diff --git a/audio/2.0/default/Device.cpp b/audio/2.0/default/Device.cpp
index 9a4aff6..b696d94 100644
--- a/audio/2.0/default/Device.cpp
+++ b/audio/2.0/default/Device.cpp
@@ -292,7 +292,7 @@
 }
 
 Return<void> Device::debugDump(const hidl_handle& fd)  {
-    if (fd->numFds == 1) {
+    if (fd.getNativeHandle() != nullptr && fd->numFds == 1) {
         analyzeStatus("dump", mDevice->dump(mDevice, fd->data[0]));
     }
     return Void();
diff --git a/audio/2.0/default/DevicesFactory.cpp b/audio/2.0/default/DevicesFactory.cpp
index 8825107..b913bc7 100644
--- a/audio/2.0/default/DevicesFactory.cpp
+++ b/audio/2.0/default/DevicesFactory.cpp
@@ -39,6 +39,7 @@
         case IDevicesFactory::Device::R_SUBMIX: return AUDIO_HARDWARE_MODULE_ID_REMOTE_SUBMIX;
         case IDevicesFactory::Device::STUB: return AUDIO_HARDWARE_MODULE_ID_STUB;
     }
+    return nullptr;
 }
 
 // static
@@ -75,19 +76,22 @@
 // Methods from ::android::hardware::audio::V2_0::IDevicesFactory follow.
 Return<void> DevicesFactory::openDevice(IDevicesFactory::Device device, openDevice_cb _hidl_cb)  {
     audio_hw_device_t *halDevice;
-    int halStatus = loadAudioInterface(deviceToString(device), &halDevice);
-    Result retval(Result::OK);
+    Result retval(Result::INVALID_ARGUMENTS);
     sp<IDevice> result;
-    if (halStatus == OK) {
-        if (device == IDevicesFactory::Device::PRIMARY) {
-            result = new PrimaryDevice(halDevice);
-        } else {
-            result = new ::android::hardware::audio::V2_0::implementation::Device(halDevice);
+    const char* moduleName = deviceToString(device);
+    if (moduleName != nullptr) {
+        int halStatus = loadAudioInterface(moduleName, &halDevice);
+        if (halStatus == OK) {
+            if (device == IDevicesFactory::Device::PRIMARY) {
+                result = new PrimaryDevice(halDevice);
+            } else {
+                result = new ::android::hardware::audio::V2_0::implementation::
+                    Device(halDevice);
+            }
+            retval = Result::OK;
+        } else if (halStatus == -EINVAL) {
+            retval = Result::NOT_INITIALIZED;
         }
-    } else if (halStatus == -EINVAL) {
-        retval = Result::NOT_INITIALIZED;
-    } else {
-        retval = Result::INVALID_ARGUMENTS;
     }
     _hidl_cb(retval, result);
     return Void();
diff --git a/audio/2.0/default/Stream.cpp b/audio/2.0/default/Stream.cpp
index 29946fe..671f171 100644
--- a/audio/2.0/default/Stream.cpp
+++ b/audio/2.0/default/Stream.cpp
@@ -226,7 +226,7 @@
 }
 
 Return<void> Stream::debugDump(const hidl_handle& fd)  {
-    if (fd->numFds == 1) {
+    if (fd.getNativeHandle() != nullptr && fd->numFds == 1) {
         analyzeStatus("dump", mStream->dump(mStream, fd->data[0]));
     }
     return Void();
diff --git a/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp b/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp
index 4b00f35..074903f 100644
--- a/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp
+++ b/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp
@@ -155,6 +155,16 @@
     doc::test("test the getService (called in SetUp)");
 }
 
+TEST_F(AudioHidlTest, OpenDeviceInvalidParameter) {
+    doc::test("test passing an invalid parameter to openDevice");
+    IDevicesFactory::Result result;
+    sp<IDevice> device;
+    ASSERT_OK(devicesFactory->openDevice(IDevicesFactory::Device(-1),
+                                         returnIn(result, device)));
+    ASSERT_EQ(IDevicesFactory::Result::INVALID_ARGUMENTS, result);
+    ASSERT_TRUE(device == nullptr);
+}
+
 //////////////////////////////////////////////////////////////////////////////
 /////////////////////////////// openDevice primary ///////////////////////////
 //////////////////////////////////////////////////////////////////////////////
@@ -498,6 +508,11 @@
     testDebugDump([this](const auto& handle){ return device->debugDump(handle); });
 }
 
+TEST_F(AudioPrimaryHidlTest, debugDumpInvalidArguments) {
+    doc::test("Check that the hal dump doesn't crash on invalid arguments");
+    ASSERT_OK(device->debugDump(hidl_handle()));
+}
+
 //////////////////////////////////////////////////////////////////////////////
 ////////////////////////// open{Output,Input}Stream //////////////////////////
 //////////////////////////////////////////////////////////////////////////////
@@ -809,6 +824,10 @@
                "Check that a stream can dump its state without error",
                testDebugDump([this](const auto& handle){ return stream->debugDump(handle); }))
 
+TEST_IO_STREAM(DebugDumpInvalidArguments,
+               "Check that the stream dump doesn't crash on invalid arguments",
+               ASSERT_OK(stream->debugDump(hidl_handle())))
+
 //////////////////////////////////////////////////////////////////////////////
 ////////////////////////////// addRemoveEffect ///////////////////////////////
 //////////////////////////////////////////////////////////////////////////////
diff --git a/audio/effect/2.0/default/EffectsFactory.cpp b/audio/effect/2.0/default/EffectsFactory.cpp
index 08d92bd..922a922 100644
--- a/audio/effect/2.0/default/EffectsFactory.cpp
+++ b/audio/effect/2.0/default/EffectsFactory.cpp
@@ -186,7 +186,7 @@
 }
 
 Return<void> EffectsFactory::debugDump(const hidl_handle& fd)  {
-    if (fd->numFds == 1) {
+    if (fd.getNativeHandle() != nullptr && fd->numFds == 1) {
         EffectDumpEffects(fd->data[0]);
     }
     return Void();
diff --git a/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp b/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp
index 15a564a..18e9862 100644
--- a/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp
+++ b/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp
@@ -47,6 +47,7 @@
 using android::hardware::MQDescriptorSync;
 using android::hardware::Return;
 using android::hardware::Void;
+using android::hardware::hidl_handle;
 using android::hardware::hidl_memory;
 using android::hardware::hidl_string;
 using android::hardware::hidl_vec;
@@ -142,6 +143,12 @@
   EXPECT_TRUE(ret.isOk());
 }
 
+TEST_F(AudioEffectsFactoryHidlTest, DebugDumpInvalidArgument) {
+    description("Verify that debugDump doesn't crash on invalid arguments");
+    Return<void> ret = effectsFactory->debugDump(hidl_handle());
+    ASSERT_TRUE(ret.isOk());
+}
+
 // Equalizer effect is required by CDD, but only the type is fixed.
 // This is the same UUID as AudioEffect.EFFECT_TYPE_EQUALIZER in Java.
 static const Uuid EQUALIZER_EFFECT_TYPE = {
diff --git a/automotive/vehicle/2.0/default/Android.mk b/automotive/vehicle/2.0/default/Android.mk
index 3c56159..ee6d134 100644
--- a/automotive/vehicle/2.0/default/Android.mk
+++ b/automotive/vehicle/2.0/default/Android.mk
@@ -98,6 +98,7 @@
     $(vhal_v2_0) \
 
 LOCAL_STATIC_LIBRARIES := \
+    libqemu_pipe \
     $(vhal_v2_0)-libproto-native \
 
 LOCAL_CFLAGS += -Wall -Wextra -Werror
@@ -162,6 +163,7 @@
     $(vhal_v2_0)-manager-lib \
     $(vhal_v2_0)-default-impl-lib \
     $(vhal_v2_0)-libproto-native \
+    libqemu_pipe \
 
 LOCAL_CFLAGS += -Wall -Wextra -Werror
 
diff --git a/automotive/vehicle/2.0/default/common/src/VehicleUtils.cpp b/automotive/vehicle/2.0/default/common/src/VehicleUtils.cpp
index 311cdef..9146fa1 100644
--- a/automotive/vehicle/2.0/default/common/src/VehicleUtils.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VehicleUtils.cpp
@@ -102,10 +102,10 @@
 }
 
 void shallowCopyHidlStr(hidl_string* dest, const hidl_string& src) {
-    if (!src.empty()) {
+    if (src.empty()) {
+        dest->clear();
+    } else {
         dest->setToExternal(src.c_str(), src.size());
-    } else if (dest->size() > 0) {
-        dest->setToExternal(0, 0);
     }
 }
 
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
index 2b15aa3..5a9b254 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
@@ -17,9 +17,8 @@
 #define LOG_TAG "PipeComm"
 
 #include <android/hardware/automotive/vehicle/2.0/IVehicle.h>
-#include <android/log.h>
 #include <log/log.h>
-#include <system/qemu_pipe.h>
+#include <qemu_pipe.h>
 
 #include "PipeComm.h"
 
diff --git a/automotive/vehicle/2.1/Android.mk b/automotive/vehicle/2.1/Android.mk
index 693fe2d..8e1c0dd 100644
--- a/automotive/vehicle/2.1/Android.mk
+++ b/automotive/vehicle/2.1/Android.mk
@@ -208,9 +208,9 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (VmsMessageIntegerValuesIndex)
+# Build types.hal (VmsBaseMessageIntegerValuesIndex)
 #
-GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsMessageIntegerValuesIndex.java
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsBaseMessageIntegerValuesIndex.java
 $(GEN): $(HIDL)
 $(GEN): PRIVATE_HIDL := $(HIDL)
 $(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
@@ -220,7 +220,7 @@
         -Ljava \
         -randroid.hardware:hardware/interfaces \
         -randroid.hidl:system/libhidl/transport \
-        android.hardware.automotive.vehicle@2.1::types.VmsMessageIntegerValuesIndex
+        android.hardware.automotive.vehicle@2.1::types.VmsBaseMessageIntegerValuesIndex
 
 $(GEN): $(LOCAL_PATH)/types.hal
 	$(transform-generated-source)
@@ -246,6 +246,63 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (VmsOfferingMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsOfferingMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsOfferingMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSimpleMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSimpleMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSimpleMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSubscriptionResponseFormat)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSubscriptionResponseFormat.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSubscriptionResponseFormat
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build IVehicle.hal
 #
 GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/IVehicle.java
@@ -472,9 +529,9 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (VmsMessageIntegerValuesIndex)
+# Build types.hal (VmsBaseMessageIntegerValuesIndex)
 #
-GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsMessageIntegerValuesIndex.java
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsBaseMessageIntegerValuesIndex.java
 $(GEN): $(HIDL)
 $(GEN): PRIVATE_HIDL := $(HIDL)
 $(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
@@ -484,7 +541,7 @@
         -Ljava \
         -randroid.hardware:hardware/interfaces \
         -randroid.hidl:system/libhidl/transport \
-        android.hardware.automotive.vehicle@2.1::types.VmsMessageIntegerValuesIndex
+        android.hardware.automotive.vehicle@2.1::types.VmsBaseMessageIntegerValuesIndex
 
 $(GEN): $(LOCAL_PATH)/types.hal
 	$(transform-generated-source)
@@ -510,6 +567,63 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (VmsOfferingMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsOfferingMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsOfferingMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSimpleMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSimpleMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSimpleMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSubscriptionResponseFormat)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSubscriptionResponseFormat.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSubscriptionResponseFormat
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build IVehicle.hal
 #
 GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/IVehicle.java
diff --git a/automotive/vehicle/2.1/default/Android.mk b/automotive/vehicle/2.1/default/Android.mk
index 32ec456..f19263c 100644
--- a/automotive/vehicle/2.1/default/Android.mk
+++ b/automotive/vehicle/2.1/default/Android.mk
@@ -65,6 +65,7 @@
 LOCAL_STATIC_LIBRARIES := \
     $(vhal_v2_0)-default-impl-lib \
     $(vhal_v2_0)-manager-lib \
+    libqemu_pipe \
     $(vhal_v2_1)-manager-lib \
     $(vhal_v2_0)-libproto-native
 
@@ -101,6 +102,7 @@
     $(vhal_v2_0)-manager-lib \
     $(vhal_v2_0)-default-impl-lib \
     $(vhal_v2_1)-default-impl-lib \
+    libqemu_pipe \
     $(vhal_v2_1)-manager-lib \
 
 LOCAL_SHARED_LIBRARIES := \
diff --git a/automotive/vehicle/2.1/default/impl/vhal_v2_1/EmulatedVehicleHal.cpp b/automotive/vehicle/2.1/default/impl/vhal_v2_1/EmulatedVehicleHal.cpp
index 4dceae0..1d19aa2 100644
--- a/automotive/vehicle/2.1/default/impl/vhal_v2_1/EmulatedVehicleHal.cpp
+++ b/automotive/vehicle/2.1/default/impl/vhal_v2_1/EmulatedVehicleHal.cpp
@@ -139,6 +139,8 @@
     for (auto&& dtc : sampleDtcs) {
         auto freezeFrame = createVehiclePropValue(V2_0::VehiclePropertyType::COMPLEX, 0);
         sensorStore->fillPropValue(dtc, freezeFrame.get());
+        freezeFrame->prop = OBD2_FREEZE_FRAME;
+
         mPropStore->writeValue(*freezeFrame);
     }
 }
diff --git a/automotive/vehicle/2.1/types.hal b/automotive/vehicle/2.1/types.hal
index 08dc144..7be611c 100644
--- a/automotive/vehicle/2.1/types.hal
+++ b/automotive/vehicle/2.1/types.hal
@@ -584,22 +584,70 @@
 
   /** A client publishes a data packet. */
   DATA = 3,
+
+  /* A client declaring layers offering. */
+  OFFERING = 4,
+
+  /* Requesting the list of available layers. */
+  AVAILABILITY_REQUEST = 5,
+
+  /* Returning the list of available layers. */
+  AVAILABILITY_RESPONSE = 6,
+
+  /** Requesting layers that have subscribers. */
+  SUBSCRIPTION_REQUEST = 7,
+
+  /** Returning layers that have subscribers. */
+  SUBSCRIPTION_RESPONSE = 8,
 };
 
 /**
  * This enum provides the canonical mapping for VMS properties that have an
  * integer value.
  */
-enum VmsMessageIntegerValuesIndex : int32_t {
-  /** The message type as enumerated by VmsMessageType enum. */
+enum VmsBaseMessageIntegerValuesIndex : int32_t {
+  /* The message type as enumerated by VmsMessageType enum. */
   VMS_MESSAGE_TYPE = 0,
+};
 
-  /** The layer ID as defined in the vms protocol. */
+/*
+ * This enum provides the canonical mapping for VMS SUBMIT, UNSUBMIT and DATA
+ * messages integer value properties.
+ */
+enum VmsSimpleMessageIntegerValuesIndex : VmsBaseMessageIntegerValuesIndex {
+  /* The layer ID as defined in the vms protocol. */
   VMS_LAYER_ID = 1,
 
-  /** The version of the VMS layer. */
+  /* The version of the VMS layer. */
   VMS_LAYER_VERSION = 2,
+};
 
-  /** The number of bytes in the payload */
-  VMS_PAYLOAD_SIZE_BYTES = 3,
+/*
+ * This enum provides the canonical mapping for VMS offering messages integer
+ * value properties
+ */
+enum VmsOfferingMessageIntegerValuesIndex : VmsBaseMessageIntegerValuesIndex {
+  /* The number of VMS layer dependencies. */
+  VMS_NUMBER_OF_LAYERS_DEPENDENCIES = 1,
+
+  /* The first index that contain dependencies */
+  FIRST_DEPENDENCIES_INDEX = 2,
+};
+
+/**
+ * A VMS subscription request only contains its message type. The format of a VMS subscription
+ * response is described below.
+ */
+enum VmsSubscriptionResponseFormat : VmsBaseMessageIntegerValuesIndex {
+  /**
+    * Recipients should ignore any packet with a sequence number that is less than the highest
+    * sequence number they have seen thus far.
+    */
+  SEQUENCE_NUMBER = 1,
+
+  /** The number of VMS layers. Each layer has two integers: type and version. */
+  NUMBER_OF_LAYERS = 2,
+
+  /** The first index that contains a layer. */
+  FIRST_LAYER = 3,
 };
diff --git a/broadcastradio/1.1/ITuner.hal b/broadcastradio/1.1/ITuner.hal
index 82d45c6..dd7c844 100644
--- a/broadcastradio/1.1/ITuner.hal
+++ b/broadcastradio/1.1/ITuner.hal
@@ -47,8 +47,8 @@
      *
      * @return result OK if the scan was properly scheduled (this does not mean
      *                it successfully finished).
-     *                TEMPORARILY_UNAVAILABLE if the background scan is
-     *                temporarily unavailable, ie. due to ongoing foreground
+     *                UNAVAILABLE if the background scan is unavailable,
+     *                ie. temporarily due to ongoing foreground
      *                playback in single-tuner device.
      *                NOT_INITIALIZED other error, ie. HW failure.
      */
@@ -74,4 +74,33 @@
     getProgramList(string filter)
         generates (ProgramListResult result, vec<ProgramInfo> programList);
 
+    /**
+     * Checks, if the analog playback is forced, see setAnalogForced.
+     *
+     * The isForced value is only valid if result was OK.
+     *
+     * @return result OK if the call succeeded and isForced is valid.
+     *                INVALID_STATE if the switch is not supported at current
+     *                configuration.
+     *                NOT_INITIALIZED if any other error occurs.
+     * @return isForced true if analog is forced, false otherwise.
+     */
+    isAnalogForced() generates (Result result, bool isForced);
+
+    /**
+     * Forces the analog playback for the supporting radio technology.
+     *
+     * User may disable digital playback for FM HD Radio or hybrid FM/DAB with
+     * this option. This is purely user choice, ie. does not reflect digital-
+     * analog handover managed from the HAL implementation side.
+     *
+     * Some radio technologies may not support this, ie. DAB.
+     *
+     * @param isForced true to force analog, false for a default behaviour.
+     * @return result OK if the setting was successfully done.
+     *                INVALID_STATE if the switch is not supported at current
+     *                configuration.
+     *                NOT_INITIALIZED if any other error occurs.
+     */
+    setAnalogForced(bool isForced) generates (Result result);
 };
diff --git a/broadcastradio/1.1/ITunerCallback.hal b/broadcastradio/1.1/ITunerCallback.hal
index 07ce984..158e217 100644
--- a/broadcastradio/1.1/ITunerCallback.hal
+++ b/broadcastradio/1.1/ITunerCallback.hal
@@ -40,11 +40,19 @@
     oneway afSwitch_1_1(ProgramInfo info);
 
     /**
+     * Called by the HAL when background scan feature becomes available or not.
+     *
+     * @param isAvailable true, if the tuner turned temporarily background-
+     *                    capable, false in the other case.
+     */
+    oneway backgroundScanAvailable(bool isAvailable);
+
+    /**
      * Called by the HAL when background scan initiated by startBackgroundScan
      * finishes. If the list was changed, programListChanged must be called too.
      * @param result OK if the scan succeeded, client may retrieve the actual
      *               list with ITuner::getProgramList.
-     *               TEMPORARILY_UNAVAILABLE if the scan was interrupted due to
+     *               UNAVAILABLE if the scan was interrupted due to
      *               hardware becoming temporarily unavailable.
      *               NOT_INITIALIZED other error, ie. HW failure.
      */
diff --git a/broadcastradio/1.1/default/Tuner.cpp b/broadcastradio/1.1/default/Tuner.cpp
index f280754..4a6c691 100644
--- a/broadcastradio/1.1/default/Tuner.cpp
+++ b/broadcastradio/1.1/default/Tuner.cpp
@@ -211,6 +211,17 @@
     return Void();
 }
 
+Return<void> Tuner::isAnalogForced(isAnalogForced_cb _hidl_cb) {
+    // TODO(b/34348946): do the actual implementation.
+    _hidl_cb(Result::NOT_INITIALIZED, false);
+    return Void();
+}
+
+Return<Result> Tuner::setAnalogForced(bool isForced __unused) {
+    // TODO(b/34348946): do the actual implementation.
+    return Result::NOT_INITIALIZED;
+}
+
 } // namespace implementation
 }  // namespace V1_1
 }  // namespace broadcastradio
diff --git a/broadcastradio/1.1/default/Tuner.h b/broadcastradio/1.1/default/Tuner.h
index d7b4545..57eafd3 100644
--- a/broadcastradio/1.1/default/Tuner.h
+++ b/broadcastradio/1.1/default/Tuner.h
@@ -44,6 +44,8 @@
     Return<void> getProgramInformation_1_1(getProgramInformation_1_1_cb _hidl_cb) override;
     Return<ProgramListResult> startBackgroundScan() override;
     Return<void> getProgramList(const hidl_string& filter, getProgramList_cb _hidl_cb) override;
+    Return<void> isAnalogForced(isAnalogForced_cb _hidl_cb) override;
+    Return<Result> setAnalogForced(bool isForced) override;
 
     static void callback(radio_hal_event_t *halEvent, void *cookie);
     void onCallback(radio_hal_event_t *halEvent);
diff --git a/broadcastradio/1.1/types.hal b/broadcastradio/1.1/types.hal
index 3021f2e..5577ea0 100644
--- a/broadcastradio/1.1/types.hal
+++ b/broadcastradio/1.1/types.hal
@@ -23,7 +23,7 @@
 enum ProgramListResult : Result {
     NOT_READY,
     NOT_STARTED,
-    TEMPORARILY_UNAVAILABLE,
+    UNAVAILABLE,
 };
 
 /**
@@ -53,6 +53,18 @@
      * it may not be available though, see startBackgroundScan.
      */
     bool supportsBackgroundScanning;
+
+    /**
+     * Opaque vendor-specific string, to be passed to front-end without changes.
+     * Format of this string can vary across vendors.
+     *
+     * It may be used for extra features, that's not supported by a platform,
+     * for example: "preset-slots=6;ultra-hd-capable=false".
+     *
+     * Front-end application MUST verify vendor/product name from the
+     * @1.0::Properties struct before doing any interpretation of this value.
+     */
+    string vendorExension;
 };
 
 /**
@@ -64,10 +76,14 @@
     bitfield<ProgramInfoFlags> flags;
 
     /**
-     * Vendors are allowed to define their own set of flags and store it in this
-     * field. They MUST verify vendor/product name from Properties struct
-     * (IBroadcastRadio::getProperties) before doing any interpretation
-     * of such values.
+     * Opaque vendor-specific string, to be passed to front-end without changes.
+     * Format of this string can vary across vendors.
+     *
+     * It may be used for extra features, that's not supported by a platform,
+     * for example: "paid-service=true;bitrate=320kbps".
+     *
+     * Front-end application MUST verify vendor/product name from the
+     * @1.0::Properties struct before doing any interpretation of this value.
      */
-    uint32_t vendorFlags;
+    string vendorExension;
 };
diff --git a/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp b/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp
index d3c05c4..aa5ab54 100644
--- a/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp
+++ b/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp
@@ -129,6 +129,10 @@
             return Void();
         }
 
+        virtual Return<void> backgroundScanAvailable(bool isAvailable __unused) {
+            return Void();
+        }
+
         virtual Return<void> backgroundScanComplete(ProgramListResult result __unused) {
             return Void();
         }
diff --git a/camera/provider/2.4/default/Android.bp b/camera/provider/2.4/default/Android.bp
index 8e8df62..9506827 100644
--- a/camera/provider/2.4/default/Android.bp
+++ b/camera/provider/2.4/default/Android.bp
@@ -37,7 +37,6 @@
     shared_libs: [
         "libhidlbase",
         "libhidltransport",
-	"libbinder",
         "liblog",
         "libutils",
         "android.hardware.camera.device@1.0",
diff --git a/camera/provider/2.4/default/service.cpp b/camera/provider/2.4/default/service.cpp
index 7eeb637..df2602e 100644
--- a/camera/provider/2.4/default/service.cpp
+++ b/camera/provider/2.4/default/service.cpp
@@ -19,16 +19,11 @@
 #include <android/hardware/camera/provider/2.4/ICameraProvider.h>
 #include <hidl/LegacySupport.h>
 
-#include <binder/ProcessState.h>
-
 using android::hardware::camera::provider::V2_4::ICameraProvider;
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main()
 {
     ALOGI("Camera provider Service is starting.");
-    // The camera HAL may communicate to other vendor components via
-    // /dev/vndbinder
-    android::ProcessState::initWithDriver("/dev/vndbinder");
     return defaultPassthroughServiceImplementation<ICameraProvider>("legacy/0", /*maxThreads*/ 6);
 }
diff --git a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
index 04f2658..26641e8 100644
--- a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
@@ -16,7 +16,6 @@
 
 #define LOG_TAG "drm_hal_clearkey_test@1.0"
 
-#include <android-base/logging.h>
 #include <android/hardware/drm/1.0/ICryptoFactory.h>
 #include <android/hardware/drm/1.0/ICryptoPlugin.h>
 #include <android/hardware/drm/1.0/IDrmFactory.h>
@@ -27,8 +26,8 @@
 #include <hidl/HidlSupport.h>
 #include <hidlmemory/mapping.h>
 #include <log/log.h>
-#include <openssl/aes.h>
 #include <memory>
+#include <openssl/aes.h>
 #include <random>
 
 #include "VtsHalHidlTargetTestBase.h"
diff --git a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
index 33fb6fb..e2c9cca 100644
--- a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
@@ -16,7 +16,6 @@
 
 #define LOG_TAG "drm_hal_vendor_test@1.0"
 
-#include <android-base/logging.h>
 #include <android/hardware/drm/1.0/ICryptoFactory.h>
 #include <android/hardware/drm/1.0/ICryptoPlugin.h>
 #include <android/hardware/drm/1.0/IDrmFactory.h>
@@ -27,8 +26,8 @@
 #include <gtest/gtest.h>
 #include <hidlmemory/mapping.h>
 #include <log/log.h>
-#include <openssl/aes.h>
 #include <memory>
+#include <openssl/aes.h>
 #include <random>
 
 #include "drm_hal_vendor_module_api.h"
diff --git a/gnss/1.0/default/android.hardware.gnss@1.0-service.rc b/gnss/1.0/default/android.hardware.gnss@1.0-service.rc
index 96638a3..1f6d13e 100644
--- a/gnss/1.0/default/android.hardware.gnss@1.0-service.rc
+++ b/gnss/1.0/default/android.hardware.gnss@1.0-service.rc
@@ -1,4 +1,4 @@
 service gnss_service /vendor/bin/hw/android.hardware.gnss@1.0-service
-    class main
-    user system
+    class hal
+    user gps
     group system gps
diff --git a/graphics/composer/2.1/default/service.cpp b/graphics/composer/2.1/default/service.cpp
index aa0604a..712dac1 100644
--- a/graphics/composer/2.1/default/service.cpp
+++ b/graphics/composer/2.1/default/service.cpp
@@ -28,7 +28,6 @@
 
 int main() {
     // the conventional HAL might start binder services
-    android::ProcessState::initWithDriver("/dev/vndbinder");
     android::ProcessState::self()->setThreadPoolMaxThreadCount(4);
     android::ProcessState::self()->startThreadPool();
 
diff --git a/oemlock/1.0/Android.bp b/oemlock/1.0/Android.bp
new file mode 100644
index 0000000..6d471e9
--- /dev/null
+++ b/oemlock/1.0/Android.bp
@@ -0,0 +1,64 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+filegroup {
+    name: "android.hardware.oemlock@1.0_hal",
+    srcs: [
+        "types.hal",
+        "IOemLock.hal",
+    ],
+}
+
+genrule {
+    name: "android.hardware.oemlock@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.oemlock@1.0",
+    srcs: [
+        ":android.hardware.oemlock@1.0_hal",
+    ],
+    out: [
+        "android/hardware/oemlock/1.0/types.cpp",
+        "android/hardware/oemlock/1.0/OemLockAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.oemlock@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.oemlock@1.0",
+    srcs: [
+        ":android.hardware.oemlock@1.0_hal",
+    ],
+    out: [
+        "android/hardware/oemlock/1.0/types.h",
+        "android/hardware/oemlock/1.0/hwtypes.h",
+        "android/hardware/oemlock/1.0/IOemLock.h",
+        "android/hardware/oemlock/1.0/IHwOemLock.h",
+        "android/hardware/oemlock/1.0/BnHwOemLock.h",
+        "android/hardware/oemlock/1.0/BpHwOemLock.h",
+        "android/hardware/oemlock/1.0/BsOemLock.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.oemlock@1.0",
+    generated_sources: ["android.hardware.oemlock@1.0_genc++"],
+    generated_headers: ["android.hardware.oemlock@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.oemlock@1.0_genc++_headers"],
+    vendor_available: true,
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hidl.base@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/oemlock/1.0/Android.mk b/oemlock/1.0/Android.mk
new file mode 100644
index 0000000..d986441
--- /dev/null
+++ b/oemlock/1.0/Android.mk
@@ -0,0 +1,156 @@
+# This file is autogenerated by hidl-gen. Do not edit manually.
+
+LOCAL_PATH := $(call my-dir)
+
+################################################################################
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := android.hardware.oemlock-V1.0-java
+LOCAL_MODULE_CLASS := JAVA_LIBRARIES
+
+intermediates := $(call local-generated-sources-dir, COMMON)
+
+HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
+
+LOCAL_JAVA_LIBRARIES := \
+    android.hidl.base-V1.0-java \
+
+
+#
+# Build types.hal (OemLockSecureStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockSecureStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockSecureStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (OemLockStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IOemLock.hal
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/IOemLock.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IOemLock.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::IOemLock
+
+$(GEN): $(LOCAL_PATH)/IOemLock.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+include $(BUILD_JAVA_LIBRARY)
+
+
+################################################################################
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := android.hardware.oemlock-V1.0-java-static
+LOCAL_MODULE_CLASS := JAVA_LIBRARIES
+
+intermediates := $(call local-generated-sources-dir, COMMON)
+
+HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
+
+LOCAL_STATIC_JAVA_LIBRARIES := \
+    android.hidl.base-V1.0-java-static \
+
+
+#
+# Build types.hal (OemLockSecureStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockSecureStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockSecureStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (OemLockStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IOemLock.hal
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/IOemLock.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IOemLock.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::IOemLock
+
+$(GEN): $(LOCAL_PATH)/IOemLock.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+include $(BUILD_STATIC_JAVA_LIBRARY)
+
+
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/oemlock/1.0/IOemLock.hal b/oemlock/1.0/IOemLock.hal
new file mode 100644
index 0000000..d570123
--- /dev/null
+++ b/oemlock/1.0/IOemLock.hal
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.oemlock@1.0;
+
+/*
+ * The OEM lock prevents the bootloader from allowing the device to be flashed.
+ *
+ * Both the carrier and the device itself have a say as to whether OEM unlock is
+ * allowed and both must agree that is allowed in order for unlock to be
+ * possible.
+ */
+interface IOemLock {
+    /**
+     * Returns a vendor specific identifier of the HAL.
+     *
+     * The name returned must not be interpreted by the framework but must be
+     * passed to vendor code which may use it to identify the security protocol
+     * used by setOemUnlockAllowedByCarrier. This allows the vendor to identify
+     * the protocol without having to maintain a device-to-protocol mapping.
+     *
+     * @return name of the implementation.
+     */
+    getName() generates (OemLockStatus status, string name);
+
+    /**
+     * Updates whether OEM unlock is allowed by the carrier.
+     *
+     * The implementation may require a vendor defined signature to prove the
+     * validity of this request in order to harden its security.
+     *
+     * @param allowed is the new value of the flag.
+     * @param signature to prove validity of this request or empty if not
+     *        required.
+     * @return status is OK if the flag was successfully updated,
+     *         INVALID_SIGNATURE if a signature is required but the wrong one
+     *         was provided or FAILED if the update was otherwise unsuccessful.
+     */
+    setOemUnlockAllowedByCarrier(bool allowed, vec<uint8_t> signature)
+            generates (OemLockSecureStatus status);
+
+    /**
+     * Returns whether OEM unlock is allowed by the carrier.
+     *
+     * @return status is OK if the flag was successfully read.
+     * @return allowed is the current state of the flag.
+     */
+    isOemUnlockAllowedByCarrier() generates (OemLockStatus status, bool allowed);
+
+    /**
+     * Updates whether OEM unlock is allowed by the device.
+     *
+     * @param allowed is the new value of the flag.
+     * @return status is OK if the flag was successfully updated.
+     */
+    setOemUnlockAllowedByDevice(bool allowed) generates (OemLockStatus status);
+
+    /**
+     * Returns whether OEM unlock ia allowed by the device.
+     *
+     * @return status is OK if the flag was successfully read.
+     * @return allowed is the current state of the flag.
+     */
+    isOemUnlockAllowedByDevice() generates (OemLockStatus status, bool allowed);
+};
diff --git a/oemlock/1.0/types.hal b/oemlock/1.0/types.hal
new file mode 100644
index 0000000..0b4a8d1
--- /dev/null
+++ b/oemlock/1.0/types.hal
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.oemlock@1.0;
+
+enum OemLockStatus : uint32_t {
+    /** The operation completed successfully. */
+    OK,
+    /** The operation encountered a problem. */
+    FAILED,
+};
+
+enum OemLockSecureStatus : OemLockStatus {
+    /** An invalid signature was provided so the operation was not performed. */
+    INVALID_SIGNATURE,
+};
diff --git a/oemlock/Android.bp b/oemlock/Android.bp
new file mode 100644
index 0000000..bbb3e4b
--- /dev/null
+++ b/oemlock/Android.bp
@@ -0,0 +1,4 @@
+// This is an autogenerated file, do not edit.
+subdirs = [
+    "1.0",
+]
diff --git a/sensors/1.0/default/android.hardware.sensors@1.0-service.rc b/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
index 50cf787..c085552 100644
--- a/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
+++ b/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
@@ -1,4 +1,4 @@
 service sensors-hal-1-0 /vendor/bin/hw/android.hardware.sensors@1.0-service
-    class main
+    class hal
     user system
     group system
diff --git a/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp b/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp
index 3989c94..dfa11a1 100644
--- a/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp
+++ b/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp
@@ -68,10 +68,12 @@
       if (i < baseSize_) {
         EXPECT_EQ(names_[i], temperatures[i].name.c_str());
       } else {
-        // Names must be unique.
-        EXPECT_EQ(names_.end(), std::find(names_.begin(), names_.end(),
-                                          temperatures[i].name.c_str()));
-        names_.push_back(temperatures[i].name);
+          // Names must be unique only for known temperature types.
+          if (temperatures[i].type != TemperatureType::UNKNOWN) {
+              EXPECT_EQ(names_.end(), std::find(names_.begin(), names_.end(),
+                                                temperatures[i].name.c_str()));
+          }
+          names_.push_back(temperatures[i].name);
       }
     }
     baseSize_ = size;
@@ -88,10 +90,9 @@
       if (i < baseSize_) {
         EXPECT_EQ(names_[i], cpuUsages[i].name.c_str());
       } else {
-        // Names must be unique.
-        EXPECT_EQ(names_.end(), std::find(names_.begin(), names_.end(),
-                                          cpuUsages[i].name.c_str()));
-        names_.push_back(cpuUsages[i].name);
+          // Names are not guaranteed to be unique because of the current
+          // default Thermal HAL implementation.
+          names_.push_back(cpuUsages[i].name);
       }
     }
     baseSize_ = size;
diff --git a/weaver/1.0/Android.bp b/weaver/1.0/Android.bp
new file mode 100644
index 0000000..2a7b128
--- /dev/null
+++ b/weaver/1.0/Android.bp
@@ -0,0 +1,64 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+filegroup {
+    name: "android.hardware.weaver@1.0_hal",
+    srcs: [
+        "types.hal",
+        "IWeaver.hal",
+    ],
+}
+
+genrule {
+    name: "android.hardware.weaver@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.weaver@1.0",
+    srcs: [
+        ":android.hardware.weaver@1.0_hal",
+    ],
+    out: [
+        "android/hardware/weaver/1.0/types.cpp",
+        "android/hardware/weaver/1.0/WeaverAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.weaver@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.weaver@1.0",
+    srcs: [
+        ":android.hardware.weaver@1.0_hal",
+    ],
+    out: [
+        "android/hardware/weaver/1.0/types.h",
+        "android/hardware/weaver/1.0/hwtypes.h",
+        "android/hardware/weaver/1.0/IWeaver.h",
+        "android/hardware/weaver/1.0/IHwWeaver.h",
+        "android/hardware/weaver/1.0/BnHwWeaver.h",
+        "android/hardware/weaver/1.0/BpHwWeaver.h",
+        "android/hardware/weaver/1.0/BsWeaver.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.weaver@1.0",
+    generated_sources: ["android.hardware.weaver@1.0_genc++"],
+    generated_headers: ["android.hardware.weaver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.weaver@1.0_genc++_headers"],
+    vendor_available: true,
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hidl.base@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/weaver/1.0/Android.mk b/weaver/1.0/Android.mk
new file mode 100644
index 0000000..7f35b4e
--- /dev/null
+++ b/weaver/1.0/Android.mk
@@ -0,0 +1,232 @@
+# This file is autogenerated by hidl-gen. Do not edit manually.
+
+LOCAL_PATH := $(call my-dir)
+
+################################################################################
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := android.hardware.weaver-V1.0-java
+LOCAL_MODULE_CLASS := JAVA_LIBRARIES
+
+intermediates := $(call local-generated-sources-dir, COMMON)
+
+HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
+
+LOCAL_JAVA_LIBRARIES := \
+    android.hidl.base-V1.0-java \
+
+
+#
+# Build types.hal (WeaverConfig)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverConfig.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverConfig
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (WeaverReadResponse)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverReadResponse.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverReadResponse
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (WeaverReadStatus)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverReadStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverReadStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (WeaverStatus)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IWeaver.hal
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/IWeaver.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IWeaver.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::IWeaver
+
+$(GEN): $(LOCAL_PATH)/IWeaver.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+include $(BUILD_JAVA_LIBRARY)
+
+
+################################################################################
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := android.hardware.weaver-V1.0-java-static
+LOCAL_MODULE_CLASS := JAVA_LIBRARIES
+
+intermediates := $(call local-generated-sources-dir, COMMON)
+
+HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
+
+LOCAL_STATIC_JAVA_LIBRARIES := \
+    android.hidl.base-V1.0-java-static \
+
+
+#
+# Build types.hal (WeaverConfig)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverConfig.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverConfig
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (WeaverReadResponse)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverReadResponse.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverReadResponse
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (WeaverReadStatus)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverReadStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverReadStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (WeaverStatus)
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/WeaverStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::types.WeaverStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IWeaver.hal
+#
+GEN := $(intermediates)/android/hardware/weaver/V1_0/IWeaver.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IWeaver.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.weaver@1.0::IWeaver
+
+$(GEN): $(LOCAL_PATH)/IWeaver.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+include $(BUILD_STATIC_JAVA_LIBRARY)
+
+
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/weaver/1.0/IWeaver.hal b/weaver/1.0/IWeaver.hal
new file mode 100644
index 0000000..e572123
--- /dev/null
+++ b/weaver/1.0/IWeaver.hal
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.weaver@1.0;
+
+/**
+ * Weaver provides secure storage of secret values that may only be read if the
+ * corresponding key has been presented.
+ *
+ * The storage must be secure as the device's user authentication and encryption
+ * relies on the security of these values. The cardinality of the domains of the
+ * key and value must be suitably large such that they cannot be easily guessed.
+ *
+ * Weaver is structured as an array of slots, each containing a key-value pair.
+ * Slots are uniquely identified by an ID in the range [0, `getConfig().slots`).
+ */
+interface IWeaver {
+    /**
+     * Retrieves the config information for this implementation of Weaver.
+     *
+     * The config is static i.e. every invocation returns the same information.
+     *
+     * @return status is OK if the config was successfuly obtained.
+     * @return config data for this implementation of Weaver if status is OK,
+     *         otherwise undefined.
+     */
+    getConfig() generates (WeaverStatus status, WeaverConfig config);
+
+    /**
+     * Overwrites the identified slot with the provided key and value.
+     *
+     * The new values are written regardless of the current state of the slot in
+     * order to remain idempotent.
+     *
+     * @param slotId of the slot to write to.
+     * @param key to write to the slot.
+     * @param value to write to slot.
+     * @return status is OK if the write was successfully completed.
+     */
+    write(uint32_t slotId, vec<uint8_t> key, vec<uint8_t> value)
+                generates (WeaverStatus status);
+
+    /**
+     * Attempts to retrieve the value stored in the identified slot.
+     *
+     * The value is only returned if the provided key matches the key stored in
+     * the slot. The value is never returned if the wrong key is provided.
+     *
+     * Throttling must be used to limit the frequency of failed read attempts.
+     * The value is only returned when throttling is not active, even if the
+     * correct key is provided. If called when throttling is active, the time
+     * until the next attempt can be made is returned.
+     *
+     * @param slotId of the slot to read from.
+     * @param key that is stored in the slot.
+     * @return status is OK if the value was successfully read, INCORRECT_KEY if
+     *         the key does not match the key in the slot, THROTTLE if
+     *         throttling is active or FAILED if the read was unsuccessful for
+     *         another reason.
+     * @return readResponse contains the value read and the timeout to wait
+     *         before making the next request. If the status is OK, value is set
+     *         to the value in the slot and timeout is 0. Otherwise, value is
+     *         empty and timeout is set accordingly.
+     */
+    read(uint32_t slotId, vec<uint8_t> key)
+                generates (WeaverReadStatus status,
+                           WeaverReadResponse readResponse);
+};
diff --git a/weaver/1.0/types.hal b/weaver/1.0/types.hal
new file mode 100644
index 0000000..49e5c04
--- /dev/null
+++ b/weaver/1.0/types.hal
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.weaver@1.0;
+
+enum WeaverStatus : uint32_t {
+    OK,
+    FAILED,
+};
+
+struct WeaverConfig {
+    /** The number of slots available. */
+    uint32_t slots;
+    /** The number of bytes used for a key. */
+    uint32_t keySize;
+    /** The number of bytes used for a value. */
+    uint32_t valueSize;
+};
+
+enum WeaverReadStatus : WeaverStatus {
+    INCORRECT_KEY,
+    THROTTLE,
+};
+
+struct WeaverReadResponse {
+    /** The time to wait, in milliseconds, before making the next request. */
+    uint32_t timeout;
+    /** The value read from the slot or empty if the value was not read. */
+    vec<uint8_t> value;
+};
diff --git a/weaver/Android.bp b/weaver/Android.bp
new file mode 100644
index 0000000..bbb3e4b
--- /dev/null
+++ b/weaver/Android.bp
@@ -0,0 +1,4 @@
+// This is an autogenerated file, do not edit.
+subdirs = [
+    "1.0",
+]
diff --git a/wifi/1.0/default/hidl_struct_util.cpp b/wifi/1.0/default/hidl_struct_util.cpp
index 077dbb8..32206d8 100644
--- a/wifi/1.0/default/hidl_struct_util.cpp
+++ b/wifi/1.0/default/hidl_struct_util.cpp
@@ -914,7 +914,14 @@
   legacy_request->sid_beacon_val =
         (hidl_request.configParams.includePublishServiceIdsInBeacon ? 0x1 : 0x0)
             | (hidl_request.configParams.numberOfPublishServiceIdsInBeacon << 1);
-  // TODO: b/35195516 connect SubscribeServiceIds to legacy HAL once implemented
+  legacy_request->config_subscribe_sid_beacon = 1;
+  if (hidl_request.configParams.numberOfSubscribeServiceIdsInBeacon > 127) {
+    LOG(ERROR) << "convertHidlNanEnableRequestToLegacy: numberOfSubscribeServiceIdsInBeacon > 127";
+    return false;
+  }
+  legacy_request->subscribe_sid_beacon_val =
+        (hidl_request.configParams.includeSubscribeServiceIdsInBeacon ? 0x1 : 0x0)
+            | (hidl_request.configParams.numberOfSubscribeServiceIdsInBeacon << 1);
   legacy_request->config_rssi_window_size = 1;
   legacy_request->rssi_window_size_val = hidl_request.configParams.rssiWindowSize;
   legacy_request->config_disc_mac_addr_randomization = 1;
@@ -1321,7 +1328,14 @@
   }
   legacy_request->sid_beacon = (hidl_request.includePublishServiceIdsInBeacon ? 0x1 : 0x0)
         | (hidl_request.numberOfPublishServiceIdsInBeacon << 1);
-  // TODO: b/35195516 connect SubscribeServiceIds to legacy HAL once implemented
+  legacy_request->config_subscribe_sid_beacon = 1;
+  if (hidl_request.numberOfSubscribeServiceIdsInBeacon > 127) {
+    LOG(ERROR) << "convertHidlNanConfigRequestToLegacy: numberOfSubscribeServiceIdsInBeacon > 127";
+    return false;
+  }
+  legacy_request->subscribe_sid_beacon_val =
+        (hidl_request.includeSubscribeServiceIdsInBeacon ? 0x1 : 0x0)
+            | (hidl_request.numberOfSubscribeServiceIdsInBeacon << 1);
   legacy_request->config_rssi_window_size = 1;
   legacy_request->rssi_window_size_val = hidl_request.rssiWindowSize;
   legacy_request->config_disc_mac_addr_randomization = 1;
diff --git a/wifi/Android.bp b/wifi/Android.bp
index d4e0fda..523014f 100644
--- a/wifi/Android.bp
+++ b/wifi/Android.bp
@@ -2,5 +2,7 @@
 subdirs = [
     "1.0",
     "1.0/vts/functional",
+    "offload/1.0",
+    "offload/1.0/vts/functional",
     "supplicant/1.0",
 ]
diff --git a/wifi/offload/1.0/Android.bp b/wifi/offload/1.0/Android.bp
new file mode 100644
index 0000000..7ea8deb
--- /dev/null
+++ b/wifi/offload/1.0/Android.bp
@@ -0,0 +1,71 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+filegroup {
+    name: "android.hardware.wifi.offload@1.0_hal",
+    srcs: [
+        "types.hal",
+        "IOffload.hal",
+        "IOffloadCallback.hal",
+    ],
+}
+
+genrule {
+    name: "android.hardware.wifi.offload@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.wifi.offload@1.0",
+    srcs: [
+        ":android.hardware.wifi.offload@1.0_hal",
+    ],
+    out: [
+        "android/hardware/wifi/offload/1.0/types.cpp",
+        "android/hardware/wifi/offload/1.0/OffloadAll.cpp",
+        "android/hardware/wifi/offload/1.0/OffloadCallbackAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.wifi.offload@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.wifi.offload@1.0",
+    srcs: [
+        ":android.hardware.wifi.offload@1.0_hal",
+    ],
+    out: [
+        "android/hardware/wifi/offload/1.0/types.h",
+        "android/hardware/wifi/offload/1.0/hwtypes.h",
+        "android/hardware/wifi/offload/1.0/IOffload.h",
+        "android/hardware/wifi/offload/1.0/IHwOffload.h",
+        "android/hardware/wifi/offload/1.0/BnHwOffload.h",
+        "android/hardware/wifi/offload/1.0/BpHwOffload.h",
+        "android/hardware/wifi/offload/1.0/BsOffload.h",
+        "android/hardware/wifi/offload/1.0/IOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/IHwOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/BnHwOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/BpHwOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/BsOffloadCallback.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.wifi.offload@1.0",
+    generated_sources: ["android.hardware.wifi.offload@1.0_genc++"],
+    generated_headers: ["android.hardware.wifi.offload@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.wifi.offload@1.0_genc++_headers"],
+    vendor_available: true,
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hidl.base@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/wifi/offload/1.0/IOffload.hal b/wifi/offload/1.0/IOffload.hal
new file mode 100644
index 0000000..7ad902c
--- /dev/null
+++ b/wifi/offload/1.0/IOffload.hal
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.offload@1.0;
+
+import IOffloadCallback;
+
+interface IOffload {
+    /**
+     * Configure the offload module to perform scans and filter results
+     * Scans must not be triggered due to configuration of the module.
+     *
+     * @param ScanParam paramters for scanning
+     * @param ScanFilter settings to filter scan result
+     * @return boolean status indicating success (true) when configuration
+     *            is applied or failure (false) for invalid configuration
+     */
+    @entry
+    @callflow(next={"setEventCallback", "subscribeScanResults"})
+    configureScans(ScanParam param, ScanFilter filter);
+
+    /**
+     * Get scan statistics
+     *
+     * @return ScanStats statistics of scans performed
+     */
+    @exit
+    @callflow(next={"subscribeScanResults", "unsubscribeScanResults", "getScanStats"})
+    getScanStats() generates (ScanStats scanStats);
+
+    /**
+     * Subscribe to asynchronous scan events sent by offload module. This enables
+     * offload scans to be performed as per scan parameters, filtering the scan
+     * results based on configured scan filter and delivering the results after
+     * at least delayMs milliseconds from this call. If the client is already
+     * subscribed to the scan results, a call to this API must be a no-op.
+     *
+     * @param delayMs an integer expressing the minimum delay in mS after
+     *        subscribing when scan results must be delivered to the client
+     */
+    @callflow(next={"unsubscribeScanResults", "getScanStats"})
+    subscribeScanResults(uint32_t delayMs);
+
+    /**
+     * Unsubscribe to scan events sent by the offload module, hence disabling scans.
+     * If the client is already unsubscribed, a call to this API will be a no-op.
+     */
+    @exit
+    @callflow(next={"*"})
+    unsubscribeScanResults();
+
+    /**
+     * Setup the HIDL interface for reporting asynchronous scan events. A maximum
+     * of one callback interface is supported. Only one callback must be registered
+     * at any given time. If two consecutive calls are made with different callback
+     * interface objects, the latest one must be used to deliver events to client.
+     *
+     * @param cb An instance of the |IOffloadCallback| HIDL interface object
+     */
+    @entry
+    @callflow(next={"subscribeScanStats", "configureScans"})
+    setEventCallback(IOffloadCallback cb);
+};
diff --git a/wifi/offload/1.0/IOffloadCallback.hal b/wifi/offload/1.0/IOffloadCallback.hal
new file mode 100644
index 0000000..4888125
--- /dev/null
+++ b/wifi/offload/1.0/IOffloadCallback.hal
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.wifi.offload@1.0;
+
+interface IOffloadCallback {
+    /**
+     * Interface for the Offload HAL to return scan events to the client
+     *
+     * @param scanResult a vector of scan result objects
+     */
+    oneway onScanResult(vec<ScanResult> scanResult);
+    /**
+     * Interface for the Offload HAL to inform the client of error conditions
+     * see OffloadStatus for the error conditions to be reported
+     *
+     * @param status OffloadStatus
+     */
+    oneway onError(OffloadStatus status);
+};
diff --git a/wifi/offload/1.0/types.hal b/wifi/offload/1.0/types.hal
new file mode 100644
index 0000000..38d5eda
--- /dev/null
+++ b/wifi/offload/1.0/types.hal
@@ -0,0 +1,219 @@
+/*
+ * Copyright 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.wifi.offload@1.0;
+
+/**
+ * Defines a bitmap of security modes
+ */
+enum SecurityMode : uint8_t {
+    OPEN                    = 0x1 << 1,
+    WEP                     = 0x1 << 2,
+    PSK                     = 0x1 << 3,
+    EAP                     = 0x1 << 4,
+};
+
+/**
+ * SSID of the Access Point, maximum 32 characters
+ */
+typedef vec<uint8_t> Ssid;
+
+/**
+ * Preferred network information
+ * SSID and associated security mode(s)
+ */
+struct NetworkInfo {
+    Ssid ssid;
+    /* SecurityMode flags that are associated with this SSID
+     * More than one security mode can be supported, see SecurityMode */
+    bitfield<SecurityMode> flags;
+};
+
+/**
+ * This is a bit mask describing the capabilities of a BSS.
+ * See IEEE Std 802.11: 8.4.1.4
+ */
+enum Capability : uint16_t {
+    ESS                     = 1 << 0,
+    IBSS                    = 1 << 1,
+    CF_POLLABLE             = 1 << 2,
+    CF_PLL_REQ              = 1 << 3,
+    PRIVACY                 = 1 << 4,
+    SHORT_PREAMBLE          = 1 << 5,
+    PBCC                    = 1 << 6,
+    CHANNEL_AGILITY         = 1 << 7,
+    SPECTURM_MGMT           = 1 << 8,
+    QOS                     = 1 << 9,
+    SHORT_SLOT_TIME         = 1 << 10,
+    APSD                    = 1 << 11,
+    RADIO_MEASUREMENT       = 1 << 12,
+    DSSS_OFDM               = 1 << 13,
+    DELAYED_BLOCK_ACK       = 1 << 14,
+    IMMEDIATE_BLOCK_ACK     = 1 << 15,
+};
+
+/**
+ * Scan Results returned by the offload Hal
+ */
+struct ScanResult {
+    /* Information about this BSS
+     * SSID and security modes supported */
+    NetworkInfo networkInfo;
+    /* BSSID of the BSS */
+    uint8_t[6] bssid;
+    /* Can have multiple bits set, see Capability */
+    bitfield<Capability> capability;
+    /* Frequency scanned, in mHz */
+    uint32_t frequency;
+    /* Signal strength in dBm */
+    int8_t rssi;
+    /* TSF found in beacon/probe response */
+    uint64_t tsf;
+};
+
+
+/**
+ * Parameters for performing offload scans
+ */
+struct ScanParam {
+    /* Specify a list of SSIDs to scan, an empty list implies no preferred
+     * networks to scan */
+    vec<Ssid> ssidList;
+    /* Frequencies to scan, in mHz, an empty frequency list implies a full scan */
+    vec<uint32_t> frequencyList;
+    /* Periodicity of the scans to be performed by the offload module
+     * A value of zero indicates disable periodic scans. For this revision,
+     * where offload module is performing scans in disconnected mode, this value
+     * should not be zero. In future versions, periodic scans can be eliminated */
+    uint32_t disconnectedModeScanIntervalMs;
+};
+
+/**
+ * Instruction on how to filter the scan result before performing network
+ * selection and waking up the AP to connect
+ */
+struct ScanFilter {
+    /* Preferred network List of SSIDs and their security mode of interest
+     * The filter will drop the remaining scan results in the scan event.
+     * An empty list implies no filtering of scan result based on SSID and
+     * security mode. */
+    vec<NetworkInfo> preferredNetworkInfoList;
+    /* Minimum qualifying RSSI to be considered for network selection (dBm) */
+    int8_t rssiThreshold;
+};
+
+struct ScanRecord {
+    /* Amount of time spent scanning */
+    uint64_t durationMs;
+    /* Number of channels scanned */
+    uint32_t numChannelsScanned;
+    /* Number of entries aggregated into this record */
+    uint32_t numEntriesAggregated;
+};
+
+/**
+ * Enumerates the type of log that is recorded
+ */
+enum RecordName : uint32_t {
+    CMD_BASE                        = 0x00001000,
+    /* Record name corresponding to initialization */
+    CMD_INT                         = CMD_BASE + 0,
+   /* Record name corresponding to configureScans() API */
+    CMD_CONFIG_SCANS                = CMD_BASE + 1,
+    /* Record name corresponding to subscribeScanResults() API */
+    CMD_SUBSCRIBE_SCAN_RESULTS      = CMD_BASE + 2,
+    /* Record name corresponding to unsubscribeScanResults() API */
+    CMD_UNSUBSCRIBE_SCAN_RESULTS    = CMD_BASE + 3,
+    /* Record name corresponding to getScanStats() API */
+    CMD_GET_SCAN_STATS              = CMD_BASE + 4,
+    /* Record name corresponding to a reset*/
+    CMD_RESET                       = CMD_BASE + 5,
+    /* Add new commands here */
+    EVENT_RECVD_BASE                = 0x00002000,
+    /* Record name corresponding to scan monitor event*/
+    EVENT_RECVD_SCAN_RESULT_ASYNC   = EVENT_RECVD_BASE + 0,
+    /* Record name corresponding to scan response event */
+    EVENT_RECVD_SCAN_RESULT         = EVENT_RECVD_BASE + 1,
+    /* Add new events received here */
+    EVENT_SENT_BASE                 = 0x00003000,
+    /* Record name corresponding to scan event sent */
+    EVENT_SENT_SCAN_RESULT          = EVENT_SENT_BASE + 0,
+    /* Record name corresponding to abort event sent */
+    EVENT_SENT_ABORT                = EVENT_SENT_BASE + 1,
+    /* Record name corresponding to error event sent */
+    EVENT_SENT_ERROR                = EVENT_SENT_BASE + 2,
+    /* Add new events sent here */
+    REQ_BASE                        = 0x00004000,
+    /* Record name corresponding to scan request sent*/
+    REQ_SCAN                        = REQ_BASE + 0,
+    /* Add new requests here */
+};
+
+/**
+ * Defines the structure of each log record
+ */
+struct LogRecord {
+    /* Indicates the log recorded */
+    RecordName recordName;
+    /* Platform reference time in milliseconds when the log is recorded */
+    uint64_t logTimeMs;
+};
+
+/**
+ * Defines the scan statistics to be returned to the framework
+ */
+struct ScanStats {
+    /* Incremented everytime a new scan is requested */
+    uint32_t numScansRequestedByWifi;
+    /* Incremented everytime the scan is serviced by performing a scan*/
+    uint32_t numScansServicedByWifi;
+    /* Incremented everytime the scan is serviced by the scan cache */
+    uint32_t numScansServicedbyCache;
+    /* The last (CHRE reference) time this data structure is updated */
+    uint64_t lastUpdated;
+    /* The last (CHRE reference) time this data structure is read */
+    uint64_t lastRead;
+    /* The total time when the Offload module could be performing scans (T2 - T1)
+     * T1 - time when the framework subscribes for scan result (includes delayMs)
+     * T2 - min (time when the framework unsubscribes for scan result,
+     * currentTime) */
+    uint64_t subscriptionDurationMs;
+    /* Histograms of the channels scanned, 802.11 and with an 8 bit
+     * representation, only 256 channels are available */
+    uint8_t[256] histogramChannelsScanned;
+    /* Scan Record for this subscribe duration */
+    vec<ScanRecord> scanRecord;
+    /* Vector of the logRecord entries */
+    vec<LogRecord> logRecord;
+};
+
+/**
+ * Defines a list of return codes to indicate status of Offload HAL
+ */
+enum OffloadStatus : uint32_t {
+    /* No error */
+    OFFLOAD_STATUS_OK,
+    /* No Connection to underlying implementation */
+    OFFLOAD_STATUS_NO_CONNECTION,
+    /* Operation timeout */
+    OFFLOAD_STATUS_TIMEOUT,
+    /* Other errors */
+    OFFLOAD_STATUS_ERROR
+};
+
+
+
+
+
diff --git a/wifi/offload/1.0/vts/functional/Android.bp b/wifi/offload/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..f907a89
--- /dev/null
+++ b/wifi/offload/1.0/vts/functional/Android.bp
@@ -0,0 +1,36 @@
+//
+// Copyright (C) 2017 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalWifiOffloadV1_0TargetTest",
+    defaults: ["hidl_defaults"],
+    srcs: ["VtsHalWifiOffloadV1_0TargetTest.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libnativehelper",
+        "libutils",
+        "android.hardware.wifi.offload@1.0",
+    ],
+    static_libs: ["VtsHalHidlTargetTestBase"],
+    cflags: [
+        "-O0",
+        "-g",
+    ],
+}
diff --git a/wifi/offload/1.0/vts/functional/VtsHalWifiOffloadV1_0TargetTest.cpp b/wifi/offload/1.0/vts/functional/VtsHalWifiOffloadV1_0TargetTest.cpp
new file mode 100644
index 0000000..3020542
--- /dev/null
+++ b/wifi/offload/1.0/vts/functional/VtsHalWifiOffloadV1_0TargetTest.cpp
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "wifi_offload_hidl_hal_test"
+
+#include <android-base/logging.h>
+#include <android/hardware/wifi/offload/1.0/IOffload.h>
+#include <android/hardware/wifi/offload/1.0/IOffloadCallback.h>
+#include <android/hardware/wifi/offload/1.0/types.h>
+
+#include <VtsHalHidlTargetCallbackBase.h>
+#include <VtsHalHidlTargetTestBase.h>
+
+#include <vector>
+
+using ::android::hardware::wifi::offload::V1_0::IOffload;
+using ::android::hardware::wifi::offload::V1_0::IOffloadCallback;
+using ::android::hardware::wifi::offload::V1_0::ScanResult;
+using ::android::hardware::wifi::offload::V1_0::ScanParam;
+using ::android::hardware::wifi::offload::V1_0::ScanFilter;
+using ::android::hardware::wifi::offload::V1_0::ScanStats;
+using ::android::hardware::wifi::offload::V1_0::OffloadStatus;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::hidl_vec;
+using ::android::sp;
+
+constexpr char kOffloadCallbackSendScanResult[] = "onScanResult";
+constexpr char kOffloadCallbackSendError[] = "onError";
+
+namespace {
+const uint8_t kSsid[] = {'G', 'o', 'o', 'g', 'l', 'e'};
+const uint8_t kBssid[6] = {0x12, 0xef, 0xa1, 0x2c, 0x97, 0x8b};
+const int16_t kRssi = -60;
+const uint32_t kFrequency = 2412;
+const uint8_t kBssidSize = 6;
+const uint64_t kTsf = 0;
+const uint16_t kCapability = 0;
+const uint8_t kNetworkFlags = 0;
+}
+
+class OffloadCallbackArgs {
+   public:
+    hidl_vec<ScanResult> scan_results_;
+    OffloadStatus error_code_;
+};
+
+// The main test class for WifiOffload HIDL HAL.
+class WifiOffloadHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        wifi_offload_ =
+            ::testing::VtsHalHidlTargetTestBase::getService<IOffload>();
+        ASSERT_NE(wifi_offload_, nullptr);
+
+        wifi_offload_cb_ = new OffloadCallback();
+        ASSERT_NE(wifi_offload_cb_, nullptr);
+    }
+
+    virtual void TearDown() override {}
+
+    /* Callback class for Offload HAL. */
+    class OffloadCallback
+        : public ::testing::VtsHalHidlTargetCallbackBase<OffloadCallbackArgs>,
+          public IOffloadCallback {
+       public:
+        OffloadCallback(){};
+
+        virtual ~OffloadCallback() = default;
+
+        Return<void> onScanResult(
+            const hidl_vec<ScanResult>& scan_result) override {
+            OffloadCallbackArgs args;
+            args.scan_results_ = scan_result;
+            NotifyFromCallback(kOffloadCallbackSendScanResult, args);
+            return Void();
+        };
+
+        Return<void> onError(OffloadStatus status) {
+            OffloadCallbackArgs args;
+            args.error_code_ = status;
+            NotifyFromCallback(kOffloadCallbackSendError, args);
+            return Void();
+        }
+    };
+
+    sp<IOffload> wifi_offload_;
+    sp<OffloadCallback> wifi_offload_cb_;
+};
+
+/*
+ * Verify that setEventCallback method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, setEventCallback) {
+    auto returnObject = wifi_offload_->setEventCallback(wifi_offload_cb_);
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that subscribeScanResults method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, subscribeScanResults) {
+    auto returnObject = wifi_offload_->subscribeScanResults(0);
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that unsubscribeScanResults method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, unsubscribeScanResults) {
+    auto returnObject = wifi_offload_->unsubscribeScanResults();
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that configureScans method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, configureScans) {
+    ScanParam* pScanParam = new ScanParam();
+    ScanFilter* pScanFilter = new ScanFilter();
+    auto returnObject =
+        wifi_offload_->configureScans(*pScanParam, *pScanFilter);
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that getScanStats returns without any errors
+ */
+TEST_F(WifiOffloadHidlTest, getScanStats) {
+    ScanStats* pScanStats = new ScanStats();
+    const auto& returnObject =
+        wifi_offload_->getScanStats([pScanStats](ScanStats scanStats) -> void {
+            *pScanStats = std::move(scanStats);
+        });
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that onScanResult callback is invoked
+ */
+TEST_F(WifiOffloadHidlTest, getScanResults) {
+    wifi_offload_->setEventCallback(wifi_offload_cb_);
+    std::vector<ScanResult> scan_results;
+    std::vector<uint8_t> ssid(kSsid, kSsid + sizeof(kSsid));
+    ScanResult scan_result;
+    scan_result.tsf = kTsf;
+    scan_result.rssi = kRssi;
+    scan_result.frequency = kFrequency;
+    scan_result.capability = kCapability;
+    memcpy(&scan_result.bssid[0], &kBssid[0], kBssidSize);
+    scan_result.networkInfo.ssid = ssid;
+    scan_result.networkInfo.flags = kNetworkFlags;
+    scan_results.push_back(scan_result);
+    wifi_offload_cb_->onScanResult(scan_results);
+    auto res =
+        wifi_offload_cb_->WaitForCallback(kOffloadCallbackSendScanResult);
+    ASSERT_EQ(res.no_timeout, true);
+}
+
+/*
+ * Verify that onError callback is invoked
+ */
+TEST_F(WifiOffloadHidlTest, getError) {
+    wifi_offload_->setEventCallback(wifi_offload_cb_);
+    wifi_offload_cb_->onError(OffloadStatus::OFFLOAD_STATUS_ERROR);
+    auto res = wifi_offload_cb_->WaitForCallback(kOffloadCallbackSendError);
+    ASSERT_EQ(res.no_timeout, true);
+}
+
+// A class for test environment setup
+class WifiOffloadHalHidlEnvironment : public ::testing::Environment {
+   public:
+    virtual void SetUp() {}
+    virtual void TearDown() {}
+};
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(new WifiOffloadHalHidlEnvironment);
+    ::testing::InitGoogleTest(&argc, argv);
+
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+
+    return status;
+}