diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 04ee155..3f224af 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -145,6 +145,7 @@
     <uses-permission android:name="com.android.voicemail.permission.ADD_VOICEMAIL" />
     <uses-permission android:name="com.android.voicemail.permission.WRITE_VOICEMAIL" />
     <uses-permission android:name="com.android.voicemail.permission.READ_VOICEMAIL" />
+    <uses-permission android:name="android.permission.BIND_VISUAL_VOICEMAIL_SERVICE"/>
     <uses-permission android:name="android.permission.LOCAL_MAC_ADDRESS" />
     <uses-permission android:name="android.permission.CHANGE_COMPONENT_ENABLED_STATE" />
     <uses-permission android:name="android.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST" />
@@ -319,7 +320,7 @@
         <!-- "Mobile network settings" screen, used on both
              non-voice-capable tablets and regular phone devices. -->
         <activity android:name="MobileNetworkSettings"
-            android:label="@string/settings_label"
+            android:label="@string/mobile_networks"
             android:theme="@style/NetworkOperatorsSettingsTheme">
             <intent-filter>
                 <action android:name="android.intent.action.VIEW" />
@@ -596,7 +597,9 @@
                 <action android:name="android.content.action.SEARCH_INDEXABLES_PROVIDER" />
             </intent-filter>
         </provider>
-        <receiver android:name="com.android.phone.vvm.omtp.sms.OmtpMessageReceiver"
+
+        <receiver
+          android:name="com.android.phone.vvm.VvmSmsReceiver"
             android:exported="false"
             androidprv:systemUserOnly="true">
             <intent-filter>
@@ -656,14 +659,21 @@
             </intent-filter>
         </receiver>
 
-        <service
-            android:name="com.android.phone.vvm.omtp.sms.OmtpProvisioningService"
-            android:exported="false" />
 
         <service
           android:name="com.android.phone.vvm.omtp.scheduling.TaskSchedulerService"
           android:exported="false" />
 
+        <receiver
+          android:name="com.android.phone.vvm.VvmSimStateTracker"
+          android:exported="false">
+            <intent-filter>
+                <action android:name="android.intent.action.BOOT_COMPLETED"/>
+                <action android:name="android.telephony.action.CARRIER_CONFIG_CHANGED"/>
+                <action android:name="android.intent.action.SIM_STATE_CHANGED"/>
+            </intent-filter>
+        </receiver>
+
         <receiver android:name="com.android.phone.vvm.omtp.VvmPackageInstallReceiver"
             androidprv:systemUserOnly="true">
             <intent-filter>
@@ -673,10 +683,15 @@
             </intent-filter>
         </receiver>
 
-        <activity android:name=".settings.VoicemailChangePinActivity"
-          android:exported="false"
-          android:theme="@style/DialerSettingsLight"
-          android:windowSoftInputMode="stateVisible|adjustResize">
-          </activity>
+        <activity
+            android:name="com.android.phone.settings.VoicemailChangePinActivity"
+            android:exported="false"
+            android:theme="@style/DialerSettingsLight"
+            android:windowSoftInputMode="stateVisible|adjustResize">
+        </activity>
+
+        <service
+            android:name="com.android.phone.vvm.RemoteVvmTaskManager"
+            android:exported="false"/>
     </application>
 </manifest>
diff --git a/res/values/config.xml b/res/values/config.xml
index ce3f8a2..d897d9a 100644
--- a/res/values/config.xml
+++ b/res/values/config.xml
@@ -207,6 +207,10 @@
     <!-- Flag indicating whether to allow visual voicemail if available on the device.[DO NOT TRANSLATE] -->
     <bool name="allow_visual_voicemail">true</bool>
 
+    <!-- The package to handle visual voicemail if the default dialer or the package
+    CarrierConfigManager.KEY_CARRIER_VVM_PACKAGE_NAME_STRING does not handle it -->
+    <string name="system_visual_voicemail_client"></string>
+
     <!-- Flag to enable VVM3 visual voicemail. VVM3 is used by Verizon Wireless. -->
     <bool name="vvm3_enabled">false</bool>
 
diff --git a/src/com/android/phone/Assert.java b/src/com/android/phone/Assert.java
index 143e66f..37ccda8 100644
--- a/src/com/android/phone/Assert.java
+++ b/src/com/android/phone/Assert.java
@@ -49,7 +49,11 @@
     }
 
     public static void fail() {
-        throw new AssertionError("Fail");
+        fail("Fail");
+    }
+
+    public static void fail(String reason) {
+        throw new AssertionError(reason);
     }
 
     /**
diff --git a/src/com/android/phone/CallFeaturesSetting.java b/src/com/android/phone/CallFeaturesSetting.java
index d692cb9..b7c84ff 100644
--- a/src/com/android/phone/CallFeaturesSetting.java
+++ b/src/com/android/phone/CallFeaturesSetting.java
@@ -286,7 +286,7 @@
                 ImsManager.isVtProvisionedOnDevice(mPhone.getContext()) &&
                 (carrierConfig.getBoolean(
                         CarrierConfigManager.KEY_IGNORE_DATA_ENABLED_CHANGED_FOR_VIDEO_CALLS)
-                        || mPhone.mDcTracker.isDataEnabled(true))) {
+                        || mPhone.mDcTracker.isDataEnabled())) {
             boolean currentValue =
                     ImsManager.isEnhanced4gLteModeSettingEnabledByUser(mPhone.getContext())
                     ? PhoneGlobals.getInstance().phoneMgr.isVideoCallingEnabled(
diff --git a/src/com/android/phone/ImsUtil.java b/src/com/android/phone/ImsUtil.java
index 8ee7773..b6c88ae 100644
--- a/src/com/android/phone/ImsUtil.java
+++ b/src/com/android/phone/ImsUtil.java
@@ -60,21 +60,6 @@
     }
 
     /**
-     * @return {@code true} if WFC is provisioned on the device.
-     */
-    public static boolean isWfcProvisioned(Context context) {
-        CarrierConfigManager cfgManager = (CarrierConfigManager) context
-                .getSystemService(Context.CARRIER_CONFIG_SERVICE);
-            if (cfgManager != null
-                    && cfgManager.getConfig().getBoolean(
-                            CarrierConfigManager.KEY_CARRIER_VOLTE_OVERRIDE_WFC_PROVISIONING_BOOL)
-                    && !ImsManager.isVolteProvisionedOnDevice(context)) {
-                return false;
-            }
-            return ImsManager.isWfcProvisionedOnDevice(context);
-    }
-
-    /**
      * @return {@code true} if the device is configured to use "Wi-Fi only" mode. If WFC is not
      * enabled, this will return {@code false}.
      */
@@ -101,7 +86,7 @@
             return false;
         }
 
-        if (!isWfcProvisioned(context)) {
+        if (!ImsManager.isWfcProvisionedOnDevice(context)) {
             return false;
         }
 
diff --git a/src/com/android/phone/PhoneGlobals.java b/src/com/android/phone/PhoneGlobals.java
index 88ff579..7a3683f 100644
--- a/src/com/android/phone/PhoneGlobals.java
+++ b/src/com/android/phone/PhoneGlobals.java
@@ -145,8 +145,6 @@
     private Activity mPUKEntryActivity;
     private ProgressDialog mPUKEntryProgressDialog;
 
-    private boolean mDataDisconnectedDueToRoaming = false;
-
     private WakeState mWakeState = WakeState.SLEEP;
 
     private PowerManager mPowerManager;
@@ -648,36 +646,36 @@
             } else if (action.equals(TelephonyIntents.ACTION_ANY_DATA_CONNECTION_STATE_CHANGED)) {
                 int subId = intent.getIntExtra(PhoneConstants.SUBSCRIPTION_KEY,
                         SubscriptionManager.INVALID_SUBSCRIPTION_ID);
-                int phoneId = SubscriptionManager.getPhoneId(subId);
-                String state = intent.getStringExtra(PhoneConstants.STATE_KEY);
+                final String apnType = intent.getStringExtra(PhoneConstants.DATA_APN_TYPE_KEY);
+                final String state = intent.getStringExtra(PhoneConstants.STATE_KEY);
+                final String reason = intent.getStringExtra(PhoneConstants.STATE_CHANGE_REASON_KEY);
                 if (VDBG) {
                     Log.d(LOG_TAG, "mReceiver: ACTION_ANY_DATA_CONNECTION_STATE_CHANGED");
                     Log.d(LOG_TAG, "- state: " + state);
-                    Log.d(LOG_TAG, "- reason: "
-                    + intent.getStringExtra(PhoneConstants.STATE_CHANGE_REASON_KEY));
+                    Log.d(LOG_TAG, "- reason: " + reason);
                     Log.d(LOG_TAG, "- subId: " + subId);
-                    Log.d(LOG_TAG, "- phoneId: " + phoneId);
                 }
-                Phone phone = SubscriptionManager.isValidPhoneId(phoneId) ?
-                        PhoneFactory.getPhone(phoneId) : PhoneFactory.getDefaultPhone();
 
-                // If not default data subscription, ignore the broadcast intent and avoid action.
-                if (subId != SubscriptionManager.getDefaultDataSubscriptionId()) {
-                    if (VDBG) Log.d(LOG_TAG, "Ignore broadcast intent as not default data sub.");
+                // If the apn type of data connection state changed event is NOT default,
+                // ignore the broadcast intent and avoid action.
+                if (!PhoneConstants.APN_TYPE_DEFAULT.equals(apnType)) {
+                    if (VDBG) Log.d(LOG_TAG, "Ignore broadcast intent as not default apn type");
                     return;
                 }
+
                 // The "data disconnected due to roaming" notification is shown
                 // if (a) you have the "data roaming" feature turned off, and
                 // (b) you just lost data connectivity because you're roaming.
-                boolean disconnectedDueToRoaming =
-                        !phone.getDataRoamingEnabled()
-                        && PhoneConstants.DataState.DISCONNECTED.equals(state)
-                        && Phone.REASON_ROAMING_ON.equals(
-                            intent.getStringExtra(PhoneConstants.STATE_CHANGE_REASON_KEY));
-                if (mDataDisconnectedDueToRoaming != disconnectedDueToRoaming) {
-                    mDataDisconnectedDueToRoaming = disconnectedDueToRoaming;
-                    mHandler.sendEmptyMessage(disconnectedDueToRoaming
-                            ? EVENT_DATA_ROAMING_DISCONNECTED : EVENT_DATA_ROAMING_OK);
+                if (PhoneConstants.DataState.DISCONNECTED.name().equals(state)
+                        && Phone.REASON_ROAMING_ON.equals(reason)
+                        && !getPhone(subId).getDataRoamingEnabled()) {
+                    // Notify the user that data call is disconnected due to roaming. Note that
+                    // calling this multiple times will not cause multiple notifications.
+                    mHandler.sendEmptyMessage(EVENT_DATA_ROAMING_DISCONNECTED);
+                } else if (PhoneConstants.DataState.CONNECTED.name().equals(state)) {
+                    // Cancel the notification when data is available. Note it is okay to call this
+                    // even if the notification doesn't exist.
+                    mHandler.sendEmptyMessage(EVENT_DATA_ROAMING_OK);
                 }
             } else if ((action.equals(TelephonyIntents.ACTION_SIM_STATE_CHANGED)) &&
                     (mPUKEntryActivity != null)) {
diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index 38bfa50..f59e97f 100644
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -18,8 +18,11 @@
 
 import static com.android.internal.telephony.PhoneConstants.SUBSCRIPTION_KEY;
 
+import android.Manifest.permission;
+import android.annotation.Nullable;
 import android.app.ActivityManager;
 import android.app.AppOpsManager;
+import android.app.PendingIntent;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
@@ -53,6 +56,7 @@
 import android.telephony.NeighboringCellInfo;
 import android.telephony.RadioAccessFamily;
 import android.telephony.ServiceState;
+import android.telephony.SmsManager;
 import android.telephony.SubscriptionInfo;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyHistogram;
@@ -63,6 +67,7 @@
 import android.util.Log;
 import android.util.Pair;
 import android.util.Slog;
+
 import com.android.ims.ImsManager;
 import com.android.ims.internal.IImsServiceController;
 import com.android.ims.internal.IImsServiceFeatureListener;
@@ -90,8 +95,11 @@
 import com.android.internal.util.HexDump;
 import com.android.phone.settings.VisualVoicemailSettingsUtil;
 import com.android.phone.settings.VoicemailNotificationSettingsUtil;
+import com.android.phone.vvm.RemoteVvmTaskManager;
+
 import java.io.FileDescriptor;
 import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -153,6 +161,7 @@
     private static final int EVENT_SET_ALLOWED_CARRIERS_DONE = 44;
     private static final int CMD_GET_ALLOWED_CARRIERS = 45;
     private static final int EVENT_GET_ALLOWED_CARRIERS_DONE = 46;
+    private static final int CMD_HANDLE_USSD_REQUEST = 47;
     private static final int CMD_GET_FORBIDDEN_PLMNS = 48;
     private static final int EVENT_GET_FORBIDDEN_PLMNS_DONE = 49;
 
@@ -264,6 +273,22 @@
             IccAPDUArgument iccArgument;
 
             switch (msg.what) {
+                 case CMD_HANDLE_USSD_REQUEST: {
+                     request = (MainThreadRequest) msg.obj;
+                     final Phone phone = getPhoneFromRequest(request);
+                     Pair<String, ResultReceiver> ussdObject = (Pair) request.argument;
+                     String ussdRequest =  ussdObject.first;
+                     ResultReceiver wrappedCallback = ussdObject.second;
+                     request.result = phone != null ?
+                             phone.handleUssdRequest(ussdRequest, wrappedCallback)
+                             :false;
+                     // Wake up the requesting thread
+                     synchronized (request) {
+                         request.notifyAll();
+                     }
+                     break;
+                }
+
                 case CMD_HANDLE_PIN_MMI: {
                     request = (MainThreadRequest) msg.obj;
                     final Phone phone = getPhoneFromRequest(request);
@@ -1527,6 +1552,15 @@
         return handlePinMmiForSubscriber(getDefaultSubscription(), dialString);
     }
 
+    public void handleUssdRequest(int subId, String ussdRequest, ResultReceiver wrappedCallback) {
+      enforceCallPermission();
+      if (!SubscriptionManager.isValidSubscriptionId(subId)) {
+          return;
+      }
+      Pair<String, ResultReceiver> ussdObject = new Pair(ussdRequest, wrappedCallback);
+      sendRequest(CMD_HANDLE_USSD_REQUEST, ussdObject, subId);
+    };
+
     public boolean handlePinMmiForSubscriber(int subId, String dialString) {
         enforceModifyPermission();
         if (!SubscriptionManager.isValidSubscriptionId(subId)) {
@@ -2002,6 +2036,15 @@
     }
 
     @Override
+    public String getVisualVoicemailPackageName(String callingPackage, int subId) {
+        mAppOps.checkPackage(Binder.getCallingUid(), callingPackage);
+        if (!canReadPhoneState(callingPackage, "getVisualVoicemailPackageName")) {
+            return null;
+        }
+        return RemoteVvmTaskManager.getRemotePackage(mPhone.getContext(), subId).getPackageName();
+    }
+
+    @Override
     public void enableVisualVoicemailSmsFilter(String callingPackage, int subId,
             VisualVoicemailSmsFilterSettings settings) {
         mAppOps.checkPackage(Binder.getCallingUid(), callingPackage);
@@ -2026,11 +2069,33 @@
     }
 
     @Override
-    public VisualVoicemailSmsFilterSettings getSystemVisualVoicemailSmsFilterSettings(
-            String packageName, int subId) {
+    public VisualVoicemailSmsFilterSettings getActiveVisualVoicemailSmsFilterSettings(int subId) {
         enforceReadPrivilegedPermission();
         return VisualVoicemailSmsFilterConfig
-                .getVisualVoicemailSmsFilterSettings(mPhone.getContext(), packageName, subId);
+                .getActiveVisualVoicemailSmsFilterSettings(mPhone.getContext(), subId);
+    }
+
+    @Override
+    public void sendVisualVoicemailSmsForSubscriber(String callingPackage, int subId,
+            String number, int port, String text, PendingIntent sentIntent) {
+        mAppOps.checkPackage(Binder.getCallingUid(), callingPackage);
+        enforceVisualVoicemailPackage(callingPackage, subId);
+        enforceSendSmsPermission();
+        // Make the calls as the phone process.
+        final long identity = Binder.clearCallingIdentity();
+        try {
+            SmsManager smsManager = SmsManager.getSmsManagerForSubscriptionId(subId);
+            if (port == 0) {
+                smsManager.sendTextMessageWithSelfPermissions(number, null, text,
+                        sentIntent, null, false);
+            } else {
+                byte[] data = text.getBytes(StandardCharsets.UTF_8);
+                smsManager.sendDataMessageWithSelfPermissions(number, null,
+                        (short) port, data, sentIntent, null);
+            }
+        } finally {
+            Binder.restoreCallingIdentity(identity);
+        }
     }
     /**
      * Sets the voice activation state of a given subId.
@@ -2113,6 +2178,16 @@
     }
 
     /**
+      * returns true, if the device is in a state where both voice and data
+      * are supported simultaneously. This can change based on location or network condition.
+     */
+    @Override
+    public boolean isConcurrentVoiceAndDataAllowed(int subId) {
+        final Phone phone = getPhone(subId);
+        return (phone == null ? false : phone.isConcurrentVoiceAndDataAllowed());
+    }
+
+    /**
      * Returns the data network type.
      * Legacy call, permission-free.
      *
@@ -3357,6 +3432,30 @@
     }
 
     /**
+     * Make sure either called from same process as self (phone) or IPC caller has send SMS
+     * permission.
+     *
+     * @throws SecurityException if the caller does not have the required permission
+     */
+    private void enforceSendSmsPermission() {
+        mApp.enforceCallingOrSelfPermission(permission.SEND_SMS, null);
+    }
+
+    /**
+     * Make sure called from the package in charge of visual voicemail.
+     *
+     * @throws SecurityException if the caller is not the visual voicemail package.
+     */
+    private void enforceVisualVoicemailPackage(String callingPackage, int subId) {
+        String vvmPackage = RemoteVvmTaskManager.getRemotePackage(mPhone.getContext(), subId)
+                .getPackageName();
+        if (!callingPackage.equals(vvmPackage)) {
+            throw new SecurityException("Caller not current active visual voicemail package[" +
+                    vvmPackage + "]");
+        }
+    }
+
+    /**
      * Return the application ID for the app type.
      *
      * @param subId the subscription ID that this request applies to.
diff --git a/src/com/android/phone/VisualVoicemailSmsFilterConfig.java b/src/com/android/phone/VisualVoicemailSmsFilterConfig.java
index 2b2e2f5..db79e2b 100644
--- a/src/com/android/phone/VisualVoicemailSmsFilterConfig.java
+++ b/src/com/android/phone/VisualVoicemailSmsFilterConfig.java
@@ -16,12 +16,15 @@
 package com.android.phone;
 
 import android.annotation.Nullable;
+import android.content.ComponentName;
 import android.content.Context;
 import android.content.SharedPreferences;
 import android.preference.PreferenceManager;
 import android.telephony.VisualVoicemailSmsFilterSettings;
 import android.util.ArraySet;
 
+import com.android.phone.vvm.RemoteVvmTaskManager;
+
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Set;
@@ -39,6 +42,7 @@
     private static final String PREFIX_KEY = "_prefix";
     private static final String ORIGINATING_NUMBERS_KEY = "_originating_numbers";
     private static final String DESTINATION_PORT_KEY = "_destination_port";
+    private static final String DEFAULT_PACKAGE = "com.android.phone";
 
     public static void enableVisualVoicemailSmsFilter(Context context, String callingPackage,
             int subId,
@@ -58,6 +62,21 @@
                 .apply();
     }
 
+    public static VisualVoicemailSmsFilterSettings getActiveVisualVoicemailSmsFilterSettings(
+            Context context, int subId) {
+        ComponentName componentName = RemoteVvmTaskManager.getRemotePackage(context, subId);
+        String packageName;
+        if (componentName == null) {
+            packageName = DEFAULT_PACKAGE;
+        } else {
+            packageName = componentName.getPackageName();
+        }
+        return getVisualVoicemailSmsFilterSettings(
+                context,
+                packageName,
+                subId);
+    }
+
     @Nullable
     public static VisualVoicemailSmsFilterSettings getVisualVoicemailSmsFilterSettings(
             Context context,
@@ -75,6 +94,7 @@
                         VisualVoicemailSmsFilterSettings.DEFAULT_DESTINATION_PORT))
                 .build();
     }
+
     private static SharedPreferences getSharedPreferences(Context context) {
         return PreferenceManager
                 .getDefaultSharedPreferences(context.createDeviceProtectedStorageContext());
diff --git a/src/com/android/phone/vvm/RemoteVvmTaskManager.java b/src/com/android/phone/vvm/RemoteVvmTaskManager.java
new file mode 100644
index 0000000..b0f9fef
--- /dev/null
+++ b/src/com/android/phone/vvm/RemoteVvmTaskManager.java
@@ -0,0 +1,294 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package com.android.phone.vvm;
+
+import android.annotation.Nullable;
+import android.app.Service;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.ServiceConnection;
+import android.content.pm.PackageManager;
+import android.content.pm.ResolveInfo;
+import android.os.Bundle;
+import android.os.Handler;
+import android.os.IBinder;
+import android.os.Message;
+import android.os.Messenger;
+import android.os.PersistableBundle;
+import android.os.RemoteException;
+import android.telecom.PhoneAccountHandle;
+import android.telecom.TelecomManager;
+import android.telephony.CarrierConfigManager;
+import android.telephony.VisualVoicemailService;
+import android.telephony.VisualVoicemailSms;
+import android.text.TextUtils;
+
+import com.android.phone.Assert;
+import com.android.phone.R;
+import com.android.phone.vvm.omtp.VvmLog;
+import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
+
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Queue;
+
+/**
+ * Service to manage tasks issued to the {@link VisualVoicemailService}. This service will bind to
+ * the default dialer on a visual voicemail event if it implements the VisualVoicemailService. The
+ * service will hold all resource for the VisualVoicemailService until {@link
+ * VisualVoicemailService.VisualVoicemailTask#finish()} has been called on all issued tasks.
+ *
+ * If the service is already running it will be reused for new events. The service will stop itself
+ * after all events are handled.
+ */
+public class RemoteVvmTaskManager extends Service {
+
+    private static final String TAG = "RemoteVvmTaskManager";
+
+    private static final String ACTION_START_CELL_SERVICE_CONNECTED =
+            "ACTION_START_CELL_SERVICE_CONNECTED";
+    private static final String ACTION_START_SMS_RECEIVED = "ACTION_START_SMS_RECEIVED";
+    private static final String ACTION_START_SIM_REMOVED = "ACTION_START_SIM_REMOVED";
+
+    // TODO(twyen): track task individually to have time outs.
+    private int mTaskReferenceCount;
+
+    private RemoteServiceConnection mConnection;
+
+    /**
+     * Handles incoming messages from the VisualVoicemailService.
+     */
+    private Messenger mMessenger;
+
+    public static void startCellServiceConnected(Context context,
+            PhoneAccountHandle phoneAccountHandle) {
+        Intent intent = new Intent(ACTION_START_CELL_SERVICE_CONNECTED, null, context,
+                RemoteVvmTaskManager.class);
+        intent.putExtra(VisualVoicemailService.DATA_PHONE_ACCOUNT_HANDLE, phoneAccountHandle);
+        context.startService(intent);
+    }
+
+    public static void startSmsReceived(Context context, VisualVoicemailSms sms) {
+        Intent intent = new Intent(ACTION_START_SMS_RECEIVED, null, context,
+                RemoteVvmTaskManager.class);
+        intent.putExtra(VisualVoicemailService.DATA_PHONE_ACCOUNT_HANDLE,
+                sms.getPhoneAccountHandle());
+        intent.putExtra(VisualVoicemailService.DATA_SMS, sms);
+        context.startService(intent);
+    }
+
+    public static void startSimRemoved(Context context, PhoneAccountHandle phoneAccountHandle) {
+        Intent intent = new Intent(ACTION_START_SIM_REMOVED, null, context,
+                RemoteVvmTaskManager.class);
+        intent.putExtra(VisualVoicemailService.DATA_PHONE_ACCOUNT_HANDLE, phoneAccountHandle);
+        context.startService(intent);
+    }
+
+    public static boolean hasRemoteService(Context context, int subId) {
+        return getRemotePackage(context, subId) != null;
+    }
+
+    @Nullable
+    public static ComponentName getRemotePackage(Context context, int subId) {
+        Intent bindIntent = newBindIntent(context);
+
+        TelecomManager telecomManager = context.getSystemService(TelecomManager.class);
+        List<String> packages = new ArrayList<>();
+        packages.add(telecomManager.getDefaultDialerPackage());
+        PersistableBundle carrierConfig = context
+                .getSystemService(CarrierConfigManager.class).getConfigForSubId(subId);
+        packages.add(
+                carrierConfig.getString(CarrierConfigManager.KEY_CARRIER_VVM_PACKAGE_NAME_STRING));
+        for (String packageName : carrierConfig
+                .getStringArray(CarrierConfigManager.KEY_CARRIER_VVM_PACKAGE_NAME_STRING_ARRAY)) {
+            packages.add(packageName);
+        }
+        packages.add(context.getResources().getString(R.string.system_visual_voicemail_client));
+        packages.add(telecomManager.getSystemDialerPackage());
+        for (String packageName : packages) {
+            if (TextUtils.isEmpty(packageName)) {
+                continue;
+            }
+            bindIntent.setPackage(packageName);
+            ResolveInfo info = context.getPackageManager()
+                    .resolveService(bindIntent, PackageManager.MATCH_ALL);
+            if (info != null) {
+                return info.getComponentInfo().getComponentName();
+            }
+
+        }
+        return null;
+    }
+
+    @Override
+    public void onCreate() {
+        Assert.isMainThread();
+        mMessenger = new Messenger(new Handler() {
+            @Override
+            public void handleMessage(Message msg) {
+                Assert.isMainThread();
+                switch (msg.what) {
+                    case VisualVoicemailService.MSG_TASK_ENDED:
+                        mTaskReferenceCount--;
+                        checkReference();
+                        break;
+                    default:
+                        VvmLog.wtf(TAG, "unexpected message " + msg.what);
+                }
+            }
+        });
+    }
+
+    @Override
+    public int onStartCommand(@Nullable Intent intent, int flags, int startId) {
+        Assert.isMainThread();
+        mTaskReferenceCount++;
+
+        PhoneAccountHandle phoneAccountHandle = intent.getExtras()
+                .getParcelable(VisualVoicemailService.DATA_PHONE_ACCOUNT_HANDLE);
+        int subId = PhoneAccountHandleConverter.toSubId(phoneAccountHandle);
+        ComponentName remotePackage = getRemotePackage(this, subId);
+        if (remotePackage == null) {
+            VvmLog.i(TAG, "No service to handle " + intent.getAction() + ", ignoring");
+            checkReference();
+            return START_NOT_STICKY;
+        }
+
+        switch (intent.getAction()) {
+            case ACTION_START_CELL_SERVICE_CONNECTED:
+                send(remotePackage, VisualVoicemailService.MSG_ON_CELL_SERVICE_CONNECTED,
+                        intent.getExtras());
+                break;
+            case ACTION_START_SMS_RECEIVED:
+                send(remotePackage, VisualVoicemailService.MSG_ON_SMS_RECEIVED, intent.getExtras());
+                break;
+            case ACTION_START_SIM_REMOVED:
+                send(remotePackage, VisualVoicemailService.MSG_ON_SIM_REMOVED, intent.getExtras());
+                break;
+            default:
+                Assert.fail("Unexpected action +" + intent.getAction());
+                break;
+        }
+        // Don't rerun service if processed is killed.
+        return START_NOT_STICKY;
+    }
+
+    @Override
+    @Nullable
+    public IBinder onBind(Intent intent) {
+        return null;
+    }
+
+    private int getTaskId() {
+        // TODO(twyen): generate unique IDs. Reference counting is used now so it doesn't matter.
+        return 1;
+    }
+
+    /**
+     * Class for interacting with the main interface of the service.
+     */
+    private class RemoteServiceConnection implements ServiceConnection {
+
+        private final Queue<Message> mTaskQueue = new LinkedList<>();
+
+        private boolean mConnected;
+
+        /**
+         * A handler in the VisualVoicemailService
+         */
+        private Messenger mRemoteMessenger;
+
+        public void enqueue(Message message) {
+            mTaskQueue.add(message);
+            if (mConnected) {
+                runQueue();
+            }
+        }
+
+        public boolean isConnected() {
+            return mConnected;
+        }
+
+        public void onServiceConnected(ComponentName className,
+                IBinder service) {
+            mRemoteMessenger = new Messenger(service);
+            mConnected = true;
+            runQueue();
+        }
+
+        public void onServiceDisconnected(ComponentName className) {
+            mConnection = null;
+            mConnected = false;
+            mRemoteMessenger = null;
+            VvmLog.e(TAG, "Service disconnected, " + mTaskReferenceCount + " tasks dropped.");
+            mTaskReferenceCount = 0;
+            checkReference();
+        }
+
+        private void runQueue() {
+            Assert.isMainThread();
+            Message message = mTaskQueue.poll();
+            while (message != null) {
+                message.replyTo = mMessenger;
+                message.arg1 = getTaskId();
+
+                try {
+                    mRemoteMessenger.send(message);
+                } catch (RemoteException e) {
+                    VvmLog.e(TAG, "Error sending message to remote service", e);
+                }
+                message = mTaskQueue.poll();
+            }
+        }
+    }
+
+    private void send(ComponentName remotePackage,int what, Bundle extras) {
+        Assert.isMainThread();
+        Message message = Message.obtain();
+        message.what = what;
+        message.setData(new Bundle(extras));
+        if (mConnection == null) {
+            mConnection = new RemoteServiceConnection();
+        }
+        mConnection.enqueue(message);
+
+        if (!mConnection.isConnected()) {
+            Intent intent = newBindIntent(this);
+            intent.setComponent(remotePackage);
+            VvmLog.i(TAG, "Binding to " + intent.getComponent());
+            bindService(intent, mConnection, Context.BIND_AUTO_CREATE);
+        }
+    }
+
+    private void checkReference() {
+        if (mConnection == null) {
+            return;
+        }
+        if (mTaskReferenceCount == 0) {
+            unbindService(mConnection);
+            mConnection = null;
+        }
+    }
+
+    private static Intent newBindIntent(Context context) {
+        Intent intent = new Intent();
+        intent.setAction(VisualVoicemailService.SERVICE_INTERFACE);
+        return intent;
+    }
+}
diff --git a/src/com/android/phone/vvm/VvmSimStateTracker.java b/src/com/android/phone/vvm/VvmSimStateTracker.java
new file mode 100644
index 0000000..1059f86
--- /dev/null
+++ b/src/com/android/phone/vvm/VvmSimStateTracker.java
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package com.android.phone.vvm;
+
+import android.annotation.Nullable;
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+import android.os.SystemProperties;
+import android.telecom.PhoneAccountHandle;
+import android.telephony.CarrierConfigManager;
+import android.telephony.PhoneStateListener;
+import android.telephony.ServiceState;
+import android.telephony.SubscriptionManager;
+import android.telephony.TelephonyManager;
+import android.util.ArrayMap;
+import android.util.ArraySet;
+
+import com.android.internal.telephony.IccCardConstants;
+import com.android.internal.telephony.PhoneConstants;
+import com.android.internal.telephony.TelephonyIntents;
+import com.android.phone.PhoneUtils;
+import com.android.phone.vvm.omtp.VvmLog;
+import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
+
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * Tracks the status of all inserted SIMs. Will notify {@link RemoteVvmTaskManager} of when a SIM
+ * connected to the service for the first time after it was inserted or the system booted, and when
+ * the SIM is removed. Losing cell signal or entering airplane mode will not cause the connected
+ * event to be triggered again. Reinserting the SIM will trigger the connected event. Changing the
+ * carrier config will also trigger the connected event. Events will be delayed until the device has
+ * been fully booted (and left FBE mode).
+ */
+public class VvmSimStateTracker extends BroadcastReceiver {
+
+    private static final String TAG = "VvmSimStateTracker";
+
+    /**
+     * Map to keep track of currently inserted SIMs. If the SIM hasn't been connected to the service
+     * before the value will be a {@link ServiceStateListener} that is still waiting for the
+     * connection. A value of {@code null} means the SIM has been connected to the service before.
+     */
+    private static Map<PhoneAccountHandle, ServiceStateListener> sListeners = new ArrayMap<>();
+
+    /**
+     * Accounts that has events before the device is booted. The events should be regenerated after
+     * the device has fully booted.
+     */
+    private static Set<PhoneAccountHandle> sPreBootHandles = new ArraySet<>();
+
+    /**
+     * Waits for the account to become {@link ServiceState#STATE_IN_SERVICE} and notify the
+     * connected event. Will unregister itself once the event has been triggered.
+     */
+    private class ServiceStateListener extends PhoneStateListener {
+
+        private final PhoneAccountHandle mPhoneAccountHandle;
+        private final Context mContext;
+
+        public ServiceStateListener(Context context, PhoneAccountHandle phoneAccountHandle) {
+            mContext = context;
+            mPhoneAccountHandle = phoneAccountHandle;
+        }
+
+        public void listen() {
+            TelephonyManager telephonyManager = getTelephonyManager(mContext, mPhoneAccountHandle);
+            if(telephonyManager == null){
+                VvmLog.e(TAG, "Cannot create TelephonyManager from " + mPhoneAccountHandle);
+                return;
+            }
+            telephonyManager.listen(this, PhoneStateListener.LISTEN_SERVICE_STATE);
+        }
+
+        public void unlisten() {
+            // TelephonyManager does not need to be pinned to an account when removing a
+            // PhoneStateListener, and mPhoneAccountHandle might be invalid at this point
+            // (e.g. SIM removal)
+            mContext.getSystemService(TelephonyManager.class)
+                    .listen(this, PhoneStateListener.LISTEN_NONE);
+            sListeners.put(mPhoneAccountHandle, null);
+        }
+
+        @Override
+        public void onServiceStateChanged(ServiceState serviceState) {
+            if (serviceState.getState() == ServiceState.STATE_IN_SERVICE) {
+                VvmLog.i(TAG, "in service");
+                sendConnected(mContext, mPhoneAccountHandle);
+                unlisten();
+            }
+        }
+    }
+
+    @Override
+    public void onReceive(Context context, Intent intent) {
+
+        final String action = intent.getAction();
+        if (action == null) {
+            VvmLog.w(TAG, "Null action for intent.");
+            return;
+        }
+        VvmLog.i(TAG, action);
+        switch (action) {
+            case Intent.ACTION_BOOT_COMPLETED:
+                onBootCompleted(context);
+                break;
+            case TelephonyIntents.ACTION_SIM_STATE_CHANGED:
+                if (IccCardConstants.INTENT_VALUE_ICC_ABSENT.equals(
+                        intent.getStringExtra(IccCardConstants.INTENT_KEY_ICC_STATE))) {
+                    // onSimRemoved will scan all known accounts with isPhoneAccountActive() to find
+                    // which SIM is removed.
+                    // ACTION_SIM_STATE_CHANGED only provides subId which cannot be converted to a
+                    // PhoneAccountHandle when the SIM is absent.
+                    onSimRemoved(context);
+                }
+                break;
+            case CarrierConfigManager.ACTION_CARRIER_CONFIG_CHANGED:
+                int subId = intent.getIntExtra(PhoneConstants.SUBSCRIPTION_KEY,
+                        SubscriptionManager.INVALID_SUBSCRIPTION_ID);
+
+                if (!SubscriptionManager.isValidSubscriptionId(subId)) {
+                    VvmLog.i(TAG, "Received SIM change for invalid subscription id.");
+                    return;
+                }
+
+                PhoneAccountHandle phoneAccountHandle =
+                        PhoneAccountHandleConverter.fromSubId(subId);
+
+                if ("null".equals(phoneAccountHandle.getId())) {
+                    VvmLog.e(TAG,
+                            "null phone account handle ID, possible modem crash."
+                                    + " Ignoring carrier config changed event");
+                    return;
+                }
+                onCarrierConfigChanged(context, phoneAccountHandle);
+        }
+    }
+
+    private void onBootCompleted(Context context) {
+        for (PhoneAccountHandle phoneAccountHandle : sPreBootHandles) {
+            TelephonyManager telephonyManager = getTelephonyManager(context, phoneAccountHandle);
+            if (telephonyManager == null) {
+                continue;
+            }
+            if (telephonyManager.getServiceState().getState() == ServiceState.STATE_IN_SERVICE) {
+                sListeners.put(phoneAccountHandle, null);
+                sendConnected(context, phoneAccountHandle);
+            } else {
+                listenToAccount(context, phoneAccountHandle);
+            }
+        }
+        sPreBootHandles.clear();
+    }
+
+    private void sendConnected(Context context, PhoneAccountHandle phoneAccountHandle) {
+        VvmLog.i(TAG, "Service connected on " + phoneAccountHandle);
+        RemoteVvmTaskManager.startCellServiceConnected(context, phoneAccountHandle);
+    }
+
+    private void onSimRemoved(Context context) {
+        SubscriptionManager subscriptionManager = SubscriptionManager.from(context);
+        if (!isBootCompleted()) {
+            for (PhoneAccountHandle phoneAccountHandle : sPreBootHandles) {
+                if (!PhoneUtils.isPhoneAccountActive(subscriptionManager, phoneAccountHandle)) {
+                    sPreBootHandles.remove(phoneAccountHandle);
+                }
+            }
+            return;
+        }
+        Set<PhoneAccountHandle> removeList = new ArraySet<>();
+        for (PhoneAccountHandle phoneAccountHandle : sListeners.keySet()) {
+            if (!PhoneUtils.isPhoneAccountActive(subscriptionManager, phoneAccountHandle)) {
+                removeList.add(phoneAccountHandle);
+                ServiceStateListener listener = sListeners.get(phoneAccountHandle);
+                if (listener != null) {
+                    listener.unlisten();
+                }
+                sendSimRemoved(context, phoneAccountHandle);
+            }
+        }
+
+        for (PhoneAccountHandle phoneAccountHandle : removeList) {
+            sListeners.remove(phoneAccountHandle);
+        }
+    }
+
+    private boolean isBootCompleted() {
+        return SystemProperties.getBoolean("sys.boot_completed", false);
+    }
+
+    private void sendSimRemoved(Context context, PhoneAccountHandle phoneAccountHandle) {
+        VvmLog.i(TAG, "Sim removed on " + phoneAccountHandle);
+        RemoteVvmTaskManager.startSimRemoved(context, phoneAccountHandle);
+    }
+
+    private void onCarrierConfigChanged(Context context, PhoneAccountHandle phoneAccountHandle) {
+        if (!isBootCompleted()) {
+            sPreBootHandles.add(phoneAccountHandle);
+            return;
+        }
+        if (getTelephonyManager(context, phoneAccountHandle).getServiceState().getState()
+                == ServiceState.STATE_IN_SERVICE) {
+            sendConnected(context, phoneAccountHandle);
+            sListeners.put(phoneAccountHandle, null);
+        } else {
+            listenToAccount(context, phoneAccountHandle);
+        }
+    }
+
+    private void listenToAccount(Context context, PhoneAccountHandle phoneAccountHandle) {
+        ServiceStateListener listener = new ServiceStateListener(context, phoneAccountHandle);
+        listener.listen();
+        sListeners.put(phoneAccountHandle, listener);
+    }
+
+    @Nullable
+    private static TelephonyManager getTelephonyManager(Context context,
+            PhoneAccountHandle phoneAccountHandle) {
+        return context.getSystemService(TelephonyManager.class)
+                .createForPhoneAccountHandle(phoneAccountHandle);
+    }
+}
diff --git a/src/com/android/phone/vvm/VvmSmsReceiver.java b/src/com/android/phone/vvm/VvmSmsReceiver.java
new file mode 100644
index 0000000..feaa46b
--- /dev/null
+++ b/src/com/android/phone/vvm/VvmSmsReceiver.java
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package com.android.phone.vvm;
+
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+import android.provider.VoicemailContract;
+import android.telephony.SubscriptionManager;
+import android.telephony.VisualVoicemailSms;
+
+import com.android.phone.vvm.omtp.VvmLog;
+import com.android.phone.vvm.omtp.sms.OmtpMessageReceiver;
+import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
+
+/**
+ * Receives the SMS filtered by {@link com.android.internal.telephony.VisualVoicemailSmsFilter} and
+ * redirect it to the visual voicemail client. The redirection is required to let telephony service
+ * handle tasks with {@link RemoteVvmTaskManager}
+ */
+public class VvmSmsReceiver extends BroadcastReceiver {
+
+    private static final String TAG = "VvmSmsReceiver";
+
+    @Override
+    public void onReceive(Context context, Intent intent) {
+        VisualVoicemailSms sms = intent.getExtras()
+                .getParcelable(VoicemailContract.EXTRA_VOICEMAIL_SMS);
+
+        if (sms.getPhoneAccountHandle() == null) {
+            // This should never happen
+            VvmLog.e(TAG, "Received message for null phone account");
+            return;
+        }
+
+        int subId = PhoneAccountHandleConverter.toSubId(sms.getPhoneAccountHandle());
+        if (!SubscriptionManager.isValidSubscriptionId(subId)) {
+            VvmLog.e(TAG, "Received message for invalid subId");
+            return;
+        }
+
+        if (RemoteVvmTaskManager.hasRemoteService(context, subId)) {
+            VvmLog.i(TAG, "Sending SMS received event to remote service");
+            RemoteVvmTaskManager.startSmsReceived(context, sms);
+            return;
+        }
+
+        OmtpMessageReceiver
+                .onReceive(context, sms);
+    }
+}
diff --git a/src/com/android/phone/vvm/omtp/OmtpVvmCarrierConfigHelper.java b/src/com/android/phone/vvm/omtp/OmtpVvmCarrierConfigHelper.java
index 0b321b5..c82012a 100644
--- a/src/com/android/phone/vvm/omtp/OmtpVvmCarrierConfigHelper.java
+++ b/src/com/android/phone/vvm/omtp/OmtpVvmCarrierConfigHelper.java
@@ -35,6 +35,7 @@
 import com.android.phone.vvm.omtp.sms.StatusMessage;
 import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.Set;
 
 /**
@@ -280,10 +281,14 @@
         if (!bundle.containsKey(KEY_VVM_DISABLED_CAPABILITIES_STRING_ARRAY)) {
             return null;
         }
-        ArraySet<String> result = new ArraySet<String>();
-        result.addAll(
-                Arrays.asList(bundle.getStringArray(KEY_VVM_DISABLED_CAPABILITIES_STRING_ARRAY)));
-        return result;
+        String[] disabledCapabilities =
+                bundle.getStringArray(KEY_VVM_DISABLED_CAPABILITIES_STRING_ARRAY);
+        if (disabledCapabilities != null && disabledCapabilities.length > 0) {
+            ArraySet<String> result = new ArraySet<>();
+            Collections.addAll(result, disabledCapabilities);
+            return result;
+        }
+        return null;
     }
 
     public String getClientPrefix() {
diff --git a/src/com/android/phone/vvm/omtp/SimChangeReceiver.java b/src/com/android/phone/vvm/omtp/SimChangeReceiver.java
index a506a12..fb8f02d 100644
--- a/src/com/android/phone/vvm/omtp/SimChangeReceiver.java
+++ b/src/com/android/phone/vvm/omtp/SimChangeReceiver.java
@@ -28,10 +28,12 @@
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
+
 import com.android.internal.telephony.IccCardConstants;
 import com.android.internal.telephony.PhoneConstants;
 import com.android.internal.telephony.TelephonyIntents;
 import com.android.phone.settings.VisualVoicemailSettingsUtil;
+import com.android.phone.vvm.RemoteVvmTaskManager;
 import com.android.phone.vvm.omtp.sync.OmtpVvmSourceManager;
 import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
 
@@ -55,6 +57,18 @@
             return;
         }
 
+        int subId = intent.getIntExtra(PhoneConstants.SUBSCRIPTION_KEY,
+                SubscriptionManager.INVALID_SUBSCRIPTION_ID);
+
+        if (!SubscriptionManager.isValidSubscriptionId(subId)) {
+            VvmLog.i(TAG, "Received SIM change for invalid subscription id.");
+            return;
+        }
+
+        if (RemoteVvmTaskManager.hasRemoteService(context, subId)) {
+            return;
+        }
+
         switch (action) {
             case TelephonyIntents.ACTION_SIM_STATE_CHANGED:
                 if (IccCardConstants.INTENT_VALUE_ICC_ABSENT.equals(
@@ -64,13 +78,7 @@
                 }
                 break;
             case CarrierConfigManager.ACTION_CARRIER_CONFIG_CHANGED:
-                int subId = intent.getIntExtra(PhoneConstants.SUBSCRIPTION_KEY,
-                        SubscriptionManager.INVALID_SUBSCRIPTION_ID);
 
-                if (!SubscriptionManager.isValidSubscriptionId(subId)) {
-                    VvmLog.i(TAG, "Received SIM change for invalid subscription id.");
-                    return;
-                }
 
                 TelephonyManager telephonyManager = context
                         .getSystemService(TelephonyManager.class);
@@ -91,6 +99,7 @@
                 }
 
                 VvmLog.d(TAG, "Carrier config changed");
+
                 if (UserManager.get(context).isUserUnlocked() && !isCryptKeeperMode()) {
                     processSubId(context, subId);
                 } else {
diff --git a/src/com/android/phone/vvm/omtp/VvmBootCompletedReceiver.java b/src/com/android/phone/vvm/omtp/VvmBootCompletedReceiver.java
index 9809c64..f725f96 100644
--- a/src/com/android/phone/vvm/omtp/VvmBootCompletedReceiver.java
+++ b/src/com/android/phone/vvm/omtp/VvmBootCompletedReceiver.java
@@ -22,6 +22,8 @@
 import android.telecom.PhoneAccountHandle;
 import android.telecom.TelecomManager;
 import android.telephony.SubscriptionManager;
+
+import com.android.phone.vvm.RemoteVvmTaskManager;
 import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
 
 /**
@@ -55,6 +57,10 @@
                 VvmLog.e(TAG, "phone account " + handle + " has invalid subId " + subId);
                 continue;
             }
+            if (RemoteVvmTaskManager.hasRemoteService(context, subId)) {
+                return;
+            }
+
             VvmLog.v(TAG, "processing subId " + subId);
             SimChangeReceiver.processSubId(context, subId);
         }
diff --git a/src/com/android/phone/vvm/omtp/VvmPhoneStateListener.java b/src/com/android/phone/vvm/omtp/VvmPhoneStateListener.java
index 7e2472b..75ffc71 100644
--- a/src/com/android/phone/vvm/omtp/VvmPhoneStateListener.java
+++ b/src/com/android/phone/vvm/omtp/VvmPhoneStateListener.java
@@ -23,6 +23,7 @@
 
 import com.android.phone.PhoneUtils;
 import com.android.phone.VoicemailStatus;
+import com.android.phone.vvm.RemoteVvmTaskManager;
 import com.android.phone.vvm.omtp.sync.OmtpVvmSourceManager;
 import com.android.phone.vvm.omtp.sync.OmtpVvmSyncService;
 import com.android.phone.vvm.omtp.sync.SyncTask;
@@ -55,6 +56,10 @@
             return;
         }
 
+        if (RemoteVvmTaskManager.hasRemoteService(mContext, subId)) {
+            return;
+        }
+
         int state = serviceState.getState();
         if (state == mPreviousState || (state != ServiceState.STATE_IN_SERVICE
                 && mPreviousState != ServiceState.STATE_IN_SERVICE)) {
@@ -67,6 +72,7 @@
         OmtpVvmCarrierConfigHelper helper = new OmtpVvmCarrierConfigHelper(mContext, subId);
 
         if (state == ServiceState.STATE_IN_SERVICE) {
+
             VoicemailStatusQueryHelper voicemailStatusQueryHelper =
                     new VoicemailStatusQueryHelper(mContext);
             if (voicemailStatusQueryHelper.isVoicemailSourceConfigured(mPhoneAccount)) {
diff --git a/src/com/android/phone/vvm/omtp/sms/LegacyModeSmsHandler.java b/src/com/android/phone/vvm/omtp/sms/LegacyModeSmsHandler.java
index ba5bd70..6a5f349 100644
--- a/src/com/android/phone/vvm/omtp/sms/LegacyModeSmsHandler.java
+++ b/src/com/android/phone/vvm/omtp/sms/LegacyModeSmsHandler.java
@@ -17,10 +17,8 @@
 package com.android.phone.vvm.omtp.sms;
 
 import android.content.Context;
-import android.content.Intent;
 import android.os.Bundle;
-import android.provider.VoicemailContract;
-import android.telecom.PhoneAccountHandle;
+import android.telephony.VisualVoicemailSms;
 
 import com.android.internal.telephony.Phone;
 import com.android.phone.PhoneUtils;
@@ -37,15 +35,14 @@
 
     private static final String TAG = "LegacyModeSmsHandler";
 
-    public static void handle(Context context, Intent intent, PhoneAccountHandle handle) {
+    public static void handle(Context context, VisualVoicemailSms sms) {
         VvmLog.v(TAG, "processing VVM SMS on legacy mode");
-        String eventType = intent.getExtras()
-                .getString(VoicemailContract.EXTRA_VOICEMAIL_SMS_PREFIX);
-        Bundle data = intent.getExtras().getBundle(VoicemailContract.EXTRA_VOICEMAIL_SMS_FIELDS);
+        String eventType = sms.getPrefix();
+        Bundle data = sms.getFields();
 
         if (eventType.equals(OmtpConstants.SYNC_SMS_PREFIX)) {
             SyncMessage message = new SyncMessage(data);
-            VvmLog.v(TAG, "Received SYNC sms for " + handle.getId() +
+            VvmLog.v(TAG, "Received SYNC sms for " + sms.getPhoneAccountHandle() +
                     " with event " + message.getSyncTriggerEvent());
 
             switch (message.getSyncTriggerEvent()) {
@@ -56,7 +53,8 @@
                     // For some carriers new message count could be set to 0 even if there are still
                     // unread messages, to clear the message waiting indicator.
                     VvmLog.v(TAG, "updating MWI");
-                    Phone phone = PhoneUtils.getPhoneForPhoneAccountHandle(handle);
+                    Phone phone = PhoneUtils.getPhoneForPhoneAccountHandle(
+                            sms.getPhoneAccountHandle());
                     // Setting voicemail message count to non-zero will show the telephony voicemail
                     // notification, and zero will clear it.
                     phone.setVoiceMessageCount(message.getNewMessageCount());
diff --git a/src/com/android/phone/vvm/omtp/sms/OmtpMessageReceiver.java b/src/com/android/phone/vvm/omtp/sms/OmtpMessageReceiver.java
index 397caf8..d42e70e 100644
--- a/src/com/android/phone/vvm/omtp/sms/OmtpMessageReceiver.java
+++ b/src/com/android/phone/vvm/omtp/sms/OmtpMessageReceiver.java
@@ -15,7 +15,6 @@
  */
 package com.android.phone.vvm.omtp.sms;
 
-import android.content.BroadcastReceiver;
 import android.content.ContentUris;
 import android.content.Context;
 import android.content.Intent;
@@ -25,6 +24,8 @@
 import android.provider.VoicemailContract;
 import android.telecom.PhoneAccountHandle;
 import android.telecom.Voicemail;
+import android.telephony.VisualVoicemailSms;
+
 import com.android.phone.settings.VisualVoicemailSettingsUtil;
 import com.android.phone.vvm.omtp.ActivationTask;
 import com.android.phone.vvm.omtp.OmtpConstants;
@@ -40,46 +41,35 @@
 /**
  * Receive SMS messages and send for processing by the OMTP visual voicemail source.
  */
-public class OmtpMessageReceiver extends BroadcastReceiver {
+public class OmtpMessageReceiver {
 
     private static final String TAG = "OmtpMessageReceiver";
 
-    private Context mContext;
+    public static void onReceive(Context context, VisualVoicemailSms sms) {
 
-    @Override
-    public void onReceive(Context context, Intent intent) {
-        mContext = context;
-        int subId = intent.getExtras().getInt(VoicemailContract.EXTRA_VOICEMAIL_SMS_SUBID);
-        PhoneAccountHandle phone = PhoneAccountHandleConverter.fromSubId(subId);
-
-        if (phone == null) {
-            // This should never happen
-            VvmLog.i(TAG, "Received message for null phone account on subId " + subId);
-            return;
-        }
-
+        PhoneAccountHandle phone = sms.getPhoneAccountHandle();
+        int subId = PhoneAccountHandleConverter.toSubId(phone);
         if (!UserManager.get(context).isUserUnlocked()) {
             VvmLog.i(TAG, "Received message on locked device");
             // LegacyModeSmsHandler can handle new message notifications without storage access
-            LegacyModeSmsHandler.handle(context, intent, phone);
+            LegacyModeSmsHandler.handle(context, sms);
             // A full sync will happen after the device is unlocked, so nothing else need to be
             // done.
             return;
         }
 
-        OmtpVvmCarrierConfigHelper helper = new OmtpVvmCarrierConfigHelper(mContext, subId);
-        if (!VisualVoicemailSettingsUtil.isEnabled(mContext, phone)) {
+        OmtpVvmCarrierConfigHelper helper = new OmtpVvmCarrierConfigHelper(context, subId);
+        if (!VisualVoicemailSettingsUtil.isEnabled(context, phone)) {
             if (helper.isLegacyModeEnabled()) {
-                LegacyModeSmsHandler.handle(context, intent, phone);
+                LegacyModeSmsHandler.handle(context, sms);
             } else {
                 VvmLog.i(TAG, "Received vvm message for disabled vvm source.");
             }
             return;
         }
 
-        String eventType = intent.getExtras()
-                .getString(VoicemailContract.EXTRA_VOICEMAIL_SMS_PREFIX);
-        Bundle data = intent.getExtras().getBundle(VoicemailContract.EXTRA_VOICEMAIL_SMS_FIELDS);
+        String eventType = sms.getPrefix();
+        Bundle data = sms.getFields();
 
         if (eventType == null || data == null) {
             VvmLog.e(TAG, "Unparsable VVM SMS received, ignoring");
@@ -91,7 +81,7 @@
 
             VvmLog.v(TAG, "Received SYNC sms for " + subId +
                     " with event " + message.getSyncTriggerEvent());
-            processSync(phone, message);
+            processSync(context, phone, message);
         } else if (eventType.equals(OmtpConstants.STATUS_SMS_PREFIX)) {
             VvmLog.v(TAG, "Received Status sms for " + subId);
             // If the STATUS SMS is initiated by ActivationTask the TaskSchedulerService will reject
@@ -122,7 +112,8 @@
      *
      * @param message The sync message to extract data from.
      */
-    private void processSync(PhoneAccountHandle phone, SyncMessage message) {
+    private static void processSync(Context context, PhoneAccountHandle phone,
+            SyncMessage message) {
         Intent serviceIntent = null;
         switch (message.getSyncTriggerEvent()) {
             case OmtpConstants.NEW_MESSAGE:
@@ -137,18 +128,18 @@
                         .setPhoneAccount(phone)
                         .setSourceData(message.getId())
                         .setDuration(message.getLength())
-                        .setSourcePackage(mContext.getPackageName());
+                        .setSourcePackage(context.getPackageName());
                 Voicemail voicemail = builder.build();
 
-                VoicemailsQueryHelper queryHelper = new VoicemailsQueryHelper(mContext);
+                VoicemailsQueryHelper queryHelper = new VoicemailsQueryHelper(context);
                 if (queryHelper.isVoicemailUnique(voicemail)) {
-                    Uri uri = VoicemailContract.Voicemails.insert(mContext, voicemail);
+                    Uri uri = VoicemailContract.Voicemails.insert(context, voicemail);
                     voicemail = builder.setId(ContentUris.parseId(uri)).setUri(uri).build();
-                    SyncOneTask.start(mContext, phone, voicemail);
+                    SyncOneTask.start(context, phone, voicemail);
                 }
                 break;
             case OmtpConstants.MAILBOX_UPDATE:
-                SyncTask.start(mContext, phone, OmtpVvmSyncService.SYNC_DOWNLOAD_ONLY);
+                SyncTask.start(context, phone, OmtpVvmSyncService.SYNC_DOWNLOAD_ONLY);
                 break;
             case OmtpConstants.GREETINGS_UPDATE:
                 // Not implemented in V1
diff --git a/src/com/android/phone/vvm/omtp/sms/OmtpProvisioningService.java b/src/com/android/phone/vvm/omtp/sms/OmtpProvisioningService.java
deleted file mode 100644
index 154eeeb..0000000
--- a/src/com/android/phone/vvm/omtp/sms/OmtpProvisioningService.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License
- */
-
-package com.android.phone.vvm.omtp.sms;
-
-import android.app.IntentService;
-import android.content.Context;
-import android.content.Intent;
-import android.os.Bundle;
-import android.provider.VoicemailContract;
-import android.telecom.PhoneAccountHandle;
-
-import com.android.phone.PhoneUtils;
-import com.android.phone.vvm.omtp.OmtpVvmCarrierConfigHelper;
-import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
-
-/**
- * Performs visual voicemail provisioning in background thread. Not exported.
- */
-public class OmtpProvisioningService extends IntentService {
-
-    public OmtpProvisioningService() {
-        super("OmtpProvisioningService");
-    }
-
-    /**
-     * Create an intent to start OmtpProvisioningService from a {@link
-     * VoicemailContract.ACTION_VOICEMAIL_SMS_RECEIVED} intent.
-     */
-    public static Intent getProvisionIntent(Context context, Intent messageIntent) {
-        Intent serviceIntent = new Intent(context, OmtpProvisioningService.class);
-
-        serviceIntent.putExtra(VoicemailContract.EXTRA_VOICEMAIL_SMS_SUBID,
-                messageIntent.getExtras().getInt(VoicemailContract.EXTRA_VOICEMAIL_SMS_SUBID));
-        serviceIntent.putExtra(VoicemailContract.EXTRA_VOICEMAIL_SMS_FIELDS,
-                messageIntent.getExtras().getBundle(VoicemailContract.EXTRA_VOICEMAIL_SMS_FIELDS));
-
-        return serviceIntent;
-    }
-
-    @Override
-    public void onHandleIntent(Intent intent) {
-        int subId = intent.getExtras().getInt(VoicemailContract.EXTRA_VOICEMAIL_SMS_SUBID);
-        PhoneAccountHandle phone = PhoneAccountHandleConverter.fromSubId(subId);
-
-        Bundle data = intent.getExtras().getBundle(VoicemailContract.EXTRA_VOICEMAIL_SMS_FIELDS);
-
-        StatusMessage message = new StatusMessage(data);
-        startProvisioning(phone, message, data);
-    }
-
-    private void startProvisioning(PhoneAccountHandle phone, StatusMessage message, Bundle data) {
-        OmtpVvmCarrierConfigHelper helper = new OmtpVvmCarrierConfigHelper(this,
-                PhoneUtils.getSubIdForPhoneAccountHandle(phone));
-
-    }
-}
diff --git a/src/com/android/phone/vvm/omtp/sms/StatusSmsFetcher.java b/src/com/android/phone/vvm/omtp/sms/StatusSmsFetcher.java
index 69e4f5f..adaa2f4 100644
--- a/src/com/android/phone/vvm/omtp/sms/StatusSmsFetcher.java
+++ b/src/com/android/phone/vvm/omtp/sms/StatusSmsFetcher.java
@@ -27,13 +27,16 @@
 import android.content.IntentFilter;
 import android.os.Bundle;
 import android.provider.VoicemailContract;
+import android.telecom.PhoneAccountHandle;
 import android.telephony.SmsManager;
+import android.telephony.VisualVoicemailSms;
 
 import com.android.phone.Assert;
 import com.android.phone.vvm.omtp.OmtpConstants;
 import com.android.phone.vvm.omtp.OmtpVvmCarrierConfigHelper;
 import com.android.phone.vvm.omtp.VvmLog;
 import com.android.phone.vvm.omtp.protocol.VisualVoicemailProtocol;
+import com.android.phone.vvm.omtp.utils.PhoneAccountHandleConverter;
 
 import java.io.Closeable;
 import java.io.IOException;
@@ -107,16 +110,17 @@
             return;
         }
 
-        int subId = intent.getExtras().getInt(VoicemailContract.EXTRA_VOICEMAIL_SMS_SUBID);
-
+        VisualVoicemailSms sms = intent.getExtras()
+                .getParcelable(VoicemailContract.EXTRA_VOICEMAIL_SMS);
+        PhoneAccountHandle phoneAccountHandle = sms.getPhoneAccountHandle();
+        int subId = PhoneAccountHandleConverter.toSubId(phoneAccountHandle);
         if (mSubId != subId) {
             return;
         }
-        String eventType = intent.getExtras()
-                .getString(VoicemailContract.EXTRA_VOICEMAIL_SMS_PREFIX);
+        String eventType = sms.getPrefix();
 
         if (eventType.equals(OmtpConstants.STATUS_SMS_PREFIX)) {
-            mFuture.complete(intent.getBundleExtra(VoicemailContract.EXTRA_VOICEMAIL_SMS_FIELDS));
+            mFuture.complete(sms.getFields());
             return;
         }
 
@@ -132,7 +136,7 @@
             return;
         }
         Bundle translatedBundle = protocol.translateStatusSmsBundle(helper, eventType,
-                intent.getBundleExtra(VoicemailContract.EXTRA_VOICEMAIL_SMS_FIELDS));
+                sms.getFields());
 
         if (translatedBundle != null) {
             VvmLog.i(TAG, "Translated to STATUS SMS");
diff --git a/src/com/android/services/telephony/TelecomAccountRegistry.java b/src/com/android/services/telephony/TelecomAccountRegistry.java
index 8abf381..bcc53b5 100644
--- a/src/com/android/services/telephony/TelecomAccountRegistry.java
+++ b/src/com/android/services/telephony/TelecomAccountRegistry.java
@@ -621,9 +621,11 @@
      * @return {@code True} if merging IMS calls is supported.
      */
     boolean isMergeImsCallSupported(PhoneAccountHandle handle) {
-        for (AccountEntry entry : mAccounts) {
-            if (entry.getPhoneAccountHandle().equals(handle)) {
-                return entry.isMergeImsCallSupported();
+        synchronized (mAccountsLock) {
+            for (AccountEntry entry : mAccounts) {
+                if (entry.getPhoneAccountHandle().equals(handle)) {
+                    return entry.isMergeImsCallSupported();
+                }
             }
         }
         return false;
diff --git a/src/com/android/services/telephony/TelephonyConnection.java b/src/com/android/services/telephony/TelephonyConnection.java
index b5dcba6..9ac40fd 100644
--- a/src/com/android/services/telephony/TelephonyConnection.java
+++ b/src/com/android/services/telephony/TelephonyConnection.java
@@ -50,6 +50,7 @@
 import com.android.internal.telephony.Phone;
 import com.android.internal.telephony.imsphone.ImsPhone;
 import com.android.internal.telephony.imsphone.ImsPhoneCallTracker;
+import com.android.internal.telephony.imsphone.ImsPhoneConnection;
 import com.android.phone.ImsUtil;
 import com.android.phone.PhoneGlobals;
 import com.android.phone.PhoneUtils;
@@ -417,6 +418,20 @@
         public void onConnectionEvent(String event, Bundle extras) {
             sendConnectionEvent(event, extras);
         }
+
+        @Override
+        public void onRttModifyRequestReceived() {
+            sendRemoteRttRequest();
+        }
+
+        @Override
+        public void onRttModifyResponseReceived(int status) {
+            if (status == RttModifyStatus.SESSION_MODIFY_REQUEST_SUCCESS) {
+                sendRttInitiationSuccess();
+            } else {
+                sendRttInitiationFailure(status);
+            }
+        }
     };
 
     protected com.android.internal.telephony.Connection mOriginalConnection;
@@ -618,6 +633,31 @@
         }
     }
 
+    @Override
+    public void onStartRtt(RttTextStream textStream) {
+        if (isImsConnection()) {
+            ImsPhoneConnection originalConnection = (ImsPhoneConnection) mOriginalConnection;
+            originalConnection.sendRttModifyRequest(textStream);
+        } else {
+            Log.w(this, "onStartRtt - not in IMS, so RTT cannot be enabled.");
+        }
+    }
+
+    @Override
+    public void onStopRtt() {
+        // This is not supported by carriers/vendor yet. No-op for now.
+    }
+
+    @Override
+    public void handleRttUpgradeResponse(RttTextStream textStream) {
+        if (!isImsConnection()) {
+            Log.w(this, "handleRttUpgradeResponse - not in IMS, so RTT cannot be enabled.");
+            return;
+        }
+        ImsPhoneConnection originalConnection = (ImsPhoneConnection) mOriginalConnection;
+        originalConnection.sendRttModifyResponse(textStream);
+    }
+
     public void performHold() {
         Log.v(this, "performHold");
         // TODO: Can dialing calls be put on hold as well since they take up the