diff --git a/audio/effect/2.0/vts/functional/vts/testcases/hal/audio/effect/hidl/target_profiling/Android.mk b/audio/effect/2.0/vts/functional/vts/testcases/hal/audio/effect/hidl/target_profiling/Android.mk
new file mode 100644
index 0000000..430600d
--- /dev/null
+++ b/audio/effect/2.0/vts/functional/vts/testcases/hal/audio/effect/hidl/target_profiling/Android.mk
@@ -0,0 +1,23 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := HalAudioEffectHidlTargetBasicProfilingTest
+VTS_CONFIG_SRC_DIR := testcases/hal/audio/effect/hidl/target_profiling
+include test/vts/tools/build/Android.host_config.mk
diff --git a/audio/effect/2.0/vts/functional/vts/testcases/hal/audio/effect/hidl/target_profiling/AndroidTest.xml b/audio/effect/2.0/vts/functional/vts/testcases/hal/audio/effect/hidl/target_profiling/AndroidTest.xml
new file mode 100644
index 0000000..7febf26
--- /dev/null
+++ b/audio/effect/2.0/vts/functional/vts/testcases/hal/audio/effect/hidl/target_profiling/AndroidTest.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2016 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS Audio Effect HIDL HAL's basic target-side, profiling test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer" />
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="HalAudioEffectHidlTargetBasicProfilingTest" />
+        <option name="binary-test-sources" value="
+            _32bit::DATA/nativetest/audio_effect_hidl_hal_test/audio_effect_hidl_hal_test,
+            _64bit::DATA/nativetest64/audio_effect_hidl_hal_test/audio_effect_hidl_hal_test,
+            "/>
+        <option name="binary-test-type" value="gtest" />
+        <option name="test-timeout" value="1m" />
+        <option name="enable-profiling" value="true" />
+    </test>
+</configuration>
diff --git a/bluetooth/1.0/IBluetoothHci.hal b/bluetooth/1.0/IBluetoothHci.hal
index 10cf914..8722616 100644
--- a/bluetooth/1.0/IBluetoothHci.hal
+++ b/bluetooth/1.0/IBluetoothHci.hal
@@ -35,12 +35,18 @@
      * required to communicate with the Bluetooth hardware in the
      * device.
      *
+     * The |oninitializationComplete| callback must be invoked in response
+     * to this function to indicate success before any other function
+     * (sendHciCommand, sendAclData, * sendScoData) is invoked on this
+     * interface.
+     *
      * @param callback implements IBluetoothHciCallbacks which will
      *    receive callbacks when incoming HCI packets are received
      *    from the controller to be sent to the host.
-     * @return status result of the initialization
      */
-    initialize(IBluetoothHciCallbacks callback) generates (Status status);
+    @entry
+    @callflow(next={"sendHciCommand", "sendAclData", "sendScoData", "close"})
+    initialize(IBluetoothHciCallbacks callback);
 
     /**
      * Send an HCI command (as specified in the Bluetooth Specification
@@ -49,6 +55,7 @@
      *
      * @param command is the HCI command to be sent
      */
+    @callflow(next={"sendHciCommand", "sendAclData", "sendScoData", "close"})
     sendHciCommand(HciPacket command);
 
     /**
@@ -57,6 +64,7 @@
      * Packets must be processed in order.
      * @param data HCI data packet to be sent
      */
+    @callflow(next={"sendHciCommand", "sendAclData", "sendScoData", "close"})
     sendAclData(HciPacket data);
 
     /**
@@ -65,10 +73,12 @@
      * Packets must be processed in order.
      * @param data HCI data packet to be sent
      */
+    @callflow(next={"sendHciCommand", "sendAclData", "sendScoData", "close"})
     sendScoData(HciPacket data);
 
     /**
      * Close the HCI interface
      */
+    @exit
     close();
 };
diff --git a/bluetooth/1.0/IBluetoothHciCallbacks.hal b/bluetooth/1.0/IBluetoothHciCallbacks.hal
index afaab6c..15db1ce 100644
--- a/bluetooth/1.0/IBluetoothHciCallbacks.hal
+++ b/bluetooth/1.0/IBluetoothHciCallbacks.hal
@@ -19,21 +19,27 @@
 /* The interface from the Bluetooth Controller to the stack. */
 interface IBluetoothHciCallbacks {
     /**
+     * Invoked when the Bluetooth controller initialization has been
+     * completed.
+     */
+    initializationComplete(Status status);
+
+    /**
      * This function is invoked when an HCI event is received from the
      * Bluetooth controller to be forwarded to the Bluetooth stack.
      * @param event is the HCI event to be sent to the Bluetooth stack.
      */
-    oneway hciEventReceived(HciPacket event);
+    hciEventReceived(HciPacket event);
 
     /**
      * Send an ACL data packet form the controller to the host.
      * @param data the ACL HCI packet to be passed to the host stack
      */
-    oneway aclDataReceived(HciPacket data);
+    aclDataReceived(HciPacket data);
 
     /**
      * Send a SCO data packet form the controller to the host.
      * @param data the SCO HCI packet to be passed to the host stack
      */
-    oneway scoDataReceived(HciPacket data);
+    scoDataReceived(HciPacket data);
 };
diff --git a/bluetooth/1.0/default/bluetooth_hci.cc b/bluetooth/1.0/default/bluetooth_hci.cc
index d12bfb9..1559119 100644
--- a/bluetooth/1.0/default/bluetooth_hci.cc
+++ b/bluetooth/1.0/default/bluetooth_hci.cc
@@ -30,12 +30,16 @@
 static const uint8_t HCI_DATA_TYPE_ACL = 2;
 static const uint8_t HCI_DATA_TYPE_SCO = 3;
 
-Return<Status> BluetoothHci::initialize(
+Return<void> BluetoothHci::initialize(
     const ::android::sp<IBluetoothHciCallbacks>& cb) {
   ALOGW("BluetoothHci::initialize()");
   event_cb_ = cb;
 
   bool rc = VendorInterface::Initialize(
+      [this](bool status) {
+        event_cb_->initializationComplete(
+            status ? Status::SUCCESS : Status::INITIALIZATION_ERROR);
+      },
       [this](HciPacketType type, const hidl_vec<uint8_t>& packet) {
         switch (type) {
           case HCI_PACKET_TYPE_EVENT:
@@ -52,9 +56,8 @@
             break;
         }
       });
-  if (!rc) return Status::INITIALIZATION_ERROR;
-
-  return Status::SUCCESS;
+  if (!rc) event_cb_->initializationComplete(Status::INITIALIZATION_ERROR);
+  return Void();
 }
 
 Return<void> BluetoothHci::close() {
diff --git a/bluetooth/1.0/default/bluetooth_hci.h b/bluetooth/1.0/default/bluetooth_hci.h
index d297570..da1b411 100644
--- a/bluetooth/1.0/default/bluetooth_hci.h
+++ b/bluetooth/1.0/default/bluetooth_hci.h
@@ -32,7 +32,7 @@
 
 class BluetoothHci : public IBluetoothHci {
  public:
-  Return<Status> initialize(
+  Return<void> initialize(
       const ::android::sp<IBluetoothHciCallbacks>& cb) override;
   Return<void> sendHciCommand(const hidl_vec<uint8_t>& packet) override;
   Return<void> sendAclData(const hidl_vec<uint8_t>& data) override;
diff --git a/bluetooth/1.0/default/service.cpp b/bluetooth/1.0/default/service.cpp
index a3c3cad..fa5106f 100644
--- a/bluetooth/1.0/default/service.cpp
+++ b/bluetooth/1.0/default/service.cpp
@@ -25,5 +25,5 @@
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main() {
-  return defaultPassthroughServiceImplementation<IBluetoothHci>("bluetooth");
+  return defaultPassthroughServiceImplementation<IBluetoothHci>();
 }
diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
index 905e1a6..20b30ae 100644
--- a/bluetooth/1.0/default/vendor_interface.cc
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -35,6 +35,7 @@
 namespace {
 
 using android::hardware::bluetooth::V1_0::implementation::VendorInterface;
+using android::hardware::hidl_vec;
 
 tINT_CMD_CBACK internal_command_cb;
 VendorInterface* g_vendor_interface = nullptr;
@@ -46,17 +47,14 @@
     0, HCI_LENGTH_OFFSET_CMD, HCI_LENGTH_OFFSET_ACL, HCI_LENGTH_OFFSET_SCO,
     HCI_LENGTH_OFFSET_EVT};
 
-size_t HciGetPacketLengthForType(
-    HciPacketType type, const android::hardware::hidl_vec<uint8_t>& packet) {
+size_t HciGetPacketLengthForType(HciPacketType type,
+                                 const hidl_vec<uint8_t>& packet) {
   size_t offset = packet_length_offset_for_type[type];
-  if (type == HCI_PACKET_TYPE_ACL_DATA) {
-    return (((packet[offset + 1]) << 8) | packet[offset]);
-  }
-  return packet[offset];
+  if (type != HCI_PACKET_TYPE_ACL_DATA) return packet[offset];
+  return (((packet[offset + 1]) << 8) | packet[offset]);
 }
 
-HC_BT_HDR* WrapPacketAndCopy(uint16_t event,
-                             const android::hardware::hidl_vec<uint8_t>& data) {
+HC_BT_HDR* WrapPacketAndCopy(uint16_t event, const hidl_vec<uint8_t>& data) {
   size_t packet_size = data.size() + sizeof(HC_BT_HDR);
   HC_BT_HDR* packet = reinterpret_cast<HC_BT_HDR*>(new uint8_t[packet_size]);
   packet->offset = 0;
@@ -71,17 +69,16 @@
 
 uint8_t transmit_cb(uint16_t opcode, void* buffer, tINT_CMD_CBACK callback) {
   ALOGV("%s opcode: 0x%04x, ptr: %p", __func__, opcode, buffer);
-  HC_BT_HDR* bt_hdr = reinterpret_cast<HC_BT_HDR*>(buffer);
-
   internal_command_cb = callback;
   uint8_t type = HCI_PACKET_TYPE_COMMAND;
-  VendorInterface::get()->SendPrivate(&type, 1);
-  VendorInterface::get()->SendPrivate(bt_hdr->data, bt_hdr->len);
+  VendorInterface::get()->Send(&type, 1);
+  HC_BT_HDR* bt_hdr = reinterpret_cast<HC_BT_HDR*>(buffer);
+  VendorInterface::get()->Send(bt_hdr->data, bt_hdr->len);
   return true;
 }
 
 void firmware_config_cb(bt_vendor_op_result_t result) {
-  ALOGD("%s result: %d", __func__, result);
+  ALOGV("%s result: %d", __func__, result);
   VendorInterface::get()->OnFirmwareConfigured(result);
 }
 
@@ -131,10 +128,28 @@
 namespace V1_0 {
 namespace implementation {
 
-bool VendorInterface::Initialize(PacketReadCallback packet_read_cb) {
+class FirmwareStartupTimer {
+ public:
+  FirmwareStartupTimer() : start_time_(std::chrono::steady_clock::now()) {}
+
+  ~FirmwareStartupTimer() {
+    std::chrono::duration<double> duration =
+        std::chrono::steady_clock::now() - start_time_;
+    double s = duration.count();
+    if (s == 0) return;
+    ALOGD("Firmware configured in %.3fs", s);
+  }
+
+ private:
+  std::chrono::steady_clock::time_point start_time_;
+};
+
+bool VendorInterface::Initialize(
+    InitializeCompleteCallback initialize_complete_cb,
+    PacketReadCallback packet_read_cb) {
   assert(!g_vendor_interface);
   g_vendor_interface = new VendorInterface();
-  return g_vendor_interface->Open(packet_read_cb);
+  return g_vendor_interface->Open(initialize_complete_cb, packet_read_cb);
 }
 
 void VendorInterface::Shutdown() {
@@ -146,8 +161,9 @@
 
 VendorInterface* VendorInterface::get() { return g_vendor_interface; }
 
-bool VendorInterface::Open(PacketReadCallback packet_read_cb) {
-  firmware_configured_ = false;
+bool VendorInterface::Open(InitializeCompleteCallback initialize_complete_cb,
+                           PacketReadCallback packet_read_cb) {
+  initialize_complete_cb_ = initialize_complete_cb;
   packet_read_cb_ = packet_read_cb;
 
   // Initialize vendor interface
@@ -209,6 +225,7 @@
                                          [this](int fd) { OnDataReady(fd); });
 
   // Start configuring the firmware
+  firmware_startup_timer_ = new FirmwareStartupTimer();
   lib_interface_->op(BT_VND_OP_FW_CFG, nullptr);
 
   return true;
@@ -229,31 +246,13 @@
     lib_handle_ = nullptr;
   }
 
-  firmware_configured_ = false;
+  if (firmware_startup_timer_ != nullptr) {
+    delete firmware_startup_timer_;
+    firmware_startup_timer_ = nullptr;
+  }
 }
 
 size_t VendorInterface::Send(const uint8_t* data, size_t length) {
-  if (firmware_configured_ && queued_data_.size() == 0)
-    return SendPrivate(data, length);
-
-  if (!firmware_configured_) {
-    ALOGI("%s queueing command", __func__);
-    queued_data_.resize(queued_data_.size() + length);
-    uint8_t* append_ptr = &queued_data_[queued_data_.size() - length];
-    memcpy(append_ptr, data, length);
-    return length;
-  }
-
-  ALOGI("%s sending queued command", __func__);
-  SendPrivate(queued_data_.data(), queued_data_.size());
-  queued_data_.resize(0);
-
-  ALOGI("%s done sending queued command", __func__);
-
-  return SendPrivate(data, length);
-}
-
-size_t VendorInterface::SendPrivate(const uint8_t* data, size_t length) {
   if (uart_fd_ == INVALID_FD) return 0;
 
   size_t transmitted_length = 0;
@@ -280,9 +279,18 @@
 }
 
 void VendorInterface::OnFirmwareConfigured(uint8_t result) {
-  ALOGI("%s: result = %d", __func__, result);
-  firmware_configured_ = true;
-  VendorInterface::get()->Send(NULL, 0);
+  ALOGD("%s result: %d", __func__, result);
+  internal_command_cb = nullptr;
+
+  if (firmware_startup_timer_ != nullptr) {
+    delete firmware_startup_timer_;
+    firmware_startup_timer_ = nullptr;
+  }
+
+  if (initialize_complete_cb_ != nullptr) {
+    initialize_complete_cb_(result == 0);
+    initialize_complete_cb_ = nullptr;
+  }
 }
 
 void VendorInterface::OnDataReady(int fd) {
@@ -331,16 +339,17 @@
       hci_packet_bytes_remaining_ -= bytes_read;
       hci_packet_bytes_read_ += bytes_read;
       if (hci_packet_bytes_remaining_ == 0) {
-        if (firmware_configured_) {
-          if (packet_read_cb_ != nullptr) {
-            packet_read_cb_(hci_packet_type_, hci_packet_);
-          }
+        if (internal_command_cb != nullptr) {
+          HC_BT_HDR* bt_hdr =
+              WrapPacketAndCopy(HCI_PACKET_TYPE_EVENT, hci_packet_);
+          internal_command_cb(bt_hdr);
+        } else if (packet_read_cb_ != nullptr &&
+                   initialize_complete_cb_ == nullptr) {
+          packet_read_cb_(hci_packet_type_, hci_packet_);
         } else {
-          if (internal_command_cb != nullptr) {
-            HC_BT_HDR* bt_hdr =
-                WrapPacketAndCopy(HCI_PACKET_TYPE_EVENT, hci_packet_);
-            internal_command_cb(bt_hdr);
-          }
+          ALOGE(
+              "%s HCI_PAYLOAD received without packet_read_cb or pending init.",
+              __func__);
         }
         hci_parser_state_ = HCI_IDLE;
       }
diff --git a/bluetooth/1.0/default/vendor_interface.h b/bluetooth/1.0/default/vendor_interface.h
index 73ff2eb..450b99c 100644
--- a/bluetooth/1.0/default/vendor_interface.h
+++ b/bluetooth/1.0/default/vendor_interface.h
@@ -29,55 +29,50 @@
 namespace implementation {
 
 using ::android::hardware::hidl_vec;
+using InitializeCompleteCallback = std::function<void(bool success)>;
 using PacketReadCallback =
     std::function<void(HciPacketType, const hidl_vec<uint8_t> &)>;
 
+class FirmwareStartupTimer;
+
 class VendorInterface {
  public:
-  static bool Initialize(PacketReadCallback packet_read_cb);
+  static bool Initialize(InitializeCompleteCallback initialize_complete_cb,
+                         PacketReadCallback packet_read_cb);
   static void Shutdown();
-  static VendorInterface* get();
+  static VendorInterface *get();
 
   size_t Send(const uint8_t *data, size_t length);
 
   void OnFirmwareConfigured(uint8_t result);
 
-  // Actually send the data.
-  size_t SendPrivate(const uint8_t *data, size_t length);
-
  private:
-  VendorInterface() { queued_data_.resize(0); }
   virtual ~VendorInterface() = default;
 
-  bool Open(PacketReadCallback packet_read_cb);
+  bool Open(InitializeCompleteCallback initialize_complete_cb, PacketReadCallback packet_read_cb);
   void Close();
 
   void OnDataReady(int fd);
 
-  // Queue data from Send() until the interface is ready.
-  hidl_vec<uint8_t> queued_data_;
-
   void *lib_handle_;
   bt_vendor_interface_t *lib_interface_;
   AsyncFdWatcher fd_watcher_;
   int uart_fd_;
   PacketReadCallback packet_read_cb_;
-  bool firmware_configured_;
+  InitializeCompleteCallback initialize_complete_cb_;
 
-  enum HciParserState {
-    HCI_IDLE,
-    HCI_TYPE_READY,
-    HCI_PAYLOAD
-  };
+  enum HciParserState { HCI_IDLE, HCI_TYPE_READY, HCI_PAYLOAD };
   HciParserState hci_parser_state_{HCI_IDLE};
   HciPacketType hci_packet_type_{HCI_PACKET_TYPE_UNKNOWN};
   hidl_vec<uint8_t> hci_packet_;
   size_t hci_packet_bytes_remaining_;
   size_t hci_packet_bytes_read_;
+
+  FirmwareStartupTimer *firmware_startup_timer_;
 };
 
-} // namespace implementation
-} // namespace V1_0
-} // namespace bluetooth
-} // namespace hardware
-} // namespace android
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
diff --git a/bluetooth/1.0/vts/functional/bluetooth_hidl_hal_test.cpp b/bluetooth/1.0/vts/functional/bluetooth_hidl_hal_test.cpp
index 2a4bbdd..683029e 100644
--- a/bluetooth/1.0/vts/functional/bluetooth_hidl_hal_test.cpp
+++ b/bluetooth/1.0/vts/functional/bluetooth_hidl_hal_test.cpp
@@ -36,13 +36,12 @@
 using ::android::hardware::Void;
 using ::android::sp;
 
-#define Bluetooth_HCI_SERVICE_NAME "bluetooth"
-
 #define HCI_MINIMUM_HCI_VERSION 5  // Bluetooth Core Specification 3.0 + HS
 #define HCI_MINIMUM_LMP_VERSION 5  // Bluetooth Core Specification 3.0 + HS
 #define NUM_HCI_COMMANDS_BANDWIDTH 1000
 #define NUM_SCO_PACKETS_BANDWIDTH 1000
 #define NUM_ACL_PACKETS_BANDWIDTH 1000
+#define WAIT_FOR_INIT_TIMEOUT std::chrono::milliseconds(2000)
 #define WAIT_FOR_HCI_EVENT_TIMEOUT std::chrono::milliseconds(2000)
 #define WAIT_FOR_SCO_DATA_TIMEOUT std::chrono::milliseconds(1000)
 #define WAIT_FOR_ACL_DATA_TIMEOUT std::chrono::milliseconds(1000)
@@ -122,8 +121,8 @@
  public:
   virtual void SetUp() override {
     // currently test passthrough mode only
-    bluetooth = IBluetoothHci::getService(Bluetooth_HCI_SERVICE_NAME);
-    ALOGW("%s: getService(%s) is %s", __func__, Bluetooth_HCI_SERVICE_NAME,
+    bluetooth = IBluetoothHci::getService();
+    ALOGW("%s: getService() for bluetooth is %s", __func__,
           bluetooth->isRemote() ? "remote" : "local");
     ASSERT_NE(bluetooth, nullptr);
 
@@ -135,6 +134,8 @@
     max_acl_data_packets = 0;
     max_sco_data_packets = 0;
 
+    initialized = false;
+    initialized_count = 0;
     event_count = 0;
     acl_count = 0;
     sco_count = 0;
@@ -142,9 +143,12 @@
     acl_cb_count = 0;
     sco_cb_count = 0;
 
-    // Collision with android::hardware::Status
-    EXPECT_EQ(android::hardware::bluetooth::V1_0::Status::SUCCESS,
-              bluetooth->initialize(bluetooth_cb));
+    ASSERT_EQ(initialized, false);
+    bluetooth->initialize(bluetooth_cb);
+
+    wait_for_init_callback();
+
+    ASSERT_EQ(initialized, true);
   }
 
   virtual void TearDown() override {
@@ -167,6 +171,26 @@
   void wait_for_command_complete_event(hidl_vec<uint8_t> cmd);
   int wait_for_completed_packets_event(uint16_t handle);
 
+  // Inform the test about the initialization callback
+  inline void notify_initialized() {
+    std::unique_lock<std::mutex> lock(initialized_mutex);
+    initialized_count++;
+    initialized_condition.notify_one();
+  }
+
+  // Test code calls this function to wait for the init callback
+  inline void wait_for_init_callback() {
+    std::unique_lock<std::mutex> lock(initialized_mutex);
+
+    auto start_time = std::chrono::steady_clock::now();
+    while (initialized_count == 0)
+      if (initialized_condition.wait_until(lock,
+                                     start_time + WAIT_FOR_INIT_TIMEOUT) ==
+          std::cv_status::timeout)
+        return;
+    initialized_count--;
+  }
+
   // Inform the test about an event callback
   inline void notify_event_received() {
     std::unique_lock<std::mutex> lock(event_mutex);
@@ -230,6 +254,13 @@
 
     virtual ~BluetoothHciCallbacks() = default;
 
+    Return<void> initializationComplete(Status status) override {
+      parent_.initialized = true;
+      parent_.notify_initialized();
+      ALOGV("%s (status = %d)", __func__, static_cast<int>(status));
+      return Void();
+    };
+
     Return<void> hciEventReceived(
         const ::android::hardware::hidl_vec<uint8_t>& event) override {
       parent_.event_cb_count++;
@@ -262,6 +293,8 @@
   std::queue<hidl_vec<uint8_t>> acl_queue;
   std::queue<hidl_vec<uint8_t>> sco_queue;
 
+  bool initialized;
+
   int event_cb_count;
   int sco_cb_count;
   int acl_cb_count;
@@ -272,12 +305,15 @@
   int max_sco_data_packets;
 
  private:
+  std::mutex initialized_mutex;
   std::mutex event_mutex;
   std::mutex sco_mutex;
   std::mutex acl_mutex;
+  std::condition_variable initialized_condition;
   std::condition_variable event_condition;
   std::condition_variable sco_condition;
   std::condition_variable acl_condition;
+  int initialized_count;
   int event_count;
   int sco_count;
   int acl_count;
diff --git a/camera/device/3.2/default/CameraDeviceSession.cpp b/camera/device/3.2/default/CameraDeviceSession.cpp
index 201a3b4..26b7b73 100644
--- a/camera/device/3.2/default/CameraDeviceSession.cpp
+++ b/camera/device/3.2/default/CameraDeviceSession.cpp
@@ -94,15 +94,7 @@
         if (handle == nullptr || handle->numFds == 0) {
             fd = -1;
         } else if (handle->numFds == 1) {
-//TODO(b/34110242): make this hidl transport agnostic
-#ifdef BINDERIZED
             fd = dup(handle->data[0]);
-            // TODO(b/34169301)
-            // Camera service expect FD be closed by HAL process (in passthrough mode)
-            // close(handle->data[0]);
-#else
-            fd = handle->data[0];
-#endif
             if (fd < 0) {
                 ALOGE("failed to dup fence fd %d", handle->data[0]);
                 return false;
@@ -118,13 +110,9 @@
 
     void closeFence(int fd)
     {
-#ifdef BINDERIZED
         if (fd >= 0) {
             close(fd);
         }
-#else
-        (void) fd;
-#endif
     }
 
 private:
@@ -307,31 +295,40 @@
         hidl_vec<buffer_handle_t*>& allBufPtrs,
         hidl_vec<int>& allFences) {
     bool hasInputBuf = (request.inputBuffer.streamId != -1 &&
-            request.inputBuffer.buffer.getNativeHandle() != nullptr);
+            request.inputBuffer.bufferId != 0);
     size_t numOutputBufs = request.outputBuffers.size();
     size_t numBufs = numOutputBufs + (hasInputBuf ? 1 : 0);
     // Validate all I/O buffers
     hidl_vec<buffer_handle_t> allBufs;
+    hidl_vec<uint64_t> allBufIds;
     allBufs.resize(numBufs);
+    allBufIds.resize(numBufs);
     allBufPtrs.resize(numBufs);
     allFences.resize(numBufs);
     std::vector<int32_t> streamIds(numBufs);
 
     for (size_t i = 0; i < numOutputBufs; i++) {
         allBufs[i] = request.outputBuffers[i].buffer.getNativeHandle();
+        allBufIds[i] = request.outputBuffers[i].bufferId;
         allBufPtrs[i] = &allBufs[i];
         streamIds[i] = request.outputBuffers[i].streamId;
     }
     if (hasInputBuf) {
         allBufs[numOutputBufs] = request.inputBuffer.buffer.getNativeHandle();
+        allBufIds[numOutputBufs] = request.inputBuffer.bufferId;
         allBufPtrs[numOutputBufs] = &allBufs[numOutputBufs];
         streamIds[numOutputBufs] = request.inputBuffer.streamId;
     }
 
     for (size_t i = 0; i < numBufs; i++) {
         buffer_handle_t buf = allBufs[i];
+        uint64_t bufId = allBufIds[i];
         CirculatingBuffers& cbs = mCirculatingBuffers[streamIds[i]];
-        if (cbs.count(buf) == 0) {
+        if (cbs.count(bufId) == 0) {
+            if (buf == nullptr) {
+                ALOGE("%s: bufferId %" PRIu64 " has null buffer handle!", __FUNCTION__, bufId);
+                return Status::ILLEGAL_ARGUMENT;
+            }
             // Register a newly seen buffer
             buffer_handle_t importedBuf = buf;
             sHandleImporter.importBuffer(importedBuf);
@@ -339,10 +336,10 @@
                 ALOGE("%s: output buffer %zu is invalid!", __FUNCTION__, i);
                 return Status::INTERNAL_ERROR;
             } else {
-                cbs[buf] = importedBuf;
+                cbs[bufId] = importedBuf;
             }
         }
-        allBufPtrs[i] = &cbs[buf];
+        allBufPtrs[i] = &cbs[bufId];
     }
 
     // All buffers are imported. Now validate output buffer acquire fences
@@ -509,7 +506,7 @@
     hidl_vec<buffer_handle_t*> allBufPtrs;
     hidl_vec<int> allFences;
     bool hasInputBuf = (request.inputBuffer.streamId != -1 &&
-            request.inputBuffer.buffer.getNativeHandle() != nullptr);
+            request.inputBuffer.bufferId != 0);
     size_t numOutputBufs = request.outputBuffers.size();
     size_t numBufs = numOutputBufs + (hasInputBuf ? 1 : 0);
     status = importRequest(request, allBufPtrs, allFences);
diff --git a/camera/device/3.2/default/CameraDeviceSession.h b/camera/device/3.2/default/CameraDeviceSession.h
index 498617e..ca9d24d 100644
--- a/camera/device/3.2/default/CameraDeviceSession.h
+++ b/camera/device/3.2/default/CameraDeviceSession.h
@@ -100,44 +100,12 @@
     // (streamID, frameNumber) -> inflight buffer cache
     std::map<std::pair<int, uint32_t>, camera3_stream_buffer_t>  mInflightBuffers;
 
-    struct BufferHasher {
-        size_t operator()(const buffer_handle_t& buf) const {
-            if (buf == nullptr)
-                return 0;
-
-            size_t result = 1;
-            result = 31 * result + buf->numFds;
-            result = 31 * result + buf->numInts;
-            int length = buf->numFds + buf->numInts;
-            for (int i = 0; i < length; i++) {
-                result = 31 * result + buf->data[i];
-            }
-            return result;
-        }
-    };
-
-    struct BufferComparator {
-        bool operator()(const buffer_handle_t& buf1, const buffer_handle_t& buf2) const {
-            if (buf1->numFds == buf2->numFds && buf1->numInts == buf2->numInts) {
-                int length = buf1->numFds + buf1->numInts;
-                for (int i = 0; i < length; i++) {
-                    if (buf1->data[i] != buf2->data[i]) {
-                        return false;
-                    }
-                }
-                return true;
-            }
-            return false;
-        }
-    };
-
     // buffers currently ciculating between HAL and camera service
-    // key: buffer_handle_t sent via HIDL interface
+    // key: bufferId sent via HIDL interface
     // value: imported buffer_handle_t
     // Buffer will be imported during process_capture_request and will be freed
     // when the its stream is deleted or camera device session is closed
-    typedef std::unordered_map<buffer_handle_t, buffer_handle_t,
-            BufferHasher, BufferComparator> CirculatingBuffers;
+    typedef std::unordered_map<uint64_t, buffer_handle_t> CirculatingBuffers;
     // Stream ID -> circulating buffers map
     std::map<int, CirculatingBuffers> mCirculatingBuffers;
 
diff --git a/camera/device/3.2/types.hal b/camera/device/3.2/types.hal
index 1e0924c..c07a670 100644
--- a/camera/device/3.2/types.hal
+++ b/camera/device/3.2/types.hal
@@ -405,16 +405,33 @@
     /**
      * The ID of the stream this buffer is associated with. -1 indicates an
      * invalid (empty) StreamBuffer, in which case buffer must also point to
-     * null.
+     * null and bufferId must be 0.
      */
     int32_t streamId;
 
     /**
+     * The unique ID of the buffer within this StreamBuffer. 0 indicates this
+     * StreamBuffer contains no buffer.
+     * For StreamBuffers sent to the HAL in a CaptureRequest, this ID uniquely
+     * identifies a buffer. When a buffer is sent to HAL for the first time,
+     * both bufferId and buffer handle must be filled. HAL must keep track of
+     * the mapping between bufferId and corresponding buffer until the
+     * corresponding stream is removed from stream configuration or until camera
+     * device session is closed. After the first time a buffer is introduced to
+     * HAL, in the future camera service must refer to the same buffer using
+     * only bufferId, and keep the buffer handle null.
+     */
+    uint64_t bufferId;
+
+    /**
      * The graphics buffer handle to the buffer.
      *
-     * For StreamBuffers sent to the HAL in a CaptureRequest, this must be a
+     * For StreamBuffers sent to the HAL in a CaptureRequest, if the bufferId
+     * is not seen by the HAL before, this buffer handle is guaranteed to be a
      * valid handle to a graphics buffer, with dimensions and format matching
-     * that of the stream.
+     * that of the stream. If the bufferId has been sent to the HAL before, this
+     * buffer handle must be null and HAL must look up the actual buffer handle
+     * to use from its own bufferId to buffer handle map.
      *
      * For StreamBuffers returned in a CaptureResult, this must be null, since
      * the handle to the buffer is already known to the client (since the client
diff --git a/contexthub/1.0/IContexthub.hal b/contexthub/1.0/IContexthub.hal
index 42f2e2d..c0928d5 100644
--- a/contexthub/1.0/IContexthub.hal
+++ b/contexthub/1.0/IContexthub.hal
@@ -77,7 +77,8 @@
      * device.
      *
      * @param hubId identifer of the contextHub
-     *        appBinary serialized NanoApppBinary for the nanoApp
+     *        appBinary contains the binary representation of the nanoApp, plus
+     *                  metadata
      *        transactionId transactionId for this call
      *
      * @return result OK if transation started
@@ -88,7 +89,7 @@
      *
      */
     loadNanoApp(uint32_t hubId,
-                vec<uint8_t> appBinary,
+                NanoAppBinary appBinary,
                 uint32_t transactionId)
             generates (Result result);
 
diff --git a/contexthub/1.0/default/Contexthub.cpp b/contexthub/1.0/default/Contexthub.cpp
index 5f78004..4a6b3f2 100644
--- a/contexthub/1.0/default/Contexthub.cpp
+++ b/contexthub/1.0/default/Contexthub.cpp
@@ -22,6 +22,7 @@
 
 #include <android/hardware/contexthub/1.0/IContexthub.h>
 #include <hardware/context_hub.h>
+#include <sys/endian.h>
 
 #undef LOG_TAG
 #define LOG_TAG "ContextHubHalAdapter"
@@ -385,7 +386,7 @@
 }
 
 Return<Result> Contexthub::loadNanoApp(uint32_t hubId,
-                                       const ::android::hardware::hidl_vec<uint8_t>& appBinary,
+                                       const NanoAppBinary& appBinary,
                                        uint32_t transactionId) {
     if (!isInitialized()) {
       return Result::NOT_INIT;
@@ -401,11 +402,34 @@
         return Result::BAD_PARAMS;
     }
 
-    hubMsg.message_type = CONTEXT_HUB_LOAD_APP;
-    hubMsg.message_len = appBinary.size();
-    hubMsg.message = appBinary.data();
+    // Data from the nanoapp header is passed through HIDL as explicit fields,
+    // but the legacy HAL expects it prepended to the binary, therefore we must
+    // reconstruct it here prior to passing to the legacy HAL.
+    uint32_t targetChreApiVersion =
+        (appBinary.targetChreApiMajorVersion << 24) |
+        (appBinary.targetChreApiMinorVersion << 16);
+    const struct nano_app_binary_t header = {
+        .header_version = htole32(1),
+        .magic          = htole32(NANOAPP_MAGIC),
+        .app_id.id      = htole64(appBinary.appId),
+        .app_version    = htole32(appBinary.appVersion),
+        .flags          = htole32(appBinary.flags),
+        .hw_hub_type    = htole64(0),
+        .reserved[0]    = htole32(targetChreApiVersion),
+        .reserved[1]    = 0,
+    };
+    const uint8_t *headerBytes = reinterpret_cast<const uint8_t *>(&header);
 
-    if(mContextHubModule->send_message(hubId, &hubMsg) != 0) {
+    std::vector<uint8_t> binaryWithHeader(appBinary.customBinary);
+    binaryWithHeader.insert(binaryWithHeader.begin(),
+                            headerBytes,
+                            headerBytes + sizeof(header));
+
+    hubMsg.message_type = CONTEXT_HUB_LOAD_APP;
+    hubMsg.message_len = binaryWithHeader.size();
+    hubMsg.message = binaryWithHeader.data();
+
+    if (mContextHubModule->send_message(hubId, &hubMsg) != 0) {
         return Result::TRANSACTION_FAILED;
     } else {
         mTransactionId = transactionId;
diff --git a/contexthub/1.0/default/Contexthub.h b/contexthub/1.0/default/Contexthub.h
index 0883ce8..236e079 100644
--- a/contexthub/1.0/default/Contexthub.h
+++ b/contexthub/1.0/default/Contexthub.h
@@ -40,7 +40,7 @@
                                     const ContextHubMsg &msg) override;
 
     Return<Result> loadNanoApp(uint32_t hubId,
-                               const ::android::hardware::hidl_vec<uint8_t>& appBinary,
+                               const NanoAppBinary& appBinary,
                                uint32_t transactionId) override;
 
     Return<Result> unloadNanoApp(uint32_t hubId,
diff --git a/contexthub/1.0/types.hal b/contexthub/1.0/types.hal
index 2326b58..4950627 100644
--- a/contexthub/1.0/types.hal
+++ b/contexthub/1.0/types.hal
@@ -26,35 +26,26 @@
 };
 
 enum NanoAppFlags : uint32_t {
-    SIGNED = (1<<0),   // Signed nanoapp
-    ENCRYPTED = (1<<1),// Encrypted nanoapp
-};
-
-enum HostEndPoint : uint16_t {
-    BROADCAST = 0xFFFF, // The message endpoint is a broadcast end point.
-                        // This value must never be used for a message from
-                        // the host to the hub.
-                        // If BROADCAST is specified as a destination for a
-                        // message from the context hub to the ContextHub
-                        // service, the message must be broadcast to all
-                        // registered clients by the Context Hub service.
-    UNSPECIFIED = 0xFFFE, // The message endpoint is unspecified. This value
-                          // must not be used for messages from the hub to host.
-                          // This value may be used for messages from the host
-                          // to the hub.
+    SIGNED    = 1 << 0,
+    ENCRYPTED = 1 << 1,
 };
 
 struct NanoAppBinary {
-    uint32_t headerVersion;    // 0x1 for this version
-    uint32_t magic;            // "NANO"
-    uint64_t appId;            // App ID (contains vendor ID in most significant
-                               // 5 bytes)
-    uint32_t appVersion;       // Version of the app
-    uint32_t flags;            // Mask of NanoAppFlags
-    uint64_t hwHubType;        // Which hub type is this app is compiled for. A
-                               // unique ID for each h/w + toolchain
-                               // combination.
-    vec<uint8_t> customBinary; // start of custom binary data
+    uint64_t appId;            // Nanoapp identifier
+    uint32_t appVersion;       // Version of the app (semantics defined by app)
+    bitfield<NanoAppFlags> flags;
+
+    // The version of the CHRE API that this nanoApp was compiled against. See
+    // the CHRE API header file chre/version.h for more information. The hub
+    // implementation must use this to confirm compatibility before loading
+    // this nanoApp.
+    uint8_t targetChreApiMajorVersion;
+    uint8_t targetChreApiMinorVersion;
+
+    // Implementation-specific binary nanoapp data. This does not include the
+    // common nanoapp header that contains the app ID, etc., as this data is
+    // explicitly passed through the other fields in this struct.
+    vec<uint8_t> customBinary;
 };
 
 enum SensorType : uint32_t {
@@ -130,20 +121,34 @@
                                 // be sent to the hub in one chunk (in bytes)
 
     // Machine-readable CHRE platform ID, returned to nanoapps in the CHRE API
-    // function call chreGetPlatformId(). The most significant 5 bytes of this
-    // value identify the vendor, while the remaining bytes are set by the
-    // vendor to uniquely identify each different CHRE implementation/hardware
-    // that the vendor supplies. This field pairs with the patch version part of
-    // chreVersion to fully specify the CHRE implementation version. See also
-    // the CHRE API header file chre/version.h.
+    // function call chreGetPlatformId(). This field pairs with
+    // chreApiMajorVersion, chreApiMinorVersion, and chrePatchVersion to fully
+    // specify the CHRE implementation version. See also the CHRE API header
+    // file chre/version.h.
     uint64_t chrePlatformId;
 
-    // CHRE implementation version, returned to nanoApps in the CHRE API
-    // function call chreGetVersion(). This value consists of the implemented
-    // CHRE API version (major version in most significant byte, followed by
-    // minor version), and the platform-specific implementation patch version
-    // in the lower two bytes. See also the CHRE API header file chre/version.h.
-    uint32_t chreVersion;
+    // The version of the CHRE implementation returned to nanoApps in the CHRE
+    // API function call chreGetVersion(). The major and minor version specify
+    // the implemented version of the CHRE API, while the patch version
+    // describes the implementation version within the scope of the platform
+    // ID. See also the CHRE API header file chre/version.h.
+    uint8_t chreApiMajorVersion;
+    uint8_t chreApiMinorVersion;
+    uint16_t chrePatchVersion;
+};
+
+enum HostEndPoint : uint16_t {
+    BROADCAST = 0xFFFF, // The message endpoint is a broadcast end point.
+                        // This value must never be used for a message from
+                        // the host to the hub.
+                        // If BROADCAST is specified as a destination for a
+                        // message from the context hub to the ContextHub
+                        // service, the message must be broadcast to all
+                        // registered clients by the Context Hub service.
+    UNSPECIFIED = 0xFFFE, // The message endpoint is unspecified. This value
+                          // must not be used for messages from the hub to host.
+                          // This value may be used for messages from the host
+                          // to the hub.
 };
 
 struct ContextHubMsg {
@@ -160,16 +165,16 @@
 };
 
 enum HubMemoryFlag : uint32_t {
-    READ  = (1<<0), // Readable
-    WRITE = (1<<1), // Writable
-    EXEC  = (1<<2), // Executable
+    READ  = 1 << 0, // Readable
+    WRITE = 1 << 1, // Writable
+    EXEC  = 1 << 2, // Executable
 };
 
 struct MemRange {
     uint32_t totalBytes; // Total capacity in bytes
     uint32_t freeBytes;  // Free capacity in bytes
     HubMemoryType type;  // Type of memory, see HubMemoryType
-    uint32_t flags;      // Mask of HubMemoryFlag
+    bitfield<HubMemoryFlag> flags;
 };
 
 enum AsyncEventType : uint32_t {
diff --git a/nfc/1.0/default/Nfc.cpp b/nfc/1.0/default/Nfc.cpp
index 9d05fc2..3bd5e41 100644
--- a/nfc/1.0/default/Nfc.cpp
+++ b/nfc/1.0/default/Nfc.cpp
@@ -65,7 +65,7 @@
         }
     }
     else
-        ALOGE ("hw_get_module failed: %d", ret);
+        ALOGE ("hw_get_module %s failed: %d", NFC_NCI_HARDWARE_MODULE_ID, ret);
 
     if (ret == 0) {
         return new Nfc(nfc_device);
diff --git a/nfc/1.0/default/service.cpp b/nfc/1.0/default/service.cpp
index 32f9c28..731acd5 100644
--- a/nfc/1.0/default/service.cpp
+++ b/nfc/1.0/default/service.cpp
@@ -9,5 +9,5 @@
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main() {
-    return defaultPassthroughServiceImplementation<INfc>("nfc_nci");
+    return defaultPassthroughServiceImplementation<INfc>();
 }
diff --git a/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp b/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp
index f5ed4d7..521f17f 100644
--- a/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp
+++ b/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp
@@ -37,8 +37,6 @@
 using ::android::hardware::hidl_vec;
 using ::android::sp;
 
-#define NFC_NCI_SERVICE_NAME "nfc_nci"
-
 /* NCI Commands */
 #define CORE_RESET_CMD \
   { 0x20, 0x00, 0x01, 0x00 }
@@ -61,7 +59,7 @@
 class NfcHidlTest : public ::testing::Test {
  public:
   virtual void SetUp() override {
-    nfc_ = INfc::getService(NFC_NCI_SERVICE_NAME, passthrough);
+    nfc_ = INfc::getService(passthrough);
     ASSERT_NE(nfc_, nullptr);
 
     nfc_cb_ = new NfcClientCallback(*this);
diff --git a/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py b/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py
index f2f17f4..cb40931 100644
--- a/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py
+++ b/nfc/1.0/vts/functional/vts/testcases/hal/nfc/hidl/host/NfcHidlBasicTest.py
@@ -54,7 +54,6 @@
             target_version=1.0,
             target_package="android.hardware.nfc",
             target_component_name="INfc",
-            hw_binder_service_name="nfc_nci",
             bits=64 if self.dut.is64Bit else 32)
 
     def tearDownClass(self):
diff --git a/sensors/1.0/ISensors.hal b/sensors/1.0/ISensors.hal
index c56da29..5c8301a 100644
--- a/sensors/1.0/ISensors.hal
+++ b/sensors/1.0/ISensors.hal
@@ -61,7 +61,9 @@
      * If there is no sensor event when this function is being called, block
      * until there are sensor events available.
      *
-     * @param  maxCount max number of samples can be returned.
+     * @param  maxCount max number of samples can be returned, must be > 0.
+     *         Actual number of events returned in data must be <= maxCount
+     *         and > 0.
      * @return result OK on success or BAD_VALUE if maxCount <= 0.
      * @return data vector of Event contains sensor events.
      * @return dynamicSensorsAdded vector of SensorInfo contains dynamic sensor
diff --git a/sensors/1.0/default/Sensors.cpp b/sensors/1.0/default/Sensors.cpp
index 8903397..41eb945 100644
--- a/sensors/1.0/default/Sensors.cpp
+++ b/sensors/1.0/default/Sensors.cpp
@@ -42,10 +42,12 @@
     switch (err) {
         case OK:
             return Result::OK;
-        case BAD_VALUE:
-            return Result::BAD_VALUE;
         case PERMISSION_DENIED:
             return Result::PERMISSION_DENIED;
+        case NO_MEMORY:
+            return Result::NO_MEMORY;
+        case BAD_VALUE:
+            return Result::BAD_VALUE;
         default:
             return Result::INVALID_OPERATION;
     }
@@ -151,12 +153,13 @@
         return Void();
     }
 
-    std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[maxCount]);
+    int bufferSize = maxCount <= kPollMaxBufferSize ? maxCount : kPollMaxBufferSize;
+
+    std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[bufferSize]);
 
     int err = mSensorDevice->poll(
             reinterpret_cast<sensors_poll_device_t *>(mSensorDevice),
-            data.get(),
-            maxCount);
+            data.get(), bufferSize);
 
     if (err < 0) {
         _hidl_cb(ResultFromStatus(err), out, dynamicSensorsAdded);
@@ -226,27 +229,68 @@
 
 Return<void> Sensors::registerDirectChannel(
         const SharedMemInfo& mem, registerDirectChannel_cb _hidl_cb) {
-    //TODO(b/30985702): finish implementation
-    (void) mem;
-    _hidl_cb(Result::INVALID_OPERATION, -1);
+    if (mSensorDevice->register_direct_channel == nullptr
+            || mSensorDevice->config_direct_report == nullptr) {
+        // HAL does not support
+        _hidl_cb(Result::INVALID_OPERATION, -1);
+        return Void();
+    }
+
+    sensors_direct_mem_t m;
+    if (!convertFromSharedMemInfo(mem, &m)) {
+      _hidl_cb(Result::BAD_VALUE, -1);
+      return Void();
+    }
+
+    int err = mSensorDevice->register_direct_channel(mSensorDevice, &m, -1);
+
+    if (err < 0) {
+        _hidl_cb(ResultFromStatus(err), -1);
+    } else {
+        int32_t channelHandle = static_cast<int32_t>(err);
+        _hidl_cb(Result::OK, channelHandle);
+    }
     return Void();
 }
 
 Return<Result> Sensors::unregisterDirectChannel(int32_t channelHandle) {
-    //TODO(b/30985702): finish implementation
-    (void) channelHandle;
-    return Result::INVALID_OPERATION;
+    if (mSensorDevice->register_direct_channel == nullptr
+            || mSensorDevice->config_direct_report == nullptr) {
+        // HAL does not support
+        return Result::INVALID_OPERATION;
+    }
+
+    mSensorDevice->register_direct_channel(mSensorDevice, nullptr, channelHandle);
+
+    return Result::OK;
 }
 
 Return<void> Sensors::configDirectReport(
         int32_t sensorHandle, int32_t channelHandle, RateLevel rate,
         configDirectReport_cb _hidl_cb) {
-    //TODO(b/30985702): finish implementation
-    (void) sensorHandle;
-    (void) channelHandle;
-    (void) rate;
+    if (mSensorDevice->register_direct_channel == nullptr
+            || mSensorDevice->config_direct_report == nullptr) {
+        // HAL does not support
+        _hidl_cb(Result::INVALID_OPERATION, -1);
+        return Void();
+    }
 
-    _hidl_cb(Result::INVALID_OPERATION, -1);
+    sensors_direct_cfg_t cfg = {
+        .rate_level = convertFromRateLevel(rate)
+    };
+    if (cfg.rate_level < 0) {
+        _hidl_cb(Result::BAD_VALUE, -1);
+        return Void();
+    }
+
+    int err = mSensorDevice->config_direct_report(mSensorDevice,
+            sensorHandle, channelHandle, &cfg);
+
+    if (rate == RateLevel::STOP) {
+        _hidl_cb(ResultFromStatus(err), -1);
+    } else {
+        _hidl_cb(err > 0 ? Result::OK : ResultFromStatus(err), err);
+    }
     return Void();
 }
 
diff --git a/sensors/1.0/default/Sensors.h b/sensors/1.0/default/Sensors.h
index e8bd98d..09729d3 100644
--- a/sensors/1.0/default/Sensors.h
+++ b/sensors/1.0/default/Sensors.h
@@ -27,6 +27,7 @@
 namespace V1_0 {
 namespace implementation {
 
+
 struct Sensors : public ::android::hardware::sensors::V1_0::ISensors {
     Sensors();
 
@@ -60,6 +61,7 @@
             configDirectReport_cb _hidl_cb) override;
 
 private:
+    static constexpr int32_t kPollMaxBufferSize = 128;
     status_t mInitCheck;
     sensors_module_t *mSensorModule;
     sensors_poll_device_1_t *mSensorDevice;
diff --git a/sensors/1.0/default/convert.cpp b/sensors/1.0/default/convert.cpp
index 6735e96..acff6ca 100644
--- a/sensors/1.0/default/convert.cpp
+++ b/sensors/1.0/default/convert.cpp
@@ -340,6 +340,50 @@
     }
 }
 
+bool convertFromSharedMemInfo(const SharedMemInfo& memIn, sensors_direct_mem_t *memOut) {
+    if (memOut == nullptr) {
+        return false;
+    }
+
+    switch(memIn.type) {
+        case SharedMemType::ASHMEM:
+            memOut->type = SENSOR_DIRECT_MEM_TYPE_ASHMEM;
+            break;
+        case SharedMemType::GRALLOC:
+            memOut->type = SENSOR_DIRECT_MEM_TYPE_GRALLOC;
+            break;
+        default:
+            return false;
+    }
+
+    switch(memIn.format) {
+        case SharedMemFormat::SENSORS_EVENT:
+            memOut->format = SENSOR_DIRECT_FMT_SENSORS_EVENT;
+            break;
+        default:
+            return false;
+    }
+
+    memOut->size = memIn.size;
+    memOut->handle = memIn.memoryHandle;
+    return true;
+}
+
+int convertFromRateLevel(RateLevel rate) {
+    switch(rate) {
+        case RateLevel::STOP:
+            return SENSOR_DIRECT_RATE_STOP;
+        case RateLevel::NORMAL:
+            return SENSOR_DIRECT_RATE_NORMAL;
+        case RateLevel::FAST:
+            return SENSOR_DIRECT_RATE_FAST;
+        case RateLevel::VERY_FAST:
+            return SENSOR_DIRECT_RATE_VERY_FAST;
+        default:
+            return -1;
+    }
+}
+
 }  // namespace implementation
 }  // namespace V1_0
 }  // namespace sensors
diff --git a/sensors/1.0/default/include/sensors/convert.h b/sensors/1.0/default/include/sensors/convert.h
index d289a81..c3a0125 100644
--- a/sensors/1.0/default/include/sensors/convert.h
+++ b/sensors/1.0/default/include/sensors/convert.h
@@ -33,6 +33,9 @@
 void convertFromSensorEvent(const sensors_event_t &src, Event *dst);
 void convertToSensorEvent(const Event &src, sensors_event_t *dst);
 
+bool convertFromSharedMemInfo(const SharedMemInfo& memIn, sensors_direct_mem_t *memOut);
+int convertFromRateLevel(RateLevel rate);
+
 }  // namespace implementation
 }  // namespace V1_0
 }  // namespace sensors
diff --git a/sensors/1.0/types.hal b/sensors/1.0/types.hal
index c8c8dfc..552c997 100644
--- a/sensors/1.0/types.hal
+++ b/sensors/1.0/types.hal
@@ -1224,23 +1224,32 @@
 @export(name="direct_format_t", value_prefix="SENSOR_DIRECT_FMT_")
 enum SharedMemFormat : int32_t {
     SENSORS_EVENT = 1,  // shared memory is formated as an array of data
-                        // elements, each sized 104 bytes. Details of fields:
-                        //
-                        // offset   type        name
-                        //-----------------------------------
-                        // 0x0000   int32_t     size (always 104)
-                        // 0x0004   int32_t     sensor report token
-                        // 0x0008   int32_t     type (see SensorType)
-                        // 0x000C   int32_t     atomic counter
-                        // 0x0010   int64_t     timestamp (see Event)
-                        // 0x0014   float[16]/  data
-                        //          int64_t[8]
-                        // 0x0058   int32_t[4]  reserved
-                        //
+                        // elements. See SensorsEventFormatOffset for details.
                         // Upon return of channel registration call, the
                         // shared memory space must be formated to all 0 by HAL.
 };
 
+enum SensorsEventFormatOffset : uint16_t {
+    // offset   type        name
+    //-----------------------------------
+    // 0x0000   int32_t     size (always 104)
+    // 0x0004   int32_t     sensor report token
+    // 0x0008   int32_t     type (see SensorType)
+    // 0x000C   uint32_t    atomic counter
+    // 0x0010   int64_t     timestamp (see Event)
+    // 0x0018   float[16]/  data
+    //          int64_t[8]
+    // 0x0058   int32_t[4]  reserved (set to zero)
+    SIZE_FIELD      = 0x0,
+    REPORT_TOKEN    = 0x4,
+    SENSOR_TYPE     = 0x8,
+    ATOMIC_COUNTER  = 0xC,
+    TIMESTAMP       = 0x10,
+    DATA            = 0x18,
+    RESERVED        = 0x58,
+    TOTAL_LENGTH    = 0x68
+};
+
 /**
  * Shared memory information for a direct channel
  */
diff --git a/sensors/1.0/vts/functional/Android.bp b/sensors/1.0/vts/functional/Android.bp
index 675484a..9ca6230 100644
--- a/sensors/1.0/vts/functional/Android.bp
+++ b/sensors/1.0/vts/functional/Android.bp
@@ -19,10 +19,11 @@
     gtest: true,
     srcs: ["sensors_hidl_hal_test.cpp"],
     shared_libs: [
-        "liblog",
-        "libhidlbase",
-        "libutils",
         "android.hardware.sensors@1.0",
+        "libcutils",
+        "libhidlbase",
+        "liblog",
+        "libutils",
     ],
     static_libs: ["libgtest"],
     cflags: [
diff --git a/sensors/1.0/vts/functional/sensors_hidl_hal_test.cpp b/sensors/1.0/vts/functional/sensors_hidl_hal_test.cpp
index 2edc5c3..c7600f3 100644
--- a/sensors/1.0/vts/functional/sensors_hidl_hal_test.cpp
+++ b/sensors/1.0/vts/functional/sensors_hidl_hal_test.cpp
@@ -19,16 +19,20 @@
 #include <android/hardware/sensors/1.0/ISensors.h>
 #include <android/hardware/sensors/1.0/types.h>
 #include <android/log.h>
+#include <cutils/ashmem.h>
 #include <gtest/gtest.h>
 #include <hardware/sensors.h>       // for sensor type strings
 
 #include <algorithm>
 #include <cinttypes>
 #include <cmath>
+#include <memory>
 #include <mutex>
 #include <thread>
+#include <unordered_set>
 #include <vector>
 
+#include <sys/mman.h>
 #include <unistd.h>
 
 using ::android::hardware::Return;
@@ -148,6 +152,164 @@
   ALOGD("polling thread end");
 }
 
+class SensorsTestSharedMemory {
+ public:
+  static SensorsTestSharedMemory* create(SharedMemType type, size_t size);
+  SharedMemInfo getSharedMemInfo() const;
+  char * getBuffer() const;
+  std::vector<Event> parseEvents(int64_t lastCounter = -1, size_t offset = 0) const;
+  virtual ~SensorsTestSharedMemory();
+ private:
+  SensorsTestSharedMemory(SharedMemType type, size_t size);
+
+  SharedMemType mType;
+  native_handle_t* mNativeHandle;
+  size_t mSize;
+  char* mBuffer;
+
+  DISALLOW_COPY_AND_ASSIGN(SensorsTestSharedMemory);
+};
+
+SharedMemInfo SensorsTestSharedMemory::getSharedMemInfo() const {
+  SharedMemInfo mem = {
+    .type = mType,
+    .format = SharedMemFormat::SENSORS_EVENT,
+    .size = static_cast<uint32_t>(mSize),
+    .memoryHandle = mNativeHandle
+  };
+  return mem;
+}
+
+char * SensorsTestSharedMemory::getBuffer() const {
+  return mBuffer;
+}
+
+std::vector<Event> SensorsTestSharedMemory::parseEvents(int64_t lastCounter, size_t offset) const {
+
+  constexpr size_t kEventSize = static_cast<size_t>(SensorsEventFormatOffset::TOTAL_LENGTH);
+  constexpr size_t kOffsetSize = static_cast<size_t>(SensorsEventFormatOffset::SIZE_FIELD);
+  constexpr size_t kOffsetToken = static_cast<size_t>(SensorsEventFormatOffset::REPORT_TOKEN);
+  constexpr size_t kOffsetType = static_cast<size_t>(SensorsEventFormatOffset::SENSOR_TYPE);
+  constexpr size_t kOffsetAtomicCounter =
+      static_cast<size_t>(SensorsEventFormatOffset::ATOMIC_COUNTER);
+  constexpr size_t kOffsetTimestamp = static_cast<size_t>(SensorsEventFormatOffset::TIMESTAMP);
+  constexpr size_t kOffsetData = static_cast<size_t>(SensorsEventFormatOffset::DATA);
+
+  std::vector<Event> events;
+  std::vector<float> data(16);
+
+  while (offset + kEventSize <= mSize) {
+    int64_t atomicCounter = *reinterpret_cast<uint32_t *>(mBuffer + offset + kOffsetAtomicCounter);
+    if (atomicCounter <= lastCounter) {
+      break;
+    }
+
+    int32_t size = *reinterpret_cast<int32_t *>(mBuffer + offset + kOffsetSize);
+    if (size != kEventSize) {
+      // unknown error, events parsed may be wrong, remove all
+      events.clear();
+      break;
+    }
+
+    int32_t token = *reinterpret_cast<int32_t *>(mBuffer + offset + kOffsetToken);
+    int32_t type = *reinterpret_cast<int32_t *>(mBuffer + offset + kOffsetType);
+    int64_t timestamp = *reinterpret_cast<int64_t *>(mBuffer + offset + kOffsetTimestamp);
+
+    ALOGV("offset = %zu, cnt %" PRId32 ", token %" PRId32 ", type %" PRId32 ", timestamp %" PRId64,
+        offset, atomicCounter, token, type, timestamp);
+
+    Event event = {
+      .timestamp = timestamp,
+      .sensorHandle = token,
+      .sensorType = static_cast<SensorType>(type),
+    };
+    event.u.data = android::hardware::hidl_array<float, 16>
+        (reinterpret_cast<float*>(mBuffer + offset + kOffsetData));
+
+    events.push_back(event);
+
+    lastCounter = atomicCounter;
+    offset += kEventSize;
+  }
+
+  return events;
+}
+
+SensorsTestSharedMemory::SensorsTestSharedMemory(SharedMemType type, size_t size)
+    : mType(type), mSize(0), mBuffer(nullptr) {
+  native_handle_t *handle = nullptr;
+  char *buffer = nullptr;
+  switch(type) {
+    case SharedMemType::ASHMEM: {
+      int fd;
+      handle = ::native_handle_create(1 /*nFds*/, 0/*nInts*/);
+      if (handle != nullptr) {
+        handle->data[0] = fd = ::ashmem_create_region("SensorsTestSharedMemory", size);
+        if (handle->data[0] > 0) {
+          // memory is pinned by default
+          buffer = static_cast<char *>
+              (::mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0));
+          if (buffer != reinterpret_cast<char*>(MAP_FAILED)) {
+            break;
+          }
+          ::native_handle_close(handle);
+        }
+        ::native_handle_delete(handle);
+        handle = nullptr;
+      }
+      break;
+    }
+    default:
+      break;
+  }
+
+  if (buffer != nullptr) {
+    mNativeHandle = handle;
+    mSize = size;
+    mBuffer = buffer;
+  }
+}
+
+SensorsTestSharedMemory::~SensorsTestSharedMemory() {
+  switch(mType) {
+    case SharedMemType::ASHMEM: {
+      if (mSize != 0) {
+        ::munmap(mBuffer, mSize);
+        mBuffer = nullptr;
+
+        ::native_handle_close(mNativeHandle);
+        ::native_handle_delete(mNativeHandle);
+
+        mNativeHandle = nullptr;
+        mSize = 0;
+      }
+      break;
+    }
+    default: {
+      if (mNativeHandle != nullptr || mSize != 0 || mBuffer != nullptr) {
+        ALOGE("SensorsTestSharedMemory %p not properly destructed: "
+            "type %d, native handle %p, size %zu, buffer %p",
+            this, static_cast<int>(mType), mNativeHandle, mSize, mBuffer);
+      }
+      break;
+    }
+  }
+}
+
+SensorsTestSharedMemory* SensorsTestSharedMemory::create(SharedMemType type, size_t size) {
+  constexpr size_t kMaxSize = 128*1024*1024; // sensor test should not need more than 128M
+  if (size == 0 || size >= kMaxSize) {
+    return nullptr;
+  }
+
+  auto m = new SensorsTestSharedMemory(type, size);
+  if (m->mSize != size || m->mBuffer == nullptr) {
+    delete m;
+    m = nullptr;
+  }
+  return m;
+}
+
 // The main test class for SENSORS HIDL HAL.
 class SensorsHidlTest : public ::testing::Test {
  public:
@@ -155,52 +317,66 @@
   }
 
   virtual void TearDown() override {
+    // stop all sensors
+    for (auto s : mSensorHandles) {
+      S()->activate(s, false);
+    }
+    mSensorHandles.clear();
+
+    // stop all direct report and channels
+    for (auto c : mDirectChannelHandles) {
+      // disable all reports
+      S()->configDirectReport(-1, c, RateLevel::STOP, [] (auto, auto){});
+      S()->unregisterDirectChannel(c);
+    }
+    mDirectChannelHandles.clear();
   }
 
  protected:
+  SensorInfo defaultSensorByType(SensorType type);
+  std::vector<Event> collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
+        bool clearBeforeStart = true, bool changeCollection = true);
+
+  // implementation wrapper
+  Return<void> getSensorsList(ISensors::getSensorsList_cb _hidl_cb) {
+    return S()->getSensorsList(_hidl_cb);
+  }
+
+  Return<Result> activate(
+          int32_t sensorHandle, bool enabled);
+
+  Return<Result> batch(
+          int32_t sensorHandle,
+          int64_t samplingPeriodNs,
+          int64_t maxReportLatencyNs) {
+    return S()->batch(sensorHandle, samplingPeriodNs, maxReportLatencyNs);
+  }
+
+  Return<Result> flush(int32_t sensorHandle) {
+    return S()->flush(sensorHandle);
+  }
+
+  Return<Result> injectSensorData(const Event& event) {
+    return S()->injectSensorData(event);
+  }
+
+  Return<void> registerDirectChannel(
+          const SharedMemInfo& mem, ISensors::registerDirectChannel_cb _hidl_cb);
+
+  Return<Result> unregisterDirectChannel(int32_t channelHandle) {
+    return S()->unregisterDirectChannel(channelHandle);
+  }
+
+  Return<void> configDirectReport(
+          int32_t sensorHandle, int32_t channelHandle, RateLevel rate,
+          ISensors::configDirectReport_cb _hidl_cb) {
+    return S()->configDirectReport(sensorHandle, channelHandle, rate, _hidl_cb);
+  }
+
   inline sp<ISensors>& S() {
     return SensorsHidlEnvironment::Instance()->sensors;
   }
 
-  std::vector<Event> collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
-                                   bool clearBeforeStart = true,
-                                   bool changeCollection = true) {
-    std::vector<Event> events;
-    constexpr useconds_t SLEEP_GRANULARITY = 100*1000; //gradularity 100 ms
-
-    ALOGI("collect max of %zu events for %d us, clearBeforeStart %d",
-          nEventLimit, timeLimitUs, clearBeforeStart);
-
-    if (changeCollection) {
-      SensorsHidlEnvironment::Instance()->setCollection(true);
-    }
-    if (clearBeforeStart) {
-      SensorsHidlEnvironment::Instance()->catEvents(nullptr);
-    }
-
-    while (timeLimitUs > 0) {
-      useconds_t duration = std::min(SLEEP_GRANULARITY, timeLimitUs);
-      usleep(duration);
-      timeLimitUs -= duration;
-
-      SensorsHidlEnvironment::Instance()->catEvents(&events);
-      if (events.size() >= nEventLimit) {
-        break;
-      }
-      ALOGV("time to go = %d, events to go = %d",
-            (int)timeLimitUs, (int)(nEventLimit - events.size()));
-    }
-
-    if (changeCollection) {
-      SensorsHidlEnvironment::Instance()->setCollection(false);
-    }
-    return events;
-  }
-
-  static bool typeMatchStringType(SensorType type, const hidl_string& stringType);
-  static bool typeMatchReportMode(SensorType type, SensorFlagBits reportMode);
-  static bool delayMatchReportMode(int32_t minDelay, int32_t maxDelay, SensorFlagBits reportMode);
-
   inline static SensorFlagBits extractReportMode(uint64_t flag) {
     return (SensorFlagBits) (flag
         & ((uint64_t) SensorFlagBits::CONTINUOUS_MODE
@@ -219,10 +395,77 @@
     return (int32_t) type > 0;
   }
 
+  static bool typeMatchStringType(SensorType type, const hidl_string& stringType);
+  static bool typeMatchReportMode(SensorType type, SensorFlagBits reportMode);
+  static bool delayMatchReportMode(int32_t minDelay, int32_t maxDelay, SensorFlagBits reportMode);
   static SensorFlagBits expectedReportModeForType(SensorType type);
-  SensorInfo defaultSensorByType(SensorType type);
+
+  // all sensors and direct channnels used
+  std::unordered_set<int32_t> mSensorHandles;
+  std::unordered_set<int32_t> mDirectChannelHandles;
 };
 
+
+Return<Result> SensorsHidlTest::activate(int32_t sensorHandle, bool enabled) {
+  // If activating a sensor, add the handle in a set so that when test fails it can be turned off.
+  // The handle is not removed when it is deactivating on purpose so that it is not necessary to
+  // check the return value of deactivation. Deactivating a sensor more than once does not have
+  // negative effect.
+  if (enabled) {
+    mSensorHandles.insert(sensorHandle);
+  }
+  return S()->activate(sensorHandle, enabled);
+}
+
+Return<void> SensorsHidlTest::registerDirectChannel(
+    const SharedMemInfo& mem, ISensors::registerDirectChannel_cb cb) {
+  // If registeration of a channel succeeds, add the handle of channel to a set so that it can be
+  // unregistered when test fails. Unregister a channel does not remove the handle on purpose.
+  // Unregistering a channel more than once should not have negative effect.
+  S()->registerDirectChannel(mem,
+      [&] (auto result, auto channelHandle) {
+        if (result == Result::OK) {
+          mDirectChannelHandles.insert(channelHandle);
+        }
+        cb(result, channelHandle);
+      });
+  return Void();
+}
+
+std::vector<Event> SensorsHidlTest::collectEvents(useconds_t timeLimitUs, size_t nEventLimit,
+      bool clearBeforeStart, bool changeCollection) {
+  std::vector<Event> events;
+  constexpr useconds_t SLEEP_GRANULARITY = 100*1000; //gradularity 100 ms
+
+  ALOGI("collect max of %zu events for %d us, clearBeforeStart %d",
+        nEventLimit, timeLimitUs, clearBeforeStart);
+
+  if (changeCollection) {
+    SensorsHidlEnvironment::Instance()->setCollection(true);
+  }
+  if (clearBeforeStart) {
+    SensorsHidlEnvironment::Instance()->catEvents(nullptr);
+  }
+
+  while (timeLimitUs > 0) {
+    useconds_t duration = std::min(SLEEP_GRANULARITY, timeLimitUs);
+    usleep(duration);
+    timeLimitUs -= duration;
+
+    SensorsHidlEnvironment::Instance()->catEvents(&events);
+    if (events.size() >= nEventLimit) {
+      break;
+    }
+    ALOGV("time to go = %d, events to go = %d",
+          (int)timeLimitUs, (int)(nEventLimit - events.size()));
+  }
+
+  if (changeCollection) {
+    SensorsHidlEnvironment::Instance()->setCollection(false);
+  }
+  return events;
+}
+
 bool SensorsHidlTest::typeMatchStringType(SensorType type, const hidl_string& stringType) {
 
   if (type >= SensorType::DEVICE_PRIVATE_BASE) {
@@ -303,6 +546,7 @@
       break;
     case SensorFlagBits::SPECIAL_REPORTING_MODE:
       res = (minDelay == 0) && (maxDelay == 0);
+      break;
     default:
       res = false;
   }
@@ -439,10 +683,10 @@
 
   int32_t handle = sensor.sensorHandle;
 
-  S()->batch(handle, samplingPeriodInNs, batchingPeriodInNs);
-  S()->activate(handle, 1);
+  ASSERT_EQ(batch(handle, samplingPeriodInNs, batchingPeriodInNs), Result::OK);
+  ASSERT_EQ(activate(handle, 1), Result::OK);
   events = collectEvents(minTimeUs, minNEvent, true /*clearBeforeStart*/);
-  S()->activate(handle, 0);
+  ASSERT_EQ(activate(handle, 0), Result::OK);
 
   ALOGI("Collected %zu samples", events.size());
 
@@ -475,7 +719,6 @@
 
 // Test if sensor hal can do gyroscope streaming properly
 TEST_F(SensorsHidlTest, NormalGyroscopeStreamingOperation) {
-
   std::vector<Event> events;
 
   constexpr int64_t samplingPeriodInNs = 10ull*1000*1000; // 10ms
@@ -493,10 +736,10 @@
 
   int32_t handle = sensor.sensorHandle;
 
-  S()->batch(handle, samplingPeriodInNs, batchingPeriodInNs);
-  S()->activate(handle, 1);
+  ASSERT_EQ(batch(handle, samplingPeriodInNs, batchingPeriodInNs), Result::OK);
+  ASSERT_EQ(activate(handle, 1), Result::OK);
   events = collectEvents(minTimeUs, minNEvent, true /*clearBeforeStart*/);
-  S()->activate(handle, 0);
+  ASSERT_EQ(activate(handle, 0), Result::OK);
 
   ALOGI("Collected %zu samples", events.size());
 
@@ -529,7 +772,6 @@
 
 // Test if sensor hal can do accelerometer sampling rate switch properly when sensor is active
 TEST_F(SensorsHidlTest, AccelerometerSamplingPeriodHotSwitchOperation) {
-
   std::vector<Event> events1, events2;
 
   constexpr int64_t batchingPeriodInNs = 0; // no batching
@@ -553,18 +795,18 @@
     return;
   }
 
-  S()->batch(handle, minSamplingPeriodInNs, batchingPeriodInNs);
-  S()->activate(handle, 1);
+  ASSERT_EQ(batch(handle, minSamplingPeriodInNs, batchingPeriodInNs), Result::OK);
+  ASSERT_EQ(activate(handle, 1), Result::OK);
 
   usleep(500000); // sleep 0.5 sec to wait for change rate to happen
   events1 = collectEvents(sensor.minDelay * minNEvent, minNEvent, true /*clearBeforeStart*/);
 
-  S()->batch(handle, maxSamplingPeriodInNs, batchingPeriodInNs);
+  ASSERT_EQ(batch(handle, maxSamplingPeriodInNs, batchingPeriodInNs), Result::OK);
 
   usleep(500000); // sleep 0.5 sec to wait for change rate to happen
   events2 = collectEvents(sensor.maxDelay * minNEvent, minNEvent, true /*clearBeforeStart*/);
 
-  S()->activate(handle, 0);
+  ASSERT_EQ(activate(handle, 0), Result::OK);
 
   ALOGI("Collected %zu fast samples and %zu slow samples", events1.size(), events2.size());
 
@@ -616,7 +858,6 @@
 
 // Test if sensor hal can do normal accelerometer batching properly
 TEST_F(SensorsHidlTest, AccelerometerBatchingOperation) {
-
   std::vector<Event> events;
 
   constexpr int64_t oneSecondInNs = 1ull * 1000 * 1000 * 1000;
@@ -649,18 +890,17 @@
   int64_t allowedBatchDeliverTimeNs =
       std::max(oneSecondInNs, batchingPeriodInNs / 10);
 
-  S()->batch(handle, minSamplingPeriodInNs, INT64_MAX);
-  S()->activate(handle, 1);
+  ASSERT_EQ(batch(handle, minSamplingPeriodInNs, INT64_MAX), Result::OK);
+  ASSERT_EQ(activate(handle, 1), Result::OK);
 
   usleep(500000); // sleep 0.5 sec to wait for initialization
-  S()->flush(handle);
+  ASSERT_EQ(flush(handle), Result::OK);
 
   // wait for 80% of the reserved batching period
   // there should not be any significant amount of events
   // since collection is not enabled all events will go down the drain
   usleep(batchingPeriodInNs / 1000 * 8 / 10);
 
-
   SensorsHidlEnvironment::Instance()->setCollection(true);
   // 0.8 + 0.3 times the batching period
   // plus some time for the event to deliver
@@ -668,13 +908,13 @@
       batchingPeriodInNs / 1000 * 3 / 10,
         minFifoCount, true /*clearBeforeStart*/, false /*change collection*/);
 
-  S()->flush(handle);
+  ASSERT_EQ(flush(handle), Result::OK);
 
   events = collectEvents(allowedBatchDeliverTimeNs / 1000,
         minFifoCount, true /*clearBeforeStart*/, false /*change collection*/);
 
   SensorsHidlEnvironment::Instance()->setCollection(false);
-  S()->activate(handle, 0);
+  ASSERT_EQ(activate(handle, 0), Result::OK);
 
   size_t nEvent = 0;
   for (auto & e : events) {
@@ -687,6 +927,79 @@
   ASSERT_GT(nEvent, (size_t)(batchingPeriodInNs / minSamplingPeriodInNs * 9 / 10));
 }
 
+// Test sensor event direct report with ashmem for gyro sensor
+TEST_F(SensorsHidlTest, GyroscopeAshmemDirectReport) {
+
+  constexpr SensorType type = SensorType::GYROSCOPE;
+  constexpr size_t kEventSize = 104;
+  constexpr size_t kNEvent = 500;
+  constexpr size_t kMemSize = kEventSize * kNEvent;
+
+  SensorInfo sensor = defaultSensorByType(type);
+
+  if (!(sensor.flags | SensorFlagBits::MASK_DIRECT_REPORT)
+      || !(sensor.flags | SensorFlagBits::DIRECT_CHANNEL_ASHMEM)) {
+    // does not declare support
+    return;
+  }
+
+  std::unique_ptr<SensorsTestSharedMemory>
+      mem(SensorsTestSharedMemory::create(SharedMemType::ASHMEM, kMemSize));
+  ASSERT_NE(mem, nullptr);
+
+  char* buffer = mem->getBuffer();
+  // fill memory with data
+  for (size_t i = 0; i < kMemSize; ++i) {
+    buffer[i] = '\xcc';
+  }
+
+  int32_t channelHandle;
+  registerDirectChannel(mem->getSharedMemInfo(),
+      [&channelHandle] (auto result, auto channelHandle_) {
+          ASSERT_EQ(result, Result::OK);
+          channelHandle = channelHandle_;
+      });
+
+  // check memory is zeroed
+  for (size_t i = 0; i < kMemSize; ++i) {
+    ASSERT_EQ(buffer[i], '\0');
+  }
+
+  int32_t eventToken;
+  configDirectReport(sensor.sensorHandle, channelHandle, RateLevel::NORMAL,
+      [&eventToken] (auto result, auto token) {
+          ASSERT_EQ(result, Result::OK);
+          eventToken = token;
+      });
+
+  usleep(1500000); // sleep 1 sec for data, plus 0.5 sec for initialization
+  auto events = mem->parseEvents();
+
+  // allowed to be 55% of nominal freq (50Hz)
+  ASSERT_GT(events.size(), 50 / 2);
+  ASSERT_LT(events.size(), static_cast<size_t>(110*1.5));
+
+  int64_t lastTimestamp = 0;
+  for (auto &e : events) {
+    ASSERT_EQ(e.sensorType, type);
+    ASSERT_EQ(e.sensorHandle, eventToken);
+    ASSERT_GT(e.timestamp, lastTimestamp);
+
+    Vec3 gyro = e.u.vec3;
+    double gyroNorm = std::sqrt(gyro.x * gyro.x + gyro.y * gyro.y + gyro.z * gyro.z);
+    // assert not drifting
+    ASSERT_TRUE(gyroNorm < 0.1);  // < ~5 degree/sa
+
+    lastTimestamp = e.timestamp;
+  }
+
+  // stop sensor and unregister channel
+  configDirectReport(sensor.sensorHandle, channelHandle, RateLevel::STOP,
+        [&eventToken] (auto result, auto) {
+            ASSERT_EQ(result, Result::OK);
+        });
+  ASSERT_EQ(unregisterDirectChannel(channelHandle), Result::OK);
+}
 
 int main(int argc, char **argv) {
   ::testing::AddGlobalTestEnvironment(SensorsHidlEnvironment::Instance());
@@ -695,4 +1008,4 @@
   ALOGI("Test result = %d", status);
   return status;
 }
-
+// vim: set ts=2 sw=2
diff --git a/sensors/1.0/vts/types.vts b/sensors/1.0/vts/types.vts
index 2980507..1b48916 100644
--- a/sensors/1.0/vts/types.vts
+++ b/sensors/1.0/vts/types.vts
@@ -374,10 +374,7 @@
     struct_value: {
         name: "flags"
         type: TYPE_MASK
-        enum_value: {
-            type: TYPE_ENUM
-            predefined_type: "::android::hardware::sensors::V1_0::SensorFlagBits"
-        }
+        predefined_type: "::android::hardware::sensors::V1_0::SensorFlagBits"
     }
 }
 
@@ -615,6 +612,26 @@
         scalar_value: {
             uint32_t: 131077
         }
+        enumerator: "AINFO_LOCAL_GEOMAGNETIC_FIELD"
+        scalar_value: {
+            uint32_t: 196608
+        }
+        enumerator: "AINFO_LOCAL_GRAVITY"
+        scalar_value: {
+            uint32_t: 196609
+        }
+        enumerator: "AINFO_DOCK_STATE"
+        scalar_value: {
+            uint32_t: 196610
+        }
+        enumerator: "AINFO_HIGH_PERFORMANCE_MODE"
+        scalar_value: {
+            uint32_t: 196611
+        }
+        enumerator: "AINFO_MAGNETIC_FIELD_CALIBRATION"
+        scalar_value: {
+            uint32_t: 196612
+        }
         enumerator: "AINFO_CUSTOM_START"
         scalar_value: {
             uint32_t: 268435456
@@ -817,6 +834,47 @@
 }
 
 attribute: {
+    name: "::android::hardware::sensors::V1_0::SensorsEventFormatOffset"
+    type: TYPE_ENUM
+    enum_value: {
+        scalar_type: "uint16_t"
+
+        enumerator: "SIZE_FIELD"
+        scalar_value: {
+            uint16_t: 0
+        }
+        enumerator: "REPORT_TOKEN"
+        scalar_value: {
+            uint16_t: 4
+        }
+        enumerator: "SENSOR_TYPE"
+        scalar_value: {
+            uint16_t: 8
+        }
+        enumerator: "ATOMIC_COUNTER"
+        scalar_value: {
+            uint16_t: 12
+        }
+        enumerator: "TIMESTAMP"
+        scalar_value: {
+            uint16_t: 16
+        }
+        enumerator: "DATA"
+        scalar_value: {
+            uint16_t: 24
+        }
+        enumerator: "RESERVED"
+        scalar_value: {
+            uint16_t: 88
+        }
+        enumerator: "TOTAL_LENGTH"
+        scalar_value: {
+            uint16_t: 104
+        }
+    }
+}
+
+attribute: {
     name: "::android::hardware::sensors::V1_0::SharedMemInfo"
     type: TYPE_STRUCT
     struct_value: {
diff --git a/soundtrigger/2.0/Android.bp b/soundtrigger/2.0/Android.bp
index 91e7ad1..5b50f39 100644
--- a/soundtrigger/2.0/Android.bp
+++ b/soundtrigger/2.0/Android.bp
@@ -64,3 +64,159 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.soundtrigger.vts.driver@2.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.soundtrigger@2.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/soundtrigger/2.0/ $(genDir)/android/hardware/soundtrigger/2.0/",
+    srcs: [
+        "types.hal",
+        "ISoundTriggerHw.hal",
+        "ISoundTriggerHwCallback.hal",
+    ],
+    out: [
+        "android/hardware/soundtrigger/2.0/types.vts.cpp",
+        "android/hardware/soundtrigger/2.0/SoundTriggerHw.vts.cpp",
+        "android/hardware/soundtrigger/2.0/SoundTriggerHwCallback.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.soundtrigger.vts.driver@2.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.soundtrigger@2.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/soundtrigger/2.0/ $(genDir)/android/hardware/soundtrigger/2.0/",
+    srcs: [
+        "types.hal",
+        "ISoundTriggerHw.hal",
+        "ISoundTriggerHwCallback.hal",
+    ],
+    out: [
+        "android/hardware/soundtrigger/2.0/types.vts.h",
+        "android/hardware/soundtrigger/2.0/SoundTriggerHw.vts.h",
+        "android/hardware/soundtrigger/2.0/SoundTriggerHwCallback.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.soundtrigger.vts.driver@2.0",
+    generated_sources: ["android.hardware.soundtrigger.vts.driver@2.0_genc++"],
+    generated_headers: ["android.hardware.soundtrigger.vts.driver@2.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.soundtrigger.vts.driver@2.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hardware.audio.common@2.0",
+        "android.hidl.base@1.0",
+        "android.hardware.soundtrigger@2.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hardware.audio.common@2.0",
+        "android.hidl.base@1.0",
+    ],
+}
+
+genrule {
+    name: "android.hardware.soundtrigger@2.0-ISoundTriggerHw-vts.profiler_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.soundtrigger@2.0 && $(location vtsc) -mPROFILER -tSOURCE -b$(genDir) android/hardware/soundtrigger/2.0/ $(genDir)/android/hardware/soundtrigger/2.0/",
+    srcs: [
+        "ISoundTriggerHw.hal",
+        "types.hal",
+    ],
+    out: [
+        "android/hardware/soundtrigger/2.0/SoundTriggerHw.vts.cpp",
+        "android/hardware/soundtrigger/2.0/types.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.soundtrigger@2.0-ISoundTriggerHw-vts.profiler_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.soundtrigger@2.0 && $(location vtsc) -mPROFILER -tHEADER -b$(genDir) android/hardware/soundtrigger/2.0/ $(genDir)/android/hardware/soundtrigger/2.0/",
+    srcs: [
+        "ISoundTriggerHw.hal",
+        "types.hal",
+    ],
+    out: [
+        "android/hardware/soundtrigger/2.0/SoundTriggerHw.vts.h",
+        "android/hardware/soundtrigger/2.0/types.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.soundtrigger@2.0-ISoundTriggerHw-vts.profiler",
+    generated_sources: ["android.hardware.soundtrigger@2.0-ISoundTriggerHw-vts.profiler_genc++"],
+    generated_headers: ["android.hardware.soundtrigger@2.0-ISoundTriggerHw-vts.profiler_genc++_headers"],
+    export_generated_headers: ["android.hardware.soundtrigger@2.0-ISoundTriggerHw-vts.profiler_genc++_headers"],
+    shared_libs: [
+        "libbase",
+        "libhidlbase",
+        "libhidltransport",
+        "libvts_profiling",
+        "libvts_multidevice_proto",
+        "libprotobuf-cpp-full",
+        "android.hardware.audio.common@2.0",
+        "android.hidl.base@1.0",
+        "android.hardware.soundtrigger@2.0",
+    ],
+}
+
+genrule {
+    name: "android.hardware.soundtrigger@2.0-ISoundTriggerHwCallback-vts.profiler_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.soundtrigger@2.0 && $(location vtsc) -mPROFILER -tSOURCE -b$(genDir) android/hardware/soundtrigger/2.0/ $(genDir)/android/hardware/soundtrigger/2.0/",
+    srcs: [
+        "ISoundTriggerHwCallback.hal",
+        "types.hal",
+    ],
+    out: [
+        "android/hardware/soundtrigger/2.0/SoundTriggerHwCallback.vts.cpp",
+        "android/hardware/soundtrigger/2.0/types.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.soundtrigger@2.0-ISoundTriggerHwCallback-vts.profiler_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.soundtrigger@2.0 && $(location vtsc) -mPROFILER -tHEADER -b$(genDir) android/hardware/soundtrigger/2.0/ $(genDir)/android/hardware/soundtrigger/2.0/",
+    srcs: [
+        "ISoundTriggerHwCallback.hal",
+        "types.hal",
+    ],
+    out: [
+        "android/hardware/soundtrigger/2.0/SoundTriggerHwCallback.vts.h",
+        "android/hardware/soundtrigger/2.0/types.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.soundtrigger@2.0-ISoundTriggerHwCallback-vts.profiler",
+    generated_sources: ["android.hardware.soundtrigger@2.0-ISoundTriggerHwCallback-vts.profiler_genc++"],
+    generated_headers: ["android.hardware.soundtrigger@2.0-ISoundTriggerHwCallback-vts.profiler_genc++_headers"],
+    export_generated_headers: ["android.hardware.soundtrigger@2.0-ISoundTriggerHwCallback-vts.profiler_genc++_headers"],
+    shared_libs: [
+        "libbase",
+        "libhidlbase",
+        "libhidltransport",
+        "libvts_profiling",
+        "libvts_multidevice_proto",
+        "libprotobuf-cpp-full",
+        "android.hardware.audio.common@2.0",
+        "android.hidl.base@1.0",
+        "android.hardware.soundtrigger@2.0",
+    ],
+}
diff --git a/soundtrigger/2.0/vts/functional/vts/testcases/hal/soundtrigger/hidl/target_profiling/Android.mk b/soundtrigger/2.0/vts/functional/vts/testcases/hal/soundtrigger/hidl/target_profiling/Android.mk
new file mode 100644
index 0000000..fc0f9c4
--- /dev/null
+++ b/soundtrigger/2.0/vts/functional/vts/testcases/hal/soundtrigger/hidl/target_profiling/Android.mk
@@ -0,0 +1,23 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := HalSoundTriggerHidlTargetBasicProfilingTest
+VTS_CONFIG_SRC_DIR := testcases/hal/soundtrigger/hidl/target_profiling
+include test/vts/tools/build/Android.host_config.mk
diff --git a/soundtrigger/2.0/vts/functional/vts/testcases/hal/soundtrigger/hidl/target_profiling/AndroidTest.xml b/soundtrigger/2.0/vts/functional/vts/testcases/hal/soundtrigger/hidl/target_profiling/AndroidTest.xml
new file mode 100644
index 0000000..e95a406
--- /dev/null
+++ b/soundtrigger/2.0/vts/functional/vts/testcases/hal/soundtrigger/hidl/target_profiling/AndroidTest.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2016 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS sound trigger HIDL HAL's basic target-side, profiling test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer" />
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="HalSoundTriggerHidlTargetBasicTest" />
+        <option name="binary-test-sources" value="
+            _32bit::DATA/nativetest/soundtrigger_hidl_hal_test/soundtrigger_hidl_hal_test,
+            _64bit::DATA/nativetest64/soundtrigger_hidl_hal_test/soundtrigger_hidl_hal_test,
+            "/>
+        <option name="binary-test-type" value="gtest" />
+        <option name="test-timeout" value="1m" />
+        <option name="enable-profiling" value="true" />
+    </test>
+</configuration>
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target_profiling/Android.mk b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target_profiling/Android.mk
new file mode 100644
index 0000000..6f60af3
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target_profiling/Android.mk
@@ -0,0 +1,23 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := VrHidlTargetProfilingTest
+VTS_CONFIG_SRC_DIR := testcases/hal/vr/hidl/target_profiling
+include test/vts/tools/build/Android.host_config.mk
diff --git a/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target_profiling/AndroidTest.xml b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target_profiling/AndroidTest.xml
new file mode 100644
index 0000000..3bc711a
--- /dev/null
+++ b/vr/1.0/vts/functional/vts/testcases/hal/vr/hidl/target_profiling/AndroidTest.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2016 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS VR HIDL HAL's target-side, profiling test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer" />
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="VrHidlTargetTest" />
+        <option name="binary-test-sources" value="
+            _32bit::DATA/nativetest/vr_hidl_hal_test/vr_hidl_hal_test,
+            _64bit::DATA/nativetest64/vr_hidl_hal_test/vr_hidl_hal_test,
+            "/>
+        <option name="binary-test-type" value="gtest" />
+        <option name="test-timeout" value="1m" />
+        <option name="enable-profiling" value="true" />
+    </test>
+</configuration>
+
diff --git a/wifi/1.0/IWifiStaIface.hal b/wifi/1.0/IWifiStaIface.hal
index 0d6b560..7dad8af 100644
--- a/wifi/1.0/IWifiStaIface.hal
+++ b/wifi/1.0/IWifiStaIface.hal
@@ -81,13 +81,17 @@
      */
     TDLS_OFFCHANNEL = 1 << 11,
     /**
+     * Support for neighbour discovery offload.
+     */
+    ND_OFFLOAD = 1 << 12,
+    /**
      * Support for keep alive packet offload.
      */
-    KEEP_ALIVE = 1 << 12,
+    KEEP_ALIVE = 1 << 13,
     /**
      * Support for tracking connection packets' fate.
      */
-    DEBUG_PACKET_FATE = 1 << 13
+    DEBUG_PACKET_FATE = 1 << 14
   };
 
   /**
diff --git a/wifi/1.0/default/hidl_struct_util.cpp b/wifi/1.0/default/hidl_struct_util.cpp
index 80cc56e..bbb9346 100644
--- a/wifi/1.0/default/hidl_struct_util.cpp
+++ b/wifi/1.0/default/hidl_struct_util.cpp
@@ -82,6 +82,8 @@
       return HidlStaIfaceCaps::TDLS;
     case WIFI_FEATURE_TDLS_OFFCHANNEL:
       return HidlStaIfaceCaps::TDLS_OFFCHANNEL;
+    case WIFI_FEATURE_CONFIG_NDO:
+      return HidlStaIfaceCaps::ND_OFFLOAD;
     case WIFI_FEATURE_MKEEP_ALIVE:
       return HidlStaIfaceCaps::KEEP_ALIVE;
   };
@@ -242,6 +244,7 @@
                              WIFI_FEATURE_PNO,
                              WIFI_FEATURE_TDLS,
                              WIFI_FEATURE_TDLS_OFFCHANNEL,
+                             WIFI_FEATURE_CONFIG_NDO,
                              WIFI_FEATURE_MKEEP_ALIVE}) {
     if (feature & legacy_feature_set) {
       *hidl_caps |= convertLegacyFeatureToHidlStaIfaceCapability(feature);
diff --git a/wifi/supplicant/1.0/vts/functional/Android.mk b/wifi/supplicant/1.0/vts/functional/Android.mk
new file mode 100644
index 0000000..8fa649f
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/Android.mk
@@ -0,0 +1,43 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := supplicant_hidl_test
+LOCAL_CPPFLAGS := -Wall -Werror -Wextra
+LOCAL_SRC_FILES := \
+    main.cpp \
+    supplicant_hidl_test.cpp \
+    supplicant_hidl_test_utils.cpp \
+    supplicant_p2p_iface_hidl_test.cpp \
+    supplicant_sta_iface_hidl_test.cpp \
+    supplicant_sta_network_hidl_test.cpp
+LOCAL_SHARED_LIBRARIES := \
+    android.hardware.wifi.supplicant@1.0 \
+    libbase \
+    libcutils \
+    libhidlbase \
+    libhidltransport \
+    libhwbinder \
+    liblog \
+    libutils \
+    libwifi-hal \
+    libwifi-system
+LOCAL_STATIC_LIBRARIES := \
+    libgmock \
+    libgtest
+include $(BUILD_NATIVE_TEST)
+
diff --git a/wifi/supplicant/1.0/vts/functional/main.cpp b/wifi/supplicant/1.0/vts/functional/main.cpp
new file mode 100644
index 0000000..81a2947
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/main.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <gtest/gtest.h>
+
+#include "supplicant_hidl_test_utils.h"
+
+class SupplicantHidlEnvironment : public ::testing::Environment {
+   public:
+    virtual void SetUp() override {
+        stopWifiFramework();
+        stopSupplicant();
+    }
+    virtual void TearDown() override {
+        startWifiFramework();
+        // Framework will start wpa_supplicant.
+    }
+};
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(new SupplicantHidlEnvironment);
+    ::testing::InitGoogleTest(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    return status;
+}
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test.cpp
new file mode 100644
index 0000000..9922447
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <gtest/gtest.h>
+
+#include "supplicant_hidl_test_utils.h"
+
+/*
+ * Create:
+ * Ensures that an instance of the ISupplicant proxy object is
+ * successfully created.
+ */
+TEST(SupplicantHidlTestNoFixture, Create) {
+    startSupplicantAndWaitForHidlService();
+    EXPECT_NE(nullptr, getSupplicant().get());
+    stopSupplicant();
+}
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
new file mode 100644
index 0000000..3877b97
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
@@ -0,0 +1,267 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <gtest/gtest.h>
+
+#include <hidl/HidlTransportSupport.h>
+#include <android/hidl/manager/1.0/IServiceManager.h>
+#include <android/hidl/manager/1.0/IServiceNotification.h>
+
+#include <wifi_hal/driver_tool.h>
+#include <wifi_system/interface_tool.h>
+#include <wifi_system/supplicant_manager.h>
+
+#include "supplicant_hidl_test_utils.h"
+
+using ::android::sp;
+using ::android::hardware::configureRpcThreadpool;
+using ::android::hardware::joinRpcThreadpool;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::wifi::supplicant::V1_0::ISupplicant;
+using ::android::hardware::wifi::supplicant::V1_0::ISupplicantIface;
+using ::android::hardware::wifi::supplicant::V1_0::ISupplicantNetwork;
+using ::android::hardware::wifi::supplicant::V1_0::ISupplicantStaIface;
+using ::android::hardware::wifi::supplicant::V1_0::ISupplicantStaNetwork;
+using ::android::hardware::wifi::supplicant::V1_0::ISupplicantP2pIface;
+using ::android::hardware::wifi::supplicant::V1_0::IfaceType;
+using ::android::hardware::wifi::supplicant::V1_0::SupplicantStatus;
+using ::android::hardware::wifi::supplicant::V1_0::SupplicantStatusCode;
+using ::android::hidl::manager::V1_0::IServiceNotification;
+using ::android::wifi_hal::DriverTool;
+using ::android::wifi_system::InterfaceTool;
+using ::android::wifi_system::SupplicantManager;
+
+namespace {
+const char kSupplicantServiceName[] = "wpa_supplicant";
+
+// Helper function to initialize the driver and firmware to STA mode.
+void initilializeDriverAndFirmware() {
+    DriverTool driver_tool;
+    InterfaceTool iface_tool;
+    EXPECT_TRUE(driver_tool.LoadDriver());
+    EXPECT_TRUE(driver_tool.ChangeFirmwareMode(DriverTool::kFirmwareModeSta));
+    EXPECT_TRUE(iface_tool.SetWifiUpState(true));
+}
+
+// Helper function to find any iface of the desired type exposed.
+bool findIfaceOfType(sp<ISupplicant> supplicant, IfaceType desired_type,
+                     ISupplicant::IfaceInfo* out_info) {
+    bool operation_failed = false;
+    std::vector<ISupplicant::IfaceInfo> iface_infos;
+    supplicant->listInterfaces([&](const SupplicantStatus& status,
+                                   hidl_vec<ISupplicant::IfaceInfo> infos) {
+        if (status.code != SupplicantStatusCode::SUCCESS) {
+            operation_failed = true;
+            return;
+        }
+        iface_infos = infos;
+    });
+    if (operation_failed) {
+        return false;
+    }
+    for (const auto& info : iface_infos) {
+        if (info.type == desired_type) {
+            *out_info = info;
+            return true;
+        }
+    }
+    return false;
+}
+}  // namespace
+
+// Utility class to wait for wpa_supplicant's HIDL service registration.
+class ServiceNotificationListener : public IServiceNotification {
+   public:
+    Return<void> onRegistration(const hidl_string& fully_qualified_name,
+                                const hidl_string& instance_name,
+                                bool pre_existing) override {
+        if (pre_existing) {
+            return Void();
+        }
+        std::unique_lock<std::mutex> lock(mutex_);
+        registered_.push_back(std::string(fully_qualified_name.c_str()) + "/" +
+                              instance_name.c_str());
+        lock.unlock();
+        condition_.notify_one();
+        return Void();
+    }
+
+    bool registerForHidlServiceNotifications(const std::string& instance_name) {
+        if (!ISupplicant::registerForNotifications(instance_name, this)) {
+            return false;
+        }
+        configureRpcThreadpool(2, false);
+        return true;
+    }
+
+    bool waitForHidlService(uint32_t timeout_in_millis,
+                            const std::string& instance_name) {
+        std::unique_lock<std::mutex> lock(mutex_);
+        condition_.wait_for(lock, std::chrono::milliseconds(timeout_in_millis),
+                            [&]() { return registered_.size() >= 1; });
+        if (registered_.size() != 1) {
+            return false;
+        }
+        std::string exptected_registered =
+            std::string(ISupplicant::descriptor) + "/" + instance_name;
+        if (registered_[0] != exptected_registered) {
+            LOG(ERROR) << "Expected: " << exptected_registered
+                       << ", Got: " << registered_[0];
+            return false;
+        }
+        return true;
+    }
+
+   private:
+    std::vector<std::string> registered_{};
+    std::mutex mutex_;
+    std::condition_variable condition_;
+};
+
+void stopWifiFramework() {
+    ASSERT_EQ(std::system("svc wifi disable"), 0);
+    // TODO: Use some other mechanism to wait for the framework to
+    // finish disabling.
+    sleep(5);
+}
+
+void startWifiFramework() {
+    ASSERT_EQ(std::system("svc wifi enable"), 0);
+    // These tests don't care whether the framework
+    // finished enabling or not.
+}
+
+void stopSupplicant() {
+    DriverTool driver_tool;
+    SupplicantManager supplicant_manager;
+
+    ASSERT_TRUE(supplicant_manager.StopSupplicant());
+    ASSERT_TRUE(driver_tool.UnloadDriver());
+    ASSERT_FALSE(supplicant_manager.IsSupplicantRunning());
+}
+
+void startSupplicantAndWaitForHidlService() {
+    initilializeDriverAndFirmware();
+
+    android::sp<ServiceNotificationListener> notification_listener =
+        new ServiceNotificationListener();
+    ASSERT_TRUE(notification_listener->registerForHidlServiceNotifications(
+        kSupplicantServiceName));
+
+    SupplicantManager supplicant_manager;
+    ASSERT_TRUE(supplicant_manager.StartSupplicant());
+    ASSERT_TRUE(supplicant_manager.IsSupplicantRunning());
+
+    ASSERT_TRUE(
+        notification_listener->waitForHidlService(200, kSupplicantServiceName));
+}
+
+sp<ISupplicant> getSupplicant() {
+    return ISupplicant::getService(kSupplicantServiceName);
+}
+
+sp<ISupplicantStaIface> getSupplicantStaIface() {
+    sp<ISupplicant> supplicant = getSupplicant();
+    if (!supplicant.get()) {
+        return nullptr;
+    }
+    ISupplicant::IfaceInfo info;
+    if (!findIfaceOfType(supplicant, IfaceType::STA, &info)) {
+        return nullptr;
+    }
+    bool operation_failed = false;
+    sp<ISupplicantStaIface> sta_iface;
+    supplicant->getInterface(info, [&](const SupplicantStatus& status,
+                                       const sp<ISupplicantIface>& iface) {
+        if (status.code != SupplicantStatusCode::SUCCESS) {
+            operation_failed = true;
+            return;
+        }
+        sta_iface = ISupplicantStaIface::castFrom(iface);
+    });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return sta_iface;
+}
+
+sp<ISupplicantStaNetwork> createSupplicantStaNetwork() {
+    sp<ISupplicantStaIface> sta_iface = getSupplicantStaIface();
+    if (!sta_iface.get()) {
+        return nullptr;
+    }
+    bool operation_failed = false;
+    sp<ISupplicantStaNetwork> sta_network;
+    sta_iface->addNetwork([&](const SupplicantStatus& status,
+                              const sp<ISupplicantNetwork>& network) {
+        if (status.code != SupplicantStatusCode::SUCCESS) {
+            operation_failed = true;
+            return;
+        }
+        sta_network = ISupplicantStaNetwork::castFrom(network);
+    });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return sta_network;
+}
+
+sp<ISupplicantP2pIface> getSupplicantP2pIface() {
+    sp<ISupplicant> supplicant = getSupplicant();
+    if (!supplicant.get()) {
+        return nullptr;
+    }
+    ISupplicant::IfaceInfo info;
+    if (!findIfaceOfType(supplicant, IfaceType::P2P, &info)) {
+        return nullptr;
+    }
+    bool operation_failed = false;
+    sp<ISupplicantP2pIface> p2p_iface;
+    supplicant->getInterface(info, [&](const SupplicantStatus& status,
+                                       const sp<ISupplicantIface>& iface) {
+        if (status.code != SupplicantStatusCode::SUCCESS) {
+            operation_failed = true;
+            return;
+        }
+        p2p_iface = ISupplicantP2pIface::castFrom(iface);
+    });
+    if (operation_failed) {
+        return nullptr;
+    }
+    return p2p_iface;
+}
+
+bool turnOnExcessiveLogging() {
+    sp<ISupplicant> supplicant = getSupplicant();
+    if (!supplicant.get()) {
+        return false;
+    }
+    bool operation_failed = false;
+    supplicant->setDebugParams(
+        ISupplicant::DebugLevel::EXCESSIVE,
+        true,  // show timestamps
+        true,  // show keys
+        [&](const SupplicantStatus& status) {
+            if (status.code != SupplicantStatusCode::SUCCESS) {
+                operation_failed = true;
+            }
+        });
+    return !operation_failed;
+}
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
new file mode 100644
index 0000000..38143e4
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SUPPLICANT_HIDL_TEST_UTILS_H
+#define SUPPLICANT_HIDL_TEST_UTILS_H
+
+#include <android/hardware/wifi/supplicant/1.0/ISupplicant.h>
+#include <android/hardware/wifi/supplicant/1.0/ISupplicantP2pIface.h>
+#include <android/hardware/wifi/supplicant/1.0/ISupplicantStaIface.h>
+#include <android/hardware/wifi/supplicant/1.0/ISupplicantStaNetwork.h>
+
+// Used to stop the android wifi framework before every test.
+void stopWifiFramework();
+void startWifiFramework();
+void stopSupplicant();
+// Used to configure the chip, driver and start wpa_supplicant before every
+// test.
+void startSupplicantAndWaitForHidlService();
+
+// Helper functions to obtain references to the various HIDL interface objects.
+// Note: We only have a single instance of each of these objects currently.
+// These helper functions should be modified to return vectors if we support
+// multiple instances.
+android::sp<android::hardware::wifi::supplicant::V1_0::ISupplicant>
+getSupplicant();
+android::sp<android::hardware::wifi::supplicant::V1_0::ISupplicantStaIface>
+getSupplicantStaIface();
+android::sp<android::hardware::wifi::supplicant::V1_0::ISupplicantStaNetwork>
+createSupplicantStaNetwork();
+android::sp<android::hardware::wifi::supplicant::V1_0::ISupplicantP2pIface>
+getSupplicantP2pIface();
+
+bool turnOnExcessiveLogging();
+
+#endif /* SUPPLICANT_HIDL_TEST_UTILS_H */
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_p2p_iface_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_p2p_iface_hidl_test.cpp
new file mode 100644
index 0000000..968d4c9
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_p2p_iface_hidl_test.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <gtest/gtest.h>
+
+#include "supplicant_hidl_test_utils.h"
+
+/*
+ * Create:
+ * Ensures that an instance of the ISupplicantP2pIface proxy object is
+ * successfully created.
+ */
+TEST(SupplicantP2pIfaceHidlTestNoFixture, Create) {
+    startSupplicantAndWaitForHidlService();
+    EXPECT_NE(nullptr, getSupplicantP2pIface().get());
+    stopSupplicant();
+}
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_sta_iface_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_sta_iface_hidl_test.cpp
new file mode 100644
index 0000000..45cc6bc
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_sta_iface_hidl_test.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <gtest/gtest.h>
+
+#include "supplicant_hidl_test_utils.h"
+
+/*
+ * Create:
+ * Ensures that an instance of the ISupplicantStaIface proxy object is
+ * successfully created.
+ */
+TEST(SupplicantStaIfaceHidlTestNoFixture, Create) {
+    startSupplicantAndWaitForHidlService();
+    EXPECT_NE(nullptr, getSupplicantStaIface().get());
+    stopSupplicant();
+}
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_sta_network_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_sta_network_hidl_test.cpp
new file mode 100644
index 0000000..8c42a22
--- /dev/null
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_sta_network_hidl_test.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <gtest/gtest.h>
+
+#include "supplicant_hidl_test_utils.h"
+
+/*
+ * Create:
+ * Ensures that an instance of the ISupplicantStaNetwork proxy object is
+ * successfully created.
+ */
+TEST(SupplicantStaNetworkHidlTestNoFixture, Create) {
+    startSupplicantAndWaitForHidlService();
+    EXPECT_NE(nullptr, createSupplicantStaNetwork().get());
+    stopSupplicant();
+}