diff --git a/base/HidlInternal.cpp b/base/HidlInternal.cpp
index 843fcad..5fae1c4 100644
--- a/base/HidlInternal.cpp
+++ b/base/HidlInternal.cpp
@@ -40,10 +40,10 @@
 
 // ----------------------------------------------------------------------
 // HidlInstrumentor implementation.
-HidlInstrumentor::HidlInstrumentor(
-        const std::string &package,
-        const std::string &interface)
-        : mInstrumentationLibPackage(package), mInterfaceName(interface) {
+HidlInstrumentor::HidlInstrumentor(const std::string& package, const std::string& interface)
+    : mEnableInstrumentation(false),
+      mInstrumentationLibPackage(package),
+      mInterfaceName(interface) {
     configureInstrumentation(false);
 #ifdef LIBHIDL_TARGET_DEBUGGABLE
     if (__sanitizer_cov_dump != nullptr) {
@@ -62,11 +62,11 @@
 HidlInstrumentor::~HidlInstrumentor() {}
 
 void HidlInstrumentor::configureInstrumentation(bool log) {
-    bool enable_instrumentation = property_get_bool(
+    bool enableInstrumentation = property_get_bool(
             "hal.instrumentation.enable",
             false);
-    if (enable_instrumentation != mEnableInstrumentation) {
-        mEnableInstrumentation = enable_instrumentation;
+    if (enableInstrumentation != mEnableInstrumentation) {
+        mEnableInstrumentation = enableInstrumentation;
         if (mEnableInstrumentation) {
             if (log) {
                 LOG(INFO) << "Enable instrumentation.";
@@ -85,11 +85,11 @@
         std::vector<InstrumentationCallback> *instrumentationCallbacks) {
 #ifdef LIBHIDL_TARGET_DEBUGGABLE
     std::vector<std::string> instrumentationLibPaths;
-    char instrumentation_lib_path[PROPERTY_VALUE_MAX];
+    char instrumentationLibPath[PROPERTY_VALUE_MAX];
     if (property_get("hal.instrumentation.lib.path",
-                     instrumentation_lib_path,
+                     instrumentationLibPath,
                      "") > 0) {
-        instrumentationLibPaths.push_back(instrumentation_lib_path);
+        instrumentationLibPaths.push_back(instrumentationLibPath);
     } else {
         instrumentationLibPaths.push_back(HAL_LIBRARY_PATH_SYSTEM);
         instrumentationLibPaths.push_back(HAL_LIBRARY_PATH_VENDOR);
@@ -118,7 +118,7 @@
 
             dlerror(); /* Clear any existing error */
 
-            using cb_fun = void (*)(
+            using cbFun = void (*)(
                     const InstrumentationEvent,
                     const char *,
                     const char *,
@@ -138,7 +138,7 @@
                     continue;
                 }
             }
-            auto cb = (cb_fun)dlsym(handle, ("HIDL_INSTRUMENTATION_FUNCTION_"
+            auto cb = (cbFun)dlsym(handle, ("HIDL_INSTRUMENTATION_FUNCTION_"
                         + package + "_" + mInterfaceName).c_str());
             if ((error = dlerror()) != NULL) {
                 LOG(WARNING)
diff --git a/base/HidlSupport.cpp b/base/HidlSupport.cpp
index 7580693..4de7f7c 100644
--- a/base/HidlSupport.cpp
+++ b/base/HidlSupport.cpp
@@ -99,6 +99,7 @@
 }
 
 void hidl_handle::setTo(native_handle_t* handle, bool shouldOwn) {
+    freeHandle();
     mHandle = handle;
     mOwnsHandle = shouldOwn;
 }
diff --git a/base/include/hidl/SynchronizedQueue.h b/base/SynchronizedQueue.h
similarity index 88%
rename from base/include/hidl/SynchronizedQueue.h
rename to base/SynchronizedQueue.h
index efb04e0..0ef9e4f 100644
--- a/base/include/hidl/SynchronizedQueue.h
+++ b/base/SynchronizedQueue.h
@@ -45,11 +45,23 @@
      */
     size_t size();
 
+    std::unique_lock<std::mutex> lock() {
+        return std::unique_lock<std::mutex>(mMutex);
+    }
+
+    bool isInitializedLocked() {
+        return mInitialized;
+    }
+    void setInitializedLocked(bool isInitialized) {
+        mInitialized = isInitialized;
+    }
+
 private:
     std::condition_variable mCondition;
     std::mutex mMutex;
     std::queue<T> mQueue;
     const size_t mQueueLimit;
+    bool mInitialized;
 };
 
 template <typename T>
diff --git a/base/TaskRunner.cpp b/base/TaskRunner.cpp
index 782b40b..d4357bf 100644
--- a/base/TaskRunner.cpp
+++ b/base/TaskRunner.cpp
@@ -15,6 +15,9 @@
  */
 
 #include <hidl/TaskRunner.h>
+
+#include "SynchronizedQueue.h"
+
 #include <thread>
 
 namespace android {
@@ -26,15 +29,6 @@
 
 void TaskRunner::start(size_t limit) {
     mQueue = std::make_shared<SynchronizedQueue<Task>>(limit);
-
-    // Allow the thread to continue running in background;
-    // TaskRunner do not care about the std::thread object.
-    std::thread{[q = mQueue] {
-        Task nextTask;
-        while (!!(nextTask = q->wait_pop())) {
-            nextTask();
-        }
-    }}.detach();
 }
 
 TaskRunner::~TaskRunner() {
@@ -44,7 +38,28 @@
 }
 
 bool TaskRunner::push(const Task &t) {
-    return (mQueue != nullptr) && (!!t) && this->mQueue->push(t);
+    if (mQueue == nullptr || !t) {
+        return false;
+    }
+
+    {
+        std::unique_lock<std::mutex> lock = mQueue->lock();
+
+        if (!mQueue->isInitializedLocked()) {
+            // Allow the thread to continue running in background;
+            // TaskRunner do not care about the std::thread object.
+            std::thread{[q = mQueue] {
+                Task nextTask;
+                while (!!(nextTask = q->wait_pop())) {
+                    nextTask();
+                }
+            }}.detach();
+
+            mQueue->setInitializedLocked(true);
+        }
+    }
+
+    return this->mQueue->push(t);
 }
 
 } // namespace details
diff --git a/base/include/hidl/HidlSupport.h b/base/include/hidl/HidlSupport.h
index de5081d..6e37229 100644
--- a/base/include/hidl/HidlSupport.h
+++ b/base/include/hidl/HidlSupport.h
@@ -94,14 +94,14 @@
     hidl_handle(const hidl_handle &other);
 
     // move constructor.
-    hidl_handle(hidl_handle &&other);
+    hidl_handle(hidl_handle &&other) noexcept;
 
     // assignment operators
     hidl_handle &operator=(const hidl_handle &other);
 
     hidl_handle &operator=(const native_handle_t *native_handle);
 
-    hidl_handle &operator=(hidl_handle &&other);
+    hidl_handle &operator=(hidl_handle &&other) noexcept;
 
     void setTo(native_handle_t* handle, bool shouldOwn = false);
 
@@ -133,7 +133,7 @@
     hidl_string(const std::string &);
 
     // move constructor.
-    hidl_string(hidl_string &&);
+    hidl_string(hidl_string &&) noexcept;
 
     const char *c_str() const;
     size_t size() const;
@@ -146,7 +146,7 @@
     // copy from an std::string.
     hidl_string &operator=(const std::string &);
     // move assignment operator.
-    hidl_string &operator=(hidl_string &&other);
+    hidl_string &operator=(hidl_string &&other) noexcept;
     // cast to std::string.
     operator std::string() const;
 
@@ -236,12 +236,12 @@
     }
 
     // move constructor
-    hidl_memory(hidl_memory&& other) {
+    hidl_memory(hidl_memory&& other) noexcept {
         *this = std::move(other);
     }
 
     // move assignment
-    hidl_memory &operator=(hidl_memory &&other) {
+    hidl_memory &operator=(hidl_memory &&other) noexcept {
         if (this != &other) {
             mHandle = std::move(other.mHandle);
             mSize = other.mSize;
@@ -294,7 +294,7 @@
         *this = other;
     }
 
-    hidl_vec(hidl_vec<T> &&other)
+    hidl_vec(hidl_vec<T> &&other) noexcept
     : mOwnsBuffer(false) {
         *this = std::move(other);
     }
@@ -376,7 +376,7 @@
         return mBuffer;
     }
 
-    hidl_vec &operator=(hidl_vec &&other) {
+    hidl_vec &operator=(hidl_vec &&other) noexcept {
         if (mOwnsBuffer) {
             delete[] mBuffer;
         }
diff --git a/base/include/hidl/TaskRunner.h b/base/include/hidl/TaskRunner.h
index 28ea01c..6a79ebf 100644
--- a/base/include/hidl/TaskRunner.h
+++ b/base/include/hidl/TaskRunner.h
@@ -16,7 +16,6 @@
 #ifndef ANDROID_HIDL_TASK_RUNNER_H
 #define ANDROID_HIDL_TASK_RUNNER_H
 
-#include "SynchronizedQueue.h"
 #include <memory>
 #include <thread>
 
@@ -24,13 +23,17 @@
 namespace hardware {
 namespace details {
 
+using Task = std::function<void(void)>;
+
+template <typename T>
+struct SynchronizedQueue;
+
 /*
  * A background infinite loop that runs the Tasks push()'ed.
  * Equivalent to a simple single-threaded Looper.
  */
 class TaskRunner {
 public:
-    using Task = std::function<void(void)>;
 
     /* Create an empty task runner. Nothing will be done until start() is called. */
     TaskRunner();
@@ -44,7 +47,9 @@
 
     /*
      * Sets the queue limit. Fails the push operation once the limit is reached.
-     * Then kicks off the loop.
+     * This function is named start for legacy reasons and to maintain ABI
+     * stability, but the underlying thread running tasks isn't started until
+     * the first task is pushed.
      */
     void start(size_t limit);
 
diff --git a/libhidlmemory/mapping.cpp b/libhidlmemory/mapping.cpp
index f4bb21e..3cb6485 100644
--- a/libhidlmemory/mapping.cpp
+++ b/libhidlmemory/mapping.cpp
@@ -15,6 +15,10 @@
  */
 #define LOG_TAG "libhidlmemory"
 
+#include <map>
+#include <mutex>
+#include <string>
+
 #include <hidlmemory/mapping.h>
 
 #include <android-base/logging.h>
@@ -23,14 +27,31 @@
 
 using android::sp;
 using android::hidl::memory::V1_0::IMemory;
+using android::hidl::memory::V1_0::IMapper;
 
 namespace android {
 namespace hardware {
 
-sp<IMemory> mapMemory(const hidl_memory &memory) {
-    using android::hidl::memory::V1_0::IMapper;
+static std::map<std::string, sp<IMapper>> gMappersByName;
+static std::mutex gMutex;
 
-    sp<IMapper> mapper = IMapper::getService(memory.name(), true /* getStub */);
+static inline sp<IMapper> getMapperService(const std::string& name) {
+    std::unique_lock<std::mutex> _lock(gMutex);
+    auto iter = gMappersByName.find(name);
+    if (iter != gMappersByName.end()) {
+        return iter->second;
+    }
+
+    sp<IMapper> mapper = IMapper::getService(name, true /* getStub */);
+    if (mapper != nullptr) {
+        gMappersByName[name] = mapper;
+    }
+    return mapper;
+}
+
+sp<IMemory> mapMemory(const hidl_memory& memory) {
+
+    sp<IMapper> mapper = getMapperService(memory.name());
 
     if (mapper == nullptr) {
         LOG(ERROR) << "Could not fetch mapper for " << memory.name() << " shared memory";
diff --git a/manifest.xml b/manifest.xml
index dd22531..fb1ee39 100644
--- a/manifest.xml
+++ b/manifest.xml
@@ -35,4 +35,49 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal>
+        <name>android.frameworks.displayservice</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>IDisplayService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal>
+        <name>android.frameworks.schedulerservice</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>ISchedulingPolicyService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal>
+        <name>android.frameworks.sensorservice</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>ISensorManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal>
+        <name>android.system.wifi.keystore</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>IKeystore</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal>
+      <name>android.hardware.graphics.composer</name>
+      <transport>hwbinder</transport>
+      <version>2.1</version>
+      <interface>
+          <name>IComposer</name>
+          <instance>vr</instance>
+      </interface>
+    </hal>
 </manifest>
diff --git a/transport/ServiceManagement.cpp b/transport/ServiceManagement.cpp
index c19ef58..a404d10 100644
--- a/transport/ServiceManagement.cpp
+++ b/transport/ServiceManagement.cpp
@@ -16,6 +16,7 @@
 
 #define LOG_TAG "ServiceManagement"
 
+#include <android/dlext.h>
 #include <condition_variable>
 #include <dlfcn.h>
 #include <dirent.h>
@@ -44,6 +45,10 @@
 #define RE_PATH         RE_COMPONENT "(?:[.]" RE_COMPONENT ")*"
 static const std::regex gLibraryFileNamePattern("(" RE_PATH "@[0-9]+[.][0-9]+)-impl(.*?).so");
 
+extern "C" {
+    android_namespace_t* android_get_exported_namespace(const char*);
+}
+
 using android::base::WaitForProperty;
 
 using IServiceManager1_0 = android::hidl::manager::V1_0::IServiceManager;
@@ -270,6 +275,7 @@
         const std::string prefix = packageAndVersion + "-impl";
         const std::string sym = "HIDL_FETCH_" + ifaceName;
 
+        const android_namespace_t* sphal_namespace = android_get_exported_namespace("sphal");
         const int dlMode = RTLD_LAZY;
         void *handle = nullptr;
 
@@ -295,7 +301,29 @@
             for (const std::string &lib : libs) {
                 const std::string fullPath = path + lib;
 
-                handle = dlopen(fullPath.c_str(), dlMode);
+                // If sphal namespace is available, try to load from the
+                // namespace first. If it fails, fall back to the original
+                // dlopen, which loads from the current namespace.
+                if (sphal_namespace != nullptr && path != HAL_LIBRARY_PATH_SYSTEM) {
+                    const android_dlextinfo dlextinfo = {
+                        .flags = ANDROID_DLEXT_USE_NAMESPACE,
+                        // const_cast is dirty but required because
+                        // library_namespace field is non-const.
+                        .library_namespace = const_cast<android_namespace_t*>(sphal_namespace),
+                    };
+                    handle = android_dlopen_ext(fullPath.c_str(), dlMode, &dlextinfo);
+                    if (handle == nullptr) {
+                        const char* error = dlerror();
+                        LOG(WARNING) << "Failed to dlopen " << lib << " from sphal namespace:"
+                                     << (error == nullptr ? "unknown error" : error);
+                    } else {
+                        LOG(DEBUG) << lib << " loaded from sphal namespace.";
+                    }
+                }
+                if (handle == nullptr) {
+                    handle = dlopen(fullPath.c_str(), dlMode);
+                }
+
                 if (handle == nullptr) {
                     const char* error = dlerror();
                     LOG(ERROR) << "Failed to dlopen " << lib << ": "
diff --git a/transport/current.txt b/transport/current.txt
new file mode 100644
index 0000000..a6ecd81
--- /dev/null
+++ b/transport/current.txt
@@ -0,0 +1,13 @@
+# Do not change this file except to add new interfaces. Changing
+# pre-existing interfaces will fail VTS and break framework-only OTAs
+
+# HALs released in Android O
+
+fc6cbbc8a22edabd4b58f8949e591359d3138d16a82506052e25ac43e1dbda68 android.hidl.allocator@1.0::IAllocator
+bddab6184d7a346da6a07dc0828cf19a696f4caa3611c51f2e14565a14b40fd9 android.hidl.base@1.0::IBase
+500ec34f1b0826a93c4abe45b23c4d85565d8041acaf3cf9fb23c09702967567 android.hidl.base@1.0::types
+4d046a598e85f1c2d383c3a9096c3c0578e97458072ee7e67f704e99d5fb0d3f android.hidl.manager@1.0::IServiceManager
+50552b700ef67c7ed8c8d776d323f8c629a9b43b965e10a916a66f3c946c50fb android.hidl.manager@1.0::IServiceNotification
+2b885b5dec97391c82f35e64180686dc4c8f78b2b0a01732f8536385654f27c8 android.hidl.memory@1.0::IMapper
+4632246017013e75536fa6ee47db286b24a323fb92c37c6b14bb0ab796b7a16b android.hidl.memory@1.0::IMemory
+7c9fe352af04af659bd51ab6f5495115575bc063ddf684fc6d0dec1f4a4b4b7c android.hidl.token@1.0::ITokenManager
diff --git a/transport/include/hidl/LegacySupport.h b/transport/include/hidl/LegacySupport.h
index 2f0c3f3..f03d34d 100644
--- a/transport/include/hidl/LegacySupport.h
+++ b/transport/include/hidl/LegacySupport.h
@@ -74,7 +74,7 @@
     }
 
     joinRpcThreadpool();
-    return 0;
+    return UNKNOWN_ERROR;
 }
 template<class Interface>
 __attribute__((warn_unused_result))