[automerger skipped] Type confusion due to race condition on tag type change am: c46f6bae6e -s ours am: c338a5067a -s ours

am skip reason: Merged-In I93c36bf0f6b92e33a5d03d7420251f5bcf112d66 with SHA-1 963eb722db is already in history

Original change: https://googleplex-android-review.googlesource.com/c/platform/system/nfc/+/15684786

Change-Id: Iab6b67f67ae446466ca79a6ded9fedfc27bff8ac
diff --git a/OWNERS b/OWNERS
index 984e5f9..0aa310b 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,2 +1,4 @@
-eisenbach@google.com
-kandoiruchi@google.com
+zachoverflow@google.com
+rmojumder@google.com
+jackcwyu@google.com
+georgekgchang@google.com
diff --git a/src/Android.bp b/src/Android.bp
index 0db231d..60fb9b0 100644
--- a/src/Android.bp
+++ b/src/Android.bp
@@ -11,10 +11,10 @@
         "libdl",
         "libhardware",
         "libmetricslogger",
-        "libpower",
         "libz",
         "libchrome",
         "libbase",
+	"libstatslog",
 
         // Treble configuration
         "libhidlbase",
@@ -23,6 +23,7 @@
         "libutils",
         "android.hardware.nfc@1.0",
         "android.hardware.nfc@1.1",
+        "android.hardware.nfc@1.2",
     ],
     static_libs: [
         "libnfcutils",
@@ -31,6 +32,7 @@
         "-DBUILDCFG=1",
         "-Wall",
         "-Werror",
+        "-Wimplicit-fallthrough",
     ],
     local_include_dirs: [
         "include",
diff --git a/src/adaptation/CrcChecksum.cc b/src/adaptation/CrcChecksum.cc
index a94879e..b8d6ecc 100644
--- a/src/adaptation/CrcChecksum.cc
+++ b/src/adaptation/CrcChecksum.cc
@@ -28,7 +28,7 @@
 
 extern bool nfc_debug_enabled;
 
-static const unsigned short crctab[256] = {
+static const uint16_t crctab[256] = {
     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601,
     0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440, 0xcc01, 0x0cc0,
     0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81,
@@ -69,8 +69,8 @@
 ** Returns          2-byte checksum.
 **
 *******************************************************************************/
-unsigned short crcChecksumCompute(const unsigned char* buffer, int bufferLen) {
-  unsigned short crc = 0;
+uint16_t crcChecksumCompute(const unsigned char* buffer, int bufferLen) {
+  uint16_t crc = 0;
   const unsigned char* cp = buffer;
   int cnt = bufferLen;
 
@@ -96,7 +96,7 @@
   bool isGood = false;
   int fileStream = open(filename, O_RDONLY);
   if (fileStream >= 0) {
-    unsigned short checksum = 0;
+    uint16_t checksum = 0;
     std::string data;
     size_t actualReadCrc = read(fileStream, &checksum, sizeof(checksum));
     while (true) {
diff --git a/src/adaptation/NfcAdaptation.cc b/src/adaptation/NfcAdaptation.cc
old mode 100755
new mode 100644
index 528bdd7..9c70947
--- a/src/adaptation/NfcAdaptation.cc
+++ b/src/adaptation/NfcAdaptation.cc
@@ -17,13 +17,13 @@
  ******************************************************************************/
 #include <android-base/stringprintf.h>
 #include <android/hardware/nfc/1.1/INfc.h>
+#include <android/hardware/nfc/1.2/INfc.h>
 #include <base/command_line.h>
 #include <base/logging.h>
 #include <cutils/properties.h>
 #include <hwbinder/ProcessState.h>
 
 #include "NfcAdaptation.h"
-#include "android_logmsg.h"
 #include "debug_nfcsnoop.h"
 #include "nfa_api.h"
 #include "nfa_rw_api.h"
@@ -41,7 +41,9 @@
 using android::hardware::nfc::V1_0::INfc;
 using android::hardware::nfc::V1_1::PresenceCheckAlgorithm;
 using INfcV1_1 = android::hardware::nfc::V1_1::INfc;
-using NfcVendorConfig = android::hardware::nfc::V1_1::NfcConfig;
+using INfcV1_2 = android::hardware::nfc::V1_2::INfc;
+using NfcVendorConfigV1_1 = android::hardware::nfc::V1_1::NfcConfig;
+using NfcVendorConfigV1_2 = android::hardware::nfc::V1_2::NfcConfig;
 using android::hardware::nfc::V1_1::INfcClientCallback;
 using android::hardware::hidl_vec;
 
@@ -51,19 +53,21 @@
 extern void verify_stack_non_volatile_store();
 extern void delete_stack_non_volatile_store(bool forceDelete);
 
-NfcAdaptation* NfcAdaptation::mpInstance = NULL;
+NfcAdaptation* NfcAdaptation::mpInstance = nullptr;
 ThreadMutex NfcAdaptation::sLock;
-tHAL_NFC_CBACK* NfcAdaptation::mHalCallback = NULL;
-tHAL_NFC_DATA_CBACK* NfcAdaptation::mHalDataCallback = NULL;
+tHAL_NFC_CBACK* NfcAdaptation::mHalCallback = nullptr;
+tHAL_NFC_DATA_CBACK* NfcAdaptation::mHalDataCallback = nullptr;
 ThreadCondVar NfcAdaptation::mHalOpenCompletedEvent;
 ThreadCondVar NfcAdaptation::mHalCloseCompletedEvent;
 sp<INfc> NfcAdaptation::mHal;
 sp<INfcV1_1> NfcAdaptation::mHal_1_1;
+sp<INfcV1_2> NfcAdaptation::mHal_1_2;
 INfcClientCallback* NfcAdaptation::mCallback;
 
 bool nfc_debug_enabled = false;
 std::string nfc_storage_path;
 uint8_t appl_dta_mode_flag = 0x00;
+bool isDownloadFirmwareCompleted = false;
 
 extern tNFA_DM_CFG nfa_dm_cfg;
 extern tNFA_PROPRIETARY_CFG nfa_proprietary_cfg;
@@ -149,7 +153,7 @@
 ** Returns:     none
 **
 *******************************************************************************/
-NfcAdaptation::~NfcAdaptation() { mpInstance = NULL; }
+NfcAdaptation::~NfcAdaptation() { mpInstance = nullptr; }
 
 /*******************************************************************************
 **
@@ -172,51 +176,73 @@
 
 void NfcAdaptation::GetVendorConfigs(
     std::map<std::string, ConfigValue>& configMap) {
-  if (mHal_1_1) {
-    mHal_1_1->getConfig([&configMap](NfcVendorConfig config) {
-      std::vector<uint8_t> nfaPropCfg = {
-          config.nfaProprietaryCfg.protocol18092Active,
-          config.nfaProprietaryCfg.protocolBPrime,
-          config.nfaProprietaryCfg.protocolDual,
-          config.nfaProprietaryCfg.protocol15693,
-          config.nfaProprietaryCfg.protocolKovio,
-          config.nfaProprietaryCfg.protocolMifare,
-          config.nfaProprietaryCfg.discoveryPollKovio,
-          config.nfaProprietaryCfg.discoveryPollBPrime,
-          config.nfaProprietaryCfg.discoveryListenBPrime};
-      configMap.emplace(NAME_NFA_PROPRIETARY_CFG, ConfigValue(nfaPropCfg));
-      configMap.emplace(NAME_NFA_POLL_BAIL_OUT_MODE,
-                        ConfigValue(config.nfaPollBailOutMode ? 1 : 0));
-      configMap.emplace(NAME_DEFAULT_OFFHOST_ROUTE,
-                        ConfigValue(config.defaultOffHostRoute));
-      configMap.emplace(NAME_DEFAULT_ROUTE, ConfigValue(config.defaultRoute));
-      configMap.emplace(NAME_DEFAULT_NFCF_ROUTE,
-                        ConfigValue(config.defaultOffHostRouteFelica));
-      configMap.emplace(NAME_DEFAULT_SYS_CODE_ROUTE,
-                        ConfigValue(config.defaultSystemCodeRoute));
-      configMap.emplace(NAME_DEFAULT_SYS_CODE_PWR_STATE,
-                        ConfigValue(config.defaultSystemCodePowerState));
-      configMap.emplace(NAME_OFF_HOST_SIM_PIPE_ID,
-                        ConfigValue(config.offHostSIMPipeId));
-      configMap.emplace(NAME_OFF_HOST_ESE_PIPE_ID,
-                        ConfigValue(config.offHostESEPipeId));
-      configMap.emplace(NAME_ISO_DEP_MAX_TRANSCEIVE,
-                        ConfigValue(config.maxIsoDepTransceiveLength));
-      if (config.hostWhitelist.size() != 0) {
-        configMap.emplace(NAME_DEVICE_HOST_WHITE_LIST,
-                          ConfigValue(config.hostWhitelist));
-      }
-      /* For Backwards compatibility */
-      if (config.presenceCheckAlgorithm ==
-          PresenceCheckAlgorithm::ISO_DEP_NAK) {
-        configMap.emplace(NAME_PRESENCE_CHECK_ALGORITHM,
-                          ConfigValue((uint32_t)NFA_RW_PRES_CHK_ISO_DEP_NAK));
-      } else {
-        configMap.emplace(NAME_PRESENCE_CHECK_ALGORITHM,
-                          ConfigValue((uint32_t)config.presenceCheckAlgorithm));
-      }
+  NfcVendorConfigV1_2 configValue;
+  if (mHal_1_2) {
+    mHal_1_2->getConfig_1_2(
+        [&configValue](NfcVendorConfigV1_2 config) { configValue = config; });
+  } else if (mHal_1_1) {
+    mHal_1_1->getConfig([&configValue](NfcVendorConfigV1_1 config) {
+      configValue.v1_1 = config;
+      configValue.defaultIsoDepRoute = 0x00;
     });
   }
+
+  if (mHal_1_1 || mHal_1_2) {
+    std::vector<uint8_t> nfaPropCfg = {
+        configValue.v1_1.nfaProprietaryCfg.protocol18092Active,
+        configValue.v1_1.nfaProprietaryCfg.protocolBPrime,
+        configValue.v1_1.nfaProprietaryCfg.protocolDual,
+        configValue.v1_1.nfaProprietaryCfg.protocol15693,
+        configValue.v1_1.nfaProprietaryCfg.protocolKovio,
+        configValue.v1_1.nfaProprietaryCfg.protocolMifare,
+        configValue.v1_1.nfaProprietaryCfg.discoveryPollKovio,
+        configValue.v1_1.nfaProprietaryCfg.discoveryPollBPrime,
+        configValue.v1_1.nfaProprietaryCfg.discoveryListenBPrime};
+    configMap.emplace(NAME_NFA_PROPRIETARY_CFG, ConfigValue(nfaPropCfg));
+    configMap.emplace(NAME_NFA_POLL_BAIL_OUT_MODE,
+                      ConfigValue(configValue.v1_1.nfaPollBailOutMode ? 1 : 0));
+    configMap.emplace(NAME_DEFAULT_OFFHOST_ROUTE,
+                      ConfigValue(configValue.v1_1.defaultOffHostRoute));
+    if (configValue.offHostRouteUicc.size() != 0) {
+      configMap.emplace(NAME_OFFHOST_ROUTE_UICC,
+                        ConfigValue(configValue.offHostRouteUicc));
+    }
+    if (configValue.offHostRouteEse.size() != 0) {
+      configMap.emplace(NAME_OFFHOST_ROUTE_ESE,
+                        ConfigValue(configValue.offHostRouteEse));
+    }
+    configMap.emplace(NAME_DEFAULT_ROUTE,
+                      ConfigValue(configValue.v1_1.defaultRoute));
+    configMap.emplace(NAME_DEFAULT_NFCF_ROUTE,
+                      ConfigValue(configValue.v1_1.defaultOffHostRouteFelica));
+    configMap.emplace(NAME_DEFAULT_ISODEP_ROUTE,
+                      ConfigValue(configValue.defaultIsoDepRoute));
+    configMap.emplace(NAME_DEFAULT_SYS_CODE_ROUTE,
+                      ConfigValue(configValue.v1_1.defaultSystemCodeRoute));
+    configMap.emplace(
+        NAME_DEFAULT_SYS_CODE_PWR_STATE,
+        ConfigValue(configValue.v1_1.defaultSystemCodePowerState));
+    configMap.emplace(NAME_OFF_HOST_SIM_PIPE_ID,
+                      ConfigValue(configValue.v1_1.offHostSIMPipeId));
+    configMap.emplace(NAME_OFF_HOST_ESE_PIPE_ID,
+                      ConfigValue(configValue.v1_1.offHostESEPipeId));
+    configMap.emplace(NAME_ISO_DEP_MAX_TRANSCEIVE,
+                      ConfigValue(configValue.v1_1.maxIsoDepTransceiveLength));
+    if (configValue.v1_1.hostWhitelist.size() != 0) {
+      configMap.emplace(NAME_DEVICE_HOST_WHITE_LIST,
+                        ConfigValue(configValue.v1_1.hostWhitelist));
+    }
+    /* For Backwards compatibility */
+    if (configValue.v1_1.presenceCheckAlgorithm ==
+        PresenceCheckAlgorithm::ISO_DEP_NAK) {
+      configMap.emplace(NAME_PRESENCE_CHECK_ALGORITHM,
+                        ConfigValue((uint32_t)NFA_RW_PRES_CHK_ISO_DEP_NAK));
+    } else {
+      configMap.emplace(
+          NAME_PRESENCE_CHECK_ALGORITHM,
+          ConfigValue((uint32_t)configValue.v1_1.presenceCheckAlgorithm));
+    }
+  }
 }
 /*******************************************************************************
 **
@@ -236,6 +262,8 @@
   // Android already logs thread_id, proc_id, timestamp, so disable those.
   logging::SetLogItems(false, false, false, false);
 
+  initializeGlobalDebugEnabledFlag();
+
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s: enter", func);
 
   nfc_storage_path = NfcConfig::getString(NAME_NFA_STORAGE, "/data/nfc");
@@ -297,8 +325,6 @@
     nfa_hci_cfg.p_whitelist = &host_whitelist[0];
   }
 
-  initializeGlobalDebugEnabledFlag();
-
   verify_stack_non_volatile_store();
   if (NfcConfig::hasKey(NAME_PRESERVE_STORAGE) &&
       NfcConfig::getUnsigned(NAME_PRESERVE_STORAGE) == 1) {
@@ -310,12 +336,12 @@
 
   GKI_init();
   GKI_enable();
-  GKI_create_task((TASKPTR)NFCA_TASK, BTU_TASK, (int8_t*)"NFCA_TASK", 0, 0,
-                  (pthread_cond_t*)NULL, NULL);
+  GKI_create_task((TASKPTR)NFCA_TASK, BTU_TASK, (int8_t*)"NFCA_TASK", nullptr, 0,
+                  (pthread_cond_t*)nullptr, nullptr);
   {
     AutoThreadMutex guard(mCondVar);
-    GKI_create_task((TASKPTR)Thread, MMI_TASK, (int8_t*)"NFCA_THREAD", 0, 0,
-                    (pthread_cond_t*)NULL, NULL);
+    GKI_create_task((TASKPTR)Thread, MMI_TASK, (int8_t*)"NFCA_THREAD", nullptr, 0,
+                    (pthread_cond_t*)nullptr, nullptr);
     mCondVar.wait();
   }
 
@@ -346,13 +372,17 @@
 }
 
 void NfcAdaptation::FactoryReset() {
-  if (mHal_1_1 != nullptr) {
+  if (mHal_1_2 != nullptr) {
+    mHal_1_2->factoryReset();
+  } else if (mHal_1_1 != nullptr) {
     mHal_1_1->factoryReset();
   }
 }
 
 void NfcAdaptation::DeviceShutdown() {
-  if (mHal_1_1 != nullptr) {
+  if (mHal_1_2 != nullptr) {
+    mHal_1_2->closeForPowerOffCase();
+  } else if (mHal_1_1 != nullptr) {
     mHal_1_1->closeForPowerOffCase();
   }
 }
@@ -391,7 +421,7 @@
 uint32_t NfcAdaptation::NFCA_TASK(__attribute__((unused)) uint32_t arg) {
   const char* func = "NfcAdaptation::NFCA_TASK";
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s: enter", func);
-  GKI_run(0);
+  GKI_run(nullptr);
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s: exit", func);
   return 0;
 }
@@ -412,7 +442,7 @@
   {
     ThreadCondVar CondVar;
     AutoThreadMutex guard(CondVar);
-    GKI_create_task((TASKPTR)nfc_task, NFC_TASK, (int8_t*)"NFC_TASK", 0, 0,
+    GKI_create_task((TASKPTR)nfc_task, NFC_TASK, (int8_t*)"NFC_TASK", nullptr, 0,
                     (pthread_cond_t*)CondVar, (pthread_mutex_t*)CondVar);
     CondVar.wait();
   }
@@ -458,9 +488,12 @@
   mHalEntryFuncs.power_cycle = HalPowerCycle;
   mHalEntryFuncs.get_max_ee = HalGetMaxNfcee;
   LOG(INFO) << StringPrintf("%s: INfc::getService()", func);
-  mHal = mHal_1_1 = INfcV1_1::getService();
-  if (mHal_1_1 == nullptr) {
-    mHal = INfc::getService();
+  mHal = mHal_1_1 = mHal_1_2 = INfcV1_2::getService();
+  if (mHal_1_2 == nullptr) {
+    mHal = mHal_1_1 = INfcV1_1::getService();
+    if (mHal_1_1 == nullptr) {
+      mHal = INfc::getService();
+    }
   }
   LOG_FATAL_IF(mHal == nullptr, "Failed to retrieve the NFC HAL!");
   LOG(INFO) << StringPrintf("%s: INfc::getService() returned %p (%s)", func,
@@ -686,8 +719,9 @@
 ** Returns:     None.
 **
 *******************************************************************************/
-void NfcAdaptation::DownloadFirmware() {
+bool NfcAdaptation::DownloadFirmware() {
   const char* func = "NfcAdaptation::DownloadFirmware";
+  isDownloadFirmwareCompleted = false;
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s: enter", func);
   HalInitialize();
 
@@ -696,13 +730,13 @@
   HalOpen(HalDownloadFirmwareCallback, HalDownloadFirmwareDataCallback);
   mHalOpenCompletedEvent.wait();
 
-  mHalCloseCompletedEvent.lock();
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s: try close HAL", func);
   HalClose();
-  mHalCloseCompletedEvent.wait();
 
   HalTerminate();
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s: exit", func);
+
+  return isDownloadFirmwareCompleted;
 }
 
 /*******************************************************************************
@@ -724,13 +758,13 @@
     case HAL_NFC_OPEN_CPLT_EVT: {
       DLOG_IF(INFO, nfc_debug_enabled)
           << StringPrintf("%s: HAL_NFC_OPEN_CPLT_EVT", func);
+      if (event_status == HAL_NFC_STATUS_OK) isDownloadFirmwareCompleted = true;
       mHalOpenCompletedEvent.signal();
       break;
     }
     case HAL_NFC_CLOSE_CPLT_EVT: {
       DLOG_IF(INFO, nfc_debug_enabled)
           << StringPrintf("%s: HAL_NFC_CLOSE_CPLT_EVT", func);
-      mHalCloseCompletedEvent.signal();
       break;
     }
   }
diff --git a/src/adaptation/android_logmsg.cc b/src/adaptation/android_logmsg.cc
deleted file mode 100644
index bdfe3b9..0000000
--- a/src/adaptation/android_logmsg.cc
+++ /dev/null
@@ -1,108 +0,0 @@
-/******************************************************************************
- *
- *  Copyright (C) 1999-2012 Broadcom Corporation
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-#include <android-base/stringprintf.h>
-#include <base/logging.h>
-#include <cutils/log.h>
-
-#include "android_logmsg.h"
-#include "buildcfg.h"
-
-using android::base::StringPrintf;
-
-extern bool nfc_debug_enabled;
-
-#define MAX_NCI_PACKET_SIZE 259
-#define BTE_LOG_BUF_SIZE 1024
-#define BTE_LOG_MAX_SIZE (BTE_LOG_BUF_SIZE - 12)
-#define MAX_LOGCAT_LINE 4096
-#define PRINT(s) __android_log_write(ANDROID_LOG_DEBUG, "BrcmNci", s)
-static char log_line[MAX_LOGCAT_LINE];
-static const char* sTable = "0123456789abcdef";
-
-static void ToHex(const uint8_t* data, uint16_t len, char* hexString,
-                  uint16_t hexStringSize);
-
-void ProtoDispAdapterDisplayNciPacket(uint8_t* nciPacket, uint16_t nciPacketLen,
-                                      bool is_recv) {
-  if (!nfc_debug_enabled) return;
-
-  char line_buf[(MAX_NCI_PACKET_SIZE * 2) + 1];
-  ToHex(nciPacket, nciPacketLen, line_buf, sizeof(line_buf));
-  DLOG_IF(INFO, nfc_debug_enabled)
-      << StringPrintf("%s:%s", is_recv ? "NciR" : "NciX", line_buf);
-}
-
-void ToHex(const uint8_t* data, uint16_t len, char* hexString,
-           uint16_t hexStringSize) {
-  int i = 0, j = 0;
-  for (i = 0, j = 0; i < len && j < hexStringSize - 3; i++) {
-    hexString[j++] = sTable[(*data >> 4) & 0xf];
-    hexString[j++] = sTable[*data & 0xf];
-    data++;
-  }
-  hexString[j] = '\0';
-}
-
-inline void byte2hex(const char* data, char** str) {
-  **str = sTable[(*data >> 4) & 0xf];
-  ++*str;
-  **str = sTable[*data & 0xf];
-  ++*str;
-}
-
-/***************************************************************************
-**
-** Function         DispLLCP
-**
-** Description      Log LLCP packet as hex-ascii bytes.
-**
-** Returns          None.
-**
-***************************************************************************/
-void DispLLCP(NFC_HDR* p_buf, bool is_recv) {
-  if (!nfc_debug_enabled) return;
-
-  uint32_t nBytes = ((NFC_HDR_SIZE + p_buf->offset + p_buf->len) * 2) + 1;
-  if (nBytes > sizeof(log_line)) return;
-
-  uint8_t* data = (uint8_t*)p_buf;
-  int data_len = NFC_HDR_SIZE + p_buf->offset + p_buf->len;
-  ToHex(data, data_len, log_line, sizeof(log_line));
-  DLOG_IF(INFO, nfc_debug_enabled)
-      << StringPrintf("%s:%s", is_recv ? "LlcpR" : "LlcpX", log_line);
-}
-
-/***************************************************************************
-**
-** Function         DispHcp
-**
-** Description      Log raw HCP packet as hex-ascii bytes
-**
-** Returns          None.
-**
-***************************************************************************/
-void DispHcp(uint8_t* data, uint16_t len, bool is_recv) {
-  if (!nfc_debug_enabled) return;
-
-  uint32_t nBytes = (len * 2) + 1;
-  if (nBytes > sizeof(log_line)) return;
-
-  ToHex(data, len, log_line, sizeof(log_line));
-  DLOG_IF(INFO, nfc_debug_enabled)
-      << StringPrintf("%s:%s", is_recv ? "HcpR" : "HcpX", log_line);
-}
diff --git a/src/adaptation/debug_nfcsnoop.cc b/src/adaptation/debug_nfcsnoop.cc
index 9466b9f..130e1f7 100644
--- a/src/adaptation/debug_nfcsnoop.cc
+++ b/src/adaptation/debug_nfcsnoop.cc
@@ -41,7 +41,7 @@
 static const uint8_t MAX_LINE_LENGTH = 128;
 
 static std::mutex buffer_mutex;
-static ringbuffer_t* buffer = NULL;
+static ringbuffer_t* buffer = nullptr;
 static uint64_t last_timestamp_ms = 0;
 
 static void nfcsnoop_cb(const uint8_t* data, const size_t length,
@@ -74,8 +74,8 @@
 }
 
 static bool nfcsnoop_compress(ringbuffer_t* rb_dst, ringbuffer_t* rb_src) {
-  CHECK(rb_dst != NULL);
-  CHECK(rb_src != NULL);
+  CHECK(rb_dst != nullptr);
+  CHECK(rb_src != nullptr);
 
   z_stream zs;
   zs.zalloc = Z_NULL;
@@ -116,7 +116,7 @@
 
 void nfcsnoop_capture(const NFC_HDR* packet, bool is_received) {
   struct timeval tv;
-  gettimeofday(&tv, NULL);
+  gettimeofday(&tv, nullptr);
   uint64_t timestamp = static_cast<uint64_t>(tv.tv_sec) * USEC_PER_SEC +
                        static_cast<uint64_t>(tv.tv_usec);
   uint8_t* p = (uint8_t*)(packet + 1) + packet->offset;
@@ -130,12 +130,16 @@
 }
 
 void debug_nfcsnoop_init(void) {
-  if (buffer == NULL) buffer = ringbuffer_init(NFCSNOOP_MEM_BUFFER_SIZE);
+  if (buffer == nullptr) buffer = ringbuffer_init(NFCSNOOP_MEM_BUFFER_SIZE);
 }
 
 void debug_nfcsnoop_dump(int fd) {
+  if (buffer == nullptr) {
+    dprintf(fd, "%s Nfcsnoop is not ready\n", __func__);
+    return;
+  }
   ringbuffer_t* ringbuffer = ringbuffer_init(NFCSNOOP_MEM_BUFFER_SIZE);
-  if (ringbuffer == NULL) {
+  if (ringbuffer == nullptr) {
     dprintf(fd, "%s Unable to allocate memory for compression", __func__);
     return;
   }
diff --git a/src/adaptation/libmain.cc b/src/adaptation/libmain.cc
index eb9a9f1..8ceb5ff 100644
--- a/src/adaptation/libmain.cc
+++ b/src/adaptation/libmain.cc
@@ -88,7 +88,7 @@
       "%s: buffer len=%u; file=%s", __func__, nbytes, filename.c_str());
   int fileStream = open(filename.c_str(), O_RDONLY);
   if (fileStream >= 0) {
-    unsigned short checksum = 0;
+    uint16_t checksum = 0;
     read(fileStream, &checksum, sizeof(checksum));
     size_t actualReadData = read(fileStream, pBuffer, nbytes);
     close(fileStream);
@@ -136,7 +136,7 @@
   int fileStream =
       open(filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
   if (fileStream >= 0) {
-    unsigned short checksum = crcChecksumCompute(pBuffer, nbytes);
+    uint16_t checksum = crcChecksumCompute(pBuffer, nbytes);
     size_t actualWrittenCrc = write(fileStream, &checksum, sizeof(checksum));
     size_t actualWrittenData = write(fileStream, pBuffer, nbytes);
     DLOG_IF(INFO, nfc_debug_enabled)
diff --git a/src/gki/common/gki_buffer.cc b/src/gki/common/gki_buffer.cc
index b14f6c8..dbb1d8b 100644
--- a/src/gki/common/gki_buffer.cc
+++ b/src/gki/common/gki_buffer.cc
@@ -45,7 +45,7 @@
   uint16_t i;
   uint16_t act_size;
   BUFFER_HDR_T* hdr;
-  BUFFER_HDR_T* hdr1 = NULL;
+  BUFFER_HDR_T* hdr1 = nullptr;
   uint32_t* magic;
   int32_t tempsize = size;
   tGKI_COM_CB* p_cb = &gki_cb.com;
@@ -81,8 +81,8 @@
       hdr = (BUFFER_HDR_T*)((uint8_t*)hdr + act_size);
       hdr1->p_next = hdr;
     }
-    if (hdr1 != NULL) hdr = hdr1;
-    hdr->p_next = NULL;
+    if (hdr1 != nullptr) hdr = hdr1;
+    hdr->p_next = nullptr;
     p_cb->freeq[id].p_last = hdr;
   }
   return;
@@ -94,7 +94,7 @@
 
   Q = &p_cb->freeq[p_cb->pool_list[id]];
 
-  if (Q->p_first == 0) {
+  if (Q->p_first == nullptr) {
     void* p_mem = GKI_os_malloc((Q->size + BUFFER_PADDING_SIZE) * Q->total);
     if (p_mem) {
       // re-initialize the queue with allocated memory
@@ -124,18 +124,18 @@
   /* Initialize mailboxes */
   for (tt = 0; tt < GKI_MAX_TASKS; tt++) {
     for (mb = 0; mb < NUM_TASK_MBOX; mb++) {
-      p_cb->OSTaskQFirst[tt][mb] = NULL;
-      p_cb->OSTaskQLast[tt][mb] = NULL;
+      p_cb->OSTaskQFirst[tt][mb] = nullptr;
+      p_cb->OSTaskQLast[tt][mb] = nullptr;
     }
   }
 
   for (tt = 0; tt < GKI_NUM_TOTAL_BUF_POOLS; tt++) {
-    p_cb->pool_start[tt] = NULL;
-    p_cb->pool_end[tt] = NULL;
+    p_cb->pool_start[tt] = nullptr;
+    p_cb->pool_end[tt] = nullptr;
     p_cb->pool_size[tt] = 0;
 
-    p_cb->freeq[tt].p_first = 0;
-    p_cb->freeq[tt].p_last = 0;
+    p_cb->freeq[tt].p_first = nullptr;
+    p_cb->freeq[tt].p_last = nullptr;
     p_cb->freeq[tt].size = 0;
     p_cb->freeq[tt].total = 0;
     p_cb->freeq[tt].cur_cnt = 0;
@@ -229,7 +229,7 @@
 **
 *******************************************************************************/
 void GKI_init_q(BUFFER_Q* p_q) {
-  p_q->p_first = p_q->p_last = NULL;
+  p_q->p_first = p_q->p_last = nullptr;
   p_q->count = 0;
 
   return;
@@ -259,7 +259,7 @@
 
   if (size == 0) {
     GKI_exception(GKI_ERROR_BUF_SIZE_ZERO, "getbuf: Size is zero");
-    return (NULL);
+    return (nullptr);
   }
 
   /* Find the first buffer pool that is public that can hold the desired size */
@@ -269,7 +269,7 @@
 
   if (i == p_cb->curr_total_no_of_pools) {
     GKI_exception(GKI_ERROR_BUF_SIZE_TOOBIG, "getbuf: Size is too big");
-    return (NULL);
+    return (nullptr);
   }
 
   /* Make sure the buffers aren't disturbed til finished with allocation */
@@ -283,23 +283,23 @@
 
     Q = &p_cb->freeq[p_cb->pool_list[i]];
     if (Q->cur_cnt < Q->total) {
-      if (Q->p_first == 0 && gki_alloc_free_queue(i) != true) {
+      if (Q->p_first == nullptr && gki_alloc_free_queue(i) != true) {
         LOG(ERROR) << StringPrintf("out of buffer");
         GKI_enable();
-        return NULL;
+        return nullptr;
       }
 
-      if (Q->p_first == 0) {
+      if (Q->p_first == nullptr) {
         /* gki_alloc_free_queue() failed to alloc memory */
         LOG(ERROR) << StringPrintf("fail alloc free queue");
         GKI_enable();
-        return NULL;
+        return nullptr;
       }
 
       p_hdr = Q->p_first;
       Q->p_first = p_hdr->p_next;
 
-      if (!Q->p_first) Q->p_last = NULL;
+      if (!Q->p_first) Q->p_last = nullptr;
 
       if (++Q->cur_cnt > Q->max_cnt) Q->max_cnt = Q->cur_cnt;
 
@@ -308,7 +308,7 @@
       p_hdr->task_id = GKI_get_taskid();
 
       p_hdr->status = BUF_STATUS_UNLINKED;
-      p_hdr->p_next = NULL;
+      p_hdr->p_next = nullptr;
       p_hdr->Type = 0;
       return ((void*)((uint8_t*)p_hdr + BUFFER_HDR_SIZE));
     }
@@ -318,7 +318,7 @@
 
   GKI_enable();
 
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -342,25 +342,25 @@
   BUFFER_HDR_T* p_hdr;
   tGKI_COM_CB* p_cb = &gki_cb.com;
 
-  if (pool_id >= GKI_NUM_TOTAL_BUF_POOLS) return (NULL);
+  if (pool_id >= GKI_NUM_TOTAL_BUF_POOLS) return (nullptr);
 
   /* Make sure the buffers aren't disturbed til finished with allocation */
   GKI_disable();
 
   Q = &p_cb->freeq[pool_id];
   if (Q->cur_cnt < Q->total) {
-    if (Q->p_first == 0 && gki_alloc_free_queue(pool_id) != true) return NULL;
+    if (Q->p_first == nullptr && gki_alloc_free_queue(pool_id) != true) return nullptr;
 
-    if (Q->p_first == 0) {
+    if (Q->p_first == nullptr) {
       /* gki_alloc_free_queue() failed to alloc memory */
       LOG(ERROR) << StringPrintf("fail alloc free queue");
-      return NULL;
+      return nullptr;
     }
 
     p_hdr = Q->p_first;
     Q->p_first = p_hdr->p_next;
 
-    if (!Q->p_first) Q->p_last = NULL;
+    if (!Q->p_first) Q->p_last = nullptr;
 
     if (++Q->cur_cnt > Q->max_cnt) Q->max_cnt = Q->cur_cnt;
 
@@ -369,7 +369,7 @@
     p_hdr->task_id = GKI_get_taskid();
 
     p_hdr->status = BUF_STATUS_UNLINKED;
-    p_hdr->p_next = NULL;
+    p_hdr->p_next = nullptr;
     p_hdr->Type = 0;
 
     return ((void*)((uint8_t*)p_hdr + BUFFER_HDR_SIZE));
@@ -429,7 +429,7 @@
     Q->p_first = p_hdr;
 
   Q->p_last = p_hdr;
-  p_hdr->p_next = NULL;
+  p_hdr->p_next = nullptr;
   p_hdr->status = BUF_STATUS_FREE;
   p_hdr->task_id = GKI_INVALID_TASK;
   if (Q->cur_cnt > 0) Q->cur_cnt--;
@@ -536,7 +536,7 @@
 
   p_cb->OSTaskQLast[task_id][mbox] = p_hdr;
 
-  p_hdr->p_next = NULL;
+  p_hdr->p_next = nullptr;
   p_hdr->status = BUF_STATUS_QUEUED;
   p_hdr->task_id = task_id;
 
@@ -561,10 +561,10 @@
 *******************************************************************************/
 void* GKI_read_mbox(uint8_t mbox) {
   uint8_t task_id = GKI_get_taskid();
-  void* p_buf = NULL;
+  void* p_buf = nullptr;
   BUFFER_HDR_T* p_hdr;
 
-  if ((task_id >= GKI_MAX_TASKS) || (mbox >= NUM_TASK_MBOX)) return (NULL);
+  if ((task_id >= GKI_MAX_TASKS) || (mbox >= NUM_TASK_MBOX)) return (nullptr);
 
   GKI_disable();
 
@@ -572,7 +572,7 @@
     p_hdr = gki_cb.com.OSTaskQFirst[task_id][mbox];
     gki_cb.com.OSTaskQFirst[task_id][mbox] = p_hdr->p_next;
 
-    p_hdr->p_next = NULL;
+    p_hdr->p_next = nullptr;
     p_hdr->status = BUF_STATUS_UNLINKED;
 
     p_buf = (uint8_t*)p_hdr + BUFFER_HDR_SIZE;
@@ -626,7 +626,7 @@
   p_q->p_last = p_buf;
   p_q->count++;
 
-  p_hdr->p_next = NULL;
+  p_hdr->p_next = nullptr;
   p_hdr->status = BUF_STATUS_QUEUED;
 
   GKI_enable();
@@ -672,7 +672,7 @@
   } else {
     p_q->p_first = p_buf;
     p_q->p_last = p_buf;
-    p_hdr->p_next = NULL;
+    p_hdr->p_next = nullptr;
   }
   p_q->count++;
 
@@ -701,7 +701,7 @@
 
   if (!p_q || !p_q->count) {
     GKI_enable();
-    return (NULL);
+    return (nullptr);
   }
 
   p_hdr = (BUFFER_HDR_T*)((uint8_t*)p_q->p_first - BUFFER_HDR_SIZE);
@@ -711,13 +711,13 @@
   if (p_hdr->p_next)
     p_q->p_first = ((uint8_t*)p_hdr->p_next + BUFFER_HDR_SIZE);
   else {
-    p_q->p_first = NULL;
-    p_q->p_last = NULL;
+    p_q->p_first = nullptr;
+    p_q->p_last = nullptr;
   }
 
   p_q->count--;
 
-  p_hdr->p_next = NULL;
+  p_hdr->p_next = nullptr;
   p_hdr->status = BUF_STATUS_UNLINKED;
 
   GKI_enable();
@@ -763,7 +763,7 @@
       p_q->count--;
 
       /* The buffer is now unlinked */
-      p_buf_hdr->p_next = NULL;
+      p_buf_hdr->p_next = nullptr;
       p_buf_hdr->status = BUF_STATUS_UNLINKED;
 
       GKI_enable();
@@ -772,7 +772,7 @@
   }
 
   GKI_enable();
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -822,7 +822,7 @@
   if (p_hdr->p_next)
     return ((uint8_t*)p_hdr->p_next + BUFFER_HDR_SIZE);
   else
-    return (NULL);
+    return (nullptr);
 }
 
 /*******************************************************************************
@@ -874,7 +874,7 @@
   /* If here, invalid address - not in one of our buffers */
   GKI_exception(GKI_ERROR_BUF_SIZE_ZERO, "GKI_get_buf_start:: bad addr");
 
-  return (NULL);
+  return (nullptr);
 }
 
 /********************************************************
@@ -1178,13 +1178,13 @@
     Q->total = 0;
     Q->cur_cnt = 0;
     Q->max_cnt = 0;
-    Q->p_first = NULL;
-    Q->p_last = NULL;
+    Q->p_first = nullptr;
+    Q->p_last = nullptr;
 
     GKI_os_free(p_cb->pool_start[pool_id]);
 
-    p_cb->pool_start[pool_id] = NULL;
-    p_cb->pool_end[pool_id] = NULL;
+    p_cb->pool_start[pool_id] = nullptr;
+    p_cb->pool_end[pool_id] = nullptr;
     p_cb->pool_size[pool_id] = 0;
 
     gki_remove_from_pool_list(pool_id);
diff --git a/src/gki/common/gki_time.cc b/src/gki/common/gki_time.cc
index ac9a649..1265220 100644
--- a/src/gki/common/gki_time.cc
+++ b/src/gki/common/gki_time.cc
@@ -79,10 +79,10 @@
   }
 
   for (tt = 0; tt < GKI_MAX_TIMER_QUEUES; tt++) {
-    gki_cb.com.timer_queues[tt] = NULL;
+    gki_cb.com.timer_queues[tt] = nullptr;
   }
 
-  gki_cb.com.p_tick_cb = NULL;
+  gki_cb.com.p_tick_cb = nullptr;
   gki_cb.com.system_tick_running = false;
 
   return;
@@ -585,8 +585,8 @@
 **
 *******************************************************************************/
 void GKI_init_timer_list(TIMER_LIST_Q* p_timer_listq) {
-  p_timer_listq->p_first = NULL;
-  p_timer_listq->p_last = NULL;
+  p_timer_listq->p_first = nullptr;
+  p_timer_listq->p_last = nullptr;
   p_timer_listq->last_ticks = 0;
 
   return;
@@ -606,8 +606,8 @@
 **
 *******************************************************************************/
 void GKI_init_timer_list_entry(TIMER_LIST_ENT* p_tle) {
-  p_tle->p_next = NULL;
-  p_tle->p_prev = NULL;
+  p_tle->p_next = nullptr;
+  p_tle->p_prev = nullptr;
   p_tle->ticks = GKI_UNUSED_LIST_ENTRY;
   p_tle->in_use = false;
 }
@@ -653,7 +653,7 @@
   rem_ticks = num_units_since_last_update;
 
   /* Now, adjust remaining timer entries */
-  while ((p_tle != NULL) && (rem_ticks > 0)) {
+  while ((p_tle != nullptr) && (rem_ticks > 0)) {
     temp_ticks = p_tle->ticks;
     p_tle->ticks -= rem_ticks;
 
@@ -750,7 +750,7 @@
   uint32_t nr_ticks_total;
   uint8_t tt;
   TIMER_LIST_ENT* p_temp;
-  if (p_tle == NULL || p_timer_listq == NULL) {
+  if (p_tle == nullptr || p_timer_listq == nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
         "%s: invalid argument %p, %p****************************<<", __func__,
         p_timer_listq, p_tle);
@@ -762,17 +762,17 @@
     /* If this entry is the last in the list */
     if (p_tle->ticks >= p_timer_listq->last_ticks) {
       /* If this entry is the only entry in the list */
-      if (p_timer_listq->p_first == NULL)
+      if (p_timer_listq->p_first == nullptr)
         p_timer_listq->p_first = p_tle;
       else {
         /* Insert the entry onto the end of the list */
-        if (p_timer_listq->p_last != NULL)
+        if (p_timer_listq->p_last != nullptr)
           p_timer_listq->p_last->p_next = p_tle;
 
         p_tle->p_prev = p_timer_listq->p_last;
       }
 
-      p_tle->p_next = NULL;
+      p_tle->p_next = nullptr;
       p_timer_listq->p_last = p_tle;
       nr_ticks_total = p_tle->ticks;
       p_tle->ticks -= p_timer_listq->last_ticks;
@@ -811,7 +811,7 @@
     }
     /* add this timer queue to the array */
     for (tt = 0; tt < GKI_MAX_TIMER_QUEUES; tt++) {
-      if (gki_cb.com.timer_queues[tt] == NULL) break;
+      if (gki_cb.com.timer_queues[tt] == nullptr) break;
     }
     if (tt < GKI_MAX_TIMER_QUEUES) {
       gki_cb.com.timer_queues[tt] = p_timer_listq;
@@ -840,15 +840,15 @@
   uint8_t tt;
 
   /* Verify that the entry is valid */
-  if (p_tle == NULL || p_tle->in_use == false ||
-      p_timer_listq->p_first == NULL) {
+  if (p_tle == nullptr || p_tle->in_use == false ||
+      p_timer_listq->p_first == nullptr) {
     return;
   }
 
   /* Add the ticks remaining in this timer (if any) to the next guy in the list.
   ** Note: Expired timers have a tick value of '0'.
   */
-  if (p_tle->p_next != NULL) {
+  if (p_tle->p_next != nullptr) {
     p_tle->p_next->ticks += p_tle->ticks;
   } else {
     p_timer_listq->last_ticks -= p_tle->ticks;
@@ -859,23 +859,23 @@
   if (p_timer_listq->p_first == p_tle) {
     p_timer_listq->p_first = p_tle->p_next;
 
-    if (p_timer_listq->p_first != NULL) p_timer_listq->p_first->p_prev = NULL;
+    if (p_timer_listq->p_first != nullptr) p_timer_listq->p_first->p_prev = nullptr;
 
-    if (p_timer_listq->p_last == p_tle) p_timer_listq->p_last = NULL;
+    if (p_timer_listq->p_last == p_tle) p_timer_listq->p_last = nullptr;
   } else {
     if (p_timer_listq->p_last == p_tle) {
       p_timer_listq->p_last = p_tle->p_prev;
 
-      if (p_timer_listq->p_last != NULL) p_timer_listq->p_last->p_next = NULL;
+      if (p_timer_listq->p_last != nullptr) p_timer_listq->p_last->p_next = nullptr;
     } else {
-      if (p_tle->p_next != NULL && p_tle->p_next->p_prev == p_tle)
+      if (p_tle->p_next != nullptr && p_tle->p_next->p_prev == p_tle)
         p_tle->p_next->p_prev = p_tle->p_prev;
       else {
         /* Error case - chain messed up ?? */
         return;
       }
 
-      if (p_tle->p_prev != NULL && p_tle->p_prev->p_next == p_tle)
+      if (p_tle->p_prev != nullptr && p_tle->p_prev->p_next == p_tle)
         p_tle->p_prev->p_next = p_tle->p_next;
       else {
         /* Error case - chain messed up ?? */
@@ -884,15 +884,15 @@
     }
   }
 
-  p_tle->p_next = p_tle->p_prev = NULL;
+  p_tle->p_next = p_tle->p_prev = nullptr;
   p_tle->ticks = GKI_UNUSED_LIST_ENTRY;
   p_tle->in_use = false;
 
   /* if timer queue is empty */
-  if (p_timer_listq->p_first == NULL && p_timer_listq->p_last == NULL) {
+  if (p_timer_listq->p_first == nullptr && p_timer_listq->p_last == nullptr) {
     for (tt = 0; tt < GKI_MAX_TIMER_QUEUES; tt++) {
       if (gki_cb.com.timer_queues[tt] == p_timer_listq) {
-        gki_cb.com.timer_queues[tt] = NULL;
+        gki_cb.com.timer_queues[tt] = nullptr;
         break;
       }
     }
diff --git a/src/gki/ulinux/gki_int.h b/src/gki/ulinux/gki_int.h
index 27ff76e..6736b62 100644
--- a/src/gki/ulinux/gki_int.h
+++ b/src/gki/ulinux/gki_int.h
@@ -38,7 +38,6 @@
   int no_timer_suspend; /* 1: no suspend, 0 stop calling GKI_timer_update() */
   pthread_mutex_t gki_timer_mutex;
   pthread_cond_t gki_timer_cond;
-  int gki_timer_wake_lock_on;
 } tGKI_OS;
 
 /* condition to exit or continue GKI_run() timer loop */
diff --git a/src/gki/ulinux/gki_ulinux.cc b/src/gki/ulinux/gki_ulinux.cc
index 01ba892..fc3b5c6 100644
--- a/src/gki/ulinux/gki_ulinux.cc
+++ b/src/gki/ulinux/gki_ulinux.cc
@@ -99,7 +99,7 @@
                              p_pthread_info->task_id);
   gki_cb.os.thread_id[p_pthread_info->task_id] = 0;
 
-  return NULL;
+  return nullptr;
 }
 /* end android */
 
@@ -122,7 +122,7 @@
 
   gki_buffer_init();
   gki_timers_init();
-  gki_cb.com.OSTicks = (uint32_t)times(0);
+  gki_cb.com.OSTicks = (uint32_t)times(nullptr);
 
   pthread_mutexattr_init(&attr);
 
@@ -139,8 +139,8 @@
    * state.
    * this works too even if GKI_NO_TICK_STOP is defined in btld.txt */
   p_os->no_timer_suspend = GKI_TIMER_TICK_RUN_COND;
-  pthread_mutex_init(&p_os->gki_timer_mutex, NULL);
-  pthread_cond_init(&p_os->gki_timer_cond, NULL);
+  pthread_mutex_init(&p_os->gki_timer_mutex, nullptr);
+  pthread_cond_init(&p_os->gki_timer_cond, nullptr);
 }
 
 /*******************************************************************************
@@ -207,9 +207,9 @@
   gki_cb.com.OSWaitEvt[task_id] = 0;
 
   /* Initialize mutex and condition variable objects for events and timeouts */
-  pthread_mutex_init(&gki_cb.os.thread_evt_mutex[task_id], NULL);
+  pthread_mutex_init(&gki_cb.os.thread_evt_mutex[task_id], nullptr);
   pthread_cond_init(&gki_cb.os.thread_evt_cond[task_id], &attr);
-  pthread_mutex_init(&gki_cb.os.thread_timeout_mutex[task_id], NULL);
+  pthread_mutex_init(&gki_cb.os.thread_timeout_mutex[task_id], nullptr);
   pthread_cond_init(&gki_cb.os.thread_timeout_cond[task_id], &attr);
 
   pthread_attr_init(&attr1);
@@ -278,11 +278,6 @@
 ** Returns          void
 **
 *******************************************************************************/
-#define WAKE_LOCK_ID "brcm_nfca"
-#define PARTIAL_WAKE_LOCK 1
-extern "C" int acquire_wake_lock(int lock, const char* id);
-extern "C" int release_wake_lock(const char* id);
-
 void GKI_shutdown(void) {
   uint8_t task_id;
   volatile int* p_run_cond = &gki_cb.os.no_timer_suspend;
@@ -337,12 +332,6 @@
 #ifdef NO_GKI_RUN_RETURN
   shutdown_timer = 1;
 #endif
-  if (gki_cb.os.gki_timer_wake_lock_on) {
-    DLOG_IF(INFO, nfc_debug_enabled)
-        << StringPrintf("GKI_shutdown :  release_wake_lock(brcm_btld)");
-    release_wake_lock(WAKE_LOCK_ID);
-    gki_cb.os.gki_timer_wake_lock_on = 0;
-  }
   oldCOnd = *p_run_cond;
   *p_run_cond = GKI_TIMER_TICK_EXIT_COND;
   if (oldCOnd == GKI_TIMER_TICK_STOP_COND)
@@ -363,9 +352,6 @@
 void gki_system_tick_start_stop_cback(bool start) {
   tGKI_OS* p_os = &gki_cb.os;
   volatile int* p_run_cond = &p_os->no_timer_suspend;
-#ifdef GKI_TICK_TIMER_DEBUG
-  static volatile int wake_lock_count;
-#endif
   if (start == false) {
     /* this can lead to a race condition. however as we only read this variable
      * in the timer loop
@@ -374,25 +360,12 @@
     /* GKI_disable(); */
     *p_run_cond = GKI_TIMER_TICK_STOP_COND;
 /* GKI_enable(); */
-#ifdef GKI_TICK_TIMER_DEBUG
-    DLOG_IF(INFO, nfc_debug_enabled)
-        << StringPrintf(">>> STOP wake_lock_count:%d", --wake_lock_count);
-#endif
-    release_wake_lock(WAKE_LOCK_ID);
-    gki_cb.os.gki_timer_wake_lock_on = 0;
   } else {
     /* restart GKI_timer_update() loop */
-    acquire_wake_lock(PARTIAL_WAKE_LOCK, WAKE_LOCK_ID);
-    gki_cb.os.gki_timer_wake_lock_on = 1;
     *p_run_cond = GKI_TIMER_TICK_RUN_COND;
     pthread_mutex_lock(&p_os->gki_timer_mutex);
     pthread_cond_signal(&p_os->gki_timer_cond);
     pthread_mutex_unlock(&p_os->gki_timer_mutex);
-
-#ifdef GKI_TICK_TIMER_DEBUG
-    DLOG_IF(INFO, nfc_debug_enabled)
-        << StringPrintf(">>> START wake_lock_count:%d", ++wake_lock_count);
-#endif
   }
 }
 
@@ -580,7 +553,7 @@
   }
 
   gki_pthread_info_t* p_pthread_info = &gki_pthread_info[rtask];
-  if (p_pthread_info->pCond != NULL && p_pthread_info->pMutex != NULL) {
+  if (p_pthread_info->pCond != nullptr && p_pthread_info->pMutex != nullptr) {
     int ret;
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("GKI_wait task=%i, pCond/pMutex = %p/%p", rtask,
@@ -588,8 +561,8 @@
     ret = pthread_mutex_lock(p_pthread_info->pMutex);
     ret = pthread_cond_signal(p_pthread_info->pCond);
     ret = pthread_mutex_unlock(p_pthread_info->pMutex);
-    p_pthread_info->pMutex = NULL;
-    p_pthread_info->pCond = NULL;
+    p_pthread_info->pMutex = nullptr;
+    p_pthread_info->pCond = nullptr;
   }
   gki_cb.com.OSWaitForEvt[rtask] = flag;
 
@@ -947,7 +920,7 @@
   uint32_t h_time;
   int8_t* p_out = tbuf;
 
-  gki_cb.com.OSTicks = times(0);
+  gki_cb.com.OSTicks = times(nullptr);
   ms_time = GKI_TICKS_TO_MS(gki_cb.com.OSTicks);
   s_time = ms_time / 100; /* 100 Ticks per second */
   m_time = s_time / 60;
@@ -1028,7 +1001,7 @@
 **
 *******************************************************************************/
 void GKI_os_free(void* p_mem) {
-  if (p_mem != NULL) free(p_mem);
+  if (p_mem != nullptr) free(p_mem);
   return;
 }
 
diff --git a/src/include/CrcChecksum.h b/src/include/CrcChecksum.h
index ffbc9a7..00a3dd8 100644
--- a/src/include/CrcChecksum.h
+++ b/src/include/CrcChecksum.h
@@ -18,6 +18,7 @@
 #pragma once
 
 #include <stdbool.h>
+#include <stdint.h>
 
 /*******************************************************************************
 **
@@ -28,7 +29,7 @@
 ** Returns          2-byte checksum.
 **
 *******************************************************************************/
-unsigned short crcChecksumCompute(const unsigned char* buffer, int bufferLen);
+uint16_t crcChecksumCompute(const unsigned char* buffer, int bufferLen);
 
 /*******************************************************************************
 **
diff --git a/src/include/NfcAdaptation.h b/src/include/NfcAdaptation.h
index cf1054e..7bcba00 100644
--- a/src/include/NfcAdaptation.h
+++ b/src/include/NfcAdaptation.h
@@ -35,6 +35,9 @@
 struct INfc;
 struct INfcClientCallback;
 }
+namespace V1_2 {
+struct INfc;
+}
 }
 }
 }
@@ -45,7 +48,7 @@
   virtual ~ThreadMutex();
   void lock();
   void unlock();
-  operator pthread_mutex_t*() { return &mMutex; }
+  explicit operator pthread_mutex_t*() { return &mMutex; }
 
  private:
   pthread_mutex_t mMutex;
@@ -57,7 +60,8 @@
   virtual ~ThreadCondVar();
   void signal();
   void wait();
-  operator pthread_cond_t*() { return &mCondVar; }
+  explicit operator pthread_cond_t*() { return &mCondVar; }
+  // NOLINTNEXTLINE(google-explicit-constructor)
   operator pthread_mutex_t*() {
     return ThreadMutex::operator pthread_mutex_t*();
   }
@@ -68,10 +72,10 @@
 
 class AutoThreadMutex {
  public:
-  AutoThreadMutex(ThreadMutex& m);
+  explicit AutoThreadMutex(ThreadMutex& m);
   virtual ~AutoThreadMutex();
-  operator ThreadMutex&() { return mm; }
-  operator pthread_mutex_t*() { return (pthread_mutex_t*)mm; }
+  explicit operator ThreadMutex&() { return mm; }
+  explicit operator pthread_mutex_t*() { return (pthread_mutex_t*)mm; }
 
  private:
   ThreadMutex& mm;
@@ -86,7 +90,7 @@
   void DeviceShutdown();
   static NfcAdaptation& GetInstance();
   tHAL_NFC_ENTRY* GetHalEntryFuncs();
-  void DownloadFirmware();
+  bool DownloadFirmware();
   void GetVendorConfigs(std::map<std::string, ConfigValue>& configMap);
   void Dump(int fd);
 
@@ -99,6 +103,7 @@
   tHAL_NFC_ENTRY mHalEntryFuncs;  // function pointers for HAL entry points
   static android::sp<android::hardware::nfc::V1_0::INfc> mHal;
   static android::sp<android::hardware::nfc::V1_1::INfc> mHal_1_1;
+  static android::sp<android::hardware::nfc::V1_2::INfc> mHal_1_2;
   static android::hardware::nfc::V1_1::INfcClientCallback* mCallback;
   static tHAL_NFC_CBACK* mHalCallback;
   static tHAL_NFC_DATA_CBACK* mHalDataCallback;
diff --git a/src/include/android_logmsg.h b/src/include/android_logmsg.h
deleted file mode 100644
index ed38807..0000000
--- a/src/include/android_logmsg.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/******************************************************************************
- *
- *  Copyright (C) 2011-2012 Broadcom Corporation
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-/******************************************************************************
- * Decode NFC packets and print them to ADB log.
- * If protocol decoder is not present, then decode packets into hex numbers.
- ******************************************************************************/
-
-#include "data_types.h"
-#include "nfc_types.h"
-
-#define DISP_NCI ProtoDispAdapterDisplayNciPacket
-void ProtoDispAdapterDisplayNciPacket(uint8_t* nciPacket, uint16_t nciPacketLen,
-                                      bool is_recv);
-void DispLLCP(NFC_HDR* p_buf, bool is_recv);
-void DispHcp(uint8_t* data, uint16_t len, bool is_recv);
diff --git a/src/include/buildcfg.h b/src/include/buildcfg.h
index 53f7aa2..86e7aec 100644
--- a/src/include/buildcfg.h
+++ b/src/include/buildcfg.h
@@ -44,9 +44,4 @@
 
 #define GKI_NUM_FIXED_BUF_POOLS 4
 
-extern void DispNci(uint8_t* p, uint16_t len, bool is_recv);
-
-void ProtoDispAdapterDisplayNciPacket(uint8_t* nciPacket, uint16_t nciPacketLen,
-                                      bool is_recv);
-#define DISP_NCI ProtoDispAdapterDisplayNciPacket
 #endif
diff --git a/src/include/metrics.h b/src/include/metrics.h
new file mode 100644
index 0000000..2435a04
--- /dev/null
+++ b/src/include/metrics.h
@@ -0,0 +1,21 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 Google, Inc.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+enum ErrorType { UNKNOWN, NCI_TIMEOUT, ERROR_NTF, AID_OVERFLOW };
diff --git a/src/include/nci_defs.h b/src/include/nci_defs.h
index 3cbe41b..6745673 100644
--- a/src/include/nci_defs.h
+++ b/src/include/nci_defs.h
@@ -489,6 +489,8 @@
 #define NCI_PARAM_ID_RF_FIELD_INFO 0x80
 #define NCI_PARAM_ID_NFC_DEP_OP 0x82
 
+#define NCI_PARAM_ID_NFCC_CONFIG_CONTROL 0x85
+
 /* Type A Parameters */
 #define NCI_PARAM_PLATFORM_T1T 0x0C
 #define NCI_PARAM_SEL_INFO_ISODEP 0x20
diff --git a/src/include/nfc_brcm_defs.h b/src/include/nfc_brcm_defs.h
old mode 100644
new mode 100755
index 16a3e20..d2a0d30
--- a/src/include/nfc_brcm_defs.h
+++ b/src/include/nfc_brcm_defs.h
@@ -46,16 +46,9 @@
 /**********************************************
  * NCI Interface Types
  **********************************************/
-#define NCI_INTERFACE_VS_MIFARE 0x80
+#define NCI_INTERFACE_VS_MIFARE NCI_PROTOCOL_MIFARE
 #define NCI_INTERFACE_VS_T2T_CE 0x82 /* for Card Emulation side */
 
-/**********************************************
- * NCI Proprietary Parameter IDs
- **********************************************/
-#define NCI_PARAM_ID_HOST_LISTEN_MASK 0xA2
-#define NCI_PARAM_ID_TAGSNIFF_CFG 0xB9
-#define NCI_PARAM_ID_ACT_ORDER 0xC5
-
 #define NFC_SNOOZE_MODE_UART 0x01    /* Snooze mode for UART    */
 
 #define NFC_SNOOZE_ACTIVE_LOW 0x00  /* high to low voltage is asserting */
diff --git a/src/include/nfc_config.h b/src/include/nfc_config.h
index c3687d9..68e2d88 100644
--- a/src/include/nfc_config.h
+++ b/src/include/nfc_config.h
@@ -36,12 +36,15 @@
 #define NAME_AID_FOR_EMPTY_SELECT "AID_FOR_EMPTY_SELECT"
 #define NAME_AID_MATCHING_MODE "AID_MATCHING_MODE"
 #define NAME_OFFHOST_AID_ROUTE_PWR_STATE "OFFHOST_AID_ROUTE_PWR_STATE"
+#define NAME_LEGACY_MIFARE_READER "LEGACY_MIFARE_READER"
 
 /* Configs from vendor interface */
 #define NAME_NFA_POLL_BAIL_OUT_MODE "NFA_POLL_BAIL_OUT_MODE"
 #define NAME_PRESENCE_CHECK_ALGORITHM "PRESENCE_CHECK_ALGORITHM"
 #define NAME_NFA_PROPRIETARY_CFG "NFA_PROPRIETARY_CFG"
 #define NAME_DEFAULT_OFFHOST_ROUTE "DEFAULT_OFFHOST_ROUTE"
+#define NAME_OFFHOST_ROUTE_ESE "OFFHOST_ROUTE_ESE"
+#define NAME_OFFHOST_ROUTE_UICC "OFFHOST_ROUTE_UICC"
 #define NAME_DEFAULT_NFCF_ROUTE "DEFAULT_NFCF_ROUTE"
 #define NAME_DEFAULT_SYS_CODE "DEFAULT_SYS_CODE"
 #define NAME_DEFAULT_SYS_CODE_ROUTE "DEFAULT_SYS_CODE_ROUTE"
@@ -51,6 +54,7 @@
 #define NAME_OFF_HOST_SIM_PIPE_ID "OFF_HOST_SIM_PIPE_ID"
 #define NAME_ISO_DEP_MAX_TRANSCEIVE "ISO_DEP_MAX_TRANSCEIVE"
 #define NAME_DEVICE_HOST_WHITE_LIST "DEVICE_HOST_WHITE_LIST"
+#define NAME_DEFAULT_ISODEP_ROUTE "DEFAULT_ISODEP_ROUTE"
 
 class NfcConfig {
  public:
diff --git a/src/include/nfc_hal_int.h b/src/include/nfc_hal_int.h
index b33a38b..8e6aa2e 100644
--- a/src/include/nfc_hal_int.h
+++ b/src/include/nfc_hal_int.h
@@ -266,14 +266,4 @@
 #define nfc_hal_hci_evt_hdlr(p) ;
 #endif
 
-/* Define default NCI protocol trace function (if protocol tracing is enabled)
- */
-#if (NFC_HAL_TRACE_PROTOCOL == TRUE)
-#if !defined(DISP_NCI)
-#define DISP_NCI (DispNci)
-void DispNci(uint8_t* p, uint16_t len, bool is_recv);
-#endif /* DISP_NCI */
-
-#endif /* NFC_HAL_TRACE_PROTOCOL */
-
 #endif /* NFC_HAL_INT_H */
diff --git a/src/include/nfc_target.h b/src/include/nfc_target.h
index 3de5a84..8cf8c61 100644
--- a/src/include/nfc_target.h
+++ b/src/include/nfc_target.h
@@ -330,6 +330,11 @@
 #define RW_I93_FLAG_DATA_RATE I93_FLAG_DATA_RATE_HIGH
 #endif
 
+/* RW Mifare Classic Tag timeout for each API call, in ms */
+#ifndef RW_MFC_TOUT_RESP
+#define RW_MFC_TOUT_RESP 300
+#endif
+
 /* TRUE, to include Card Emulation related test commands */
 #ifndef CE_TEST_INCLUDED
 #define CE_TEST_INCLUDED FALSE
@@ -423,7 +428,7 @@
 /* Response Waiting Time */
 #ifndef LLCP_WAITING_TIME
 /* its scaled value should be less than LTO */
-#define LLCP_WAITING_TIME 7
+#define LLCP_WAITING_TIME 8
 #endif
 
 /* Options Parameters */
diff --git a/src/include/trace_api.h b/src/include/trace_api.h
deleted file mode 100644
index 47eb0aa..0000000
--- a/src/include/trace_api.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/******************************************************************************
- *
- *  Copyright (C) 1999-2012 Broadcom Corporation
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-
-/******************************************************************************
- *
- *  Contains API for BTE Test Tool trace related functions.
- *
- ******************************************************************************/
-
-#ifndef TRACE_API_H
-#define TRACE_API_H
-
-#include "bt_types.h"
-#include "nfc_hal_api.h"
-
-/* Trace API Function External Declarations */
-extern void DispT3TagMessage(NFC_HDR* p_msg, bool is_rx);
-extern void DispRWT4Tags(NFC_HDR* p_buf, bool is_rx);
-extern void DispCET4Tags(NFC_HDR* p_buf, bool is_rx);
-extern void DispRWI93Tag(NFC_HDR* p_buf, bool is_rx,
-                         uint8_t command_to_respond);
-
-extern void DispLLCP(NFC_HDR* p_buf, bool is_rx);
-extern void DispHcp(uint8_t* p, uint16_t len, bool is_recv);
-
-#endif /* TRACE_API_H */
diff --git a/src/nfa/ce/nfa_ce_act.cc b/src/nfa/ce/nfa_ce_act.cc
index e82e959..1efca7d 100644
--- a/src/nfa/ce/nfa_ce_act.cc
+++ b/src/nfa/ce/nfa_ce_act.cc
@@ -184,7 +184,7 @@
     case CE_T4T_NDEF_UPDATE_ABORT_EVT:
       conn_evt.ndef_write_cplt.len = 0;
       conn_evt.ndef_write_cplt.status = NFA_STATUS_FAILED;
-      conn_evt.ndef_write_cplt.p_data = NULL;
+      conn_evt.ndef_write_cplt.p_data = nullptr;
       (*p_cb->p_active_conn_cback)(NFA_CE_NDEF_WRITE_CPLT_EVT, &conn_evt);
       break;
 
@@ -624,8 +624,8 @@
   /* Handle NDEF stopping */
   if (listen_info_idx == NFA_CE_LISTEN_INFO_IDX_NDEF) {
     /* clear NDEF contents */
-    CE_T3tSetLocalNDEFMsg(true, 0, 0, NULL, NULL);
-    CE_T4tSetLocalNDEFMsg(true, 0, 0, NULL, NULL);
+    CE_T3tSetLocalNDEFMsg(true, 0, 0, nullptr, nullptr);
+    CE_T4tSetLocalNDEFMsg(true, 0, 0, nullptr, nullptr);
 
     if (p_cb->listen_info[listen_info_idx].protocol_mask &
         NFA_PROTOCOL_MASK_T3T) {
@@ -676,7 +676,7 @@
   tNFA_CE_CB* p_cb = &nfa_ce_cb;
   if (p_cb->p_scratch_buf) {
     nfa_mem_co_free(p_cb->p_scratch_buf);
-    p_cb->p_scratch_buf = NULL;
+    p_cb->p_scratch_buf = nullptr;
   }
 }
 
@@ -702,14 +702,14 @@
     /* If no scratch buffer allocated yet, or if current scratch buffer size is
      * different from current ndef size, */
     /* then allocate a new scratch buffer. */
-    if ((nfa_ce_cb.p_scratch_buf == NULL) ||
+    if ((nfa_ce_cb.p_scratch_buf == nullptr) ||
         (nfa_ce_cb.scratch_buf_size != nfa_ce_cb.ndef_max_size)) {
       /* Free existing scratch buffer, if one was allocated */
       nfa_ce_free_scratch_buf();
 
       nfa_ce_cb.p_scratch_buf =
           (uint8_t*)nfa_mem_co_alloc(nfa_ce_cb.ndef_max_size);
-      if (nfa_ce_cb.p_scratch_buf != NULL) {
+      if (nfa_ce_cb.p_scratch_buf != nullptr) {
         nfa_ce_cb.scratch_buf_size = nfa_ce_cb.ndef_max_size;
       } else {
         LOG(ERROR) << StringPrintf(
@@ -777,8 +777,8 @@
 
   if (status != NFA_STATUS_OK) {
     /* clear NDEF contents */
-    CE_T3tSetLocalNDEFMsg(true, 0, 0, NULL, NULL);
-    CE_T4tSetLocalNDEFMsg(true, 0, 0, NULL, NULL);
+    CE_T3tSetLocalNDEFMsg(true, 0, 0, nullptr, nullptr);
+    CE_T4tSetLocalNDEFMsg(true, 0, 0, nullptr, nullptr);
 
     LOG(ERROR) << StringPrintf("Unable to set contents (error %02x)", status);
   }
@@ -804,10 +804,10 @@
       p_ce_msg->activate_ntf.p_activation_params;
   tNFA_CE_CB* p_cb = &nfa_ce_cb;
   tNFA_CONN_EVT_DATA conn_evt;
-  tCE_CBACK* p_ce_cback = NULL;
+  tCE_CBACK* p_ce_cback = nullptr;
   uint16_t t3t_system_code = 0xFFFF;
   uint8_t listen_info_idx = NFA_CE_LISTEN_INFO_IDX_INVALID;
-  uint8_t* p_nfcid2 = NULL;
+  uint8_t* p_nfcid2 = nullptr;
   uint8_t i;
   bool t4t_activate_pending = false;
 
@@ -1092,7 +1092,7 @@
     nfa_ce_remove_listen_info_entry(p_cb->idx_cur_active, true);
   }
 
-  p_cb->p_active_conn_cback = NULL;
+  p_cb->p_active_conn_cback = nullptr;
   p_cb->idx_cur_active = NFA_CE_LISTEN_INFO_IDX_INVALID;
 
   /* Restart listening (if any listen_info entries are still active) */
@@ -1190,8 +1190,8 @@
         NFA_HANDLE_INVALID;
 
     /* clear NDEF contents */
-    CE_T3tSetLocalNDEFMsg(true, 0, 0, NULL, NULL);
-    CE_T4tSetLocalNDEFMsg(true, 0, 0, NULL, NULL);
+    CE_T3tSetLocalNDEFMsg(true, 0, 0, nullptr, nullptr);
+    CE_T4tSetLocalNDEFMsg(true, 0, 0, nullptr, nullptr);
   }
 
   /* Store NDEF info to control block */
@@ -1263,12 +1263,20 @@
         (p_cb->listen_info[i].flags & NFA_CE_LISTEN_INFO_IN_USE) &&
         (p_cb->listen_info[i].flags & NFA_CE_LISTEN_INFO_UICC) &&
         (p_cb->listen_info[i].ee_handle == p_ce_msg->reg_listen.ee_handle)) {
-      LOG(ERROR) << StringPrintf("UICC (0x%x) listening already specified",
+      if(p_cb->listen_info[i].tech_mask == p_ce_msg->reg_listen.tech_mask) {
+        LOG(ERROR) << StringPrintf("UICC (0x%x) listening already specified",
                                  p_ce_msg->reg_listen.ee_handle);
-      conn_evt.status = NFA_STATUS_FAILED;
-      nfa_dm_conn_cback_event_notify(NFA_CE_UICC_LISTEN_CONFIGURED_EVT,
+        conn_evt.status = NFA_STATUS_FAILED;
+        nfa_dm_conn_cback_event_notify(NFA_CE_UICC_LISTEN_CONFIGURED_EVT,
                                      &conn_evt);
-      return true;
+        return true;
+      } else {
+        DLOG_IF(INFO, nfc_debug_enabled)
+        << StringPrintf("UICC (0x%x) listening parameter changed to %x",
+                                 p_ce_msg->reg_listen.ee_handle, p_ce_msg->reg_listen.tech_mask);
+        listen_info_idx = i;
+        break;
+      }
     }
     /* If this is a free entry, and we haven't found one yet, remember it */
     else if ((!(p_cb->listen_info[i].flags & NFA_CE_LISTEN_INFO_IN_USE)) &&
diff --git a/src/nfa/ce/nfa_ce_api.cc b/src/nfa/ce/nfa_ce_api.cc
index ed8d8ba..55ad70b 100644
--- a/src/nfa/ce/nfa_ce_api.cc
+++ b/src/nfa/ce/nfa_ce_api.cc
@@ -58,7 +58,7 @@
   }
 
   p_ce_msg = (tNFA_CE_MSG*)GKI_getbuf((uint16_t)(sizeof(tNFA_CE_MSG)));
-  if (p_ce_msg != NULL) {
+  if (p_ce_msg != nullptr) {
     p_ce_msg->hdr.event = NFA_CE_API_DEREG_LISTEN_EVT;
     p_ce_msg->dereg_listen.handle = handle;
     p_ce_msg->dereg_listen.listen_info = listen_info;
@@ -130,7 +130,7 @@
   if (protocol_mask) {
     /* If any protocols are specified, then NDEF buffer pointer must be non-NULL
      */
-    if (p_ndef_data == NULL) {
+    if (p_ndef_data == nullptr) {
       LOG(ERROR) << StringPrintf(
           "NFA_CeConfigureLocalTag: NULL ndef data pointer");
       return (NFA_STATUS_INVALID_PARAM);
@@ -151,7 +151,7 @@
     }
   }
   p_msg = (tNFA_CE_MSG*)GKI_getbuf((uint16_t)sizeof(tNFA_CE_MSG));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->local_tag.hdr.event = NFA_CE_API_CFG_LOCAL_TAG_EVT;
 
     /* Copy ndef info */
@@ -213,7 +213,7 @@
   /* Otherwise then app is configuring uicc listen for the specificed
    * technologies */
   p_msg = (tNFA_CE_MSG*)GKI_getbuf((uint16_t)sizeof(tNFA_CE_MSG));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->reg_listen.hdr.event = NFA_CE_API_REG_LISTEN_EVT;
     p_msg->reg_listen.listen_type = NFA_CE_REG_TYPE_UICC;
 
@@ -259,10 +259,10 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   /* Validate parameters */
-  if (p_conn_cback == NULL) return (NFA_STATUS_INVALID_PARAM);
+  if (p_conn_cback == nullptr) return (NFA_STATUS_INVALID_PARAM);
 
   p_msg = (tNFA_CE_MSG*)GKI_getbuf((uint16_t)sizeof(tNFA_CE_MSG));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->reg_listen.hdr.event = NFA_CE_API_REG_LISTEN_EVT;
     p_msg->reg_listen.p_conn_cback = p_conn_cback;
     p_msg->reg_listen.listen_type = NFA_CE_REG_TYPE_FELICA;
@@ -334,10 +334,10 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   /* Validate parameters */
-  if (p_conn_cback == NULL) return (NFA_STATUS_INVALID_PARAM);
+  if (p_conn_cback == nullptr) return (NFA_STATUS_INVALID_PARAM);
 
   p_msg = (tNFA_CE_MSG*)GKI_getbuf((uint16_t)sizeof(tNFA_CE_MSG));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->reg_listen.hdr.event = NFA_CE_API_REG_LISTEN_EVT;
     p_msg->reg_listen.p_conn_cback = p_conn_cback;
     p_msg->reg_listen.listen_type = NFA_CE_REG_TYPE_ISO_DEP;
@@ -417,7 +417,7 @@
   }
 
   p_msg = (tNFA_CE_MSG*)GKI_getbuf((uint16_t)sizeof(tNFA_CE_MSG));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_CE_API_CFG_ISODEP_TECH_EVT;
     p_msg->hdr.layer_specific = tech_mask;
 
diff --git a/src/nfa/ce/nfa_ce_main.cc b/src/nfa/ce/nfa_ce_main.cc
index d082969..62f1370 100644
--- a/src/nfa/ce/nfa_ce_main.cc
+++ b/src/nfa/ce/nfa_ce_main.cc
@@ -44,7 +44,7 @@
 static void nfa_ce_proc_nfcc_power_mode(uint8_t nfcc_power_mode);
 
 static const tNFA_SYS_REG nfa_ce_sys_reg = {
-    NULL, nfa_ce_hdl_event, nfa_ce_sys_disable, nfa_ce_proc_nfcc_power_mode};
+    nullptr, nfa_ce_hdl_event, nfa_ce_sys_disable, nfa_ce_proc_nfcc_power_mode};
 
 /* NFA_CE actions */
 const tNFA_CE_ACTION nfa_ce_action_tbl[] = {
@@ -105,7 +105,7 @@
   tNFA_CE_LISTEN_INFO* p_info;
   uint8_t xx;
 
-  NFC_SetStaticRfCback(NULL);
+  NFC_SetStaticRfCback(nullptr);
 
   /* Free scratch buf if any */
   nfa_ce_free_scratch_buf();
diff --git a/src/nfa/dm/nfa_dm_act.cc b/src/nfa/dm/nfa_dm_act.cc
index 59d55a6..5476749 100644
--- a/src/nfa/dm/nfa_dm_act.cc
+++ b/src/nfa/dm/nfa_dm_act.cc
@@ -101,7 +101,7 @@
     nfa_dm_cb.flags &= ~NFA_DM_FLAGS_NFCC_IS_RESTORING;
 
     /* reconfigure BRCM NFCC */
-    nfa_dm_disc_sm_execute(NFA_DM_RF_DISCOVER_CMD, NULL);
+    nfa_dm_disc_sm_execute(NFA_DM_RF_DISCOVER_CMD, nullptr);
   }
 
   nfa_dm_cb.flags &= ~NFA_DM_FLAGS_SETTING_PWR_MODE;
@@ -183,7 +183,7 @@
   nfa_dm_cb.params.wt[0] = 14;
 
   /* Set CE default configuration */
-  if (p_nfa_dm_ce_cfg[0]) {
+  if (p_nfa_dm_ce_cfg[0] && NFC_GetNCIVersion() != NCI_VERSION_2_0) {
     nfa_dm_check_set_config(p_nfa_dm_ce_cfg[0], &p_nfa_dm_ce_cfg[1], false);
   }
 
@@ -194,7 +194,7 @@
 
   if (p_nfa_dm_interface_mapping && nfa_dm_num_dm_interface_mapping) {
     NFC_DiscoveryMap(nfa_dm_num_dm_interface_mapping,
-                     p_nfa_dm_interface_mapping, NULL);
+                     p_nfa_dm_interface_mapping, nullptr);
   }
 }
 
@@ -246,7 +246,7 @@
   nfa_dm_cb.flags &=
       ~(NFA_DM_FLAGS_DM_IS_ACTIVE | NFA_DM_FLAGS_DM_DISABLING_NFC |
         NFA_DM_FLAGS_ENABLE_EVT_PEND);
-  (*nfa_dm_cb.p_dm_cback)(NFA_DM_DISABLE_EVT, NULL);
+  (*nfa_dm_cb.p_dm_cback)(NFA_DM_DISABLE_EVT, nullptr);
 }
 
 /*******************************************************************************
@@ -397,7 +397,7 @@
       dm_cback_evt = (event == NFC_NFCC_TIMEOUT_REVT)
                          ? NFA_DM_NFCC_TIMEOUT_EVT
                          : NFA_DM_NFCC_TRANSPORT_ERR_EVT;
-      (*nfa_dm_cb.p_dm_cback)(dm_cback_evt, NULL);
+      (*nfa_dm_cb.p_dm_cback)(dm_cback_evt, nullptr);
       break;
 
     case NFC_NFCC_POWER_OFF_REVT:
@@ -603,6 +603,7 @@
         << StringPrintf("NFA_DM_RFST_LISTEN_ACTIVE");
     /* NFCC will give semantic error for power sub state command in Rf listen
      * active state */
+    nfa_dm_cb.pending_power_state = nfa_dm_cb.power_state;
     status = NFC_STATUS_SEMANTIC_ERROR;
   } else {
     status = NFC_SetPowerSubState(p_data->set_power_state.screen_state);
@@ -660,8 +661,8 @@
   conn_evt.status = NFA_STATUS_OK;
   (*nfa_dm_cb.p_excl_conn_cback)(NFA_EXCLUSIVE_RF_CONTROL_STOPPED_EVT,
                                  &conn_evt);
-  nfa_dm_cb.p_excl_conn_cback = NULL;
-  nfa_dm_cb.p_excl_ndef_cback = NULL;
+  nfa_dm_cb.p_excl_conn_cback = nullptr;
+  nfa_dm_cb.p_excl_ndef_cback = nullptr;
 }
 
 /*******************************************************************************
@@ -916,6 +917,7 @@
       poll_disc_mask |= NFA_DM_DISC_MASK_PA_ISO_DEP;
       poll_disc_mask |= NFA_DM_DISC_MASK_PA_NFC_DEP;
       poll_disc_mask |= NFA_DM_DISC_MASK_P_LEGACY;
+      poll_disc_mask |= NFA_DM_DISC_MASK_PA_MIFARE;
     }
     if (NFC_GetNCIVersion() == NCI_VERSION_2_0) {
       if (poll_tech_mask & NFA_TECHNOLOGY_MASK_ACTIVE) {
@@ -1207,7 +1209,7 @@
       << StringPrintf("tech_mask = %d", p_data->set_p2p_listen_tech.tech_mask);
 
   nfa_p2p_update_listen_tech(p_data->set_p2p_listen_tech.tech_mask);
-  nfa_dm_conn_cback_event_notify(NFA_SET_P2P_LISTEN_TECH_EVT, NULL);
+  nfa_dm_conn_cback_event_notify(NFA_SET_P2P_LISTEN_TECH_EVT, nullptr);
 
   return true;
 }
@@ -1431,7 +1433,7 @@
           "pointer");
     }
   } else if (event == NFC_DEACTIVATE_CEVT) {
-    NFC_SetStaticRfCback(NULL);
+    NFC_SetStaticRfCback(nullptr);
   }
 }
 
@@ -1487,14 +1489,15 @@
               (nfa_dm_cb.disc_cb.activated_protocol == NFC_PROTOCOL_T3T) ||
               (nfa_dm_cb.disc_cb.activated_protocol == NFC_PROTOCOL_ISO_DEP) ||
               (nfa_dm_cb.disc_cb.activated_protocol == NFA_PROTOCOL_T5T) ||
-              (nfa_dm_cb.disc_cb.activated_protocol == NFC_PROTOCOL_KOVIO)) {
+              (nfa_dm_cb.disc_cb.activated_protocol == NFC_PROTOCOL_KOVIO) ||
+              (nfa_dm_cb.disc_cb.activated_protocol == NFC_PROTOCOL_MIFARE)) {
             /* Notify NFA tag sub-system */
             nfa_rw_proc_disc_evt(NFA_DM_RF_DISC_ACTIVATED_EVT, p_data, false);
           } else /* if NFC-DEP, ISO-DEP with frame interface or others */
           {
             /* Set data callback to receive raw frame */
             NFC_SetStaticRfCback(nfa_dm_act_data_cback);
-            nfa_dm_notify_activation_status(NFA_STATUS_OK, NULL);
+            nfa_dm_notify_activation_status(NFA_STATUS_OK, nullptr);
           }
         } else {
           /* deactivate and restart RF discovery */
@@ -1514,7 +1517,7 @@
 
       if (nfa_dm_cb.disc_cb.activated_protocol != NFC_PROTOCOL_NFC_DEP) {
         /* Notify NFA RW sub-systems */
-        nfa_rw_proc_disc_evt(NFA_DM_RF_DISC_DEACTIVATED_EVT, NULL, false);
+        nfa_rw_proc_disc_evt(NFA_DM_RF_DISC_DEACTIVATED_EVT, nullptr, false);
       }
 
       /* if deactivated as sleep mode */
@@ -1581,18 +1584,18 @@
               ((nfa_dm_cb.eDtaMode & 0x0F) == NFA_DTA_DEFAULT_MODE)) {
             /* Open raw channel in case of p2p for DTA testing */
             NFC_SetStaticRfCback(nfa_dm_act_data_cback);
-            nfa_dm_notify_activation_status(NFA_STATUS_OK, NULL);
+            nfa_dm_notify_activation_status(NFA_STATUS_OK, nullptr);
           } else {
             if (!(nfa_dm_cb.flags & NFA_DM_FLAGS_P2P_PAUSED)) {
               /* activate LLCP */
               nfa_p2p_activate_llcp(p_data);
               if (nfa_dm_cb.p_activate_ntf) {
                 GKI_freebuf(nfa_dm_cb.p_activate_ntf);
-                nfa_dm_cb.p_activate_ntf = NULL;
+                nfa_dm_cb.p_activate_ntf = nullptr;
               }
             } else {
               DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("P2P is paused");
-              nfa_dm_notify_activation_status(NFA_STATUS_OK, NULL);
+              nfa_dm_notify_activation_status(NFA_STATUS_OK, nullptr);
             }
           }
         } else if ((nfa_dm_cb.disc_cb.activated_protocol == NFC_PROTOCOL_T1T) ||
@@ -1611,7 +1614,7 @@
         {
           /* Set data callback to receive raw frame */
           NFC_SetStaticRfCback(nfa_dm_act_data_cback);
-          nfa_dm_notify_activation_status(NFA_STATUS_OK, NULL);
+          nfa_dm_notify_activation_status(NFA_STATUS_OK, nullptr);
         }
       } else {
         /* deactivate and restart RF discovery */
@@ -1637,7 +1640,7 @@
         */
       } else {
         /* Notify NFA RW sub-systems */
-        nfa_rw_proc_disc_evt(NFA_DM_RF_DISC_DEACTIVATED_EVT, NULL, true);
+        nfa_rw_proc_disc_evt(NFA_DM_RF_DISC_DEACTIVATED_EVT, nullptr, true);
       }
 
       /* if NFA sent NFA_ACTIVATED_EVT earlier */
@@ -1701,7 +1704,7 @@
                                      tNFA_TAG_PARAMS* p_params) {
   tNFA_CONN_EVT_DATA evt_data;
   tNFC_RF_TECH_PARAMS* p_tech_params;
-  uint8_t *p_nfcid = NULL, nfcid_len;
+  uint8_t *p_nfcid = nullptr, nfcid_len;
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("status:0x%X", status);
 
@@ -1724,7 +1727,7 @@
 
     /* get length of NFCID and location */
     if (p_tech_params->mode == NFC_DISCOVERY_TYPE_POLL_A) {
-      if ((p_tech_params->param.pa.nfcid1_len == 0) && (p_params != NULL)) {
+      if ((p_tech_params->param.pa.nfcid1_len == 0) && (p_params != nullptr)) {
         nfcid_len = sizeof(p_params->t1t.uid);
         p_nfcid = p_params->t1t.uid;
         evt_data.activated.activate_ntf.rf_tech_param.param.pa.nfcid1_len =
@@ -1806,7 +1809,7 @@
   }
 
   GKI_freebuf(nfa_dm_cb.p_activate_ntf);
-  nfa_dm_cb.p_activate_ntf = NULL;
+  nfa_dm_cb.p_activate_ntf = nullptr;
 }
 
 /*******************************************************************************
diff --git a/src/nfa/dm/nfa_dm_api.cc b/src/nfa/dm/nfa_dm_api.cc
index 197174a..e8334dc 100644
--- a/src/nfa/dm/nfa_dm_api.cc
+++ b/src/nfa/dm/nfa_dm_api.cc
@@ -108,7 +108,7 @@
   }
 
   p_msg = (tNFA_DM_API_ENABLE*)GKI_getbuf(sizeof(tNFA_DM_API_ENABLE));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_ENABLE_EVT;
     p_msg->p_dm_cback = p_dm_cback;
     p_msg->p_conn_cback = p_conn_cback;
@@ -148,7 +148,7 @@
       << StringPrintf("NFA_Disable (graceful=%i)", graceful);
 
   p_msg = (tNFA_DM_API_DISABLE*)GKI_getbuf(sizeof(tNFA_DM_API_DISABLE));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_DISABLE_EVT;
     p_msg->graceful = graceful;
 
@@ -192,7 +192,7 @@
   tNFA_DM_API_SET_POWER_SUB_STATE* p_msg =
       (tNFA_DM_API_SET_POWER_SUB_STATE*)GKI_getbuf(buf_size);
 
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SET_POWER_SUB_STATE_EVT;
     switch (screenState) {
       case NFA_SCREEN_STATE_ON_UNLOCKED:
@@ -246,7 +246,7 @@
 
   p_msg = (tNFA_DM_API_SET_CONFIG*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_DM_API_SET_CONFIG) + length));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SET_CONFIG_EVT;
 
     p_msg->param_id = param_id;
@@ -283,7 +283,7 @@
 
   p_msg = (tNFA_DM_API_GET_CONFIG*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_DM_API_GET_CONFIG) + num_ids));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_GET_CONFIG_EVT;
 
     p_msg->num_ids = num_ids;
@@ -350,7 +350,7 @@
 
   p_msg = (tNFA_DM_API_REQ_EXCL_RF_CTRL*)GKI_getbuf(
       sizeof(tNFA_DM_API_REQ_EXCL_RF_CTRL));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_REQUEST_EXCL_RF_CTRL_EVT;
     p_msg->poll_mask = poll_mask;
     p_msg->p_conn_cback = p_conn_cback;
@@ -393,7 +393,7 @@
   }
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_RELEASE_EXCL_RF_CTRL_EVT;
     nfa_sys_sendmsg(p_msg);
     return (NFA_STATUS_OK);
@@ -443,7 +443,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("0x%X", poll_mask);
 
   p_msg = (tNFA_DM_API_ENABLE_POLL*)GKI_getbuf(sizeof(tNFA_DM_API_ENABLE_POLL));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_ENABLE_POLLING_EVT;
     p_msg->poll_mask = poll_mask;
 
@@ -477,7 +477,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_DISABLE_POLLING_EVT;
 
     nfa_sys_sendmsg(p_msg);
@@ -517,7 +517,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_ENABLE_LISTENING_EVT;
 
     nfa_sys_sendmsg(p_msg);
@@ -551,7 +551,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_DISABLE_LISTENING_EVT;
 
     nfa_sys_sendmsg(p_msg);
@@ -588,7 +588,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_PAUSE_P2P_EVT;
 
     nfa_sys_sendmsg(p_msg);
@@ -621,7 +621,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_RESUME_P2P_EVT;
 
     nfa_sys_sendmsg(p_msg);
@@ -659,7 +659,7 @@
 
   p_msg = (tNFA_DM_API_SET_P2P_LISTEN_TECH*)GKI_getbuf(
       sizeof(tNFA_DM_API_SET_P2P_LISTEN_TECH));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SET_P2P_LISTEN_TECH_EVT;
     p_msg->tech_mask = tech_mask;
 
@@ -691,7 +691,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_START_RF_DISCOVERY_EVT;
 
     nfa_sys_sendmsg(p_msg);
@@ -721,7 +721,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_STOP_RF_DISCOVERY_EVT;
 
     nfa_sys_sendmsg(p_msg);
@@ -761,7 +761,7 @@
 
   /* Post the API message */
   p_msg = (tNFA_DM_API_SET_RF_DISC_DUR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SET_RF_DISC_DURATION_EVT;
 
     /* Set discovery duration */
@@ -811,7 +811,7 @@
 
   p_msg =
       (tNFA_DM_API_SELECT*)GKI_getbuf((uint16_t)(sizeof(tNFA_DM_API_SELECT)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SELECT_EVT;
     p_msg->rf_disc_id = rf_disc_id;
     p_msg->protocol = protocol;
@@ -846,7 +846,7 @@
 
   p_msg = (tNFA_DM_API_UPDATE_RF_PARAMS*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_DM_API_UPDATE_RF_PARAMS)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_UPDATE_RF_PARAMS_EVT;
     memcpy(&p_msg->params, p_params, sizeof(tNFA_RF_COMM_PARAMS));
 
@@ -896,7 +896,7 @@
 
   p_msg = (tNFA_DM_API_DEACTIVATE*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_DM_API_DEACTIVATE)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_DEACTIVATE_EVT;
     p_msg->sleep_mode = sleep_mode;
 
@@ -936,7 +936,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("data_len:%d", data_len);
 
   /* Validate parameters */
-  if ((data_len == 0) || (p_raw_data == NULL))
+  if ((data_len == 0) || (p_raw_data == nullptr))
     return (NFA_STATUS_INVALID_PARAM);
 
   size = NFC_HDR_SIZE + NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE + data_len;
@@ -946,7 +946,7 @@
     return NFA_STATUS_INVALID_PARAM;
   }
   p_msg = (NFC_HDR*)GKI_getbuf(size);
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_RAW_FRAME_EVT;
     p_msg->layer_specific = presence_check_start_delay;
     p_msg->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
@@ -1010,7 +1010,7 @@
 
   p_msg = (tNFA_DM_API_REG_NDEF_HDLR*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_DM_API_REG_NDEF_HDLR) + type_name_len));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_REG_NDEF_HDLR_EVT;
 
     p_msg->flags =
@@ -1070,7 +1070,7 @@
 
   p_msg = (tNFA_DM_API_REG_NDEF_HDLR*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_DM_API_REG_NDEF_HDLR) + uri_id_len));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_REG_NDEF_HDLR_EVT;
 
     p_msg->flags = NFA_NDEF_FLAGS_WKT_URI;
@@ -1116,7 +1116,7 @@
 
   p_msg = (tNFA_DM_API_DEREG_NDEF_HDLR*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_DM_API_DEREG_NDEF_HDLR)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_DEREG_NDEF_HDLR_EVT;
     p_msg->ndef_type_handle = ndef_type_handle;
 
@@ -1156,7 +1156,7 @@
   }
 
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_POWER_OFF_SLEEP_EVT;
     p_msg->layer_specific = start_stop;
 
@@ -1186,13 +1186,13 @@
   DLOG_IF(INFO, nfc_debug_enabled)
       << StringPrintf("is_register=%d", is_register);
 
-  if (p_cback == NULL) {
+  if (p_cback == nullptr) {
     LOG(ERROR) << StringPrintf("requires a valid callback function");
     return (NFA_STATUS_FAILED);
   }
 
   p_msg = (tNFA_DM_API_REG_VSC*)GKI_getbuf(sizeof(tNFA_DM_API_REG_VSC));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_REG_VSC_EVT;
     p_msg->is_register = is_register;
     p_msg->p_cback = p_cback;
@@ -1230,7 +1230,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("oid=0x%x", oid);
 
   p_msg = (tNFA_DM_API_SEND_VSC*)GKI_getbuf(size);
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SEND_VSC_EVT;
     p_msg->oid = oid;
     p_msg->p_cback = p_cback;
@@ -1240,7 +1240,7 @@
       memcpy(p_msg->p_cmd_params, p_cmd_params, cmd_params_len);
     } else {
       p_msg->cmd_params_len = 0;
-      p_msg->p_cmd_params = NULL;
+      p_msg->p_cmd_params = nullptr;
     }
 
     nfa_sys_sendmsg(p_msg);
@@ -1269,13 +1269,13 @@
 *******************************************************************************/
 tNFA_STATUS NFA_SendRawVsCommand(uint8_t cmd_params_len, uint8_t* p_cmd_params,
                                  tNFA_VSC_CBACK* p_cback) {
-  if (cmd_params_len == 0x00 || p_cmd_params == NULL || p_cback == NULL) {
+  if (cmd_params_len == 0x00 || p_cmd_params == nullptr || p_cback == nullptr) {
     return NFA_STATUS_INVALID_PARAM;
   }
   uint16_t size = sizeof(tNFA_DM_API_SEND_VSC) + cmd_params_len;
   tNFA_DM_API_SEND_VSC* p_msg = (tNFA_DM_API_SEND_VSC*)GKI_getbuf(size);
 
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SEND_RAW_VS_EVT;
     p_msg->p_cback = p_cback;
     if (cmd_params_len && p_cmd_params) {
@@ -1284,7 +1284,7 @@
       memcpy(p_msg->p_cmd_params, p_cmd_params, cmd_params_len);
     } else {
       p_msg->cmd_params_len = 0;
-      p_msg->p_cmd_params = NULL;
+      p_msg->p_cmd_params = nullptr;
     }
 
     nfa_sys_sendmsg(p_msg);
diff --git a/src/nfa/dm/nfa_dm_cfg.cc b/src/nfa/dm/nfa_dm_cfg.cc
index ceef2ff..21c72c7 100644
--- a/src/nfa/dm/nfa_dm_cfg.cc
+++ b/src/nfa/dm/nfa_dm_cfg.cc
@@ -42,7 +42,7 @@
 
 uint8_t* p_nfa_dm_ce_cfg = (uint8_t*)nfa_dm_ce_cfg;
 
-uint8_t* p_nfa_dm_gen_cfg = NULL;
+uint8_t* p_nfa_dm_gen_cfg = nullptr;
 
 /* the RF Discovery Frequency for each technology */
 const tNFA_DM_DISC_FREQ_CFG nfa_dm_rf_disc_freq_cfg = {
@@ -63,7 +63,7 @@
 uint8_t nfa_ee_max_ee_cfg = NFA_EE_MAX_EE_SUPPORTED;
 
 /* set to NULL to use the default mapping set by stack */
-tNCI_DISCOVER_MAPS* p_nfa_dm_interface_mapping = NULL;
+tNCI_DISCOVER_MAPS* p_nfa_dm_interface_mapping = nullptr;
 uint8_t nfa_dm_num_dm_interface_mapping = 0;
 
 tNFA_DM_CFG nfa_dm_cfg = {
diff --git a/src/nfa/dm/nfa_dm_discover.cc b/src/nfa/dm/nfa_dm_discover.cc
index 62332cb..3414c91 100644
--- a/src/nfa/dm/nfa_dm_discover.cc
+++ b/src/nfa/dm/nfa_dm_discover.cc
@@ -307,14 +307,16 @@
   p = params;
 
   /*
-  ** for Listen A
-  **
-  ** Set ATQA 0x0C00 for T1T listen
-  ** If the ATQA values are 0x0000, then the FW will use 0x0400
-  ** which works for ISODEP, T2T and NFCDEP.
-  */
-  if (nfa_dm_cb.disc_cb.listen_RT[NFA_DM_DISC_LRT_NFC_A] ==
-      NFA_DM_DISC_HOST_ID_DH) {
+   * for Listen A
+   *
+   * Set ATQA 0x0C00 for T1T listen
+   * If the ATQA values are 0x0000, then the FW will use 0x0400
+   * which works for ISODEP, T2T and NFCDEP.
+   *
+   * In mode NFCC allowed to manage RF config (NFCC_CONFIG_CONTROL),
+   * DH will only add RF parameters for itself.
+   * In this case, we must program LA_SEL_INFO for DH techs only
+   */
     UINT8_TO_STREAM(p, NFC_PMID_LA_BIT_FRAME_SDD);
     UINT8_TO_STREAM(p, NCI_PARAM_LEN_LA_BIT_FRAME_SDD);
     UINT8_TO_STREAM(p, 0x04);
@@ -324,23 +326,9 @@
     UINT8_TO_STREAM(p, NFC_PMID_LA_SEL_INFO);
     UINT8_TO_STREAM(p, NCI_PARAM_LEN_LA_SEL_INFO);
     UINT8_TO_STREAM(p, sens_info);
-  } else /* Let NFCC use UICC configuration by configuring with length = 0 */
-  {
-    UINT8_TO_STREAM(p, NFC_PMID_LA_BIT_FRAME_SDD);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LA_PLATFORM_CONFIG);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LA_SEL_INFO);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LA_NFCID1);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LA_HIST_BY);
-    UINT8_TO_STREAM(p, 0);
-  }
 
   /* for Listen B */
-  if (nfa_dm_cb.disc_cb.listen_RT[NFA_DM_DISC_LRT_NFC_B] ==
-      NFA_DM_DISC_HOST_ID_DH) {
+
     UINT8_TO_STREAM(p, NFC_PMID_LB_SENSB_INFO);
     UINT8_TO_STREAM(p, NCI_PARAM_LEN_LB_SENSB_INFO);
     if (tech_proto_mask & NFA_DM_DISC_MASK_LB_ISO_DEP) {
@@ -348,19 +336,6 @@
     } else {
       UINT8_TO_STREAM(p, 0x00);
     }
-  } else /* Let NFCC use UICC configuration by configuring with length = 0 */
-  {
-    UINT8_TO_STREAM(p, NFC_PMID_LB_SENSB_INFO);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LB_NFCID0);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LB_APPDATA);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LB_ADC_FO);
-    UINT8_TO_STREAM(p, 0);
-    UINT8_TO_STREAM(p, NFC_PMID_LB_H_INFO);
-    UINT8_TO_STREAM(p, 0);
-  }
 
   /* for Listen F */
   /* NFCC can support NFC-DEP and T3T listening based on NFCID routing
@@ -959,13 +934,13 @@
           /* host can listen ISO-DEP based on AID routing */
           listen_mask |= (nfa_dm_cb.disc_cb.entry[xx].requested_disc_mask &
                           NFA_DM_DISC_MASK_LA_ISO_DEP);
+          /* host can listen NFC-DEP based on protocol routing */
+           listen_mask |= (nfa_dm_cb.disc_cb.entry[xx].requested_disc_mask &
+                            NFA_DM_DISC_MASK_LA_NFC_DEP);
           if (NFC_GetNCIVersion() == NCI_VERSION_2_0) {
             listen_mask |= (nfa_dm_cb.disc_cb.entry[xx].requested_disc_mask &
                             NFA_DM_DISC_MASK_LACM_NFC_DEP);
           } else {
-            /* host can listen NFC-DEP based on protocol routing */
-            listen_mask |= (nfa_dm_cb.disc_cb.entry[xx].requested_disc_mask &
-                            NFA_DM_DISC_MASK_LA_NFC_DEP);
             listen_mask |= (nfa_dm_cb.disc_cb.entry[xx].requested_disc_mask &
                             NFA_DM_DISC_MASK_LAA_NFC_DEP);
           }
@@ -1689,7 +1664,7 @@
 
   /* if selection failed */
   if (event == NFC_ERROR_CEVT) {
-    nfa_dm_disc_sm_execute(NFA_DM_CORE_INTF_ERROR_NTF, NULL);
+    nfa_dm_disc_sm_execute(NFA_DM_CORE_INTF_ERROR_NTF, nullptr);
   } else if (event == NFC_DATA_CEVT) {
     GKI_freebuf(p_data->data.p_data);
   }
@@ -2237,8 +2212,8 @@
             NFC_DEACTIVATE_REASON_DH_REQ_FAILED) {
           /* count for number of times deactivate cmd sent */
           nfa_dm_cb.deactivate_cmd_retry_count = 0;
+          nfa_dm_disc_new_state(NFA_DM_RFST_W4_HOST_SELECT);
         }
-        nfa_dm_disc_new_state(NFA_DM_RFST_W4_HOST_SELECT);
         if (old_sleep_wakeup_flag) {
           sleep_wakeup_event_processed = true;
           /* process pending deactivate request */
@@ -2249,7 +2224,7 @@
 
             /* Notify NFA RW sub-systems because NFA_DM_RF_DEACTIVATE_RSP will
              * not call this function */
-            nfa_rw_proc_disc_evt(NFA_DM_RF_DISC_DEACTIVATED_EVT, NULL, true);
+            nfa_rw_proc_disc_evt(NFA_DM_RF_DISC_DEACTIVATED_EVT, nullptr, true);
           } else {
             /* Successfully went to sleep mode for sleep wakeup */
             /* Now wake up the tag to complete the operation */
@@ -2372,6 +2347,10 @@
         } else if (p_data->nfc_discover.deactivate.type ==
                    NFC_DEACTIVATE_TYPE_DISCOVERY) {
           /* Discovery */
+          if (nfa_dm_cb.pending_power_state != SCREEN_STATE_INVALID) {
+            NFC_SetPowerSubState(nfa_dm_cb.pending_power_state);
+            nfa_dm_cb.pending_power_state = SCREEN_STATE_INVALID;
+          }
           nfa_dm_disc_new_state(NFA_DM_RFST_DISCOVERY);
           if (nfa_dm_cb.disc_cb.disc_flags & NFA_DM_DISC_FLAGS_STOPPING) {
             /* stop discovery */
@@ -2677,7 +2656,7 @@
   memcpy(&nfa_dm_cb.disc_cb.excl_listen_config, p_listen_cfg,
          sizeof(tNFA_LISTEN_CFG));
 
-  nfa_dm_disc_sm_execute(NFA_DM_RF_DISCOVER_CMD, NULL);
+  nfa_dm_disc_sm_execute(NFA_DM_RF_DISCOVER_CMD, nullptr);
 }
 
 /*******************************************************************************
@@ -2693,7 +2672,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   nfa_dm_cb.disc_cb.excl_disc_entry.in_use = false;
-  nfa_dm_cb.disc_cb.excl_disc_entry.p_disc_cback = NULL;
+  nfa_dm_cb.disc_cb.excl_disc_entry.p_disc_cback = nullptr;
 }
 
 /*******************************************************************************
@@ -2949,6 +2928,9 @@
       DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
           "nfa_dm_p2p_prio_logic listen mode activated reset all the "
           "nfa_dm_p2p_prio_logic variables ");
+      if (p2p_prio_logic_data.timer_list.in_use) {
+        nfc_stop_quick_timer(&p2p_prio_logic_data.timer_list);
+      }
       nfa_dm_p2p_prio_logic_cleanup();
     }
 
diff --git a/src/nfa/dm/nfa_dm_main.cc b/src/nfa/dm/nfa_dm_main.cc
index f73d9c0..fe03a5b 100644
--- a/src/nfa/dm/nfa_dm_main.cc
+++ b/src/nfa/dm/nfa_dm_main.cc
@@ -99,6 +99,7 @@
   nfa_dm_cb.poll_disc_handle = NFA_HANDLE_INVALID;
   nfa_dm_cb.disc_cb.disc_duration = NFA_DM_DISC_DURATION_POLL;
   nfa_dm_cb.nfcc_pwr_mode = NFA_DM_PWR_MODE_FULL;
+  nfa_dm_cb.pending_power_state = SCREEN_STATE_INVALID;
 
   /* register message handler on NFA SYS */
   nfa_sys_register(NFA_ID_DM, &nfa_dm_sys_reg);
@@ -175,7 +176,8 @@
            (sel_res == NFC_SEL_RES_NFC_FORUM_T2T)) ||
           (protocol == NFC_PROTOCOL_T3T) ||
           (protocol == NFC_PROTOCOL_ISO_DEP) ||
-          (protocol == NFC_PROTOCOL_NFC_DEP) || (protocol == NFC_PROTOCOL_T5T));
+          (protocol == NFC_PROTOCOL_NFC_DEP) ||
+          (protocol == NFC_PROTOCOL_T5T) || (protocol == NFC_PROTOCOL_MIFARE));
 }
 /*******************************************************************************
 **
@@ -233,7 +235,7 @@
     type = *(p_tlv_list + xx);
     len = *(p_tlv_list + xx + 1);
     p_value = p_tlv_list + xx + 2;
-    p_cur_len = NULL;
+    p_cur_len = nullptr;
 
     switch (type) {
       /*
@@ -356,7 +358,7 @@
         } else {
           /* we don't stored this config items */
           update = true;
-          p_stored = NULL;
+          p_stored = nullptr;
         }
         break;
     }
diff --git a/src/nfa/dm/nfa_dm_ndef.cc b/src/nfa/dm/nfa_dm_ndef.cc
index 0e07d95..e5361cd 100644
--- a/src/nfa/dm/nfa_dm_ndef.cc
+++ b/src/nfa/dm/nfa_dm_ndef.cc
@@ -38,7 +38,7 @@
 * URI Well-known-type prefixes
 *******************************************************************************/
 const uint8_t* nfa_dm_ndef_wkt_uri_str_tbl[] = {
-    NULL,                                         /* 0x00 */
+    nullptr,                                         /* 0x00 */
     (const uint8_t*)"http://www.",                /* 0x01 */
     (const uint8_t*)"https://www.",               /* 0x02 */
     (const uint8_t*)"http://",                    /* 0x03 */
@@ -94,7 +94,7 @@
 
   if (p_cb->p_ndef_handler[hdlr_idx]) {
     GKI_freebuf(p_cb->p_ndef_handler[hdlr_idx]);
-    p_cb->p_ndef_handler[hdlr_idx] = NULL;
+    p_cb->p_ndef_handler[hdlr_idx] = nullptr;
   }
 }
 
@@ -114,9 +114,9 @@
 
   for (i = 0; i < NFA_NDEF_MAX_HANDLERS; i++) {
     /* If this is a free slot, then remember it */
-    if (p_cb->p_ndef_handler[i] != NULL) {
+    if (p_cb->p_ndef_handler[i] != nullptr) {
       GKI_freebuf(p_cb->p_ndef_handler[i]);
-      p_cb->p_ndef_handler[i] = NULL;
+      p_cb->p_ndef_handler[i] = nullptr;
     }
   }
 }
@@ -160,7 +160,7 @@
     for (i = (NFA_NDEF_DEFAULT_HANDLER_IDX + 1); i < NFA_NDEF_MAX_HANDLERS;
          i++) {
       /* If this is a free slot, then remember it */
-      if (p_cb->p_ndef_handler[i] == NULL) {
+      if (p_cb->p_ndef_handler[i] == nullptr) {
         hdlr_idx = i;
         break;
       }
@@ -326,7 +326,7 @@
   if (i < NFA_NDEF_MAX_HANDLERS)
     return (p_cb->p_ndef_handler[i]);
   else
-    return (NULL);
+    return (nullptr);
 }
 
 /*******************************************************************************
@@ -398,11 +398,11 @@
   /* Handle zero length - notify default handler */
   if (len == 0) {
     p_handler = p_cb->p_ndef_handler[NFA_NDEF_DEFAULT_HANDLER_IDX];
-    if (p_handler != NULL) {
+    if (p_handler != nullptr) {
       DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
           "Notifying default handler of zero-length NDEF message...");
       ndef_data.ndef_type_handle = p_handler->ndef_type_handle;
-      ndef_data.p_data = NULL; /* Start of record */
+      ndef_data.p_data = nullptr; /* Start of record */
       ndef_data.len = 0;
       tNFA_NDEF_EVT_DATA nfa_ndef_evt_data;
       nfa_ndef_evt_data.ndef_data = ndef_data;
@@ -433,7 +433,7 @@
   p_rec = p_ndef_start = p_msg_buf;
 
   /* Check each record in the NDEF message */
-  while (p_rec != NULL) {
+  while (p_rec != nullptr) {
     /* Get record type */
     p_type = NDEF_RecGetType(p_rec, &tnf, &type_len);
 
@@ -444,12 +444,12 @@
     p_payload = NDEF_RecGetPayload(p_rec, &payload_len);
 
     /* Find first handler for this type */
-    p_handler = nfa_dm_ndef_find_next_handler(NULL, tnf, p_type, type_len,
+    p_handler = nfa_dm_ndef_find_next_handler(nullptr, tnf, p_type, type_len,
                                               p_payload, payload_len);
-    if (p_handler == NULL) {
+    if (p_handler == nullptr) {
       /* Not a registered NDEF type. Use default handler */
       p_handler = p_cb->p_ndef_handler[NFA_NDEF_DEFAULT_HANDLER_IDX];
-      if (p_handler != NULL) {
+      if (p_handler != nullptr) {
         DLOG_IF(INFO, nfc_debug_enabled)
             << StringPrintf("No handler found. Using default handler...");
       }
@@ -473,7 +473,7 @@
       ndef_data.p_data = p_rec; /* Start of record */
 
       /* Calculate length of NDEF record */
-      if (p_payload != NULL)
+      if (p_payload != nullptr)
         ndef_data.len = payload_len + (uint32_t)(p_payload - p_rec);
       else {
         /* If no payload, calculate length of ndef record header */
diff --git a/src/nfa/ee/nfa_ee_act.cc b/src/nfa/ee/nfa_ee_act.cc
index ab1eefc..02548de 100644
--- a/src/nfa/ee/nfa_ee_act.cc
+++ b/src/nfa/ee/nfa_ee_act.cc
@@ -31,6 +31,9 @@
 #include "nfa_ee_int.h"
 #include "nfa_hci_int.h"
 
+#include <statslog.h>
+#include "metrics.h"
+
 using android::base::StringPrintf;
 
 extern bool nfc_debug_enabled;
@@ -149,7 +152,8 @@
   int xx;
   uint8_t power_cfg = 0;
 
-  p_cb->size_mask = 0;
+  p_cb->size_mask_proto = 0;
+  p_cb->size_mask_tech = 0;
   /* add the Technology based routing */
   for (xx = 0; xx < NFA_EE_NUM_TECH; xx++) {
     power_cfg = 0;
@@ -170,7 +174,7 @@
     }
     if (power_cfg) {
       /* 5 = 1 (tag) + 1 (len) + 1(nfcee_id) + 1(power cfg) + 1 (technology) */
-      p_cb->size_mask += 5;
+      p_cb->size_mask_tech += 5;
     }
   }
 
@@ -192,14 +196,19 @@
       if (p_cb->proto_screen_off_lock & nfa_ee_proto_mask_list[xx])
         power_cfg |= NCI_ROUTE_PWR_STATE_SCREEN_OFF_LOCK();
     }
-    if (power_cfg) {
+
+    // NFC-DEP must route to HOST
+    if (power_cfg ||
+        (p_cb->nfcee_id == NFC_DH_ID &&
+         nfa_ee_proto_mask_list[xx] == NFA_PROTOCOL_MASK_NFC_DEP)) {
       /* 5 = 1 (tag) + 1 (len) + 1(nfcee_id) + 1(power cfg) + 1 (protocol) */
-      p_cb->size_mask += 5;
+      p_cb->size_mask_proto += 5;
     }
   }
-  DLOG_IF(INFO, nfc_debug_enabled)
-      << StringPrintf("nfa_ee_update_route_size nfcee_id:0x%x size_mask:%d",
-                      p_cb->nfcee_id, p_cb->size_mask);
+  DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
+      "nfa_ee_update_route_size nfcee_id:0x%x size_mask_proto:%d "
+      "size_mask_tech:%d",
+      p_cb->nfcee_id, p_cb->size_mask_proto, p_cb->size_mask_tech);
 }
 
 /*******************************************************************************
@@ -279,13 +288,15 @@
   tNFA_EE_ECB* p_cb;
 
   p_cb = &nfa_ee_cb.ecb[NFA_EE_CB_4_DH];
-  lmrt_size += p_cb->size_mask;
+  lmrt_size += p_cb->size_mask_proto;
+  lmrt_size += p_cb->size_mask_tech;
   lmrt_size += p_cb->size_aid;
   lmrt_size += p_cb->size_sys_code;
   p_cb = &nfa_ee_cb.ecb[nfa_ee_cb.cur_ee - 1];
   for (xx = 0; xx < nfa_ee_cb.cur_ee; xx++, p_cb--) {
     if (p_cb->ee_status == NFC_NFCEE_STATUS_ACTIVE) {
-      lmrt_size += p_cb->size_mask;
+      lmrt_size += p_cb->size_mask_proto;
+      lmrt_size += p_cb->size_mask_tech;
       lmrt_size += p_cb->size_aid;
       lmrt_size += p_cb->size_sys_code;
     }
@@ -347,7 +358,9 @@
       power_cfg |= NCI_ROUTE_PWR_STATE_SWITCH_OFF;
     if (p_cb->proto_battery_off & nfa_ee_proto_mask_list[xx])
       power_cfg |= NCI_ROUTE_PWR_STATE_BATT_OFF;
-    if (power_cfg) {
+    if (power_cfg ||
+        (p_cb->nfcee_id == NFC_DH_ID &&
+         nfa_ee_proto_mask_list[xx] == NFA_PROTOCOL_MASK_NFC_DEP)) {
       /* Applying Route Block for ISO DEP Protocol, so that AIDs
        * which are not in the routing table can also be blocked */
       if (nfa_ee_proto_mask_list[xx] == NFA_PROTOCOL_MASK_ISO_DEP) {
@@ -367,24 +380,23 @@
       } else {
         proto_tag = NFC_ROUTE_TAG_PROTO;
       }
-
-      add_route_tech_proto_tlv(&pp, proto_tag, p_cb->nfcee_id, power_cfg,
-                               nfa_ee_proto_list[xx]);
+      if (p_cb->nfcee_id == NFC_DH_ID &&
+          nfa_ee_proto_mask_list[xx] == NFA_PROTOCOL_MASK_NFC_DEP) {
+        /* add NFC-DEP routing to HOST */
+        add_route_tech_proto_tlv(&pp, NFC_ROUTE_TAG_PROTO, NFC_DH_ID,
+                                 NCI_ROUTE_PWR_STATE_ON, NFC_PROTOCOL_NFC_DEP);
+        DLOG_IF(INFO, nfc_debug_enabled)
+            << StringPrintf("%s - NFC DEP added for DH!!!", __func__);
+      } else {
+        add_route_tech_proto_tlv(&pp, proto_tag, p_cb->nfcee_id, power_cfg,
+                                 nfa_ee_proto_list[xx]);
+      }
       num_tlv++;
       if (power_cfg != NCI_ROUTE_PWR_STATE_ON)
         nfa_ee_cb.ee_cfged |= NFA_EE_CFGED_OFF_ROUTING;
     }
   }
 
-  /* add NFC-DEP routing to HOST */
-  if (p_cb->nfcee_id == NFC_DH_ID) {
-    add_route_tech_proto_tlv(&pp, NFC_ROUTE_TAG_PROTO, NFC_DH_ID,
-                             NCI_ROUTE_PWR_STATE_ON, NFC_PROTOCOL_NFC_DEP);
-
-    num_tlv++;
-    DLOG_IF(INFO, nfc_debug_enabled)
-        << StringPrintf("%s - NFC DEP added for DH!!!", __func__);
-  }
   /* update the num_tlv and current offset */
   uint8_t entry_size = (uint8_t)(pp - p);
   *p_cur_offset += entry_size;
@@ -538,6 +550,24 @@
 
 /*******************************************************************************
 **
+** Function         nfa_ee_find_max_aid_cfg_len
+**
+** Description      Find the max len for aid_cfg
+**
+** Returns          max length
+**
+*******************************************************************************/
+int nfa_ee_find_max_aid_cfg_len(void) {
+  int max_lmrt_size = NFC_GetLmrtSize();
+  if (max_lmrt_size) {
+    return max_lmrt_size - NFA_EE_MAX_PROTO_TECH_EXT_ROUTE_LEN;
+  } else {
+    return NFA_EE_MAX_AID_CFG_LEN;
+  }
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_ee_find_total_aid_len
 **
 ** Description      Find the total len in aid_cfg from start_entry to the last
@@ -608,7 +638,7 @@
 tNFA_EE_ECB* nfa_ee_find_aid_offset(uint8_t aid_len, uint8_t* p_aid,
                                     int* p_offset, int* p_entry) {
   int xx, yy, aid_len_offset, offset;
-  tNFA_EE_ECB *p_ret = NULL, *p_ecb;
+  tNFA_EE_ECB *p_ret = nullptr, *p_ecb;
 
   p_ecb = &nfa_ee_cb.ecb[NFA_EE_CB_4_DH];
   aid_len_offset = 1; /* skip the tag */
@@ -651,7 +681,7 @@
  *******************************************************************************/
 tNFA_EE_ECB* nfa_ee_find_sys_code_offset(uint16_t sys_code, int* p_offset,
                                          int* p_entry) {
-  tNFA_EE_ECB* p_ret = NULL;
+  tNFA_EE_ECB* p_ret = nullptr;
 
   for (uint8_t xx = 0; xx < NFA_EE_NUM_ECBS; xx++) {
     tNFA_EE_ECB* p_ecb = &nfa_ee_cb.ecb[xx];
@@ -701,7 +731,7 @@
   }
   /* if the given is NULL, report to all registered ones */
   for (xx = 0; xx < NFA_EE_MAX_CBACKS; xx++) {
-    if (nfa_ee_cb.p_ee_cback[xx] != NULL) {
+    if (nfa_ee_cb.p_ee_cback[xx] != nullptr) {
       (*nfa_ee_cb.p_ee_cback[xx])(event, p_data);
     }
   }
@@ -740,7 +770,7 @@
     nfa_sys_stop_timer(&nfa_ee_cb.discv_timer);
     if (NFA_GetNCIVersion() != NCI_VERSION_2_0) NFC_NfceeDiscover(false);
   }
-  if (nfa_ee_cb.p_ee_disc_cback == NULL &&
+  if (nfa_ee_cb.p_ee_disc_cback == nullptr &&
       NFC_NfceeDiscover(true) == NFC_STATUS_OK) {
     nfa_ee_cb.p_ee_disc_cback = p_cback;
   } else {
@@ -777,13 +807,41 @@
   /* If no matching callback, allocated an entry */
   if (!found) {
     for (xx = 0; xx < NFA_EE_MAX_CBACKS; xx++) {
-      if (nfa_ee_cb.p_ee_cback[xx] == NULL) {
+      if (nfa_ee_cb.p_ee_cback[xx] == nullptr) {
         nfa_ee_cb.p_ee_cback[xx] = p_cback;
         evt_data.ee_register = NFA_STATUS_OK;
         break;
       }
     }
   }
+
+  int max_aid_cfg_length = nfa_ee_find_max_aid_cfg_len();
+  int max_aid_entries = max_aid_cfg_length / NFA_MIN_AID_LEN + 1;
+
+  DLOG_IF(INFO, nfc_debug_enabled)
+      << StringPrintf("max_aid_cfg_length: %d and max_aid_entries: %d",
+                      max_aid_cfg_length, max_aid_entries);
+
+  for (xx = 0; xx < NFA_EE_NUM_ECBS; xx++) {
+    nfa_ee_cb.ecb[xx].aid_len = (uint8_t*)GKI_getbuf(max_aid_entries);
+    nfa_ee_cb.ecb[xx].aid_pwr_cfg = (uint8_t*)GKI_getbuf(max_aid_entries);
+    nfa_ee_cb.ecb[xx].aid_rt_info = (uint8_t*)GKI_getbuf(max_aid_entries);
+    nfa_ee_cb.ecb[xx].aid_info = (uint8_t*)GKI_getbuf(max_aid_entries);
+    nfa_ee_cb.ecb[xx].aid_cfg = (uint8_t*)GKI_getbuf(max_aid_cfg_length);
+    if ((NULL != nfa_ee_cb.ecb[xx].aid_len) &&
+        (NULL != nfa_ee_cb.ecb[xx].aid_pwr_cfg) &&
+        (NULL != nfa_ee_cb.ecb[xx].aid_info) &&
+        (NULL != nfa_ee_cb.ecb[xx].aid_cfg)) {
+      memset(nfa_ee_cb.ecb[xx].aid_len, 0, max_aid_entries);
+      memset(nfa_ee_cb.ecb[xx].aid_pwr_cfg, 0, max_aid_entries);
+      memset(nfa_ee_cb.ecb[xx].aid_rt_info, 0, max_aid_entries);
+      memset(nfa_ee_cb.ecb[xx].aid_info, 0, max_aid_entries);
+      memset(nfa_ee_cb.ecb[xx].aid_cfg, 0, max_aid_cfg_length);
+    } else {
+      LOG(ERROR) << StringPrintf("GKI_getbuf allocation for ECB failed !");
+    }
+  }
+
   /* This callback is verified (not NULL) in NFA_EeRegister() */
   (*p_cback)(NFA_EE_REGISTER_EVT, &evt_data);
 
@@ -802,13 +860,22 @@
 **
 *******************************************************************************/
 void nfa_ee_api_deregister(tNFA_EE_MSG* p_data) {
-  tNFA_EE_CBACK* p_cback = NULL;
+  tNFA_EE_CBACK* p_cback = nullptr;
   int index = p_data->deregister.index;
   tNFA_EE_CBACK_DATA evt_data = {0};
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("nfa_ee_api_deregister");
+
+  for (int xx = 0; xx < NFA_EE_NUM_ECBS; xx++) {
+    GKI_freebuf(nfa_ee_cb.ecb[xx].aid_len);
+    GKI_freebuf(nfa_ee_cb.ecb[xx].aid_pwr_cfg);
+    GKI_freebuf(nfa_ee_cb.ecb[xx].aid_rt_info);
+    GKI_freebuf(nfa_ee_cb.ecb[xx].aid_info);
+    GKI_freebuf(nfa_ee_cb.ecb[xx].aid_cfg);
+  }
+
   p_cback = nfa_ee_cb.p_ee_cback[index];
-  nfa_ee_cb.p_ee_cback[index] = NULL;
+  nfa_ee_cb.p_ee_cback[index] = nullptr;
   if (p_cback) (*p_cback)(NFA_EE_DEREGISTER_EVT, &evt_data);
 }
 
@@ -833,7 +900,7 @@
     mode_set.ee_status = p_data->mode_set.mode;
     tNFA_EE_CBACK_DATA nfa_ee_cback_data;
     nfa_ee_cback_data.mode_set = mode_set;
-    nfa_ee_report_event(NULL, NFA_EE_MODE_SET_EVT, &nfa_ee_cback_data);
+    nfa_ee_report_event(nullptr, NFA_EE_MODE_SET_EVT, &nfa_ee_cback_data);
     return;
   }
   /* set the NFA_EE_STATUS_PENDING bit to indicate the status is not exactly
@@ -871,7 +938,7 @@
   tNFA_TECHNOLOGY_MASK old_tech_screen_lock = p_cb->tech_screen_lock;
   tNFA_TECHNOLOGY_MASK old_tech_screen_off = p_cb->tech_screen_off;
   tNFA_TECHNOLOGY_MASK old_tech_screen_off_lock = p_cb->tech_screen_off_lock;
-  uint8_t old_size_mask = p_cb->size_mask;
+  uint8_t old_size_mask_tech = p_cb->size_mask_tech;
 
   if ((p_cb->tech_switch_on == p_data->set_tech.technologies_switch_on) &&
       (p_cb->tech_switch_off == p_data->set_tech.technologies_switch_off) &&
@@ -902,7 +969,7 @@
     p_cb->tech_screen_lock = old_tech_screen_lock;
     p_cb->tech_screen_off = old_tech_screen_off;
     p_cb->tech_screen_off_lock = old_tech_screen_off_lock;
-    p_cb->size_mask = old_size_mask;
+    p_cb->size_mask_tech = old_size_mask_tech;
   } else {
     p_cb->ecb_flags |= NFA_EE_ECB_FLAGS_TECH;
     if (p_cb->tech_switch_on | p_cb->tech_switch_off | p_cb->tech_battery_off |
@@ -919,6 +986,54 @@
 
 /*******************************************************************************
 **
+** Function         nfa_ee_api_clear_tech_cfg
+**
+** Description      process clear technology routing configuration from user
+**                  start a 1 second timer. When the timer expires,
+**                  the configuration collected in control block is sent to NFCC
+**
+** Returns          void
+**
+*******************************************************************************/
+void nfa_ee_api_clear_tech_cfg(tNFA_EE_MSG* p_data) {
+  tNFA_EE_ECB* p_cb = p_data->cfg_hdr.p_cb;
+  tNFA_EE_CBACK_DATA evt_data = {0};
+
+  tNFA_TECHNOLOGY_MASK old_tech_switch_on = p_cb->tech_switch_on;
+  tNFA_TECHNOLOGY_MASK old_tech_switch_off = p_cb->tech_switch_off;
+  tNFA_TECHNOLOGY_MASK old_tech_battery_off = p_cb->tech_battery_off;
+  tNFA_TECHNOLOGY_MASK old_tech_screen_lock = p_cb->tech_screen_lock;
+  tNFA_TECHNOLOGY_MASK old_tech_screen_off = p_cb->tech_screen_off;
+  tNFA_TECHNOLOGY_MASK old_tech_screen_off_lock = p_cb->tech_screen_off_lock;
+
+  p_cb->tech_switch_on &= ~p_data->clear_tech.technologies_switch_on;
+  p_cb->tech_switch_off &= ~p_data->clear_tech.technologies_switch_off;
+  p_cb->tech_battery_off &= ~p_data->clear_tech.technologies_battery_off;
+  p_cb->tech_screen_lock &= ~p_data->clear_tech.technologies_screen_lock;
+  p_cb->tech_screen_off &= ~p_data->clear_tech.technologies_screen_off;
+  p_cb->tech_screen_off_lock &=
+      ~p_data->clear_tech.technologies_screen_off_lock;
+
+  if ((p_cb->tech_switch_on == old_tech_switch_on) &&
+      (p_cb->tech_switch_off == old_tech_switch_off) &&
+      (p_cb->tech_battery_off == old_tech_battery_off) &&
+      (p_cb->tech_screen_lock == old_tech_screen_lock) &&
+      (p_cb->tech_screen_off == old_tech_screen_off) &&
+      (p_cb->tech_screen_off_lock == old_tech_screen_off_lock)) {
+    /* nothing to change */
+    evt_data.status = NFA_STATUS_OK;
+    nfa_ee_report_event(p_cb->p_ee_cback, NFA_EE_CLEAR_TECH_CFG_EVT, &evt_data);
+    return;
+  }
+  nfa_ee_update_route_size(p_cb);
+  p_cb->ecb_flags |= NFA_EE_ECB_FLAGS_TECH;
+
+  nfa_ee_start_timer();
+  nfa_ee_report_event(p_cb->p_ee_cback, NFA_EE_CLEAR_TECH_CFG_EVT, &evt_data);
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_ee_api_set_proto_cfg
 **
 ** Description      process set protocol routing configuration from user
@@ -937,7 +1052,7 @@
   tNFA_PROTOCOL_MASK old_proto_screen_lock = p_cb->proto_screen_lock;
   tNFA_PROTOCOL_MASK old_proto_screen_off = p_cb->proto_screen_off;
   tNFA_PROTOCOL_MASK old_proto_screen_off_lock = p_cb->proto_screen_off_lock;
-  uint8_t old_size_mask = p_cb->size_mask;
+  uint8_t old_size_mask_proto = p_cb->size_mask_proto;
 
   if ((p_cb->proto_switch_on == p_data->set_proto.protocols_switch_on) &&
       (p_cb->proto_switch_off == p_data->set_proto.protocols_switch_off) &&
@@ -968,7 +1083,7 @@
     p_cb->proto_screen_lock = old_proto_screen_lock;
     p_cb->proto_screen_off = old_proto_screen_off;
     p_cb->proto_screen_off_lock = old_proto_screen_off_lock;
-    p_cb->size_mask = old_size_mask;
+    p_cb->size_mask_proto = old_size_mask_proto;
   } else {
     p_cb->ecb_flags |= NFA_EE_ECB_FLAGS_PROTO;
     if (p_cb->proto_switch_on | p_cb->proto_switch_off |
@@ -985,6 +1100,54 @@
 
 /*******************************************************************************
 **
+** Function         nfa_ee_api_clear_proto_cfg
+**
+** Description      process clear protocol routing configuration from user
+**                  start a 1 second timer. When the timer expires,
+**                  the configuration collected in control block is sent to NFCC
+**
+** Returns          void
+**
+*******************************************************************************/
+void nfa_ee_api_clear_proto_cfg(tNFA_EE_MSG* p_data) {
+  tNFA_EE_ECB* p_cb = p_data->cfg_hdr.p_cb;
+  tNFA_EE_CBACK_DATA evt_data = {0};
+
+  tNFA_TECHNOLOGY_MASK old_proto_switch_on = p_cb->proto_switch_on;
+  tNFA_TECHNOLOGY_MASK old_proto_switch_off = p_cb->proto_switch_off;
+  tNFA_TECHNOLOGY_MASK old_proto_battery_off = p_cb->proto_battery_off;
+  tNFA_TECHNOLOGY_MASK old_proto_screen_lock = p_cb->proto_screen_lock;
+  tNFA_TECHNOLOGY_MASK old_proto_screen_off = p_cb->proto_screen_off;
+  tNFA_TECHNOLOGY_MASK old_proto_screen_off_lock = p_cb->proto_screen_off_lock;
+
+  p_cb->proto_switch_on &= ~p_data->clear_proto.protocols_switch_on;
+  p_cb->proto_switch_off &= ~p_data->clear_proto.protocols_switch_off;
+  p_cb->proto_battery_off &= ~p_data->clear_proto.protocols_battery_off;
+  p_cb->proto_screen_lock &= ~p_data->clear_proto.protocols_screen_lock;
+  p_cb->proto_screen_off &= ~p_data->clear_proto.protocols_screen_off;
+  p_cb->proto_screen_off_lock &= ~p_data->clear_proto.protocols_screen_off_lock;
+
+  if ((p_cb->proto_switch_on == old_proto_switch_on) &&
+      (p_cb->proto_switch_off == old_proto_switch_off) &&
+      (p_cb->proto_battery_off == old_proto_battery_off) &&
+      (p_cb->proto_screen_lock == old_proto_screen_lock) &&
+      (p_cb->proto_screen_off == old_proto_screen_off) &&
+      (p_cb->proto_screen_off_lock == old_proto_screen_off_lock)) {
+    /* nothing to change */
+    evt_data.status = NFA_STATUS_OK;
+    nfa_ee_report_event(p_cb->p_ee_cback, NFA_EE_CLEAR_PROTO_CFG_EVT,
+                        &evt_data);
+    return;
+  }
+  nfa_ee_update_route_size(p_cb);
+  p_cb->ecb_flags |= NFA_EE_ECB_FLAGS_PROTO;
+
+  nfa_ee_start_timer();
+  nfa_ee_report_event(p_cb->p_ee_cback, NFA_EE_CLEAR_PROTO_CFG_EVT, &evt_data);
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_ee_api_add_aid
 **
 ** Description      process add an AID routing configuration from user
@@ -1006,6 +1169,9 @@
 
   nfa_ee_trace_aid("nfa_ee_api_add_aid", p_cb->nfcee_id, p_add->aid_len,
                    p_add->p_aid);
+  int max_aid_cfg_length = nfa_ee_find_max_aid_cfg_len();
+  int max_aid_entries = max_aid_cfg_length / NFA_MIN_AID_LEN + 1;
+
   p_chk_cb =
       nfa_ee_find_aid_offset(p_add->aid_len, p_add->p_aid, &offset, &entry);
   if (p_chk_cb) {
@@ -1036,13 +1202,13 @@
     /* make sure the control block has enough room to hold this entry */
     len_needed = p_add->aid_len + 2; /* tag/len */
 
-    if ((len_needed + len) > NFA_EE_MAX_AID_CFG_LEN) {
+    if ((len_needed + len) > max_aid_cfg_length) {
       LOG(ERROR) << StringPrintf(
           "Exceed capacity: (len_needed:%d + len:%d) > "
           "NFA_EE_MAX_AID_CFG_LEN:%d",
-          len_needed, len, NFA_EE_MAX_AID_CFG_LEN);
+          len_needed, len, max_aid_cfg_length);
       evt_data.status = NFA_STATUS_BUFFER_FULL;
-    } else if (p_cb->aid_entries < NFA_EE_MAX_AID_ENTRIES) {
+    } else if (p_cb->aid_entries < max_aid_entries) {
       /* 4 = 1 (tag) + 1 (len) + 1(nfcee_id) + 1(power cfg) */
       new_size = nfa_ee_total_lmrt_size() + 4 + p_add->aid_len;
       if (new_size > NFC_GetLmrtSize()) {
@@ -1064,7 +1230,7 @@
       }
     } else {
       LOG(ERROR) << StringPrintf("Exceed NFA_EE_MAX_AID_ENTRIES:%d",
-                                 NFA_EE_MAX_AID_ENTRIES);
+                                 max_aid_entries);
       evt_data.status = NFA_STATUS_BUFFER_FULL;
     }
   }
@@ -1078,6 +1244,9 @@
   }
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
       "status:%d ee_cfged:0x%02x ", evt_data.status, nfa_ee_cb.ee_cfged);
+  if (evt_data.status == NFA_STATUS_BUFFER_FULL)
+    android::util::stats_write(android::util::NFC_ERROR_OCCURRED,
+                               (int32_t)AID_OVERFLOW, 0, 0);
   /* report the status of this operation */
   nfa_ee_report_event(p_cb->p_ee_cback, NFA_EE_ADD_AID_EVT, &evt_data);
 }
@@ -1098,7 +1267,7 @@
   tNFA_EE_CBACK_DATA evt_data = {0};
   int offset = 0, entry = 0, len;
   int rest_len;
-  tNFA_EE_CBACK* p_cback = NULL;
+  tNFA_EE_CBACK* p_cback = nullptr;
 
   nfa_ee_trace_aid("nfa_ee_api_remove_aid", 0, p_data->rm_aid.aid_len,
                    p_data->rm_aid.p_aid);
@@ -1339,7 +1508,7 @@
       << StringPrintf("nfa_ee_api_lmrt_size total size:%d remaining size:%d",
                       total_size, evt_data.size);
 
-  nfa_ee_report_event(NULL, NFA_EE_REMAINING_SIZE_EVT, &evt_data);
+  nfa_ee_report_event(nullptr, NFA_EE_REMAINING_SIZE_EVT, &evt_data);
 }
 
 /*******************************************************************************
@@ -1360,7 +1529,7 @@
         "ee_wait_evt:0x%x wait_rsp:%d",
         nfa_ee_cb.ee_wait_evt, nfa_ee_cb.wait_rsp);
     evt_data.status = NFA_STATUS_SEMANTIC_ERROR;
-    nfa_ee_report_event(NULL, NFA_EE_UPDATED_EVT, &evt_data);
+    nfa_ee_report_event(nullptr, NFA_EE_UPDATED_EVT, &evt_data);
     return;
   }
   nfa_sys_stop_timer(&nfa_ee_cb.timer);
@@ -1501,7 +1670,7 @@
     if (nfa_ee_cb.p_ee_disc_cback) {
       /* notify API callback */
       p_cback = nfa_ee_cb.p_ee_disc_cback;
-      nfa_ee_cb.p_ee_disc_cback = NULL;
+      nfa_ee_cb.p_ee_disc_cback = nullptr;
       evt_data.status = NFA_STATUS_OK;
       evt_data.ee_discover.num_ee = NFA_EE_MAX_EE_SUPPORTED;
       NFA_EeGetInfo(&evt_data.ee_discover.num_ee, evt_data.ee_discover.ee_info);
@@ -1673,7 +1842,7 @@
 *******************************************************************************/
 void nfa_ee_nci_disc_ntf(tNFA_EE_MSG* p_data) {
   tNFC_NFCEE_INFO_REVT* p_ee = p_data->disc_ntf.p_data;
-  tNFA_EE_ECB* p_cb = NULL;
+  tNFA_EE_ECB* p_cb = nullptr;
   bool notify_enable_done = false;
   bool notify_new_ee = false;
   tNFA_EE_CBACK_DATA evt_data = {0};
@@ -1688,7 +1857,7 @@
   if (nfa_ee_cb.num_ee_expecting) {
     nfa_ee_cb.num_ee_expecting--;
     if ((nfa_ee_cb.num_ee_expecting == 0) &&
-        (nfa_ee_cb.p_ee_disc_cback != NULL)) {
+        (nfa_ee_cb.p_ee_disc_cback != nullptr)) {
       /* Discovery triggered by API function */
       if (NFA_GetNCIVersion() != NCI_VERSION_2_0) NFC_NfceeDiscover(false);
     }
@@ -1709,7 +1878,7 @@
 
     case NFA_EE_EM_STATE_INIT_DONE:
       p_cb = nfa_ee_find_ecb(p_ee->nfcee_id);
-      if (p_cb == NULL) {
+      if (p_cb == nullptr) {
         /* the NFCEE ID is not in the last NFCEE discovery
          * maybe it's a new one */
         p_cb = nfa_ee_find_ecb(NFA_EE_INVALID);
@@ -1729,7 +1898,7 @@
 
     case NFA_EE_EM_STATE_RESTORING:
       p_cb = nfa_ee_find_ecb(p_ee->nfcee_id);
-      if (p_cb == NULL) {
+      if (p_cb == nullptr) {
         /* the NFCEE ID is not in the last NFCEE discovery
          * maybe it's a new one */
         p_cb = nfa_ee_find_ecb(NFA_EE_INVALID);
@@ -1774,7 +1943,7 @@
       }
     }
 
-    if ((nfa_ee_cb.p_ee_disc_cback == NULL) && (notify_new_ee == true)) {
+    if ((nfa_ee_cb.p_ee_disc_cback == nullptr) && (notify_new_ee == true)) {
       if (nfa_dm_is_active() && (p_cb->ee_status != NFA_EE_STATUS_REMOVED)) {
         /* report this NFA_EE_NEW_EE_EVT only after NFA_DM_ENABLE_EVT is
          * reported */
@@ -1788,7 +1957,7 @@
                p_cb->num_tlvs * sizeof(tNFA_EE_TLV));
         if (NFA_GetNCIVersion() == NCI_VERSION_2_0)
           p_info->ee_power_supply_status = p_cb->ee_power_supply_status;
-        nfa_ee_report_event(NULL, NFA_EE_NEW_EE_EVT, &evt_data);
+        nfa_ee_report_event(nullptr, NFA_EE_NEW_EE_EVT, &evt_data);
       }
     } else
       nfa_ee_report_disc_done(notify_enable_done);
@@ -1826,7 +1995,7 @@
 **
 *******************************************************************************/
 void nfa_ee_nci_nfcee_status_ntf(tNFA_EE_MSG* p_data) {
-  if (p_data != NULL) {
+  if (p_data != nullptr) {
     tNFC_NFCEE_STATUS_REVT* p_ee_data = p_data->nfcee_status_ntf.p_data;
     if ((NFA_GetNCIVersion() == NCI_VERSION_2_0) &&
         (p_ee_data->nfcee_status == NFC_NFCEE_STATUS_UNRECOVERABLE_ERROR)) {
@@ -1874,7 +2043,7 @@
   if (proc_complete) {
     /* update routing table when NFA_EE_ROUT_TIMEOUT_EVT is received */
     if (nfa_ee_cb.ee_cfg_sts & NFA_EE_STS_PREV_ROUTING)
-      nfa_ee_api_update_now(NULL);
+      nfa_ee_api_update_now(nullptr);
 
     nfa_ee_cb.em_state = NFA_EE_EM_STATE_INIT_DONE;
     nfa_sys_cback_notify_nfcc_power_mode_proc_complete(NFA_ID_EE);
@@ -1946,7 +2115,7 @@
 
   tNFA_EE_CBACK_DATA nfa_ee_cback_data;
   nfa_ee_build_discover_req_evt(&nfa_ee_cback_data.discover_req);
-  nfa_ee_report_event(NULL, NFA_EE_DISCOVER_REQ_EVT, &nfa_ee_cback_data);
+  nfa_ee_report_event(nullptr, NFA_EE_DISCOVER_REQ_EVT, &nfa_ee_cback_data);
 }
 
 /*******************************************************************************
@@ -1966,7 +2135,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
       "%s handle:0x%02x mode:%d", __func__, p_rsp->nfcee_id, p_rsp->mode);
   p_cb = nfa_ee_find_ecb(p_rsp->nfcee_id);
-  if (p_cb == NULL) {
+  if (p_cb == nullptr) {
     LOG(ERROR) << StringPrintf("%s Can not find cb for handle:0x%02x", __func__,
                                p_rsp->nfcee_id);
     return;
@@ -2059,7 +2228,7 @@
       nfa_ee_cb.ee_wait_evt &= ~NFA_EE_WAIT_UPDATE;
       /* finished updating NFCC; report NFA_EE_UPDATED_EVT now */
       evt_data.status = NFA_STATUS_OK;
-      nfa_ee_report_event(NULL, NFA_EE_UPDATED_EVT, &evt_data);
+      nfa_ee_report_event(nullptr, NFA_EE_UPDATED_EVT, &evt_data);
     }
   }
 }
@@ -2098,10 +2267,10 @@
   tNFA_EE_ECB* p_cb;
   tNFA_EE_NCI_CONN* p_cbk = &p_data->conn;
   tNFC_CONN* p_conn = p_data->conn.p_data;
-  NFC_HDR* p_pkt = NULL;
+  NFC_HDR* p_pkt = nullptr;
   tNFA_EE_CBACK_DATA evt_data = {0};
   tNFA_EE_EVT event = NFA_EE_INVALID;
-  tNFA_EE_CBACK* p_cback = NULL;
+  tNFA_EE_CBACK* p_cback = nullptr;
 
   if (p_cbk->event == NFC_CONN_CREATE_CEVT) {
     p_cb = nfa_ee_find_ecb(p_cbk->p_data->conn_create.id);
@@ -2134,7 +2303,7 @@
       case NFC_CONN_CLOSE_CEVT:
         if (p_cb->conn_st != NFA_EE_CONN_ST_DISC) event = NFA_EE_DISCONNECT_EVT;
         p_cb->conn_st = NFA_EE_CONN_ST_NONE;
-        p_cb->p_ee_cback = NULL;
+        p_cb->p_ee_cback = nullptr;
         p_cb->conn_id = 0;
         if (nfa_ee_cb.em_state == NFA_EE_EM_STATE_DISABLING) {
           if (nfa_ee_cb.ee_flags & NFA_EE_FLAG_WAIT_DISCONN) {
@@ -2156,7 +2325,7 @@
             evt_data.data.len = p_pkt->len;
             evt_data.data.p_buf = (uint8_t*)(p_pkt + 1) + p_pkt->offset;
             event = NFA_EE_DATA_EVT;
-            p_pkt = NULL; /* so this function does not free this GKI buffer */
+            p_pkt = nullptr; /* so this function does not free this GKI buffer */
           }
         }
         break;
@@ -2186,7 +2355,7 @@
          sizeof(tNFA_EE_ACTION_PARAM));
   tNFA_EE_CBACK_DATA nfa_ee_cback_data;
   nfa_ee_cback_data.action = evt_data;
-  nfa_ee_report_event(NULL, NFA_EE_ACTION_EVT, &nfa_ee_cback_data);
+  nfa_ee_report_event(nullptr, NFA_EE_ACTION_EVT, &nfa_ee_cback_data);
 }
 
 /*******************************************************************************
@@ -2201,7 +2370,7 @@
 void nfa_ee_nci_disc_req_ntf(tNFA_EE_MSG* p_data) {
   tNFC_EE_DISCOVER_REQ_REVT* p_cbk = p_data->disc_req.p_data;
   tNFA_HANDLE ee_handle;
-  tNFA_EE_ECB* p_cb = NULL;
+  tNFA_EE_ECB* p_cb = nullptr;
   uint8_t report_ntf = 0;
   uint8_t xx;
 
@@ -2386,8 +2555,6 @@
 void nfa_ee_route_add_one_ecb_by_route_order(tNFA_EE_ECB* p_cb, int rout_type,
                                              int* p_max_len, bool more,
                                              uint8_t* ps, int* p_cur_offset) {
-  nfa_ee_check_set_routing(p_cb->size_mask, p_max_len, ps, p_cur_offset);
-
   /* use the first byte of the buffer (ps) to keep the num_tlv */
   uint8_t num_tlv = *ps;
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
@@ -2399,10 +2566,18 @@
 
   switch (rout_type) {
     case NCI_ROUTE_ORDER_TECHNOLOGY: {
+      nfa_ee_check_set_routing(p_cb->size_mask_tech, p_max_len, ps,
+                               p_cur_offset);
+      pp = ps + 1 + *p_cur_offset;
+      p = pp;
       nfa_ee_add_tech_route_to_ecb(p_cb, pp, p, ps, p_cur_offset);
     } break;
 
     case NCI_ROUTE_ORDER_PROTOCOL: {
+      nfa_ee_check_set_routing(p_cb->size_mask_proto, p_max_len, ps,
+                               p_cur_offset);
+      pp = ps + 1 + *p_cur_offset;
+      p = pp;
       nfa_ee_add_proto_route_to_ecb(p_cb, pp, p, ps, p_cur_offset);
     } break;
     case NCI_ROUTE_ORDER_AID: {
@@ -2581,7 +2756,7 @@
 void nfa_ee_lmrt_to_nfcc(__attribute__((unused)) tNFA_EE_MSG* p_data) {
   int xx;
   tNFA_EE_ECB* p_cb;
-  uint8_t* p = NULL;
+  uint8_t* p = nullptr;
   bool more = true;
   bool check = true;
   uint8_t last_active = NFA_EE_INVALID;
@@ -2591,12 +2766,14 @@
   uint8_t max_tlv;
 
   /* update routing table: DH and the activated NFCEEs */
-  p = (uint8_t*)GKI_getbuf(NFA_EE_ROUT_BUF_SIZE);
-  if (p == NULL) {
+  max_len = (NFC_GetLmrtSize() > NFA_EE_ROUT_BUF_SIZE) ? NFC_GetLmrtSize()
+                                                       : NFA_EE_ROUT_BUF_SIZE;
+  p = (uint8_t*)GKI_getbuf(max_len);
+  if (p == nullptr) {
     LOG(ERROR) << StringPrintf("no buffer to send routing info.");
     tNFA_EE_CBACK_DATA nfa_ee_cback_data;
     nfa_ee_cback_data.status = status;
-    nfa_ee_report_event(NULL, NFA_EE_NO_MEM_ERR_EVT, &nfa_ee_cback_data);
+    nfa_ee_report_event(nullptr, NFA_EE_NO_MEM_ERR_EVT, &nfa_ee_cback_data);
     return;
   }
 
@@ -2615,7 +2792,6 @@
     check = false;
   }
 
-  max_len = NFC_GetLmrtSize();
   max_tlv =
       (uint8_t)((max_len > NFA_EE_ROUT_MAX_TLV_SIZE) ? NFA_EE_ROUT_MAX_TLV_SIZE
                                                      : max_len);
diff --git a/src/nfa/ee/nfa_ee_api.cc b/src/nfa/ee/nfa_ee_api.cc
index af99a7d..bb6005a 100644
--- a/src/nfa/ee/nfa_ee_api.cc
+++ b/src/nfa/ee/nfa_ee_api.cc
@@ -61,12 +61,12 @@
     LOG(ERROR) << StringPrintf("NFA_EeDiscover bad em state: %d",
                                nfa_ee_cb.em_state);
     status = NFA_STATUS_FAILED;
-  } else if ((nfa_ee_cb.p_ee_disc_cback != NULL) || (p_cback == NULL)) {
+  } else if ((nfa_ee_cb.p_ee_disc_cback != nullptr) || (p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("in progress or NULL callback function");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_DISCOVER*)GKI_getbuf(sizeof(tNFA_EE_API_DISCOVER));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_DISCOVER_EVT;
       p_msg->p_cback = p_cback;
 
@@ -102,7 +102,7 @@
       << StringPrintf("NFA_EeGetInfo em_state:%d cur_ee:%d", nfa_ee_cb.em_state,
                       nfa_ee_cb.cur_ee);
   /* validate parameters */
-  if (p_info == NULL || p_num_nfcee == NULL) {
+  if (p_info == nullptr || p_num_nfcee == nullptr) {
     LOG(ERROR) << StringPrintf("NFA_EeGetInfo bad parameter");
     return (NFA_STATUS_INVALID_PARAM);
   }
@@ -156,12 +156,12 @@
 
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
-  if (p_cback == NULL) {
+  if (p_cback == nullptr) {
     LOG(ERROR) << StringPrintf("with NULL callback function");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_REGISTER*)GKI_getbuf(sizeof(tNFA_EE_API_REGISTER));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_REGISTER_EVT;
       p_msg->p_cback = p_cback;
 
@@ -203,7 +203,7 @@
       << StringPrintf("%d, status:%d", index, status);
   if ((status != NFA_STATUS_INVALID_PARAM) &&
       (p_msg = (tNFA_EE_API_DEREGISTER*)GKI_getbuf(
-           sizeof(tNFA_EE_API_DEREGISTER))) != NULL) {
+           sizeof(tNFA_EE_API_DEREGISTER))) != nullptr) {
     p_msg->hdr.event = NFA_EE_API_DEREGISTER_EVT;
     p_msg->index = index;
 
@@ -233,7 +233,7 @@
 tNFA_STATUS NFA_EeModeSet(tNFA_HANDLE ee_handle, tNFA_EE_MD mode) {
   tNFA_EE_API_MODE_SET* p_msg;
   tNFA_STATUS status = NFA_STATUS_FAILED;
-  tNFA_EE_ECB *p_cb, *p_found = NULL;
+  tNFA_EE_ECB *p_cb, *p_found = nullptr;
   uint32_t xx;
   uint8_t nfcee_id = (ee_handle & 0xFF);
 
@@ -247,12 +247,12 @@
   DLOG_IF(INFO, nfc_debug_enabled)
       << StringPrintf("handle:<0x%x>, mode:0x%02X", ee_handle, mode);
 
-  if (p_found == NULL) {
+  if (p_found == nullptr) {
     LOG(ERROR) << StringPrintf("invalid NFCEE:0x%04x", ee_handle);
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_MODE_SET*)GKI_getbuf(sizeof(tNFA_EE_API_MODE_SET));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_MODE_SET_EVT;
       p_msg->nfcee_id = nfcee_id;
       p_msg->mode = mode;
@@ -308,13 +308,13 @@
       technologies_screen_off, technologies_screen_off_lock);
   p_cb = nfa_ee_find_ecb(nfcee_id);
 
-  if (p_cb == NULL) {
+  if (p_cb == nullptr) {
     LOG(ERROR) << StringPrintf("Bad ee_handle");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg =
         (tNFA_EE_API_SET_TECH_CFG*)GKI_getbuf(sizeof(tNFA_EE_API_SET_TECH_CFG));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_SET_TECH_CFG_EVT;
       p_msg->nfcee_id = nfcee_id;
       p_msg->p_cb = p_cb;
@@ -336,6 +336,70 @@
 
 /*******************************************************************************
 **
+** Function         NFA_EeClearDefaultTechRouting
+**
+** Description      This function is called to remove the default routing based
+**                  on RF technology in the listen mode routing table for the
+**                  given ee_handle. The status of this operation is reported
+**                  as the NFA_EE_CLEAR_TECH_CFG_EVT.
+**
+** Note:            If RF discovery is started,
+**                  NFA_StopRfDiscovery()/NFA_RF_DISCOVERY_STOPPED_EVT should
+**                  happen before calling this function
+**
+** Note:            NFA_EeUpdateNow() should be called after last NFA-EE
+**                  function to change the listen mode routing is called.
+**
+** Returns          NFA_STATUS_OK if successfully initiated
+**                  NFA_STATUS_FAILED otherwise
+**                  NFA_STATUS_INVALID_PARAM If bad parameter
+**
+*******************************************************************************/
+tNFA_STATUS NFA_EeClearDefaultTechRouting(
+    tNFA_HANDLE ee_handle, tNFA_TECHNOLOGY_MASK clear_technology) {
+  tNFA_EE_API_SET_TECH_CFG* p_msg;
+  tNFA_STATUS status = NFA_STATUS_FAILED;
+  uint8_t nfcee_id = (uint8_t)(ee_handle & 0xFF);
+  tNFA_EE_ECB* p_cb;
+
+  DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
+      "handle:<0x%x>clear technology_mask:<0x%x>", ee_handle, clear_technology);
+  if (!clear_technology) {
+    DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("nothing to clear");
+    status = NFA_STATUS_OK;
+    return status;
+  }
+
+  p_cb = nfa_ee_find_ecb(nfcee_id);
+
+  if (p_cb == nullptr) {
+    LOG(ERROR) << StringPrintf("Bad ee_handle");
+    status = NFA_STATUS_INVALID_PARAM;
+  } else {
+    p_msg = (tNFA_EE_API_CLEAR_TECH_CFG*)GKI_getbuf(
+        sizeof(tNFA_EE_API_CLEAR_TECH_CFG));
+    if (p_msg != nullptr) {
+      p_msg->hdr.event = NFA_EE_API_CLEAR_TECH_CFG_EVT;
+      p_msg->nfcee_id = nfcee_id;
+      p_msg->p_cb = p_cb;
+      p_msg->technologies_switch_on = clear_technology;
+      p_msg->technologies_switch_off = clear_technology;
+      p_msg->technologies_battery_off = clear_technology;
+      p_msg->technologies_screen_lock = clear_technology;
+      p_msg->technologies_screen_off = clear_technology;
+      p_msg->technologies_screen_off_lock = clear_technology;
+
+      nfa_sys_sendmsg(p_msg);
+
+      status = NFA_STATUS_OK;
+    }
+  }
+
+  return status;
+}
+
+/*******************************************************************************
+**
 ** Function         NFA_EeSetDefaultProtoRouting
 **
 ** Description      This function is called to add, change or remove the
@@ -374,13 +438,13 @@
       protocols_screen_off_lock);
   p_cb = nfa_ee_find_ecb(nfcee_id);
 
-  if (p_cb == NULL) {
+  if (p_cb == nullptr) {
     LOG(ERROR) << StringPrintf("Bad ee_handle");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_SET_PROTO_CFG*)GKI_getbuf(
         sizeof(tNFA_EE_API_SET_PROTO_CFG));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_SET_PROTO_CFG_EVT;
       p_msg->nfcee_id = nfcee_id;
       p_msg->p_cb = p_cb;
@@ -402,6 +466,70 @@
 
 /*******************************************************************************
 **
+** Function         NFA_EeClearDefaultProtoRouting
+**
+** Description      This function is called to remove the default routing based
+**                  on RF technology in the listen mode routing table for the
+**                  given ee_handle. The status of this operation is reported
+**                  as the NFA_EE_CLEAR_TECH_CFG_EVT.
+**
+** Note:            If RF discovery is started,
+**                  NFA_StopRfDiscovery()/NFA_RF_DISCOVERY_STOPPED_EVT should
+**                  happen before calling this function
+**
+** Note:            NFA_EeUpdateNow() should be called after last NFA-EE
+**                  function to change the listen mode routing is called.
+**
+** Returns          NFA_STATUS_OK if successfully initiated
+**                  NFA_STATUS_FAILED otherwise
+**                  NFA_STATUS_INVALID_PARAM If bad parameter
+**
+*******************************************************************************/
+tNFA_STATUS NFA_EeClearDefaultProtoRouting(tNFA_HANDLE ee_handle,
+                                           tNFA_PROTOCOL_MASK clear_protocol) {
+  tNFA_EE_API_SET_PROTO_CFG* p_msg;
+  tNFA_STATUS status = NFA_STATUS_FAILED;
+  uint8_t nfcee_id = (uint8_t)(ee_handle & 0xFF);
+  tNFA_EE_ECB* p_cb;
+
+  DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
+      "handle:<0x%x>clear protocol_mask:<0x%x>", ee_handle, clear_protocol);
+  if (!clear_protocol) {
+    DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("nothing to clear");
+    status = NFA_STATUS_OK;
+    return status;
+  }
+
+  p_cb = nfa_ee_find_ecb(nfcee_id);
+
+  if (p_cb == nullptr) {
+    LOG(ERROR) << StringPrintf("Bad ee_handle");
+    status = NFA_STATUS_INVALID_PARAM;
+  } else {
+    p_msg = (tNFA_EE_API_SET_PROTO_CFG*)GKI_getbuf(
+        sizeof(tNFA_EE_API_SET_PROTO_CFG));
+    if (p_msg != nullptr) {
+      p_msg->hdr.event = NFA_EE_API_CLEAR_PROTO_CFG_EVT;
+      p_msg->nfcee_id = nfcee_id;
+      p_msg->p_cb = p_cb;
+      p_msg->protocols_switch_on = clear_protocol;
+      p_msg->protocols_switch_off = clear_protocol;
+      p_msg->protocols_battery_off = clear_protocol;
+      p_msg->protocols_screen_lock = clear_protocol;
+      p_msg->protocols_screen_off = clear_protocol;
+      p_msg->protocols_screen_off_lock = clear_protocol;
+
+      nfa_sys_sendmsg(p_msg);
+
+      status = NFA_STATUS_OK;
+    }
+  }
+
+  return status;
+}
+
+/*******************************************************************************
+**
 ** Function         NFA_EeAddAidRouting
 **
 ** Description      This function is called to add an AID entry in the
@@ -433,15 +561,20 @@
   p_cb = nfa_ee_find_ecb(nfcee_id);
 
   /* validate parameters - make sure the AID is in valid length range */
-  if ((p_cb == NULL) || (aid_len == 0) || (p_aid == NULL) ||
-      (aid_len < NFA_MIN_AID_LEN) || (aid_len > NFA_MAX_AID_LEN)) {
+  if ((p_cb == nullptr) ||
+      ((NFA_GetNCIVersion() == NCI_VERSION_2_0) && (aid_len != 0) &&
+       (p_aid == nullptr)) ||
+      ((NFA_GetNCIVersion() != NCI_VERSION_2_0) &&
+       ((aid_len == 0) || (p_aid == nullptr) || (aid_len < NFA_MIN_AID_LEN))) ||
+      (aid_len > NFA_MAX_AID_LEN)) {
     LOG(ERROR) << StringPrintf("Bad ee_handle or AID (len=%d)", aid_len);
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_ADD_AID*)GKI_getbuf(size);
-    if (p_msg != NULL) {
-      DLOG_IF(INFO, nfc_debug_enabled)
-          << StringPrintf("aid:<%02x%02x>", p_aid[0], p_aid[1]);
+    if (p_msg != nullptr) {
+      if (p_aid != nullptr)
+        DLOG_IF(INFO, nfc_debug_enabled)
+            << StringPrintf("aid:<%02x%02x>", p_aid[0], p_aid[1]);
       p_msg->hdr.event = NFA_EE_API_ADD_AID_EVT;
       p_msg->nfcee_id = nfcee_id;
       p_msg->p_cb = p_cb;
@@ -449,7 +582,7 @@
       p_msg->power_state = power_state;
       p_msg->p_aid = (uint8_t*)(p_msg + 1);
       p_msg->aidInfo = aidInfo;
-      memcpy(p_msg->p_aid, p_aid, aid_len);
+      if (p_aid != nullptr) memcpy(p_msg->p_aid, p_aid, aid_len);
 
       nfa_sys_sendmsg(p_msg);
 
@@ -487,12 +620,16 @@
   uint16_t size = sizeof(tNFA_EE_API_REMOVE_AID) + aid_len;
 
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
-  if ((aid_len == 0) || (p_aid == NULL) || (aid_len > NFA_MAX_AID_LEN)) {
+  if (((NFA_GetNCIVersion() == NCI_VERSION_2_0) && (aid_len != 0) &&
+       (p_aid == nullptr)) ||
+      ((NFA_GetNCIVersion() != NCI_VERSION_2_0) &&
+       ((aid_len == 0) || (p_aid == nullptr) || (aid_len < NFA_MIN_AID_LEN))) ||
+      (aid_len > NFA_MAX_AID_LEN)) {
     LOG(ERROR) << StringPrintf("Bad AID");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_REMOVE_AID*)GKI_getbuf(size);
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_REMOVE_AID_EVT;
       p_msg->aid_len = aid_len;
       p_msg->p_aid = (uint8_t*)(p_msg + 1);
@@ -536,7 +673,7 @@
       << StringPrintf("NFA_EeAddSystemCodeRouting(): handle:<0x%x>", ee_handle);
   tNFA_EE_ECB* p_cb = nfa_ee_find_ecb(nfcee_id);
 
-  if (p_cb == NULL || systemcode == 0) {
+  if (p_cb == nullptr || systemcode == 0) {
     LOG(ERROR) << StringPrintf("Bad ee_handle or System Code");
     status = NFA_STATUS_INVALID_PARAM;
   } else if ((NFA_GetNCIVersion() != NCI_VERSION_2_0) &&
@@ -546,7 +683,7 @@
   } else {
     tNFA_EE_API_ADD_SYSCODE* p_msg =
         (tNFA_EE_API_ADD_SYSCODE*)GKI_getbuf(sizeof(tNFA_EE_API_ADD_SYSCODE));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_ADD_SYSCODE_EVT;
       p_msg->power_state = power_state;
       p_msg->nfcee_id = nfcee_id;
@@ -594,7 +731,7 @@
   } else {
     tNFA_EE_API_REMOVE_SYSCODE* p_msg = (tNFA_EE_API_REMOVE_SYSCODE*)GKI_getbuf(
         sizeof(tNFA_EE_API_REMOVE_SYSCODE));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_REMOVE_SYSCODE_EVT;
       p_msg->syscode = (systemcode & 0x00FF) << 8 | (systemcode & 0xFF00) >> 8;
       nfa_sys_sendmsg(p_msg);
@@ -606,6 +743,18 @@
 
 /*******************************************************************************
 **
+** Function         NFA_GetAidTableSize
+**
+** Description      This function is called to get the Maximum AID routing table
+*size.
+**
+** Returns          AID routing table maximum size
+**
+*******************************************************************************/
+uint16_t NFA_GetAidTableSize() { return nfa_ee_find_max_aid_cfg_len(); }
+
+/*******************************************************************************
+**
 ** Function         NFA_EeGetLmrtRemainingSize
 **
 ** Description      This function is called to get remaining size of the
@@ -622,7 +771,7 @@
 
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
   p_msg = (tNFA_EE_API_LMRT_SIZE*)GKI_getbuf(sizeof(tNFA_EE_API_LMRT_SIZE));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_EE_API_LMRT_SIZE_EVT;
     nfa_sys_sendmsg(p_msg);
     status = NFA_STATUS_OK;
@@ -657,7 +806,7 @@
     status = NFA_STATUS_SEMANTIC_ERROR;
   } else {
     p_msg = (NFC_HDR*)GKI_getbuf(NFC_HDR_SIZE);
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->event = NFA_EE_API_UPDATE_NOW_EVT;
 
       nfa_sys_sendmsg(p_msg);
@@ -694,12 +843,12 @@
       "handle:<0x%x> ee_interface:0x%x", ee_handle, ee_interface);
   p_cb = nfa_ee_find_ecb(nfcee_id);
 
-  if ((p_cb == NULL) || (p_cback == NULL)) {
+  if ((p_cb == nullptr) || (p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Bad ee_handle or NULL callback function");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_CONNECT*)GKI_getbuf(sizeof(tNFA_EE_API_CONNECT));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_CONNECT_EVT;
       p_msg->nfcee_id = nfcee_id;
       p_msg->p_cb = p_cb;
@@ -740,14 +889,14 @@
 
   p_cb = nfa_ee_find_ecb(nfcee_id);
 
-  if ((p_cb == NULL) || (p_cb->conn_st != NFA_EE_CONN_ST_CONN) ||
-      (p_data == NULL)) {
+  if ((p_cb == nullptr) || (p_cb->conn_st != NFA_EE_CONN_ST_CONN) ||
+      (p_data == nullptr)) {
     LOG(ERROR) << StringPrintf("Bad ee_handle or NULL data");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_SEND_DATA*)GKI_getbuf(
         (uint16_t)(sizeof(tNFA_EE_API_SEND_DATA) + data_len));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_SEND_DATA_EVT;
       p_msg->nfcee_id = nfcee_id;
       p_msg->p_cb = p_cb;
@@ -786,12 +935,12 @@
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("handle:<0x%x>", ee_handle);
   p_cb = nfa_ee_find_ecb(nfcee_id);
 
-  if ((p_cb == NULL) || (p_cb->conn_st != NFA_EE_CONN_ST_CONN)) {
+  if ((p_cb == nullptr) || (p_cb->conn_st != NFA_EE_CONN_ST_CONN)) {
     LOG(ERROR) << StringPrintf("Bad ee_handle");
     status = NFA_STATUS_INVALID_PARAM;
   } else {
     p_msg = (tNFA_EE_API_DISCONNECT*)GKI_getbuf(sizeof(tNFA_EE_API_DISCONNECT));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_EE_API_DISCONNECT_EVT;
       p_msg->nfcee_id = nfcee_id;
       p_msg->p_cb = p_cb;
diff --git a/src/nfa/ee/nfa_ee_main.cc b/src/nfa/ee/nfa_ee_main.cc
index 259bcba..30a44a7 100644
--- a/src/nfa/ee/nfa_ee_main.cc
+++ b/src/nfa/ee/nfa_ee_main.cc
@@ -57,7 +57,9 @@
     nfa_ee_api_deregister,      /* NFA_EE_API_DEREGISTER_EVT    */
     nfa_ee_api_mode_set,        /* NFA_EE_API_MODE_SET_EVT      */
     nfa_ee_api_set_tech_cfg,    /* NFA_EE_API_SET_TECH_CFG_EVT  */
+    nfa_ee_api_clear_tech_cfg,  /*NFA_EE_API_CLEAR_TECH_CFG_EVT */
     nfa_ee_api_set_proto_cfg,   /* NFA_EE_API_SET_PROTO_CFG_EVT */
+    nfa_ee_api_clear_proto_cfg, /*NFA_EE_API_CLEAR_PROTO_CFG_EVT*/
     nfa_ee_api_add_aid,         /* NFA_EE_API_ADD_AID_EVT       */
     nfa_ee_api_remove_aid,      /* NFA_EE_API_REMOVE_AID_EVT    */
     nfa_ee_api_add_sys_code,    /* NFA_EE_API_ADD_SYSCODE_EVT   */
@@ -397,7 +399,7 @@
 *******************************************************************************/
 tNFA_EE_ECB* nfa_ee_find_ecb(uint8_t nfcee_id) {
   uint32_t xx;
-  tNFA_EE_ECB *p_ret = NULL, *p_cb;
+  tNFA_EE_ECB *p_ret = nullptr, *p_cb;
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   if (nfcee_id == NFC_DH_ID) {
@@ -426,7 +428,7 @@
 *******************************************************************************/
 tNFA_EE_ECB* nfa_ee_find_ecb_by_conn_id(uint8_t conn_id) {
   uint32_t xx;
-  tNFA_EE_ECB *p_ret = NULL, *p_cb;
+  tNFA_EE_ECB *p_ret = nullptr, *p_cb;
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_cb = nfa_ee_cb.ecb;
@@ -572,8 +574,12 @@
       return "API_MODE_SET";
     case NFA_EE_API_SET_TECH_CFG_EVT:
       return "API_SET_TECH_CFG";
+    case NFA_EE_API_CLEAR_TECH_CFG_EVT:
+      return "API_CLEAR_TECH_CFG";
     case NFA_EE_API_SET_PROTO_CFG_EVT:
       return "API_SET_PROTO_CFG";
+    case NFA_EE_API_CLEAR_PROTO_CFG_EVT:
+      return "API_CLEAR_PROTO_CFG";
     case NFA_EE_API_ADD_AID_EVT:
       return "API_ADD_AID";
     case NFA_EE_API_REMOVE_AID_EVT:
diff --git a/src/nfa/hci/nfa_hci_act.cc b/src/nfa/hci/nfa_hci_act.cc
index c75c1c6..4ad9754 100644
--- a/src/nfa/hci/nfa_hci_act.cc
+++ b/src/nfa/hci/nfa_hci_act.cc
@@ -84,7 +84,7 @@
   /* If busy, or API queue is empty, then exit */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_IDLE) ||
       ((p_msg = (NFC_HDR*)GKI_dequeue(&nfa_hci_cb.hci_host_reset_api_q)) ==
-       NULL))
+       nullptr))
     return;
 
   /* Process API request */
@@ -134,7 +134,7 @@
   for (;;) {
     /* If busy, or API queue is empty, then exit */
     if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_IDLE) ||
-        ((p_msg = (NFC_HDR*)GKI_dequeue(&nfa_hci_cb.hci_api_q)) == NULL))
+        ((p_msg = (NFC_HDR*)GKI_dequeue(&nfa_hci_cb.hci_api_q)) == nullptr))
       break;
 
     /* Process API request */
@@ -306,13 +306,13 @@
 *******************************************************************************/
 void nfa_hci_api_deregister(tNFA_HCI_EVENT_DATA* p_evt_data) {
   tNFA_HCI_EVT_DATA evt_data;
-  tNFA_HCI_CBACK* p_cback = NULL;
+  tNFA_HCI_CBACK* p_cback = nullptr;
   int xx;
   tNFA_HCI_DYN_PIPE* p_pipe;
   tNFA_HCI_DYN_GATE* p_gate;
 
   /* If needed, find the application registration handle */
-  if (p_evt_data != NULL) {
+  if (p_evt_data != nullptr) {
     for (xx = 0; xx < NFA_HCI_MAX_APP_CB; xx++) {
       if ((nfa_hci_cb.cfg.reg_app_names[xx][0] != 0) &&
           !strncmp(p_evt_data->app_info.app_name,
@@ -339,16 +339,16 @@
   }
 
   /* See if any pipe is owned by this app */
-  if (nfa_hciu_find_pipe_by_owner(nfa_hci_cb.app_in_use) == NULL) {
+  if (nfa_hciu_find_pipe_by_owner(nfa_hci_cb.app_in_use) == nullptr) {
     /* No pipes, release all gates owned by this app */
     while ((p_gate = nfa_hciu_find_gate_by_owner(nfa_hci_cb.app_in_use)) !=
-           NULL)
+           nullptr)
       nfa_hciu_release_gate(p_gate->gate_id);
 
     memset(&nfa_hci_cb.cfg
                 .reg_app_names[nfa_hci_cb.app_in_use & NFA_HANDLE_MASK][0],
            0, NFA_MAX_HCI_APP_NAME_LEN + 1);
-    nfa_hci_cb.p_app_cback[nfa_hci_cb.app_in_use & NFA_HANDLE_MASK] = NULL;
+    nfa_hci_cb.p_app_cback[nfa_hci_cb.app_in_use & NFA_HANDLE_MASK] = nullptr;
 
     nfa_hci_cb.nv_write_needed = true;
 
@@ -360,13 +360,13 @@
     /* notify NFA_HCI_DEREGISTER_EVT to the application */
     if (p_cback) p_cback(NFA_HCI_DEREGISTER_EVT, &evt_data);
   } else if ((p_pipe = nfa_hciu_find_active_pipe_by_owner(
-                  nfa_hci_cb.app_in_use)) == NULL) {
+                  nfa_hci_cb.app_in_use)) == nullptr) {
     /* No pipes, release all gates owned by this app */
     while ((p_gate = nfa_hciu_find_gate_with_nopipes_by_owner(
-                nfa_hci_cb.app_in_use)) != NULL)
+                nfa_hci_cb.app_in_use)) != nullptr)
       nfa_hciu_release_gate(p_gate->gate_id);
 
-    nfa_hci_cb.p_app_cback[nfa_hci_cb.app_in_use & NFA_HANDLE_MASK] = NULL;
+    nfa_hci_cb.p_app_cback[nfa_hci_cb.app_in_use & NFA_HANDLE_MASK] = nullptr;
 
     nfa_hci_cb.nv_write_needed = true;
 
@@ -436,8 +436,8 @@
                pp->pipe_id <= NFA_HCI_LAST_DYNAMIC_PIPE && pp->pipe_id &&
                pp->local_gate >= NFA_HCI_FIRST_PROP_GATE &&
                pp->local_gate <= NFA_HCI_LAST_PROP_GATE) {
-      for (xx = 0, pg = nfa_hci_cb.cfg.dyn_gates; xx < NFA_HCI_MAX_GATE_CB;
-           xx++, pg++) {
+      for (yy = 0, pg = nfa_hci_cb.cfg.dyn_gates; yy < NFA_HCI_MAX_GATE_CB;
+           yy++, pg++) {
         if (pp->local_gate == pg->gate_id) {
           if (!pg->gate_owner)
             memcpy(&evt_data.gates_pipes.uicc_created_pipe
@@ -478,7 +478,7 @@
       p_gate->gate_owner = app_handle;
     } else if (p_gate->gate_owner != app_handle) {
       /* Some other app owns the gate */
-      p_gate = NULL;
+      p_gate = nullptr;
       LOG(ERROR) << StringPrintf("The Gate (0X%02x) already taken!",
                                  p_evt_data->gate_info.gate);
     }
@@ -523,13 +523,13 @@
 
   p_gate = nfa_hciu_find_gate_by_gid(gate_id);
 
-  if (p_gate == NULL) {
+  if (p_gate == nullptr) {
     evt_data.deallocated.status = NFA_STATUS_UNKNOWN_GID;
   } else if (p_gate->gate_owner != app_handle) {
     evt_data.deallocated.status = NFA_STATUS_FAILED;
   } else {
     /* See if any pipe is owned by this app */
-    if (nfa_hciu_find_pipe_on_gate(p_gate->gate_id) == NULL) {
+    if (nfa_hciu_find_pipe_on_gate(p_gate->gate_id) == nullptr) {
       nfa_hciu_release_gate(p_gate->gate_id);
 
       nfa_hci_cb.nv_write_needed = true;
@@ -538,7 +538,7 @@
       if (nfa_hci_cb.hci_state == NFA_HCI_STATE_REMOVE_GATE)
         nfa_hci_cb.hci_state = NFA_HCI_STATE_IDLE;
     } else if ((p_pipe = nfa_hciu_find_active_pipe_on_gate(p_gate->gate_id)) ==
-               NULL) {
+               nullptr) {
       /* UICC is not active at the moment and cannot delete the pipe */
       nfa_hci_cb.nv_write_needed = true;
       evt_data.deallocated.status = NFA_STATUS_FAILED;
@@ -577,7 +577,7 @@
    * application with valid handle and callback function */
   if ((nfa_hci_cb.app_in_use == NFA_HANDLE_INVALID) ||
       ((app_inx < NFA_HCI_MAX_APP_CB) &&
-       (nfa_hci_cb.p_app_cback[app_inx] != NULL))) {
+       (nfa_hci_cb.p_app_cback[app_inx] != nullptr))) {
     nfa_hciu_send_get_param_cmd(NFA_HCI_ADMIN_PIPE, NFA_HCI_HOST_LIST_INDEX);
   }
 }
@@ -599,7 +599,7 @@
   bool report_failed = false;
 
   /* Verify that the app owns the gate that the pipe is being created on */
-  if ((p_gate == NULL) ||
+  if ((p_gate == nullptr) ||
       (p_gate->gate_owner != p_evt_data->create_pipe.hci_handle)) {
     report_failed = true;
     LOG(ERROR) << StringPrintf(
@@ -654,11 +654,11 @@
   tNFA_HCI_EVT_DATA evt_data;
   tNFA_HCI_DYN_PIPE* p_pipe =
       nfa_hciu_find_pipe_by_pid(p_evt_data->open_pipe.pipe);
-  tNFA_HCI_DYN_GATE* p_gate = NULL;
+  tNFA_HCI_DYN_GATE* p_gate = nullptr;
 
-  if (p_pipe != NULL) p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
+  if (p_pipe != nullptr) p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
 
-  if ((p_pipe != NULL) && (p_gate != NULL) &&
+  if ((p_pipe != nullptr) && (p_gate != nullptr) &&
       (nfa_hciu_is_active_host(p_pipe->dest_host)) &&
       (p_gate->gate_owner == p_evt_data->open_pipe.hci_handle)) {
     if (p_pipe->pipe_state == NFA_HCI_PIPE_CLOSED) {
@@ -696,10 +696,10 @@
   tNFA_STATUS status = NFA_STATUS_FAILED;
   tNFA_HCI_EVT_DATA evt_data;
 
-  if (p_pipe != NULL) {
+  if (p_pipe != nullptr) {
     p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
 
-    if ((p_gate != NULL) && (nfa_hciu_is_active_host(p_pipe->dest_host)) &&
+    if ((p_gate != nullptr) && (nfa_hciu_is_active_host(p_pipe->dest_host)) &&
         (p_gate->gate_owner == p_evt_data->get_registry.hci_handle)) {
       nfa_hci_cb.app_in_use = p_evt_data->get_registry.hci_handle;
 
@@ -745,10 +745,10 @@
   tNFA_STATUS status = NFA_STATUS_FAILED;
   tNFA_HCI_EVT_DATA evt_data;
 
-  if (p_pipe != NULL) {
+  if (p_pipe != nullptr) {
     p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
 
-    if ((p_gate != NULL) && (nfa_hciu_is_active_host(p_pipe->dest_host)) &&
+    if ((p_gate != nullptr) && (nfa_hciu_is_active_host(p_pipe->dest_host)) &&
         (p_gate->gate_owner == p_evt_data->set_registry.hci_handle)) {
       nfa_hci_cb.app_in_use = p_evt_data->set_registry.hci_handle;
 
@@ -790,11 +790,11 @@
   tNFA_HCI_EVT_DATA evt_data;
   tNFA_HCI_DYN_PIPE* p_pipe =
       nfa_hciu_find_pipe_by_pid(p_evt_data->close_pipe.pipe);
-  tNFA_HCI_DYN_GATE* p_gate = NULL;
+  tNFA_HCI_DYN_GATE* p_gate = nullptr;
 
-  if (p_pipe != NULL) p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
+  if (p_pipe != nullptr) p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
 
-  if ((p_pipe != NULL) && (p_gate != NULL) &&
+  if ((p_pipe != nullptr) && (p_gate != nullptr) &&
       (nfa_hciu_is_active_host(p_pipe->dest_host)) &&
       (p_gate->gate_owner == p_evt_data->close_pipe.hci_handle)) {
     if (p_pipe->pipe_state == NFA_HCI_PIPE_OPENED) {
@@ -828,11 +828,11 @@
   tNFA_HCI_EVT_DATA evt_data;
   tNFA_HCI_DYN_PIPE* p_pipe =
       nfa_hciu_find_pipe_by_pid(p_evt_data->delete_pipe.pipe);
-  tNFA_HCI_DYN_GATE* p_gate = NULL;
+  tNFA_HCI_DYN_GATE* p_gate = nullptr;
 
-  if (p_pipe != NULL) {
+  if (p_pipe != nullptr) {
     p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
-    if ((p_gate != NULL) &&
+    if ((p_gate != nullptr) &&
         (p_gate->gate_owner == p_evt_data->delete_pipe.hci_handle) &&
         (nfa_hciu_is_active_host(p_pipe->dest_host))) {
       nfa_hciu_send_delete_pipe_cmd(p_evt_data->delete_pipe.pipe);
@@ -862,7 +862,7 @@
   tNFA_HCI_EVT_DATA evt_data;
   tNFA_HANDLE app_handle;
 
-  if ((p_pipe = nfa_hciu_find_pipe_by_pid(p_evt_data->send_cmd.pipe)) != NULL) {
+  if ((p_pipe = nfa_hciu_find_pipe_by_pid(p_evt_data->send_cmd.pipe)) != nullptr) {
     app_handle = nfa_hciu_get_pipe_owner(p_evt_data->send_cmd.pipe);
 
     if ((nfa_hciu_is_active_host(p_pipe->dest_host)) &&
@@ -918,7 +918,7 @@
   tNFA_HCI_EVT_DATA evt_data;
   tNFA_HANDLE app_handle;
 
-  if ((p_pipe = nfa_hciu_find_pipe_by_pid(p_evt_data->send_rsp.pipe)) != NULL) {
+  if ((p_pipe = nfa_hciu_find_pipe_by_pid(p_evt_data->send_rsp.pipe)) != nullptr) {
     app_handle = nfa_hciu_get_pipe_owner(p_evt_data->send_rsp.pipe);
 
     if ((nfa_hciu_is_active_host(p_pipe->dest_host)) &&
@@ -968,7 +968,7 @@
   tNFA_HCI_EVT_DATA evt_data;
   tNFA_HANDLE app_handle;
 
-  if ((p_pipe = nfa_hciu_find_pipe_by_pid(p_evt_data->send_evt.pipe)) != NULL) {
+  if ((p_pipe = nfa_hciu_find_pipe_by_pid(p_evt_data->send_evt.pipe)) != nullptr) {
     app_handle = nfa_hciu_get_pipe_owner(p_evt_data->send_evt.pipe);
 
     if ((nfa_hciu_is_active_host(p_pipe->dest_host)) &&
@@ -1010,7 +1010,7 @@
                                   p_nfa_hci_cfg->hcp_response_timeout);
             }
             nfa_hci_cb.rsp_buf_size = 0;
-            nfa_hci_cb.p_rsp_buf = NULL;
+            nfa_hci_cb.p_rsp_buf = nullptr;
           }
         }
       } else {
@@ -1053,7 +1053,7 @@
   /* Allocate a proprietary gate */
   pg = nfa_hciu_alloc_gate(p_evt_data->add_static_pipe.gate,
                            p_evt_data->add_static_pipe.hci_handle);
-  if (pg != NULL) {
+  if (pg != nullptr) {
     /* Assign new owner to the gate */
     pg->gate_owner = p_evt_data->add_static_pipe.hci_handle;
 
@@ -1070,7 +1070,7 @@
       return;
     }
     pp = nfa_hciu_find_pipe_by_pid(p_evt_data->add_static_pipe.pipe);
-    if (pp != NULL) {
+    if (pp != nullptr) {
       /* This pipe is always opened */
       pp->pipe_state = NFA_HCI_PIPE_OPENED;
       evt_data.pipe_added.status = NFA_STATUS_OK;
@@ -1104,7 +1104,7 @@
   if ((nfa_hci_cb.cfg.link_mgmt_gate.pipe00_state != NFA_HCI_PIPE_OPENED) &&
       (nfa_hci_cb.inst != NFA_HCI_ANY_OPEN_PIPE)) {
     nfa_hciu_send_msg(NFA_HCI_LINK_MANAGEMENT_PIPE, NFA_HCI_RESPONSE_TYPE,
-                      NFA_HCI_ANY_E_PIPE_NOT_OPENED, 0, NULL);
+                      NFA_HCI_ANY_E_PIPE_NOT_OPENED, 0, nullptr);
     return;
   }
 
@@ -1165,7 +1165,7 @@
   tNFA_HCI_DYN_GATE* p_gate;
 
   if (nfa_hci_cb.inst == NFA_HCI_ANY_OPEN_PIPE) {
-    if ((p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate)) != NULL)
+    if ((p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate)) != nullptr)
       data[0] = nfa_hciu_count_open_pipes_on_gate(p_gate);
     else
       data[0] = 0;
@@ -1226,7 +1226,7 @@
         response = nfa_hciu_add_pipe_to_static_gate(dest_gate, pipe,
                                                     source_host, source_gate);
       } else {
-        if ((pgate = nfa_hciu_find_gate_by_gid(dest_gate)) != NULL) {
+        if ((pgate = nfa_hciu_find_gate_by_gid(dest_gate)) != nullptr) {
           /* If the gate is valid, add the pipe to it  */
           if (nfa_hciu_check_pipe_between_gates(dest_gate, source_host,
                                                 source_gate)) {
@@ -1280,11 +1280,17 @@
         nfa_hciu_send_open_pipe_cmd(NFA_HCI_ADMIN_PIPE);
         return;
       } else {
-        if ((source_host >= NFA_HCI_HOST_ID_UICC0) &&
-            (source_host <
-             (NFA_HCI_HOST_ID_UICC0 + NFA_HCI_MAX_HOST_IN_NETWORK))) {
-          nfa_hci_cb.reset_host[source_host - NFA_HCI_HOST_ID_UICC0] =
-              source_host;
+        uint8_t host_index = 0;
+
+        if ((source_host == NFA_HCI_HOST_ID_UICC0) ||
+            (source_host >= NFA_HCI_HOST_ID_FIRST_DYNAMICALLY_ALLOCATED)) {
+          while (host_index < NFA_HCI_MAX_HOST_IN_NETWORK) {
+            if (nfa_hci_cb.reset_host[host_index] == 0x0) {
+              nfa_hci_cb.reset_host[host_index] = source_host;
+              break;
+            }
+            host_index++;
+          }
         }
       }
       break;
@@ -1365,27 +1371,33 @@
 
       case NFA_HCI_ANY_GET_PARAMETER:
         if (nfa_hci_cb.param_in_use == NFA_HCI_HOST_LIST_INDEX) {
-          host_count = 0;
-          while (host_count < NFA_HCI_MAX_HOST_IN_NETWORK) {
-            nfa_hci_cb.inactive_host[host_count] =
-                NFA_HCI_HOST_ID_UICC0 + host_count;
-            host_count++;
-          }
+          uint8_t host_index = 0;
+
+          memset(nfa_hci_cb.active_host, 0x0, NFA_HCI_MAX_HOST_IN_NETWORK);
 
           host_count = 0;
+
           /* Collect active host in the Host Network */
-          while (host_count < data_len) {
+          while ((host_count < data_len) &&
+                 (host_count < NFA_HCI_MAX_HOST_IN_NETWORK)) {
             host_id = (uint8_t)*p_data++;
 
-            if ((host_id >= NFA_HCI_HOST_ID_UICC0) &&
-                (host_id <
-                 NFA_HCI_HOST_ID_UICC0 + NFA_HCI_MAX_HOST_IN_NETWORK)) {
-              nfa_hci_cb.inactive_host[host_id - NFA_HCI_HOST_ID_UICC0] = 0x00;
-              nfa_hci_cb.reset_host[host_id - NFA_HCI_HOST_ID_UICC0] = 0x00;
+            if ((host_id == NFA_HCI_HOST_ID_UICC0) ||
+                (host_id >= NFA_HCI_HOST_ID_FIRST_DYNAMICALLY_ALLOCATED)) {
+              nfa_hci_cb.active_host[host_index] = host_id;
+              uint8_t index = 0;
+              while (index < NFA_HCI_MAX_HOST_IN_NETWORK) {
+                if (nfa_hci_cb.reset_host[index] == host_id) {
+                  nfa_hci_cb.reset_host[index] = 0x0;
+                  break;
+                }
+                index++;
+              }
+              host_index++;
             }
-
             host_count++;
           }
+
           nfa_hci_startup_complete(NFA_STATUS_OK);
         } else if (nfa_hci_cb.param_in_use == NFA_HCI_SESSION_IDENTITY_INDEX) {
           /* The only parameter we get when initializing is the session ID.
@@ -1450,9 +1462,9 @@
     switch (nfa_hci_cb.cmd_sent) {
       case NFA_HCI_ANY_SET_PARAMETER:
         if (nfa_hci_cb.hci_state == NFA_HCI_STATE_APP_DEREGISTER)
-          nfa_hci_api_deregister(NULL);
+          nfa_hci_api_deregister(nullptr);
         else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_REMOVE_GATE)
-          nfa_hci_api_dealloc_gate(NULL);
+          nfa_hci_api_dealloc_gate(nullptr);
         break;
 
       case NFA_HCI_ANY_GET_PARAMETER:
@@ -1477,9 +1489,9 @@
               android_errorWriteLog(0x534e4554, "124524315");
             }
             if (nfa_hci_cb.hci_state == NFA_HCI_STATE_APP_DEREGISTER)
-              nfa_hci_api_deregister(NULL);
+              nfa_hci_api_deregister(nullptr);
             else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_REMOVE_GATE)
-              nfa_hci_api_dealloc_gate(NULL);
+              nfa_hci_api_dealloc_gate(nullptr);
           }
         } else if (nfa_hci_cb.param_in_use == NFA_HCI_HOST_LIST_INDEX) {
           evt_data.hosts.status = status;
@@ -1490,26 +1502,32 @@
           evt_data.hosts.num_hosts = data_len;
           memcpy(evt_data.hosts.host, p_data, data_len);
 
-          host_count = 0;
-          while (host_count < NFA_HCI_MAX_HOST_IN_NETWORK) {
-            nfa_hci_cb.inactive_host[host_count] =
-                NFA_HCI_HOST_ID_UICC0 + host_count;
-            host_count++;
-          }
+          uint8_t host_index = 0;
+
+          memset(nfa_hci_cb.active_host, 0x0, NFA_HCI_MAX_HOST_IN_NETWORK);
 
           host_count = 0;
           /* Collect active host in the Host Network */
-          while (host_count < data_len) {
+          while ((host_count < data_len) &&
+                 (host_count < NFA_HCI_MAX_HOST_IN_NETWORK)) {
             host_id = (uint8_t)*p_data++;
 
-            if ((host_id >= NFA_HCI_HOST_ID_UICC0) &&
-                (host_id <
-                 NFA_HCI_HOST_ID_UICC0 + NFA_HCI_MAX_HOST_IN_NETWORK)) {
-              nfa_hci_cb.inactive_host[host_id - NFA_HCI_HOST_ID_UICC0] = 0x00;
-              nfa_hci_cb.reset_host[host_id - NFA_HCI_HOST_ID_UICC0] = 0x00;
+            if ((host_id == NFA_HCI_HOST_ID_UICC0) ||
+                (host_id >= NFA_HCI_HOST_ID_FIRST_DYNAMICALLY_ALLOCATED)) {
+              nfa_hci_cb.active_host[host_index] = host_id;
+              uint8_t index = 0;
+              while (index < NFA_HCI_MAX_HOST_IN_NETWORK) {
+                if (nfa_hci_cb.reset_host[index] == host_id) {
+                  nfa_hci_cb.reset_host[index] = 0x0;
+                  break;
+                }
+                index++;
+              }
+              host_index++;
             }
             host_count++;
           }
+
           if (nfa_hciu_is_no_host_resetting())
             nfa_hci_check_pending_api_requests();
           nfa_hciu_send_to_app(NFA_HCI_HOST_LIST_EVT, &evt_data,
@@ -1564,9 +1582,9 @@
             nfa_hciu_send_to_app(NFA_HCI_DELETE_PIPE_EVT, &evt_data,
                                  nfa_hci_cb.app_in_use);
           } else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_APP_DEREGISTER)
-            nfa_hci_api_deregister(NULL);
+            nfa_hci_api_deregister(nullptr);
           else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_REMOVE_GATE)
-            nfa_hci_api_dealloc_gate(NULL);
+            nfa_hci_api_dealloc_gate(nullptr);
         } else {
           /* If only deleting one pipe, tell the app we are done */
           if (nfa_hci_cb.hci_state == NFA_HCI_STATE_IDLE) {
@@ -1577,10 +1595,10 @@
                                  nfa_hci_cb.app_in_use);
           } else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_APP_DEREGISTER) {
             nfa_hciu_release_pipe(nfa_hci_cb.pipe_in_use);
-            nfa_hci_api_deregister(NULL);
+            nfa_hci_api_deregister(nullptr);
           } else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_REMOVE_GATE) {
             nfa_hciu_release_pipe(nfa_hci_cb.pipe_in_use);
-            nfa_hci_api_dealloc_gate(NULL);
+            nfa_hci_api_dealloc_gate(nullptr);
           }
         }
         break;
@@ -1665,7 +1683,7 @@
     /* Send Get Host List after receiving any pending response */
     p_msg = (tNFA_HCI_API_GET_HOST_LIST*)GKI_getbuf(
         sizeof(tNFA_HCI_API_GET_HOST_LIST));
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       p_msg->hdr.event = NFA_HCI_API_GET_HOST_LIST_EVT;
       /* Set Invalid handle to identify this Get Host List command is internal
        */
@@ -1690,13 +1708,13 @@
   tNFA_HCI_DYN_PIPE* p_pipe = nfa_hciu_find_pipe_by_pid(pipe_id);
   tNFA_HCI_DYN_GATE* p_gate;
 
-  if (p_pipe == NULL) {
+  if (p_pipe == nullptr) {
     /* Invalid pipe ID */
     LOG(ERROR) << StringPrintf("nfa_hci_handle_dyn_pipe_pkt - Unknown pipe %d",
                                pipe_id);
     if (nfa_hci_cb.type == NFA_HCI_COMMAND_TYPE)
       nfa_hciu_send_msg(pipe_id, NFA_HCI_RESPONSE_TYPE, NFA_HCI_ANY_E_NOK, 0,
-                        NULL);
+                        nullptr);
     return;
   }
 
@@ -1708,13 +1726,13 @@
     nfa_hci_handle_connectivity_gate_pkt(p_data, data_len, p_pipe);
   } else {
     p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
-    if (p_gate == NULL) {
+    if (p_gate == nullptr) {
       LOG(ERROR) << StringPrintf(
           "nfa_hci_handle_dyn_pipe_pkt - Pipe's gate %d is corrupt",
           p_pipe->local_gate);
       if (nfa_hci_cb.type == NFA_HCI_COMMAND_TYPE)
         nfa_hciu_send_msg(pipe_id, NFA_HCI_RESPONSE_TYPE, NFA_HCI_ANY_E_NOK, 0,
-                          NULL);
+                          nullptr);
       return;
     }
 
@@ -2000,12 +2018,12 @@
         /* now, we will implement it when the spec is clearer and UICCs need it.
          */
         nfa_hciu_send_msg(p_pipe->pipe_id, NFA_HCI_RESPONSE_TYPE,
-                          NFA_HCI_ANY_E_CMD_NOT_SUPPORTED, 0, NULL);
+                          NFA_HCI_ANY_E_CMD_NOT_SUPPORTED, 0, nullptr);
         break;
 
       default:
         nfa_hciu_send_msg(p_pipe->pipe_id, NFA_HCI_RESPONSE_TYPE,
-                          NFA_HCI_ANY_E_CMD_NOT_SUPPORTED, 0, NULL);
+                          NFA_HCI_ANY_E_CMD_NOT_SUPPORTED, 0, nullptr);
         break;
     }
   } else if (nfa_hci_cb.type == NFA_HCI_RESPONSE_TYPE) {
@@ -2129,7 +2147,7 @@
 
   evt_data.rcvd_evt.p_evt_buf = p_data;
   nfa_hci_cb.rsp_buf_size = 0;
-  nfa_hci_cb.p_rsp_buf = NULL;
+  nfa_hci_cb.p_rsp_buf = nullptr;
 
   /* notify NFA_HCI_EVENT_RCVD_EVT to the application */
   nfa_hciu_send_to_app(NFA_HCI_EVENT_RCVD_EVT, &evt_data, p_gate->gate_owner);
diff --git a/src/nfa/hci/nfa_hci_api.cc b/src/nfa/hci/nfa_hci_api.cc
index ce66f89..03c2bb2 100644
--- a/src/nfa/hci/nfa_hci_api.cc
+++ b/src/nfa/hci/nfa_hci_api.cc
@@ -54,13 +54,13 @@
   tNFA_HCI_API_REGISTER_APP* p_msg;
   uint8_t app_name_len;
 
-  if (p_app_name == NULL) {
+  if (p_app_name == nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("Invalid Application name");
     return (NFA_STATUS_FAILED);
   }
 
-  if (p_cback == NULL) {
+  if (p_cback == nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
         "Application should provide callback function to "
         "register!");
@@ -74,9 +74,9 @@
 
   /* Register the application with HCI */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
-      (p_app_name != NULL) && (app_name_len <= NFA_MAX_HCI_APP_NAME_LEN) &&
+      (p_app_name != nullptr) && (app_name_len <= NFA_MAX_HCI_APP_NAME_LEN) &&
       ((p_msg = (tNFA_HCI_API_REGISTER_APP*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_REGISTER_APP))) != NULL)) {
+            sizeof(tNFA_HCI_API_REGISTER_APP))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_REGISTER_APP_EVT;
 
     /* Save application name and callback */
@@ -123,7 +123,7 @@
   /* Register the application with HCI */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_GET_APP_GATE_PIPE*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_GET_APP_GATE_PIPE))) != NULL)) {
+            sizeof(tNFA_HCI_API_GET_APP_GATE_PIPE))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_GET_APP_GATE_PIPE_EVT;
     p_msg->hci_handle = hci_handle;
 
@@ -155,7 +155,7 @@
   int xx;
   uint8_t app_name_len;
 
-  if (p_app_name == NULL) {
+  if (p_app_name == nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("Invalid Application");
     return (NFA_STATUS_FAILED);
   }
@@ -182,7 +182,7 @@
   /* Deregister the application with HCI */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_DEREGISTER_APP*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_DEREGISTER_APP))) != NULL)) {
+            sizeof(tNFA_HCI_API_DEREGISTER_APP))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_DEREGISTER_APP_EVT;
 
     memset(p_msg->app_name, 0, sizeof(p_msg->app_name));
@@ -235,7 +235,7 @@
   /* Request HCI to allocate gate to the application */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_ALLOC_GATE*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_ALLOC_GATE))) != NULL)) {
+            sizeof(tNFA_HCI_API_ALLOC_GATE))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_ALLOC_GATE_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->gate = gate;
@@ -282,7 +282,7 @@
    * application */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_DEALLOC_GATE*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_DEALLOC_GATE))) != NULL)) {
+            sizeof(tNFA_HCI_API_DEALLOC_GATE))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_DEALLOC_GATE_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->gate = gate;
@@ -321,7 +321,7 @@
   /* Request HCI to get list of host in the hci network */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_GET_HOST_LIST*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_GET_HOST_LIST))) != NULL)) {
+            sizeof(tNFA_HCI_API_GET_HOST_LIST))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_GET_HOST_LIST_EVT;
     p_msg->hci_handle = hci_handle;
 
@@ -355,7 +355,6 @@
 tNFA_STATUS NFA_HciCreatePipe(tNFA_HANDLE hci_handle, uint8_t source_gate_id,
                               uint8_t dest_host, uint8_t dest_gate) {
   tNFA_HCI_API_CREATE_PIPE_EVT* p_msg;
-  uint8_t xx;
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
       "hci_handle:0x%04x, source gate:0x%02X, "
@@ -384,12 +383,9 @@
     return (NFA_STATUS_FAILED);
   }
 
-  for (xx = 0; xx < NFA_HCI_MAX_HOST_IN_NETWORK; xx++)
-    if (nfa_hci_cb.inactive_host[xx] == dest_host) break;
-
-  if (xx != NFA_HCI_MAX_HOST_IN_NETWORK) {
+  if (!nfa_hciu_is_active_host(dest_host)) {
     DLOG_IF(INFO, nfc_debug_enabled)
-        << StringPrintf("Host not active:0x%02x", dest_host);
+        << StringPrintf("Host not active: 0x%02x", dest_host);
     return (NFA_STATUS_FAILED);
   }
 
@@ -397,7 +393,7 @@
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       (!nfa_hci_cb.b_low_power_mode) &&
       ((p_msg = (tNFA_HCI_API_CREATE_PIPE_EVT*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_CREATE_PIPE_EVT))) != NULL)) {
+            sizeof(tNFA_HCI_API_CREATE_PIPE_EVT))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_CREATE_PIPE_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->source_gate = source_gate_id;
@@ -446,7 +442,7 @@
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       (!nfa_hci_cb.b_low_power_mode) &&
       ((p_msg = (tNFA_HCI_API_OPEN_PIPE_EVT*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_OPEN_PIPE_EVT))) != NULL)) {
+            sizeof(tNFA_HCI_API_OPEN_PIPE_EVT))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_OPEN_PIPE_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->pipe = pipe; /* Pipe ID of the pipe to open */
@@ -495,7 +491,7 @@
   /* Request HCI to get list of gates supported by the specified host */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_GET_REGISTRY*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_GET_REGISTRY))) != NULL)) {
+            sizeof(tNFA_HCI_API_GET_REGISTRY))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_GET_REGISTRY_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->pipe = pipe;
@@ -540,7 +536,7 @@
     return (NFA_STATUS_FAILED);
   }
 
-  if ((cmd_size && (p_data == NULL)) || (cmd_size > NFA_MAX_HCI_CMD_LEN)) {
+  if ((cmd_size && (p_data == nullptr)) || (cmd_size > NFA_MAX_HCI_CMD_LEN)) {
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("Invalid cmd size:0x%02x", cmd_size);
     return (NFA_STATUS_FAILED);
@@ -553,7 +549,7 @@
   /* Request HCI to post event data on a particular pipe */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_SEND_CMD_EVT*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_SEND_CMD_EVT))) != NULL)) {
+            sizeof(tNFA_HCI_API_SEND_CMD_EVT))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_SEND_CMD_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->pipe = pipe;
@@ -622,13 +618,13 @@
     return (NFA_STATUS_FAILED);
   }
 
-  if (evt_size && (p_data == NULL)) {
+  if (evt_size && (p_data == nullptr)) {
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("Invalid Event size:0x%02x", evt_size);
     return (NFA_STATUS_FAILED);
   }
 
-  if (rsp_size && (p_rsp_buf == NULL)) {
+  if (rsp_size && (p_rsp_buf == nullptr)) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
         "No Event buffer, but invalid event buffer size "
         ":%u",
@@ -639,7 +635,7 @@
   /* Request HCI to post event data on a particular pipe */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_SEND_EVENT_EVT*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_SEND_EVENT_EVT))) != NULL)) {
+            sizeof(tNFA_HCI_API_SEND_EVENT_EVT))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_SEND_EVENT_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->pipe = pipe;
@@ -693,7 +689,7 @@
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       (!nfa_hci_cb.b_low_power_mode) &&
       ((p_msg = (tNFA_HCI_API_CLOSE_PIPE_EVT*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_CLOSE_PIPE_EVT))) != NULL)) {
+            sizeof(tNFA_HCI_API_CLOSE_PIPE_EVT))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_CLOSE_PIPE_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->pipe = pipe;
@@ -744,7 +740,7 @@
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       (!nfa_hci_cb.b_low_power_mode) &&
       ((p_msg = (tNFA_HCI_API_DELETE_PIPE_EVT*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_DELETE_PIPE_EVT))) != NULL)) {
+            sizeof(tNFA_HCI_API_DELETE_PIPE_EVT))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_DELETE_PIPE_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->pipe = pipe;
@@ -771,7 +767,6 @@
 tNFA_STATUS NFA_HciAddStaticPipe(tNFA_HANDLE hci_handle, uint8_t host,
                                  uint8_t gate, uint8_t pipe) {
   tNFA_HCI_API_ADD_STATIC_PIPE_EVT* p_msg;
-  uint8_t xx;
 
   if ((NFA_HANDLE_GROUP_MASK & hci_handle) != NFA_HANDLE_GROUP_HCI) {
     DLOG_IF(INFO, nfc_debug_enabled)
@@ -779,12 +774,9 @@
     return (NFA_STATUS_FAILED);
   }
 
-  for (xx = 0; xx < NFA_HCI_MAX_HOST_IN_NETWORK; xx++)
-    if (nfa_hci_cb.inactive_host[xx] == host) break;
-
-  if (xx != NFA_HCI_MAX_HOST_IN_NETWORK) {
+  if (!nfa_hciu_is_active_host(host)) {
     DLOG_IF(INFO, nfc_debug_enabled)
-        << StringPrintf("Host not active:0x%02x", host);
+        << StringPrintf("Host not active: 0x%02x", host);
     return (NFA_STATUS_FAILED);
   }
 
@@ -807,7 +799,7 @@
    * handle */
   if ((nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED) &&
       ((p_msg = (tNFA_HCI_API_ADD_STATIC_PIPE_EVT*)GKI_getbuf(
-            sizeof(tNFA_HCI_API_ADD_STATIC_PIPE_EVT))) != NULL)) {
+            sizeof(tNFA_HCI_API_ADD_STATIC_PIPE_EVT))) != nullptr)) {
     p_msg->hdr.event = NFA_HCI_API_ADD_STATIC_PIPE_EVT;
     p_msg->hci_handle = hci_handle;
     p_msg->host = host;
@@ -874,7 +866,7 @@
 
     case NFA_HCI_DEBUG_SIM_HCI_EVENT:
       p_msg = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-      if (p_msg != NULL) {
+      if (p_msg != nullptr) {
         p = (uint8_t*)(p_msg + 1);
 
         p_msg->event = NFA_HCI_CHECK_QUEUE_EVT;
diff --git a/src/nfa/hci/nfa_hci_ci.cc b/src/nfa/hci/nfa_hci_ci.cc
index 2f29745..5e5e433 100644
--- a/src/nfa/hci/nfa_hci_ci.cc
+++ b/src/nfa/hci/nfa_hci_ci.cc
@@ -40,7 +40,7 @@
   tNFA_HCI_EVENT_DATA* p_msg;
 
   p_msg = (tNFA_HCI_EVENT_DATA*)GKI_getbuf(sizeof(tNFA_HCI_EVENT_DATA));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->nv_read.hdr.event = NFA_HCI_RSP_NV_READ_EVT;
 
     if ((status == NFA_STATUS_OK) && (num_bytes_read != 0))
@@ -67,7 +67,7 @@
   tNFA_HCI_EVENT_DATA* p_msg;
 
   p_msg = (tNFA_HCI_EVENT_DATA*)GKI_getbuf(sizeof(tNFA_HCI_EVENT_DATA));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->nv_write.hdr.event = NFA_HCI_RSP_NV_WRITE_EVT;
     p_msg->nv_write.status =
         (status == NFA_NV_CO_OK) ? NFA_STATUS_OK : NFA_STATUS_FAILED;
diff --git a/src/nfa/hci/nfa_hci_main.cc b/src/nfa/hci/nfa_hci_main.cc
index 91aa89d..d6667e1 100644
--- a/src/nfa/hci/nfa_hci_main.cc
+++ b/src/nfa/hci/nfa_hci_main.cc
@@ -33,7 +33,6 @@
 #include "nfa_hci_defs.h"
 #include "nfa_hci_int.h"
 #include "nfa_nv_co.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -173,7 +172,7 @@
       break;
     case NFA_EE_RECOVERY_INIT:
       /*NFCEE recovery in progress*/
-      nfa_ee_cb.isDiscoveryStopped = nfa_dm_act_stop_rf_discovery(NULL);
+      nfa_ee_cb.isDiscoveryStopped = nfa_dm_act_stop_rf_discovery(nullptr);
       nfa_hci_cb.hci_state = NFA_HCI_STATE_EE_RECOVERY;
       break;
   }
@@ -563,7 +562,7 @@
     } else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_EE_RECOVERY) {
       nfa_hci_cb.hci_state = NFA_HCI_STATE_IDLE;
       if (nfa_ee_cb.isDiscoveryStopped == true) {
-        nfa_dm_act_start_rf_discovery(NULL);
+        nfa_dm_act_start_rf_discovery(nullptr);
         nfa_ee_cb.isDiscoveryStopped = false;
       }
     }
@@ -673,8 +672,8 @@
       if (NFC_GetNCIVersion() == NCI_VERSION_1_0) {
         nfa_hciu_send_to_all_apps(NFA_HCI_EXIT_EVT, &evt_data);
         NFC_ConnClose(nfa_hci_cb.conn_id);
+        return;
       }
-      return;
     }
     nfa_hci_cb.conn_id = 0;
   }
@@ -727,7 +726,7 @@
     nfa_sys_deregister(NFA_ID_HCI);
   }
 
-  if ((event != NFC_DATA_CEVT) || (p_pkt == NULL)) return;
+  if ((event != NFC_DATA_CEVT) || (p_pkt == nullptr)) return;
 
   if ((nfa_hci_cb.hci_state == NFA_HCI_STATE_WAIT_NETWK_ENABLE) ||
       (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE_NETWK_ENABLE)) {
@@ -742,8 +741,6 @@
   p = (uint8_t*)(p_pkt + 1) + p_pkt->offset;
   pkt_len = p_pkt->len;
 
-  DispHcp(p, pkt_len, true);
-
   chaining_bit = ((*p) >> 0x07) & 0x01;
   pipe = (*p++) & 0x7F;
   if (pkt_len != 0) pkt_len--;
@@ -933,7 +930,7 @@
         nfa_hciu_send_clear_all_pipe_cmd();
       } else {
         nfa_hciu_remove_all_pipes_from_host(0);
-        nfa_hci_api_dealloc_gate(NULL);
+        nfa_hci_api_dealloc_gate(nullptr);
       }
       break;
 
@@ -943,7 +940,7 @@
         nfa_hciu_send_clear_all_pipe_cmd();
       } else {
         nfa_hciu_remove_all_pipes_from_host(0);
-        nfa_hci_api_deregister(NULL);
+        nfa_hci_api_deregister(nullptr);
       }
       break;
 
@@ -956,9 +953,9 @@
         evt_data.rcvd_evt.pipe = nfa_hci_cb.pipe_in_use;
         evt_data.rcvd_evt.evt_code = 0;
         evt_data.rcvd_evt.evt_len = 0;
-        evt_data.rcvd_evt.p_evt_buf = NULL;
+        evt_data.rcvd_evt.p_evt_buf = nullptr;
         nfa_hci_cb.rsp_buf_size = 0;
-        nfa_hci_cb.p_rsp_buf = NULL;
+        nfa_hci_cb.p_rsp_buf = nullptr;
 
         break;
       }
@@ -1073,7 +1070,7 @@
 static void nfa_hci_set_receive_buf(uint8_t pipe) {
   if ((pipe >= NFA_HCI_FIRST_DYNAMIC_PIPE) &&
       (nfa_hci_cb.type == NFA_HCI_EVENT_TYPE)) {
-    if ((nfa_hci_cb.rsp_buf_size) && (nfa_hci_cb.p_rsp_buf != NULL)) {
+    if ((nfa_hci_cb.rsp_buf_size) && (nfa_hci_cb.p_rsp_buf != nullptr)) {
       nfa_hci_cb.p_msg_data = nfa_hci_cb.p_rsp_buf;
       nfa_hci_cb.max_msg_len = nfa_hci_cb.rsp_buf_size;
       return;
diff --git a/src/nfa/hci/nfa_hci_utils.cc b/src/nfa/hci/nfa_hci_utils.cc
index d6d3720..d64fe6c 100644
--- a/src/nfa/hci/nfa_hci_utils.cc
+++ b/src/nfa/hci/nfa_hci_utils.cc
@@ -30,7 +30,6 @@
 #include "nfa_hci_api.h"
 #include "nfa_hci_defs.h"
 #include "nfa_hci_int.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -59,7 +58,7 @@
   }
 
   /* If here, not found */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -79,7 +78,7 @@
     if (pg->gate_id == gate_id) return (pg);
   }
 
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -99,7 +98,7 @@
     if (pg->gate_owner == app_handle) return (pg);
   }
 
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -121,7 +120,7 @@
     if ((pg->gate_owner == app_handle) && (pg->pipe_inx_mask == 0)) return (pg);
   }
 
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -187,7 +186,7 @@
   tNFA_HCI_DYN_GATE* pg;
 
   pg = nfa_hciu_find_gate_by_gid(gate_id);
-  if (pg == NULL) return (NFA_HANDLE_INVALID);
+  if (pg == nullptr) return (NFA_HANDLE_INVALID);
 
   return (pg->gate_owner);
 }
@@ -206,10 +205,10 @@
   tNFA_HCI_DYN_GATE* pg;
 
   pp = nfa_hciu_find_pipe_by_pid(pipe_id);
-  if (pp == NULL) return (NFA_HANDLE_INVALID);
+  if (pp == nullptr) return (NFA_HANDLE_INVALID);
 
   pg = nfa_hciu_find_gate_by_gid(pp->local_gate);
-  if (pg == NULL) return (NFA_HANDLE_INVALID);
+  if (pg == nullptr) return (NFA_HANDLE_INVALID);
 
   return (pg->gate_owner);
 }
@@ -234,29 +233,33 @@
       (gate_id < NFA_HCI_FIRST_PROP_GATE) &&
       (((app_handle & NFA_HANDLE_GROUP_MASK) != NFA_HANDLE_GROUP_HCI) ||
        (app_inx >= NFA_HCI_MAX_APP_CB) ||
-       (nfa_hci_cb.p_app_cback[app_inx] == NULL))) {
-    return (NULL);
+       (nfa_hci_cb.p_app_cback[app_inx] == nullptr))) {
+    return (nullptr);
   }
 
   if (gate_id != 0) {
     pg = nfa_hciu_find_gate_by_gid(gate_id);
-    if (pg != NULL) return (pg);
+    if (pg != nullptr) return (pg);
   } else {
     /* If gate_id is 0, we need to assign a free one */
     /* Loop through all possible gate IDs checking if they are already used */
-    for (gate_id = NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE;
-         gate_id <= NFA_HCI_LAST_PROP_GATE; gate_id++) {
+    uint32_t gate_id_index;
+    for (gate_id_index = NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE;
+         gate_id_index <= NFA_HCI_LAST_PROP_GATE; gate_id_index++) {
       /* Skip connectivity gate */
-      if (gate_id == NFA_HCI_CONNECTIVITY_GATE) gate_id++;
+      if (gate_id_index == NFA_HCI_CONNECTIVITY_GATE) continue;
 
       /* Check if the gate is already allocated */
-      if (nfa_hciu_find_gate_by_gid(gate_id) == NULL) break;
+      if (nfa_hciu_find_gate_by_gid(gate_id_index) == nullptr) {
+        gate_id = gate_id_index & 0xFF;
+        break;
+      }
     }
-    if (gate_id > NFA_HCI_LAST_PROP_GATE) {
+    if (gate_id_index > NFA_HCI_LAST_PROP_GATE) {
       LOG(ERROR) << StringPrintf(
           "nfa_hci_alloc_gate - no free Gate ID: %u  App Handle: 0x%04x",
-          gate_id, app_handle);
-      return (NULL);
+          gate_id_index, app_handle);
+      return (nullptr);
     }
   }
 
@@ -281,7 +284,7 @@
   LOG(ERROR) << StringPrintf(
       "nfa_hci_alloc_gate - no CB  Gate ID: %u  App Handle: 0x%04x", gate_id,
       app_handle);
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -315,7 +318,7 @@
 
   while ((first_pkt == true) || (msg_len != 0)) {
     p_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-    if (p_buf != NULL) {
+    if (p_buf != nullptr) {
       p_buf->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
 
       /* First packet has a 2-byte header, subsequent fragments have a 1-byte
@@ -350,8 +353,6 @@
         if (msg_len > 0) p_msg += data_len;
       }
 
-      DispHcp(((uint8_t*)(p_buf + 1) + p_buf->offset), p_buf->len, false);
-
       if (HCI_LOOPBACK_DEBUG == NFA_HCI_DEBUG_ON)
         handle_debug_loopback(p_buf, type, instruction);
       else
@@ -420,7 +421,7 @@
 
   /* If we already have a pipe of the same ID, release it first it */
   pp = nfa_hciu_find_pipe_by_pid(pipe_id);
-  if (pp != NULL) {
+  if (pp != nullptr) {
     if (pipe_id > NFA_HCI_LAST_DYNAMIC_PIPE) return pp;
     nfa_hciu_release_pipe(pipe_id);
   }
@@ -440,7 +441,7 @@
 
   DLOG_IF(INFO, nfc_debug_enabled)
       << StringPrintf("nfa_hciu_alloc_pipe:%d, NO free entries !!", pipe_id);
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -455,7 +456,7 @@
 void nfa_hciu_release_gate(uint8_t gate_id) {
   tNFA_HCI_DYN_GATE* p_gate = nfa_hciu_find_gate_by_gid(gate_id);
 
-  if (p_gate != NULL) {
+  if (p_gate != nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("ID: %d  owner: 0x%04x  pipe_inx_mask: 0x%04x", gate_id,
                         p_gate->gate_owner, p_gate->pipe_inx_mask);
@@ -489,10 +490,10 @@
 
   p_gate = nfa_hciu_find_gate_by_gid(local_gate);
 
-  if (p_gate != NULL) {
+  if (p_gate != nullptr) {
     /* Allocate a pipe control block */
     p_pipe = nfa_hciu_alloc_pipe(pipe_id);
-    if (p_pipe != NULL) {
+    if (p_pipe != nullptr) {
       p_pipe->pipe_id = pipe_id;
       p_pipe->pipe_state = NFA_HCI_PIPE_CLOSED;
       p_pipe->dest_host = dest_host;
@@ -541,7 +542,7 @@
 
   /* Allocate a pipe control block */
   p_pipe = nfa_hciu_alloc_pipe(pipe_id);
-  if (p_pipe != NULL) {
+  if (p_pipe != nullptr) {
     p_pipe->pipe_id = pipe_id;
     p_pipe->pipe_state = NFA_HCI_PIPE_CLOSED;
     p_pipe->dest_host = dest_host;
@@ -583,14 +584,14 @@
     if ((pp->pipe_id != 0) && (pp->pipe_id >= NFA_HCI_FIRST_DYNAMIC_PIPE) &&
         (pp->pipe_id <= NFA_HCI_LAST_DYNAMIC_PIPE) &&
         (nfa_hciu_is_active_host(pp->dest_host))) {
-      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != NULL) &&
+      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != nullptr) &&
           (pg->gate_owner == app_handle))
         return (pp);
     }
   }
 
   /* If here, not found */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -650,14 +651,14 @@
   for (xx = 0, pp = nfa_hci_cb.cfg.dyn_pipes; xx < NFA_HCI_MAX_PIPE_CB;
        xx++, pp++) {
     if (pp->pipe_id != 0) {
-      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != NULL) &&
+      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != nullptr) &&
           (pg->gate_owner == app_handle))
         return (pp);
     }
   }
 
   /* If here, not found */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -680,14 +681,14 @@
   for (xx = 0, pp = nfa_hci_cb.cfg.dyn_pipes; xx < NFA_HCI_MAX_PIPE_CB;
        xx++, pp++) {
     if (pp->pipe_id != 0) {
-      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != NULL) &&
+      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != nullptr) &&
           (pg->gate_id == gate_id))
         return (pp);
     }
   }
 
   /* If here, not found */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -703,11 +704,14 @@
 bool nfa_hciu_is_active_host(uint8_t host_id) {
   uint8_t xx;
 
-  for (xx = 0; xx < NFA_HCI_MAX_HOST_IN_NETWORK; xx++) {
-    if (nfa_hci_cb.inactive_host[xx] == host_id) return false;
+  if ((host_id == NFA_HCI_HOST_ID_UICC0) ||
+      (host_id >= NFA_HCI_HOST_ID_FIRST_DYNAMICALLY_ALLOCATED)) {
+    for (xx = 0; xx < NFA_HCI_MAX_HOST_IN_NETWORK; xx++) {
+      if (nfa_hci_cb.active_host[xx] == host_id) return true;
+    }
   }
 
-  return true;
+  return false;
 }
 
 /*******************************************************************************
@@ -723,8 +727,11 @@
 bool nfa_hciu_is_host_reseting(uint8_t host_id) {
   uint8_t xx;
 
-  for (xx = 0; xx < NFA_HCI_MAX_HOST_IN_NETWORK; xx++) {
-    if (nfa_hci_cb.reset_host[xx] == host_id) return true;
+  if ((host_id == NFA_HCI_HOST_ID_UICC0) ||
+      (host_id >= NFA_HCI_HOST_ID_FIRST_DYNAMICALLY_ALLOCATED)) {
+    for (xx = 0; xx < NFA_HCI_MAX_HOST_IN_NETWORK; xx++) {
+      if (nfa_hci_cb.reset_host[xx] == host_id) return true;
+    }
   }
 
   return false;
@@ -772,14 +779,14 @@
     if ((pp->pipe_id != 0) && (pp->pipe_id >= NFA_HCI_FIRST_DYNAMIC_PIPE) &&
         (pp->pipe_id <= NFA_HCI_LAST_DYNAMIC_PIPE) &&
         (nfa_hciu_is_active_host(pp->dest_host))) {
-      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != NULL) &&
+      if (((pg = nfa_hciu_find_gate_by_gid(pp->local_gate)) != nullptr) &&
           (pg->gate_id == gate_id))
         return (pp);
     }
   }
 
   /* If here, not found */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -801,7 +808,7 @@
       << StringPrintf("nfa_hciu_release_pipe: %u", pipe_id);
 
   p_pipe = nfa_hciu_find_pipe_by_pid(pipe_id);
-  if (p_pipe == NULL) return (NFA_HCI_ANY_E_NOK);
+  if (p_pipe == nullptr) return (NFA_HCI_ANY_E_NOK);
 
   if (pipe_id > NFA_HCI_LAST_DYNAMIC_PIPE) {
     DLOG_IF(INFO, nfc_debug_enabled)
@@ -816,7 +823,7 @@
     nfa_hci_cb.cfg.id_mgmt_gate.pipe_inx_mask &= ~(uint32_t)(1 << pipe_index);
   } else {
     p_gate = nfa_hciu_find_gate_by_gid(p_pipe->local_gate);
-    if (p_gate == NULL) {
+    if (p_gate == nullptr) {
       /* Mark the pipe control block as free */
       p_pipe->pipe_id = 0;
       return (NFA_HCI_ANY_E_NOK);
@@ -859,7 +866,7 @@
       continue;
 
     pg = nfa_hciu_find_gate_by_gid(pp->local_gate);
-    if (pg != NULL) {
+    if (pg != nullptr) {
       evt_data.deleted.status = NFA_STATUS_OK;
       evt_data.deleted.pipe = pp->pipe_id;
 
@@ -967,7 +974,7 @@
   nfa_hci_cb.pipe_in_use = pipe;
 
   status = nfa_hciu_send_msg(pipe, NFA_HCI_COMMAND_TYPE, NFA_HCI_ANY_OPEN_PIPE,
-                             0, NULL);
+                             0, nullptr);
 
   return status;
 }
@@ -987,7 +994,7 @@
   nfa_hci_cb.pipe_in_use = pipe;
 
   status = nfa_hciu_send_msg(pipe, NFA_HCI_COMMAND_TYPE, NFA_HCI_ANY_CLOSE_PIPE,
-                             0, NULL);
+                             0, nullptr);
 
   return status;
 }
@@ -1053,7 +1060,7 @@
   /* First, check if the application handle is valid */
   if (((app_handle & NFA_HANDLE_GROUP_MASK) == NFA_HANDLE_GROUP_HCI) &&
       (app_inx < NFA_HCI_MAX_APP_CB)) {
-    if (nfa_hci_cb.p_app_cback[app_inx] != NULL) {
+    if (nfa_hci_cb.p_app_cback[app_inx] != nullptr) {
       nfa_hci_cb.p_app_cback[app_inx](event, p_evt);
       return;
     }
@@ -1079,7 +1086,7 @@
   uint8_t app_inx;
 
   for (app_inx = 0; app_inx < NFA_HCI_MAX_APP_CB; app_inx++) {
-    if (nfa_hci_cb.p_app_cback[app_inx] != NULL)
+    if (nfa_hci_cb.p_app_cback[app_inx] != nullptr)
       nfa_hci_cb.p_app_cback[app_inx](event, p_evt);
   }
 }
@@ -1099,7 +1106,7 @@
   uint8_t app_inx;
 
   for (app_inx = 0; app_inx < NFA_HCI_MAX_APP_CB; app_inx++) {
-    if ((nfa_hci_cb.p_app_cback[app_inx] != NULL) &&
+    if ((nfa_hci_cb.p_app_cback[app_inx] != nullptr) &&
         (nfa_hci_cb.cfg.b_send_conn_evts[app_inx]))
 
       nfa_hci_cb.p_app_cback[app_inx](event, p_evt);
@@ -1342,7 +1349,7 @@
 std::string nfa_hciu_evt_2_str(uint8_t pipe_id, uint8_t evt) {
   tNFA_HCI_DYN_PIPE* p_pipe = nfa_hciu_find_pipe_by_pid(pipe_id);
   if (pipe_id != NFA_HCI_ADMIN_PIPE &&
-      pipe_id != NFA_HCI_LINK_MANAGEMENT_PIPE && p_pipe != NULL &&
+      pipe_id != NFA_HCI_LINK_MANAGEMENT_PIPE && p_pipe != nullptr &&
       p_pipe->local_gate == NFA_HCI_CONNECTIVITY_GATE) {
     switch (evt) {
       case NFA_HCI_EVT_CONNECTIVITY:
diff --git a/src/nfa/include/nfa_api.h b/src/nfa/include/nfa_api.h
old mode 100644
new mode 100755
index 1b0f18c..d139966
--- a/src/nfa/include/nfa_api.h
+++ b/src/nfa/include/nfa_api.h
@@ -206,6 +206,7 @@
   SCREEN_STATE_OFF_UNLOCKED,
   SCREEN_STATE_ON_LOCKED,
   SCREEN_STATE_OFF_LOCKED,
+  SCREEN_STATE_INVALID = 0xFF
 } epower_substate_t;
 
 #define NFA_SCREEN_STATE_MASK 0x0F
diff --git a/src/nfa/include/nfa_dm_int.h b/src/nfa/include/nfa_dm_int.h
old mode 100644
new mode 100755
index a7f61d8..ec75612
--- a/src/nfa/include/nfa_dm_int.h
+++ b/src/nfa/include/nfa_dm_int.h
@@ -293,6 +293,7 @@
 #define NFA_DM_DISC_MASK_PFA_NFC_DEP 0x00001000
 /* Legacy/proprietary/non-NFC Forum protocol (e.g Shanghai transit card) */
 #define NFA_DM_DISC_MASK_P_LEGACY 0x00002000
+#define NFA_DM_DISC_MASK_PA_MIFARE 0x00004000
 #define NFA_DM_DISC_MASK_POLL 0x0000FFFF
 
 #define NFA_DM_DISC_MASK_LA_T1T 0x00010000
@@ -545,6 +546,9 @@
 
   uint8_t power_state; /* current screen/power  state */
   uint32_t eDtaMode;   /* To enable the DTA type modes. */
+  uint8_t pending_power_state; /* pending screen state change received in
+                                  LISTEN_ACTIVE state which needs to be applied
+                                  after current transaction is completed*/
 } tNFA_DM_CB;
 
 /* Internal function prototypes */
diff --git a/src/nfa/include/nfa_ee_api.h b/src/nfa/include/nfa_ee_api.h
index 78d0fe7..8a60dcf 100644
--- a/src/nfa/include/nfa_ee_api.h
+++ b/src/nfa/include/nfa_ee_api.h
@@ -52,10 +52,16 @@
                                 Table   */
   NFA_EE_SET_TECH_CFG_EVT,   /* The status for setting the routing based on RF
                                 tech.  */
-  NFA_EE_SET_PROTO_CFG_EVT,  /* The status for setting the routing based on
-                                protocols */
-  NFA_EE_UPDATED_EVT,        /* The status for NFA_EeUpdateNow */
-  NFA_EE_CONNECT_EVT,        /* Result of NFA_EeConnect */
+  NFA_EE_CLEAR_TECH_CFG_EVT, /* The status for clearing the routing based on RF
+                              tech.  */
+
+  NFA_EE_SET_PROTO_CFG_EVT,   /* The status for setting the routing based on
+                                 protocols */
+  NFA_EE_CLEAR_PROTO_CFG_EVT, /* The status for clearing the routing based on
+                               protocols */
+
+  NFA_EE_UPDATED_EVT, /* The status for NFA_EeUpdateNow */
+  NFA_EE_CONNECT_EVT, /* Result of NFA_EeConnect */
   NFA_EE_DATA_EVT, /* Received data from NFCEE.                             */
   NFA_EE_DISCONNECT_EVT, /* NFCEE connection closed. */
   NFA_EE_NEW_EE_EVT, /* A new NFCEE is discovered                             */
@@ -190,7 +196,9 @@
   tNFA_STATUS add_sc;
   tNFA_STATUS remove_sc;
   tNFA_STATUS set_tech;
+  tNFA_STATUS clear_tech;
   tNFA_STATUS set_proto;
+  tNFA_STATUS clear_proto;
   uint16_t size;
   tNFA_EE_CONNECT connect;
   tNFA_EE_ACTION action;
@@ -313,6 +321,30 @@
 
 /*******************************************************************************
 **
+** Function         NFA_EeClearDefaultTechRouting
+**
+** Description      This function is called to remove the
+**                  default routing based on RF technology in the listen mode
+**                  routing table for the given ee_handle. The status of this
+**                  operation is reported as the NFA_EE_CLEAR_TECH_CFG_EVT.
+**
+** Note:            If RF discovery is started,
+**                  NFA_StopRfDiscovery()/NFA_RF_DISCOVERY_STOPPED_EVT should
+**                  happen before calling this function
+**
+** Note:            NFA_EeUpdateNow() should be called after last NFA-EE
+**                  function to change the listen mode routing is called.
+**
+** Returns          NFA_STATUS_OK if successfully initiated
+**                  NFA_STATUS_FAILED otherwise
+**                  NFA_STATUS_INVALID_PARAM If bad parameter
+**
+*******************************************************************************/
+extern tNFA_STATUS NFA_EeClearDefaultTechRouting(
+    tNFA_HANDLE ee_handle, tNFA_TECHNOLOGY_MASK clear_technology);
+
+/*******************************************************************************
+**
 ** Function         NFA_EeSetDefaultProtoRouting
 **
 ** Description      This function is called to add, change or remove the
@@ -342,6 +374,30 @@
 
 /*******************************************************************************
 **
+** Function         NFA_EeClearDefaultProtoRouting
+**
+** Description      This function is called remove the
+**                  default routing based on Protocol in the listen mode routing
+**                  table for the given ee_handle. The status of this
+**                  operation is reported as the NFA_EE_CLEAR_PROTO_CFG_EVT.
+**
+** Note:            If RF discovery is started,
+**                  NFA_StopRfDiscovery()/NFA_RF_DISCOVERY_STOPPED_EVT should
+**                  happen before calling this function
+**
+** Note:            NFA_EeUpdateNow() should be called after last NFA-EE
+**                  function to change the listen mode routing is called.
+**
+** Returns          NFA_STATUS_OK if successfully initiated
+**                  NFA_STATUS_FAILED otherwise
+**                  NFA_STATUS_INVALID_PARAM If bad parameter
+**
+*******************************************************************************/
+extern tNFA_STATUS NFA_EeClearDefaultProtoRouting(
+    tNFA_HANDLE ee_handle, tNFA_PROTOCOL_MASK clear_protocol);
+
+/*******************************************************************************
+**
 ** Function         NFA_EeAddAidRouting
 **
 ** Description      This function is called to add an AID entry in the
@@ -438,6 +494,17 @@
 
 /*******************************************************************************
 **
+** Function         NFA_GetAidTableSize
+**
+** Description      This function is called to get the AID routing table size.
+**
+** Returns          Maximum AID routing table size.
+**
+*******************************************************************************/
+extern uint16_t NFA_GetAidTableSize();
+
+/*******************************************************************************
+**
 ** Function         NFA_EeGetLmrtRemainingSize
 **
 ** Description      This function is called to get remaining size of the
diff --git a/src/nfa/include/nfa_ee_int.h b/src/nfa/include/nfa_ee_int.h
index 5c933ab..bf9a864 100644
--- a/src/nfa/include/nfa_ee_int.h
+++ b/src/nfa/include/nfa_ee_int.h
@@ -50,7 +50,9 @@
   NFA_EE_API_DEREGISTER_EVT,
   NFA_EE_API_MODE_SET_EVT,
   NFA_EE_API_SET_TECH_CFG_EVT,
+  NFA_EE_API_CLEAR_TECH_CFG_EVT,
   NFA_EE_API_SET_PROTO_CFG_EVT,
+  NFA_EE_API_CLEAR_PROTO_CFG_EVT,
   NFA_EE_API_ADD_AID_EVT,
   NFA_EE_API_REMOVE_AID_EVT,
   NFA_EE_API_ADD_SYSCODE_EVT,
@@ -105,6 +107,10 @@
 typedef uint8_t tNFA_EE_CONN_ST;
 
 #define NFA_EE_MAX_AID_CFG_LEN (510)
+// Technology A/B/F reserved: 5*3 = 15
+// Protocol ISODEP/NFCDEP/T3T reserved: 5*3 = 15
+// Extends (APDU pattern/SC)reserved: 30
+#define NFA_EE_MAX_PROTO_TECH_EXT_ROUTE_LEN 60
 
 #define NFA_EE_SYSTEM_CODE_LEN 02
 #define NFA_EE_SYSTEM_CODE_TLV_SIZE 06
@@ -179,12 +185,14 @@
    * the aid_len is the total length of all the TLVs associated with this AID
    * entry
    */
-  uint8_t aid_len[NFA_EE_MAX_AID_ENTRIES]; /* the actual lengths in aid_cfg */
-  uint8_t aid_pwr_cfg[NFA_EE_MAX_AID_ENTRIES]; /* power configuration of this
+  uint8_t* aid_len;     /* the actual lengths in aid_cfg */
+  uint8_t* aid_pwr_cfg; /* power configuration of this
                                                   AID entry */
-  uint8_t aid_rt_info[NFA_EE_MAX_AID_ENTRIES]; /* route/vs info for this AID
+  uint8_t* aid_rt_info; /* route/vs info for this AID
                                                   entry */
-  uint8_t aid_cfg[NFA_EE_MAX_AID_CFG_LEN]; /* routing entries based on AID */
+  uint8_t* aid_cfg;     /* routing entries based on AID */
+  uint8_t* aid_info;    /* Aid Info Prefix/Suffix/Exact */
+
   uint8_t aid_entries;   /* The number of AID entries in aid_cfg */
   uint8_t nfcee_id;      /* ID for this NFCEE */
   uint8_t ee_status;     /* The NFCEE status */
@@ -201,9 +209,9 @@
   tNFA_NFC_PROTOCOL lb_protocol;   /* Listen B protocol    */
   tNFA_NFC_PROTOCOL lf_protocol;   /* Listen F protocol    */
   tNFA_NFC_PROTOCOL lbp_protocol;  /* Listen B' protocol   */
-  uint8_t size_mask; /* the size for technology and protocol routing */
+  uint8_t size_mask_proto;         /* the size for protocol routing */
+  uint8_t size_mask_tech;          /* the size for technology routing */
   uint16_t size_aid; /* the size for aid routing */
-  uint8_t aid_info[NFA_EE_MAX_AID_ENTRIES]; /* Aid Info Prefix/Suffix/Exact */
   /*System Code Based Routing Variables*/
   uint8_t sys_code_cfg[NFA_EE_MAX_SYSTEM_CODE_ENTRIES * NFA_EE_SYSTEM_CODE_LEN];
   uint8_t sys_code_pwr_cfg[NFA_EE_MAX_SYSTEM_CODE_ENTRIES];
@@ -251,7 +259,7 @@
   tNFA_TECHNOLOGY_MASK technologies_screen_lock;
   tNFA_TECHNOLOGY_MASK technologies_screen_off;
   tNFA_TECHNOLOGY_MASK technologies_screen_off_lock;
-} tNFA_EE_API_SET_TECH_CFG;
+} tNFA_EE_API_SET_TECH_CFG, tNFA_EE_API_CLEAR_TECH_CFG;
 
 /* data type for NFA_EE_API_SET_PROTO_CFG_EVT */
 typedef struct {
@@ -264,7 +272,7 @@
   tNFA_PROTOCOL_MASK protocols_screen_lock;
   tNFA_PROTOCOL_MASK protocols_screen_off;
   tNFA_PROTOCOL_MASK protocols_screen_off_lock;
-} tNFA_EE_API_SET_PROTO_CFG;
+} tNFA_EE_API_SET_PROTO_CFG, tNFA_EE_API_CLEAR_PROTO_CFG;
 
 /* data type for NFA_EE_API_ADD_AID_EVT */
 typedef struct {
@@ -394,7 +402,9 @@
   tNFA_EE_API_DEREGISTER deregister;
   tNFA_EE_API_MODE_SET mode_set;
   tNFA_EE_API_SET_TECH_CFG set_tech;
+  tNFA_EE_API_CLEAR_TECH_CFG clear_tech;
   tNFA_EE_API_SET_PROTO_CFG set_proto;
+  tNFA_EE_API_CLEAR_PROTO_CFG clear_proto;
   tNFA_EE_API_ADD_AID add_aid;
   tNFA_EE_API_REMOVE_AID rm_aid;
   tNFA_EE_API_ADD_SYSCODE add_syscode;
@@ -523,7 +533,9 @@
 void nfa_ee_api_deregister(tNFA_EE_MSG* p_data);
 void nfa_ee_api_mode_set(tNFA_EE_MSG* p_data);
 void nfa_ee_api_set_tech_cfg(tNFA_EE_MSG* p_data);
+void nfa_ee_api_clear_tech_cfg(tNFA_EE_MSG* p_data);
 void nfa_ee_api_set_proto_cfg(tNFA_EE_MSG* p_data);
+void nfa_ee_api_clear_proto_cfg(tNFA_EE_MSG* p_data);
 void nfa_ee_api_add_aid(tNFA_EE_MSG* p_data);
 void nfa_ee_api_remove_aid(tNFA_EE_MSG* p_data);
 void nfa_ee_api_add_sys_code(tNFA_EE_MSG* p_data);
@@ -561,5 +573,5 @@
 void nfa_ee_check_disable(void);
 bool nfa_ee_restore_ntf_done(void);
 void nfa_ee_check_restore_complete(void);
-
+int nfa_ee_find_max_aid_cfg_len(void);
 #endif /* NFA_P2P_INT_H */
diff --git a/src/nfa/include/nfa_hci_int.h b/src/nfa/include/nfa_hci_int.h
index 9158a4e..5d13f95 100644
--- a/src/nfa/include/nfa_hci_int.h
+++ b/src/nfa/include/nfa_hci_int.h
@@ -38,6 +38,8 @@
 *****************************************************************************/
 
 #define NFA_HCI_HOST_ID_UICC0 0x02 /* Host ID for UICC 0 */
+/* First dynamically allocated host ID */
+#define NFA_HCI_HOST_ID_FIRST_DYNAMICALLY_ALLOCATED 0x80
 /* Lost host specific gate */
 #define NFA_HCI_LAST_HOST_SPECIFIC_GATE 0xEF
 
@@ -363,8 +365,10 @@
   uint8_t num_ee_dis_req_ntf; /* Number of ee discovery request ntf received */
   uint8_t num_hot_plug_evts;  /* Number of Hot plug events received after ee
                                  discovery disable ntf */
-  uint8_t inactive_host[NFA_HCI_MAX_HOST_IN_NETWORK]; /* Inactive host in the
-                                                         host network */
+  /* Inactive host in the host network */
+  uint8_t inactive_host[NFA_HCI_MAX_HOST_IN_NETWORK];
+  /* active host in the host network */
+  uint8_t active_host[NFA_HCI_MAX_HOST_IN_NETWORK];
   uint8_t reset_host[NFA_HCI_MAX_HOST_IN_NETWORK]; /* List of host reseting */
   bool b_low_power_mode;  /* Host controller in low power mode */
   bool b_hci_netwk_reset; /* Command sent to reset HCI Network */
diff --git a/src/nfa/p2p/nfa_p2p_act.cc b/src/nfa/p2p/nfa_p2p_act.cc
index 0d8c8e4..36726e7 100644
--- a/src/nfa/p2p/nfa_p2p_act.cc
+++ b/src/nfa/p2p/nfa_p2p_act.cc
@@ -594,7 +594,7 @@
         nfa_p2p_cb.sap_cb[local_sap].flags = NFA_P2P_SAP_FLAG_CLIENT;
       } else /* if this is not registered service */
       {
-        nfa_p2p_cb.sap_cb[local_sap].p_cback = NULL;
+        nfa_p2p_cb.sap_cb[local_sap].p_cback = nullptr;
       }
     }
   }
@@ -736,7 +736,7 @@
   }
 
   LLCP_Deregister(local_sap);
-  nfa_p2p_cb.sap_cb[local_sap].p_cback = NULL;
+  nfa_p2p_cb.sap_cb[local_sap].p_cback = nullptr;
 
   if (nfa_p2p_cb.is_p2p_listening) {
     /* check if this is the last server on NFA P2P */
diff --git a/src/nfa/p2p/nfa_p2p_api.cc b/src/nfa/p2p/nfa_p2p_api.cc
index 2c0dc0b..2e13dce 100644
--- a/src/nfa/p2p/nfa_p2p_api.cc
+++ b/src/nfa/p2p/nfa_p2p_api.cc
@@ -83,7 +83,7 @@
   }
 
   if ((p_msg = (tNFA_P2P_API_REG_SERVER*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_REG_SERVER))) != NULL) {
+           sizeof(tNFA_P2P_API_REG_SERVER))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_REG_SERVER_EVT;
 
     p_msg->server_sap = server_sap;
@@ -131,7 +131,7 @@
   }
 
   if ((p_msg = (tNFA_P2P_API_REG_CLIENT*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_REG_CLIENT))) != NULL) {
+           sizeof(tNFA_P2P_API_REG_CLIENT))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_REG_CLIENT_EVT;
 
     p_msg->p_cback = p_cback;
@@ -170,13 +170,13 @@
 
   xx = handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Handle is invalid or not registered");
     return (NFA_STATUS_BAD_HANDLE);
   }
 
   if ((p_msg = (tNFA_P2P_API_DEREG*)GKI_getbuf(sizeof(tNFA_P2P_API_DEREG))) !=
-      NULL) {
+      nullptr) {
     p_msg->hdr.event = NFA_P2P_API_DEREG_EVT;
 
     p_msg->handle = handle;
@@ -227,7 +227,7 @@
     LOG(ERROR) << StringPrintf("MIU(%d) must be between %d and %d", miu,
                                LLCP_DEFAULT_MIU, nfa_p2p_cb.local_link_miu);
   } else if ((p_msg = (tNFA_P2P_API_ACCEPT_CONN*)GKI_getbuf(
-                  sizeof(tNFA_P2P_API_ACCEPT_CONN))) != NULL) {
+                  sizeof(tNFA_P2P_API_ACCEPT_CONN))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_ACCEPT_CONN_EVT;
 
     p_msg->conn_handle = handle;
@@ -276,7 +276,7 @@
   }
 
   if ((p_msg = (tNFA_P2P_API_REJECT_CONN*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_REJECT_CONN))) != NULL) {
+           sizeof(tNFA_P2P_API_REJECT_CONN))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_REJECT_CONN_EVT;
 
     p_msg->conn_handle = handle;
@@ -329,7 +329,7 @@
   }
 
   if ((p_msg = (tNFA_P2P_API_DISCONNECT*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_DISCONNECT))) != NULL) {
+           sizeof(tNFA_P2P_API_DISCONNECT))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_DISCONNECT_EVT;
 
     p_msg->conn_handle = handle;
@@ -369,7 +369,7 @@
 
   xx = client_handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Client Handle is not valid");
     return (NFA_STATUS_BAD_HANDLE);
   }
@@ -382,7 +382,7 @@
         "link is not activated",
         miu, LLCP_DEFAULT_MIU, nfa_p2p_cb.local_link_miu);
   } else if ((p_msg = (tNFA_P2P_API_CONNECT*)GKI_getbuf(
-                  sizeof(tNFA_P2P_API_CONNECT))) != NULL) {
+                  sizeof(tNFA_P2P_API_CONNECT))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_CONNECT_EVT;
 
     strncpy(p_msg->service_name, p_service_name, LLCP_MAX_SN_LEN);
@@ -426,7 +426,7 @@
 
   xx = client_handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Client Handle is not valid");
     return (NFA_STATUS_BAD_HANDLE);
   }
@@ -439,7 +439,7 @@
         "link is not activated",
         miu, LLCP_DEFAULT_MIU, nfa_p2p_cb.local_link_miu);
   } else if ((p_msg = (tNFA_P2P_API_CONNECT*)GKI_getbuf(
-                  sizeof(tNFA_P2P_API_CONNECT))) != NULL) {
+                  sizeof(tNFA_P2P_API_CONNECT))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_CONNECT_EVT;
 
     p_msg->service_name[LLCP_MAX_SN_LEN] = 0;
@@ -485,7 +485,7 @@
 
   xx = handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Handle (0x%X) is not valid", handle);
     ret_status = NFA_STATUS_BAD_HANDLE;
   } else if (length > nfa_p2p_cb.remote_link_miu) {
@@ -508,14 +508,14 @@
                                  handle);
     ret_status = NFA_STATUS_CONGESTED;
   } else if ((p_msg = (tNFA_P2P_API_SEND_UI*)GKI_getbuf(
-                  sizeof(tNFA_P2P_API_SEND_UI))) != NULL) {
+                  sizeof(tNFA_P2P_API_SEND_UI))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_SEND_UI_EVT;
 
     p_msg->handle = handle;
     p_msg->dsap = dsap;
 
     p_msg->p_msg = (NFC_HDR*)GKI_getpoolbuf(LLCP_POOL_ID);
-    if (p_msg->p_msg != NULL) {
+    if (p_msg->p_msg != nullptr) {
       p_msg->p_msg->len = length;
       p_msg->p_msg->offset = LLCP_MIN_OFFSET;
       memcpy(((uint8_t*)(p_msg->p_msg + 1) + p_msg->p_msg->offset), p_data,
@@ -572,7 +572,7 @@
 
   xx = handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Handle (0x%X) is not valid", handle);
     ret_status = NFA_STATUS_BAD_HANDLE;
   } else {
@@ -607,7 +607,7 @@
 
   xx = handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Handle (0x%X) is not valid", handle);
     ret_status = NFA_STATUS_BAD_HANDLE;
     *p_length = 0;
@@ -678,13 +678,13 @@
         "handle:0x%X, data link connection is congested", handle);
     ret_status = NFA_STATUS_CONGESTED;
   } else if ((p_msg = (tNFA_P2P_API_SEND_DATA*)GKI_getbuf(
-                  sizeof(tNFA_P2P_API_SEND_DATA))) != NULL) {
+                  sizeof(tNFA_P2P_API_SEND_DATA))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_SEND_DATA_EVT;
 
     p_msg->conn_handle = handle;
 
     p_msg->p_msg = (NFC_HDR*)GKI_getpoolbuf(LLCP_POOL_ID);
-    if (p_msg->p_msg != NULL) {
+    if (p_msg->p_msg != nullptr) {
       p_msg->p_msg->len = length;
       p_msg->p_msg->offset = LLCP_MIN_OFFSET;
       memcpy(((uint8_t*)(p_msg->p_msg + 1) + p_msg->p_msg->offset), p_data,
@@ -827,7 +827,7 @@
   }
 
   if ((p_msg = (tNFA_P2P_API_SET_LOCAL_BUSY*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_SET_LOCAL_BUSY))) != NULL) {
+           sizeof(tNFA_P2P_API_SET_LOCAL_BUSY))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_SET_LOCAL_BUSY_EVT;
 
     p_msg->conn_handle = conn_handle;
@@ -867,13 +867,13 @@
 
   xx = handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Handle is invalid or not registered");
     return (NFA_STATUS_BAD_HANDLE);
   }
 
   if ((p_msg = (tNFA_P2P_API_GET_LINK_INFO*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_GET_LINK_INFO))) != NULL) {
+           sizeof(tNFA_P2P_API_GET_LINK_INFO))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_GET_LINK_INFO_EVT;
 
     p_msg->handle = handle;
@@ -913,13 +913,13 @@
 
   xx = handle & NFA_HANDLE_MASK;
 
-  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == NULL)) {
+  if ((xx >= NFA_P2P_NUM_SAP) || (nfa_p2p_cb.sap_cb[xx].p_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("Handle is invalid or not registered");
     return (NFA_STATUS_BAD_HANDLE);
   }
 
   if ((p_msg = (tNFA_P2P_API_GET_REMOTE_SAP*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_GET_REMOTE_SAP))) != NULL) {
+           sizeof(tNFA_P2P_API_GET_REMOTE_SAP))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_GET_REMOTE_SAP_EVT;
 
     p_msg->handle = handle;
@@ -987,7 +987,7 @@
   }
 
   if ((p_msg = (tNFA_P2P_API_SET_LLCP_CFG*)GKI_getbuf(
-           sizeof(tNFA_P2P_API_SET_LLCP_CFG))) != NULL) {
+           sizeof(tNFA_P2P_API_SET_LLCP_CFG))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_SET_LLCP_CFG_EVT;
 
     p_msg->link_miu = link_miu;
diff --git a/src/nfa/p2p/nfa_p2p_main.cc b/src/nfa/p2p/nfa_p2p_main.cc
index eb965e7..e39f59d 100644
--- a/src/nfa/p2p/nfa_p2p_main.cc
+++ b/src/nfa/p2p/nfa_p2p_main.cc
@@ -62,8 +62,8 @@
 /* timeout to restore active listen mode if no RF activation on passive mode */
 #define NFA_P2P_RESTORE_ACTIVE_LISTEN_TIMEOUT 5000
 
-static const tNFA_SYS_REG nfa_p2p_sys_reg = {NULL, nfa_p2p_evt_hdlr,
-                                             nfa_p2p_sys_disable, NULL};
+static const tNFA_SYS_REG nfa_p2p_sys_reg = {nullptr, nfa_p2p_evt_hdlr,
+                                             nfa_p2p_sys_disable, nullptr};
 
 #define NFA_P2P_NUM_ACTIONS (NFA_P2P_LAST_EVT & 0x00ff)
 
@@ -261,7 +261,7 @@
 
   /* restart RF discovery to update RF technologies */
   p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->event = NFA_P2P_INT_RESTART_RF_DISC_EVT;
     nfa_sys_sendmsg(p_msg);
   }
@@ -290,7 +290,7 @@
 
     if (nfa_p2p_cb.is_initiator) {
       /* notify NFA DM to send Activate Event to applicaiton with status  */
-      nfa_dm_notify_activation_status(NFA_STATUS_OK, NULL);
+      nfa_dm_notify_activation_status(NFA_STATUS_OK, nullptr);
     }
 
     llcp_activated.is_initiator = nfa_p2p_cb.is_initiator;
@@ -309,12 +309,12 @@
 
     if (nfa_p2p_cb.is_initiator) {
       /* notify NFA DM to send Activate Event to applicaiton with status  */
-      nfa_dm_notify_activation_status(NFA_STATUS_FAILED, NULL);
+      nfa_dm_notify_activation_status(NFA_STATUS_FAILED, nullptr);
     }
 
     nfa_dm_rf_deactivate(NFA_DEACTIVATE_TYPE_DISCOVERY);
   } else if (event == LLCP_LINK_FIRST_PACKET_RECEIVED_EVT) {
-    nfa_dm_act_conn_cback_notify(NFA_LLCP_FIRST_PACKET_RECEIVED_EVT, NULL);
+    nfa_dm_act_conn_cback_notify(NFA_LLCP_FIRST_PACKET_RECEIVED_EVT, nullptr);
   } else /* LLCP_LINK_DEACTIVATED_EVT       */
   {
     nfa_p2p_cb.llcp_state = NFA_P2P_LLCP_STATE_IDLE;
diff --git a/src/nfa/rw/nfa_rw_act.cc b/src/nfa/rw/nfa_rw_act.cc
index 7f9dcfa..0c0e608 100644
--- a/src/nfa/rw/nfa_rw_act.cc
+++ b/src/nfa/rw/nfa_rw_act.cc
@@ -47,11 +47,13 @@
 static tNFC_STATUS nfa_rw_start_ndef_detection(void);
 static tNFC_STATUS nfa_rw_config_tag_ro(bool b_hard_lock);
 static bool nfa_rw_op_req_while_busy(tNFA_RW_MSG* p_data);
+static bool nfa_rw_op_req_while_inactive(tNFA_RW_MSG* p_data);
 static void nfa_rw_error_cleanup(uint8_t event);
 static void nfa_rw_presence_check(tNFA_RW_MSG* p_data);
 static void nfa_rw_handle_t2t_evt(tRW_EVENT event, tRW_DATA* p_rw_data);
 static bool nfa_rw_detect_ndef(void);
 static void nfa_rw_cback(tRW_EVENT event, tRW_DATA* p_rw_data);
+static void nfa_rw_handle_mfc_evt(tRW_EVENT event, tRW_DATA* p_rw_data);
 
 /*******************************************************************************
 **
@@ -65,7 +67,7 @@
 void nfa_rw_free_ndef_rx_buf(void) {
   if (nfa_rw_cb.p_ndef_buf) {
     nfa_mem_co_free(nfa_rw_cb.p_ndef_buf);
-    nfa_rw_cb.p_ndef_buf = NULL;
+    nfa_rw_cb.p_ndef_buf = nullptr;
   }
 }
 
@@ -95,7 +97,7 @@
   }
 
   GKI_freebuf(p_rw_data->data.p_data);
-  p_rw_data->data.p_data = NULL;
+  p_rw_data->data.p_data = nullptr;
 }
 
 /*******************************************************************************
@@ -111,7 +113,7 @@
   tNFA_CONN_EVT_DATA conn_evt_data;
 
   if ((p_rw_data->status == NFC_STATUS_TIMEOUT) ||
-      (p_rw_data->data.p_data == NULL))
+      (p_rw_data->data.p_data == nullptr))
     return;
 
   DLOG_IF(INFO, nfc_debug_enabled)
@@ -128,7 +130,7 @@
   nfa_dm_act_conn_cback_notify(NFA_DATA_EVT, &conn_evt_data);
 
   GKI_freebuf(p_rw_data->data.p_data);
-  p_rw_data->data.p_data = NULL;
+  p_rw_data->data.p_data = nullptr;
 }
 
 /*******************************************************************************
@@ -171,7 +173,7 @@
                           presence_check_start_delay);
     } else {
       /* Presence check now */
-      nfa_rw_presence_check(NULL);
+      nfa_rw_presence_check(nullptr);
     }
   }
 }
@@ -270,7 +272,7 @@
     if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF) {
       /* if ndef detection was done as part of ndef-read operation, then notify
        * NDEF handlers of failure */
-      nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
+      nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, nullptr, 0);
 
       /* Notify app of read status */
       nfa_dm_act_conn_cback_notify(NFA_READ_CPLT_EVT, &conn_evt_data);
@@ -410,7 +412,7 @@
         if (nfa_rw_cb.halt_event == RW_T2T_READ_CPLT_EVT) {
           if (nfa_rw_cb.rw_data.data.p_data)
             GKI_freebuf(nfa_rw_cb.rw_data.data.p_data);
-          nfa_rw_cb.rw_data.data.p_data = NULL;
+          nfa_rw_cb.rw_data.data.p_data = nullptr;
         }
         /* Do not try to detect NDEF again but just notify current operation
          * failed */
@@ -488,7 +490,7 @@
         nfa_dm_act_conn_cback_notify(NFA_PRESENCE_CHECK_EVT,
                                      &nfa_conn_evt_data);
         GKI_freebuf(nfa_rw_cb.p_pending_msg);
-        nfa_rw_cb.p_pending_msg = NULL;
+        nfa_rw_cb.p_pending_msg = nullptr;
       }
       /* For all other APIs called during auto-presence check, perform the
          command now (if tag is still present) */
@@ -496,13 +498,13 @@
         DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
             "Performing deferred operation after presence check...");
         p_pending_msg = (NFC_HDR*)nfa_rw_cb.p_pending_msg;
-        nfa_rw_cb.p_pending_msg = NULL;
+        nfa_rw_cb.p_pending_msg = nullptr;
         nfa_rw_handle_event(p_pending_msg);
         GKI_freebuf(p_pending_msg);
       } else {
         /* Tag no longer present. Free command for pending API command */
         GKI_freebuf(nfa_rw_cb.p_pending_msg);
-        nfa_rw_cb.p_pending_msg = NULL;
+        nfa_rw_cb.p_pending_msg = nullptr;
       }
     }
 
@@ -549,7 +551,7 @@
   conn_evt_data.status = p_rw_data->data.status;
   switch (event) {
     case RW_T1T_RID_EVT:
-      if (p_rw_data->data.p_data != NULL) {
+      if (p_rw_data->data.p_data != nullptr) {
         /* Assume the data is just the response byte sequence */
         p_rid_rsp = (uint8_t*)(p_rw_data->data.p_data + 1) +
                     p_rw_data->data.p_data->offset;
@@ -558,7 +560,7 @@
         /* Fetch UID0-3 from RID response message */
         STREAM_TO_ARRAY(tag_params.t1t.uid, p_rid_rsp, T1T_CMD_UID_LEN);
         GKI_freebuf(p_rw_data->data.p_data);
-        p_rw_data->data.p_data = NULL;
+        p_rw_data->data.p_data = nullptr;
       }
 
       /* Command complete - perform cleanup, notify the app */
@@ -627,7 +629,7 @@
         if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF) {
           /* If current operation is READ_NDEF, then notify ndef handlers of
            * failure */
-          nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
+          nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, nullptr, 0);
         }
       }
 
@@ -788,7 +790,7 @@
         if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF) {
           /* If current operation is READ_NDEF, then notify ndef handlers of
            * failure */
-          nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
+          nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, nullptr, 0);
         }
       }
 
@@ -900,7 +902,7 @@
         if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF) {
           /* If current operation is READ_NDEF, then notify ndef handlers of
            * failure */
-          nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
+          nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, nullptr, 0);
         }
       }
 
@@ -944,7 +946,7 @@
         tag_params.t3t.p_system_codes = p_rw_data->t3t_sc.p_system_codes;
       } else {
         tag_params.t3t.num_system_codes = 0;
-        tag_params.t3t.p_system_codes = NULL;
+        tag_params.t3t.p_system_codes = nullptr;
       }
 
       nfa_dm_notify_activation_status(NFA_STATUS_OK, &tag_params);
@@ -1046,7 +1048,7 @@
       if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF) {
         /* If current operation is READ_NDEF, then notify ndef handlers of
          * failure */
-        nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
+        nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, nullptr, 0);
 
         /* Free ndef buffer */
         nfa_rw_free_ndef_rx_buf();
@@ -1167,7 +1169,7 @@
       if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF) {
         /* If current operation is READ_NDEF, then notify ndef handlers of
          * failure */
-        nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
+        nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, nullptr, 0);
 
         /* Free ndef buffer */
         nfa_rw_free_ndef_rx_buf();
@@ -1300,7 +1302,7 @@
       }
 
       GKI_freebuf(p_rw_data->i93_data.p_data);
-      p_rw_data->i93_data.p_data = NULL;
+      p_rw_data->i93_data.p_data = nullptr;
 
       nfa_rw_cb.cur_op = NFA_RW_OP_MAX; /* clear current operation */
       break;
@@ -1392,6 +1394,97 @@
 
 /*******************************************************************************
 **
+** Function         nfa_rw_handle_mfc_evt
+**
+** Description      Handler for Mifare Classic tag reader/writer events
+**
+** Returns          Nothing
+**
+*******************************************************************************/
+static void nfa_rw_handle_mfc_evt(tRW_EVENT event, tRW_DATA* p_rw_data) {
+  tNFA_CONN_EVT_DATA conn_evt_data;
+
+  conn_evt_data.status = p_rw_data->status;
+  DLOG_IF(INFO, nfc_debug_enabled)
+      << StringPrintf("nfa_rw_handle_mfc_evt() event = 0x%X", event);
+
+  switch (event) {
+    /* Read completed */
+    case RW_MFC_NDEF_READ_CPLT_EVT:
+      nfa_rw_send_data_to_upper(p_rw_data);
+      /* Command complete - perform cleanup, notify the app */
+      nfa_rw_command_complete();
+      nfa_dm_act_conn_cback_notify(NFA_READ_CPLT_EVT, &conn_evt_data);
+      break;
+
+    /* NDEF detection complete */
+    case RW_MFC_NDEF_DETECT_EVT:
+      nfa_rw_handle_ndef_detect(p_rw_data);
+      break;
+
+    /* NDEF read completed */
+    case RW_MFC_NDEF_READ_EVT:
+      if (p_rw_data->status == NFC_STATUS_OK) {
+        /* Process the ndef record */
+        nfa_dm_ndef_handle_message(NFA_STATUS_OK, nfa_rw_cb.p_ndef_buf,
+                                   nfa_rw_cb.ndef_cur_size);
+      } else {
+        /* Notify app of failure */
+        if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF) {
+          /* If current operation is READ_NDEF, then notify ndef handlers of
+           * failure */
+          nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
+        }
+      }
+
+      /* Notify app of read status */
+      conn_evt_data.status = p_rw_data->status;
+      nfa_dm_act_conn_cback_notify(NFA_READ_CPLT_EVT, &conn_evt_data);
+      /* Free ndef buffer */
+      nfa_rw_free_ndef_rx_buf();
+
+      /* Command complete - perform cleanup */
+      nfa_rw_command_complete();
+      break;
+
+    /* Raw Frame data event */
+    case RW_MFC_RAW_FRAME_EVT:
+      nfa_rw_send_data_to_upper(p_rw_data);
+
+      if (p_rw_data->status != NFC_STATUS_CONTINUE) {
+        /* Command complete - perform cleanup */
+        nfa_rw_command_complete();
+        nfa_rw_cb.cur_op = NFA_RW_OP_MAX;
+      }
+      break;
+
+    /* RF Interface error event */
+    case RW_MFC_INTF_ERROR_EVT:
+      nfa_dm_act_conn_cback_notify(NFA_RW_INTF_ERROR_EVT, &conn_evt_data);
+      break;
+
+    case RW_MFC_NDEF_FORMAT_CPLT_EVT:
+      /* Command complete - perform cleanup, notify the app */
+      nfa_rw_command_complete();
+      nfa_dm_act_conn_cback_notify(NFA_FORMAT_CPLT_EVT, &conn_evt_data);
+      break;
+
+    /* NDEF write completed or failed*/
+    case RW_MFC_NDEF_WRITE_CPLT_EVT:
+    case RW_MFC_NDEF_WRITE_FAIL_EVT:
+      /* Command complete - perform cleanup, notify the app */
+      nfa_rw_command_complete();
+      nfa_dm_act_conn_cback_notify(NFA_WRITE_CPLT_EVT, &conn_evt_data);
+      break;
+
+    default:
+      DLOG_IF(INFO, nfc_debug_enabled)
+          << StringPrintf("; Unhandled RW event 0x%X", event);
+  }
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_rw_cback
 **
 ** Description      Callback for reader/writer event notification
@@ -1419,6 +1512,9 @@
   } else if (event < RW_I93_MAX_EVT) {
     /* Handle ISO 15693 tag events */
     nfa_rw_handle_i93_evt(event, p_rw_data);
+  } else if (event < RW_MFC_MAX_EVT) {
+    /* Handle Mifare Classic tag events */
+    nfa_rw_handle_mfc_evt(event, p_rw_data);
   } else {
     LOG(ERROR) << StringPrintf("nfa_rw_cback: unhandled event=0x%02x", event);
   }
@@ -1454,6 +1550,8 @@
   } else if (NFC_PROTOCOL_T5T == protocol) {
     /* ISO 15693 */
     status = RW_I93DetectNDef();
+  } else if (NFC_PROTOCOL_MIFARE == protocol) {
+    status = RW_MfcDetectNDef();
   }
 
   return (status);
@@ -1479,7 +1577,7 @@
         << StringPrintf("NDEF message is zero-length");
 
     /* Send zero-lengh NDEF message to ndef callback */
-    nfa_dm_ndef_handle_message(NFA_STATUS_OK, NULL, 0);
+    nfa_dm_ndef_handle_message(NFA_STATUS_OK, nullptr, 0);
 
     /* Command complete - perform cleanup, notify app */
     nfa_rw_command_complete();
@@ -1492,7 +1590,7 @@
    * needed) */
   nfa_rw_free_ndef_rx_buf();
   nfa_rw_cb.p_ndef_buf = (uint8_t*)nfa_mem_co_alloc(nfa_rw_cb.ndef_cur_size);
-  if (nfa_rw_cb.p_ndef_buf == NULL) {
+  if (nfa_rw_cb.p_ndef_buf == nullptr) {
     LOG(ERROR) << StringPrintf(
         "Unable to allocate a buffer for reading NDEF (size=%i)",
         nfa_rw_cb.ndef_cur_size);
@@ -1524,6 +1622,10 @@
   } else if (NFC_PROTOCOL_T5T == protocol) {
     /* ISO 15693 */
     status = RW_I93ReadNDef();
+  } else if (NFC_PROTOCOL_MIFARE == protocol) {
+    /* Mifare Classic*/
+    status =
+        RW_MfcReadNDef(nfa_rw_cb.p_ndef_buf, (uint16_t)nfa_rw_cb.ndef_cur_size);
   }
 
   return (status);
@@ -1600,6 +1702,10 @@
       /* ISO 15693 */
       status = RW_I93UpdateNDef((uint16_t)nfa_rw_cb.ndef_wr_len,
                                 nfa_rw_cb.p_ndef_wr_buf);
+    } else if (NFC_PROTOCOL_MIFARE == protocol) {
+      /* Mifare Tag */
+      status = RW_MfcWriteNDef((uint16_t)nfa_rw_cb.ndef_wr_len,
+                               nfa_rw_cb.p_ndef_wr_buf);
     }
   }
 
@@ -1813,7 +1919,7 @@
       << StringPrintf("Auto-presence check starting...");
 
   /* Perform presence check */
-  nfa_rw_presence_check(NULL);
+  nfa_rw_presence_check(nullptr);
 
   return true;
 }
@@ -1857,6 +1963,8 @@
     status = RW_I93FormatNDef();
   } else if (protocol == NFC_PROTOCOL_ISO_DEP) {
     status = RW_T4tFormatNDef();
+  } else if (protocol == NFC_PROTOCOL_MIFARE) {
+    status = RW_MfcFormatNDef();
   }
 
   /* If unable to format NDEF, notify the app */
@@ -2221,7 +2329,7 @@
     /* Command complete - perform cleanup, notify app */
     nfa_rw_command_complete();
     tag_params.t3t.num_system_codes = 0;
-    tag_params.t3t.p_system_codes = NULL;
+    tag_params.t3t.p_system_codes = nullptr;
 
     nfa_dm_notify_activation_status(NFA_STATUS_OK, &tag_params);
   }
@@ -2252,7 +2360,7 @@
                                  p_data->op_req.params.i93_cmd.uid);
       } else {
         status = RW_I93Inventory(p_data->op_req.params.i93_cmd.afi_present,
-                                 p_data->op_req.params.i93_cmd.afi, NULL);
+                                 p_data->op_req.params.i93_cmd.afi, nullptr);
       }
       break;
 
@@ -2330,7 +2438,7 @@
       if (p_data->op_req.params.i93_cmd.uid_present) {
         status = RW_I93GetSysInfo(p_data->op_req.params.i93_cmd.uid);
       } else {
-        status = RW_I93GetSysInfo(NULL);
+        status = RW_I93GetSysInfo(nullptr);
       }
       break;
 
@@ -2393,7 +2501,7 @@
           "received NFC_DATA_CEVT with NULL data pointer");
     }
   } else if (event == NFC_DEACTIVATE_CEVT) {
-    NFC_SetStaticRfCback(NULL);
+    NFC_SetStaticRfCback(nullptr);
   }
 }
 
@@ -2418,9 +2526,9 @@
       (nfa_rw_cb.protocol == NFC_PROTOCOL_T2T) &&
       (nfa_rw_cb.pa_sel_res == NFC_SEL_RES_NFC_FORUM_T2T)) {
     /* Type 2 tag is wake up from HALT State */
-    if (nfa_dm_cb.p_activate_ntf != NULL) {
+    if (nfa_dm_cb.p_activate_ntf != nullptr) {
       GKI_freebuf(nfa_dm_cb.p_activate_ntf);
-      nfa_dm_cb.p_activate_ntf = NULL;
+      nfa_dm_cb.p_activate_ntf = nullptr;
     }
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("- Type 2 tag wake up from HALT State");
@@ -2469,7 +2577,7 @@
     NFC_SetStaticRfCback(nfa_rw_raw_mode_data_cback);
 
     /* Notify app of NFA_ACTIVATED_EVT and start presence check timer */
-    nfa_dm_notify_activation_status(NFA_STATUS_OK, NULL);
+    nfa_dm_notify_activation_status(NFA_STATUS_OK, nullptr);
     nfa_rw_check_start_presence_check_timer(NFA_RW_PRESENCE_CHECK_INTERVAL);
     return true;
   }
@@ -2486,7 +2594,7 @@
     NFC_SetStaticRfCback(nfa_rw_raw_mode_data_cback);
 
     /* Notify app of NFA_ACTIVATED_EVT and start presence check timer */
-    nfa_dm_notify_activation_status(NFA_STATUS_OK, NULL);
+    nfa_dm_notify_activation_status(NFA_STATUS_OK, nullptr);
     nfa_rw_check_start_presence_check_timer(NFA_RW_PRESENCE_CHECK_INTERVAL);
     return true;
   }
@@ -2514,7 +2622,9 @@
              NFA_T1T_HR_LEN);
       tNFA_RW_MSG msg;
       msg.op_req.op = NFA_RW_OP_T1T_RID;
-      nfa_rw_handle_op_req(&msg);
+      bool free_buf = nfa_rw_handle_op_req(&msg);
+      CHECK(free_buf)
+          << "nfa_rw_handle_op_req is holding on to soon-garbage stack memory.";
       /* Delay notifying upper layer of NFA_ACTIVATED_EVT
          until HR0/HR1 is received */
       activate_notify = false;
@@ -2536,7 +2646,9 @@
       /* Issue command to get Felica system codes */
       tNFA_RW_MSG msg;
       msg.op_req.op = NFA_RW_OP_T3T_GET_SYSTEM_CODES;
-      nfa_rw_handle_op_req(&msg);
+      bool free_buf = nfa_rw_handle_op_req(&msg);
+      CHECK(free_buf)
+          << "nfa_rw_handle_op_req is holding on to soon-garbage stack memory.";
     }
   } else if (NFA_PROTOCOL_T5T == nfa_rw_cb.protocol) {
     /* Delay notifying upper layer of NFA_ACTIVATED_EVT to retrieve additional
@@ -2640,14 +2752,14 @@
     }
 
     GKI_freebuf(nfa_rw_cb.p_pending_msg);
-    nfa_rw_cb.p_pending_msg = NULL;
+    nfa_rw_cb.p_pending_msg = nullptr;
   }
 
   /* If we are in the process of waking up tag from HALT state */
   if (nfa_rw_cb.halt_event == RW_T2T_READ_CPLT_EVT) {
     if (nfa_rw_cb.rw_data.data.p_data)
       GKI_freebuf(nfa_rw_cb.rw_data.data.p_data);
-    nfa_rw_cb.rw_data.data.p_data = NULL;
+    nfa_rw_cb.rw_data.data.p_data = nullptr;
   }
 
   /* Stop presence check timer (if started) */
@@ -2673,7 +2785,7 @@
   /* Check if activated */
   if (!(nfa_rw_cb.flags & NFA_RW_FL_ACTIVATED)) {
     LOG(ERROR) << StringPrintf("nfa_rw_handle_op_req: not activated");
-    return true;
+    return (nfa_rw_op_req_while_inactive(p_data));
   }
   /* Check if currently busy with another API call */
   else if (nfa_rw_cb.flags & NFA_RW_FL_API_BUSY) {
@@ -2917,6 +3029,89 @@
 
 /*******************************************************************************
 **
+** Function         nfa_rw_op_req_while_inactive
+**
+** Description      Handle operation request while inactive
+**
+** Returns          TRUE if caller should free p_data
+**                  FALSE if caller does not need to free p_data
+**
+*******************************************************************************/
+static bool nfa_rw_op_req_while_inactive(tNFA_RW_MSG* p_data) {
+  bool freebuf = true;
+  tNFA_CONN_EVT_DATA conn_evt_data;
+  uint8_t event;
+
+  LOG(ERROR) << StringPrintf(
+      "nfa_rw_op_req_while_inactive: unable to handle API");
+
+  /* Return appropriate event for requested API, with status=REJECTED */
+  conn_evt_data.status = NFA_STATUS_REJECTED;
+
+  switch (p_data->op_req.op) {
+    case NFA_RW_OP_DETECT_NDEF:
+      conn_evt_data.ndef_detect.cur_size = 0;
+      conn_evt_data.ndef_detect.max_size = 0;
+      conn_evt_data.ndef_detect.flags = RW_NDEF_FL_UNKNOWN;
+      event = NFA_NDEF_DETECT_EVT;
+      break;
+    case NFA_RW_OP_READ_NDEF:
+    case NFA_RW_OP_T1T_RID:
+    case NFA_RW_OP_T1T_RALL:
+    case NFA_RW_OP_T1T_READ:
+    case NFA_RW_OP_T1T_RSEG:
+    case NFA_RW_OP_T1T_READ8:
+    case NFA_RW_OP_T2T_READ:
+    case NFA_RW_OP_T3T_READ:
+      event = NFA_READ_CPLT_EVT;
+      break;
+    case NFA_RW_OP_WRITE_NDEF:
+    case NFA_RW_OP_T1T_WRITE:
+    case NFA_RW_OP_T1T_WRITE8:
+    case NFA_RW_OP_T2T_WRITE:
+    case NFA_RW_OP_T3T_WRITE:
+      event = NFA_WRITE_CPLT_EVT;
+      break;
+    case NFA_RW_OP_FORMAT_TAG:
+      event = NFA_FORMAT_CPLT_EVT;
+      break;
+    case NFA_RW_OP_DETECT_LOCK_TLV:
+    case NFA_RW_OP_DETECT_MEM_TLV:
+      event = NFA_TLV_DETECT_EVT;
+      break;
+    case NFA_RW_OP_SET_TAG_RO:
+      event = NFA_SET_TAG_RO_EVT;
+      break;
+    case NFA_RW_OP_T2T_SECTOR_SELECT:
+      event = NFA_SELECT_CPLT_EVT;
+      break;
+    case NFA_RW_OP_I93_INVENTORY:
+    case NFA_RW_OP_I93_STAY_QUIET:
+    case NFA_RW_OP_I93_READ_SINGLE_BLOCK:
+    case NFA_RW_OP_I93_WRITE_SINGLE_BLOCK:
+    case NFA_RW_OP_I93_LOCK_BLOCK:
+    case NFA_RW_OP_I93_READ_MULTI_BLOCK:
+    case NFA_RW_OP_I93_WRITE_MULTI_BLOCK:
+    case NFA_RW_OP_I93_SELECT:
+    case NFA_RW_OP_I93_RESET_TO_READY:
+    case NFA_RW_OP_I93_WRITE_AFI:
+    case NFA_RW_OP_I93_LOCK_AFI:
+    case NFA_RW_OP_I93_WRITE_DSFID:
+    case NFA_RW_OP_I93_LOCK_DSFID:
+    case NFA_RW_OP_I93_GET_SYS_INFO:
+    case NFA_RW_OP_I93_GET_MULTI_BLOCK_STATUS:
+      event = NFA_I93_CMD_CPLT_EVT;
+      break;
+    default:
+      return (freebuf);
+  }
+  nfa_dm_act_conn_cback_notify(event, &conn_evt_data);
+
+  return (freebuf);
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_rw_command_complete
 **
 ** Description      Handle command complete: clear the busy flag,
diff --git a/src/nfa/rw/nfa_rw_api.cc b/src/nfa/rw/nfa_rw_api.cc
index a55962a..9f176d2 100644
--- a/src/nfa/rw/nfa_rw_api.cc
+++ b/src/nfa/rw/nfa_rw_api.cc
@@ -70,7 +70,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_DETECT_NDEF;
 
@@ -115,7 +115,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_READ_NDEF;
 
@@ -154,10 +154,10 @@
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("ndef len: %i", len);
 
   /* Validate parameters */
-  if (p_data == NULL) return (NFA_STATUS_INVALID_PARAM);
+  if (p_data == nullptr) return (NFA_STATUS_INVALID_PARAM);
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_WRITE_NDEF;
     p_msg->params.write_ndef.len = len;
@@ -192,7 +192,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_PRESENCE_CHECK;
     p_msg->params.option = option;
@@ -225,7 +225,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_FORMAT_TAG;
 
@@ -280,7 +280,7 @@
       << StringPrintf("%s", b_hard_lock ? "Hard lock" : "Soft lock");
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_SET_TAG_RO;
@@ -338,7 +338,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
 
     if (tlv_type == TAG_LOCK_CTRL_TLV) {
@@ -378,7 +378,7 @@
   tNFA_RW_OPERATION* p_msg;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T1T_RID;
@@ -409,7 +409,7 @@
   tNFA_RW_OPERATION* p_msg;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T1T_RALL;
@@ -440,7 +440,7 @@
   tNFA_RW_OPERATION* p_msg;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T1T_READ;
@@ -474,7 +474,7 @@
   tNFA_RW_OPERATION* p_msg;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->params.t1t_write.b_erase = b_erase;
@@ -509,7 +509,7 @@
   tNFA_RW_OPERATION* p_msg;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T1T_RSEG;
@@ -541,7 +541,7 @@
   tNFA_RW_OPERATION* p_msg;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T1T_READ8;
@@ -574,7 +574,7 @@
   tNFA_RW_OPERATION* p_msg;
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->params.t1t_write.b_erase = b_erase;
@@ -612,7 +612,7 @@
       << StringPrintf("Block to read: %d", block_number);
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T2T_READ;
@@ -646,7 +646,7 @@
       << StringPrintf("Block to write: %d", block_number);
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T2T_WRITE;
@@ -683,7 +683,7 @@
       << StringPrintf("sector to select: %d", sector_number);
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_T2T_SECTOR_SELECT;
@@ -720,12 +720,12 @@
       << StringPrintf("num_blocks to read: %i", num_blocks);
 
   /* Validate parameters */
-  if ((num_blocks == 0) || (t3t_blocks == NULL))
+  if ((num_blocks == 0) || (t3t_blocks == nullptr))
     return (NFA_STATUS_INVALID_PARAM);
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(
       sizeof(tNFA_RW_OPERATION) + (num_blocks * sizeof(tNFA_T3T_BLOCK_DESC))));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* point to area after tNFA_RW_OPERATION */
     p_block_desc = (uint8_t*)(p_msg + 1);
 
@@ -772,13 +772,13 @@
       << StringPrintf("num_blocks to write: %i", num_blocks);
 
   /* Validate parameters */
-  if ((num_blocks == 0) || (t3t_blocks == NULL) | (p_data == NULL))
+  if ((num_blocks == 0) || (t3t_blocks == nullptr) | (p_data == nullptr))
     return (NFA_STATUS_INVALID_PARAM);
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_RW_OPERATION) +
                  (num_blocks * (sizeof(tNFA_T3T_BLOCK_DESC) + 16))));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* point to block descriptor and data areas after tNFA_RW_OPERATION */
     p_block_desc = (uint8_t*)(p_msg + 1);
     p_data_area = p_block_desc + (num_blocks * (sizeof(tNFA_T3T_BLOCK_DESC)));
@@ -834,7 +834,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_INVENTORY;
@@ -883,7 +883,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_STAY_QUIET;
@@ -924,7 +924,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_READ_SINGLE_BLOCK;
@@ -972,7 +972,7 @@
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_RW_OPERATION) + nfa_rw_cb.i93_block_size));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_WRITE_SINGLE_BLOCK;
@@ -1017,7 +1017,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_LOCK_BLOCK;
@@ -1061,7 +1061,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_READ_MULTI_BLOCK;
@@ -1115,7 +1115,7 @@
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_RW_OPERATION) + data_length));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_WRITE_MULTI_BLOCK;
@@ -1167,7 +1167,7 @@
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf(
       (uint16_t)(sizeof(tNFA_RW_OPERATION) + I93_UID_BYTE_LEN));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_SELECT;
@@ -1209,7 +1209,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_RESET_TO_READY;
@@ -1248,7 +1248,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_WRITE_AFI;
@@ -1289,7 +1289,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_LOCK_AFI;
@@ -1328,7 +1328,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_WRITE_DSFID;
@@ -1369,7 +1369,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_LOCK_DSFID;
@@ -1409,7 +1409,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_GET_SYS_INFO;
@@ -1459,7 +1459,7 @@
   }
 
   p_msg = (tNFA_RW_OPERATION*)GKI_getbuf((uint16_t)(sizeof(tNFA_RW_OPERATION)));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Fill in tNFA_RW_OPERATION struct */
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op = NFA_RW_OP_I93_GET_MULTI_BLOCK_STATUS;
diff --git a/src/nfa/rw/nfa_rw_main.cc b/src/nfa/rw/nfa_rw_main.cc
index 9023f4a..36701ac 100644
--- a/src/nfa/rw/nfa_rw_main.cc
+++ b/src/nfa/rw/nfa_rw_main.cc
@@ -41,8 +41,8 @@
 /*****************************************************************************
 ** Constants and types
 *****************************************************************************/
-static const tNFA_SYS_REG nfa_rw_sys_reg = {NULL, nfa_rw_handle_event,
-                                            nfa_rw_sys_disable, NULL};
+static const tNFA_SYS_REG nfa_rw_sys_reg = {nullptr, nfa_rw_handle_event,
+                                            nfa_rw_sys_disable, nullptr};
 
 /* NFA_RW actions */
 const tNFA_RW_ACTION nfa_rw_action_tbl[] = {
@@ -93,6 +93,7 @@
   tRW_T3T_CB* p_t3t;
   tRW_T4T_CB* p_t4t;
   tRW_I93_CB* p_i93;
+  tRW_MFC_CB* p_mfc;
 
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
@@ -132,12 +133,20 @@
         p_i93->p_retry_cmd = NULL;
       }
       break;
+    case RW_CB_TYPE_MIFARE:
+      p_mfc = &rw_cb.tcb.mfc;
+      if (p_mfc->p_cur_cmd_buf != NULL) {
+        GKI_freebuf(p_mfc->p_cur_cmd_buf);
+        p_mfc->p_cur_cmd_buf = NULL;
+      }
+      break;
     default: /* do nothing */
       break;
   }
+  rw_cb.tcb_type = RW_CB_TYPE_UNKNOWN;
 
   /* Return to idle */
-  NFC_SetStaticRfCback(NULL);
+  NFC_SetStaticRfCback(nullptr);
 
   /* Stop presence check timer (if started) */
   nfa_rw_stop_presence_check_timer();
@@ -148,7 +157,7 @@
   /* Free pending command if any */
   if (nfa_rw_cb.p_pending_msg) {
     GKI_freebuf(nfa_rw_cb.p_pending_msg);
-    nfa_rw_cb.p_pending_msg = NULL;
+    nfa_rw_cb.p_pending_msg = nullptr;
   }
 
   nfa_sys_deregister(NFA_ID_RW);
@@ -200,7 +209,7 @@
   tNFA_RW_MSG* p_msg;
 
   p_msg = (tNFA_RW_MSG*)GKI_getbuf((uint16_t)sizeof(tNFA_RW_MSG));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
     p_msg->op_req.op = NFA_RW_OP_SEND_RAW_FRAME;
 
diff --git a/src/nfa/sys/nfa_sys_cback.cc b/src/nfa/sys/nfa_sys_cback.cc
index 4ca898c..2834349 100644
--- a/src/nfa/sys/nfa_sys_cback.cc
+++ b/src/nfa/sys/nfa_sys_cback.cc
@@ -66,7 +66,7 @@
   if ((nfa_sys_cb.enable_cplt_flags == nfa_sys_cb.enable_cplt_mask) &&
       (nfa_sys_cb.p_enable_cback)) {
     nfa_sys_cb.p_enable_cback();
-    nfa_sys_cb.p_enable_cback = NULL;
+    nfa_sys_cb.p_enable_cback = nullptr;
   }
 }
 
@@ -108,6 +108,6 @@
        nfa_sys_cb.proc_nfcc_pwr_mode_cplt_mask) &&
       (nfa_sys_cb.p_proc_nfcc_pwr_mode_cmpl_cback)) {
     nfa_sys_cb.p_proc_nfcc_pwr_mode_cmpl_cback();
-    nfa_sys_cb.p_proc_nfcc_pwr_mode_cmpl_cback = NULL;
+    nfa_sys_cb.p_proc_nfcc_pwr_mode_cmpl_cback = nullptr;
   }
 }
diff --git a/src/nfa/sys/nfa_sys_main.cc b/src/nfa/sys/nfa_sys_main.cc
index 147d1b0..12224ae 100644
--- a/src/nfa/sys/nfa_sys_main.cc
+++ b/src/nfa/sys/nfa_sys_main.cc
@@ -239,7 +239,7 @@
   /* Enable all subsystems except SYS */
   for (id = NFA_ID_DM; id < NFA_ID_MAX; id++) {
     if (nfa_sys_cb.is_reg[id]) {
-      if (nfa_sys_cb.reg[id]->enable != NULL) {
+      if (nfa_sys_cb.reg[id]->enable != nullptr) {
         /* Subsytem has a Disable funciton. Call it now */
         (*nfa_sys_cb.reg[id]->enable)();
       } else {
@@ -273,7 +273,7 @@
   for (id = (NFA_ID_DM + 1); id < NFA_ID_MAX; id++) {
     if (nfa_sys_cb.is_reg[id]) {
       done = false;
-      if (nfa_sys_cb.reg[id]->disable != NULL) {
+      if (nfa_sys_cb.reg[id]->disable != nullptr) {
         /* Subsytem has a Disable funciton. Call it now */
         (*nfa_sys_cb.reg[id]->disable)();
       } else {
diff --git a/src/nfa/sys/nfa_sys_ptim.cc b/src/nfa/sys/nfa_sys_ptim.cc
index 3f0d48a..abcd608 100644
--- a/src/nfa/sys/nfa_sys_ptim.cc
+++ b/src/nfa/sys/nfa_sys_ptim.cc
@@ -98,7 +98,7 @@
       (*p_tle->p_cback)(p_tle);
     } else if (p_tle->event) {
       p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR));
-      if (p_msg != NULL) {
+      if (p_msg != nullptr) {
         p_msg->event = p_tle->event;
         p_msg->layer_specific = 0;
         nfa_sys_sendmsg(p_msg);
@@ -107,7 +107,7 @@
   }
 
   /* if timer list is empty stop periodic GKI timer */
-  if (p_cb->timer_queue.p_first == NULL) {
+  if (p_cb->timer_queue.p_first == nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("ptim timer stop");
     GKI_stop_timer(p_cb->timer_id);
   }
@@ -129,7 +129,7 @@
       << StringPrintf("nfa_sys_ptim_start_timer %p", p_tle);
 
   /* if timer list is currently empty, start periodic GKI timer */
-  if (p_cb->timer_queue.p_first == NULL) {
+  if (p_cb->timer_queue.p_first == nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("ptim timer start");
     p_cb->last_gki_ticks = GKI_get_tick_count();
     GKI_start_timer(p_cb->timer_id, GKI_MS_TO_TICKS(p_cb->period), true);
@@ -159,7 +159,7 @@
   GKI_remove_from_timer_list(&p_cb->timer_queue, p_tle);
 
   /* if timer list is empty stop periodic GKI timer */
-  if (p_cb->timer_queue.p_first == NULL) {
+  if (p_cb->timer_queue.p_first == nullptr) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("ptim timer stop");
     GKI_stop_timer(p_cb->timer_id);
   }
diff --git a/src/nfc/include/nfc_api.h b/src/nfc/include/nfc_api.h
index c4a654e..3a0b673 100644
--- a/src/nfc/include/nfc_api.h
+++ b/src/nfc/include/nfc_api.h
@@ -405,6 +405,7 @@
 
 /* Select Response codes */
 #define NFC_SEL_RES_NFC_FORUM_T2T 0x00
+#define NFC_SEL_RES_MF_CLASSIC 0x08
 
 /* Bit Rates */
 #define NFC_BIT_RATE_212 NCI_BIT_RATE_212   /* 212 kbit/s */
diff --git a/src/nfc/include/nfc_int.h b/src/nfc/include/nfc_int.h
index 71b8564..f357965 100644
--- a/src/nfc/include/nfc_int.h
+++ b/src/nfc/include/nfc_int.h
@@ -62,6 +62,7 @@
 #define NFC_TTYPE_P2P_PRIO_RESPONSE 110
 /* added for p2p prio logic clenaup */
 #define NFC_TTYPE_P2P_PRIO_LOGIC_CLEANUP 111
+#define NFC_TTYPE_RW_MFC_RESPONSE 112
 /* time out for mode set notification */
 #define NFC_MODE_SET_NTF_TIMEOUT 2
 /* NFC Task event messages */
diff --git a/src/nfc/include/rw_api.h b/src/nfc/include/rw_api.h
index edf7e83..ea9c1cf 100644
--- a/src/nfc/include/rw_api.h
+++ b/src/nfc/include/rw_api.h
@@ -36,6 +36,7 @@
 #define RW_T3T_FIRST_EVT 0x60
 #define RW_T4T_FIRST_EVT 0x80
 #define RW_I93_FIRST_EVT 0xA0
+#define RW_MFC_FIRST_EVT 0xC0
 
 enum {
   /* Note: the order of these events can not be changed */
@@ -122,7 +123,23 @@
   RW_I93_PRESENCE_CHECK_EVT,   /* Response to RW_I93PresenceCheck    */
   RW_I93_RAW_FRAME_EVT,        /* Response of raw frame sent         */
   RW_I93_INTF_ERROR_EVT,       /* RF Interface error event           */
-  RW_I93_MAX_EVT
+  RW_I93_MAX_EVT,
+
+  /* Mifare Classic tag events for tRW_CBACK */
+  RW_MFC_NDEF_DETECT_EVT =
+      RW_MFC_FIRST_EVT,      /* Result of NDEF detection procedure       */
+                             /* Mandatory NDEF file is selected          */
+  RW_MFC_NDEF_READ_EVT,      /* Segment of data received from mifare tag */
+  RW_MFC_NDEF_READ_CPLT_EVT, /* Read operation completed                 */
+  RW_MFC_NDEF_READ_FAIL_EVT, /* Read operation failed                    */
+
+  RW_MFC_NDEF_WRITE_CPLT_EVT,  /* Write operation completed               */
+  RW_MFC_NDEF_WRITE_FAIL_EVT,  /* Write operation failed                  */
+  RW_MFC_NDEF_FORMAT_CPLT_EVT, /* Format operation completed              */
+
+  RW_MFC_RAW_FRAME_EVT,  /* Response of raw frame sent               */
+  RW_MFC_INTF_ERROR_EVT, /* RF Interface error event                 */
+  RW_MFC_MAX_EVT
 };
 
 #define RW_RAW_FRAME_EVT 0xFF
@@ -1331,4 +1348,65 @@
 *******************************************************************************/
 extern tNFC_STATUS RW_SetActivatedTagType(tNFC_ACTIVATE_DEVT* p_activate_params,
                                           tRW_CBACK* p_cback);
+/*******************************************************************************
+**
+** Function         RW_MfcDetectNDef
+**
+** Description      This function performs NDEF detection procedure
+**
+**                  RW_MFC_NDEF_DETECT_EVT will be returned
+**
+** Returns          NFC_STATUS_OK if success
+**                  NFC_STATUS_FAILED if Mifare classic tag is busy or other
+*error
+**
+*******************************************************************************/
+extern tNFC_STATUS RW_MfcDetectNDef(void);
+
+/*******************************************************************************
+**
+** Function         RW_MfcReadNDef
+**
+** Description      This function can be called to read the NDEF message on the
+*tag.
+**
+** Parameters:      p_buffer:   The buffer into which to read the NDEF message
+**                  buf_len:    The length of the buffer
+**
+** Returns          NCI_STATUS_OK, if read was started. Otherwise, error status.
+**
+*******************************************************************************/
+extern tNFC_STATUS RW_MfcReadNDef(uint8_t* p_buffer, uint16_t buf_len);
+
+/*****************************************************************************
+**
+** Function         RW_MfcFormatNDef
+**
+** Description
+**      Format Tag content
+**
+** Returns
+**      NFC_STATUS_OK, Command sent to format Tag
+**      NFC_STATUS_REJECTED: cannot format the tag
+**      NFC_STATUS_FAILED: other error
+**
+*****************************************************************************/
+extern tNFC_STATUS RW_MfcFormatNDef(void);
+
+/*******************************************************************************
+**
+** Function         RW_MfcWriteNDef
+**
+** Description      This function can be called to write an NDEF message to the
+**                  tag.
+**
+** Parameters:      buf_len:    The length of the buffer
+**                  p_buffer:   The NDEF message to write
+**
+** Returns          NCI_STATUS_OK, if write was started. Otherwise, error
+**                  status.
+**
+*******************************************************************************/
+extern tNFC_STATUS RW_MfcWriteNDef(uint16_t buf_len, uint8_t* p_buffer);
+
 #endif /* RW_API_H */
diff --git a/src/nfc/include/rw_int.h b/src/nfc/include/rw_int.h
index 72d24ab..698dfe4 100644
--- a/src/nfc/include/rw_int.h
+++ b/src/nfc/include/rw_int.h
@@ -607,6 +607,48 @@
 } tRW_STATS;
 #endif /* RW_STATS_INCLUDED */
 
+/* Mifare Classic RW Control Block */
+
+typedef struct {
+  uint16_t block;
+  bool auth;
+} tRW_MFC_BLOCK;
+
+#define MFC_NDEF_NOT_DETECTED 0x00
+#define MFC_NDEF_DETECTED 0x01
+#define MFC_NDEF_READ 0x02
+
+typedef uint8_t tRW_MFC_RW_STATE;
+typedef uint8_t tRW_MFC_RW_SUBSTATE;
+typedef struct {
+  tRW_MFC_RW_STATE state;       /* main state */
+  tRW_MFC_RW_SUBSTATE substate; /* Reader/write substate in NDEF write state*/
+  tRW_MFC_RW_SUBSTATE
+      prev_substate;    /* Reader/write substate in NDEF write state*/
+  TIMER_LIST_ENT timer; /* timeout for each API call */
+  uint8_t uid[4];
+  uint8_t selres;
+  uint8_t tlv_detect;       /* TLV type under detection */
+  uint16_t ndef_length;     /* length of NDEF data */
+  uint16_t ndef_start_pos;   /* NDEF start position */
+  uint16_t ndef_first_block; /* Frst block containing the NDEF */
+  uint8_t* p_update_data;   /* pointer of data to update */
+  uint16_t rw_length;       /* remaining bytes to read/write */
+  uint16_t rw_offset;       /* remaining offset to read/write */
+  NFC_HDR* p_data_to_free;  /* GKI buffer to delete after done */
+  tRW_MFC_BLOCK last_block_accessed;
+  tRW_MFC_BLOCK next_block;
+  uint8_t sector_authentified;
+  TIMER_LIST_ENT mfc_timer; /* timeout for each API call */
+  uint16_t work_offset;     /* Working byte offset */
+  uint8_t* p_ndef_buffer;   /* Buffer to store ndef message */
+  uint16_t current_block;
+  NFC_HDR* p_cur_cmd_buf; /* Copy of current command, for retx/send after sector
+                             change */
+
+  uint8_t ndef_status; /* bitmap for NDEF status */
+} tRW_MFC_CB;
+
 /* ISO 15693 RW Control Block */
 typedef uint8_t tRW_I93_RW_STATE;
 typedef uint8_t tRW_I93_RW_SUBSTATE;
@@ -696,6 +738,7 @@
   tRW_T3T_CB t3t;
   tRW_T4T_CB t4t;
   tRW_I93_CB i93;
+  tRW_MFC_CB mfc;
 } tRW_TCB;
 
 /* RW callback type */
@@ -705,6 +748,7 @@
 #define RW_CB_TYPE_T3T 3
 #define RW_CB_TYPE_T4T 4
 #define RW_CB_TYPE_T5T 5
+#define RW_CB_TYPE_MIFARE 6
 typedef uint8_t tRW_CB_TYPE;
 
 /* RW control blocks */
@@ -775,6 +819,9 @@
 extern tNFC_STATUS rw_i93_select(uint8_t* p_uid);
 extern void rw_i93_process_timeout(TIMER_LIST_ENT* p_tle);
 extern void rw_t4t_handle_isodep_nak_rsp(uint8_t status, bool is_ntf);
+
+extern tNFC_STATUS rw_mfc_select(uint8_t selres, uint8_t uid[T1T_CMD_UID_LEN]);
+extern void rw_mfc_process_timeout(TIMER_LIST_ENT* p_tle);
 #if (RW_STATS_INCLUDED == TRUE)
 /* Internal fcns for statistics (from rw_main.c) */
 void rw_main_reset_stats(void);
diff --git a/src/nfc/include/tags_defs.h b/src/nfc/include/tags_defs.h
index 55022ff..23a8f03 100644
--- a/src/nfc/include/tags_defs.h
+++ b/src/nfc/include/tags_defs.h
@@ -447,6 +447,9 @@
 #define T4T_DES_EV1_NFC_APP_ID 0x010000
 #define T4T_DES_EV0_NFC_APP_ID 0x10EEEE
 
+/*  Mifare Classic Tag Definitions */
+#define MFC_UID_LEN 4
+
 /*
 **
 **  ISO 15693 Tag Definitions
@@ -531,14 +534,24 @@
 /* Information flags definition */
 /* DSFID is supported and DSFID field is present */
 #define I93_INFO_FLAG_DSFID 0x01
+/* DSFID info length */
+#define I93_INFO_DSFID_LEN 0x01
 /* AFI is supported and AFI field is present     */
 #define I93_INFO_FLAG_AFI 0x02
+/* AFI info length */
+#define I93_INFO_AFI_LEN 0x01
 /* VICC memory size field is present             */
 #define I93_INFO_FLAG_MEM_SIZE 0x04
+/* block size info length */
+#define I93_INFO_BLOCK_SIZE_LEN 0x01
+/* 8bit num of blocks info length */
+#define I93_INFO_8BIT_NUM_BLOCK_LEN 0x01
 /* 16bit num of blocks info length */
 #define I93_INFO_16BIT_NUM_BLOCK_LEN 0x02
 /* IC reference field is present                 */
 #define I93_INFO_FLAG_IC_REF 0x08
+/* IC ref info length */
+#define I93_INFO_IC_REF_LEN 0x01
 /* Memory coded in 2 bytes address               */
 #define I93_INFO_FLAG_MOI 0x10
 
diff --git a/src/nfc/include/tags_int.h b/src/nfc/include/tags_int.h
index b7fc8d3..9b6defd 100644
--- a/src/nfc/include/tags_int.h
+++ b/src/nfc/include/tags_int.h
@@ -85,6 +85,6 @@
 extern const char* t1t_info_to_str(const tT1T_CMD_RSP_INFO* p_info);
 extern const char* t2t_info_to_str(const tT2T_CMD_RSP_INFO* p_info);
 extern int tags_pow(int x, int y);
-extern unsigned int tags_log2(register unsigned int x);
+extern unsigned int tags_log2(unsigned int x);
 
 #endif /* TAGS_INT_H */
diff --git a/src/nfc/llcp/llcp_api.cc b/src/nfc/llcp/llcp_api.cc
index 289af2a..93dbc6a 100644
--- a/src/nfc/llcp/llcp_api.cc
+++ b/src/nfc/llcp/llcp_api.cc
@@ -363,7 +363,7 @@
   uint8_t sap;
   uint16_t length;
   tLLCP_APP_CB* p_app_cb = {
-      0,
+      nullptr,
   };
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
@@ -382,7 +382,7 @@
   if (reg_sap == LLCP_INVALID_SAP) {
     /* allocate a SAP between 0x10 and 0x1F */
     for (sap = 0; sap < LLCP_MAX_SERVER; sap++) {
-      if (llcp_cb.server_cb[sap].p_app_cback == NULL) {
+      if (llcp_cb.server_cb[sap].p_app_cback == nullptr) {
         p_app_cb = &llcp_cb.server_cb[sap];
         reg_sap = LLCP_LOWER_BOUND_SDP_SAP + sap;
         break;
@@ -433,7 +433,7 @@
     }
 
     p_app_cb->p_service_name = (char*)GKI_getbuf((uint16_t)(length + 1));
-    if (p_app_cb->p_service_name == NULL) {
+    if (p_app_cb->p_service_name == nullptr) {
       LOG(ERROR) << StringPrintf("Out of resource");
       return LLCP_INVALID_SAP;
     }
@@ -441,7 +441,7 @@
     strncpy(p_app_cb->p_service_name, p_service_name.c_str(), length + 1);
     p_app_cb->p_service_name[length] = 0;
   } else
-    p_app_cb->p_service_name = NULL;
+    p_app_cb->p_service_name = nullptr;
 
   p_app_cb->p_app_cback = p_app_cback;
   p_app_cb->link_type = link_type;
@@ -493,7 +493,7 @@
 
   /* allocate a SAP between 0x20 and 0x3F */
   for (sap = 0; sap < LLCP_MAX_CLIENT; sap++) {
-    if (llcp_cb.client_cb[sap].p_app_cback == NULL) {
+    if (llcp_cb.client_cb[sap].p_app_cback == nullptr) {
       p_app_cb = &llcp_cb.client_cb[sap];
       memset(p_app_cb, 0x00, sizeof(tLLCP_APP_CB));
       reg_sap = LLCP_LOWER_BOUND_LOCAL_SAP + sap;
@@ -507,7 +507,7 @@
   }
 
   p_app_cb->p_app_cback = p_app_cback;
-  p_app_cb->p_service_name = NULL;
+  p_app_cb->p_service_name = nullptr;
   p_app_cb->link_type = link_type;
 
   DLOG_IF(INFO, nfc_debug_enabled)
@@ -539,7 +539,7 @@
 
   p_app_cb = llcp_util_get_app_cb(local_sap);
 
-  if ((!p_app_cb) || (p_app_cb->p_app_cback == NULL)) {
+  if ((!p_app_cb) || (p_app_cb->p_app_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("SAP (0x%x) is not registered", local_sap);
     return LLCP_STATUS_FAIL;
   }
@@ -563,7 +563,7 @@
     }
   }
 
-  p_app_cb->p_app_cback = NULL;
+  p_app_cb->p_app_cback = nullptr;
 
   /* discard any pending tx UI PDU from this SAP */
   while (p_app_cb->ui_xmit_q.p_first) {
@@ -604,7 +604,7 @@
   p_app_cb = llcp_util_get_app_cb(local_sap);
 
   if ((llcp_cb.lcb.link_state != LLCP_LINK_STATE_ACTIVATED) ||
-      (p_app_cb == NULL) || (p_app_cb->p_app_cback == NULL) ||
+      (p_app_cb == nullptr) || (p_app_cb->p_app_cback == nullptr) ||
       ((p_app_cb->link_type & LLCP_LINK_TYPE_LOGICAL_DATA_LINK) == 0) ||
       (p_app_cb->is_ui_tx_congested)) {
     return true;
@@ -644,7 +644,7 @@
 
   p_app_cb = llcp_util_get_app_cb(ssap);
 
-  if ((p_app_cb == NULL) || (p_app_cb->p_app_cback == NULL)) {
+  if ((p_app_cb == nullptr) || (p_app_cb->p_app_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("SSAP (0x%x) is not registered", ssap);
   } else if ((p_app_cb->link_type & LLCP_LINK_TYPE_LOGICAL_DATA_LINK) == 0) {
     LOG(ERROR) << StringPrintf("Logical link on SSAP (0x%x) is not enabled",
@@ -862,7 +862,7 @@
   p_app_cb = llcp_util_get_app_cb(reg_sap);
 
   /* if application is registered */
-  if ((p_app_cb == NULL) || (p_app_cb->p_app_cback == NULL)) {
+  if ((p_app_cb == nullptr) || (p_app_cb->p_app_cback == nullptr)) {
     LOG(ERROR) << StringPrintf("SSAP (0x%x) is not registered", reg_sap);
     return LLCP_STATUS_FAIL;
   }
@@ -1345,7 +1345,7 @@
 
       if (is_busy == false) {
         if (p_dlcb->i_rx_q.count) {
-          llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_PEER_DATA_IND, NULL);
+          llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_PEER_DATA_IND, nullptr);
         }
       }
     }
@@ -1494,7 +1494,7 @@
       status = llcp_sdp_send_sdreq(llcp_cb.sdp_cb.transac[i].tid, p_name);
 
       if (status == LLCP_STATUS_FAIL) {
-        llcp_cb.sdp_cb.transac[i].p_cback = NULL;
+        llcp_cb.sdp_cb.transac[i].p_cback = nullptr;
       }
 
       *p_tid = llcp_cb.sdp_cb.transac[i].tid;
diff --git a/src/nfc/llcp/llcp_dlc.cc b/src/nfc/llcp/llcp_dlc.cc
index 22fd548..5882b9a 100644
--- a/src/nfc/llcp/llcp_dlc.cc
+++ b/src/nfc/llcp/llcp_dlc.cc
@@ -582,7 +582,7 @@
       }
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 /*******************************************************************************
@@ -633,7 +633,7 @@
 
   p_app_cb = llcp_util_get_app_cb(dsap);
 
-  if ((p_app_cb == NULL) || (p_app_cb->p_app_cback == NULL) ||
+  if ((p_app_cb == nullptr) || (p_app_cb->p_app_cback == nullptr) ||
       ((p_app_cb->link_type & LLCP_LINK_TYPE_DATA_LINK_CONNECTION) == 0)) {
     LOG(ERROR) << StringPrintf("Unregistered SAP:0x%x", dsap);
     llcp_util_send_dm(ssap, dsap, LLCP_SAP_DM_REASON_NO_SERVICE);
@@ -691,7 +691,7 @@
       /* check if this application can support connection-oriented transport */
       p_app_cb = llcp_util_get_app_cb(dsap);
 
-      if ((p_app_cb == NULL) || (p_app_cb->p_app_cback == NULL) ||
+      if ((p_app_cb == nullptr) || (p_app_cb->p_app_cback == nullptr) ||
           ((p_app_cb->link_type & LLCP_LINK_TYPE_DATA_LINK_CONNECTION) == 0)) {
         LOG(ERROR) << StringPrintf(
             "SAP(0x%x) doesn't support "
@@ -753,9 +753,9 @@
       llcp_util_send_frmr(p_dlcb,
                           LLCP_FRMR_W_ERROR_FLAG | LLCP_FRMR_I_ERROR_FLAG,
                           LLCP_PDU_DISC_TYPE, 0);
-      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, NULL);
+      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, nullptr);
     } else {
-      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_PEER_DISCONNECT_IND, NULL);
+      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_PEER_DISCONNECT_IND, nullptr);
     }
   } else {
     LOG(ERROR) << StringPrintf("No data link for SAP (0x%x,0x%x)", dsap, ssap);
@@ -798,7 +798,7 @@
       llcp_util_send_frmr(p_dlcb,
                           LLCP_FRMR_W_ERROR_FLAG | LLCP_FRMR_I_ERROR_FLAG,
                           LLCP_PDU_DISC_TYPE, 0);
-      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, NULL);
+      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, nullptr);
     }
   } else {
     LOG(ERROR) << StringPrintf("No data link for SAP (0x%x,0x%x)", dsap, ssap);
@@ -934,7 +934,7 @@
     /* if any error is found */
     if (error_flags) {
       llcp_util_send_frmr(p_dlcb, error_flags, LLCP_PDU_I_TYPE, *p);
-      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, NULL);
+      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, nullptr);
     } else {
       /* update local sequence variables */
       p_dlcb->next_rx_seq = (p_dlcb->next_rx_seq + 1) % LLCP_SEQ_MODULO;
@@ -967,7 +967,7 @@
 
           if (p_msg) {
             GKI_freebuf(p_msg);
-            p_msg = NULL;
+            p_msg = nullptr;
           }
 
           appended = true;
@@ -1011,7 +1011,7 @@
         /* insert I PDU in rx queue */
         if (p_msg) {
           GKI_enqueue(&p_dlcb->i_rx_q, p_msg);
-          p_msg = NULL;
+          p_msg = nullptr;
           llcp_cb.total_rx_i_pdu++;
 
           llcp_util_check_rx_congested_status();
@@ -1023,7 +1023,7 @@
       if ((!p_dlcb->local_busy) && (p_dlcb->num_rx_i_pdu == 1)) {
         /* notify rx data is available so upper layer reads data until queue is
          * empty */
-        llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_PEER_DATA_IND, NULL);
+        llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_PEER_DATA_IND, nullptr);
       }
 
       if ((!p_dlcb->is_rx_congested) &&
@@ -1068,7 +1068,7 @@
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
   p_dlcb = llcp_dlc_find_dlcb_by_sap(dsap, ssap);
-  if (p_dlcb != NULL) {
+  if (p_dlcb != nullptr) {
     error_flags = 0;
 
     if (length == 0) {
@@ -1095,7 +1095,7 @@
 
     if (error_flags) {
       llcp_util_send_frmr(p_dlcb, error_flags, ptype, *p_data);
-      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, NULL);
+      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, nullptr);
     } else {
       p_dlcb->rcvd_ack_seq = rcv_seq;
 
@@ -1198,7 +1198,7 @@
     case LLCP_PDU_FRMR_TYPE:
       p_dlcb = llcp_dlc_find_dlcb_by_sap(dsap, ssap);
       if (p_dlcb) {
-        llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, NULL);
+        llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, nullptr);
       }
       break;
 
@@ -1213,7 +1213,7 @@
       p_dlcb = llcp_dlc_find_dlcb_by_sap(dsap, ssap);
       if (p_dlcb) {
         llcp_util_send_frmr(p_dlcb, LLCP_FRMR_W_ERROR_FLAG, ptype, 0);
-        llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, NULL);
+        llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, nullptr);
       }
       break;
   }
@@ -1293,7 +1293,7 @@
 **
 *******************************************************************************/
 NFC_HDR* llcp_dlc_get_next_pdu(tLLCP_DLCB* p_dlcb) {
-  NFC_HDR* p_msg = NULL;
+  NFC_HDR* p_msg = nullptr;
   bool flush = true;
   tLLCP_SAP_CBACK_DATA data;
 
@@ -1320,7 +1320,7 @@
       LOG(ERROR) << StringPrintf("offset (%d) must be %d at least",
                                  p_msg->offset, LLCP_MIN_OFFSET);
       GKI_freebuf(p_msg);
-      p_msg = NULL;
+      p_msg = nullptr;
     }
   }
 
diff --git a/src/nfc/llcp/llcp_link.cc b/src/nfc/llcp/llcp_link.cc
index f144d45..f87da82 100644
--- a/src/nfc/llcp/llcp_link.cc
+++ b/src/nfc/llcp/llcp_link.cc
@@ -33,7 +33,6 @@
 #include "llcp_int.h"
 #include "nfa_dm_int.h"
 #include "nfc_int.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -377,7 +376,7 @@
   } else if (llcp_cb.lcb.link_state == LLCP_LINK_STATE_DEACTIVATING) {
     llcp_deactivate_cleanup(llcp_cb.lcb.link_deact_reason);
 
-    NFC_SetStaticRfCback(NULL);
+    NFC_SetStaticRfCback(nullptr);
   }
 }
 
@@ -424,7 +423,7 @@
     if (llcp_cb.dlcb[idx].state != LLCP_DLC_STATE_IDLE) {
       p_dlcb = &(llcp_cb.dlcb[idx]);
 
-      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_LINK_ERROR, NULL);
+      llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_LINK_ERROR, nullptr);
     }
   }
   llcp_cb.total_tx_i_pdu = 0;
@@ -884,7 +883,7 @@
         "in state of "
         "LLCP_LINK_SYMM_LOCAL_XMIT_NEXT");
 
-    p_pdu = llcp_link_build_next_pdu(NULL);
+    p_pdu = llcp_link_build_next_pdu(nullptr);
 
     /*
     ** For data link connection,
@@ -900,7 +899,7 @@
     /* add RR/RNR PDU to be sent if any */
     p_pdu = llcp_link_build_next_pdu(p_pdu);
 
-    if (p_pdu != NULL) {
+    if (p_pdu != nullptr) {
       llcp_link_send_to_lower(p_pdu);
 
       /* stop inactivity timer */
@@ -968,7 +967,7 @@
   p_dlcb = llcp_dlc_find_dlcb_by_sap(local_sap, remote_sap);
   if (p_dlcb) {
     llcp_util_send_frmr(p_dlcb, LLCP_FRMR_W_ERROR_FLAG, LLCP_PDU_UI_TYPE, 0);
-    llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, NULL);
+    llcp_dlsm_execute(p_dlcb, LLCP_DLC_EVENT_FRAME_ERROR, nullptr);
     if (p_msg) {
       GKI_freebuf(p_msg);
     }
@@ -1138,7 +1137,7 @@
   agf_length = p_agf->len;
   p = (uint8_t*)(p_agf + 1) + p_agf->offset;
 
-  while (agf_length >= LLCP_PDU_HEADER_SIZE) {
+  while (agf_length >= (LLCP_PDU_HEADER_SIZE + LLCP_PDU_AGF_LEN_SIZE)) {
     /* get length of PDU */
     p_pdu_length = p;
     BE_STREAM_TO_UINT16(pdu_length, p);
@@ -1172,9 +1171,9 @@
       llcp_sdp_proc_snl((uint16_t)(pdu_length - LLCP_PDU_HEADER_SIZE), p_info);
     } else if ((ptype == LLCP_PDU_UI_TYPE) &&
                (pdu_length > LLCP_PDU_HEADER_SIZE)) {
-      llcp_link_proc_ui_pdu(dsap, ssap, pdu_length, p, NULL);
+      llcp_link_proc_ui_pdu(dsap, ssap, pdu_length, p, nullptr);
     } else if (ptype == LLCP_PDU_I_TYPE) {
-      llcp_dlc_proc_i_pdu(dsap, ssap, pdu_length, p, NULL);
+      llcp_dlc_proc_i_pdu(dsap, ssap, pdu_length, p, nullptr);
     } else /* let data link connection handle PDU */
     {
       llcp_dlc_proc_rx_pdu(dsap, ptype, ssap,
@@ -1230,12 +1229,12 @@
       break;
 
     case LLCP_PDU_UI_TYPE:
-      llcp_link_proc_ui_pdu(dsap, ssap, 0, NULL, p_msg);
+      llcp_link_proc_ui_pdu(dsap, ssap, 0, nullptr, p_msg);
       free_buffer = false;
       break;
 
     case LLCP_PDU_I_TYPE:
-      llcp_dlc_proc_i_pdu(dsap, ssap, 0, NULL, p_msg);
+      llcp_dlc_proc_i_pdu(dsap, ssap, 0, nullptr, p_msg);
       free_buffer = false;
       break;
 
@@ -1372,7 +1371,7 @@
     if (length_only) {
       p_msg = (NFC_HDR*)llcp_cb.lcb.sig_xmit_q.p_first;
       *p_next_pdu_length = p_msg->len;
-      return NULL;
+      return nullptr;
     } else
       p_msg = (NFC_HDR*)GKI_dequeue(&llcp_cb.lcb.sig_xmit_q);
 
@@ -1393,7 +1392,7 @@
                */
               p_msg = (NFC_HDR*)p_app_cb->ui_xmit_q.p_first;
               *p_next_pdu_length = p_msg->len;
-              return NULL;
+              return nullptr;
             } else {
               /* check data link connection first in next time */
               llcp_cb.lcb.ll_served = !llcp_cb.lcb.ll_served;
@@ -1427,7 +1426,7 @@
               if (*p_next_pdu_length > 0) {
                 /* don't change data link connection to return the same length
                  * of PDU */
-                return NULL;
+                return nullptr;
               } else {
                 /* no data, so check next data link connection */
                 llcp_cb.lcb.dl_idx =
@@ -1463,7 +1462,7 @@
 
   /* nothing to send */
   *p_next_pdu_length = 0;
-  return NULL;
+  return nullptr;
 }
 
 /*******************************************************************************
@@ -1477,7 +1476,7 @@
 **
 *******************************************************************************/
 static NFC_HDR* llcp_link_build_next_pdu(NFC_HDR* p_pdu) {
-  NFC_HDR *p_agf = NULL, *p_msg = NULL, *p_next_pdu;
+  NFC_HDR *p_agf = nullptr, *p_msg = nullptr, *p_next_pdu;
   uint8_t *p, ptype;
   uint16_t next_pdu_length, pdu_hdr;
 
@@ -1504,7 +1503,7 @@
     p_msg = llcp_link_get_next_pdu(false, &next_pdu_length);
 
     if (!p_msg) {
-      return NULL;
+      return nullptr;
     }
   }
 
@@ -1579,10 +1578,7 @@
 **
 *******************************************************************************/
 static void llcp_link_send_to_lower(NFC_HDR* p_pdu) {
-  DispLLCP(p_pdu, false);
-
   llcp_cb.lcb.symm_state = LLCP_LINK_SYMM_REMOTE_XMIT_NEXT;
-
   NFC_SendData(NFC_RF_CONN_ID, p_pdu);
 }
 
@@ -1598,7 +1594,6 @@
 void llcp_link_connection_cback(__attribute__((unused)) uint8_t conn_id,
                                 tNFC_CONN_EVT event, tNFC_CONN* p_data) {
   if (event == NFC_DATA_CEVT) {
-    DispLLCP((NFC_HDR*)p_data->data.p_data, true);
     if (llcp_cb.lcb.link_state == LLCP_LINK_STATE_DEACTIVATED) {
       /* respoding SYMM while LLCP is deactivated but RF link is not deactivated
        * yet */
@@ -1633,7 +1628,7 @@
       llcp_link_deactivate(LLCP_LINK_RF_LINK_LOSS_ERR);
     }
 
-    NFC_SetStaticRfCback(NULL);
+    NFC_SetStaticRfCback(nullptr);
   } else if (event == NFC_DATA_START_CEVT) {
     if (llcp_cb.lcb.symm_state == LLCP_LINK_SYMM_REMOTE_XMIT_NEXT) {
       /* LLCP shall stop LTO timer when receiving the first bit of LLC PDU */
diff --git a/src/nfc/llcp/llcp_sdp.cc b/src/nfc/llcp/llcp_sdp.cc
index affa4ff..607786a 100644
--- a/src/nfc/llcp/llcp_sdp.cc
+++ b/src/nfc/llcp/llcp_sdp.cc
@@ -79,7 +79,7 @@
         p, LLCP_GET_PDU_HEADER(LLCP_SAP_SDP, LLCP_PDU_SNL_TYPE, LLCP_SAP_SDP));
 
     GKI_enqueue(&llcp_cb.lcb.sig_xmit_q, llcp_cb.sdp_cb.p_snl);
-    llcp_cb.sdp_cb.p_snl = NULL;
+    llcp_cb.sdp_cb.p_snl = nullptr;
   } else {
     /* Notify DTA after sending out SNL with SDRES not to send SNLs in AGF PDU
      */
@@ -333,7 +333,7 @@
         (llcp_cb.sdp_cb.transac[i].tid == tid)) {
       (*llcp_cb.sdp_cb.transac[i].p_cback)(tid, sap);
 
-      llcp_cb.sdp_cb.transac[i].p_cback = NULL;
+      llcp_cb.sdp_cb.transac[i].p_cback = nullptr;
     }
   }
 }
@@ -358,14 +358,14 @@
     if (llcp_cb.sdp_cb.transac[i].p_cback) {
       (*llcp_cb.sdp_cb.transac[i].p_cback)(llcp_cb.sdp_cb.transac[i].tid, 0x00);
 
-      llcp_cb.sdp_cb.transac[i].p_cback = NULL;
+      llcp_cb.sdp_cb.transac[i].p_cback = nullptr;
     }
   }
 
   /* free any pending SNL PDU */
   if (llcp_cb.sdp_cb.p_snl) {
     GKI_freebuf(llcp_cb.sdp_cb.p_snl);
-    llcp_cb.sdp_cb.p_snl = NULL;
+    llcp_cb.sdp_cb.p_snl = nullptr;
   }
 
   llcp_cb.sdp_cb.next_tid = 0;
diff --git a/src/nfc/llcp/llcp_util.cc b/src/nfc/llcp/llcp_util.cc
index 7c5d851..80709e0 100644
--- a/src/nfc/llcp/llcp_util.cc
+++ b/src/nfc/llcp/llcp_util.cc
@@ -345,7 +345,7 @@
 **
 ******************************************************************************/
 tLLCP_DLCB* llcp_util_allocate_data_link(uint8_t reg_sap, uint8_t remote_sap) {
-  tLLCP_DLCB* p_dlcb = NULL;
+  tLLCP_DLCB* p_dlcb = nullptr;
   int idx;
 
   DLOG_IF(INFO, nfc_debug_enabled)
@@ -868,7 +868,7 @@
 **
 *******************************************************************************/
 tLLCP_APP_CB* llcp_util_get_app_cb(uint8_t local_sap) {
-  tLLCP_APP_CB* p_app_cb = NULL;
+  tLLCP_APP_CB* p_app_cb = nullptr;
 
   if (local_sap <= LLCP_UPPER_BOUND_WK_SAP) {
     if ((local_sap != LLCP_SAP_LM) && (local_sap < LLCP_MAX_WKS)) {
diff --git a/src/nfc/nci/nci_hmsgs.cc b/src/nfc/nci/nci_hmsgs.cc
index 245b06a..885ebaa 100644
--- a/src/nfc/nci/nci_hmsgs.cc
+++ b/src/nfc/nci/nci_hmsgs.cc
@@ -44,7 +44,7 @@
   uint8_t* pp;
 
   p = NCI_GET_CMD_BUF(NCI_CORE_PARAM_SIZE_RESET);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_CORE_PARAM_SIZE_RESET;
@@ -74,7 +74,7 @@
   NFC_HDR* p;
   uint8_t* pp;
 
-  if ((p = NCI_GET_CMD_BUF(NCI_CORE_PARAM_SIZE_INIT(nci_version))) == NULL)
+  if ((p = NCI_GET_CMD_BUF(NCI_CORE_PARAM_SIZE_INIT(nci_version))) == nullptr)
     return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
@@ -109,7 +109,7 @@
   uint8_t* pp;
 
   p = NCI_GET_CMD_BUF(num_ids);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + num_ids + 1;
@@ -142,7 +142,7 @@
   uint8_t num = 0, ulen, len, *pt;
 
   p = NCI_GET_CMD_BUF(tlv_size + 1);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + tlv_size + 1;
@@ -191,7 +191,7 @@
   uint8_t size = NCI_CORE_PARAM_SIZE_CON_CREATE + tlv_size;
 
   p = NCI_GET_CMD_BUF(size);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_CORE_PARAM_SIZE_CON_CREATE;
@@ -227,7 +227,7 @@
   uint8_t* pp;
 
   p = NCI_GET_CMD_BUF(NCI_CORE_PARAM_SIZE_CON_CLOSE);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_CORE_PARAM_SIZE_CON_CLOSE;
@@ -261,7 +261,7 @@
   uint8_t* pp;
 
   p = NCI_GET_CMD_BUF(NCI_PARAM_SIZE_DISCOVER_NFCEE(NFC_GetNCIVersion()));
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len =
@@ -295,7 +295,7 @@
   uint8_t* pp;
 
   p = NCI_GET_CMD_BUF(NCI_CORE_PARAM_SIZE_NFCEE_MODE_SET);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_CORE_PARAM_SIZE_NFCEE_MODE_SET;
@@ -328,7 +328,7 @@
   NFC_HDR* p;
   uint8_t* pp;
 
-  if ((p = NCI_GET_CMD_BUF(0)) == NULL) return (NCI_STATUS_FAILED);
+  if ((p = NCI_GET_CMD_BUF(0)) == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->offset = NCI_MSG_OFFSET_SIZE;
@@ -363,7 +363,7 @@
 
   size = num * sizeof(tNCI_DISCOVER_PARAMS) + 1;
   p = NCI_GET_CMD_BUF(size);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->offset = NCI_MSG_OFFSET_SIZE;
@@ -403,7 +403,7 @@
   uint8_t* pp;
 
   p = NCI_GET_CMD_BUF(NCI_DISCOVER_PARAM_SIZE_SELECT);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_DISCOVER_PARAM_SIZE_SELECT;
@@ -439,7 +439,7 @@
   nfc_cb.reassembly = true;
 
   p = NCI_GET_CMD_BUF(NCI_DISCOVER_PARAM_SIZE_DEACT);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_DISCOVER_PARAM_SIZE_DEACT;
@@ -475,7 +475,7 @@
   size = num * sizeof(tNCI_DISCOVER_MAPS) + 1;
 
   p = NCI_GET_CMD_BUF(size);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->offset = NCI_MSG_OFFSET_SIZE;
@@ -513,7 +513,7 @@
   uint8_t* pp;
 
   p = NCI_GET_CMD_BUF(NCI_RF_PARAM_SIZE_T3T_POLLING);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_RF_PARAM_SIZE_T3T_POLLING;
@@ -548,7 +548,7 @@
   uint8_t num = 0, ulen, len, *pt;
 
   p = NCI_GET_CMD_BUF(tlv_size + 1);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + tlv_size + 1;
@@ -594,7 +594,7 @@
 uint8_t nci_snd_nfcee_power_link_control(uint8_t nfcee_id, uint8_t pl_config) {
   uint8_t* pp;
   NFC_HDR* p = NCI_GET_CMD_BUF(NCI_CORE_PARAM_SIZE_NFCEE_PL_CTRL);
-  if (p == NULL) return NCI_STATUS_FAILED;
+  if (p == nullptr) return NCI_STATUS_FAILED;
 
   p->event = NFC_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + NCI_CORE_PARAM_SIZE_NFCEE_PL_CTRL;
@@ -637,7 +637,7 @@
   }
 
   p = NCI_GET_CMD_BUF(size);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->offset = NCI_MSG_OFFSET_SIZE;
@@ -673,7 +673,7 @@
   NFC_HDR* p = NCI_GET_CMD_BUF(NCI_CORE_PARAM_SIZE_SET_POWER_SUB_STATE);
   uint8_t* pp;
 
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->offset = NCI_MSG_OFFSET_SIZE;
@@ -706,7 +706,7 @@
   uint8_t param_size = 0;
 
   p = NCI_GET_CMD_BUF(param_size);
-  if (p == NULL) return (NCI_STATUS_FAILED);
+  if (p == nullptr) return (NCI_STATUS_FAILED);
 
   p->event = BT_EVT_TO_NFC_NCI;
   p->len = NCI_MSG_HDR_SIZE + param_size;
diff --git a/src/nfc/nci/nci_hrcv.cc b/src/nfc/nci/nci_hrcv.cc
index e42d04c..fdef020 100644
--- a/src/nfc/nci/nci_hrcv.cc
+++ b/src/nfc/nci/nci_hrcv.cc
@@ -116,12 +116,18 @@
 
   /* find the start of the NCI message and parse the NCI header */
   p = (uint8_t*)(p_msg + 1) + p_msg->offset;
+  len = p_msg->len;
   pp = p + 1;
+
+  if (len == 0) {
+    LOG(ERROR) << __func__ << ": Invalid packet length";
+    return;
+  }
   NCI_MSG_PRS_HDR1(pp, op_code);
   DLOG_IF(INFO, nfc_debug_enabled)
       << StringPrintf("nci_proc_core_ntf opcode:0x%x", op_code);
-  len = *pp++;
-
+  pp++;
+  len--;
   /* process the message based on the opcode and message type */
   switch (op_code) {
     case NCI_MSG_CORE_RESET:
@@ -354,7 +360,7 @@
       event = NFC_NFCEE_PL_CONTROL_REVT;
       break;
     default:
-      p_cback = NULL;
+      p_cback = nullptr;
       LOG(ERROR) << StringPrintf("unknown opcode:0x%x", op_code);
       break;
   }
@@ -439,7 +445,7 @@
     nfc_response.nfcee_status.nfcee_id = *pp++;
     nfc_response.nfcee_status.nfcee_status = *pp;
   } else {
-    p_cback = NULL;
+    p_cback = nullptr;
     LOG(ERROR) << StringPrintf("unknown opcode:0x%x", op_code);
   }
 
@@ -498,7 +504,7 @@
    * callback function */
   if (p_cback) {
     (*p_cback)((tNFC_VS_EVT)(NCI_RSP_BIT | op_code), p_msg->len, p_evt);
-    nfc_cb.p_vsc_cback = NULL;
+    nfc_cb.p_vsc_cback = nullptr;
   }
   nfc_cb.rawVsCbflag = false;
   nfc_ncif_update_window();
diff --git a/src/nfc/ndef/ndef_utils.cc b/src/nfc/ndef/ndef_utils.cc
index 89eb6ff..128cb69 100644
--- a/src/nfc/ndef/ndef_utils.cc
+++ b/src/nfc/ndef/ndef_utils.cc
@@ -81,7 +81,7 @@
   uint32_t payload_len;
   bool bInChunk = false;
 
-  if ((p_msg == NULL) || (msg_len < 3)) return (NDEF_MSG_TOO_SHORT);
+  if ((p_msg == nullptr) || (msg_len < 3)) return (NDEF_MSG_TOO_SHORT);
 
   /* The first record must have the MB bit set */
   if ((*p_msg & NDEF_MB_MASK) == 0) return (NDEF_MSG_NO_MSG_BEGIN);
@@ -331,7 +331,7 @@
   rec_hdr = *p_cur_rec++;
 
   /* If this is the last record, return NULL */
-  if (rec_hdr & NDEF_ME_MASK) return (NULL);
+  if (rec_hdr & NDEF_ME_MASK) return (nullptr);
 
   /* Type field length */
   type_len = *p_cur_rec++;
@@ -375,7 +375,7 @@
 
     rec_hdr = *p_rec++;
 
-    if (rec_hdr & NDEF_ME_MASK) return (NULL);
+    if (rec_hdr & NDEF_ME_MASK) return (nullptr);
 
     /* Type field length */
     type_len = *p_rec++;
@@ -397,7 +397,7 @@
   }
 
   /* If here, there is no record of that index */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -489,14 +489,14 @@
       return (pRecStart);
 
     /* If this was the last record, return NULL */
-    if (rec_hdr & NDEF_ME_MASK) return (NULL);
+    if (rec_hdr & NDEF_ME_MASK) return (nullptr);
 
     /* Point to next record */
     p_rec += (payload_len + type_len + id_len);
   }
 
   /* If here, there is no record of that type */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -518,7 +518,7 @@
 
   /* If this is the last record in the message, return NULL */
   p_rec = NDEF_MsgGetNextRec(p_cur_rec);
-  if (p_rec == NULL) return (NULL);
+  if (p_rec == nullptr) return (nullptr);
 
   for (;;) {
     pRecStart = p_rec;
@@ -554,7 +554,7 @@
   }
 
   /* If here, there is no record of that type */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -601,14 +601,14 @@
     if ((id_len == ilen) && (!memcmp(p_rec, p_id, ilen))) return (pRecStart);
 
     /* If this was the last record, return NULL */
-    if (rec_hdr & NDEF_ME_MASK) return (NULL);
+    if (rec_hdr & NDEF_ME_MASK) return (nullptr);
 
     /* Point to next record */
     p_rec += (id_len + payload_len);
   }
 
   /* If here, there is no record of that ID */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -630,7 +630,7 @@
 
   /* If this is the last record in the message, return NULL */
   p_rec = NDEF_MsgGetNextRec(p_cur_rec);
-  if (p_rec == NULL) return (NULL);
+  if (p_rec == nullptr) return (nullptr);
 
   for (;;) {
     pRecStart = p_rec;
@@ -667,7 +667,7 @@
   }
 
   /* If here, there is no record of that ID */
-  return (NULL);
+  return (nullptr);
 }
 
 /*******************************************************************************
@@ -703,7 +703,7 @@
   *p_tnf = rec_hdr & NDEF_TNF_MASK;
 
   if (type_len == 0)
-    return (NULL);
+    return (nullptr);
   else
     return (p_rec);
 }
@@ -741,7 +741,7 @@
 
   /* p_rec now points to the start of the type field. The ID field follows it */
   if (*p_id_len == 0)
-    return (NULL);
+    return (nullptr);
   else
     return (p_rec + type_len);
 }
@@ -784,7 +784,7 @@
   /* p_rec now points to the start of the type field. The ID field follows it,
    * then the payload */
   if (payload_len == 0)
-    return (NULL);
+    return (nullptr);
   else
     return (p_rec + type_len + id_len);
 }
@@ -1266,7 +1266,7 @@
   if (*p_rec & NDEF_MB_MASK) {
     /* Find the second record (if any) and set his 'Message Begin' bit */
     pNext = NDEF_MsgGetRecByIndex(p_msg, 1);
-    if (pNext != NULL) {
+    if (pNext != nullptr) {
       *pNext |= NDEF_MB_MASK;
 
       *p_cur_size -= (uint32_t)(pNext - p_msg);
@@ -1283,7 +1283,7 @@
     if (index > 0) {
       /* Find the previous record and set his 'Message End' bit */
       pPrev = NDEF_MsgGetRecByIndex(p_msg, index - 1);
-      if (pPrev == NULL) return false;
+      if (pPrev == nullptr) return false;
 
       *pPrev |= NDEF_ME_MASK;
     }
@@ -1294,7 +1294,7 @@
 
   /* Not the first or the last... get the address of the next record */
   pNext = NDEF_MsgGetNextRec(p_rec);
-  if (pNext == NULL) return false;
+  if (pNext == nullptr) return false;
 
   /* We are removing p_rec, so shift from pNext to the end */
   shiftup(p_rec, pNext, (uint32_t)(*p_cur_size - (pNext - p_msg)));
@@ -1339,7 +1339,7 @@
   p_rec = p_src;
 
   /* Now, copy record by record */
-  while ((p_rec != NULL) && (status == NDEF_OK)) {
+  while ((p_rec != nullptr) && (status == NDEF_OK)) {
     p_type = NDEF_RecGetType(p_rec, &tnf, &type_len);
     p_id = NDEF_RecGetId(p_rec, &id_len);
     p_pay = NDEF_RecGetPayload(p_rec, &pay_len);
diff --git a/src/nfc/nfc/nfc_main.cc b/src/nfc/nfc/nfc_main.cc
index 77c0485..a1a2c7f 100644
--- a/src/nfc/nfc/nfc_main.cc
+++ b/src/nfc/nfc/nfc_main.cc
@@ -291,7 +291,7 @@
       STREAM_TO_ARRAY(evt_data.enable.nfcc_info, p, NFC_NFCC_INFO_LEN);
     }
     NFC_DiscoveryMap(nfc_cb.num_disc_maps,
-                     (tNCI_DISCOVER_MAPS*)nfc_cb.p_disc_maps, NULL);
+                     (tNCI_DISCOVER_MAPS*)nfc_cb.p_disc_maps, nullptr);
   }
   /* else not successful. the buffers will be freed in nfc_free_conn_cb () */
   else {
@@ -346,7 +346,7 @@
   if (nfc_cb.flags & NFC_FL_DISCOVER_PENDING) {
     nfc_cb.flags &= ~NFC_FL_DISCOVER_PENDING;
     GKI_freebuf(nfc_cb.p_disc_pending);
-    nfc_cb.p_disc_pending = NULL;
+    nfc_cb.p_disc_pending = nullptr;
   }
 
   nfc_cb.flags &= ~(NFC_FL_CONTROL_REQUESTED | NFC_FL_CONTROL_GRANTED |
@@ -359,7 +359,7 @@
 
   if (nfc_cb.p_nci_init_rsp) {
     GKI_freebuf(nfc_cb.p_nci_init_rsp);
-    nfc_cb.p_nci_init_rsp = NULL;
+    nfc_cb.p_nci_init_rsp = nullptr;
   }
 
   /* clear any pending CMD/RSP */
@@ -381,7 +381,7 @@
 
   switch (p_msg->hal_evt) {
     case HAL_NFC_OPEN_CPLT_EVT: /* only for failure case */
-      nfc_enabled(NFC_STATUS_FAILED, NULL);
+      nfc_enabled(NFC_STATUS_FAILED, nullptr);
       break;
 
     case HAL_NFC_CLOSE_CPLT_EVT:
@@ -390,11 +390,11 @@
           if (nfc_cb.flags & NFC_FL_POWER_OFF_SLEEP) {
             nfc_cb.flags &= ~NFC_FL_POWER_OFF_SLEEP;
             nfc_set_state(NFC_STATE_NFCC_POWER_OFF_SLEEP);
-            (*nfc_cb.p_resp_cback)(NFC_NFCC_POWER_OFF_REVT, NULL);
+            (*nfc_cb.p_resp_cback)(NFC_NFCC_POWER_OFF_REVT, nullptr);
           } else {
             nfc_set_state(NFC_STATE_NONE);
-            (*nfc_cb.p_resp_cback)(NFC_DISABLE_REVT, NULL);
-            nfc_cb.p_resp_cback = NULL;
+            (*nfc_cb.p_resp_cback)(NFC_DISABLE_REVT, nullptr);
+            nfc_cb.p_resp_cback = nullptr;
           }
         } else {
           /* found error during initialization */
@@ -415,12 +415,12 @@
             nfc_enabled(NCI_STATUS_OK, nfc_cb.p_nci_init_rsp);
           } else /* if post initailization failed */
           {
-            nfc_enabled(NCI_STATUS_FAILED, NULL);
+            nfc_enabled(NCI_STATUS_FAILED, nullptr);
           }
         }
 
         GKI_freebuf(nfc_cb.p_nci_init_rsp);
-        nfc_cb.p_nci_init_rsp = NULL;
+        nfc_cb.p_nci_init_rsp = nullptr;
       }
       break;
 
@@ -435,10 +435,10 @@
         ps = (uint8_t*)nfc_cb.p_disc_pending;
         nci_snd_discover_cmd(*ps, (tNFC_DISCOVER_PARAMS*)(ps + 1));
         GKI_freebuf(nfc_cb.p_disc_pending);
-        nfc_cb.p_disc_pending = NULL;
+        nfc_cb.p_disc_pending = nullptr;
       } else {
         /* check if there's other pending commands */
-        nfc_ncif_check_cmd_queue(NULL);
+        nfc_ncif_check_cmd_queue(nullptr);
       }
 
       if (p_msg->status == HAL_NFC_STATUS_ERR_CMD_TIMEOUT)
@@ -448,14 +448,14 @@
     case HAL_NFC_REQUEST_CONTROL_EVT:
       nfc_cb.flags |= NFC_FL_CONTROL_REQUESTED;
       nfc_cb.flags |= NFC_FL_HAL_REQUESTED;
-      nfc_ncif_check_cmd_queue(NULL);
+      nfc_ncif_check_cmd_queue(nullptr);
       break;
 
     case HAL_NFC_RELEASE_CONTROL_EVT:
       if (nfc_cb.flags & NFC_FL_CONTROL_GRANTED) {
         nfc_cb.flags &= ~NFC_FL_CONTROL_GRANTED;
         nfc_cb.nci_cmd_window = NCI_MAX_CMD_WINDOW;
-        nfc_ncif_check_cmd_queue(NULL);
+        nfc_ncif_check_cmd_queue(nullptr);
 
         if (p_msg->status == HAL_NFC_STATUS_ERR_CMD_TIMEOUT)
           nfc_ncif_event_status(NFC_NFCC_TIMEOUT_REVT, NFC_STATUS_HW_TIMEOUT);
@@ -467,12 +467,12 @@
         case HAL_NFC_STATUS_ERR_TRANSPORT:
           /* Notify app of transport error */
           if (nfc_cb.p_resp_cback) {
-            (*nfc_cb.p_resp_cback)(NFC_NFCC_TRANSPORT_ERR_REVT, NULL);
+            (*nfc_cb.p_resp_cback)(NFC_NFCC_TRANSPORT_ERR_REVT, nullptr);
 
             /* if enabling NFC, notify upper layer of failure after closing HAL
              */
             if (nfc_cb.nfc_state < NFC_STATE_IDLE) {
-              nfc_enabled(NFC_STATUS_FAILED, NULL);
+              nfc_enabled(NFC_STATUS_FAILED, nullptr);
             }
           }
           break;
@@ -482,7 +482,7 @@
 
           /* if enabling NFC, notify upper layer of failure after closing HAL */
           if (nfc_cb.nfc_state < NFC_STATE_IDLE) {
-            nfc_enabled(NFC_STATUS_FAILED, NULL);
+            nfc_enabled(NFC_STATUS_FAILED, nullptr);
             return;
           }
           break;
@@ -523,7 +523,7 @@
   nfc_stop_timer(&nfc_cb.nci_wait_rsp_timer);
 
   /* dequeue and free buffer */
-  while ((p_msg = (NFC_HDR*)GKI_dequeue(&nfc_cb.nci_cmd_xmit_q)) != NULL) {
+  while ((p_msg = (NFC_HDR*)GKI_dequeue(&nfc_cb.nci_cmd_xmit_q)) != nullptr) {
     GKI_freebuf(p_msg);
   }
 }
@@ -541,7 +541,7 @@
   tNFC_HAL_EVT_MSG* p_msg;
 
   p_msg = (tNFC_HAL_EVT_MSG*)GKI_getbuf(sizeof(tNFC_HAL_EVT_MSG));
-  if (p_msg != NULL) {
+  if (p_msg != nullptr) {
     /* Initialize NFC_HDR */
     p_msg->hdr.len = 0;
     p_msg->hdr.event = BT_EVT_TO_NFC_MSGS;
@@ -621,7 +621,7 @@
 
   if (p_data) {
     p_msg = (NFC_HDR*)GKI_getpoolbuf(NFC_NCI_POOL_ID);
-    if (p_msg != NULL) {
+    if (p_msg != nullptr) {
       /* Initialize NFC_HDR */
       p_msg->len = data_len;
       p_msg->event = BT_EVT_TO_NFC_NCI;
@@ -699,8 +699,8 @@
       (nfc_cb.nfc_state == NFC_STATE_NFCC_POWER_OFF_SLEEP)) {
     nfc_set_state(NFC_STATE_NONE);
     if (nfc_cb.p_resp_cback) {
-      (*nfc_cb.p_resp_cback)(NFC_DISABLE_REVT, NULL);
-      nfc_cb.p_resp_cback = NULL;
+      (*nfc_cb.p_resp_cback)(NFC_DISABLE_REVT, nullptr);
+      nfc_cb.p_resp_cback = nullptr;
     }
     return;
   }
@@ -901,7 +901,7 @@
       *p++ = num_params;
       memcpy(p, p_params, params_size);
       status = NFC_STATUS_CMD_STARTED;
-      nfc_ncif_check_cmd_queue(NULL);
+      nfc_ncif_check_cmd_queue(nullptr);
     }
   }
 
@@ -1095,7 +1095,7 @@
 
   if (p_cb) {
     status = NFC_STATUS_OK;
-    while ((p_buf = GKI_dequeue(&p_cb->tx_q)) != NULL) GKI_freebuf(p_buf);
+    while ((p_buf = GKI_dequeue(&p_cb->tx_q)) != nullptr) GKI_freebuf(p_buf);
   }
 
   return status;
@@ -1136,7 +1136,7 @@
       nfc_cb.flags &= ~NFC_FL_CONTROL_REQUESTED;
     }
     GKI_freebuf(nfc_cb.p_disc_pending);
-    nfc_cb.p_disc_pending = NULL;
+    nfc_cb.p_disc_pending = nullptr;
     return NFC_STATUS_OK;
   }
 
diff --git a/src/nfc/nfc/nfc_ncif.cc b/src/nfc/nfc/nfc_ncif.cc
index 0757b40..0322a97 100644
--- a/src/nfc/nfc/nfc_ncif.cc
+++ b/src/nfc/nfc/nfc_ncif.cc
@@ -38,6 +38,9 @@
 #include "rw_api.h"
 #include "rw_int.h"
 
+#include <statslog.h>
+#include "metrics.h"
+
 using android::base::StringPrintf;
 
 #if (NFC_RW_ONLY == FALSE)
@@ -54,6 +57,9 @@
 extern unsigned char appl_dta_mode_flag;
 extern bool nfc_debug_enabled;
 
+static struct timeval timer_start;
+static struct timeval timer_end;
+
 /*******************************************************************************
 **
 ** Function         nfc_ncif_update_window
@@ -75,11 +81,11 @@
   /* Stop command-pending timer */
   nfc_stop_timer(&nfc_cb.nci_wait_rsp_timer);
 
-  nfc_cb.p_vsc_cback = NULL;
+  nfc_cb.p_vsc_cback = nullptr;
   nfc_cb.nci_cmd_window++;
 
   /* Check if there were any commands waiting to be sent */
-  nfc_ncif_check_cmd_queue(NULL);
+  nfc_ncif_check_cmd_queue(nullptr);
 }
 
 /*******************************************************************************
@@ -100,7 +106,7 @@
 
   /* if enabling NFC, notify upper layer of failure */
   if (nfc_cb.nfc_state == NFC_STATE_CORE_INIT) {
-    nfc_enabled(NFC_STATUS_FAILED, NULL);
+    nfc_enabled(NFC_STATUS_FAILED, nullptr);
   }
 
   /* XXX maco since this failure is unrecoverable, abort the process */
@@ -149,7 +155,7 @@
   if (p_cb->id == NFC_RF_CONN_ID) {
     if (nfc_cb.nfc_state != NFC_STATE_OPEN) {
       if (nfc_cb.nfc_state == NFC_STATE_CLOSING) {
-        if ((p_data == NULL) && /* called because credit from NFCC */
+        if ((p_data == nullptr) && /* called because credit from NFCC */
             (nfc_cb.flags & NFC_FL_DEACTIVATING)) {
           if (p_cb->init_credits == p_cb->num_buff) {
             /* all the credits are back */
@@ -194,7 +200,7 @@
        * prepare a new GKI buffer
        * (even the last fragment to avoid issues) */
       p = NCI_GET_CMD_BUF(ulen);
-      if (p == NULL) return (NCI_STATUS_BUFFER_FULL);
+      if (p == nullptr) return (NCI_STATUS_BUFFER_FULL);
       p->len = ulen;
       p->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE + 1;
       if (p->len) {
@@ -227,6 +233,16 @@
     }
   }
 
+  // log duration for the first hce data response
+  if (timer_start.tv_sec != 0 || timer_start.tv_usec != 0) {
+    gettimeofday(&timer_end, nullptr);
+    uint32_t delta_time_ms = (timer_end.tv_sec - timer_start.tv_sec) * 1000 +
+                             (timer_end.tv_usec - timer_start.tv_usec) / 1000;
+    memset(&timer_start, 0, sizeof(timer_start));
+    memset(&timer_end, 0, sizeof(timer_end));
+    android::util::stats_write(android::util::NFC_HCE_TRANSACTION_OCCURRED,
+                               (int32_t)delta_time_ms);
+  }
   return (NCI_STATUS_OK);
 }
 
@@ -247,7 +263,7 @@
   if (p_buf) {
     if ((nfc_cb.nci_cmd_xmit_q.count) || (nfc_cb.nci_cmd_window == 0)) {
       GKI_enqueue(&nfc_cb.nci_cmd_xmit_q, p_buf);
-      p_buf = NULL;
+      p_buf = nullptr;
     }
   }
 
@@ -300,7 +316,7 @@
           ps = (uint8_t*)nfc_cb.p_disc_pending;
           nci_snd_discover_cmd(*ps, (tNFC_DISCOVER_PARAMS*)(ps + 1));
           GKI_freebuf(nfc_cb.p_disc_pending);
-          nfc_cb.p_disc_pending = NULL;
+          nfc_cb.p_disc_pending = nullptr;
         }
       } else if (nfc_cb.flags & NFC_FL_HAL_REQUESTED) {
         /* grant the control to HAL */
@@ -522,8 +538,13 @@
 *******************************************************************************/
 void nfc_ncif_event_status(tNFC_RESPONSE_EVT event, uint8_t status) {
   tNFC_RESPONSE evt_data;
-  if (event == NFC_NFCC_TIMEOUT_REVT && status == NFC_STATUS_HW_TIMEOUT)
+  if (event == NFC_NFCC_TIMEOUT_REVT && status == NFC_STATUS_HW_TIMEOUT) {
     android::metricslogger::LogCounter("nfc_hw_timeout_error", 1);
+    uint32_t cmd_hdr = (nfc_cb.last_hdr[0] << 8) | nfc_cb.last_hdr[1];
+    android::util::stats_write(android::util::NFC_ERROR_OCCURRED,
+                               (int32_t)NCI_TIMEOUT, (int32_t)cmd_hdr,
+                               (int32_t)status);
+  }
   if (nfc_cb.p_resp_cback) {
     evt_data.status = (tNFC_STATUS)status;
     (*nfc_cb.p_resp_cback)(event, &evt_data);
@@ -547,6 +568,9 @@
     nfc_conn.status = status;
     (*p_cb->p_cback)(conn_id, NFC_ERROR_CEVT, &nfc_conn);
   }
+  android::util::stats_write(android::util::NFC_ERROR_OCCURRED,
+                             (int32_t)ERROR_NTF, (int32_t)0, (int32_t)status);
+
   if (status == NFC_STATUS_TIMEOUT)
     android::metricslogger::LogCounter("nfc_rf_timeout_error", 1);
   else if (status == NFC_STATUS_EE_TIMEOUT)
@@ -594,31 +618,38 @@
 ** Returns          void
 **
 *******************************************************************************/
-void nfc_ncif_proc_credits(uint8_t* p, __attribute__((unused)) uint16_t plen) {
+void nfc_ncif_proc_credits(uint8_t* p, uint16_t plen) {
   uint8_t num, xx;
   tNFC_CONN_CB* p_cb;
 
-  num = *p++;
-  for (xx = 0; xx < num; xx++) {
-    p_cb = nfc_find_conn_cb_by_conn_id(*p++);
-    if (p_cb && p_cb->num_buff != NFC_CONN_NO_FC) {
-      p_cb->num_buff += (*p);
-#if (BT_USE_TRACES == TRUE)
-      if (p_cb->num_buff > p_cb->init_credits) {
-        if (nfc_cb.nfc_state == NFC_STATE_OPEN) {
-          /* if this happens in activated state, it's very likely that our NFCC
-           * has issues */
-          /* However, credit may be returned after deactivation */
-          LOG(ERROR) << StringPrintf("num_buff:0x%x, init_credits:0x%x",
-                                     p_cb->num_buff, p_cb->init_credits);
-        }
-        p_cb->num_buff = p_cb->init_credits;
-      }
-#endif
-      /* check if there's nay data in tx q to be sent */
-      nfc_ncif_send_data(p_cb, NULL);
+  if (plen != 0) {
+    num = *p++;
+    plen--;
+    if (num > plen) {
+      android_errorWriteLog(0x534e4554, "118148142");
+      return;
     }
-    p++;
+    for (xx = 0; xx < num; xx++) {
+      p_cb = nfc_find_conn_cb_by_conn_id(*p++);
+      if (p_cb && p_cb->num_buff != NFC_CONN_NO_FC) {
+        p_cb->num_buff += (*p);
+#if (BT_USE_TRACES == TRUE)
+        if (p_cb->num_buff > p_cb->init_credits) {
+          if (nfc_cb.nfc_state == NFC_STATE_OPEN) {
+            /* if this happens in activated state, it's very likely that our
+             * NFCC has issues */
+            /* However, credit may be returned after deactivation */
+            LOG(ERROR) << StringPrintf("num_buff:0x%x, init_credits:0x%x",
+                                       p_cb->num_buff, p_cb->init_credits);
+          }
+          p_cb->num_buff = p_cb->init_credits;
+        }
+#endif
+        /* check if there's nay data in tx q to be sent */
+        nfc_ncif_send_data(p_cb, nullptr);
+      }
+      p++;
+    }
   }
 }
 /*******************************************************************************
@@ -922,6 +953,7 @@
 
       case NCI_DISCOVERY_TYPE_LISTEN_A:
         p_intf->intf_param.la_iso.rats = *p++;
+        gettimeofday(&timer_start, nullptr);
         break;
 
       case NCI_DISCOVERY_TYPE_POLL_B:
@@ -972,6 +1004,7 @@
                  &p_lb_iso->attrib_req[NFC_LB_ATTRIB_REQ_FIXED_BYTES],
                  p_lb_iso->hi_info_len);
         }
+        gettimeofday(&timer_start, nullptr);
         break;
     }
 
@@ -983,12 +1016,32 @@
     if (buff_size > NCI_NFC_DEP_MAX_DATA) buff_size = NCI_NFC_DEP_MAX_DATA;
 
     p_pa_nfc = &p_intf->intf_param.pa_nfc;
-    p_pa_nfc->atr_res_len = *p++;
+
+    /* Active mode, no info in activation parameters (NCI 2.0) */
+    if ((NFC_GetNCIVersion() == NCI_VERSION_2_0) &&
+        ((mode == NCI_DISCOVERY_TYPE_POLL_ACTIVE) ||
+         (mode == NCI_DISCOVERY_TYPE_LISTEN_ACTIVE))) {
+        p_pa_nfc->atr_res_len =
+                  evt_data.activate.rf_tech_param.param.acm_p.atr_res_len;
+    } else {
+      p_pa_nfc->atr_res_len = *p++;
+    }
 
     if (p_pa_nfc->atr_res_len > 0) {
       if (p_pa_nfc->atr_res_len > NFC_MAX_ATS_LEN)
         p_pa_nfc->atr_res_len = NFC_MAX_ATS_LEN;
-      STREAM_TO_ARRAY(p_pa_nfc->atr_res, p, p_pa_nfc->atr_res_len);
+
+      if ((NFC_GetNCIVersion() == NCI_VERSION_2_0) &&
+          ((mode == NCI_DISCOVERY_TYPE_POLL_ACTIVE) ||
+           (mode == NCI_DISCOVERY_TYPE_LISTEN_ACTIVE))) {
+         /* NCI 2.0 : ATR_RES is included in RF technology parameters in active mode */
+          memcpy(p_pa_nfc->atr_res,
+                         evt_data.activate.rf_tech_param.param.acm_p.atr_res,
+                         p_pa_nfc->atr_res_len);
+          } else {
+             STREAM_TO_ARRAY(p_pa_nfc->atr_res, p, p_pa_nfc->atr_res_len);
+         }
+
       if ((mode == NCI_DISCOVERY_TYPE_POLL_A) ||
           (mode == NCI_DISCOVERY_TYPE_POLL_F) ||
           ((mode == NCI_DISCOVERY_TYPE_POLL_A_ACTIVE ||
@@ -1073,11 +1126,11 @@
     evt_data.deactivate.reason = nfc_cb.deact_reason;
   }
 
-  while ((p_data = GKI_dequeue(&p_cb->rx_q)) != NULL) {
+  while ((p_data = GKI_dequeue(&p_cb->rx_q)) != nullptr) {
     GKI_freebuf(p_data);
   }
 
-  while ((p_data = GKI_dequeue(&p_cb->tx_q)) != NULL) {
+  while ((p_data = GKI_dequeue(&p_cb->tx_q)) != nullptr) {
     GKI_freebuf(p_data);
   }
 
@@ -1090,6 +1143,11 @@
   if (nfc_cb.p_discv_cback) {
     (*nfc_cb.p_discv_cback)(NFC_DEACTIVATE_DEVT, &evt_data);
   }
+
+  // clear previous stored tick count if not comsumed
+  if (timer_start.tv_sec != 0 || timer_start.tv_usec != 0) {
+    memset(&timer_start, 0, sizeof(timer_start));
+  }
 }
 /*******************************************************************************
 **
@@ -1134,7 +1192,7 @@
           tag = *p++;
           ulen = *p++;
           if (ulen > data_len) ulen = data_len;
-          p_data = NULL;
+          p_data = nullptr;
           max_len = ulen;
           switch (tag) {
             case NCI_EE_ACT_TAG_AID: /* AID                 */
@@ -1397,7 +1455,7 @@
     }
   } else {
     LOG(ERROR) << StringPrintf("Failed to reset NFCC");
-    nfc_enabled(status, NULL);
+    nfc_enabled(status, nullptr);
   }
 }
 
@@ -1439,7 +1497,7 @@
       nfc_cb.nci_version = NCI_VERSION_1_0;
       nci_snd_core_reset(NCI_RESET_TYPE_RESET_CFG);
     } else {
-      nfc_enabled(status, NULL);
+      nfc_enabled(status, nullptr);
       GKI_freebuf(p_msg);
     }
   }
@@ -1505,7 +1563,7 @@
   uint8_t* p;
 
   if (p_cb->p_cback) {
-    while ((p_evt = (NFC_HDR*)GKI_getfirst(&p_cb->rx_q)) != NULL) {
+    while ((p_evt = (NFC_HDR*)GKI_getfirst(&p_cb->rx_q)) != nullptr) {
       if (p_evt->layer_specific & NFC_RAS_FRAGMENTED) {
         /* Not the last fragment */
         if (!(p_evt->layer_specific & NFC_RAS_TOO_BIG)) {
@@ -1564,7 +1622,7 @@
       tNFC_CONN nfc_conn;
       nfc_conn.data = data_cevt;
       (*p_cb->p_cback)(p_cb->conn_id, NFC_DATA_CEVT, &nfc_conn);
-      p_evt = NULL;
+      p_evt = nullptr;
     }
   }
 }
@@ -1587,7 +1645,7 @@
   NFC_HDR* p_last;
   uint8_t *ps, *pd;
   uint16_t size;
-  NFC_HDR* p_max = NULL;
+  NFC_HDR* p_max = nullptr;
   uint16_t len;
 
   pp = (uint8_t*)(p_msg + 1) + p_msg->offset;
@@ -1629,7 +1687,7 @@
             p_last = p_max;
           }
         }
-        if (p_max == NULL) {
+        if (p_max == nullptr) {
           /* Biggest GKI Pool not available (or)
            * Biggest available GKI Pool is not big enough to hold the new
            * fragment, p_msg */
@@ -1650,12 +1708,6 @@
             << StringPrintf("nfc_ncif_proc_data len:%d", p_last->len);
         p_last->layer_specific = p_msg->layer_specific;
         GKI_freebuf(p_msg);
-#ifdef DISP_NCI
-        if (!(p_last->layer_specific & NFC_RAS_FRAGMENTED)) {
-          /* this packet was reassembled. display the complete packet */
-          DISP_NCI((uint8_t*)(p_last + 1) + p_last->offset, p_last->len, true);
-        }
-#endif
         nfc_data_event(p_cb);
       } else {
         /* Not enough memory to add new buffer
@@ -1669,7 +1721,7 @@
       if ((p_msg->layer_specific & NFC_RAS_FRAGMENTED) &&
           (p_cb->conn_id == NFC_RF_CONN_ID) && (p_cb->p_cback)) {
         /* Indicate upper layer that local device started receiving data */
-        (*p_cb->p_cback)(p_cb->conn_id, NFC_DATA_START_CEVT, NULL);
+        (*p_cb->p_cback)(p_cb->conn_id, NFC_DATA_START_CEVT, nullptr);
       }
       /* enqueue the new buffer to the rx queue */
       GKI_enqueue(&p_cb->rx_q, p_msg);
diff --git a/src/nfc/nfc/nfc_task.cc b/src/nfc/nfc/nfc_task.cc
index bf0a7a7..19bbb8c 100644
--- a/src/nfc/nfc/nfc_task.cc
+++ b/src/nfc/nfc/nfc_task.cc
@@ -61,12 +61,12 @@
   NFC_HDR* p_msg;
 
   /* if timer list is currently empty, start periodic GKI timer */
-  if (nfc_cb.timer_queue.p_first == NULL) {
+  if (nfc_cb.timer_queue.p_first == nullptr) {
     /* if timer starts on other than NFC task (scritp wrapper) */
     if (GKI_get_taskid() != NFC_TASK) {
       /* post event to start timer in NFC task */
       p_msg = (NFC_HDR*)GKI_getbuf(NFC_HDR_SIZE);
-      if (p_msg != NULL) {
+      if (p_msg != nullptr) {
         p_msg->event = BT_EVT_TO_START_TIMER;
         GKI_send_msg(NFC_TASK, NFC_MBOX_ID, p_msg);
       }
@@ -137,7 +137,7 @@
   }
 
   /* if timer list is empty stop periodic GKI timer */
-  if (nfc_cb.timer_queue.p_first == NULL) {
+  if (nfc_cb.timer_queue.p_first == nullptr) {
     GKI_stop_timer(NFC_TIMER_ID);
   }
 }
@@ -155,7 +155,7 @@
   GKI_remove_from_timer_list(&nfc_cb.timer_queue, p_tle);
 
   /* if timer list is empty stop periodic GKI timer */
-  if (nfc_cb.timer_queue.p_first == NULL) {
+  if (nfc_cb.timer_queue.p_first == nullptr) {
     GKI_stop_timer(NFC_TIMER_ID);
   }
 }
@@ -178,12 +178,12 @@
   NFC_HDR* p_msg;
 
   /* if timer list is currently empty, start periodic GKI timer */
-  if (nfc_cb.quick_timer_queue.p_first == NULL) {
+  if (nfc_cb.quick_timer_queue.p_first == nullptr) {
     /* if timer starts on other than NFC task (scritp wrapper) */
     if (GKI_get_taskid() != NFC_TASK) {
       /* post event to start timer in NFC task */
       p_msg = (NFC_HDR*)GKI_getbuf(NFC_HDR_SIZE);
-      if (p_msg != NULL) {
+      if (p_msg != nullptr) {
         p_msg->event = BT_EVT_TO_START_QUICK_TIMER;
         GKI_send_msg(NFC_TASK, NFC_MBOX_ID, p_msg);
       }
@@ -216,7 +216,7 @@
   GKI_remove_from_timer_list(&nfc_cb.quick_timer_queue, p_tle);
 
   /* if timer list is empty stop periodic GKI timer */
-  if (nfc_cb.quick_timer_queue.p_first == NULL) {
+  if (nfc_cb.quick_timer_queue.p_first == nullptr) {
     GKI_stop_timer(NFC_QUICK_TIMER_ID);
   }
 }
@@ -270,6 +270,10 @@
       case NFC_TTYPE_P2P_PRIO_LOGIC_CLEANUP:
         nfa_dm_p2p_prio_logic_cleanup();
         break;
+      case NFC_TTYPE_RW_MFC_RESPONSE:
+        rw_mfc_process_timeout(p_tle);
+        break;
+
 #if (NFC_RW_ONLY == FALSE)
       case NFC_TTYPE_CE_T4T_UPDATE:
         ce_t4t_process_timeout(p_tle);
@@ -284,7 +288,7 @@
   }
 
   /* if timer list is empty stop periodic GKI timer */
-  if (nfc_cb.quick_timer_queue.p_first == NULL) {
+  if (nfc_cb.quick_timer_queue.p_first == nullptr) {
     GKI_stop_timer(NFC_QUICK_TIMER_ID);
   }
 }
@@ -302,7 +306,7 @@
   NFC_HDR* p_msg;
 
   /* Free any messages still in the mbox */
-  while ((p_msg = (NFC_HDR*)GKI_read_mbox(NFC_MBOX_ID)) != NULL) {
+  while ((p_msg = (NFC_HDR*)GKI_read_mbox(NFC_MBOX_ID)) != nullptr) {
     GKI_freebuf(p_msg);
   }
 
@@ -365,7 +369,7 @@
 
     if (event & NFC_MBOX_EVT_MASK) {
       /* Process all incoming NCI messages */
-      while ((p_msg = (NFC_HDR*)GKI_read_mbox(NFC_MBOX_ID)) != NULL) {
+      while ((p_msg = (NFC_HDR*)GKI_read_mbox(NFC_MBOX_ID)) != nullptr) {
         free_buf = true;
 
         /* Determine the input message type. */
@@ -413,7 +417,7 @@
     }
 
     if (event & NFA_MBOX_EVT_MASK) {
-      while ((p_msg = (NFC_HDR*)GKI_read_mbox(NFA_MBOX_ID)) != NULL) {
+      while ((p_msg = (NFC_HDR*)GKI_read_mbox(NFA_MBOX_ID)) != nullptr) {
         nfa_sys_event(p_msg);
       }
     }
diff --git a/src/nfc/nfc/nfc_utils.cc b/src/nfc/nfc/nfc_utils.cc
index 93fa7c6..7c2103a 100644
--- a/src/nfc/nfc/nfc_utils.cc
+++ b/src/nfc/nfc/nfc_utils.cc
@@ -46,7 +46,7 @@
 *******************************************************************************/
 tNFC_CONN_CB* nfc_alloc_conn_cb(tNFC_CONN_CBACK* p_cback) {
   int xx, max = NCI_MAX_CONN_CBS;
-  tNFC_CONN_CB* p_conn_cb = NULL;
+  tNFC_CONN_CB* p_conn_cb = nullptr;
 
   NFC_CHECK_MAX_CONN();
   for (xx = 0; xx < max; xx++) {
@@ -74,7 +74,7 @@
 void nfc_set_conn_id(tNFC_CONN_CB* p_cb, uint8_t conn_id) {
   uint8_t handle;
 
-  if (p_cb == NULL) return;
+  if (p_cb == nullptr) return;
 
   p_cb->conn_id = conn_id;
   handle = (uint8_t)(p_cb - nfc_cb.conn_cb + 1);
@@ -95,7 +95,7 @@
 *******************************************************************************/
 tNFC_CONN_CB* nfc_find_conn_cb_by_handle(uint8_t id) {
   int xx;
-  tNFC_CONN_CB* p_conn_cb = NULL;
+  tNFC_CONN_CB* p_conn_cb = nullptr;
 
   for (xx = 0; xx < NCI_MAX_CONN_CBS; xx++) {
     if (nfc_cb.conn_cb[xx].id == id) {
@@ -117,7 +117,7 @@
 **
 *******************************************************************************/
 tNFC_CONN_CB* nfc_find_conn_cb_by_conn_id(uint8_t conn_id) {
-  tNFC_CONN_CB* p_conn_cb = NULL;
+  tNFC_CONN_CB* p_conn_cb = nullptr;
   uint8_t handle;
   uint8_t id;
   int xx;
@@ -153,14 +153,14 @@
 void nfc_free_conn_cb(tNFC_CONN_CB* p_cb) {
   void* p_buf;
 
-  if (p_cb == NULL) return;
+  if (p_cb == nullptr) return;
 
-  while ((p_buf = GKI_dequeue(&p_cb->rx_q)) != NULL) GKI_freebuf(p_buf);
+  while ((p_buf = GKI_dequeue(&p_cb->rx_q)) != nullptr) GKI_freebuf(p_buf);
 
-  while ((p_buf = GKI_dequeue(&p_cb->tx_q)) != NULL) GKI_freebuf(p_buf);
+  while ((p_buf = GKI_dequeue(&p_cb->tx_q)) != nullptr) GKI_freebuf(p_buf);
 
   nfc_cb.conn_id[p_cb->conn_id] = 0;
-  p_cb->p_cback = NULL;
+  p_cb->p_cback = nullptr;
   p_cb->conn_id = NFC_ILLEGAL_CONN_ID;
 }
 
diff --git a/src/nfc/nfc/nfc_vs.cc b/src/nfc/nfc/nfc_vs.cc
index c23daf7..8b4e3e2 100644
--- a/src/nfc/nfc/nfc_vs.cc
+++ b/src/nfc/nfc/nfc_vs.cc
@@ -58,7 +58,7 @@
   if (is_register) {
     for (i = 0; i < NFC_NUM_VS_CBACKS; i++) {
       /* find an empty spot to hold the callback function */
-      if (nfc_cb.p_vs_cb[i] == NULL) {
+      if (nfc_cb.p_vs_cb[i] == nullptr) {
         nfc_cb.p_vs_cb[i] = p_cback;
         status = NFC_STATUS_OK;
         break;
@@ -68,7 +68,7 @@
     for (i = 0; i < NFC_NUM_VS_CBACKS; i++) {
       /* find the callback to de-register */
       if (nfc_cb.p_vs_cb[i] == p_cback) {
-        nfc_cb.p_vs_cb[i] = NULL;
+        nfc_cb.p_vs_cb[i] = nullptr;
         status = NFC_STATUS_OK;
         break;
       }
@@ -92,7 +92,7 @@
 *******************************************************************************/
 tNFC_STATUS NFC_SendRawVsCommand(NFC_HDR* p_data, tNFC_VS_CBACK* p_cback) {
   /* Validate parameters */
-  if (p_data == NULL || (p_data->len > NCI_MAX_VSC_SIZE)) {
+  if (p_data == nullptr || (p_data->len > NCI_MAX_VSC_SIZE)) {
     LOG(ERROR) << StringPrintf("buffer offset must be >= %d",
                                NCI_VSC_MSG_HDR_SIZE);
     if (p_data) GKI_freebuf(p_data);
@@ -128,7 +128,7 @@
   uint8_t* pp;
 
   /* Allow VSC with 0-length payload */
-  if (p_data == NULL) {
+  if (p_data == nullptr) {
     p_data = NCI_GET_CMD_BUF(0);
     if (p_data) {
       p_data->offset = NCI_VSC_MSG_HDR_SIZE;
@@ -137,7 +137,7 @@
   }
 
   /* Validate parameters */
-  if ((p_data == NULL) || (p_data->offset < NCI_VSC_MSG_HDR_SIZE) ||
+  if ((p_data == nullptr) || (p_data->offset < NCI_VSC_MSG_HDR_SIZE) ||
       (p_data->len > NCI_MAX_VSC_SIZE)) {
     LOG(ERROR) << StringPrintf("buffer offset must be >= %d",
                                NCI_VSC_MSG_HDR_SIZE);
diff --git a/src/nfc/tags/ce_main.cc b/src/nfc/tags/ce_main.cc
index 46e6955..27c218c 100644
--- a/src/nfc/tags/ce_main.cc
+++ b/src/nfc/tags/ce_main.cc
@@ -121,8 +121,8 @@
   }
 
   if (status != NFC_STATUS_OK) {
-    NFC_SetStaticRfCback(NULL);
-    ce_cb.p_cback = NULL;
+    NFC_SetStaticRfCback(nullptr);
+    ce_cb.p_cback = nullptr;
   }
   return status;
 }
diff --git a/src/nfc/tags/ce_t3t.cc b/src/nfc/tags/ce_t3t.cc
index 461b9ed..f2a0229 100644
--- a/src/nfc/tags/ce_t3t.cc
+++ b/src/nfc/tags/ce_t3t.cc
@@ -26,13 +26,13 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 
 #include "nfc_target.h"
 
 #include "bt_types.h"
 #include "ce_api.h"
 #include "ce_int.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -136,7 +136,7 @@
   NFC_HDR* p_cmd_buf;
 
   p_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_CE_POOL_ID);
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Reserve offset for NCI_DATA_HDR and NFC-F Sod (LEN) field */
     p_cmd_buf->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE + 1;
     p_cmd_buf->len = 0;
@@ -161,12 +161,12 @@
   uint8_t *p_dst, *p_rsp_start;
 
   /* If p_nfcid2 is NULL, then used activated NFCID2 */
-  if (p_nfcid2 == NULL) {
+  if (p_nfcid2 == nullptr) {
     p_nfcid2 = p_cb->local_nfcid2;
   }
 
   p_rsp_msg = ce_t3t_get_rsp_buf();
-  if (p_rsp_msg != NULL) {
+  if (p_rsp_msg != nullptr) {
     p_dst = p_rsp_start = (uint8_t*)(p_rsp_msg + 1) + p_rsp_msg->offset;
 
     /* Response Code */
@@ -325,10 +325,10 @@
 
   /* Send appropriate response to reader/writer */
   if (nfc_status == NFC_STATUS_OK) {
-    ce_t3t_send_rsp(p_ce_cb, NULL, T3T_MSG_OPC_UPDATE_RSP,
+    ce_t3t_send_rsp(p_ce_cb, nullptr, T3T_MSG_OPC_UPDATE_RSP,
                     T3T_MSG_RSP_STATUS_OK, T3T_MSG_RSP_STATUS_OK);
   } else {
-    ce_t3t_send_rsp(p_ce_cb, NULL, T3T_MSG_OPC_UPDATE_RSP,
+    ce_t3t_send_rsp(p_ce_cb, nullptr, T3T_MSG_OPC_UPDATE_RSP,
                     T3T_MSG_RSP_STATUS_ERROR, T3T_MSG_RSP_STATUS2_ERROR_MEMORY);
     p_cb->state = CE_T3T_STATE_IDLE;
   }
@@ -336,12 +336,12 @@
   /* Notify the app of what got updated */
   if (update_flags & CE_T3T_UPDATE_FL_NDEF_UPDATE_START) {
     /* NDEF attribute got updated with WriteF=TRUE */
-    p_ce_cb->p_cback(CE_T3T_NDEF_UPDATE_START_EVT, NULL);
+    p_ce_cb->p_cback(CE_T3T_NDEF_UPDATE_START_EVT, nullptr);
   }
 
   if (update_flags & CE_T3T_UPDATE_FL_UPDATE) {
     /* UPDATE message contained at least one non-NDEF block */
-    p_ce_cb->p_cback(CE_T3T_UPDATE_EVT, NULL);
+    p_ce_cb->p_cback(CE_T3T_UPDATE_EVT, nullptr);
   }
 
   if (update_flags & CE_T3T_UPDATE_FL_NDEF_UPDATE_CPLT) {
@@ -378,7 +378,7 @@
   uint16_t block_number, service_code, checksum;
 
   p_rsp_msg = ce_t3t_get_rsp_buf();
-  if (p_rsp_msg != NULL) {
+  if (p_rsp_msg != nullptr) {
     p_dst = p_rsp_start = (uint8_t*)(p_rsp_msg + 1) + p_rsp_msg->offset;
 
     /* Response Code */
@@ -449,8 +449,8 @@
           UINT16_TO_BE_STREAM(p_dst, (ndef_len & 0xFFFF));
 
           checksum = 0;
-          for (i = 0; i < T3T_MSG_NDEF_ATTR_INFO_SIZE; i++) {
-            checksum += p_temp[i];
+          for (int j = 0; j < T3T_MSG_NDEF_ATTR_INFO_SIZE; j++) {
+            checksum += p_temp[j];
           }
           UINT16_TO_BE_STREAM(p_dst, checksum);
         } else {
@@ -527,11 +527,17 @@
   bool send_response = true;
 
   p_rsp_msg = ce_t3t_get_rsp_buf();
-  if (p_rsp_msg != NULL) {
+  if (p_rsp_msg != nullptr) {
     p_dst = p_rsp_start = (uint8_t*)(p_rsp_msg + 1) + p_rsp_msg->offset;
 
     switch (cmd_id) {
       case T3T_MSG_OPC_POLL_CMD:
+        if (p_cmd_msg->len < 5) {
+          LOG(ERROR) << "Received invalid T3t message";
+          android_errorWriteLog(0x534e4554, "121150966");
+          send_response = false;
+          break;
+        }
         /* Get system code and RC */
         /* Skip over sod and cmd_id */
         p += 2;
@@ -620,7 +626,7 @@
   NFC_HDR* p_msg = p_data->p_data;
   tCE_DATA ce_data;
   uint8_t cmd_id, bl0, entry_len, i;
-  uint8_t* p_nfcid2 = NULL;
+  uint8_t* p_nfcid2 = nullptr;
   uint8_t* p = (uint8_t*)(p_msg + 1) + p_msg->offset;
   uint8_t cmd_nfcid2[NCI_RF_F_UID_LEN];
   uint16_t block_list_start_offset, remaining;
@@ -667,95 +673,106 @@
         STREAM_TO_ARRAY(cmd_nfcid2, p, NCI_RF_F_UID_LEN);
         STREAM_TO_UINT8(p_cb->cur_cmd.num_services, p);
 
-        /* Calculate offset of block-list-start */
-        block_list_start_offset =
-            T3T_MSG_CMD_COMMON_HDR_LEN + 2 * p_cb->cur_cmd.num_services + 1;
-
-        if (p_cb->state == CE_T3T_STATE_NOT_ACTIVATED) {
+        /* Validate num_services */
+        if (p_cb->cur_cmd.num_services > T3T_MSG_SERVICE_LIST_MAX) {
           LOG(ERROR) << StringPrintf(
-              "CE: received command 0x%02X while in bad state (%i))", cmd_id,
-              p_cb->state);
-        } else if (memcmp(cmd_nfcid2, p_cb->local_nfcid2, NCI_RF_F_UID_LEN) !=
-                   0) {
-          LOG(ERROR) << StringPrintf(
-              "CE: received invalid T3t message (invalid NFCID2)");
-          p_nfcid2 = cmd_nfcid2; /* respond with ERROR using the NFCID2 from the
-                                    command message */
-        } else if (p_msg->len < block_list_start_offset) {
-          /* Does not have minimum (including number_of_blocks field) */
-          LOG(ERROR) << StringPrintf("CE: incomplete message");
+              "CE: recieved num_services (%i) exceeds maximum (%i)",
+              p_cb->cur_cmd.num_services, T3T_MSG_SERVICE_LIST_MAX);
         } else {
-          /* Parse service code list */
-          for (i = 0; i < p_cb->cur_cmd.num_services; i++) {
-            STREAM_TO_UINT16(p_cb->cur_cmd.service_code_list[i], p);
-          }
+          /* Calculate offset of block-list-start */
+          block_list_start_offset =
+              T3T_MSG_CMD_COMMON_HDR_LEN + 2 * p_cb->cur_cmd.num_services + 1;
 
-          /* Verify that block list */
-          block_list_ok = true;
-          STREAM_TO_UINT8(p_cb->cur_cmd.num_blocks, p);
-          remaining = p_msg->len - block_list_start_offset;
-          p_cb->cur_cmd.p_block_list_start = p;
-          for (i = 0; i < p_cb->cur_cmd.num_blocks; i++) {
-            /* Each entry is at lease 2 bytes long */
-            if (remaining < 2) {
-              /* Unexpected end of message (while reading block-list) */
-              LOG(ERROR) << StringPrintf(
-                  "CE: received invalid T3t message (unexpected end of "
-                  "block-list)");
-              block_list_ok = false;
-              break;
+          if (p_cb->state == CE_T3T_STATE_NOT_ACTIVATED) {
+            LOG(ERROR) << StringPrintf(
+                "CE: received command 0x%02X while in bad state (%i))", cmd_id,
+                p_cb->state);
+          } else if (memcmp(cmd_nfcid2, p_cb->local_nfcid2, NCI_RF_F_UID_LEN) !=
+                     0) {
+            LOG(ERROR) << StringPrintf(
+                "CE: received invalid T3t message (invalid NFCID2)");
+            p_nfcid2 =
+                cmd_nfcid2; /* respond with ERROR using the NFCID2 from the
+                               command message */
+          } else if (p_msg->len < block_list_start_offset) {
+            /* Does not have minimum (including number_of_blocks field) */
+            LOG(ERROR) << StringPrintf("CE: incomplete message");
+          } else {
+            /* Parse service code list */
+            for (i = 0; i < p_cb->cur_cmd.num_services; i++) {
+              STREAM_TO_UINT16(p_cb->cur_cmd.service_code_list[i], p);
             }
 
-            /* Get byte0 of block-list entry */
-            bl0 = *p;
-
-            /* Validate service code index and size of block-list */
-            if ((bl0 & T3T_MSG_SERVICE_LIST_MASK) >=
-                p_cb->cur_cmd.num_services) {
-              /* Invalid service code */
-              LOG(ERROR) << StringPrintf(
-                  "CE: received invalid T3t message (invalid service index: "
-                  "%i)",
-                  (bl0 & T3T_MSG_SERVICE_LIST_MASK));
-              block_list_ok = false;
-              break;
-            } else if ((!(bl0 & T3T_MSG_MASK_TWO_BYTE_BLOCK_DESC_FORMAT)) &&
-                       (remaining < 3)) {
-              /* Unexpected end of message (while reading 3-byte entry) */
-              LOG(ERROR) << StringPrintf(
-                  "CE: received invalid T3t message (unexpected end of "
-                  "block-list)");
-              block_list_ok = false;
-              break;
-            }
-
-            /* Advance pointers to next block-list entry */
-            entry_len = (bl0 & T3T_MSG_MASK_TWO_BYTE_BLOCK_DESC_FORMAT) ? 2 : 3;
-            p += entry_len;
-            remaining -= entry_len;
-          }
-
-          /* Block list is verified. Call CHECK or UPDATE handler */
-          if (block_list_ok) {
-            p_cb->cur_cmd.p_block_data_start = p;
-            if (cmd_id == T3T_MSG_OPC_CHECK_CMD) {
-              /* This is a CHECK command. Sanity check: there shouldn't be any
-               * more data remaining after reading block list */
-              if (remaining) {
+            /* Verify that block list */
+            block_list_ok = true;
+            STREAM_TO_UINT8(p_cb->cur_cmd.num_blocks, p);
+            remaining = p_msg->len - block_list_start_offset;
+            p_cb->cur_cmd.p_block_list_start = p;
+            for (i = 0; i < p_cb->cur_cmd.num_blocks; i++) {
+              /* Each entry is at lease 2 bytes long */
+              if (remaining < 2) {
+                /* Unexpected end of message (while reading block-list) */
                 LOG(ERROR) << StringPrintf(
-                    "CE: unexpected data after after CHECK command (%u bytes)",
-                    (unsigned int)remaining);
+                    "CE: received invalid T3t message (unexpected end of "
+                    "block-list)");
+                block_list_ok = false;
+                break;
               }
-              ce_t3t_handle_check_cmd(p_ce_cb, p_msg);
-              msg_processed = true;
-            } else {
-              /* This is an UPDATE command. See if message contains all the
-               * expected block data */
-              if (remaining < p_cb->cur_cmd.num_blocks * T3T_MSG_BLOCKSIZE) {
-                LOG(ERROR) << StringPrintf("CE: unexpected end of block-data");
-              } else {
-                ce_t3t_handle_update_cmd(p_ce_cb, p_msg);
+
+              /* Get byte0 of block-list entry */
+              bl0 = *p;
+
+              /* Validate service code index and size of block-list */
+              if ((bl0 & T3T_MSG_SERVICE_LIST_MASK) >=
+                  p_cb->cur_cmd.num_services) {
+                /* Invalid service code */
+                LOG(ERROR) << StringPrintf(
+                    "CE: received invalid T3t message (invalid service index: "
+                    "%i)",
+                    (bl0 & T3T_MSG_SERVICE_LIST_MASK));
+                block_list_ok = false;
+                break;
+              } else if ((!(bl0 & T3T_MSG_MASK_TWO_BYTE_BLOCK_DESC_FORMAT)) &&
+                         (remaining < 3)) {
+                /* Unexpected end of message (while reading 3-byte entry) */
+                LOG(ERROR) << StringPrintf(
+                    "CE: received invalid T3t message (unexpected end of "
+                    "block-list)");
+                block_list_ok = false;
+                break;
+              }
+
+              /* Advance pointers to next block-list entry */
+              entry_len =
+                  (bl0 & T3T_MSG_MASK_TWO_BYTE_BLOCK_DESC_FORMAT) ? 2 : 3;
+              p += entry_len;
+              remaining -= entry_len;
+            }
+
+            /* Block list is verified. Call CHECK or UPDATE handler */
+            if (block_list_ok) {
+              p_cb->cur_cmd.p_block_data_start = p;
+              if (cmd_id == T3T_MSG_OPC_CHECK_CMD) {
+                /* This is a CHECK command. Sanity check: there shouldn't be any
+                 * more data remaining after reading block list */
+                if (remaining) {
+                  LOG(ERROR) << StringPrintf(
+                      "CE: unexpected data after after CHECK command (%u "
+                      "bytes)",
+                      (unsigned int)remaining);
+                }
+                ce_t3t_handle_check_cmd(p_ce_cb, p_msg);
                 msg_processed = true;
+              } else {
+                /* This is an UPDATE command. See if message contains all the
+                 * expected block data */
+                if (remaining < p_cb->cur_cmd.num_blocks * T3T_MSG_BLOCKSIZE) {
+                  LOG(ERROR)
+                      << StringPrintf("CE: unexpected end of block-data");
+                } else {
+                  ce_t3t_handle_update_cmd(p_ce_cb, p_msg);
+                  msg_processed = true;
+                }
               }
             }
           }
@@ -804,7 +821,7 @@
 
     case NFC_DEACTIVATE_CEVT:
       p_cb->state = CE_T3T_STATE_NOT_ACTIVATED;
-      NFC_SetStaticRfCback(NULL);
+      NFC_SetStaticRfCback(nullptr);
       break;
 
     default:
@@ -947,7 +964,7 @@
   }
 
   p_rsp_msg = ce_t3t_get_rsp_buf();
-  if (p_rsp_msg != NULL) {
+  if (p_rsp_msg != nullptr) {
     p_dst = p_rsp_start = (uint8_t*)(p_rsp_msg + 1) + p_rsp_msg->offset;
 
     /* Response Code */
@@ -990,7 +1007,7 @@
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
       "CE_T3tUpdateRsp: status1=0x%02X, status2=0x%02X", status1, status2);
-  ce_t3t_send_rsp(p_ce_cb, NULL, T3T_MSG_OPC_UPDATE_RSP, status1, status2);
+  ce_t3t_send_rsp(p_ce_cb, nullptr, T3T_MSG_OPC_UPDATE_RSP, status1, status2);
 
   return (retval);
 }
diff --git a/src/nfc/tags/ce_t4t.cc b/src/nfc/tags/ce_t4t.cc
index 9b859e2..c8a6251 100644
--- a/src/nfc/tags/ce_t4t.cc
+++ b/src/nfc/tags/ce_t4t.cc
@@ -35,7 +35,6 @@
 #include "ce_int.h"
 #include "nfc_int.h"
 #include "tags_int.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -154,7 +153,7 @@
 *******************************************************************************/
 static bool ce_t4t_read_binary(uint16_t offset, uint8_t length) {
   tCE_T4T_MEM* p_t4t = &ce_cb.mem.t4t;
-  uint8_t *p_src = NULL, *p_dst;
+  uint8_t *p_src = nullptr, *p_dst;
   NFC_HDR* p_r_apdu;
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
@@ -292,7 +291,7 @@
         &p_t4t->timer, NFC_TTYPE_CE_T4T_UPDATE,
         (CE_T4T_TOUT_UPDATE * QUICK_TIMER_TICKS_PER_SEC) / 1000);
 
-    if (ce_cb.p_cback) (*ce_cb.p_cback)(CE_T4T_NDEF_UPDATE_START_EVT, NULL);
+    if (ce_cb.p_cback) (*ce_cb.p_cback)(CE_T4T_NDEF_UPDATE_START_EVT, nullptr);
   }
 
   if (!ce_t4t_send_status(T4T_RSP_CMD_CMPLTED)) {
@@ -446,7 +445,7 @@
     ce_data.raw_frame.p_data = p_c_apdu;
     ce_data.raw_frame.aid_handle = ce_cb.mem.t4t.selected_aid_idx;
 
-    p_c_apdu = NULL;
+    p_c_apdu = nullptr;
 
     (*(ce_cb.mem.t4t.reg_aid[ce_cb.mem.t4t.selected_aid_idx].p_cback))(
         CE_T4T_RAW_FRAME_EVT, &ce_data);
@@ -476,7 +475,7 @@
     ce_data.raw_frame.status = NFC_STATUS_OK;
     ce_data.raw_frame.p_data = p_c_apdu;
     ce_data.raw_frame.aid_handle = CE_T4T_WILDCARD_AID_HANDLE;
-    p_c_apdu = NULL;
+    p_c_apdu = nullptr;
 
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
         "CET4T: Forward raw frame (SELECT APP) to wildcard AID handler");
@@ -555,7 +554,7 @@
   tCE_DATA ce_data;
 
   if (event == NFC_DEACTIVATE_CEVT) {
-    NFC_SetStaticRfCback(NULL);
+    NFC_SetStaticRfCback(nullptr);
     return;
   }
   if (event != NFC_DATA_CEVT) {
@@ -623,7 +622,7 @@
       ce_data.raw_frame.status = p_data->data.status;
       ce_data.raw_frame.p_data = p_c_apdu;
       ce_data.raw_frame.aid_handle = ce_cb.mem.t4t.selected_aid_idx;
-      p_c_apdu = NULL;
+      p_c_apdu = nullptr;
 
       (*(ce_cb.mem.t4t.reg_aid[ce_cb.mem.t4t.selected_aid_idx].p_cback))(
           CE_T4T_RAW_FRAME_EVT, &ce_data);
@@ -639,7 +638,7 @@
     ce_data.raw_frame.status = p_data->data.status;
     ce_data.raw_frame.p_data = p_c_apdu;
     ce_data.raw_frame.aid_handle = CE_T4T_WILDCARD_AID_HANDLE;
-    p_c_apdu = NULL;
+    p_c_apdu = nullptr;
 
     (*(ce_cb.mem.t4t.p_wildcard_aid_cback))(CE_T4T_RAW_FRAME_EVT, &ce_data);
   } else if (ce_cb.mem.t4t.status & CE_T4T_STATUS_T4T_APP_SELECTED) {
@@ -660,6 +659,14 @@
           max_file_size = ce_cb.mem.t4t.max_file_size;
         }
 
+        /*CLA+INS+Offset(P1P2)+Le = 5 bytes*/
+        if (p_c_apdu->len < T4T_CMD_MAX_HDR_SIZE) {
+          LOG(ERROR) << "Wrong length";
+          android_errorWriteLog(0x534e4554, "120845341");
+          GKI_freebuf(p_c_apdu);
+          ce_t4t_send_status(T4T_RSP_WRONG_LENGTH);
+          return;
+        }
         BE_STREAM_TO_UINT16(offset, p_cmd); /* Offset */
         BE_STREAM_TO_UINT8(length, p_cmd);  /* Le     */
 
@@ -701,6 +708,14 @@
         LOG(ERROR) << StringPrintf("CET4T: No access right");
         ce_t4t_send_status(T4T_RSP_CMD_NOT_ALLOWED);
       } else if (ce_cb.mem.t4t.status & CE_T4T_STATUS_NDEF_SELECTED) {
+        /*CLA+INS+Offset(P1P2)+Lc = 5 bytes*/
+        if (p_c_apdu->len < T4T_CMD_MAX_HDR_SIZE) {
+          LOG(ERROR) << "Wrong length";
+          android_errorWriteLog(0x534e4554, "120845341");
+          GKI_freebuf(p_c_apdu);
+          ce_t4t_send_status(T4T_RSP_WRONG_LENGTH);
+          return;
+        }
         BE_STREAM_TO_UINT16(offset, p_cmd); /* Offset */
         BE_STREAM_TO_UINT8(length, p_cmd);  /* Lc     */
 
@@ -797,7 +812,7 @@
                       read_only, ndef_msg_max, ndef_msg_len);
 
   if (!p_ndef_msg) {
-    p_t4t->p_ndef_msg = NULL;
+    p_t4t->p_ndef_msg = nullptr;
 
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("T4T is disabled");
     return NFC_STATUS_OK;
@@ -879,7 +894,7 @@
 
     /* Check if a wildcard callback is already registered (only one is allowed)
      */
-    if (p_t4t->p_wildcard_aid_cback != NULL) {
+    if (p_t4t->p_wildcard_aid_cback != nullptr) {
       LOG(ERROR) << StringPrintf(
           "only one wildcard AID can be registered at "
           "time.");
@@ -902,7 +917,7 @@
     return CE_T4T_AID_HANDLE_INVALID;
   }
 
-  if (p_cback == NULL) {
+  if (p_cback == nullptr) {
     LOG(ERROR) << StringPrintf("callback must be provided");
     return CE_T4T_AID_HANDLE_INVALID;
   }
@@ -951,8 +966,8 @@
 
   /* Check if deregistering wildcard AID */
   if (aid_handle == CE_T4T_WILDCARD_AID_HANDLE) {
-    if (p_t4t->p_wildcard_aid_cback != NULL) {
-      p_t4t->p_wildcard_aid_cback = NULL;
+    if (p_t4t->p_wildcard_aid_cback != nullptr) {
+      p_t4t->p_wildcard_aid_cback = nullptr;
     } else {
       LOG(ERROR) << StringPrintf("Invalid handle");
     }
@@ -965,6 +980,6 @@
     LOG(ERROR) << StringPrintf("Invalid handle");
   } else {
     p_t4t->reg_aid[aid_handle].aid_len = 0;
-    p_t4t->reg_aid[aid_handle].p_cback = NULL;
+    p_t4t->reg_aid[aid_handle].p_cback = nullptr;
   }
 }
diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index acf28a6..0f38ab7 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -35,7 +35,6 @@
 #include "nfc_int.h"
 #include "rw_api.h"
 #include "rw_int.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -230,7 +229,7 @@
   length -= I93_UID_BYTE_LEN;
 
   if (p_i93->info_flags & I93_INFO_FLAG_DSFID) {
-    if (length < 1) {
+    if (length < I93_INFO_DSFID_LEN) {
       android_errorWriteLog(0x534e4554, "122316913");
       return false;
     }
@@ -238,7 +237,7 @@
     length--;
   }
   if (p_i93->info_flags & I93_INFO_FLAG_AFI) {
-    if (length < 1) {
+    if (length < I93_INFO_AFI_LEN) {
       android_errorWriteLog(0x534e4554, "122316913");
       return false;
     }
@@ -246,7 +245,7 @@
     length--;
   }
   if (p_i93->info_flags & I93_INFO_FLAG_MEM_SIZE) {
-    if (length < 3) {
+    if (length < I93_INFO_16BIT_NUM_BLOCK_LEN + I93_INFO_BLOCK_SIZE_LEN) {
       android_errorWriteLog(0x534e4554, "122316913");
       return false;
     }
@@ -262,7 +261,7 @@
     p_i93->block_size = (p_i93->block_size & 0x1F) + 1;
   }
   if (p_i93->info_flags & I93_INFO_FLAG_IC_REF) {
-    if (length < 1) {
+    if (length < I93_INFO_IC_REF_LEN) {
       android_errorWriteLog(0x534e4554, "122316913");
       return false;
     }
@@ -387,7 +386,7 @@
           */
           if (!(p_i93->intl_flags & RW_I93_FLAG_16BIT_NUM_BLOCK)) {
             /* get memory size with protocol extension flag */
-            if (rw_i93_send_cmd_get_sys_info(NULL, I93_FLAG_PROT_EXT_YES) ==
+            if (rw_i93_send_cmd_get_sys_info(nullptr, I93_FLAG_PROT_EXT_YES) ==
                 NFC_STATUS_OK) {
               /* STM supports more than 2040 bytes */
               p_i93->intl_flags |= RW_I93_FLAG_16BIT_NUM_BLOCK;
@@ -402,7 +401,7 @@
           p_i93->block_size = 4;
         } else if (!(p_i93->info_flags & I93_INFO_FLAG_MEM_SIZE)) {
           if (!(p_i93->intl_flags & RW_I93_FLAG_EXT_COMMANDS)) {
-            if (rw_i93_send_cmd_get_ext_sys_info(NULL) == NFC_STATUS_OK) {
+            if (rw_i93_send_cmd_get_ext_sys_info(nullptr) == NFC_STATUS_OK) {
               /* STM supports more than 2040 bytes */
               p_i93->intl_flags |= RW_I93_FLAG_EXT_COMMANDS;
 
@@ -435,7 +434,7 @@
   if ((p_i93->uid[1] == I93_UID_IC_MFG_CODE_STM) &&
       (p_i93->sent_cmd == I93_CMD_GET_SYS_INFO) &&
       (error_code == I93_ERROR_CODE_OPTION_NOT_SUPPORTED) &&
-      (rw_i93_send_cmd_get_sys_info(NULL, I93_FLAG_PROT_EXT_YES) ==
+      (rw_i93_send_cmd_get_sys_info(nullptr, I93_FLAG_PROT_EXT_YES) ==
        NFC_STATUS_OK)) {
     return true;
   } else {
@@ -463,6 +462,15 @@
 
   DLOG_IF(INFO, nfc_debug_enabled) << __func__;
 
+  if (length == 0) {
+    android_errorWriteLog(0x534e4554, "121035878");
+    rw_data.i93_cmd_cmpl.status = NFC_STATUS_FAILED;
+    rw_data.i93_cmd_cmpl.command = p_i93->sent_cmd;
+    rw_cb.tcb.i93.sent_cmd = 0;
+    (*(rw_cb.p_cback))(RW_I93_CMD_CMPL_EVT, &rw_data);
+    return;
+  }
+
   STREAM_TO_UINT8(flags, p);
   length--;
 
@@ -472,7 +480,7 @@
       /* This STM tag supports more than 2040 bytes */
       p_i93->intl_flags |= RW_I93_FLAG_16BIT_NUM_BLOCK;
       p_i93->state = RW_I93_STATE_BUSY;
-    } else {
+    } else if (length) {
       /* notify error to upper layer */
       rw_data.i93_cmd_cmpl.status = NFC_STATUS_FAILED;
       rw_data.i93_cmd_cmpl.command = p_i93->sent_cmd;
@@ -486,6 +494,7 @@
 
   switch (p_i93->sent_cmd) {
     case I93_CMD_INVENTORY:
+      if (length < I93_INFO_DSFID_LEN + I93_UID_BYTE_LEN) return;
 
       /* forward inventory response */
       rw_data.i93_inventory.status = NFC_STATUS_OK;
@@ -619,7 +628,7 @@
   /* store command for retransmitting */
   if (rw_cb.tcb.i93.p_retry_cmd) {
     GKI_freebuf(rw_cb.tcb.i93.p_retry_cmd);
-    rw_cb.tcb.i93.p_retry_cmd = NULL;
+    rw_cb.tcb.i93.p_retry_cmd = nullptr;
   }
 
   rw_cb.tcb.i93.p_retry_cmd = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
@@ -1701,7 +1710,7 @@
         rw_i93_handle_error(NFC_STATUS_FAILED);
       } else {
         /* get system information to get memory size */
-        if (rw_i93_send_cmd_get_sys_info(NULL, I93_FLAG_PROT_EXT_NO) ==
+        if (rw_i93_send_cmd_get_sys_info(nullptr, I93_FLAG_PROT_EXT_NO) ==
             NFC_STATUS_OK) {
           p_i93->sub_state = RW_I93_SUBSTATE_WAIT_SYS_INFO;
         } else {
@@ -2400,7 +2409,7 @@
 
         p_i93->state = RW_I93_STATE_IDLE;
         p_i93->sent_cmd = 0;
-        p_i93->p_update_data = NULL;
+        p_i93->p_update_data = nullptr;
 
         rw_data.status = NFC_STATUS_OK;
         (*(rw_cb.p_cback))(RW_I93_NDEF_UPDATE_CPLT_EVT, &rw_data);
@@ -2438,6 +2447,10 @@
       "sub_state:%s (0x%x)",
       rw_i93_get_sub_state_name(p_i93->sub_state).c_str(), p_i93->sub_state);
 
+  if (length == 0) {
+    android_errorWriteLog(0x534e4554, "122323053");
+    return;
+  }
   STREAM_TO_UINT8(flags, p);
   length--;
 
@@ -2464,12 +2477,16 @@
   switch (p_i93->sub_state) {
     case RW_I93_SUBSTATE_WAIT_UID:
 
+      if (length < (I93_UID_BYTE_LEN + 1)) {
+        android_errorWriteLog(0x534e4554, "122323053");
+        return;
+      }
       p++; /* skip DSFID */
       p_uid = p_i93->uid;
       STREAM_TO_ARRAY8(p_uid, p); /* store UID */
 
       /* get system information to get memory size */
-      if (rw_i93_send_cmd_get_sys_info(NULL, I93_FLAG_PROT_EXT_NO) ==
+      if (rw_i93_send_cmd_get_sys_info(nullptr, I93_FLAG_PROT_EXT_NO) ==
           NFC_STATUS_OK) {
         p_i93->sub_state = RW_I93_SUBSTATE_WAIT_SYS_INFO;
       } else {
@@ -2746,7 +2763,7 @@
         }
       } else {
         GKI_freebuf(p_i93->p_update_data);
-        p_i93->p_update_data = NULL;
+        p_i93->p_update_data = nullptr;
 
         p_i93->state = RW_I93_STATE_IDLE;
         p_i93->sent_cmd = 0;
@@ -2785,6 +2802,12 @@
       "sub_state:%s (0x%x)",
       rw_i93_get_sub_state_name(p_i93->sub_state).c_str(), p_i93->sub_state);
 
+  if (length == 0) {
+    android_errorWriteLog(0x534e4554, "122322613");
+    rw_i93_handle_error(NFC_STATUS_FAILED);
+    return;
+  }
+
   STREAM_TO_UINT8(flags, p);
   length--;
 
@@ -2939,14 +2962,14 @@
         break;
 
       case RW_I93_STATE_UPDATE_NDEF:
-        p_i93->p_update_data = NULL;
+        p_i93->p_update_data = nullptr;
         event = RW_I93_NDEF_UPDATE_FAIL_EVT;
         break;
 
       case RW_I93_STATE_FORMAT:
         if (p_i93->p_update_data) {
           GKI_freebuf(p_i93->p_update_data);
-          p_i93->p_update_data = NULL;
+          p_i93->p_update_data = nullptr;
         }
         event = RW_I93_FORMAT_CPLT_EVT;
         break;
@@ -2997,7 +3020,7 @@
       LOG(ERROR) << StringPrintf("retry_count = %d", rw_cb.tcb.i93.retry_count);
 
       p_buf = rw_cb.tcb.i93.p_retry_cmd;
-      rw_cb.tcb.i93.p_retry_cmd = NULL;
+      rw_cb.tcb.i93.p_retry_cmd = nullptr;
 
       if (rw_i93_send_to_lower(p_buf)) {
         return;
@@ -3007,7 +3030,7 @@
     /* all retrial is done or failed to send command to lower layer */
     if (rw_cb.tcb.i93.p_retry_cmd) {
       GKI_freebuf(rw_cb.tcb.i93.p_retry_cmd);
-      rw_cb.tcb.i93.p_retry_cmd = NULL;
+      rw_cb.tcb.i93.p_retry_cmd = nullptr;
       rw_cb.tcb.i93.retry_count = 0;
     }
     rw_i93_handle_error(NFC_STATUS_TIMEOUT);
@@ -3046,8 +3069,12 @@
         LOG(ERROR) << StringPrintf("retry_count = %d", p_i93->retry_count);
 
         p_resp = p_i93->p_retry_cmd;
-        p_i93->p_retry_cmd = NULL;
+        p_i93->p_retry_cmd = nullptr;
         if (rw_i93_send_to_lower(p_resp)) {
+          if (event == NFC_DATA_CEVT) {
+            p_resp = (NFC_HDR*)p_data->data.p_data;
+            GKI_freebuf(p_resp);
+          }
           return;
         }
       }
@@ -3055,7 +3082,7 @@
       /* all retrial is done or failed to send command to lower layer */
       if (p_i93->p_retry_cmd) {
         GKI_freebuf(p_i93->p_retry_cmd);
-        p_i93->p_retry_cmd = NULL;
+        p_i93->p_retry_cmd = nullptr;
         p_i93->retry_count = 0;
       }
 
@@ -3064,12 +3091,16 @@
       /* free retry buffer */
       if (p_i93->p_retry_cmd) {
         GKI_freebuf(p_i93->p_retry_cmd);
-        p_i93->p_retry_cmd = NULL;
+        p_i93->p_retry_cmd = nullptr;
         p_i93->retry_count = 0;
       }
-      NFC_SetStaticRfCback(NULL);
+      NFC_SetStaticRfCback(nullptr);
       p_i93->state = RW_I93_STATE_NOT_ACTIVATED;
     }
+    if ((event == NFC_DATA_CEVT) && (p_data->status != NFC_STATUS_OK)) {
+      p_resp = (NFC_HDR*)p_data->data.p_data;
+      GKI_freebuf(p_resp);
+    }
     return;
   }
 
@@ -3084,7 +3115,7 @@
   /* free retry buffer */
   if (p_i93->p_retry_cmd) {
     GKI_freebuf(p_i93->p_retry_cmd);
-    p_i93->p_retry_cmd = NULL;
+    p_i93->p_retry_cmd = nullptr;
     p_i93->retry_count = 0;
   }
 
@@ -3101,7 +3132,7 @@
         rw_data.raw_frame.status = p_data->data.status;
         rw_data.raw_frame.p_data = p_resp;
         (*(rw_cb.p_cback))(RW_I93_RAW_FRAME_EVT, &rw_data);
-        p_resp = NULL;
+        p_resp = nullptr;
       } else {
         GKI_freebuf(p_resp);
       }
@@ -3675,7 +3706,7 @@
   if (p_uid) {
     status = rw_i93_send_cmd_get_sys_info(p_uid, I93_FLAG_PROT_EXT_NO);
   } else {
-    status = rw_i93_send_cmd_get_sys_info(NULL, I93_FLAG_PROT_EXT_NO);
+    status = rw_i93_send_cmd_get_sys_info(nullptr, I93_FLAG_PROT_EXT_NO);
   }
 
   if (status == NFC_STATUS_OK) {
@@ -3748,7 +3779,7 @@
   }
 
   if (rw_cb.tcb.i93.uid[0] != I93_UID_FIRST_BYTE) {
-    status = rw_i93_send_cmd_inventory(NULL, false, 0x00);
+    status = rw_i93_send_cmd_inventory(nullptr, false, 0x00);
     sub_state = RW_I93_SUBSTATE_WAIT_UID;
   } else if ((rw_cb.tcb.i93.num_block == 0) ||
              (rw_cb.tcb.i93.block_size == 0)) {
diff --git a/src/nfc/tags/rw_main.cc b/src/nfc/tags/rw_main.cc
index 3c2c076..0c70638 100644
--- a/src/nfc/tags/rw_main.cc
+++ b/src/nfc/tags/rw_main.cc
@@ -209,7 +209,7 @@
       p_activate_params->protocol, p_activate_params->rf_tech_param.mode,
       p_activate_params->rf_tech_param.param.pa.sel_rsp);
 
-  if (p_cback == NULL) {
+  if (p_cback == nullptr) {
     LOG(ERROR) << StringPrintf(
         "RW_SetActivatedTagType called with NULL callback");
     return (NFC_STATUS_FAILED);
@@ -237,6 +237,11 @@
       nfc_stop_quick_timer(&rw_cb.tcb.i93.timer);
       break;
     }
+    case RW_CB_TYPE_MIFARE: {
+      nfc_stop_quick_timer(&rw_cb.tcb.mfc.timer);
+      nfc_stop_quick_timer(&rw_cb.tcb.mfc.mfc_timer);
+      break;
+    }
     case RW_CB_TYPE_UNKNOWN: {
       break;
     }
@@ -289,6 +294,15 @@
       rw_cb.tcb_type = RW_CB_TYPE_T5T;
       status = rw_i93_select(p_activate_params->rf_tech_param.param.pi93.uid);
     }
+  } else if (NFC_PROTOCOL_MIFARE == p_activate_params->protocol) {
+    /* Mifare Classic*/
+    if (p_activate_params->rf_tech_param.mode == NFC_DISCOVERY_TYPE_POLL_A) {
+      rw_cb.tcb_type = RW_CB_TYPE_MIFARE;
+      status = rw_mfc_select(
+          p_activate_params->rf_tech_param.param.pa.sel_rsp,
+          p_activate_params->rf_tech_param.param.pa.nfcid1 +
+              p_activate_params->rf_tech_param.param.pa.nfcid1_len - 4);
+    }
   }
   /* TODO set up callback for proprietary protocol */
   else {
@@ -296,6 +310,6 @@
     LOG(ERROR) << StringPrintf("RW_SetActivatedTagType Invalid protocol");
   }
 
-  if (status != NFC_STATUS_OK) rw_cb.p_cback = NULL;
+  if (status != NFC_STATUS_OK) rw_cb.p_cback = nullptr;
   return status;
 }
diff --git a/src/nfc/tags/rw_mfc.cc b/src/nfc/tags/rw_mfc.cc
new file mode 100644
index 0000000..ef5bfdc
--- /dev/null
+++ b/src/nfc/tags/rw_mfc.cc
@@ -0,0 +1,1418 @@
+/*****************************************************************************
+ * Copyright (C) 2015 ST Microelectronics S.A.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *******************************************************************************/
+
+/******************************************************************************
+ *
+ *  This file contains the implementation for Mifare Classic tag in
+ *  Reader/Writer mode.
+ *
+ ******************************************************************************/
+#include <android-base/stringprintf.h>
+#include <base/logging.h>
+#include <log/log.h>
+#include <string.h>
+#include "bt_types.h"
+#include "nfc_target.h"
+
+#include "gki.h"
+#include "nfc_api.h"
+#include "nfc_int.h"
+#include "rw_api.h"
+#include "rw_int.h"
+#include "tags_int.h"
+
+#define MFC_KeyA 0x60
+#define MFC_KeyB 0x61
+#define MFC_Read 0x30
+#define MFC_Write 0xA0
+
+/* main state */
+/* Mifare Classic is not activated */
+#define RW_MFC_STATE_NOT_ACTIVATED 0x00
+/* waiting for upper layer API */
+#define RW_MFC_STATE_IDLE 0x01
+/* performing NDEF detection precedure */
+#define RW_MFC_STATE_DETECT_NDEF 0x02
+/* performing read NDEF procedure */
+#define RW_MFC_STATE_READ_NDEF 0x03
+/* performing update NDEF procedure */
+#define RW_MFC_STATE_UPDATE_NDEF 0x04
+/* checking presence of tag */
+#define RW_MFC_STATE_PRESENCE_CHECK 0x05
+/* convert tag to read only */
+#define RW_MFC_STATE_SET_READ_ONLY 0x06
+/* detect tlv */
+#define RW_MFC_STATE_DETECT_TLV 0x7
+/* NDef Format */
+#define RW_MFC_STATE_NDEF_FORMAT 0x8
+
+#define RW_MFC_SUBSTATE_NONE 0x00
+#define RW_MFC_SUBSTATE_IDLE 0x01
+#define RW_MFC_SUBSTATE_WAIT_ACK 0x02
+#define RW_MFC_SUBSTATE_READ_BLOCK 0x03
+#define RW_MFC_SUBSTATE_FORMAT_BLOCK 0x04
+#define RW_MFC_SUBSTATE_WRITE_BLOCK 0x05
+
+#define RW_MFC_LONG_TLV_SIZE 4
+#define RW_MFC_SHORT_TLV_SIZE 2
+
+#define RW_MFC_4K_Support 0x10
+
+#define RW_MFC_1K_BLOCK_SIZE 16
+
+uint8_t KeyNDEF[6] = {0xD3, 0XF7, 0xD3, 0XF7, 0xD3, 0XF7};
+uint8_t KeyMAD[6] = {0xA0, 0XA1, 0xA2, 0XA3, 0xA4, 0XA5};
+uint8_t KeyDefault[6] = {0xFF, 0XFF, 0xFF, 0XFF, 0xFF, 0XFF};
+uint8_t access_permission_nfc[4] = {0x7F, 0x07, 0x88, 0x40};
+uint8_t access_permission_mad[4] = {0x78, 0x77, 0x88, 0xC1};
+uint8_t MAD_B1[16] = {0x14, 0x01, 0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1,
+                      0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1};
+uint8_t MAD_B2[16] = {0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1,
+                      0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1};
+uint8_t MAD_B64[16] = {0xE8, 0x01, 0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1,
+                       0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1, 0x03, 0xE1};
+uint8_t NFC_B0[16] = {0x03, 0x00, 0xFE, 0x00, 0x00, 0x00, 0x00, 0x00,
+                      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+static bool rw_mfc_send_to_lower(NFC_HDR* p_c_apdu);
+static bool rw_mfc_authenticate(int sector, bool KeyA);
+static tNFC_STATUS rw_mfc_readBlock(int block);
+static void rw_mfc_handle_tlv_detect_rsp(uint8_t* p_data);
+static tNFC_STATUS rw_MfcLocateTlv(uint8_t tlv_type);
+static void rw_mfc_conn_cback(uint8_t conn_id, tNFC_CONN_EVT event,
+                              tNFC_CONN* p_data);
+static void rw_mfc_resume_op();
+static bool rw_nfc_decodeTlv(uint8_t* p_data);
+static void rw_mfc_ntf_tlv_detect_complete(tNFC_STATUS status);
+static void rw_mfc_handle_read_op(uint8_t* data);
+static void rw_mfc_handle_op_complete(void);
+static void rw_mfc_handle_ndef_read_rsp(uint8_t* p_data);
+static void rw_mfc_process_error();
+
+static tNFC_STATUS rw_mfc_formatBlock(int block);
+static void rw_mfc_handle_format_rsp(uint8_t* p_data);
+static void rw_mfc_handle_format_op();
+static tNFC_STATUS rw_mfc_writeBlock(int block);
+static void rw_mfc_handle_write_rsp(uint8_t* p_data);
+static void rw_mfc_handle_write_op();
+
+using android::base::StringPrintf;
+extern bool nfc_debug_enabled;
+
+/*****************************************************************************
+**
+** Function         RW_MfcFormatNDef
+**
+** Description
+**      Format Tag content
+**
+** Returns
+**      NFC_STATUS_OK, Command sent to format Tag
+**      NFC_STATUS_REJECTED: cannot format the tag
+**      NFC_STATUS_FAILED: other error
+**
+*****************************************************************************/
+tNFC_STATUS RW_MfcFormatNDef(void) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tNFC_STATUS status = NFC_STATUS_OK;
+
+  if (p_mfc->state != RW_MFC_STATE_IDLE) {
+    LOG(ERROR) << __func__
+               << " Mifare Classic tag not activated or Busy - State:"
+               << p_mfc->state;
+    return NFC_STATUS_BUSY;
+  }
+
+  p_mfc->state = RW_MFC_STATE_NDEF_FORMAT;
+  p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+  p_mfc->last_block_accessed.block = 1;
+  p_mfc->next_block.block = 1;
+
+  status = rw_mfc_formatBlock(p_mfc->next_block.block);
+  if (status == NFC_STATUS_OK) {
+    p_mfc->state = RW_MFC_STATE_NDEF_FORMAT;
+  } else {
+    p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+  }
+
+  return status;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_formatBlock
+ **
+ ** Description      This function format a given block.
+ **
+ ** Returns          true if success
+ **
+ *******************************************************************************/
+static tNFC_STATUS rw_mfc_formatBlock(int block) {
+  NFC_HDR* mfcbuf;
+  uint8_t* p;
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  int sectorlength = block / 4;
+  tNFC_STATUS status = NFC_STATUS_OK;
+
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__ << ": block : " << block;
+
+  if (block > 128) {
+    sectorlength = (p_mfc->next_block.block - 128) / 16 + 32;
+  }
+
+  if (sectorlength != p_mfc->sector_authentified) {
+    if (rw_mfc_authenticate(block, true) == true) {
+      return NFC_STATUS_OK;
+    }
+    return NFC_STATUS_FAILED;
+  }
+
+  mfcbuf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
+
+  if (!mfcbuf) {
+    LOG(ERROR) << __func__ << ": Cannot allocate buffer";
+    return NFC_STATUS_REJECTED;
+  }
+
+  mfcbuf->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+  p = (uint8_t*)(mfcbuf + 1) + mfcbuf->offset;
+
+  UINT8_TO_BE_STREAM(p, MFC_Write);
+  UINT8_TO_BE_STREAM(p, block);
+
+  if (block == 1) {
+    ARRAY_TO_BE_STREAM(p, MAD_B1, 16);
+  } else if (block == 2 || block == 65 || block == 66) {
+    ARRAY_TO_BE_STREAM(p, MAD_B2, 16);
+  } else if (block == 3 || block == 67) {
+    ARRAY_TO_BE_STREAM(p, KeyMAD, 6);
+    ARRAY_TO_BE_STREAM(p, access_permission_mad, 4);
+    ARRAY_TO_BE_STREAM(p, KeyDefault, 6);
+  } else if (block == 4) {
+    ARRAY_TO_BE_STREAM(p, NFC_B0, 16);
+  } else if (block == 64) {
+    ARRAY_TO_BE_STREAM(p, MAD_B64, 16);
+  } else {
+    ARRAY_TO_BE_STREAM(p, KeyNDEF, 6);
+    ARRAY_TO_BE_STREAM(p, access_permission_nfc, 4);
+    ARRAY_TO_BE_STREAM(p, KeyDefault, 6);
+  }
+  mfcbuf->len = 18;
+
+  if (!rw_mfc_send_to_lower(mfcbuf)) {
+    return NFC_STATUS_REJECTED;
+  }
+  p_mfc->current_block = block;
+  p_mfc->substate = RW_MFC_SUBSTATE_FORMAT_BLOCK;
+
+  return status;
+}
+
+static void rw_mfc_handle_format_rsp(uint8_t* p_data) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  NFC_HDR* mfc_data;
+  uint8_t* p;
+
+  mfc_data = (NFC_HDR*)p_data;
+  /* Assume the data is just the response byte sequence */
+  p = (uint8_t*)(mfc_data + 1) + mfc_data->offset;
+
+  switch (p_mfc->substate) {
+    case RW_MFC_SUBSTATE_WAIT_ACK:
+      p_mfc->last_block_accessed.block = p_mfc->current_block;
+
+      if (p[0] == 0x0) {
+        p_mfc->next_block.auth = true;
+        p_mfc->last_block_accessed.auth = true;
+
+        if (p_mfc->next_block.block < 128) {
+          p_mfc->sector_authentified = p_mfc->next_block.block / 4;
+        } else {
+          p_mfc->sector_authentified =
+              (p_mfc->next_block.block - 128) / 16 + 32;
+        }
+        rw_mfc_resume_op();
+      } else {
+        p_mfc->next_block.auth = false;
+        p_mfc->last_block_accessed.auth = false;
+        nfc_stop_quick_timer(&p_mfc->timer);
+        rw_mfc_process_error();
+      }
+      break;
+
+    case RW_MFC_SUBSTATE_FORMAT_BLOCK:
+      if (p[0] == 0x0) {
+        rw_mfc_handle_format_op();
+      } else {
+        nfc_stop_quick_timer(&p_mfc->timer);
+        rw_mfc_process_error();
+      }
+      break;
+  }
+}
+
+static void rw_mfc_handle_format_op() {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tRW_READ_DATA evt_data;
+  int num_of_blocks = 0;
+
+  /* Total blockes of Mifare 1k/4K */
+  if (p_mfc->selres & RW_MFC_4K_Support)
+    num_of_blocks = 256;
+  else
+    num_of_blocks = 64;
+
+  p_mfc->last_block_accessed.block = p_mfc->current_block;
+
+  // Find next block needed to format
+  if (p_mfc->current_block < 4) {
+    p_mfc->next_block.block = p_mfc->current_block + 1;
+  } else if (p_mfc->current_block == 4) {
+    p_mfc->next_block.block = 7;
+  } else if (p_mfc->current_block >= 63 && p_mfc->current_block < 67) {
+    p_mfc->next_block.block = p_mfc->current_block + 1;
+  } else if (p_mfc->current_block < 127) {
+    p_mfc->next_block.block = p_mfc->current_block + 4;
+  } else {
+    p_mfc->next_block.block = p_mfc->current_block + 16;
+  }
+
+  if (p_mfc->next_block.block < num_of_blocks) {
+    /* Format next blocks */
+    if (rw_mfc_formatBlock(p_mfc->next_block.block) != NFC_STATUS_OK) {
+      evt_data.status = NFC_STATUS_FAILED;
+      evt_data.p_data = NULL;
+      (*rw_cb.p_cback)(RW_MFC_NDEF_FORMAT_CPLT_EVT, (tRW_DATA*)&evt_data);
+    }
+  } else {
+    evt_data.status = NFC_STATUS_OK;
+    evt_data.p_data = NULL;
+    rw_mfc_handle_op_complete();
+    (*rw_cb.p_cback)(RW_MFC_NDEF_FORMAT_CPLT_EVT, (tRW_DATA*)&evt_data);
+  }
+}
+
+/*******************************************************************************
+**
+** Function         RW_MfcWriteNDef
+**
+** Description      This function can be called to write an NDEF message to the
+**                  tag.
+**
+** Parameters:      buf_len:    The length of the buffer
+**                  p_buffer:   The NDEF message to write
+**
+** Returns          NCI_STATUS_OK, if write was started. Otherwise, error
+**                  status.
+**
+*******************************************************************************/
+tNFC_STATUS RW_MfcWriteNDef(uint16_t buf_len, uint8_t* p_buffer) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tNFC_STATUS status = NFC_STATUS_OK;
+
+  if (p_mfc->state != RW_MFC_STATE_IDLE) {
+    return NFC_STATUS_BUSY;
+  }
+
+  p_mfc->state = RW_MFC_STATE_UPDATE_NDEF;
+  p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+  p_mfc->last_block_accessed.block = 4;
+  p_mfc->next_block.block = 4;
+
+  p_mfc->p_ndef_buffer = p_buffer;
+  p_mfc->ndef_length = buf_len;
+  p_mfc->work_offset = 0;
+
+  status = rw_mfc_writeBlock(p_mfc->next_block.block);
+  if (status == NFC_STATUS_OK) {
+    p_mfc->state = RW_MFC_STATE_UPDATE_NDEF;
+  } else {
+    p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+  }
+
+  return status;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_writeBlock
+ **
+ ** Description      This function write a given block.
+ **
+ ** Returns          true if success
+ **
+ *******************************************************************************/
+static tNFC_STATUS rw_mfc_writeBlock(int block) {
+  NFC_HDR* mfcbuf;
+  uint8_t* p;
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  int sectorlength = block / 4;
+  tNFC_STATUS status = NFC_STATUS_OK;
+
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__ << ": block : " << block;
+
+  if (block > 128) {
+    sectorlength = (p_mfc->next_block.block - 128) / 16 + 32;
+  }
+
+  if (sectorlength != p_mfc->sector_authentified) {
+    if (rw_mfc_authenticate(block, true) == true) {
+      return NFC_STATUS_OK;
+    }
+    return NFC_STATUS_FAILED;
+  }
+
+  mfcbuf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
+
+  if (!mfcbuf) {
+    LOG(ERROR) << __func__ << ": Cannot allocate buffer";
+    return NFC_STATUS_REJECTED;
+  }
+
+  mfcbuf->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+  p = (uint8_t*)(mfcbuf + 1) + mfcbuf->offset;
+
+  UINT8_TO_BE_STREAM(p, MFC_Write);
+  UINT8_TO_BE_STREAM(p, block);
+  int index = 0;
+  while (index < RW_MFC_1K_BLOCK_SIZE) {
+    if (p_mfc->work_offset == 0) {
+      if (p_mfc->ndef_length < 0xFF) {
+        UINT8_TO_BE_STREAM(p, 0x03);
+        UINT8_TO_BE_STREAM(p, p_mfc->ndef_length);
+        index = index + 2;
+      } else {
+        UINT8_TO_BE_STREAM(p, 0x03);
+        UINT8_TO_BE_STREAM(p, 0xFF);
+        UINT8_TO_BE_STREAM(p, (uint8_t)(p_mfc->ndef_length >>8));
+        UINT8_TO_BE_STREAM(p, (uint8_t)(p_mfc->ndef_length & 0xFF));
+        index = index + 4;
+      }
+    }
+
+    if (p_mfc->work_offset == p_mfc->ndef_length) {
+      UINT8_TO_BE_STREAM(p, 0xFE);
+      index = index + 1;
+    }
+
+    if (p_mfc->work_offset > p_mfc->ndef_length) {
+      UINT8_TO_BE_STREAM(p, 0x00);
+    } else {
+      UINT8_TO_BE_STREAM(p, p_mfc->p_ndef_buffer[p_mfc->work_offset]);
+    }
+    p_mfc->work_offset++;
+    index++;
+  }
+  mfcbuf->len = 18;
+
+  if (!rw_mfc_send_to_lower(mfcbuf)) {
+    return NFC_STATUS_REJECTED;
+  }
+  p_mfc->current_block = block;
+  p_mfc->substate = RW_MFC_SUBSTATE_WRITE_BLOCK;
+
+  return status;
+}
+
+static void rw_mfc_handle_write_rsp(uint8_t* p_data) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  NFC_HDR* mfc_data;
+  uint8_t* p;
+
+  mfc_data = (NFC_HDR*)p_data;
+  /* Assume the data is just the response byte sequence */
+  p = (uint8_t*)(mfc_data + 1) + mfc_data->offset;
+
+  switch (p_mfc->substate) {
+    case RW_MFC_SUBSTATE_WAIT_ACK:
+      p_mfc->last_block_accessed.block = p_mfc->current_block;
+
+      if (p[0] == 0x0) {
+        p_mfc->next_block.auth = true;
+        p_mfc->last_block_accessed.auth = true;
+
+        if (p_mfc->next_block.block < 128) {
+          p_mfc->sector_authentified = p_mfc->next_block.block / 4;
+        } else {
+          p_mfc->sector_authentified =
+              (p_mfc->next_block.block - 128) / 16 + 32;
+        }
+        rw_mfc_resume_op();
+      } else {
+        p_mfc->next_block.auth = false;
+        p_mfc->last_block_accessed.auth = false;
+        nfc_stop_quick_timer(&p_mfc->timer);
+        rw_mfc_process_error();
+      }
+      break;
+
+    case RW_MFC_SUBSTATE_WRITE_BLOCK:
+      if (p[0] == 0x0) {
+        rw_mfc_handle_write_op();
+      } else {
+        nfc_stop_quick_timer(&p_mfc->timer);
+        rw_mfc_process_error();
+      }
+      break;
+  }
+}
+
+static void rw_mfc_handle_write_op() {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tRW_READ_DATA evt_data;
+
+  if (p_mfc->work_offset >= p_mfc->ndef_length) {
+    evt_data.status = NFC_STATUS_OK;
+    evt_data.p_data = NULL;
+    (*rw_cb.p_cback)(RW_MFC_NDEF_WRITE_CPLT_EVT, (tRW_DATA*)&evt_data);
+  } else {
+    p_mfc->last_block_accessed.block = p_mfc->current_block;
+
+    if (p_mfc->current_block % 4 == 2) {
+      p_mfc->next_block.block = p_mfc->current_block + 2;
+    } else {
+      p_mfc->next_block.block = p_mfc->current_block + 1;
+    }
+
+    /* Do not read block 16 (MAD2) - Mifare Classic4 k */
+    if (p_mfc->next_block.block == 64) {
+      p_mfc->next_block.block += 4;
+    }
+
+    if ((p_mfc->selres & RW_MFC_4K_Support) &&
+        (p_mfc->next_block.block >= 128)) {
+      if (p_mfc->current_block % 16 == 14) {
+        p_mfc->next_block.block = p_mfc->current_block + 2;
+      } else {
+        p_mfc->next_block.block = p_mfc->current_block + 1;
+      }
+    }
+
+    /* Write next blocks */
+    if (rw_mfc_writeBlock(p_mfc->next_block.block) != NFC_STATUS_OK) {
+      evt_data.status = NFC_STATUS_FAILED;
+      evt_data.p_data = NULL;
+      (*rw_cb.p_cback)(RW_MFC_NDEF_WRITE_FAIL_EVT, (tRW_DATA*)&evt_data);
+    }
+  }
+}
+
+/*****************************************************************************
+ **
+ ** Function         RW_MfcDetectNDef
+ **
+ ** Description
+ **      This function is used to perform NDEF detection on a Mifare Classic
+ **      tag, and retrieve the tag's NDEF attribute information.
+ **      Before using this API, the application must call RW_SelectTagType to
+ **      indicate that a Type 1 tag has been activated.
+ **
+ ** Returns
+ **      NFC_STATUS_OK: ndef detection procedure started
+ **      NFC_STATUS_WRONG_PROTOCOL: type 1 tag not activated
+ **      NFC_STATUS_BUSY: another command is already in progress
+ **      NFC_STATUS_FAILED: other error
+ **
+ *****************************************************************************/
+tNFC_STATUS RW_MfcDetectNDef(void) {
+  LOG(ERROR) << __func__;
+  return rw_MfcLocateTlv(TAG_NDEF_TLV);
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_select
+ **
+ ** Description      This function will set the callback function to
+ **                  receive data from lower layers.
+ **
+ ** Returns          tNFC_STATUS
+ **
+ *******************************************************************************/
+tNFC_STATUS rw_mfc_select(uint8_t selres, uint8_t uid[MFC_UID_LEN]) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+
+  p_mfc->state = RW_MFC_STATE_NOT_ACTIVATED;
+
+  /* Alloc cmd buf for retransmissions */
+  if (p_mfc->p_cur_cmd_buf == NULL) {
+    DLOG_IF(INFO, nfc_debug_enabled) << __func__;
+    p_mfc->p_cur_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
+    if (p_mfc->p_cur_cmd_buf == NULL) {
+      LOG(ERROR) << __func__
+                 << ": unable to allocate buffer for retransmission";
+
+      return NFC_STATUS_FAILED;
+    }
+  }
+  p_mfc->selres = selres;
+  memcpy(p_mfc->uid, uid, MFC_UID_LEN);
+
+  NFC_SetStaticRfCback(rw_mfc_conn_cback);
+
+  p_mfc->state = RW_MFC_STATE_IDLE;
+  p_mfc->substate = RW_MFC_SUBSTATE_IDLE;
+  p_mfc->last_block_accessed.block = -1;
+  p_mfc->last_block_accessed.auth = false;
+  p_mfc->next_block.block = 4;
+  p_mfc->next_block.auth = false;
+  p_mfc->sector_authentified = -1;
+
+  return NFC_STATUS_OK;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_send_to_lower
+ **
+ ** Description      Send C-APDU to lower layer
+ **
+ ** Returns          true if success
+ **
+ *******************************************************************************/
+static bool rw_mfc_send_to_lower(NFC_HDR* p_data) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  /* Indicate first attempt to send command, back up cmd buffer in case needed
+   * for retransmission */
+  rw_cb.cur_retry = 0;
+  memcpy(p_mfc->p_cur_cmd_buf, p_data,
+         sizeof(NFC_HDR) + p_data->offset + p_data->len);
+
+  if (NFC_SendData(NFC_RF_CONN_ID, p_data) != NFC_STATUS_OK) {
+    LOG(ERROR) << __func__ << ": NFC_SendData () failed";
+    return false;
+  }
+
+  nfc_start_quick_timer(&rw_cb.tcb.mfc.timer, NFC_TTYPE_RW_MFC_RESPONSE,
+                        (RW_MFC_TOUT_RESP * QUICK_TIMER_TICKS_PER_SEC) / 1000);
+
+  return true;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_process_timeout
+ **
+ ** Description      handles timeout event
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+void rw_mfc_process_timeout(TIMER_LIST_ENT* p_tle) {
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__ << " event=" << p_tle->event;
+
+  if (p_tle->event == NFC_TTYPE_RW_MFC_RESPONSE) {
+    rw_mfc_process_error();
+  } else {
+    LOG(ERROR) << __func__ << " unknown event=" << p_tle->event;
+  }
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_conn_cback
+ **
+ ** Description      This callback function receives the events/data from NFCC.
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+static void rw_mfc_conn_cback(uint8_t conn_id, tNFC_CONN_EVT event,
+                              tNFC_CONN* p_data) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tRW_READ_DATA evt_data;
+  NFC_HDR* mfc_data = {};
+  uint8_t* p;
+  tRW_DATA rw_data;
+
+  DLOG_IF(INFO, nfc_debug_enabled)
+      << StringPrintf("%s conn_id=%i, evt=0x%x", __func__, conn_id, event);
+  /* Only handle static conn_id */
+  if (conn_id != NFC_RF_CONN_ID) {
+    LOG(ERROR) << __func__ << " Not static connection id =" << conn_id;
+    return;
+  }
+
+  switch (event) {
+    case NFC_CONN_CREATE_CEVT:
+    case NFC_CONN_CLOSE_CEVT:
+      break;
+
+    case NFC_DEACTIVATE_CEVT:
+
+      /* Stop mfc timer (if started) */
+      nfc_stop_quick_timer(&p_mfc->timer);
+      /* Free cmd buf for retransmissions */
+      if (p_mfc->p_cur_cmd_buf) {
+        GKI_freebuf(p_mfc->p_cur_cmd_buf);
+        p_mfc->p_cur_cmd_buf = NULL;
+      }
+
+      p_mfc->state = RW_MFC_STATE_NOT_ACTIVATED;
+      NFC_SetStaticRfCback(NULL);
+      break;
+
+    case NFC_DATA_CEVT:
+      if ((p_data != NULL) && (p_data->data.status == NFC_STATUS_OK)) {
+        mfc_data = (NFC_HDR*)p_data->data.p_data;
+        break;
+      }
+      /* Data event with error status...fall through to NFC_ERROR_CEVT case */
+      FALLTHROUGH_INTENDED;
+    case NFC_ERROR_CEVT:
+
+      if ((p_mfc->state == RW_MFC_STATE_NOT_ACTIVATED) ||
+          (p_mfc->state == RW_MFC_STATE_IDLE)) {
+        if (event == NFC_ERROR_CEVT) {
+          evt_data.status = (tNFC_STATUS)(*(uint8_t*)p_data);
+        } else if (p_data) {
+          evt_data.status = p_data->status;
+        } else {
+          evt_data.status = NFC_STATUS_FAILED;
+        }
+
+        evt_data.p_data = NULL;
+        (*rw_cb.p_cback)(RW_MFC_INTF_ERROR_EVT, (tRW_DATA*)&evt_data);
+        break;
+      }
+      nfc_stop_quick_timer(&p_mfc->timer);
+      break;
+
+    default:
+      break;
+  }
+
+  /* Assume the data is just the response byte sequence */
+  p = (uint8_t*)(mfc_data + 1) + mfc_data->offset;
+
+  switch (p_mfc->state) {
+    case RW_MFC_STATE_IDLE:
+      /* Unexpected R-APDU, it should be raw frame response */
+      /* forward to upper layer without parsing */
+      if (rw_cb.p_cback) {
+        rw_data.raw_frame.status = p_data->data.status;
+        rw_data.raw_frame.p_data = mfc_data;
+        (*(rw_cb.p_cback))(RW_MFC_RAW_FRAME_EVT, &rw_data);
+        mfc_data = NULL;
+      } else {
+        GKI_freebuf(mfc_data);
+      }
+      break;
+    case RW_MFC_STATE_DETECT_TLV:
+      rw_mfc_handle_tlv_detect_rsp((uint8_t*)mfc_data);
+      GKI_freebuf(mfc_data);
+      break;
+
+    case RW_MFC_STATE_READ_NDEF:
+      rw_mfc_handle_ndef_read_rsp((uint8_t*)mfc_data);
+      GKI_freebuf(mfc_data);
+      break;
+    case RW_MFC_STATE_NOT_ACTIVATED:
+      DLOG_IF(INFO, nfc_debug_enabled)
+          << __func__ << " RW_MFC_STATE_NOT_ACTIVATED";
+      /* p_r_apdu may send upper layer */
+      break;
+    case RW_MFC_STATE_NDEF_FORMAT:
+      rw_mfc_handle_format_rsp((uint8_t*)mfc_data);
+      GKI_freebuf(mfc_data);
+      break;
+    case RW_MFC_STATE_UPDATE_NDEF:
+      rw_mfc_handle_write_rsp((uint8_t*)mfc_data);
+      GKI_freebuf(mfc_data);
+      break;
+    default:
+      LOG(ERROR) << __func__ << ": invalid state=" << p_mfc->state;
+      break;
+  }
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_MfcLocateTlv
+ **
+ ** Description      This function performs NDEF detection procedure
+ **
+ **                  RW_MFC_NDEF_DETECT_EVT will be returned
+ **
+ ** Returns          NFC_STATUS_OK if success
+ **                  NFC_STATUS_FAILED if Mifare classic tag is busy or other
+ **                  error
+ **
+ *******************************************************************************/
+static tNFC_STATUS rw_MfcLocateTlv(uint8_t tlv_type) {
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__;
+
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tNFC_STATUS success = NFC_STATUS_OK;
+
+  if (p_mfc->state != RW_MFC_STATE_IDLE) {
+    LOG(ERROR) << __func__
+               << " Mifare Classic tag not activated or Busy - State:"
+               << p_mfc->state;
+    return NFC_STATUS_BUSY;
+  }
+
+  if ((tlv_type != TAG_LOCK_CTRL_TLV) && (tlv_type != TAG_MEM_CTRL_TLV) &&
+      (tlv_type != TAG_NDEF_TLV) && (tlv_type != TAG_PROPRIETARY_TLV)) {
+    DLOG_IF(INFO, nfc_debug_enabled)
+        << StringPrintf("%s - Cannot search TLV: 0x%02x", __func__, tlv_type);
+    return NFC_STATUS_FAILED;
+  }
+  if (tlv_type == TAG_NDEF_TLV) {
+    p_mfc->ndef_length = 0;
+    p_mfc->ndef_start_pos = 0;
+    p_mfc->ndef_first_block = 0;
+    p_mfc->work_offset = 0;
+    p_mfc->ndef_status = MFC_NDEF_NOT_DETECTED;
+  }
+
+  p_mfc->substate = RW_MFC_SUBSTATE_READ_BLOCK;
+  p_mfc->state = RW_MFC_STATE_DETECT_TLV;
+
+  success = rw_mfc_readBlock(p_mfc->next_block.block);
+  if (success == NFC_STATUS_OK) {
+    p_mfc->state = RW_MFC_STATE_DETECT_TLV;
+    DLOG_IF(INFO, nfc_debug_enabled)
+        << __func__ << " RW_MFC_STATE_DETECT_TLV state=" << p_mfc->state;
+  } else {
+    p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+    DLOG_IF(INFO, nfc_debug_enabled)
+        << __func__ << " rw_MfcLocateTlv state=" << p_mfc->state;
+  }
+
+  return NFC_STATUS_OK;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_authenticate
+ **
+ ** Description      This function performs the authentication of a given
+ **                  block.
+ **
+ ** Returns          true if success
+ **
+ *******************************************************************************/
+static bool rw_mfc_authenticate(int block, bool KeyA) {
+  NFC_HDR* mfcbuf;
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  uint8_t* p;
+
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__ << ": block:" << block;
+
+  uint8_t* KeyToUse;
+
+  mfcbuf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
+
+  if (!mfcbuf) {
+    LOG(ERROR) << __func__ << ": Cannot allocate buffer";
+    return false;
+  }
+
+  mfcbuf->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+  p = (uint8_t*)(mfcbuf + 1) + mfcbuf->offset;
+
+  if (KeyA) {
+    UINT8_TO_BE_STREAM(p, MFC_KeyA);
+  } else {
+    UINT8_TO_BE_STREAM(p, MFC_KeyB);
+  }
+
+  UINT8_TO_BE_STREAM(p, block);
+  ARRAY_TO_BE_STREAM(p, p_mfc->uid, 4);
+
+  if (p_mfc->state == RW_MFC_STATE_NDEF_FORMAT)
+    KeyToUse = KeyDefault;
+  else {
+    if (block >= 0 && block < 4) {
+      KeyToUse = KeyMAD;
+    } else {
+      KeyToUse = KeyNDEF;
+    }
+  }
+  ARRAY_TO_BE_STREAM(p, KeyToUse, 6);
+
+  mfcbuf->len = 12;
+
+  if (!rw_mfc_send_to_lower(mfcbuf)) {
+    return false;
+  }
+  /* Backup the current substate to move back to this substate after changing
+   * sector */
+  p_mfc->prev_substate = p_mfc->substate;
+  p_mfc->substate = RW_MFC_SUBSTATE_WAIT_ACK;
+  return true;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_readBlock
+ **
+ ** Description      This function read a given block.
+ **
+ ** Returns          true if success
+ **
+ *******************************************************************************/
+static tNFC_STATUS rw_mfc_readBlock(int block) {
+  NFC_HDR* mfcbuf;
+  uint8_t* p;
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  int sectorlength = block / 4;
+  tNFC_STATUS status = NFC_STATUS_OK;
+
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__ << ": block : " << block;
+
+  if (block > 128) {
+    sectorlength = (p_mfc->next_block.block - 128) / 16 + 32;
+  }
+
+  if (sectorlength != p_mfc->sector_authentified) {
+    if (rw_mfc_authenticate(block, true) == true) {
+      LOG(ERROR) << __func__ << ": RW_MFC_SUBSTATE_WAIT_ACK";
+      return NFC_STATUS_OK;
+    }
+    return NFC_STATUS_FAILED;
+  }
+
+  mfcbuf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
+
+  if (!mfcbuf) {
+    LOG(ERROR) << __func__ << ": Cannot allocate buffer";
+    return NFC_STATUS_REJECTED;
+  }
+
+  mfcbuf->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+  p = (uint8_t*)(mfcbuf + 1) + mfcbuf->offset;
+
+  UINT8_TO_BE_STREAM(p, MFC_Read);
+  UINT8_TO_BE_STREAM(p, block);
+
+  mfcbuf->len = 2;
+
+  if (!rw_mfc_send_to_lower(mfcbuf)) {
+    return NFC_STATUS_REJECTED;
+  }
+  p_mfc->current_block = block;
+  p_mfc->substate = RW_MFC_SUBSTATE_READ_BLOCK;
+
+  return status;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_handle_tlv_detect_rsp
+ **
+ ** Description      Handle TLV detection.
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+static void rw_mfc_handle_tlv_detect_rsp(uint8_t* p_data) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  NFC_HDR* mfc_data;
+  uint8_t* p;
+
+  mfc_data = (NFC_HDR*)p_data;
+  /* Assume the data is just the response byte sequence */
+  p = (uint8_t*)(mfc_data + 1) + mfc_data->offset;
+
+  p_mfc->last_block_accessed.block = p_mfc->next_block.block;
+  switch (p_mfc->substate) {
+    case RW_MFC_SUBSTATE_WAIT_ACK:
+      /* Search for the tlv */
+      if (p[0] == 0x0) {
+        p_mfc->next_block.auth = true;
+        p_mfc->last_block_accessed.auth = true;
+        p_mfc->sector_authentified = p_mfc->next_block.block / 4;
+
+        rw_mfc_resume_op();
+      } else {
+        p_mfc->next_block.auth = false;
+        p_mfc->last_block_accessed.auth = false;
+        DLOG_IF(INFO, nfc_debug_enabled) << __func__ << ": status=" << p[0];
+        nfc_stop_quick_timer(&p_mfc->timer);
+        rw_mfc_process_error();
+      }
+      break;
+
+    case RW_MFC_SUBSTATE_READ_BLOCK:
+      /* Search for the tlv */
+      if (mfc_data->len == 0x10) {
+        p_mfc->last_block_accessed.block = p_mfc->next_block.block;
+        p_mfc->next_block.block += 1;
+        p_mfc->next_block.auth = false;
+        rw_mfc_handle_read_op((uint8_t*)mfc_data);
+      }
+      break;
+  }
+}
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_resume_op
+ **
+ ** Description      This function will continue operation after moving to new
+ **                  sector
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+static void rw_mfc_resume_op() {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  bool status = true;
+
+  switch (p_mfc->state) {
+    case RW_MFC_STATE_DETECT_TLV:
+      status = rw_mfc_readBlock(p_mfc->next_block.block);
+      break;
+    case RW_MFC_STATE_READ_NDEF:
+      status = rw_mfc_readBlock(p_mfc->next_block.block);
+      break;
+    case RW_MFC_STATE_NDEF_FORMAT:
+      status = rw_mfc_formatBlock(p_mfc->next_block.block);
+      break;
+    case RW_MFC_STATE_UPDATE_NDEF:
+      status = rw_mfc_writeBlock(p_mfc->next_block.block);
+      break;
+  }
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_handle_read_op
+ **
+ ** Description      This function handles all the read operation.
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+static void rw_mfc_handle_read_op(uint8_t* data) {
+  uint8_t* p;
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  bool tlv_found = false;
+  NFC_HDR* mfc_data;
+  uint16_t len;
+  uint16_t offset;
+  uint16_t saved_length;
+  bool failed = false;
+  bool done = false;
+  tRW_READ_DATA evt_data;
+
+  mfc_data = (NFC_HDR*)data;
+  p = (uint8_t*)(mfc_data + 1) + mfc_data->offset;
+
+  switch (p_mfc->state) {
+    case RW_MFC_STATE_DETECT_TLV:
+      tlv_found = rw_nfc_decodeTlv(data);
+      if (tlv_found) {
+        p_mfc->ndef_status = MFC_NDEF_DETECTED;
+        p_mfc->ndef_first_block = p_mfc->last_block_accessed.block;
+        rw_mfc_ntf_tlv_detect_complete(tlv_found);
+      }
+      break;
+
+    case RW_MFC_STATE_READ_NDEF:
+      /* On the first read, adjust for any partial block offset */
+      offset = 0;
+      len = RW_MFC_1K_BLOCK_SIZE;
+      saved_length = p_mfc->ndef_length;
+
+      if (p_mfc->work_offset == 0) {
+        /* The Ndef Message offset may be present in the read 16 bytes */
+        offset = p_mfc->ndef_start_pos;
+
+        if (!rw_nfc_decodeTlv(data)) {
+          failed = true;
+          DLOG_IF(INFO, nfc_debug_enabled) << __func__ << " FAILED finding TLV";
+        }
+      }
+
+      if (!failed && saved_length >= p_mfc->ndef_length) {
+        /* Skip all reserved and lock bytes */
+        while ((offset < len) && (p_mfc->work_offset < p_mfc->ndef_length))
+
+        {
+          /* Collect the NDEF Message */
+          p_mfc->p_ndef_buffer[p_mfc->work_offset] = p[offset];
+          p_mfc->work_offset++;
+          offset++;
+        }
+      } else {
+        android_errorWriteLog(0x534e4554, "178725766");
+      }
+
+      if (p_mfc->work_offset >= p_mfc->ndef_length) {
+        done = true;
+        p_mfc->ndef_status = MFC_NDEF_READ;
+      } else {
+        /* Read next  blocks */
+        if (rw_mfc_readBlock(p_mfc->next_block.block) != NFC_STATUS_OK) {
+          failed = true;
+          DLOG_IF(INFO, nfc_debug_enabled)
+              << __func__ << " FAILED reading next";
+        }
+      }
+
+      if (failed || done) {
+        evt_data.status = failed ? NFC_STATUS_FAILED : NFC_STATUS_OK;
+        evt_data.p_data = NULL;
+        rw_mfc_handle_op_complete();
+        (*rw_cb.p_cback)(RW_MFC_NDEF_READ_EVT, (tRW_DATA*)&evt_data);
+      }
+      break;
+  }
+}
+/*******************************************************************************
+ **
+ ** Function         rw_nfc_decodeTlv
+ **
+ ** Description      Decode the NDEF data length from the Mifare TLV
+ **                  Leading null TLVs (0x0) are skipped
+ **
+ ** Returns          true if success
+ **
+ *******************************************************************************/
+static bool rw_nfc_decodeTlv(uint8_t* data) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  NFC_HDR* mfc_data;
+  uint8_t* p;
+
+  mfc_data = (NFC_HDR*)data;
+  p = (uint8_t*)(mfc_data + 1) + mfc_data->offset;
+  int i = 0;
+
+  do {
+    if (p[i] == 0x0) {
+      // do nothing, skip
+    } else if (p[i] == 0x3) {
+      p_mfc->tlv_detect = TAG_NDEF_TLV;
+      break;
+
+    } else {
+      DLOG_IF(INFO, nfc_debug_enabled) << __func__ << ": Unknown TLV";
+      p_mfc->tlv_detect = TAG_PROPRIETARY_TLV;
+      break;
+    }
+    i++;
+  } while (i < mfc_data->len);
+
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__ << ": i=" << i;
+
+  if (i < 0 || p[i] != 0x3) {
+    LOG(ERROR) << __func__ << ": Can't decode message length";
+    return false;
+  } else {
+    if (p[i + 1] == 0xFF) {
+      p_mfc->ndef_length = (((uint16_t)p[i + 2]) << 8) | ((uint16_t)(p[i + 3]));
+      p_mfc->ndef_start_pos = i + RW_MFC_LONG_TLV_SIZE;
+      DLOG_IF(INFO, nfc_debug_enabled)
+          << __func__ << " long NDEF SIZE=" << p_mfc->ndef_length;
+    } else {
+      p_mfc->ndef_length = p[i + 1];
+      p_mfc->ndef_start_pos = i + RW_MFC_SHORT_TLV_SIZE;
+      DLOG_IF(INFO, nfc_debug_enabled)
+          << __func__ << " short NDEF SIZE=" << p_mfc->ndef_length;
+    }
+  }
+  return true;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_ntf_tlv_detect_complete
+ **
+ ** Description      Notify TLV detection complete to upper layer
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+static void rw_mfc_ntf_tlv_detect_complete(tNFC_STATUS status) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tRW_DETECT_NDEF_DATA ndef_data = {};
+
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__;
+  if (p_mfc->tlv_detect == TAG_NDEF_TLV) {
+    /* Notify upper layer the result of NDEF detect op */
+    ndef_data.status = NFC_STATUS_OK;  // status;
+    ndef_data.protocol = NFC_PROTOCOL_MIFARE;
+    ndef_data.flags = 0;
+    ndef_data.cur_size = p_mfc->ndef_length;
+
+    if (status == NFC_STATUS_OK) {
+      ndef_data.flags |= RW_NDEF_FL_FORMATED;
+    }
+
+    // TODO - calculate max size based on MAD sectr NFC_AID condition
+    // Set max size as format condition
+    if (p_mfc->selres & RW_MFC_4K_Support)
+      ndef_data.max_size = 3356;
+    else
+      ndef_data.max_size = 716;
+
+    rw_mfc_handle_op_complete();
+    (*rw_cb.p_cback)(RW_MFC_NDEF_DETECT_EVT, (tRW_DATA*)&ndef_data);
+  }
+}
+
+/*******************************************************************************
+ **
+ ** Function         RW_MfcReadNDef
+ **
+ ** Description      Retrieve NDEF contents from a Mifare Classic tag..
+ **
+ **                  The RW_MFC_NDEF_READ_EVT event is used to notify the
+ **                  application after reading the NDEF message.
+ **
+ **                  Before using this API, the RW_MfcReadNDef function must
+ **                  be called to verify that the tag contains NDEF data, and to
+ **                  retrieve the NDEF attributes.
+ **
+ **                  Internally, this command will be separated into multiple
+ **                  Mifare Classic Read commands (if necessary) - depending
+ **                  on the NDEF Msg size.
+ **
+ ** Parameters:      p_buffer:   The buffer into which to read the NDEF message
+ **                  buf_len:    The length of the buffer
+ **
+ ** Returns          NCI_STATUS_OK, if read was started. Otherwise, error
+ **                  status.
+ **
+ *******************************************************************************/
+tNFC_STATUS RW_MfcReadNDef(uint8_t* p_buffer, uint16_t buf_len) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tNFC_STATUS status = NFC_STATUS_OK;
+
+  if (p_mfc->state != RW_MFC_STATE_IDLE) {
+    LOG(ERROR) << __func__
+               << " Mifare Classic tag not activated or Busy - State="
+               << p_mfc->state;
+    return NFC_STATUS_FAILED;
+  }
+
+  if (p_mfc->ndef_status == MFC_NDEF_NOT_DETECTED) {
+    LOG(ERROR) << __func__ << " NDEF detection not performed yet";
+    return NFC_STATUS_FAILED;
+  }
+
+  if (buf_len < p_mfc->ndef_length) {
+    LOG(ERROR) << __func__ << " buffer size=" << buf_len
+               << "less than NDEF msg sise=" << p_mfc->ndef_length;
+    return NFC_STATUS_FAILED;
+  }
+
+  if (!p_mfc->ndef_length) {
+    LOG(ERROR) << __func__ << " NDEF Message length is zero ";
+    return NFC_STATUS_NOT_INITIALIZED;
+  }
+
+  p_mfc->p_ndef_buffer = p_buffer;
+  p_mfc->work_offset = 0;
+
+  p_mfc->last_block_accessed.block = 0;
+  p_mfc->next_block.block = p_mfc->ndef_first_block;
+  p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+
+  /* Start reading NDEF Message */
+  status = rw_mfc_readBlock(p_mfc->next_block.block);
+  if (status == NFC_STATUS_OK) {
+    p_mfc->state = RW_MFC_STATE_READ_NDEF;
+  }
+
+  return status;
+}
+
+/*****************************************************************************
+ **
+ ** Function         rw_mfc_handle_op_complete
+ **
+ ** Description      Reset to IDLE state
+ **
+ ** Returns          none
+ **
+ *****************************************************************************/
+static void rw_mfc_handle_op_complete(void) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+
+  p_mfc->last_block_accessed.auth = false;
+  p_mfc->next_block.auth = false;
+  p_mfc->state = RW_MFC_STATE_IDLE;
+  p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+  return;
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_handle_ndef_read_rsp
+ **
+ ** Description      Handle TLV detection.
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+static void rw_mfc_handle_ndef_read_rsp(uint8_t* p_data) {
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  NFC_HDR* mfc_data;
+  uint8_t* p;
+
+  mfc_data = (NFC_HDR*)p_data;
+  /* Assume the data is just the response byte sequence */
+  p = (uint8_t*)(mfc_data + 1) + mfc_data->offset;
+
+  switch (p_mfc->substate) {
+    case RW_MFC_SUBSTATE_WAIT_ACK:
+      /* Search for the tlv */
+      p_mfc->last_block_accessed.block = p_mfc->current_block;
+
+      if (p[0] == 0x0) {
+        p_mfc->next_block.auth = true;
+        p_mfc->last_block_accessed.auth = true;
+
+        if (p_mfc->current_block < 128) {
+          p_mfc->sector_authentified = p_mfc->next_block.block / 4;
+        }
+
+        else
+          p_mfc->sector_authentified =
+              (p_mfc->next_block.block - 128) / 16 + 32;
+
+        rw_mfc_resume_op();
+        DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
+            "rw_mfc_handle_ndef_read_rsp () sector authentified: %d",
+            p_mfc->sector_authentified);
+      } else {
+        p_mfc->next_block.auth = false;
+        p_mfc->last_block_accessed.auth = false;
+      }
+      break;
+
+    case RW_MFC_SUBSTATE_READ_BLOCK:
+      /* Search for the tlv */
+
+      if (mfc_data->len == 0x10) {
+        p_mfc->last_block_accessed.block = p_mfc->current_block;
+
+        if (p_mfc->current_block % 4 == 2) {
+          p_mfc->next_block.block = p_mfc->current_block + 2;
+        } else {
+          p_mfc->next_block.block = p_mfc->current_block + 1;
+        }
+
+        /* Do not read block 16 (MAD2) - Mifare Classic4 k */
+        if (p_mfc->next_block.block == 64) {
+          p_mfc->next_block.block += 4;
+        }
+
+        if ((p_mfc->selres & RW_MFC_4K_Support) &&
+            (p_mfc->next_block.block >= 128)) {
+          if (p_mfc->current_block % 16 == 14) {
+            p_mfc->next_block.block = p_mfc->current_block + 2;
+          } else {
+            p_mfc->next_block.block = p_mfc->current_block + 1;
+          }
+        }
+
+        p_mfc->next_block.auth = false;
+        rw_mfc_handle_read_op((uint8_t*)mfc_data);
+      }
+      break;
+  }
+}
+
+/*******************************************************************************
+ **
+ ** Function         rw_mfc_process_error
+ **
+ ** Description      Process error including Timeout, Frame error. This function
+ **                  will retry atleast till RW_MAX_RETRIES before give up and
+ **                  sending negative notification to upper layer
+ **
+ ** Returns          none
+ **
+ *******************************************************************************/
+static void rw_mfc_process_error() {
+  tRW_READ_DATA evt_data;
+  tRW_EVENT rw_event = RW_MFC_NDEF_DETECT_EVT;
+  NFC_HDR* p_cmd_buf;
+  tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
+  tRW_DETECT_NDEF_DATA ndef_data;
+
+  DLOG_IF(INFO, nfc_debug_enabled) << __func__ << " State=" << p_mfc->state;
+
+  /* Retry sending command if retry-count < max */
+  if (rw_cb.cur_retry < RW_MAX_RETRIES) {
+    /* retry sending the command */
+    rw_cb.cur_retry++;
+
+    DLOG_IF(INFO, nfc_debug_enabled)
+        << __func__ << "Mifare Classic retransmission attempt "
+        << rw_cb.cur_retry << " of " << RW_MAX_RETRIES;
+
+    /* allocate a new buffer for message */
+    p_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
+    if (p_cmd_buf != NULL) {
+      memcpy(p_cmd_buf, p_mfc->p_cur_cmd_buf,
+             sizeof(NFC_HDR) + p_mfc->p_cur_cmd_buf->offset +
+                 p_mfc->p_cur_cmd_buf->len);
+
+      if (NFC_SendData(NFC_RF_CONN_ID, p_cmd_buf) == NFC_STATUS_OK) {
+        /* Start timer for waiting for response */
+        nfc_start_quick_timer(
+            &p_mfc->timer, NFC_TTYPE_RW_MFC_RESPONSE,
+            (RW_MFC_TOUT_RESP * QUICK_TIMER_TICKS_PER_SEC) / 1000);
+
+        return;
+      }
+    }
+  } else {
+    DLOG_IF(INFO, nfc_debug_enabled)
+        << __func__ << "MFC maximum retransmission attempts reached "
+        << RW_MAX_RETRIES;
+  }
+
+  if (p_mfc->state == RW_MFC_STATE_DETECT_TLV) {
+    rw_event = RW_MFC_NDEF_DETECT_EVT;
+  } else if (p_mfc->state == RW_MFC_STATE_READ_NDEF) {
+    rw_event = RW_MFC_NDEF_READ_EVT;
+  } else if (p_mfc->state == RW_MFC_STATE_UPDATE_NDEF) {
+    rw_event = RW_MFC_NDEF_WRITE_FAIL_EVT;
+  } else if (p_mfc->state == RW_MFC_STATE_NDEF_FORMAT) {
+    rw_event = RW_MFC_NDEF_FORMAT_CPLT_EVT;
+  }
+
+  if (rw_event == RW_MFC_NDEF_DETECT_EVT) {
+    ndef_data.status = evt_data.status;
+    ndef_data.protocol = NFC_PROTOCOL_MIFARE;
+    ndef_data.flags = RW_NDEF_FL_UNKNOWN;
+    ndef_data.max_size = 0;
+    ndef_data.cur_size = 0;
+    DLOG_IF(INFO, nfc_debug_enabled)
+        << __func__ << " status=" << evt_data.status;
+    /* If not Halt move to idle state */
+    rw_mfc_handle_op_complete();
+
+    (*rw_cb.p_cback)(rw_event, (tRW_DATA*)&ndef_data);
+  } else {
+    evt_data.p_data = NULL;
+    /* If activated and not Halt move to idle state */
+    if (p_mfc->state != RW_MFC_STATE_NOT_ACTIVATED) {
+      rw_mfc_handle_op_complete();
+    }
+
+    DLOG_IF(INFO, nfc_debug_enabled)
+        << __func__ << " status=" << evt_data.status;
+    p_mfc->substate = RW_MFC_SUBSTATE_NONE;
+    (*rw_cb.p_cback)(rw_event, (tRW_DATA*)&evt_data);
+  }
+}
diff --git a/src/nfc/tags/rw_t1t.cc b/src/nfc/tags/rw_t1t.cc
index b7e8aa8..c4e5e31 100644
--- a/src/nfc/tags/rw_t1t.cc
+++ b/src/nfc/tags/rw_t1t.cc
@@ -73,7 +73,7 @@
   uint8_t begin_state = p_t1t->state;
 
   p_pkt = (NFC_HDR*)(p_data->data.p_data);
-  if (p_pkt == NULL) return;
+  if (p_pkt == nullptr) return;
   /* Assume the data is just the response byte sequence */
   p = (uint8_t*)(p_pkt + 1) + p_pkt->offset;
 
@@ -194,7 +194,7 @@
     if ((p_t1t->state != RW_T1T_STATE_READ) &&
         (p_t1t->state != RW_T1T_STATE_WRITE)) {
       GKI_freebuf(p_pkt);
-      evt_data.data.p_data = NULL;
+      evt_data.data.p_data = nullptr;
     } else {
       evt_data.data.p_data = p_pkt;
     }
@@ -250,25 +250,26 @@
       /* Free cmd buf for retransmissions */
       if (p_t1t->p_cur_cmd_buf) {
         GKI_freebuf(p_t1t->p_cur_cmd_buf);
-        p_t1t->p_cur_cmd_buf = NULL;
+        p_t1t->p_cur_cmd_buf = nullptr;
       }
 
       p_t1t->state = RW_T1T_STATE_NOT_ACTIVATED;
-      NFC_SetStaticRfCback(NULL);
+      NFC_SetStaticRfCback(nullptr);
       break;
 
     case NFC_DATA_CEVT:
-      if (p_data != NULL) {
+      if (p_data != nullptr) {
         if (p_data->data.status == NFC_STATUS_OK) {
           rw_t1t_data_cback(conn_id, event, p_data);
           break;
-        } else if (p_data->data.p_data != NULL) {
+        } else if (p_data->data.p_data != nullptr) {
           /* Free the response buffer in case of error response */
           GKI_freebuf((NFC_HDR*)(p_data->data.p_data));
-          p_data->data.p_data = NULL;
+          p_data->data.p_data = nullptr;
         }
       }
-    /* Data event with error status...fall through to NFC_ERROR_CEVT case */
+      /* Data event with error status...fall through to NFC_ERROR_CEVT case */
+      FALLTHROUGH_INTENDED;
 
     case NFC_ERROR_CEVT:
       if ((p_t1t->state == RW_T1T_STATE_NOT_ACTIVATED) ||
@@ -285,7 +286,7 @@
         else
           evt_data.status = NFC_STATUS_FAILED;
 
-        evt_data.p_data = NULL;
+        evt_data.p_data = nullptr;
         tRW_DATA rw_data;
         rw_data.data = evt_data;
         (*rw_cb.p_cback)(RW_T1T_INTF_ERROR_EVT, &rw_data);
@@ -496,9 +497,9 @@
   p_t1t->state = RW_T1T_STATE_NOT_ACTIVATED;
 
   /* Alloc cmd buf for retransmissions */
-  if (p_t1t->p_cur_cmd_buf == NULL) {
+  if (p_t1t->p_cur_cmd_buf == nullptr) {
     p_t1t->p_cur_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-    if (p_t1t->p_cur_cmd_buf == NULL) {
+    if (p_t1t->p_cur_cmd_buf == nullptr) {
       LOG(ERROR) << StringPrintf(
           "rw_t1t_select: unable to allocate buffer for retransmission");
       return status;
@@ -586,7 +587,7 @@
 
     /* allocate a new buffer for message */
     p_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-    if (p_cmd_buf != NULL) {
+    if (p_cmd_buf != nullptr) {
       memcpy(p_cmd_buf, p_t1t->p_cur_cmd_buf, sizeof(NFC_HDR) +
                                                   p_t1t->p_cur_cmd_buf->offset +
                                                   p_t1t->p_cur_cmd_buf->len);
@@ -640,7 +641,7 @@
   } else {
     tRW_READ_DATA evt_data;
     evt_data.status = NFC_STATUS_TIMEOUT;
-    evt_data.p_data = NULL;
+    evt_data.p_data = nullptr;
     tRW_DATA rw_data;
     rw_data.data = evt_data;
     (*rw_cb.p_cback)(rw_event, &rw_data);
@@ -949,7 +950,7 @@
   if (rw_cb.tcb.t1t.hr[0] != T1T_STATIC_HR0) {
     /* send RSEG command */
     RW_T1T_BLD_ADDS((adds), (segment));
-    status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, NULL);
+    status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, nullptr);
     if (status == NFC_STATUS_OK) {
       p_t1t->state = RW_T1T_STATE_READ;
     }
@@ -979,7 +980,7 @@
   if (rw_cb.tcb.t1t.hr[0] != T1T_STATIC_HR0 ||
       rw_cb.tcb.t1t.hr[1] >= RW_T1T_HR1_MIN) {
     /* send READ8 command */
-    status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, block, NULL);
+    status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, block, nullptr);
     if (status == NFC_STATUS_OK) {
       p_t1t->state = RW_T1T_STATE_READ;
     }
diff --git a/src/nfc/tags/rw_t1t_ndef.cc b/src/nfc/tags/rw_t1t_ndef.cc
index 9568327..e428bd5 100644
--- a/src/nfc/tags/rw_t1t_ndef.cc
+++ b/src/nfc/tags/rw_t1t_ndef.cc
@@ -299,7 +299,7 @@
       } else if (offset < (p_t1t->mem[T1T_CC_TMS_BYTE] + 1) * T1T_BLOCK_SIZE) {
         /* send READ8 command */
         p_t1t->block_read = (uint8_t)(offset / T1T_BLOCK_SIZE);
-        status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, p_t1t->block_read, NULL);
+        status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, p_t1t->block_read, nullptr);
         if (status == NFC_STATUS_OK) {
           /* Reading Locks */
           status = NFC_STATUS_CONTINUE;
@@ -596,7 +596,7 @@
       if (status != NFC_STATUS_CONTINUE) {
         tRW_DATA rw_data;
         rw_data.data.status = status;
-        rw_data.data.p_data = NULL;
+        rw_data.data.p_data = nullptr;
         rw_t1t_handle_op_complete();
         (*rw_cb.p_cback)(RW_T1T_NDEF_READ_EVT, &rw_data);
       }
@@ -1176,7 +1176,7 @@
         p_t1t->segment++;
       }
       if (p_t1t->ndef_msg_len - p_t1t->work_offset <= 8) {
-        status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, p_t1t->block_read, NULL);
+        status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, p_t1t->block_read, nullptr);
         if (status == NFC_STATUS_OK) {
           p_t1t->tlv_detect = TAG_NDEF_TLV;
           p_t1t->state = RW_T1T_STATE_READ_NDEF;
@@ -1185,7 +1185,7 @@
       } else {
         /* send RSEG command */
         RW_T1T_BLD_ADDS((adds), (p_t1t->segment));
-        status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, NULL);
+        status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, nullptr);
         if (status == NFC_STATUS_OK) {
           p_t1t->state = RW_T1T_STATE_READ_NDEF;
           status = NFC_STATUS_CONTINUE;
@@ -1269,7 +1269,7 @@
       if ((p_t1t->ndef_msg_len - p_t1t->work_offset) <= T1T_BLOCK_SIZE) {
         p_t1t->block_read++;
         ndef_status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8,
-                                          (uint8_t)(p_t1t->block_read), NULL);
+                                          (uint8_t)(p_t1t->block_read), nullptr);
         if (ndef_status == NFC_STATUS_OK) {
           ndef_status = NFC_STATUS_CONTINUE;
         }
@@ -1277,7 +1277,7 @@
         p_t1t->segment++;
         /* send RSEG command */
         RW_T1T_BLD_ADDS((adds), (p_t1t->segment));
-        ndef_status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, NULL);
+        ndef_status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, nullptr);
         if (ndef_status == NFC_STATUS_OK) {
           ndef_status = NFC_STATUS_CONTINUE;
         }
@@ -1606,7 +1606,7 @@
   if ((p_t1t->hr[0] & 0xF0) == T1T_NDEF_SUPPORTED)
     flags |= RW_NDEF_FL_SUPPORTED;
 
-  if (t1t_tag_init_data(p_t1t->hr[0]) != NULL) flags |= RW_NDEF_FL_FORMATABLE;
+  if (t1t_tag_init_data(p_t1t->hr[0]) != nullptr) flags |= RW_NDEF_FL_FORMATABLE;
 
   if ((p_t1t->mem[T1T_CC_RWA_BYTE] & 0x0F) == T1T_CC_RWA_RO)
     flags |= RW_NDEF_FL_READ_ONLY;
@@ -1641,7 +1641,7 @@
        (p_t1t->mem[T1T_CC_NMN_BYTE] != 0))) {
     /* Tag not formated, determine maximum NDEF size from HR */
     if (((p_t1t->hr[0] & 0xF0) == T1T_NDEF_SUPPORTED) &&
-        ((p_ret = t1t_tag_init_data(p_t1t->hr[0])) != NULL)) {
+        ((p_ret = t1t_tag_init_data(p_t1t->hr[0])) != nullptr)) {
       p_t1t->max_ndef_msg_len = ((p_ret->tms + 1) * T1T_BLOCK_SIZE) -
                                 T1T_OTP_LOCK_RES_BYTES - T1T_UID_LEN -
                                 T1T_ADD_LEN - T1T_CC_LEN - T1T_TLV_TYPE_LEN -
@@ -2161,7 +2161,7 @@
   }
 
   p_ret = t1t_tag_init_data(p_t1t->hr[0]);
-  if (p_ret == NULL) {
+  if (p_ret == nullptr) {
     LOG(WARNING) << StringPrintf(
         "RW_T1tFormatNDef - Invalid HR - HR0: %u, HR1: %u", p_t1t->hr[0],
         p_t1t->hr[1]);
@@ -2273,7 +2273,7 @@
   if ((p_t1t->hr[0] & 0x0F) != 1) {
     /* send RSEG command */
     RW_T1T_BLD_ADDS((adds), (p_t1t->segment));
-    status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, NULL);
+    status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, nullptr);
   } else {
     status = rw_t1t_send_static_cmd(T1T_CMD_RALL, 0, 0);
   }
@@ -2387,7 +2387,7 @@
     if ((p_t1t->hr[0] & 0x0F) != 1) {
       /* send RSEG command */
       RW_T1T_BLD_ADDS((adds), (p_t1t->segment));
-      status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, NULL);
+      status = rw_t1t_send_dyn_cmd(T1T_CMD_RSEG, adds, nullptr);
     } else {
       status = rw_t1t_send_static_cmd(T1T_CMD_RALL, 0, 0);
     }
@@ -2487,7 +2487,7 @@
     /* Dynamic data structure */
     p_t1t->block_read = (uint8_t)((offset - 1) / T1T_BLOCK_SIZE);
     /* Read NDEF final block before updating */
-    status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, p_t1t->block_read, NULL);
+    status = rw_t1t_send_dyn_cmd(T1T_CMD_READ8, p_t1t->block_read, nullptr);
     if (status == NFC_STATUS_OK) {
       p_t1t->num_ndef_finalblock = p_t1t->block_read;
       p_t1t->state = RW_T1T_STATE_WRITE_NDEF;
diff --git a/src/nfc/tags/rw_t2t.cc b/src/nfc/tags/rw_t2t.cc
index a05c942..2f3841e 100644
--- a/src/nfc/tags/rw_t2t.cc
+++ b/src/nfc/tags/rw_t2t.cc
@@ -74,7 +74,7 @@
   tRW_DETECT_NDEF_DATA ndef_data;
   uint8_t begin_state = p_t2t->state;
 
-  if ((p_t2t->state == RW_T2T_STATE_IDLE) || (p_cmd_rsp_info == NULL)) {
+  if ((p_t2t->state == RW_T2T_STATE_IDLE) || (p_cmd_rsp_info == nullptr)) {
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("RW T2T Raw Frame: Len [0x%X] Status [%s]", p_pkt->len,
                         NFC_GetStatusName(p_data->status).c_str());
@@ -119,7 +119,7 @@
       "rw_t2t_proc_data State: %u  conn_id: %u  len: %u  data[0]: 0x%02x",
       p_t2t->state, conn_id, p_pkt->len, *p);
 
-  evt_data.p_data = NULL;
+  evt_data.p_data = nullptr;
 
   if (p_t2t->substate == RW_T2T_SUBSTATE_WAIT_SELECT_SECTOR_SUPPORT) {
     /* The select process happens in two steps */
@@ -265,31 +265,32 @@
       /* Free cmd buf for retransmissions */
       if (p_t2t->p_cur_cmd_buf) {
         GKI_freebuf(p_t2t->p_cur_cmd_buf);
-        p_t2t->p_cur_cmd_buf = NULL;
+        p_t2t->p_cur_cmd_buf = nullptr;
       }
       /* Free cmd buf used to hold command before sector change */
       if (p_t2t->p_sec_cmd_buf) {
         GKI_freebuf(p_t2t->p_sec_cmd_buf);
-        p_t2t->p_sec_cmd_buf = NULL;
+        p_t2t->p_sec_cmd_buf = nullptr;
       }
 
       p_t2t->state = RW_T2T_STATE_NOT_ACTIVATED;
-      NFC_SetStaticRfCback(NULL);
+      NFC_SetStaticRfCback(nullptr);
       break;
 
     case NFC_DATA_CEVT:
-      if (p_data != NULL) {
+      if (p_data != nullptr) {
         if ((p_data->data.status == NFC_STATUS_OK) ||
             (p_data->data.status == NFC_STATUS_CONTINUE)) {
           rw_t2t_proc_data(conn_id, &(p_data->data));
           break;
-        } else if (p_data->data.p_data != NULL) {
+        } else if (p_data->data.p_data != nullptr) {
           /* Free the response buffer in case of error response */
           GKI_freebuf((NFC_HDR*)(p_data->data.p_data));
-          p_data->data.p_data = NULL;
+          p_data->data.p_data = nullptr;
         }
       }
-    /* Data event with error status...fall through to NFC_ERROR_CEVT case */
+      /* Data event with error status...fall through to NFC_ERROR_CEVT case */
+      FALLTHROUGH_INTENDED;
 
     case NFC_ERROR_CEVT:
       if ((p_t2t->state == RW_T2T_STATE_NOT_ACTIVATED) ||
@@ -305,7 +306,7 @@
         else
           evt_data.status = NFC_STATUS_FAILED;
 
-        evt_data.p_data = NULL;
+        evt_data.p_data = nullptr;
         tRW_DATA rw_data;
         rw_data.data = evt_data;
         (*rw_cb.p_cback)(RW_T2T_INTF_ERROR_EVT, &rw_data);
@@ -430,7 +431,7 @@
       /* Notify that select sector op is successfull */
       rw_t2t_handle_op_complete();
       evt_data.status = NFC_STATUS_OK;
-      evt_data.p_data = NULL;
+      evt_data.p_data = nullptr;
       tRW_DATA rw_data;
       rw_data.data = evt_data;
       (*rw_cb.p_cback)(RW_T2T_SELECT_CPLT_EVT, &rw_data);
@@ -496,7 +497,7 @@
 
     /* allocate a new buffer for message */
     p_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-    if (p_cmd_buf != NULL) {
+    if (p_cmd_buf != nullptr) {
       memcpy(p_cmd_buf, p_t2t->p_cur_cmd_buf, sizeof(NFC_HDR) +
                                                   p_t2t->p_cur_cmd_buf->offset +
                                                   p_t2t->p_cur_cmd_buf->len);
@@ -549,7 +550,7 @@
     rw_data.ndef = ndef_data;
     (*rw_cb.p_cback)(rw_event, &rw_data);
   } else {
-    evt_data.p_data = NULL;
+    evt_data.p_data = nullptr;
     /* If activated and not Halt move to idle state */
     if (p_t2t->state != RW_T2T_STATE_NOT_ACTIVATED) rw_t2t_handle_op_complete();
 
@@ -607,7 +608,7 @@
 
   /* allocate a new buffer for message */
   p_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     memcpy(p_cmd_buf, p_t2t->p_sec_cmd_buf, sizeof(NFC_HDR) +
                                                 p_t2t->p_sec_cmd_buf->offset +
                                                 p_t2t->p_sec_cmd_buf->len);
@@ -626,7 +627,7 @@
           (RW_T2T_TOUT_RESP * QUICK_TIMER_TICKS_PER_SEC) / 1000);
     } else {
       /* failure - could not send buffer */
-      evt_data.p_data = NULL;
+      evt_data.p_data = nullptr;
       evt_data.status = NFC_STATUS_FAILED;
       event = rw_t2t_info_to_event(p_cmd_rsp_info);
       rw_t2t_handle_op_complete();
@@ -654,7 +655,7 @@
   tRW_T2T_CB* p_t2t = &rw_cb.tcb.t2t;
 
   p_data = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-  if (p_data == NULL) {
+  if (p_data == nullptr) {
     LOG(ERROR) << StringPrintf("rw_t2t_sector_change - No buffer");
     return (NFC_STATUS_NO_BUFFERS);
   }
@@ -672,7 +673,7 @@
   status = NFC_SendData(NFC_RF_CONN_ID, p_data);
   if (status == NFC_STATUS_OK) {
     /* Passive rsp command and suppose not to get response to this command */
-    p_t2t->p_cmd_rsp_info = NULL;
+    p_t2t->p_cmd_rsp_info = nullptr;
     p_t2t->substate = RW_T2T_SUBSTATE_WAIT_SELECT_SECTOR;
 
     DLOG_IF(INFO, nfc_debug_enabled)
@@ -820,18 +821,18 @@
   p_t2t->ndef_status = T2T_NDEF_NOT_DETECTED;
 
   /* Alloc cmd buf for retransmissions */
-  if (p_t2t->p_cur_cmd_buf == NULL) {
+  if (p_t2t->p_cur_cmd_buf == nullptr) {
     p_t2t->p_cur_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-    if (p_t2t->p_cur_cmd_buf == NULL) {
+    if (p_t2t->p_cur_cmd_buf == nullptr) {
       LOG(ERROR) << StringPrintf(
           "rw_t2t_select: unable to allocate buffer for retransmission");
       return (NFC_STATUS_FAILED);
     }
   }
   /* Alloc cmd buf for holding a command untill sector changes */
-  if (p_t2t->p_sec_cmd_buf == NULL) {
+  if (p_t2t->p_sec_cmd_buf == nullptr) {
     p_t2t->p_sec_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-    if (p_t2t->p_sec_cmd_buf == NULL) {
+    if (p_t2t->p_sec_cmd_buf == nullptr) {
       LOG(ERROR) << StringPrintf(
           "rw_t2t_select: unable to allocate buffer used during sector change");
       return (NFC_STATUS_FAILED);
diff --git a/src/nfc/tags/rw_t2t_ndef.cc b/src/nfc/tags/rw_t2t_ndef.cc
index 36c7fec..ad98228 100644
--- a/src/nfc/tags/rw_t2t_ndef.cc
+++ b/src/nfc/tags/rw_t2t_ndef.cc
@@ -727,7 +727,7 @@
   /* If not found and not failed, read next block and search tlv */
   if (!found && !failed) {
     if (p_t2t->work_offset >=
-        (p_t2t->tag_hdr[T2T_CC2_TMS_BYTE] * T2T_TMS_TAG_FACTOR)) {
+        (p_t2t->tag_hdr[T2T_CC2_TMS_BYTE] * T2T_TMS_TAG_FACTOR + T2T_FIRST_DATA_BLOCK * T2T_BLOCK_LEN)) {
       if (((tlvtype == TAG_LOCK_CTRL_TLV) && (p_t2t->num_lockbytes > 0)) ||
           ((tlvtype == TAG_MEM_CTRL_TLV) && (p_t2t->num_mem_tlvs > 0))) {
         found = true;
@@ -735,8 +735,7 @@
         failed = true;
       }
     } else {
-      if (rw_t2t_read((uint16_t)((p_t2t->work_offset / T2T_BLOCK_LEN) +
-                                 T2T_FIRST_DATA_BLOCK)) != NFC_STATUS_OK)
+      if (rw_t2t_read((uint16_t)(p_t2t->work_offset / T2T_BLOCK_LEN) ) != NFC_STATUS_OK)
         failed = true;
     }
   }
@@ -863,7 +862,7 @@
      * default location */
     /* Add a virtual Lock tlv to map this default lock location */
     p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0);
-    if (p_ret != NULL) bytes_locked_per_lock_bit = p_ret->default_lock_blpb;
+    if (p_ret != nullptr) bytes_locked_per_lock_bit = p_ret->default_lock_blpb;
 
     num_dynamic_lock_bits =
         ((p_t2t->tag_hdr[T2T_CC2_TMS_BYTE] * T2T_TMS_TAG_FACTOR) -
@@ -1388,7 +1387,7 @@
   if ((p_t2t->tag_hdr[T2T_CC3_RWA_BYTE] & T2T_CC3_RWA_RO) == T2T_CC3_RWA_RO)
     flags |= RW_NDEF_FL_READ_ONLY;
 
-  if (((p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0)) != NULL) &&
+  if (((p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0)) != nullptr) &&
       (p_ret->b_otp)) {
     /* Set otp flag */
     flags |= RW_NDEF_FL_OTP;
@@ -1530,7 +1529,7 @@
 
   if (failed || done) {
     evt_data.status = failed ? NFC_STATUS_FAILED : NFC_STATUS_OK;
-    evt_data.p_data = NULL;
+    evt_data.p_data = nullptr;
     rw_t2t_handle_op_complete();
     tRW_DATA rw_data;
     rw_data.data = evt_data;
@@ -1686,7 +1685,7 @@
   }
 
   if (failed || done) {
-    evt_data.p_data = NULL;
+    evt_data.p_data = nullptr;
     /* NDEF WRITE Operation is done, inform up the stack */
     evt_data.status = failed ? NFC_STATUS_FAILED : NFC_STATUS_OK;
     if (done) {
@@ -1770,10 +1769,10 @@
         b_notify = true;
         break;
       }
+      FALLTHROUGH_INTENDED;
 
     /* Coverity: [FALSE-POSITIVE error] intended fall through */
     /* Missing break statement between cases in switch statement */
-    /* fall through */
     case RW_T2T_SUBSTATE_WAIT_SET_DYN_LOCK_BITS:
 
       num_locks = 0;
@@ -1872,7 +1871,7 @@
       p_t2t->b_read_data = true;
       version_no = (uint16_t)p_data[0] << 8 | p_data[1];
       p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], true, version_no);
-      if (p_ret != NULL) {
+      if (p_ret != nullptr) {
         /* Valid Version Number */
         if (p_ret->b_calc_cc) /* Calculate tag size from Version Information */
           tms = rw_t2t_get_tag_size(p_data);
@@ -1892,7 +1891,7 @@
       version_no = (uint16_t)p_t2t->tag_data[0] << 8 | p_t2t->tag_data[1];
       if ((version_no == 0) ||
           ((p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], true, version_no)) ==
-           NULL) ||
+           nullptr) ||
           (!p_ret->b_multi_version) || (!p_ret->b_calc_cc)) {
         /* Currently Formating a non blank tag or a blank tag with manufacturer
          * has only one variant of tag. Set Null NDEF TLV and complete Format
@@ -1916,15 +1915,15 @@
         } else
           break;
       }
+      FALLTHROUGH_INTENDED;
 
-    /* falls through */
     case RW_T2T_SUBSTATE_WAIT_SET_LOCK_TLV:
 
       /* Prepare NULL NDEF TLV, TERMINATOR_TLV */
       UINT8_TO_BE_STREAM(p, TAG_NDEF_TLV);
       UINT8_TO_BE_STREAM(p, 0);
 
-      if (((p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0)) != NULL) &&
+      if (((p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0)) != nullptr) &&
           (!p_ret->b_otp)) {
         UINT8_TO_BE_STREAM(p, TAG_TERMINATOR_TLV);
       } else
@@ -2601,7 +2600,7 @@
   bool b_blank_tag = true;
 
   p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0);
-  if (p_ret == NULL) {
+  if (p_ret == nullptr) {
     LOG(WARNING) << StringPrintf(
         "rw_t2t_format_tag - Unknown Manufacturer ID: %u, Cannot Format the "
         "tag!",
@@ -3015,7 +3014,7 @@
   /* If OTP tag and tag has valid NDEF Message, stop writting new NDEF Message
    * as it may corrupt the tag */
   if ((p_t2t->ndef_msg_len > 0) &&
-      ((p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0)) != NULL) &&
+      ((p_ret = t2t_tag_init_data(p_t2t->tag_hdr[0], false, 0)) != nullptr) &&
       (p_ret->b_otp)) {
     LOG(WARNING) << StringPrintf(
         "RW_T2tWriteNDef - Cannot Overwrite NDEF Message on a OTP tag!");
diff --git a/src/nfc/tags/rw_t3t.cc b/src/nfc/tags/rw_t3t.cc
index cb820e2..e0121de 100644
--- a/src/nfc/tags/rw_t3t.cc
+++ b/src/nfc/tags/rw_t3t.cc
@@ -36,7 +36,6 @@
 #include "nfc_int.h"
 #include "rw_api.h"
 #include "rw_int.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -269,7 +268,7 @@
 
       /* allocate a new buffer for message */
       p_cmd_buf = rw_t3t_get_cmd_buf();
-      if (p_cmd_buf != NULL) {
+      if (p_cmd_buf != nullptr) {
         memcpy(p_cmd_buf, p_cb->p_cur_cmd_buf, sizeof(NFC_HDR) +
                                                    p_cb->p_cur_cmd_buf->offset +
                                                    p_cb->p_cur_cmd_buf->len);
@@ -591,7 +590,7 @@
   NFC_HDR* p_cmd_buf;
 
   p_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Reserve offset for NCI_DATA_HDR and NFC-F Sod (LEN) field */
     p_cmd_buf->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE + 1;
     p_cmd_buf->len = 0;
@@ -659,7 +658,7 @@
   uint8_t* p_ndef_attr_info_start;
 
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Construct T3T message */
     p = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
 
@@ -749,7 +748,7 @@
   uint32_t timeout;
 
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Construct T3T message */
     p = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
 
@@ -890,7 +889,7 @@
   uint8_t *p_cmd_start, *p;
 
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Construct T3T message */
     p = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
 
@@ -1075,7 +1074,7 @@
 
   p_cb->cur_cmd = RW_T3T_CMD_CHECK;
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Construct T3T message */
     p = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
     rw_t3t_message_set_block_list(p_cb, &p, num_blocks, p_t3t_blocks);
@@ -1111,7 +1110,7 @@
 
   p_cb->cur_cmd = RW_T3T_CMD_UPDATE;
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Construct T3T message */
     p = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
     rw_t3t_message_set_block_list(p_cb, &p, num_blocks, p_t3t_blocks);
@@ -1147,7 +1146,7 @@
 
   /* Read Memory Configuration block */
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Construct T3T message */
     p = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
 
@@ -1198,7 +1197,7 @@
   tNFC_STATUS retval = NFC_STATUS_OK;
 
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     /* Construct T3T message */
     p = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
 
@@ -1491,13 +1490,19 @@
   uint8_t* p_t3t_rsp = (uint8_t*)(p_msg_rsp + 1) + p_msg_rsp->offset;
   uint8_t rsp_num_bytes_rx;
 
-  /* Validate response from tag */
-  if ((p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] !=
-       T3T_MSG_RSP_STATUS_OK) /* verify response status code */
-      || (memcmp(p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
-                 NCI_NFCID2_LEN) != 0) /* verify response IDm */
-      || (p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] !=
-          ((p_cb->ndef_rx_readlen + 15) >> 4))) /* verify length of response */
+  if (p_msg_rsp->len < T3T_MSG_RSP_OFFSET_CHECK_DATA) {
+    LOG(ERROR) << StringPrintf("%s invalid len", __func__);
+    nfc_status = NFC_STATUS_FAILED;
+    GKI_freebuf(p_msg_rsp);
+    android_errorWriteLog(0x534e4554, "120428637");
+    /* Validate response from tag */
+  } else if ((p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] !=
+              T3T_MSG_RSP_STATUS_OK) /* verify response status code */
+             || (memcmp(p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
+                        NCI_NFCID2_LEN) != 0) /* verify response IDm */
+             || (p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] !=
+                 ((p_cb->ndef_rx_readlen + 15) >>
+                  4))) /* verify length of response */
   {
     LOG(ERROR) << StringPrintf(
         "Response error: bad status, nfcid2, or invalid len: %i %i",
@@ -1697,7 +1702,7 @@
 
     /* Read NDEF attribute block */
     p_cmd_buf = rw_t3t_get_cmd_buf();
-    if (p_cmd_buf != NULL) {
+    if (p_cmd_buf != nullptr) {
       /* Construct T3T message */
       p = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
 
@@ -1760,7 +1765,7 @@
   tNFC_STATUS status;
 
   p_cmd_buf = rw_t3t_get_cmd_buf();
-  if (p_cmd_buf != NULL) {
+  if (p_cmd_buf != nullptr) {
     p_dst = p_cmd_start = (uint8_t*)(p_cmd_buf + 1) + p_cmd_buf->offset;
 
     /* Add UPDATE opcode to message  */
@@ -2170,16 +2175,15 @@
     LOG(ERROR) << StringPrintf(
         "T3T: invalid Type3 Tag Message (invalid len: %i)", p_msg->len);
     free_msg = true;
-
     rw_t3t_process_frame_error();
   } else {
     /* Check for RF frame error */
     p = (uint8_t*)(p_msg + 1) + p_msg->offset;
     sod = p[0];
-    if (p[sod] != NCI_STATUS_OK) {
-      LOG(ERROR) << StringPrintf("T3T: rf frame error (crc status=%i)", p[sod]);
-      GKI_freebuf(p_msg);
 
+    if (p_msg->len < sod || p[sod] != NCI_STATUS_OK) {
+      LOG(ERROR) << "T3T: rf frame error";
+      GKI_freebuf(p_msg);
       rw_t3t_process_frame_error();
       return;
     }
@@ -2260,16 +2264,17 @@
       break;
 
     case NFC_DATA_CEVT: /* check for status in tNFC_CONN */
-      if ((p_data != NULL) && ((p_data->data.status == NFC_STATUS_OK) ||
+      if ((p_data != nullptr) && ((p_data->data.status == NFC_STATUS_OK) ||
                                (p_data->data.status == NFC_STATUS_CONTINUE))) {
         rw_t3t_data_cback(conn_id, &(p_data->data));
         break;
-      } else if (p_data->data.p_data != NULL) {
+      } else if (p_data->data.p_data != nullptr) {
         /* Free the response buffer in case of error response */
         GKI_freebuf((NFC_HDR*)(p_data->data.p_data));
-        p_data->data.p_data = NULL;
+        p_data->data.p_data = nullptr;
       }
-    /* Data event with error status...fall through to NFC_ERROR_CEVT case */
+      /* Data event with error status...fall through to NFC_ERROR_CEVT case */
+      FALLTHROUGH_INTENDED;
 
     case NFC_ERROR_CEVT:
       nfc_stop_quick_timer(&p_cb->timer);
@@ -2338,9 +2343,9 @@
   rw_t3t_mrti_to_a_b(mrti_update, &p_cb->update_tout_a, &p_cb->update_tout_b);
 
   /* Alloc cmd buf for retransmissions */
-  if (p_cb->p_cur_cmd_buf == NULL) {
+  if (p_cb->p_cur_cmd_buf == nullptr) {
     p_cb->p_cur_cmd_buf = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
-    if (p_cb->p_cur_cmd_buf == NULL) {
+    if (p_cb->p_cur_cmd_buf == nullptr) {
       LOG(ERROR) << StringPrintf(
           "rw_t3t_select: unable to allocate buffer for retransmission");
       p_cb->rw_state = RW_T3T_STATE_NOT_ACTIVATED;
@@ -2376,11 +2381,11 @@
   /* Free cmd buf for retransmissions */
   if (p_cb->p_cur_cmd_buf) {
     GKI_freebuf(p_cb->p_cur_cmd_buf);
-    p_cb->p_cur_cmd_buf = NULL;
+    p_cb->p_cur_cmd_buf = nullptr;
   }
 
   p_cb->rw_state = RW_T3T_STATE_NOT_ACTIVATED;
-  NFC_SetStaticRfCback(NULL);
+  NFC_SetStaticRfCback(nullptr);
 
   return NFC_STATUS_OK;
 }
diff --git a/src/nfc/tags/rw_t4t.cc b/src/nfc/tags/rw_t4t.cc
index f9549d0..92ff5d9 100644
--- a/src/nfc/tags/rw_t4t.cc
+++ b/src/nfc/tags/rw_t4t.cc
@@ -35,7 +35,6 @@
 #include "nfc_int.h"
 #include "rw_api.h"
 #include "rw_int.h"
-#include "trace_api.h"
 
 using android::base::StringPrintf;
 
@@ -1522,7 +1521,7 @@
                 << StringPrintf("Sent RW_T4T_NDEF_READ_CPLT_EVT");
           }
 
-          p_r_apdu = NULL;
+          p_r_apdu = nullptr;
         } else {
           p_t4t->rw_length = 0;
           p_t4t->state = RW_T4T_STATE_IDLE;
@@ -1584,7 +1583,7 @@
 
         if (!rw_t4t_update_file()) {
           rw_t4t_handle_error(NFC_STATUS_FAILED, 0, 0);
-          p_t4t->p_update_data = NULL;
+          p_t4t->p_update_data = nullptr;
         }
       } else {
         p_t4t->state = RW_T4T_STATE_IDLE;
@@ -1606,10 +1605,10 @@
       if (p_t4t->rw_length > 0) {
         if (!rw_t4t_update_file()) {
           rw_t4t_handle_error(NFC_STATUS_FAILED, 0, 0);
-          p_t4t->p_update_data = NULL;
+          p_t4t->p_update_data = nullptr;
         }
       } else {
-        p_t4t->p_update_data = NULL;
+        p_t4t->p_update_data = nullptr;
 
         /* update NLEN as last step of updating file */
         if (!rw_t4t_update_nlen(p_t4t->ndef_length)) {
@@ -1763,7 +1762,7 @@
 
   switch (event) {
     case NFC_DEACTIVATE_CEVT:
-      NFC_SetStaticRfCback(NULL);
+      NFC_SetStaticRfCback(nullptr);
       p_t4t->state = RW_T4T_STATE_NOT_ACTIVATED;
       return;
 
@@ -1819,7 +1818,7 @@
         rw_data.raw_frame.status = p_data->data.status;
         rw_data.raw_frame.p_data = p_r_apdu;
         (*(rw_cb.p_cback))(RW_T4T_RAW_FRAME_EVT, &rw_data);
-        p_r_apdu = NULL;
+        p_r_apdu = nullptr;
       } else {
         GKI_freebuf(p_r_apdu);
       }
@@ -2118,7 +2117,7 @@
     if (option == RW_T4T_CHK_EMPTY_I_BLOCK) {
       /* use empty I block for presence check */
       p_data = (NFC_HDR*)GKI_getbuf(NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE);
-      if (p_data != NULL) {
+      if (p_data != nullptr) {
         p_data->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
         p_data->len = 0;
         if (NFC_SendData(NFC_RF_CONN_ID, (NFC_HDR*)p_data) == NFC_STATUS_OK)
diff --git a/src/nfc/tags/tags_int.cc b/src/nfc/tags/tags_int.cc
index 71d9c42..edf7a12 100644
--- a/src/nfc/tags/tags_int.cc
+++ b/src/nfc/tags/tags_int.cc
@@ -93,7 +93,7 @@
 const char* const t2t_cmd_str[] = {"T2T_CMD_READ", "T2T_CMD_WRITE",
                                    "T2T_CMD_SEC_SEL"};
 
-static unsigned int tags_ones32(register unsigned int x);
+static unsigned int tags_ones32(unsigned int x);
 
 /*******************************************************************************
 **
@@ -105,7 +105,7 @@
 **
 *******************************************************************************/
 const tT1T_CMD_RSP_INFO* t1t_cmd_to_rsp_info(uint8_t opcode) {
-  const tT1T_CMD_RSP_INFO *p_ret = NULL, *p;
+  const tT1T_CMD_RSP_INFO *p_ret = nullptr, *p;
   int xx;
 
   for (xx = 0, p = &t1t_cmd_rsp_infos[0]; xx < T1T_MAX_NUM_OPCODES; xx++, p++) {
@@ -129,7 +129,7 @@
 **
 *******************************************************************************/
 const tT1T_INIT_TAG* t1t_tag_init_data(uint8_t tag_model) {
-  const tT1T_INIT_TAG *p_ret = NULL, *p;
+  const tT1T_INIT_TAG *p_ret = nullptr, *p;
   int xx;
 
   for (xx = 0, p = &t1t_init_content[0]; xx < T1T_MAX_TAG_MODELS; xx++, p++) {
@@ -154,7 +154,7 @@
 *******************************************************************************/
 const tT2T_INIT_TAG* t2t_tag_init_data(uint8_t manufacturer_id,
                                        bool b_valid_ver, uint16_t version_no) {
-  const tT2T_INIT_TAG *p_ret = NULL, *p;
+  const tT2T_INIT_TAG *p_ret = nullptr, *p;
   int xx;
 
   for (xx = 0, p = &t2t_init_content[0]; xx < T2T_MAX_TAG_MODELS; xx++, p++) {
@@ -180,7 +180,7 @@
 **
 *******************************************************************************/
 const tT2T_CMD_RSP_INFO* t2t_cmd_to_rsp_info(uint8_t opcode) {
-  const tT2T_CMD_RSP_INFO *p_ret = NULL, *p;
+  const tT2T_CMD_RSP_INFO *p_ret = nullptr, *p;
   int xx;
 
   for (xx = 0, p = &t2t_cmd_rsp_infos[0]; xx < T2T_MAX_NUM_OPCODES; xx++, p++) {
@@ -284,7 +284,7 @@
 ** Returns          int
 **
 *******************************************************************************/
-static unsigned int tags_ones32(register unsigned int x) {
+static unsigned int tags_ones32(unsigned int x) {
   /* 32-bit recursive reduction using SWAR...
      but first step is mapping 2-bit values
      into sum of 2 1-bit values in sneaky way
@@ -306,7 +306,7 @@
 ** Returns          int
 **
 *******************************************************************************/
-unsigned int tags_log2(register unsigned int x) {
+unsigned int tags_log2(unsigned int x) {
   x |= (x >> 1);
   x |= (x >> 2);
   x |= (x >> 4);
diff --git a/utils/config.cc b/utils/config.cc
index 8850c95..48bee61 100644
--- a/utils/config.cc
+++ b/utils/config.cc
@@ -28,7 +28,7 @@
 bool parseBytesString(std::string in, std::vector<uint8_t>& out) {
   vector<string> values = Split(in, ":");
   if (values.size() == 0) return false;
-  for (string value : values) {
+  for (const string& value : values) {
     if (value.length() != 2) return false;
     uint8_t tmp = 0;
     string hexified = "0x";
diff --git a/utils/include/config.h b/utils/include/config.h
index bb3e0dc..f4bcdec 100644
--- a/utils/include/config.h
+++ b/utils/include/config.h
@@ -24,9 +24,9 @@
   enum Type { UNSIGNED, STRING, BYTES };
 
   ConfigValue();
-  ConfigValue(std::string);
-  ConfigValue(unsigned);
-  ConfigValue(std::vector<uint8_t>);
+  explicit ConfigValue(std::string);
+  explicit ConfigValue(unsigned);
+  explicit ConfigValue(std::vector<uint8_t>);
   Type getType() const;
   std::string getString() const;
   unsigned getUnsigned() const;
diff --git a/utils/ringbuffer.cc b/utils/ringbuffer.cc
index d7798fd..e130afd 100644
--- a/utils/ringbuffer.cc
+++ b/utils/ringbuffer.cc
@@ -32,7 +32,7 @@
 ringbuffer_t* ringbuffer_init(const size_t size) {
   ringbuffer_t* p = static_cast<ringbuffer_t*>(calloc(1, sizeof(ringbuffer_t)));
 
-  if (p == NULL) return p;
+  if (p == nullptr) return p;
 
   p->base = static_cast<uint8_t*>(calloc(size, sizeof(uint8_t)));
   p->head = p->tail = p->base;
@@ -42,7 +42,7 @@
 }
 
 void ringbuffer_free(ringbuffer_t* rb) {
-  if (rb != NULL) free(rb->base);
+  if (rb != nullptr) free(rb->base);
   free(rb);
 }
 
diff --git a/utils/test/ringbuffer_test.cc b/utils/test/ringbuffer_test.cc
index bebf8a2..682b8e2 100644
--- a/utils/test/ringbuffer_test.cc
+++ b/utils/test/ringbuffer_test.cc
@@ -4,7 +4,7 @@
 
 TEST(RingbufferTest, test_new_simple) {
   ringbuffer_t* rb = ringbuffer_init(4096);
-  ASSERT_TRUE(rb != NULL);
+  ASSERT_TRUE(rb != nullptr);
   EXPECT_EQ((size_t)4096, ringbuffer_available(rb));
   EXPECT_EQ((size_t)0, ringbuffer_size(rb));
   ringbuffer_free(rb);