diff --git a/base/include/hidl/HidlSupport.h b/base/include/hidl/HidlSupport.h
index f6ce09b..a8eae8c 100644
--- a/base/include/hidl/HidlSupport.h
+++ b/base/include/hidl/HidlSupport.h
@@ -123,8 +123,8 @@
 private:
     void freeHandle();
 
-    details::hidl_pointer<const native_handle_t> mHandle;
-    bool mOwnsHandle;
+    details::hidl_pointer<const native_handle_t> mHandle __attribute__ ((aligned(8)));
+    bool mOwnsHandle __attribute ((aligned(8)));
 };
 
 struct hidl_string {
diff --git a/base/include/hidl/MQDescriptor.h b/base/include/hidl/MQDescriptor.h
index bf2f8a4..3ed3685 100644
--- a/base/include/hidl/MQDescriptor.h
+++ b/base/include/hidl/MQDescriptor.h
@@ -120,6 +120,14 @@
         if (kAlignmentSize % __WORDSIZE != 0) {
             details::logAlwaysFatal("Incompatible word size");
         }
+
+        /*
+         * Check if alignment to word boundary would cause an overflow.
+         */
+        if (length > SIZE_MAX - kAlignmentSize/8 + 1) {
+            details::logAlwaysFatal("Queue size too large");
+        }
+
         return (length + kAlignmentSize/8 - 1) & ~(kAlignmentSize/8 - 1U);
     }
 
diff --git a/transport/Android.bp b/transport/Android.bp
index f81d9c6..835c6e1 100644
--- a/transport/Android.bp
+++ b/transport/Android.bp
@@ -60,7 +60,6 @@
         "HidlBinderSupport.cpp",
         "HidlPassthroughSupport.cpp",
         "HidlTransportSupport.cpp",
-        "LegacySupport.cpp",
         "ServiceManagement.cpp",
         "Static.cpp"
     ],
diff --git a/transport/LegacySupport.cpp b/transport/LegacySupport.cpp
deleted file mode 100644
index ae02928..0000000
--- a/transport/LegacySupport.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define LOG_TAG "libhidltransport"
-
-#include <inttypes.h>
-
-#include <hidl/LegacySupport.h>
-
-#include <chrono>
-#include <thread>
-#include <utils/misc.h>
-#include <utils/Log.h>
-#include <utils/SystemClock.h>
-
-#include <android-base/properties.h>
-
-namespace android {
-namespace hardware {
-
-namespace details {
-
-using android::base::GetBoolProperty;
-using android::base::WaitForPropertyCreation;
-
-static const char* kPersistPropReadyProperty = "ro.persistent_properties.ready";
-static const char* kBinderizationProperty = "persist.hal.binderization";
-
-bool blockingHalBinderizationEnabled() {
-    if (!GetBoolProperty(kPersistPropReadyProperty, false)) { // not set yet
-        int64_t startTime = elapsedRealtime();
-        WaitForPropertyCreation(kPersistPropReadyProperty, std::chrono::milliseconds::max());
-        ALOGI("Waiting for %s took %" PRId64 " ms", kPersistPropReadyProperty,
-              elapsedRealtime() - startTime);
-    }
-    return GetBoolProperty(kBinderizationProperty, false);
-}
-
-void blockIfBinderizationDisabled(const std::string& interface,
-                                  const std::string& instance) {
-    // TODO(b/34274385) remove this
-
-    size_t loc = interface.find_first_of("@");
-    if (loc == std::string::npos) {
-        LOG_ALWAYS_FATAL("Bad interface name: %s", interface.c_str());
-    }
-    std::string package = interface.substr(0, loc);
-
-    // only block if this is supposed to be toggled
-    if (getTransport(interface, instance) != vintf::Transport::TOGGLED) {
-        return;
-    }
-
-    // Must wait for data to be mounted and persistant properties to be read,
-    // but only delay the start of hals which require reading this property.
-    bool enabled = blockingHalBinderizationEnabled();
-
-    if (!enabled) {
-        ALOGI("Deactivating %s/%s binderized service to"
-              " yield to passthrough implementation.",
-              interface.c_str(),
-              instance.c_str());
-        while (true) {
-            sleep(UINT_MAX);
-        }
-    }
-}
-}  // namespace details
-
-}  // namespace hardware
-}  // namespace android
diff --git a/transport/base/1.0/IBase.hal b/transport/base/1.0/IBase.hal
index 9301c65..e862ec8 100644
--- a/transport/base/1.0/IBase.hal
+++ b/transport/base/1.0/IBase.hal
@@ -41,7 +41,7 @@
      *     package android.hardware.foo@1.0;
      *     interface IParent {};
      *     interface IChild extends IParent {};
-     * Calling interfaceChain on an IChild object will yield the following:
+     * Calling interfaceChain on an IChild object must yield the following:
      *     ["android.hardware.foo@1.0::IChild",
      *      "android.hardware.foo@1.0::IParent"
      *      "android.hidl.base@1.0::IBase"]
@@ -57,7 +57,7 @@
      *     package android.hardware.foo@1.0;
      *     interface IParent {};
      *     interface IChild extends IParent {};
-     * Calling interfaceDescriptor on an IChild object will yield
+     * Calling interfaceDescriptor on an IChild object must yield
      *     "android.hardware.foo@1.0::IChild"
      *
      * @return descriptor a descriptor of the run-time type of the
@@ -116,4 +116,23 @@
      *                Must support empty for default debug information.
      */
     debug(handle fd, vec<string> options);
+
+    /*
+     * Returns hashes of the source HAL files that define the interfaces of the
+     * runtime type information on the object.
+     * For example, for the following interface definition:
+     *     package android.hardware.foo@1.0;
+     *     interface IParent {};
+     *     interface IChild extends IParent {};
+     * Calling interfaceChain on an IChild object must yield the following:
+     *     [(hash of IChild.hal),
+     *      (hash of IParent.hal)
+     *      (hash of IBase.hal)].
+     *
+     * SHA-256 is used as the hashing algorithm. Each hash has 32 bytes
+     * according to SHA-256 standard.
+     *
+     * @return hashchain a vector of SHA-1 digests
+     */
+    getHashChain() generates (vec<uint8_t[32]> hashchain);
 };
diff --git a/transport/include/hidl/LegacySupport.h b/transport/include/hidl/LegacySupport.h
index efe4d92..2f0c3f3 100644
--- a/transport/include/hidl/LegacySupport.h
+++ b/transport/include/hidl/LegacySupport.h
@@ -26,12 +26,6 @@
 namespace android {
 namespace hardware {
 
-namespace details {
-bool blockingHalBinderizationEnabled();
-void blockIfBinderizationDisabled(const std::string& interface,
-                                  const std::string& instance);
-} // namespace details
-
 /**
  * Registers passthrough service implementation.
  */
@@ -39,13 +33,6 @@
 __attribute__((warn_unused_result))
 status_t registerPassthroughServiceImplementation(
         std::string name = "default") {
-    // TODO(b/34274385)
-    // If binderization is enabled, we should start up. Otherwise, wait around.
-    // If we return/kill ourselves, we will just be restarted by init. This
-    // function is only called from thin wrapping services, so blocking won't
-    // stop anything important from happening.
-    details::blockIfBinderizationDisabled(Interface::descriptor, name);
-
     sp<Interface> service = Interface::getService(name, true /* getStub */);
 
     if (service == nullptr) {