diff --git a/src/utils/list.h b/src/utils/list.h
index 85aa5e3..5298c26 100644
--- a/src/utils/list.h
+++ b/src/utils/list.h
@@ -46,12 +46,12 @@
 	item->prev = NULL;
 }
 
-static inline int dl_list_empty(struct dl_list *list)
+static inline int dl_list_empty(const struct dl_list *list)
 {
 	return list->next == list;
 }
 
-static inline unsigned int dl_list_len(struct dl_list *list)
+static inline unsigned int dl_list_len(const struct dl_list *list)
 {
 	struct dl_list *item;
 	int count = 0;
diff --git a/wpa_supplicant/hidl/1.4/hidl_manager.cpp b/wpa_supplicant/hidl/1.4/hidl_manager.cpp
index d7136a6..8325311 100644
--- a/wpa_supplicant/hidl/1.4/hidl_manager.cpp
+++ b/wpa_supplicant/hidl/1.4/hidl_manager.cpp
@@ -17,6 +17,7 @@
 extern "C" {
 #include "scan.h"
 #include "src/eap_common/eap_sim_common.h"
+#include "list.h"
 }
 
 namespace {
@@ -821,23 +822,33 @@
 	    sta_iface_object_map_.end())
 		return;
 
-	ISupplicantStaIfaceCallback::AnqpData hidl_anqp_data;
+	V1_4::ISupplicantStaIfaceCallback::AnqpData hidl_anqp_data;
 	ISupplicantStaIfaceCallback::Hs20AnqpData hidl_hs20_anqp_data;
 	if (std::string(result) == "SUCCESS") {
-		hidl_anqp_data.venueName =
+		hidl_anqp_data.V1_0.venueName =
 		    misc_utils::convertWpaBufToVector(anqp->venue_name);
-		hidl_anqp_data.roamingConsortium =
+		hidl_anqp_data.V1_0.roamingConsortium =
 		    misc_utils::convertWpaBufToVector(anqp->roaming_consortium);
-		hidl_anqp_data.ipAddrTypeAvailability =
+		hidl_anqp_data.V1_0.ipAddrTypeAvailability =
 		    misc_utils::convertWpaBufToVector(
 			anqp->ip_addr_type_availability);
-		hidl_anqp_data.naiRealm =
+		hidl_anqp_data.V1_0.naiRealm =
 		    misc_utils::convertWpaBufToVector(anqp->nai_realm);
-		hidl_anqp_data.anqp3gppCellularNetwork =
+		hidl_anqp_data.V1_0.anqp3gppCellularNetwork =
 		    misc_utils::convertWpaBufToVector(anqp->anqp_3gpp);
-		hidl_anqp_data.domainName =
+		hidl_anqp_data.V1_0.domainName =
 		    misc_utils::convertWpaBufToVector(anqp->domain_name);
 
+		struct wpa_bss_anqp_elem *elem;
+		dl_list_for_each(elem, &anqp->anqp_elems, struct wpa_bss_anqp_elem,
+				 list) {
+			if (elem->infoid == ANQP_VENUE_URL) {
+				hidl_anqp_data.venueUrl =
+						    misc_utils::convertWpaBufToVector(elem->payload);
+				break;
+			}
+		}
+
 		hidl_hs20_anqp_data.operatorFriendlyName =
 		    misc_utils::convertWpaBufToVector(
 			anqp->hs20_operator_friendly_name);
@@ -851,9 +862,9 @@
 			anqp->hs20_osu_providers_list);
 	}
 
-	callWithEachStaIfaceCallback(
+	callWithEachStaIfaceCallback_1_4(
 	    wpa_s->ifname, std::bind(
-			       &ISupplicantStaIfaceCallback::onAnqpQueryDone,
+			       &V1_4::ISupplicantStaIfaceCallback::onAnqpQueryDone_1_4,
 			       std::placeholders::_1, bssid, hidl_anqp_data,
 			       hidl_hs20_anqp_data));
 }
diff --git a/wpa_supplicant/hidl/1.4/hidl_manager.h b/wpa_supplicant/hidl/1.4/hidl_manager.h
index e3d6312..f027676 100644
--- a/wpa_supplicant/hidl/1.4/hidl_manager.h
+++ b/wpa_supplicant/hidl/1.4/hidl_manager.h
@@ -16,7 +16,7 @@
 #include <android/hardware/wifi/supplicant/1.0/ISupplicantCallback.h>
 #include <android/hardware/wifi/supplicant/1.0/ISupplicantP2pIfaceCallback.h>
 #include <android/hardware/wifi/supplicant/1.0/ISupplicantP2pNetworkCallback.h>
-#include <android/hardware/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.h>
+#include <android/hardware/wifi/supplicant/1.4/ISupplicantStaIfaceCallback.h>
 #include <android/hardware/wifi/supplicant/1.0/ISupplicantStaNetworkCallback.h>
 #include <android/hardware/wifi/supplicant/1.4/ISupplicantStaNetworkCallback.h>
 
diff --git a/wpa_supplicant/hidl/1.4/sta_iface.cpp b/wpa_supplicant/hidl/1.4/sta_iface.cpp
index 40ec870..47a75ad 100644
--- a/wpa_supplicant/hidl/1.4/sta_iface.cpp
+++ b/wpa_supplicant/hidl/1.4/sta_iface.cpp
@@ -402,7 +402,7 @@
 }
 Return<void> StaIface::initiateAnqpQuery(
     const hidl_array<uint8_t, 6> &mac_address,
-    const hidl_vec<ISupplicantStaIface::AnqpInfoId> &info_elements,
+    const hidl_vec<V1_0::ISupplicantStaIface::AnqpInfoId> &info_elements,
     const hidl_vec<ISupplicantStaIface::Hs20AnqpSubtypes> &sub_types,
     initiateAnqpQuery_cb _hidl_cb)
 {
@@ -412,6 +412,15 @@
 	    info_elements, sub_types);
 }
 
+Return<void> StaIface::initiateVenueUrlAnqpQuery(
+    const hidl_array<uint8_t, 6> &mac_address,
+	initiateVenueUrlAnqpQuery_cb _hidl_cb)
+{
+	return validateAndCall(
+	    this, V1_4::SupplicantStatusCode::FAILURE_IFACE_INVALID,
+	    &StaIface::initiateVenueUrlAnqpQueryInternal, _hidl_cb, mac_address);
+}
+
 Return<void> StaIface::initiateHs20IconQuery(
     const hidl_array<uint8_t, 6> &mac_address, const hidl_string &file_name,
     initiateHs20IconQuery_cb _hidl_cb)
@@ -978,6 +987,19 @@
 	return {SupplicantStatusCode::SUCCESS, ""};
 }
 
+V1_4::SupplicantStatus StaIface::initiateVenueUrlAnqpQueryInternal(
+    const std::array<uint8_t, 6> &mac_address)
+{
+	struct wpa_supplicant *wpa_s = retrieveIfacePtr();
+	uint16_t info_elems_buf[1] = {ANQP_VENUE_URL};
+
+	if (anqp_send_req(
+		wpa_s, mac_address.data(), 0, info_elems_buf, 1, 0, 0)) {
+		return {V1_4::SupplicantStatusCode::FAILURE_UNKNOWN, ""};
+	}
+	return {V1_4::SupplicantStatusCode::SUCCESS, ""};
+}
+
 SupplicantStatus StaIface::initiateHs20IconQueryInternal(
     const std::array<uint8_t, 6> &mac_address, const std::string &file_name)
 {
diff --git a/wpa_supplicant/hidl/1.4/sta_iface.h b/wpa_supplicant/hidl/1.4/sta_iface.h
index b6590d3..26a26d7 100644
--- a/wpa_supplicant/hidl/1.4/sta_iface.h
+++ b/wpa_supplicant/hidl/1.4/sta_iface.h
@@ -109,9 +109,12 @@
 	    initiateTdlsTeardown_cb _hidl_cb) override;
 	Return<void> initiateAnqpQuery(
 	    const hidl_array<uint8_t, 6>& mac_address,
-	    const hidl_vec<ISupplicantStaIface::AnqpInfoId>& info_elements,
+	    const hidl_vec<V1_0::ISupplicantStaIface::AnqpInfoId>& info_elements,
 	    const hidl_vec<ISupplicantStaIface::Hs20AnqpSubtypes>& sub_types,
 	    initiateAnqpQuery_cb _hidl_cb) override;
+	Return<void> initiateVenueUrlAnqpQuery(
+	    const hidl_array<uint8_t, 6>& mac_address,
+		initiateVenueUrlAnqpQuery_cb _hidl_cb) override;
 	Return<void> initiateHs20IconQuery(
 	    const hidl_array<uint8_t, 6>& mac_address,
 	    const hidl_string& file_name,
@@ -237,6 +240,8 @@
 	    const std::vector<ISupplicantStaIface::AnqpInfoId>& info_elements,
 	    const std::vector<ISupplicantStaIface::Hs20AnqpSubtypes>&
 		sub_types);
+	V1_4::SupplicantStatus initiateVenueUrlAnqpQueryInternal(
+	    const std::array<uint8_t, 6>& mac_address);
 	SupplicantStatus initiateHs20IconQueryInternal(
 	    const std::array<uint8_t, 6>& mac_address,
 	    const std::string& file_name);
diff --git a/wpa_supplicant/interworking.c b/wpa_supplicant/interworking.c
index c799b5a..3946252 100644
--- a/wpa_supplicant/interworking.c
+++ b/wpa_supplicant/interworking.c
@@ -2998,13 +2998,13 @@
 	case ANQP_VENUE_URL:
 		wpa_msg(wpa_s, MSG_INFO, RX_ANQP MACSTR " Venue URL",
 			MAC2STR(sa));
-		anqp_add_extra(wpa_s, anqp, info_id, pos, slen);
 
 		if (!pmf_in_use(wpa_s, sa)) {
 			wpa_printf(MSG_DEBUG,
 				   "ANQP: Ignore Venue URL since PMF was not enabled");
 			break;
 		}
+		anqp_add_extra(wpa_s, anqp, info_id, pos, slen);
 		interworking_parse_venue_url(wpa_s, pos, slen);
 		break;
 	case ANQP_VENDOR_SPECIFIC: