diff --git a/audio/core/all-versions/vts/functional/Android.bp b/audio/core/all-versions/vts/functional/Android.bp
index b04adf7..6498289 100644
--- a/audio/core/all-versions/vts/functional/Android.bp
+++ b/audio/core/all-versions/vts/functional/Android.bp
@@ -22,6 +22,7 @@
         "libaudiopolicycomponents",
         "libicuuc",
         "libicuuc_stubdata",
+        "libandroidicu",
         "libmedia_helper",
         "libxml2",
     ],
diff --git a/audio/effect/all-versions/vts/functional/Android.bp b/audio/effect/all-versions/vts/functional/Android.bp
index 88d49d8..de6cad9 100644
--- a/audio/effect/all-versions/vts/functional/Android.bp
+++ b/audio/effect/all-versions/vts/functional/Android.bp
@@ -28,6 +28,7 @@
         "libeffectsconfig",
         "libicuuc",
         "libicuuc_stubdata",
+        "libandroidicu",
         "libxml2",
     ],
     header_libs: [
diff --git a/automotive/OWNERS b/automotive/OWNERS
new file mode 100644
index 0000000..4a94494
--- /dev/null
+++ b/automotive/OWNERS
@@ -0,0 +1,3 @@
+randolphs@google.com
+pirozzoj@google.com
+twasilczyk@google.com
diff --git a/automotive/vehicle/2.0/default/OWNERS b/automotive/vehicle/2.0/default/OWNERS
deleted file mode 100644
index d5d9d4c..0000000
--- a/automotive/vehicle/2.0/default/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-egranata@google.com
-pavelm@google.com
-spaik@google.com
diff --git a/automotive/vehicle/2.0/types.hal b/automotive/vehicle/2.0/types.hal
index 4751a76..e874146 100644
--- a/automotive/vehicle/2.0/types.hal
+++ b/automotive/vehicle/2.0/types.hal
@@ -131,6 +131,9 @@
  * When a property's status field is not set to AVAILABLE:
  *  - IVehicle#set may return StatusCode::NOT_AVAILABLE.
  *  - IVehicle#get is not guaranteed to work.
+ *
+ * Properties set to values out of range must be ignored and no action taken
+ * in response to such ill formed requests.
  */
 enum VehicleProperty : int32_t {
 
@@ -243,7 +246,7 @@
      * Fuel door location
      *
      * @change_mode VehiclePropertyChangeMode:STATIC
-     * @data_enum FuelDoorLocationType
+     * @data_enum PortLocationType
      * @access VehiclePropertyAccess:READ
      */
     INFO_FUEL_DOOR_LOCATION = (
@@ -267,6 +270,7 @@
 
     /**
      * Driver's seat location
+     * VHAL implementations must ignore the areaId. Use VehicleArea:GLOBAL.
      *
      * @change_mode VehiclePropertyChangeMode:STATIC
      * @data_enum VehicleAreaSeat
diff --git a/camera/device/3.4/default/ExternalCameraDevice.cpp b/camera/device/3.4/default/ExternalCameraDevice.cpp
index b96f574..0f23657 100644
--- a/camera/device/3.4/default/ExternalCameraDevice.cpp
+++ b/camera/device/3.4/default/ExternalCameraDevice.cpp
@@ -378,8 +378,12 @@
     const uint8_t timestampSource = ANDROID_SENSOR_INFO_TIMESTAMP_SOURCE_UNKNOWN;
     UPDATE(ANDROID_SENSOR_INFO_TIMESTAMP_SOURCE, &timestampSource, 1);
 
-    // Orientation probably isn't useful for external facing camera?
-    const int32_t orientation = 0;
+    // Orientation is a bit odd for external camera, but consider it as the orientation
+    // between the external camera sensor (which is usually landscape) and the device's
+    // natural display orientation. For devices with natural landscape display (ex: tablet/TV), the
+    // orientation should be 0. For devices with natural portrait display (phone), the orientation
+    // should be 270.
+    const int32_t orientation = mCfg.orientation;
     UPDATE(ANDROID_SENSOR_ORIENTATION, &orientation, 1);
 
     // android.shading
diff --git a/camera/device/3.4/default/ExternalCameraUtils.cpp b/camera/device/3.4/default/ExternalCameraUtils.cpp
index 680c95a..0941052 100644
--- a/camera/device/3.4/default/ExternalCameraUtils.cpp
+++ b/camera/device/3.4/default/ExternalCameraUtils.cpp
@@ -160,9 +160,11 @@
 namespace common {
 
 namespace {
-    const int  kDefaultJpegBufSize = 5 << 20; // 5MB
-    const int  kDefaultNumVideoBuffer = 4;
-    const int  kDefaultNumStillBuffer = 2;
+    const int kDefaultJpegBufSize = 5 << 20; // 5MB
+    const int kDefaultNumVideoBuffer = 4;
+    const int kDefaultNumStillBuffer = 2;
+    const int kDefaultOrientation = 0; // suitable for natural landscape displays like tablet/TV
+                                       // For phone devices 270 is better
 } // anonymous namespace
 
 const char* ExternalCameraConfig::kDefaultCfgPath = "/vendor/etc/external_camera_config.xml";
@@ -276,10 +278,17 @@
                 minStreamSize->UnsignedAttribute("height", /*Default*/0)};
     }
 
+    XMLElement *orientation = deviceCfg->FirstChildElement("Orientation");
+    if (orientation == nullptr) {
+        ALOGI("%s: no sensor orientation specified", __FUNCTION__);
+    } else {
+        ret.orientation = orientation->IntAttribute("degree", /*Default*/kDefaultOrientation);
+    }
+
     ALOGI("%s: external camera cfg loaded: maxJpgBufSize %d,"
-            " num video buffers %d, num still buffers %d",
+            " num video buffers %d, num still buffers %d, orientation %d",
             __FUNCTION__, ret.maxJpegBufSize,
-            ret.numVideoBuffers, ret.numStillBuffers);
+            ret.numVideoBuffers, ret.numStillBuffers, ret.orientation);
     for (const auto& limit : ret.fpsLimits) {
         ALOGI("%s: fpsLimitList: %dx%d@%f", __FUNCTION__,
                 limit.size.width, limit.size.height, limit.fpsUpperBound);
@@ -292,7 +301,8 @@
 ExternalCameraConfig::ExternalCameraConfig() :
         maxJpegBufSize(kDefaultJpegBufSize),
         numVideoBuffers(kDefaultNumVideoBuffer),
-        numStillBuffers(kDefaultNumStillBuffer) {
+        numStillBuffers(kDefaultNumStillBuffer),
+        orientation(kDefaultOrientation) {
     fpsLimits.push_back({/*Size*/{ 640,  480}, /*FPS upper bound*/30.0});
     fpsLimits.push_back({/*Size*/{1280,  720}, /*FPS upper bound*/7.5});
     fpsLimits.push_back({/*Size*/{1920, 1080}, /*FPS upper bound*/5.0});
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraUtils.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraUtils.h
index 5754ccb..3b1ac96 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraUtils.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraUtils.h
@@ -80,6 +80,9 @@
     // Minimum output stream size
     Size minStreamSize;
 
+    // The value of android.sensor.orientation
+    int32_t orientation;
+
 private:
     ExternalCameraConfig();
 };
diff --git a/cas/1.0/default/service.cpp b/cas/1.0/default/service.cpp
index 2e6e55d..516acfb 100644
--- a/cas/1.0/default/service.cpp
+++ b/cas/1.0/default/service.cpp
@@ -47,7 +47,7 @@
     android::status_t status;
     if (kLazyService) {
         auto serviceRegistrar = std::make_shared<LazyServiceRegistrar>();
-        status = serviceRegistrar->registerServiceWithCallback(service);
+        status = serviceRegistrar->registerService(service);
     } else {
         status = service->registerAsService();
     }
diff --git a/compatibility_matrices/Android.bp b/compatibility_matrices/Android.bp
index b88d88f..5f56ee9 100644
--- a/compatibility_matrices/Android.bp
+++ b/compatibility_matrices/Android.bp
@@ -70,7 +70,6 @@
         "compatibility_matrix.current.xml",
     ],
     kernel_configs: [
-        "kernel_config_current_4.4",
         "kernel_config_current_4.9",
         "kernel_config_current_4.14",
         "kernel_config_current_4.19",
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index d4c422d..495ae45 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -367,6 +367,7 @@
     <hal format="hidl" optional="true">
         <name>android.hardware.sensors</name>
         <version>1.0</version>
+        <version>2.0</version>
         <interface>
             <name>ISensors</name>
             <instance>default</instance>
diff --git a/drm/1.0/default/Android.mk b/drm/1.0/default/Android.mk
index 99773be..d66f377 100644
--- a/drm/1.0/default/Android.mk
+++ b/drm/1.0/default/Android.mk
@@ -19,39 +19,23 @@
 LOCAL_PATH := $(call my-dir)
 
 include $(CLEAR_VARS)
+
+include $(LOCAL_PATH)/common_default_service.mk
 LOCAL_MODULE := android.hardware.drm@1.0-service
 LOCAL_INIT_RC := android.hardware.drm@1.0-service.rc
-LOCAL_PROPRIETARY_MODULE := true
-LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_SRC_FILES := \
-  service.cpp \
+LOCAL_SRC_FILES := service.cpp
 
-LOCAL_SHARED_LIBRARIES := \
-  android.hardware.drm@1.0 \
-  android.hidl.memory@1.0 \
-  libhidlbase \
-  libhidltransport \
-  libhardware \
-  liblog \
-  libutils \
-  libbinder \
+include $(BUILD_EXECUTABLE)
 
-LOCAL_STATIC_LIBRARIES := \
-  android.hardware.drm@1.0-helper \
+############# Build legacy drm lazy service ############
 
-LOCAL_C_INCLUDES := \
-  hardware/interfaces/drm
+include $(CLEAR_VARS)
 
-LOCAL_HEADER_LIBRARIES := \
-  media_plugin_headers
-
-# TODO(b/18948909) Some legacy DRM plugins only support 32-bit. They need to be
-# migrated to 64-bit. Once all of a device's legacy DRM plugins support 64-bit,
-# that device can turn on TARGET_ENABLE_MEDIADRM_64 to build this service as
-# 64-bit.
-ifneq ($(TARGET_ENABLE_MEDIADRM_64), true)
-LOCAL_32_BIT_ONLY := true
-endif
+include $(LOCAL_PATH)/common_default_service.mk
+LOCAL_MODULE := android.hardware.drm@1.0-service-lazy
+LOCAL_OVERRIDES_MODULES := android.hardware.drm@1.0-service
+LOCAL_INIT_RC := android.hardware.drm@1.0-service-lazy.rc
+LOCAL_SRC_FILES := serviceLazy.cpp
 
 include $(BUILD_EXECUTABLE)
 
diff --git a/drm/1.0/default/android.hardware.drm@1.0-service-lazy.rc b/drm/1.0/default/android.hardware.drm@1.0-service-lazy.rc
new file mode 100644
index 0000000..4b32f7f
--- /dev/null
+++ b/drm/1.0/default/android.hardware.drm@1.0-service-lazy.rc
@@ -0,0 +1,10 @@
+service vendor.drm-hal-1-0 /vendor/bin/hw/android.hardware.drm@1.0-service-lazy
+    interface android.hardware.drm@1.0::ICryptoFactory default
+    interface android.hardware.drm@1.0::IDrmFactory default
+    oneshot
+    disabled
+    class hal
+    user media
+    group mediadrm drmrpc
+    ioprio rt 4
+    writepid /dev/cpuset/foreground/tasks
diff --git a/drm/1.0/default/android.hardware.drm@1.0-service.rc b/drm/1.0/default/android.hardware.drm@1.0-service.rc
index a3457b5..790eded 100644
--- a/drm/1.0/default/android.hardware.drm@1.0-service.rc
+++ b/drm/1.0/default/android.hardware.drm@1.0-service.rc
@@ -1,4 +1,6 @@
 service vendor.drm-hal-1-0 /vendor/bin/hw/android.hardware.drm@1.0-service
+    interface android.hardware.drm@1.0::ICryptoFactory default
+    interface android.hardware.drm@1.0::IDrmFactory default
     class hal
     user media
     group mediadrm drmrpc
diff --git a/drm/1.0/default/common_default_service.mk b/drm/1.0/default/common_default_service.mk
new file mode 100644
index 0000000..28db567
--- /dev/null
+++ b/drm/1.0/default/common_default_service.mk
@@ -0,0 +1,45 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include $(CLEAR_VARS)
+LOCAL_PROPRIETARY_MODULE := true
+LOCAL_MODULE_RELATIVE_PATH := hw
+
+LOCAL_SHARED_LIBRARIES := \
+  android.hardware.drm@1.0 \
+  android.hidl.memory@1.0 \
+  libhidlbase \
+  libhidltransport \
+  libhardware \
+  liblog \
+  libutils \
+  libbinder \
+
+LOCAL_STATIC_LIBRARIES := \
+  android.hardware.drm@1.0-helper \
+
+LOCAL_C_INCLUDES := \
+  hardware/interfaces/drm
+
+LOCAL_HEADER_LIBRARIES := \
+  media_plugin_headers
+
+# TODO(b/18948909) Some legacy DRM plugins only support 32-bit. They need to be
+# migrated to 64-bit. Once all of a device's legacy DRM plugins support 64-bit,
+# that device can turn on TARGET_ENABLE_MEDIADRM_64 to build this service as
+# 64-bit.
+ifneq ($(TARGET_ENABLE_MEDIADRM_64), true)
+LOCAL_32_BIT_ONLY := true
+endif
diff --git a/drm/1.0/default/service.cpp b/drm/1.0/default/service.cpp
index 1a44ce2..98d2c3b 100644
--- a/drm/1.0/default/service.cpp
+++ b/drm/1.0/default/service.cpp
@@ -13,7 +13,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#define LOG_TAG "android.hardware.drm@1.0-service"
 
 #include <1.0/default/CryptoFactory.h>
 #include <1.0/default/DrmFactory.h>
@@ -31,15 +30,8 @@
 using android::hardware::drm::V1_0::IDrmFactory;
 
 int main() {
-    ALOGD("android.hardware.drm@1.0-service starting...");
-
-    // The DRM HAL may communicate to other vendor components via
-    // /dev/vndbinder
-    android::ProcessState::initWithDriver("/dev/vndbinder");
-
     configureRpcThreadpool(8, true /* callerWillJoin */);
-    android::status_t status =
-        registerPassthroughServiceImplementation<IDrmFactory>();
+    android::status_t status = registerPassthroughServiceImplementation<IDrmFactory>();
     LOG_ALWAYS_FATAL_IF(
         status != android::OK,
         "Error while registering drm service: %d", status);
diff --git a/drm/1.0/default/serviceLazy.cpp b/drm/1.0/default/serviceLazy.cpp
new file mode 100644
index 0000000..e5068b5
--- /dev/null
+++ b/drm/1.0/default/serviceLazy.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <1.0/default/CryptoFactory.h>
+#include <1.0/default/DrmFactory.h>
+
+#include <hidl/HidlTransportSupport.h>
+#include <hidl/LegacySupport.h>
+
+#include <binder/ProcessState.h>
+
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
+using android::hardware::registerLazyPassthroughServiceImplementation;
+
+using android::hardware::drm::V1_0::ICryptoFactory;
+using android::hardware::drm::V1_0::IDrmFactory;
+
+int main() {
+    configureRpcThreadpool(8, true /* callerWillJoin */);
+    android::status_t status = registerLazyPassthroughServiceImplementation<IDrmFactory>();
+    LOG_ALWAYS_FATAL_IF(status != android::OK, "Error while registering drm service: %d", status);
+    status = registerLazyPassthroughServiceImplementation<ICryptoFactory>();
+    LOG_ALWAYS_FATAL_IF(status != android::OK, "Error while registering crypto service: %d",
+                        status);
+    joinRpcThreadpool();
+}
diff --git a/graphics/composer/2.3/utils/OWNERS b/graphics/composer/2.3/utils/OWNERS
index 234bc75..b3ea6be 100644
--- a/graphics/composer/2.3/utils/OWNERS
+++ b/graphics/composer/2.3/utils/OWNERS
@@ -1,6 +1,7 @@
 # Graphics team
-olv@google.com
+lpy@google.com
 stoza@google.com
+vhau@google.com
 
 # VTS team
 yim@google.com
diff --git a/graphics/composer/2.3/vts/functional/OWNERS b/graphics/composer/2.3/vts/functional/OWNERS
index 234bc75..b3ea6be 100644
--- a/graphics/composer/2.3/vts/functional/OWNERS
+++ b/graphics/composer/2.3/vts/functional/OWNERS
@@ -1,6 +1,7 @@
 # Graphics team
-olv@google.com
+lpy@google.com
 stoza@google.com
+vhau@google.com
 
 # VTS team
 yim@google.com
diff --git a/graphics/composer/2.3/vts/functional/VtsHalGraphicsComposerV2_3TargetTest.cpp b/graphics/composer/2.3/vts/functional/VtsHalGraphicsComposerV2_3TargetTest.cpp
index 535f847..dca7406 100644
--- a/graphics/composer/2.3/vts/functional/VtsHalGraphicsComposerV2_3TargetTest.cpp
+++ b/graphics/composer/2.3/vts/functional/VtsHalGraphicsComposerV2_3TargetTest.cpp
@@ -248,14 +248,47 @@
 }
 
 /**
+ * Test IComposerClient::getHdrCapabilities_2_3
+ */
+TEST_F(GraphicsComposerHidlTest, GetHdrCapabilities_2_3) {
+    float maxLuminance;
+    float maxAverageLuminance;
+    float minLuminance;
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->getHdrCapabilities_2_3(
+        mPrimaryDisplay, &maxLuminance, &maxAverageLuminance, &minLuminance));
+    ASSERT_TRUE(maxLuminance >= minLuminance);
+}
+
+/**
+ * Test IComposerClient::getPerFrameMetadataKeys_2_3
+ */
+TEST_F(GraphicsComposerHidlTest, GetPerFrameMetadataKeys_2_3) {
+    std::vector<IComposerClient::PerFrameMetadataKey> keys;
+    mComposerClient->getRaw()->getPerFrameMetadataKeys_2_3(
+        mPrimaryDisplay, [&](const auto tmpError, const auto outKeys) {
+            if (tmpError != Error::UNSUPPORTED) {
+                ASSERT_EQ(Error::NONE, tmpError);
+                keys = outKeys;
+            }
+        });
+}
+
+/**
  * TestIComposerClient::getReadbackBufferAttributes_2_3
  */
 TEST_F(GraphicsComposerHidlTest, GetReadbackBufferAttributes_2_3) {
     Dataspace dataspace;
     PixelFormat pixelFormat;
 
-    ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferAttributes_2_3(
-        mPrimaryDisplay, &pixelFormat, &dataspace));
+    mComposerClient->getRaw()->getReadbackBufferAttributes_2_3(
+        mPrimaryDisplay,
+        [&](const auto tmpError, const auto outPixelFormat, const auto outDataspace) {
+            if (tmpError != Error::UNSUPPORTED) {
+                ASSERT_EQ(Error::NONE, tmpError);
+                dataspace = outDataspace;
+                pixelFormat = outPixelFormat;
+            }
+        });
 }
 
 /**
diff --git a/health/1.0/default/android.hardware.health@1.0-service.rc b/health/1.0/default/android.hardware.health@1.0-service.rc
index d74a07e..405784f 100644
--- a/health/1.0/default/android.hardware.health@1.0-service.rc
+++ b/health/1.0/default/android.hardware.health@1.0-service.rc
@@ -2,3 +2,4 @@
     class hal
     user system
     group system
+    capabilities WAKE_ALARM
diff --git a/health/2.0/README.md b/health/2.0/README.md
index 5efc51a..58ea9e3 100644
--- a/health/2.0/README.md
+++ b/health/2.0/README.md
@@ -67,6 +67,7 @@
         class hal
         user system
         group system
+        capabilities WAKE_ALARM
         file /dev/kmsg w
     ```
 
@@ -97,7 +98,7 @@
 1. Storage related APIs:
 
     1. If the device does not implement `IHealth.getDiskStats` and
-        `IHealth.getStorageInfo`, add `libstoragehealthdefault` to `static_libs`.
+        `IHealth.getStorageInfo`, add `libhealthstoragedefault` to `static_libs`.
 
     1. If the device implements one of these two APIs, add and implement the
         following functions in `HealthService.cpp`:
@@ -115,7 +116,7 @@
 
     ```
     # device/<manufacturer>/<device>/sepolicy/vendor/file_contexts
-    /vendor/bin/hw/android\.hardware\.health@2\.0-service.<device> u:object_r:hal_health_default_exec:s0
+    /vendor/bin/hw/android\.hardware\.health@2\.0-service\.<device> u:object_r:hal_health_default_exec:s0
 
     # device/<manufacturer>/<device>/sepolicy/vendor/hal_health_default.te
     # Add device specific permissions to hal_health_default domain, especially
diff --git a/health/storage/1.0/default/android.hardware.health.storage@1.0-service.rc b/health/storage/1.0/default/android.hardware.health.storage@1.0-service.rc
index c6a1425..d5e1a29 100644
--- a/health/storage/1.0/default/android.hardware.health.storage@1.0-service.rc
+++ b/health/storage/1.0/default/android.hardware.health.storage@1.0-service.rc
@@ -1,5 +1,7 @@
 service vendor.health-storage-hal-1-0 /vendor/bin/hw/android.hardware.health.storage@1.0-service
     interface android.hardware.health.storage@1.0::IStorage default
+    oneshot
+    disabled
     class hal
     user system
     group system
diff --git a/health/storage/1.0/default/service.cpp b/health/storage/1.0/default/service.cpp
index a945033..f4296f1 100644
--- a/health/storage/1.0/default/service.cpp
+++ b/health/storage/1.0/default/service.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <hidl/HidlLazyUtils.h>
 #include <hidl/HidlTransportSupport.h>
 #include "Storage.h"
 
@@ -23,6 +24,7 @@
 using android::UNKNOWN_ERROR;
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
+using android::hardware::LazyServiceRegistrar;
 using android::hardware::health::storage::V1_0::IStorage;
 using android::hardware::health::storage::V1_0::implementation::Storage;
 
@@ -30,7 +32,8 @@
     configureRpcThreadpool(1, true);
 
     sp<IStorage> service = new Storage();
-    status_t result = service->registerAsService();
+    LazyServiceRegistrar registrar;
+    status_t result = registrar.registerService(service);
 
     if (result != OK) {
         return result;
diff --git a/keymaster/3.0/vts/functional/keymaster_tags.h b/keymaster/3.0/vts/functional/keymaster_tags.h
index f241ef1..8544bf7 100644
--- a/keymaster/3.0/vts/functional/keymaster_tags.h
+++ b/keymaster/3.0/vts/functional/keymaster_tags.h
@@ -274,7 +274,10 @@
  */
 template <typename ValueT> class NullOr {
     template <typename T> struct reference_initializer {
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wnull-dereference"
         static T&& init() { return *static_cast<std::remove_reference_t<T>*>(nullptr); }
+#pragma GCC diagnostic pop
     };
     template <typename T> struct pointer_initializer {
         static T init() { return nullptr; }
diff --git a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
index 61c444c..97dab68 100644
--- a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
+++ b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
@@ -282,7 +282,10 @@
 class NullOr {
     template <typename T>
     struct reference_initializer {
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wnull-dereference"
         static T&& init() { return *static_cast<std::remove_reference_t<T>*>(nullptr); }
+#pragma GCC diagnostic pop
     };
     template <typename T>
     struct pointer_initializer {
diff --git a/nfc/1.2/Android.bp b/nfc/1.2/Android.bp
new file mode 100644
index 0000000..c338e02
--- /dev/null
+++ b/nfc/1.2/Android.bp
@@ -0,0 +1,23 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.nfc@1.2",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "INfc.hal",
+    ],
+    interfaces: [
+        "android.hardware.nfc@1.0",
+        "android.hardware.nfc@1.1",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "NfcConfig",
+    ],
+    gen_java: true,
+}
+
diff --git a/nfc/1.2/INfc.hal b/nfc/1.2/INfc.hal
new file mode 100644
index 0000000..4788fd7
--- /dev/null
+++ b/nfc/1.2/INfc.hal
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.nfc@1.2;
+
+import @1.1::INfc;
+import @1.2::NfcConfig;
+
+interface INfc extends @1.1::INfc {
+    /**
+     * Fetches vendor specific configurations.
+     * @return config indicates support for certain features and
+     *     populates the vendor specific configs
+     */
+    getConfig_1_2() generates (NfcConfig config);
+};
diff --git a/nfc/1.2/types.hal b/nfc/1.2/types.hal
new file mode 100644
index 0000000..d6db9a8
--- /dev/null
+++ b/nfc/1.2/types.hal
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.nfc@1.2;
+
+import @1.1::NfcConfig;
+
+struct NfcConfig {
+    @1.1::NfcConfig v1_1;
+
+    /*
+     * NFCEE ID for offhost UICC & eSE secure element.
+     * 0x00 if there aren't any. Refer NCI specification
+     */
+    vec<uint8_t> offHostRouteUicc;
+    vec<uint8_t> offHostRouteEse;
+
+    /** Default IsoDep route. 0x00 if there aren't any. Refer NCI spec */
+    uint8_t defaultIsoDepRoute;
+};
diff --git a/nfc/1.2/vts/functional/Android.bp b/nfc/1.2/vts/functional/Android.bp
new file mode 100644
index 0000000..13b254c
--- /dev/null
+++ b/nfc/1.2/vts/functional/Android.bp
@@ -0,0 +1,26 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalNfcV1_2TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: ["VtsHalNfcV1_2TargetTest.cpp"],
+    static_libs: [
+        "android.hardware.nfc@1.0",
+        "android.hardware.nfc@1.1",
+        "android.hardware.nfc@1.2",
+    ],
+}
diff --git a/nfc/1.2/vts/functional/VtsHalNfcV1_2TargetTest.cpp b/nfc/1.2/vts/functional/VtsHalNfcV1_2TargetTest.cpp
new file mode 100644
index 0000000..ee4a887
--- /dev/null
+++ b/nfc/1.2/vts/functional/VtsHalNfcV1_2TargetTest.cpp
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "nfc_hidl_hal_test"
+#include <android-base/logging.h>
+
+#include <android/hardware/nfc/1.1/INfcClientCallback.h>
+#include <android/hardware/nfc/1.2/INfc.h>
+#include <android/hardware/nfc/1.2/types.h>
+#include <hardware/nfc.h>
+
+#include <VtsHalHidlTargetCallbackBase.h>
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+using ::android::sp;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::nfc::V1_0::NfcData;
+using ::android::hardware::nfc::V1_0::NfcStatus;
+using ::android::hardware::nfc::V1_1::INfcClientCallback;
+using ::android::hardware::nfc::V1_1::NfcEvent;
+using ::android::hardware::nfc::V1_2::INfc;
+using ::android::hardware::nfc::V1_2::NfcConfig;
+
+// Range of valid off host route ids
+constexpr unsigned int MIN_OFFHOST_ROUTE_ID = 0x80;
+constexpr unsigned int MAX_OFFHOST_ROUTE_ID = 0xFE;
+
+constexpr char kCallbackNameSendEvent[] = "sendEvent";
+constexpr char kCallbackNameSendData[] = "sendData";
+
+class NfcClientCallbackArgs {
+   public:
+    NfcEvent last_event_;
+    NfcStatus last_status_;
+    NfcData last_data_;
+};
+
+/* Callback class for data & Event. */
+class NfcClientCallback : public ::testing::VtsHalHidlTargetCallbackBase<NfcClientCallbackArgs>,
+                          public INfcClientCallback {
+   public:
+    virtual ~NfcClientCallback() = default;
+
+    /* sendEvent callback function - Records the Event & Status
+     * and notifies the TEST
+     **/
+    Return<void> sendEvent_1_1(NfcEvent event, NfcStatus event_status) override {
+        NfcClientCallbackArgs args;
+        args.last_event_ = event;
+        args.last_status_ = event_status;
+        NotifyFromCallback(kCallbackNameSendEvent, args);
+        return Void();
+    };
+
+    /** NFC 1.1 HAL shouldn't send 1.0 callbacks */
+    Return<void> sendEvent(__attribute__((unused))::android::hardware::nfc::V1_0::NfcEvent event,
+                           __attribute__((unused)) NfcStatus event_status) override {
+        return Void();
+    }
+
+    /* sendData callback function. Records the data and notifies the TEST*/
+    Return<void> sendData(const NfcData& data) override {
+        NfcClientCallbackArgs args;
+        args.last_data_ = data;
+        NotifyFromCallback(kCallbackNameSendData, args);
+        return Void();
+    };
+};
+
+// Test environment for Nfc HIDL HAL.
+class NfcHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static NfcHidlEnvironment* Instance() {
+        static NfcHidlEnvironment* instance = new NfcHidlEnvironment;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<INfc>(); }
+
+   private:
+    NfcHidlEnvironment() {}
+};
+
+// The main test class for NFC HIDL HAL.
+class NfcHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        nfc_ = ::testing::VtsHalHidlTargetTestBase::getService<INfc>();
+        ASSERT_NE(nfc_, nullptr);
+
+        nfc_cb_ = new NfcClientCallback();
+        ASSERT_NE(nfc_cb_, nullptr);
+
+        EXPECT_EQ(NfcStatus::OK, nfc_->open_1_1(nfc_cb_));
+        // Wait for OPEN_CPLT event
+        auto res = nfc_cb_->WaitForCallback(kCallbackNameSendEvent);
+        EXPECT_TRUE(res.no_timeout);
+        EXPECT_EQ(NfcEvent::OPEN_CPLT, res.args->last_event_);
+        EXPECT_EQ(NfcStatus::OK, res.args->last_status_);
+
+        /*
+         * Close the hal and then re-open to make sure we are in a predictable
+         * state for all the tests.
+         */
+        EXPECT_EQ(NfcStatus::OK, nfc_->close());
+        // Wait for CLOSE_CPLT event
+        res = nfc_cb_->WaitForCallback(kCallbackNameSendEvent);
+        EXPECT_TRUE(res.no_timeout);
+        EXPECT_EQ(NfcEvent::CLOSE_CPLT, res.args->last_event_);
+        EXPECT_EQ(NfcStatus::OK, res.args->last_status_);
+
+        EXPECT_EQ(NfcStatus::OK, nfc_->open_1_1(nfc_cb_));
+        // Wait for OPEN_CPLT event
+        res = nfc_cb_->WaitForCallback(kCallbackNameSendEvent);
+        EXPECT_TRUE(res.no_timeout);
+        EXPECT_EQ(NfcEvent::OPEN_CPLT, res.args->last_event_);
+        EXPECT_EQ(NfcStatus::OK, res.args->last_status_);
+    }
+
+    virtual void TearDown() override {
+        EXPECT_EQ(NfcStatus::OK, nfc_->close());
+        // Wait for CLOSE_CPLT event
+        auto res = nfc_cb_->WaitForCallback(kCallbackNameSendEvent);
+        EXPECT_TRUE(res.no_timeout);
+        EXPECT_EQ(NfcEvent::CLOSE_CPLT, res.args->last_event_);
+        EXPECT_EQ(NfcStatus::OK, res.args->last_status_);
+    }
+
+    sp<INfc> nfc_;
+    sp<NfcClientCallback> nfc_cb_;
+};
+
+/*
+ * getConfig:
+ * Calls getConfig()
+ * checks if fields in NfcConfig are populated correctly
+ */
+TEST_F(NfcHidlTest, GetExtendedConfig) {
+    nfc_->getConfig_1_2([](NfcConfig config) {
+        for (uint8_t uicc : config.offHostRouteUicc) {
+            EXPECT_GE(uicc, MIN_OFFHOST_ROUTE_ID);
+            EXPECT_LE(uicc, MAX_OFFHOST_ROUTE_ID);
+        }
+        for (uint8_t ese : config.offHostRouteEse) {
+            EXPECT_GE(ese, MIN_OFFHOST_ROUTE_ID);
+            EXPECT_LE(ese, MAX_OFFHOST_ROUTE_ID);
+        }
+        if (config.defaultIsoDepRoute != 0) {
+            EXPECT_GE(config.defaultIsoDepRoute, MIN_OFFHOST_ROUTE_ID);
+            EXPECT_LE(config.defaultIsoDepRoute, MAX_OFFHOST_ROUTE_ID);
+        }
+    });
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(NfcHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    NfcHidlEnvironment::Instance()->init(&argc, argv);
+
+    std::system("svc nfc disable"); /* Turn off NFC */
+    sleep(5);
+
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+
+    std::system("svc nfc enable"); /* Turn on NFC */
+    sleep(5);
+
+    return status;
+}
diff --git a/radio/1.4/Android.bp b/radio/1.4/Android.bp
index ad114f3..32f9712 100644
--- a/radio/1.4/Android.bp
+++ b/radio/1.4/Android.bp
@@ -30,6 +30,7 @@
         "DataConnActiveStatus",
         "DataProfileInfo",
         "DataRegStateResult",
+        "EmergencyCallRouting",
         "EmergencyNumber",
         "EmergencyNumberSource",
         "EmergencyServiceCategory",
diff --git a/radio/1.4/IRadio.hal b/radio/1.4/IRadio.hal
index 8438777..511aa05 100644
--- a/radio/1.4/IRadio.hal
+++ b/radio/1.4/IRadio.hal
@@ -21,6 +21,7 @@
 import @1.3::IRadio;
 import @1.4::AccessNetwork;
 import @1.4::DataProfileInfo;
+import @1.4::EmergencyCallRouting;
 import @1.4::EmergencyServiceCategory;
 import @1.4::RadioAccessFamily;
 
@@ -101,21 +102,26 @@
     oneway setDataProfile_1_4(int32_t serial, vec<DataProfileInfo> profiles);
 
     /**
-     * Initiate emergency voice call, with zero or more emergency service category(s).
+     * Initiate emergency voice call, with zero or more emergency service category(s) and routing
+     * information for handling the call. Android uses this request to make its emergency call
+     * instead of using @1.0::IRadio.dial if the 'address' in the 'dialInfo' field is identified
+     * as an emergency number by Android.
      *
-     * Note this API is the same as IRadio.dial except using the
-     * @1.4::EmergencyServiceCategory as the input param.
+     * In multi-sim senario, this radio request is sent through the IRadio service that serves
+     * the subscription the emergency number belongs to, no matter of the PUK/PIN state of the
+     * subscription and the service state.
      *
-     * If the number in the 'dialInfo' field is identified as an emergency number in Android,
-     * Android use this request for its emergency call instead of @1.0::IRadio.dial. The
-     * implementation decides how to handle the call (e.g. emergency routing or normal
-     * routing).
+     * Some countries or carriers require some emergency numbers that must be handled with normal
+     * call routing or emergency routing. If the 'routing' field is specified as
+     * @1.4::EmergencyNumberRouting#NORMAL, the implementation must use normal call routing to
+     * handle the call; if it is specified as @1.4::EmergencyNumberRouting#EMERGENCY, the
+     * implementation must use emergency routing to handle the call; if it is
+     * @1.4::EmergencyNumberRouting#UNKNOWN, Android does not know how to handle the call.
      *
      * If the dialed emergency number does not have a specified emergency service category, the
-     * 'categories' field is set to @1.4::EmergencyServiceCategory#UNSPECIFIED; iff either the
-     * 'categories' field is set to @1.4::EmergencyServiceCategory#UNSPECIFIED or the underlying
+     * 'categories' field is set to @1.4::EmergencyServiceCategory#UNSPECIFIED; if the underlying
      * technology used to request emergency services does not support the emergency service
-     * category, the interpretation of the categories is defined by implementation.
+     * category, the categories may be ignored.
      *
      * Reference: 3gpp TS 22.101, Section 10 - Emergency Calls
      *
@@ -123,11 +129,12 @@
      * @param dialInfo the same @1.0::Dial information used by @1.0::IRadio.dial.
      * @param categories bitfield<@1.4::EmergencyServiceCategory> the Emergency Service Category(s)
      *     of the call.
+     * @param routing @1.4::EmergencyCallRouting the emergency call routing information.
      *
      * Response function is IRadioResponse.emergencyDialResponse()
      */
     oneway emergencyDial(int32_t serial, Dial dialInfo,
-            bitfield<EmergencyServiceCategory> categories);
+            bitfield<EmergencyServiceCategory> categories, EmergencyCallRouting routing);
 
     /**
      * Query the preferred network type bitmap.
diff --git a/radio/1.4/IRadioIndication.hal b/radio/1.4/IRadioIndication.hal
index 626b494..a58d19c 100644
--- a/radio/1.4/IRadioIndication.hal
+++ b/radio/1.4/IRadioIndication.hal
@@ -27,17 +27,17 @@
      * Report the current list of emergency numbers
      *
      * Each emergency number (@1.4::EmergencyNumber) in the emergency number list contains a
-     * dialing number, zero or more service category(s), mobile country code, and source(s) that
-     * indicate where it comes from.
+     * dialing number, zero or more service category(s), mobile country code, mobile network code,
+     * and source(s) that indicate where it comes from.
      *
-     * Radio must report all the valid emergency numbers with known mobile country code and
-     * emergency service categories from all available sources including network signaling, sim,
-     * modem/oem configuration, and default configuration (112 and 911 must be always available;
-     * additionally, 000, 08, 110, 999, 118 and 119 must be available when sim is not present).
-     * Radio shall not report emergency numbers that are invalid in the current locale. The
-     * reported emergency number list must not have duplicate @1.4::EmergencyNumber entries. Please
-     * refer the documentation of @1.4::EmergencyNumber to construct each emergency number to
-     * report.
+     * Radio must report all the valid emergency numbers with known mobile country code, mobile
+     * network code and emergency service categories from all available sources including network
+     * signaling, sim, modem/oem configuration, and default configuration (112 and 911 must be
+     * always available; additionally, 000, 08, 110, 999, 118 and 119 must be available when sim
+     * is not present). Radio shall not report emergency numbers that are invalid in the current
+     * locale. The reported emergency number list must not have duplicate @1.4::EmergencyNumber
+     * entries. Please refer the documentation of @1.4::EmergencyNumber to construct each
+     * emergency number to report.
      *
      * Radio must report the complete list of emergency numbers whenever the emergency numbers in
      * the list are changed or whenever the client and the radio server are connected.
diff --git a/radio/1.4/types.hal b/radio/1.4/types.hal
index d0eb0ac..74613af 100644
--- a/radio/1.4/types.hal
+++ b/radio/1.4/types.hal
@@ -53,7 +53,7 @@
 
 /**
  * Emergency number contains information of number, one or more service category(s), mobile country
- * code (mcc), and source(s) that indicate where it comes from.
+ * code (mcc), mobile network country (mnc) and source(s) that indicate where it comes from.
  *
  * If the source of the emergency number is associated with country, field ‘mcc’ must be provided;
  * otherwise the field ‘mcc’ must be an empty string.
@@ -155,6 +155,25 @@
     DEFAULT = 1 << 3,
 };
 
+/**
+ * Indicates how the implementation should handle the emergency call if it is required by Android.
+ */
+enum EmergencyCallRouting : int32_t {
+    /**
+     * Indicates Android does not require how to handle the corresponding emergency call; it is
+     * decided by implementation.
+     */
+    UNKNOWN = 0,
+    /**
+     * Indicates the implementation must handle the call through emergency routing.
+     */
+    EMERGENCY = 1,
+    /**
+     * Indicates the implementation must handle the call through normal call routing.
+     */
+    NORMAL = 2,
+};
+
 enum RadioTechnology : @1.0::RadioTechnology {
     /** 5G NR. */
     NR = 20,
diff --git a/sensors/2.0/ISensors.hal b/sensors/2.0/ISensors.hal
index 939bf73..1685a0a 100644
--- a/sensors/2.0/ISensors.hal
+++ b/sensors/2.0/ISensors.hal
@@ -77,11 +77,20 @@
      * framework. The Event FMQ is created using the eventQueueDescriptor.
      * Data may only be written to the Event FMQ. Data must not be read from
      * the Event FMQ since the framework is the only reader. Upon receiving
-     * sensor events, the HAL should write the sensor events to the Event FMQ.
+     * sensor events, the HAL writes the sensor events to the Event FMQ.
+     *
      * Once the HAL is finished writing sensor events to the Event FMQ, the HAL
-     * must call the Event FMQ's EventFlag wake() function with the
-     * EventQueueFlagBits::READ_AND_PROCESS mask which notifies the framework
-     * that sensor events are available to be read and processed.
+     * must notify the framework that sensor events are available to be read and
+     * processed. This is accomplished by either:
+     *     1) Calling the Event FMQ’s EventFlag::wake() function with
+              EventQueueFlagBits::READ_AND_PROCESS
+     *     2) Setting the write notification in the Event FMQ’s writeBlocking()
+     *        function to EventQueueFlagBits::READ_AND_PROCESS.
+     *
+     * If the Event FMQ’s writeBlocking() function is used, the read
+     * notification must be set to EventQueueFlagBits::EVENTS_READ in order to
+     * be notified and unblocked when the framework has successfully read events
+     * from the Event FMQ.
      *
      * The Wake Lock FMQ is used by the framework to notify the HAL when it is
      * safe to release its wake_lock. When the framework receives WAKE_UP events
@@ -110,6 +119,10 @@
      * any outstanding wake_locks held as a result of WAKE_UP events should be
      * released.
      *
+     * All active sensor requests and direct channels must be closed and
+     * properly cleaned up when initialize is called in order to ensure that the
+     * HAL and framework's state is consistent (e.g. after a runtime restart).
+     *
      * initialize must be thread safe and prevent concurrent calls
      * to initialize from simultaneously modifying state.
      *
diff --git a/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
index 37b7349..be7415b 100644
--- a/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
+++ b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
@@ -24,10 +24,12 @@
 
 using ::android::hardware::EventFlag;
 using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
 using ::android::hardware::sensors::V1_0::Result;
 using ::android::hardware::sensors::V1_0::SensorInfo;
 using ::android::hardware::sensors::V2_0::EventQueueFlagBits;
 using ::android::hardware::sensors::V2_0::ISensors;
+using ::android::hardware::sensors::V2_0::ISensorsCallback;
 
 template <typename EnumType>
 constexpr typename std::underlying_type<EnumType>::type asBaseType(EnumType value) {
@@ -36,6 +38,16 @@
 
 constexpr size_t SensorsHidlEnvironmentV2_0::MAX_RECEIVE_BUFFER_EVENT_COUNT;
 
+struct SensorsCallback : ISensorsCallback {
+    Return<void> onDynamicSensorsConnected(const hidl_vec<SensorInfo>& /* sensorInfos */) {
+        return Return<void>();
+    }
+
+    Return<void> onDynamicSensorsDisconnected(const hidl_vec<int32_t>& /* sensorHandles */) {
+        return Return<void>();
+    }
+};
+
 bool SensorsHidlEnvironmentV2_0::resetHal() {
     bool succeed = false;
     do {
@@ -63,7 +75,7 @@
         }
 
         mSensors->initialize(*mEventQueue->getDesc(), *mWakeLockQueue->getDesc(),
-                             nullptr /* TODO: callback */);
+                             new SensorsCallback());
 
         std::vector<SensorInfo> sensorList;
         if (!mSensors->getSensorsList([&](const hidl_vec<SensorInfo>& list) { sensorList = list; })
diff --git a/wifi/1.0/vts/functional/Android.bp b/wifi/1.0/vts/functional/Android.bp
index 3189db4..397ad17 100644
--- a/wifi/1.0/vts/functional/Android.bp
+++ b/wifi/1.0/vts/functional/Android.bp
@@ -45,6 +45,7 @@
     static_libs: [
         "VtsHalWifiV1_0TargetTestUtil",
         "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
         "android.hardware.wifi@1.2",
         "android.hardware.wifi@1.3",
     ],
diff --git a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
index a3fdf27..3555c2e 100644
--- a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
+++ b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
@@ -17,6 +17,7 @@
 #include <android-base/logging.h>
 
 #include <android/hardware/wifi/1.0/IWifiChip.h>
+#include <android/hardware/wifi/1.3/IWifiChip.h>
 
 #include <VtsHalHidlTargetTestBase.h>
 
@@ -87,7 +88,19 @@
 
     uint32_t configureChipForStaIfaceAndGetCapabilities() {
         configureChipForIfaceType(IfaceType::STA, true);
-        const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
+
+        sp<::android::hardware::wifi::V1_3::IWifiChip> chip_converted =
+            ::android::hardware::wifi::V1_3::IWifiChip::castFrom(wifi_chip_);
+
+        std::pair<WifiStatus, uint32_t> status_and_caps;
+
+        if (chip_converted != nullptr) {
+            // Call the newer HAL version
+            status_and_caps = HIDL_INVOKE(chip_converted, getCapabilities_1_3);
+        } else {
+            status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
+        }
+
         if (status_and_caps.first.code != WifiStatusCode::SUCCESS) {
             EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED, status_and_caps.first.code);
             return 0;
diff --git a/wifi/1.1/vts/functional/Android.bp b/wifi/1.1/vts/functional/Android.bp
index 78d7a85..6662314 100644
--- a/wifi/1.1/vts/functional/Android.bp
+++ b/wifi/1.1/vts/functional/Android.bp
@@ -24,6 +24,8 @@
         "VtsHalWifiV1_0TargetTestUtil",
         "android.hardware.wifi@1.0",
         "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
     ],
     test_suites: ["general-tests"],
 }
diff --git a/wifi/1.1/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.1/vts/functional/wifi_chip_hidl_test.cpp
index d3a983c..6323547 100644
--- a/wifi/1.1/vts/functional/wifi_chip_hidl_test.cpp
+++ b/wifi/1.1/vts/functional/wifi_chip_hidl_test.cpp
@@ -18,6 +18,7 @@
 
 #include <android/hardware/wifi/1.1/IWifi.h>
 #include <android/hardware/wifi/1.1/IWifiChip.h>
+#include <android/hardware/wifi/1.3/IWifiChip.h>
 
 #include <VtsHalHidlTargetTestBase.h>
 
@@ -58,7 +59,19 @@
         ChipModeId mode_id;
         EXPECT_TRUE(configureChipToSupportIfaceType(
             wifi_chip_, IfaceType::STA, &mode_id));
-        const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
+
+        sp<::android::hardware::wifi::V1_3::IWifiChip> chip_converted =
+            ::android::hardware::wifi::V1_3::IWifiChip::castFrom(wifi_chip_);
+
+        std::pair<WifiStatus, uint32_t> status_and_caps;
+
+        if (chip_converted != nullptr) {
+            // Call the newer HAL version
+            status_and_caps = HIDL_INVOKE(chip_converted, getCapabilities_1_3);
+        } else {
+            status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
+        }
+
         EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
         return status_and_caps.second;
     }
diff --git a/wifi/1.2/vts/functional/Android.bp b/wifi/1.2/vts/functional/Android.bp
index a969f65..b2956ce 100644
--- a/wifi/1.2/vts/functional/Android.bp
+++ b/wifi/1.2/vts/functional/Android.bp
@@ -27,6 +27,7 @@
         "android.hardware.wifi@1.0",
         "android.hardware.wifi@1.1",
         "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
     ],
     test_suites: ["general-tests"],
 }
diff --git a/wifi/1.2/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.2/vts/functional/wifi_chip_hidl_test.cpp
index a5457b7..9d567fe 100644
--- a/wifi/1.2/vts/functional/wifi_chip_hidl_test.cpp
+++ b/wifi/1.2/vts/functional/wifi_chip_hidl_test.cpp
@@ -18,6 +18,7 @@
 
 #include <android/hardware/wifi/1.2/IWifiChip.h>
 #include <android/hardware/wifi/1.2/IWifiChipEventCallback.h>
+#include <android/hardware/wifi/1.3/IWifiChip.h>
 
 #include <VtsHalHidlTargetCallbackBase.h>
 #include <VtsHalHidlTargetTestBase.h>
@@ -104,7 +105,19 @@
     ChipModeId mode_id;
     EXPECT_TRUE(
         configureChipToSupportIfaceType(wifi_chip_, IfaceType::STA, &mode_id));
-    const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
+
+    sp<::android::hardware::wifi::V1_3::IWifiChip> chip_converted =
+        ::android::hardware::wifi::V1_3::IWifiChip::castFrom(wifi_chip_);
+
+    std::pair<WifiStatus, uint32_t> status_and_caps;
+
+    if (chip_converted != nullptr) {
+        // Call the newer HAL version
+        status_and_caps = HIDL_INVOKE(chip_converted, getCapabilities_1_3);
+    } else {
+        status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
+    }
+
     EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
     return status_and_caps.second;
   }
diff --git a/wifi/1.3/default/tests/wifi_chip_unit_tests.cpp b/wifi/1.3/default/tests/wifi_chip_unit_tests.cpp
index 32ba760..3fcc39e 100644
--- a/wifi/1.3/default/tests/wifi_chip_unit_tests.cpp
+++ b/wifi/1.3/default/tests/wifi_chip_unit_tests.cpp
@@ -16,6 +16,7 @@
 
 #include <android-base/logging.h>
 #include <android-base/macros.h>
+#include <cutils/properties.h>
 #include <gmock/gmock.h>
 
 #undef NAN  // This is weird, NAN is defined in bionic/libc/include/math.h:38
@@ -117,6 +118,19 @@
             .WillRepeatedly(testing::Return(modes));
     }
 
+    void setup_MultiIfaceCombination() {
+        // clang-format off
+        const hidl_vec<V1_0::IWifiChip::ChipIfaceCombination> combinations = {
+            {{{{IfaceType::STA}, 3}}}
+        };
+        const std::vector<V1_0::IWifiChip::ChipMode> modes = {
+            {feature_flags::chip_mode_ids::kV3, combinations}
+        };
+        // clang-format on
+        EXPECT_CALL(*feature_flags_, getChipModes())
+            .WillRepeatedly(testing::Return(modes));
+    }
+
     void assertNumberOfModes(uint32_t num_modes) {
         chip_->getAvailableModes(
             [num_modes](const WifiStatus& status,
@@ -655,6 +669,58 @@
     ASSERT_TRUE(createIface(IfaceType::AP).empty());
 }
 
+class WifiChip_MultiIfaceTest : public WifiChipTest {
+   public:
+    void SetUp() override {
+        setup_MultiIfaceCombination();
+        WifiChipTest::SetUp();
+    }
+};
+
+TEST_F(WifiChip_MultiIfaceTest, Create3Sta) {
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_TRUE(createIface(IfaceType::STA).empty());
+}
+
+TEST_F(WifiChip_MultiIfaceTest, CreateStaWithDefaultNames) {
+    property_set("wifi.interface.0", "");
+    property_set("wifi.interface.1", "");
+    property_set("wifi.interface.2", "");
+    property_set("wifi.interface", "");
+    property_set("wifi.concurrent.interface", "");
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_EQ(createIface(IfaceType::STA), "wlan0");
+    ASSERT_EQ(createIface(IfaceType::STA), "wlan1");
+    ASSERT_EQ(createIface(IfaceType::STA), "wlan2");
+}
+
+TEST_F(WifiChip_MultiIfaceTest, CreateStaWithCustomNames) {
+    property_set("wifi.interface.0", "test0");
+    property_set("wifi.interface.1", "test1");
+    property_set("wifi.interface.2", "test2");
+    property_set("wifi.interface", "bad0");
+    property_set("wifi.concurrent.interface", "bad1");
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_EQ(createIface(IfaceType::STA), "test0");
+    ASSERT_EQ(createIface(IfaceType::STA), "test1");
+    ASSERT_EQ(createIface(IfaceType::STA), "test2");
+}
+
+TEST_F(WifiChip_MultiIfaceTest, CreateStaWithCustomAltNames) {
+    property_set("wifi.interface.0", "");
+    property_set("wifi.interface.1", "");
+    property_set("wifi.interface.2", "");
+    property_set("wifi.interface", "testA0");
+    property_set("wifi.concurrent.interface", "testA1");
+    findModeAndConfigureForIfaceType(IfaceType::STA);
+    ASSERT_EQ(createIface(IfaceType::STA), "testA0");
+    ASSERT_EQ(createIface(IfaceType::STA), "testA1");
+    ASSERT_EQ(createIface(IfaceType::STA), "wlan2");
+}
+
 }  // namespace implementation
 }  // namespace V1_3
 }  // namespace wifi
diff --git a/wifi/1.3/default/wifi_chip.cpp b/wifi/1.3/default/wifi_chip.cpp
index 1f1aa95..e7ebc3b 100644
--- a/wifi/1.3/default/wifi_chip.cpp
+++ b/wifi/1.3/default/wifi_chip.cpp
@@ -41,6 +41,7 @@
 constexpr uint32_t kMaxRingBufferFileAgeSeconds = 60 * 60 * 10;
 constexpr uint32_t kMaxRingBufferFileNum = 20;
 constexpr char kTombstoneFolderPath[] = "/data/vendor/tombstones/wifi/";
+constexpr unsigned kMaxWlanIfaces = 100;
 
 template <typename Iface>
 void invalidateAndClear(std::vector<sp<Iface>>& ifaces, sp<Iface> iface) {
@@ -78,16 +79,25 @@
     return nullptr;
 }
 
-std::string getWlan0IfaceName() {
-    std::array<char, PROPERTY_VALUE_MAX> buffer;
-    property_get("wifi.interface", buffer.data(), "wlan0");
-    return buffer.data();
-}
+std::string getWlanIfaceName(unsigned idx) {
+    if (idx >= kMaxWlanIfaces) {
+        CHECK(false) << "Requested interface beyond wlan" << kMaxWlanIfaces;
+        return {};
+    }
 
-std::string getWlan1IfaceName() {
     std::array<char, PROPERTY_VALUE_MAX> buffer;
-    property_get("wifi.concurrent.interface", buffer.data(), "wlan1");
-    return buffer.data();
+    std::string propName = "wifi.interface." + std::to_string(idx);
+    auto res = property_get(propName.c_str(), buffer.data(), nullptr);
+    if (res > 0) return buffer.data();
+
+    if (idx == 0 || idx == 1) {
+        const char* altPropName =
+            (idx == 0) ? "wifi.interface" : "wifi.concurrent.interface";
+        res = property_get(altPropName, buffer.data(), nullptr);
+        if (res > 0) return buffer.data();
+    }
+
+    return "wlan" + std::to_string(idx);
 }
 
 std::string getP2pIfaceName() {
@@ -636,13 +646,14 @@
     legacy_hal::wifi_error legacy_status;
     uint32_t legacy_feature_set;
     uint32_t legacy_logger_feature_set;
+    const auto ifname = getWlanIfaceName(0);
     std::tie(legacy_status, legacy_feature_set) =
-        legacy_hal_.lock()->getSupportedFeatureSet(getWlan0IfaceName());
+        legacy_hal_.lock()->getSupportedFeatureSet(ifname);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), 0};
     }
     std::tie(legacy_status, legacy_logger_feature_set) =
-        legacy_hal_.lock()->getLoggerSupportedFeatureSet(getWlan0IfaceName());
+        legacy_hal_.lock()->getLoggerSupportedFeatureSet(ifname);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         // some devices don't support querying logger feature set
         legacy_logger_feature_set = 0;
@@ -703,8 +714,9 @@
     IWifiChip::ChipDebugInfo result;
     legacy_hal::wifi_error legacy_status;
     std::string driver_desc;
+    const auto ifname = getWlanIfaceName(0);
     std::tie(legacy_status, driver_desc) =
-        legacy_hal_.lock()->getDriverVersion(getWlan0IfaceName());
+        legacy_hal_.lock()->getDriverVersion(ifname);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         LOG(ERROR) << "Failed to get driver version: "
                    << legacyErrorToString(legacy_status);
@@ -716,7 +728,7 @@
 
     std::string firmware_desc;
     std::tie(legacy_status, firmware_desc) =
-        legacy_hal_.lock()->getFirmwareVersion(getWlan0IfaceName());
+        legacy_hal_.lock()->getFirmwareVersion(ifname);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         LOG(ERROR) << "Failed to get firmware version: "
                    << legacyErrorToString(legacy_status);
@@ -734,7 +746,7 @@
     legacy_hal::wifi_error legacy_status;
     std::vector<uint8_t> driver_dump;
     std::tie(legacy_status, driver_dump) =
-        legacy_hal_.lock()->requestDriverMemoryDump(getWlan0IfaceName());
+        legacy_hal_.lock()->requestDriverMemoryDump(getWlanIfaceName(0));
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         LOG(ERROR) << "Failed to get driver debug dump: "
                    << legacyErrorToString(legacy_status);
@@ -749,7 +761,7 @@
     legacy_hal::wifi_error legacy_status;
     std::vector<uint8_t> firmware_dump;
     std::tie(legacy_status, firmware_dump) =
-        legacy_hal_.lock()->requestFirmwareMemoryDump(getWlan0IfaceName());
+        legacy_hal_.lock()->requestFirmwareMemoryDump(getWlanIfaceName(0));
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         LOG(ERROR) << "Failed to get firmware debug dump: "
                    << legacyErrorToString(legacy_status);
@@ -809,7 +821,7 @@
         return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
     }
     // These are still assumed to be based on wlan0.
-    std::string ifname = getWlan0IfaceName();
+    std::string ifname = getWlanIfaceName(0);
     sp<WifiNanIface> iface = new WifiNanIface(ifname, legacy_hal_);
     nan_ifaces_.push_back(iface);
     for (const auto& callback : event_cb_handler_.getCallbacks()) {
@@ -952,7 +964,7 @@
         return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
     }
     sp<WifiRttController> rtt =
-        new WifiRttController(getWlan0IfaceName(), bound_iface, legacy_hal_);
+        new WifiRttController(getWlanIfaceName(0), bound_iface, legacy_hal_);
     rtt_controllers_.emplace_back(rtt);
     return {createWifiStatus(WifiStatusCode::SUCCESS), rtt};
 }
@@ -963,7 +975,7 @@
     std::vector<legacy_hal::wifi_ring_buffer_status>
         legacy_ring_buffer_status_vec;
     std::tie(legacy_status, legacy_ring_buffer_status_vec) =
-        legacy_hal_.lock()->getRingBuffersStatus(getWlan0IfaceName());
+        legacy_hal_.lock()->getRingBuffersStatus(getWlanIfaceName(0));
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
@@ -985,7 +997,7 @@
     }
     legacy_hal::wifi_error legacy_status =
         legacy_hal_.lock()->startRingBufferLogging(
-            getWlan0IfaceName(), ring_name,
+            getWlanIfaceName(0), ring_name,
             static_cast<
                 std::underlying_type<WifiDebugRingBufferVerboseLevel>::type>(
                 verbose_level),
@@ -1002,7 +1014,7 @@
         return status;
     }
     legacy_hal::wifi_error legacy_status =
-        legacy_hal_.lock()->getRingBufferData(getWlan0IfaceName(), ring_name);
+        legacy_hal_.lock()->getRingBufferData(getWlanIfaceName(0), ring_name);
 
     return createWifiStatusFromLegacyError(legacy_status);
 }
@@ -1018,7 +1030,7 @@
 WifiStatus WifiChip::stopLoggingToDebugRingBufferInternal() {
     legacy_hal::wifi_error legacy_status =
         legacy_hal_.lock()->deregisterRingBufferCallbackHandler(
-            getWlan0IfaceName());
+            getWlanIfaceName(0));
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
@@ -1027,7 +1039,7 @@
     legacy_hal::wifi_error legacy_status;
     legacy_hal::WakeReasonStats legacy_stats;
     std::tie(legacy_status, legacy_stats) =
-        legacy_hal_.lock()->getWakeReasonStats(getWlan0IfaceName());
+        legacy_hal_.lock()->getWakeReasonStats(getWlanIfaceName(0));
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
@@ -1059,10 +1071,10 @@
             }
         };
         legacy_status = legacy_hal_.lock()->registerErrorAlertCallbackHandler(
-            getWlan0IfaceName(), on_alert_callback);
+            getWlanIfaceName(0), on_alert_callback);
     } else {
         legacy_status = legacy_hal_.lock()->deregisterErrorAlertCallbackHandler(
-            getWlan0IfaceName());
+            getWlanIfaceName(0));
     }
     return createWifiStatusFromLegacyError(legacy_status);
 }
@@ -1070,20 +1082,20 @@
 WifiStatus WifiChip::selectTxPowerScenarioInternal(
     V1_1::IWifiChip::TxPowerScenario scenario) {
     auto legacy_status = legacy_hal_.lock()->selectTxPowerScenario(
-        getWlan0IfaceName(),
+        getWlanIfaceName(0),
         hidl_struct_util::convertHidlTxPowerScenarioToLegacy(scenario));
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
 WifiStatus WifiChip::resetTxPowerScenarioInternal() {
     auto legacy_status =
-        legacy_hal_.lock()->resetTxPowerScenario(getWlan0IfaceName());
+        legacy_hal_.lock()->resetTxPowerScenario(getWlanIfaceName(0));
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
 WifiStatus WifiChip::setLatencyModeInternal(LatencyMode mode) {
     auto legacy_status = legacy_hal_.lock()->setLatencyMode(
-        getWlan0IfaceName(),
+        getWlanIfaceName(0),
         hidl_struct_util::convertHidlLatencyModeToLegacy(mode));
     return createWifiStatusFromLegacyError(legacy_status);
 }
@@ -1099,7 +1111,7 @@
 WifiStatus WifiChip::selectTxPowerScenarioInternal_1_2(
     TxPowerScenario scenario) {
     auto legacy_status = legacy_hal_.lock()->selectTxPowerScenario(
-        getWlan0IfaceName(),
+        getWlanIfaceName(0),
         hidl_struct_util::convertHidlTxPowerScenarioToLegacy_1_2(scenario));
     return createWifiStatusFromLegacyError(legacy_status);
 }
@@ -1179,7 +1191,7 @@
         };
     legacy_hal::wifi_error legacy_status =
         legacy_hal_.lock()->registerRingBufferCallbackHandler(
-            getWlan0IfaceName(), on_ring_buffer_data_callback);
+            getWlanIfaceName(0), on_ring_buffer_data_callback);
 
     if (legacy_status == legacy_hal::WIFI_SUCCESS) {
         debug_ring_buffer_cb_registered_ = true;
@@ -1213,7 +1225,7 @@
         };
     legacy_hal::wifi_error legacy_status =
         legacy_hal_.lock()->registerRadioModeChangeCallbackHandler(
-            getWlan0IfaceName(), on_radio_mode_change_callback);
+            getWlanIfaceName(0), on_radio_mode_change_callback);
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
@@ -1330,22 +1342,17 @@
     return false;
 }
 
-// Return "wlan0", if "wlan0" is not already in use, else return "wlan1".
-// This is based on the assumption that we'll have a max of 2 concurrent
-// AP/STA ifaces.
+// Return the first wlan (wlan0, wlan1 etc.) not already in use.
+// This doesn't check the actual presence of these interfaces.
 std::string WifiChip::allocateApOrStaIfaceName() {
-    auto ap_iface = findUsingName(ap_ifaces_, getWlan0IfaceName());
-    auto sta_iface = findUsingName(sta_ifaces_, getWlan0IfaceName());
-    if (!ap_iface.get() && !sta_iface.get()) {
-        return getWlan0IfaceName();
-    }
-    ap_iface = findUsingName(ap_ifaces_, getWlan1IfaceName());
-    sta_iface = findUsingName(sta_ifaces_, getWlan1IfaceName());
-    if (!ap_iface.get() && !sta_iface.get()) {
-        return getWlan1IfaceName();
+    for (unsigned i = 0; i < kMaxWlanIfaces; i++) {
+        const auto ifname = getWlanIfaceName(i);
+        if (findUsingName(ap_ifaces_, ifname)) continue;
+        if (findUsingName(sta_ifaces_, ifname)) continue;
+        return ifname;
     }
     // This should never happen. We screwed up somewhere if it did.
-    CHECK(0) << "wlan0 and wlan1 in use already!";
+    CHECK(false) << "All wlan interfaces in use already!";
     return {};
 }
 
diff --git a/wifi/1.3/vts/functional/wifi_sta_iface_hidl_test.cpp b/wifi/1.3/vts/functional/wifi_sta_iface_hidl_test.cpp
index e195ade..71e90ac 100644
--- a/wifi/1.3/vts/functional/wifi_sta_iface_hidl_test.cpp
+++ b/wifi/1.3/vts/functional/wifi_sta_iface_hidl_test.cpp
@@ -43,6 +43,13 @@
     virtual void TearDown() override { stopWifi(); }
 
    protected:
+    bool isCapabilitySupported(IWifiStaIface::StaIfaceCapabilityMask cap_mask) {
+        const auto& status_and_caps =
+            HIDL_INVOKE(wifi_sta_iface_, getCapabilities);
+        EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
+        return (status_and_caps.second & cap_mask) != 0;
+    }
+
     sp<IWifiStaIface> wifi_sta_iface_;
 };
 
@@ -61,3 +68,30 @@
         EXPECT_NE(0, status_and_mac.second[i]);
     }
 }
+
+/*
+ * GetLinkLayerStats_1_3
+ * Ensures that calls to get link layer stats V1_3 will retrieve a non-empty
+ * StaLinkLayerStats after link layer stats collection is enabled.
+ */
+TEST_F(WifiStaIfaceHidlTest, GetLinkLayerStats_1_3) {
+    if (!isCapabilitySupported(
+            IWifiStaIface::StaIfaceCapabilityMask::LINK_LAYER_STATS)) {
+        // No-op if link layer stats is not supported.
+        return;
+    }
+
+    // Enable link layer stats collection.
+    EXPECT_EQ(WifiStatusCode::SUCCESS,
+              HIDL_INVOKE(wifi_sta_iface_, enableLinkLayerStatsCollection, true)
+                  .code);
+    // Retrieve link layer stats.
+    const auto& status_and_stats =
+        HIDL_INVOKE(wifi_sta_iface_, getLinkLayerStats_1_3);
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_stats.first.code);
+    EXPECT_GT(status_and_stats.second.timeStampInMs, 0u);
+    // Disable link layer stats collection.
+    EXPECT_EQ(
+        WifiStatusCode::SUCCESS,
+        HIDL_INVOKE(wifi_sta_iface_, disableLinkLayerStatsCollection).code);
+}
diff --git a/wifi/supplicant/1.2/Android.bp b/wifi/supplicant/1.2/Android.bp
index 529dad4..18e1cca 100644
--- a/wifi/supplicant/1.2/Android.bp
+++ b/wifi/supplicant/1.2/Android.bp
@@ -10,13 +10,22 @@
         "ISupplicant.hal",
         "ISupplicantP2pIface.hal",
         "ISupplicantStaIface.hal",
+        "ISupplicantStaIfaceCallback.hal",
         "ISupplicantStaNetwork.hal",
+        "types.hal",
     ],
     interfaces: [
         "android.hardware.wifi.supplicant@1.0",
         "android.hardware.wifi.supplicant@1.1",
         "android.hidl.base@1.0",
     ],
+    types: [
+        "DppAkm",
+        "DppNetRole",
+        "DppSuccessCode",
+        "DppProgressCode",
+        "DppFailureCode",
+    ],
     gen_java: true,
 }
 
diff --git a/wifi/supplicant/1.2/ISupplicantStaIface.hal b/wifi/supplicant/1.2/ISupplicantStaIface.hal
index a338c6a..9152a64 100644
--- a/wifi/supplicant/1.2/ISupplicantStaIface.hal
+++ b/wifi/supplicant/1.2/ISupplicantStaIface.hal
@@ -18,6 +18,7 @@
 
 import @1.0::SupplicantStatus;
 import @1.1::ISupplicantStaIface;
+import @1.2::ISupplicantStaIfaceCallback;
 import @1.2::ISupplicantStaNetwork;
 
 /**
@@ -25,6 +26,24 @@
  * interface (e.g wlan0) it controls.
  */
 interface ISupplicantStaIface extends @1.1::ISupplicantStaIface {
+    /**
+     * Register for callbacks from this interface.
+     *
+     * These callbacks are invoked for events that are specific to this interface.
+     * Registration of multiple callback objects is supported. These objects must
+     * be automatically deleted when the corresponding client process is dead or
+     * if this interface is removed.
+     *
+     * @param callback An instance of the |ISupplicantStaIfaceCallback| HIDL
+     *        interface object.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+     */
+    registerCallback_1_2(ISupplicantStaIfaceCallback callback)
+        generates (SupplicantStatus status);
 
     /**
      * Get Key management capabilities of the device
@@ -38,5 +57,84 @@
      */
     getKeyMgmtCapabilities()
         generates (SupplicantStatus status, bitfield<KeyMgmtMask> keyMgmtMask);
-};
 
+    /**
+     * Add a DPP peer URI. URI is acquired externally, e.g. by scanning a QR code
+     *
+     * @param uri Peer's DPP URI.
+     * @return status Status of the operation, and an ID for the URI.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    addDppPeerUri(string uri)
+        generates (SupplicantStatus status, uint32_t id);
+
+    /**
+     * Remove a DPP peer URI.
+     *
+     * @param id The ID of the URI, as returned by |addDppPeerUri|.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    removeDppUri(uint32_t id)
+        generates (SupplicantStatus status);
+
+    /**
+     * Start DPP in Configurator-Initiator mode.
+     *
+     * @param peerBootstrapId Peer device's URI ID.
+     * @param ownBootstrapId Local device's URI ID (0 for none, optional).
+     * @param ssid Network SSID to send to peer (SAE/PSK mode).
+     * @param password Network password to send to peer (SAE/PSK mode).
+     * @param psk Network PSK to send to peer (PSK mode only). Either password or psk should be set.
+     * @param netRole Role to configure the peer, |DppNetRole.DPP_NET_ROLE_STA| or
+     *        |DppNetRole.DPP_NET_ROLE_AP|.
+     * @param securityAkm Security AKM to use (See DppAkm).
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    startDppConfiguratorInitiator(uint32_t peerBootstrapId,
+        uint32_t ownBootstrapId, string ssid, string password,
+        string psk, DppNetRole netRole, DppAkm securityAkm)
+        generates (SupplicantStatus status);
+
+    /**
+     * Start DPP in Enrollee-Initiator mode.
+     *
+     * @param peerBootstrapId Peer device's URI ID.
+     * @param ownBootstrapId Local device's URI ID (0 for none, optional).
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    startDppEnrolleeInitiator(uint32_t peerBootstrapId,
+        uint32_t ownBootstrapId)
+        generates (SupplicantStatus status);
+
+    /**
+     * Stop DPP Initiator operation.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+     stopDppInitiator()
+        generates (SupplicantStatus status);
+};
diff --git a/wifi/supplicant/1.2/ISupplicantStaIfaceCallback.hal b/wifi/supplicant/1.2/ISupplicantStaIfaceCallback.hal
new file mode 100644
index 0000000..5d5cccf
--- /dev/null
+++ b/wifi/supplicant/1.2/ISupplicantStaIfaceCallback.hal
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant@1.2;
+
+import @1.1::ISupplicantStaIfaceCallback;
+import @1.0::Ssid;
+
+/**
+ * Callback Interface exposed by the supplicant service
+ * for each station mode interface (ISupplicantStaIface).
+ *
+ * Clients need to host an instance of this HIDL interface object and
+ * pass a reference of the object to the supplicant via the
+ * corresponding |ISupplicantStaIface.registerCallback_1_2| method.
+ */
+interface ISupplicantStaIfaceCallback extends @1.1::ISupplicantStaIfaceCallback {
+    /**
+     * Indicates DPP configuration received success event (Enrolee mode).
+     */
+    oneway onDppSuccessConfigReceived(Ssid ssid, string password, uint8_t[32] psk,
+        DppAkm securityAkm);
+
+    /**
+     * Indicates DPP configuration sent success event (Configurator mode).
+     */
+    oneway onDppSuccess(DppSuccessCode code);
+
+    /**
+     * Indicates a DPP progress event.
+     */
+    oneway onDppProgress(DppProgressCode code);
+
+    /**
+     * Indicates a DPP failure event.
+     */
+    oneway onDppFailure(DppFailureCode code);
+};
diff --git a/wifi/supplicant/1.2/ISupplicantStaNetwork.hal b/wifi/supplicant/1.2/ISupplicantStaNetwork.hal
index 6fd0d51..6c356a4 100644
--- a/wifi/supplicant/1.2/ISupplicantStaNetwork.hal
+++ b/wifi/supplicant/1.2/ISupplicantStaNetwork.hal
@@ -36,6 +36,9 @@
 
         /** Enhacned Open (OWE) Key management */
         OWE = 1 << 22,
+
+        /** Easy Connect (DPP) Key management */
+        DPP = 1 << 23,
     };
 
     /** Possble mask of values for PairwiseCipher param. */
diff --git a/wifi/supplicant/1.2/types.hal b/wifi/supplicant/1.2/types.hal
new file mode 100644
index 0000000..576b4f5
--- /dev/null
+++ b/wifi/supplicant/1.2/types.hal
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant@1.2;
+
+/**
+ * DppAkm: The various AKMs that can be provisioned using DPP.
+ */
+enum DppAkm : uint32_t {
+    PSK,
+    PSK_SAE,
+    SAE,
+    DPP,
+};
+
+/**
+ * DppNetRole: The network role that the configurator offers the enrollee.
+ */
+enum DppNetRole: uint32_t {
+    STA,
+    AP,
+};
+
+/**
+ * DppSuccessCode: Success codes for DPP (Easy Connect)
+ */
+enum DppSuccessCode : uint32_t {
+    CONFIGURATION_SENT,
+};
+
+/**
+ * DppProgressCode: Progress codes for DPP (Easy Connect)
+ */
+enum DppProgressCode : uint32_t {
+    AUTHENTICATION_SUCCESS,
+    RESPONSE_PENDING,
+};
+
+/**
+ * DppFailureCode: Error codes for DPP (Easy Connect)
+ */
+enum DppFailureCode : uint32_t {
+    INVALID_URI,
+    AUTHENTICATION,
+    NOT_COMPATIBLE,
+    CONFIGURATION,
+    BUSY,
+    TIMEOUT,
+    FAILURE,
+};