diff --git a/Android.bp b/Android.bp
index 2b9e80f..670ee39 100644
--- a/Android.bp
+++ b/Android.bp
@@ -98,7 +98,7 @@
         "//apex_available:platform",
         "com.android.neuralnetworks",
         "test_com.android.neuralnetworks",
-        "com.android.bluetooth",
+        "com.android.btservices",
         "com.android.media",
         "com.android.media.swcodec",
         "com.android.tethering",
diff --git a/base/include/hidl/MQDescriptor.h b/base/include/hidl/MQDescriptor.h
index 0429444..38ac325 100644
--- a/base/include/hidl/MQDescriptor.h
+++ b/base/include/hidl/MQDescriptor.h
@@ -181,7 +181,11 @@
 
 template<typename T, MQFlavor flavor>
 size_t MQDescriptor<T, flavor>::getSize() const {
-    return static_cast<size_t>(mGrantors[details::DATAPTRPOS].extent);
+    if (mGrantors.size() > details::DATAPTRPOS) {
+        return static_cast<size_t>(mGrantors[details::DATAPTRPOS].extent);
+    } else {
+        return 0;
+    }
 }
 
 template<typename T, MQFlavor flavor>
diff --git a/transport/ServiceManagement.cpp b/transport/ServiceManagement.cpp
index 0640eef..f3ee611 100644
--- a/transport/ServiceManagement.cpp
+++ b/transport/ServiceManagement.cpp
@@ -59,6 +59,7 @@
 using IServiceManager1_1 = android::hidl::manager::V1_1::IServiceManager;
 using IServiceManager1_2 = android::hidl::manager::V1_2::IServiceManager;
 using ::android::hidl::manager::V1_0::IServiceNotification;
+using ::android::hidl::manager::V1_2::IClientCallback;
 
 namespace android {
 namespace hardware {
@@ -204,6 +205,109 @@
 sp<IServiceManager1_1> defaultServiceManager1_1() {
     return defaultServiceManager1_2();
 }
+static bool isServiceManager(const hidl_string& fqName) {
+    return fqName == IServiceManager1_0::descriptor || fqName == IServiceManager1_1::descriptor ||
+           fqName == IServiceManager1_2::descriptor;
+}
+static bool isHwServiceManagerInstalled() {
+    return access("/system/bin/hwservicemanager", F_OK) == 0;
+}
+
+/*
+ * A replacement for hwservicemanager when it is not installed on a device.
+ *
+ * Clients in the framework need to continue supporting HIDL services through
+ * hwservicemanager for upgrading devices. Being unable to get an instance of
+ * hardware service manager is a hard error, so this implementation is returned
+ * to be able service the requests and tell clients there are no services
+ * registered.
+ */
+struct NoHwServiceManager : public IServiceManager1_2 {
+    Return<sp<IBase>> get(const hidl_string& fqName, const hidl_string&) override {
+        sp<IBase> ret = nullptr;
+
+        if (isServiceManager(fqName)) {
+            ret = defaultServiceManager1_2();
+        }
+        return ret;
+    }
+
+    Return<bool> add(const hidl_string& name, const sp<IBase>& /* service */) override {
+        LOG(INFO) << "Cannot add " << name << " without hwservicemanager";
+        return false;
+    }
+
+    Return<Transport> getTransport(const hidl_string& fqName, const hidl_string& name) {
+        LOG(INFO) << "Trying to get transport of " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return Transport::PASSTHROUGH;
+    }
+
+    Return<void> list(list_cb _hidl_cb) override {
+        _hidl_cb({});
+        LOG(INFO) << "Cannot list all services without hwservicemanager";
+        return Void();
+    }
+    Return<void> listByInterface(const hidl_string& fqName, listByInterface_cb _hidl_cb) override {
+        _hidl_cb({});
+        LOG(INFO) << "Cannot list service " << fqName << " without hwservicemanager";
+        return Void();
+    }
+
+    Return<bool> registerForNotifications(const hidl_string& fqName, const hidl_string& name,
+                                          const sp<IServiceNotification>& /* callback */) override {
+        LOG(INFO) << "Cannot register for notifications for " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+
+    Return<void> debugDump(debugDump_cb _hidl_cb) override {
+        _hidl_cb({});
+        return Void();
+    }
+
+    Return<void> registerPassthroughClient(const hidl_string& fqName,
+                                           const hidl_string& name) override {
+        LOG(INFO) << "This process is a client of " << fqName << "/" << name
+                  << " passthrough HAL, but it won't show up in lshal because hwservicemanager is "
+                     "not installed";
+        return Void();
+    }
+
+    Return<bool> unregisterForNotifications(
+            const hidl_string& fqName, const hidl_string& name,
+            const sp<IServiceNotification>& /* callback */) override {
+        LOG(INFO) << "Cannot unregister for notifications for " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+    Return<bool> registerClientCallback(const hidl_string& fqName, const hidl_string& name,
+                                        const sp<IBase>&, const sp<IClientCallback>&) {
+        LOG(INFO) << "Cannot add client callback for " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+    Return<bool> unregisterClientCallback(const sp<IBase>&, const sp<IClientCallback>&) {
+        LOG(INFO) << "Cannot unregister client callbacks without hwservicemanager";
+        return false;
+    }
+    Return<bool> addWithChain(const hidl_string& fqName, const sp<IBase>&,
+                              const hidl_vec<hidl_string>&) {
+        LOG(INFO) << "Cannot add " << fqName << " with chain without hwservicemanager";
+        return false;
+    }
+    Return<void> listManifestByInterface(const hidl_string& fqName, listManifestByInterface_cb) {
+        LOG(INFO) << "Cannot list manifest for " << fqName << " without hwservicemanager";
+        return Void();
+    }
+    Return<bool> tryUnregister(const hidl_string& fqName, const hidl_string& name,
+                               const sp<IBase>&) {
+        LOG(INFO) << "Cannot unregister service " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+};
+
 sp<IServiceManager1_2> defaultServiceManager1_2() {
     using android::hidl::manager::V1_2::BnHwServiceManager;
     using android::hidl::manager::V1_2::BpHwServiceManager;
@@ -217,6 +321,12 @@
             return gDefaultServiceManager;
         }
 
+        if (!isHwServiceManagerInstalled()) {
+            // hwservicemanager is not available on this device.
+            gDefaultServiceManager = sp<NoHwServiceManager>::make();
+            return gDefaultServiceManager;
+        }
+
         if (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) {
             // HwBinder not available on this device or not accessible to
             // this process.
@@ -413,6 +523,12 @@
     Return<sp<IBase>> get(const hidl_string& fqName,
                           const hidl_string& name) override {
         sp<IBase> ret = nullptr;
+        // This is required to run without hwservicemanager while we have
+        // passthrough HIDL services. Once the passthrough HIDL services have
+        // been removed, the PassthroughServiceManager will no longer be needed.
+        if (!isHwServiceManagerInstalled() && isServiceManager(fqName)) {
+            return defaultServiceManager1_2();
+        }
 
         openLibs(fqName, [&](void* handle, const std::string &lib, const std::string &sym) {
             IBase* (*generator)(const char* name);
diff --git a/vintfdata/README.md b/vintfdata/README.md
index cfc1da7..6116757 100644
--- a/vintfdata/README.md
+++ b/vintfdata/README.md
@@ -70,7 +70,7 @@
 Execute the following, replacing the argument with the level to freeze:
 
 ```shell script
-lunch cf_x86_phone-userdebug # or any generic target
+lunch aosp_arm64
 LEVEL=5
 ./freeze.sh ${LEVEL}
 ```
diff --git a/vintfdata/device_compatibility_matrix.default.xml b/vintfdata/device_compatibility_matrix.default.xml
index eaa513e..70d23e2 100644
--- a/vintfdata/device_compatibility_matrix.default.xml
+++ b/vintfdata/device_compatibility_matrix.default.xml
@@ -1,5 +1,5 @@
 <compatibility-matrix version="1.0" type="device">
-    <hal format="hidl" optional="false">
+    <hal format="hidl" optional="true">
         <name>android.hidl.manager</name>
         <version>1.0</version>
         <interface>
diff --git a/vintfdata/manifest.xml b/vintfdata/manifest.xml
index 9d7bfcb..b3d84aa 100644
--- a/vintfdata/manifest.xml
+++ b/vintfdata/manifest.xml
@@ -1,14 +1,5 @@
 <manifest version="1.0" type="framework">
-    <hal>
-        <name>android.hidl.manager</name>
-        <transport>hwbinder</transport>
-        <version>1.2</version>
-        <interface>
-            <name>IServiceManager</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal>
+    <hal format="hidl">
         <name>android.hidl.memory</name>
         <transport arch="32+64">passthrough</transport>
         <version>1.0</version>
@@ -17,16 +8,7 @@
             <instance>ashmem</instance>
         </interface>
     </hal>
-    <hal>
-        <name>android.hidl.token</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>ITokenManager</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal max-level="6">
+    <hal format="hidl" max-level="6">
         <name>android.frameworks.displayservice</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -40,7 +22,7 @@
         `ioprio <class> <priority>`. For more information, see
         system/core/init/README.md
     -->
-    <hal max-level="5">
+    <hal format="hidl" max-level="5">
         <name>android.frameworks.schedulerservice</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -49,7 +31,12 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal>
+    <hal format="aidl">
+        <name>android.frameworks.sensorservice</name>
+        <version>1</version>
+        <fqname>ISensorManager/default</fqname>
+    </hal>
+    <hal format="hidl">
         <name>android.frameworks.sensorservice</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -58,7 +45,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal>
+    <hal format="hidl" max-level="7">
         <name>android.system.net.netd</name>
         <transport>hwbinder</transport>
         <version>1.1</version>
@@ -67,7 +54,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal>
+    <hal format="hidl">
         <name>android.system.wifi.keystore</name>
         <transport>hwbinder</transport>
         <version>1.0</version>