diff --git a/bluetooth/1.0/default/bluetooth_hci.cc b/bluetooth/1.0/default/bluetooth_hci.cc
index 1559119..6cea623 100644
--- a/bluetooth/1.0/default/bluetooth_hci.cc
+++ b/bluetooth/1.0/default/bluetooth_hci.cc
@@ -83,8 +83,7 @@
 
 void BluetoothHci::sendDataToController(const uint8_t type,
                                         const hidl_vec<uint8_t>& data) {
-  VendorInterface::get()->Send(&type, 1);
-  VendorInterface::get()->Send(data.data(), data.size());
+  VendorInterface::get()->Send(type, data.data(), data.size());
 }
 
 IBluetoothHci* HIDL_FETCH_IBluetoothHci(const char* /* name */) {
diff --git a/bluetooth/1.0/default/hci_internals.h b/bluetooth/1.0/default/hci_internals.h
index d839590..d5714be 100644
--- a/bluetooth/1.0/default/hci_internals.h
+++ b/bluetooth/1.0/default/hci_internals.h
@@ -42,3 +42,6 @@
 const size_t HCI_LENGTH_OFFSET_EVT = 1;
 
 const size_t HCI_PREAMBLE_SIZE_MAX = HCI_ACL_PREAMBLE_SIZE;
+
+// Event codes (Volume 2, Part E, 7.7.14)
+const uint8_t HCI_COMMAND_COMPLETE_EVENT = 0x0E;
diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
index 20b30ae..51a0add 100644
--- a/bluetooth/1.0/default/vendor_interface.cc
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -16,6 +16,8 @@
 
 #include "vendor_interface.h"
 
+#include <assert.h>
+
 #define LOG_TAG "android.hardware.bluetooth@1.0-impl"
 #include <android-base/logging.h>
 #include <cutils/properties.h>
@@ -38,6 +40,8 @@
 using android::hardware::hidl_vec;
 
 tINT_CMD_CBACK internal_command_cb;
+uint16_t internal_command_opcode;
+
 VendorInterface* g_vendor_interface = nullptr;
 
 const size_t preamble_size_for_type[] = {
@@ -47,11 +51,10 @@
     0, HCI_LENGTH_OFFSET_CMD, HCI_LENGTH_OFFSET_ACL, HCI_LENGTH_OFFSET_SCO,
     HCI_LENGTH_OFFSET_EVT};
 
-size_t HciGetPacketLengthForType(HciPacketType type,
-                                 const hidl_vec<uint8_t>& packet) {
+size_t HciGetPacketLengthForType(HciPacketType type, const uint8_t* preamble) {
   size_t offset = packet_length_offset_for_type[type];
-  if (type != HCI_PACKET_TYPE_ACL_DATA) return packet[offset];
-  return (((packet[offset + 1]) << 8) | packet[offset]);
+  if (type != HCI_PACKET_TYPE_ACL_DATA) return preamble[offset];
+  return (((preamble[offset + 1]) << 8) | preamble[offset]);
 }
 
 HC_BT_HDR* WrapPacketAndCopy(uint16_t event, const hidl_vec<uint8_t>& data) {
@@ -67,13 +70,54 @@
   return packet;
 }
 
+size_t write_safely(int fd, const uint8_t* data, size_t length) {
+  size_t transmitted_length = 0;
+  while (length > 0) {
+    ssize_t ret =
+        TEMP_FAILURE_RETRY(write(fd, data + transmitted_length, length));
+
+    if (ret == -1) {
+      if (errno == EAGAIN) continue;
+      ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
+      break;
+
+    } else if (ret == 0) {
+      // Nothing written :(
+      ALOGE("%s zero bytes written - something went wrong...", __func__);
+      break;
+    }
+
+    transmitted_length += ret;
+    length -= ret;
+  }
+
+  return transmitted_length;
+}
+
+bool internal_command_event_match(const hidl_vec<uint8_t>& packet) {
+  uint8_t event_code = packet[0];
+  if (event_code != HCI_COMMAND_COMPLETE_EVENT) {
+    ALOGE("%s: Unhandled event type %02X", __func__, event_code);
+    return false;
+  }
+
+  size_t opcode_offset = HCI_EVENT_PREAMBLE_SIZE + 1;  // Skip num packets.
+
+  uint16_t opcode = packet[opcode_offset] | (packet[opcode_offset + 1] << 8);
+
+  ALOGV("%s internal_command_opcode = %04X opcode = %04x", __func__,
+        internal_command_opcode, opcode);
+  return opcode == internal_command_opcode;
+}
+
 uint8_t transmit_cb(uint16_t opcode, void* buffer, tINT_CMD_CBACK callback) {
-  ALOGV("%s opcode: 0x%04x, ptr: %p", __func__, opcode, buffer);
+  ALOGV("%s opcode: 0x%04x, ptr: %p, cb: %p", __func__, opcode, buffer,
+        callback);
   internal_command_cb = callback;
+  internal_command_opcode = opcode;
   uint8_t type = HCI_PACKET_TYPE_COMMAND;
-  VendorInterface::get()->Send(&type, 1);
   HC_BT_HDR* bt_hdr = reinterpret_cast<HC_BT_HDR*>(buffer);
-  VendorInterface::get()->Send(bt_hdr->data, bt_hdr->len);
+  VendorInterface::get()->Send(type, bt_hdr->data, bt_hdr->len);
   return true;
 }
 
@@ -137,7 +181,7 @@
         std::chrono::steady_clock::now() - start_time_;
     double s = duration.count();
     if (s == 0) return;
-    ALOGD("Firmware configured in %.3fs", s);
+    ALOGI("Firmware configured in %.3fs", s);
   }
 
  private:
@@ -219,7 +263,7 @@
     return false;
   }
 
-  ALOGD("%s UART fd: %d", __func__, uart_fd_);
+  ALOGI("%s UART fd: %d", __func__, uart_fd_);
 
   fd_watcher_.WatchFdForNonBlockingReads(uart_fd_,
                                          [this](int fd) { OnDataReady(fd); });
@@ -252,35 +296,18 @@
   }
 }
 
-size_t VendorInterface::Send(const uint8_t* data, size_t length) {
+size_t VendorInterface::Send(uint8_t type, const uint8_t* data, size_t length) {
   if (uart_fd_ == INVALID_FD) return 0;
 
-  size_t transmitted_length = 0;
-  while (length > 0) {
-    ssize_t ret =
-        TEMP_FAILURE_RETRY(write(uart_fd_, data + transmitted_length, length));
+  int rv = write_safely(uart_fd_, &type, sizeof(type));
+  if (rv == sizeof(type))
+    rv = write_safely(uart_fd_, data, length);
 
-    if (ret == -1) {
-      if (errno == EAGAIN) continue;
-      ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
-      break;
-
-    } else if (ret == 0) {
-      // Nothing written :(
-      ALOGE("%s zero bytes written - something went wrong...", __func__);
-      break;
-    }
-
-    transmitted_length += ret;
-    length -= ret;
-  }
-
-  return transmitted_length;
+  return rv;
 }
 
 void VendorInterface::OnFirmwareConfigured(uint8_t result) {
   ALOGD("%s result: %d", __func__, result);
-  internal_command_cb = nullptr;
 
   if (firmware_startup_timer_ != nullptr) {
     delete firmware_startup_timer_;
@@ -303,9 +330,8 @@
       // TODO(eisenbach): Check for workaround(s)
       CHECK(hci_packet_type_ >= HCI_PACKET_TYPE_ACL_DATA &&
             hci_packet_type_ <= HCI_PACKET_TYPE_EVENT)
-          << "buffer[0] = " << buffer[0];
+          << "buffer[0] = " << static_cast<unsigned int>(buffer[0]);
       hci_parser_state_ = HCI_TYPE_READY;
-      hci_packet_.resize(HCI_PREAMBLE_SIZE_MAX);
       hci_packet_bytes_remaining_ = preamble_size_for_type[hci_packet_type_];
       hci_packet_bytes_read_ = 0;
       break;
@@ -313,16 +339,18 @@
 
     case HCI_TYPE_READY: {
       size_t bytes_read = TEMP_FAILURE_RETRY(
-          read(fd, hci_packet_.data() + hci_packet_bytes_read_,
+          read(fd, hci_packet_preamble_ + hci_packet_bytes_read_,
                hci_packet_bytes_remaining_));
       CHECK(bytes_read > 0);
       hci_packet_bytes_remaining_ -= bytes_read;
       hci_packet_bytes_read_ += bytes_read;
       if (hci_packet_bytes_remaining_ == 0) {
         size_t packet_length =
-            HciGetPacketLengthForType(hci_packet_type_, hci_packet_);
+            HciGetPacketLengthForType(hci_packet_type_, hci_packet_preamble_);
         hci_packet_.resize(preamble_size_for_type[hci_packet_type_] +
                            packet_length);
+        memcpy(hci_packet_.data(), hci_packet_preamble_,
+               preamble_size_for_type[hci_packet_type_]);
         hci_packet_bytes_remaining_ = packet_length;
         hci_parser_state_ = HCI_PAYLOAD;
         hci_packet_bytes_read_ = 0;
@@ -339,17 +367,18 @@
       hci_packet_bytes_remaining_ -= bytes_read;
       hci_packet_bytes_read_ += bytes_read;
       if (hci_packet_bytes_remaining_ == 0) {
-        if (internal_command_cb != nullptr) {
+        if (internal_command_cb != nullptr &&
+            hci_packet_type_ == HCI_PACKET_TYPE_EVENT &&
+            internal_command_event_match(hci_packet_)) {
           HC_BT_HDR* bt_hdr =
               WrapPacketAndCopy(HCI_PACKET_TYPE_EVENT, hci_packet_);
-          internal_command_cb(bt_hdr);
-        } else if (packet_read_cb_ != nullptr &&
-                   initialize_complete_cb_ == nullptr) {
-          packet_read_cb_(hci_packet_type_, hci_packet_);
+
+          // The callbacks can send new commands, so don't zero after calling.
+          tINT_CMD_CBACK saved_cb = internal_command_cb;
+          internal_command_cb = nullptr;
+          saved_cb(bt_hdr);
         } else {
-          ALOGE(
-              "%s HCI_PAYLOAD received without packet_read_cb or pending init.",
-              __func__);
+          packet_read_cb_(hci_packet_type_, hci_packet_);
         }
         hci_parser_state_ = HCI_IDLE;
       }
diff --git a/bluetooth/1.0/default/vendor_interface.h b/bluetooth/1.0/default/vendor_interface.h
index 450b99c..79611cd 100644
--- a/bluetooth/1.0/default/vendor_interface.h
+++ b/bluetooth/1.0/default/vendor_interface.h
@@ -42,14 +42,15 @@
   static void Shutdown();
   static VendorInterface *get();
 
-  size_t Send(const uint8_t *data, size_t length);
+  size_t Send(uint8_t type, const uint8_t *data, size_t length);
 
   void OnFirmwareConfigured(uint8_t result);
 
  private:
   virtual ~VendorInterface() = default;
 
-  bool Open(InitializeCompleteCallback initialize_complete_cb, PacketReadCallback packet_read_cb);
+  bool Open(InitializeCompleteCallback initialize_complete_cb,
+            PacketReadCallback packet_read_cb);
   void Close();
 
   void OnDataReady(int fd);
@@ -64,6 +65,7 @@
   enum HciParserState { HCI_IDLE, HCI_TYPE_READY, HCI_PAYLOAD };
   HciParserState hci_parser_state_{HCI_IDLE};
   HciPacketType hci_packet_type_{HCI_PACKET_TYPE_UNKNOWN};
+  uint8_t hci_packet_preamble_[HCI_PREAMBLE_SIZE_MAX];
   hidl_vec<uint8_t> hci_packet_;
   size_t hci_packet_bytes_remaining_;
   size_t hci_packet_bytes_read_;
diff --git a/drm/1.0/IDrmFactory.hal b/drm/1.0/IDrmFactory.hal
index de53929..f8e4779 100644
--- a/drm/1.0/IDrmFactory.hal
+++ b/drm/1.0/IDrmFactory.hal
@@ -50,10 +50,12 @@
      *
      * @param uuid uniquely identifies the drm scheme. See
      * http://dashif.org/identifiers/protection for uuid assignments
+     * @param appPackageName identifies the package name of the calling
+     * application.
      * @return status the status of the call. The HAL implementation must return
      * OK if the plugin is created and ERROR_DRM_CANNOT_HANDLE if the plugin
      * cannot be created.
      */
-    createPlugin(uint8_t[16] uuid) generates (Status status,
-            IDrmPlugin drmPlugin);
+    createPlugin(uint8_t[16] uuid, string appPackageName)
+            generates (Status status, IDrmPlugin drmPlugin);
 };
diff --git a/drm/1.0/default/CryptoFactory.cpp b/drm/1.0/default/CryptoFactory.cpp
index e46233d..13cad67 100644
--- a/drm/1.0/default/CryptoFactory.cpp
+++ b/drm/1.0/default/CryptoFactory.cpp
@@ -15,10 +15,11 @@
  */
 #define LOG_TAG "android.hardware.drm@1.0-impl"
 
+#include <utils/Log.h>
+
 #include "CryptoFactory.h"
 #include "CryptoPlugin.h"
 #include "TypeConvert.h"
-#include <utils/Log.h>
 
 namespace android {
 namespace hardware {
@@ -26,45 +27,63 @@
 namespace V1_0 {
 namespace implementation {
 
-    CryptoFactory::CryptoFactory() :
-        loader("/vendor/lib/mediadrm", "createCryptoFactory") {
-    }
+CryptoFactory::CryptoFactory() :
+    trebleLoader("/vendor/lib/hw", "createCryptoFactory"),
+    legacyLoader("/vendor/lib/mediadrm", "createCryptoFactory") {
+}
 
-    // Methods from ::android::hardware::drm::V1_0::ICryptoFactory follow.
-    Return<bool> CryptoFactory::isCryptoSchemeSupported(
-            const hidl_array<uint8_t, 16>& uuid) {
-        for (size_t i = 0; i < loader.factoryCount(); i++) {
-            if (loader.getFactory(i)->isCryptoSchemeSupported(uuid.data())) {
-                return true;
-            }
-        }
-        return false;
-    }
+// Methods from ::android::hardware::drm::V1_0::ICryptoFactory follow.
+Return<bool> CryptoFactory::isCryptoSchemeSupported(
+        const hidl_array<uint8_t, 16>& uuid) {
+    return isCryptoSchemeSupported(trebleLoader, uuid) ||
+            isCryptoSchemeSupported(legacyLoader, uuid);
+}
 
-    Return<void> CryptoFactory::createPlugin(const hidl_array<uint8_t, 16>& uuid,
-            const hidl_vec<uint8_t>& initData, createPlugin_cb _hidl_cb) {
-        for (size_t i = 0; i < loader.factoryCount(); i++) {
-            if (loader.getFactory(i)->isCryptoSchemeSupported(uuid.data())) {
-                android::CryptoPlugin *legacyPlugin = NULL;
-                status_t status = loader.getFactory(i)->createPlugin(uuid.data(),
-                        initData.data(), initData.size(), &legacyPlugin);
-                CryptoPlugin *newPlugin = NULL;
-                if (legacyPlugin == NULL) {
-                    ALOGE("Crypto legacy HAL: failed to create crypto plugin");
-                } else {
-                    newPlugin = new CryptoPlugin(legacyPlugin);
+Return<void> CryptoFactory::createPlugin(const hidl_array<uint8_t, 16>& uuid,
+        const hidl_vec<uint8_t>& initData, createPlugin_cb _hidl_cb) {
+    sp<ICryptoPlugin> plugin = createTreblePlugin(uuid, initData);
+    if (plugin == nullptr) {
+        plugin = createLegacyPlugin(uuid, initData);
+    }
+    _hidl_cb(plugin != nullptr ? Status::OK : Status::ERROR_DRM_CANNOT_HANDLE, plugin);
+    return Void();
+}
+
+sp<ICryptoPlugin> CryptoFactory::createTreblePlugin(const hidl_array<uint8_t, 16>& uuid,
+        const hidl_vec<uint8_t>& initData) {
+    sp<ICryptoPlugin> plugin;
+    for (size_t i = 0; i < trebleLoader.factoryCount(); i++) {
+        Return<void> hResult = trebleLoader.getFactory(i)->createPlugin(uuid, initData,
+                [&](Status status, const sp<ICryptoPlugin>& hPlugin) {
+                    if (status == Status::OK) {
+                        plugin = hPlugin;
+                    }
                 }
-                _hidl_cb(toStatus(status), newPlugin);
-                return Void();
-            }
+            );
+        if (plugin != nullptr) {
+            return plugin;
         }
-        _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, NULL);
-        return Void();
     }
+    return nullptr;
+}
 
-    ICryptoFactory* HIDL_FETCH_ICryptoFactory(const char* /* name */) {
-        return new CryptoFactory();
+sp<ICryptoPlugin> CryptoFactory::createLegacyPlugin(const hidl_array<uint8_t, 16>& uuid,
+        const hidl_vec<uint8_t>& initData) {
+    android::CryptoPlugin *legacyPlugin = nullptr;
+    for (size_t i = 0; i < legacyLoader.factoryCount(); i++) {
+        legacyLoader.getFactory(i)->createPlugin(uuid.data(),
+                initData.data(), initData.size(), &legacyPlugin);
+        if (legacyPlugin) {
+            return new CryptoPlugin(legacyPlugin);
+        }
     }
+    return nullptr;
+}
+
+
+ICryptoFactory* HIDL_FETCH_ICryptoFactory(const char* /* name */) {
+    return new CryptoFactory();
+}
 
 }  // namespace implementation
 }  // namespace V1_0
diff --git a/drm/1.0/default/CryptoFactory.h b/drm/1.0/default/CryptoFactory.h
index 412b557..d774406 100644
--- a/drm/1.0/default/CryptoFactory.h
+++ b/drm/1.0/default/CryptoFactory.h
@@ -41,8 +41,7 @@
     CryptoFactory();
     virtual ~CryptoFactory() {}
 
-    // Methods from ::android::hardware::drm::V1_0::ICryptoFactory follow.
-
+    // Methods from ::android::hardware::drmn::V1_0::ICryptoFactory follow.
     Return<bool> isCryptoSchemeSupported(const hidl_array<uint8_t, 16>& uuid)
             override;
 
@@ -51,7 +50,27 @@
             override;
 
 private:
-    android::PluginLoader<android::CryptoFactory> loader;
+    template <typename L> Return<bool> isCryptoSchemeSupported(
+            const L& loader, const hidl_array<uint8_t, 16>& uuid) {
+        for (size_t i = 0; i < loader.factoryCount(); i++) {
+           if (loader.getFactory(i)->isCryptoSchemeSupported(uuid.data())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    sp<ICryptoPlugin> createTreblePlugin(const hidl_array<uint8_t, 16>& uuid,
+                    const hidl_vec<uint8_t>& initData);
+
+    sp<ICryptoPlugin> createLegacyPlugin(const hidl_array<uint8_t, 16>& uuid,
+                    const hidl_vec<uint8_t>& initData);
+
+    typedef android::PluginLoader<ICryptoFactory> PluginLoader;
+    PluginLoader trebleLoader;
+
+    typedef android::PluginLoader<android::CryptoFactory> LegacyLoader;
+    LegacyLoader legacyLoader;
 
     CryptoFactory(const CryptoFactory &) = delete;
     void operator=(const CryptoFactory &) = delete;
diff --git a/drm/1.0/default/DrmFactory.cpp b/drm/1.0/default/DrmFactory.cpp
index b6f642f..c98c1da 100644
--- a/drm/1.0/default/DrmFactory.cpp
+++ b/drm/1.0/default/DrmFactory.cpp
@@ -15,10 +15,11 @@
  */
 #define LOG_TAG "android.hardware.drm@1.0-impl"
 
+#include <utils/Log.h>
+
 #include "DrmFactory.h"
 #include "DrmPlugin.h"
 #include "TypeConvert.h"
-#include <utils/Log.h>
 
 namespace android {
 namespace hardware {
@@ -26,56 +27,66 @@
 namespace V1_0 {
 namespace implementation {
 
-    DrmFactory::DrmFactory() :
-        loader("/vendor/lib/mediadrm", "createDrmFactory") {
-    }
+DrmFactory::DrmFactory() :
+    trebleLoader("/vendor/lib/hw", "createDrmFactory"),
+    legacyLoader("/vendor/lib/mediadrm", "createDrmFactory") {
+}
 
-    // Methods from ::android::hardware::drm::V1_0::IDrmFactory follow.
-    Return<bool> DrmFactory::isCryptoSchemeSupported (
-            const hidl_array<uint8_t, 16>& uuid) {
-        for (size_t i = 0; i < loader.factoryCount(); i++) {
-            if (loader.getFactory(i)->isCryptoSchemeSupported(uuid.data())) {
-                return true;
-            }
-        }
-        return false;
-    }
+// Methods from ::android::hardware::drm::V1_0::IDrmFactory follow.
+Return<bool> DrmFactory::isCryptoSchemeSupported(
+        const hidl_array<uint8_t, 16>& uuid) {
+    return isCryptoSchemeSupported(trebleLoader, uuid) ||
+            isCryptoSchemeSupported(legacyLoader, uuid);
+}
 
-    Return<bool> DrmFactory::isContentTypeSupported (
-            const hidl_string& mimeType) {
-        for (size_t i = 0; i < loader.factoryCount(); i++) {
-            if (loader.getFactory(i)->isContentTypeSupported(String8(mimeType.c_str()))) {
-                return true;
-            }
-        }
-        return false;
-    }
+Return<bool> DrmFactory::isContentTypeSupported (
+        const hidl_string& mimeType) {
+    return isContentTypeSupported<PluginLoader, hidl_string>(trebleLoader, mimeType) ||
+            isContentTypeSupported<LegacyLoader, String8>(legacyLoader, mimeType);
+}
 
     Return<void> DrmFactory::createPlugin(const hidl_array<uint8_t, 16>& uuid,
-            createPlugin_cb _hidl_cb) {
+            const hidl_string& appPackageName, createPlugin_cb _hidl_cb) {
+        sp<IDrmPlugin> plugin = createTreblePlugin(uuid, appPackageName);
+    if (plugin == nullptr) {
+        plugin = createLegacyPlugin(uuid);
+    }
+    _hidl_cb(plugin != nullptr ? Status::OK : Status::ERROR_DRM_CANNOT_HANDLE, plugin);
+    return Void();
+}
 
-        for (size_t i = 0; i < loader.factoryCount(); i++) {
-            if (loader.getFactory(i)->isCryptoSchemeSupported(uuid.data())) {
-                android::DrmPlugin *legacyPlugin = NULL;
-                status_t status = loader.getFactory(i)->createDrmPlugin(
-                        uuid.data(), &legacyPlugin);
-                DrmPlugin *newPlugin = NULL;
-                if (legacyPlugin == NULL) {
-                    ALOGE("Drm legacy HAL: failed to create drm plugin");
-                } else {
-                    newPlugin = new DrmPlugin(legacyPlugin);
+sp<IDrmPlugin> DrmFactory::createTreblePlugin(const hidl_array<uint8_t, 16>& uuid,
+        const hidl_string& appPackageName) {
+    sp<IDrmPlugin> plugin;
+    for (size_t i = 0; i < trebleLoader.factoryCount(); i++) {
+        Return<void> hResult = trebleLoader.getFactory(i)->createPlugin(uuid,
+                appPackageName, [&](Status status, const sp<IDrmPlugin>& hPlugin) {
+                    if (status == Status::OK) {
+                        plugin = hPlugin;
+                    }
                 }
-                _hidl_cb(toStatus(status), newPlugin);
-                return Void();
-            }
+            );
+        if (plugin != nullptr) {
+            return plugin;
         }
-        _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, NULL);
-        return Void();
     }
+    return nullptr;
+}
 
-    IDrmFactory* HIDL_FETCH_IDrmFactory(const char* /* name */) {
-        return new DrmFactory();
+sp<IDrmPlugin> DrmFactory::createLegacyPlugin(const hidl_array<uint8_t, 16>& uuid) {
+    android::DrmPlugin *legacyPlugin = nullptr;
+    for (size_t i = 0; i < legacyLoader.factoryCount(); i++) {
+        legacyLoader.getFactory(i)->createDrmPlugin(uuid.data(), &legacyPlugin);
+        if (legacyPlugin) {
+            return new DrmPlugin(legacyPlugin);
+        }
     }
+    return nullptr;
+}
+
+IDrmFactory* HIDL_FETCH_IDrmFactory(const char* /* name */) {
+    return new DrmFactory();
+}
 
 }  // namespace implementation
 }  // namespace V1_0
diff --git a/drm/1.0/default/DrmFactory.h b/drm/1.0/default/DrmFactory.h
index 78b7f6e..2e71624 100644
--- a/drm/1.0/default/DrmFactory.h
+++ b/drm/1.0/default/DrmFactory.h
@@ -42,18 +42,45 @@
     virtual ~DrmFactory() {}
 
     // Methods from ::android::hardware::drm::V1_0::IDrmFactory follow.
-
     Return<bool> isCryptoSchemeSupported(const hidl_array<uint8_t, 16>& uuid)
             override;
 
-    Return<bool> isContentTypeSupported(const hidl_string &mimeType)
+    Return<bool> isContentTypeSupported(const hidl_string& mimeType)
             override;
 
     Return<void> createPlugin(const hidl_array<uint8_t, 16>& uuid,
-            createPlugin_cb _hidl_cb) override;
+            const hidl_string& appPackageName, createPlugin_cb _hidl_cb) override;
 
 private:
-    android::PluginLoader<android::DrmFactory> loader;
+    template <typename L> Return<bool> isCryptoSchemeSupported(
+            const L& loader, const hidl_array<uint8_t, 16>& uuid) {
+        for (size_t i = 0; i < loader.factoryCount(); i++) {
+            if (loader.getFactory(i)->isCryptoSchemeSupported(uuid.data())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    template <typename L, typename S> Return<bool> isContentTypeSupported(
+            const L& loader, const hidl_string& mimeType) {
+        for (size_t i = 0; i < loader.factoryCount(); i++) {
+            if (loader.getFactory(i)->isContentTypeSupported(S(mimeType))) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    sp<IDrmPlugin> createTreblePlugin(const hidl_array<uint8_t, 16>& uuid,
+        const hidl_string& appPackageName);
+    sp<IDrmPlugin> createLegacyPlugin(const hidl_array<uint8_t, 16>& uuid);
+
+    typedef android::PluginLoader<IDrmFactory> PluginLoader;
+    PluginLoader trebleLoader;
+
+    typedef android::PluginLoader<android::DrmFactory> LegacyLoader;
+    LegacyLoader legacyLoader;
 
     DrmFactory(const DrmFactory &) = delete;
     void operator=(const DrmFactory &) = delete;
diff --git a/graphics/common/1.0/types.hal b/graphics/common/1.0/types.hal
index 6fddfaf..7663701 100644
--- a/graphics/common/1.0/types.hal
+++ b/graphics/common/1.0/types.hal
@@ -38,6 +38,16 @@
     BGRA_8888          = 5,
 
     /*
+     * The following formats use 10bit integers for R, G, and B and
+     * 2 bits for alpha. This is used to improve color precision on
+     * wide-color devices, e.g. Display-P3 or scRGB.
+     *
+     * When used with ANativeWindow, the dataSpace field describes the color
+     * space of the buffer.
+     */
+    RGBA_1010102       = 0x2B,
+
+    /*
      * The following formats use a 16bit float per color component.
      *
      * When used with ANativeWindow, the dataSpace field describes the color
@@ -322,6 +332,7 @@
      * -------------------------------+-----------------------------------------
      *  HAL_DATASPACE_JFIF            | An encoded JPEG image
      *  HAL_DATASPACE_DEPTH           | An android_depth_points buffer
+     *  HAL_DATASPACE_SENSOR          | Sensor event data.
      *  Other                         | Unsupported
      *
      */
@@ -1080,7 +1091,17 @@
      *       The point cloud will be represented with the android_depth_points
      *       structure.
      */
-    DEPTH = 0x1000
+    DEPTH = 0x1000,
+
+
+    /*
+     * The buffer contains sensor events from sensor direct report.
+     * This value is valid with formats:
+     *    HAL_PIXEL_FORMAT_BLOB: an array of sensor event structure that forms
+     *       a lock free queue. Format of sensor event structure is specified
+     *       in Sensors HAL.
+     */
+    SENSOR = 0x1001
 };
 
 /*
diff --git a/radio/1.0/IRadioIndication.hal b/radio/1.0/IRadioIndication.hal
index 79ebf30..fb8666f 100644
--- a/radio/1.0/IRadioIndication.hal
+++ b/radio/1.0/IRadioIndication.hal
@@ -342,10 +342,6 @@
    oneway exitEmergencyCallbackMode(RadioIndicationType type);
 
    /*
-    * TODO(Consider moving this to separate interface. Client will receive this function with an
-    * IRadioResponse interface so that all requests in that IRadioResponse will fail before
-    * rilConnected() is received)
-    *
     * Indicates the ril connects and returns the version
     *
     * @param type Type of radio indication
@@ -472,4 +468,4 @@
     *        restart" that explains the cause of the modem restart
     */
    oneway modemReset(RadioIndicationType type, string reason);
-};
\ No newline at end of file
+};
diff --git a/radio/1.0/types.hal b/radio/1.0/types.hal
index 593dc92..c0a6475 100644
--- a/radio/1.0/types.hal
+++ b/radio/1.0/types.hal
@@ -117,9 +117,6 @@
     ABORTED = 65,                         // Operation aborted
     INVALID_RESPONSE = 66,                // Response from vendor had invalid data
 
-    // TODO(May be moved to vendor HAL extension)
-    // OEM specific error codes. To be used by OEM when they don't want to reveal
-    // specific error codes which would be replaced by Generic failure.
     OEM_ERROR_1 = 501,
     OEM_ERROR_2 = 502,
     OEM_ERROR_3 = 503,
@@ -462,9 +459,6 @@
     AUTH_FAILURE_ON_EMERGENCY_CALL = 0x7A,
     OEM_DCFAILCAUSE_1 = 0x1001,
 
-    // OEM specific error codes. To be used by OEMs when they don't want to
-    // reveal error code which would be replaced by PDP_FAIL_ERROR_UNSPECIFIED
-    // TODO(May be moved to vendor HAL extension)
     OEM_DCFAILCAUSE_2 = 0x1002,
     OEM_DCFAILCAUSE_3 = 0x1003,
     OEM_DCFAILCAUSE_4 = 0x1004,
diff --git a/tv/Android.bp b/tv/Android.bp
index 5ad82f4..ac54910 100644
--- a/tv/Android.bp
+++ b/tv/Android.bp
@@ -2,4 +2,5 @@
 subdirs = [
     "cec/1.0",
     "input/1.0",
+    "input/1.0/vts/functional",
 ]
diff --git a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
index 5f7aaf1..7cb1b06 100644
--- a/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
+++ b/tv/cec/1.0/vts/functional/vts/testcases/hal/tv_cec/hidl/host/TvCecHidlTest.py
@@ -21,8 +21,10 @@
 from vts.runners.host import asserts
 from vts.runners.host import base_test_with_webdb
 from vts.runners.host import const
+from vts.runners.host import keys
 from vts.runners.host import test_runner
 from vts.utils.python.controllers import android_device
+from vts.utils.python.coverage import coverage_utils
 
 
 class TvCecHidlTest(base_test_with_webdb.BaseTestWithWebDbClass):
@@ -38,6 +40,9 @@
         self.dut.shell.one.Execute(
             "setprop vts.hal.vts.hidl.get_stub true")
 
+        if getattr(self, keys.ConfigKeys.IKEY_ENABLE_COVERAGE, False):
+            coverage_utils.InitializeDeviceCoverage(self.dut)
+
         self.dut.hal.InitHidlHal(
             target_type="tv_cec",
             target_basepaths=self.dut.libPaths,
@@ -47,6 +52,11 @@
             hw_binder_service_name="cec-hal-1-0",
             bits=64 if self.dut.is64Bit else 32)
 
+    def tearDownClass(self):
+        """To be executed when all test cases are finished."""
+        if getattr(self, keys.ConfigKeys.IKEY_ENABLE_COVERAGE, False):
+            self.SetCoverageData(coverage_utils.GetGcdaDict(self.dut))
+
     def testGetCecVersion1(self):
         """A simple test case which queries the cec version."""
         logging.info('DIR HAL %s', dir(self.dut.hal))
diff --git a/tv/input/1.0/vts/functional/Android.bp b/tv/input/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..979eb99
--- /dev/null
+++ b/tv/input/1.0/vts/functional/Android.bp
@@ -0,0 +1,43 @@
+//
+// Copyright (C) 2017 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "tv_input_hidl_hal_test",
+    gtest: true,
+    srcs: ["tv_input_hidl_hal_test.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libnativehelper",
+        "libutils",
+        "android.hardware.tv.input@1.0",
+    ],
+    static_libs: ["libgtest"],
+    cflags: [
+// TODO: add --coverage when the segfault issue is fixed.
+//        "--coverage",
+        "-O0",
+        "-g",
+    ],
+//    ldflags: [
+//        "--coverage"
+//    ]
+}
+
diff --git a/tv/input/1.0/vts/functional/tv_input_hidl_hal_test.cpp b/tv/input/1.0/vts/functional/tv_input_hidl_hal_test.cpp
new file mode 100644
index 0000000..1279ecd
--- /dev/null
+++ b/tv/input/1.0/vts/functional/tv_input_hidl_hal_test.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "tv_input_hidl_hal_test"
+#include <android-base/logging.h>
+
+#include <android/hardware/tv/input/1.0/types.h>
+#include <android/hardware/tv/input/1.0/ITvInput.h>
+#include <android/hardware/tv/input/1.0/ITvInputCallback.h>
+
+#include <gtest/gtest.h>
+
+using ::android::hardware::tv::input::V1_0::ITvInput;
+using ::android::hardware::tv::input::V1_0::ITvInputCallback;
+using ::android::hardware::tv::input::V1_0::Result;
+using ::android::hardware::tv::input::V1_0::TvInputType;
+using ::android::hardware::tv::input::V1_0::TvInputDeviceInfo;
+using ::android::hardware::tv::input::V1_0::TvInputEventType;
+using ::android::hardware::tv::input::V1_0::TvInputEvent;
+using ::android::hardware::tv::input::V1_0::TvStreamConfig;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::sp;
+
+
+// Simple ITvInputCallback used as part of testing.
+class TvInputCallback : public ITvInputCallback {
+  public:
+   TvInputCallback() {};
+
+   virtual ~TvInputCallback() = default;
+
+   // notify callback function - currently no-op.
+   // TODO: modify it later.
+   Return<void> notify(const TvInputEvent& event) override {
+     return Void();
+   };
+};
+
+
+// The main test class for TV Input HIDL HAL.
+class TvInputHidlTest : public ::testing::Test {
+ public:
+  virtual void SetUp() override {
+    // currently test passthrough mode only
+    tv_input = ITvInput::getService();
+    ASSERT_NE(tv_input, nullptr);
+
+    tv_input_callback = new TvInputCallback();
+    ASSERT_NE(tv_input_callback, nullptr);
+  }
+
+  virtual void TearDown() override {}
+
+  sp<ITvInput> tv_input;
+  sp<ITvInputCallback> tv_input_callback;
+};
+
+
+// A class for test environment setup.
+class TvInputHidlEnvironment : public ::testing::Environment {
+ public:
+  virtual void SetUp() {}
+  virtual void TearDown() {}
+
+ private:
+};
+
+// TODO: remove this test and add meaningful tests.
+TEST_F(TvInputHidlTest, DummyTest) {
+  EXPECT_NE(tv_input, nullptr);
+}
+
+int main(int argc, char **argv) {
+  ::testing::AddGlobalTestEnvironment(new TvInputHidlEnvironment);
+  ::testing::InitGoogleTest(&argc, argv);
+  int status = RUN_ALL_TESTS();
+  ALOGI("Test result = %d", status);
+  return status;
+}
+
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest.py b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest.py
index b5becd6..828b9dd 100644
--- a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest.py
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest.py
@@ -20,8 +20,10 @@
 from vts.runners.host import asserts
 from vts.runners.host import base_test_with_webdb
 from vts.runners.host import const
+from vts.runners.host import keys
 from vts.runners.host import test_runner
 from vts.utils.python.controllers import android_device
+from vts.utils.python.coverage import coverage_utils
 
 
 class TvInputHidlTest(base_test_with_webdb.BaseTestWithWebDbClass):
@@ -34,6 +36,9 @@
         self.dut.shell.InvokeTerminal("one")
         self.dut.shell.one.Execute("setenforce 0")  # SELinux permissive mode
 
+        if getattr(self, keys.ConfigKeys.IKEY_ENABLE_COVERAGE, False):
+            coverage_utils.InitializeDeviceCoverage(self.dut)
+
         self.dut.hal.InitHidlHal(target_type="tv_input",
                                  target_basepaths=["/system/lib64"],
                                  target_version=1.0,
@@ -43,6 +48,11 @@
 
         self.dut.shell.InvokeTerminal("one")
 
+    def tearDownClass(self):
+        """To be executed when all test cases are finished."""
+        if getattr(self, keys.ConfigKeys.IKEY_ENABLE_COVERAGE, False):
+            self.SetCoverageData(coverage_utils.GetGcdaDict(self.dut))
+
     def testGetStreamConfigurations(self):
         configs = self.dut.hal.tv_input.getStreamConfigurations(0)
         logging.info('return value of getStreamConfigurations(0): %s', configs)
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/target/Android.mk b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/target/Android.mk
new file mode 100644
index 0000000..153da0b
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/target/Android.mk
@@ -0,0 +1,26 @@
+#
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := HalTvInputHidlTargetTest
+VTS_CONFIG_SRC_DIR := testcases/hal/tv_input/hidl/target
+include test/vts/tools/build/Android.host_config.mk
+
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/target/AndroidTest.xml b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/target/AndroidTest.xml
new file mode 100644
index 0000000..4f98940
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/target/AndroidTest.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS TV Input HIDL HAL's target-side test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer" />
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="HalTvInputHidlTargetTest"/>
+        <option name="binary-test-sources" value="
+            _32bit::DATA/nativetest/tv_input_hidl_hal_test/tv_input_hidl_hal_test,
+            "/>
+        <option name="binary-test-type" value="gtest" />
+        <option name="test-timeout" value="1m" />
+    </test>
+</configuration>
+
diff --git a/vehicle/2.0/Android.mk b/vehicle/2.0/Android.mk
index 9544960..1dd0f45 100644
--- a/vehicle/2.0/Android.mk
+++ b/vehicle/2.0/Android.mk
@@ -1081,6 +1081,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (Wheel)
+#
+GEN := $(intermediates)/android/hardware/vehicle/V2_0/Wheel.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.vehicle@2.0::types.Wheel
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build IVehicle.hal
 #
 GEN := $(intermediates)/android/hardware/vehicle/V2_0/IVehicle.java
@@ -2205,6 +2224,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (Wheel)
+#
+GEN := $(intermediates)/android/hardware/vehicle/V2_0/Wheel.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.vehicle@2.0::types.Wheel
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build IVehicle.hal
 #
 GEN := $(intermediates)/android/hardware/vehicle/V2_0/IVehicle.java
diff --git a/vehicle/2.0/types.hal b/vehicle/2.0/types.hal
index fb59a5a..9fda4fd 100644
--- a/vehicle/2.0/types.hal
+++ b/vehicle/2.0/types.hal
@@ -226,6 +226,28 @@
         | VehicleArea:GLOBAL),
 
     /*
+     * Reports wheel rotational distance in meters since last wheel tick
+     * event
+     *
+     * The value is a vector each element represents distance for individual
+     * wheel in the following order: left front, right front, left rear,
+     * right rear. VehiclePropValue.timestamp must be correctly filled in.
+     *
+     * Vendors must specify wheels that support this sensor in
+     * VehiclePropConfig.configFlags. The format of this field is a bitset of
+     * values from Wheel enum.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE|VehiclePropertyChangeMode:CONTINUOUS
+     * @access VehiclePropertyAccess:READ
+     * @unit VehicleUnit:METER
+     */
+    WHEEL_TICK = (
+        0x0306
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:FLOAT_VEC
+        | VehicleArea:GLOBAL),
+
+    /*
      * Currently selected gear
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
@@ -972,23 +994,44 @@
         | VehicleArea:GLOBAL),
 
     /*
-     * Index in int32Values for AP_POWER_STATE property.
+     * Property to control power state of application processor
+     *
+     * It is assumed that AP's power state is controller by separate power
+     * controller.
+     *
+     * For configuration information, VehiclePropConfig.configFlags can
+     * have bit flag combining values in VehicleApPowerStateConfigFlag.
+     *
+     * Value format for IVehicle#get / IVehicle#subscribe:
+     *   int32Values[0] : vehicle_ap_power_state_type
+     *   int32Values[1] : additional parameter relevant for each state,
+     *                    0 if not used.
+     * Value format for IVehicle#set:
+     *   int32Values[0] : vehicle_ap_power_state_set_type
+     *   int32Values[1] : additional parameter relevant for each request. should be 0 if not used.
+     *
+     * @change_mode VEHICLE_PROP_CHANGE_MODE_ON_CHANGE
+     * @access VEHICLE_PROP_ACCESS_READ_WRITE
      */
-    AP_POWER_STATE = (0x00000A00),
+    AP_POWER_STATE = (
+        0x0A00
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32_VEC
+        | VehicleArea:GLOBAL),
 
-  /*
-   * Property to represent brightness of the display. Some cars have single
-   * control for the brightness of all displays and this property is to share
-   * change in that control.
-   *
-   * If this is writable, android side can set this value when user changes
-   * display brightness from Settings. If this is read only, user may still
-   * change display brightness from Settings, but that will not be reflected
-   * to other displays.
-   *
-   * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-   * @access VehiclePropertyAccess:READ_WRITE
-   */
+    /*
+     * Property to represent brightness of the display. Some cars have single
+     * control for the brightness of all displays and this property is to share
+     * change in that control.
+     *
+     * If this is writable, android side can set this value when user changes
+     * display brightness from Settings. If this is read only, user may still
+     * change display brightness from Settings, but that will not be reflected
+     * to other displays.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     */
     DISPLAY_BRIGHTNESS = (
         0x0A01
         | VehiclePropertyGroup:SYSTEM
@@ -1714,7 +1757,15 @@
         | VehicleArea:GLOBAL),
 
     /*
-     * Vehicle Maps Data Service (VMDS) message
+     * Vehicle Maps Service (VMS) message
+     *
+     * This property uses COMPLEX data to communicate vms messages.
+     *
+     * Its contents are to be interpreted as follows:
+     * the indices defined in VmsMessageIntegerValuesIndex are to be used to
+     * read from int32Values;
+     * stringValue is a serialized VMS message as defined in the vms protocol
+     * which is opaque to the framework;
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -2745,6 +2796,15 @@
   NMHC_CATALYST_INCOMPLETE = 0x1 << 17,
 };
 
+enum Wheel : int32_t {
+    UNKNOWN = 0x0,
+
+    LEFT_FRONT = 0x1,
+    RIGHT_FRONT = 0x2,
+    LEFT_REAR = 0x4,
+    RIGHT_REAR = 0x8,
+};
+
 enum SecondaryAirStatus : int32_t {
   UPSTREAM = 1,
 
@@ -3044,3 +3104,32 @@
 
   VENDOR_START_INDEX = LAST_SYSTEM_INDEX + 1,
 };
+
+/*
+ * This enum lists the types of supported VMS messages.
+ */
+enum VmsMessageType : int32_t {
+  /* A client subscribes to a layer. */
+  SUBSCRIBE = 1,
+
+  /* A client unsubscribes from a layer. */
+  UNSUBSCRIBE = 2,
+
+  /* A client publishes a data packet. */
+  DATA = 3,
+};
+
+/*
+ * This enum provides the canonical mapping for VMS properties that have an
+ * integer value.
+ */
+enum VmsMessageIntegerValuesIndex : int32_t {
+  /* The message type as enumerated by VmsMessageType enum. */
+  VMS_MESSAGE_TYPE = 1,
+
+  /* The layer ID as defined in the vms protocol. */
+  VMS_LAYER_ID = 2,
+
+  /* The version of the VMS layer. */
+  VMS_LAYER_VERSION = 3,
+};
diff --git a/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py b/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
index 7854c7b..2c32836 100644
--- a/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
+++ b/vehicle/2.0/vts/functional/vts/testcases/hal/vehicle/hidl/host/VehicleHidlTest.py
@@ -21,9 +21,11 @@
 from vts.runners.host import asserts
 from vts.runners.host import base_test_with_webdb
 from vts.runners.host import const
+from vts.runners.host import keys
 from vts.runners.host import test_runner
 from vts.utils.python.controllers import android_device
 from vts.utils.python.profiling import profiling_utils
+from vts.utils.python.coverage import coverage_utils
 
 
 class VehicleHidlTest(base_test_with_webdb.BaseTestWithWebDbClass):
@@ -40,6 +42,9 @@
         system_uid = results[const.STDOUT][0].strip()
         logging.info("system_uid: %s", system_uid)
 
+        if getattr(self, keys.ConfigKeys.IKEY_ENABLE_COVERAGE, False):
+            coverage_utils.InitializeDeviceCoverage(self.dut)
+
         self.dut.hal.InitHidlHal(
             target_type="vehicle",
             target_basepaths=self.dut.libPaths,
@@ -63,6 +68,9 @@
         if self.enable_profiling:
             self.ProcessAndUploadTraceData()
 
+        if getattr(self, keys.ConfigKeys.IKEY_ENABLE_COVERAGE, False):
+            self.SetCoverageData(coverage_utils.GetGcdaDict(self.dut))
+
     def setUpTest(self):
         if self.enable_profiling:
             profiling_utils.EnableVTSProfiling(self.dut.shell.one)
diff --git a/vibrator/1.0/default/service.cpp b/vibrator/1.0/default/service.cpp
index 064e1e2..7cc0744 100644
--- a/vibrator/1.0/default/service.cpp
+++ b/vibrator/1.0/default/service.cpp
@@ -22,5 +22,5 @@
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main() {
-    return defaultPassthroughServiceImplementation<IVibrator>("vibrator");
+    return defaultPassthroughServiceImplementation<IVibrator>();
 }
diff --git a/wifi/1.0/Android.mk b/wifi/1.0/Android.mk
index 1058cc7..708c14c 100644
--- a/wifi/1.0/Android.mk
+++ b/wifi/1.0/Android.mk
@@ -1589,6 +1589,8 @@
 $(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IWifiApIface.hal
 $(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/IWifiIface.hal
 $(GEN): $(LOCAL_PATH)/IWifiIface.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
 $(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
 $(GEN): PRIVATE_CUSTOM_TOOL = \
         $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
@@ -3447,6 +3449,8 @@
 $(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IWifiApIface.hal
 $(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/IWifiIface.hal
 $(GEN): $(LOCAL_PATH)/IWifiIface.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
 $(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
 $(GEN): PRIVATE_CUSTOM_TOOL = \
         $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
diff --git a/wifi/1.0/IWifiApIface.hal b/wifi/1.0/IWifiApIface.hal
index 6bc3580..aeca2cd 100644
--- a/wifi/1.0/IWifiApIface.hal
+++ b/wifi/1.0/IWifiApIface.hal
@@ -22,5 +22,15 @@
  * Interface used to represent a single AP iface.
  */
 interface IWifiApIface extends IWifiIface {
-  /** TODO(rpius): Add methods to the interface. */
+  /**
+   * Set country code for this iface.
+   *
+   * @param code 2 byte country code (as defined in ISO 3166) to set.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |WifiStatusCode.SUCCESS|,
+   *         |WifiStatusCode.FAILURE_UNKNOWN|,
+   *         |WifiStatusCode.FAILURE_IFACE_INVALID|
+   */
+  setCountryCode(int8_t[2] code) generates (WifiStatus status);
 };
diff --git a/wifi/1.0/IWifiStaIface.hal b/wifi/1.0/IWifiStaIface.hal
index 6a738a9..2c72ead 100644
--- a/wifi/1.0/IWifiStaIface.hal
+++ b/wifi/1.0/IWifiStaIface.hal
@@ -439,7 +439,8 @@
 
   /**
    * API to start packet fate monitoring.
-   * - Once stared, monitoring must remain active until HAL is unloaded.
+   * - Once started, monitoring must remain active until HAL is stopped or the
+   *   chip is reconfigured.
    * - When HAL is unloaded, all packet fate buffers must be cleared.
    * - The packet fates are used to monitor the state of packets transmitted/
    *   received during association.
@@ -455,20 +456,6 @@
   startDebugPacketFateMonitoring() generates (WifiStatus status);
 
   /**
-   * API to stop packet fate monitoring.
-   *
-   * @return status WifiStatus of the operation.
-   *         Possible status codes:
-   *         |WifiStatusCode.SUCCESS|,
-   *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
-   *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
-   *         |WifiStatusCode.ERROR_NOT_STARTED|,
-   *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
-   *         |WifiStatusCode.ERROR_UNKNOWN|
-   */
-  stopDebugPacketFateMonitoring() generates (WifiStatus status);
-
-  /**
    * API to retrieve fates of outbound packets.
    * - HAL implementation must return the fates of
    *   all the frames transmitted for the most recent association.
diff --git a/wifi/1.0/default/Android.mk b/wifi/1.0/default/Android.mk
index f0c78ea..144c067 100644
--- a/wifi/1.0/default/Android.mk
+++ b/wifi/1.0/default/Android.mk
@@ -16,7 +16,7 @@
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.wifi@1.0-service
 LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_CPPFLAGS := -Wall -Wno-unused-parameter -Werror -Wextra
+LOCAL_CPPFLAGS := -Wall -Werror -Wextra
 LOCAL_SRC_FILES := \
     hidl_struct_util.cpp \
     service.cpp \
diff --git a/wifi/1.0/default/wifi.cpp b/wifi/1.0/default/wifi.cpp
index c06abe8..8feb836 100644
--- a/wifi/1.0/default/wifi.cpp
+++ b/wifi/1.0/default/wifi.cpp
@@ -107,11 +107,6 @@
         LOG(ERROR) << "Failed to invoke onStart callback";
       };
     }
-    for (const auto& callback : event_callbacks_) {
-      if (!callback->onFailure(wifi_status).isOk()) {
-        LOG(ERROR) << "Failed to invoke onFailure callback";
-      }
-    }
   } else {
     for (const auto& callback : event_callbacks_) {
       if (!callback->onFailure(wifi_status).isOk()) {
diff --git a/wifi/1.0/default/wifi_ap_iface.cpp b/wifi/1.0/default/wifi_ap_iface.cpp
index b8b7a3a..1a8b31d 100644
--- a/wifi/1.0/default/wifi_ap_iface.cpp
+++ b/wifi/1.0/default/wifi_ap_iface.cpp
@@ -55,6 +55,15 @@
                          hidl_status_cb);
 }
 
+Return<void> WifiApIface::setCountryCode(const hidl_array<int8_t, 2>& code,
+                                         setCountryCode_cb hidl_status_cb) {
+  return validateAndCall(this,
+                         WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                         &WifiApIface::setCountryCodeInternal,
+                         hidl_status_cb,
+                         code);
+}
+
 std::pair<WifiStatus, std::string> WifiApIface::getNameInternal() {
   return {createWifiStatus(WifiStatusCode::SUCCESS), ifname_};
 }
@@ -63,6 +72,13 @@
   return {createWifiStatus(WifiStatusCode::SUCCESS), IfaceType::AP};
 }
 
+WifiStatus WifiApIface::setCountryCodeInternal(
+    const std::array<int8_t, 2>& code) {
+  legacy_hal::wifi_error legacy_status =
+      legacy_hal_.lock()->setCountryCode(code);
+  return createWifiStatusFromLegacyError(legacy_status);
+}
+
 }  // namespace implementation
 }  // namespace V1_0
 }  // namespace wifi
diff --git a/wifi/1.0/default/wifi_ap_iface.h b/wifi/1.0/default/wifi_ap_iface.h
index ee5dc56..23d6435 100644
--- a/wifi/1.0/default/wifi_ap_iface.h
+++ b/wifi/1.0/default/wifi_ap_iface.h
@@ -42,11 +42,14 @@
   // HIDL methods exposed.
   Return<void> getName(getName_cb hidl_status_cb) override;
   Return<void> getType(getType_cb hidl_status_cb) override;
+  Return<void> setCountryCode(const hidl_array<int8_t, 2>& code,
+                              setCountryCode_cb hidl_status_cb) override;
 
  private:
   // Corresponding worker functions for the HIDL methods.
   std::pair<WifiStatus, std::string> getNameInternal();
   std::pair<WifiStatus, IfaceType> getTypeInternal();
+  WifiStatus setCountryCodeInternal(const std::array<int8_t, 2>& code);
 
   std::string ifname_;
   std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
diff --git a/wifi/1.0/default/wifi_legacy_hal.cpp b/wifi/1.0/default/wifi_legacy_hal.cpp
index 3bfd2bb..e4eddcd 100644
--- a/wifi/1.0/default/wifi_legacy_hal.cpp
+++ b/wifi/1.0/default/wifi_legacy_hal.cpp
@@ -22,12 +22,7 @@
 #include "wifi_legacy_hal.h"
 #include "wifi_legacy_hal_stubs.h"
 
-namespace android {
-namespace hardware {
-namespace wifi {
-namespace V1_0 {
-namespace implementation {
-namespace legacy_hal {
+namespace {
 // Constants ported over from the legacy HAL calling code
 // (com_android_server_wifi_WifiNative.cpp). This will all be thrown
 // away when this shim layer is replaced by the real vendor
@@ -39,6 +34,21 @@
 static constexpr uint32_t kMaxWakeReasonStatsArraySize = 32;
 static constexpr uint32_t kMaxRingBuffers = 10;
 
+// Helper function to create a non-const char* for legacy Hal API's.
+std::vector<char> makeCharVec(const std::string& str) {
+  std::vector<char> vec(str.size() + 1);
+  vec.assign(str.begin(), str.end());
+  vec.push_back('\0');
+  return vec;
+}
+}  // namespace
+
+namespace android {
+namespace hardware {
+namespace wifi {
+namespace V1_0 {
+namespace implementation {
+namespace legacy_hal {
 // Legacy HAL functions accept "C" style function pointers, so use global
 // functions to pass to the legacy HAL function and store the corresponding
 // std::function methods to be invoked.
@@ -804,19 +814,17 @@
                                                  uint32_t verbose_level,
                                                  uint32_t max_interval_sec,
                                                  uint32_t min_data_size) {
-  std::vector<char> ring_name_internal(ring_name.begin(), ring_name.end());
   return global_func_table_.wifi_start_logging(wlan_interface_handle_,
                                                verbose_level,
                                                0,
                                                max_interval_sec,
                                                min_data_size,
-                                               ring_name_internal.data());
+                                               makeCharVec(ring_name).data());
 }
 
 wifi_error WifiLegacyHal::getRingBufferData(const std::string& ring_name) {
-  std::vector<char> ring_name_internal(ring_name.begin(), ring_name.end());
   return global_func_table_.wifi_get_ring_data(wlan_interface_handle_,
-                                               ring_name_internal.data());
+                                               makeCharVec(ring_name).data());
 }
 
 wifi_error WifiLegacyHal::registerErrorAlertCallbackHandler(
@@ -1091,16 +1099,14 @@
 
 wifi_error WifiLegacyHal::nanDataInterfaceCreate(
     transaction_id id, const std::string& iface_name) {
-  std::vector<char> iface_name_internal(iface_name.begin(), iface_name.end());
   return global_func_table_.wifi_nan_data_interface_create(
-      id, wlan_interface_handle_, iface_name_internal.data());
+      id, wlan_interface_handle_, makeCharVec(iface_name).data());
 }
 
 wifi_error WifiLegacyHal::nanDataInterfaceDelete(
     transaction_id id, const std::string& iface_name) {
-  std::vector<char> iface_name_internal(iface_name.begin(), iface_name.end());
   return global_func_table_.wifi_nan_data_interface_delete(
-      id, wlan_interface_handle_, iface_name_internal.data());
+      id, wlan_interface_handle_, makeCharVec(iface_name).data());
 }
 
 wifi_error WifiLegacyHal::nanDataRequestInitiator(
@@ -1124,6 +1130,12 @@
       id, wlan_interface_handle_, &msg_internal);
 }
 
+wifi_error WifiLegacyHal::setCountryCode(std::array<int8_t, 2> code) {
+  std::string code_str(code.data(), code.data() + code.size());
+  return global_func_table_.wifi_set_country_code(wlan_interface_handle_,
+                                                  code_str.c_str());
+}
+
 wifi_error WifiLegacyHal::retrieveWlanInterfaceHandle() {
   const std::string& ifname_to_find = getStaIfaceName();
   wifi_interface_handle* iface_handles = nullptr;
diff --git a/wifi/1.0/default/wifi_legacy_hal.h b/wifi/1.0/default/wifi_legacy_hal.h
index a3ac075..1ab74b7 100644
--- a/wifi/1.0/default/wifi_legacy_hal.h
+++ b/wifi/1.0/default/wifi_legacy_hal.h
@@ -256,6 +256,8 @@
   wifi_error nanDataIndicationResponse(
       transaction_id id, const NanDataPathIndicationResponse& msg);
   wifi_error nanDataEnd(transaction_id id, const NanDataPathEndRequest& msg);
+  // AP functions.
+  wifi_error setCountryCode(std::array<int8_t, 2> code);
 
  private:
   // Retrieve the interface handle to be used for the "wlan" interface.
diff --git a/wifi/1.0/default/wifi_sta_iface.cpp b/wifi/1.0/default/wifi_sta_iface.cpp
index a00c5bc..be2fe37 100644
--- a/wifi/1.0/default/wifi_sta_iface.cpp
+++ b/wifi/1.0/default/wifi_sta_iface.cpp
@@ -258,14 +258,6 @@
                          hidl_status_cb);
 }
 
-Return<void> WifiStaIface::stopDebugPacketFateMonitoring(
-    stopDebugPacketFateMonitoring_cb hidl_status_cb) {
-  return validateAndCall(this,
-                         WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
-                         &WifiStaIface::stopDebugPacketFateMonitoringInternal,
-                         hidl_status_cb);
-}
-
 Return<void> WifiStaIface::getDebugTxPacketFates(
     getDebugTxPacketFates_cb hidl_status_cb) {
   return validateAndCall(this,
@@ -567,11 +559,6 @@
   return createWifiStatusFromLegacyError(legacy_status);
 }
 
-WifiStatus WifiStaIface::stopDebugPacketFateMonitoringInternal() {
-  // There is no stop in legacy HAL implementation.
-  return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
-}
-
 std::pair<WifiStatus, std::vector<WifiDebugTxPacketFateReport>>
 WifiStaIface::getDebugTxPacketFatesInternal() {
   legacy_hal::wifi_error legacy_status;
diff --git a/wifi/1.0/default/wifi_sta_iface.h b/wifi/1.0/default/wifi_sta_iface.h
index 311c991..ca79c5b 100644
--- a/wifi/1.0/default/wifi_sta_iface.h
+++ b/wifi/1.0/default/wifi_sta_iface.h
@@ -97,8 +97,6 @@
       uint32_t cmd_id, stopSendingKeepAlivePackets_cb hidl_status_cb) override;
   Return<void> startDebugPacketFateMonitoring(
       startDebugPacketFateMonitoring_cb hidl_status_cb) override;
-  Return<void> stopDebugPacketFateMonitoring(
-      stopDebugPacketFateMonitoring_cb hidl_status_cb) override;
   Return<void> getDebugTxPacketFates(
       getDebugTxPacketFates_cb hidl_status_cb) override;
   Return<void> getDebugRxPacketFates(
@@ -143,7 +141,6 @@
       uint32_t period_in_ms);
   WifiStatus stopSendingKeepAlivePacketsInternal(uint32_t cmd_id);
   WifiStatus startDebugPacketFateMonitoringInternal();
-  WifiStatus stopDebugPacketFateMonitoringInternal();
   std::pair<WifiStatus, std::vector<WifiDebugTxPacketFateReport>>
   getDebugTxPacketFatesInternal();
   std::pair<WifiStatus, std::vector<WifiDebugRxPacketFateReport>>
diff --git a/wifi/1.0/default/wifi_status_util.cpp b/wifi/1.0/default/wifi_status_util.cpp
index 518032f..c2d0758 100644
--- a/wifi/1.0/default/wifi_status_util.cpp
+++ b/wifi/1.0/default/wifi_status_util.cpp
@@ -42,8 +42,9 @@
       return "TOO_MANY_REQUESTS";
     case legacy_hal::WIFI_ERROR_OUT_OF_MEMORY:
       return "OUT_OF_MEMORY";
+    case legacy_hal::WIFI_ERROR_BUSY:
+      return "BUSY";
     case legacy_hal::WIFI_ERROR_UNKNOWN:
-    default:
       return "UNKNOWN";
   }
 }
@@ -90,7 +91,6 @@
       return createWifiStatus(WifiStatusCode::SUCCESS, desc);
 
     case legacy_hal::WIFI_ERROR_UNKNOWN:
-    default:
       return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN, "unknown");
   }
 }
diff --git a/wifi/1.0/types.hal b/wifi/1.0/types.hal
index edf306d..bb00114 100644
--- a/wifi/1.0/types.hal
+++ b/wifi/1.0/types.hal
@@ -549,14 +549,14 @@
  */
 enum StaRoamingState : uint8_t {
   /**
+   * Driver/Firmware must not perform any roaming.
+   */
+  DISABLED = 0,
+  /**
    * Driver/Firmware is allowed to perform roaming respecting
    * the |StaRoamingConfig| parameters set using |configureRoaming|.
    */
-  ENABLED = 0,
-  /**
-   * Driver/Firmware must not perform any roaming.
-   */
-  DISABLED = 1
+  ENABLED = 1
 };
 
 /**
@@ -2142,7 +2142,7 @@
 };
 
 /**
- * Struct describing packet fate report for each Rx frame.
+ * Struct describing packet fate report for each Tx frame.
  */
 struct WifiDebugTxPacketFateReport {
   WifiDebugTxPacketFate fate;