diff --git a/include/gui/BufferQueueConsumer.h b/include/gui/BufferQueueConsumer.h
index 1e22d28..b383056 100644
--- a/include/gui/BufferQueueConsumer.h
+++ b/include/gui/BufferQueueConsumer.h
@@ -129,6 +129,12 @@
     // enumerated in gralloc.h, e.g. GRALLOC_USAGE_HW_RENDER; the default is 0.
     virtual status_t setConsumerUsageBits(uint32_t usage);
 
+    // setConsumerIsProtected will turn on an internal bit that indicates whether
+    // the consumer can handle protected gralloc buffers (i.e. with
+    // GRALLOC_USAGE_PROTECTED set). IGraphicBufferProducer can query this
+    // capability using NATIVE_WINDOW_CONSUMER_IS_PROTECTED.
+    virtual status_t setConsumerIsProtected(bool isProtected);
+
     // setTransformHint bakes in rotation to buffers so overlays can be used.
     // The values are enumerated in window.h, e.g.
     // NATIVE_WINDOW_TRANSFORM_ROT_90.  The default is 0 (no transform).
diff --git a/include/gui/BufferQueueCore.h b/include/gui/BufferQueueCore.h
index cfe716f..dd8b992 100644
--- a/include/gui/BufferQueueCore.h
+++ b/include/gui/BufferQueueCore.h
@@ -172,6 +172,10 @@
     // GraphicBuffers.
     uint32_t mConsumerUsageBits;
 
+    // mConsumerIsProtected indicates the consumer is ready to handle protected
+    // buffer.
+    bool mConsumerIsProtected;
+
     // mConnectedApi indicates the producer API that is currently connected
     // to this BufferQueue. It defaults to NO_CONNECTED_API, and gets updated
     // by the connect and disconnect methods.
diff --git a/include/gui/IGraphicBufferConsumer.h b/include/gui/IGraphicBufferConsumer.h
index 63254ed..57cce16 100644
--- a/include/gui/IGraphicBufferConsumer.h
+++ b/include/gui/IGraphicBufferConsumer.h
@@ -243,6 +243,12 @@
     // Return of a value other than NO_ERROR means an unknown error has occurred.
     virtual status_t setConsumerUsageBits(uint32_t usage) = 0;
 
+    // setConsumerIsProtected will turn on an internal bit that indicates whether
+    // the consumer can handle protected gralloc buffers (i.e. with
+    // GRALLOC_USAGE_PROTECTED set). IGraphicBufferProducer can query this
+    // capability using NATIVE_WINDOW_CONSUMER_IS_PROTECTED.
+    virtual status_t setConsumerIsProtected(bool isProtected) = 0;
+
     // setTransformHint bakes in rotation to buffers so overlays can be used. The values are
     // enumerated in window.h, e.g. NATIVE_WINDOW_TRANSFORM_ROT_90. The default is 0
     // (no transform).
diff --git a/libs/gui/BufferQueueConsumer.cpp b/libs/gui/BufferQueueConsumer.cpp
index cd8e696..5e5de44 100644
--- a/libs/gui/BufferQueueConsumer.cpp
+++ b/libs/gui/BufferQueueConsumer.cpp
@@ -709,6 +709,14 @@
     return NO_ERROR;
 }
 
+status_t BufferQueueConsumer::setConsumerIsProtected(bool isProtected) {
+    ATRACE_CALL();
+    BQ_LOGV("setConsumerIsProtected: %s", isProtected ? "true" : "false");
+    Mutex::Autolock lock(mCore->mMutex);
+    mCore->mConsumerIsProtected = isProtected;
+    return NO_ERROR;
+}
+
 status_t BufferQueueConsumer::setTransformHint(uint32_t hint) {
     ATRACE_CALL();
     BQ_LOGV("setTransformHint: %#x", hint);
diff --git a/libs/gui/BufferQueueCore.cpp b/libs/gui/BufferQueueCore.cpp
index cd94253..cfb25e0 100644
--- a/libs/gui/BufferQueueCore.cpp
+++ b/libs/gui/BufferQueueCore.cpp
@@ -59,6 +59,7 @@
     mConsumerName(getUniqueName()),
     mConsumerListener(),
     mConsumerUsageBits(0),
+    mConsumerIsProtected(false),
     mConnectedApi(NO_CONNECTED_API),
     mLinkedToDeath(),
     mConnectedProducerListener(),
diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index cddb1fd..8159aef 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -1105,6 +1105,9 @@
                 value = static_cast<int32_t>(mCore->mBufferAge);
             }
             break;
+        case NATIVE_WINDOW_CONSUMER_IS_PROTECTED:
+            value = static_cast<int32_t>(mCore->mConsumerIsProtected);
+            break;
         default:
             return BAD_VALUE;
     }
diff --git a/libs/gui/IGraphicBufferConsumer.cpp b/libs/gui/IGraphicBufferConsumer.cpp
index 568c318..a573bee 100644
--- a/libs/gui/IGraphicBufferConsumer.cpp
+++ b/libs/gui/IGraphicBufferConsumer.cpp
@@ -46,6 +46,7 @@
     SET_DEFAULT_BUFFER_FORMAT,
     SET_DEFAULT_BUFFER_DATA_SPACE,
     SET_CONSUMER_USAGE_BITS,
+    SET_CONSUMER_IS_PROTECTED,
     SET_TRANSFORM_HINT,
     GET_SIDEBAND_STREAM,
     GET_OCCUPANCY_HISTORY,
@@ -136,6 +137,11 @@
         return callRemote<Signature>(Tag::SET_CONSUMER_USAGE_BITS, usage);
     }
 
+    status_t setConsumerIsProtected(bool isProtected) override {
+        using Signature = decltype(&IGraphicBufferConsumer::setConsumerIsProtected);
+        return callRemote<Signature>(Tag::SET_CONSUMER_IS_PROTECTED, isProtected);
+    }
+
     status_t setTransformHint(uint32_t hint) override {
         using Signature = decltype(&IGraphicBufferConsumer::setTransformHint);
         return callRemote<Signature>(Tag::SET_TRANSFORM_HINT, hint);
@@ -204,6 +210,8 @@
             return callLocal(data, reply, &IGraphicBufferConsumer::setDefaultBufferDataSpace);
         case Tag::SET_CONSUMER_USAGE_BITS:
             return callLocal(data, reply, &IGraphicBufferConsumer::setConsumerUsageBits);
+        case Tag::SET_CONSUMER_IS_PROTECTED:
+            return callLocal(data, reply, &IGraphicBufferConsumer::setConsumerIsProtected);
         case Tag::SET_TRANSFORM_HINT:
             return callLocal(data, reply, &IGraphicBufferConsumer::setTransformHint);
         case Tag::GET_SIDEBAND_STREAM:
diff --git a/libs/nativewindow/include/system/window.h b/libs/nativewindow/include/system/window.h
index fb67a51..45110c4 100644
--- a/libs/nativewindow/include/system/window.h
+++ b/libs/nativewindow/include/system/window.h
@@ -192,6 +192,12 @@
      * present info, 0 if it won't.
      */
     NATIVE_WINDOW_FRAME_TIMESTAMPS_SUPPORTS_PRESENT = 18,
+
+    /*
+     * The consumer end is capable of handling protected buffers, i.e. buffer
+     * with GRALLOC_USAGE_PROTECTED usage bits on.
+     */
+    NATIVE_WINDOW_CONSUMER_IS_PROTECTED = 19,
 };
 
 /* Valid operations for the (*perform)() hook.