diff --git a/automotive/vehicle/2.0/default/Android.mk b/automotive/vehicle/2.0/default/Android.mk
index 3c56159..ee6d134 100644
--- a/automotive/vehicle/2.0/default/Android.mk
+++ b/automotive/vehicle/2.0/default/Android.mk
@@ -98,6 +98,7 @@
     $(vhal_v2_0) \
 
 LOCAL_STATIC_LIBRARIES := \
+    libqemu_pipe \
     $(vhal_v2_0)-libproto-native \
 
 LOCAL_CFLAGS += -Wall -Wextra -Werror
@@ -162,6 +163,7 @@
     $(vhal_v2_0)-manager-lib \
     $(vhal_v2_0)-default-impl-lib \
     $(vhal_v2_0)-libproto-native \
+    libqemu_pipe \
 
 LOCAL_CFLAGS += -Wall -Wextra -Werror
 
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
index 2b15aa3..5a9b254 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/PipeComm.cpp
@@ -17,9 +17,8 @@
 #define LOG_TAG "PipeComm"
 
 #include <android/hardware/automotive/vehicle/2.0/IVehicle.h>
-#include <android/log.h>
 #include <log/log.h>
-#include <system/qemu_pipe.h>
+#include <qemu_pipe.h>
 
 #include "PipeComm.h"
 
diff --git a/automotive/vehicle/2.1/Android.mk b/automotive/vehicle/2.1/Android.mk
index f030af08..a421c86 100644
--- a/automotive/vehicle/2.1/Android.mk
+++ b/automotive/vehicle/2.1/Android.mk
@@ -208,9 +208,9 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (VmsMessageIntegerValuesIndex)
+# Build types.hal (VmsBaseMessageIntegerValuesIndex)
 #
-GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsMessageIntegerValuesIndex.java
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsBaseMessageIntegerValuesIndex.java
 $(GEN): $(HIDL)
 $(GEN): PRIVATE_HIDL := $(HIDL)
 $(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
@@ -220,7 +220,7 @@
         -Ljava \
         -randroid.hardware:hardware/interfaces \
         -randroid.hidl:system/libhidl/transport \
-        android.hardware.automotive.vehicle@2.1::types.VmsMessageIntegerValuesIndex
+        android.hardware.automotive.vehicle@2.1::types.VmsBaseMessageIntegerValuesIndex
 
 $(GEN): $(LOCAL_PATH)/types.hal
 	$(transform-generated-source)
@@ -246,6 +246,63 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (VmsOfferingMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsOfferingMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsOfferingMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSimpleMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSimpleMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSimpleMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSubscriptionResponseFormat)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSubscriptionResponseFormat.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSubscriptionResponseFormat
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build IVehicle.hal
 #
 GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/IVehicle.java
@@ -472,9 +529,9 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
-# Build types.hal (VmsMessageIntegerValuesIndex)
+# Build types.hal (VmsBaseMessageIntegerValuesIndex)
 #
-GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsMessageIntegerValuesIndex.java
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsBaseMessageIntegerValuesIndex.java
 $(GEN): $(HIDL)
 $(GEN): PRIVATE_HIDL := $(HIDL)
 $(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
@@ -484,7 +541,7 @@
         -Ljava \
         -randroid.hardware:hardware/interfaces \
         -randroid.hidl:system/libhidl/transport \
-        android.hardware.automotive.vehicle@2.1::types.VmsMessageIntegerValuesIndex
+        android.hardware.automotive.vehicle@2.1::types.VmsBaseMessageIntegerValuesIndex
 
 $(GEN): $(LOCAL_PATH)/types.hal
 	$(transform-generated-source)
@@ -510,6 +567,63 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (VmsOfferingMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsOfferingMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsOfferingMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSimpleMessageIntegerValuesIndex)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSimpleMessageIntegerValuesIndex.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSimpleMessageIntegerValuesIndex
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (VmsSubscriptionResponseFormat)
+#
+GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/VmsSubscriptionResponseFormat.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.automotive.vehicle@2.1::types.VmsSubscriptionResponseFormat
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build IVehicle.hal
 #
 GEN := $(intermediates)/android/hardware/automotive/vehicle/V2_1/IVehicle.java
diff --git a/automotive/vehicle/2.1/default/Android.mk b/automotive/vehicle/2.1/default/Android.mk
index 32ec456..f19263c 100644
--- a/automotive/vehicle/2.1/default/Android.mk
+++ b/automotive/vehicle/2.1/default/Android.mk
@@ -65,6 +65,7 @@
 LOCAL_STATIC_LIBRARIES := \
     $(vhal_v2_0)-default-impl-lib \
     $(vhal_v2_0)-manager-lib \
+    libqemu_pipe \
     $(vhal_v2_1)-manager-lib \
     $(vhal_v2_0)-libproto-native
 
@@ -101,6 +102,7 @@
     $(vhal_v2_0)-manager-lib \
     $(vhal_v2_0)-default-impl-lib \
     $(vhal_v2_1)-default-impl-lib \
+    libqemu_pipe \
     $(vhal_v2_1)-manager-lib \
 
 LOCAL_SHARED_LIBRARIES := \
diff --git a/automotive/vehicle/2.1/types.hal b/automotive/vehicle/2.1/types.hal
index 08dc144..5594d19 100644
--- a/automotive/vehicle/2.1/types.hal
+++ b/automotive/vehicle/2.1/types.hal
@@ -584,22 +584,67 @@
 
   /** A client publishes a data packet. */
   DATA = 3,
+
+  /* A client declaring layers offering. */
+  OFFERING = 4,
+
+  /* Update for the available layers. */
+  AVAILABILITY = 5,
+
+  /** Requesting layers that have subscribers. */
+  SUBSCRIPTION_REQUEST = 6,
+
+  /** Returning layers that have subscribers. */
+  SUBSCRIPTION_RESPONSE = 7,
 };
 
 /**
  * This enum provides the canonical mapping for VMS properties that have an
  * integer value.
  */
-enum VmsMessageIntegerValuesIndex : int32_t {
-  /** The message type as enumerated by VmsMessageType enum. */
+enum VmsBaseMessageIntegerValuesIndex : int32_t {
+  /* The message type as enumerated by VmsMessageType enum. */
   VMS_MESSAGE_TYPE = 0,
+};
 
-  /** The layer ID as defined in the vms protocol. */
+/*
+ * This enum provides the canonical mapping for VMS SUBMIT, UNSUBMIT and DATA
+ * messages integer value properties.
+ */
+enum VmsSimpleMessageIntegerValuesIndex : VmsBaseMessageIntegerValuesIndex {
+  /* The layer ID as defined in the vms protocol. */
   VMS_LAYER_ID = 1,
 
-  /** The version of the VMS layer. */
+  /* The version of the VMS layer. */
   VMS_LAYER_VERSION = 2,
+};
 
-  /** The number of bytes in the payload */
-  VMS_PAYLOAD_SIZE_BYTES = 3,
+/*
+ * This enum provides the canonical mapping for VMS offering messages integer
+ * value properties
+ */
+enum VmsOfferingMessageIntegerValuesIndex : VmsBaseMessageIntegerValuesIndex {
+  /* The number of VMS layer dependencies. */
+  VMS_NUMBER_OF_LAYERS_DEPENDENCIES = 1,
+
+  /* The first index that contain dependencies */
+  FIRST_DEPENDENCIES_INDEX = 2,
+};
+
+/**
+ * A VMS subscription request only contains its message type. The format of a VMS subscription
+ * response is described below.
+ */
+enum VmsSubscriptionResponseFormat : VmsBaseMessageIntegerValuesIndex {
+  /**
+    * Recipients should ignore any packet with a sequence number that is less than the highest
+    * sequence number they have seen thus far.
+    */
+  SEQUENCE_NUMBER = 1,
+
+  /** The number of VMS layers. Each layer has two integers: type and version. */
+  NUMBER_OF_LAYERS = 2,
+
+  /** The first index that contains a layer. */
+  FIRST_LAYER = 3,
 };
diff --git a/broadcastradio/1.1/ITuner.hal b/broadcastradio/1.1/ITuner.hal
index 82d45c6..dd7c844 100644
--- a/broadcastradio/1.1/ITuner.hal
+++ b/broadcastradio/1.1/ITuner.hal
@@ -47,8 +47,8 @@
      *
      * @return result OK if the scan was properly scheduled (this does not mean
      *                it successfully finished).
-     *                TEMPORARILY_UNAVAILABLE if the background scan is
-     *                temporarily unavailable, ie. due to ongoing foreground
+     *                UNAVAILABLE if the background scan is unavailable,
+     *                ie. temporarily due to ongoing foreground
      *                playback in single-tuner device.
      *                NOT_INITIALIZED other error, ie. HW failure.
      */
@@ -74,4 +74,33 @@
     getProgramList(string filter)
         generates (ProgramListResult result, vec<ProgramInfo> programList);
 
+    /**
+     * Checks, if the analog playback is forced, see setAnalogForced.
+     *
+     * The isForced value is only valid if result was OK.
+     *
+     * @return result OK if the call succeeded and isForced is valid.
+     *                INVALID_STATE if the switch is not supported at current
+     *                configuration.
+     *                NOT_INITIALIZED if any other error occurs.
+     * @return isForced true if analog is forced, false otherwise.
+     */
+    isAnalogForced() generates (Result result, bool isForced);
+
+    /**
+     * Forces the analog playback for the supporting radio technology.
+     *
+     * User may disable digital playback for FM HD Radio or hybrid FM/DAB with
+     * this option. This is purely user choice, ie. does not reflect digital-
+     * analog handover managed from the HAL implementation side.
+     *
+     * Some radio technologies may not support this, ie. DAB.
+     *
+     * @param isForced true to force analog, false for a default behaviour.
+     * @return result OK if the setting was successfully done.
+     *                INVALID_STATE if the switch is not supported at current
+     *                configuration.
+     *                NOT_INITIALIZED if any other error occurs.
+     */
+    setAnalogForced(bool isForced) generates (Result result);
 };
diff --git a/broadcastradio/1.1/ITunerCallback.hal b/broadcastradio/1.1/ITunerCallback.hal
index 07ce984..158e217 100644
--- a/broadcastradio/1.1/ITunerCallback.hal
+++ b/broadcastradio/1.1/ITunerCallback.hal
@@ -40,11 +40,19 @@
     oneway afSwitch_1_1(ProgramInfo info);
 
     /**
+     * Called by the HAL when background scan feature becomes available or not.
+     *
+     * @param isAvailable true, if the tuner turned temporarily background-
+     *                    capable, false in the other case.
+     */
+    oneway backgroundScanAvailable(bool isAvailable);
+
+    /**
      * Called by the HAL when background scan initiated by startBackgroundScan
      * finishes. If the list was changed, programListChanged must be called too.
      * @param result OK if the scan succeeded, client may retrieve the actual
      *               list with ITuner::getProgramList.
-     *               TEMPORARILY_UNAVAILABLE if the scan was interrupted due to
+     *               UNAVAILABLE if the scan was interrupted due to
      *               hardware becoming temporarily unavailable.
      *               NOT_INITIALIZED other error, ie. HW failure.
      */
diff --git a/broadcastradio/1.1/default/Tuner.cpp b/broadcastradio/1.1/default/Tuner.cpp
index f280754..4a6c691 100644
--- a/broadcastradio/1.1/default/Tuner.cpp
+++ b/broadcastradio/1.1/default/Tuner.cpp
@@ -211,6 +211,17 @@
     return Void();
 }
 
+Return<void> Tuner::isAnalogForced(isAnalogForced_cb _hidl_cb) {
+    // TODO(b/34348946): do the actual implementation.
+    _hidl_cb(Result::NOT_INITIALIZED, false);
+    return Void();
+}
+
+Return<Result> Tuner::setAnalogForced(bool isForced __unused) {
+    // TODO(b/34348946): do the actual implementation.
+    return Result::NOT_INITIALIZED;
+}
+
 } // namespace implementation
 }  // namespace V1_1
 }  // namespace broadcastradio
diff --git a/broadcastradio/1.1/default/Tuner.h b/broadcastradio/1.1/default/Tuner.h
index d7b4545..57eafd3 100644
--- a/broadcastradio/1.1/default/Tuner.h
+++ b/broadcastradio/1.1/default/Tuner.h
@@ -44,6 +44,8 @@
     Return<void> getProgramInformation_1_1(getProgramInformation_1_1_cb _hidl_cb) override;
     Return<ProgramListResult> startBackgroundScan() override;
     Return<void> getProgramList(const hidl_string& filter, getProgramList_cb _hidl_cb) override;
+    Return<void> isAnalogForced(isAnalogForced_cb _hidl_cb) override;
+    Return<Result> setAnalogForced(bool isForced) override;
 
     static void callback(radio_hal_event_t *halEvent, void *cookie);
     void onCallback(radio_hal_event_t *halEvent);
diff --git a/broadcastradio/1.1/types.hal b/broadcastradio/1.1/types.hal
index 3021f2e..5577ea0 100644
--- a/broadcastradio/1.1/types.hal
+++ b/broadcastradio/1.1/types.hal
@@ -23,7 +23,7 @@
 enum ProgramListResult : Result {
     NOT_READY,
     NOT_STARTED,
-    TEMPORARILY_UNAVAILABLE,
+    UNAVAILABLE,
 };
 
 /**
@@ -53,6 +53,18 @@
      * it may not be available though, see startBackgroundScan.
      */
     bool supportsBackgroundScanning;
+
+    /**
+     * Opaque vendor-specific string, to be passed to front-end without changes.
+     * Format of this string can vary across vendors.
+     *
+     * It may be used for extra features, that's not supported by a platform,
+     * for example: "preset-slots=6;ultra-hd-capable=false".
+     *
+     * Front-end application MUST verify vendor/product name from the
+     * @1.0::Properties struct before doing any interpretation of this value.
+     */
+    string vendorExension;
 };
 
 /**
@@ -64,10 +76,14 @@
     bitfield<ProgramInfoFlags> flags;
 
     /**
-     * Vendors are allowed to define their own set of flags and store it in this
-     * field. They MUST verify vendor/product name from Properties struct
-     * (IBroadcastRadio::getProperties) before doing any interpretation
-     * of such values.
+     * Opaque vendor-specific string, to be passed to front-end without changes.
+     * Format of this string can vary across vendors.
+     *
+     * It may be used for extra features, that's not supported by a platform,
+     * for example: "paid-service=true;bitrate=320kbps".
+     *
+     * Front-end application MUST verify vendor/product name from the
+     * @1.0::Properties struct before doing any interpretation of this value.
      */
-    uint32_t vendorFlags;
+    string vendorExension;
 };
diff --git a/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp b/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp
index d3c05c4..aa5ab54 100644
--- a/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp
+++ b/broadcastradio/1.1/vts/functional/VtsHalBroadcastradioV1_1TargetTest.cpp
@@ -129,6 +129,10 @@
             return Void();
         }
 
+        virtual Return<void> backgroundScanAvailable(bool isAvailable __unused) {
+            return Void();
+        }
+
         virtual Return<void> backgroundScanComplete(ProgramListResult result __unused) {
             return Void();
         }
diff --git a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
index e97ac10..5a0d73a 100644
--- a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
@@ -16,7 +16,6 @@
 
 #define LOG_TAG "drm_hal_clearkey_test@1.0"
 
-#include <android-base/logging.h>
 #include <android/hardware/drm/1.0/ICryptoFactory.h>
 #include <android/hardware/drm/1.0/ICryptoPlugin.h>
 #include <android/hardware/drm/1.0/IDrmFactory.h>
@@ -27,8 +26,8 @@
 #include <hidl/HidlSupport.h>
 #include <hidlmemory/mapping.h>
 #include <log/log.h>
-#include <openssl/aes.h>
 #include <memory>
+#include <openssl/aes.h>
 #include <random>
 
 #include "VtsHalHidlTargetTestBase.h"
diff --git a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
index 5945c05..3239265 100644
--- a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
@@ -16,7 +16,6 @@
 
 #define LOG_TAG "drm_hal_vendor_test@1.0"
 
-#include <android-base/logging.h>
 #include <android/hardware/drm/1.0/ICryptoFactory.h>
 #include <android/hardware/drm/1.0/ICryptoPlugin.h>
 #include <android/hardware/drm/1.0/IDrmFactory.h>
@@ -27,8 +26,8 @@
 #include <gtest/gtest.h>
 #include <hidlmemory/mapping.h>
 #include <log/log.h>
-#include <openssl/aes.h>
 #include <memory>
+#include <openssl/aes.h>
 #include <random>
 
 #include "drm_hal_vendor_module_api.h"
diff --git a/oemlock/1.0/Android.bp b/oemlock/1.0/Android.bp
new file mode 100644
index 0000000..33096c3
--- /dev/null
+++ b/oemlock/1.0/Android.bp
@@ -0,0 +1,63 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+filegroup {
+    name: "android.hardware.oemlock@1.0_hal",
+    srcs: [
+        "types.hal",
+        "IOemLock.hal",
+    ],
+}
+
+genrule {
+    name: "android.hardware.oemlock@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.oemlock@1.0",
+    srcs: [
+        ":android.hardware.oemlock@1.0_hal",
+    ],
+    out: [
+        "android/hardware/oemlock/1.0/types.cpp",
+        "android/hardware/oemlock/1.0/OemLockAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.oemlock@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.oemlock@1.0",
+    srcs: [
+        ":android.hardware.oemlock@1.0_hal",
+    ],
+    out: [
+        "android/hardware/oemlock/1.0/types.h",
+        "android/hardware/oemlock/1.0/hwtypes.h",
+        "android/hardware/oemlock/1.0/IOemLock.h",
+        "android/hardware/oemlock/1.0/IHwOemLock.h",
+        "android/hardware/oemlock/1.0/BnHwOemLock.h",
+        "android/hardware/oemlock/1.0/BpHwOemLock.h",
+        "android/hardware/oemlock/1.0/BsOemLock.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.oemlock@1.0",
+    generated_sources: ["android.hardware.oemlock@1.0_genc++"],
+    generated_headers: ["android.hardware.oemlock@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.oemlock@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hidl.base@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/oemlock/1.0/Android.mk b/oemlock/1.0/Android.mk
new file mode 100644
index 0000000..e50c288
--- /dev/null
+++ b/oemlock/1.0/Android.mk
@@ -0,0 +1,156 @@
+# This file is autogenerated by hidl-gen. Do not edit manually.
+
+LOCAL_PATH := $(call my-dir)
+
+################################################################################
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := android.hardware.oemlock@1.0-java
+LOCAL_MODULE_CLASS := JAVA_LIBRARIES
+
+intermediates := $(call local-generated-sources-dir, COMMON)
+
+HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
+
+LOCAL_JAVA_LIBRARIES := \
+    android.hidl.base@1.0-java \
+
+
+#
+# Build types.hal (OemLockSecureStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockSecureStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockSecureStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (OemLockStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IOemLock.hal
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/IOemLock.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IOemLock.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::IOemLock
+
+$(GEN): $(LOCAL_PATH)/IOemLock.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+include $(BUILD_JAVA_LIBRARY)
+
+
+################################################################################
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := android.hardware.oemlock@1.0-java-static
+LOCAL_MODULE_CLASS := JAVA_LIBRARIES
+
+intermediates := $(call local-generated-sources-dir, COMMON)
+
+HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
+
+LOCAL_STATIC_JAVA_LIBRARIES := \
+    android.hidl.base@1.0-java-static \
+
+
+#
+# Build types.hal (OemLockSecureStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockSecureStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockSecureStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (OemLockStatus)
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/OemLockStatus.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::types.OemLockStatus
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IOemLock.hal
+#
+GEN := $(intermediates)/android/hardware/oemlock/V1_0/IOemLock.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/IOemLock.hal
+$(GEN): PRIVATE_DEPS += $(LOCAL_PATH)/types.hal
+$(GEN): $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.oemlock@1.0::IOemLock
+
+$(GEN): $(LOCAL_PATH)/IOemLock.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+include $(BUILD_STATIC_JAVA_LIBRARY)
+
+
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/oemlock/1.0/IOemLock.hal b/oemlock/1.0/IOemLock.hal
new file mode 100644
index 0000000..d570123
--- /dev/null
+++ b/oemlock/1.0/IOemLock.hal
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.oemlock@1.0;
+
+/*
+ * The OEM lock prevents the bootloader from allowing the device to be flashed.
+ *
+ * Both the carrier and the device itself have a say as to whether OEM unlock is
+ * allowed and both must agree that is allowed in order for unlock to be
+ * possible.
+ */
+interface IOemLock {
+    /**
+     * Returns a vendor specific identifier of the HAL.
+     *
+     * The name returned must not be interpreted by the framework but must be
+     * passed to vendor code which may use it to identify the security protocol
+     * used by setOemUnlockAllowedByCarrier. This allows the vendor to identify
+     * the protocol without having to maintain a device-to-protocol mapping.
+     *
+     * @return name of the implementation.
+     */
+    getName() generates (OemLockStatus status, string name);
+
+    /**
+     * Updates whether OEM unlock is allowed by the carrier.
+     *
+     * The implementation may require a vendor defined signature to prove the
+     * validity of this request in order to harden its security.
+     *
+     * @param allowed is the new value of the flag.
+     * @param signature to prove validity of this request or empty if not
+     *        required.
+     * @return status is OK if the flag was successfully updated,
+     *         INVALID_SIGNATURE if a signature is required but the wrong one
+     *         was provided or FAILED if the update was otherwise unsuccessful.
+     */
+    setOemUnlockAllowedByCarrier(bool allowed, vec<uint8_t> signature)
+            generates (OemLockSecureStatus status);
+
+    /**
+     * Returns whether OEM unlock is allowed by the carrier.
+     *
+     * @return status is OK if the flag was successfully read.
+     * @return allowed is the current state of the flag.
+     */
+    isOemUnlockAllowedByCarrier() generates (OemLockStatus status, bool allowed);
+
+    /**
+     * Updates whether OEM unlock is allowed by the device.
+     *
+     * @param allowed is the new value of the flag.
+     * @return status is OK if the flag was successfully updated.
+     */
+    setOemUnlockAllowedByDevice(bool allowed) generates (OemLockStatus status);
+
+    /**
+     * Returns whether OEM unlock ia allowed by the device.
+     *
+     * @return status is OK if the flag was successfully read.
+     * @return allowed is the current state of the flag.
+     */
+    isOemUnlockAllowedByDevice() generates (OemLockStatus status, bool allowed);
+};
diff --git a/oemlock/1.0/types.hal b/oemlock/1.0/types.hal
new file mode 100644
index 0000000..0b4a8d1
--- /dev/null
+++ b/oemlock/1.0/types.hal
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.oemlock@1.0;
+
+enum OemLockStatus : uint32_t {
+    /** The operation completed successfully. */
+    OK,
+    /** The operation encountered a problem. */
+    FAILED,
+};
+
+enum OemLockSecureStatus : OemLockStatus {
+    /** An invalid signature was provided so the operation was not performed. */
+    INVALID_SIGNATURE,
+};
diff --git a/oemlock/Android.bp b/oemlock/Android.bp
new file mode 100644
index 0000000..bbb3e4b
--- /dev/null
+++ b/oemlock/Android.bp
@@ -0,0 +1,4 @@
+// This is an autogenerated file, do not edit.
+subdirs = [
+    "1.0",
+]
diff --git a/sensors/1.0/default/android.hardware.sensors@1.0-service.rc b/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
index 50cf787..c085552 100644
--- a/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
+++ b/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
@@ -1,4 +1,4 @@
 service sensors-hal-1-0 /vendor/bin/hw/android.hardware.sensors@1.0-service
-    class main
+    class hal
     user system
     group system
diff --git a/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp b/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp
index 3989c94..dfa11a1 100644
--- a/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp
+++ b/thermal/1.0/vts/functional/VtsHalThermalV1_0TargetTest.cpp
@@ -68,10 +68,12 @@
       if (i < baseSize_) {
         EXPECT_EQ(names_[i], temperatures[i].name.c_str());
       } else {
-        // Names must be unique.
-        EXPECT_EQ(names_.end(), std::find(names_.begin(), names_.end(),
-                                          temperatures[i].name.c_str()));
-        names_.push_back(temperatures[i].name);
+          // Names must be unique only for known temperature types.
+          if (temperatures[i].type != TemperatureType::UNKNOWN) {
+              EXPECT_EQ(names_.end(), std::find(names_.begin(), names_.end(),
+                                                temperatures[i].name.c_str()));
+          }
+          names_.push_back(temperatures[i].name);
       }
     }
     baseSize_ = size;
@@ -88,10 +90,9 @@
       if (i < baseSize_) {
         EXPECT_EQ(names_[i], cpuUsages[i].name.c_str());
       } else {
-        // Names must be unique.
-        EXPECT_EQ(names_.end(), std::find(names_.begin(), names_.end(),
-                                          cpuUsages[i].name.c_str()));
-        names_.push_back(cpuUsages[i].name);
+          // Names are not guaranteed to be unique because of the current
+          // default Thermal HAL implementation.
+          names_.push_back(cpuUsages[i].name);
       }
     }
     baseSize_ = size;
diff --git a/vibrator/1.0/Android.mk b/vibrator/1.0/Android.mk
index d921a7e..8de1ac3 100644
--- a/vibrator/1.0/Android.mk
+++ b/vibrator/1.0/Android.mk
@@ -36,6 +36,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (EffectStrength)
+#
+GEN := $(intermediates)/android/hardware/vibrator/V1_0/EffectStrength.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.vibrator@1.0::types.EffectStrength
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (Status)
 #
 GEN := $(intermediates)/android/hardware/vibrator/V1_0/Status.java
@@ -111,6 +130,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (EffectStrength)
+#
+GEN := $(intermediates)/android/hardware/vibrator/V1_0/EffectStrength.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.vibrator@1.0::types.EffectStrength
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (Status)
 #
 GEN := $(intermediates)/android/hardware/vibrator/V1_0/Status.java
@@ -158,7 +196,7 @@
 LOCAL_MODULE := android.hardware.vibrator@1.0-java-constants
 LOCAL_MODULE_CLASS := JAVA_LIBRARIES
 
-intermediates := $(local-generated-sources-dir)
+intermediates := $(call local-generated-sources-dir, COMMON)
 
 HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
 #
diff --git a/wifi/Android.bp b/wifi/Android.bp
index d4e0fda..523014f 100644
--- a/wifi/Android.bp
+++ b/wifi/Android.bp
@@ -2,5 +2,7 @@
 subdirs = [
     "1.0",
     "1.0/vts/functional",
+    "offload/1.0",
+    "offload/1.0/vts/functional",
     "supplicant/1.0",
 ]
diff --git a/wifi/offload/1.0/Android.bp b/wifi/offload/1.0/Android.bp
new file mode 100644
index 0000000..5e89ceb
--- /dev/null
+++ b/wifi/offload/1.0/Android.bp
@@ -0,0 +1,69 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+filegroup {
+    name: "android.hardware.wifi.offload@1.0_hal",
+    srcs: [
+        "types.hal",
+        "IOffload.hal",
+        "IOffloadCallback.hal",
+    ],
+}
+
+genrule {
+    name: "android.hardware.wifi.offload@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.wifi.offload@1.0",
+    srcs: [
+        ":android.hardware.wifi.offload@1.0_hal",
+    ],
+    out: [
+        "android/hardware/wifi/offload/1.0/types.cpp",
+        "android/hardware/wifi/offload/1.0/OffloadAll.cpp",
+        "android/hardware/wifi/offload/1.0/OffloadCallbackAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.wifi.offload@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.wifi.offload@1.0",
+    srcs: [
+        ":android.hardware.wifi.offload@1.0_hal",
+    ],
+    out: [
+        "android/hardware/wifi/offload/1.0/types.h",
+        "android/hardware/wifi/offload/1.0/IOffload.h",
+        "android/hardware/wifi/offload/1.0/IHwOffload.h",
+        "android/hardware/wifi/offload/1.0/BnHwOffload.h",
+        "android/hardware/wifi/offload/1.0/BpHwOffload.h",
+        "android/hardware/wifi/offload/1.0/BsOffload.h",
+        "android/hardware/wifi/offload/1.0/IOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/IHwOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/BnHwOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/BpHwOffloadCallback.h",
+        "android/hardware/wifi/offload/1.0/BsOffloadCallback.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.wifi.offload@1.0",
+    generated_sources: ["android.hardware.wifi.offload@1.0_genc++"],
+    generated_headers: ["android.hardware.wifi.offload@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.wifi.offload@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hidl.base@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/wifi/offload/1.0/IOffload.hal b/wifi/offload/1.0/IOffload.hal
new file mode 100644
index 0000000..7ad902c
--- /dev/null
+++ b/wifi/offload/1.0/IOffload.hal
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.offload@1.0;
+
+import IOffloadCallback;
+
+interface IOffload {
+    /**
+     * Configure the offload module to perform scans and filter results
+     * Scans must not be triggered due to configuration of the module.
+     *
+     * @param ScanParam paramters for scanning
+     * @param ScanFilter settings to filter scan result
+     * @return boolean status indicating success (true) when configuration
+     *            is applied or failure (false) for invalid configuration
+     */
+    @entry
+    @callflow(next={"setEventCallback", "subscribeScanResults"})
+    configureScans(ScanParam param, ScanFilter filter);
+
+    /**
+     * Get scan statistics
+     *
+     * @return ScanStats statistics of scans performed
+     */
+    @exit
+    @callflow(next={"subscribeScanResults", "unsubscribeScanResults", "getScanStats"})
+    getScanStats() generates (ScanStats scanStats);
+
+    /**
+     * Subscribe to asynchronous scan events sent by offload module. This enables
+     * offload scans to be performed as per scan parameters, filtering the scan
+     * results based on configured scan filter and delivering the results after
+     * at least delayMs milliseconds from this call. If the client is already
+     * subscribed to the scan results, a call to this API must be a no-op.
+     *
+     * @param delayMs an integer expressing the minimum delay in mS after
+     *        subscribing when scan results must be delivered to the client
+     */
+    @callflow(next={"unsubscribeScanResults", "getScanStats"})
+    subscribeScanResults(uint32_t delayMs);
+
+    /**
+     * Unsubscribe to scan events sent by the offload module, hence disabling scans.
+     * If the client is already unsubscribed, a call to this API will be a no-op.
+     */
+    @exit
+    @callflow(next={"*"})
+    unsubscribeScanResults();
+
+    /**
+     * Setup the HIDL interface for reporting asynchronous scan events. A maximum
+     * of one callback interface is supported. Only one callback must be registered
+     * at any given time. If two consecutive calls are made with different callback
+     * interface objects, the latest one must be used to deliver events to client.
+     *
+     * @param cb An instance of the |IOffloadCallback| HIDL interface object
+     */
+    @entry
+    @callflow(next={"subscribeScanStats", "configureScans"})
+    setEventCallback(IOffloadCallback cb);
+};
diff --git a/wifi/offload/1.0/IOffloadCallback.hal b/wifi/offload/1.0/IOffloadCallback.hal
new file mode 100644
index 0000000..4599370
--- /dev/null
+++ b/wifi/offload/1.0/IOffloadCallback.hal
@@ -0,0 +1,25 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.wifi.offload@1.0;
+
+interface IOffloadCallback {
+    /**
+     * Interface for the Offload HAL to return scan events to the client
+     *
+     * @param scanResult a vector of scan result objects
+     */
+    oneway onScanResult(vec<ScanResult> scanResult);
+};
diff --git a/wifi/offload/1.0/types.hal b/wifi/offload/1.0/types.hal
new file mode 100644
index 0000000..870d2d3
--- /dev/null
+++ b/wifi/offload/1.0/types.hal
@@ -0,0 +1,205 @@
+/*
+ * Copyright 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.wifi.offload@1.0;
+
+/**
+ * Defines a bitmap of security modes
+ */
+enum SecurityMode : uint8_t {
+    OPEN                    = 0x1 << 1,
+    WEP                     = 0x1 << 2,
+    PSK                     = 0x1 << 3,
+    EAP                     = 0x1 << 4,
+};
+
+/**
+ * SSID of the Access Point, maximum 32 characters
+ */
+typedef vec<uint8_t> Ssid;
+
+/**
+ * Preferred network information
+ * SSID and associated security mode(s)
+ */
+struct NetworkInfo {
+    Ssid ssid;
+    /* SecurityMode flags that are associated with this SSID
+     * More than one security mode can be supported, see SecurityMode */
+    bitfield<SecurityMode> flags;
+};
+
+/**
+ * This is a bit mask describing the capabilities of a BSS.
+ * See IEEE Std 802.11: 8.4.1.4
+ */
+enum Capability : uint16_t {
+    ESS                     = 1 << 0,
+    IBSS                    = 1 << 1,
+    CF_POLLABLE             = 1 << 2,
+    CF_PLL_REQ              = 1 << 3,
+    PRIVACY                 = 1 << 4,
+    SHORT_PREAMBLE          = 1 << 5,
+    PBCC                    = 1 << 6,
+    CHANNEL_AGILITY         = 1 << 7,
+    SPECTURM_MGMT           = 1 << 8,
+    QOS                     = 1 << 9,
+    SHORT_SLOT_TIME         = 1 << 10,
+    APSD                    = 1 << 11,
+    RADIO_MEASUREMENT       = 1 << 12,
+    DSSS_OFDM               = 1 << 13,
+    DELAYED_BLOCK_ACK       = 1 << 14,
+    IMMEDIATE_BLOCK_ACK     = 1 << 15,
+};
+
+/**
+ * Scan Results returned by the offload Hal
+ */
+struct ScanResult {
+    /* Information about this BSS
+     * SSID and security modes supported */
+    NetworkInfo networkInfo;
+    /* BSSID of the BSS */
+    uint8_t[6] bssid;
+    /* Can have multiple bits set, see Capability */
+    bitfield<Capability> capability;
+    /* Frequency scanned, in mHz */
+    uint32_t frequency;
+    /* Signal strength in dBm */
+    int8_t rssi;
+    /* TSF found in beacon/probe response */
+    uint64_t tsf;
+};
+
+
+/**
+ * Parameters for performing offload scans
+ */
+struct ScanParam {
+    /* Specify a list of SSIDs to scan, an empty list implies no preferred
+     * networks to scan */
+    vec<Ssid> ssidList;
+    /* Frequencies to scan, in mHz, an empty frequency list implies a full scan */
+    vec<uint32_t> frequencyList;
+    /* Periodicity of the scans to be performed by the offload module
+     * A value of zero indicates disable periodic scans. For this revision,
+     * where offload module is performing scans in disconnected mode, this value
+     * should not be zero. In future versions, periodic scans can be eliminated */
+    uint32_t disconnectedModeScanIntervalMs;
+};
+
+/**
+ * Instruction on how to filter the scan result before performing network
+ * selection and waking up the AP to connect
+ */
+struct ScanFilter {
+    /* Preferred network List of SSIDs and their security mode of interest
+     * The filter will drop the remaining scan results in the scan event.
+     * An empty list implies no filtering of scan result based on SSID and
+     * security mode. */
+    vec<NetworkInfo> preferredNetworkInfoList;
+    /* Minimum qualifying RSSI to be considered for network selection (dBm) */
+    int8_t rssiThreshold;
+};
+
+struct ScanRecord {
+    /* Amount of time spent scanning */
+    uint64_t durationMs;
+    /* Number of channels scanned */
+    uint32_t numChannelsScanned;
+    /* Number of entries aggregated into this record */
+    uint32_t numEntriesAggregated;
+};
+
+/**
+ * Enumerates the type of log that is recorded
+ */
+enum RecordName : uint32_t {
+    CMD_BASE                        = 0x00001000,
+    /* Record name corresponding to initialization */
+    CMD_INT                         = CMD_BASE + 0,
+   /* Record name corresponding to configureScans() API */
+    CMD_CONFIG_SCANS                = CMD_BASE + 1,
+    /* Record name corresponding to subscribeScanResults() API */
+    CMD_SUBSCRIBE_SCAN_RESULTS      = CMD_BASE + 2,
+    /* Record name corresponding to unsubscribeScanResults() API */
+    CMD_UNSUBSCRIBE_SCAN_RESULTS    = CMD_BASE + 3,
+    /* Record name corresponding to getScanStats() API */
+    CMD_GET_SCAN_STATS              = CMD_BASE + 4,
+    /* Record name corresponding to a reset*/
+    CMD_RESET                       = CMD_BASE + 5,
+    /* Add new commands here */
+    EVENT_RECVD_BASE                = 0x00002000,
+    /* Record name corresponding to scan monitor event*/
+    EVENT_RECVD_SCAN_RESULT_ASYNC   = EVENT_RECVD_BASE + 0,
+    /* Record name corresponding to scan response event */
+    EVENT_RECVD_SCAN_RESULT         = EVENT_RECVD_BASE + 1,
+    /* Add new events received here */
+    EVENT_SENT_BASE                 = 0x00003000,
+    /* Record name corresponding to scan event sent */
+    EVENT_SENT_SCAN_RESULT          = EVENT_SENT_BASE + 0,
+    /* Record name corresponding to abort event sent */
+    EVENT_SENT_ABORT                = EVENT_SENT_BASE + 1,
+    /* Record name corresponding to error event sent */
+    EVENT_SENT_ERROR                = EVENT_SENT_BASE + 2,
+    /* Add new events sent here */
+    REQ_BASE                        = 0x00004000,
+    /* Record name corresponding to scan request sent*/
+    REQ_SCAN                        = REQ_BASE + 0,
+    /* Add new requests here */
+};
+
+/**
+ * Defines the structure of each log record
+ */
+struct LogRecord {
+    /* Indicates the log recorded */
+    RecordName recordName;
+    /* Platform reference time in milliseconds when the log is recorded */
+    uint64_t logTimeMs;
+};
+
+/**
+ * Defines the scan statistics to be returned to the framework
+ */
+struct ScanStats {
+    /* Incremented everytime a new scan is requested */
+    uint32_t numScansRequestedByWifi;
+    /* Incremented everytime the scan is serviced by performing a scan*/
+    uint32_t numScansServicedByWifi;
+    /* Incremented everytime the scan is serviced by the scan cache */
+    uint32_t numScansServicedbyCache;
+    /* The last (CHRE reference) time this data structure is updated */
+    uint64_t lastUpdated;
+    /* The last (CHRE reference) time this data structure is read */
+    uint64_t lastRead;
+    /* The total time when the Offload module could be performing scans (T2 - T1)
+     * T1 - time when the framework subscribes for scan result (includes delayMs)
+     * T2 - min (time when the framework unsubscribes for scan result,
+     * currentTime) */
+    uint64_t subscriptionDurationMs;
+    /* Histograms of the channels scanned, 802.11 and with an 8 bit
+     * representation, only 256 channels are available */
+    uint8_t[256] histogramChannelsScanned;
+    /* Scan Record for this subscribe duration */
+    vec<ScanRecord> scanRecord;
+    /* Vector of the logRecord entries */
+    vec<LogRecord> logRecord;
+};
+
+
+
+
+
diff --git a/wifi/offload/1.0/vts/functional/Android.bp b/wifi/offload/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..f907a89
--- /dev/null
+++ b/wifi/offload/1.0/vts/functional/Android.bp
@@ -0,0 +1,36 @@
+//
+// Copyright (C) 2017 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalWifiOffloadV1_0TargetTest",
+    defaults: ["hidl_defaults"],
+    srcs: ["VtsHalWifiOffloadV1_0TargetTest.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libnativehelper",
+        "libutils",
+        "android.hardware.wifi.offload@1.0",
+    ],
+    static_libs: ["VtsHalHidlTargetTestBase"],
+    cflags: [
+        "-O0",
+        "-g",
+    ],
+}
diff --git a/wifi/offload/1.0/vts/functional/VtsHalWifiOffloadV1_0TargetTest.cpp b/wifi/offload/1.0/vts/functional/VtsHalWifiOffloadV1_0TargetTest.cpp
new file mode 100644
index 0000000..630922a
--- /dev/null
+++ b/wifi/offload/1.0/vts/functional/VtsHalWifiOffloadV1_0TargetTest.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "wifi_offload_hidl_hal_test"
+
+#include <android-base/logging.h>
+#include <android/hardware/wifi/offload/1.0/IOffload.h>
+#include <android/hardware/wifi/offload/1.0/IOffloadCallback.h>
+#include <android/hardware/wifi/offload/1.0/types.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+
+#include <vector>
+
+using ::android::hardware::wifi::offload::V1_0::IOffload;
+using ::android::hardware::wifi::offload::V1_0::IOffloadCallback;
+using ::android::hardware::wifi::offload::V1_0::ScanResult;
+using ::android::hardware::wifi::offload::V1_0::ScanParam;
+using ::android::hardware::wifi::offload::V1_0::ScanFilter;
+using ::android::hardware::wifi::offload::V1_0::ScanStats;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::hidl_vec;
+using ::android::sp;
+
+typedef std::function<void(const std::vector<ScanResult>& scanResult)>
+    OnOffloadScanResultsReadyHandler;
+
+// The main test class for WifiOffload HIDL HAL.
+class WifiOffloadHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        wifi_offload_ =
+            ::testing::VtsHalHidlTargetTestBase::getService<IOffload>();
+        ASSERT_NE(wifi_offload_, nullptr);
+
+        wifi_offload_cb_ = new OffloadCallback(
+            [this](std::vector<ScanResult> scanResult) -> void {
+                this->reportScanResults(scanResult);
+            });
+        ASSERT_NE(wifi_offload_cb_, nullptr);
+
+        defaultSize = 0;
+    }
+
+    virtual void TearDown() override {}
+
+    void reportScanResults(std::vector<ScanResult> scanResult) {
+        defaultSize = scanResult.size();
+    }
+
+    /* Callback class for scanResult. */
+    class OffloadCallback : public IOffloadCallback {
+       public:
+        OffloadCallback(OnOffloadScanResultsReadyHandler handler)
+            : handler_(handler){};
+
+        virtual ~OffloadCallback() = default;
+
+        Return<void> onScanResult(
+            const hidl_vec<ScanResult>& scanResult) override {
+            const std::vector<ScanResult> scanResult_(scanResult);
+            handler_(scanResult_);
+            return Void();
+        };
+
+       private:
+        OnOffloadScanResultsReadyHandler handler_;
+    };
+
+    sp<IOffload> wifi_offload_;
+    sp<IOffloadCallback> wifi_offload_cb_;
+    int defaultSize = 0;
+};
+
+/*
+ * Verify that setEventCallback method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, setEventCallback) {
+    auto returnObject = wifi_offload_->setEventCallback(wifi_offload_cb_);
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that subscribeScanResults method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, subscribeScanResults) {
+    auto returnObject = wifi_offload_->subscribeScanResults(0);
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that unsubscribeScanResults method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, unsubscribeScanResults) {
+    auto returnObject = wifi_offload_->unsubscribeScanResults();
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that configureScans method returns without errors
+ */
+TEST_F(WifiOffloadHidlTest, configureScans) {
+    ScanParam* pScanParam = new ScanParam();
+    ScanFilter* pScanFilter = new ScanFilter();
+    auto returnObject =
+        wifi_offload_->configureScans(*pScanParam, *pScanFilter);
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+/*
+ * Verify that getScanStats returns without any errors
+ */
+TEST_F(WifiOffloadHidlTest, getScanStats) {
+    ScanStats* pScanStats = new ScanStats();
+    const auto& returnObject =
+        wifi_offload_->getScanStats([pScanStats](ScanStats scanStats) -> void {
+            *pScanStats = std::move(scanStats);
+        });
+    ASSERT_EQ(returnObject.isOk(), true);
+}
+
+// A class for test environment setup
+class WifiOffloadHalHidlEnvironment : public ::testing::Environment {
+   public:
+    virtual void SetUp() {}
+    virtual void TearDown() {}
+};
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(new WifiOffloadHalHidlEnvironment);
+    ::testing::InitGoogleTest(&argc, argv);
+
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+
+    return status;
+}