Upgrade stack to NFA_PI_1.03.66+

Take code from NFCA_MI_430.10.00.07.
Additional changes include:
* Adjust copyright.
* Clean up stack and HAL diagnostic tracing.
* Fix ce_t4t_data_cback() in src/nfc/tags/ce_t4t.c in order to let HCE payment to work.
* Reduce compilation warnings.

Change-Id: I7b174229029d4a4955ff7750623e78c9a8c856f6

84 files changed, 2206 insertions, 1686 deletions

diff --git a/Android.mk b/Android.mk
index 276bde2..815cc41 100644
--- a/Android.mk
+++ b/Android.mk
@@ -35,7 +35,8 @@ LOCAL_C_INCLUDES := external/stlport/stlport bionic/ bionic/libstdc++/include \
     $(LOCAL_PATH)/$(NFC)/include \
     $(LOCAL_PATH)/$(NFC)/int \
     $(LOCAL_PATH)/src/hal/include \
-    $(LOCAL_PATH)/src/hal/int
+    $(LOCAL_PATH)/src/hal/int \
+    $(LOCAL_PATH)/$(HALIMPL)/include
 LOCAL_SRC_FILES := \
     $(call all-c-files-under, $(NFA)/ce $(NFA)/dm $(NFA)/ee) \
     $(call all-c-files-under, $(NFA)/hci $(NFA)/int $(NFA)/p2p $(NFA)/rw $(NFA)/sys) \
@@ -43,6 +44,7 @@ LOCAL_SRC_FILES := \
     $(call all-c-files-under, src/adaptation) \
     $(call all-cpp-files-under, src/adaptation) \
     $(call all-c-files-under, src/gki) \
+    $(HALIMPL)/adaptation/android_logmsg.cpp \
     src/nfca_version.c
 include $(BUILD_SHARED_LIBRARY)
 
diff --git a/halimpl/bcm2079x/adaptation/HalAdaptation.cpp b/halimpl/bcm2079x/adaptation/HalAdaptation.cpp
index 9d7ac35..fbeedc7 100644
--- a/halimpl/bcm2079x/adaptation/HalAdaptation.cpp
+++ b/halimpl/bcm2079x/adaptation/HalAdaptation.cpp
@@ -33,6 +33,7 @@
 #include <errno.h>
 #include <pthread.h>
 #include "buildcfg.h"
+#include "android_logmsg.h"
 extern void delete_hal_non_volatile_store (bool forceDelete);
 extern void verify_hal_non_volatile_store ();
 extern "C"
@@ -40,6 +41,7 @@ extern "C"
 #include "userial.h"
 }
 
+extern void configureCrystalFrequency ();
 
 ///////////////////////////////////////
 // private declaration, definition
@@ -72,9 +74,11 @@ int HaiInitializeLibrary (const bcm2079x_dev_t* device)
     unsigned long num = 0;
     char temp[120];
     UINT8 logLevel = 0;
+    static bool isColdBoot = true;
 
     logLevel = InitializeGlobalAppLogLevel ();
 
+    configureCrystalFrequency ();
     verify_hal_non_volatile_store ();
     if ( GetNumValue ( NAME_PRESERVE_STORAGE, (char*)&num, sizeof ( num ) ) &&
             (num == 1) )
@@ -84,6 +88,15 @@ int HaiInitializeLibrary (const bcm2079x_dev_t* device)
         delete_hal_non_volatile_store (false);
     }
 
+    if ( GetNumValue ( NAME_USE_RAW_NCI_TRACE, &num, sizeof ( num ) ) )
+    {
+        if (num == 1)
+        {
+            // display protocol traces in raw format
+            ProtoDispAdapterUseRawOutput (TRUE);
+        }
+    }
+
     // Initialize protocol logging level
     if ( GetNumValue ( NAME_PROTOCOL_TRACE_LEVEL, &num, sizeof ( num ) ) )
         ScrProtocolTraceFlag = num;
@@ -170,6 +183,14 @@ int HaiInitializeLibrary (const bcm2079x_dev_t* device)
         p_nfc_hal_cfg->nfc_hal_hci_uicc_support = 0;
     }
 
+    if (isColdBoot)
+    {
+        isColdBoot = false;
+        p_nfc_hal_cfg->nfc_hal_first_boot = TRUE;
+    }
+    else
+        p_nfc_hal_cfg->nfc_hal_first_boot = FALSE;
+
     HAL_NfcInitialize ();
     HAL_NfcSetTraceLevel (logLevel); // Initialize HAL's logging level
 
@@ -353,19 +374,11 @@ int HaiGetMaxNfcee (const bcm2079x_dev_t* device, uint8_t* maxNfcee)
 
     if ( maxNfcee )
     {
-        unsigned long num;
-
-        // At this point we can see if there is a chip-specific value for max ee.
-        if ( GetNumValue ( NAME_NFA_MAX_EE_SUPPORTED, &num, sizeof ( num ) ) )
-        {
-            *maxNfcee = num;
-        }
-        else
-            *maxNfcee = HAL_NfcGetMaxNfcee ();
-
+        *maxNfcee = HAL_NfcGetMaxNfcee ();
         ALOGD("%s: max_ee from HAL to use %d", __FUNCTION__, *maxNfcee);
         retval = 0;
     }
     ALOGD ("%s: exit %d", __FUNCTION__, retval);
     return retval;
 }
+
diff --git a/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp b/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
index 72f4207..0168517 100644
--- a/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
+++ b/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
@@ -20,10 +20,9 @@
 #include "gki.h"
 extern "C"
 {
-    #include "nfc_hal_nv_co.h"
+    #include "nfc_hal_target.h"
+    #include "nfc_hal_nv_ci.h"
 }
-#include "nfc_hal_nv_ci.h"
-#include "nfc_hal_int.h"
 #include "config.h"
 #include "CrcChecksum.h"
 #include <sys/types.h>
diff --git a/halimpl/bcm2079x/adaptation/OverrideLog.cpp b/halimpl/bcm2079x/adaptation/OverrideLog.cpp
index 966aec6..ba99f0d 100644
--- a/halimpl/bcm2079x/adaptation/OverrideLog.cpp
+++ b/halimpl/bcm2079x/adaptation/OverrideLog.cpp
@@ -25,6 +25,7 @@
 #include "OverrideLog.h"
 #include <cutils/properties.h>
 #include "config.h"
+#include "android_logmsg.h"
 #define LOG_TAG "NfcNciHal"
 
 
@@ -69,5 +70,11 @@ unsigned char InitializeGlobalAppLogLevel ()
     if (appl_trace_level == 0xFF)
         appl_trace_level = BT_TRACE_LEVEL_DEBUG;
     ALOGD ("%s: level=%u", __FUNCTION__, appl_trace_level);
+
+    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+    {
+        //display protocol traces in raw format
+        ProtoDispAdapterUseRawOutput (TRUE);
+    }
     return appl_trace_level;
 }
diff --git a/halimpl/bcm2079x/adaptation/StartupConfig.cpp b/halimpl/bcm2079x/adaptation/StartupConfig.cpp
index 529361b..f296763 100644
--- a/halimpl/bcm2079x/adaptation/StartupConfig.cpp
+++ b/halimpl/bcm2079x/adaptation/StartupConfig.cpp
@@ -85,23 +85,25 @@ const UINT8* StartupConfig::getInternalBuffer ()
 ** Description:     Append new config data to internal buffer.
 **                  newContent: buffer containing new content; newContent[0] is
 **                          payload length; newContent[1..end] is payload.
+**                  newContentLen: total length of newContent.
 **
 ** Returns:         True if ok.
 **
 *******************************************************************************/
-bool StartupConfig::append (const UINT8* newContent)
+bool StartupConfig::append (const UINT8* newContent, UINT8 newContentLen)
 {
     static const char fn [] = "StartupConfig::append";
-    if ((newContent[0]+mBuffer.size()) > mMaxLength)
+    if ((newContentLen+mBuffer.size()) > mMaxLength)
     {
         ALOGE ("%s: exceed max length", fn);
         return false;
     }
-    ALOGD ("%s: try append %u bytes", fn, (uint8_string::size_type) (newContent[0]));
+
+    ALOGD ("%s: try append %u bytes", fn, (uint8_string::size_type) (newContentLen));
     //append new payload into private buffer
-    mBuffer.append (newContent+1, (uint8_string::size_type) (newContent[0]));
+    mBuffer.append (newContent+1, (uint8_string::size_type) (newContentLen-1));
     //increase size counter of payload in private buffer
-    mBuffer[0] = mBuffer[0] + newContent[0];
+    mBuffer[0] = mBuffer[0] + newContentLen-1;
     ALOGD ("%s: new size %u bytes", fn, mBuffer[0]);
     return true;
 };
@@ -109,30 +111,6 @@ bool StartupConfig::append (const UINT8* newContent)
 
 /*******************************************************************************
 **
-** Function:        append
-**
-** Description:     Append new config data to internal buffer.
-**                  newContent: buffer containing new content; newContent[0] is
-**                          payload length; newContent[1..end] is payload.
-**                  newContentLen: total length of newContent.
-**
-** Returns:         True if ok.
-**
-*******************************************************************************/
-bool StartupConfig::append (const UINT8* newContent, UINT8 newContentLen)
-{
-    static const char fn [] = "StartupConfig::append";
-    if ((newContent[0]+1) != newContentLen)
-    {
-        ALOGE ("%s: invalid length at newContent[0]", fn);
-        return false;
-    }
-    return append (newContent);
-};
-
-
-/*******************************************************************************
-**
 ** Function:        disableSecureElement
 **
 ** Description:     Adjust a TLV to disable secure element(s).  The TLV's type is 0xC2.
@@ -171,7 +149,7 @@ bool StartupConfig::disableSecureElement (UINT8 bitmask)
     {
         UINT8 tlv [] = {0x04, 0xC2, 0x02, 0x61, 0x00};
         tlv [4] = tlv [4] | bitmask;
-        found0xC2 = append (tlv);
+        found0xC2 = append (tlv, 5);
     }
     return found0xC2;
 }
diff --git a/halimpl/bcm2079x/adaptation/android_logmsg.cpp b/halimpl/bcm2079x/adaptation/android_logmsg.cpp
index ec092f7..86fc9b8 100644
--- a/halimpl/bcm2079x/adaptation/android_logmsg.cpp
+++ b/halimpl/bcm2079x/adaptation/android_logmsg.cpp
@@ -16,112 +16,345 @@
  *
  ******************************************************************************/
 #include "OverrideLog.h"
-extern "C"
-{
-    #include "nfc_hal_target.h"
-}
+#include "android_logmsg.h"
+#include "nfc_target.h"
+#include "buildcfg.h"
 #include <cutils/log.h>
 
 
-#ifndef BTE_LOG_BUF_SIZE
-    #define BTE_LOG_BUF_SIZE  1024
-#endif
-#define BTE_LOG_MAX_SIZE  (BTE_LOG_BUF_SIZE - 12)
-#define MAX_NCI_PACKET_SIZE  259
-#define MAX_LOGCAT_LINE     4096
-static char log_line[MAX_LOGCAT_LINE];
+extern UINT32 ScrProtocolTraceFlag;
+#define MAX_NCI_PACKET_SIZE 259
+#define BTE_LOG_BUF_SIZE 1024
+#define BTE_LOG_MAX_SIZE (BTE_LOG_BUF_SIZE - 12)
+#define MAX_LOGCAT_LINE 4096
+#define PRINT(s) __android_log_write (ANDROID_LOG_DEBUG, "BrcmNci", s)
+static char log_line [MAX_LOGCAT_LINE];
 static const char* sTable = "0123456789abcdef";
+static BOOLEAN sIsUseRaw = FALSE;
+static void ToHex (const UINT8* data, UINT16 len, char* hexString, UINT16 hexStringSize);
+static void dumpbin (const char* data, int size, UINT32 trace_layer, UINT32 trace_type);
+static inline void word2hex (const char* data, char** hex);
+static inline void byte2char (const char* data, char** str);
+static inline void byte2hex (const char* data, char** str);
 
-extern UINT32 ScrProtocolTraceFlag;         // = SCR_PROTO_TRACE_ALL; // 0x017F;
-extern "C"
+
+void BTDISP_LOCK_LOG()
 {
-    void DispNci (UINT8 *p, UINT16 len, BOOLEAN is_recv);
-    void DispHciCmd (BT_HDR *p_buf);
-    void DispHciEvt (BT_HDR *p_buf);
 }
 
 
-void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...)
+void BTDISP_UNLOCK_LOG()
 {
-    static char buffer [BTE_LOG_BUF_SIZE];
-    va_list ap;
-    UINT32 trace_type = trace_set_mask & 0x07; //lower 3 bits contain trace type
-    int android_log_type = ANDROID_LOG_INFO;
+}
 
-    va_start (ap, fmt_str);
-    vsnprintf (buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
-    va_end (ap);
-    if (trace_type == TRACE_TYPE_ERROR)
-        android_log_type = ANDROID_LOG_ERROR;
-    __android_log_write (android_log_type, "NfcNciHal", buffer);
+
+void BTDISP_INIT_LOCK()
+{
+}
+
+
+void BTDISP_UNINIT_LOCK()
+{
 }
 
 
-void DispNci (UINT8 *data, UINT16 len, BOOLEAN is_recv)
+void ProtoDispAdapterUseRawOutput (BOOLEAN isUseRaw)
 {
+    sIsUseRaw = isUseRaw;
+}
+
+
+void ProtoDispAdapterDisplayNciPacket (UINT8 *nciPacket, UINT16 nciPacketLen, BOOLEAN is_recv)
+{
+    //Protocol decoder is not available, so decode NCI packet into hex numbers.
     if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_NCI))
         return;
+    char line_buf [(MAX_NCI_PACKET_SIZE*2)+1];
+    ToHex (nciPacket, nciPacketLen, line_buf, sizeof(line_buf));
+    __android_log_write (ANDROID_LOG_DEBUG, (is_recv) ? "BrcmNciR": "BrcmNciX", line_buf);
+}
 
-    char line_buf[(MAX_NCI_PACKET_SIZE*2)+1];
-    int i,j;
 
-    for(i = 0, j = 0; i < len && j < sizeof(line_buf)-3; i++)
+void ToHex (const UINT8* data, UINT16 len, char* hexString, UINT16 hexStringSize)
+{
+    int i=0, j=0;
+    for(i = 0, j = 0; i < len && j < hexStringSize-3; i++)
     {
-        line_buf[j++] = sTable[(*data >> 4) & 0xf];
-        line_buf[j++] = sTable[*data & 0xf];
+        hexString [j++] = sTable [(*data >> 4) & 0xf];
+        hexString [j++] = sTable [*data & 0xf];
         data++;
     }
-    line_buf[j] = '\0';
+    hexString [j] = '\0';
+}
+
+
+//Protodisp code calls ScrLog() to print decoded texts.
+void ScrLog (UINT32 trace_set_mask, const char *fmt_str, ...)
+{
+    static char buffer [BTE_LOG_BUF_SIZE];
+    va_list ap;
 
-    __android_log_write(ANDROID_LOG_DEBUG, (is_recv) ? "BrcmNciR": "BrcmNciX", line_buf);
+    va_start (ap, fmt_str);
+    vsnprintf (buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
+    va_end (ap);
+    __android_log_write(ANDROID_LOG_INFO, "BrcmNci", buffer);
 }
 
 
-void DispHciCmd (BT_HDR *p_buf)
+UINT8 *scru_dump_hex (UINT8 *p, char *pTitle, UINT32 len, UINT32 layer, UINT32 type)
 {
-    int i,j;
-    int nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
-    UINT8 * data = (UINT8*) p_buf;
-    int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+    if(pTitle && *pTitle)
+        PRINT(pTitle);
+    dumpbin((char*) p, len, layer, type);
+    return p;
+}
 
-    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
-        return;
 
-    if (nBytes > sizeof(log_line))
+void dumpbin(const char* data, int size, UINT32 trace_layer, UINT32 trace_type)
+{
+    char line_buff[256];
+    char *line;
+    int i, j, addr;
+    const int width = 16;
+    if(size <= 0)
         return;
-
-    for(i = 0, j = 0; i < data_len && j < sizeof(log_line)-3; i++)
+    for(i = 0; i < size / width; i++)
     {
-        log_line[j++] = sTable[(*data >> 4) & 0xf];
-        log_line[j++] = sTable[*data & 0xf];
-        data++;
+        line = line_buff;
+        //write address:
+        addr = i*width;
+        word2hex((const char*)&addr, &line);
+        *line++ = ':'; *line++ = ' ';
+        //write hex of data
+        for(j = 0; j < width; j++)
+        {
+            byte2hex(&data[j], &line);
+            *line++ = ' ';
+        }
+        //write char of data
+        for(j = 0; j < width; j++)
+            byte2char(data++, &line);
+        //wirte the end of line
+        *line = 0;
+        //output the line
+        PRINT(line_buff);
+    }
+    //last line of left over if any
+    int leftover = size % width;
+    if(leftover > 0)
+    {
+        line = line_buff;
+        //write address:
+        addr = i*width;
+        word2hex((const char*)&addr, &line);
+        *line++ = ':'; *line++ = ' ';
+        //write hex of data
+        for(j = 0; j < leftover; j++)
+        {
+            byte2hex(&data[j], &line);
+            *line++ = ' ';
+        }
+        //write hex padding
+        for(; j < width; j++)
+        {
+            *line++ = ' ';
+            *line++ = ' ';
+            *line++ = ' ';
+        }
+        //write char of data
+        for(j = 0; j < leftover; j++)
+            byte2char(data++, &line);
+        //write the end of line
+        *line = 0;
+        //output the line
+        PRINT(line_buff);
     }
-    log_line[j] = '\0';
+}
+
 
-    __android_log_write(ANDROID_LOG_DEBUG, "BrcmHciX", log_line);
+inline void word2hex (const char* data, char** hex)
+{
+    byte2hex(&data[1], hex);
+    byte2hex(&data[0], hex);
 }
 
 
-void DispHciEvt (BT_HDR *p_buf)
+inline void byte2char (const char* data, char** str)
 {
-    int i,j;
-    int nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
-    UINT8 * data = (UINT8*) p_buf;
-    int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+    **str = *data < ' ' ? '.' : *data > '~' ? '.' : *data;
+    ++(*str);
+}
 
-    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
-        return;
 
-    if (nBytes > sizeof(log_line))
-        return;
+inline void byte2hex (const char* data, char** str)
+{
+    **str = sTable[(*data >> 4) & 0xf];
+    ++*str;
+    **str = sTable[*data & 0xf];
+    ++*str;
+}
+
 
-    for(i = 0, j = 0; i < data_len && j < sizeof(log_line)-3; i++)
+    //Decode a few Bluetooth HCI packets into hex numbers.
+    void DispHciCmd (BT_HDR *p_buf)
     {
-        log_line[j++] = sTable[(*data >> 4) & 0xf];
-        log_line[j++] = sTable[*data & 0xf];
-        data++;
+        UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
+        UINT8* data = (UINT8*) p_buf;
+        int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, data_len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, "BrcmHciX", log_line);
     }
-    log_line[j] = '\0';
 
-    __android_log_write(ANDROID_LOG_DEBUG, "BrcmHciR", log_line);
+
+    //Decode a few Bluetooth HCI packets into hex numbers.
+    void DispHciEvt (BT_HDR *p_buf)
+    {
+        UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
+        UINT8* data = (UINT8*) p_buf;
+        int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, data_len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, "BrcmHciR", log_line);
+    }
+
+
+    /*******************************************************************************
+    **
+    ** Function         DispLLCP
+    **
+    ** Description      Log LLCP packet as hex-ascii bytes.
+    **
+    ** Returns          None.
+    **
+    *******************************************************************************/
+    void DispLLCP (BT_HDR *p_buf, BOOLEAN is_recv)
+    {
+        UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
+        UINT8 * data = (UINT8*) p_buf;
+        int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, data_len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, (is_recv) ? "BrcmLlcpR": "BrcmLlcpX", log_line);
+    }
+
+
+    /*******************************************************************************
+    **
+    ** Function         DispHcp
+    **
+    ** Description      Log raw HCP packet as hex-ascii bytes
+    **
+    ** Returns          None.
+    **
+    *******************************************************************************/
+    void DispHcp (UINT8 *data, UINT16 len, BOOLEAN is_recv)
+    {
+        UINT32 nBytes = (len*2)+1;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        // Only trace HCP if we're tracing HCI as well
+        if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_HCI_SUMMARY))
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, (is_recv) ? "BrcmHcpR": "BrcmHcpX", log_line);
+    }
+
+
+    void DispSNEP (UINT8 local_sap, UINT8 remote_sap, BT_HDR *p_buf, BOOLEAN is_first, BOOLEAN is_rx) {}
+    void DispCHO (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_rx) {}
+    void DispT3TagMessage(BT_HDR *p_msg, BOOLEAN is_rx) {}
+    void DispRWT4Tags (BT_HDR *p_buf, BOOLEAN is_rx) {}
+    void DispCET4Tags (BT_HDR *p_buf, BOOLEAN is_rx) {}
+    void DispRWI93Tag (BT_HDR *p_buf, BOOLEAN is_rx, UINT8 command_to_respond) {}
+    void DispNDEFMsg (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_recv) {}
+
+
+/*******************************************************************************
+**
+** Function:        LogMsg
+**
+** Description:     Print messages from NFC stack.
+**
+** Returns:         None.
+**
+*******************************************************************************/
+void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...)
+{
+    static char buffer [BTE_LOG_BUF_SIZE];
+    va_list ap;
+    UINT32 trace_type = trace_set_mask & 0x07; //lower 3 bits contain trace type
+    int android_log_type = ANDROID_LOG_INFO;
+
+    va_start (ap, fmt_str);
+    vsnprintf (buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
+    va_end (ap);
+    if (trace_type == TRACE_TYPE_ERROR)
+        android_log_type = ANDROID_LOG_ERROR;
+    __android_log_write (android_log_type, LOGMSG_TAG_NAME, buffer);
+}
+
+
+void LogMsg_0 (UINT32 maskTraceSet, const char *p_str)
+{
+    LogMsg (maskTraceSet, p_str);
+}
+
+
+void LogMsg_1 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1)
+{
+    LogMsg (maskTraceSet, fmt_str, p1);
+}
+
+
+void LogMsg_2 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2);
+}
+
+
+void LogMsg_3 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3);
+}
+
+
+void LogMsg_4 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3, p4);
+}
+
+void LogMsg_5 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3, p4, p5);
+}
+
+
+void LogMsg_6 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5, UINT32 p6)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3, p4, p5, p6);
 }
diff --git a/halimpl/bcm2079x/adaptation/config.cpp b/halimpl/bcm2079x/adaptation/config.cpp
index 11ef297..f847389 100644
--- a/halimpl/bcm2079x/adaptation/config.cpp
+++ b/halimpl/bcm2079x/adaptation/config.cpp
@@ -24,7 +24,6 @@
 
 #define LOG_TAG "NfcNciHal"
 
-const char alternative_config_path[] = "";
 const char transport_config_path[] = "/etc/";
 
 #define config_name             "libnfc-brcm.conf"
@@ -380,16 +379,6 @@ CNfcConfig& CNfcConfig::GetInstance()
     if (theInstance.size() == 0 && theInstance.mValidFile)
     {
         string strPath;
-        if (alternative_config_path[0] != '\0')
-        {
-            strPath.assign(alternative_config_path);
-            strPath += config_name;
-            theInstance.readConfig(strPath.c_str(), true);
-            if (!theInstance.empty())
-            {
-                return theInstance;
-        }
-        }
         strPath.assign(transport_config_path);
         strPath += config_name;
         theInstance.readConfig(strPath.c_str(), true);
@@ -739,9 +728,6 @@ void readOptionalConfig(const char* extra)
 {
     string strPath;
     strPath.assign(transport_config_path);
-    if (alternative_config_path[0] != '\0')
-        strPath.assign(alternative_config_path);
-
     strPath += extra_config_base;
     strPath += extra;
     strPath += extra_config_ext;
diff --git a/halimpl/bcm2079x/adaptation/patchram.cpp b/halimpl/bcm2079x/adaptation/patchram.cpp
index 7b693ca..955be5f 100644
--- a/halimpl/bcm2079x/adaptation/patchram.cpp
+++ b/halimpl/bcm2079x/adaptation/patchram.cpp
@@ -49,6 +49,7 @@ extern UINT8 *p_nfc_hal_dm_start_up_cfg; //defined in the HAL
 static UINT8 nfa_dm_start_up_vsc_cfg[CONFIG_MAX_LEN];
 extern UINT8 *p_nfc_hal_dm_start_up_vsc_cfg; //defined in the HAL
 extern UINT8 *p_nfc_hal_dm_lptd_cfg; //defined in the HAL
+static UINT8 sDontSendLptd[] = { 0 };
 extern UINT8 *p_nfc_hal_pre_discover_cfg; //defined in the HAL
 
 extern tSNOOZE_MODE_CONFIG gSnoozeModeCfg;
@@ -307,17 +308,15 @@ void prmCallback(UINT8 event)
 ** Returns:         None
 **
 *******************************************************************************/
-static void getNfaValues()
+static void getNfaValues (UINT32 chipid)
 {
     unsigned long num = 0;
     int actualLen = 0;
 
-    p_nfc_hal_cfg->nfc_hal_prm_nvm_required = TRUE; //don't download firmware if controller cannot detect EERPOM
     sStartupConfig.initialize ();
     sLptdConfig.initialize ();
     sPreDiscoveryConfig.initialize();
 
-
     actualLen = GetStrValue (NAME_NFA_DM_START_UP_CFG, (char*)sConfig, sizeof(sConfig));
     if (actualLen)
         sStartupConfig.append (sConfig, actualLen);
@@ -347,6 +346,11 @@ static void getNfaValues()
         sLptdConfig.append (sConfig, actualLen);
         p_nfc_hal_dm_lptd_cfg = const_cast<UINT8*> (sLptdConfig.getInternalBuffer ());
     }
+    else
+    {
+        // Default to not sending any LPTD setting.
+        p_nfc_hal_dm_lptd_cfg = sDontSendLptd;
+    }
 
     mayDisableSecureElement (sStartupConfig);
     p_nfc_hal_dm_start_up_cfg = const_cast<UINT8*> (sStartupConfig.getInternalBuffer ());
@@ -358,6 +362,28 @@ static void getNfaValues()
         mayDisableSecureElement (sPreDiscoveryConfig);
         p_nfc_hal_pre_discover_cfg = const_cast<UINT8*> (sPreDiscoveryConfig.getInternalBuffer ());
     }
+
+    //configure how many secure elements are available for each type of chip
+    if (p_nfc_hal_cfg->nfc_hal_hci_uicc_support > 0)
+    {
+        if (GetNumValue(NAME_NFA_MAX_EE_SUPPORTED, &num, sizeof(num)))
+            nfc_hal_cb.max_ee = num;
+        else if ((chipid & BRCM_NFC_GEN_MASK) == BRCM_NFC_20791_GEN)
+        {
+            nfc_hal_cb.max_ee = BRCM_NFC_20791_GEN_MAX_EE;
+            p_nfc_hal_cfg->nfc_hal_hci_uicc_support = HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST;
+        }
+        else if ((chipid & BRCM_NFC_GEN_MASK) == BRCM_NFC_43341_GEN)
+        {
+            nfc_hal_cb.max_ee = BRCM_NFC_43341_GEN_MAX_EE;
+            p_nfc_hal_cfg->nfc_hal_hci_uicc_support = HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST;
+        }
+        else if ((chipid & BRCM_NFC_GEN_MASK) == BRCM_NFC_20795_GEN)
+        {
+            nfc_hal_cb.max_ee = BRCM_NFC_20795_GEN_MAX_EE;
+            p_nfc_hal_cfg->nfc_hal_hci_uicc_support = HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST | HAL_NFC_HCI_UICC2_HOST;
+        }
+    }
 }
 
 /*******************************************************************************
@@ -380,8 +406,7 @@ static void StartPatchDownload(UINT32 chipid)
 
     readOptionalConfig(chipID);     // Read optional chip specific settings
     readOptionalConfig("fime");     // Read optional FIME specific settings
-    getNfaValues();                 // Get NFA configuration values into variables
-
+    getNfaValues(chipid);                 // Get NFA configuration values into variables
 
     findPatchramFile(FW_PATCH, sPatchFn, sizeof(sPatchFn));
     findPatchramFile(FW_PRE_PATCH, sPrePatchFn, sizeof(sPatchFn));
@@ -488,16 +513,24 @@ void nfc_hal_post_reset_init (UINT32 brcm_hw_id, UINT8 nvm_type)
 {
     ALOGD("%s: brcm_hw_id=0x%lx, nvm_type=%d", __FUNCTION__, brcm_hw_id, nvm_type);
     tHAL_NFC_STATUS stat = HAL_NFC_STATUS_FAILED;
-    UINT8 max_credits = 1;
+    UINT8 max_credits = 1, allow_no_nvm=0;
+
+    p_nfc_hal_cfg->nfc_hal_prm_nvm_required = TRUE; //don't download firmware if controller cannot detect EERPOM
 
     if (nvm_type == NCI_SPD_NVM_TYPE_NONE)
     {
+        GetNumValue(NAME_ALLOW_NO_NVM, &allow_no_nvm, sizeof(allow_no_nvm));
+        if (allow_no_nvm == 0)
+        {
         ALOGD("%s: No NVM detected, FAIL the init stage to force a retry", __FUNCTION__);
         USERIAL_PowerupDevice (0);
         stat = HAL_NfcReInit ();
+            return;
+        }
+
+        p_nfc_hal_cfg->nfc_hal_prm_nvm_required = FALSE; //allow download firmware if controller cannot detect EERPOM
     }
-    else
-    {
+
         /* Start downloading the patch files */
         StartPatchDownload(brcm_hw_id);
 
@@ -507,7 +540,6 @@ void nfc_hal_post_reset_init (UINT32 brcm_hw_id, UINT8 nvm_type)
             HAL_NfcSetMaxRfDataCredits(max_credits);
         }
     }
-}
 
 
 /*******************************************************************************
@@ -536,3 +568,41 @@ void mayDisableSecureElement (StartupConfig& config)
         config.disableSecureElement ((UINT8) (bitmask & 0xC0));
     }
 }
+
+
+/*******************************************************************************
+**
+** Function:    configureCrystalFrequency
+**
+** Description: Configure controller's crystal frequency by reading values from
+**              .conf file.  If .conf file does not define any value, then use
+**              default values defined in struct nfc_post_reset_cb.
+**
+** Returns:     none
+**
+*******************************************************************************/
+void configureCrystalFrequency ()
+{
+    unsigned long num = 0;
+    UINT32 hwId = 0;
+    UINT16 xtalFreq = 0;
+    UINT8 xtalIndex = 0;
+
+    GetNumValue (NAME_XTAL_HARDWARE_ID, &num, sizeof(num));
+    hwId = num;
+
+    GetNumValue (NAME_XTAL_FREQUENCY, &num, sizeof(num));
+    xtalFreq = (UINT16) num;
+
+    GetNumValue (NAME_XTAL_FREQ_INDEX, &num, sizeof(num));
+    xtalIndex = (UINT8) num;
+
+    if ((hwId == 0) && (xtalFreq == 0) && (xtalIndex == 0))
+        return;
+
+    ALOGD ("%s: hwId=0x%lX; freq=%u; index=%u", __FUNCTION__, hwId, xtalFreq, xtalIndex);
+    nfc_post_reset_cb.dev_init_config.xtal_cfg[0].brcm_hw_id = (hwId & BRCM_NFC_GEN_MASK);
+    nfc_post_reset_cb.dev_init_config.xtal_cfg[0].xtal_freq  = xtalFreq;
+    nfc_post_reset_cb.dev_init_config.xtal_cfg[0].xtal_index = xtalIndex;
+    nfc_post_reset_cb.dev_init_config.num_xtal_cfg = 1;
+}
diff --git a/halimpl/bcm2079x/adaptation/userial_linux.c b/halimpl/bcm2079x/adaptation/userial_linux.c
index 1a474d3..5e543cf 100644
--- a/halimpl/bcm2079x/adaptation/userial_linux.c
+++ b/halimpl/bcm2079x/adaptation/userial_linux.c
@@ -48,6 +48,7 @@
 #endif
 extern UINT8 appl_trace_level;
 
+
 /* Mapping of USERIAL_PORT_x to linux */
 extern UINT32 ScrProtocolTraceFlag;
 static tUPIO_STATE current_nfc_wake_state = UPIO_OFF;
@@ -423,10 +424,16 @@ static inline int create_signal_fds(struct pollfd* set)
 *******************************************************************************/
 static inline void close_signal_fds()
 {
-    close(signal_fds[0]);
+    int stat = 0;
+
+    stat = close(signal_fds[0]);
+    if (stat == -1)
+        ALOGE ("%s, fail close index 0; errno=%d", __FUNCTION__, errno);
     signal_fds[0] = 0;
 
-    close(signal_fds[1]);
+    stat = close(signal_fds[1]);
+    if (stat == -1)
+        ALOGE ("%s, fail close index 1; errno=%d", __FUNCTION__, errno);
     signal_fds[1] = 0;
 }
 
@@ -540,13 +547,28 @@ UDRV_API void    USERIAL_Init(void * p_cfg)
 {
     ALOGI(__FUNCTION__);
 
+    //if userial_close_thread() is waiting to run; let it go first;
+    //let it finish; then continue this function
+    while (TRUE)
+    {
+        pthread_mutex_lock(&close_thread_mutex);
+        if (is_close_thread_is_waiting)
+        {
+            pthread_mutex_unlock(&close_thread_mutex);
+            ALOGI("USERIAL_Open(): wait for close-thread");
+            sleep (1);
+        }
+        else
+            break;
+    }
+
     memset(&linux_cb, 0, sizeof(linux_cb));
     linux_cb.sock = -1;
     linux_cb.ser_cb = NULL;
     linux_cb.sock_power_control = -1;
     linux_cb.client_device_address = 0;
     GKI_init_q(&Userial_in_q);
-    return;
+    pthread_mutex_unlock(&close_thread_mutex);
 }
 
 /*******************************************************************************
@@ -652,6 +674,8 @@ int my_read(int fd, uchar *pbuf, int len)
             break;
         }
     } while (count > 0);
+
+
  #if VALIDATE_PACKET
 /*
  * vallidate the packet structure
@@ -1000,7 +1024,7 @@ UDRV_API void USERIAL_Open(tUSERIAL_PORT port, tUSERIAL_OPEN_CFG *p_cfg, tUSERIA
             GKI_send_event(NFC_HAL_TASK, NFC_HAL_TASK_EVT_TERMINATE);
             goto done_open;
         }
-        ALOGD( "sock = %d\n", linux_cb.sock);
+        ALOGD( "%s sock = %d\n", __FUNCTION__, linux_cb.sock);
         if (GetStrValue ( NAME_POWER_CONTROL_DRIVER, power_control_dev, sizeof ( power_control_dev ) ) &&
             power_control_dev[0] != '\0')
         {
@@ -1450,13 +1474,13 @@ void userial_close_thread(UINT32 params)
         GKI_delay(gPostPowerOffDelay);
     }
     result = close(linux_cb.sock);
-    if (result<0)
-        ALOGD("%s: close return %d", __FUNCTION__, result);
+    if (result == -1)
+        ALOGE("%s: fail close linux_cb.sock; errno=%d", __FUNCTION__, errno);
 
     if (linux_cb.sock_power_control > 0 && linux_cb.sock_power_control != linux_cb.sock)
     result = close(linux_cb.sock_power_control);
-    if (result<0)
-        ALOGD("%s: close return %d", __FUNCTION__, result);
+    if (result == -1)
+        ALOGE("%s: fail close linux_cb.sock_power_control; errno=%d", __FUNCTION__, errno);
 
     linux_cb.sock_power_control = -1;
     linux_cb.sock = -1;
@@ -1650,7 +1674,7 @@ UDRV_API void USERIAL_PowerupDevice(tUSERIAL_PORT port)
                 resetSuccess = 1;
                 linux_cb.client_device_address = bcmi2cnfc_client_addr;
                 /* Delay long enough for address change */
-                delay = 200;
+                delay = 100;
             }
         } else {
             resetSuccess = 1;
@@ -1693,9 +1717,12 @@ static int change_client_addr(int addr)
     /* If it fails, it is likely a B3 we are talking to */
     if (ret != size) {
         ALOGD( "change_client_addr() change addr to 0x%x by setting BSP address to 0x%x\n", addr, ALIAS_CLIENT_ADDRESS);
-        /* MACO changed to support B3 with old kernel driver */
-        ret = ioctl(linux_cb.sock, BCMNFC_CHANGE_ADDR, addr);
-        return ret;
+        /* legacy kernel */
+        ioctl(linux_cb.sock, BCMNFC_CHANGE_ADDR, addr);
+        /* We'll tweak address to make it look like 0x1FA address */
+        ret = ioctl(linux_cb.sock, BCMNFC_SET_CLIENT_ADDR, ALIAS_CLIENT_ADDRESS);
+        size++;
+        ret = write(linux_cb.sock, addr_data, size);
     }
 
     if (ret == size) {
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c b/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c
index 46ef04b..ad02144 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c
@@ -73,18 +73,6 @@ const UINT8 nfc_hal_dm_get_patch_version_cmd [NCI_MSG_HDR_SIZE] =
 };
 #define NCI_PATCH_INFO_VERSION_LEN  16  /* Length of patch version string in PATCH_INFO */
 
-/* Version string for BCM20791B3 */
-const UINT8 NFC_HAL_DM_BCM20791B3_STR[]   = "20791B3";
-#define NFC_HAL_DM_BCM20791B3_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B3_STR)-1)
-
-/* Version string for BCM20791B4 */
-const UINT8 NFC_HAL_DM_BCM20791B4_STR[]   = "20791B4";
-#define NFC_HAL_DM_BCM20791B4_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B4_STR)-1)
-
-/* Version string for BCM43341B0 */
-const UINT8 NFC_HAL_DM_BCM43341B0_STR[]   = "43341B0";
-#define NFC_HAL_DM_BCM43341B0_STR_LEN     (sizeof (NFC_HAL_DM_BCM43341B0_STR)-1)
-
 /*****************************************************************************
 ** Extern function prototypes
 *****************************************************************************/
@@ -576,25 +564,7 @@ void nfc_hal_dm_proc_msg_during_init (NFC_HDR *p_msg)
 
             STREAM_TO_ARRAY (chipverstr, p, chipverlen);
 
-            if ((chipverlen == NFC_HAL_DM_BCM20791B3_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B3_STR, chipverstr, NFC_HAL_DM_BCM20791B3_STR_LEN) == 0))
-            {
-                /* BCM2079B3 FW - eSE restarted for patch download */
-                nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
-                nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = TRUE;
-            }
-            else if (  ((chipverlen == NFC_HAL_DM_BCM20791B4_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B4_STR, chipverstr, NFC_HAL_DM_BCM20791B4_STR_LEN) == 0))
-                     ||((chipverlen == NFC_HAL_DM_BCM43341B0_STR_LEN) && (memcmp (NFC_HAL_DM_BCM43341B0_STR, chipverstr, NFC_HAL_DM_BCM43341B0_STR_LEN) == 0))  )
-            {
-                /* BCM43341B0/BCM2079B4 FW - eSE restarted for patch download */
-                nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
-                nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
-            }
-            else
-            {
-                /* BCM2079B5 FW - eSE not be restarted for patch download from UICC */
-                nfc_hal_cb.hci_cb.hci_fw_workaround         = FALSE;
-                nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
-            }
+            nfc_hal_hci_handle_build_info (chipverlen, chipverstr);
 
             /* if NFCC needs to set Xtal frequency before getting patch version */
             if (nfc_hal_dm_get_xtal_index (nfc_hal_cb.dev_cb.brcm_hw_id, &xtal_freq) < NFC_HAL_XTAL_INDEX_MAX)
@@ -988,7 +958,6 @@ void nfc_hal_dm_shutting_down_nfcc (void)
     }
 
     nfc_hal_cb.ncit_cb.nci_wait_rsp = NFC_HAL_WAIT_RSP_NONE;
-    nfc_hal_cb.hci_cb.hcp_conn_id = 0;
 
     nfc_hal_cb.dev_cb.power_mode  = NFC_HAL_POWER_MODE_FULL;
     nfc_hal_cb.dev_cb.snooze_mode = NFC_HAL_LP_SNOOZE_MODE_NONE;
@@ -997,7 +966,10 @@ void nfc_hal_dm_shutting_down_nfcc (void)
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.ncit_cb.nci_wait_rsp_timer);
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.dev_cb.lp_timer);
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.prm.timer);
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    nfc_hal_cb.hci_cb.hcp_conn_id = 0;
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.hci_cb.hci_timer);
+#endif
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.timer);
 }
 
@@ -1019,7 +991,9 @@ void nfc_hal_dm_init (void)
 
     nfc_hal_cb.ncit_cb.nci_wait_rsp_timer.p_cback = nfc_hal_nci_cmd_timeout_cback;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
     nfc_hal_cb.hci_cb.hci_timer.p_cback = nfc_hal_hci_timeout_cback;
+#endif
 
     nfc_hal_cb.pre_discover_done        = FALSE;
 
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c b/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c
index defc610..420a538 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c
@@ -148,10 +148,14 @@ tNFC_HAL_CFG nfc_hal_cfg =
                                             ** then set it to short to optimize bootup time because NFCC cannot send RESET NTF.
                                             ** Otherwise, it depends on NVM type and size of patchram.
                                             */
-    (UINT16) NFC_HAL_NFCC_ENABLE_TIMEOUT,   /* max time to wait for RESET NTF after setting Xtal frequency
+    (UINT16) NFC_HAL_NFCC_ENABLE_TIMEOUT    /* max time to wait for RESET NTF after setting Xtal frequency
                                             ** It depends on NVM type and size of patchram.
                                             */
-    (HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST)  /* Set bit(s) for supported UICC(s) */
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    ,
+    TRUE,                                   /* set nfc_hal_first_boot to TRUE, if platform enables NFC for the first time after bootup */
+    (HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST | HAL_NFC_HCI_UICC2_HOST)  /* Set bit(s) for supported UICC(s) */
+#endif
 };
 
 tNFC_HAL_CFG *p_nfc_hal_cfg= (tNFC_HAL_CFG *) &nfc_hal_cfg;
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c b/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c
index 0a754d1..6b573d5 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c
@@ -23,13 +23,17 @@
  *
  ******************************************************************************/
 #include "gki.h"
+#include "nfc_hal_target.h"
 #include "nfc_hal_api.h"
 #include "nfc_hal_int.h"
+
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+
 #include "nfc_hal_nv_ci.h"
 #include "nfc_hal_nv_co.h"
 
 #include <string.h>
-#include "nfc_hal_nv_co.h"
+
 
 #ifndef NFC_HAL_HCI_NV_READ_TIMEOUT
 #define NFC_HAL_HCI_NV_READ_TIMEOUT    1000
@@ -46,6 +50,21 @@
 
 #define NFC_HAL_HCI_PIPE_VALID_MASK                         0x80
 
+#define NFC_HAL_HCI_FIRST_BOOT_SESSION_ID_0_VAL             0xFF
+#define NFC_HAL_HCI_NEXT_BOOT_SESSION_ID_0_VAL              0xFE
+
+/* Version string for BCM20791B3 */
+const UINT8 NFC_HAL_DM_BCM20791B3_STR[]   = "20791B3";
+#define NFC_HAL_DM_BCM20791B3_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B3_STR)-1)
+
+/* Version string for BCM20791B4 */
+const UINT8 NFC_HAL_DM_BCM20791B4_STR[]   = "20791B4";
+#define NFC_HAL_DM_BCM20791B4_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B4_STR)-1)
+
+/* Version string for BCM43341B0 */
+const UINT8 NFC_HAL_DM_BCM43341B0_STR[]   = "43341B0";
+#define NFC_HAL_DM_BCM43341B0_STR_LEN     (sizeof (NFC_HAL_DM_BCM43341B0_STR)-1)
+
 extern tNFC_HAL_CFG *p_nfc_hal_cfg;
 /****************************************************************************
 ** Internal function prototypes
@@ -72,10 +91,10 @@ void nfc_hal_hci_evt_hdlr (tNFC_HAL_HCI_EVENT_DATA *p_evt_data)
     switch (p_evt_data->hdr.event)
     {
     case NFC_HAL_HCI_RSP_NV_READ_EVT:
-        if (  (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf && (p_evt_data->nv_read.block == HC_F3_NV_BLOCK || p_evt_data->nv_read.block == HC_F4_NV_BLOCK))
+        if (  (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf && (p_evt_data->nv_read.block == HC_F3_NV_BLOCK || p_evt_data->nv_read.block == HC_F4_NV_BLOCK || p_evt_data->nv_read.block == HC_F5_NV_BLOCK))
             ||(nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf && p_evt_data->nv_read.block == HC_F2_NV_BLOCK)  )
         {
-        nfc_hal_hci_handle_nv_read (p_evt_data->nv_read.block, p_evt_data->nv_read.status, p_evt_data->nv_read.size);
+            nfc_hal_hci_handle_nv_read (p_evt_data->nv_read.block, p_evt_data->nv_read.status, p_evt_data->nv_read.size);
         }
         else
         {
@@ -131,7 +150,8 @@ void nfc_hal_hci_enable (void)
     }
 
     if (  (p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC0_HOST)
-        ||((p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC1_HOST) && ((!nfc_hal_cb.hci_cb.hci_fw_workaround) || (nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_EEPROM)))  )
+        ||((p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC1_HOST) && ((!nfc_hal_cb.hci_cb.hci_fw_workaround) || (nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_EEPROM)))
+        ||(p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC2_HOST)  )
     {
         if ((p_hci_netwk_cmd = (UINT8 *) GKI_getbuf (NCI_MSG_HDR_SIZE + NFC_HAL_HCI_NETWK_INFO_SIZE)) == NULL)
         {
@@ -165,6 +185,40 @@ void nfc_hal_hci_enable (void)
 
 /*******************************************************************************
 **
+** Function         nfc_hal_hci_handle_build_info
+**
+** Description      handle build info evt
+**
+** Returns          void
+**
+*******************************************************************************/
+void nfc_hal_hci_handle_build_info (UINT8 chipverlen, UINT8 *p_chipverstr)
+{
+    HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_build_info ()");
+
+    if ((chipverlen == NFC_HAL_DM_BCM20791B3_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B3_STR, p_chipverstr, NFC_HAL_DM_BCM20791B3_STR_LEN) == 0))
+    {
+        /* BCM2079B3 FW - eSE restarted for patch download */
+        nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
+        nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = TRUE;
+    }
+    else if (  ((chipverlen == NFC_HAL_DM_BCM20791B4_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B4_STR, p_chipverstr, NFC_HAL_DM_BCM20791B4_STR_LEN) == 0))
+             ||((chipverlen == NFC_HAL_DM_BCM43341B0_STR_LEN) && (memcmp (NFC_HAL_DM_BCM43341B0_STR, p_chipverstr, NFC_HAL_DM_BCM43341B0_STR_LEN) == 0))  )
+    {
+        /* BCM43341B0/BCM2079B4 FW - eSE restarted for patch download */
+        nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
+        nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
+    }
+    else
+    {
+        /* BCM2079B5 FW - eSE not be restarted for patch download from UICC */
+        nfc_hal_cb.hci_cb.hci_fw_workaround         = FALSE;
+        nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
+    }
+}
+
+/*******************************************************************************
+**
 ** Function         nfc_hal_hci_handle_hci_netwk_info
 **
 ** Description      Handler function for HCI Network Notification
@@ -176,8 +230,9 @@ void nfc_hal_hci_handle_hci_netwk_info (UINT8 *p_data)
 {
     UINT8  *p = p_data;
     UINT16 data_len;
-    UINT8  target_handle;
-    UINT8   hci_netwk_cmd[1 + NFC_HAL_HCI_SESSION_ID_LEN];
+    UINT8  target_handle = 0;
+    UINT8  hci_netwk_cmd[1 + NFC_HAL_HCI_SESSION_ID_LEN];
+    UINT8  block = 0;
 
     HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_hci_netwk_info ()");
 
@@ -188,46 +243,46 @@ void nfc_hal_hci_handle_hci_netwk_info (UINT8 *p_data)
     target_handle = *(UINT8 *) p;
 
     if (target_handle == NFC_HAL_HCI_DH_TARGET_HANDLE)
+    {
+        /* Correct the session id assigned by DH */
+        *(p+1) = nfc_hal_cb.hci_cb.dh_session_id[0];
         nfc_hal_nv_co_write (p, data_len, HC_F2_NV_BLOCK);
+        return;
+    }
 
-    else if (target_handle == NFC_HAL_HCI_UICC0_TARGET_HANDLE)
+    if (target_handle == NFC_HAL_HCI_UICC0_TARGET_HANDLE)
     {
-        if (  (!nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_B_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_BP_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_F_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)  )
-        {
-            /* HCI Network notification received for UICC 0, Update nv data */
-            nfc_hal_nv_co_write (p, data_len,HC_F3_NV_BLOCK);
-        }
-        else
-        {
-            HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Type A Card Emulation invalid, Reset nv file: 0x%02x", p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET]);
-            hci_netwk_cmd[0] = NFC_HAL_HCI_UICC0_TARGET_HANDLE;
-            memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-            nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F3_NV_BLOCK);
-        }
+        block = HC_F3_NV_BLOCK;
     }
     else if (target_handle == NFC_HAL_HCI_UICC1_TARGET_HANDLE)
     {
-        if (  (!nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_B_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_BP_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_F_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)  )
-        {
-            /* HCI Network notification received for UICC 1, Update nv data */
-            nfc_hal_nv_co_write (p, data_len,HC_F4_NV_BLOCK);
-        }
-        else
-        {
-            HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Type A Card Emulation invalid, Reset nv file: 0x%02x", p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET]);
-            hci_netwk_cmd[0] = NFC_HAL_HCI_UICC1_TARGET_HANDLE;
-            /* Reset Session ID */
-            memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-            nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F4_NV_BLOCK);
-        }
+        block = HC_F4_NV_BLOCK;
+    }
+    else if (target_handle == NFC_HAL_HCI_UICC2_TARGET_HANDLE)
+    {
+        block = HC_F5_NV_BLOCK;
+    }
+    else
+    {
+        HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Invalid Target handle: 0x%02x", target_handle);
+        return;
+    }
+
+    if (  (!nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_B_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_BP_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_F_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)  )
+    {
+        /* HCI Network notification received for UICC0/UICC1/UICC2, Update nv data */
+        nfc_hal_nv_co_write (p, data_len, block);
+    }
+    else
+    {
+        HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Type A Card Emulation invalid, Reset nv file: 0x%02x", p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET]);
+        hci_netwk_cmd[0] = target_handle;
+        memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
+        nfc_hal_nv_co_write (hci_netwk_cmd, 1, block);
     }
 }
 
@@ -298,13 +353,6 @@ BOOLEAN nfc_hal_hci_handle_hcp_pkt_to_hc (UINT8 *p_data)
 
     HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_hcp_pkt_to_hc ()");
 
-    if (  (!nfc_hal_cb.hci_cb.hci_fw_workaround)
-        ||(nfc_hal_cb.nvm_cb.nvm_type != NCI_SPD_NVM_TYPE_UICC)  )
-    {
-        /* Do nothing, just forward the stack hcp packet to host controller */
-        return FALSE;
-    }
-
     chaining_bit = ((*p_data) >> 0x07) & 0x01;
     pipe = (*p_data++) & 0x7F;
 
@@ -316,21 +364,46 @@ BOOLEAN nfc_hal_hci_handle_hcp_pkt_to_hc (UINT8 *p_data)
         if (type == NFC_HAL_HCI_COMMAND_TYPE)
         {
             inst  = (*p_data++ & 0x3F);
-            if (inst == NFC_HAL_HCI_ANY_SET_PARAMETER)
+            if (inst == NFC_HAL_HCI_ANY_GET_PARAMETER)
             {
                 index = *(p_data++);
-                if (index == NFC_HAL_HCI_WHITELIST_INDEX)
+                if (index == NFC_HAL_HCI_SESSION_IDENTITY_INDEX)
                 {
-                    /* Set flag to fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd to nfc task after
-                     * response from host controller to set whitelist cmd
+                    /* Set flag to modify session id[0] on response
+                     * from host controller to set session id cmd
                      */
-                    nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1 = TRUE;
+                    nfc_hal_cb.hci_cb.update_session_id = TRUE;
+                }
+            }
+            else if (inst == NFC_HAL_HCI_ANY_SET_PARAMETER)
+            {
+                index = *(p_data++);
+                if (index == NFC_HAL_HCI_WHITELIST_INDEX)
+                {
+                    if (  (nfc_hal_cb.hci_cb.hci_fw_workaround)
+                        &&(nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_UICC)  )
+                    {
+                        /* Set flag to fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd to nfc task after
+                         * response from host controller to set whitelist cmd
+                         */
+                        nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1 = TRUE;
+                    }
+                }
+                else if (index == NFC_HAL_HCI_SESSION_IDENTITY_INDEX)
+                {
+                    nfc_hal_cb.hci_cb.dh_session_id[0] = *p_data;
+                    if (p_nfc_hal_cfg->nfc_hal_first_boot)
+                        *p_data = NFC_HAL_HCI_FIRST_BOOT_SESSION_ID_0_VAL;
+                    else
+                        *p_data = NFC_HAL_HCI_NEXT_BOOT_SESSION_ID_0_VAL;
                 }
             }
         }
         else if (type == NFC_HAL_HCI_RESPONSE_TYPE)
         {
-            if (nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)
+            if (  (nfc_hal_cb.hci_cb.hci_fw_workaround)
+                &&(nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_UICC)
+                &&(nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)  )
             {
                 /* Got response to the fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd sent by HAL to nfc task */
                 nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1 =  FALSE;
@@ -360,12 +433,10 @@ void nfc_hal_hci_handle_hcp_pkt_from_hc (UINT8 *p_data)
     UINT8   inst;
     UINT8   hci_netwk_cmd[1 + NFC_HAL_HCI_SESSION_ID_LEN];
     UINT8   source_host;
+    UINT8   block = 0;
 
     HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_hcp_pkt_from_hc ()");
 
-    if (!nfc_hal_cb.hci_cb.hci_fw_workaround)
-        return;
-
     chaining_bit = ((*p_data) >> 0x07) & 0x01;
     pipe = (*p_data++) & 0x7F;
 
@@ -376,35 +447,54 @@ void nfc_hal_hci_handle_hcp_pkt_from_hc (UINT8 *p_data)
 
         if (type == NFC_HAL_HCI_COMMAND_TYPE)
         {
+            if (!nfc_hal_cb.hci_cb.hci_fw_workaround)
+                return;
+
             inst  = (*p_data++ & 0x3F);
 
             if (inst == NFC_HAL_HCI_ADM_NOTIFY_ALL_PIPE_CLEARED)
             {
-
                 STREAM_TO_UINT8 (source_host, p_data);
 
                 HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Received ADM_NOTIFY_ALL_PIPE_CLEARED command for UICC: 0x%02x", source_host);
                 if (source_host == NFC_HAL_HCI_HOST_ID_UICC0)
                 {
+                    block            = HC_F3_NV_BLOCK;
                     hci_netwk_cmd[0] = NFC_HAL_HCI_UICC0_TARGET_HANDLE;
-                    /* Reset Session ID */
-                    memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-                    nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F3_NV_BLOCK);
-                    HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Sent command to reset nv file for block: 0x%02x", HC_F3_NV_BLOCK);
                 }
                 else if (source_host == NFC_HAL_HCI_HOST_ID_UICC1)
                 {
+                    block            = HC_F4_NV_BLOCK;
                     hci_netwk_cmd[0] = NFC_HAL_HCI_UICC1_TARGET_HANDLE;
+                }
+                else if (source_host == NFC_HAL_HCI_HOST_ID_UICC2)
+                {
+                    block            = HC_F5_NV_BLOCK;
+                    hci_netwk_cmd[0] = NFC_HAL_HCI_UICC2_TARGET_HANDLE;
+                }
+
+                if (source_host >= NFC_HAL_HCI_HOST_ID_UICC0)
+                {
                     /* Reset Session ID */
                     memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-                    nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F4_NV_BLOCK);
-                    HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Sent command to reset nv file for block: 0x%02x", HC_F4_NV_BLOCK);
+                    nfc_hal_nv_co_write (hci_netwk_cmd, 1, block);
+                    HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Sent command to reset nv file for block: 0x%02x", block);
                 }
             }
         }
         else if (type == NFC_HAL_HCI_RESPONSE_TYPE)
         {
-            if (nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)
+            if (nfc_hal_cb.hci_cb.update_session_id)
+            {
+                nfc_hal_cb.hci_cb.update_session_id = FALSE;
+                inst  = (*p_data++ & 0x3F);
+                if (inst == NFC_HAL_HCI_ANY_OK)
+                {
+                    /* Correct the session id assigned by DH */
+                    *p_data = nfc_hal_cb.hci_cb.dh_session_id[0];
+                }
+            }
+            else if (nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)
             {
                 /* NVM Type is UICC and got response from host controller
                  * to Set whitelist command. Now fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd to
@@ -439,6 +529,7 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
     {
     case HC_F3_NV_BLOCK:
     case HC_F4_NV_BLOCK:
+    case HC_F5_NV_BLOCK:
         if (  (status != HAL_NFC_STATUS_OK)
             ||(size > NFC_HAL_HCI_NETWK_INFO_SIZE)
             ||(size < NFC_HAL_HCI_MIN_NETWK_INFO_SIZE)
@@ -446,7 +537,13 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
         {
             HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_nv_read: Invalid data from nv memory, Set DEFAULT Configuration for block:0x%02x", block);
             memset (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf, 0, NFC_HAL_HCI_NETWK_INFO_SIZE);
-            nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = (block == HC_F3_NV_BLOCK) ? NFC_HAL_HCI_UICC0_TARGET_HANDLE : NFC_HAL_HCI_UICC1_TARGET_HANDLE;
+            if (block == HC_F3_NV_BLOCK)
+                nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = NFC_HAL_HCI_UICC0_TARGET_HANDLE;
+            else if (block == HC_F4_NV_BLOCK)
+                nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = NFC_HAL_HCI_UICC1_TARGET_HANDLE;
+            else
+                nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = NFC_HAL_HCI_UICC2_TARGET_HANDLE;
+
             memset (&nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
             size = NFC_HAL_HCI_NETWK_INFO_SIZE;
         }
@@ -455,15 +552,21 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
         break;
 
     case HC_F2_NV_BLOCK:
+        nfc_hal_cb.hci_cb.dh_session_id[0] = nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1];
+        if (p_nfc_hal_cfg->nfc_hal_first_boot)
+            nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1] = NFC_HAL_HCI_FIRST_BOOT_SESSION_ID_0_VAL;
+        else
+            nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1] = NFC_HAL_HCI_NEXT_BOOT_SESSION_ID_0_VAL;
 
         if (  (status != HAL_NFC_STATUS_OK)
             ||(size > NFC_HAL_HCI_DH_NETWK_INFO_SIZE)
             ||(size < NFC_HAL_HCI_MIN_DH_NETWK_INFO_SIZE)  )
         {
             HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_nv_read: Invalid data from nv memory, Set DEFAULT Configuration for block:0x%02x", block);
-            memset (nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf, 0, NFC_HAL_HCI_DH_NETWK_INFO_SIZE);
             nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[0] = NFC_HAL_HCI_DH_TARGET_HANDLE;
-            memset (&nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
+            nfc_hal_cb.hci_cb.dh_session_id[0] = 0xFF;
+            memset (&nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[2], 0xFF, (NFC_HAL_HCI_SESSION_ID_LEN - 1));
+            memset ((nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf + NFC_HAL_HCI_SESSION_ID_LEN + 1), 0, (NFC_HAL_HCI_DH_NETWK_INFO_SIZE - NFC_HAL_HCI_SESSION_ID_LEN - 1));
             size = NFC_HAL_HCI_DH_NETWK_INFO_SIZE;
             p_hci_netwk_info = (UINT8 *) nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf - NCI_MSG_HDR_SIZE;
         }
@@ -486,15 +589,15 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
         return;
     }
 
-        p = p_hci_netwk_info;
-        /* Send HCI Network ntf command using nv data */
-        NCI_MSG_BLD_HDR0 (p, NCI_MT_CMD, NCI_GID_PROP);
-        NCI_MSG_BLD_HDR1 (p, NCI_MSG_HCI_NETWK);
-        UINT8_TO_STREAM (p, (UINT8) size);
+    p = p_hci_netwk_info;
+    /* Send HCI Network ntf command using nv data */
+    NCI_MSG_BLD_HDR0 (p, NCI_MT_CMD, NCI_GID_PROP);
+    NCI_MSG_BLD_HDR1 (p, NCI_MSG_HCI_NETWK);
+    UINT8_TO_STREAM (p, (UINT8) size);
 
-        nfc_hal_dm_send_nci_cmd (p_hci_netwk_info, (UINT16) (NCI_MSG_HDR_SIZE + size), nfc_hal_hci_vsc_cback);
+    nfc_hal_dm_send_nci_cmd (p_hci_netwk_info, (UINT16) (NCI_MSG_HDR_SIZE + size), nfc_hal_hci_vsc_cback);
 
-        nfc_hal_cb.hci_cb.hci_netwk_config_block = block;
+    nfc_hal_cb.hci_cb.hci_netwk_config_block = block;
 }
 
 /*******************************************************************************
@@ -606,6 +709,18 @@ void nfc_hal_hci_set_next_hci_netwk_config (UINT8 block)
         HAL_TRACE_DEBUG2 ("nfc_hal_hci_set_next_hci_netwk_config (): Skip send F4 HCI NETWK CMD for UICC Mask: 0x%02x & NVM Type: 0x%02x", p_nfc_hal_cfg->nfc_hal_hci_uicc_support, nfc_hal_cb.nvm_cb.nvm_type);
 
     case HC_F4_NV_BLOCK:
+        if (  (p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC2_HOST)
+            &&(nfc_hal_cb.hci_cb.p_hci_netwk_info_buf)  )
+        {
+            /* Send command to read nvram data for 0xF5 */
+            memset (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf, 0, NFC_HAL_HCI_NETWK_INFO_SIZE);
+            nfc_hal_nv_co_read ((UINT8 *) nfc_hal_cb.hci_cb.p_hci_netwk_info_buf, NFC_HAL_HCI_NETWK_INFO_SIZE, HC_F5_NV_BLOCK);
+            nfc_hal_main_start_quick_timer (&nfc_hal_cb.hci_cb.hci_timer, NFC_HAL_HCI_VSC_TIMEOUT_EVT, NFC_HAL_HCI_NV_READ_TIMEOUT);
+            break;
+        }
+        HAL_TRACE_DEBUG2 ("nfc_hal_hci_set_next_hci_netwk_config (): Skip send F5 HCI NETWK CMD for UICC Mask: 0x%02x & NVM Type: 0x%02x", p_nfc_hal_cfg->nfc_hal_hci_uicc_support, nfc_hal_cb.nvm_cb.nvm_type);
+
+    case HC_F5_NV_BLOCK:
         if ((p_hci_netwk_cmd = (UINT8 *) GKI_getbuf (NCI_MSG_HDR_SIZE + NFC_HAL_HCI_DH_NETWK_INFO_SIZE)) == NULL)
         {
             HAL_TRACE_ERROR0 ("nfc_hal_hci_set_next_hci_netwk_config: unable to allocate buffer for reading hci network info from nvram");
@@ -665,6 +780,7 @@ static void nfc_hal_hci_vsc_cback (tNFC_HAL_NCI_EVT event, UINT16 data_len, UINT
     {
     case HC_F3_NV_BLOCK:
     case HC_F4_NV_BLOCK:
+    case HC_F5_NV_BLOCK:
     case HC_F2_NV_BLOCK:
         nfc_hal_hci_set_next_hci_netwk_config (nfc_hal_cb.hci_cb.hci_netwk_config_block);
         break;
@@ -697,3 +813,5 @@ void nfc_hal_hci_timeout_cback (void *p_tle)
     }
 }
 
+#endif
+
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c b/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c
index 4ec5f5d..49236f9 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c
@@ -26,6 +26,8 @@
 #include "gki.h"
 #include "nfc_hal_api.h"
 #include "nfc_hal_int.h"
+
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
 #include "nfc_hal_nv_ci.h"
 #include "nfc_hal_nv_co.h"
 
@@ -88,3 +90,4 @@ void nfc_hal_nv_ci_write (tNFC_HAL_NV_CO_STATUS status)
     }
 }
 
+#endif
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_main.c b/halimpl/bcm2079x/hal/hal/nfc_hal_main.c
index 10be44d..d7fc5d5 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_main.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_main.c
@@ -502,9 +502,12 @@ static void nfc_hal_send_credit_ntf_for_cid (UINT8 cid)
 *******************************************************************************/
 static void nfc_hal_main_send_message (NFC_HDR *p_msg)
 {
-    UINT8   *ps, *pp, cid, pbf;
-    UINT16  len = p_msg->len;
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    UINT8   cid, pbf;
     UINT16  data_len;
+#endif
+    UINT8   *ps, *pp;
+    UINT16  len = p_msg->len;
 #ifdef DISP_NCI
     UINT8   delta;
 #endif
@@ -530,6 +533,8 @@ static void nfc_hal_main_send_message (NFC_HDR *p_msg)
         delta = p_msg->len - len;
         DISP_NCI (ps + delta, (UINT16) (p_msg->len - delta), FALSE);
 #endif
+
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
         if (nfc_hal_cb.hci_cb.hcp_conn_id)
         {
             NCI_DATA_PRS_HDR(pp, pbf, cid, data_len);
@@ -545,6 +550,8 @@ static void nfc_hal_main_send_message (NFC_HDR *p_msg)
             }
 
         }
+#endif
+
         /* check low power mode state */
         if (nfc_hal_dm_power_mode_execute (NFC_HAL_LP_TX_DATA_EVT))
         {
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c b/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c
index 21d0458..f3547d3 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c
@@ -316,7 +316,8 @@ static BOOLEAN nfc_hal_nci_receive_bt_msg (tNFC_HAL_NCIT_CB *p_cb, UINT8 byte)
             p_cb->rcv_len = byte;
 
             /* Verify that buffer is big enough to fit message */
-            if ((sizeof (NFC_HDR) + HCIE_PREAMBLE_SIZE + byte) > GKI_get_buf_size (p_cb->p_rcv_msg))
+            if ((p_cb->p_rcv_msg) &&
+                ((sizeof (NFC_HDR) + HCIE_PREAMBLE_SIZE + byte) > GKI_get_buf_size (p_cb->p_rcv_msg))  )
             {
                 /* Message cannot fit into buffer */
                 GKI_freebuf (p_cb->p_rcv_msg);
@@ -523,10 +524,13 @@ BOOLEAN nfc_hal_nci_receive_msg (UINT8 byte)
 *******************************************************************************/
 BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
 {
-    UINT8 *p, *pp, cid;
+    UINT8 *p, *pp;
     UINT8 mt, pbf, gid, op_code;
     UINT8 payload_len;
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    UINT8  cid;
     UINT16 data_len;
+#endif
 
     HAL_TRACE_DEBUG0 ("nfc_hal_nci_preproc_rx_nci_msg()");
 
@@ -545,6 +549,7 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
         NCI_MSG_PRS_HDR1 (p, op_code);
         payload_len = *p++;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
         if (mt == NCI_MT_DATA)
         {
             if (nfc_hal_cb.hci_cb.hcp_conn_id)
@@ -568,7 +573,9 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
                 }
             }
         }
-        else if (gid == NCI_GID_RF_MANAGE)
+        else
+#endif
+        if (gid == NCI_GID_RF_MANAGE)
         {
             if (mt == NCI_MT_NTF)
             {
@@ -587,6 +594,7 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
                 }
             }
         }
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
         else if (gid == NCI_GID_CORE)
         {
             if (mt == NCI_MT_RSP)
@@ -604,6 +612,7 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
                 }
             }
         }
+#endif
     }
 
     if (nfc_hal_cb.dev_cb.power_mode == NFC_HAL_POWER_MODE_FULL)
@@ -649,6 +658,7 @@ void nfc_hal_nci_add_nfc_pkt_type (NFC_HDR *p_msg)
     }
 }
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
 /*******************************************************************************
 **
 ** Function         nci_brcm_check_cmd_create_hcp_connection
@@ -698,6 +708,8 @@ static void nci_brcm_check_cmd_create_hcp_connection (NFC_HDR *p_msg)
     }
 }
 
+#endif
+
 /*******************************************************************************
 **
 ** Function         nfc_hal_nci_send_cmd
@@ -718,9 +730,11 @@ void nfc_hal_nci_send_cmd (NFC_HDR *p_buf)
     UINT8   nci_ctrl_size = nfc_hal_cb.ncit_cb.nci_ctrl_size;
     UINT8   delta = 0;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
     if (  (nfc_hal_cb.hci_cb.hcp_conn_id == 0)
         &&(nfc_hal_cb.nvm_cb.nvm_type != NCI_SPD_NVM_TYPE_NONE)  )
         nci_brcm_check_cmd_create_hcp_connection ((NFC_HDR*) p_buf);
+#endif
 
     /* check low power mode state */
     continue_to_process = nfc_hal_dm_power_mode_execute (NFC_HAL_LP_TX_DATA_EVT);
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c b/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c
index ee9cea7..7c22a79 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c
@@ -380,7 +380,7 @@ void nfc_hal_prm_spd_check_version (void)
 
         /*********************************************************************
         * Version check of patchfile against NVM
-        ********************************************************************
+        *********************************************************************/
         /* Download the patchfile if no patches in NVM */
         if ((nfc_hal_cb.nvm_cb.project_id == 0) || !(nfc_hal_cb.nvm_cb.flags & NFC_HAL_NVM_FLAGS_PATCH_PRESENT))
         {
@@ -402,7 +402,7 @@ void nfc_hal_prm_spd_check_version (void)
         /* Skip download if version of patchfile is equal to version in NVM */
         /*                  and patches of the power modes are the same as the good patches in NVM */
         else if (  (nfc_hal_cb.nvm_cb.ver_major == patchfile_ver_major)
-                 &&(nfc_hal_cb.nvm_cb.ver_minor == patchfile_ver_minor)
+            &&(nfc_hal_cb.nvm_cb.ver_minor == patchfile_ver_minor)
                  &&((nvm_patch_present_mask | patchfile_patch_present_mask) == nvm_patch_present_mask)  ) /* if the NVM patch include all the patched in file */
         {
             HAL_TRACE_DEBUG2 ("Patch download skipped. NVM patch (version %i.%i) is the same than the patchfile ",
@@ -598,15 +598,9 @@ void nfc_hal_prm_nci_command_complete_cback (tNFC_HAL_NCI_EVT event, UINT16 data
         if (nfc_hal_cb.prm.flags & NFC_HAL_PRM_FLAGS_SIGNATURE_SENT)
         {
             /* Wait for authentication complete (SECURE_PATCH_DOWNLOAD NTF), including time to commit to NVM (for BCM43341B0) */
-            int auth_delay = NFC_HAL_PRM_SPD_TOUT;
-            if (!(nfc_hal_cb.prm.flags & NFC_HAL_PRM_FLAGS_BCM20791B3))
-            {
-                /* XXX maco only wait 30 seconds for B4+ revisions to avoid watchdog timeouts */
-                auth_delay = NFC_HAL_PRM_COMMIT_DELAY;
-            }
             nfc_hal_cb.prm.state = NFC_HAL_PRM_ST_SPD_AUTHENTICATING;
             nfc_hal_main_start_quick_timer (&nfc_hal_cb.prm.timer, 0x00,
-                                            (auth_delay * QUICK_TIMER_TICKS_PER_SEC) / 1000);
+                                            (NFC_HAL_PRM_COMMIT_DELAY * QUICK_TIMER_TICKS_PER_SEC) / 1000);
             return;
         }
         /* Download next segment */
diff --git a/halimpl/bcm2079x/include/StartupConfig.h b/halimpl/bcm2079x/include/StartupConfig.h
index 137371c..e56a83c 100644
--- a/halimpl/bcm2079x/include/StartupConfig.h
+++ b/halimpl/bcm2079x/include/StartupConfig.h
@@ -65,20 +65,6 @@ public:
     ** Description:     Append new config data to internal buffer.
     **                  newContent: buffer containing new content; newContent[0] is
     **                          payload length; newContent[1..end] is payload.
-    **
-    ** Returns:         True if ok.
-    **
-    *******************************************************************************/
-    bool append (const UINT8* newContent);
-
-
-    /*******************************************************************************
-    **
-    ** Function:        append
-    **
-    ** Description:     Append new config data to internal buffer.
-    **                  newContent: buffer containing new content; newContent[0] is
-    **                          payload length; newContent[1..end] is payload.
     **                  newContentLen: total length of newContent.
     **
     ** Returns:         True if ok.
diff --git a/halimpl/bcm2079x/include/android_logmsg.h b/halimpl/bcm2079x/include/android_logmsg.h
new file mode 100644
index 0000000..9922893
--- /dev/null
+++ b/halimpl/bcm2079x/include/android_logmsg.h
@@ -0,0 +1,65 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2011-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+/******************************************************************************
+ * Decode NFC packets and print them to ADB log.
+ * If protocol decoder is not present, then decode packets into hex numbers.
+ ******************************************************************************/
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+
+#include "data_types.h"
+
+
+#define DISP_NCI    ProtoDispAdapterDisplayNciPacket
+void ProtoDispAdapterDisplayNciPacket (UINT8* nciPacket, UINT16 nciPacketLen, BOOLEAN is_recv);
+void ProtoDispAdapterUseRawOutput (BOOLEAN isUseRaw);
+void ScrLog (UINT32 trace_set_mask, const char* fmt_str, ...);
+void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...);
+void LogMsg_0 (UINT32 trace_set_mask, const char *p_str);
+void LogMsg_1 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1);
+void LogMsg_2 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2);
+void LogMsg_3 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3);
+void LogMsg_4 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4);
+void LogMsg_5 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5);
+void LogMsg_6 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5, UINT32 p6);
+UINT8* scru_dump_hex (UINT8* p, char* pTitle, UINT32 len, UINT32 layer, UINT32 type);
+void BTDISP_LOCK_LOG();
+void BTDISP_UNLOCK_LOG();
+void BTDISP_INIT_LOCK();
+void BTDISP_UNINIT_LOCK();
+void DispHciCmd (BT_HDR* p_buf);
+void DispHciEvt (BT_HDR* p_buf);
+void DispLLCP (BT_HDR *p_buf, BOOLEAN is_recv);
+void DispHcp (UINT8 *data, UINT16 len, BOOLEAN is_recv);
+void DispSNEP (UINT8 local_sap, UINT8 remote_sap, BT_HDR *p_buf, BOOLEAN is_first, BOOLEAN is_rx);
+void DispCHO (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_rx);
+void DispT3TagMessage(BT_HDR *p_msg, BOOLEAN is_rx);
+void DispRWT4Tags (BT_HDR *p_buf, BOOLEAN is_rx);
+void DispCET4Tags (BT_HDR *p_buf, BOOLEAN is_rx);
+void DispRWI93Tag (BT_HDR *p_buf, BOOLEAN is_rx, UINT8 command_to_respond);
+void DispNDEFMsg (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_recv);
+
+
+
+#ifdef __cplusplus
+};
+#endif
diff --git a/halimpl/bcm2079x/include/buildcfg.h b/halimpl/bcm2079x/include/buildcfg.h
index c49bb60..32cf681 100644
--- a/halimpl/bcm2079x/include/buildcfg.h
+++ b/halimpl/bcm2079x/include/buildcfg.h
@@ -31,7 +31,9 @@ extern "C" {
 
 extern UINT8 *scru_dump_hex (UINT8 *p, char *p_title, UINT32 len, UINT32 trace_layer, UINT32 trace_type);
 void DispNci (UINT8 *p, UINT16 len, BOOLEAN is_recv);
-#define DISP_NCI	(DispNci)
+void ProtoDispAdapterDisplayNciPacket (UINT8* nciPacket, UINT16 nciPacketLen, BOOLEAN is_recv);
+#define DISP_NCI    ProtoDispAdapterDisplayNciPacket
+#define LOGMSG_TAG_NAME "NfcNciHal"
 
 
 #ifdef	__cplusplus
diff --git a/halimpl/bcm2079x/include/buildcfg_hal.h b/halimpl/bcm2079x/include/buildcfg_hal.h
index cd21c2c..a8136b7 100644
--- a/halimpl/bcm2079x/include/buildcfg_hal.h
+++ b/halimpl/bcm2079x/include/buildcfg_hal.h
@@ -18,7 +18,6 @@
 //override any HAL-specific macros
 #pragma once
 
-
 #include "bt_types.h"
 
 //NFC_HAL_TASK=0 is already defined in gki_hal_target.h; it executes the Broadcom HAL
diff --git a/halimpl/bcm2079x/nfc_nci.c b/halimpl/bcm2079x/nfc_nci.c
index b401a59..5c0564f 100644
--- a/halimpl/bcm2079x/nfc_nci.c
+++ b/halimpl/bcm2079x/nfc_nci.c
@@ -111,6 +111,7 @@ static int hal_get_max_nfcee (const struct nfc_nci_device *p_dev, uint8_t* maxNf
     return retval;
 }
 
+
 /*************************************
  * Generic device handling.
  *************************************/
@@ -149,8 +150,7 @@ static int nfc_open (const hw_module_t* module, const char* name, hw_device_t**
         dev->nci_device.close = hal_close;
         dev->nci_device.control_granted = hal_control_granted;
         dev->nci_device.power_cycle = hal_power_cycle;
-        // TODO maco commented out for binary HAL compatibility
-        // dev->nci_device.get_max_ee = hal_get_max_nfcee;
+        //dev->nci_device.get_max_ee = hal_get_max_nfcee;
 
 
         // Copy in
diff --git a/src/adaptation/CrcChecksum.cpp b/src/adaptation/CrcChecksum.cpp
index 22ab7b5..691e8ef 100644
--- a/src/adaptation/CrcChecksum.cpp
+++ b/src/adaptation/CrcChecksum.cpp
@@ -108,7 +108,7 @@ BOOLEAN crcChecksumVerifyIntegrity (const char* filename)
         while (true)
         {
             char buffer [1024];
-            size_t actualReadData = read (fileStream, buffer, sizeof(buffer));
+            ssize_t actualReadData = read (fileStream, buffer, sizeof(buffer));
             if (actualReadData > 0)
                 data.append (buffer, actualReadData);
             else
diff --git a/src/adaptation/NfcAdaptation.cpp b/src/adaptation/NfcAdaptation.cpp
index c30b97b..83b4ca5 100644
--- a/src/adaptation/NfcAdaptation.cpp
+++ b/src/adaptation/NfcAdaptation.cpp
@@ -24,6 +24,7 @@ extern "C"
     #include "nfc_int.h"
 }
 #include "config.h"
+#include "android_logmsg.h"
 
 #define LOG_TAG "NfcAdaptation"
 
@@ -111,6 +112,15 @@ void NfcAdaptation::Initialize ()
     ALOGE("%s: ver=%s nfa=%s", func, nfca_version_string, nfa_version_string);
     unsigned long num;
 
+    if ( GetNumValue ( NAME_USE_RAW_NCI_TRACE, &num, sizeof ( num ) ) )
+    {
+        if (num == 1)
+        {
+            // display protocol traces in raw format
+            ProtoDispAdapterUseRawOutput (TRUE);
+            ALOGD("%s: logging protocol in raw format", func);
+        }
+    }
     if ( !GetStrValue ( NAME_NFA_STORAGE, bcm_nfc_location, sizeof ( bcm_nfc_location ) ) )
     {
         memset (bcm_nfc_location, 0, sizeof(bcm_nfc_location));
@@ -523,15 +533,19 @@ UINT8 NfcAdaptation::HalGetMaxNfcee()
 {
     const char* func = "NfcAdaptation::HalPowerCycle";
     UINT8 maxNfcee = 0;
+    ALOGD ("%s", func);
     if (mHalDeviceContext)
     {
         // TODO maco call into HAL when we figure out binary compatibility.
         return nfa_ee_max_ee_cfg;
+
+        //mHalDeviceContext->get_max_ee (mHalDeviceContext, &maxNfcee);
     }
 
     return maxNfcee;
 }
 
+
 /*******************************************************************************
 **
 ** Function:    NfcAdaptation::DownloadFirmware
diff --git a/src/adaptation/OverrideLog.cpp b/src/adaptation/OverrideLog.cpp
index 37ed099..11b735a 100644
--- a/src/adaptation/OverrideLog.cpp
+++ b/src/adaptation/OverrideLog.cpp
@@ -25,6 +25,7 @@
 #include "OverrideLog.h"
 #include <cutils/properties.h>
 #include "config.h"
+#include "android_logmsg.h"
 #define LOG_TAG "BrcmNfcJni"
 
 
@@ -67,5 +68,11 @@ unsigned char initializeGlobalAppLogLevel ()
     if (appl_trace_level == 0xFF)
         appl_trace_level = BT_TRACE_LEVEL_DEBUG;
     ALOGD ("%s: level=%u", __FUNCTION__, appl_trace_level);
+
+    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+    {
+        //display protocol traces in raw format
+        ProtoDispAdapterUseRawOutput (TRUE);
+    }
     return appl_trace_level;
 }
diff --git a/src/adaptation/android_logmsg.cpp b/src/adaptation/android_logmsg.cpp
deleted file mode 100644
index acede64..0000000
--- a/src/adaptation/android_logmsg.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/******************************************************************************
- *
- *  Copyright (C) 2011-2012 Broadcom Corporation
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-#include "buildcfg.h"
-#include "bt_types.h"
-#include <cutils/log.h>
-
-
-#ifndef BTE_LOG_BUF_SIZE
-    #define BTE_LOG_BUF_SIZE  1024
-#endif
-#define BTE_LOG_MAX_SIZE  (BTE_LOG_BUF_SIZE - 12)
-
-
-extern "C"
-{
-    void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...);
-}
-
-/*******************************************************************************
-**
-** Function:    ScrLog
-**
-** Description: log a message
-**
-** Returns:     none
-**
-*******************************************************************************/
-void ScrLog (UINT32 trace_set_mask, const char *fmt_str, ...)
-{
-    static char buffer[BTE_LOG_BUF_SIZE];
-    va_list ap;
-
-    va_start(ap, fmt_str);
-    vsnprintf(buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
-    va_end(ap);
-    __android_log_write(ANDROID_LOG_INFO, "BrcmNci", buffer);
-}
-
-
-/*******************************************************************************
-**
-** Function:    LogMsg
-**
-** Description: log a message
-**
-** Returns:     none
-**
-*******************************************************************************/
-void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...)
-{
-    static char buffer[BTE_LOG_BUF_SIZE];
-    va_list ap;
-    UINT32 trace_type = trace_set_mask & 0x07; //lower 3 bits contain trace type
-    int android_log_type = ANDROID_LOG_INFO;
-
-    va_start(ap, fmt_str);
-    vsnprintf(buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
-    va_end(ap);
-    if (trace_type == TRACE_TYPE_ERROR)
-        android_log_type = ANDROID_LOG_ERROR;
-    __android_log_write(android_log_type, "BrcmNfcNfa", buffer);
-}
-
diff --git a/src/adaptation/bte_logmsg.c b/src/adaptation/bte_logmsg.c
deleted file mode 100644
index c147f28..0000000
--- a/src/adaptation/bte_logmsg.c
+++ /dev/null
@@ -1,412 +0,0 @@
-/******************************************************************************
- *
- *  Copyright (C) 2011-2012 Broadcom Corporation
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-#include <stdio.h>
-#include <string.h>
-#include <stdarg.h>
-#include <time.h>
-#include <sys/time.h>
-#include "bt_target.h"
-#include "gki.h"
-
-#define BT_USE_TRACES   TRUE
-
-#if MMI_INCLUDED == TRUE
-#include "mmi.h"
-#endif
-
-volatile UINT8 bte_target_mode;
-
-#if BT_USE_TRACES == TRUE
-
-#ifdef __CYGWIN__
-#undef RPC_INCLUDED
-#define RPC_INCLUDED TRUE
-
-/*******************************************************************************
-**
-** Function:    LogMsg
-**
-** Description: log a message
-**
-** Returns:     none
-**
-*******************************************************************************/
-void
-LogMsg(UINT32 maskTraceSet, const char *strFormat, ...)
-{
-    va_list ap;
-    char buffer[256];
-    struct timeval tv;
-    struct timezone tz;
-    struct tm *tm;
-    time_t t;
-
-
-    gettimeofday(&tv, &tz);
-    time(&t);
-    tm = localtime(&t);
-
-    sprintf(buffer, "%02d:%02d:%02d.%03d ", tm->tm_hour, tm->tm_min, tm->tm_sec,
-        tv.tv_usec / 1000);
-    pth_write(2, buffer, strlen(buffer));
-
-    va_start(ap, strFormat);
-    vsprintf(buffer, strFormat, ap);
-    pth_write(2, buffer, strlen(buffer));
-    pth_write(2, "\n", 1);
-    va_end(ap);
-}
-
-/*******************************************************************************
-**
-** Function:    ScrLog
-**
-** Description: log a message
-**
-** Returns:     none
-**
-*******************************************************************************/
-void
-ScrLog(UINT32 maskTraceSet, const char *strFormat, ...)
-{
-    va_list ap;
-    char buffer[256];
-    struct timeval tv;
-    struct timezone tz;
-    struct tm *tm;
-    time_t t;
-
-    gettimeofday(&tv, &tz);
-    time(&t);
-    tm = localtime(&t);
-
-    sprintf(buffer, "%02d:%02d:%02d.%03d ", tm->tm_hour, tm->tm_min, tm->tm_sec,
-        tv.tv_usec / 1000);
-    pth_write(2, buffer, strlen(buffer));
-
-    va_start(ap, strFormat);
-    vsprintf(buffer, strFormat, ap);
-    pth_write(2, buffer, strlen(buffer));
-    pth_write(2, "\n", 1);
-    va_end(ap);
-}
-#endif
-
-/********************************************************************************
-**
-**    Function Name:   LogMsg_0
-**
-**    Purpose:  Encodes a trace message that has no parameter arguments
-**
-**    Input Parameters:  maskTraceSet: tester trace type.
-**                       strFormat: displayable string.
-**    Returns:
-**                      Nothing.
-**
-*********************************************************************************/
-void LogMsg_0 (UINT32 maskTraceSet, const char *strFormat)
-{
-    if (bte_target_mode == BTE_MODE_APPL)
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg(maskTraceSet, strFormat);
-#else
-        return; /* No RPC */
-#endif
-    }
-    else if (bte_target_mode == BTE_MODE_SAMPLE_APPS)  /* Using demo sample apps */
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg(maskTraceSet, strFormat);
-#elif MMI_INCLUDED == TRUE
-        if (mmi_debug_traces)
-            MMI_Echo(strFormat);
-#endif
-    }
-
-#if (defined(TRACE_TASK_INCLUDED) && TRACE_TASK_INCLUDED == TRUE)
-    LogMsg(maskTraceSet, strFormat);
-#endif
-
-#if (defined(DONGLE_MODE_INCLUDED) && DONGLE_MODE_INCLUDED == TRUE)
-    else if (bte_target_mode == BTE_MODE_DONGLE)
-        bte_hcisl_send_traces(maskTraceSet, strFormat);
-#endif
-
-
-}
-
-/********************************************************************************
-**
-**    Function Name:   LogMsg_1
-**
-**    Purpose:  Encodes a trace message that has one parameter argument
-**
-**    Input Parameters:  maskTraceSet: tester trace type.
-**                       strFormat: displayable string.
-**    Returns:
-**                      Nothing.
-**
-*********************************************************************************/
-void LogMsg_1 (UINT32 maskTraceSet, const char *strFormat, UINT32 p1)
-{
-    if (bte_target_mode == BTE_MODE_APPL)
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1);
-#else
-        return; /* No RPC */
-#endif
-    }
-    else if (bte_target_mode == BTE_MODE_SAMPLE_APPS)  /* Using demo sample apps */
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1);
-#elif MMI_INCLUDED == TRUE
-        if (mmi_debug_traces)
-            MMI_Echo(strFormat, p1);
-#endif
-    }
-
-#if (defined(TRACE_TASK_INCLUDED) && TRACE_TASK_INCLUDED == TRUE)
-    LogMsg (maskTraceSet, strFormat, p1);
-#endif
-
-#if (defined(DONGLE_MODE_INCLUDED) && DONGLE_MODE_INCLUDED == TRUE)
-    else if (bte_target_mode == BTE_MODE_DONGLE)
-        bte_hcisl_send_traces(maskTraceSet, strFormat, p1);
-#endif
-}
-
-/********************************************************************************
-**
-**    Function Name:   LogMsg_2
-**
-**    Purpose:  Encodes a trace message that has two parameter arguments
-**
-**    Input Parameters:  maskTraceSet: tester trace type.
-**                       strFormat: displayable string.
-**    Returns:
-**                      Nothing.
-**
-*********************************************************************************/
-void LogMsg_2 (UINT32 maskTraceSet, const char *strFormat, UINT32 p1, UINT32 p2)
-{
-    if (bte_target_mode == BTE_MODE_APPL)
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2);
-#else
-        return; /* No RPC */
-#endif
-    }
-    else if (bte_target_mode == BTE_MODE_SAMPLE_APPS)  /* Using demo sample apps */
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2);
-#elif MMI_INCLUDED == TRUE
-        if (mmi_debug_traces)
-            MMI_Echo(strFormat, p1, p2);
-#endif
-    }
-
-#if (defined(TRACE_TASK_INCLUDED) && TRACE_TASK_INCLUDED == TRUE)
-    LogMsg (maskTraceSet, strFormat, p1, p2);
-#endif
-
-#if (defined(DONGLE_MODE_INCLUDED) && DONGLE_MODE_INCLUDED == TRUE)
-    else if (bte_target_mode == BTE_MODE_DONGLE)
-        bte_hcisl_send_traces(maskTraceSet, strFormat, p1, p2);
-#endif
-}
-
-/********************************************************************************
-**
-**    Function Name:   LogMsg_3
-**
-**    Purpose:  Encodes a trace message that has three parameter arguments
-**
-**    Input Parameters:  maskTraceSet: tester trace type.
-**                       strFormat: displayable string.
-**    Returns:
-**                      Nothing.
-**
-*********************************************************************************/
-void LogMsg_3 (UINT32 maskTraceSet, const char *strFormat, UINT32 p1, UINT32 p2, UINT32 p3)
-{
-    if (bte_target_mode == BTE_MODE_APPL)
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3);
-#else
-        return; /* No RPC */
-#endif
-    }
-    else if (bte_target_mode == BTE_MODE_SAMPLE_APPS)  /* Using demo sample apps */
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3);
-#elif MMI_INCLUDED == TRUE
-        if (mmi_debug_traces)
-            MMI_Echo(strFormat, p1, p2, p3);
-#endif
-    }
-
-#if (defined(TRACE_TASK_INCLUDED) && TRACE_TASK_INCLUDED == TRUE)
-    LogMsg (maskTraceSet, strFormat, p1, p2, p3);
-#endif
-
-#if (defined(DONGLE_MODE_INCLUDED) && DONGLE_MODE_INCLUDED == TRUE)
-    else if (bte_target_mode == BTE_MODE_DONGLE)
-        bte_hcisl_send_traces(maskTraceSet, strFormat, p1, p2, p3);
-#endif
-}
-
-/********************************************************************************
-**
-**    Function Name:   LogMsg_4
-**
-**    Purpose:  Encodes a trace message that has four parameter arguments
-**
-**    Input Parameters:  maskTraceSet: tester trace type.
-**                       strFormat: displayable string.
-**    Returns:
-**                      Nothing.
-**
-*********************************************************************************/
-void LogMsg_4 (UINT32 maskTraceSet, const char *strFormat, UINT32 p1, UINT32 p2,
-               UINT32 p3, UINT32 p4)
-{
-    if (bte_target_mode == BTE_MODE_APPL)
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4);
-#else
-        return; /* No RPC */
-#endif
-    }
-    else if (bte_target_mode == BTE_MODE_SAMPLE_APPS)  /* Using demo sample apps */
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4);
-#elif MMI_INCLUDED == TRUE
-        if (mmi_debug_traces)
-            MMI_Echo(strFormat, p1, p2, p3, p4);
-#endif
-    }
-
-#if (defined(TRACE_TASK_INCLUDED) && TRACE_TASK_INCLUDED == TRUE)
-    LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4);
-#endif
-
-#if (defined(DONGLE_MODE_INCLUDED) && DONGLE_MODE_INCLUDED == TRUE)
-    else if (bte_target_mode == BTE_MODE_DONGLE)
-        bte_hcisl_send_traces(maskTraceSet, strFormat, p1, p2, p3, p4);
-#endif
-}
-
-/********************************************************************************
-**
-**    Function Name:   LogMsg_5
-**
-**    Purpose:  Encodes a trace message that has five parameter arguments
-**
-**    Input Parameters:  maskTraceSet: tester trace type.
-**                       strFormat: displayable string.
-**    Returns:
-**                      Nothing.
-**
-*********************************************************************************/
-void LogMsg_5 (UINT32 maskTraceSet, const char *strFormat, UINT32 p1, UINT32 p2,
-               UINT32 p3, UINT32 p4, UINT32 p5)
-{
-    if (bte_target_mode == BTE_MODE_APPL)
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4, p5);
-#else
-        return; /* No RPC */
-#endif
-    }
-    else if (bte_target_mode == BTE_MODE_SAMPLE_APPS)  /* Using demo sample apps */
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4, p5);
-#elif MMI_INCLUDED == TRUE
-        if (mmi_debug_traces)
-            MMI_Echo(strFormat, p1, p2, p3, p4, p5);
-#endif
-    }
-
-#if (defined(TRACE_TASK_INCLUDED) && TRACE_TASK_INCLUDED == TRUE)
-    LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4, p5);
-#endif
-
-#if (defined(DONGLE_MODE_INCLUDED) && DONGLE_MODE_INCLUDED == TRUE)
-    else if (bte_target_mode == BTE_MODE_DONGLE)
-        bte_hcisl_send_traces(maskTraceSet, strFormat, p1, p2, p3, p4, p5);
-#endif
-}
-
-/********************************************************************************
-**
-**    Function Name:   LogMsg_6
-**
-**    Purpose:  Encodes a trace message that has six parameter arguments
-**
-**    Input Parameters:  maskTraceSet: tester trace type.
-**                       strFormat: displayable string.
-**    Returns:
-**                      Nothing.
-**
-*********************************************************************************/
-void LogMsg_6 (UINT32 maskTraceSet, const char *strFormat, UINT32 p1, UINT32 p2,
-               UINT32 p3, UINT32 p4, UINT32 p5, UINT32 p6)
-{
-    if (bte_target_mode == BTE_MODE_APPL)
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4, p5, p6);
-#else
-        return; /* No RPC */
-#endif
-    }
-    else if (bte_target_mode == BTE_MODE_SAMPLE_APPS)  /* Using demo sample apps */
-    {
-#if RPC_INCLUDED == TRUE
-        LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4, p5, p6);
-#elif MMI_INCLUDED == TRUE
-        if (mmi_debug_traces)
-            MMI_Echo(strFormat, p1, p2, p3, p4, p5, p6);
-#endif
-    }
-
-
-#if (defined(TRACE_TASK_INCLUDED) && TRACE_TASK_INCLUDED == TRUE)
-    LogMsg (maskTraceSet, strFormat, p1, p2, p3, p4, p5, p6);
-#endif
-
-#if (defined(DONGLE_MODE_INCLUDED) && DONGLE_MODE_INCLUDED == TRUE)
-    else if (bte_target_mode == BTE_MODE_DONGLE)
-        bte_hcisl_send_traces(maskTraceSet, strFormat, p1, p2, p3, p4, p5, p6);
-#endif
-
-}
-
-#endif /* BT_USE_TRACES */
-
diff --git a/src/adaptation/config.cpp b/src/adaptation/config.cpp
index 1498b5d..11dadae 100644
--- a/src/adaptation/config.cpp
+++ b/src/adaptation/config.cpp
@@ -24,7 +24,6 @@
 
 #define LOG_TAG "NfcAdaptation"
 
-const char alternative_config_path[] = "";
 const char transport_config_path[] = "/etc/";
 
 #define config_name             "libnfc-brcm.conf"
@@ -193,8 +192,19 @@ bool CNfcConfig::readConfig(const char* name, bool bResetContent)
             moveToList();
     }
 
-    while (!feof(fd) && fread(&c, 1, 1, fd) == 1)
+    for (;;)
     {
+        if (feof(fd) || fread(&c, 1, 1, fd) != 1)
+        {
+            if (state == BEGIN_LINE)
+                break;
+
+            // got to the EOF but not in BEGIN_LINE state so the file
+            // probably does not end with a newline, so the parser has
+            // not processed current line, simulate a newline in the file
+            c = '\n';
+        }
+
         switch (state & 0xff)
         {
         case BEGIN_LINE:
@@ -329,6 +339,9 @@ bool CNfcConfig::readConfig(const char* name, bool bResetContent)
         default:
             break;
         }
+
+        if (feof(fd))
+            break;
     }
 
     fclose(fd);
@@ -380,16 +393,6 @@ CNfcConfig& CNfcConfig::GetInstance()
     if (theInstance.size() == 0 && theInstance.mValidFile)
     {
         string strPath;
-        if (alternative_config_path[0] != '\0')
-        {
-            strPath.assign(alternative_config_path);
-            strPath += config_name;
-            theInstance.readConfig(strPath.c_str(), true);
-            if (!theInstance.empty())
-            {
-                return theInstance;
-        }
-        }
         strPath.assign(transport_config_path);
         strPath += config_name;
         theInstance.readConfig(strPath.c_str(), true);
@@ -739,9 +742,6 @@ void readOptionalConfig(const char* extra)
 {
     string strPath;
     strPath.assign(transport_config_path);
-    if (alternative_config_path[0] != '\0')
-        strPath.assign(alternative_config_path);
-
     strPath += extra_config_base;
     strPath += extra;
     strPath += extra_config_ext;
diff --git a/src/adaptation/libmain.c b/src/adaptation/libmain.c
index a413f4a..29c07b5 100644
--- a/src/adaptation/libmain.c
+++ b/src/adaptation/libmain.c
@@ -21,20 +21,10 @@
 #include <fcntl.h>
 #include <errno.h>
 #include "buildcfg.h"
-#include "nfa_mem_co.h"
 #include "nfa_nv_co.h"
-#include "nfa_nv_ci.h"
 #include "config.h"
+#include "nfc_hal_target.h"
 #include "nfc_hal_nv_co.h"
-
-#define LOG_TAG "BrcmNfcNfa"
-#define PRINT(s) __android_log_write(ANDROID_LOG_DEBUG, "BrcmNci", s)
-#define MAX_NCI_PACKET_SIZE  259
-#define MAX_LOGCAT_LINE     4096
-static char log_line[MAX_LOGCAT_LINE];
-
-extern UINT32 ScrProtocolTraceFlag;         // = SCR_PROTO_TRACE_ALL; // 0x017F;
-static const char* sTable = "0123456789abcdef";
 extern char bcm_nfc_location[];
 static const char* sNfaStorageBin = "/nfaStorage.bin";
 
@@ -49,7 +39,7 @@ static const char* sNfaStorageBin = "/nfaStorage.bin";
 **                  NULL otherwise
 **
 *******************************************************************************/
-NFC_API extern void *nfa_mem_co_alloc(UINT32 num_bytes)
+extern void *nfa_mem_co_alloc(UINT32 num_bytes)
 {
     return malloc(num_bytes);
 }
@@ -65,7 +55,7 @@ NFC_API extern void *nfa_mem_co_alloc(UINT32 num_bytes)
 **                  Nothing
 **
 *******************************************************************************/
-NFC_API extern void nfa_mem_co_free(void *pBuffer)
+extern void nfa_mem_co_free(void *pBuffer)
 {
     free(pBuffer);
 }
@@ -91,7 +81,7 @@ NFC_API extern void nfa_mem_co_free(void *pBuffer)
 **                        or an error has occurred.
 **
 *******************************************************************************/
-NFC_API extern void nfa_nv_co_read(UINT8 *pBuffer, UINT16 nbytes, UINT8 block)
+extern void nfa_nv_co_read(UINT8 *pBuffer, UINT16 nbytes, UINT8 block)
 {
     char filename[256], filename2[256];
 
@@ -124,6 +114,7 @@ NFC_API extern void nfa_nv_co_read(UINT8 *pBuffer, UINT16 nbytes, UINT8 block)
             ALOGE ("%s: fail to read", __FUNCTION__);
             nfa_nv_ci_read (0, NFA_NV_CO_FAIL, block);
         }
+        close (fileStream);
     }
     else
     {
@@ -150,7 +141,7 @@ NFC_API extern void nfa_nv_co_read(UINT8 *pBuffer, UINT16 nbytes, UINT8 block)
 **                        bytes have been written, or an error has been detected,
 **
 *******************************************************************************/
-NFC_API extern void nfa_nv_co_write(const UINT8 *pBuffer, UINT16 nbytes, UINT8 block)
+extern void nfa_nv_co_write(const UINT8 *pBuffer, UINT16 nbytes, UINT8 block)
 {
     char filename[256], filename2[256];
 
@@ -281,333 +272,3 @@ void verify_stack_non_volatile_store ()
         delete_stack_non_volatile_store (TRUE);
 }
 
-/*******************************************************************************
-**
-** Function         byte2hex
-**
-** Description      convert a byte array to hexadecimal string
-**
-** Returns:
-**                  Nothing
-**
-*******************************************************************************/
-static inline void byte2hex(const char* data, char** str)
-{
-    **str = sTable[(*data >> 4) & 0xf];
-    ++*str;
-    **str = sTable[*data & 0xf];
-    ++*str;
-}
-
-/*******************************************************************************
-**
-** Function         byte2char
-**
-** Description      convert a byte array to displayable text string
-**
-** Returns:
-**                  Nothing
-**
-*******************************************************************************/
-static inline void byte2char(const char* data, char** str)
-{
-    **str = *data < ' ' ? '.' : *data > '~' ? '.' : *data;
-    ++(*str);
-}
-
-/*******************************************************************************
-**
-** Function         word2hex
-**
-** Description      Convert a two byte into text string as little-endian WORD
-**
-** Returns:
-**                  Nothing
-**
-*******************************************************************************/
-static inline void word2hex(const char* data, char** hex)
-{
-    byte2hex(&data[1], hex);
-    byte2hex(&data[0], hex);
-}
-
-/*******************************************************************************
-**
-** Function         dumpbin
-**
-** Description      convert a byte array to a blob of text string for logging
-**
-** Returns:
-**                  Nothing
-**
-*******************************************************************************/
-void dumpbin(const UINT8* data, UINT32 size, UINT32 trace_layer, UINT32 trace_type)
-{
-    char line_buff[256];
-    char *line;
-    UINT32 i, j, addr;
-    const UINT32 width = 16;
-    if(size <= 0)
-        return;
-#ifdef __RAW_HEADER
-    //write offset
-    line = line_buff;
-    *line++ = ' ';
-    *line++ = ' ';
-    *line++ = ' ';
-    *line++ = ' ';
-    *line++ = ' ';
-    *line++ = ' ';
-    for(j = 0; j < width; j++)
-    {
-        byte2hex((const char*)&j, &line);
-        *line++ = ' ';
-    }
-    *line = 0;
-    PRINT(line_buff);
-#endif
-    for(i = 0; i < size / width; i++)
-    {
-        line = line_buff;
-        //write address:
-        addr = i*width;
-        word2hex((const char*)&addr, &line);
-        *line++ = ':'; *line++ = ' ';
-        //write hex of data
-        for(j = 0; j < width; j++)
-        {
-            byte2hex((const char*)&data[j], &line);
-            *line++ = ' ';
-        }
-        //write char of data
-        for(j = 0; j < width; j++)
-            byte2char((const char*)data++, &line);
-        //wirte the end of line
-        *line = 0;
-        //output the line
-        PRINT(line_buff);
-    }
-    //last line of left over if any
-    UINT32 leftover = size % width;
-    if(leftover > 0)
-    {
-        line = line_buff;
-        //write address:
-        addr = i*width;
-        word2hex((const char*)&addr, &line);
-        *line++ = ':'; *line++ = ' ';
-        //write hex of data
-        for(j = 0; j < leftover; j++)
-        {
-            byte2hex((const char *)&data[j], &line);
-            *line++ = ' ';
-        }
-        //write hex padding
-        for(; j < width; j++)
-        {
-            *line++ = ' ';
-            *line++ = ' ';
-            *line++ = ' ';
-        }
-        //write char of data
-        for(j = 0; j < leftover; j++)
-            byte2char((const char*)data++, &line);
-        //write the end of line
-        *line = 0;
-        //output the line
-        PRINT(line_buff);
-    }
-}
-
-/*******************************************************************************
-**
-** Function         scru_dump_hex
-**
-** Description      print a text string to log
-**
-** Returns:
-**                  text string
-**
-*******************************************************************************/
-UINT8 *scru_dump_hex (UINT8 *p, char *pTitle, UINT32 len, UINT32 layer, UINT32 type)
-{
-    if(pTitle && *pTitle)
-        PRINT(pTitle);
-    dumpbin(p, len, layer, type);
-    return p;
-}
-
-/*******************************************************************************
-**
-** Function         DispHciCmd
-**
-** Description      Display a HCI command string
-**
-** Returns:
-**                  Nothing
-**
-*******************************************************************************/
-void DispHciCmd (BT_HDR *p_buf)
-{
-    UINT32 i,j;
-    UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
-    UINT8 * data = (UINT8*) p_buf;
-    UINT32 data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
-
-    if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_HCI_SUMMARY))
-        return;
-
-    if (nBytes > sizeof(log_line))
-        return;
-
-    for(i = 0, j = 0; i < data_len && j < sizeof(log_line)-3; i++)
-    {
-        log_line[j++] = sTable[(*data >> 4) & 0xf];
-        log_line[j++] = sTable[*data & 0xf];
-        data++;
-    }
-    log_line[j] = '\0';
-
-    __android_log_write(ANDROID_LOG_DEBUG, "BrcmHciX", log_line);
-}
-
-
-/*******************************************************************************
-**
-** Function         DispHciEvt
-**
-** Description      display a NCI event
-**
-** Returns:
-**                  Nothing
-**
-*******************************************************************************/
-void DispHciEvt (BT_HDR *p_buf)
-{
-    UINT32 i,j;
-    UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
-    UINT8 * data = (UINT8*) p_buf;
-    UINT32 data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
-
-    if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_HCI_SUMMARY))
-        return;
-
-    if (nBytes > sizeof(log_line))
-        return;
-
-    for(i = 0, j = 0; i < data_len && j < sizeof(log_line)-3; i++)
-    {
-        log_line[j++] = sTable[(*data >> 4) & 0xf];
-        log_line[j++] = sTable[*data & 0xf];
-        data++;
-    }
-    log_line[j] = '\0';
-
-    __android_log_write(ANDROID_LOG_DEBUG, "BrcmHciR", log_line);
-}
-
-/*******************************************************************************
-**
-** Function         DispNciDump
-**
-** Description      Log raw NCI packet as hex-ascii bytes
-**
-** Returns          None.
-**
-*******************************************************************************/
-void DispNciDump (UINT8 *data, UINT16 len, BOOLEAN is_recv)
-{
-    if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_NCI))
-        return;
-
-    char line_buf[(MAX_NCI_PACKET_SIZE*2)+1];
-    UINT32 i,j;
-
-    for(i = 0, j = 0; i < len && j < sizeof(line_buf)-3; i++)
-    {
-        line_buf[j++] = sTable[(*data >> 4) & 0xf];
-        line_buf[j++] = sTable[*data & 0xf];
-        data++;
-    }
-    line_buf[j] = '\0';
-
-    __android_log_write(ANDROID_LOG_DEBUG, (is_recv) ? "BrcmNciR": "BrcmNciX", line_buf);
-}
-
-
-/*******************************************************************************
-**
-** Function         DispLLCP
-**
-** Description      Log raw LLCP packet as hex-ascii bytes
-**
-** Returns          None.
-**
-*******************************************************************************/
-void DispLLCP (BT_HDR *p_buf, BOOLEAN is_recv)
-{
-    UINT32 i,j;
-    UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
-    UINT8 * data = (UINT8*) p_buf;
-    UINT32 data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
-
-    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
-        return;
-
-    for (i = 0; i < data_len; )
-    {
-        for(j = 0; i < data_len && j < sizeof(log_line)-3; i++)
-        {
-            log_line[j++] = sTable[(*data >> 4) & 0xf];
-            log_line[j++] = sTable[*data & 0xf];
-            data++;
-        }
-        log_line[j] = '\0';
-        __android_log_write(ANDROID_LOG_DEBUG, (is_recv) ? "BrcmLlcpR": "BrcmLlcpX", log_line);
-    }
-}
-
-
-/*******************************************************************************
-**
-** Function         DispHcp
-**
-** Description      Log raw HCP packet as hex-ascii bytes
-**
-** Returns          None.
-**
-*******************************************************************************/
-void DispHcp (UINT8 *data, UINT16 len, BOOLEAN is_recv)
-{
-    UINT32 i,j;
-    UINT32 nBytes = (len*2)+1;
-    char line_buf[400];
-
-    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
-        return;
-
-    if (nBytes > sizeof(line_buf))
-        return;
-
-    // Only trace HCP if we're tracing HCI as well
-    if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_HCI_SUMMARY))
-        return;
-
-    for(i = 0, j = 0; i < len && j < sizeof(line_buf)-3; i++)
-    {
-        line_buf[j++] = sTable[(*data >> 4) & 0xf];
-        line_buf[j++] = sTable[*data & 0xf];
-        data++;
-    }
-    line_buf[j] = '\0';
-
-    __android_log_write(ANDROID_LOG_DEBUG, (is_recv) ? "BrcmHcpR": "BrcmHcpX", line_buf);
-}
-
-void DispSNEP (UINT8 local_sap, UINT8 remote_sap, BT_HDR *p_buf, BOOLEAN is_first, BOOLEAN is_rx) {}
-void DispCHO (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_rx) {}
-void DispT3TagMessage(BT_HDR *p_msg, BOOLEAN is_rx) {}
-void DispRWT4Tags (BT_HDR *p_buf, BOOLEAN is_rx) {}
-void DispCET4Tags (BT_HDR *p_buf, BOOLEAN is_rx) {}
-void DispRWI93Tag (BT_HDR *p_buf, BOOLEAN is_rx, UINT8 command_to_respond) {}
-void DispNDEFMsg (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_recv) {}
diff --git a/src/gki/ulinux/gki_ulinux.c b/src/gki/ulinux/gki_ulinux.c
index 93fd553..bb5a932 100644
--- a/src/gki/ulinux/gki_ulinux.c
+++ b/src/gki/ulinux/gki_ulinux.c
@@ -401,7 +401,7 @@ void gki_system_tick_start_stop_cback(BOOLEAN start)
 {
     tGKI_OS         *p_os = &gki_cb.os;
     volatile int    *p_run_cond = &p_os->no_timer_suspend;
-    volatile static int wake_lock_count;
+    static volatile int wake_lock_count;
     if ( FALSE == start )
     {
         /* this can lead to a race condition. however as we only read this variable in the timer loop
@@ -908,7 +908,7 @@ INT8 *GKI_map_taskname (UINT8 task_id)
     }
     else
     {
-        return "BAD";
+        return (INT8*) "BAD";
     }
 }
 
diff --git a/src/hal/include/nci_defs.h b/src/hal/include/nci_defs.h
index bab937b..2ff50a7 100644
--- a/src/hal/include/nci_defs.h
+++ b/src/hal/include/nci_defs.h
@@ -753,101 +753,6 @@ typedef struct
     } intf_param;       /* Activation Parameters   0 - n Bytes */
 } tNCI_INTF_PARAMS;
 
-/*
-** HCI Network CMD/NTF structure
-*/
-typedef struct
-{
-    UINT8   pipe_id;        /* if MSB is set then valid, 7 bits for Pipe ID             */
-    UINT8   mode;           /* Type A card emulation enabled indicator, 0x02:enabled    */
-    UINT8   sak;
-    UINT8   uid_reg_len;
-    UINT8   uid_reg[10];
-    UINT8   atqa[2];        /* ATQA response code */
-    UINT8   app_data_len;
-    UINT8   app_data[15];   /* 15 bytes optional storage for historic data, use 2 slots */
-    UINT8   fwi_sfgi;       /* FRAME WAITING TIME, START-UP FRAME GUARD TIME            */
-    UINT8   cid_support;
-    UINT8   datarate_max[3];
-    UINT8   clt_support;
-} tNCI_HCI_CE_RF_A;
-
-typedef struct
-{
-    UINT8   pipe_id;        /* if MSB is set then valid, 7 bits for Pipe ID             */
-    UINT8   mode;           /* Type B card emulation enabled indicator, 0x02:enabled    */
-    UINT8   pupi_len;
-    UINT8   pupi_reg[4];
-    UINT8   afi;
-    UINT8   atqb[4];        /* 4 bytes ATQB application data                            */
-    UINT8   higherlayer_resp[61]; /* 0~ 61 bytes ATRB_INF use 1~4 personality slots     */
-    UINT8   datarate_max[3];
-    UINT8   natrb;
-} tNCI_HCI_CE_RF_B;
-
-typedef struct
-{
-    UINT8   pipe_id;        /* if MSB is set then valid, 7 bits for Pipe ID             */
-    UINT8   mode;           /* Type B prime card emulation enabled indicator, 0x02:enabled */
-    UINT8   pat_in_len;
-    UINT8   pat_in[8];
-    UINT8   dat_out_len;
-    UINT8   dat_out[40];    /* ISO7816-3 <=64 byte, and other fields are 9 bytes        */
-    UINT8   natr;
-} tNCI_HCI_CE_RF_BP;
-
-typedef struct
-{
-    UINT8   pipe_id;        /* if MSB is set then valid, 7 bits for Pipe ID             */
-    UINT8   mode;           /* Type F card emulation enabled indicator, 0x02:enabled    */
-    UINT8   speed_cap;
-    UINT8   clt_support;
-} tNCI_HCI_CE_RF_F;
-
-typedef struct
-{
-    UINT8   pipe_id;        /* if MSB is set then valid, 7 bits for Pipe ID             */
-    UINT8   datarate_max;
-} tNCI_HCI_RD_RF_A;
-
-typedef struct
-{
-    UINT8   pipe_id;        /* if MSB is set then valid, 7 bits for Pipe ID             */
-    UINT8   afi;
-    UINT8   hldata_len;
-    UINT8   high_layer_data[61];  /* INF field in ATTRIB command                        */
-} tNCI_HCI_RD_RF_B;
-
-typedef struct
-{
-    UINT8   source_host;
-    UINT8   dest_host;
-    UINT8   source_gate;
-    UINT8   dest_gate;
-    UINT8   pipe_id;        /* if MSB is set then valid, 7 bits for Pipe ID             */
-} tNCI_HCI_DYN_PIPE_INFO;
-
-typedef struct
-{
-    UINT8                target_handle;
-    UINT8                session_id[8];
-    UINT8                sync_id[2];
-    UINT8                static_pipe_info;
-    tNCI_HCI_CE_RF_A     ce_rf_a;
-    tNCI_HCI_CE_RF_B     ce_rf_b;
-    tNCI_HCI_CE_RF_BP    ce_rf_bp;
-    tNCI_HCI_CE_RF_F     ce_rf_f;
-} tNCI_HCI_NETWK;
-
-typedef struct
-{
-    UINT8                   target_handle;
-    UINT8                   session_id[8];
-    UINT8                   static_pipe_info;
-    UINT8                   num_dyn_pipes;
-    tNCI_HCI_DYN_PIPE_INFO  dyn_pipe_info[20];
-} tNCI_HCI_NETWK_DH;
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/hal/include/nfc_hal_api.h b/src/hal/include/nfc_hal_api.h
index 6cb7d52..6a7288b 100644
--- a/src/hal/include/nfc_hal_api.h
+++ b/src/hal/include/nfc_hal_api.h
@@ -24,7 +24,7 @@
  ******************************************************************************/
 #ifndef NFC_HAL_API_H
 #define NFC_HAL_API_H
-#include <hardware/nfc.h> /* Android must include HAL header */
+#include <hardware/nfc.h>
 #include "data_types.h"
 
 /****************************************************************************
@@ -40,13 +40,13 @@ typedef struct
 #define NFC_HDR_SIZE (sizeof (NFC_HDR))
 
 /*******************************************************************************
-** tHAL_STATUS Definitions are defined in hardware/libhardware/include/hardware/nfc.h
-** #define HAL_NFC_STATUS_OK               0
-** #define HAL_NFC_STATUS_FAILED           1
-** #define HAL_NFC_STATUS_ERR_TRANSPORT    2
-** #define HAL_NFC_STATUS_ERR_CMD_TIMEOUT  3
-** #define HAL_NFC_STATUS_REFUSED          4
+** tHAL_STATUS Definitions
 *******************************************************************************/
+#define HAL_NFC_STATUS_OK               0
+#define HAL_NFC_STATUS_FAILED           1
+#define HAL_NFC_STATUS_ERR_TRANSPORT    2
+#define HAL_NFC_STATUS_ERR_CMD_TIMEOUT  3
+#define HAL_NFC_STATUS_REFUSED          4
 
 typedef UINT8 tHAL_NFC_STATUS;
 
@@ -56,21 +56,20 @@ typedef UINT8 tHAL_NFC_STATUS;
 #define HAL_NFC_HCI_NO_UICC_HOST    0x00
 #define HAL_NFC_HCI_UICC0_HOST      0x01
 #define HAL_NFC_HCI_UICC1_HOST      0x02
+#define HAL_NFC_HCI_UICC2_HOST      0x04
 
 /*******************************************************************************
 ** tHAL_NFC_CBACK Definitions
 *******************************************************************************/
 
-/*******************************************************************************
-** tHAL_NFC_CBACK events are defined in hardware/libhardware/include/hardware/nfc.h
-** #define HAL_NFC_OPEN_CPLT_EVT           0x00
-** #define HAL_NFC_CLOSE_CPLT_EVT          0x01
-** #define HAL_NFC_POST_INIT_CPLT_EVT      0x02
-** #define HAL_NFC_PRE_DISCOVER_CPLT_EVT   0x03
-** #define HAL_NFC_REQUEST_CONTROL_EVT     0x04
-** #define HAL_NFC_RELEASE_CONTROL_EVT     0x05
-** #define HAL_NFC_ERROR_EVT               0x06
-*******************************************************************************/
+/* tHAL_NFC_CBACK events */
+#define HAL_NFC_OPEN_CPLT_EVT           0x00
+#define HAL_NFC_CLOSE_CPLT_EVT          0x01
+#define HAL_NFC_POST_INIT_CPLT_EVT      0x02
+#define HAL_NFC_PRE_DISCOVER_CPLT_EVT   0x03
+#define HAL_NFC_REQUEST_CONTROL_EVT     0x04
+#define HAL_NFC_RELEASE_CONTROL_EVT     0x05
+#define HAL_NFC_ERROR_EVT               0x06
 
 
 typedef void (tHAL_NFC_STATUS_CBACK) (tHAL_NFC_STATUS status);
@@ -99,7 +98,10 @@ typedef struct
     BOOLEAN nfc_hal_prm_nvm_required;       /* set nfc_hal_prm_nvm_required to TRUE, if the platform wants to abort PRM process without NVM */
     UINT16  nfc_hal_nfcc_enable_timeout;    /* max time to wait for RESET NTF after setting REG_PU to high */
     UINT16  nfc_hal_post_xtal_timeout;      /* max time to wait for RESET NTF after setting Xtal frequency */
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    BOOLEAN nfc_hal_first_boot;             /* set nfc_hal_first_boot to TRUE, if platform enables NFC for the first time after bootup */
     UINT8   nfc_hal_hci_uicc_support;       /* set nfc_hal_hci_uicc_support to Zero, if no UICC is supported otherwise set corresponding bit(s) for every supported UICC(s) */
+#endif
 } tNFC_HAL_CFG;
 
 typedef struct
diff --git a/src/hal/include/nfc_hal_target.h b/src/hal/include/nfc_hal_target.h
index 7d0bc9a..fcf5a4b 100644
--- a/src/hal/include/nfc_hal_target.h
+++ b/src/hal/include/nfc_hal_target.h
@@ -121,6 +121,11 @@
 #define NFC_HAL_I93_FLAG_DATA_RATE              NFC_HAL_I93_FLAG_DATA_RATE_HIGH
 #endif
 
+/* NFC HAL HCI */
+#ifndef NFC_HAL_HCI_INCLUDED
+#define NFC_HAL_HCI_INCLUDED                    TRUE
+#endif
+
 /* Quick Timer */
 #ifndef QUICK_TIMER_TICKS_PER_SEC
 #define QUICK_TIMER_TICKS_PER_SEC               100       /* 10ms timer */
diff --git a/src/hal/int/nfc_brcm_defs.h b/src/hal/int/nfc_brcm_defs.h
index ccb23b1..9f8a7e6 100644
--- a/src/hal/int/nfc_brcm_defs.h
+++ b/src/hal/int/nfc_brcm_defs.h
@@ -34,6 +34,7 @@
 #define BRCM_20791B4_ID             0x20791b04
 #define BRCM_20791B5_ID             0x20791b05
 #define BRCM_43341B0_ID             0x43341b00
+#define BRCM_20795T1_ID             0x20795a01
 #define BRCM_20795A0_ID             0x20795a00
 
 #define BRCM_NFC_GEN_MASK           0xFFFFF000  /* HW generation mask */
@@ -104,6 +105,7 @@
 #define NCI_MSG_SWP_BIST                0x31
 #define NCI_MSG_WLESS_DBG_MODE          0x32
 #define NCI_MSG_I2C_REQ_POLARITY        0x33
+#define NCI_MSG_AID_FILTER              0x39
 
 
 /**********************************************
@@ -259,4 +261,153 @@
 #define NFC_SNOOZE_ACTIVE_LOW     0x00    /* high to low voltage is asserting */
 #define NFC_SNOOZE_ACTIVE_HIGH    0x01    /* low to high voltage is asserting */
 
+
+/**********************************************
+ * HCI definitions
+ **********************************************/
+#define NFC_HAL_HCI_SESSION_ID_LEN                  8
+#define NFC_HAL_HCI_SYNC_ID_LEN                     2
+
+/* HCI Network command definitions */
+#define NFC_HAL_HCI_NETWK_INFO_SIZE                 250
+#define NFC_HAL_HCI_NO_RW_MODE_NETWK_INFO_SIZE      184
+#define NFC_HAL_HCI_DH_NETWK_INFO_SIZE              111
+#define NFC_HAL_HCI_MIN_NETWK_INFO_SIZE             12
+#define NFC_HAL_HCI_MIN_DH_NETWK_INFO_SIZE          11
+
+/* Card emulation RF Gate A definitions */
+#define NFC_HAL_HCI_CE_RF_A_UID_REG_LEN             10
+#define NFC_HAL_HCI_CE_RF_A_ATQA_RSP_CODE_LEN       2
+#define NFC_HAL_HCI_CE_RF_A_MAX_HIST_DATA_LEN       15
+#define NFC_HAL_HCI_CE_RF_A_MAX_DATA_RATE_LEN       3
+
+/* Card emulation RF Gate B definitions */
+#define NFC_HAL_HCI_CE_RF_B_PUPI_LEN                4
+#define NFC_HAL_HCI_CE_RF_B_ATQB_LEN                4
+#define NFC_HAL_HCI_CE_RF_B_HIGHER_LAYER_RSP_LEN    61
+#define NFC_HAL_HCI_CE_RF_B_MAX_DATA_RATE_LEN       3
+
+/* Card emulation RF Gate BP definitions */
+#define NFC_HAL_HCI_CE_RF_BP_MAX_PAT_IN_LEN         8
+#define NFC_HAL_HCI_CE_RF_BP_DATA_OUT_LEN           40
+
+/* Reader RF Gate A definitions */
+#define NFC_HAL_HCI_RD_RF_B_HIGHER_LAYER_DATA_LEN   61
+
+/* DH HCI Network command definitions */
+#define NFC_HAL_HCI_DH_MAX_DYN_PIPES                20
+
+/* Target handle for different host in the network */
+#define NFC_HAL_HCI_DH_TARGET_HANDLE                0xF2
+#define NFC_HAL_HCI_UICC0_TARGET_HANDLE             0xF3
+#define NFC_HAL_HCI_UICC1_TARGET_HANDLE             0xF4
+#define NFC_HAL_HCI_UICC2_TARGET_HANDLE             0xF5
+
+/* Card emulation RF Gate A registry information */
+typedef struct
+{
+    UINT8   pipe_id;                                                    /* if MSB is set then valid, 7 bits for Pipe ID             */
+    UINT8   mode;                                                       /* Type A card emulation enabled indicator, 0x02:enabled    */
+    UINT8   sak;
+    UINT8   uid_reg_len;
+    UINT8   uid_reg[NFC_HAL_HCI_CE_RF_A_UID_REG_LEN];
+    UINT8   atqa[NFC_HAL_HCI_CE_RF_A_ATQA_RSP_CODE_LEN];                /* ATQA response code */
+    UINT8   app_data_len;
+    UINT8   app_data[NFC_HAL_HCI_CE_RF_A_MAX_HIST_DATA_LEN];            /* 15 bytes optional storage for historic data, use 2 slots */
+    UINT8   fwi_sfgi;                                                   /* FRAME WAITING TIME, START-UP FRAME GUARD TIME            */
+    UINT8   cid_support;
+    UINT8   datarate_max[NFC_HAL_HCI_CE_RF_A_MAX_DATA_RATE_LEN];
+    UINT8   clt_support;
+} tNCI_HCI_CE_RF_A;
+
+/* Card emulation RF Gate B registry information */
+typedef struct
+{
+    UINT8   pipe_id;                                                    /* if MSB is set then valid, 7 bits for Pipe ID             */
+    UINT8   mode;                                                       /* Type B card emulation enabled indicator, 0x02:enabled    */
+    UINT8   pupi_len;
+    UINT8   pupi_reg[NFC_HAL_HCI_CE_RF_B_PUPI_LEN];
+    UINT8   afi;
+    UINT8   atqb[NFC_HAL_HCI_CE_RF_B_ATQB_LEN];                         /* 4 bytes ATQB application data                            */
+    UINT8   higherlayer_resp[NFC_HAL_HCI_CE_RF_B_HIGHER_LAYER_RSP_LEN]; /* 0~ 61 bytes ATRB_INF use 1~4 personality slots     */
+    UINT8   datarate_max[NFC_HAL_HCI_CE_RF_B_MAX_DATA_RATE_LEN];
+    UINT8   natrb;
+} tNCI_HCI_CE_RF_B;
+
+/* Card emulation RF Gate BP registry information */
+typedef struct
+{
+    UINT8   pipe_id;                                                    /* if MSB is set then valid, 7 bits for Pipe ID             */
+    UINT8   mode;                                                       /* Type B prime card emulation enabled indicator, 0x02:enabled */
+    UINT8   pat_in_len;
+    UINT8   pat_in[NFC_HAL_HCI_CE_RF_BP_MAX_PAT_IN_LEN];
+    UINT8   dat_out_len;
+    UINT8   dat_out[NFC_HAL_HCI_CE_RF_BP_DATA_OUT_LEN];                 /* ISO7816-3 <=64 byte, and other fields are 9 bytes        */
+    UINT8   natr;
+} tNCI_HCI_CE_RF_BP;
+
+/* Card emulation RF Gate F registry information */
+typedef struct
+{
+    UINT8   pipe_id;                                                    /* if MSB is set then valid, 7 bits for Pipe ID             */
+    UINT8   mode;                                                       /* Type F card emulation enabled indicator, 0x02:enabled    */
+    UINT8   speed_cap;
+    UINT8   clt_support;
+} tNCI_HCI_CE_RF_F;
+
+/* Reader RF Gate A registry information */
+typedef struct
+{
+    UINT8   pipe_id;                                                    /* if MSB is set then valid, 7 bits for Pipe ID             */
+    UINT8   datarate_max;
+} tNCI_HCI_RD_RF_A;
+
+/* Reader RF Gate B registry information */
+typedef struct
+{
+    UINT8   pipe_id;                                                    /* if MSB is set then valid, 7 bits for Pipe ID             */
+    UINT8   afi;
+    UINT8   hldata_len;
+    UINT8   high_layer_data[NFC_HAL_HCI_RD_RF_B_HIGHER_LAYER_DATA_LEN]; /* INF field in ATTRIB command                        */
+} tNCI_HCI_RD_RF_B;
+
+/* Dynamic pipe information */
+typedef struct
+{
+    UINT8   source_host;
+    UINT8   dest_host;
+    UINT8   source_gate;
+    UINT8   dest_gate;
+    UINT8   pipe_id;                                                    /* if MSB is set then valid, 7 bits for Pipe ID             */
+} tNCI_HCI_DYN_PIPE_INFO;
+
+/*************************************************************
+ * HCI Network CMD/NTF structure for UICC host in the network
+ *************************************************************/
+typedef struct
+{
+    UINT8                target_handle;
+    UINT8                session_id[NFC_HAL_HCI_SESSION_ID_LEN];
+    UINT8                sync_id[NFC_HAL_HCI_SYNC_ID_LEN];
+    UINT8                static_pipe_info;
+    tNCI_HCI_CE_RF_A     ce_rf_a;
+    tNCI_HCI_CE_RF_B     ce_rf_b;
+    tNCI_HCI_CE_RF_BP    ce_rf_bp;
+    tNCI_HCI_CE_RF_F     ce_rf_f;
+    tNCI_HCI_RD_RF_A     rw_rf_a;
+    tNCI_HCI_RD_RF_B     rw_rf_b;
+} tNCI_HCI_NETWK;
+
+/************************************************
+ * HCI Network CMD/NTF structure for Device host
+ ************************************************/
+typedef struct
+{
+    UINT8                   target_handle;
+    UINT8                   session_id[NFC_HAL_HCI_SESSION_ID_LEN];
+    UINT8                   static_pipe_info;
+    UINT8                   num_dyn_pipes;
+    tNCI_HCI_DYN_PIPE_INFO  dyn_pipe_info[NFC_HAL_HCI_DH_MAX_DYN_PIPES];
+} tNCI_HCI_NETWK_DH;
+
 #endif  /* NFC_BRCM_DEFS_H */
diff --git a/src/hal/int/nfc_hal_int.h b/src/hal/int/nfc_hal_int.h
index 84d7643..3eabf77 100644
--- a/src/hal/int/nfc_hal_int.h
+++ b/src/hal/int/nfc_hal_int.h
@@ -73,35 +73,31 @@ extern "C" {
 
 typedef UINT8 tNFC_HAL_WAIT_RSP;
 
-typedef UINT16 tNFC_HAL_HCI_EVT;
-
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
 
-#define NFC_HAL_HCI_DH_TARGET_HANDLE            0xF2
-#define NFC_HAL_HCI_UICC0_TARGET_HANDLE         0xF3
-#define NFC_HAL_HCI_UICC1_TARGET_HANDLE         0xF4
+typedef UINT16 tNFC_HAL_HCI_EVT;
 
-#define NFC_HAL_HCI_SESSION_ID_LEN              0x08
-#define NFC_HAL_HCI_NETWK_INFO_SIZE             184
-#define NFC_HAL_HCI_DH_NETWK_INFO_SIZE          111
-#define NFC_HAL_HCI_MIN_NETWK_INFO_SIZE         12
-#define NFC_HAL_HCI_MIN_DH_NETWK_INFO_SIZE      11
 #define NFC_HAL_HCI_PIPE_INFO_SIZE              5
 
 #define NFC_HAL_HCI_ANY_SET_PARAMETER           0x01
 #define NFC_HAL_HCI_ANY_GET_PARAMETER           0x02
 #define NFC_HAL_HCI_ADM_NOTIFY_ALL_PIPE_CLEARED 0x15
 
+#define NFC_HAL_HCI_SESSION_IDENTITY_INDEX      0x01
 #define NFC_HAL_HCI_WHITELIST_INDEX             0x03
 
 #define NFC_HAL_HCI_ADMIN_PIPE                  0x01
 #define NFC_HAL_HCI_HOST_ID_UICC0               0x02        /* Host ID for UICC 0 */
 #define NFC_HAL_HCI_HOST_ID_UICC1               0x03        /* Host ID for UICC 1 */
+#define NFC_HAL_HCI_HOST_ID_UICC2               0x04        /* Host ID for UICC 2 */
 #define NFC_HAL_HCI_COMMAND_TYPE                0x00
 #define NFC_HAL_HCI_RESPONSE_TYPE               0x02
 
 /* NFC HAL HCI responses */
 #define NFC_HAL_HCI_ANY_OK                      0x00
 
+#endif
+
 /* Flag defintions for tNFC_HAL_NVM */
 #define NFC_HAL_NVM_FLAGS_NO_NVM                0x01    /* No NVM available                     */
 #define NFC_HAL_NVM_FLAGS_LPM_BAD               0x02    /* FPM patch in NVM failed CRC check    */
@@ -245,6 +241,7 @@ typedef struct
 
 typedef void (tNFC_HAL_BTVSC_CPLT_CBACK) (tNFC_HAL_BTVSC_CPLT *p1);
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
 
 /* data type for NFC_HAL_HCI_RSP_NV_READ_EVT */
 typedef struct
@@ -272,6 +269,7 @@ typedef union
     tNFC_HAL_HCI_RSP_NV_WRITE_EVT   nv_write;
 } tNFC_HAL_HCI_EVENT_DATA;
 
+#endif
 /*****************************************************************************
 ** Control block for NFC HAL
 *****************************************************************************/
@@ -389,6 +387,8 @@ typedef struct
     tHAL_NFC_STATUS_CBACK   *p_prop_cback;          /* callback to notify complete of proprietary update */
 } tNFC_HAL_DEV_CB;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+
 /* data members for NFC_HAL-HCI */
 typedef struct
 {
@@ -398,11 +398,15 @@ typedef struct
     UINT8                   hci_netwk_config_block;   /* Rsp awaiting for hci network configuration block */
     BOOLEAN                 b_wait_hcp_conn_create_rsp; /* Waiting for hcp connection create response */
     BOOLEAN                 clear_all_pipes_to_uicc1; /* UICC1 was restarted for patch download */
+    BOOLEAN                 update_session_id;        /* Next response from NFCC is to Get Session id cmd */
     BOOLEAN                 hci_fw_workaround;        /* HAL HCI Workaround need */
     BOOLEAN                 hci_fw_validate_netwk_cmd;/* Flag to indicate if hci network ntf to validate */
     UINT8                   hcp_conn_id;              /* NCI Connection id for HCP */
+    UINT8                   dh_session_id[1];         /* Byte 0 of DH Session ID */
 } tNFC_HAL_HCI_CB;
 
+#endif
+
 typedef struct
 {
     tHAL_NFC_CBACK          *p_stack_cback;     /* Callback for HAL event notification  */
@@ -419,8 +423,10 @@ typedef struct
     tNFC_HAL_PRM_CB         prm;
     tNFC_HAL_PRM_I2C_FIX_CB prm_i2c;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
     /* data members for NFC_HAL-HCI */
     tNFC_HAL_HCI_CB         hci_cb;
+#endif
 
     UINT8                   pre_discover_done;  /* TRUE, when the prediscover config is complete */
 
@@ -479,6 +485,7 @@ void nfc_hal_prm_spd_reset_ntf (UINT8 reset_reason, UINT8 reset_type);
 void nfc_hal_prm_nci_command_complete_cback (tNFC_HAL_NCI_EVT event, UINT16 data_len, UINT8 *p_data);
 void nfc_hal_prm_process_timeout (void *p_tle);
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
 /* nfc_hal_hci.c */
 void nfc_hal_hci_enable (void);
 void nfc_hal_hci_evt_hdlr (tNFC_HAL_HCI_EVENT_DATA *p_evt_data);
@@ -487,6 +494,12 @@ void nfc_hal_hci_handle_hcp_pkt_from_hc (UINT8 *p_data);
 NFC_HDR* nfc_hal_hci_postproc_hcp (void);
 BOOLEAN nfc_hal_hci_handle_hcp_pkt_to_hc (UINT8 *p_data);
 void nfc_hal_hci_timeout_cback (void *p_tle);
+void nfc_hal_hci_handle_build_info (UINT8 chipverlen, UINT8 *p_chipverstr);
+#else
+#define nfc_hal_hci_enable()    NFC_HAL_SET_INIT_STATE (NFC_HAL_INIT_STATE_IDLE);
+#define nfc_hal_hci_handle_build_info(p,a)
+#define nfc_hal_hci_evt_hdlr(p);
+#endif
 
 
 /* Define default NCI protocol trace function (if protocol tracing is enabled) */
diff --git a/src/hal/int/nfc_hal_nv_ci.h b/src/hal/int/nfc_hal_nv_ci.h
index be8ae9e..1a36b57 100644
--- a/src/hal/int/nfc_hal_nv_ci.h
+++ b/src/hal/int/nfc_hal_nv_ci.h
@@ -25,6 +25,8 @@
 #ifndef NFC_HAL_NV_CI_H
 #define NFC_HAL_NV_CI_H
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+
 #include "nfc_hal_nv_co.h"
 
 
@@ -85,5 +87,7 @@ void nfc_hal_nv_ci_read (UINT16                  num_bytes_read,
 }
 #endif
 
+#endif /* NFC_HAL_HCI_INCLUDED */
+
 #endif /* NFC_HAL_NV_CI_H */
 
diff --git a/src/hal/int/nfc_hal_nv_co.h b/src/hal/int/nfc_hal_nv_co.h
index 7879f9b..7ddf46f 100644
--- a/src/hal/int/nfc_hal_nv_co.h
+++ b/src/hal/int/nfc_hal_nv_co.h
@@ -25,6 +25,8 @@
 #ifndef NFC_HAL_NV_CO_H
 #define NFC_HAL_NV_CO_H
 
+#if (NFC_HAL_HCI_INCLUDED == TRUE)
+
 #include <time.h>
 
 
@@ -55,6 +57,7 @@ typedef UINT8 tNFC_HAL_NV_CO_STATUS;
 #define  HC_F3_NV_BLOCK         0x02
 #define  HC_F4_NV_BLOCK         0x03
 #define  HC_F2_NV_BLOCK         0x04
+#define  HC_F5_NV_BLOCK         0x05
 
 /*****************************************************************************
 **  Function Declarations
@@ -105,5 +108,5 @@ void nfc_hal_nv_co_read (UINT8 *p_buf, UINT16 nbytes, UINT8 block);
 *******************************************************************************/
 void nfc_hal_nv_co_write (const UINT8 *p_buf, UINT16 nbytes, UINT8 block);
 
-
+#endif /* NFC_HAL_HCI_INCLUDED */
 #endif /* NFC_HAL_NV_CO_H */
diff --git a/src/include/OverrideLog.h b/src/include/OverrideLog.h
index ffb2994..472f4da 100644
--- a/src/include/OverrideLog.h
+++ b/src/include/OverrideLog.h
@@ -32,7 +32,7 @@
 
 
 #include <cutils/log.h> //define Android logging macros
-#include "bt_types.h" //define various BT_TRACE_LEVEL_*
+#include "bt_types.h"
 
 
 #ifdef __cplusplus
@@ -40,7 +40,7 @@ extern "C" {
 #endif
 
 
-extern unsigned char appl_trace_level; //defined in /external/libnfc-nci/
+extern unsigned char appl_trace_level;
 
 
 /*******************************************************************************
diff --git a/src/include/bt_target.h b/src/include/bt_target.h
index d873a20..f751548 100644
--- a/src/include/bt_target.h
+++ b/src/include/bt_target.h
@@ -38,6 +38,10 @@
 **
 ******************************************************************************/
 
+#ifndef BT_BRCM_VS_INCLUDED
+#define BT_BRCM_VS_INCLUDED             TRUE
+#endif
+
 /* set to FALSE unless using Zeevo */
 #ifndef ZEEVO_CTRL_DEFINED
 #define ZEEVO_CTRL_DEFINED FALSE
@@ -530,10 +534,10 @@ BT_API extern void HCILL_RegState( tHCILL_STATE_CBACK *p_cback);
 #endif
 
 /* Quick Timer */
-/* if L2CAP_FCR_INCLUDED is TRUE then it should have 100 millisecond resolution */
+/* minimum should have 100 millisecond resolution for eL2CAP */
 /* if HCILP_INCLUDED is TRUE     then it should have 100 millisecond resolution */
 /* if SLIP_INCLUDED is TRUE      then it should have 10 millisecond resolution  */
-/* if BCM2045_USE_DELAY is FALSE then it should have 10 millisecond resolution  */
+/* if BRCM_USE_DELAY is FALSE then it should have 10 millisecond resolution  */
 /* if none of them is included then QUICK_TIMER_TICKS_PER_SEC is set to 0 to exclude quick timer */
 #ifndef QUICK_TIMER_TICKS_PER_SEC
 #define QUICK_TIMER_TICKS_PER_SEC   100       /* 10ms timer */
@@ -551,37 +555,16 @@ and USER_HW_DISABLE_API macros */
 #define BTM_AUTOMATIC_HCI_RESET      TRUE
 #endif
 
-/* Include BTM Discovery database and code. */
-#ifndef BTM_DISCOVERY_INCLUDED
-#define BTM_DISCOVERY_INCLUDED      TRUE
-#endif
-
-/* Include inquiry code. */
-#ifndef BTM_INQUIRY_INCLUDED
-#define BTM_INQUIRY_INCLUDED        TRUE
-#endif
-
 /* Cancel Inquiry on incoming SSP - Work around code for a FW issue (CQ#167446). */
 #ifndef BTM_NO_SSP_ON_INQUIRY
 #define BTM_NO_SSP_ON_INQUIRY       FALSE
 #endif
 
-/* Include periodic inquiry code (used when BTM_INQUIRY_INCLUDED is TRUE). */
-#ifndef BTM_PERIODIC_INQ_INCLUDED
-#define BTM_PERIODIC_INQ_INCLUDED   TRUE
-#endif
-
-/* Include security authorization code */
-#ifndef BTM_AUTHORIZATION_INCLUDED
-#define BTM_AUTHORIZATION_INCLUDED  TRUE
-#endif
-
 /* Include the implemenation needed by Pre-Lisbon controller (2.0_EDR or older) */
 #ifndef BTM_PRE_LISBON_INCLUDED
 #define BTM_PRE_LISBON_INCLUDED     TRUE
 #endif
 
-
 /* Includes SCO if TRUE */
 #ifndef BTM_SCO_INCLUDED
 #define BTM_SCO_INCLUDED            TRUE       /* TRUE includes SCO code */
@@ -629,11 +612,6 @@ and USER_HW_DISABLE_API macros */
 #define BTM_INQ_DB_SIZE             12
 #endif
 
-/* This is set to enable automatic periodic inquiry at startup. */
-#ifndef BTM_ENABLE_AUTO_INQUIRY
-#define BTM_ENABLE_AUTO_INQUIRY     FALSE
-#endif
-
 /* This is set to always try to acquire the remote device name. */
 #ifndef BTM_INQ_GET_REMOTE_NAME
 #define BTM_INQ_GET_REMOTE_NAME     FALSE
@@ -659,16 +637,6 @@ and USER_HW_DISABLE_API macros */
 #define BTM_DEFAULT_INQ_MIN_DELAY   20
 #endif
 
-/* The maximum age of entries in inquiry database in seconds ('0' disables feature). */
-#ifndef BTM_INQ_MAX_AGE
-#define BTM_INQ_MAX_AGE             0
-#endif
-
-/* The maximum age of entries in inquiry database based on inquiry response failure ('0' disables feature). */
-#ifndef BTM_INQ_AGE_BY_COUNT
-#define BTM_INQ_AGE_BY_COUNT        0
-#endif
-
 /* TRUE if controller does not support inquiry event filtering. */
 #ifndef BTM_BYPASS_EVENT_FILTERING
 #define BTM_BYPASS_EVENT_FILTERING  FALSE
@@ -724,16 +692,6 @@ and USER_HW_DISABLE_API macros */
 #define BTM_DEFAULT_DISC_INTERVAL   0x0800
 #endif
 
-/* Sets the period, in seconds, to automatically perform service discovery. */
-#ifndef BTM_AUTO_DISCOVERY_PERIOD
-#define BTM_AUTO_DISCOVERY_PERIOD   0
-#endif
-
-/* The size in bytes of the BTM discovery database (if discovery is included). */
-#ifndef BTM_DISCOVERY_DB_SIZE
-#define BTM_DISCOVERY_DB_SIZE       4000
-#endif
-
 /* Number of milliseconds to delay BTU task startup upon device initialization. */
 #ifndef BTU_STARTUP_DELAY
 #define BTU_STARTUP_DELAY           0
@@ -865,7 +823,7 @@ and USER_HW_DISABLE_API macros */
 
 /* Maximum number of callbacks that can be registered using BTM_RegisterForVSEvents */
 #ifndef BTM_MAX_VSE_CALLBACKS
-#define BTM_MAX_VSE_CALLBACKS           3
+#define BTM_MAX_VSE_CALLBACKS           6
 #endif
 
 /* Number of streams for dual stack */
@@ -916,7 +874,7 @@ and USER_HW_DISABLE_API macros */
 /* The default MITM Protection Requirement for dedicated bonding using Simple Pairing
  * Possible values are BTM_AUTH_AP_YES or BTM_AUTH_AP_NO */
 #ifndef BTM_DEFAULT_DD_AUTH_REQ
-#define BTM_DEFAULT_DD_AUTH_REQ            BTM_AUTH_AP_YES
+#define BTM_DEFAULT_DD_AUTH_REQ         BTM_AUTH_AP_YES
 #endif
 
 /* Include Out-of-Band implementation for Simple Pairing */
@@ -933,9 +891,29 @@ and USER_HW_DISABLE_API macros */
 ** End of Lisbon Features
 **************************/
 
+/* This is set to use the BTM TBFC Supported. */
+#ifndef BTM_TBFC_INCLUDED
+#define BTM_TBFC_INCLUDED               FALSE
+#endif
+
+/* TRUE to include bi-directionnal TBFC */
+#ifndef BTM_BI_DIR_TBFC_INCLUDED
+#define BTM_BI_DIR_TBFC_INCLUDED        FALSE
+#endif
+
+/* TRUE to include CLB (ConnectionLess Slave Broadcast) */
+#ifndef BTM_CLB_INCLUDED
+#define BTM_CLB_INCLUDED                FALSE
+#endif
+
+/* TRUE to include CLB Rx (ConnectionLess Broadcast Reception) */
+#ifndef BTM_CLB_RX_INCLUDED
+#define BTM_CLB_RX_INCLUDED             FALSE
+#endif
+
 /* Used for conformance testing ONLY */
 #ifndef BTM_BLE_CONFORMANCE_TESTING
-#define BTM_BLE_CONFORMANCE_TESTING           FALSE
+#define BTM_BLE_CONFORMANCE_TESTING     FALSE
 #endif
 
 
@@ -945,12 +923,6 @@ and USER_HW_DISABLE_API macros */
 **
 ******************************************************************************/
 
-/* Flow control and retransmission mode */
-
-#ifndef L2CAP_FCR_INCLUDED
-#define L2CAP_FCR_INCLUDED FALSE
-#endif
-
 /* The maximum number of simultaneous links that L2CAP can support. */
 #ifndef MAX_L2CAP_LINKS
 #define MAX_L2CAP_LINKS             4
@@ -1310,13 +1282,6 @@ and USER_HW_DISABLE_API macros */
 #define AMP_RFC_TEST            FALSE
 #endif
 
-#ifndef TIMER_PARAM_TYPE
-#ifdef  WIN2000
-#define TIMER_PARAM_TYPE    void *
-#else
-#define TIMER_PARAM_TYPE    UINT32
-#endif
-#endif
 
 /******************************************************************************
 **
@@ -1332,27 +1297,36 @@ and USER_HW_DISABLE_API macros */
 #define LOCAL_BLE_CONTROLLER_ID         (AMP_MAX_LOCAL_CTRLS + 1)
 #endif
 
+#ifndef BTM_BLE_PRIVACY_SPT
+#define BTM_BLE_PRIVACY_SPT         FALSE
+#endif
+
+#ifndef BTM_PERIPHERAL_ENABLED
+#define BTM_PERIPHERAL_ENABLED     FALSE
+#endif
+
+#ifndef HID_LE_INCLUDED
+#define HID_LE_INCLUDED         FALSE
+#endif
+
+#ifndef BLE_BRCM_INCLUDED
+#define BLE_BRCM_INCLUDED         FALSE
+#endif
+
+#ifndef BTM_DUMO_ADDR_CENTRAL_ENABLED
+#define BTM_DUMO_ADDR_CENTRAL_ENABLED         FALSE
+#endif
+
+
 /******************************************************************************
 **
 ** ATT/GATT Protocol/Profile Settings
 **
 ******************************************************************************/
-#ifndef ATT_INCLUDED
-#define ATT_INCLUDED         FALSE
-#endif
-
 #ifndef ATT_DEBUG
 #define ATT_DEBUG           FALSE
 #endif
 
-#ifndef GATT_SERVER_ENABLED
-#define GATT_SERVER_ENABLED          FALSE
-#endif
-
-#ifndef GATT_CLIENT_ENABLED
-#define GATT_CLIENT_ENABLED          FALSE
-#endif
-
 #ifndef GATT_MAX_SR_PROFILES
 #define GATT_MAX_SR_PROFILES        32 /* max is 32 */
 #endif
@@ -1362,7 +1336,7 @@ and USER_HW_DISABLE_API macros */
 #endif
 
 #ifndef GATT_MAX_PHY_CHANNEL
-#define GATT_MAX_PHY_CHANNEL        4
+#define GATT_MAX_PHY_CHANNEL        4 /* limited by the BLE controller upto 15 */
 #endif
 
 /* Used for conformance testing ONLY */
@@ -1424,11 +1398,7 @@ and USER_HW_DISABLE_API macros */
 
 /* The maximum number of attributes in each record. */
 #ifndef SDP_MAX_REC_ATTR
-#if defined(HID_DEV_INCLUDED) && (HID_DEV_INCLUDED==TRUE)
 #define SDP_MAX_REC_ATTR            25
-#else
-#define SDP_MAX_REC_ATTR            13
-#endif
 #endif
 
 #ifndef SDP_MAX_PAD_LEN
@@ -1437,11 +1407,7 @@ and USER_HW_DISABLE_API macros */
 
 /* The maximum length, in bytes, of an attribute. */
 #ifndef SDP_MAX_ATTR_LEN
-#if defined(HID_DEV_INCLUDED) && (HID_DEV_INCLUDED==TRUE)
-#define SDP_MAX_ATTR_LEN            80
-#else
-#define SDP_MAX_ATTR_LEN            100
-#endif
+#define SDP_MAX_ATTR_LEN            256
 #endif
 
 /* The maximum number of attribute filters supported by SDP databases. */
@@ -1499,11 +1465,6 @@ and USER_HW_DISABLE_API macros */
 #define SDP_SECURITY_LEVEL          BTM_SEC_NONE
 #endif
 
-/* Device identification feature. */
-#ifndef SDP_DI_INCLUDED
-#define SDP_DI_INCLUDED             FALSE
-#endif
-
 /******************************************************************************
 **
 ** RFCOMM
@@ -1589,11 +1550,6 @@ and USER_HW_DISABLE_API macros */
 #define PORT_CREDIT_RX_LOW          8
 #endif
 
-/* Test code allowing l2cap FEC on RFCOMM.*/
-#ifndef PORT_ENABLE_L2CAP_FCR_TEST
-#define PORT_ENABLE_L2CAP_FCR_TEST  FALSE
-#endif
-
 /* if application like BTA, Java or script test engine is running on other than BTU thread, */
 /* PORT_SCHEDULE_LOCK shall be defined as GKI_sched_lock() or GKI_disable() */
 #ifndef PORT_SCHEDULE_LOCK
@@ -1693,32 +1649,11 @@ and USER_HW_DISABLE_API macros */
 #define OBX_SERVER_INCLUDED        TRUE
 #endif
 
-/* TRUE to include OBEX authentication/MD5 code */
-#ifndef OBX_MD5_INCLUDED
-#define OBX_MD5_INCLUDED           TRUE
-#endif
-
 /* TRUE to include OBEX authentication/MD5 test code */
 #ifndef OBX_MD5_TEST_INCLUDED
 #define OBX_MD5_TEST_INCLUDED       FALSE
 #endif
 
-/* TRUE to include OBEX 1.4 enhancement (including Obex Over L2CAP) */
-#ifndef OBX_14_INCLUDED
-#define OBX_14_INCLUDED             FALSE
-#endif
-/* MD5 code is required to use OBEX 1.4 features (Reliable session) */
-#if (OBX_MD5_INCLUDED == FALSE)
-#undef OBX_14_INCLUDED
-#define OBX_14_INCLUDED             FALSE
-#endif
-
-/* L2CAP FCR/eRTM mode is required to use OBEX Over L2CAP */
-#if (L2CAP_FCR_INCLUDED == FALSE)
-#undef OBX_14_INCLUDED
-#define OBX_14_INCLUDED             FALSE
-#endif
-
 /* The timeout value (in seconds) for reliable sessions to remain in suspend. 0xFFFFFFFF for no timeout event. */
 #ifndef OBX_SESS_TIMEOUT_VALUE
 #define OBX_SESS_TIMEOUT_VALUE      600
@@ -1739,11 +1674,6 @@ and USER_HW_DISABLE_API macros */
 #define OBX_NUM_SERVERS             12
 #endif
 
-/* The maximum number of sessions per registered server. */
-#ifndef OBX_MAX_SR_SESSION
-#define OBX_MAX_SR_SESSION          4
-#endif
-
 /* The maximum number of sessions for all registered servers.
  * (must be equal or bigger than OBX_NUM_SERVERS) */
 #ifndef OBX_NUM_SR_SESSIONS
@@ -1781,7 +1711,7 @@ and USER_HW_DISABLE_API macros */
 #define OBX_MAX_RX_QUEUE_COUNT      3
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
    Pool ID where to reassemble the SDU.
    This Pool will allow buffers to be used that are larger than
    the L2CAP_MAX_MTU. */
@@ -1789,7 +1719,7 @@ and USER_HW_DISABLE_API macros */
 #define OBX_USER_RX_POOL_ID     OBX_LRG_DATA_POOL_ID
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
    Pool ID where to hold the SDU.
    This Pool will allow buffers to be used that are larger than
    the L2CAP_MAX_MTU. */
@@ -1797,14 +1727,14 @@ and USER_HW_DISABLE_API macros */
 #define OBX_USER_TX_POOL_ID     OBX_LRG_DATA_POOL_ID
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
 GKI Buffer Pool ID used to hold MPS segments during SDU reassembly
 */
 #ifndef OBX_FCR_RX_POOL_ID
 #define OBX_FCR_RX_POOL_ID      HCI_ACL_POOL_ID
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
 GKI Buffer Pool ID used to hold MPS segments used in (re)transmissions.
 L2CAP_DEFAULT_ERM_POOL_ID is specified to use the HCI ACL data pool.
 Note:  This pool needs to have enough buffers to hold two times the window size negotiated
@@ -1816,7 +1746,7 @@ Note:  This pool needs to have enough buffers to hold two times the window size
 #define OBX_FCR_TX_POOL_ID      HCI_ACL_POOL_ID
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
 Size of the transmission window when using enhanced retransmission mode. Not used
 in basic and streaming modes. Range: 1 - 63
 This is used when AMP_INCLUDED == FALSE
@@ -1825,7 +1755,7 @@ This is used when AMP_INCLUDED == FALSE
 #define OBX_FCR_OPT_TX_WINDOW_SIZE_BR_EDR       20
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
 Size of the transmission window when using enhanced retransmission mode. Not used
 in basic and streaming modes. Range: 1 - 63
 This is used when AMP_INCLUDED == TRUE
@@ -1834,7 +1764,7 @@ This is used when AMP_INCLUDED == TRUE
 #define OBX_FCR_OPT_TX_WINDOW_SIZE_AMP          45
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
 Number of transmission attempts for a single I-Frame before taking
 Down the connection. Used In ERTM mode only. Value is Ignored in basic and
 Streaming modes.
@@ -1846,7 +1776,7 @@ Range: 0, 1-0xFF
 #define OBX_FCR_OPT_MAX_TX_B4_DISCNT    20
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
 Retransmission Timeout
 Range: Minimum 2000 (2 secs) on BR/EDR when supporting PBF.
  */
@@ -1854,7 +1784,7 @@ Range: Minimum 2000 (2 secs) on BR/EDR when supporting PBF.
 #define OBX_FCR_OPT_RETX_TOUT           2000
 #endif
 
-/* This option is application when OBX_14_INCLUDED=TRUE
+/* This option is application when OBEX over L2CAP is in use
 Monitor Timeout
 Range: Minimum 12000 (12 secs) on BR/EDR when supporting PBF.
 */
@@ -3350,11 +3280,6 @@ Range: Minimum 12000 (12 secs) on BR/EDR when supporting PBF.
 #define AVCT_BROWSE_INCLUDED        TRUE
 #endif
 
-#if ((L2CAP_FCR_INCLUDED == FALSE) && (AVCT_BROWSE_INCLUDED == TRUE))
-#undef AVCT_BROWSE_INCLUDED
-#define AVCT_BROWSE_INCLUDED        FALSE
-#endif
-
 /* Pool ID where to reassemble the SDU.
    This Pool allows buffers to be used that are larger than
    the L2CAP_MAX_MTU. */
@@ -3850,7 +3775,7 @@ The H5 work around sequence will be:
 #endif
 
 #ifndef H4IBSS_INCLUDED
-#define H4IBSS_INCLUDED                 TRUE
+#define H4IBSS_INCLUDED                 FALSE  /* !!!! Android must use FALSE */
 #endif
 
 /* display H4IBSS state and event in text */
@@ -3980,12 +3905,12 @@ The H5 work around sequence will be:
 
 
 /* Use gki_delay for patch ram */
-#ifndef BCM2045_USE_DELAY
+#ifndef BRCM_USE_DELAY
 #if ( SLIP_INCLUDED == TRUE )
 /* H5 need to be initialized after sending download mini driver HCI command */
-#define BCM2045_USE_DELAY           FALSE
+#define BRCM_USE_DELAY           FALSE
 #else
-#define BCM2045_USE_DELAY           TRUE
+#define BRCM_USE_DELAY           TRUE
 #endif
 #endif
 
@@ -4004,6 +3929,15 @@ The H5 work around sequence will be:
 #define BTA_EIR_SERVER_NUM_CUSTOM_UUID     8
 #endif
 
+/* MIP A2DP Feature enabled */
+#ifndef BTA_MIP_INCLUDED
+#define BTA_MIP_INCLUDED   FALSE
+#endif
+
+/* No 3D sync profile debug by default */
+#ifndef BTA_3DS_DEBUG
+#define BTA_3DS_DEBUG FALSE
+#endif
 /******************************************************************************
 **
 ** BTE
diff --git a/src/include/bt_trace.h b/src/include/bt_trace.h
index 6191cc3..d9c58dd 100644
--- a/src/include/bt_trace.h
+++ b/src/include/bt_trace.h
@@ -241,7 +241,7 @@ EXPORT_API extern void BTTRC_StackTrace6(tBTTRC_LAYER_ID layer_id,
 
 /* Enables or disables protocol trace information. */
 #ifndef BT_TRACE_PROTOCOL
-#define BT_TRACE_PROTOCOL   FALSE  /* Android requires FALSE */
+#define BT_TRACE_PROTOCOL   TRUE  /* Android requires TRUE */
 #endif
 
 /******************************************************************************
diff --git a/src/include/buildcfg.h b/src/include/buildcfg.h
index 24b9ab0..fcd2396 100644
--- a/src/include/buildcfg.h
+++ b/src/include/buildcfg.h
@@ -83,8 +83,9 @@ extern void DispNci (UINT8 *p, UINT16 len, BOOLEAN is_recv);
 
 extern void downloadFirmwarePatchFile (UINT32 brcm_hw_id);
 
-#define DISP_NCI	(DispNciDump)
-extern void DispNciDump(UINT8 *p, UINT16 len, BOOLEAN is_recv);
+void ProtoDispAdapterDisplayNciPacket (UINT8* nciPacket, UINT16 nciPacketLen, BOOLEAN is_recv);
+#define DISP_NCI ProtoDispAdapterDisplayNciPacket
+#define LOGMSG_TAG_NAME "BrcmNfcNfa"
 
 #ifndef _TIMEB
 #define _TIMEB
diff --git a/src/include/config.h b/src/include/config.h
index 6be16fc..e864d28 100644
--- a/src/include/config.h
+++ b/src/include/config.h
@@ -64,6 +64,7 @@ int GetNumValue(const char* name, void* p_value, unsigned long len);
 #define NAME_NFA_DM_START_UP_VSC_CFG    "NFA_DM_START_UP_VSC_CFG"
 #define NAME_NFA_DTA_START_UP_VSC_CFG   "NFA_DTA_START_UP_VSC_CFG"
 #define NAME_UICC_LISTEN_TECH_MASK      "UICC_LISTEN_TECH_MASK"
+#define NAME_UICC_LISTEN_TECH_EX_MASK   "UICC_LISTEN_TECH_EXCLUDE_MASK"
 #define NAME_SNOOZE_MODE_CFG            "SNOOZE_MODE_CFG"
 #define NAME_NFA_DM_DISC_DURATION_POLL  "NFA_DM_DISC_DURATION_POLL"
 #define NAME_SPD_DEBUG                  "SPD_DEBUG"
@@ -75,6 +76,13 @@ int GetNumValue(const char* name, void* p_value, unsigned long len);
 #define NAME_NFCC_ENABLE_TIMEOUT        "NFCC_ENABLE_TIMEOUT"
 #define NAME_NFA_DM_PRE_DISCOVERY_CFG   "NFA_DM_PRE_DISCOVERY_CFG"
 #define NAME_POLL_FREQUENCY             "POLL_FREQUENCY"
+#define NAME_XTAL_HARDWARE_ID           "XTAL_HARDWARE_ID"
+#define NAME_XTAL_FREQUENCY             "XTAL_FREQUENCY"
+#define NAME_XTAL_FREQ_INDEX            "XTAL_FREQ_INDEX"
+#define NAME_EXCLUSIVE_SE_ACCESS        "EXCLUSIVE_SE_ACCESS"
+#define NAME_DBG_NO_UICC_IDLE_TIMEOUT_TOGGLING  "DBG_NO_UICC_IDLE_TIMEOUT_TOGGLING"
+#define NAME_PRESENCE_CHECK_ALGORITHM   "PRESENCE_CHECK_ALGORITHM"
+#define NAME_ALLOW_NO_NVM               "ALLOW_NO_NVM"
 
 #define                     LPTD_PARAM_LEN (40)
 
diff --git a/src/include/nfc_target.h b/src/include/nfc_target.h
index c7cf22b..52cc228 100644
--- a/src/include/nfc_target.h
+++ b/src/include/nfc_target.h
@@ -186,8 +186,6 @@
 #define NFC_BRCM_VS_INCLUDED    TRUE
 #endif
 
-/* Define to TRUE to include not openned Broadcom Vendor Specific implementation */
-
 /* Define to TRUE if compling for NFC Reader/Writer Only mode */
 #ifndef NFC_RW_ONLY
 #define NFC_RW_ONLY         FALSE
@@ -562,11 +560,21 @@
 #define NFA_DM_AUTO_READ_NDEF        FALSE  /* !!!!! NFC-Android needs FALSE */
 #endif
 
-/* Automatic NDEF read (when not in exclusive RF mode) */
+/* Automatic NDEF presence check (when not in exclusive RF mode) */
 #ifndef NFA_DM_AUTO_PRESENCE_CHECK
 #define NFA_DM_AUTO_PRESENCE_CHECK   FALSE  /* Android requires FALSE */
 #endif
 
+/* Presence check option: 0x01: use sleep/wake for none-NDEF ISO-DEP tags */
+#ifndef NFA_DM_PRESENCE_CHECK_OPTION
+#define NFA_DM_PRESENCE_CHECK_OPTION                0x03  /* !!!!! Android needs value 3 */
+#endif
+
+/* Maximum time to wait for presence check response */
+#ifndef NFA_DM_MAX_PRESENCE_CHECK_TIMEOUT
+#define NFA_DM_MAX_PRESENCE_CHECK_TIMEOUT           500
+#endif
+
 /* Default delay to auto presence check after sending raw frame */
 #ifndef NFA_DM_DEFAULT_PRESENCE_CHECK_START_DELAY
 #define NFA_DM_DEFAULT_PRESENCE_CHECK_START_DELAY   750
@@ -677,6 +685,23 @@
 #ifndef HAL_WRITE
 #define HAL_WRITE(p)    {nfc_cb.p_hal->write(p->len, (UINT8 *)(p+1) + p->offset); GKI_freebuf(p);}
 
+#ifdef NFC_HAL_SHARED_GKI
+
+/* NFC HAL Included if NFC_NFCEE_INCLUDED */
+#if (NFC_NFCEE_INCLUDED == TRUE)
+
+#ifndef NFC_HAL_HCI_INCLUDED
+#define NFC_HAL_HCI_INCLUDED    TRUE
+#endif
+#else /* NFC_NFCEE_INCLUDED == TRUE */
+#ifndef NFC_HAL_HCI_INCLUDED
+#define NFC_HAL_HCI_INCLUDED    FALSE
+#endif
+
+#endif /* NFC_NFCEE_INCLUDED == FALSE */
+
+#endif /* NFC_HAL_SHARED_GKI */
+
 
 
 #endif /* HAL_WRITE */
diff --git a/src/nfa/ce/nfa_ce_act.c b/src/nfa/ce/nfa_ce_act.c
index b6ccb40..5b3b1d9 100644
--- a/src/nfa/ce/nfa_ce_act.c
+++ b/src/nfa/ce/nfa_ce_act.c
@@ -86,12 +86,14 @@ void nfa_ce_handle_t3t_evt (tCE_EVENT event, tCE_DATA *p_ce_data)
     case CE_T3T_RAW_FRAME_EVT:
         if (p_cb->idx_cur_active == NFA_CE_LISTEN_INFO_IDX_NDEF)
         {
+            conn_evt.data.status = p_ce_data->raw_frame.status;
             conn_evt.data.p_data = (UINT8 *) (p_ce_data->raw_frame.p_data + 1) + p_ce_data->raw_frame.p_data->offset;
             conn_evt.data.len    = p_ce_data->raw_frame.p_data->len;
             (*p_cb->p_active_conn_cback) (NFA_DATA_EVT, &conn_evt);
         }
         else
         {
+            conn_evt.ce_data.status = p_ce_data->raw_frame.status;
             conn_evt.ce_data.handle = (NFA_HANDLE_GROUP_CE | ((tNFA_HANDLE)p_cb->idx_cur_active));
             conn_evt.ce_data.p_data = (UINT8 *) (p_ce_data->raw_frame.p_data + 1) + p_ce_data->raw_frame.p_data->offset;
             conn_evt.ce_data.len    = p_ce_data->raw_frame.p_data->len;
@@ -212,7 +214,8 @@ void nfa_ce_handle_t4t_aid_evt (tCE_EVENT event, tCE_DATA *p_ce_data)
             }
 
             /* Notify app of AID data */
-            conn_evt.ce_data.handle =   NFA_HANDLE_GROUP_CE | ((tNFA_HANDLE)p_cb->idx_cur_active);
+            conn_evt.ce_data.status = p_ce_data->raw_frame.status;
+            conn_evt.ce_data.handle = NFA_HANDLE_GROUP_CE | ((tNFA_HANDLE)p_cb->idx_cur_active);
             conn_evt.ce_data.p_data = (UINT8 *) (p_ce_data->raw_frame.p_data + 1) + p_ce_data->raw_frame.p_data->offset;
             conn_evt.ce_data.len    = p_ce_data->raw_frame.p_data->len;
             (*p_cb->p_active_conn_cback) (NFA_CE_DATA_EVT, &conn_evt);
@@ -1400,4 +1403,3 @@ BOOLEAN nfa_ce_api_cfg_isodep_tech (tNFA_CE_MSG *p_ce_msg)
         nfa_ce_cb.isodep_disc_mask |= NFA_DM_DISC_MASK_LB_ISO_DEP;
     return TRUE;
 }
-
diff --git a/src/nfa/dm/nfa_dm_act.c b/src/nfa/dm/nfa_dm_act.c
index 7263539..bdec959 100644
--- a/src/nfa/dm/nfa_dm_act.c
+++ b/src/nfa/dm/nfa_dm_act.c
@@ -1168,6 +1168,8 @@ BOOLEAN nfa_dm_act_send_raw_frame (tNFA_DM_MSG *p_data)
     if (  (nfa_dm_cb.disc_cb.disc_state == NFA_DM_RFST_POLL_ACTIVE)
         ||(nfa_dm_cb.disc_cb.disc_state == NFA_DM_RFST_LISTEN_ACTIVE)  )
     {
+        nfa_dm_cb.flags |= NFA_DM_FLAGS_RAW_FRAME;
+        NFC_SetReassemblyFlag (FALSE);
         /* If not in exclusive mode, and not activated for LISTEN, then forward raw data to NFA_RW to send */
         if (  !(nfa_dm_cb.flags & NFA_DM_FLAGS_EXCL_RF_ACTIVE)
             &&!(nfa_dm_cb.disc_cb.disc_state == NFA_DM_RFST_LISTEN_ACTIVE)
@@ -1183,6 +1185,10 @@ BOOLEAN nfa_dm_act_send_raw_frame (tNFA_DM_MSG *p_data)
         else
         {
             status = NFC_SendData (NFC_RF_CONN_ID, (BT_HDR*) p_data);
+            if (status != NFC_STATUS_OK)
+            {
+                NFC_SetReassemblyFlag (TRUE);
+            }
             /* Already freed or NCI layer will free buffer */
             return FALSE;
         }
@@ -1190,6 +1196,7 @@ BOOLEAN nfa_dm_act_send_raw_frame (tNFA_DM_MSG *p_data)
 
     if (status == NFC_STATUS_FAILED)
     {
+        NFC_SetReassemblyFlag (TRUE);
         /* free the buffer */
         return TRUE;
     }
@@ -1440,6 +1447,7 @@ static void nfa_dm_act_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN
 
         if (p_msg)
         {
+            evt_data.data.status = p_data->data.status;
             evt_data.data.p_data = (UINT8 *) (p_msg + 1) + p_msg->offset;
             evt_data.data.len    = p_msg->len;
 
diff --git a/src/nfa/dm/nfa_dm_api.c b/src/nfa/dm/nfa_dm_api.c
index 89f667f..d8533a0 100644
--- a/src/nfa/dm/nfa_dm_api.c
+++ b/src/nfa/dm/nfa_dm_api.c
@@ -61,10 +61,10 @@ void NFA_Init(tHAL_NFC_ENTRY *p_hal_entry_tbl)
     nfa_snep_init(FALSE);
     nfa_rw_init();
     nfa_ce_init();
-    nfa_ee_init();
     if (nfa_ee_max_ee_cfg != 0)
     {
         nfa_dm_cb.get_max_ee    = p_hal_entry_tbl->get_max_ee;
+        nfa_ee_init();
         nfa_hci_init();
     }
 
diff --git a/src/nfa/dm/nfa_dm_cfg.c b/src/nfa/dm/nfa_dm_cfg.c
index ea1c1cc..85956b8 100644
--- a/src/nfa/dm/nfa_dm_cfg.c
+++ b/src/nfa/dm/nfa_dm_cfg.c
@@ -97,8 +97,10 @@ UINT8 nfa_dm_num_dm_interface_mapping = 0;
 const tNFA_DM_CFG nfa_dm_cfg =
 {
     NFA_DM_AUTO_DETECT_NDEF,                /* Automatic NDEF detection (when not in exclusive RF mode) */
-    NFA_DM_AUTO_READ_NDEF                   /* Automatic NDEF read (when not in exclusive RF mode)      */
-
+    NFA_DM_AUTO_READ_NDEF,                  /* Automatic NDEF read (when not in exclusive RF mode)      */
+    NFA_DM_AUTO_PRESENCE_CHECK,             /* Automatic presence check                                 */
+    NFA_DM_PRESENCE_CHECK_OPTION,           /* Use sleep/wake(last interface) for ISODEP presence check */
+    NFA_DM_MAX_PRESENCE_CHECK_TIMEOUT       /* Maximum time to wait for presence check response         */
 };
 
 tNFA_DM_CFG *p_nfa_dm_cfg = (tNFA_DM_CFG *) &nfa_dm_cfg;
diff --git a/src/nfa/dm/nfa_dm_discover.c b/src/nfa/dm/nfa_dm_discover.c
index 6204967..a161c34 100644
--- a/src/nfa/dm/nfa_dm_discover.c
+++ b/src/nfa/dm/nfa_dm_discover.c
@@ -79,6 +79,10 @@ static UINT8 nfa_dm_get_rf_discover_config (tNFA_DM_DISC_TECH_PROTO_MASK dm_disc
         NFA_TRACE_DEBUG1 ("nfa_dm_get_rf_discover_config () listen disabled, rm listen from 0x%x", dm_disc_mask);
         dm_disc_mask &= NFA_DM_DISC_MASK_POLL;
     }
+    if (nfa_dm_is_p2p_paused ())
+    {
+        dm_disc_mask &= ~NFA_DM_DISC_MASK_NFC_DEP;
+    }
 
     /* Check polling A */
     if (dm_disc_mask & ( NFA_DM_DISC_MASK_PA_T1T
@@ -371,7 +375,8 @@ static tNFA_STATUS nfa_dm_set_rf_listen_mode_config (tNFA_DM_DISC_TECH_PROTO_MAS
     /* NFCC can support NFC-DEP and T3T listening based on NFCID routing regardless of NFC-F tech routing */
     UINT8_TO_STREAM (p, NFC_PMID_LF_PROTOCOL);
     UINT8_TO_STREAM (p, NCI_PARAM_LEN_LF_PROTOCOL);
-    if (tech_proto_mask & NFA_DM_DISC_MASK_LF_NFC_DEP)
+    if ((tech_proto_mask & NFA_DM_DISC_MASK_LF_NFC_DEP) &&
+        !nfa_dm_is_p2p_paused() )
     {
         UINT8_TO_STREAM (p, NCI_LISTEN_PROTOCOL_NFC_DEP);
     }
@@ -761,7 +766,14 @@ static void nfa_dm_disc_discovery_cback (tNFC_DISCOVER_EVT event, tNFC_DISCOVER
         break;
     case NFC_DEACTIVATE_DEVT:
         if (p_data->deactivate.is_ntf)
+        {
             dm_disc_event = NFA_DM_RF_DEACTIVATE_NTF;
+            if ((p_data->deactivate.type == NFC_DEACTIVATE_TYPE_IDLE) || (p_data->deactivate.type == NFC_DEACTIVATE_TYPE_DISCOVERY))
+            {
+                NFC_SetReassemblyFlag (TRUE);
+                nfa_dm_cb.flags &= ~NFA_DM_FLAGS_RAW_FRAME;
+            }
+        }
         else
             dm_disc_event = NFA_DM_RF_DEACTIVATE_RSP;
         break;
@@ -1052,14 +1064,7 @@ void nfa_dm_start_rf_discover (void)
         }
 
         /* Let P2P set GEN bytes for LLCP to NFCC */
-        if (dm_disc_mask & ( NFA_DM_DISC_MASK_PA_NFC_DEP
-                            |NFA_DM_DISC_MASK_PF_NFC_DEP
-                            |NFA_DM_DISC_MASK_LA_NFC_DEP
-                            |NFA_DM_DISC_MASK_LF_NFC_DEP
-                            |NFA_DM_DISC_MASK_PAA_NFC_DEP
-                            |NFA_DM_DISC_MASK_PFA_NFC_DEP
-                            |NFA_DM_DISC_MASK_LAA_NFC_DEP
-                            |NFA_DM_DISC_MASK_LFA_NFC_DEP ))
+        if (dm_disc_mask & NFA_DM_DISC_MASK_NFC_DEP)
         {
             nfa_p2p_set_config (dm_disc_mask);
         }
@@ -1534,6 +1539,21 @@ tNFC_STATUS nfa_dm_disc_sleep_wakeup (void)
 
 /*******************************************************************************
 **
+** Function         nfa_dm_is_raw_frame_session
+**
+** Description      If NFA_SendRawFrame is called since RF activation,
+**                  this function returns TRUE.
+**
+** Returns          TRUE if NFA_SendRawFrame is called
+**
+*******************************************************************************/
+BOOLEAN nfa_dm_is_raw_frame_session (void)
+{
+    return ((nfa_dm_cb.flags & NFA_DM_FLAGS_RAW_FRAME) ? TRUE : FALSE);
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_dm_is_p2p_paused
 **
 ** Description      If NFA_PauseP2p is called sand still effective,
diff --git a/src/nfa/ee/nfa_ee_act.c b/src/nfa/ee/nfa_ee_act.c
index f92b676..d5396b1 100644
--- a/src/nfa/ee/nfa_ee_act.c
+++ b/src/nfa/ee/nfa_ee_act.c
@@ -496,6 +496,7 @@ void nfa_ee_api_add_aid(tNFA_EE_MSG *p_data)
         /* mark AID changed */
         p_cb->ecb_flags                       |= NFA_EE_ECB_FLAGS_AID;
         nfa_ee_cb.ee_cfged                    |= nfa_ee_ecb_to_mask(p_cb);
+        nfa_ee_start_timer();
     }
     NFA_TRACE_DEBUG2 ("status:%d ee_cfged:0x%02x ",evt_data.status, nfa_ee_cb.ee_cfged);
     /* report the status of this operation */
@@ -551,6 +552,7 @@ void nfa_ee_api_remove_aid(tNFA_EE_MSG *p_data)
         /* else the last entry, just reduce the aid_entries by 1 */
         p_cb->aid_entries--;
         nfa_ee_cb.ee_cfged      |= nfa_ee_ecb_to_mask(p_cb);
+        nfa_ee_start_timer();
         /* report NFA_EE_REMOVE_AID_EVT to the callback associated the NFCEE */
         p_cback = p_cb->p_ee_cback;
     }
@@ -1395,6 +1397,7 @@ void nfa_ee_nci_disc_req_ntf(tNFA_EE_MSG *p_data)
     tNFC_EE_DISCOVER_REQ_REVT   *p_cbk = p_data->disc_req.p_data;
     tNFA_HANDLE         ee_handle;
     tNFA_EE_ECB         *p_cb = NULL;
+    UINT8               report_ntf = 0;
     UINT8 xx;
 
     NFA_TRACE_DEBUG2 ("nfa_ee_nci_disc_req_ntf () num_info: %d cur_ee:%d", p_cbk->num_info, nfa_ee_cb.cur_ee );
@@ -1419,6 +1422,10 @@ void nfa_ee_nci_disc_req_ntf(tNFA_EE_MSG *p_data)
                 continue;
             }
         }
+        else
+        {
+            report_ntf  |= nfa_ee_ecb_to_mask (p_cb);
+        }
 
         p_cb->ecb_flags |= NFA_EE_ECB_FLAGS_DISC_REQ;
         if (p_cbk->info[xx].op == NFC_EE_DISC_OP_ADD)
@@ -1460,13 +1467,13 @@ void nfa_ee_nci_disc_req_ntf(tNFA_EE_MSG *p_data)
             else if (p_cbk->info[xx].tech_n_mode == NFC_DISCOVERY_TYPE_LISTEN_B_PRIME)
             {
                 p_cb->lbp_protocol = 0;
-        }
+            }
         }
     }
 
 
     /* Report NFA_EE_DISCOVER_REQ_EVT for all active NFCEE */
-    if ((p_cb->ecb_flags & NFA_EE_ECB_FLAGS_ORDER) == 0)
+    if (report_ntf)
         nfa_ee_report_discover_req_evt();
 
 }
diff --git a/src/nfa/hci/nfa_hci_act.c b/src/nfa/hci/nfa_hci_act.c
index c1e59e6..07c3f87 100644
--- a/src/nfa/hci/nfa_hci_act.c
+++ b/src/nfa/hci/nfa_hci_act.c
@@ -450,6 +450,18 @@ static void nfa_hci_api_get_gate_pipe_list (tNFA_HCI_EVENT_DATA *p_evt_data)
         {
             memcpy (&evt_data.gates_pipes.uicc_created_pipe [evt_data.gates_pipes.num_uicc_created_pipes++], pp, sizeof (tNFA_HCI_PIPE_INFO));
         }
+        else if (pp->pipe_id >= NFA_HCI_FIRST_DYNAMIC_PIPE  && pp->pipe_id <= NFA_HCI_LAST_DYNAMIC_PIPE  && pp->pipe_id && pp->local_gate >= NFA_HCI_FIRST_PROP_GATE && pp->local_gate <= NFA_HCI_LAST_PROP_GATE)
+        {
+            for (xx = 0, pg = nfa_hci_cb.cfg.dyn_gates; xx < NFA_HCI_MAX_GATE_CB; xx++, pg++)
+            {
+                if (pp->local_gate == pg->gate_id)
+                {
+                    if (!pg->gate_owner)
+                        memcpy (&evt_data.gates_pipes.uicc_created_pipe [evt_data.gates_pipes.num_uicc_created_pipes++], pp, sizeof (tNFA_HCI_PIPE_INFO));
+                    break;
+                }
+            }
+        }
     }
 
     evt_data.gates_pipes.status = NFA_STATUS_OK;
@@ -462,7 +474,7 @@ static void nfa_hci_api_get_gate_pipe_list (tNFA_HCI_EVENT_DATA *p_evt_data)
 **
 ** Function         nfa_hci_api_alloc_gate
 **
-** Description      action function to allocate a generic gate
+** Description      action function to allocate gate
 **
 ** Returns          None
 **
@@ -473,7 +485,22 @@ static void nfa_hci_api_alloc_gate (tNFA_HCI_EVENT_DATA *p_evt_data)
     tNFA_HCI_EVT_DATA   evt_data;
     tNFA_HCI_DYN_GATE   *p_gate;
 
-    p_gate = nfa_hciu_alloc_gate (0, app_handle);
+    p_gate = nfa_hciu_alloc_gate (p_evt_data->gate_info.gate, app_handle);
+
+    if (p_gate)
+    {
+        if (!p_gate->gate_owner)
+        {
+            /* No app owns the gate yet */
+            p_gate->gate_owner = app_handle;
+        }
+        else if (p_gate->gate_owner != app_handle)
+        {
+            /* Some other app owns the gate */
+            p_gate = NULL;
+            NFA_TRACE_ERROR1 ("nfa_hci_api_alloc_gate (): The Gate (0X%02x) already taken!", p_evt_data->gate_info.gate);
+        }
+    }
 
     evt_data.allocated.gate   = p_gate ? p_gate->gate_id : 0;
     evt_data.allocated.status = p_gate ? NFA_STATUS_OK : NFA_STATUS_FAILED;
@@ -599,14 +626,26 @@ static BOOLEAN nfa_hci_api_create_pipe (tNFA_HCI_EVENT_DATA *p_evt_data)
 {
     tNFA_HCI_DYN_GATE   *p_gate = nfa_hciu_find_gate_by_gid (p_evt_data->create_pipe.source_gate);
     tNFA_HCI_EVT_DATA   evt_data;
+    BOOLEAN             report_failed = FALSE;
 
     /* Verify that the app owns the gate that the pipe is being created on */
-    if ((p_gate == NULL) || (p_gate->gate_owner != p_evt_data->create_pipe.hci_handle))
+    if (  (p_gate == NULL)
+        ||(p_gate->gate_owner != p_evt_data->create_pipe.hci_handle)  )
+    {
+        report_failed = TRUE;
+        NFA_TRACE_ERROR2 ("nfa_hci_api_create_pipe Cannot create pipe! APP: 0x%02x does not own the gate:0x%x", p_evt_data->create_pipe.hci_handle, p_evt_data->create_pipe.source_gate);
+    }
+    else if (nfa_hciu_check_pipe_between_gates (p_evt_data->create_pipe.source_gate, p_evt_data->create_pipe.dest_host, p_evt_data->create_pipe.dest_gate))
+    {
+        report_failed = TRUE;
+        NFA_TRACE_ERROR0 ("nfa_hci_api_create_pipe : Cannot create multiple pipe between the same two gates!");
+    }
+
+    if (report_failed)
     {
         evt_data.created.source_gate = p_evt_data->create_pipe.source_gate;
         evt_data.created.status = NFA_STATUS_FAILED;
 
-        NFA_TRACE_ERROR2 ("nfa_hci_api_create_pipe Cannot create pipe! APP: 0x%02x does not own the gate:0x%x", p_evt_data->create_pipe.hci_handle, p_evt_data->create_pipe.source_gate);
         nfa_hciu_send_to_app (NFA_HCI_CREATE_PIPE_EVT, &evt_data, p_evt_data->open_pipe.hci_handle);
     }
     else
@@ -1253,7 +1292,12 @@ void nfa_hci_handle_admin_gate_cmd (UINT8 *p_data)
             if ((pgate = nfa_hciu_find_gate_by_gid (dest_gate)) != NULL)
             {
                 /* If the gate is valid, add the pipe to it  */
-                if ((response = nfa_hciu_add_pipe_to_gate (pipe, dest_gate, source_host, source_gate)) == NFA_HCI_ANY_OK)
+                if (nfa_hciu_check_pipe_between_gates (dest_gate, source_host, source_gate))
+                {
+                    /* Already, there is a pipe between these two gates, so will reject */
+                    response = NFA_HCI_ANY_E_NOK;
+                }
+                else if ((response = nfa_hciu_add_pipe_to_gate (pipe, dest_gate, source_host, source_gate)) == NFA_HCI_ANY_OK)
                 {
                     /* Tell the application a pipe was created with its gate */
 
@@ -1267,7 +1311,14 @@ void nfa_hci_handle_admin_gate_cmd (UINT8 *p_data)
                 }
             }
             else
+            {
                 response = NFA_HCI_ANY_E_NOK;
+                if ((dest_gate >= NFA_HCI_FIRST_PROP_GATE) && (dest_gate <= NFA_HCI_LAST_PROP_GATE))
+                {
+                    if (nfa_hciu_alloc_gate (dest_gate, 0))
+                        response = nfa_hciu_add_pipe_to_gate (pipe, dest_gate, source_host, source_gate);
+                }
+            }
         }
         break;
 
@@ -1320,7 +1371,7 @@ void nfa_hci_handle_admin_gate_cmd (UINT8 *p_data)
 *******************************************************************************/
 void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
 {
-    UINT8               hosts[2] = {NFA_HCI_HOST_ID_UICC0, (NFA_HCI_HOST_ID_UICC0 + 1)};
+    UINT8               hosts[NFA_EE_MAX_EE_SUPPORTED - 1];
     UINT8               source_host;
     UINT8               source_gate = nfa_hci_cb.local_gate_in_use;
     UINT8               dest_host   = nfa_hci_cb.remote_host_in_use;
@@ -1332,6 +1383,7 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
     UINT8               host_count  = 0;
     UINT8               host_id     = 0;
     UINT32              os_tick;
+    UINT8               xx;
 
 #if (BT_TRACE_VERBOSE == TRUE)
     NFA_TRACE_DEBUG4 ("nfa_hci_handle_admin_gate_rsp - LastCmdSent: %s  App: 0x%04x  Gate: 0x%02x  Pipe: 0x%02x",
@@ -1365,8 +1417,14 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
         case NFA_HCI_ANY_SET_PARAMETER:
             if (nfa_hci_cb.param_in_use == NFA_HCI_SESSION_IDENTITY_INDEX)
             {
+                /* Terminal Host allows all UICC(s) to communicate, using Host id RFU values for subsequent UICC(s) */
+                for (xx = 0; xx <(nfa_ee_max_ee_cfg - 1); xx++)
+                {
+                    hosts[xx] = NFA_HCI_HOST_ID_UICC0 + xx;
+                }
+
                 /* Set WHITELIST */
-                nfa_hciu_send_set_param_cmd (NFA_HCI_ADMIN_PIPE, NFA_HCI_WHITELIST_INDEX, 0x02, hosts);
+                nfa_hciu_send_set_param_cmd (NFA_HCI_ADMIN_PIPE, NFA_HCI_WHITELIST_INDEX, (UINT8) (nfa_ee_max_ee_cfg - 1), (UINT8 *) hosts);
             }
             else if (nfa_hci_cb.param_in_use == NFA_HCI_WHITELIST_INDEX)
             {
@@ -1408,8 +1466,16 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
                 /* The only parameter we get when initializing is the session ID. Check for match. */
                 if (!memcmp ((UINT8 *) nfa_hci_cb.cfg.admin_gate.session_id, p_data, NFA_HCI_SESSION_ID_LEN) )
                 {
-                    /* Session has not changed. Set the WHITELIST */
-                    nfa_hciu_send_set_param_cmd (NFA_HCI_ADMIN_PIPE, NFA_HCI_WHITELIST_INDEX, 0x02, hosts);
+                    /* Session has not changed, Terminal Host allows all UICC(s) to communicate
+                     * And using Host id RFU values for subsequent UICC(s)
+                     */
+                    for (xx = 0; xx <(nfa_ee_max_ee_cfg - 1); xx++)
+                    {
+                        hosts[xx] = NFA_HCI_HOST_ID_UICC0 + xx;
+                    }
+
+                    /* Set WHITELIST */
+                    nfa_hciu_send_set_param_cmd (NFA_HCI_ADMIN_PIPE, NFA_HCI_WHITELIST_INDEX, (UINT8) (nfa_ee_max_ee_cfg - 1), (UINT8 *) hosts);
                 }
                 else
                 {
diff --git a/src/nfa/hci/nfa_hci_api.c b/src/nfa/hci/nfa_hci_api.c
index 02078f7..8fb268f 100644
--- a/src/nfa/hci/nfa_hci_api.c
+++ b/src/nfa/hci/nfa_hci_api.c
@@ -197,19 +197,19 @@ tNFA_STATUS NFA_HciDeregister (char *p_app_name)
 **
 ** Function         NFA_HciAllocGate
 **
-** Description      This function will allocate an available generic gate for
-**                  the app to provide an entry point for a particular service
-**                  to other host or to establish communication with other host.
-**                  When the generic gate is allocated (or if an error occurs),
-**                  the app will be notified with NFA_HCI_ALLOCATE_GATE_EVT with
-**                  the gate id. The allocated Gate information will be stored in
-**                  non volatile memory.
+** Description      This function will allocate the gate if any specified or an
+**                  available generic gate for the app to provide an entry point
+**                  for a particular service to other host or to establish
+**                  communication with other host. When the gate is
+**                  allocated (or if an error occurs), the app will be notified
+**                  with NFA_HCI_ALLOCATE_GATE_EVT with the gate id. The allocated
+**                  Gate information will be stored in non volatile memory.
 **
 ** Returns          NFA_STATUS_OK if this API started
 **                  NFA_STATUS_FAILED if no generic gate is available
 **
 *******************************************************************************/
-tNFA_STATUS NFA_HciAllocGate (tNFA_HANDLE hci_handle)
+tNFA_STATUS NFA_HciAllocGate (tNFA_HANDLE hci_handle, UINT8 gate)
 {
     tNFA_HCI_API_ALLOC_GATE *p_msg;
 
@@ -219,14 +219,22 @@ tNFA_STATUS NFA_HciAllocGate (tNFA_HANDLE hci_handle)
         return (NFA_STATUS_FAILED);
     }
 
-    NFA_TRACE_API1 ("NFA_HciAllocGate (): hci_handle:0x%04x", hci_handle);
+    if (  (gate)
+        &&((gate < NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE) || (gate > NFA_HCI_LAST_PROP_GATE) || (gate == NFA_HCI_CONNECTIVITY_GATE))  )
+    {
+        NFA_TRACE_API1 ("NFA_HciAllocGate (): Cannot allocate gate:0x%02x", gate);
+        return (NFA_STATUS_FAILED);
+    }
 
-    /* Request HCI to allocate a gate to the application */
+    NFA_TRACE_API2 ("NFA_HciAllocGate (): hci_handle:0x%04x, Gate:0x%02x", hci_handle, gate);
+
+    /* Request HCI to allocate gate to the application */
     if (  (nfa_hci_cb.hci_state != NFA_HCI_STATE_DISABLED)
         &&((p_msg = (tNFA_HCI_API_ALLOC_GATE *) GKI_getbuf (sizeof (tNFA_HCI_API_ALLOC_GATE))) != NULL) )
     {
         p_msg->hdr.event  = NFA_HCI_API_ALLOC_GATE_EVT;
         p_msg->hci_handle = hci_handle;
+        p_msg->gate       = gate;
 
         nfa_sys_sendmsg (p_msg);
         return (NFA_STATUS_OK);
@@ -257,7 +265,7 @@ tNFA_STATUS NFA_HciDeallocGate (tNFA_HANDLE hci_handle, UINT8 gate)
         return (NFA_STATUS_FAILED);
     }
 
-    if ((gate < NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE) || (gate > NFA_HCI_LAST_HOST_SPECIFIC_GENERIC_GATE) || (gate == NFA_HCI_CONNECTIVITY_GATE))
+    if ((gate < NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE) || (gate > NFA_HCI_LAST_PROP_GATE) || (gate == NFA_HCI_CONNECTIVITY_GATE))
     {
         NFA_TRACE_API1 ("NFA_HciDeallocGate (): Cannot deallocate the gate:0x%02x", gate);
         return (NFA_STATUS_FAILED);
@@ -356,14 +364,14 @@ tNFA_STATUS NFA_HciCreatePipe (tNFA_HANDLE  hci_handle,
         return (NFA_STATUS_FAILED);
     }
 
-    if ((source_gate_id < NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE) || (source_gate_id > NFA_HCI_LAST_HOST_SPECIFIC_GENERIC_GATE))
+    if ((source_gate_id < NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE) || (source_gate_id > NFA_HCI_LAST_PROP_GATE))
     {
         NFA_TRACE_API1 ("NFA_HciCreatePipe (): Invalid local Gate:0x%02x", source_gate_id);
         return (NFA_STATUS_FAILED);
     }
 
     if (  ((dest_gate < NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE) && (dest_gate != NFA_HCI_LOOP_BACK_GATE) && (dest_gate != NFA_HCI_IDENTITY_MANAGEMENT_GATE))
-        ||(dest_gate > NFA_HCI_LAST_HOST_SPECIFIC_GENERIC_GATE))
+        ||(dest_gate > NFA_HCI_LAST_PROP_GATE))
     {
         NFA_TRACE_API1 ("NFA_HciCreatePipe (): Invalid Destination Gate:0x%02x", dest_gate);
         return (NFA_STATUS_FAILED);
diff --git a/src/nfa/hci/nfa_hci_main.c b/src/nfa/hci/nfa_hci_main.c
index bb5583b..7558919 100644
--- a/src/nfa/hci/nfa_hci_main.c
+++ b/src/nfa/hci/nfa_hci_main.c
@@ -99,12 +99,12 @@ void nfa_hci_ee_info_cback (tNFA_EE_DISC_STS status)
         if (  (!nfa_hci_cb.ee_disc_cmplt)
             &&((nfa_hci_cb.hci_state == NFA_HCI_STATE_STARTUP) || (nfa_hci_cb.hci_state == NFA_HCI_STATE_RESTORE))  )
         {
-            /* NFCEE Discovery is in progress */
-            nfa_hci_cb.ee_disc_cmplt      = TRUE;
-            nfa_hci_cb.num_ee_dis_req_ntf = 0;
-            nfa_hci_cb.num_hot_plug_evts  = 0;
-            nfa_hci_cb.conn_id            = 0;
-            nfa_hci_startup ();
+        /* NFCEE Discovery is in progress */
+        nfa_hci_cb.ee_disc_cmplt      = TRUE;
+        nfa_hci_cb.num_ee_dis_req_ntf = 0;
+        nfa_hci_cb.num_hot_plug_evts  = 0;
+        nfa_hci_cb.conn_id            = 0;
+        nfa_hci_startup ();
         }
         break;
 
diff --git a/src/nfa/hci/nfa_hci_utils.c b/src/nfa/hci/nfa_hci_utils.c
index 72b7c14..3ee8bdf 100644
--- a/src/nfa/hci/nfa_hci_utils.c
+++ b/src/nfa/hci/nfa_hci_utils.c
@@ -247,11 +247,11 @@ tNFA_HCI_DYN_GATE *nfa_hciu_alloc_gate (UINT8 gate_id, tNFA_HANDLE app_handle)
 
 
     /* First, check if the application handle is valid */
-    if ((gate_id != NFA_HCI_CONNECTIVITY_GATE)
-                    &&
-        (  ((app_handle & NFA_HANDLE_GROUP_MASK) != NFA_HANDLE_GROUP_HCI)
-         ||(app_inx >= NFA_HCI_MAX_APP_CB)
-         ||(nfa_hci_cb.p_app_cback[app_inx] == NULL)  ))
+    if (  (gate_id != NFA_HCI_CONNECTIVITY_GATE)
+        &&(gate_id < NFA_HCI_FIRST_PROP_GATE)
+        &&((  (app_handle & NFA_HANDLE_GROUP_MASK) != NFA_HANDLE_GROUP_HCI)
+            ||(app_inx >= NFA_HCI_MAX_APP_CB)
+            ||(nfa_hci_cb.p_app_cback[app_inx] == NULL))  )
     {
         return (NULL);
     }
@@ -265,20 +265,16 @@ tNFA_HCI_DYN_GATE *nfa_hciu_alloc_gate (UINT8 gate_id, tNFA_HANDLE app_handle)
     {
         /* If gate_id is 0, we need to assign a free one */
         /* Loop through all possible gate IDs checking if they are already used */
-        for (gate_id = NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE; gate_id < NFA_HCI_LAST_PROP_GATE; gate_id++)
+        for (gate_id = NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE; gate_id <= NFA_HCI_LAST_PROP_GATE; gate_id++)
         {
             /* Skip connectivity gate */
             if (gate_id == NFA_HCI_CONNECTIVITY_GATE) gate_id++;
 
             /* Check if the gate is already allocated */
-            for (xx = 0, pg = nfa_hci_cb.cfg.dyn_gates; xx < NFA_HCI_MAX_GATE_CB; xx++, pg++)
-                if (pg->gate_id == gate_id)
-                    break;
-            /* If the gate is not allocated, use the gate */
-            if (xx == NFA_HCI_MAX_GATE_CB)
+            if (nfa_hciu_find_gate_by_gid (gate_id) == NULL)
                 break;
         }
-        if (gate_id == NFA_HCI_LAST_PROP_GATE)
+        if (gate_id > NFA_HCI_LAST_PROP_GATE)
         {
             NFA_TRACE_ERROR2 ("nfa_hci_alloc_gate - no free Gate ID: %u  App Handle: 0x%04x", gate_id, app_handle);
             return (NULL);
@@ -633,6 +629,42 @@ tNFA_HCI_DYN_PIPE *nfa_hciu_find_active_pipe_by_owner (tNFA_HANDLE app_handle)
 
 /*******************************************************************************
 **
+** Function         nfa_hciu_check_pipe_between_gates
+**
+** Description      Check if there is a pipe between specified Terminal host
+**                  gate and and the specified UICC gate
+**
+** Returns          TRUE, if there exists a pipe between the two specified gated
+**                  FALSE, otherwise
+**
+*******************************************************************************/
+BOOLEAN nfa_hciu_check_pipe_between_gates (UINT8 local_gate, UINT8 dest_host, UINT8 dest_gate)
+{
+    tNFA_HCI_DYN_PIPE   *pp;
+    int                 xx;
+
+    NFA_TRACE_DEBUG3 ("nfa_hciu_check_pipe_between_gates () Local gate: 0x%02X, Host[0x%02X] gate: 0x%02X", local_gate, dest_host, dest_gate);
+
+    /* Loop through all pipes looking for the owner */
+    for (xx = 0, pp = nfa_hci_cb.cfg.dyn_pipes; xx < NFA_HCI_MAX_PIPE_CB; xx++, pp++)
+    {
+        if (  (pp->pipe_id != 0)
+            &&(pp->pipe_id >= NFA_HCI_FIRST_DYNAMIC_PIPE)
+            &&(pp->pipe_id <= NFA_HCI_LAST_DYNAMIC_PIPE)
+            &&(pp->local_gate == local_gate)
+            &&(pp->dest_host  == dest_host)
+            &&(pp->dest_gate  == dest_gate)  )
+        {
+            return (TRUE);
+        }
+    }
+
+    /* If here, not found */
+    return (FALSE);
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_hciu_find_pipe_by_owner
 **
 ** Description      Find the first pipe associated with the given app
diff --git a/src/nfa/include/nfa_api.h b/src/nfa/include/nfa_api.h
index 70ad5b4..0753934 100644
--- a/src/nfa/include/nfa_api.h
+++ b/src/nfa/include/nfa_api.h
@@ -147,8 +147,6 @@ typedef UINT8 tNFA_PROTOCOL_MASK;
 #define NFA_DM_NFCC_TIMEOUT_EVT         6   /* NFCC is not responding           */
 #define NFA_DM_NFCC_TRANSPORT_ERR_EVT   7   /* NCI Tranport error               */
 
-#define NFA_DM_MAX_UICC                 2   /* Max number of UICC               */
-
 #define NFA_T1T_HR_LEN              T1T_HR_LEN      /* T1T HR length            */
 #define NFA_MAX_UID_LEN             TAG_MAX_UID_LEN /* Max UID length of T1/T2  */
 #define NFA_T1T_UID_LEN             T1T_UID_LEN     /* T1T UID length           */
@@ -347,6 +345,7 @@ typedef struct
 /* Structure for NFA_DATA_EVT data */
 typedef struct
 {
+    tNFA_STATUS         status;         /* Status of Data received          */
     UINT8               *p_data;        /* Data buffer                      */
     UINT16              len;            /* Length of data                   */
 } tNFA_RX_DATA;
@@ -437,6 +436,7 @@ typedef struct
 /* Structure for NFA_CE_DATA_EVT data */
 typedef struct
 {
+    tNFA_STATUS         status;         /* NFA_STATUS_OK if complete packet     */
     tNFA_HANDLE         handle;         /* handle from NFA_CE_REGISTERED_EVT    */
     UINT8               *p_data;        /* Data buffer                          */
     UINT16              len;            /* Length of data                       */
@@ -500,11 +500,19 @@ typedef struct
     UINT8   pfa;    /* Frequency for NFC Technology F active mode   */
 } tNFA_DM_DISC_FREQ_CFG;
 
+/* definitions for tNFA_DM_CFG.presence_check_option */
+#define NFA_DM_PCO_ISO_SLEEP_WAKE       0x01 /* if NDEF is not supported by the tag, use sleep/wake(last interface) */
+#define NFA_DM_PCO_EMPTY_I_BLOCK        0x02 /* NFA_SendRawFrame() has been used, use empty I block for presence check
+                                              * if this bit is not set, use read-binary on channel 3 for presence check */
+
 /* compile-time configuration structure */
 typedef struct
 {
     BOOLEAN auto_detect_ndef;           /* Automatic NDEF detection (when not in exclusive RF mode) */
     BOOLEAN auto_read_ndef;             /* Automatic NDEF read (when not in exclusive RF mode)      */
+    BOOLEAN auto_presence_check;        /* Automatic presence check                                 */
+    UINT8   presence_check_option;      /* Use sleep/wake(last interface) for ISODEP presence check */
+    UINT16  presence_check_timeout;     /* Maximum time to wait for presence check response         */
 } tNFA_DM_CFG;
 
 /* compile-time configuration structure for HCI */
diff --git a/src/nfa/include/nfa_ee_api.h b/src/nfa/include/nfa_ee_api.h
index 2db02be..0abc5c8 100644
--- a/src/nfa/include/nfa_ee_api.h
+++ b/src/nfa/include/nfa_ee_api.h
@@ -128,7 +128,7 @@ typedef struct
     tNFA_EE_INTERFACE   ee_interface;   /* NFCEE interface associated with this connection  */
 } tNFA_EE_CONNECT;
 
-#define NFA_EE_TRGR_SELECT              NFC_EE_TRIG_7816_SELECT  /* ISO 7816-4 SELECT command */
+#define NFA_EE_TRGR_SELECT              NFC_EE_TRIG_SELECT       /* ISO 7816-4 SELECT command */
 #define NFA_EE_TRGR_RF_PROTOCOL         NFC_EE_TRIG_RF_PROTOCOL  /* RF Protocol changed       */
 #define NFA_EE_TRGR_RF_TECHNOLOGY       NFC_EE_TRIG_RF_TECHNOLOGY/* RF Technology changed     */
 #define NFA_EE_TRGR_APP_INIT            NFC_EE_TRIG_APP_INIT     /* Application initiation    */
@@ -171,7 +171,7 @@ typedef struct
 {
     UINT8                   status;                         /* NFA_STATUS_OK if successful   */
     UINT8                   num_ee;                         /* number of MFCEE information   */
-    tNFA_EE_DISCOVER_INFO   ee_disc_info[NFA_DM_MAX_UICC];  /* MFCEE DISCOVER Request info   */
+    tNFA_EE_DISCOVER_INFO   ee_disc_info[NFA_EE_MAX_EE_SUPPORTED - 1]; /* NFCEE DISCOVER Request info   */
 } tNFA_EE_DISCOVER_REQ;
 
 /* Data for NFA_EE_DATA_EVT */
diff --git a/src/nfa/include/nfa_hci_api.h b/src/nfa/include/nfa_hci_api.h
index 7f02a1c..0d8ab18 100644
--- a/src/nfa/include/nfa_hci_api.h
+++ b/src/nfa/include/nfa_hci_api.h
@@ -110,7 +110,7 @@ typedef struct
     UINT8               num_gates;                      /* Number of generic gates exist for the application */
     UINT8               gate[NFA_HCI_MAX_GATE_CB];      /* List of generic gates allocated to the application */
     UINT8               num_uicc_created_pipes;         /* Number of pipes created by UICC host */
-    tNFA_HCI_PIPE_INFO  uicc_created_pipe[NFA_HCI_MAX_HOST_IN_NETWORK]; /* Pipe information of the UICC created pipe */
+    tNFA_HCI_PIPE_INFO  uicc_created_pipe[NFA_HCI_MAX_PIPE_CB]; /* Pipe information of the UICC created pipe */
 } tNFA_HCI_GET_GATE_PIPE_LIST;
 
 /* Data for NFA_HCI_ALLOCATE_GATE_EVT */
@@ -341,20 +341,19 @@ NFC_API extern tNFA_STATUS NFA_HciDeregister (char *p_app_name);
 **
 ** Function         NFA_HciAllocGate
 **
-** Description      This function will allocate an available generic gate for
-**                  the app to provide an entry point for a particular service
-**                  to other host or to establish communication with other host.
-**                  When the generic gate is allocated (or if an error occurs),
-**                  the app will be notified with NFA_HCI_ALLOCATE_GATE_EVT with
-**                  the gate id. The allocated Gate information will be stored in
-**                  non volatile memory.
+** Description      This function will allocate the gate if any specified or an
+**                  available generic gate for the app to provide an entry point
+**                  for a particular service to other host or to establish
+**                  communication with other host. When the gate is
+**                  allocated (or if an error occurs), the app will be notified
+**                  with NFA_HCI_ALLOCATE_GATE_EVT with the gate id. The allocated
+**                  Gate information will be stored in non volatile memory.
 **
 ** Returns          NFA_STATUS_OK if this API started
-**                  NFA_STATUS_BAD_HANDLE if handle is not valid
 **                  NFA_STATUS_FAILED if no generic gate is available
 **
 *******************************************************************************/
-NFC_API extern tNFA_STATUS NFA_HciAllocGate (tNFA_HANDLE hci_handle);
+NFC_API extern tNFA_STATUS NFA_HciAllocGate (tNFA_HANDLE hci_handle, UINT8 gate);
 
 /*******************************************************************************
 **
diff --git a/src/nfa/include/nfa_hci_defs.h b/src/nfa/include/nfa_hci_defs.h
index 2b1f183..dab93cf 100644
--- a/src/nfa/include/nfa_hci_defs.h
+++ b/src/nfa/include/nfa_hci_defs.h
@@ -33,6 +33,7 @@
 
 #define NFA_HCI_FIRST_HOST_SPECIFIC_GENERIC_GATE    0x10
 #define NFA_HCI_LAST_HOST_SPECIFIC_GENERIC_GATE     0xEF
+#define NFA_HCI_FIRST_PROP_GATE                     0xF0
 #define NFA_HCI_LAST_PROP_GATE                      0xFF
 
 /* Generic Gates */
diff --git a/src/nfa/include/nfa_nv_co.h b/src/nfa/include/nfa_nv_co.h
index fdb0e52..154f04b 100644
--- a/src/nfa/include/nfa_nv_co.h
+++ b/src/nfa/include/nfa_nv_co.h
@@ -58,6 +58,8 @@ typedef UINT8 tNFA_NV_CO_STATUS;
 #define  HC_F3_NV_BLOCK         0x02
 #define  HC_F4_NV_BLOCK         0x03
 #define  HC_DH_NV_BLOCK         0x04
+#define  HC_F5_NV_BLOCK         0x05
+
 
 /*****************************************************************************
 **  Function Declarations
diff --git a/src/nfa/include/nfa_rw_api.h b/src/nfa/include/nfa_rw_api.h
index 80fdc92..6534ccd 100644
--- a/src/nfa/include/nfa_rw_api.h
+++ b/src/nfa/include/nfa_rw_api.h
@@ -31,6 +31,15 @@
 /*****************************************************************************
 **  Constants and data types
 *****************************************************************************/
+enum
+{
+    NFA_RW_PRES_CHK_DEFAULT,    /* The default behavior             */
+    NFA_RW_PRES_CHK_I_BLOCK,    /* Empty I Block                    */
+    NFA_RW_PRES_CHK_RESET,      /* Deactivate to Sleep; Re-activate */
+    NFA_RW_PRES_CHK_RB_CH0,     /* ReadBinary on Channel 0          */
+    NFA_RW_PRES_CHK_RB_CH3      /* ReadBinary on Channel 3          */
+};
+typedef UINT8 tNFA_RW_PRES_CHK_OPTION;
 
 /*****************************************************************************
 **  NFA T3T Constants and definitions
@@ -139,12 +148,14 @@ NFC_API extern tNFA_STATUS NFA_RwWriteNDef (UINT8 *p_data, UINT32 len);
 **                  The NFA_RW_PRESENCE_CHECK_EVT w/ status is used to
 **                  indicate presence or non-presence.
 **
+**                  option is used only with ISO-DEP protocol
+**
 ** Returns
 **                  NFA_STATUS_OK if successfully initiated
 **                  NFA_STATUS_FAILED otherwise
 **
 *****************************************************************************/
-NFC_API extern tNFA_STATUS NFA_RwPresenceCheck (void);
+NFC_API extern tNFA_STATUS NFA_RwPresenceCheck (tNFA_RW_PRES_CHK_OPTION option);
 
 /*****************************************************************************
 **
diff --git a/src/nfa/int/nfa_dm_int.h b/src/nfa/int/nfa_dm_int.h
index 1e7fcfe..71dfa14 100644
--- a/src/nfa/int/nfa_dm_int.h
+++ b/src/nfa/int/nfa_dm_int.h
@@ -312,6 +312,9 @@ typedef UINT8 tNFA_DM_RF_DISC_EVT;
 #define NFA_DM_DISC_MASK_L_LEGACY               0x10000000
 #define NFA_DM_DISC_MASK_LISTEN                 0xFFFF0000
 
+#define NFA_DM_DISC_MASK_NFC_DEP                0x0C481848
+
+
 typedef UINT32  tNFA_DM_DISC_TECH_PROTO_MASK;
 
 
@@ -416,6 +419,7 @@ typedef struct
 #define NFA_DM_FLAGS_NFCC_IS_RESTORING          0x00000100  /* NFCC is restoring after back to full power mode                      */
 #define NFA_DM_FLAGS_SETTING_PWR_MODE           0x00000200  /* NFCC power mode is updating                                          */
 #define NFA_DM_FLAGS_DM_DISABLING_NFC           0x00000400  /* NFA DM is disabling NFC                                              */
+#define NFA_DM_FLAGS_RAW_FRAME                  0x00000800  /* NFA_SendRawFrame() is called since RF activation                     */
 #define NFA_DM_FLAGS_LISTEN_DISABLED            0x00001000  /* NFA_DisableListening() is called and engaged                         */
 #define NFA_DM_FLAGS_P2P_PAUSED                 0x00002000  /* NFA_PauseP2p() is called and engaged                         */
 /* stored parameters */
@@ -460,6 +464,12 @@ typedef struct
     UINT8 atr_res_gen_bytes_len;
 } tNFA_DM_PARAMS;
 
+/*
+**  NFA_NDEF CHO callback
+**  It returns TRUE if NDEF is handled by connection handover module.
+*/
+typedef BOOLEAN (tNFA_NDEF_CHO_CBACK) (UINT32 ndef_len, UINT8 *p_ndef_data);
+
 /* DM control block */
 typedef struct
 {
@@ -474,6 +484,8 @@ typedef struct
     tNFA_CONN_CBACK            *p_excl_conn_cback;  /* exclusive RF mode callback           */
     tNFA_NDEF_CBACK            *p_excl_ndef_cback;  /* ndef callback for exclusive RF mdoe  */
 
+    tNFA_NDEF_CHO_CBACK        *p_ndef_cho_cback;   /* NDEF callback for static connection handover */
+
     tNFA_HANDLE                 poll_disc_handle;   /* discovery handle for polling         */
 
     UINT8                      *p_activate_ntf;     /* temp holding activation notfication  */
@@ -501,6 +513,8 @@ typedef struct
 } tNFA_DM_CB;
 
 /* Internal function prototypes */
+void nfa_dm_ndef_register_cho (tNFA_NDEF_CHO_CBACK *p_cback);
+void nfa_dm_ndef_deregister_cho (void);
 void nfa_dm_ndef_handle_message (tNFA_STATUS status, UINT8 *p_msg_buf, UINT32 len);
 void nfa_dm_ndef_dereg_all (void);
 void nfa_dm_act_conn_cback_notify (UINT8 event, tNFA_CONN_EVT_DATA *p_data);
@@ -613,6 +627,7 @@ BOOLEAN nfa_dm_is_protocol_supported (tNFA_NFC_PROTOCOL protocol, UINT8 sel_res)
 BOOLEAN nfa_dm_is_active (void);
 tNFC_STATUS nfa_dm_disc_sleep_wakeup (void);
 tNFC_STATUS nfa_dm_disc_start_kovio_presence_check (void);
+BOOLEAN nfa_dm_is_raw_frame_session (void);
 BOOLEAN nfa_dm_is_p2p_paused (void);
 
 
diff --git a/src/nfa/int/nfa_hci_int.h b/src/nfa/int/nfa_hci_int.h
index 442f110..fe77a5c 100644
--- a/src/nfa/int/nfa_hci_int.h
+++ b/src/nfa/int/nfa_hci_int.h
@@ -136,9 +136,9 @@ typedef struct
 {
     BT_HDR              hdr;
     tNFA_HANDLE         hci_handle;
+    UINT8               gate;
 } tNFA_HCI_API_ALLOC_GATE;
 
-
 /* data type for NFA_HCI_API_DEALLOC_GATE_EVT */
 typedef struct
 {
@@ -470,6 +470,7 @@ extern tNFA_HCI_DYN_PIPE  *nfa_hciu_find_pipe_by_owner (tNFA_HANDLE app_handle);
 extern tNFA_HCI_DYN_PIPE  *nfa_hciu_find_active_pipe_by_owner (tNFA_HANDLE app_handle);
 extern tNFA_HCI_DYN_PIPE  *nfa_hciu_find_pipe_on_gate (UINT8 gate_id);
 extern tNFA_HANDLE         nfa_hciu_get_gate_owner (UINT8 gate_id);
+extern BOOLEAN             nfa_hciu_check_pipe_between_gates (UINT8 local_gate, UINT8 dest_host, UINT8 dest_gate);
 extern BOOLEAN             nfa_hciu_is_active_host (UINT8 host_id);
 extern BOOLEAN             nfa_hciu_is_host_reseting (UINT8 host_id);
 extern BOOLEAN             nfa_hciu_is_no_host_resetting (void);
diff --git a/src/nfa/int/nfa_rw_int.h b/src/nfa/int/nfa_rw_int.h
index 562ae5a..ec3b644 100644
--- a/src/nfa/int/nfa_rw_int.h
+++ b/src/nfa/int/nfa_rw_int.h
@@ -56,6 +56,7 @@ enum
     NFA_RW_ACTIVATE_NTF_EVT,
     NFA_RW_DEACTIVATE_NTF_EVT,
     NFA_RW_PRESENCE_CHECK_TICK_EVT,
+    NFA_RW_PRESENCE_CHECK_TIMEOUT_EVT,
     NFA_RW_MAX_EVT
 };
 
@@ -227,6 +228,9 @@ typedef union
     tNFA_RW_OP_PARAMS_T3T_READ          t3t_read;
     tNFA_RW_OP_PARAMS_T3T_WRITE         t3t_write;
 
+    /* params for NFA_RW_OP_PRESENCE_CHECK */
+    tNFA_RW_PRES_CHK_OPTION             option;
+
     /* params for ISO 15693 */
     tNFA_RW_OP_PARAMS_I93_CMD           i93_cmd;
 
@@ -273,6 +277,7 @@ typedef UINT8 tNFA_RW_NDEF_ST;
 #define NFA_RW_FL_ACTIVATION_NTF_PENDING        0x08    /* Busy retrieving additional tag information                               */
 #define NFA_RW_FL_API_BUSY                      0x10    /* Tag operation is in progress                                             */
 #define NFA_RW_FL_ACTIVATED                     0x20    /* Tag is been activated                                                    */
+#define NFA_RW_FL_NDEF_OK                       0x40    /* NDEF DETECTed OK                                                         */
 
 /* NFA RW control block */
 typedef struct
@@ -284,6 +289,7 @@ typedef struct
 
     /* Tag info */
     tNFC_PROTOCOL   protocol;
+    tNFC_INTF_TYPE  intf_type;
     UINT8           pa_sel_res;
     tNFC_RF_TECH_N_MODE  activated_tech_mode;    /* activated technology and mode */
 
@@ -335,6 +341,7 @@ extern BOOLEAN nfa_rw_handle_op_req (tNFA_RW_MSG *p_data);
 extern BOOLEAN nfa_rw_activate_ntf (tNFA_RW_MSG *p_data);
 extern BOOLEAN nfa_rw_deactivate_ntf (tNFA_RW_MSG *p_data);
 extern BOOLEAN nfa_rw_presence_check_tick (tNFA_RW_MSG *p_data);
+extern BOOLEAN nfa_rw_presence_check_timeout (tNFA_RW_MSG *p_data);
 extern void    nfa_rw_handle_sleep_wakeup_rsp (tNFC_STATUS status);
 extern void    nfa_rw_handle_presence_check_rsp (tNFC_STATUS status);
 extern void    nfa_rw_command_complete (void);
diff --git a/src/nfa/rw/nfa_rw_act.c b/src/nfa/rw/nfa_rw_act.c
index 7c3b68e..d153b9f 100644
--- a/src/nfa/rw/nfa_rw_act.c
+++ b/src/nfa/rw/nfa_rw_act.c
@@ -30,6 +30,8 @@
 #include "ndef_utils.h"
 #include "rw_api.h"
 
+#define NFA_RW_OPTION_INVALID   0xFF
+
 /* Local static function prototypes */
 static tNFC_STATUS nfa_rw_start_ndef_read(void);
 static tNFC_STATUS nfa_rw_start_ndef_write(void);
@@ -100,7 +102,14 @@ static void nfa_rw_send_data_to_upper (tRW_DATA *p_rw_data)
         ||(p_rw_data->data.p_data == NULL) )
         return;
 
+#if (BT_TRACE_VERBOSE == TRUE)
+        NFA_TRACE_DEBUG2 ("nfa_rw_send_data_to_upper: Len [0x%X] Status [%s]", p_rw_data->data.p_data->len, NFC_GetStatusName (p_rw_data->data.status));
+#else
+        NFA_TRACE_DEBUG2 ("nfa_rw_send_data_to_upper: Len [0x%X] Status [0x%X]", p_rw_data->data.p_data->len, p_rw_data->data.status);
+#endif
+
     /* Notify conn cback of NFA_DATA_EVT */
+    conn_evt_data.data.status = p_rw_data->data.status;
     conn_evt_data.data.p_data = (UINT8 *)(p_rw_data->data.p_data + 1) + p_rw_data->data.p_data->offset;
     conn_evt_data.data.len    = p_rw_data->data.p_data->len;
 
@@ -141,7 +150,9 @@ static void nfa_rw_error_cleanup (UINT8 event)
 *******************************************************************************/
 static void nfa_rw_check_start_presence_check_timer (UINT16 presence_check_start_delay)
 {
-#if (defined (NFA_DM_AUTO_PRESENCE_CHECK) && (NFA_DM_AUTO_PRESENCE_CHECK == TRUE))
+    if (!p_nfa_dm_cfg->auto_presence_check)
+        return;
+
     if (nfa_rw_cb.flags & NFA_RW_FL_NOT_EXCL_RF_MODE)
     {
         if (presence_check_start_delay)
@@ -155,7 +166,6 @@ static void nfa_rw_check_start_presence_check_timer (UINT16 presence_check_start
             nfa_rw_presence_check (NULL);
         }
     }
-#endif   /* NFA_DM_AUTO_PRESENCE_CHECK  */
 }
 
 /*******************************************************************************
@@ -194,6 +204,7 @@ static void nfa_rw_handle_ndef_detect(tRW_EVENT event, tRW_DATA *p_rw_data)
     {
         /* Set NDEF detection state */
         nfa_rw_cb.ndef_st = NFA_RW_NDEF_ST_TRUE;
+        nfa_rw_cb.flags  |= NFA_RW_FL_NDEF_OK;
 
         /* Store ndef properties */
         conn_evt_data.ndef_detect.status = NFA_STATUS_OK;
@@ -248,6 +259,7 @@ static void nfa_rw_handle_ndef_detect(tRW_EVENT event, tRW_DATA *p_rw_data)
         /* Command complete - perform cleanup, notify app */
         nfa_rw_command_complete();
         nfa_rw_cb.ndef_st = NFA_RW_NDEF_ST_FALSE;
+        conn_evt_data.status = p_rw_data->ndef.status;
 
         if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF)
         {
@@ -255,20 +267,17 @@ static void nfa_rw_handle_ndef_detect(tRW_EVENT event, tRW_DATA *p_rw_data)
             nfa_dm_ndef_handle_message(NFA_STATUS_FAILED, NULL, 0);
 
             /* Notify app of read status */
-            conn_evt_data.status = NFC_STATUS_FAILED;
             nfa_dm_act_conn_cback_notify(NFA_READ_CPLT_EVT, &conn_evt_data);
         }
         else if (nfa_rw_cb.cur_op == NFA_RW_OP_WRITE_NDEF)
         {
             /* if ndef detection was done as part of ndef-write operation, then notify app of failure */
-            conn_evt_data.status = NFA_STATUS_FAILED;
             nfa_dm_act_conn_cback_notify(NFA_WRITE_CPLT_EVT, &conn_evt_data);
         }
         else if (nfa_rw_cb.cur_op == NFA_RW_OP_DETECT_NDEF)
         {
             conn_evt_data.ndef_detect.protocol = p_rw_data->ndef.protocol;
             /* current op was stand-alone NFA_DetectNDef. Notify app of failure */
-            conn_evt_data.ndef_detect.status = NFA_STATUS_FAILED;
             if (p_rw_data->ndef.status == NFC_STATUS_TIMEOUT)
             {
                 /* Tag could have moved away */
@@ -394,22 +403,21 @@ void nfa_rw_handle_sleep_wakeup_rsp (tNFC_STATUS status)
     tNFC_ACTIVATE_DEVT activate_params;
     tRW_EVENT event;
 
-    if (nfa_rw_cb.halt_event != RW_T2T_MAX_EVT)
-    {
-        NFA_TRACE_DEBUG0("nfa_rw_handle_sleep_wakeup_rsp; Attempt to woke up tag from HALT State is complete");
-        /* Tag is wakeup from HALT state */
-        if (nfa_rw_cb.flags & NFA_RW_FL_ACTIVATED)
+    if (  (nfa_rw_cb.halt_event != RW_T2T_MAX_EVT)
+        &&(nfa_rw_cb.activated_tech_mode == NFC_DISCOVERY_TYPE_POLL_A)
+                &&(nfa_rw_cb.protocol == NFC_PROTOCOL_T2T)
+                &&(nfa_rw_cb.pa_sel_res == NFC_SEL_RES_NFC_FORUM_T2T)  )
+            {
+        NFA_TRACE_DEBUG0("nfa_rw_handle_sleep_wakeup_rsp; Attempt to wake up Type 2 tag from HALT State is complete");
+        if (status == NFC_STATUS_OK)
         {
+            /* Type 2 Tag is wakeup from HALT state */
             NFA_TRACE_DEBUG0("nfa_rw_handle_sleep_wakeup_rsp; Handle the NACK rsp received now");
             /* Initialize control block */
             activate_params.protocol                        = nfa_rw_cb.protocol;
             activate_params.rf_tech_param.param.pa.sel_rsp  = nfa_rw_cb.pa_sel_res;
             activate_params.rf_tech_param.mode              = nfa_rw_cb.activated_tech_mode;
 
-            if (  (nfa_rw_cb.activated_tech_mode == NFC_DISCOVERY_TYPE_POLL_A)
-                &&(nfa_rw_cb.protocol == NFC_PROTOCOL_T2T)
-                &&(nfa_rw_cb.pa_sel_res == NFC_SEL_RES_NFC_FORUM_T2T)  )
-            {
                 /* Initialize RW module */
                 if ((RW_SetActivatedTagType (&activate_params, nfa_rw_cback)) != NFC_STATUS_OK)
                 {
@@ -421,32 +429,31 @@ void nfa_rw_handle_sleep_wakeup_rsp (tNFC_STATUS status)
                             GKI_freebuf(nfa_rw_cb.rw_data.data.p_data);
                         nfa_rw_cb.rw_data.data.p_data = NULL;
                     }
-                    return;
-                }
+                /* Do not try to detect NDEF again but just notify current operation failed */
+                nfa_rw_cb.halt_event = RW_T2T_MAX_EVT;
+            }
+        }
 
+        /* The current operation failed with NACK rsp from type 2 tag */
                 nfa_rw_cb.rw_data.status = NFC_STATUS_FAILED;
                 event = nfa_rw_cb.halt_event;
 
+        /* Got NACK rsp during presence check and legacy presence check performed */
                 if (nfa_rw_cb.cur_op == NFA_RW_OP_PRESENCE_CHECK)
                     nfa_rw_cb.rw_data.status = status;
 
-                if ((status == NFA_STATUS_FAILED) && (nfa_rw_cb.halt_event == RW_T2T_NDEF_DETECT_EVT))
+        /* If cannot Sleep wakeup tag, then NDEF Detect operation is complete */
+        if ((status != NFC_STATUS_OK) && (nfa_rw_cb.halt_event == RW_T2T_NDEF_DETECT_EVT))
                     nfa_rw_cb.halt_event = RW_T2T_MAX_EVT;
 
                 nfa_rw_handle_t2t_evt (event, &nfa_rw_cb.rw_data);
-            }
-        }
-        else
+        nfa_rw_cb.halt_event = RW_T2T_MAX_EVT;
+
+        /* If Type 2 tag sleep wakeup failed and If in normal mode (not-exclusive RF mode) then deactivate the link if sleep wakeup failed */
+        if ((nfa_rw_cb.flags & NFA_RW_FL_NOT_EXCL_RF_MODE) && (status != NFC_STATUS_OK))
         {
-            NFA_TRACE_DEBUG0("nfa_rw_handle_sleep_wakeup_rsp; Tag is already deactivated, just drop the NACK from tag");
-            if (nfa_rw_cb.halt_event == RW_T2T_READ_CPLT_EVT)
-            {
-                if (nfa_rw_cb.rw_data.data.p_data)
-                    GKI_freebuf(nfa_rw_cb.rw_data.data.p_data);
-                nfa_rw_cb.rw_data.data.p_data = NULL;
-            }
-            nfa_rw_cb.halt_event = RW_T2T_MAX_EVT;
-            nfa_rw_cb.skip_dyn_locks = FALSE;
+            NFA_TRACE_DEBUG0("Sleep wakeup failed. Deactivating...");
+            nfa_dm_rf_deactivate (NFA_DEACTIVATE_TYPE_DISCOVERY);
         }
     }
     else
@@ -470,6 +477,8 @@ void nfa_rw_handle_presence_check_rsp (tNFC_STATUS status)
 {
     BT_HDR *p_pending_msg;
 
+    /* Stop the presence check timer - timer may have been started when presence check started */
+    nfa_rw_stop_presence_check_timer();
     if (status == NFA_STATUS_OK)
     {
         /* Clear the BUSY flag and restart the presence-check timer */
@@ -649,7 +658,6 @@ static void nfa_rw_handle_t1t_evt (tRW_EVENT event, tRW_DATA *p_rw_data)
 
     case RW_T1T_RAW_FRAME_EVT:
         nfa_rw_send_data_to_upper (p_rw_data);
-
         /* Command complete - perform cleanup */
         nfa_rw_command_complete();
         break;
@@ -814,9 +822,11 @@ static void nfa_rw_handle_t2t_evt (tRW_EVENT event, tRW_DATA *p_rw_data)
 
     case RW_T2T_RAW_FRAME_EVT:
         nfa_rw_send_data_to_upper (p_rw_data);
-
         /* Command complete - perform cleanup */
-        nfa_rw_command_complete();
+        if (p_rw_data->status != NFC_STATUS_CONTINUE)
+        {
+            nfa_rw_command_complete();
+        }
         break;
 
     case RW_T2T_PRESENCE_CHECK_EVT:             /* Presence check completed */
@@ -836,9 +846,6 @@ static void nfa_rw_handle_t2t_evt (tRW_EVENT event, tRW_DATA *p_rw_data)
         nfa_dm_act_conn_cback_notify(NFA_RW_INTF_ERROR_EVT, &conn_evt_data);
         break;
     }
-
-    if (event != RW_T2T_INTF_ERROR_EVT)
-        nfa_rw_cb.halt_event     = RW_T2T_MAX_EVT;
 }
 
 /*******************************************************************************
@@ -917,8 +924,11 @@ static void nfa_rw_handle_t3t_evt (tRW_EVENT event, tRW_DATA *p_rw_data)
     case RW_T3T_RAW_FRAME_EVT:              /* SendRawFrame response */
         nfa_rw_send_data_to_upper (p_rw_data);
 
-        /* Command complete - perform cleanup */
-        nfa_rw_command_complete();
+        if (p_rw_data->status != NFC_STATUS_CONTINUE)
+        {
+            /* Command complete - perform cleanup */
+            nfa_rw_command_complete();
+        }
         break;
 
     case RW_T3T_PRESENCE_CHECK_EVT:             /* Presence check completed */
@@ -1070,9 +1080,12 @@ static void nfa_rw_handle_t4t_evt (tRW_EVENT event, tRW_DATA *p_rw_data)
     case RW_T4T_RAW_FRAME_EVT:              /* Raw Frame data event         */
         nfa_rw_send_data_to_upper (p_rw_data);
 
-        /* Command complete - perform cleanup */
-        nfa_rw_command_complete();
-        nfa_rw_cb.cur_op = NFA_RW_OP_MAX;
+        if (p_rw_data->status != NFC_STATUS_CONTINUE)
+        {
+            /* Command complete - perform cleanup */
+            nfa_rw_command_complete();
+            nfa_rw_cb.cur_op = NFA_RW_OP_MAX;
+        }
         break;
 
     case RW_T4T_SET_TO_RO_EVT:              /* Tag is set as read only          */
@@ -1196,9 +1209,11 @@ static void nfa_rw_handle_i93_evt (tRW_EVENT event, tRW_DATA *p_rw_data)
 
     case RW_I93_RAW_FRAME_EVT:              /* Raw Frame data event         */
         nfa_rw_send_data_to_upper (p_rw_data);
-
-        /* Command complete - perform cleanup */
-        nfa_rw_command_complete();
+        if (p_rw_data->status != NFC_STATUS_CONTINUE)
+        {
+            /* Command complete - perform cleanup */
+            nfa_rw_command_complete();
+        }
         break;
 
     case RW_I93_INTF_ERROR_EVT:             /* RF Interface error event         */
@@ -1767,6 +1782,9 @@ void nfa_rw_presence_check (tNFA_RW_MSG *p_data)
     tNFC_PROTOCOL       protocol = nfa_rw_cb.protocol;
     UINT8               sel_res  = nfa_rw_cb.pa_sel_res;
     tNFC_STATUS         status   = NFC_STATUS_FAILED;
+    BOOLEAN             unsupported = FALSE;
+    UINT8               option = NFA_RW_OPTION_INVALID;
+    tNFA_RW_PRES_CHK_OPTION op_param = NFA_RW_PRES_CHK_DEFAULT;
 
     switch (protocol)
     {
@@ -1779,7 +1797,72 @@ void nfa_rw_presence_check (tNFA_RW_MSG *p_data)
         break;
 
     case NFC_PROTOCOL_ISO_DEP:     /* ISODEP/4A,4B- NFC-A or NFC-B */
-        status = RW_T4tPresenceCheck();
+        if (p_data)
+        {
+            op_param    = p_data->op_req.params.option;
+        }
+
+        switch (op_param)
+        {
+        case NFA_RW_PRES_CHK_I_BLOCK:
+            option = RW_T4T_CHK_EMPTY_I_BLOCK;
+            break;
+
+        case NFA_RW_PRES_CHK_RESET:
+            /* option is initialized to NFA_RW_OPTION_INVALID, which will Deactivate to Sleep; Re-activate */
+            break;
+
+        case NFA_RW_PRES_CHK_RB_CH0:
+            option = RW_T4T_CHK_READ_BINARY_CH0;
+            break;
+
+        case NFA_RW_PRES_CHK_RB_CH3:
+            option = RW_T4T_CHK_READ_BINARY_CH3;
+            break;
+
+        default:
+            if (nfa_rw_cb.flags & NFA_RW_FL_NDEF_OK)
+            {
+                /* read binary on channel 0 */
+                option = RW_T4T_CHK_READ_BINARY_CH0;
+            }
+            else
+            {
+                /* NDEF DETECT failed.*/
+                if ( nfa_dm_is_raw_frame_session())
+                {
+                    /* NFA_SendRawFrame() is called */
+                    if (p_nfa_dm_cfg->presence_check_option & NFA_DM_PCO_EMPTY_I_BLOCK)
+                    {
+                        /* empty I block */
+                        option = RW_T4T_CHK_EMPTY_I_BLOCK;
+                    }
+                    else
+                    {
+                        /* read binary on channel 3 */
+                        option = RW_T4T_CHK_READ_BINARY_CH3;
+                    }
+                }
+                else if (!(p_nfa_dm_cfg->presence_check_option & NFA_DM_PCO_ISO_SLEEP_WAKE) && (nfa_rw_cb.intf_type == NFC_INTERFACE_ISO_DEP))
+                {
+                    /* the option indicates to use empty I block && ISODEP interface is activated */
+                    option = RW_T4T_CHK_EMPTY_I_BLOCK;
+                }
+            }
+        }
+
+        if (option != NFA_RW_OPTION_INVALID)
+        {
+            /* use the presence check with the chosen option */
+            status = RW_T4tPresenceCheck (option);
+        }
+        else
+        {
+            /* use sleep/wake for presence check */
+            unsupported = TRUE;
+        }
+
+
         break;
 
     case NFC_PROTOCOL_15693:       /* ISO 15693 */
@@ -1797,7 +1880,12 @@ void nfa_rw_presence_check (tNFA_RW_MSG *p_data)
 
     default:
         /* Protocol unsupported by RW module... */
+        unsupported = TRUE;
+        break;
+    }
 
+    if (unsupported)
+    {
         if (nfa_rw_cb.activated_tech_mode == NFC_DISCOVERY_TYPE_POLL_KOVIO)
         {
             /* start Kovio presence check (deactivate and wait for activation) */
@@ -1808,12 +1896,15 @@ void nfa_rw_presence_check (tNFA_RW_MSG *p_data)
             /* Let DM perform presence check (by putting tag to sleep and then waking it up) */
             status = nfa_dm_disc_sleep_wakeup();
         }
-        break;
     }
 
     /* Handle presence check failure */
     if (status != NFC_STATUS_OK)
         nfa_rw_handle_presence_check_rsp(NFC_STATUS_FAILED);
+    else if (!unsupported)
+    {
+        nfa_sys_start_timer (&nfa_rw_cb.tle, NFA_RW_PRESENCE_CHECK_TIMEOUT_EVT, p_nfa_dm_cfg->presence_check_timeout);
+    }
 }
 
 
@@ -1842,6 +1933,21 @@ BOOLEAN nfa_rw_presence_check_tick(tNFA_RW_MSG *p_data)
 
 /*******************************************************************************
 **
+** Function         nfa_rw_presence_check_timeout
+**
+** Description      presence check timeout: report presence check failure
+**
+** Returns          TRUE (caller frees message buffer)
+**
+*******************************************************************************/
+BOOLEAN nfa_rw_presence_check_timeout (tNFA_RW_MSG *p_data)
+{
+    nfa_rw_handle_presence_check_rsp(NFC_STATUS_FAILED);
+    return TRUE;
+}
+
+/*******************************************************************************
+**
 ** Function         nfa_rw_format_tag
 **
 ** Description      Handler for NFA_RW_API_FORMAT_TAG
@@ -2427,12 +2533,15 @@ static void nfa_rw_raw_mode_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC
 
     NFA_TRACE_DEBUG1 ("nfa_rw_raw_mode_data_cback(): event = 0x%X", event);
 
-    if ((event == NFC_DATA_CEVT) && (p_data->data.status == NFC_STATUS_OK))
+    if (  (event == NFC_DATA_CEVT)
+        &&(  (p_data->data.status == NFC_STATUS_OK)
+           ||(p_data->data.status == NFC_STATUS_CONTINUE)  )  )
     {
         p_msg = (BT_HDR *)p_data->data.p_data;
 
         if (p_msg)
         {
+            evt_data.data.status = p_data->data.status;
             evt_data.data.p_data = (UINT8 *)(p_msg + 1) + p_msg->offset;
             evt_data.data.len    = p_msg->len;
 
@@ -2473,6 +2582,7 @@ BOOLEAN nfa_rw_activate_ntf(tNFA_RW_MSG *p_data)
 
     /* Initialize control block */
     nfa_rw_cb.protocol   = p_activate_params->protocol;
+    nfa_rw_cb.intf_type  = p_activate_params->intf_param.type;
     nfa_rw_cb.pa_sel_res = p_activate_params->rf_tech_param.param.pa.sel_rsp;
     nfa_rw_cb.activated_tech_mode = p_activate_params->rf_tech_param.mode;
     nfa_rw_cb.flags      = NFA_RW_FL_ACTIVATED;
diff --git a/src/nfa/rw/nfa_rw_api.c b/src/nfa/rw/nfa_rw_api.c
index 2327b0a..f0c90a1 100644
--- a/src/nfa/rw/nfa_rw_api.c
+++ b/src/nfa/rw/nfa_rw_api.c
@@ -179,12 +179,14 @@ tNFA_STATUS NFA_RwWriteNDef (UINT8 *p_data, UINT32 len)
 **                  The NFA_RW_PRESENCE_CHECK_EVT w/ status is used to
 **                  indicate presence or non-presence.
 **
+**                  option is used only with ISO-DEP protocol
+**
 ** Returns
 **                  NFA_STATUS_OK if successfully initiated
 **                  NFA_STATUS_FAILED otherwise
 **
 *****************************************************************************/
-tNFA_STATUS NFA_RwPresenceCheck (void)
+tNFA_STATUS NFA_RwPresenceCheck (tNFA_RW_PRES_CHK_OPTION option)
 {
     tNFA_RW_OPERATION *p_msg;
 
@@ -194,6 +196,7 @@ tNFA_STATUS NFA_RwPresenceCheck (void)
     {
         p_msg->hdr.event = NFA_RW_OP_REQUEST_EVT;
         p_msg->op        = NFA_RW_OP_PRESENCE_CHECK;
+        p_msg->params.option    = option;
 
         nfa_sys_sendmsg (p_msg);
 
diff --git a/src/nfa/rw/nfa_rw_main.c b/src/nfa/rw/nfa_rw_main.c
index 5818275..2176c08 100644
--- a/src/nfa/rw/nfa_rw_main.c
+++ b/src/nfa/rw/nfa_rw_main.c
@@ -50,6 +50,7 @@ const tNFA_RW_ACTION nfa_rw_action_tbl[] =
     nfa_rw_activate_ntf,            /* NFA_RW_ACTIVATE_NTF_EVT          */
     nfa_rw_deactivate_ntf,          /* NFA_RW_DEACTIVATE_NTF_EVT        */
     nfa_rw_presence_check_tick,     /* NFA_RW_PRESENCE_CHECK_TICK_EVT   */
+    nfa_rw_presence_check_timeout   /* NFA_RW_PRESENCE_CHECK_TIMEOUT_EVT*/
 };
 
 
@@ -229,6 +230,9 @@ static char *nfa_rw_evt_2_str (UINT16 event)
     case NFA_RW_PRESENCE_CHECK_TICK_EVT:
         return "NFA_RW_PRESENCE_CHECK_TICK_EVT";
 
+    case NFA_RW_PRESENCE_CHECK_TIMEOUT_EVT:
+        return "NFA_RW_PRESENCE_CHECK_TIMEOUT_EVT";
+
     default:
         return "Unknown";
     }
diff --git a/src/nfc/include/nfc_api.h b/src/nfc/include/nfc_api.h
index e4fbd4f..2e4119d 100644
--- a/src/nfc/include/nfc_api.h
+++ b/src/nfc/include/nfc_api.h
@@ -1073,6 +1073,25 @@ NFC_API extern void NFC_SetStaticRfCback(tNFC_CONN_CBACK    *p_cback);
 
 /*******************************************************************************
 **
+** Function         NFC_SetReassemblyFlag
+**
+** Description      This function is called to set if nfc will reassemble
+**                  nci packet as much as its buffer can hold or it should not
+**                  reassemble but forward the fragmented nci packet to layer above.
+**                  If nci data pkt is fragmented, nfc may send multiple
+**                  NFC_DATA_CEVT with status NFC_STATUS_CONTINUE before sending
+**                  NFC_DATA_CEVT with status NFC_STATUS_OK based on reassembly
+**                  configuration and reassembly buffer size
+**
+** Parameters       reassembly - flag to indicate if nfc may reassemble or not
+**
+** Returns          Nothing
+**
+*******************************************************************************/
+NFC_API extern void NFC_SetReassemblyFlag (BOOLEAN    reassembly);
+
+/*******************************************************************************
+**
 ** Function         NFC_SendData
 **
 ** Description      This function is called to send the given data packet
@@ -1251,6 +1270,21 @@ NFC_API extern tNFC_STATUS NFC_TestLoopback(BT_HDR *p_data);
 *******************************************************************************/
 NFC_API extern UINT8 NFC_SetTraceLevel (UINT8 new_level);
 
+#if (BT_TRACE_VERBOSE == TRUE)
+/*******************************************************************************
+**
+** Function         NFC_GetStatusName
+**
+** Description      This function returns the status name.
+**
+** NOTE             conditionally compiled to save memory.
+**
+** Returns          pointer to the name
+**
+*******************************************************************************/
+NFC_API extern char * NFC_GetStatusName (tNFC_STATUS status);
+#endif
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/nfc/include/rw_api.h b/src/nfc/include/rw_api.h
index 67522d8..6522417 100644
--- a/src/nfc/include/rw_api.h
+++ b/src/nfc/include/rw_api.h
@@ -138,6 +138,13 @@ typedef UINT8 tRW_EVENT;
 
 typedef UINT8 tRW_NDEF_FLAG;
 
+/* options for RW_T4tPresenceCheck  */
+#define RW_T4T_CHK_READ_BINARY_CH0      0
+#define RW_T4T_CHK_READ_BINARY_CH1      1
+#define RW_T4T_CHK_READ_BINARY_CH2      2
+#define RW_T4T_CHK_READ_BINARY_CH3      3
+#define RW_T4T_CHK_EMPTY_I_BLOCK        4
+
 typedef struct
 {
     tNFC_STATUS     status;
@@ -892,6 +899,7 @@ NFC_API extern tNFC_STATUS RW_T4tUpdateNDef (UINT16 length, UINT8 *p_data);
 **
 **      The RW_T4T_PRESENCE_CHECK_EVT w/ status is used to indicate presence
 **      or non-presence.
+**      option is RW_T4T_CHK_EMPTY_I_BLOCK, use empty I block for presence check.
 **
 ** Returns
 **      NFC_STATUS_OK, if raw data frame sent
@@ -899,7 +907,7 @@ NFC_API extern tNFC_STATUS RW_T4tUpdateNDef (UINT16 length, UINT8 *p_data);
 **      NFC_STATUS_FAILED: other error
 **
 *****************************************************************************/
-NFC_API extern tNFC_STATUS RW_T4tPresenceCheck (void);
+NFC_API extern tNFC_STATUS RW_T4tPresenceCheck (UINT8 option);
 
 /*****************************************************************************
 **
diff --git a/src/nfc/int/llcp_int.h b/src/nfc/int/llcp_int.h
index 9d94ba6..d6aabbd 100644
--- a/src/nfc/int/llcp_int.h
+++ b/src/nfc/int/llcp_int.h
@@ -74,6 +74,7 @@ typedef struct
     UINT16              peer_lto;               /* link timeout of peer device in ms            */
     UINT8               peer_opt;               /* Option field of peer device                  */
     UINT16              effective_miu;          /* MIU to send PDU in activated state           */
+
     TIMER_LIST_ENT      timer;                  /* link timer for LTO and SYMM response         */
     UINT8               symm_state;             /* state of symmectric procedure                */
     BOOLEAN             ll_served;              /* TRUE if last transmisstion was for UI        */
diff --git a/src/nfc/int/nfc_int.h b/src/nfc/int/nfc_int.h
index 1d81891..7845c69 100644
--- a/src/nfc/int/nfc_int.h
+++ b/src/nfc/int/nfc_int.h
@@ -176,6 +176,7 @@ typedef struct
     TIMER_LIST_ENT      deactivate_timer;           /* Timer to wait for deactivation */
 
     tNFC_STATE          nfc_state;
+    BOOLEAN             reassembly;         /* Reassemble fragmented data pkt */
     UINT8               trace_level;
     UINT8               last_hdr[NFC_SAVED_HDR_SIZE];/* part of last NCI command header */
     UINT8               last_cmd[NFC_SAVED_CMD_SIZE];/* part of last NCI command payload */
diff --git a/src/nfc/int/rw_int.h b/src/nfc/int/rw_int.h
index a4d33ca..3de459e 100644
--- a/src/nfc/int/rw_int.h
+++ b/src/nfc/int/rw_int.h
@@ -223,6 +223,7 @@ typedef UINT8 tRW_T2T_LOCK_STATUS;
 #define RW_T2T_STATE_SET_TAG_RO                         0x08    /* Setting Tag as Read only tag                             */
 #define RW_T2T_STATE_CHECK_PRESENCE                     0x09    /* Check if Tag is still present                            */
 #define RW_T2T_STATE_FORMAT_TAG                         0x0A    /* Format the tag                                           */
+#define RW_T2T_STATE_HALT                               0x0B    /* Tag is in HALT State */
 
 /* rw_t2t_read/rw_t2t_write takes care of sector change if the block to read/write is in a different sector
  * Next Substate should be assigned to control variable 'substate' before calling these function for State Machine to
@@ -310,6 +311,7 @@ typedef struct
     BOOLEAN             b_read_hdr;                         /* Tag header read from tag                                     */
     BOOLEAN             b_read_data;                        /* Tag data block read from tag                                 */
     BOOLEAN             b_hard_lock;                        /* Hard lock the tag as part of config tag to Read only         */
+    BOOLEAN             check_tag_halt;                     /* Resent command after NACK rsp to find tag is in HALT State   */
 #if (defined (RW_NDEF_INCLUDED) && (RW_NDEF_INCLUDED == TRUE))
     BOOLEAN             skip_dyn_locks;                     /* Skip reading dynamic lock bytes from the tag                 */
     UINT8               found_tlv;                          /* The Tlv found while searching a particular TLV               */
@@ -453,6 +455,7 @@ typedef struct
 #define RW_T4T_NDEF_STATUS_NDEF_READ_ONLY   0x02    /* NDEF file is read-only   */
 
     UINT8               ndef_status;        /* bitmap for NDEF status           */
+    UINT8               channel;            /* channel id: used for read-binary */
 
     UINT16              max_read_size;      /* max reading size per a command   */
     UINT16              max_update_size;    /* max updating size per a command  */
diff --git a/src/nfc/llcp/llcp_api.c b/src/nfc/llcp/llcp_api.c
index a6cb23c..a18a920 100644
--- a/src/nfc/llcp/llcp_api.c
+++ b/src/nfc/llcp/llcp_api.c
@@ -908,6 +908,7 @@ tLLCP_STATUS LLCP_ConnectReq (UINT8                    reg_sap,
     tLLCP_DLCB   *p_dlcb;
     tLLCP_STATUS status;
     tLLCP_APP_CB *p_app_cb;
+    tLLCP_CONNECTION_PARAMS params;
 
     LLCP_TRACE_API2 ("LLCP_ConnectReq () reg_sap=0x%x, DSAP=0x%x", reg_sap, dsap);
 
@@ -918,6 +919,14 @@ tLLCP_STATUS LLCP_ConnectReq (UINT8                    reg_sap,
         return LLCP_STATUS_FAIL;
     }
 
+    if (!p_params)
+    {
+        params.miu   = LLCP_DEFAULT_MIU;
+        params.rw    = LLCP_DEFAULT_RW;
+        params.sn[0] = 0;
+        p_params     = &params;
+    }
+
     p_app_cb = llcp_util_get_app_cb (reg_sap);
 
     /* if application is registered */
@@ -999,16 +1008,19 @@ tLLCP_STATUS LLCP_ConnectCfm (UINT8                    local_sap,
 {
     tLLCP_STATUS  status;
     tLLCP_DLCB   *p_dlcb;
+    tLLCP_CONNECTION_PARAMS params;
 
     LLCP_TRACE_API2 ("LLCP_ConnectCfm () Local SAP:0x%x, Remote SAP:0x%x)",
                      local_sap, remote_sap);
 
     if (!p_params)
     {
-        LLCP_TRACE_ERROR0 ("LLCP_ConnectCfm (): tLLCP_CONNECTION_PARAMS must be provided");
-        return LLCP_STATUS_FAIL;
+        params.miu   = LLCP_DEFAULT_MIU;
+        params.rw    = LLCP_DEFAULT_RW;
+        params.sn[0] = 0;
+        p_params     = &params;
     }
-    else if (p_params->miu > llcp_cb.lcb.local_link_miu)
+    if (p_params->miu > llcp_cb.lcb.local_link_miu)
     {
         LLCP_TRACE_ERROR0 ("LLCP_ConnectCfm (): Data link MIU shall not be bigger than local link MIU");
         return LLCP_STATUS_FAIL;
diff --git a/src/nfc/llcp/llcp_link.c b/src/nfc/llcp/llcp_link.c
index 1c23ef2..d70349c 100644
--- a/src/nfc/llcp/llcp_link.c
+++ b/src/nfc/llcp/llcp_link.c
@@ -447,6 +447,12 @@ void llcp_link_deactivate (UINT8 reason)
     else /*  for link timeout and interface error */
     {
         /* if got RF link loss receiving no LLC PDU from peer */
+        if (  (reason == LLCP_LINK_RF_LINK_LOSS_ERR)
+            &&(!(llcp_cb.lcb.flags & LLCP_LINK_FLAGS_RX_ANY_LLC_PDU)))
+        {
+            reason = LLCP_LINK_RF_LINK_LOSS_NO_RX_LLC;
+        }
+
         NFC_FlushData (NFC_RF_CONN_ID);
     }
 
diff --git a/src/nfc/nci/nci_hmsgs.c b/src/nfc/nci/nci_hmsgs.c
index a1a2b1f..83904e8 100644
--- a/src/nfc/nci/nci_hmsgs.c
+++ b/src/nfc/nci/nci_hmsgs.c
@@ -417,6 +417,8 @@ UINT8 nci_snd_deactivate_cmd (UINT8 de_act_type )
     BT_HDR *p;
     UINT8 *pp;
 
+    nfc_cb.reassembly = TRUE;
+
     if ((p = NCI_GET_CMD_BUF (NCI_DISCOVER_PARAM_SIZE_DEACT)) == NULL)
         return (NCI_STATUS_FAILED);
 
diff --git a/src/nfc/nfc/nfc_main.c b/src/nfc/nfc/nfc_main.c
index 7805bfd..908942c 100644
--- a/src/nfc/nfc/nfc_main.c
+++ b/src/nfc/nfc/nfc_main.c
@@ -750,6 +750,7 @@ void NFC_Init (tHAL_NFC_ENTRY *p_hal_entry_tbl)
     nfc_cb.num_disc_maps    = NFC_NUM_INTERFACE_MAP;
     nfc_cb.trace_level      = NFC_INITIAL_TRACE_LEVEL;
     nfc_cb.nci_ctrl_size    = NCI_CTRL_INIT_SIZE;
+    nfc_cb.reassembly       = TRUE;
 
     rw_init ();
     ce_init ();
@@ -1058,6 +1059,28 @@ void NFC_SetStaticRfCback (tNFC_CONN_CBACK    *p_cback)
 
 /*******************************************************************************
 **
+** Function         NFC_SetReassemblyFlag
+**
+** Description      This function is called to set if nfc will reassemble
+**                  nci packet as much as its buffer can hold or it should not
+**                  reassemble but forward the fragmented nci packet to layer above.
+**                  If nci data pkt is fragmented, nfc may send multiple
+**                  NFC_DATA_CEVT with status NFC_STATUS_CONTINUE before sending
+**                  NFC_DATA_CEVT with status NFC_STATUS_OK based on reassembly
+**                  configuration and reassembly buffer size
+**
+** Parameters       reassembly - flag to indicate if nfc may reassemble or not
+**
+** Returns          Nothing
+**
+*******************************************************************************/
+void NFC_SetReassemblyFlag (BOOLEAN    reassembly)
+{
+    nfc_cb.reassembly = reassembly;
+}
+
+/*******************************************************************************
+**
 ** Function         NFC_SendData
 **
 ** Description      This function is called to send the given data packet
@@ -1322,5 +1345,96 @@ UINT8 NFC_SetTraceLevel (UINT8 new_level)
     return (nfc_cb.trace_level);
 }
 
+#if (BT_TRACE_VERBOSE == TRUE)
+/*******************************************************************************
+**
+** Function         NFC_GetStatusName
+**
+** Description      This function returns the status name.
+**
+** NOTE             conditionally compiled to save memory.
+**
+** Returns          pointer to the name
+**
+*******************************************************************************/
+char *NFC_GetStatusName (tNFC_STATUS status)
+{
+    switch (status)
+    {
+    case NFC_STATUS_OK:
+        return "OK";
+    case NFC_STATUS_REJECTED:
+        return "REJECTED";
+    case NFC_STATUS_MSG_CORRUPTED:
+        return "CORRUPTED";
+    case NFC_STATUS_BUFFER_FULL:
+        return "BUFFER_FULL";
+    case NFC_STATUS_FAILED:
+        return "FAILED";
+    case NFC_STATUS_NOT_INITIALIZED:
+        return "NOT_INITIALIZED";
+    case NFC_STATUS_SYNTAX_ERROR:
+        return "SYNTAX_ERROR";
+    case NFC_STATUS_SEMANTIC_ERROR:
+        return "SEMANTIC_ERROR";
+    case NFC_STATUS_UNKNOWN_GID:
+        return "UNKNOWN_GID";
+    case NFC_STATUS_UNKNOWN_OID:
+        return "UNKNOWN_OID";
+    case NFC_STATUS_INVALID_PARAM:
+        return "INVALID_PARAM";
+    case NFC_STATUS_MSG_SIZE_TOO_BIG:
+        return "MSG_SIZE_TOO_BIG";
+    case NFC_STATUS_ALREADY_STARTED:
+        return "ALREADY_STARTED";
+    case NFC_STATUS_ACTIVATION_FAILED:
+        return "ACTIVATION_FAILED";
+    case NFC_STATUS_TEAR_DOWN:
+        return "TEAR_DOWN";
+    case NFC_STATUS_RF_TRANSMISSION_ERR:
+        return "RF_TRANSMISSION_ERR";
+    case NFC_STATUS_RF_PROTOCOL_ERR:
+        return "RF_PROTOCOL_ERR";
+    case NFC_STATUS_TIMEOUT:
+        return "TIMEOUT";
+    case NFC_STATUS_EE_INTF_ACTIVE_FAIL:
+        return "EE_INTF_ACTIVE_FAIL";
+    case NFC_STATUS_EE_TRANSMISSION_ERR:
+        return "EE_TRANSMISSION_ERR";
+    case NFC_STATUS_EE_PROTOCOL_ERR:
+        return "EE_PROTOCOL_ERR";
+    case NFC_STATUS_EE_TIMEOUT:
+        return "EE_TIMEOUT";
+    case NFC_STATUS_CMD_STARTED:
+        return "CMD_STARTED";
+    case NFC_STATUS_HW_TIMEOUT:
+        return "HW_TIMEOUT";
+    case NFC_STATUS_CONTINUE:
+        return "CONTINUE";
+    case NFC_STATUS_REFUSED:
+        return "REFUSED";
+    case NFC_STATUS_BAD_RESP:
+        return "BAD_RESP";
+    case NFC_STATUS_CMD_NOT_CMPLTD:
+        return "CMD_NOT_CMPLTD";
+    case NFC_STATUS_NO_BUFFERS:
+        return "NO_BUFFERS";
+    case NFC_STATUS_WRONG_PROTOCOL:
+        return "WRONG_PROTOCOL";
+    case NFC_STATUS_BUSY:
+        return "BUSY";
+    case NFC_STATUS_LINK_LOSS:
+        return "LINK_LOSS";
+    case NFC_STATUS_BAD_LENGTH:
+        return "BAD_LENGTH";
+    case NFC_STATUS_BAD_HANDLE:
+        return "BAD_HANDLE";
+    case NFC_STATUS_CONGESTED:
+        return "CONGESTED";
+    default:
+        return"UNKNOWN";
+    }
+}
+#endif
 
 #endif /* NFC_INCLUDED == TRUE */
diff --git a/src/nfc/nfc/nfc_ncif.c b/src/nfc/nfc/nfc_ncif.c
index 437ef4d..f39ec70 100644
--- a/src/nfc/nfc/nfc_ncif.c
+++ b/src/nfc/nfc/nfc_ncif.c
@@ -102,10 +102,6 @@ void nfc_ncif_cmd_timeout (void)
     {
         nfc_enabled (NFC_STATUS_FAILED, NULL);
     }
-
-    /* terminate the process so we'll try again */
-    NFC_TRACE_ERROR0 ("NFC controller stopped responding, aborting the NFC process");
-    abort();
 }
 
 /*******************************************************************************
@@ -181,7 +177,7 @@ UINT8 nfc_ncif_send_data (tNFC_CONN_CB *p_cb, BT_HDR *p_data)
     p_data = (BT_HDR *)GKI_getfirst (&p_cb->tx_q);
 
     /* post data fragment to NCIT task as credits are available */
-    while (p_data && (p_data->len > 0) && (p_cb->num_buff > 0))
+    while (p_data && (p_data->len >= 0) && (p_cb->num_buff > 0))
     {
         if (p_data->len <= buffer_size)
         {
@@ -210,9 +206,12 @@ UINT8 nfc_ncif_send_data (tNFC_CONN_CB *p_cb, BT_HDR *p_data)
                 return (NCI_STATUS_BUFFER_FULL);
             p->len    = ulen;
             p->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE + 1;
+            if (p->len)
+            {
             pp        = (UINT8 *)(p + 1) + p->offset;
             ps        = (UINT8 *)(p_data + 1) + p_data->offset;
             memcpy (pp, ps, ulen);
+            }
             /* adjust the BT_HDR on the old fragment */
             p_data->len     -= ulen;
             p_data->offset  += ulen;
@@ -1287,7 +1286,7 @@ void nfc_ncif_proc_reset_rsp (UINT8 *p, BOOLEAN is_ntf)
     {
         if ((*p) != NCI_VERSION)
         {
-            NFC_TRACE_DEBUG2 ("NCI version mismatch!!:0x%02x != 0x%02x ", NCI_VERSION, *p);
+            NFC_TRACE_ERROR2 ("NCI version mismatch!!:0x%02x != 0x%02x ", NCI_VERSION, *p);
             if ((*p) < NCI_VERSION_0_F)
             {
                 NFC_TRACE_ERROR0 ("NFCC version is too old");
@@ -1411,16 +1410,33 @@ void nfc_data_event (tNFC_CONN_CB * p_cb)
         {
             if (p_evt->layer_specific & NFC_RAS_FRAGMENTED)
             {
-                break;
+                /* Not the last fragment */
+                if (!(p_evt->layer_specific & NFC_RAS_TOO_BIG))
+                {
+                    /* buffer can hold more */
+                    if (  (p_cb->conn_id != NFC_RF_CONN_ID)
+                        ||(nfc_cb.reassembly)  )
+                    {
+                        /* If not rf connection or If rf connection and reassembly requested,
+                         * try to Reassemble next packet */
+                        break;
+                    }
+                }
             }
+
             p_evt = (BT_HDR *) GKI_dequeue (&p_cb->rx_q);
             /* report data event */
             p_evt->offset   += NCI_MSG_HDR_SIZE;
             p_evt->len      -= NCI_MSG_HDR_SIZE;
+
             if (p_evt->layer_specific)
-                data_cevt.status = NFC_STATUS_BAD_LENGTH;
+                data_cevt.status = NFC_STATUS_CONTINUE;
             else
+            {
+                nfc_cb.reassembly = TRUE;
                 data_cevt.status = NFC_STATUS_OK;
+            }
+
             data_cevt.p_data = p_evt;
             /* adjust payload, if needed */
             if (p_cb->conn_id == NFC_RF_CONN_ID)
@@ -1461,7 +1477,6 @@ void nfc_ncif_proc_data (BT_HDR *p_msg)
     UINT16  size;
     BT_HDR  *p_max = NULL;
     UINT16  len;
-    UINT16  error_mask = 0;
 
     pp   = (UINT8 *) (p_msg+1) + p_msg->offset;
     NFC_TRACE_DEBUG3 ("nfc_ncif_proc_data 0x%02x%02x%02x", pp[0], pp[1], pp[2]);
@@ -1470,85 +1485,91 @@ void nfc_ncif_proc_data (BT_HDR *p_msg)
     if (p_cb && (p_msg->len >= NCI_DATA_HDR_SIZE))
     {
         NFC_TRACE_DEBUG1 ("nfc_ncif_proc_data len:%d", len);
-        if (len > 0)
+
+        p_msg->layer_specific       = 0;
+        if (pbf)
+            p_msg->layer_specific   = NFC_RAS_FRAGMENTED;
+        p_last = (BT_HDR *)GKI_getlast (&p_cb->rx_q);
+        if (p_last && (p_last->layer_specific & NFC_RAS_FRAGMENTED))
         {
-            p_msg->layer_specific       = 0;
-            if (pbf)
-                p_msg->layer_specific   = NFC_RAS_FRAGMENTED;
-            p_last = (BT_HDR *)GKI_getlast (&p_cb->rx_q);
-            if (p_last && (p_last->layer_specific & NFC_RAS_FRAGMENTED))
+            /* last data buffer is not last fragment, append this new packet to the last */
+            size = GKI_get_buf_size(p_last);
+            if (size < (BT_HDR_SIZE + p_last->len + p_last->offset + len))
             {
-                /* last data buffer is not last fragment, append this new packet to the last */
-                size = GKI_get_buf_size(p_last);
-                if (size < (BT_HDR_SIZE + p_last->len + p_last->offset + len))
+                /* the current size of p_last is not big enough to hold the new fragment, p_msg */
+                if (size != GKI_MAX_BUF_SIZE)
                 {
-                    /* the current size of p_last is not big enough to hold the new fragment, p_msg */
-                    if (size != GKI_MAX_BUF_SIZE)
+                    /* try the biggest GKI pool */
+                    p_max = (BT_HDR *)GKI_getpoolbuf (GKI_MAX_BUF_SIZE_POOL_ID);
+                    if (p_max)
                     {
-                        /* try the biggest GKI pool */
-                        p_max = (BT_HDR *)GKI_getpoolbuf (GKI_MAX_BUF_SIZE_POOL_ID);
-                        if (p_max)
-                        {
-                            /* copy the content of last buffer to the new buffer */
-                            memcpy(p_max, p_last, BT_HDR_SIZE);
-                            pd  = (UINT8 *)(p_max + 1) + p_max->offset;
-                            ps  = (UINT8 *)(p_last + 1) + p_last->offset;
-                            memcpy(pd, ps, p_last->len);
-
-                            /* place the new buffer in the queue instead */
-                            GKI_remove_from_queue (&p_cb->rx_q, p_last);
-                            GKI_freebuf (p_last);
-                            GKI_enqueue (&p_cb->rx_q, p_max);
-                            p_last  = p_max;
-                        }
-                    }
-                    if (p_max == NULL)
-                    {
-                        p_last->layer_specific  |= NFC_RAS_TOO_BIG;
-                        NFC_TRACE_ERROR1 ("nci_reassemble_msg buffer overrun(%d)!!", len);
+                        /* copy the content of last buffer to the new buffer */
+                        memcpy(p_max, p_last, BT_HDR_SIZE);
+                        pd  = (UINT8 *)(p_max + 1) + p_max->offset;
+                        ps  = (UINT8 *)(p_last + 1) + p_last->offset;
+                        memcpy(pd, ps, p_last->len);
+
+                        /* place the new buffer in the queue instead */
+                        GKI_remove_from_queue (&p_cb->rx_q, p_last);
+                        GKI_freebuf (p_last);
+                        GKI_enqueue (&p_cb->rx_q, p_max);
+                        p_last  = p_max;
                     }
                 }
-
-                ps   = (UINT8 *)(p_msg + 1) + p_msg->offset + NCI_MSG_HDR_SIZE;
-                len  = p_msg->len - NCI_MSG_HDR_SIZE;
-                if ((p_last->layer_specific & NFC_RAS_TOO_BIG) == 0)
+                if (p_max == NULL)
                 {
-                    pd   = (UINT8 *)(p_last + 1) + p_last->offset + p_last->len;
-                    memcpy(pd, ps, len);
-                    p_last->len  += len;
-                    /* do not need to update pbf and len in NCI header.
-                     * They are stripped off at NFC_DATA_CEVT and len may exceed 255 */
-                    NFC_TRACE_DEBUG1 ("nfc_ncif_proc_data len:%d", p_last->len);
+                    /* Biggest GKI Pool not available (or)
+                     * Biggest available GKI Pool is not big enough to hold the new fragment, p_msg */
+                    p_last->layer_specific  |= NFC_RAS_TOO_BIG;
                 }
+            }
 
-                error_mask              = (p_last->layer_specific & NFC_RAS_TOO_BIG);
-                p_last->layer_specific  = (p_msg->layer_specific | error_mask);
+            ps   = (UINT8 *)(p_msg + 1) + p_msg->offset + NCI_MSG_HDR_SIZE;
+            len  = p_msg->len - NCI_MSG_HDR_SIZE;
+
+            if (!(p_last->layer_specific & NFC_RAS_TOO_BIG))
+            {
+                pd   = (UINT8 *)(p_last + 1) + p_last->offset + p_last->len;
+                memcpy(pd, ps, len);
+                p_last->len  += len;
+                /* do not need to update pbf and len in NCI header.
+                 * They are stripped off at NFC_DATA_CEVT and len may exceed 255 */
+                NFC_TRACE_DEBUG1 ("nfc_ncif_proc_data len:%d", p_last->len);
+                p_last->layer_specific  = p_msg->layer_specific;
                 GKI_freebuf (p_msg);
 #ifdef DISP_NCI
-                if ((p_last->layer_specific & NFC_RAS_FRAGMENTED) == 0)
+                if (!(p_last->layer_specific & NFC_RAS_FRAGMENTED))
                 {
                     /* this packet was reassembled. display the complete packet */
                     DISP_NCI ((UINT8 *)(p_last + 1) + p_last->offset, p_last->len, TRUE);
                 }
 #endif
+                nfc_data_event (p_cb);
             }
             else
             {
-                /* if this is the first fragment on RF link */
-                if (  (p_msg->layer_specific & NFC_RAS_FRAGMENTED)
-                    &&(p_cb->conn_id == NFC_RF_CONN_ID)
-                    &&(p_cb->p_cback)  )
-                {
-                    /* Indicate upper layer that local device started receiving data */
-                    (*p_cb->p_cback) (p_cb->conn_id, NFC_DATA_START_CEVT, NULL);
-                }
-                /* enqueue the new buffer to the rx queue */
+                /* Not enough memory to add new buffer
+                 * Send data already in queue first with status Continue */
+                nfc_data_event (p_cb);
+                /* now enqueue the new buffer to the rx queue */
                 GKI_enqueue (&p_cb->rx_q, p_msg);
             }
+        }
+        else
+        {
+            /* if this is the first fragment on RF link */
+            if (  (p_msg->layer_specific & NFC_RAS_FRAGMENTED)
+                &&(p_cb->conn_id == NFC_RF_CONN_ID)
+                &&(p_cb->p_cback)  )
+            {
+                /* Indicate upper layer that local device started receiving data */
+                (*p_cb->p_cback) (p_cb->conn_id, NFC_DATA_START_CEVT, NULL);
+            }
+            /* enqueue the new buffer to the rx queue */
+            GKI_enqueue (&p_cb->rx_q, p_msg);
             nfc_data_event (p_cb);
-            return;
         }
-        /* else an empty data packet*/
+        return;
     }
     GKI_freebuf (p_msg);
 }
diff --git a/src/nfc/tags/ce_t3t.c b/src/nfc/tags/ce_t3t.c
index d457cf5..97de9ac 100644
--- a/src/nfc/tags/ce_t3t.c
+++ b/src/nfc/tags/ce_t3t.c
@@ -660,10 +660,11 @@ void ce_t3t_handle_non_nfc_forum_cmd (tCE_CB *p_mem_cb, UINT8 cmd_id, BT_HDR *p_
 ** Returns          none
 **
 *******************************************************************************/
-void ce_t3t_data_cback (UINT8 conn_id, BT_HDR *p_msg)
+void ce_t3t_data_cback (UINT8 conn_id, tNFC_DATA_CEVT *p_data)
 {
     tCE_CB *p_ce_cb = &ce_cb;
     tCE_T3T_MEM *p_cb = &p_ce_cb->mem.t3t;
+    BT_HDR *p_msg = p_data->p_data;
     tCE_DATA     ce_data;
     UINT8 cmd_id, bl0, entry_len, i;
     UINT8 *p_nfcid2 = NULL;
@@ -682,7 +683,7 @@ void ce_t3t_data_cback (UINT8 conn_id, BT_HDR *p_msg)
     /* If activate system code is not NDEF, or if no local NDEF contents was set, then pass data up to the app */
     if ((p_cb->system_code != T3T_SYSTEM_CODE_NDEF) || (!p_cb->ndef_info.initialized))
     {
-        ce_data.raw_frame.status = NFC_STATUS_OK;
+        ce_data.raw_frame.status = p_data->status;
         ce_data.raw_frame.p_data = p_msg;
         p_ce_cb->p_cback (CE_T3T_RAW_FRAME_EVT, &ce_data);
         return;
@@ -859,7 +860,7 @@ void ce_t3t_conn_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_data)
     case NFC_DATA_CEVT:
         if (p_data->data.status == NFC_STATUS_OK)
         {
-            ce_t3t_data_cback (conn_id, p_data->data.p_data);
+            ce_t3t_data_cback (conn_id, &p_data->data);
         }
         break;
 
diff --git a/src/nfc/tags/ce_t4t.c b/src/nfc/tags/ce_t4t.c
index 51e4dfd..b812cff 100644
--- a/src/nfc/tags/ce_t4t.c
+++ b/src/nfc/tags/ce_t4t.c
@@ -629,10 +629,8 @@ static void ce_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
     /* Don't check class if registered AID has been selected */
     if (  (cla != T4T_CMD_CLASS)
         &&((ce_cb.mem.t4t.status & CE_T4T_STATUS_REG_AID_SELECTED) == 0)
-        &&((ce_cb.mem.t4t.status & CE_T4T_STATUS_WILDCARD_AID_SELECTED) == 0)
-       )
+        &&((ce_cb.mem.t4t.status & CE_T4T_STATUS_WILDCARD_AID_SELECTED) == 0)  )
     {
-        CE_TRACE_ERROR1 ("CET4T: Unsupported Class byte (0x%02X)", cla);
         GKI_freebuf (p_c_apdu);
         ce_t4t_send_status (T4T_RSP_CLASS_NOT_SUPPORTED);
         return;
@@ -661,7 +659,7 @@ static void ce_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
         /* forward raw frame to upper layer */
         if (ce_cb.mem.t4t.selected_aid_idx < CE_T4T_MAX_REG_AID)
         {
-            ce_data.raw_frame.status = NFC_STATUS_OK;
+            ce_data.raw_frame.status = p_data->data.status;
             ce_data.raw_frame.p_data = p_c_apdu;
             ce_data.raw_frame.aid_handle = ce_cb.mem.t4t.selected_aid_idx;
             p_c_apdu = NULL;
@@ -679,7 +677,7 @@ static void ce_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
         CE_TRACE_DEBUG0 ("CET4T: Forward raw frame to wildcard AID handler");
 
         /* forward raw frame to upper layer */
-        ce_data.raw_frame.status = NFC_STATUS_OK;
+        ce_data.raw_frame.status = p_data->data.status;
         ce_data.raw_frame.p_data = p_c_apdu;
         ce_data.raw_frame.aid_handle = CE_T4T_WILDCARD_AID_HANDLE;
         p_c_apdu = NULL;
diff --git a/src/nfc/tags/rw_i93.c b/src/nfc/tags/rw_i93.c
index 7cec26b..d77b231 100644
--- a/src/nfc/tags/rw_i93.c
+++ b/src/nfc/tags/rw_i93.c
@@ -3122,7 +3122,7 @@ static void rw_i93_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
         p_i93->sent_cmd = 0;
         if (rw_cb.p_cback)
         {
-            rw_data.raw_frame.status = NFC_STATUS_OK;
+            rw_data.raw_frame.status = p_data->data.status;
             rw_data.raw_frame.p_data = p_resp;
             (*(rw_cb.p_cback)) (RW_I93_RAW_FRAME_EVT, &rw_data);
             p_resp = NULL;
diff --git a/src/nfc/tags/rw_t2t.c b/src/nfc/tags/rw_t2t.c
index f41605f..de2de64 100644
--- a/src/nfc/tags/rw_t2t.c
+++ b/src/nfc/tags/rw_t2t.c
@@ -36,7 +36,7 @@
 #include "gki.h"
 
 /* Static local functions */
-static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt);
+static void rw_t2t_proc_data (UINT8 conn_id, tNFC_DATA_CEVT *p_data);
 static tNFC_STATUS rw_t2t_send_cmd (UINT8 opcode, UINT8 *p_dat);
 static void rw_t2t_process_error (void);
 static void rw_t2t_process_frame_error (void);
@@ -57,10 +57,11 @@ static char *rw_t2t_get_substate_name (UINT8 substate);
 ** Returns          none
 **
 *******************************************************************************/
-static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt)
+static void rw_t2t_proc_data (UINT8 conn_id, tNFC_DATA_CEVT *p_data)
 {
     tRW_EVENT               rw_event    = RW_RAW_FRAME_EVT;
     tRW_T2T_CB              *p_t2t      = &rw_cb.tcb.t2t;
+    BT_HDR                  *p_pkt      = p_data->p_data;
     BOOLEAN                 b_notify    = TRUE;
     BOOLEAN                 b_release   = TRUE;
     UINT8                   *p;
@@ -74,10 +75,13 @@ static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt)
     if (  (p_t2t->state == RW_T2T_STATE_IDLE)
         ||(p_cmd_rsp_info == NULL)  )
     {
-        RW_TRACE_DEBUG2 ("rw_t2t_proc_data - Raw frame event! state: IDLE, conn_id: %u  event: %u",
-                           conn_id, event);
 
-        evt_data.status = NFC_STATUS_OK;
+#if (BT_TRACE_VERBOSE == TRUE)
+        RW_TRACE_DEBUG2 ("RW T2T Raw Frame: Len [0x%X] Status [%s]", p_pkt->len, NFC_GetStatusName (p_data->status));
+#else
+        RW_TRACE_DEBUG2 ("RW T2T Raw Frame: Len [0x%X] Status [0x%X]", p_pkt->len, p_data->status);
+#endif
+        evt_data.status = p_data->status;
         evt_data.p_data = p_pkt;
         (*rw_cb.p_cback) (RW_T2T_RAW_FRAME_EVT, (tRW_DATA *)&evt_data);
         return;
@@ -91,17 +95,22 @@ static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt)
 
     RW_TRACE_EVENT2 ("RW RECV [%s]:0x%x RSP", t2t_info_to_str (p_cmd_rsp_info), p_cmd_rsp_info->opcode);
 
-    if (  (p_pkt->len != p_cmd_rsp_info->rsp_len)
-        &&(p_pkt->len != p_cmd_rsp_info->nack_rsp_len)
-        &&(p_t2t->substate != RW_T2T_SUBSTATE_WAIT_SELECT_SECTOR)  )
+    if (  (  (p_pkt->len != p_cmd_rsp_info->rsp_len)
+           &&(p_pkt->len != p_cmd_rsp_info->nack_rsp_len)
+           &&(p_t2t->substate != RW_T2T_SUBSTATE_WAIT_SELECT_SECTOR)  )
+        ||(p_t2t->state == RW_T2T_STATE_HALT)  )
     {
 #if (BT_TRACE_VERBOSE == TRUE)
         RW_TRACE_ERROR1 ("T2T Frame error. state=%s ", rw_t2t_get_state_name (p_t2t->state));
 #else
         RW_TRACE_ERROR1 ("T2T Frame error. state=0x%02X command=0x%02X ", p_t2t->state);
 #endif
-        /* Retrasmit the last sent command if retry-count < max retry */
-        rw_t2t_process_frame_error ();
+        if (p_t2t->state != RW_T2T_STATE_HALT)
+        {
+            /* Retrasmit the last sent command if retry-count < max retry */
+            rw_t2t_process_frame_error ();
+            p_t2t->check_tag_halt = FALSE;
+        }
         GKI_freebuf (p_pkt);
         return;
     }
@@ -111,8 +120,8 @@ static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt)
     p = (UINT8 *) (p_pkt + 1) + p_pkt->offset;
 
 
-    RW_TRACE_EVENT5 ("rw_t2t_proc_data State: %u  conn_id: %u  event: %u  len: %u  data[0]: 0x%02x",
-                      p_t2t->state, conn_id, event, p_pkt->len, *p);
+    RW_TRACE_EVENT4 ("rw_t2t_proc_data State: %u  conn_id: %u  len: %u  data[0]: 0x%02x",
+                      p_t2t->state, conn_id, p_pkt->len, *p);
 
     evt_data.p_data     = NULL;
 
@@ -136,10 +145,36 @@ static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt)
     {
         evt_data.status = NFC_STATUS_FAILED;
     }
-    else if (p_pkt->len == p_cmd_rsp_info->rsp_len)
+    else if (  (p_pkt->len != p_cmd_rsp_info->rsp_len)
+             ||((p_cmd_rsp_info->opcode == T2T_CMD_WRITE) && ((*p & 0x0f) != T2T_RSP_ACK))  )
+    {
+        /* Received NACK response */
+        evt_data.p_data = p_pkt;
+        if (p_t2t->state == RW_T2T_STATE_READ)
+            b_release = FALSE;
+
+        RW_TRACE_EVENT1 ("rw_t2t_proc_data - Received NACK response(0x%x)", (*p & 0x0f));
+
+        if (!p_t2t->check_tag_halt)
+        {
+            /* Just received first NACK. Retry just one time to find if tag went in to HALT State */
+            b_notify =  FALSE;
+            rw_t2t_process_error ();
+            /* Assume Tag is in HALT State, untill we get response to retry command */
+            p_t2t->check_tag_halt = TRUE;
+        }
+        else
+        {
+            p_t2t->check_tag_halt = FALSE;
+            /* Got consecutive NACK so tag not really halt after first NACK, but current operation failed */
+            evt_data.status = NFC_STATUS_FAILED;
+        }
+    }
+    else
     {
         /* If the response length indicates positive response or cannot be known from length then assume success */
         evt_data.status  = NFC_STATUS_OK;
+        p_t2t->check_tag_halt = FALSE;
 
         /* The response data depends on what the current operation was */
         switch (p_t2t->state)
@@ -160,41 +195,16 @@ static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt)
             break;
 
         case RW_T2T_STATE_WRITE:
-            /* Check positive or negative acknowledgment */
-            if ((*p & 0x0f) != T2T_RSP_ACK)
-            {
-                RW_TRACE_EVENT1 ("rw_t2t_proc_data - Received NACK response(0x%x) to WRITE CMD", (*p & 0x0f));
-                evt_data.status = NFC_STATUS_REJECTED;
-            }
+            /* Write operation completed successfully */
             break;
 
         default:
-            /* NDEF/other Tlv Operation/Format Tag/Config Tag as Read only
-             * Check if Positive response to previous write command */
-            if (  (p_cmd_rsp_info->opcode == T2T_CMD_WRITE)
-                &&((*p & 0x0f) != T2T_RSP_ACK)  )
-            {
-                RW_TRACE_EVENT1 ("rw_t2t_proc_data - Received NACK response(0x%x) to WRITE CMD", (*p & 0x0f));
-                evt_data.status = NFC_STATUS_REJECTED;
-            }
-            else
-            {
-                b_notify = FALSE;
-                rw_t2t_handle_rsp (p);
-            }
+            /* NDEF/other Tlv Operation/Format-Tag/Config Tag as Read only */
+            b_notify = FALSE;
+            rw_t2t_handle_rsp (p);
             break;
         }
     }
-    else
-    {
-        evt_data.p_data = p_pkt;
-        if (p_t2t->state == RW_T2T_STATE_READ)
-            b_release = FALSE;
-
-        RW_TRACE_EVENT1 ("rw_t2t_proc_data - Received NACK response(0x%x)", (*p & 0x0f));
-        /* Negative response to the command sent */
-        evt_data.status = NFC_STATUS_REJECTED;
-    }
 
     if (b_notify)
     {
@@ -223,6 +233,7 @@ static void rw_t2t_proc_data (UINT8 conn_id, tNFC_CONN_EVT event, BT_HDR *p_pkt)
 
     if (b_release)
         GKI_freebuf (p_pkt);
+
 #if (BT_TRACE_VERBOSE == TRUE)
     if (begin_state != p_t2t->state)
     {
@@ -287,16 +298,18 @@ void rw_t2t_conn_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_data)
 
     case NFC_DATA_CEVT:
         if (  (p_data != NULL)
-            &&(p_data->data.status == NFC_STATUS_OK)  )
+            &&(  (p_data->data.status == NFC_STATUS_OK)
+               ||(p_data->data.status == NFC_STATUS_CONTINUE)  )  )
         {
-            rw_t2t_proc_data (conn_id, event, (BT_HDR *) (p_data->data.p_data));
+            rw_t2t_proc_data (conn_id, &(p_data->data));
             break;
         }
         /* Data event with error status...fall through to NFC_ERROR_CEVT case */
 
     case NFC_ERROR_CEVT:
         if (  (p_t2t->state == RW_T2T_STATE_NOT_ACTIVATED)
-            ||(p_t2t->state == RW_T2T_STATE_IDLE)  )
+            ||(p_t2t->state == RW_T2T_STATE_IDLE)
+            ||(p_t2t->state == RW_T2T_STATE_HALT)  )
         {
 #if (defined (RW_STATS_INCLUDED) && (RW_STATS_INCLUDED == TRUE))
             rw_main_update_trans_error_stats ();
@@ -318,7 +331,16 @@ void rw_t2t_conn_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_data)
 #endif
         if (p_t2t->state == RW_T2T_STATE_CHECK_PRESENCE)
         {
-            rw_t2t_handle_presence_check_rsp (NFC_STATUS_FAILED);
+            if (p_t2t->check_tag_halt)
+            {
+                p_t2t->state = RW_T2T_STATE_HALT;
+                rw_t2t_handle_presence_check_rsp (NFC_STATUS_REJECTED);
+            }
+            else
+            {
+                /* Move back to idle state */
+                rw_t2t_handle_presence_check_rsp (NFC_STATUS_FAILED);
+            }
         }
         else
         {
@@ -418,8 +440,16 @@ void rw_t2t_process_timeout (TIMER_LIST_ENT *p_tle)
 
     if (p_t2t->state == RW_T2T_STATE_CHECK_PRESENCE)
     {
-        /* Move back to idle state */
-        rw_t2t_handle_presence_check_rsp (NFC_STATUS_FAILED);
+        if (p_t2t->check_tag_halt)
+        {
+            p_t2t->state = RW_T2T_STATE_HALT;
+            rw_t2t_handle_presence_check_rsp (NFC_STATUS_REJECTED);
+        }
+        else
+        {
+            /* Move back to idle state */
+            rw_t2t_handle_presence_check_rsp (NFC_STATUS_FAILED);
+        }
         return;
     }
 
@@ -495,7 +525,8 @@ static void rw_t2t_process_error (void)
     RW_TRACE_DEBUG1 ("rw_t2t_process_error () State: %u", p_t2t->state);
 
     /* Retry sending command if retry-count < max */
-    if (rw_cb.cur_retry < RW_MAX_RETRIES)
+    if (  (!p_t2t->check_tag_halt)
+        &&(rw_cb.cur_retry < RW_MAX_RETRIES)  )
     {
         /* retry sending the command */
         rw_cb.cur_retry++;
@@ -522,31 +553,52 @@ static void rw_t2t_process_error (void)
     }
     else
     {
-        RW_TRACE_DEBUG1 ("T2T maximum retransmission attempts reached (%i)", RW_MAX_RETRIES);
+        if (p_t2t->check_tag_halt)
+        {
+            RW_TRACE_DEBUG0 ("T2T Went to HALT State!");
+        }
+        else
+        {
+            RW_TRACE_DEBUG1 ("T2T maximum retransmission attempts reached (%i)", RW_MAX_RETRIES);
+        }
     }
     rw_event = rw_t2t_info_to_event (p_cmd_rsp_info);
 #if (defined (RW_STATS_INCLUDED) && (RW_STATS_INCLUDED == TRUE))
     /* update failure count */
     rw_main_update_fail_stats ();
 #endif
-    /* If not activated remain in non activated state, otherwise move to idle state */
-    if (p_t2t->state != RW_T2T_STATE_NOT_ACTIVATED)
-        rw_t2t_handle_op_complete ();
+    if (p_t2t->check_tag_halt)
+    {
+        evt_data.status = NFC_STATUS_REJECTED;
+        p_t2t->state    = RW_T2T_STATE_HALT;
+    }
+    else
+    {
+        evt_data.status = NFC_STATUS_TIMEOUT;
+    }
 
-    p_t2t->substate = RW_T2T_SUBSTATE_NONE;
-    evt_data.status = NFC_STATUS_TIMEOUT;
     if (rw_event == RW_T2T_NDEF_DETECT_EVT)
     {
         ndef_data.status    = evt_data.status;
         ndef_data.protocol  = NFC_PROTOCOL_T2T;
         ndef_data.flags     = RW_NDEF_FL_UNKNOWN;
+        if (p_t2t->substate == RW_T2T_SUBSTATE_WAIT_READ_LOCKS)
+            ndef_data.flags = RW_NDEF_FL_FORMATED;
         ndef_data.max_size  = 0;
         ndef_data.cur_size  = 0;
+        /* If not Halt move to idle state */
+        rw_t2t_handle_op_complete ();
+
         (*rw_cb.p_cback) (rw_event, (tRW_DATA *) &ndef_data);
     }
     else
     {
         evt_data.p_data = NULL;
+        /* If activated and not Halt move to idle state */
+        if (p_t2t->state != RW_T2T_STATE_NOT_ACTIVATED)
+            rw_t2t_handle_op_complete ();
+
+        p_t2t->substate = RW_T2T_SUBSTATE_NONE;
         (*rw_cb.p_cback) (rw_event, (tRW_DATA *) &evt_data);
     }
 }
@@ -828,6 +880,7 @@ tNFC_STATUS rw_t2t_select (void)
 
     NFC_SetStaticRfCback (rw_t2t_conn_cback);
     rw_t2t_handle_op_complete ();
+    p_t2t->check_tag_halt = FALSE;
 
     return NFC_STATUS_OK;
 }
@@ -851,7 +904,8 @@ void rw_t2t_handle_op_complete (void)
         p_t2t->b_read_data = FALSE;
     }
 
-    p_t2t->state    = RW_T2T_STATE_IDLE;
+    if (p_t2t->state != RW_T2T_STATE_HALT)
+        p_t2t->state    = RW_T2T_STATE_IDLE;
     p_t2t->substate = RW_T2T_SUBSTATE_NONE;
     return;
 }
diff --git a/src/nfc/tags/rw_t2t_ndef.c b/src/nfc/tags/rw_t2t_ndef.c
index 51a35fb..3304a90 100644
--- a/src/nfc/tags/rw_t2t_ndef.c
+++ b/src/nfc/tags/rw_t2t_ndef.c
@@ -2669,7 +2669,7 @@ tNFC_STATUS rw_t2t_format_tag (void)
     if ((p_ret = t2t_tag_init_data (p_t2t->tag_hdr[0], FALSE, 0)) == NULL)
     {
         RW_TRACE_WARNING1 ("rw_t2t_format_tag - Unknown Manufacturer ID: %u, Cannot Format the tag!", p_t2t->tag_hdr[0]);
-        return (NFC_STATUS_REJECTED);
+        return (NFC_STATUS_FAILED);
     }
 
     if (p_t2t->tag_hdr[T2T_CC2_TMS_BYTE] != 0)
diff --git a/src/nfc/tags/rw_t3t.c b/src/nfc/tags/rw_t3t.c
index e962574..323ee75 100644
--- a/src/nfc/tags/rw_t3t.c
+++ b/src/nfc/tags/rw_t3t.c
@@ -120,6 +120,7 @@ static char *rw_t3t_state_str (UINT8 state_id);
 
 
 /* Local static functions */
+static void rw_t3t_update_ndef_flag (UINT8 *p_flag);
 static tNFC_STATUS rw_t3t_unselect (UINT8 peer_nfcid2[]);
 static BT_HDR *rw_t3t_get_cmd_buf (void);
 static tNFC_STATUS rw_t3t_send_to_lower (BT_HDR *p_msg);
@@ -236,6 +237,7 @@ void rw_t3t_process_error (tNFC_STATUS status)
             if (evt == RW_T3T_NDEF_DETECT_EVT)
             {
                 evt_data.ndef.flags = RW_NDEF_FL_UNKNOWN;
+                rw_t3t_update_ndef_flag (&evt_data.ndef.flags);
             }
 
             (*(rw_cb.p_cback)) (evt, &evt_data);
@@ -1310,7 +1312,7 @@ void rw_t3t_act_handle_ndef_detect_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
     RW_TRACE_DEBUG1 ("RW_T3tDetectNDEF response: %i", evt_data.status);
 
     p_cb->rw_state = RW_T3T_STATE_IDLE;
-
+    rw_t3t_update_ndef_flag (&evt_data.flags);
     /* Notify app of NDEF detection result */
     (*(rw_cb.p_cback)) (RW_T3T_NDEF_DETECT_EVT, (tRW_DATA *) &evt_data);
 
@@ -1409,13 +1411,20 @@ void rw_t3t_act_handle_update_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
 ** Returns          Nothing
 **
 *****************************************************************************/
-void rw_t3t_act_handle_raw_senddata_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
+void rw_t3t_act_handle_raw_senddata_rsp (tRW_T3T_CB *p_cb, tNFC_DATA_CEVT *p_data)
 {
     tRW_READ_DATA evt_data;
+    BT_HDR        *p_pkt = p_data->p_data;
+
+#if (BT_TRACE_VERBOSE == TRUE)
+        RW_TRACE_DEBUG2 ("RW T3T Raw Frame: Len [0x%X] Status [%s]", p_pkt->len, NFC_GetStatusName (p_data->status));
+#else
+        RW_TRACE_DEBUG2 ("RW T3T Raw Frame: Len [0x%X] Status [0x%X]", p_pkt->len, p_data->status);
+#endif
 
     /* Copy incoming data into buffer */
-    evt_data.status = NFC_STATUS_OK;
-    evt_data.p_data = p_msg_rsp;
+    evt_data.status = p_data->status;
+    evt_data.p_data = p_pkt;
 
     p_cb->rw_state = RW_T3T_STATE_IDLE;
 
@@ -1720,6 +1729,7 @@ static void rw_t3t_handle_ndef_detect_poll_rsp (tRW_T3T_CB *p_cb, UINT8 nci_stat
     p_cb->rw_state = RW_T3T_STATE_IDLE;
     evt_data.ndef.status = nci_status;
     evt_data.ndef.flags  = RW_NDEF_FL_UNKNOWN;
+    rw_t3t_update_ndef_flag (&evt_data.ndef.flags);
     (*(rw_cb.p_cback)) (RW_T3T_NDEF_DETECT_EVT, &evt_data);
 }
 
@@ -2168,9 +2178,10 @@ void rw_t3t_act_handle_sro_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
 ** Returns          none
 **
 *******************************************************************************/
-void rw_t3t_data_cback (UINT8 conn_id, BT_HDR *p_msg)
+void rw_t3t_data_cback (UINT8 conn_id, tNFC_DATA_CEVT *p_data)
 {
-    tRW_T3T_CB *p_cb = &rw_cb.tcb.t3t;
+    tRW_T3T_CB *p_cb  = &rw_cb.tcb.t3t;
+    BT_HDR     *p_msg = p_data->p_data;
     BOOLEAN free_msg = FALSE;           /* if TRUE, free msg buffer before returning */
     UINT8 *p, sod;
 
@@ -2189,7 +2200,7 @@ void rw_t3t_data_cback (UINT8 conn_id, BT_HDR *p_msg)
         **  This must be raw frame response
         **  send raw frame to app with SoD
         */
-        rw_t3t_act_handle_raw_senddata_rsp (p_cb, p_msg);
+        rw_t3t_act_handle_raw_senddata_rsp (p_cb, p_data);
     }
     /* Sanity check: verify msg len is big enough to contain t3t header */
     else if (p_msg->len < T3T_MSG_RSP_COMMON_HDR_LEN)
@@ -2245,7 +2256,7 @@ void rw_t3t_data_cback (UINT8 conn_id, BT_HDR *p_msg)
                 break;
 
             case RW_T3T_CMD_SEND_RAW_FRAME:
-                rw_t3t_act_handle_raw_senddata_rsp (p_cb, p_msg);
+                rw_t3t_act_handle_raw_senddata_rsp (p_cb, p_data);
                 break;
 
             case RW_T3T_CMD_GET_SYSTEM_CODES:
@@ -2301,9 +2312,10 @@ void rw_t3t_conn_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_data)
         break;
 
     case NFC_DATA_CEVT:     /* check for status in tNFC_CONN */
-        if (p_data->data.status == NFC_STATUS_OK)
+        if (  (p_data->data.status == NFC_STATUS_OK)
+            ||(p_data->data.status == NFC_STATUS_CONTINUE)  )
         {
-            rw_t3t_data_cback (conn_id, p_data->data.p_data);
+            rw_t3t_data_cback (conn_id, &(p_data->data));
             break;
         }
         /* Data event with error status...fall through to NFC_ERROR_CEVT case */
@@ -2401,6 +2413,30 @@ static tNFC_STATUS rw_t3t_unselect (UINT8 peer_nfcid2[])
     return NFC_STATUS_OK;
 }
 
+/*******************************************************************************
+**
+** Function         rw_t3t_update_ndef_flag
+**
+** Description      set additional NDEF Flags for felica lite tag
+**
+** Returns          updated NDEF Flag value
+**
+*******************************************************************************/
+static void rw_t3t_update_ndef_flag (UINT8 *p_flag)
+{
+    tRW_T3T_CB *p_cb = &rw_cb.tcb.t3t;
+    UINT8 xx;
+
+    for (xx = 0; xx < p_cb->num_system_codes; xx++)
+    {
+        if (p_cb->system_codes[xx] == T3T_SYSTEM_CODE_FELICA_LITE)
+        {
+            *p_flag &= ~RW_NDEF_FL_UNKNOWN;
+            *p_flag |= (RW_NDEF_FL_SUPPORTED | RW_NDEF_FL_FORMATABLE);
+            break;
+        }
+    }
+}
 
 #if (BT_TRACE_VERBOSE == TRUE)
 /*******************************************************************************
diff --git a/src/nfc/tags/rw_t4t.c b/src/nfc/tags/rw_t4t.c
index bf12681..6e2b4ad 100644
--- a/src/nfc/tags/rw_t4t.c
+++ b/src/nfc/tags/rw_t4t.c
@@ -202,7 +202,7 @@ static BOOLEAN rw_t4t_read_file (UINT16 offset, UINT16 length, BOOLEAN is_contin
     p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
     p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
 
-    UINT8_TO_BE_STREAM (p, T4T_CMD_CLASS);
+    UINT8_TO_BE_STREAM (p, (T4T_CMD_CLASS | rw_cb.tcb.t4t.channel));
     UINT8_TO_BE_STREAM (p, T4T_CMD_INS_READ_BINARY);
     UINT16_TO_BE_STREAM (p, offset);
     UINT8_TO_BE_STREAM (p, length); /* Le */
@@ -1189,7 +1189,8 @@ static void rw_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
     }
 
 #if (BT_TRACE_PROTOCOL == TRUE)
-    DispRWT4Tags (p_r_apdu, TRUE);
+    if (p_t4t->state != RW_T4T_STATE_IDLE)
+        DispRWT4Tags (p_r_apdu, TRUE);
 #endif
 
 #if (BT_TRACE_VERBOSE == TRUE)
@@ -1204,9 +1205,14 @@ static void rw_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
     case RW_T4T_STATE_IDLE:
         /* Unexpected R-APDU, it should be raw frame response */
         /* forward to upper layer without parsing */
+#if (BT_TRACE_VERBOSE == TRUE)
+        RW_TRACE_DEBUG2 ("RW T4T Raw Frame: Len [0x%X] Status [%s]", p_r_apdu->len, NFC_GetStatusName (p_data->data.status));
+#else
+        RW_TRACE_DEBUG2 ("RW T4T Raw Frame: Len [0x%X] Status [0x%X]", p_r_apdu->len, p_data->data.status);
+#endif
         if (rw_cb.p_cback)
         {
-            rw_data.raw_frame.status = NFC_STATUS_OK;
+            rw_data.raw_frame.status = p_data->data.status;
             rw_data.raw_frame.p_data = p_r_apdu;
             (*(rw_cb.p_cback)) (RW_T4T_RAW_FRAME_EVT, &rw_data);
             p_r_apdu = NULL;
@@ -1459,6 +1465,7 @@ tNFC_STATUS RW_T4tUpdateNDef (UINT16 length, UINT8 *p_data)
 **
 **      The RW_T4T_PRESENCE_CHECK_EVT w/ status is used to indicate presence
 **      or non-presence.
+**      option is RW_T4T_CHK_EMPTY_I_BLOCK, use empty I block for presence check.
 **
 ** Returns
 **      NFC_STATUS_OK, if raw data frame sent
@@ -1466,12 +1473,14 @@ tNFC_STATUS RW_T4tUpdateNDef (UINT16 length, UINT8 *p_data)
 **      NFC_STATUS_FAILED: other error
 **
 *****************************************************************************/
-tNFC_STATUS RW_T4tPresenceCheck (void)
+tNFC_STATUS RW_T4tPresenceCheck (UINT8 option)
 {
     tNFC_STATUS retval = NFC_STATUS_OK;
     tRW_DATA    evt_data;
+    BOOLEAN     status;
+    BT_HDR      *p_data;
 
-    RW_TRACE_API0 ("RW_T4tPresenceCheck ()");
+    RW_TRACE_API1 ("RW_T4tPresenceCheck () %d", option);
 
     /* If RW_SelectTagType was not called (no conn_callback) return failure */
     if (!rw_cb.p_cback)
@@ -1492,7 +1501,29 @@ tNFC_STATUS RW_T4tPresenceCheck (void)
     }
     else
     {
-        if (rw_t4t_read_file (0, 1, FALSE))
+        status = FALSE;
+        if (option == RW_T4T_CHK_EMPTY_I_BLOCK)
+        {
+            /* use empty I block for presence check */
+            if ((p_data = (BT_HDR *) GKI_getbuf (NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE)) != NULL)
+            {
+                p_data->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+                p_data->len    = 0;
+                if (NFC_SendData (NFC_RF_CONN_ID, (BT_HDR*) p_data) == NFC_STATUS_OK)
+                    status = TRUE;
+            }
+        }
+        else
+        {
+            /* use read binary on the given channel */
+            rw_cb.tcb.t4t.channel = 0;
+            if (option <= RW_T4T_CHK_READ_BINARY_CH3)
+                rw_cb.tcb.t4t.channel = option;
+            status = rw_t4t_read_file (0, 1, FALSE);
+            rw_cb.tcb.t4t.channel = 0;
+        }
+
+        if (status == TRUE)
         {
             rw_cb.tcb.t4t.state = RW_T4T_STATE_PRESENCE_CHECK;
         }
diff --git a/src/nfca_version.c b/src/nfca_version.c
index b48a5cf..5fdf111 100644
--- a/src/nfca_version.c
+++ b/src/nfca_version.c
@@ -17,7 +17,7 @@
  ******************************************************************************/
 #include "bt_types.h"
 
-const UINT8 nfca_version_string[] = "NFCDROID_MI_422.10.0.15";
+const UINT8 nfca_version_string[] = "NFCDROID_MI_440.10.00.01";
 
 /*
 // The following string should be manually updated to contain the
@@ -25,4 +25,4 @@ const UINT8 nfca_version_string[] = "NFCDROID_MI_422.10.0.15";
 //
 // NOTE: IF additional branches are used add a "+" at the end of the string
 */
-const UINT8 nfa_version_string[] =  "NFA_MI_1.03.62+";
+const UINT8 nfa_version_string[] =  "NFA_PI_1.03.66+";
diff --git a/src/static-lib-adapt/ProtoDispBluetoothHci.c b/src/static-lib-adapt/ProtoDispBluetoothHci.c
new file mode 100644
index 0000000..abdeb07
--- /dev/null
+++ b/src/static-lib-adapt/ProtoDispBluetoothHci.c
@@ -0,0 +1,174 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2011-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "OverrideLog.h"
+#include "ProtoDispBluetoothHci.h"
+#include "nfc_target.h"
+#include <cutils/log.h>
+
+
+extern UINT8 *HCIDisp1 (char *p_descr, UINT8 *p_data);
+extern UINT32 ScrProtocolTraceFlag;
+#define HCI_GEN_TRACE   (TRACE_CTRL_GENERAL | TRACE_LAYER_HCI | \
+                         TRACE_ORG_PROTO_DISP | hci_trace_type)
+static UINT8 hci_trace_type = 0;
+static char* modes_str [] =
+{
+    "No sleep mode",
+    "UART",
+    "UART with messaging",
+    "USB",
+    "H4IBSS",
+    "USB with host wake",
+    "SDIO",
+    "UART CS-N",
+    "SPI",
+    "H5",
+    "H4DS",
+    "",
+    "UART with BREAK"
+};
+static UINT8* p_end_hci = NULL;
+static UINT8* HCIDisp1Ext (char *p_descr, UINT8 *p_data, char * p_ext);
+static void disp_sleepmode (UINT8* p);
+static void disp_sleepmode_evt (UINT8* p);
+
+
+///////////////////////////////////////////
+///////////////////////////////////////////
+
+
+UINT8 *HCIDisp1Ext (char *p_descr, UINT8 *p_data, char * p_ext)
+{
+    if (p_data == p_end_hci)
+        return p_data;
+
+    char    buff[200];
+
+    sprintf (buff, "%40s : %u (0x%02x): %s", p_descr, *p_data, *p_data, p_ext);
+
+    ScrLog (HCI_GEN_TRACE, "%s", buff);
+    return (p_data + 1);
+}
+
+
+/*******************************************************************************
+**
+** Function         disp_sleepmode
+**
+** Description      Displays VSC sleep mode
+**
+** Returns          none.
+**
+*******************************************************************************/
+void disp_sleepmode(UINT8 * p)
+{
+    hci_trace_type = TRACE_TYPE_CMD_TX;
+    ScrLog (HCI_GEN_TRACE, "--");
+    int len     = p[2];
+    ScrLog (HCI_GEN_TRACE, "SEND Command to HCI.  Name: Set_Sleepmode_Param   (Hex Code: 0xfc27  Param Len: %d)", len);
+    p       += 3;
+    p_end_hci   = p + len;
+    p = HCIDisp1Ext("Sleep_Mode", p, (*p <= 12) ? modes_str[*p] : "");
+    p = HCIDisp1("Idle_Threshold_Host", p);
+    p = HCIDisp1("Idle_Threshold_HC", p);
+    p = HCIDisp1Ext("BT_WAKE_Active_Mode", p, (*p == 0) ? "Active Low" : ((*p == 1) ? "Active High" : ""));
+    p = HCIDisp1Ext("HOST_WAKE_Active_Mode", p, (*p == 0) ? "Active Low" : ((*p == 1) ? "Active High" : ""));
+    p = HCIDisp1("Allow_Host_Sleep_During_SCO", p);
+    p = HCIDisp1("Combine_Sleep_Mode_And_LPM", p);
+    p = HCIDisp1("Enable_Tristate_Control_Of_UART_Tx_Line", p);
+    p = HCIDisp1Ext("Active_Connection_Handling_On_Suspend", p, (*p == 0) ? "Maintain connections; sleep when timed activity allows" : ((*p == 1) ? "Sleep until resume is detected" : ""));
+    p = HCIDisp1("Resume_Timeout", p);
+    p = HCIDisp1("Enable_BREAK_To_Host", p);
+    p = HCIDisp1("Pulsed_HOST_WAKE", p);
+
+    ScrLog (HCI_GEN_TRACE, "--");
+}
+
+
+/*******************************************************************************
+**
+** Function         disp_sleepmode_evt
+**
+** Description      Displays HCI comand complete event for VSC sleep mode.
+**
+** Returns          none.
+**
+*******************************************************************************/
+void disp_sleepmode_evt(UINT8* p)
+{
+    UINT8   len=p[1], status=p[5];
+
+    hci_trace_type = TRACE_TYPE_EVT_RX;
+    ScrLog (HCI_GEN_TRACE, "--");
+    ScrLog (HCI_GEN_TRACE, "RCVD Event from HCI. Name: HCI_Command_Complete  (Hex Code: 0x0e  Param Len: %d)", len);
+
+    p = HCIDisp1 ("Num HCI Cmd Packets", p+2);
+    ScrLog (HCI_GEN_TRACE,"%40s : 0xfc27  (Set_Sleepmode_Param)", "Cmd Code");
+    ScrLog (HCI_GEN_TRACE, "%40s : %d (0x%02x) %s", "Status", status, status, (status == 0) ? "Success" : "");
+    ScrLog (HCI_GEN_TRACE, "--");
+}
+
+/*******************************************************************************
+**
+** Function         ProtoDispBluetoothHciCmd
+**
+** Description      Display a HCI command string
+**
+** Returns:
+**                  Nothing
+**
+*******************************************************************************/
+void ProtoDispBluetoothHciCmd (BT_HDR *p_buf)
+{
+    if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_HCI_SUMMARY))
+        return;
+    UINT8 * p = (UINT8 *)(p_buf + 1) + p_buf->offset;
+    if (*(p) == 0x27 && *(p+1) == 0xfc) // opcode sleep mode
+    {
+        disp_sleepmode(p);
+    }
+}
+
+
+/*******************************************************************************
+**
+** Function         ProtoDispBluetoothHciEvt
+**
+** Description      display a NCI event
+**
+** Returns:
+**                  Nothing
+**
+*******************************************************************************/
+void ProtoDispBluetoothHciEvt (BT_HDR *pBuffer)
+{
+    if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_HCI_SUMMARY))
+        return;
+
+    UINT8   *p = (UINT8 *)(pBuffer + 1) + pBuffer->offset;
+    if (*p == 0x0e) // command complete
+    {
+        if (*(p+1) == 4)    // length
+        {
+            if (*(p+3) == 0x27 && *(p+4) == 0xfc)   // opcode 0x27fc (sleep mode)
+            {
+                disp_sleepmode_evt(p);
+            }
+        }
+    }
+}
diff --git a/src/udrv/include/upio.h b/src/udrv/include/upio.h
index 08b17a7..77ee4ba 100644
--- a/src/udrv/include/upio.h
+++ b/src/udrv/include/upio.h
@@ -15,12 +15,6 @@
  *  limitations under the License.
  *
  ******************************************************************************/
-
-/******************************************************************************
- *
- *  Definitions for UPIO driver
- *
- ******************************************************************************/
 #ifndef UPIO_H
 #define UPIO_H