice);
-        ASSERT_EQ(NO_ERROR, res) << "Failed to close camera device";
-
-    }
-}
-
-} // namespace tests
-} // namespace camera2
-} // namespace android
diff --git a/tests/camera2/camera2_utils.cpp b/tests/camera2/camera2_utils.cpp
index 3c0767a..d962939 100644
--- a/tests/camera2/camera2_utils.cpp
+++ b/tests/camera2/camera2_utils.cpp
@@ -574,20 +574,19 @@
     return OK;
 }
 
-void FrameWaiter::onFrameAvailable() {
+void FrameWaiter::onFrameAvailable(const BufferItem& /* item */) {
     Mutex::Autolock lock(mMutex);
     mPendingFrames++;
     mCondition.signal();
 }
 
-int HWModuleHelpers::closeModule(hw_module_t* module) {
+int HWModuleHelpers::closeModule(void *dso) {
     int status;
-
-    if (!module) {
+    if (!dso) {
         return -EINVAL;
     }
 
-    status = dlclose(module->dso);
+    status = dlclose(dso);
     if (status != 0) {
         char const *err_str = dlerror();
         ALOGE("%s dlclose failed, error: %s", __func__, err_str ?: "unknown");
diff --git a/tests/camera2/camera2_utils.h b/tests/camera2/camera2_utils.h
index 0cdf4a3..ab1fcfb 100644
--- a/tests/camera2/camera2_utils.h
+++ b/tests/camera2/camera2_utils.h
@@ -231,7 +231,7 @@
      */
     status_t waitForFrame(nsecs_t timeout);
 
-    virtual void onFrameAvailable();
+    virtual void onFrameAvailable(const BufferItem& item);
 
     int mPendingFrames;
     Mutex mMutex;
@@ -240,7 +240,7 @@
 
 struct HWModuleHelpers {
     /* attempt to unload the library with dlclose */
-    static int closeModule(hw_module_t* module);
+    static int closeModule(void* dso);
 };
 
 }
diff --git a/tests/camera3/Android.mk b/tests/camera3/Android.mk
new file mode 100644
index 0000000..652851a
--- /dev/null
+++ b/tests/camera3/Android.mk
@@ -0,0 +1,20 @@
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES:= \
+    camera3tests.cpp \
+
+LOCAL_SHARED_LIBRARIES := \
+    liblog \
+    libhardware \
+    libcamera_metadata \
+
+LOCAL_C_INCLUDES += \
+    system/media/camera/include \
+
+LOCAL_CFLAGS += -Wall -Wextra
+
+LOCAL_MODULE:= camera3_tests
+LOCAL_MODULE_TAGS := tests
+
+include $(BUILD_NATIVE_TEST)
diff --git a/tests/camera3/camera3test_fixtures.h b/tests/camera3/camera3test_fixtures.h
new file mode 100644
index 0000000..17e3d45
--- /dev/null
+++ b/tests/camera3/camera3test_fixtures.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __ANDROID_HAL_CAMERA3_TEST_COMMON__
+#define __ANDROID_HAL_CAMERA3_TEST_COMMON__
+
+#include <gtest/gtest.h>
+#include <hardware/hardware.h>
+#include <hardware/camera3.h>
+
+namespace tests {
+
+static const int kMmaxCams = 2;
+static const uint16_t kVersion3_0 = HARDWARE_MODULE_API_VERSION(3, 0);
+
+class Camera3Module : public testing::Test {
+ public:
+    Camera3Module() :
+        num_cams_(0),
+        cam_module_(NULL) {}
+    ~Camera3Module() {}
+ protected:
+    virtual void SetUp() {
+        const hw_module_t *hw_module = NULL;
+        ASSERT_EQ(0, hw_get_module(CAMERA_HARDWARE_MODULE_ID, &hw_module))
+                    << "Can't get camera module";
+        ASSERT_TRUE(NULL != hw_module)
+                    << "hw_get_module didn't return a valid camera module";
+
+        cam_module_ = reinterpret_cast<const camera_module_t*>(hw_module);
+        ASSERT_TRUE(NULL != cam_module_->get_number_of_cameras)
+                    << "get_number_of_cameras is not implemented";
+        num_cams_ = cam_module_->get_number_of_cameras();
+    }
+    int num_cams() { return num_cams_; }
+    const camera_module_t * cam_module() { return cam_module_; }
+ private:
+    int num_cams_;
+    const camera_module_t *cam_module_;
+};
+
+class Camera3Device : public Camera3Module {
+ public:
+    Camera3Device() :
+        cam_device_(NULL) {}
+    ~Camera3Device() {}
+ protected:
+    virtual void SetUp() {
+        Camera3Module::SetUp();
+        hw_device_t *device = NULL;
+        ASSERT_TRUE(NULL != cam_module()->common.methods->open)
+                    << "Camera open() is unimplemented";
+        ASSERT_EQ(0, cam_module()->common.methods->open(
+            (const hw_module_t*)cam_module(), "0", &device))
+                << "Can't open camera device";
+        ASSERT_TRUE(NULL != device)
+                    << "Camera open() returned a NULL device";
+        ASSERT_LE(kVersion3_0, device->version)
+                    << "The device does not support HAL3";
+        cam_device_ = reinterpret_cast<camera3_device_t*>(device);
+    }
+    camera3_device_t* cam_device() { return cam_device_; }
+ private:
+    camera3_device *cam_device_;
+};
+
+}  // namespace tests
+
+#endif  // __ANDROID_HAL_CAMERA3_TEST_COMMON__
diff --git a/tests/camera3/camera3tests.cpp b/tests/camera3/camera3tests.cpp
new file mode 100644
index 0000000..5dbe588
--- /dev/null
+++ b/tests/camera3/camera3tests.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+#include "camera3test_fixtures.h"
+
+namespace tests {
+
+TEST_F(Camera3Module, NumberOfCameras) {
+    ASSERT_LT(0, num_cams()) << "No cameras found";
+    ASSERT_GE(kMmaxCams, num_cams()) << "Too many cameras found";
+}
+
+TEST_F(Camera3Module, IsActiveArraySizeSubsetPixelArraySize) {
+    for (int i = 0; i < num_cams(); ++i) {
+        ASSERT_TRUE(NULL != cam_module()->get_camera_info)
+            << "get_camera_info is not implemented";
+
+        camera_info info;
+        ASSERT_EQ(0, cam_module()->get_camera_info(i, &info))
+                    << "Can't get camera info for" << i;
+
+        camera_metadata_entry entry;
+        ASSERT_EQ(0, find_camera_metadata_entry(
+                    const_cast<camera_metadata_t*>(
+                        info.static_camera_characteristics),
+                        ANDROID_SENSOR_INFO_PIXEL_ARRAY_SIZE, &entry))
+                            << "Can't find the sensor pixel array size.";
+        int pixel_array_w = entry.data.i32[0];
+        int pixel_array_h = entry.data.i32[1];
+
+        ASSERT_EQ(0, find_camera_metadata_entry(
+                    const_cast<camera_metadata_t*>(
+                        info.static_camera_characteristics),
+                        ANDROID_SENSOR_INFO_ACTIVE_ARRAY_SIZE, &entry))
+                            << "Can't find the sensor active array size.";
+        int active_array_w = entry.data.i32[0];
+        int active_array_h = entry.data.i32[1];
+
+        EXPECT_LE(active_array_h, pixel_array_h);
+        EXPECT_LE(active_array_w, pixel_array_w);
+    }
+}
+
+TEST_F(Camera3Device, DefaultSettingsStillCaptureHasAndroidControlMode) {
+    ASSERT_TRUE(NULL != cam_device()->ops) << "Camera device ops are NULL";
+    const camera_metadata_t *default_settings =
+        cam_device()->ops->construct_default_request_settings(cam_device(),
+            CAMERA3_TEMPLATE_STILL_CAPTURE);
+    ASSERT_TRUE(NULL != default_settings) << "Camera default settings are NULL";
+    camera_metadata_entry entry;
+    ASSERT_EQ(0, find_camera_metadata_entry(
+                const_cast<camera_metadata_t*>(default_settings),
+                ANDROID_CONTROL_MODE, &entry))
+                    << "Can't find ANDROID_CONTROL_MODE in default settings.";
+}
+
+}  // namespace tests
diff --git a/tests/fingerprint/Android.mk b/tests/fingerprint/Android.mk
new file mode 100644
index 0000000..4f03c39
--- /dev/null
+++ b/tests/fingerprint/Android.mk
@@ -0,0 +1,19 @@
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES:= \
+    fingerprint_tests.cpp \
+
+LOCAL_SHARED_LIBRARIES := \
+    liblog \
+    libhardware \
+
+#LOCAL_C_INCLUDES += \
+#    system/media/camera/include \
+
+LOCAL_CFLAGS += -Wall -Wextra
+
+LOCAL_MODULE:= fingerprint_tests
+LOCAL_MODULE_TAGS := tests
+
+include $(BUILD_NATIVE_TEST)
diff --git a/tests/fingerprint/fingerprint_test_fixtures.h b/tests/fingerprint/fingerprint_test_fixtures.h
new file mode 100644
index 0000000..a526203
--- /dev/null
+++ b/tests/fingerprint/fingerprint_test_fixtures.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __ANDROID_HAL_FINGERPRINT_TEST_COMMON__
+#define __ANDROID_HAL_FINGERPRINT_TEST_COMMON__
+
+#include <gtest/gtest.h>
+#include <hardware/hardware.h>
+#include <hardware/fingerprint.h>
+
+namespace tests {
+
+static const uint16_t kVersion = HARDWARE_MODULE_API_VERSION(1, 0);
+
+class FingerprintModule : public testing::Test {
+ public:
+    FingerprintModule() :
+        fp_module_(NULL) {}
+    ~FingerprintModule() {}
+ protected:
+    virtual void SetUp() {
+        const hw_module_t *hw_module = NULL;
+        ASSERT_EQ(0, hw_get_module(FINGERPRINT_HARDWARE_MODULE_ID, &hw_module))
+                    << "Can't get fingerprint module";
+        ASSERT_TRUE(NULL != hw_module)
+                    << "hw_get_module didn't return a valid fingerprint module";
+
+        fp_module_ = reinterpret_cast<const fingerprint_module_t*>(hw_module);
+    }
+    const fingerprint_module_t* fp_module() { return fp_module_; }
+ private:
+    const fingerprint_module_t *fp_module_;
+};
+
+class FingerprintDevice : public FingerprintModule {
+ public:
+    FingerprintDevice() :
+        fp_device_(NULL) {}
+    ~FingerprintDevice() {}
+ protected:
+    virtual void SetUp() {
+        FingerprintModule::SetUp();
+        hw_device_t *device = NULL;
+        ASSERT_TRUE(NULL != fp_module()->common.methods->open)
+                    << "Fingerprint open() is unimplemented";
+        ASSERT_EQ(0, fp_module()->common.methods->open(
+            (const hw_module_t*)fp_module(), NULL, &device))
+                << "Can't open fingerprint device";
+        ASSERT_TRUE(NULL != device)
+                    << "Fingerprint open() returned a NULL device";
+        ASSERT_EQ(kVersion, device->version)
+                    << "Unsupported version";
+        fp_device_ = reinterpret_cast<fingerprint_device_t*>(device);
+    }
+    fingerprint_device_t* fp_device() { return fp_device_; }
+ private:
+    fingerprint_device_t *fp_device_;
+};
+
+}  // namespace tests
+
+#endif  // __ANDROID_HAL_FINGERPRINT_TEST_COMMON__
diff --git a/tests/fingerprint/fingerprint_tests.cpp b/tests/fingerprint/fingerprint_tests.cpp
new file mode 100644
index 0000000..dbb248f
--- /dev/null
+++ b/tests/fingerprint/fingerprint_tests.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+#include "fingerprint_test_fixtures.h"
+
+namespace tests {
+
+TEST_F(FingerprintDevice, isThereEnroll) {
+    ASSERT_TRUE(NULL != fp_device()->enroll)
+        << "enroll() function is not implemented";
+}
+
+TEST_F(FingerprintDevice, isTherePreEnroll) {
+    ASSERT_TRUE(NULL != fp_device()->pre_enroll)
+        << "pre_enroll() function is not implemented";
+}
+
+TEST_F(FingerprintDevice, isThereGetAuthenticatorId) {
+    ASSERT_TRUE(NULL != fp_device()->get_authenticator_id)
+        << "get_authenticator_id() function is not implemented";
+}
+
+TEST_F(FingerprintDevice, isThereCancel) {
+    ASSERT_TRUE(NULL != fp_device()->cancel)
+        << "cancel() function is not implemented";
+}
+
+TEST_F(FingerprintDevice, isThereRemove) {
+    ASSERT_TRUE(NULL != fp_device()->remove)
+        << "remove() function is not implemented";
+}
+
+TEST_F(FingerprintDevice, isThereAuthenticate) {
+    ASSERT_TRUE(NULL != fp_device()->authenticate)
+        << "authenticate() function is not implemented";
+}
+
+TEST_F(FingerprintDevice, isThereSetActiveGroup) {
+    ASSERT_TRUE(NULL != fp_device()->set_active_group)
+        << "set_active_group() function is not implemented";
+}
+
+TEST_F(FingerprintDevice, isThereSetNotify) {
+    ASSERT_TRUE(NULL != fp_device()->set_notify)
+        << "set_notify() function is not implemented";
+}
+
+}  // namespace tests
diff --git a/tests/hardware/Android.mk b/tests/hardware/Android.mk
new file mode 100644
index 0000000..02540c9
--- /dev/null
+++ b/tests/hardware/Android.mk
@@ -0,0 +1,12 @@
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := static-hal-check
+LOCAL_SRC_FILES := struct-size.cpp struct-offset.cpp struct-last.cpp
+LOCAL_SHARED_LIBRARIES := libhardware
+LOCAL_CFLAGS := -std=gnu++11 -O0
+
+LOCAL_C_INCLUDES += \
+    system/media/camera/include
+
+include $(BUILD_STATIC_LIBRARY)
diff --git a/tests/hardware/struct-last.cpp b/tests/hardware/struct-last.cpp
new file mode 100644
index 0000000..44a7b2d
--- /dev/null
+++ b/tests/hardware/struct-last.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <cstddef>
+#include <system/window.h>
+#include <hardware/hardware.h>
+#include <hardware/sensors.h>
+#include <hardware/fb.h>
+#include <hardware/hwcomposer.h>
+#include <hardware/gralloc.h>
+#include <hardware/consumerir.h>
+#include <hardware/camera_common.h>
+#include <hardware/camera3.h>
+
+#define GET_PADDING(align, size) (((align) - ((size) % (align))) % (align))
+
+#define CHECK_LAST_MEMBER(type, member) \
+do { \
+static constexpr size_t calc_size = offsetof(type, member) + sizeof(((type *)0)->member); \
+static_assert(sizeof(type) == calc_size + GET_PADDING(alignof(type), calc_size), \
+"" #member " is not the last element of " #type); \
+} while (0)
+
+void CheckSizes(void) {
+    //Types defined in hardware.h
+    CHECK_LAST_MEMBER(hw_module_t, reserved);
+    CHECK_LAST_MEMBER(hw_device_t, close);
+
+    //Types defined in sensors.h
+    CHECK_LAST_MEMBER(sensors_vec_t, reserved);
+    CHECK_LAST_MEMBER(sensors_event_t, reserved1);
+    CHECK_LAST_MEMBER(struct sensor_t, reserved);
+    CHECK_LAST_MEMBER(sensors_poll_device_1_t, reserved_procs);
+
+    //Types defined in fb.h
+    CHECK_LAST_MEMBER(framebuffer_device_t, reserved_proc);
+
+    //Types defined in hwcomposer.h
+    CHECK_LAST_MEMBER(hwc_layer_1_t, reserved);
+    CHECK_LAST_MEMBER(hwc_composer_device_1_t, reserved_proc);
+
+    //Types defined in gralloc.h
+    CHECK_LAST_MEMBER(gralloc_module_t, reserved_proc);
+    CHECK_LAST_MEMBER(alloc_device_t, reserved_proc);
+
+    //Types defined in consumerir.h
+    CHECK_LAST_MEMBER(consumerir_device_t, reserved);
+
+    //Types defined in camera_common.h
+    CHECK_LAST_MEMBER(vendor_tag_ops_t, reserved);
+    CHECK_LAST_MEMBER(camera_module_t, reserved);
+
+    //Types defined in camera3.h
+    CHECK_LAST_MEMBER(camera3_device_ops_t, reserved);
+}
+
diff --git a/tests/hardware/struct-offset.cpp b/tests/hardware/struct-offset.cpp
new file mode 100644
index 0000000..10c0895
--- /dev/null
+++ b/tests/hardware/struct-offset.cpp
@@ -0,0 +1,231 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <cstddef>
+#include <system/window.h>
+#include <hardware/hardware.h>
+#include <hardware/sensors.h>
+#include <hardware/fb.h>
+#include <hardware/hwcomposer.h>
+#include <hardware/gralloc.h>
+#include <hardware/consumerir.h>
+#include <hardware/camera_common.h>
+#include <hardware/camera3.h>
+
+//Ideally this would print type.member instead we need to rely on the line number from the output
+template <size_t actual, size_t expected> void check_member(void) {
+    static_assert(actual == expected, "");
+}
+
+#ifdef __LP64__
+#define CHECK_MEMBER_AT(type, member, off32, off64) \
+    check_member<offsetof(type, member), off64>()
+#else
+#define CHECK_MEMBER_AT(type, member, off32, off64) \
+    check_member<offsetof(type, member), off32>()
+#endif
+
+void CheckOffsets(void) {
+    //Types defined in hardware.h
+    CHECK_MEMBER_AT(hw_module_t, tag, 0, 0);
+    CHECK_MEMBER_AT(hw_module_t, module_api_version, 4, 4);
+    CHECK_MEMBER_AT(hw_module_t, hal_api_version, 6, 6);
+    CHECK_MEMBER_AT(hw_module_t, id, 8, 8);
+    CHECK_MEMBER_AT(hw_module_t, name, 12, 16);
+    CHECK_MEMBER_AT(hw_module_t, author, 16, 24);
+    CHECK_MEMBER_AT(hw_module_t, methods, 20, 32);
+    CHECK_MEMBER_AT(hw_module_t, dso, 24, 40);
+    CHECK_MEMBER_AT(hw_module_t, reserved, 28, 48);
+
+    CHECK_MEMBER_AT(hw_device_t, tag, 0, 0);
+    CHECK_MEMBER_AT(hw_device_t, version, 4, 4);
+    CHECK_MEMBER_AT(hw_device_t, module, 8, 8);
+    CHECK_MEMBER_AT(hw_device_t, reserved, 12, 16);
+    CHECK_MEMBER_AT(hw_device_t, close, 60, 112);
+
+    //Types defined in sensors.h
+    CHECK_MEMBER_AT(sensors_vec_t, v, 0, 0);
+    CHECK_MEMBER_AT(sensors_vec_t, x, 0, 0);
+    CHECK_MEMBER_AT(sensors_vec_t, y, 4, 4);
+    CHECK_MEMBER_AT(sensors_vec_t, z, 8, 8);
+    CHECK_MEMBER_AT(sensors_vec_t, azimuth, 0, 0);
+    CHECK_MEMBER_AT(sensors_vec_t, pitch, 4, 4);
+    CHECK_MEMBER_AT(sensors_vec_t, roll, 8, 8);
+    CHECK_MEMBER_AT(sensors_vec_t, status, 12, 12);
+    CHECK_MEMBER_AT(sensors_vec_t, reserved, 13, 13);
+
+    CHECK_MEMBER_AT(sensors_event_t, version, 0, 0);
+    CHECK_MEMBER_AT(sensors_event_t, sensor, 4, 4);
+    CHECK_MEMBER_AT(sensors_event_t, type, 8, 8);
+    CHECK_MEMBER_AT(sensors_event_t, reserved0, 12, 12);
+    CHECK_MEMBER_AT(sensors_event_t, timestamp, 16, 16);
+    CHECK_MEMBER_AT(sensors_event_t, data, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, acceleration, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, magnetic, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, orientation, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, gyro, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, temperature, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, distance, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, light, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, pressure, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, relative_humidity, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, uncalibrated_gyro, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, uncalibrated_magnetic, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, meta_data, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, u64, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, u64.data, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, u64.step_counter, 24, 24);
+    CHECK_MEMBER_AT(sensors_event_t, flags, 88, 88);
+    CHECK_MEMBER_AT(sensors_event_t, reserved1, 92, 92);
+
+    CHECK_MEMBER_AT(struct sensor_t, name, 0, 0);
+    CHECK_MEMBER_AT(struct sensor_t, vendor, 4, 8);
+    CHECK_MEMBER_AT(struct sensor_t, version, 8, 16);
+    CHECK_MEMBER_AT(struct sensor_t, handle, 12, 20);
+    CHECK_MEMBER_AT(struct sensor_t, type, 16, 24);
+    CHECK_MEMBER_AT(struct sensor_t, maxRange, 20, 28);
+    CHECK_MEMBER_AT(struct sensor_t, resolution, 24, 32);
+    CHECK_MEMBER_AT(struct sensor_t, power, 28, 36);
+    CHECK_MEMBER_AT(struct sensor_t, minDelay, 32, 40);
+    CHECK_MEMBER_AT(struct sensor_t, fifoReservedEventCount, 36, 44);
+    CHECK_MEMBER_AT(struct sensor_t, fifoMaxEventCount, 40, 48);
+    CHECK_MEMBER_AT(struct sensor_t, stringType, 44, 56);
+    CHECK_MEMBER_AT(struct sensor_t, requiredPermission, 48, 64);
+    CHECK_MEMBER_AT(struct sensor_t, maxDelay, 52, 72);
+    CHECK_MEMBER_AT(struct sensor_t, flags, 56, 80);
+    CHECK_MEMBER_AT(struct sensor_t, reserved, 60, 88);
+
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, v0, 0, 0);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, common, 0, 0);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, activate, 64, 120);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, setDelay, 68, 128);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, poll, 72, 136);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, batch, 76, 144);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, flush, 80, 152);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, inject_sensor_data, 84, 160);
+    CHECK_MEMBER_AT(sensors_poll_device_1_t, reserved_procs, 88, 168);
+
+    //Types defined in fb.h
+    CHECK_MEMBER_AT(framebuffer_device_t, common, 0, 0);
+    CHECK_MEMBER_AT(framebuffer_device_t, flags, 64, 120);
+    CHECK_MEMBER_AT(framebuffer_device_t, width, 68, 124);
+    CHECK_MEMBER_AT(framebuffer_device_t, height, 72, 128);
+    CHECK_MEMBER_AT(framebuffer_device_t, stride, 76, 132);
+    CHECK_MEMBER_AT(framebuffer_device_t, format, 80, 136);
+    CHECK_MEMBER_AT(framebuffer_device_t, xdpi, 84, 140);
+    CHECK_MEMBER_AT(framebuffer_device_t, ydpi, 88, 144);
+    CHECK_MEMBER_AT(framebuffer_device_t, fps, 92, 148);
+    CHECK_MEMBER_AT(framebuffer_device_t, minSwapInterval, 96, 152);
+    CHECK_MEMBER_AT(framebuffer_device_t, maxSwapInterval, 100, 156);
+    CHECK_MEMBER_AT(framebuffer_device_t, numFramebuffers, 104, 160);
+    CHECK_MEMBER_AT(framebuffer_device_t, reserved, 108, 164);
+    CHECK_MEMBER_AT(framebuffer_device_t, setSwapInterval, 136, 192);
+    CHECK_MEMBER_AT(framebuffer_device_t, setUpdateRect, 140, 200);
+    CHECK_MEMBER_AT(framebuffer_device_t, post, 144, 208);
+    CHECK_MEMBER_AT(framebuffer_device_t, compositionComplete, 148, 216);
+    CHECK_MEMBER_AT(framebuffer_device_t, dump, 152, 224);
+    CHECK_MEMBER_AT(framebuffer_device_t, enableScreen, 156, 232);
+    CHECK_MEMBER_AT(framebuffer_device_t, reserved_proc, 160, 240);
+
+    //Types defined in hwcomposer.h
+    CHECK_MEMBER_AT(hwc_layer_1_t, compositionType, 0, 0);
+    CHECK_MEMBER_AT(hwc_layer_1_t, hints, 4, 4);
+    CHECK_MEMBER_AT(hwc_layer_1_t, flags, 8, 8);
+    CHECK_MEMBER_AT(hwc_layer_1_t, backgroundColor, 12, 16);
+    CHECK_MEMBER_AT(hwc_layer_1_t, handle, 12, 16);
+    CHECK_MEMBER_AT(hwc_layer_1_t, transform, 16, 24);
+    CHECK_MEMBER_AT(hwc_layer_1_t, blending, 20, 28);
+    CHECK_MEMBER_AT(hwc_layer_1_t, sourceCropi, 24, 32);
+    CHECK_MEMBER_AT(hwc_layer_1_t, sourceCrop, 24, 32);
+    CHECK_MEMBER_AT(hwc_layer_1_t, sourceCropf, 24, 32);
+    CHECK_MEMBER_AT(hwc_layer_1_t, displayFrame, 40, 48);
+    CHECK_MEMBER_AT(hwc_layer_1_t, visibleRegionScreen, 56, 64);
+    CHECK_MEMBER_AT(hwc_layer_1_t, acquireFenceFd, 64, 80);
+    CHECK_MEMBER_AT(hwc_layer_1_t, releaseFenceFd, 68, 84);
+    CHECK_MEMBER_AT(hwc_layer_1_t, planeAlpha, 72, 88);
+    CHECK_MEMBER_AT(hwc_layer_1_t, _pad, 73, 89);
+
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, common, 0, 0);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, prepare, 64, 120);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, set, 68, 128);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, eventControl, 72, 136);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, blank, 76, 144);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, query, 80, 152);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, registerProcs, 84, 160);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, dump, 88, 168);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, getDisplayConfigs, 92, 176);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, getDisplayAttributes, 96, 184);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, getActiveConfig, 100, 192);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, setActiveConfig, 104, 200);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, setCursorPositionAsync, 108, 208);
+    CHECK_MEMBER_AT(hwc_composer_device_1_t, reserved_proc, 112, 216);
+
+    //Types defined in gralloc.h
+    CHECK_MEMBER_AT(gralloc_module_t, common, 0, 0);
+    CHECK_MEMBER_AT(gralloc_module_t, registerBuffer, 128, 248);
+    CHECK_MEMBER_AT(gralloc_module_t, unregisterBuffer, 132, 256);
+    CHECK_MEMBER_AT(gralloc_module_t, lock, 136, 264);
+    CHECK_MEMBER_AT(gralloc_module_t, unlock, 140, 272);
+    CHECK_MEMBER_AT(gralloc_module_t, perform, 144, 280);
+    CHECK_MEMBER_AT(gralloc_module_t, lock_ycbcr, 148, 288);
+    CHECK_MEMBER_AT(gralloc_module_t, lockAsync, 152, 296);
+    CHECK_MEMBER_AT(gralloc_module_t, unlockAsync, 156, 304);
+    CHECK_MEMBER_AT(gralloc_module_t, lockAsync_ycbcr, 160, 312);
+    CHECK_MEMBER_AT(gralloc_module_t, reserved_proc, 164, 320);
+
+    CHECK_MEMBER_AT(alloc_device_t, common, 0, 0);
+    CHECK_MEMBER_AT(alloc_device_t, alloc, 64, 120);
+    CHECK_MEMBER_AT(alloc_device_t, free, 68, 128);
+    CHECK_MEMBER_AT(alloc_device_t, dump, 72, 136);
+    CHECK_MEMBER_AT(alloc_device_t, reserved_proc, 76, 144);
+
+    //Types defined in consumerir.h
+    CHECK_MEMBER_AT(consumerir_device_t, common, 0, 0);
+    CHECK_MEMBER_AT(consumerir_device_t, transmit, 64, 120);
+    CHECK_MEMBER_AT(consumerir_device_t, get_num_carrier_freqs, 68, 128);
+    CHECK_MEMBER_AT(consumerir_device_t, get_carrier_freqs, 72, 136);
+    CHECK_MEMBER_AT(consumerir_device_t, reserved, 76, 144);
+
+    //Types defined in camera_common.h
+    CHECK_MEMBER_AT(vendor_tag_ops_t, get_tag_count, 0, 0);
+    CHECK_MEMBER_AT(vendor_tag_ops_t, get_all_tags, 4, 8);
+    CHECK_MEMBER_AT(vendor_tag_ops_t, get_section_name, 8, 16);
+    CHECK_MEMBER_AT(vendor_tag_ops_t, get_tag_name, 12, 24);
+    CHECK_MEMBER_AT(vendor_tag_ops_t, get_tag_type, 16, 32);
+    CHECK_MEMBER_AT(vendor_tag_ops_t, reserved, 20, 40);
+
+    CHECK_MEMBER_AT(camera_module_t, common, 0, 0);
+    CHECK_MEMBER_AT(camera_module_t, get_number_of_cameras, 128, 248);
+    CHECK_MEMBER_AT(camera_module_t, get_camera_info, 132, 256);
+    CHECK_MEMBER_AT(camera_module_t, set_callbacks, 136, 264);
+    CHECK_MEMBER_AT(camera_module_t, get_vendor_tag_ops, 140, 272);
+    CHECK_MEMBER_AT(camera_module_t, open_legacy, 144, 280);
+    CHECK_MEMBER_AT(camera_module_t, set_torch_mode, 148, 288);
+    CHECK_MEMBER_AT(camera_module_t, init, 152, 296);
+    CHECK_MEMBER_AT(camera_module_t, reserved, 156, 304);
+
+    //Types defined in camera3.h
+    CHECK_MEMBER_AT(camera3_device_ops_t, initialize, 0, 0);
+    CHECK_MEMBER_AT(camera3_device_ops_t, configure_streams, 4, 8);
+    CHECK_MEMBER_AT(camera3_device_ops_t, register_stream_buffers, 8, 16);
+    CHECK_MEMBER_AT(camera3_device_ops_t, construct_default_request_settings, 12, 24);
+    CHECK_MEMBER_AT(camera3_device_ops_t, process_capture_request, 16, 32);
+    CHECK_MEMBER_AT(camera3_device_ops_t, get_metadata_vendor_tag_ops, 20, 40);
+    CHECK_MEMBER_AT(camera3_device_ops_t, dump, 24, 48);
+    CHECK_MEMBER_AT(camera3_device_ops_t, flush, 28, 56);
+    CHECK_MEMBER_AT(camera3_device_ops_t, reserved, 32, 64);
+}
+
diff --git a/tests/hardware/struct-size.cpp b/tests/hardware/struct-size.cpp
new file mode 100644
index 0000000..4207ea8
--- /dev/null
+++ b/tests/hardware/struct-size.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+#include <system/window.h>
+#include <hardware/hardware.h>
+#include <hardware/sensors.h>
+#include <hardware/fb.h>
+#include <hardware/hwcomposer.h>
+#include <hardware/gralloc.h>
+#include <hardware/consumerir.h>
+#include <hardware/camera_common.h>
+#include <hardware/camera3.h>
+
+template<size_t> static constexpr size_t CheckSizeHelper(size_t, size_t);
+
+template<> constexpr size_t CheckSizeHelper<4>(size_t size32, size_t size64) {
+    return size32;
+}
+
+template<> constexpr size_t CheckSizeHelper<8>(size_t size32, size_t size64) {
+    return size64;
+}
+
+template<typename T, size_t size32, size_t size64> static void CheckTypeSize() {
+    const size_t mySize = CheckSizeHelper<sizeof(void *)>(size32, size64);
+
+    static_assert(sizeof(T) == mySize, "struct is the wrong size");
+}
+
+void CheckSizes(void) {
+    //Types defined in hardware.h
+    CheckTypeSize<hw_module_t, 128, 248>();
+    CheckTypeSize<hw_device_t, 64, 120>();
+
+    //Types defined in sensors.h
+    CheckTypeSize<sensors_vec_t, 16, 16>();
+    CheckTypeSize<sensors_event_t, 104, 104>();
+    CheckTypeSize<struct sensor_t, 68, 104>();
+    CheckTypeSize<sensors_poll_device_1_t, 116, 224>();
+
+    //Types defined in fb.h
+    CheckTypeSize<framebuffer_device_t, 184, 288>();
+
+    //Types defined in hwcomposer.h
+    CheckTypeSize<hwc_layer_1_t, 96, 120>();
+    CheckTypeSize<hwc_composer_device_1_t, 116, 224>();
+
+    //Types defined in gralloc.h
+    CheckTypeSize<gralloc_module_t, 176, 344>();
+    CheckTypeSize<alloc_device_t, 104, 200>();
+
+    //Types defined in consumerir.h
+    CheckTypeSize<consumerir_device_t, 96, 184>();
+
+    //Types defined in camera_common.h
+    CheckTypeSize<vendor_tag_ops_t, 52, 104>();
+    CheckTypeSize<camera_module_t, 176, 344>();
+
+    //Types defined in camera3.h
+    CheckTypeSize<camera3_device_ops_t, 64, 128>();
+}
+
diff --git a/tests/hwc/test-arrows.c b/tests/hwc/test-arrows.c
index a35faa7..12e7c8f 100644
--- a/tests/hwc/test-arrows.c
+++ b/tests/hwc/test-arrows.c
@@ -140,7 +140,7 @@
 int main(int argc, char **argv) {
 	EGLDisplay display;
 	EGLSurface surface;
-	int w, h, count;
+	int w, h, count = 0;
 
 	if (argc > 1)
 		count = atoi(argv[1]);
diff --git a/tests/input/Android.mk b/tests/input/Android.mk
new file mode 100644
index 0000000..3011b2e
--- /dev/null
+++ b/tests/input/Android.mk
@@ -0,0 +1,19 @@
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/tests/input/evdev/Android.mk b/tests/input/evdev/Android.mk
new file mode 100644
index 0000000..167cbc2
--- /dev/null
+++ b/tests/input/evdev/Android.mk
@@ -0,0 +1,23 @@
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+LOCAL_C_INCLUDES += hardware/libhardware/modules/input/evdev
+
+LOCAL_SRC_FILES:= \
+    InputDevice_test.cpp \
+    InputHub_test.cpp \
+    TestHelpers.cpp
+
+LOCAL_SHARED_LIBRARIES := \
+    libinput_evdev \
+    liblog \
+    libutils
+
+LOCAL_CLANG := true
+LOCAL_CFLAGS += -Wall -Wextra -Wno-unused-parameter
+LOCAL_CPPFLAGS += -std=c++14
+
+LOCAL_MODULE := libinput_evdevtests
+LOCAL_MODULE_TAGS := tests
+
+include $(BUILD_NATIVE_TEST)
diff --git a/tests/input/evdev/InputDevice_test.cpp b/tests/input/evdev/InputDevice_test.cpp
new file mode 100644
index 0000000..a96d664
--- /dev/null
+++ b/tests/input/evdev/InputDevice_test.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "InputHub_test"
+//#define LOG_NDEBUG 0
+
+#include <linux/input.h>
+
+#include <gtest/gtest.h>
+
+#include <utils/Timers.h>
+
+#include "InputDevice.h"
+#include "InputHub.h"
+
+// # of milliseconds to allow for timing measurements
+#define TIMING_TOLERANCE_MS 25
+
+#define MSC_ANDROID_TIME_SEC  0x6
+#define MSC_ANDROID_TIME_USEC 0x7
+
+namespace android {
+namespace tests {
+
+class MockInputDeviceNode : public InputDeviceNode {
+    virtual const std::string& getPath() const override { return mPath; }
+
+    virtual const std::string& getName() const override { return mName; }
+    virtual const std::string& getLocation() const override { return mLocation; }
+    virtual const std::string& getUniqueId() const override { return mUniqueId; }
+
+    virtual uint16_t getBusType() const override { return 0; }
+    virtual uint16_t getVendorId() const override { return 0; }
+    virtual uint16_t getProductId() const override { return 0; }
+    virtual uint16_t getVersion() const override { return 0; }
+
+    virtual bool hasKey(int32_t key) const { return false; }
+    virtual bool hasRelativeAxis(int axis) const { return false; }
+    virtual bool hasInputProperty(int property) const { return false; }
+
+    virtual int32_t getKeyState(int32_t key) const { return 0; }
+    virtual int32_t getSwitchState(int32_t sw) const { return 0; }
+    virtual const AbsoluteAxisInfo* getAbsoluteAxisInfo(int32_t axis) const { return nullptr; }
+    virtual status_t getAbsoluteAxisValue(int32_t axis, int32_t* outValue) const { return 0; }
+
+    virtual void vibrate(nsecs_t duration) {}
+    virtual void cancelVibrate(int32_t deviceId) {}
+
+    virtual void disableDriverKeyRepeat() {}
+
+private:
+    std::string mPath = "/test";
+    std::string mName = "Test Device";
+    std::string mLocation = "test/0";
+    std::string mUniqueId = "test-id";
+};
+
+TEST(EvdevDeviceTest, testOverrideTime) {
+    auto node = std::make_shared<MockInputDeviceNode>();
+    auto device = std::make_unique<EvdevDevice>(node);
+    ASSERT_TRUE(device != nullptr);
+
+    // Send two timestamp override events before an input event.
+    nsecs_t when = 2ULL;
+    InputEvent msc1 = { when, EV_MSC, MSC_ANDROID_TIME_SEC, 1 };
+    InputEvent msc2 = { when, EV_MSC, MSC_ANDROID_TIME_USEC, 900000 };
+
+    // Send a key down and syn. Should get the overridden timestamp.
+    InputEvent keyDown = { when, EV_KEY, KEY_HOME, 1 };
+    InputEvent syn = { when, EV_SYN, SYN_REPORT, 0 };
+
+    // Send a key up, which should be at the reported timestamp.
+    InputEvent keyUp = { when, EV_KEY, KEY_HOME, 0 };
+
+    device->processInput(msc1, when);
+    device->processInput(msc2, when);
+    device->processInput(keyDown, when);
+    device->processInput(syn, when);
+    device->processInput(keyUp, when);
+
+    nsecs_t expectedWhen = s2ns(1) + us2ns(900000);
+    EXPECT_EQ(expectedWhen, keyDown.when);
+    EXPECT_EQ(expectedWhen, syn.when);
+    EXPECT_EQ(when, keyUp.when);
+}
+
+TEST(EvdevDeviceTest, testWrongClockCorrection) {
+    auto node = std::make_shared<MockInputDeviceNode>();
+    auto device = std::make_unique<EvdevDevice>(node);
+    ASSERT_TRUE(device != nullptr);
+
+    auto now = systemTime(SYSTEM_TIME_MONOTONIC);
+
+    // Input event that supposedly comes from 1 minute in the future. In
+    // reality, the timestamps would be much further off.
+    InputEvent event = { now + s2ns(60), EV_KEY, KEY_HOME, 1 };
+
+    device->processInput(event, now);
+
+    EXPECT_NEAR(now, event.when, ms2ns(TIMING_TOLERANCE_MS));
+}
+
+TEST(EvdevDeviceTest, testClockCorrectionOk) {
+    auto node = std::make_shared<MockInputDeviceNode>();
+    auto device = std::make_unique<EvdevDevice>(node);
+    ASSERT_TRUE(device != nullptr);
+
+    auto now = systemTime(SYSTEM_TIME_MONOTONIC);
+
+    // Input event from now, but will be reported as if it came early.
+    InputEvent event = { now, EV_KEY, KEY_HOME, 1 };
+
+    // event_time parameter is 11 seconds in the past, so it looks like we used
+    // the wrong clock.
+    device->processInput(event, now - s2ns(11));
+
+    EXPECT_NEAR(now, event.when, ms2ns(TIMING_TOLERANCE_MS));
+}
+
+}  // namespace tests
+}  // namespace android
diff --git a/tests/input/evdev/InputHub_test.cpp b/tests/input/evdev/InputHub_test.cpp
new file mode 100644
index 0000000..f2c8edf
--- /dev/null
+++ b/tests/input/evdev/InputHub_test.cpp
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "InputHub_test"
+//#define LOG_NDEBUG 0
+
+#include <linux/input.h>
+
+#include <chrono>
+#include <memory>
+#include <mutex>
+
+#include <gtest/gtest.h>
+
+#include <utils/Log.h>
+#include <utils/StopWatch.h>
+#include <utils/Timers.h>
+
+#include "InputHub.h"
+#include "TestHelpers.h"
+
+// # of milliseconds to fudge stopwatch measurements
+#define TIMING_TOLERANCE_MS 25
+#define NO_TIMEOUT (-1)
+
+namespace android {
+namespace tests {
+
+using namespace std::literals::chrono_literals;
+
+using InputCbFunc = std::function<void(std::shared_ptr<InputDeviceNode>, InputEvent&, nsecs_t)>;
+using DeviceCbFunc = std::function<void(std::shared_ptr<InputDeviceNode>)>;
+
+static const InputCbFunc kNoopInputCb = [](std::shared_ptr<InputDeviceNode>, InputEvent&, nsecs_t){};
+static const DeviceCbFunc kNoopDeviceCb = [](std::shared_ptr<InputDeviceNode>){};
+
+class TestInputCallback : public InputCallbackInterface {
+public:
+    TestInputCallback() :
+        mInputCb(kNoopInputCb), mDeviceAddedCb(kNoopDeviceCb), mDeviceRemovedCb(kNoopDeviceCb) {}
+    virtual ~TestInputCallback() = default;
+
+    void setInputCallback(InputCbFunc cb) { mInputCb = cb; }
+    void setDeviceAddedCallback(DeviceCbFunc cb) { mDeviceAddedCb = cb; }
+    void setDeviceRemovedCallback(DeviceCbFunc cb) { mDeviceRemovedCb = cb; }
+
+    virtual void onInputEvent(std::shared_ptr<InputDeviceNode> node, InputEvent& event,
+            nsecs_t event_time) override {
+        mInputCb(node, event, event_time);
+    }
+    virtual void onDeviceAdded(std::shared_ptr<InputDeviceNode> node) override {
+        mDeviceAddedCb(node);
+    }
+    virtual void onDeviceRemoved(std::shared_ptr<InputDeviceNode> node) override {
+        mDeviceRemovedCb(node);
+    }
+
+private:
+    InputCbFunc mInputCb;
+    DeviceCbFunc mDeviceAddedCb;
+    DeviceCbFunc mDeviceRemovedCb;
+};
+
+class InputHubTest : public ::testing::Test {
+ protected:
+     virtual void SetUp() {
+         mCallback = std::make_shared<TestInputCallback>();
+         mInputHub = std::make_shared<InputHub>(mCallback);
+     }
+
+     std::shared_ptr<TestInputCallback> mCallback;
+     std::shared_ptr<InputHub> mInputHub;
+};
+
+TEST_F(InputHubTest, testWake) {
+    // Call wake() after 100ms.
+    auto f = delay_async(100ms, [&]() { EXPECT_EQ(OK, mInputHub->wake()); });
+
+    StopWatch stopWatch("poll");
+    EXPECT_EQ(OK, mInputHub->poll());
+    int32_t elapsedMillis = ns2ms(stopWatch.elapsedTime());
+
+    EXPECT_NEAR(100, elapsedMillis, TIMING_TOLERANCE_MS);
+}
+
+TEST_F(InputHubTest, DISABLED_testDeviceAdded) {
+    auto tempDir = std::make_shared<TempDir>();
+    std::string pathname;
+    // Expect that this callback will run and set handle and pathname.
+    mCallback->setDeviceAddedCallback(
+            [&](std::shared_ptr<InputDeviceNode> node) {
+                pathname = node->getPath();
+            });
+
+    ASSERT_EQ(OK, mInputHub->registerDevicePath(tempDir->getName()));
+
+    // Create a new file in tempDir after 100ms.
+    std::unique_ptr<TempFile> tempFile;
+    std::mutex tempFileMutex;
+    auto f = delay_async(100ms,
+            [&]() {
+                std::lock_guard<std::mutex> lock(tempFileMutex);
+                tempFile.reset(tempDir->newTempFile());
+            });
+
+    StopWatch stopWatch("poll");
+    EXPECT_EQ(OK, mInputHub->poll());
+    int32_t elapsedMillis = ns2ms(stopWatch.elapsedTime());
+
+
+    EXPECT_NEAR(100, elapsedMillis, TIMING_TOLERANCE_MS);
+    std::lock_guard<std::mutex> lock(tempFileMutex);
+    EXPECT_EQ(tempFile->getName(), pathname);
+}
+
+TEST_F(InputHubTest, DISABLED_testDeviceRemoved) {
+    // Create a temp dir and file. Save its name and handle (to be filled in
+    // once InputHub scans the dir).
+    auto tempDir = std::make_unique<TempDir>();
+    auto deviceFile = std::unique_ptr<TempFile>(tempDir->newTempFile());
+    std::string tempFileName(deviceFile->getName());
+
+    std::shared_ptr<InputDeviceNode> tempNode;
+    // Expect that these callbacks will run for the above device file.
+    mCallback->setDeviceAddedCallback(
+            [&](std::shared_ptr<InputDeviceNode> node) {
+                tempNode = node;
+            });
+    mCallback->setDeviceRemovedCallback(
+            [&](std::shared_ptr<InputDeviceNode> node) {
+                EXPECT_EQ(tempNode, node);
+            });
+
+    ASSERT_EQ(OK, mInputHub->registerDevicePath(tempDir->getName()));
+    // Ensure that tempDir was scanned to find the device.
+    ASSERT_TRUE(tempNode != nullptr);
+
+    auto f = delay_async(100ms, [&]() { deviceFile.reset(); });
+
+    StopWatch stopWatch("poll");
+    EXPECT_EQ(OK, mInputHub->poll());
+    int32_t elapsedMillis = ns2ms(stopWatch.elapsedTime());
+
+    EXPECT_NEAR(100, elapsedMillis, TIMING_TOLERANCE_MS);
+}
+
+TEST_F(InputHubTest, DISABLED_testInputEvent) {
+    // Create a temp dir and file. Save its name and handle (to be filled in
+    // once InputHub scans the dir.)
+    auto tempDir = std::make_unique<TempDir>();
+    auto deviceFile = std::unique_ptr<TempFile>(tempDir->newTempFile());
+    std::string tempFileName(deviceFile->getName());
+
+    // Send a key event corresponding to HOME.
+    struct input_event iev;
+    iev.time = { 1, 0 };
+    iev.type = EV_KEY;
+    iev.code = KEY_HOME;
+    iev.value = 0x01;
+
+    auto inputDelayMs = 100ms;
+    auto f = delay_async(inputDelayMs, [&] {
+                ssize_t nWrite = TEMP_FAILURE_RETRY(write(deviceFile->getFd(), &iev, sizeof(iev)));
+
+                ASSERT_EQ(static_cast<ssize_t>(sizeof(iev)), nWrite) << "could not write to "
+                    << deviceFile->getFd() << ". errno: " << errno;
+            });
+
+    // Expect this callback to run when the input event is read.
+    nsecs_t expectedWhen = systemTime(CLOCK_MONOTONIC) + ms2ns(inputDelayMs.count());
+    mCallback->setInputCallback(
+            [&](std::shared_ptr<InputDeviceNode> node, InputEvent& event, nsecs_t event_time) {
+                EXPECT_NEAR(expectedWhen, event_time, ms2ns(TIMING_TOLERANCE_MS));
+                EXPECT_EQ(s2ns(1), event.when);
+                EXPECT_EQ(tempFileName, node->getPath());
+                EXPECT_EQ(EV_KEY, event.type);
+                EXPECT_EQ(KEY_HOME, event.code);
+                EXPECT_EQ(0x01, event.value);
+            });
+    ASSERT_EQ(OK, mInputHub->registerDevicePath(tempDir->getName()));
+
+    StopWatch stopWatch("poll");
+    EXPECT_EQ(OK, mInputHub->poll());
+    int32_t elapsedMillis = ns2ms(stopWatch.elapsedTime());
+
+    EXPECT_NEAR(100, elapsedMillis, TIMING_TOLERANCE_MS);
+}
+
+TEST_F(InputHubTest, DISABLED_testCallbackOrder) {
+    // Create two "devices": one to receive input and the other to go away.
+    auto tempDir = std::make_unique<TempDir>();
+    auto deviceFile1 = std::unique_ptr<TempFile>(tempDir->newTempFile());
+    auto deviceFile2 = std::unique_ptr<TempFile>(tempDir->newTempFile());
+    std::string tempFileName(deviceFile2->getName());
+
+    bool inputCallbackFinished = false, deviceCallbackFinished = false;
+
+    // Setup the callback for input events. Should run before the device
+    // callback.
+    mCallback->setInputCallback(
+            [&](std::shared_ptr<InputDeviceNode>, InputEvent&, nsecs_t) {
+                ASSERT_FALSE(deviceCallbackFinished);
+                inputCallbackFinished = true;
+            });
+
+    // Setup the callback for device removal. Should run after the input
+    // callback.
+    mCallback->setDeviceRemovedCallback(
+            [&](std::shared_ptr<InputDeviceNode> node) {
+                ASSERT_TRUE(inputCallbackFinished)
+                    << "input callback did not run before device changed callback";
+                // Make sure the correct device was removed.
+                EXPECT_EQ(tempFileName, node->getPath());
+                deviceCallbackFinished = true;
+            });
+    ASSERT_EQ(OK, mInputHub->registerDevicePath(tempDir->getName()));
+
+    auto f = delay_async(100ms,
+            [&]() {
+                // Delete the second device file first.
+                deviceFile2.reset();
+
+                // Then inject an input event into the first device.
+                struct input_event iev;
+                iev.time = { 1, 0 };
+                iev.type = EV_KEY;
+                iev.code = KEY_HOME;
+                iev.value = 0x01;
+
+                ssize_t nWrite = TEMP_FAILURE_RETRY(write(deviceFile1->getFd(), &iev, sizeof(iev)));
+
+                ASSERT_EQ(static_cast<ssize_t>(sizeof(iev)), nWrite) << "could not write to "
+                    << deviceFile1->getFd() << ". errno: " << errno;
+            });
+
+    StopWatch stopWatch("poll");
+    EXPECT_EQ(OK, mInputHub->poll());
+    int32_t elapsedMillis = ns2ms(stopWatch.elapsedTime());
+
+    EXPECT_NEAR(100, elapsedMillis, TIMING_TOLERANCE_MS);
+    EXPECT_TRUE(inputCallbackFinished);
+    EXPECT_TRUE(deviceCallbackFinished);
+}
+
+}  // namespace tests
+}  // namespace android
diff --git a/tests/input/evdev/TestHelpers.cpp b/tests/input/evdev/TestHelpers.cpp
new file mode 100644
index 0000000..63b579e
--- /dev/null
+++ b/tests/input/evdev/TestHelpers.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "TestHelpers"
+#define LOG_NDEBUG 0
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <utils/Log.h>
+
+#include "TestHelpers.h"
+
+namespace android {
+
+static const char kTmpDirTemplate[] = "/data/local/tmp/XXXXXX";
+
+TempFile::TempFile(const char* path) {
+    bool needTrailingSlash = path[strlen(path) - 1] != '/';
+    // name = path + XXXXXX + \0
+    size_t nameLen = strlen(path) + 6 + 1;
+    if (needTrailingSlash) nameLen++;
+
+    mName = new char[nameLen];
+    strcpy(mName, path);
+    if (needTrailingSlash) {
+        strcat(mName, "/");
+    }
+    strcat(mName, "XXXXXX");
+    mName = mktemp(mName);
+    LOG_FATAL_IF(mName == nullptr, "could not create temp filename %s. errno=%d", mName, errno);
+
+    int result = TEMP_FAILURE_RETRY(mkfifo(mName, S_IRWXU));
+    LOG_FATAL_IF(result < 0, "could not create fifo %s. errno=%d", mName, errno);
+
+    mFd = TEMP_FAILURE_RETRY(open(mName, O_RDWR | O_NONBLOCK));
+    LOG_FATAL_IF(mFd < 0, "could not open fifo %s. errno=%d", mName, errno);
+}
+
+TempFile::~TempFile() {
+    if (unlink(mName) < 0) {
+        ALOGE("could not unlink %s. errno=%d", mName, errno);
+    }
+    if (close(mFd) < 0) {
+        ALOGE("could not close %d. errno=%d", mFd, errno);
+    }
+    delete[] mName;
+}
+
+TempDir::TempDir() {
+    mName = new char[sizeof(kTmpDirTemplate)];
+    strcpy(mName, kTmpDirTemplate);
+    mName = mkdtemp(mName);
+    LOG_FATAL_IF(mName == nullptr, "could not allocate tempdir %s", mName);
+}
+
+TempDir::~TempDir() {
+    auto tmpDir = opendir(mName);
+    while (auto entry = readdir(tmpDir)) {
+        if (strcmp(entry->d_name, ".") == 0 ||
+            strcmp(entry->d_name, "..") == 0) {
+            continue;
+        }
+        ALOGD("stale file %s, removing", entry->d_name);
+        unlink(entry->d_name);
+    }
+    closedir(tmpDir);
+    rmdir(mName);
+    delete mName;
+}
+
+TempFile* TempDir::newTempFile() {
+    return new TempFile(mName);
+}
+
+}  // namespace android
diff --git a/tests/input/evdev/TestHelpers.h b/tests/input/evdev/TestHelpers.h
new file mode 100644
index 0000000..461db04
--- /dev/null
+++ b/tests/input/evdev/TestHelpers.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_TEST_HELPERS_H_
+#define ANDROID_TEST_HELPERS_H_
+
+#include <future>
+#include <thread>
+
+namespace android {
+
+/**
+ * Runs the given function after the specified delay.
+ * NOTE: if the std::future returned from std::async is not bound, this function
+ * will block until the task completes. This is almost certainly NOT what you
+ * want, so save the return value from delay_async into a variable:
+ *
+ * auto f = delay_async(100ms, []{ ALOGD("Hello world"); });
+ */
+template<class Function, class Duration>
+decltype(auto) delay_async(Duration&& delay, Function&& task)
+{
+    return std::async(std::launch::async, [=]{ std::this_thread::sleep_for(delay); task(); });
+}
+
+/**
+ * Creates and opens a temporary file at the given path. The file is unlinked
+ * and closed in the destructor.
+ */
+class TempFile {
+public:
+    TempFile(const char* path);
+    ~TempFile();
+
+    // No copy or assign
+    TempFile(const TempFile&) = delete;
+    TempFile& operator=(const TempFile&) = delete;
+
+    const char* getName() const { return mName; }
+    int getFd() const { return mFd; }
+
+private:
+    char* mName;
+    int mFd;
+};
+
+/**
+ * Creates a temporary directory that can create temporary files. The directory
+ * is emptied and deleted in the destructor.
+ */
+class TempDir {
+public:
+    TempDir();
+    ~TempDir();
+
+    // No copy or assign
+    TempDir(const TempDir&) = delete;
+    TempDir& operator=(const TempDir&) = delete;
+
+    const char* getName() const { return mName; }
+
+    TempFile* newTempFile();
+
+private:
+    char* mName;
+};
+
+}  // namespace android
+
+#endif  // ANDROID_TEST_HELPERS_H_
diff --git a/tests/keymaster/Android.mk b/tests/keymaster/Android.mk
index e53e67f..0c11795 100644
--- a/tests/keymaster/Android.mk
+++ b/tests/keymaster/Android.mk
@@ -6,26 +6,14 @@
 LOCAL_SRC_FILES:= \
     keymaster_test.cpp
 
-# Note that "bionic" is needed because of stlport
-LOCAL_C_INCLUDES := \
-    bionic \
-    external/gtest/include \
-    external/openssl/include \
-    external/stlport/stlport
-
 LOCAL_SHARED_LIBRARIES := \
     liblog \
     libutils \
     libcrypto \
-    libstlport \
-    libhardware
-
-LOCAL_STATIC_LIBRARIES := \
-    libgtest \
-    libgtest_main
+    libhardware \
 
 LOCAL_MODULE := keymaster_test
 
 LOCAL_MODULE_TAGS := tests
 
-include $(BUILD_EXECUTABLE)
+include $(BUILD_NATIVE_TEST)
diff --git a/tests/keymaster/keymaster_test.cpp b/tests/keymaster/keymaster_test.cpp
index 6b76ccb..e5e1dfd 100644
--- a/tests/keymaster/keymaster_test.cpp
+++ b/tests/keymaster/keymaster_test.cpp
@@ -35,7 +35,7 @@
 
 #include <UniquePtr.h>
 
-#include <hardware/keymaster.h>
+#include <hardware/keymaster0.h>
 
 namespace android {
 
@@ -92,13 +92,13 @@
 
 class UniqueKey : public UniqueBlob {
 public:
-    UniqueKey(keymaster_device_t** dev, uint8_t* bytes, size_t length) :
+    UniqueKey(keymaster0_device_t** dev, uint8_t* bytes, size_t length) :
             UniqueBlob(bytes, length), mDevice(dev) {
     }
 
     ~UniqueKey() {
         if (mDevice != NULL && *mDevice != NULL) {
-            keymaster_device_t* dev = *mDevice;
+            keymaster0_device_t* dev = *mDevice;
             if (dev->delete_keypair != NULL) {
                 dev->delete_keypair(dev, get(), length());
             }
@@ -106,7 +106,7 @@
     }
 
 private:
-    keymaster_device_t** mDevice;
+    keymaster0_device_t** mDevice;
 };
 
 class UniqueReadOnlyBlob {
@@ -341,7 +341,7 @@
 
         std::cout << "Using keymaster module: " << mod->name << std::endl;
 
-        ASSERT_EQ(0, keymaster_open(mod, &sDevice))
+        ASSERT_EQ(0, keymaster0_open(mod, &sDevice))
                 << "Should be able to open the keymaster device";
 
         ASSERT_EQ(KEYMASTER_MODULE_API_VERSION_0_2, mod->module_api_version)
@@ -364,14 +364,14 @@
     }
 
     static void TearDownTestCase() {
-        ASSERT_EQ(0, keymaster_close(sDevice));
+        ASSERT_EQ(0, keymaster0_close(sDevice));
     }
 
 protected:
-    static keymaster_device_t* sDevice;
+    static keymaster0_device_t* sDevice;
 };
 
-keymaster_device_t* KeymasterBaseTest::sDevice = NULL;
+keymaster0_device_t* KeymasterBaseTest::sDevice = NULL;
 
 class KeymasterTest : public KeymasterBaseTest {
 };