diff --git a/bluetooth/1.0/default/bluetooth_hci.cc b/bluetooth/1.0/default/bluetooth_hci.cc
index fec5b81..8eccfc7 100644
--- a/bluetooth/1.0/default/bluetooth_hci.cc
+++ b/bluetooth/1.0/default/bluetooth_hci.cc
@@ -15,9 +15,10 @@
 //
 
 #define LOG_TAG "android.hardware.bluetooth@1.0-impl"
+#include "bluetooth_hci.h"
+
 #include <utils/Log.h>
 
-#include "bluetooth_hci.h"
 #include "vendor_interface.h"
 
 namespace android {
@@ -38,59 +39,77 @@
       uint64_t /*cookie*/,
       const wp<::android::hidl::base::V1_0::IBase>& /*who*/) {
     ALOGE("BluetoothDeathRecipient::serviceDied - Bluetooth service died");
+    has_died_ = true;
     mHci->close();
   }
   sp<IBluetoothHci> mHci;
+  bool getHasDied() const { return has_died_; }
+  void setHasDied(bool has_died) { has_died_ = has_died; }
+
+ private:
+  bool has_died_;
 };
 
 BluetoothHci::BluetoothHci()
-    : deathRecipient(new BluetoothDeathRecipient(this)) {}
+    : death_recipient_(new BluetoothDeathRecipient(this)) {}
 
 Return<void> BluetoothHci::initialize(
     const ::android::sp<IBluetoothHciCallbacks>& cb) {
-  ALOGW("BluetoothHci::initialize()");
-  cb->linkToDeath(deathRecipient, 0);
-  event_cb_ = cb;
+  ALOGI("BluetoothHci::initialize()");
+  if (cb == nullptr) {
+    ALOGE("cb == nullptr! -> Unable to call initializationComplete(ERR)");
+    return Void();
+  }
+
+  death_recipient_->setHasDied(false);
+  cb->linkToDeath(death_recipient_, 0);
 
   bool rc = VendorInterface::Initialize(
-      [this](bool status) {
-        auto hidl_status = event_cb_->initializationComplete(
+      [cb](bool status) {
+        auto hidl_status = cb->initializationComplete(
             status ? Status::SUCCESS : Status::INITIALIZATION_ERROR);
         if (!hidl_status.isOk()) {
           ALOGE("VendorInterface -> Unable to call initializationComplete()");
         }
       },
-      [this](const hidl_vec<uint8_t>& packet) {
-        auto hidl_status = event_cb_->hciEventReceived(packet);
+      [cb](const hidl_vec<uint8_t>& packet) {
+        auto hidl_status = cb->hciEventReceived(packet);
         if (!hidl_status.isOk()) {
           ALOGE("VendorInterface -> Unable to call hciEventReceived()");
         }
       },
-      [this](const hidl_vec<uint8_t>& packet) {
-        auto hidl_status = event_cb_->aclDataReceived(packet);
+      [cb](const hidl_vec<uint8_t>& packet) {
+        auto hidl_status = cb->aclDataReceived(packet);
         if (!hidl_status.isOk()) {
           ALOGE("VendorInterface -> Unable to call aclDataReceived()");
         }
       },
-      [this](const hidl_vec<uint8_t>& packet) {
-        auto hidl_status = event_cb_->scoDataReceived(packet);
+      [cb](const hidl_vec<uint8_t>& packet) {
+        auto hidl_status = cb->scoDataReceived(packet);
         if (!hidl_status.isOk()) {
           ALOGE("VendorInterface -> Unable to call scoDataReceived()");
         }
       });
   if (!rc) {
-    auto hidl_status =
-        event_cb_->initializationComplete(Status::INITIALIZATION_ERROR);
+    auto hidl_status = cb->initializationComplete(Status::INITIALIZATION_ERROR);
     if (!hidl_status.isOk()) {
       ALOGE("VendorInterface -> Unable to call initializationComplete(ERR)");
     }
   }
+
+  unlink_cb_ = [cb](sp<BluetoothDeathRecipient>& death_recipient) {
+    if (death_recipient->getHasDied())
+      ALOGI("Skipping unlink call, service died.");
+    else
+      cb->unlinkToDeath(death_recipient);
+  };
+
   return Void();
 }
 
 Return<void> BluetoothHci::close() {
-  ALOGW("BluetoothHci::close()");
-  event_cb_->unlinkToDeath(deathRecipient);
+  ALOGI("BluetoothHci::close()");
+  unlink_cb_(death_recipient_);
   VendorInterface::Shutdown();
   return Void();
 }
diff --git a/bluetooth/1.0/default/bluetooth_hci.h b/bluetooth/1.0/default/bluetooth_hci.h
index 4f92231..6912405 100644
--- a/bluetooth/1.0/default/bluetooth_hci.h
+++ b/bluetooth/1.0/default/bluetooth_hci.h
@@ -44,8 +44,8 @@
 
  private:
   void sendDataToController(const uint8_t type, const hidl_vec<uint8_t>& data);
-  ::android::sp<IBluetoothHciCallbacks> event_cb_;
-  ::android::sp<BluetoothDeathRecipient> deathRecipient;
+  ::android::sp<BluetoothDeathRecipient> death_recipient_;
+  std::function<void(sp<BluetoothDeathRecipient>&)> unlink_cb_;
 };
 
 extern "C" IBluetoothHci* HIDL_FETCH_IBluetoothHci(const char* name);
diff --git a/configstore/1.0/default/Android.mk b/configstore/1.0/default/Android.mk
index b168029..e017cfd 100644
--- a/configstore/1.0/default/Android.mk
+++ b/configstore/1.0/default/Android.mk
@@ -2,25 +2,6 @@
 
 ################################################################################
 include $(CLEAR_VARS)
-LOCAL_MODULE := android.hardware.configstore@1.0-impl
-LOCAL_PROPRIETARY_MODULE := true
-LOCAL_MODULE_CLASS := SHARED_LIBRARIES
-LOCAL_MODULE_RELATIVE_PATH := hw
-
-include $(LOCAL_PATH)/surfaceflinger.mk
-
-LOCAL_SHARED_LIBRARIES := \
-    libbase \
-    libhidlbase \
-    libhidltransport \
-    libutils \
-    android.hardware.configstore@1.0 \
-    android.hidl.base@1.0
-
-include $(BUILD_SHARED_LIBRARY)
-
-################################################################################
-include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.configstore@1.0-service
 LOCAL_PROPRIETARY_MODULE := true
 LOCAL_MODULE_CLASS := EXECUTABLES
@@ -28,13 +9,14 @@
 LOCAL_INIT_RC := android.hardware.configstore@1.0-service.rc
 LOCAL_SRC_FILES:= service.cpp
 
+include $(LOCAL_PATH)/surfaceflinger.mk
+
 LOCAL_SHARED_LIBRARIES := \
-    liblog \
-    libdl \
-    libutils \
+    android.hardware.configstore@1.0 \
     libhidlbase \
     libhidltransport \
-    android.hardware.configstore@1.0 \
+    libbase \
+    liblog \
+    libutils \
 
 include $(BUILD_EXECUTABLE)
-
diff --git a/configstore/1.0/default/SurfaceFlingerConfigs.cpp b/configstore/1.0/default/SurfaceFlingerConfigs.cpp
index 5d62b15..acc3d1f 100644
--- a/configstore/1.0/default/SurfaceFlingerConfigs.cpp
+++ b/configstore/1.0/default/SurfaceFlingerConfigs.cpp
@@ -29,12 +29,6 @@
     return Void();
 }
 
-// Methods from ::android::hidl::base::V1_0::IBase follow.
-
-ISurfaceFlingerConfigs* HIDL_FETCH_ISurfaceFlingerConfigs(const char* /* name */) {
-    return new SurfaceFlingerConfigs();
-}
-
 }  // namespace implementation
 }  // namespace V1_0
 }  // namespace configstore
diff --git a/configstore/1.0/default/SurfaceFlingerConfigs.h b/configstore/1.0/default/SurfaceFlingerConfigs.h
index c9652fc..5bdf7bb 100644
--- a/configstore/1.0/default/SurfaceFlingerConfigs.h
+++ b/configstore/1.0/default/SurfaceFlingerConfigs.h
@@ -31,8 +31,6 @@
 
 };
 
-extern "C" ISurfaceFlingerConfigs* HIDL_FETCH_ISurfaceFlingerConfigs(const char* name);
-
 }  // namespace implementation
 }  // namespace V1_0
 }  // namespace configstore
diff --git a/configstore/1.0/default/service.cpp b/configstore/1.0/default/service.cpp
index cb04215..60b69ab 100644
--- a/configstore/1.0/default/service.cpp
+++ b/configstore/1.0/default/service.cpp
@@ -17,13 +17,15 @@
 #define LOG_TAG "android.hardware.configstore@1.0-service"
 
 #include <android/hardware/configstore/1.0/ISurfaceFlingerConfigs.h>
-#include <hidl/LegacySupport.h>
+#include <hidl/HidlTransportSupport.h>
 
-using android::hardware::configstore::V1_0::ISurfaceFlingerConfigs;
+#include "SurfaceFlingerConfigs.h"
+
 using android::hardware::configureRpcThreadpool;
-using android::hardware::registerPassthroughServiceImplementation;
 using android::hardware::joinRpcThreadpool;
-
+using android::hardware::configstore::V1_0::ISurfaceFlingerConfigs;
+using android::hardware::configstore::V1_0::implementation::SurfaceFlingerConfigs;
+using android::sp;
 using android::status_t;
 using android::OK;
 
@@ -31,9 +33,8 @@
     // TODO(b/34857894): tune the max thread count.
     configureRpcThreadpool(10, true);
 
-    status_t status;
-
-    status = registerPassthroughServiceImplementation<ISurfaceFlingerConfigs>();
+    sp<ISurfaceFlingerConfigs> surfaceFlingerConfigs = new SurfaceFlingerConfigs;
+    status_t status = surfaceFlingerConfigs->registerAsService();
     LOG_ALWAYS_FATAL_IF(status != OK, "Could not register ISurfaceFlingerConfigs");
 
     // other interface registration comes here
diff --git a/nfc/1.0/default/Nfc.cpp b/nfc/1.0/default/Nfc.cpp
index c610406..d337a36 100644
--- a/nfc/1.0/default/Nfc.cpp
+++ b/nfc/1.0/default/Nfc.cpp
@@ -12,7 +12,7 @@
 namespace V1_0 {
 namespace implementation {
 
-sp<INfcClientCallback> Nfc::mCallback = NULL;
+sp<INfcClientCallback> Nfc::mCallback = nullptr;
 
 Nfc::Nfc(nfc_nci_device_t* device) : mDevice(device),
     mDeathRecipient(new NfcDeathRecipient(this)) {
@@ -21,35 +21,58 @@
 // Methods from ::android::hardware::nfc::V1_0::INfc follow.
 ::android::hardware::Return<NfcStatus> Nfc::open(const sp<INfcClientCallback>& clientCallback)  {
     mCallback = clientCallback;
+
+    if (mDevice == nullptr || mCallback == nullptr) {
+        return NfcStatus::FAILED;
+    }
     mCallback->linkToDeath(mDeathRecipient, 0 /*cookie*/);
     int ret = mDevice->open(mDevice, eventCallback, dataCallback);
     return ret == 0 ? NfcStatus::OK : NfcStatus::FAILED;
 }
 
 ::android::hardware::Return<uint32_t> Nfc::write(const hidl_vec<uint8_t>& data)  {
+    if (mDevice == nullptr) {
+        return -1;
+    }
     return mDevice->write(mDevice, data.size(), &data[0]);
 }
 
 ::android::hardware::Return<NfcStatus> Nfc::coreInitialized(const hidl_vec<uint8_t>& data)  {
     hidl_vec<uint8_t> copy = data;
+
+    if (mDevice == nullptr) {
+        return NfcStatus::FAILED;
+    }
     int ret = mDevice->core_initialized(mDevice, &copy[0]);
     return ret == 0 ? NfcStatus::OK : NfcStatus::FAILED;
 }
 
 ::android::hardware::Return<NfcStatus> Nfc::prediscover()  {
+    if (mDevice == nullptr) {
+        return NfcStatus::FAILED;
+    }
     return mDevice->pre_discover(mDevice) ? NfcStatus::FAILED : NfcStatus::OK;
 }
 
 ::android::hardware::Return<NfcStatus> Nfc::close()  {
+    if (mDevice == nullptr || mCallback == nullptr) {
+        return NfcStatus::FAILED;
+    }
     mCallback->unlinkToDeath(mDeathRecipient);
     return mDevice->close(mDevice) ? NfcStatus::FAILED : NfcStatus::OK;
 }
 
 ::android::hardware::Return<NfcStatus> Nfc::controlGranted()  {
+    if (mDevice == nullptr) {
+        return NfcStatus::FAILED;
+    }
     return mDevice->control_granted(mDevice) ? NfcStatus::FAILED : NfcStatus::OK;
 }
 
 ::android::hardware::Return<NfcStatus> Nfc::powerCycle()  {
+    if (mDevice == nullptr) {
+        return NfcStatus::FAILED;
+    }
     return mDevice->power_cycle(mDevice) ? NfcStatus::FAILED : NfcStatus::OK;
 }
 
@@ -57,11 +80,10 @@
 INfc* HIDL_FETCH_INfc(const char * /*name*/) {
     nfc_nci_device_t* nfc_device;
     int ret = 0;
-    const hw_module_t* hw_module = NULL;
+    const hw_module_t* hw_module = nullptr;
 
     ret = hw_get_module (NFC_NCI_HARDWARE_MODULE_ID, &hw_module);
-    if (ret == 0)
-    {
+    if (ret == 0) {
         ret = nfc_nci_open (hw_module, &nfc_device);
         if (ret != 0) {
             ALOGE ("nfc_nci_open failed: %d", ret);
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
index 5fa11fc..f704520 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
@@ -417,6 +417,23 @@
 }
 
 /*
+ * Test IRadio.setCdmaSubscriptionSource() for the response returned.
+ */
+TEST_F(RadioHidlTest, setCdmaSubscriptionSource) {
+    int serial = 1;
+
+    radio->setCdmaSubscriptionSource(++serial, CdmaSubscriptionSource::RUIM_SIM);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp->rspInfo.serial);
+
+    if (cardStatus.cardState == CardState::ABSENT) {
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::SIM_ABSENT
+                || radioRsp->rspInfo.error == RadioError::SUBSCRIPTION_NOT_AVAILABLE);
+    }
+}
+
+/*
  * Test IRadio.getVoiceRadioTechnology() for the response returned.
  */
 TEST_F(RadioHidlTest, getVoiceRadioTechnology) {
@@ -455,7 +472,7 @@
     int serial = 1;
 
     // TODO(sanketpadawe): RIL crashes with value of rate = 10
-    radio->setCellInfoListRate(++serial, 0);
+    radio->setCellInfoListRate(++serial, 10);
     EXPECT_EQ(std::cv_status::no_timeout, wait());
     EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp->rspInfo.type);
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp b/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp
index 3638ccb..fa2871d 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp
@@ -28,8 +28,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE
-                || radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS);
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -87,8 +86,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::INVALID_STATE
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -106,8 +104,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::INVALID_STATE
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -125,8 +122,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::INVALID_STATE
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -144,8 +140,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::INVALID_STATE
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -163,8 +158,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::INVALID_STATE
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -182,8 +176,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::NONE);
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -218,8 +211,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::INVALID_STATE
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -319,8 +311,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::INVALID_STATE
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -358,10 +349,29 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_STATE
+                || radioRsp->rspInfo.error == RadioError::MODEM_ERR
+                || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
+    }
+}
+
+/*
+ * Test IRadio.sendCDMAFeatureCode() for the response returned.
+ */
+TEST_F(RadioHidlTest, sendCDMAFeatureCode) {
+    int serial = 1;
+
+    radio->sendCDMAFeatureCode(serial, hidl_string());
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp->rspInfo.serial);
+
+    if (cardStatus.cardState == CardState::ABSENT) {
         ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
                 || radioRsp->rspInfo.error == RadioError::INVALID_STATE
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
-                || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
+                || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR
+                || radioRsp->rspInfo.error == RadioError::SYSTEM_ERR);
     }
 }
 
@@ -414,8 +424,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::SYSTEM_ERR
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::SYSTEM_ERR
                 || radioRsp->rspInfo.error == RadioError::MODEM_ERR
                 || radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
     }
@@ -450,8 +459,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS
-                || radioRsp->rspInfo.error == RadioError::NONE);
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
diff --git a/radio/1.0/vts/functional/radio_response.cpp b/radio/1.0/vts/functional/radio_response.cpp
index 8759003..c889a18 100644
--- a/radio/1.0/vts/functional/radio_response.cpp
+++ b/radio/1.0/vts/functional/radio_response.cpp
@@ -496,7 +496,9 @@
     return Void();
 }
 
-Return<void> RadioResponse::setCdmaSubscriptionSourceResponse(const RadioResponseInfo& /*info*/) {
+Return<void> RadioResponse::setCdmaSubscriptionSourceResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent.notify();
     return Void();
 }
 
@@ -539,7 +541,9 @@
     return Void();
 }
 
-Return<void> RadioResponse::sendCDMAFeatureCodeResponse(const RadioResponseInfo& /*info*/) {
+Return<void> RadioResponse::sendCDMAFeatureCodeResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent.notify();
     return Void();
 }
 
diff --git a/tests/baz/1.0/default/Baz.cpp b/tests/baz/1.0/default/Baz.cpp
index 6252fbe..875fe65 100644
--- a/tests/baz/1.0/default/Baz.cpp
+++ b/tests/baz/1.0/default/Baz.cpp
@@ -1,3 +1,19 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 #include "Baz.h"
 #include <android-base/logging.h>
 
@@ -26,150 +42,6 @@
     return Void();
 }
 
-// TODO(b/35703683) : replace usage of below methods with toString()
-
-static std::string to_string(const IBaz::Foo::Bar &bar);
-static std::string to_string(const IBaz::Foo &foo);
-static std::string to_string(const hidl_string &s);
-static std::string to_string(bool x);
-static std::string to_string(const IBaz::StringMatrix5x3 &M);
-
-template<typename T, size_t SIZE>
-static std::string to_string(const hidl_array<T, SIZE> &array);
-
-template<size_t SIZE>
-static std::string to_string(const hidl_array<uint8_t, SIZE> &array);
-
-template<typename T>
-static std::string to_string(const hidl_vec<T> &vec) {
-    std::string out;
-    out = "[";
-    for (size_t i = 0; i < vec.size(); ++i) {
-        if (i > 0) {
-            out += ", ";
-        }
-        out += to_string(vec[i]);
-    }
-    out += "]";
-
-    return out;
-}
-
-template<typename T, size_t SIZE>
-static std::string to_string(const hidl_array<T, SIZE> &array) {
-    std::string out;
-    out = "[";
-    for (size_t i = 0; i < SIZE; ++i) {
-        if (i > 0) {
-            out += ", ";
-        }
-        out += to_string(array[i]);
-    }
-    out += "]";
-
-    return out;
-}
-
-template<size_t SIZE>
-static std::string to_string(const hidl_array<uint8_t, SIZE> &array) {
-    std::string out;
-    for (size_t i = 0; i < SIZE; ++i) {
-        if (i > 0) {
-            out += ":";
-        }
-
-        char tmp[3];
-        sprintf(tmp, "%02x", array[i]);
-
-        out += tmp;
-    }
-
-    return out;
-}
-
-template<typename T, size_t SIZE1, size_t SIZE2>
-static std::string to_string(const hidl_array<T, SIZE1, SIZE2> &array) {
-    std::string out;
-    out = "[";
-    for (size_t i = 0; i < SIZE1; ++i) {
-        if (i > 0) {
-            out += ", ";
-        }
-
-        out += "[";
-        for (size_t j = 0; j < SIZE2; ++j) {
-            if (j > 0) {
-                out += ", ";
-            }
-
-            out += to_string(array[i][j]);
-        }
-        out += "]";
-    }
-    out += "]";
-
-    return out;
-}
-
-static std::string to_string(bool x) {
-    return x ? "true" : "false";
-}
-
-static std::string to_string(const hidl_string &s) {
-    return std::string("'") + s.c_str() + "'";
-}
-
-static std::string to_string(const IBaz::Foo::Bar &bar) {
-    std::string out;
-    out = "Bar(";
-    out += "z = " + to_string(bar.z) + ", ";
-    out += "s = '" + std::string(bar.s.c_str()) + "'";
-    out += ")";
-
-    return out;
-}
-
-static std::string to_string(const IBaz::Foo &foo) {
-    std::string out;
-    out = "Foo(";
-    out += "x = " + to_string(foo.x) + ", ";
-    out += "y = " + to_string(foo.y) + ", ";
-    out += "aaa = " + to_string(foo.aaa);
-    out += ")";
-
-    return out;
-}
-
-static std::string to_string(const IBaz::StringMatrix5x3 &M) {
-    return to_string(M.s);
-}
-
-static std::string VectorOfArray_to_string(const IBaz::VectorOfArray &in) {
-    std::string out;
-    out += "VectorOfArray(";
-
-    for (size_t i = 0; i < in.addresses.size(); ++i) {
-        if (i > 0) {
-            out += ", ";
-        }
-
-        for (size_t j = 0; j < 6; ++j) {
-            if (j > 0) {
-                out += ":";
-            }
-
-            char tmp[3];
-            sprintf(tmp, "%02x", in.addresses[i][j]);
-
-            out += tmp;
-        }
-    }
-
-    out += ")";
-
-    return out;
-}
-
 // Methods from ::android::hardware::tests::baz::V1_0::IBase follow.
 Return<void> Baz::someBaseMethod() {
     LOG(INFO) << "Baz::someBaseMethod";
@@ -178,20 +50,14 @@
 }
 
 Return<bool> Baz::someBoolMethod(bool x) {
-    LOG(INFO) << "Baz::someBoolMethod(" << to_string(x) << ")";
+    LOG(INFO) << "Baz::someBoolMethod(" << std::to_string(x) << ")";
 
     return !x;
 }
 
 Return<void> Baz::someBoolArrayMethod(const hidl_array<bool, 3>& x,
                                       someBoolArrayMethod_cb _hidl_cb) {
-    LOG(INFO) << "Baz::someBoolArrayMethod("
-        << to_string(x[0])
-        << ", "
-        << to_string(x[1])
-        << ", "
-        << to_string(x[2])
-        << ")";
+    LOG(INFO) << "Baz::someBoolArrayMethod(" << toString(x) << ")";
 
     hidl_array<bool, 4> out;
     out[0] = !x[0];
@@ -205,7 +71,7 @@
 }
 
 Return<void> Baz::someBoolVectorMethod(const hidl_vec<bool>& x, someBoolVectorMethod_cb _hidl_cb) {
-    LOG(INFO) << "Baz::someBoolVectorMethod(" << to_string(x) << ")";
+    LOG(INFO) << "Baz::someBoolVectorMethod(" << toString(x) << ")";
 
     hidl_vec<bool> out;
     out.resize(x.size());
@@ -220,7 +86,7 @@
 
 Return<void> Baz::someOtherBaseMethod(const IBase::Foo& foo, someOtherBaseMethod_cb _hidl_cb) {
     LOG(INFO) << "Baz::someOtherBaseMethod "
-              << to_string(foo);
+              << toString(foo);
 
     _hidl_cb(foo);
 
@@ -230,7 +96,7 @@
 Return<void> Baz::someMethodWithFooArrays(const hidl_array<IBase::Foo, 2>& fooInput,
                                           someMethodWithFooArrays_cb _hidl_cb) {
     LOG(INFO) << "Baz::someMethodWithFooArrays "
-              << to_string(fooInput);
+              << toString(fooInput);
 
     hidl_array<IBaz::Foo, 2> fooOutput;
     fooOutput[0] = fooInput[1];
@@ -244,7 +110,7 @@
 Return<void> Baz::someMethodWithFooVectors(const hidl_vec<IBase::Foo>& fooInput,
                                            someMethodWithFooVectors_cb _hidl_cb) {
     LOG(INFO) << "Baz::someMethodWithFooVectors "
-              << to_string(fooInput);
+              << toString(fooInput);
 
     hidl_vec<IBaz::Foo> fooOutput;
     fooOutput.resize(2);
@@ -259,7 +125,7 @@
 Return<void> Baz::someMethodWithVectorOfArray(const IBase::VectorOfArray& in,
                                               someMethodWithVectorOfArray_cb _hidl_cb) {
     LOG(INFO) << "Baz::someMethodWithVectorOfArray "
-              << VectorOfArray_to_string(in);
+              << toString(in);
 
     IBase::VectorOfArray out;
 
@@ -278,7 +144,7 @@
 Return<void> Baz::someMethodTakingAVectorOfArray(const hidl_vec<hidl_array<uint8_t, 6>>& in,
                                                  someMethodTakingAVectorOfArray_cb _hidl_cb) {
     LOG(INFO) << "Baz::someMethodTakingAVectorOfArray "
-              << to_string(in);
+              << toString(in);
 
     const size_t n = in.size();
 
@@ -295,7 +161,7 @@
 }
 
 Return<void> Baz::transpose(const IBase::StringMatrix5x3& in, transpose_cb _hidl_cb) {
-    LOG(INFO) << "Baz::transpose " << to_string(in);
+    LOG(INFO) << "Baz::transpose " << toString(in);
 
     IBase::StringMatrix3x5 out;
     for (size_t i = 0; i < 3; ++i) {
@@ -310,7 +176,7 @@
 }
 
 Return<void> Baz::transpose2(const hidl_array<hidl_string, 5, 3>& in, transpose2_cb _hidl_cb) {
-    LOG(INFO) << "Baz::transpose2 " << to_string(in);
+    LOG(INFO) << "Baz::transpose2 " << toString(in);
 
     hidl_array<hidl_string, 3, 5> out;
     for (size_t i = 0; i < 3; ++i) {
@@ -443,7 +309,7 @@
 Return<void> Baz::haveSomeStrings(const hidl_array<hidl_string, 3>& array,
                                   haveSomeStrings_cb _hidl_cb) {
     LOG(INFO) << "haveSomeStrings("
-              << to_string(array)
+              << toString(array)
               << ")";
 
     hidl_array<hidl_string, 2> result;
@@ -457,7 +323,7 @@
 
 Return<void> Baz::haveAStringVec(const hidl_vec<hidl_string>& vector,
                                  haveAStringVec_cb _hidl_cb) {
-    LOG(INFO) << "haveAStringVec(" << to_string(vector) << ")";
+    LOG(INFO) << "haveAStringVec(" << toString(vector) << ")";
 
     hidl_vec<hidl_string> result;
     result.resize(2);
diff --git a/wifi/1.0/Android.mk b/wifi/1.0/Android.mk
index eabc63d..82409de 100644
--- a/wifi/1.0/Android.mk
+++ b/wifi/1.0/Android.mk
@@ -226,6 +226,44 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (NanDataPathSecurityConfig)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/NanDataPathSecurityConfig.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.NanDataPathSecurityConfig
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (NanDataPathSecurityType)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/NanDataPathSecurityType.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.NanDataPathSecurityType
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (NanDebugConfig)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/NanDebugConfig.java
@@ -359,6 +397,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (NanParamSizeLimits)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/NanParamSizeLimits.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.NanParamSizeLimits
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (NanPublishRequest)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/NanPublishRequest.java
@@ -2048,6 +2105,44 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (NanDataPathSecurityConfig)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/NanDataPathSecurityConfig.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.NanDataPathSecurityConfig
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (NanDataPathSecurityType)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/NanDataPathSecurityType.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.NanDataPathSecurityType
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (NanDebugConfig)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/NanDebugConfig.java
@@ -2181,6 +2276,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (NanParamSizeLimits)
+#
+GEN := $(intermediates)/android/hardware/wifi/V1_0/NanParamSizeLimits.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.wifi@1.0::types.NanParamSizeLimits
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (NanPublishRequest)
 #
 GEN := $(intermediates)/android/hardware/wifi/V1_0/NanPublishRequest.java
diff --git a/wifi/1.0/default/hidl_struct_util.cpp b/wifi/1.0/default/hidl_struct_util.cpp
index fb93c5a..c005213 100644
--- a/wifi/1.0/default/hidl_struct_util.cpp
+++ b/wifi/1.0/default/hidl_struct_util.cpp
@@ -973,17 +973,41 @@
         hidl_request.baseConfigs.disableMatchExpirationIndication ? 0x2 : 0x0;
   legacy_request->recv_indication_cfg |=
         hidl_request.baseConfigs.disableFollowupReceivedIndication ? 0x4 : 0x0;
-  legacy_request->cipher_type = (unsigned int) hidl_request.baseConfigs.cipherType;
-  legacy_request->pmk_len = hidl_request.baseConfigs.pmk.size();
-  if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
-    LOG(ERROR) << "convertHidlNanPublishRequestToLegacy: pmk_len too large";
-    return false;
+  legacy_request->cipher_type = (unsigned int) hidl_request.baseConfigs.securityConfig.cipherType;
+  if (hidl_request.baseConfigs.securityConfig.securityType == NanDataPathSecurityType::PMK) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PMK;
+    legacy_request->key_info.body.pmk_info.pmk_len =
+        hidl_request.baseConfigs.securityConfig.pmk.size();
+    if (legacy_request->key_info.body.pmk_info.pmk_len > NAN_PMK_INFO_LEN) {
+      LOG(ERROR) << "convertHidlNanPublishRequestToLegacy: pmk_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.pmk_info.pmk,
+          hidl_request.baseConfigs.securityConfig.pmk.data(),
+          legacy_request->key_info.body.pmk_info.pmk_len);
   }
-  memcpy(legacy_request->pmk,
-        hidl_request.baseConfigs.pmk.data(),
-        legacy_request->pmk_len);
-  legacy_request->sdea_params.security_cfg = hidl_request.baseConfigs.securityEnabledInNdp ?
-        legacy_hal::NAN_DP_CONFIG_SECURITY : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
+  if (hidl_request.baseConfigs.securityConfig.securityType
+        == NanDataPathSecurityType::PASSPHRASE) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
+    legacy_request->key_info.body.passphrase_info.passphrase_len =
+        hidl_request.baseConfigs.securityConfig.passphrase.size();
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            < NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanPublishRequestToLegacy: passphrase_len too small";
+      return false;
+    }
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            > NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanPublishRequestToLegacy: passphrase_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.passphrase_info.passphrase,
+          hidl_request.baseConfigs.securityConfig.passphrase.data(),
+          legacy_request->key_info.body.passphrase_info.passphrase_len);
+  }
+  legacy_request->sdea_params.security_cfg = (hidl_request.baseConfigs.securityConfig.securityType
+        != NanDataPathSecurityType::OPEN) ? legacy_hal::NAN_DP_CONFIG_SECURITY
+            : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
   legacy_request->sdea_params.ranging_state = hidl_request.baseConfigs.rangingRequired ?
         legacy_hal::NAN_RANGING_ENABLE : legacy_hal::NAN_RANGING_DISABLE;
   legacy_request->ranging_cfg.ranging_interval_msec = hidl_request.baseConfigs.rangingIntervalMsec;
@@ -1066,17 +1090,40 @@
         hidl_request.baseConfigs.disableMatchExpirationIndication ? 0x2 : 0x0;
   legacy_request->recv_indication_cfg |=
         hidl_request.baseConfigs.disableFollowupReceivedIndication ? 0x4 : 0x0;
-  legacy_request->cipher_type = (unsigned int) hidl_request.baseConfigs.cipherType;
-  legacy_request->pmk_len = hidl_request.baseConfigs.pmk.size();
-  if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
-    LOG(ERROR) << "convertHidlNanSubscribeRequestToLegacy: pmk_len too large";
-    return false;
+  legacy_request->cipher_type = (unsigned int) hidl_request.baseConfigs.securityConfig.cipherType;
+  if (hidl_request.baseConfigs.securityConfig.securityType == NanDataPathSecurityType::PMK) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PMK;
+    legacy_request->key_info.body.pmk_info.pmk_len =
+        hidl_request.baseConfigs.securityConfig.pmk.size();
+    if (legacy_request->key_info.body.pmk_info.pmk_len > NAN_PMK_INFO_LEN) {
+      LOG(ERROR) << "convertHidlNanSubscribeRequestToLegacy: pmk_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.pmk_info.pmk,
+          hidl_request.baseConfigs.securityConfig.pmk.data(),
+          legacy_request->key_info.body.pmk_info.pmk_len);
   }
-  memcpy(legacy_request->pmk,
-        hidl_request.baseConfigs.pmk.data(),
-        legacy_request->pmk_len);
-  legacy_request->sdea_params.security_cfg = hidl_request.baseConfigs.securityEnabledInNdp ?
-        legacy_hal::NAN_DP_CONFIG_SECURITY : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
+  if (hidl_request.baseConfigs.securityConfig.securityType == NanDataPathSecurityType::PASSPHRASE) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
+    legacy_request->key_info.body.passphrase_info.passphrase_len =
+        hidl_request.baseConfigs.securityConfig.passphrase.size();
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            < NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanSubscribeRequestToLegacy: passphrase_len too small";
+      return false;
+    }
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            > NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanSubscribeRequestToLegacy: passphrase_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.passphrase_info.passphrase,
+          hidl_request.baseConfigs.securityConfig.passphrase.data(),
+          legacy_request->key_info.body.passphrase_info.passphrase_len);
+  }
+  legacy_request->sdea_params.security_cfg = (hidl_request.baseConfigs.securityConfig.securityType
+          != NanDataPathSecurityType::OPEN) ? legacy_hal::NAN_DP_CONFIG_SECURITY
+              : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
   legacy_request->sdea_params.ranging_state = hidl_request.baseConfigs.rangingRequired ?
         legacy_hal::NAN_RANGING_ENABLE : legacy_hal::NAN_RANGING_DISABLE;
   legacy_request->ranging_cfg.ranging_interval_msec = hidl_request.baseConfigs.rangingIntervalMsec;
@@ -1251,8 +1298,9 @@
         (legacy_hal::NanDataPathChannelCfg) hidl_request.channelRequestType;
   legacy_request->channel = hidl_request.channel;
   strcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str());
-  legacy_request->ndp_cfg.security_cfg = hidl_request.securityRequired ?
-        legacy_hal::NAN_DP_CONFIG_SECURITY : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
+  legacy_request->ndp_cfg.security_cfg = (hidl_request.securityConfig.securityType
+        != NanDataPathSecurityType::OPEN) ? legacy_hal::NAN_DP_CONFIG_SECURITY
+            : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
   legacy_request->app_info.ndp_app_info_len = hidl_request.appInfo.size();
   if (legacy_request->app_info.ndp_app_info_len > NAN_DP_MAX_APP_INFO_LEN) {
     LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: ndp_app_info_len too large";
@@ -1260,13 +1308,43 @@
   }
   memcpy(legacy_request->app_info.ndp_app_info, hidl_request.appInfo.data(),
         legacy_request->app_info.ndp_app_info_len);
-  legacy_request->cipher_type = (unsigned int) hidl_request.cipherType;
-  legacy_request->pmk_len = hidl_request.pmk.size();
-  if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
-    LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: pmk_len too large";
+  legacy_request->cipher_type = (unsigned int) hidl_request.securityConfig.cipherType;
+  if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PMK) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PMK;
+    legacy_request->key_info.body.pmk_info.pmk_len = hidl_request.securityConfig.pmk.size();
+    if (legacy_request->key_info.body.pmk_info.pmk_len > NAN_PMK_INFO_LEN) {
+      LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: pmk_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.pmk_info.pmk,
+          hidl_request.securityConfig.pmk.data(),
+          legacy_request->key_info.body.pmk_info.pmk_len);
+  }
+  if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PASSPHRASE) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
+    legacy_request->key_info.body.passphrase_info.passphrase_len =
+        hidl_request.securityConfig.passphrase.size();
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            < NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: passphrase_len too small";
+      return false;
+    }
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            > NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: passphrase_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.passphrase_info.passphrase,
+          hidl_request.securityConfig.passphrase.data(),
+          legacy_request->key_info.body.passphrase_info.passphrase_len);
+  }
+  legacy_request->service_name_len = hidl_request.serviceNameOutOfBand.size();
+  if (legacy_request->service_name_len > NAN_MAX_SERVICE_NAME_LEN) {
+    LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: service_name_len too large";
     return false;
   }
-  memcpy(legacy_request->pmk, hidl_request.pmk.data(), legacy_request->pmk_len);
+  memcpy(legacy_request->service_name, hidl_request.serviceNameOutOfBand.data(),
+        legacy_request->service_name_len);
 
   return true;
 }
@@ -1284,8 +1362,9 @@
         legacy_hal::NAN_DP_REQUEST_ACCEPT : legacy_hal::NAN_DP_REQUEST_REJECT;
   legacy_request->ndp_instance_id = hidl_request.ndpInstanceId;
   strcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str());
-  legacy_request->ndp_cfg.security_cfg = hidl_request.securityRequired ?
-        legacy_hal::NAN_DP_CONFIG_SECURITY : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
+  legacy_request->ndp_cfg.security_cfg = (hidl_request.securityConfig.securityType
+        != NanDataPathSecurityType::OPEN) ? legacy_hal::NAN_DP_CONFIG_SECURITY
+            : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
   legacy_request->app_info.ndp_app_info_len = hidl_request.appInfo.size();
   if (legacy_request->app_info.ndp_app_info_len > NAN_DP_MAX_APP_INFO_LEN) {
     LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: ndp_app_info_len too large";
@@ -1293,13 +1372,43 @@
   }
   memcpy(legacy_request->app_info.ndp_app_info, hidl_request.appInfo.data(),
         legacy_request->app_info.ndp_app_info_len);
-  legacy_request->cipher_type = (unsigned int) hidl_request.cipherType;
-  legacy_request->pmk_len = hidl_request.pmk.size();
-  if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
-    LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: pmk_len too large";
+  legacy_request->cipher_type = (unsigned int) hidl_request.securityConfig.cipherType;
+  if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PMK) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PMK;
+    legacy_request->key_info.body.pmk_info.pmk_len = hidl_request.securityConfig.pmk.size();
+    if (legacy_request->key_info.body.pmk_info.pmk_len > NAN_PMK_INFO_LEN) {
+      LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: pmk_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.pmk_info.pmk,
+          hidl_request.securityConfig.pmk.data(),
+          legacy_request->key_info.body.pmk_info.pmk_len);
+  }
+  if (hidl_request.securityConfig.securityType == NanDataPathSecurityType::PASSPHRASE) {
+    legacy_request->key_info.key_type = legacy_hal::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
+    legacy_request->key_info.body.passphrase_info.passphrase_len =
+        hidl_request.securityConfig.passphrase.size();
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            < NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: passphrase_len too small";
+      return false;
+    }
+    if (legacy_request->key_info.body.passphrase_info.passphrase_len
+            > NAN_SECURITY_MIN_PASSPHRASE_LEN) {
+      LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: passphrase_len too large";
+      return false;
+    }
+    memcpy(legacy_request->key_info.body.passphrase_info.passphrase,
+          hidl_request.securityConfig.passphrase.data(),
+          legacy_request->key_info.body.passphrase_info.passphrase_len);
+  }
+  legacy_request->service_name_len = hidl_request.serviceNameOutOfBand.size();
+  if (legacy_request->service_name_len > NAN_MAX_SERVICE_NAME_LEN) {
+    LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: service_name_len too large";
     return false;
   }
-  memcpy(legacy_request->pmk, hidl_request.pmk.data(), legacy_request->pmk_len);
+  memcpy(legacy_request->service_name, hidl_request.serviceNameOutOfBand.data(),
+        legacy_request->service_name_len);
 
   return true;
 }
diff --git a/wifi/1.0/default/wifi_legacy_hal.cpp b/wifi/1.0/default/wifi_legacy_hal.cpp
index 5fc0228..ba57ba7 100644
--- a/wifi/1.0/default/wifi_legacy_hal.cpp
+++ b/wifi/1.0/default/wifi_legacy_hal.cpp
@@ -328,9 +328,8 @@
   wifi_error status = init_wifi_vendor_hal_func_table(&global_func_table_);
   if (status != WIFI_SUCCESS) {
     LOG(ERROR) << "Failed to initialize legacy hal function table";
-    return WIFI_ERROR_UNKNOWN;
   }
-  return WIFI_SUCCESS;
+  return status;
 }
 
 wifi_error WifiLegacyHal::start() {
diff --git a/wifi/1.0/types.hal b/wifi/1.0/types.hal
index d3845c9..17aadee 100644
--- a/wifi/1.0/types.hal
+++ b/wifi/1.0/types.hal
@@ -586,6 +586,17 @@
  */
 
 /**
+ * Size limits for parameters used in the NAN interface.
+ */
+enum NanParamSizeLimits : uint32_t {
+  /* Minimum length of Passphrase argument for data-path configuration */
+  MIN_PASSPHRASE_LENGTH = 8,
+
+  /* Maximum length of Passphrase argument for data-path configuration */
+  MAX_PASSPHRASE_LENGTH = 63,
+};
+
+/**
  * A unique short handle provided by the client to identify individual invocations of
  * certain API's like |IWifiNanIface.*|.
  */
@@ -701,6 +712,15 @@
 };
 
 /**
+ * NAN DP (data-path) security configuration options.
+ */
+enum NanDataPathSecurityType : uint32_t {
+  OPEN,       // no security
+  PMK,        // security: PMK
+  PASSPHRASE, // security: passphrase
+};
+
+/**
  * NAN band-specific configuration.
  */
 struct NanBandSpecificConfig {
@@ -910,6 +930,38 @@
 };
 
 /**
+ * Configuration of NAN data-path security.
+ */
+struct NanDataPathSecurityConfig {
+  /**
+   * Security configuration of the data-path (NDP). Security is required if not equal to
+   * |NanDataPathSecurityType.OPEN|.
+   * NAN Spec: Service Discovery Extension Attribute (SDEA) / Control / Security Required
+   */
+  NanDataPathSecurityType securityType;
+  /**
+   * Cipher type for data-paths. If |securityType| is |NanDataPathSecurityType.OPEN| then must
+   * be set to |NanCipherSuiteType.NONE|, otherwise a non-|NanCipherSuiteType.NONE| cipher suite
+   * must be specified.
+   */
+  NanCipherSuiteType cipherType;
+  /**
+   * Optional Pairwise Master Key (PMK). Must be specified (and is only used) if |securityType| is
+   * set to |NanDataPathSecurityType.PMK|.
+   * Ref: IEEE 802.11i
+   */
+  uint8_t[32] pmk;
+  /**
+   * Optional Passphrase. Must be specified (and is only used) if |securityType| is set to
+   * |NanDataPathSecurityType.PASSPHRASE|.
+   * Min length: |MIN_PASSPHRASE_LENGTH|
+   * Max length: |MAX_PASSPHRASE_LENGTH|
+   * NAN Spec: Appendix: Mapping pass-phrase to PMK for NCS-SK Cipher Suites
+   */
+  vec<uint8_t> passphrase;
+};
+
+/**
  * Configurations of NAN discovery sessions: common to publish and subscribe discovery.
  */
 struct NanDiscoveryCommonConfig {
@@ -1009,25 +1061,11 @@
    */
   bool disableFollowupReceivedIndication;
   /**
-   * Cipher type for data-paths constructed in the context of this discovery session. Must be
-   * specified as |NanCipherSuiteType.NONE| if no |pmk| is provided.
+   * Security configuration of data-paths created in the context of this discovery session. Security
+   * parameters can be overridden during the actual construction of the data-path - allowing
+   * individual data-paths to have unique PMKs or Passphrases.
    */
-  NanCipherSuiteType cipherType;
-  /**
-   * Optional Pairwise Master Key (PMK) for data-paths constructed in the context of this discovery
-   * session. A PMK can also be provided during the actual construction of the data-path (which
-   * allows for unique PMKs for each data-path). The |cipherType| must be specified if a PMK is
-   * provided.
-   * Max length: 32
-   * Ref: IEEE 802.11i
-   */
-  vec<uint8_t> pmk;
-  /**
-   * Specifies whether or not security is enabled in any data-path (NDP) constructed in the context
-   * of this discovery session.
-   * NAN Spec: Service Discovery Extension Attribute (SDEA) / Control / Security Required
-   */
-  bool securityEnabledInNdp;
+  NanDataPathSecurityConfig securityConfig;
   /**
    * Specifies whether or not there is a ranging requirement in this discovery session.
    * Ranging is only performed if all other match criteria with the peer are met. Ranging must
@@ -1213,10 +1251,9 @@
    */
   string ifaceName;
   /**
-   * Specifies whether or not security is required for the data-path being created.
-   * NAN Spec: Data Path Attributes / NDP Attribute / NDP Control / Security Present
+   * Security configuration of the requested data-path.
    */
-  bool securityRequired;
+  NanDataPathSecurityConfig securityConfig;
   /**
    * Arbitrary information communicated to the peer as part of the data-path setup process - there
    * is no semantic meaning to these bytes. They are passed-through from sender to receiver as-is
@@ -1226,17 +1263,13 @@
    */
   vec<uint8_t> appInfo;
   /**
-   * Cipher type for the data-path being requested. Must be specified as |NanCipherSuiteType.NONE|
-   * if no |pmk| is provided.
+   * A service name to be used with |passphrase| to construct a Pairwise Master Key (PMK) for the
+   * data-path. Only relevant when a data-path is requested which is not associated with a NAN
+   * discovery session - e.g. using out-of-band discovery.
+   * Constraints: same as |NanDiscoveryCommonConfig.serviceName|
+   * NAN Spec: Appendix: Mapping pass-phrase to PMK for NCS-SK Cipher Suites
    */
-  NanCipherSuiteType cipherType;
-  /**
-   * Pairwise Master Key (PMK) for the data-path being requested (if |securityRequired| is true).
-   * The |cipherType| must be specified if a PMK is provided.
-   * Max length: 32
-   * Ref: IEEE 802.11i
-   */
-  vec<uint8_t> pmk;
+  vec<uint8_t> serviceNameOutOfBand;
 };
 
 /**
@@ -1259,10 +1292,9 @@
    */
   string ifaceName;
   /**
-   * Specifies whether or not security is required for the data-path being created.
-   * NAN Spec: Data Path Attributes / NDP Attribute / NDP Control / Security Present
+   * Security configuration of the requested data-path.
    */
-  bool securityRequired;
+  NanDataPathSecurityConfig securityConfig;
   /**
    * Arbitrary information communicated to the peer as part of the data-path setup process - there
    * is no semantic meaning to these bytes. They are passed-through from sender to receiver as-is
@@ -1272,16 +1304,13 @@
    */
   vec<uint8_t> appInfo;
   /**
-   * Cipher type for the data-path being negotiated. Must be specified as |NanCipherSuiteType.NONE|
-   * if no |pmk| is provided.
+   * A service name to be used with |passphrase| to construct a Pairwise Master Key (PMK) for the
+   * data-path. Only relevant when a data-path is requested which is not associated with a NAN
+   * discovery session - e.g. using out-of-band discovery.
+   * Constraints: same as |NanDiscoveryCommonConfig.serviceName|
+   * NAN Spec: Appendix: Mapping pass-phrase to PMK for NCS-SK Cipher Suites
    */
-  NanCipherSuiteType cipherType;
-  /**
-   * Pairwise Master Key (PMK) for the data-path being negotiated (if |securityRequired| is true).
-   * The |cipherType| must be specified if a PMK is provided.
-   * Max length: 32
-   */
-  vec<uint8_t> pmk;
+  vec<uint8_t> serviceNameOutOfBand;
 };
 
 /**
diff --git a/wifi/1.0/vts/functional/Android.bp b/wifi/1.0/vts/functional/Android.bp
index 9403e98..b454a06 100644
--- a/wifi/1.0/vts/functional/Android.bp
+++ b/wifi/1.0/vts/functional/Android.bp
@@ -17,7 +17,7 @@
 cc_library_static {
     name: "VtsHalWifiV1_0TargetTestUtil",
     srcs: [
-        "VtsHalWifiV1_0TargetTest.cpp",
+
         "wifi_hidl_call_util_selftest.cpp",
         "wifi_hidl_test.cpp",
         "wifi_hidl_test_utils.cpp"],
@@ -38,6 +38,7 @@
     name: "VtsHalWifiV1_0TargetTest",
     defaults: ["hidl_defaults"],
     srcs: [
+        "VtsHalWifiV1_0TargetTest.cpp",
         "wifi_ap_iface_hidl_test.cpp",
         "wifi_chip_hidl_test.cpp",
         "wifi_p2p_iface_hidl_test.cpp",
@@ -63,7 +64,9 @@
 cc_test {
     name: "VtsHalWifiNanV1_0TargetTest",
     defaults: ["hidl_defaults"],
-    srcs: ["wifi_nan_iface_hidl_test.cpp"],
+    srcs: [
+        "VtsHalWifiV1_0TargetTest.cpp",
+        "wifi_nan_iface_hidl_test.cpp"],
     shared_libs: [
         "libbase",
         "liblog",
diff --git a/wifi/1.0/vts/functional/VtsHalWifiV1_0TargetTest.cpp b/wifi/1.0/vts/functional/VtsHalWifiV1_0TargetTest.cpp
index b56ed2b..160fcd2 100644
--- a/wifi/1.0/vts/functional/VtsHalWifiV1_0TargetTest.cpp
+++ b/wifi/1.0/vts/functional/VtsHalWifiV1_0TargetTest.cpp
@@ -20,14 +20,6 @@
 
 #include "wifi_hidl_test_utils.h"
 
-class WifiHidlEnvironment : public ::testing::Environment {
-   public:
-    virtual void SetUp() override { stopFramework(); }
-    virtual void TearDown() override { startFramework(); }
-
-   private:
-};
-
 int main(int argc, char** argv) {
     ::testing::AddGlobalTestEnvironment(new WifiHidlEnvironment);
     ::testing::InitGoogleTest(&argc, argv);
diff --git a/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp b/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
index 2d0b081..fefbd79 100644
--- a/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
+++ b/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
@@ -82,14 +82,6 @@
 }
 }  // namespace
 
-void stopFramework() {
-    ASSERT_EQ(std::system("stop"), 0);
-    stopWifi();
-    sleep(5);
-}
-
-void startFramework() { ASSERT_EQ(std::system("start"), 0); }
-
 sp<IWifi> getWifi() {
     sp<IWifi> wifi = ::testing::VtsHalHidlTargetTestBase::getService<IWifi>();
     return wifi;
diff --git a/wifi/1.0/vts/functional/wifi_hidl_test_utils.h b/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
index a723b2a..39a0eba 100644
--- a/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
+++ b/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
@@ -24,11 +24,6 @@
 #include <android/hardware/wifi/1.0/IWifiRttController.h>
 #include <android/hardware/wifi/1.0/IWifiStaIface.h>
 
-// Used to stop the android framework (wifi service) before every
-// test.
-void stopFramework();
-void startFramework();
-
 // Helper functions to obtain references to the various HIDL interface objects.
 // Note: We only have a single instance of each of these objects currently.
 // These helper functions should be modified to return vectors if we support
@@ -49,3 +44,12 @@
     android::hardware::wifi::V1_0::ChipModeId* configured_mode_id);
 // Used to trigger IWifi.stop() at the end of every test.
 void stopWifi();
+
+class WifiHidlEnvironment : public ::testing::Environment {
+ public:
+  virtual void SetUp() override {
+      stopWifi();
+      sleep(5);
+  }
+  virtual void TearDown() override {}
+};
\ No newline at end of file
diff --git a/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal b/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal
index 166ad96..173cce9 100644
--- a/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal
+++ b/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal
@@ -346,6 +346,24 @@
   };
 
   /**
+   * BSSID change Reasons.
+   */
+  enum BssidChangeReason : uint8_t {
+    /**
+     * Started association with new bssid.
+     */
+    ASSOC_START = 0,
+    /**
+     * Completed association with new bssid.
+     */
+    ASSOC_COMPLETE = 1,
+    /**
+     * Dis-association with current bssid.
+     */
+    DISASSOC = 2
+  };
+
+  /**
    * Used to indicate that a new network has been added.
    *
    * @param id Network ID allocated to the corresponding network.
@@ -466,6 +484,16 @@
   oneway onEapFailure();
 
   /**
+   * Used to indicate the change of active bssid.
+   * This is useful to figure out when the driver/firmware roams to a bssid
+   * on its own.
+   *
+   * @param reason Reason why the bssid changed.
+   * @param bssid BSSID of the corresponding AP.
+   */
+  oneway onBssidChanged(BssidChangeReason reason, Bssid bssid);
+
+  /**
    * Used to indicate the success of a WPS connection attempt.
    */
   oneway onWpsEventSuccess();