diff --git a/Android.bp b/Android.bp
index 2b9e80f..b694886 100644
--- a/Android.bp
+++ b/Android.bp
@@ -98,7 +98,7 @@
         "//apex_available:platform",
         "com.android.neuralnetworks",
         "test_com.android.neuralnetworks",
-        "com.android.bluetooth",
+        "com.android.btservices",
         "com.android.media",
         "com.android.media.swcodec",
         "com.android.tethering",
@@ -112,9 +112,6 @@
     ],
     min_sdk_version: "29",
     afdo: true,
-    header_abi_checker: {
-        diff_flags: ["-allow-adding-removing-weak-symbols"],
-    },
 }
 
 // WARNING: deprecated
diff --git a/TEST_MAPPING b/TEST_MAPPING
index 22c9d36..733e1b7 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -11,7 +11,9 @@
     },
     {
       "name": "hidl_lazy_test"
+    },
+    {
+      "name": "vts_ibase_test"
     }
   ]
 }
-
diff --git a/base/include/hidl/MQDescriptor.h b/base/include/hidl/MQDescriptor.h
index 0429444..38ac325 100644
--- a/base/include/hidl/MQDescriptor.h
+++ b/base/include/hidl/MQDescriptor.h
@@ -181,7 +181,11 @@
 
 template<typename T, MQFlavor flavor>
 size_t MQDescriptor<T, flavor>::getSize() const {
-    return static_cast<size_t>(mGrantors[details::DATAPTRPOS].extent);
+    if (mGrantors.size() > details::DATAPTRPOS) {
+        return static_cast<size_t>(mGrantors[details::DATAPTRPOS].extent);
+    } else {
+        return 0;
+    }
 }
 
 template<typename T, MQFlavor flavor>
diff --git a/base/include/hidl/TaskRunner.h b/base/include/hidl/TaskRunner.h
index 6a79ebf..f3ea92f 100644
--- a/base/include/hidl/TaskRunner.h
+++ b/base/include/hidl/TaskRunner.h
@@ -16,6 +16,7 @@
 #ifndef ANDROID_HIDL_TASK_RUNNER_H
 #define ANDROID_HIDL_TASK_RUNNER_H
 
+#include <functional>
 #include <memory>
 #include <thread>
 
diff --git a/transport/ServiceManagement.cpp b/transport/ServiceManagement.cpp
index 0640eef..f3ee611 100644
--- a/transport/ServiceManagement.cpp
+++ b/transport/ServiceManagement.cpp
@@ -59,6 +59,7 @@
 using IServiceManager1_1 = android::hidl::manager::V1_1::IServiceManager;
 using IServiceManager1_2 = android::hidl::manager::V1_2::IServiceManager;
 using ::android::hidl::manager::V1_0::IServiceNotification;
+using ::android::hidl::manager::V1_2::IClientCallback;
 
 namespace android {
 namespace hardware {
@@ -204,6 +205,109 @@
 sp<IServiceManager1_1> defaultServiceManager1_1() {
     return defaultServiceManager1_2();
 }
+static bool isServiceManager(const hidl_string& fqName) {
+    return fqName == IServiceManager1_0::descriptor || fqName == IServiceManager1_1::descriptor ||
+           fqName == IServiceManager1_2::descriptor;
+}
+static bool isHwServiceManagerInstalled() {
+    return access("/system/bin/hwservicemanager", F_OK) == 0;
+}
+
+/*
+ * A replacement for hwservicemanager when it is not installed on a device.
+ *
+ * Clients in the framework need to continue supporting HIDL services through
+ * hwservicemanager for upgrading devices. Being unable to get an instance of
+ * hardware service manager is a hard error, so this implementation is returned
+ * to be able service the requests and tell clients there are no services
+ * registered.
+ */
+struct NoHwServiceManager : public IServiceManager1_2 {
+    Return<sp<IBase>> get(const hidl_string& fqName, const hidl_string&) override {
+        sp<IBase> ret = nullptr;
+
+        if (isServiceManager(fqName)) {
+            ret = defaultServiceManager1_2();
+        }
+        return ret;
+    }
+
+    Return<bool> add(const hidl_string& name, const sp<IBase>& /* service */) override {
+        LOG(INFO) << "Cannot add " << name << " without hwservicemanager";
+        return false;
+    }
+
+    Return<Transport> getTransport(const hidl_string& fqName, const hidl_string& name) {
+        LOG(INFO) << "Trying to get transport of " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return Transport::PASSTHROUGH;
+    }
+
+    Return<void> list(list_cb _hidl_cb) override {
+        _hidl_cb({});
+        LOG(INFO) << "Cannot list all services without hwservicemanager";
+        return Void();
+    }
+    Return<void> listByInterface(const hidl_string& fqName, listByInterface_cb _hidl_cb) override {
+        _hidl_cb({});
+        LOG(INFO) << "Cannot list service " << fqName << " without hwservicemanager";
+        return Void();
+    }
+
+    Return<bool> registerForNotifications(const hidl_string& fqName, const hidl_string& name,
+                                          const sp<IServiceNotification>& /* callback */) override {
+        LOG(INFO) << "Cannot register for notifications for " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+
+    Return<void> debugDump(debugDump_cb _hidl_cb) override {
+        _hidl_cb({});
+        return Void();
+    }
+
+    Return<void> registerPassthroughClient(const hidl_string& fqName,
+                                           const hidl_string& name) override {
+        LOG(INFO) << "This process is a client of " << fqName << "/" << name
+                  << " passthrough HAL, but it won't show up in lshal because hwservicemanager is "
+                     "not installed";
+        return Void();
+    }
+
+    Return<bool> unregisterForNotifications(
+            const hidl_string& fqName, const hidl_string& name,
+            const sp<IServiceNotification>& /* callback */) override {
+        LOG(INFO) << "Cannot unregister for notifications for " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+    Return<bool> registerClientCallback(const hidl_string& fqName, const hidl_string& name,
+                                        const sp<IBase>&, const sp<IClientCallback>&) {
+        LOG(INFO) << "Cannot add client callback for " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+    Return<bool> unregisterClientCallback(const sp<IBase>&, const sp<IClientCallback>&) {
+        LOG(INFO) << "Cannot unregister client callbacks without hwservicemanager";
+        return false;
+    }
+    Return<bool> addWithChain(const hidl_string& fqName, const sp<IBase>&,
+                              const hidl_vec<hidl_string>&) {
+        LOG(INFO) << "Cannot add " << fqName << " with chain without hwservicemanager";
+        return false;
+    }
+    Return<void> listManifestByInterface(const hidl_string& fqName, listManifestByInterface_cb) {
+        LOG(INFO) << "Cannot list manifest for " << fqName << " without hwservicemanager";
+        return Void();
+    }
+    Return<bool> tryUnregister(const hidl_string& fqName, const hidl_string& name,
+                               const sp<IBase>&) {
+        LOG(INFO) << "Cannot unregister service " << fqName << "/" << name
+                  << " without hwservicemanager";
+        return false;
+    }
+};
+
 sp<IServiceManager1_2> defaultServiceManager1_2() {
     using android::hidl::manager::V1_2::BnHwServiceManager;
     using android::hidl::manager::V1_2::BpHwServiceManager;
@@ -217,6 +321,12 @@
             return gDefaultServiceManager;
         }
 
+        if (!isHwServiceManagerInstalled()) {
+            // hwservicemanager is not available on this device.
+            gDefaultServiceManager = sp<NoHwServiceManager>::make();
+            return gDefaultServiceManager;
+        }
+
         if (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) {
             // HwBinder not available on this device or not accessible to
             // this process.
@@ -413,6 +523,12 @@
     Return<sp<IBase>> get(const hidl_string& fqName,
                           const hidl_string& name) override {
         sp<IBase> ret = nullptr;
+        // This is required to run without hwservicemanager while we have
+        // passthrough HIDL services. Once the passthrough HIDL services have
+        // been removed, the PassthroughServiceManager will no longer be needed.
+        if (!isHwServiceManagerInstalled() && isServiceManager(fqName)) {
+            return defaultServiceManager1_2();
+        }
 
         openLibs(fqName, [&](void* handle, const std::string &lib, const std::string &sym) {
             IBase* (*generator)(const char* name);
diff --git a/transport/base/1.0/vts/functional/Android.bp b/transport/base/1.0/vts/functional/Android.bp
index f25aaaa..a2a3484 100644
--- a/transport/base/1.0/vts/functional/Android.bp
+++ b/transport/base/1.0/vts/functional/Android.bp
@@ -37,9 +37,9 @@
         "liblog",
         "libutils",
         "libprotobuf-cpp-lite",
-        "libhidl-gen-utils",
     ],
     static_libs: [
+        "libhidl-gen-utils",
         "libinit_test_utils",
     ],
     test_suites: [
diff --git a/transport/base/1.0/vts/functional/vts_ibase_test.cpp b/transport/base/1.0/vts/functional/vts_ibase_test.cpp
index 6372631..96125d0 100644
--- a/transport/base/1.0/vts/functional/vts_ibase_test.cpp
+++ b/transport/base/1.0/vts/functional/vts_ibase_test.cpp
@@ -81,7 +81,7 @@
 std::map<std::string, std::vector<Hal>> gDeclaredServiceHalMap;
 std::mutex gDeclaredServiceHalMapMutex;
 
-void GetHal(const std::string& service, const FqInstance& instance) {
+void GetHal(const sp<IServiceManager> &manager, const std::string& service, const FqInstance& instance) {
     if (instance.getFqName().string() == IBase::descriptor) {
         return;
     }
@@ -89,6 +89,23 @@
     sp<IBase> hal = android::hardware::details::getRawServiceInternal(
             instance.getFqName().string(), instance.getInstance(), true /*retry*/,
             false /*getStub*/);
+
+    // Check transport of manifest to support hardware SKU:
+    // Don't add service to gDeclaredServiceHalMap if hal instance is null and
+    // the transport of the declared interface is not present in manifest. Because
+    // manufacturer may disable this hal service in the current hardware SKU,
+    // but enable it in the other hardware SKU.
+    if (hal == nullptr && manager != nullptr) {
+        auto transport = manager->getTransport(instance.getFqName().string(),
+            instance.getInstance());
+        if(transport == IServiceManager::Transport::EMPTY){
+            LOG(WARNING)
+                << "Ignore, because Service '" << service << "' is not running,"
+                << " its interface '" << instance.string() << "' is not present in manifest.";
+            return;
+        }
+    }
+
     // Add to gDeclaredServiceHalMap if getRawServiceInternal() returns (even if
     // the returned HAL is null). getRawServiceInternal() won't return if the
     // HAL is in the VINTF but unable to start.
@@ -235,6 +252,7 @@
     const Result<ServiceInterfacesMap> service_interfaces_map =
             android::init::GetOnDeviceServiceInterfacesMap();
     ASSERT_RESULT_OK(service_interfaces_map);
+    auto service_manager = ::android::hardware::defaultServiceManager();
 
     std::map<std::string, std::set<FqInstance>> hidl_interfaces_map;
 
@@ -253,7 +271,7 @@
                 ASSERT_TRUE(fqInstance.setTo(interface))
                         << "Unable to parse interface: '" << interface << "'";
 
-                std::thread(GetHal, service, fqInstance).detach();
+                std::thread(GetHal, service_manager, service, fqInstance).detach();
                 hidl_interfaces_map[service].insert(fqInstance);
             }
         }
diff --git a/vintfdata/README.md b/vintfdata/README.md
index cfc1da7..6116757 100644
--- a/vintfdata/README.md
+++ b/vintfdata/README.md
@@ -70,7 +70,7 @@
 Execute the following, replacing the argument with the level to freeze:
 
 ```shell script
-lunch cf_x86_phone-userdebug # or any generic target
+lunch aosp_arm64
 LEVEL=5
 ./freeze.sh ${LEVEL}
 ```
diff --git a/vintfdata/device_compatibility_matrix.default.xml b/vintfdata/device_compatibility_matrix.default.xml
index eaa513e..70d23e2 100644
--- a/vintfdata/device_compatibility_matrix.default.xml
+++ b/vintfdata/device_compatibility_matrix.default.xml
@@ -1,5 +1,5 @@
 <compatibility-matrix version="1.0" type="device">
-    <hal format="hidl" optional="false">
+    <hal format="hidl" optional="true">
         <name>android.hidl.manager</name>
         <version>1.0</version>
         <interface>
diff --git a/vintfdata/frozen/8.xml b/vintfdata/frozen/8.xml
new file mode 100644
index 0000000..db34f63
--- /dev/null
+++ b/vintfdata/frozen/8.xml
@@ -0,0 +1,101 @@
+<compatibility-matrix version="7.0" type="device">
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.cameraservice.service</name>
+        <interface>
+            <name>ICameraService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.location.altitude</name>
+        <interface>
+            <name>IAltitudeService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.sensorservice</name>
+        <interface>
+            <name>ISensorManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.frameworks.sensorservice</name>
+        <version>1.0</version>
+        <interface>
+            <name>ISensorManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.stats</name>
+        <version>2</version>
+        <interface>
+            <name>IStats</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hardware.media.c2</name>
+        <version>1.2</version>
+        <interface>
+            <name>IComponentStore</name>
+            <instance>software</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.allocator</name>
+        <version>1.0</version>
+        <interface>
+            <name>IAllocator</name>
+            <instance>ashmem</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.manager</name>
+        <version>1.2</version>
+        <interface>
+            <name>IServiceManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.memory</name>
+        <version>1.0</version>
+        <interface>
+            <name>IMapper</name>
+            <instance>ashmem</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.token</name>
+        <version>1.0</version>
+        <interface>
+            <name>ITokenManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.system.keystore2</name>
+        <version>3</version>
+        <interface>
+            <name>IKeystoreService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.system.net.netd</name>
+        <interface>
+            <name>INetd</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.system.suspend</name>
+        <interface>
+            <name>ISystemSuspend</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/vintfdata/manifest.xml b/vintfdata/manifest.xml
index 9d7bfcb..b93205c 100644
--- a/vintfdata/manifest.xml
+++ b/vintfdata/manifest.xml
@@ -1,14 +1,5 @@
 <manifest version="1.0" type="framework">
-    <hal>
-        <name>android.hidl.manager</name>
-        <transport>hwbinder</transport>
-        <version>1.2</version>
-        <interface>
-            <name>IServiceManager</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal>
+    <hal format="hidl">
         <name>android.hidl.memory</name>
         <transport arch="32+64">passthrough</transport>
         <version>1.0</version>
@@ -17,16 +8,7 @@
             <instance>ashmem</instance>
         </interface>
     </hal>
-    <hal>
-        <name>android.hidl.token</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>ITokenManager</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal max-level="6">
+    <hal format="hidl" max-level="6">
         <name>android.frameworks.displayservice</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -40,7 +22,7 @@
         `ioprio <class> <priority>`. For more information, see
         system/core/init/README.md
     -->
-    <hal max-level="5">
+    <hal format="hidl" max-level="5">
         <name>android.frameworks.schedulerservice</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -49,7 +31,12 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal>
+    <hal format="aidl">
+        <name>android.frameworks.sensorservice</name>
+        <version>1</version>
+        <fqname>ISensorManager/default</fqname>
+    </hal>
+    <hal format="hidl">
         <name>android.frameworks.sensorservice</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -58,7 +45,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal>
+    <hal format="hidl" max-level="7">
         <name>android.system.net.netd</name>
         <transport>hwbinder</transport>
         <version>1.1</version>
@@ -67,7 +54,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal>
+    <hal format="hidl" max-level="7">
         <name>android.system.wifi.keystore</name>
         <transport>hwbinder</transport>
         <version>1.0</version>