Merge tag 'android-11.0.0_r48' into int/11/fp3

Android 11.0.0 Release 48 (RD2A.211001.002)

* tag 'android-11.0.0_r48':
  audio HAL - fix UAFs

Change-Id: I3aa4e9756e9bd23103f5cd366a9bd018438f28e7
diff --git a/audio/common/all-versions/default/service/Android.bp b/audio/common/all-versions/default/service/Android.bp
index 3e8b715..e5d4770 100644
--- a/audio/common/all-versions/default/service/Android.bp
+++ b/audio/common/all-versions/default/service/Android.bp
@@ -20,11 +20,19 @@
     shared_libs: [
         "libcutils",
         "libbinder",
+	"libhwbinder",
         "libhidlbase",
         "liblog",
         "libutils",
         "libhardware",
     ],
+    arch : {
+        arm : {
+	    cflags: [
+                "-DARCH_ARM_32",
+	    ]
+	}
+    },
 }
 
 // Legacy service name, use android.hardware.audio.service instead
diff --git a/audio/common/all-versions/default/service/service.cpp b/audio/common/all-versions/default/service/service.cpp
index 147d062..2801769 100644
--- a/audio/common/all-versions/default/service/service.cpp
+++ b/audio/common/all-versions/default/service/service.cpp
@@ -30,6 +30,18 @@
 
 using InterfacesList = std::vector<std::string>;
 
+#ifdef ARCH_ARM_32
+//default h/w binder memsize is 1 MB
+#define DEFAULT_HW_BINDER_MEM_SIZE_KB 1024
+
+size_t getHWBinderMmapSize(){
+    int32_t value = DEFAULT_HW_BINDER_MEM_SIZE_KB;
+    value = property_get_int32("persist.vendor.audio.hw.binder.size_kbyte", value);
+    ALOGD("Init hw binder with mem  size = %d  ", value);
+    return 1024 * value;
+}
+#endif
+
 /** Try to register the provided factories in the provided order.
  *  If any registers successfully, do not register any other and return true.
  *  If all fail, return false.
@@ -45,6 +57,9 @@
 }
 
 int main(int /* argc */, char* /* argv */ []) {
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize(getHWBinderMmapSize());
+#endif
     ::android::ProcessState::initWithDriver("/dev/vndbinder");
     // start a threadpool for vndbinder interactions
     ::android::ProcessState::self()->startThreadPool();
diff --git a/boot/1.0/default/Android.bp b/boot/1.0/default/Android.bp
index fdf7a1e..e6d46be 100644
--- a/boot/1.0/default/Android.bp
+++ b/boot/1.0/default/Android.bp
@@ -30,6 +30,13 @@
         "libhidlbase",
         "libutils",
         "android.hardware.boot@1.0",
+        "libhwbinder",
     ],
-
+    arch: {
+        arm: {
+            cflags: [
+                "-DARCH_ARM_32"
+            ],
+        },
+    },
 }
diff --git a/boot/1.0/default/service.cpp b/boot/1.0/default/service.cpp
index f3996ef..2b50740 100644
--- a/boot/1.0/default/service.cpp
+++ b/boot/1.0/default/service.cpp
@@ -17,10 +17,14 @@
 
 #include <android/hardware/boot/1.0/IBootControl.h>
 #include <hidl/LegacySupport.h>
+#include <hwbinder/ProcessState.h>
 
 using ::android::hardware::boot::V1_0::IBootControl;
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main (int /* argc */, char * /* argv */ []) {
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize((size_t)8192);
+#endif
     return defaultPassthroughServiceImplementation<IBootControl>();
 }
diff --git a/camera/common/1.0/default/CameraModule.cpp b/camera/common/1.0/default/CameraModule.cpp
index 16fb85c..188b4be 100644
--- a/camera/common/1.0/default/CameraModule.cpp
+++ b/camera/common/1.0/default/CameraModule.cpp
@@ -267,6 +267,22 @@
     return res;
 }
 
+int CameraModule::getCameraDeviceVersion(int cameraId, uint32_t* version) {
+    ATRACE_CALL();
+    int ret;
+    if (getModuleApiVersion() >= CAMERA_MODULE_API_VERSION_2_5 &&
+            mModule->get_camera_device_version != NULL) {
+        ret = mModule->get_camera_device_version(cameraId, version);
+    } else {
+        struct camera_info info;
+        ret = getCameraInfo(cameraId, &info);
+        if (ret == OK) {
+            *version = info.device_version;
+        }
+    }
+    return ret;
+}
+
 int CameraModule::getCameraInfo(int cameraId, struct camera_info *info) {
     ATRACE_CALL();
     Mutex::Autolock lock(mCameraInfoLock);
@@ -367,11 +383,9 @@
 int CameraModule::getDeviceVersion(int cameraId) {
     ssize_t index = mDeviceVersionMap.indexOfKey(cameraId);
     if (index == NAME_NOT_FOUND) {
-        int deviceVersion;
+        uint32_t deviceVersion;
         if (getModuleApiVersion() >= CAMERA_MODULE_API_VERSION_2_0) {
-            struct camera_info info;
-            getCameraInfo(cameraId, &info);
-            deviceVersion = info.device_version;
+            getCameraDeviceVersion(cameraId, &deviceVersion);
         } else {
             deviceVersion = CAMERA_DEVICE_API_VERSION_1_0;
         }
diff --git a/camera/common/1.0/default/include/CameraModule.h b/camera/common/1.0/default/include/CameraModule.h
index c89e934..8195835 100644
--- a/camera/common/1.0/default/include/CameraModule.h
+++ b/camera/common/1.0/default/include/CameraModule.h
@@ -49,6 +49,7 @@
     // Returns OK on success, NO_INIT on failure
     int init();
 
+    int getCameraDeviceVersion(int cameraId, uint32_t* version);
     int getCameraInfo(int cameraId, struct camera_info *info);
     int getDeviceVersion(int cameraId);
     int getNumberOfCameras(void);
diff --git a/camera/device/1.0/default/Android.bp b/camera/device/1.0/default/Android.bp
index da70577..f407476 100644
--- a/camera/device/1.0/default/Android.bp
+++ b/camera/device/1.0/default/Android.bp
@@ -10,6 +10,7 @@
         "libhidlmemory",
         "libutils",
         "android.hardware.camera.device@1.0",
+        "vendor.qti.hardware.camera.device@1.0",
         "android.hardware.camera.common@1.0",
         "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.mapper@2.0",
@@ -31,4 +32,8 @@
         "media_plugin_headers",
     ],
     export_include_dirs: ["."],
+    // Since this platform module has been forked to depend on a vendor
+    // proprietary library, we exclude it from the vendor snapshot so that it
+    // will be built from source as part of the vendor build.
+    exclude_from_vendor_snapshot: true,
 }
diff --git a/camera/device/1.0/default/CameraDevice.cpp b/camera/device/1.0/default/CameraDevice.cpp
index 2dd6094..9b6e4b9 100644
--- a/camera/device/1.0/default/CameraDevice.cpp
+++ b/camera/device/1.0/default/CameraDevice.cpp
@@ -430,30 +430,68 @@
              index, mem->mNumBufs);
         return;
     }
-    if (object->mDeviceCallback != nullptr) {
-        CameraFrameMetadata hidlMetadata;
-        if (metadata) {
-            hidlMetadata.faces.resize(metadata->number_of_faces);
-            for (size_t i = 0; i < hidlMetadata.faces.size(); i++) {
-                hidlMetadata.faces[i].score = metadata->faces[i].score;
-                hidlMetadata.faces[i].id = metadata->faces[i].id;
-                for (int k = 0; k < 4; k++) {
-                    hidlMetadata.faces[i].rect[k] = metadata->faces[i].rect[k];
-                }
-                for (int k = 0; k < 2; k++) {
-                    hidlMetadata.faces[i].leftEye[k] = metadata->faces[i].left_eye[k];
-                }
-                for (int k = 0; k < 2; k++) {
-                    hidlMetadata.faces[i].rightEye[k] = metadata->faces[i].right_eye[k];
-                }
-                for (int k = 0; k < 2; k++) {
-                    hidlMetadata.faces[i].mouth[k] = metadata->faces[i].mouth[k];
-                }
-            }
-        }
-        CameraHeapMemory* mem = static_cast<CameraHeapMemory *>(data->handle);
-        object->mDeviceCallback->dataCallback(
-                (DataCallbackMsg) msg_type, mem->handle.mId, index, hidlMetadata);
+    if(object->mQDeviceCallback != nullptr) {
+         vendor::qti::hardware::camera::device::V1_0::QCameraFrameMetadata hidlMetadata;
+         if (metadata) {
+             hidlMetadata.faces.resize(metadata->number_of_faces);
+             for (size_t i = 0; i < hidlMetadata.faces.size(); i++) {
+                 hidlMetadata.faces[i].score = metadata->faces[i].score;
+                 hidlMetadata.faces[i].id = metadata->faces[i].id;
+                 for (int k = 0; k < 4; k++) {
+                     hidlMetadata.faces[i].rect[k] = metadata->faces[i].rect[k];
+                 }
+                 for (int k = 0; k < 2; k++) {
+                     hidlMetadata.faces[i].leftEye[k] = metadata->faces[i].left_eye[k];
+                 }
+                 for (int k = 0; k < 2; k++) {
+                     hidlMetadata.faces[i].rightEye[k] = metadata->faces[i].right_eye[k];
+                 }
+                 for (int k = 0; k < 2; k++) {
+                     hidlMetadata.faces[i].mouth[k] = metadata->faces[i].mouth[k];
+                 }
+                 hidlMetadata.faces[i].smile_degree = metadata->faces[i].smile_degree;
+                 hidlMetadata.faces[i].smile_score = metadata->faces[i].smile_score;
+                 hidlMetadata.faces[i].blink_detected = metadata->faces[i].blink_detected;
+                 hidlMetadata.faces[i].face_recognised = metadata->faces[i].face_recognised;
+                 hidlMetadata.faces[i].gaze_angle = metadata->faces[i].gaze_angle;
+                 hidlMetadata.faces[i].updown_dir = metadata->faces[i].updown_dir;
+                 hidlMetadata.faces[i].leftright_dir = metadata->faces[i].leftright_dir;
+                 hidlMetadata.faces[i].roll_dir = metadata->faces[i].roll_dir;
+                 hidlMetadata.faces[i].left_right_gaze = metadata->faces[i].left_right_gaze;
+                 hidlMetadata.faces[i].top_bottom_gaze = metadata->faces[i].top_bottom_gaze;
+                 hidlMetadata.faces[i].leye_blink = metadata->faces[i].leye_blink;
+                 hidlMetadata.faces[i].reye_blink = metadata->faces[i].reye_blink;
+             }
+         }
+         CameraHeapMemory* mem = static_cast<CameraHeapMemory *>(data->handle);
+         object->mQDeviceCallback->QDataCallback(
+                 (DataCallbackMsg) msg_type, mem->handle.mId, index, hidlMetadata);
+    } else {
+       if (object->mDeviceCallback != nullptr) {
+           CameraFrameMetadata hidlMetadata;
+           if (metadata) {
+               hidlMetadata.faces.resize(metadata->number_of_faces);
+               for (size_t i = 0; i < hidlMetadata.faces.size(); i++) {
+                   hidlMetadata.faces[i].score = metadata->faces[i].score;
+                   hidlMetadata.faces[i].id = metadata->faces[i].id;
+                   for (int k = 0; k < 4; k++) {
+                       hidlMetadata.faces[i].rect[k] = metadata->faces[i].rect[k];
+                   }
+                   for (int k = 0; k < 2; k++) {
+                       hidlMetadata.faces[i].leftEye[k] = metadata->faces[i].left_eye[k];
+                   }
+                   for (int k = 0; k < 2; k++) {
+                       hidlMetadata.faces[i].rightEye[k] = metadata->faces[i].right_eye[k];
+                   }
+                   for (int k = 0; k < 2; k++) {
+                       hidlMetadata.faces[i].mouth[k] = metadata->faces[i].mouth[k];
+                   }
+               }
+           }
+           CameraHeapMemory* mem = static_cast<CameraHeapMemory *>(data->handle);
+           object->mDeviceCallback->dataCallback(
+                   (DataCallbackMsg) msg_type, mem->handle.mId, index, hidlMetadata);
+       }
     }
 }
 
@@ -669,6 +707,11 @@
 
     initHalPreviewWindow();
     mDeviceCallback = callback;
+    mQDeviceCallback =
+        vendor::qti::hardware::camera::device::V1_0::IQCameraDeviceCallback::castFrom(callback);
+    if(mQDeviceCallback == nullptr) {
+        ALOGI("could not cast ICameraDeviceCallback to IQCameraDeviceCallback");
+    }
 
     if (mDevice->ops->set_callbacks) {
         mDevice->ops->set_callbacks(mDevice,
diff --git a/camera/device/1.0/default/CameraDevice_1_0.h b/camera/device/1.0/default/CameraDevice_1_0.h
index 2c980f0..e5a194e 100644
--- a/camera/device/1.0/default/CameraDevice_1_0.h
+++ b/camera/device/1.0/default/CameraDevice_1_0.h
@@ -24,6 +24,7 @@
 #include "HandleImporter.h"
 
 #include <android/hardware/camera/device/1.0/ICameraDevice.h>
+#include <vendor/qti/hardware/camera/device/1.0/IQCameraDeviceCallback.h>
 #include <android/hidl/allocator/1.0/IAllocator.h>
 #include <android/hidl/memory/1.0/IMemory.h>
 #include <hidl/MQDescriptor.h>
@@ -44,6 +45,7 @@
 using ::android::hardware::camera::device::V1_0::CameraInfo;
 using ::android::hardware::camera::device::V1_0::CommandType;
 using ::android::hardware::camera::device::V1_0::ICameraDevice;
+using ::vendor::qti::hardware::camera::device::V1_0::IQCameraDeviceCallback;
 using ::android::hardware::camera::device::V1_0::ICameraDeviceCallback;
 using ::android::hardware::camera::device::V1_0::ICameraDevicePreviewCallback;
 using ::android::hardware::camera::device::V1_0::MemoryId;
@@ -164,6 +166,7 @@
     const SortedVector<std::pair<std::string, std::string>>& mCameraDeviceNames;
 
     sp<ICameraDeviceCallback> mDeviceCallback = nullptr;
+    sp<IQCameraDeviceCallback> mQDeviceCallback = nullptr;
 
     mutable Mutex mMemoryMapLock; // gating access to mMemoryMap
                                   // must not hold mLock after this lock is acquired
diff --git a/camera/device/3.2/default/CameraDeviceSession.cpp b/camera/device/3.2/default/CameraDeviceSession.cpp
index 99cdccb..8d3bf02 100644
--- a/camera/device/3.2/default/CameraDeviceSession.cpp
+++ b/camera/device/3.2/default/CameraDeviceSession.cpp
@@ -925,12 +925,12 @@
                     mStreamMap[id].data_space);
             mCirculatingBuffers.emplace(stream.mId, CirculatingBuffers{});
         } else {
-            // width/height/format must not change, but usage/rotation might need to change
+            // width/height must not change, but usage/rotation might need to change
+            // format might change and get updated with overrideFormat
             if (mStreamMap[id].stream_type !=
                     (int) requestedConfiguration.streams[i].streamType ||
                     mStreamMap[id].width != requestedConfiguration.streams[i].width ||
                     mStreamMap[id].height != requestedConfiguration.streams[i].height ||
-                    mStreamMap[id].format != (int) requestedConfiguration.streams[i].format ||
                     mStreamMap[id].data_space !=
                             mapToLegacyDataspace( static_cast<android_dataspace_t> (
                                     requestedConfiguration.streams[i].dataSpace))) {
diff --git a/camera/device/3.2/default/convert.cpp b/camera/device/3.2/default/convert.cpp
index 06ad7e9..628b7af 100644
--- a/camera/device/3.2/default/convert.cpp
+++ b/camera/device/3.2/default/convert.cpp
@@ -66,6 +66,8 @@
     dst->data_space = (android_dataspace_t) src.dataSpace;
     dst->rotation = (int) src.rotation;
     dst->usage = (uint32_t) src.usage;
+    dst->reserved[0] = NULL;
+    dst->reserved[1] = NULL;
     // Fields to be filled by HAL (max_buffers, priv) are initialized to 0
     dst->max_buffers = 0;
     dst->priv = 0;
@@ -88,6 +90,23 @@
         ALOGW("%s: Stream type %d is not currently supported!",
                 __FUNCTION__, src->stream_type);
     }
+
+    HalStream* halStream = NULL;
+    if (src->reserved[0] != NULL) {
+        halStream = (HalStream*)(src->reserved[0]);
+    } else if (src->reserved[1] != NULL) {
+        halStream = (HalStream*)(src->reserved[1]);
+    }
+
+    // Check if overrideFormat is set and honor it
+    if (halStream != NULL) {
+        dst->overrideFormat = (PixelFormat) halStream->overrideFormat;
+        if (src->stream_type == CAMERA3_STREAM_OUTPUT) {
+            dst->producerUsage = (BufferUsageFlags)halStream->producerUsage;
+        } else if (src->stream_type == CAMERA3_STREAM_INPUT) {
+            dst->consumerUsage = (BufferUsageFlags)halStream->consumerUsage;
+        }
+    }
 }
 
 void convertToHidl(const camera3_stream_configuration_t& src, HalStreamConfiguration* dst) {
diff --git a/camera/device/3.3/default/convert.cpp b/camera/device/3.3/default/convert.cpp
index dae190b..ac17d83 100644
--- a/camera/device/3.3/default/convert.cpp
+++ b/camera/device/3.3/default/convert.cpp
@@ -47,6 +47,22 @@
         ALOGW("%s: Stream type %d is not currently supported!",
                 __FUNCTION__, src->stream_type);
     }
+
+    HalStream* halStream = NULL;
+    if (src->reserved[0] != NULL) {
+        halStream = (HalStream*)(src->reserved[0]);
+    } else if (src->reserved[1] != NULL) {
+        halStream = (HalStream*)(src->reserved[1]);
+    }
+
+    if (halStream != NULL) {
+        dst->v3_2.overrideFormat  = (PixelFormat) halStream->v3_2.overrideFormat;
+        if (src->stream_type == CAMERA3_STREAM_OUTPUT) {
+            dst->v3_2.producerUsage = (BufferUsageFlags)halStream->v3_2.producerUsage;
+        } else if (src->stream_type == CAMERA3_STREAM_INPUT) {
+            dst->v3_2.consumerUsage = (BufferUsageFlags)halStream->v3_2.consumerUsage;
+        }
+    }
 }
 
 void convertToHidl(const camera3_stream_configuration_t& src, HalStreamConfiguration* dst) {
diff --git a/camera/provider/2.4/default/Android.bp b/camera/provider/2.4/default/Android.bp
index 627ddf4..24ab95e 100644
--- a/camera/provider/2.4/default/Android.bp
+++ b/camera/provider/2.4/default/Android.bp
@@ -6,6 +6,7 @@
     shared_libs: [
         "android.hardware.camera.common@1.0",
         "android.hardware.camera.device@1.0",
+        "vendor.qti.hardware.camera.device@1.0",
         "android.hardware.camera.device@3.2",
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
@@ -36,6 +37,10 @@
         "camera.device@3.5-impl_headers",
     ],
     export_include_dirs: ["."],
+    // Since this framework module has been forked to depend on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
 
 cc_library_shared {
@@ -79,6 +84,10 @@
         "camera.device@3.6-external-impl_headers"
     ],
     export_include_dirs: ["."],
+    // Since this framework module has a transitive dependency  on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
 
 cc_library_shared {
@@ -127,6 +136,10 @@
         "android.hardware.camera.common@1.0-helper",
     ],
     export_include_dirs: ["."],
+    // Since this framework module has a transitive dependency  on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
 
 cc_defaults {
@@ -138,6 +151,7 @@
     shared_libs: [
         "android.hardware.camera.common@1.0",
         "android.hardware.camera.device@1.0",
+        "vendor.qti.hardware.camera.device@1.0",
         "android.hardware.camera.device@3.2",
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
@@ -164,6 +178,10 @@
         "camera.device@3.5-external-impl_headers",
         "camera.device@3.5-impl_headers",
     ],
+    // Since this framework module has been forked to depend on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
 
 cc_binary {
@@ -226,4 +244,8 @@
         "camera.device@3.5-external-impl_headers",
         "camera.device@3.5-impl_headers",
     ],
+    // Since this framework module has a transitive dependency  on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
diff --git a/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.cpp b/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.cpp
index 4cff1b7..18149e5 100644
--- a/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.cpp
+++ b/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.cpp
@@ -87,23 +87,32 @@
     if (deviceVersion >= CAMERA_DEVICE_API_VERSION_3_2 &&
             mModule->isOpenLegacyDefined()) {
         // try open_legacy to see if it actually works
-        struct hw_device_t* halDev = nullptr;
-        int ret = mModule->openLegacy(cameraId, CAMERA_DEVICE_API_VERSION_1_0, &halDev);
-        if (ret == 0) {
-            mOpenLegacySupported[cameraIdStr] = true;
-            halDev->close(halDev);
-            deviceNamePair = std::make_pair(cameraIdStr,
+        if ((property_get_bool("ro.config.low_ram", /*default*/ false))) {
+           deviceNamePair = std::make_pair(cameraIdStr,
                             getHidlDeviceName(cameraIdStr, CAMERA_DEVICE_API_VERSION_1_0));
-            mCameraDeviceNames.add(deviceNamePair);
-            if (cam_new) {
-                mCallbacks->cameraDeviceStatusChange(deviceNamePair.second, status);
-            }
-        } else if (ret == -EBUSY || ret == -EUSERS) {
+           mCameraDeviceNames.add(deviceNamePair);
+           if (cam_new) {
+              mCallbacks->cameraDeviceStatusChange(deviceNamePair.second, status);
+           }
+          } else {
+            struct hw_device_t* halDev = nullptr;
+            int ret = mModule->openLegacy(cameraId, CAMERA_DEVICE_API_VERSION_1_0, &halDev);
+            if (ret == 0) {
+               mOpenLegacySupported[cameraIdStr] = true;
+               halDev->close(halDev);
+               deviceNamePair = std::make_pair(cameraIdStr,
+                                getHidlDeviceName(cameraIdStr, CAMERA_DEVICE_API_VERSION_1_0));
+               mCameraDeviceNames.add(deviceNamePair);
+               if (cam_new) {
+                 mCallbacks->cameraDeviceStatusChange(deviceNamePair.second, status);
+              }
+            } else if (ret == -EBUSY || ret == -EUSERS) {
             // Looks like this provider instance is not initialized during
             // system startup and there are other camera users already.
             // Not a good sign but not fatal.
-            ALOGW("%s: open_legacy try failed!", __FUNCTION__);
-        }
+              ALOGW("%s: open_legacy try failed!", __FUNCTION__);
+            }
+         }
     }
 }
 
@@ -314,15 +323,15 @@
 
     mNumberOfLegacyCameras = mModule->getNumberOfCameras();
     for (int i = 0; i < mNumberOfLegacyCameras; i++) {
-        struct camera_info info;
-        auto rc = mModule->getCameraInfo(i, &info);
+        uint32_t device_version;
+        auto rc = mModule->getCameraDeviceVersion(i, &device_version);
         if (rc != NO_ERROR) {
-            ALOGE("%s: Camera info query failed!", __func__);
+            ALOGE("%s: Camera device version query failed!", __func__);
             mModule.clear();
             return true;
         }
 
-        if (checkCameraVersion(i, info) != OK) {
+        if (checkCameraVersion(i, device_version) != OK) {
             ALOGE("%s: Camera version check failed!", __func__);
             mModule.clear();
             return true;
@@ -342,7 +351,7 @@
 /**
  * Check that the device HAL version is still in supported.
  */
-int LegacyCameraProviderImpl_2_4::checkCameraVersion(int id, camera_info info) {
+int LegacyCameraProviderImpl_2_4::checkCameraVersion(int id, uint32_t device_version) {
     if (mModule == nullptr) {
         return NO_INIT;
     }
@@ -352,7 +361,7 @@
     uint16_t moduleVersion = mModule->getModuleApiVersion();
     if (moduleVersion >= CAMERA_MODULE_API_VERSION_2_0) {
         // Verify the device version is in the supported range
-        switch (info.device_version) {
+        switch (device_version) {
             case CAMERA_DEVICE_API_VERSION_1_0:
             case CAMERA_DEVICE_API_VERSION_3_2:
             case CAMERA_DEVICE_API_VERSION_3_3:
@@ -370,7 +379,7 @@
                 if (moduleVersion < CAMERA_MODULE_API_VERSION_2_5) {
                     ALOGE("%s: Device %d has unsupported version combination:"
                             "HAL version %x and module version %x",
-                            __FUNCTION__, id, info.device_version, moduleVersion);
+                            __FUNCTION__, id, device_version, moduleVersion);
                     return NO_INIT;
                 }
                 break;
@@ -380,8 +389,8 @@
             case CAMERA_DEVICE_API_VERSION_3_1:
                 // no longer supported
             default:
-                ALOGE("%s: Device %d has HAL version %x, which is not supported",
-                        __FUNCTION__, id, info.device_version);
+                ALOGE("%s: Device %d has HAL version %x, which is not supported", __FUNCTION__, id,
+                      device_version);
                 return NO_INIT;
         }
     }
diff --git a/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.h b/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.h
index b4914b3..9ec5c5e 100644
--- a/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.h
+++ b/camera/provider/2.4/default/LegacyCameraProviderImpl_2_4.h
@@ -97,7 +97,7 @@
 
     hidl_vec<VendorTagSection> mVendorTagSections;
     bool setUpVendorTags();
-    int checkCameraVersion(int id, camera_info info);
+    int checkCameraVersion(int id, uint32_t device_version);
 
     // create HIDL device name from camera ID and legacy device version
     std::string getHidlDeviceName(std::string cameraId, int deviceVersion);
diff --git a/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service.rc b/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service.rc
index f7ac9f8..ff924ed 100644
--- a/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service.rc
+++ b/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service.rc
@@ -5,4 +5,4 @@
     group audio camera input drmrpc
     ioprio rt 4
     capabilities SYS_NICE
-    task_profiles CameraServiceCapacity MaxPerformance
+    task_profiles CameraServiceCapacity HighPerformance
diff --git a/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service_64.rc b/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service_64.rc
index a32dd46..642e84e 100644
--- a/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service_64.rc
+++ b/camera/provider/2.4/default/android.hardware.camera.provider@2.4-service_64.rc
@@ -5,4 +5,4 @@
     group audio camera input drmrpc
     ioprio rt 4
     capabilities SYS_NICE
-    task_profiles CameraServiceCapacity MaxPerformance
+    task_profiles CameraServiceCapacity HighPerformance
diff --git a/camera/provider/2.5/default/Android.bp b/camera/provider/2.5/default/Android.bp
index 9ddf651..66a2d5b 100644
--- a/camera/provider/2.5/default/Android.bp
+++ b/camera/provider/2.5/default/Android.bp
@@ -35,6 +35,10 @@
         "camera.device@3.5-impl_headers",
     ],
     export_include_dirs: ["."],
+    // Since this framework module has a transitive dependency  on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
 
 cc_library_shared {
@@ -78,6 +82,10 @@
         "camera.device@3.6-external-impl_headers"
     ],
     export_include_dirs: ["."],
+    // Since this framework module has a transitive dependency  on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
 
 cc_defaults {
@@ -114,6 +122,10 @@
         "camera.device@3.4-impl_headers",
         "camera.device@3.5-impl_headers"
     ],
+    // Since this framework module has a transitive dependency  on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
 
 cc_binary {
@@ -187,4 +199,8 @@
         "camera.device@3.5-impl_headers",
         "camera.device@3.6-external-impl_headers",
     ],
+    // Since this framework module has a transitive dependency  on a vendor
+    // proprietary library, we exclude this module from the vendor snapshot so
+    // that it will be built from source as part of the vendor image build.
+    exclude_from_vendor_snapshot: true,
 }
diff --git a/cas/1.0/default/Android.bp b/cas/1.0/default/Android.bp
index f9977ff..3891a0e 100644
--- a/cas/1.0/default/Android.bp
+++ b/cas/1.0/default/Android.bp
@@ -24,10 +24,16 @@
       "liblog",
       "libstagefright_foundation",
       "libutils",
+      "libhwbinder"
     ],
     header_libs: [
       "media_plugin_headers",
     ],
+    arch: {
+        arm: {
+            cflags: ["-DARCH_ARM_32"],
+        },
+    },
 }
 
 cc_binary {
diff --git a/cas/1.0/default/service.cpp b/cas/1.0/default/service.cpp
index 754c0c5..dfb385d 100644
--- a/cas/1.0/default/service.cpp
+++ b/cas/1.0/default/service.cpp
@@ -27,6 +27,10 @@
 
 #include "MediaCasService.h"
 
+#ifdef ARCH_ARM_32
+#include <hwbinder/ProcessState.h>
+#endif
+
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
 using android::hardware::LazyServiceRegistrar;
@@ -40,6 +44,9 @@
 #endif
 
 int main() {
+    #ifdef ARCH_ARM_32
+        android::hardware::ProcessState::initWithMmapSize((size_t)32768);
+    #endif
     configureRpcThreadpool(8, true /* callerWillJoin */);
 
     // Setup hwbinder service
diff --git a/compatibility_matrices/compatibility_matrix.4.xml b/compatibility_matrices/compatibility_matrix.4.xml
index e5e012c..9f486dd 100644
--- a/compatibility_matrices/compatibility_matrix.4.xml
+++ b/compatibility_matrices/compatibility_matrix.4.xml
@@ -499,6 +499,7 @@
         <interface>
             <name>IHostapd</name>
             <instance>default</instance>
+            <instance>wigighostapd</instance>
         </interface>
     </hal>
     <hal format="hidl" optional="true">
diff --git a/compatibility_matrices/compatibility_matrix.5.xml b/compatibility_matrices/compatibility_matrix.5.xml
index e772b6f..53b9be8 100644
--- a/compatibility_matrices/compatibility_matrix.5.xml
+++ b/compatibility_matrices/compatibility_matrix.5.xml
@@ -541,6 +541,7 @@
         <interface>
             <name>IHostapd</name>
             <instance>default</instance>
+            <instance>wigighostapd</instance>
         </interface>
     </hal>
     <hal format="hidl" optional="true">
diff --git a/current.txt b/current.txt
index 6696516..6f509c3 100644
--- a/current.txt
+++ b/current.txt
@@ -765,3 +765,13 @@
 2ce1f7fb52e49f80b13a9b153d491bce530552f02357ea729acae922a8659f93 android.hardware.wifi.supplicant@1.3::ISupplicantStaIfaceCallback
 77531c8d048f8f8ae532babd0ca86332a865ec9aace1b051226ef2b21123e645 android.hardware.wifi.supplicant@1.3::ISupplicantStaNetwork
 98592d193a717066facf91428426e5abe211e3bd718bc372e29fb944ddbe6e7c android.hardware.wifi.supplicant@1.3::types
+
+# ABI preserving changes to HALs
+1ca372cd67d197df099e87616a613ba6ede6552638a603e18f86c8834302c3d1 android.hardware.gnss@1.0::IGnssMeasurementCallback
+6a271e493907e8ba20912e42771bd0d99ae45431a851d5675ef9496d02510a34 android.hardware.gnss@1.1::IGnssMeasurementCallback
+cd84ab19c590e0e73dd2307b591a3093ee18147ef95e6d5418644463a6620076 android.hardware.neuralnetworks@1.2::IDevice
+9625e85f56515ad2cf87b6a1847906db669f746ea4ab02cd3d4ca25abc9b0109 android.hardware.neuralnetworks@1.2::types
+9e758e208d14f7256e0885d6d8ad0b61121b21d8c313864f981727ae55bffd16 android.hardware.neuralnetworks@1.3::types
+0f53d70e1eadf8d987766db4bf6ae2048004682168f4cab118da576787def3fa android.hardware.radio@1.0::types
+38d65fb20c60a5b823298560fc0825457ecdc49603a4b4e94bf81511790737da android.hardware.radio@1.4::types
+954c334efd80e8869b66d1ce5fe2755712d96ba4b3c38d415739c330af5fb4cb android.hardware.radio@1.5::types
diff --git a/drm/1.0/default/Android.bp b/drm/1.0/default/Android.bp
index 1122e46..48e084e 100644
--- a/drm/1.0/default/Android.bp
+++ b/drm/1.0/default/Android.bp
@@ -1,3 +1,17 @@
+// Copyright (C) 2016-2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 cc_library_static {
     name: "android.hardware.drm@1.0-helper",
     vendor_available: true,
@@ -22,3 +36,111 @@
     ],
     export_include_dirs: ["include"],
 }
+
+soong_config_module_type {
+    name: "android_hardware_drm_1_0_multilib",
+    module_type: "cc_defaults",
+    config_namespace: "ANDROID",
+    bool_variables: ["TARGET_ENABLE_MEDIADRM_64"],
+    properties: ["compile_multilib"],
+}
+
+android_hardware_drm_1_0_multilib {
+    name: "android.hardware.drm@1.0-multilib-lib",
+    compile_multilib: "32",
+    soong_config_variables: {
+        TARGET_ENABLE_MEDIADRM_64: {
+            compile_multilib: "both",
+        }
+    }
+}
+
+android_hardware_drm_1_0_multilib {
+    name: "android.hardware.drm@1.0-multilib-exe",
+    compile_multilib: "32",
+    soong_config_variables: {
+        TARGET_ENABLE_MEDIADRM_64: {
+            compile_multilib: "first",
+        }
+    }
+}
+
+cc_defaults {
+    name: "android.hardware.drm@1.0-service-defaults",
+    proprietary: true,
+    relative_install_path: "hw",
+    include_dirs: ["hardware/interfaces/drm"],
+    header_libs: ["media_plugin_headers"],
+    static_libs: ["android.hardware.drm@1.0-helper"],
+
+    shared_libs: [
+        "android.hardware.drm@1.0",
+        "android.hidl.memory@1.0",
+        "libhidlbase",
+        "libhardware",
+        "liblog",
+        "libutils",
+        "libbinder",
+    ],
+}
+
+//############ Build legacy drm service ############
+
+cc_binary {
+    name: "android.hardware.drm@1.0-service",
+    defaults: [
+        "android.hardware.drm@1.0-multilib-exe",
+        "android.hardware.drm@1.0-service-defaults"
+    ],
+    init_rc: ["android.hardware.drm@1.0-service.rc"],
+    srcs: ["service.cpp"],
+}
+
+//############ Build legacy drm lazy service ############
+
+cc_binary {
+    name: "android.hardware.drm@1.0-service-lazy",
+    defaults: [
+        "android.hardware.drm@1.0-multilib-exe",
+        "android.hardware.drm@1.0-service-defaults"
+    ],
+    overrides: ["android.hardware.drm@1.0-service"],
+    init_rc: ["android.hardware.drm@1.0-service-lazy.rc"],
+    srcs: ["serviceLazy.cpp"],
+}
+
+//############ Build legacy drm impl library ############
+
+cc_library_shared {
+    name: "android.hardware.drm@1.0-impl",
+    defaults: ["android.hardware.drm@1.0-multilib-lib"],
+    proprietary: true,
+    relative_install_path: "hw",
+
+    include_dirs: [
+        "frameworks/native/include",
+        "frameworks/av/include",
+    ],
+
+    shared_libs: [
+        "android.hardware.drm@1.0",
+        "android.hidl.memory@1.0",
+        "libcutils",
+        "libhidlbase",
+        "libhidlmemory",
+        "liblog",
+        "libstagefright_foundation",
+        "libutils",
+    ],
+
+    static_libs: ["android.hardware.drm@1.0-helper"],
+
+    srcs: [
+        "DrmFactory.cpp",
+        "DrmPlugin.cpp",
+        "CryptoFactory.cpp",
+        "CryptoPlugin.cpp",
+        "LegacyPluginPath.cpp",
+        "TypeConvert.cpp",
+    ],
+}
diff --git a/drm/1.0/default/Android.mk b/drm/1.0/default/Android.mk
deleted file mode 100644
index 9016dc3..0000000
--- a/drm/1.0/default/Android.mk
+++ /dev/null
@@ -1,81 +0,0 @@
-#
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-############# Build legacy drm service ############
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-
-include $(LOCAL_PATH)/common_default_service.mk
-LOCAL_MODULE := android.hardware.drm@1.0-service
-LOCAL_INIT_RC := android.hardware.drm@1.0-service.rc
-LOCAL_SRC_FILES := service.cpp
-
-include $(BUILD_EXECUTABLE)
-
-############# Build legacy drm lazy service ############
-
-include $(CLEAR_VARS)
-
-include $(LOCAL_PATH)/common_default_service.mk
-LOCAL_MODULE := android.hardware.drm@1.0-service-lazy
-LOCAL_OVERRIDES_MODULES := android.hardware.drm@1.0-service
-LOCAL_INIT_RC := android.hardware.drm@1.0-service-lazy.rc
-LOCAL_SRC_FILES := serviceLazy.cpp
-
-include $(BUILD_EXECUTABLE)
-
-############# Build legacy drm impl library ############
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := android.hardware.drm@1.0-impl
-LOCAL_PROPRIETARY_MODULE := true
-LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_SRC_FILES := \
-    DrmFactory.cpp \
-    DrmPlugin.cpp \
-    CryptoFactory.cpp \
-    CryptoPlugin.cpp \
-    LegacyPluginPath.cpp \
-    TypeConvert.cpp \
-
-LOCAL_SHARED_LIBRARIES := \
-    android.hardware.drm@1.0 \
-    android.hidl.memory@1.0 \
-    libcutils \
-    libhidlbase \
-    libhidlmemory \
-    liblog \
-    libstagefright_foundation \
-    libutils \
-
-LOCAL_STATIC_LIBRARIES := \
-    android.hardware.drm@1.0-helper \
-
-LOCAL_C_INCLUDES := \
-    frameworks/native/include \
-    frameworks/av/include
-
-# TODO: Some legacy DRM plugins only support 32-bit. They need to be migrated to
-# 64-bit. (b/18948909) Once all of a device's legacy DRM plugins support 64-bit,
-# that device can turn on TARGET_ENABLE_MEDIADRM_64 to build this impl as
-# 64-bit.
-ifneq ($(TARGET_ENABLE_MEDIADRM_64), true)
-LOCAL_32_BIT_ONLY := true
-endif
-
-include $(BUILD_SHARED_LIBRARY)
diff --git a/drm/1.0/default/common_default_service.mk b/drm/1.0/default/common_default_service.mk
deleted file mode 100644
index 1b5a975..0000000
--- a/drm/1.0/default/common_default_service.mk
+++ /dev/null
@@ -1,44 +0,0 @@
-#
-# Copyright (C) 2019 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-include $(CLEAR_VARS)
-LOCAL_PROPRIETARY_MODULE := true
-LOCAL_MODULE_RELATIVE_PATH := hw
-
-LOCAL_SHARED_LIBRARIES := \
-  android.hardware.drm@1.0 \
-  android.hidl.memory@1.0 \
-  libhidlbase \
-  libhardware \
-  liblog \
-  libutils \
-  libbinder \
-
-LOCAL_STATIC_LIBRARIES := \
-  android.hardware.drm@1.0-helper \
-
-LOCAL_C_INCLUDES := \
-  hardware/interfaces/drm
-
-LOCAL_HEADER_LIBRARIES := \
-  media_plugin_headers
-
-# TODO(b/18948909) Some legacy DRM plugins only support 32-bit. They need to be
-# migrated to 64-bit. Once all of a device's legacy DRM plugins support 64-bit,
-# that device can turn on TARGET_ENABLE_MEDIADRM_64 to build this service as
-# 64-bit.
-ifneq ($(TARGET_ENABLE_MEDIADRM_64), true)
-LOCAL_32_BIT_ONLY := true
-endif
diff --git a/graphics/allocator/2.0/default/Android.bp b/graphics/allocator/2.0/default/Android.bp
index 59229b0..3a2808e 100644
--- a/graphics/allocator/2.0/default/Android.bp
+++ b/graphics/allocator/2.0/default/Android.bp
@@ -33,4 +33,11 @@
         "liblog",
         "libutils",
     ],
+    arch: {
+        arm: {
+            cflags: [
+                "-DARCH_ARM_32"
+            ],
+        },
+    },
 }
diff --git a/graphics/allocator/2.0/default/service.cpp b/graphics/allocator/2.0/default/service.cpp
index bc0539a..ca1fee4 100644
--- a/graphics/allocator/2.0/default/service.cpp
+++ b/graphics/allocator/2.0/default/service.cpp
@@ -19,10 +19,15 @@
 #include <android/hardware/graphics/allocator/2.0/IAllocator.h>
 
 #include <hidl/LegacySupport.h>
+#include <hwbinder/ProcessState.h>
 
 using android::hardware::defaultPassthroughServiceImplementation;
 using android::hardware::graphics::allocator::V2_0::IAllocator;
 
 int main() {
+
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize((size_t)(32768));
+#endif
     return defaultPassthroughServiceImplementation<IAllocator>(4);
 }
diff --git a/graphics/composer/2.1/default/Android.bp b/graphics/composer/2.1/default/Android.bp
index a367457..422dc5f 100644
--- a/graphics/composer/2.1/default/Android.bp
+++ b/graphics/composer/2.1/default/Android.bp
@@ -12,6 +12,7 @@
         "android.hardware.graphics.composer@2.1",
         "android.hardware.graphics.composer@2.1-resources",
         "libbase",
+        "libhwbinder",
         "libbinder",
         "libcutils",
         "libfmq",
@@ -23,4 +24,11 @@
         "libsync",
         "libutils",
     ],
+    arch: {
+        arm: {
+            cflags: [
+                "-DARCH_ARM_32"
+            ],
+        },
+    },
 }
diff --git a/graphics/composer/2.1/default/android.hardware.graphics.composer@2.1-service.rc b/graphics/composer/2.1/default/android.hardware.graphics.composer@2.1-service.rc
index cbd589a..5b8a46f 100644
--- a/graphics/composer/2.1/default/android.hardware.graphics.composer@2.1-service.rc
+++ b/graphics/composer/2.1/default/android.hardware.graphics.composer@2.1-service.rc
@@ -1,8 +1,8 @@
 service vendor.hwcomposer-2-1 /vendor/bin/hw/android.hardware.graphics.composer@2.1-service
-    interface android.hardware.graphics.composer@2.1::IComposer default
     class hal animation
     user system
     group graphics drmrpc
     capabilities SYS_NICE
     onrestart restart surfaceflinger
     writepid /dev/cpuset/system-background/tasks
+    socket pps stream 0660 system system
diff --git a/graphics/composer/2.1/default/service.cpp b/graphics/composer/2.1/default/service.cpp
index 1276d2d..b8ddd21 100644
--- a/graphics/composer/2.1/default/service.cpp
+++ b/graphics/composer/2.1/default/service.cpp
@@ -23,6 +23,7 @@
 #include <binder/ProcessState.h>
 #include <composer-passthrough/2.1/HwcLoader.h>
 #include <hidl/LegacySupport.h>
+#include <hwbinder/ProcessState.h>
 
 using android::hardware::graphics::composer::V2_1::IComposer;
 using android::hardware::graphics::composer::V2_1::passthrough::HwcLoader;
@@ -41,6 +42,10 @@
         ALOGE("Couldn't set SCHED_FIFO: %d", errno);
     }
 
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize((size_t)(32768));
+#endif
+
     android::hardware::configureRpcThreadpool(4, true /* will join */);
 
     android::sp<IComposer> composer = HwcLoader::load();
diff --git a/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc b/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc
index efe6dad..289a91c 100644
--- a/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc
+++ b/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc
@@ -4,4 +4,5 @@
     group graphics drmrpc
     capabilities SYS_NICE
     onrestart restart surfaceflinger
+    socket pps stream 0660 system system
     writepid /dev/cpuset/system-background/tasks
diff --git a/graphics/composer/2.3/default/android.hardware.graphics.composer@2.3-service.rc b/graphics/composer/2.3/default/android.hardware.graphics.composer@2.3-service.rc
index 81ce890..5cc19bb 100644
--- a/graphics/composer/2.3/default/android.hardware.graphics.composer@2.3-service.rc
+++ b/graphics/composer/2.3/default/android.hardware.graphics.composer@2.3-service.rc
@@ -4,4 +4,5 @@
     group graphics drmrpc
     capabilities SYS_NICE
     onrestart restart surfaceflinger
+    socket pps stream 0660 system system
     writepid /dev/cpuset/system-background/tasks
diff --git a/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcHal.h b/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcHal.h
index e0e1394..19c4653 100644
--- a/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcHal.h
+++ b/graphics/composer/2.3/utils/passthrough/include/composer-passthrough/2.3/HwcHal.h
@@ -222,6 +222,10 @@
     Error getDisplayCapabilities(
             Display display,
             std::vector<IComposerClient::DisplayCapability>* outCapabilities) override {
+        if (!mDispatch.getDisplayCapabilities) {
+            return Error::UNSUPPORTED;
+        }
+
         uint32_t count = 0;
         int32_t error = mDispatch.getDisplayCapabilities(mDevice, display, &count, nullptr);
         if (error != HWC2_ERROR_NONE) {
diff --git a/graphics/composer/2.4/default/android.hardware.graphics.composer@2.4-service.rc b/graphics/composer/2.4/default/android.hardware.graphics.composer@2.4-service.rc
index a296b0a..802b99e 100644
--- a/graphics/composer/2.4/default/android.hardware.graphics.composer@2.4-service.rc
+++ b/graphics/composer/2.4/default/android.hardware.graphics.composer@2.4-service.rc
@@ -5,3 +5,4 @@
     capabilities SYS_NICE
     onrestart restart surfaceflinger
     writepid /dev/cpuset/system-background/tasks
+    socket pps stream 0660 system system
diff --git a/health/1.0/default/Android.bp b/health/1.0/default/Android.bp
index 7581335..b815eae 100644
--- a/health/1.0/default/Android.bp
+++ b/health/1.0/default/Android.bp
@@ -51,6 +51,12 @@
         "android.hardware.health@1.0-convert",
         "libhealthd.default",
     ],
+
+    shared_libs: [
+        "libhidlbase",
+        "libutils",
+        "android.hardware.health@1.0",
+    ],
 }
 
 cc_binary {
diff --git a/health/1.0/default/android.hardware.health@1.0-service.rc b/health/1.0/default/android.hardware.health@1.0-service.rc
index 405784f..569dc88 100644
--- a/health/1.0/default/android.hardware.health@1.0-service.rc
+++ b/health/1.0/default/android.hardware.health@1.0-service.rc
@@ -2,4 +2,4 @@
     class hal
     user system
     group system
-    capabilities WAKE_ALARM
+    capabilities WAKE_ALARM BLOCK_SUSPEND
diff --git a/health/2.1/default/android.hardware.health@2.1-service.rc b/health/2.1/default/android.hardware.health@2.1-service.rc
index b6d9e3b..8728257 100644
--- a/health/2.1/default/android.hardware.health@2.1-service.rc
+++ b/health/2.1/default/android.hardware.health@2.1-service.rc
@@ -2,5 +2,5 @@
     class hal charger
     user system
     group system
-    capabilities WAKE_ALARM
+    capabilities WAKE_ALARM BLOCK_SUSPEND
     file /dev/kmsg w
diff --git a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
index bc7f311..befb7d3 100644
--- a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
+++ b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
@@ -73,6 +73,9 @@
 static const int32_t KM_TAG_DIGEST_OLD = static_cast<int32_t>(TagType::ENUM) | 5;
 static const int32_t KM_TAG_PADDING_OLD = static_cast<int32_t>(TagType::ENUM) | 7;
 
+static const int32_t KM_TAG_FBE_ICE = static_cast<int32_t>(TagType::BOOL) | 16201;
+static const int32_t KM_TAG_KEY_TYPE = static_cast<int32_t>(TagType::UINT) | 16202;
+
 constexpr TagType typeFromTag(Tag tag) {
     return static_cast<TagType>(static_cast<uint32_t>(tag) & static_cast<uint32_t>(0xf0000000));
 }
diff --git a/light/2.0/default/Android.bp b/light/2.0/default/Android.bp
index ed48825..32fcaaf 100644
--- a/light/2.0/default/Android.bp
+++ b/light/2.0/default/Android.bp
@@ -41,10 +41,18 @@
         "libbase",
         "libdl",
         "libutils",
+        "libhwbinder",
         "libhardware",
         "libhidlbase",
         "android.hardware.light@2.0",
     ],
+    arch: {
+        arm: {
+            cflags: [
+                "-DARCH_ARM_32"
+            ],
+        },
+    },
 }
 
 cc_binary {
diff --git a/light/2.0/default/service.cpp b/light/2.0/default/service.cpp
index 20f0578..b50a203 100644
--- a/light/2.0/default/service.cpp
+++ b/light/2.0/default/service.cpp
@@ -16,10 +16,14 @@
 
 #include <android/hardware/light/2.0/ILight.h>
 #include <hidl/LegacySupport.h>
+#include <hwbinder/ProcessState.h>
 
 using android::hardware::light::V2_0::ILight;
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main() {
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize((size_t)(32768));
+#endif
     return defaultPassthroughServiceImplementation<ILight>();
 }
diff --git a/power/1.0/default/Android.bp b/power/1.0/default/Android.bp
index 1d152ee..74fb13f 100644
--- a/power/1.0/default/Android.bp
+++ b/power/1.0/default/Android.bp
@@ -54,6 +54,12 @@
         "libhardware",
         "libhidlbase",
         "android.hardware.power@1.0",
+        "libhwbinder"
     ],
 
+    arch: {
+        arm: {
+            cflags: ["-DARCH_ARM_32"],
+        },
+    },
 }
diff --git a/power/1.0/default/service.cpp b/power/1.0/default/service.cpp
index e8618b8..d561919 100644
--- a/power/1.0/default/service.cpp
+++ b/power/1.0/default/service.cpp
@@ -18,10 +18,16 @@
 
 #include <android/hardware/power/1.0/IPower.h>
 #include <hidl/LegacySupport.h>
+#ifdef ARCH_ARM_32
+#include <hwbinder/ProcessState.h>
+#endif
 
 using android::hardware::power::V1_0::IPower;
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main() {
+    #ifdef ARCH_ARM_32
+        android::hardware::ProcessState::initWithMmapSize((size_t)16384);
+    #endif
     return defaultPassthroughServiceImplementation<IPower>();
 }
diff --git a/sensors/1.0/default/Android.bp b/sensors/1.0/default/Android.bp
index d5c1b23..98f46ae 100644
--- a/sensors/1.0/default/Android.bp
+++ b/sensors/1.0/default/Android.bp
@@ -46,6 +46,7 @@
     relative_install_path: "hw",
     vendor: true,
     init_rc: ["android.hardware.sensors@1.0-service.rc"],
+    defaults: ["hidl_defaults"],
     srcs: ["service.cpp"],
 
     shared_libs: [
@@ -56,5 +57,11 @@
         "libutils",
         "libhidlbase",
         "android.hardware.sensors@1.0",
+        "libhwbinder",
     ],
+    arch: {
+        arm: {
+            cflags: ["-DARCH_ARM_32"],
+        },
+    },
 }
diff --git a/sensors/1.0/default/android.hardware.sensors@1.0-service.rc b/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
index 1af6d0b..e029bb8 100644
--- a/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
+++ b/sensors/1.0/default/android.hardware.sensors@1.0-service.rc
@@ -2,6 +2,6 @@
     interface android.hardware.sensors@1.0::ISensors default
     class hal
     user system
-    group system wakelock uhid context_hub
+    group system wakelock uhid input context_hub
     capabilities BLOCK_SUSPEND
     rlimit rtprio 10 10
diff --git a/sensors/1.0/default/service.cpp b/sensors/1.0/default/service.cpp
index 65f6d81..c413d1a 100644
--- a/sensors/1.0/default/service.cpp
+++ b/sensors/1.0/default/service.cpp
@@ -19,10 +19,30 @@
 #include <android/hardware/sensors/1.0/ISensors.h>
 #include <hidl/LegacySupport.h>
 
+#ifdef ARCH_ARM_32
+#include <hwbinder/ProcessState.h>
+#include <cutils/properties.h>
+#endif
+
 using android::hardware::sensors::V1_0::ISensors;
 using android::hardware::defaultPassthroughServiceImplementation;
 
+#ifdef ARCH_ARM_32
+//default h/w binder memsize for sensors is 8 KB
+#define DEFAULT_SENSORS_HW_BINDER_MEM_SIZE_KB 8
+size_t getHWBinderMmapSize() {
+    int32_t value = DEFAULT_SENSORS_HW_BINDER_MEM_SIZE_KB;
+
+    value = property_get_int32("persist.vendor.sensor.hw.binder.size", value);
+    ALOGD("Init hw binder with mem size = %d", value);
+    return 1024 * value;
+}
+#endif
+
 int main() {
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize((size_t)getHWBinderMmapSize());
+#endif
     /* Sensors framework service needs at least two threads.
      * One thread blocks on a "poll"
      * The second thread is needed for all other HAL methods.
diff --git a/usb/1.0/default/Usb.cpp b/usb/1.0/default/Usb.cpp
index 6eb8842..f72ab9c 100644
--- a/usb/1.0/default/Usb.cpp
+++ b/usb/1.0/default/Usb.cpp
@@ -206,6 +206,19 @@
 
 bool canSwitchRoleHelper(const std::string portName, PortRoleType type)  {
     std::string filename = appendRoleNodeHelper(portName, type);
+
+    if (type == PortRoleType::DATA_ROLE || type == PortRoleType::POWER_ROLE) {
+        std::string pd_filename = "/sys/class/power_supply/usb/pd_active";
+        std::string pd_active;
+
+        if (!readFile(pd_filename, pd_active)) {
+            if (pd_active == "0")
+                return false;
+        } else {
+            ALOGE("canSwitchRoleHelper: couldn't read %s", pd_filename.c_str());
+        }
+    }
+
     std::ofstream file(filename);
 
     if (file.is_open()) {
@@ -396,7 +409,7 @@
 
         for (int n = 0; n < nevents; ++n) {
             if (events[n].data.ptr)
-                (*(void (*)(int, struct data *payload))events[n].data.ptr)
+                (*(void (*)(uint32_t, struct data *payload))events[n].data.ptr)
                     (events[n].events, &payload);
         }
     }
diff --git a/vibrator/1.0/default/Android.bp b/vibrator/1.0/default/Android.bp
index b0d0986..1385eac 100644
--- a/vibrator/1.0/default/Android.bp
+++ b/vibrator/1.0/default/Android.bp
@@ -42,5 +42,13 @@
         "libutils",
         "libhardware",
         "android.hardware.vibrator@1.0",
+        "libhwbinder",
     ],
+    arch: {
+        arm: {
+            cflags: [
+                "-DARCH_ARM_32"
+            ],
+        },
+    },
 }
diff --git a/vibrator/1.0/default/service.cpp b/vibrator/1.0/default/service.cpp
index 7cc0744..b626056 100644
--- a/vibrator/1.0/default/service.cpp
+++ b/vibrator/1.0/default/service.cpp
@@ -17,10 +17,14 @@
 
 #include <android/hardware/vibrator/1.0/IVibrator.h>
 #include <hidl/LegacySupport.h>
+#include <hwbinder/ProcessState.h>
 
 using android::hardware::vibrator::V1_0::IVibrator;
 using android::hardware::defaultPassthroughServiceImplementation;
 
 int main() {
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize((size_t)8192);
+#endif
     return defaultPassthroughServiceImplementation<IVibrator>();
 }
diff --git a/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp b/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp
index 8340517..4967d71 100644
--- a/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp
+++ b/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp
@@ -95,7 +95,7 @@
 }
 
 TEST_P(VibratorAidl, OnWithCallback) {
-    if (!(capabilities & IVibrator::CAP_PERFORM_CALLBACK)) return;
+    if (!(capabilities & IVibrator::CAP_ON_CALLBACK)) return;
 
     std::promise<void> completionPromise;
     std::future<void> completionFuture{completionPromise.get_future()};
@@ -109,7 +109,7 @@
 }
 
 TEST_P(VibratorAidl, OnCallbackNotSupported) {
-    if (!(capabilities & IVibrator::CAP_PERFORM_CALLBACK)) {
+    if (!(capabilities & IVibrator::CAP_ON_CALLBACK)) {
         sp<CompletionCallback> callback = new CompletionCallback([] {});
         EXPECT_EQ(Status::EX_UNSUPPORTED_OPERATION, vibrator->on(250, callback).exceptionCode());
     }
diff --git a/wifi/1.4/default/Android.mk b/wifi/1.4/default/Android.mk
index 6be7dad..e7fde844 100644
--- a/wifi/1.4/default/Android.mk
+++ b/wifi/1.4/default/Android.mk
@@ -39,6 +39,12 @@
 ifdef WIFI_AVOID_IFACE_RESET_MAC_CHANGE
 LOCAL_CPPFLAGS += -DWIFI_AVOID_IFACE_RESET_MAC_CHANGE
 endif
+ifdef QC_WIFI_HIDL_FEATURE_DUAL_AP
+LOCAL_CPPFLAGS += -DQC_WIFI_HIDL_FEATURE_DUAL_AP
+endif
+ifdef QC_WIFI_HIDL_FEATURE_DUAL_STA
+LOCAL_CPPFLAGS += -DQC_WIFI_HIDL_FEATURE_DUAL_STA
+endif
 # Allow implicit fallthroughs in wifi_legacy_hal.cpp until they are fixed.
 LOCAL_CFLAGS += -Wno-error=implicit-fallthrough
 LOCAL_SRC_FILES := \
@@ -84,6 +90,10 @@
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_PROPRIETARY_MODULE := true
 LOCAL_CPPFLAGS := -Wall -Werror -Wextra
+ifeq ($(TARGET_ARCH),arm)
+    LOCAL_CPPFLAGS += -DARCH_ARM_32
+endif
+
 LOCAL_SRC_FILES := \
     service.cpp
 LOCAL_SHARED_LIBRARIES := \
@@ -93,6 +103,7 @@
     liblog \
     libnl \
     libutils \
+    libhwbinder \
     libwifi-hal \
     libwifi-system-iface \
     android.hardware.wifi@1.0 \
diff --git a/wifi/1.4/default/hidl_struct_util.cpp b/wifi/1.4/default/hidl_struct_util.cpp
index fd1d5b1..87c0708 100644
--- a/wifi/1.4/default/hidl_struct_util.cpp
+++ b/wifi/1.4/default/hidl_struct_util.cpp
@@ -52,7 +52,7 @@
         case legacy_hal::WIFI_LOGGER_POWER_EVENT_SUPPORTED:
             return HidlChipCaps::DEBUG_RING_BUFFER_POWER_EVENT;
         case legacy_hal::WIFI_LOGGER_WAKE_LOCK_SUPPORTED:
-            return HidlChipCaps::DEBUG_RING_BUFFER_WAKELOCK_EVENT;
+            return HidlChipCaps::DEBUG_HOST_WAKE_REASON_STATS;
     };
     CHECK(false) << "Unknown legacy feature: " << feature;
     return {};
@@ -155,10 +155,8 @@
         }
     }
 
-    // There are no flags for these 3 in the legacy feature set. Adding them to
+    // There are no flags for these in the legacy feature set. Adding this to
     // the set because all the current devices support it.
-    *hidl_caps |= HidlChipCaps::DEBUG_RING_BUFFER_VENDOR_DATA;
-    *hidl_caps |= HidlChipCaps::DEBUG_HOST_WAKE_REASON_STATS;
     *hidl_caps |= HidlChipCaps::DEBUG_ERROR_ALERTS;
     return true;
 }
diff --git a/wifi/1.4/default/service.cpp b/wifi/1.4/default/service.cpp
index 3f7f609..a959571 100644
--- a/wifi/1.4/default/service.cpp
+++ b/wifi/1.4/default/service.cpp
@@ -19,6 +19,9 @@
 #include <hidl/HidlTransportSupport.h>
 #include <utils/Looper.h>
 #include <utils/StrongPointer.h>
+#include <hwbinder/ProcessState.h>
+#include <cutils/properties.h>
+#include <signal.h>
 
 #include "wifi.h"
 #include "wifi_feature_flags.h"
@@ -35,6 +38,17 @@
 using android::hardware::wifi::V1_4::implementation::mode_controller::
     WifiModeController;
 
+#ifdef ARCH_ARM_32
+#define DEFAULT_WIFIHAL_HW_BINDER_SIZE_KB 16
+size_t getHWBinderMmapSize() {
+    size_t value = 0;
+    value = property_get_int32("persist.vendor.wifi.wifihal.hw.binder.size", DEFAULT_WIFIHAL_HW_BINDER_SIZE_KB);
+    if (!value) value = DEFAULT_WIFIHAL_HW_BINDER_SIZE_KB; // deafult to 1 page of 4 Kb
+
+    return 1024 * value;
+}
+#endif /* ARCH_ARM_32 */
+
 #ifdef LAZY_SERVICE
 const bool kLazyService = true;
 #else
@@ -42,6 +56,10 @@
 #endif
 
 int main(int /*argc*/, char** argv) {
+#ifdef ARCH_ARM_32
+    android::hardware::ProcessState::initWithMmapSize(getHWBinderMmapSize());
+#endif /* ARCH_ARM_32 */
+    signal(SIGPIPE, SIG_IGN);
     android::base::InitLogging(
         argv, android::base::LogdLogger(android::base::SYSTEM));
     LOG(INFO) << "Wifi Hal is booting up...";
diff --git a/wifi/1.4/default/wifi_ap_iface.cpp b/wifi/1.4/default/wifi_ap_iface.cpp
index 8777a4c..6218d0f 100644
--- a/wifi/1.4/default/wifi_ap_iface.cpp
+++ b/wifi/1.4/default/wifi_ap_iface.cpp
@@ -113,7 +113,23 @@
 
 WifiStatus WifiApIface::setMacAddressInternal(
     const std::array<uint8_t, 6>& mac) {
+#ifndef WIFI_AVOID_IFACE_RESET_MAC_CHANGE
+    if (!iface_util_.lock()->setUpState(ifname_, false)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+#endif
     bool status = iface_util_.lock()->setMacAddress(ifname_, mac);
+#ifndef WIFI_AVOID_IFACE_RESET_MAC_CHANGE
+    if (!iface_util_.lock()->setUpState(ifname_, true)) {
+        LOG(INFO) << "Wait for driver ready and try to set iface UP again";
+        if (legacy_hal_.lock()->waitForDriverReady() !=
+                legacy_hal::WIFI_SUCCESS ||
+            !iface_util_.lock()->setUpState(ifname_, true)) {
+            return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+        }
+    }
+    iface_util_.lock()->onStateToggleOffOn(ifname_);
+#endif
     if (!status) {
         return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
     }
diff --git a/wifi/1.4/default/wifi_chip.cpp b/wifi/1.4/default/wifi_chip.cpp
old mode 100644
new mode 100755
index 8cba464..16f9f26
--- a/wifi/1.4/default/wifi_chip.cpp
+++ b/wifi/1.4/default/wifi_chip.cpp
@@ -21,6 +21,7 @@
 #include <cutils/properties.h>
 #include <sys/stat.h>
 #include <sys/sysmacros.h>
+#include <net/if.h>
 
 #include "hidl_return_util.h"
 #include "hidl_struct_util.h"
@@ -664,7 +665,36 @@
                            hidl_status_cb, event_callback);
 }
 
+void WifiChip::QcRemoveAndClearDynamicIfaces() {
+    for (const auto& iface : created_ap_ifaces_) {
+        std::string ifname = iface->getName();
+        legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->deleteVirtualInterface(ifname);
+        if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+            LOG(ERROR) << "Failed to remove interface: " << ifname << " "
+                       << legacyErrorToString(legacy_status);
+        }
+    }
+
+    for (const auto& iface : created_sta_ifaces_) {
+        std::string ifname = iface->getName();
+        legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->deleteVirtualInterface(ifname);
+        if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+            LOG(ERROR) << "Failed to remove interface: " << ifname << " "
+                       << legacyErrorToString(legacy_status);
+        }
+    }
+
+    // created_ap/sta_ifaces are also part of sta/ap_ifaces.
+    // Do no invalidate here.
+
+    created_ap_ifaces_.clear();
+    created_sta_ifaces_.clear();
+}
+
 void WifiChip::invalidateAndRemoveAllIfaces() {
+    QcRemoveAndClearDynamicIfaces();
     invalidateAndClearAll(ap_ifaces_);
     invalidateAndClearAll(nan_ifaces_);
     invalidateAndClearAll(p2p_ifaces_);
@@ -824,18 +854,25 @@
     if (!canCurrentModeSupportIfaceOfTypeWithCurrentIfaces(IfaceType::AP)) {
         return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
     }
+
+    bool iface_created = false;
     std::string ifname = allocateApIfaceName();
-    legacy_hal::wifi_error legacy_status =
-        legacy_hal_.lock()->createVirtualInterface(
-            ifname,
-            hidl_struct_util::convertHidlIfaceTypeToLegacy(IfaceType::AP));
-    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
-        LOG(ERROR) << "Failed to add interface: " << ifname << " "
-                   << legacyErrorToString(legacy_status);
-        return {createWifiStatusFromLegacyError(legacy_status), {}};
+    if (!if_nametoindex(ifname.c_str())) {
+        legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->createVirtualInterface(
+                ifname,
+                hidl_struct_util::convertHidlIfaceTypeToLegacy(IfaceType::AP));
+        if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+            LOG(ERROR) << "Failed to add interface: " << ifname << " "
+                       << legacyErrorToString(legacy_status);
+            return {createWifiStatusFromLegacyError(legacy_status), {}};
+        }
+        iface_created = true;
     }
+    iface_util_.lock()->setRandomMacAddressIndex(ap_ifaces_.size());
     sp<WifiApIface> iface = new WifiApIface(ifname, legacy_hal_, iface_util_);
     ap_ifaces_.push_back(iface);
+    if (iface_created) created_ap_ifaces_.push_back(iface);
     for (const auto& callback : event_cb_handler_.getCallbacks()) {
         if (!callback->onIfaceAdded(IfaceType::AP, ifname).isOk()) {
             LOG(ERROR) << "Failed to invoke onIfaceAdded callback";
@@ -872,11 +909,15 @@
     // nan/rtt objects over AP iface. But, there is no harm to do it
     // here and not make that assumption all over the place.
     invalidateAndRemoveDependencies(ifname);
-    legacy_hal::wifi_error legacy_status =
-        legacy_hal_.lock()->deleteVirtualInterface(ifname);
-    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
-        LOG(ERROR) << "Failed to remove interface: " << ifname << " "
-                   << legacyErrorToString(legacy_status);
+    if (findUsingName(created_ap_ifaces_, ifname) != nullptr) {
+        iface_util_.lock()->setUpState(ifname, false);
+        legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->deleteVirtualInterface(ifname);
+        if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+            LOG(ERROR) << "Failed to remove interface: " << ifname << " "
+                       << legacyErrorToString(legacy_status);
+        }
+        invalidateAndClear(created_ap_ifaces_, iface);
     }
     invalidateAndClear(ap_ifaces_, iface);
     for (const auto& callback : event_cb_handler_.getCallbacks()) {
@@ -993,18 +1034,23 @@
     if (!canCurrentModeSupportIfaceOfTypeWithCurrentIfaces(IfaceType::STA)) {
         return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
     }
+    bool iface_created = false;
     std::string ifname = allocateStaIfaceName();
-    legacy_hal::wifi_error legacy_status =
-        legacy_hal_.lock()->createVirtualInterface(
-            ifname,
-            hidl_struct_util::convertHidlIfaceTypeToLegacy(IfaceType::STA));
-    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
-        LOG(ERROR) << "Failed to add interface: " << ifname << " "
-                   << legacyErrorToString(legacy_status);
-        return {createWifiStatusFromLegacyError(legacy_status), {}};
+    if (!if_nametoindex(ifname.c_str())) {
+        legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->createVirtualInterface(
+                ifname,
+                hidl_struct_util::convertHidlIfaceTypeToLegacy(IfaceType::STA));
+        if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+            LOG(ERROR) << "Failed to add interface: " << ifname << " "
+                       << legacyErrorToString(legacy_status);
+            return {createWifiStatusFromLegacyError(legacy_status), {}};
+        }
+        iface_created = true;
     }
     sp<WifiStaIface> iface = new WifiStaIface(ifname, legacy_hal_, iface_util_);
     sta_ifaces_.push_back(iface);
+    if (iface_created) created_sta_ifaces_.push_back(iface);
     for (const auto& callback : event_cb_handler_.getCallbacks()) {
         if (!callback->onIfaceAdded(IfaceType::STA, ifname).isOk()) {
             LOG(ERROR) << "Failed to invoke onIfaceAdded callback";
@@ -1038,11 +1084,15 @@
     }
     // Invalidate & remove any dependent objects first.
     invalidateAndRemoveDependencies(ifname);
-    legacy_hal::wifi_error legacy_status =
-        legacy_hal_.lock()->deleteVirtualInterface(ifname);
-    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
-        LOG(ERROR) << "Failed to remove interface: " << ifname << " "
-                   << legacyErrorToString(legacy_status);
+    if (findUsingName(created_sta_ifaces_, ifname) != nullptr) {
+        iface_util_.lock()->setUpState(ifname, false);
+        legacy_hal::wifi_error legacy_status =
+            legacy_hal_.lock()->deleteVirtualInterface(ifname);
+        if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+            LOG(ERROR) << "Failed to remove interface: " << ifname << " "
+                       << legacyErrorToString(legacy_status);
+        }
+        invalidateAndClear(created_sta_ifaces_, iface);
     }
     invalidateAndClear(sta_ifaces_, iface);
     for (const auto& callback : event_cb_handler_.getCallbacks()) {
@@ -1570,13 +1620,6 @@
     return canCurrentModeSupportIfaceCombo(req_iface_combo);
 }
 
-bool WifiChip::isDualApAllowedInCurrentMode() {
-    // Check if we can support atleast 1 STA & 1 AP concurrently.
-    std::map<IfaceType, size_t> req_iface_combo;
-    req_iface_combo[IfaceType::AP] = 2;
-    return canCurrentModeSupportIfaceCombo(req_iface_combo);
-}
-
 std::string WifiChip::getFirstActiveWlanIfaceName() {
     if (sta_ifaces_.size() > 0) return sta_ifaces_[0]->getName();
     if (ap_ifaces_.size() > 0) return ap_ifaces_[0]->getName();
@@ -1602,17 +1645,15 @@
 }
 
 // AP iface names start with idx 1 for modes supporting
-// concurrent STA and not dual AP, else start with idx 0.
+// concurrent STA, else start with idx 0.
 std::string WifiChip::allocateApIfaceName() {
     // Check if we have a dedicated iface for AP.
     std::string ifname = getApIfaceName();
     if (!ifname.empty()) {
         return ifname;
     }
-    return allocateApOrStaIfaceName((isStaApConcurrencyAllowedInCurrentMode() &&
-                                     !isDualApAllowedInCurrentMode())
-                                        ? 1
-                                        : 0);
+    return allocateApOrStaIfaceName(
+        isStaApConcurrencyAllowedInCurrentMode() ? 1 : 0);
 }
 
 // STA iface names start with idx 0.
diff --git a/wifi/1.4/default/wifi_chip.h b/wifi/1.4/default/wifi_chip.h
index 98e18bb..abe025c 100644
--- a/wifi/1.4/default/wifi_chip.h
+++ b/wifi/1.4/default/wifi_chip.h
@@ -253,12 +253,12 @@
     bool canCurrentModeSupportIfaceOfType(IfaceType requested_type);
     bool isValidModeId(ChipModeId mode_id);
     bool isStaApConcurrencyAllowedInCurrentMode();
-    bool isDualApAllowedInCurrentMode();
     std::string getFirstActiveWlanIfaceName();
     std::string allocateApOrStaIfaceName(uint32_t start_idx);
     std::string allocateApIfaceName();
     std::string allocateStaIfaceName();
     bool writeRingbufferFilesInternal();
+    void QcRemoveAndClearDynamicIfaces();
 
     ChipId chip_id_;
     std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
@@ -282,6 +282,9 @@
     hidl_callback_util::HidlCallbackHandler<IWifiChipEventCallback>
         event_cb_handler_;
 
+    std::vector<sp<WifiApIface>> created_ap_ifaces_;
+    std::vector<sp<WifiStaIface>> created_sta_ifaces_;
+
     DISALLOW_COPY_AND_ASSIGN(WifiChip);
 };
 
diff --git a/wifi/1.4/default/wifi_feature_flags.cpp b/wifi/1.4/default/wifi_feature_flags.cpp
index 195b460..515386e 100644
--- a/wifi/1.4/default/wifi_feature_flags.cpp
+++ b/wifi/1.4/default/wifi_feature_flags.cpp
@@ -79,14 +79,44 @@
 #      define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{P2P}, 1}}
 #    endif
 #  else
-#    ifdef WIFI_HIDL_FEATURE_AWARE
-//     (1 STA + 1 AP) or (1 STA + 1 of (P2P or NAN))
-#      define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
-                                              {{{STA}, 1}, {{P2P, NAN}, 1}}
+#    ifdef QC_WIFI_HIDL_FEATURE_DUAL_AP
+#      ifdef QC_WIFI_HIDL_FEATURE_DUAL_STA
+#        ifdef WIFI_HIDL_FEATURE_AWARE
+//         (1 STA + 1 AP) or (1 STA + 1 of (P2P or NAN)) or (2 AP) or (2 STA)
+#          define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
+                                                  {{{STA}, 1}, {{P2P, NAN}, 1}},\
+                                                  {{{AP}, 2}},\
+                                                  {{{STA}, 2}}
+#        else
+//         (1 STA + 1 AP) or (1 STA + 1 P2P) or (2 AP) or (2 STA)
+#          define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
+                                                  {{{STA}, 1}, {{P2P}, 1}},\
+                                                  {{{AP}, 2}},\
+                                                  {{{STA}, 2}}
+#        endif
+#      else
+#        ifdef WIFI_HIDL_FEATURE_AWARE
+//         (1 STA + 1 AP) or (1 STA + 1 of (P2P or NAN)) or (2 AP)
+#          define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
+                                                  {{{STA}, 1}, {{P2P, NAN}, 1}},\
+                                                  {{{AP}, 2}}
+#        else
+//         (1 STA + 1 AP) or (1 STA + 1 P2P) or (2 AP)
+#          define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
+                                                  {{{STA}, 1}, {{P2P}, 1}},\
+                                                  {{{AP}, 2}}
+#        endif
+#      endif
 #    else
-//     (1 STA + 1 AP) or (1 STA + 1 P2P)
-#      define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
-                                              {{{STA}, 1}, {{P2P}, 1}}
+#      ifdef WIFI_HIDL_FEATURE_AWARE
+//       (1 STA + 1 AP) or (1 STA + 1 of (P2P or NAN))
+#        define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
+                                                {{{STA}, 1}, {{P2P, NAN}, 1}}
+#      else
+//       (1 STA + 1 AP) or (1 STA + 1 P2P)
+#        define WIFI_HAL_INTERFACE_COMBINATIONS {{{STA}, 1}, {{AP}, 1}},\
+                                                {{{STA}, 1}, {{P2P}, 1}}
+#      endif
 #    endif
 #  endif
 #else
diff --git a/wifi/1.4/default/wifi_iface_util.cpp b/wifi/1.4/default/wifi_iface_util.cpp
index 49b7674..97c2f6a 100644
--- a/wifi/1.4/default/wifi_iface_util.cpp
+++ b/wifi/1.4/default/wifi_iface_util.cpp
@@ -43,8 +43,11 @@
 WifiIfaceUtil::WifiIfaceUtil(
     const std::weak_ptr<wifi_system::InterfaceTool> iface_tool)
     : iface_tool_(iface_tool),
-      random_mac_address_(nullptr),
-      event_handlers_map_() {}
+      random_mac_address_index_(0),
+      event_handlers_map_() {
+    for (int i=0; i < MAX_RANDOM_MAC_ADDR_INDEX; i++)
+        random_mac_address_[i] = nullptr;
+}
 
 std::array<uint8_t, 6> WifiIfaceUtil::getFactoryMacAddress(
     const std::string& iface_name) {
@@ -53,22 +56,15 @@
 
 bool WifiIfaceUtil::setMacAddress(const std::string& iface_name,
                                   const std::array<uint8_t, 6>& mac) {
-#ifndef WIFI_AVOID_IFACE_RESET_MAC_CHANGE
-    if (!iface_tool_.lock()->SetUpState(iface_name.c_str(), false)) {
-        LOG(ERROR) << "SetUpState(false) failed.";
-        return false;
-    }
-#endif
     if (!iface_tool_.lock()->SetMacAddress(iface_name.c_str(), mac)) {
         LOG(ERROR) << "SetMacAddress failed.";
         return false;
     }
-#ifndef WIFI_AVOID_IFACE_RESET_MAC_CHANGE
-    if (!iface_tool_.lock()->SetUpState(iface_name.c_str(), true)) {
-        LOG(ERROR) << "SetUpState(true) failed.";
-        return false;
-    }
-#endif
+    LOG(DEBUG) << "Successfully SetMacAddress.";
+    return true;
+}
+
+void WifiIfaceUtil::onStateToggleOffOn(const std::string& iface_name) {
     IfaceEventHandlers event_handlers = {};
     const auto it = event_handlers_map_.find(iface_name);
     if (it != event_handlers_map_.end()) {
@@ -77,17 +73,24 @@
     if (event_handlers.on_state_toggle_off_on != nullptr) {
         event_handlers.on_state_toggle_off_on(iface_name);
     }
-    LOG(DEBUG) << "Successfully SetMacAddress.";
-    return true;
+}
+
+void WifiIfaceUtil::setRandomMacAddressIndex(int idx) {
+    if (idx >= MAX_RANDOM_MAC_ADDR_INDEX) {
+        LOG(ERROR) << "Requested random mac address index crossed max limit!!";
+        return;
+    }
+
+    random_mac_address_index_ = idx;
 }
 
 std::array<uint8_t, 6> WifiIfaceUtil::getOrCreateRandomMacAddress() {
-    if (random_mac_address_) {
-        return *random_mac_address_.get();
+    if (random_mac_address_[random_mac_address_index_]) {
+        return *random_mac_address_[random_mac_address_index_].get();
     }
-    random_mac_address_ =
+    random_mac_address_[random_mac_address_index_] =
         std::make_unique<std::array<uint8_t, 6>>(createRandomMacAddress());
-    return *random_mac_address_.get();
+    return *random_mac_address_[random_mac_address_index_].get();
 }
 
 void WifiIfaceUtil::registerIfaceEventHandlers(const std::string& iface_name,
diff --git a/wifi/1.4/default/wifi_iface_util.h b/wifi/1.4/default/wifi_iface_util.h
index 126b6ca..a7274a1 100644
--- a/wifi/1.4/default/wifi_iface_util.h
+++ b/wifi/1.4/default/wifi_iface_util.h
@@ -17,6 +17,8 @@
 #ifndef WIFI_IFACE_UTIL_H_
 #define WIFI_IFACE_UTIL_H_
 
+#define MAX_RANDOM_MAC_ADDR_INDEX 5
+
 #include <wifi_system/interface_tool.h>
 
 #include <android/hardware/wifi/1.0/IWifi.h>
@@ -52,18 +54,22 @@
     // daemon. (So, changes on every reboot)
     virtual std::array<uint8_t, 6> getOrCreateRandomMacAddress();
 
+    virtual void setRandomMacAddressIndex(int idx);
     // Register for any iface event callbacks for the provided interface.
     virtual void registerIfaceEventHandlers(const std::string& iface_name,
                                             IfaceEventHandlers handlers);
     virtual void unregisterIfaceEventHandlers(const std::string& iface_name);
     virtual bool setUpState(const std::string& iface_name, bool request_up);
     virtual unsigned ifNameToIndex(const std::string& iface_name);
+    virtual void onStateToggleOffOn(const std::string& iface_name);
 
    private:
     std::array<uint8_t, 6> createRandomMacAddress();
 
     std::weak_ptr<wifi_system::InterfaceTool> iface_tool_;
-    std::unique_ptr<std::array<uint8_t, 6>> random_mac_address_;
+    std::unique_ptr<std::array<uint8_t, 6>> random_mac_address_[MAX_RANDOM_MAC_ADDR_INDEX];
+
+    int random_mac_address_index_;
     std::map<std::string, IfaceEventHandlers> event_handlers_map_;
 };
 
diff --git a/wifi/1.4/default/wifi_legacy_hal.cpp b/wifi/1.4/default/wifi_legacy_hal.cpp
index 75f22ec..5678848 100644
--- a/wifi/1.4/default/wifi_legacy_hal.cpp
+++ b/wifi/1.4/default/wifi_legacy_hal.cpp
@@ -36,7 +36,7 @@
 static constexpr uint32_t kLinkLayerStatsDataMpduSizeThreshold = 128;
 static constexpr uint32_t kMaxWakeReasonStatsArraySize = 32;
 static constexpr uint32_t kMaxRingBuffers = 10;
-static constexpr uint32_t kMaxStopCompleteWaitMs = 100;
+static constexpr uint32_t kMaxStopCompleteWaitMs = 2000;
 static constexpr char kDriverPropName[] = "wlan.driver.status";
 
 // Helper function to create a non-const char* for legacy Hal API's.
@@ -402,7 +402,7 @@
         on_stop_complete_user_callback();
         return WIFI_SUCCESS;
     }
-    LOG(DEBUG) << "Stopping legacy HAL";
+    LOG(ERROR) << "Stopping legacy HAL";
     on_stop_complete_internal_callback = [on_stop_complete_user_callback,
                                           this](wifi_handle handle) {
         CHECK_EQ(global_handle_, handle) << "Handle mismatch";
@@ -411,10 +411,12 @@
         // stopped.
         invalidate();
         iface_tool_.lock()->SetWifiUpState(false);
+        LOG(ERROR) << "SetWifiUpState(false) completed";
         on_stop_complete_user_callback();
         is_started_ = false;
     };
     awaiting_event_loop_termination_ = true;
+    LOG(ERROR) << "Legacy HAL trigger wifi cleanup";
     global_func_table_.wifi_cleanup(global_handle_, onAsyncStopComplete);
     const auto status = stop_wait_cv_.wait_for(
         *lock, std::chrono::milliseconds(kMaxStopCompleteWaitMs),
@@ -1390,12 +1392,13 @@
 void WifiLegacyHal::runEventLoop() {
     LOG(DEBUG) << "Starting legacy HAL event loop";
     global_func_table_.wifi_event_loop(global_handle_);
+    LOG(ERROR) << "Legacy HAL Wifi event loop exited";
     const auto lock = hidl_sync_util::acquireGlobalLock();
     if (!awaiting_event_loop_termination_) {
         LOG(FATAL)
             << "Legacy HAL event loop terminated, but HAL was not stopping";
     }
-    LOG(DEBUG) << "Legacy HAL event loop terminated";
+    LOG(ERROR) << "Legacy HAL event loop terminated";
     awaiting_event_loop_termination_ = false;
     stop_wait_cv_.notify_one();
 }
@@ -1459,6 +1462,10 @@
     return status;
 }
 
+wifi_error WifiLegacyHal::waitForDriverReady() {
+    return global_func_table_.wifi_wait_for_driver_ready();
+}
+
 void WifiLegacyHal::invalidate() {
     global_handle_ = nullptr;
     iface_name_to_handle_.clear();
diff --git a/wifi/1.4/default/wifi_legacy_hal.h b/wifi/1.4/default/wifi_legacy_hal.h
index 9964460..03035ec 100644
--- a/wifi/1.4/default/wifi_legacy_hal.h
+++ b/wifi/1.4/default/wifi_legacy_hal.h
@@ -375,6 +375,8 @@
                                               wifi_interface_type iftype);
     virtual wifi_error deleteVirtualInterface(const std::string& ifname);
 
+    virtual wifi_error waitForDriverReady();
+
    private:
     // Retrieve interface handles for all the available interfaces.
     wifi_error retrieveIfaceHandles();
diff --git a/wifi/1.4/default/wifi_sta_iface.cpp b/wifi/1.4/default/wifi_sta_iface.cpp
index 49f383a..ee70461 100644
--- a/wifi/1.4/default/wifi_sta_iface.cpp
+++ b/wifi/1.4/default/wifi_sta_iface.cpp
@@ -625,7 +625,23 @@
 
 WifiStatus WifiStaIface::setMacAddressInternal(
     const std::array<uint8_t, 6>& mac) {
+#ifndef WIFI_AVOID_IFACE_RESET_MAC_CHANGE
+    if (!iface_util_.lock()->setUpState(ifname_, false)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+#endif
     bool status = iface_util_.lock()->setMacAddress(ifname_, mac);
+#ifndef WIFI_AVOID_IFACE_RESET_MAC_CHANGE
+    if (!iface_util_.lock()->setUpState(ifname_, true)) {
+        LOG(INFO) << "Wait for driver ready and try to set iface UP again";
+        if (legacy_hal_.lock()->waitForDriverReady() !=
+                legacy_hal::WIFI_SUCCESS ||
+            !iface_util_.lock()->setUpState(ifname_, true)) {
+            return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+        }
+    }
+    iface_util_.lock()->onStateToggleOffOn(ifname_);
+#endif
     if (!status) {
         return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
     }