Upgrade stack to NFA_PI_1.03.66+

Take code from NFCA_MI_430.10.00.07.
Additional changes include:
* Adjust copyright.
* Clean up stack and HAL diagnostic tracing.
* Fix ce_t4t_data_cback() in src/nfc/tags/ce_t4t.c in order to let HCE payment to work.
* Reduce compilation warnings.

Change-Id: I7b174229029d4a4955ff7750623e78c9a8c856f6

20 files changed, 762 insertions, 283 deletions

diff --git a/halimpl/bcm2079x/adaptation/HalAdaptation.cpp b/halimpl/bcm2079x/adaptation/HalAdaptation.cpp
index 9d7ac35..fbeedc7 100644
--- a/halimpl/bcm2079x/adaptation/HalAdaptation.cpp
+++ b/halimpl/bcm2079x/adaptation/HalAdaptation.cpp
@@ -33,6 +33,7 @@
 #include <errno.h>
 #include <pthread.h>
 #include "buildcfg.h"
+#include "android_logmsg.h"
 extern void delete_hal_non_volatile_store (bool forceDelete);
 extern void verify_hal_non_volatile_store ();
 extern "C"
@@ -40,6 +41,7 @@ extern "C"
 #include "userial.h"
 }
 
+extern void configureCrystalFrequency ();
 
 ///////////////////////////////////////
 // private declaration, definition
@@ -72,9 +74,11 @@ int HaiInitializeLibrary (const bcm2079x_dev_t* device)
     unsigned long num = 0;
     char temp[120];
     UINT8 logLevel = 0;
+    static bool isColdBoot = true;
 
     logLevel = InitializeGlobalAppLogLevel ();
 
+    configureCrystalFrequency ();
     verify_hal_non_volatile_store ();
     if ( GetNumValue ( NAME_PRESERVE_STORAGE, (char*)&num, sizeof ( num ) ) &&
             (num == 1) )
@@ -84,6 +88,15 @@ int HaiInitializeLibrary (const bcm2079x_dev_t* device)
         delete_hal_non_volatile_store (false);
     }
 
+    if ( GetNumValue ( NAME_USE_RAW_NCI_TRACE, &num, sizeof ( num ) ) )
+    {
+        if (num == 1)
+        {
+            // display protocol traces in raw format
+            ProtoDispAdapterUseRawOutput (TRUE);
+        }
+    }
+
     // Initialize protocol logging level
     if ( GetNumValue ( NAME_PROTOCOL_TRACE_LEVEL, &num, sizeof ( num ) ) )
         ScrProtocolTraceFlag = num;
@@ -170,6 +183,14 @@ int HaiInitializeLibrary (const bcm2079x_dev_t* device)
         p_nfc_hal_cfg->nfc_hal_hci_uicc_support = 0;
     }
 
+    if (isColdBoot)
+    {
+        isColdBoot = false;
+        p_nfc_hal_cfg->nfc_hal_first_boot = TRUE;
+    }
+    else
+        p_nfc_hal_cfg->nfc_hal_first_boot = FALSE;
+
     HAL_NfcInitialize ();
     HAL_NfcSetTraceLevel (logLevel); // Initialize HAL's logging level
 
@@ -353,19 +374,11 @@ int HaiGetMaxNfcee (const bcm2079x_dev_t* device, uint8_t* maxNfcee)
 
     if ( maxNfcee )
     {
-        unsigned long num;
-
-        // At this point we can see if there is a chip-specific value for max ee.
-        if ( GetNumValue ( NAME_NFA_MAX_EE_SUPPORTED, &num, sizeof ( num ) ) )
-        {
-            *maxNfcee = num;
-        }
-        else
-            *maxNfcee = HAL_NfcGetMaxNfcee ();
-
+        *maxNfcee = HAL_NfcGetMaxNfcee ();
         ALOGD("%s: max_ee from HAL to use %d", __FUNCTION__, *maxNfcee);
         retval = 0;
     }
     ALOGD ("%s: exit %d", __FUNCTION__, retval);
     return retval;
 }
+
diff --git a/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp b/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
index 72f4207..0168517 100644
--- a/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
+++ b/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
@@ -20,10 +20,9 @@
 #include "gki.h"
 extern "C"
 {
-    #include "nfc_hal_nv_co.h"
+    #include "nfc_hal_target.h"
+    #include "nfc_hal_nv_ci.h"
 }
-#include "nfc_hal_nv_ci.h"
-#include "nfc_hal_int.h"
 #include "config.h"
 #include "CrcChecksum.h"
 #include <sys/types.h>
diff --git a/halimpl/bcm2079x/adaptation/OverrideLog.cpp b/halimpl/bcm2079x/adaptation/OverrideLog.cpp
index 966aec6..ba99f0d 100644
--- a/halimpl/bcm2079x/adaptation/OverrideLog.cpp
+++ b/halimpl/bcm2079x/adaptation/OverrideLog.cpp
@@ -25,6 +25,7 @@
 #include "OverrideLog.h"
 #include <cutils/properties.h>
 #include "config.h"
+#include "android_logmsg.h"
 #define LOG_TAG "NfcNciHal"
 
 
@@ -69,5 +70,11 @@ unsigned char InitializeGlobalAppLogLevel ()
     if (appl_trace_level == 0xFF)
         appl_trace_level = BT_TRACE_LEVEL_DEBUG;
     ALOGD ("%s: level=%u", __FUNCTION__, appl_trace_level);
+
+    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+    {
+        //display protocol traces in raw format
+        ProtoDispAdapterUseRawOutput (TRUE);
+    }
     return appl_trace_level;
 }
diff --git a/halimpl/bcm2079x/adaptation/StartupConfig.cpp b/halimpl/bcm2079x/adaptation/StartupConfig.cpp
index 529361b..f296763 100644
--- a/halimpl/bcm2079x/adaptation/StartupConfig.cpp
+++ b/halimpl/bcm2079x/adaptation/StartupConfig.cpp
@@ -85,23 +85,25 @@ const UINT8* StartupConfig::getInternalBuffer ()
 ** Description:     Append new config data to internal buffer.
 **                  newContent: buffer containing new content; newContent[0] is
 **                          payload length; newContent[1..end] is payload.
+**                  newContentLen: total length of newContent.
 **
 ** Returns:         True if ok.
 **
 *******************************************************************************/
-bool StartupConfig::append (const UINT8* newContent)
+bool StartupConfig::append (const UINT8* newContent, UINT8 newContentLen)
 {
     static const char fn [] = "StartupConfig::append";
-    if ((newContent[0]+mBuffer.size()) > mMaxLength)
+    if ((newContentLen+mBuffer.size()) > mMaxLength)
     {
         ALOGE ("%s: exceed max length", fn);
         return false;
     }
-    ALOGD ("%s: try append %u bytes", fn, (uint8_string::size_type) (newContent[0]));
+
+    ALOGD ("%s: try append %u bytes", fn, (uint8_string::size_type) (newContentLen));
     //append new payload into private buffer
-    mBuffer.append (newContent+1, (uint8_string::size_type) (newContent[0]));
+    mBuffer.append (newContent+1, (uint8_string::size_type) (newContentLen-1));
     //increase size counter of payload in private buffer
-    mBuffer[0] = mBuffer[0] + newContent[0];
+    mBuffer[0] = mBuffer[0] + newContentLen-1;
     ALOGD ("%s: new size %u bytes", fn, mBuffer[0]);
     return true;
 };
@@ -109,30 +111,6 @@ bool StartupConfig::append (const UINT8* newContent)
 
 /*******************************************************************************
 **
-** Function:        append
-**
-** Description:     Append new config data to internal buffer.
-**                  newContent: buffer containing new content; newContent[0] is
-**                          payload length; newContent[1..end] is payload.
-**                  newContentLen: total length of newContent.
-**
-** Returns:         True if ok.
-**
-*******************************************************************************/
-bool StartupConfig::append (const UINT8* newContent, UINT8 newContentLen)
-{
-    static const char fn [] = "StartupConfig::append";
-    if ((newContent[0]+1) != newContentLen)
-    {
-        ALOGE ("%s: invalid length at newContent[0]", fn);
-        return false;
-    }
-    return append (newContent);
-};
-
-
-/*******************************************************************************
-**
 ** Function:        disableSecureElement
 **
 ** Description:     Adjust a TLV to disable secure element(s).  The TLV's type is 0xC2.
@@ -171,7 +149,7 @@ bool StartupConfig::disableSecureElement (UINT8 bitmask)
     {
         UINT8 tlv [] = {0x04, 0xC2, 0x02, 0x61, 0x00};
         tlv [4] = tlv [4] | bitmask;
-        found0xC2 = append (tlv);
+        found0xC2 = append (tlv, 5);
     }
     return found0xC2;
 }
diff --git a/halimpl/bcm2079x/adaptation/android_logmsg.cpp b/halimpl/bcm2079x/adaptation/android_logmsg.cpp
index ec092f7..86fc9b8 100644
--- a/halimpl/bcm2079x/adaptation/android_logmsg.cpp
+++ b/halimpl/bcm2079x/adaptation/android_logmsg.cpp
@@ -16,112 +16,345 @@
  *
  ******************************************************************************/
 #include "OverrideLog.h"
-extern "C"
-{
-    #include "nfc_hal_target.h"
-}
+#include "android_logmsg.h"
+#include "nfc_target.h"
+#include "buildcfg.h"
 #include <cutils/log.h>
 
 
-#ifndef BTE_LOG_BUF_SIZE
-    #define BTE_LOG_BUF_SIZE  1024
-#endif
-#define BTE_LOG_MAX_SIZE  (BTE_LOG_BUF_SIZE - 12)
-#define MAX_NCI_PACKET_SIZE  259
-#define MAX_LOGCAT_LINE     4096
-static char log_line[MAX_LOGCAT_LINE];
+extern UINT32 ScrProtocolTraceFlag;
+#define MAX_NCI_PACKET_SIZE 259
+#define BTE_LOG_BUF_SIZE 1024
+#define BTE_LOG_MAX_SIZE (BTE_LOG_BUF_SIZE - 12)
+#define MAX_LOGCAT_LINE 4096
+#define PRINT(s) __android_log_write (ANDROID_LOG_DEBUG, "BrcmNci", s)
+static char log_line [MAX_LOGCAT_LINE];
 static const char* sTable = "0123456789abcdef";
+static BOOLEAN sIsUseRaw = FALSE;
+static void ToHex (const UINT8* data, UINT16 len, char* hexString, UINT16 hexStringSize);
+static void dumpbin (const char* data, int size, UINT32 trace_layer, UINT32 trace_type);
+static inline void word2hex (const char* data, char** hex);
+static inline void byte2char (const char* data, char** str);
+static inline void byte2hex (const char* data, char** str);
 
-extern UINT32 ScrProtocolTraceFlag;         // = SCR_PROTO_TRACE_ALL; // 0x017F;
-extern "C"
+
+void BTDISP_LOCK_LOG()
 {
-    void DispNci (UINT8 *p, UINT16 len, BOOLEAN is_recv);
-    void DispHciCmd (BT_HDR *p_buf);
-    void DispHciEvt (BT_HDR *p_buf);
 }
 
 
-void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...)
+void BTDISP_UNLOCK_LOG()
 {
-    static char buffer [BTE_LOG_BUF_SIZE];
-    va_list ap;
-    UINT32 trace_type = trace_set_mask & 0x07; //lower 3 bits contain trace type
-    int android_log_type = ANDROID_LOG_INFO;
+}
 
-    va_start (ap, fmt_str);
-    vsnprintf (buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
-    va_end (ap);
-    if (trace_type == TRACE_TYPE_ERROR)
-        android_log_type = ANDROID_LOG_ERROR;
-    __android_log_write (android_log_type, "NfcNciHal", buffer);
+
+void BTDISP_INIT_LOCK()
+{
+}
+
+
+void BTDISP_UNINIT_LOCK()
+{
 }
 
 
-void DispNci (UINT8 *data, UINT16 len, BOOLEAN is_recv)
+void ProtoDispAdapterUseRawOutput (BOOLEAN isUseRaw)
 {
+    sIsUseRaw = isUseRaw;
+}
+
+
+void ProtoDispAdapterDisplayNciPacket (UINT8 *nciPacket, UINT16 nciPacketLen, BOOLEAN is_recv)
+{
+    //Protocol decoder is not available, so decode NCI packet into hex numbers.
     if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_NCI))
         return;
+    char line_buf [(MAX_NCI_PACKET_SIZE*2)+1];
+    ToHex (nciPacket, nciPacketLen, line_buf, sizeof(line_buf));
+    __android_log_write (ANDROID_LOG_DEBUG, (is_recv) ? "BrcmNciR": "BrcmNciX", line_buf);
+}
 
-    char line_buf[(MAX_NCI_PACKET_SIZE*2)+1];
-    int i,j;
 
-    for(i = 0, j = 0; i < len && j < sizeof(line_buf)-3; i++)
+void ToHex (const UINT8* data, UINT16 len, char* hexString, UINT16 hexStringSize)
+{
+    int i=0, j=0;
+    for(i = 0, j = 0; i < len && j < hexStringSize-3; i++)
     {
-        line_buf[j++] = sTable[(*data >> 4) & 0xf];
-        line_buf[j++] = sTable[*data & 0xf];
+        hexString [j++] = sTable [(*data >> 4) & 0xf];
+        hexString [j++] = sTable [*data & 0xf];
         data++;
     }
-    line_buf[j] = '\0';
+    hexString [j] = '\0';
+}
+
+
+//Protodisp code calls ScrLog() to print decoded texts.
+void ScrLog (UINT32 trace_set_mask, const char *fmt_str, ...)
+{
+    static char buffer [BTE_LOG_BUF_SIZE];
+    va_list ap;
 
-    __android_log_write(ANDROID_LOG_DEBUG, (is_recv) ? "BrcmNciR": "BrcmNciX", line_buf);
+    va_start (ap, fmt_str);
+    vsnprintf (buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
+    va_end (ap);
+    __android_log_write(ANDROID_LOG_INFO, "BrcmNci", buffer);
 }
 
 
-void DispHciCmd (BT_HDR *p_buf)
+UINT8 *scru_dump_hex (UINT8 *p, char *pTitle, UINT32 len, UINT32 layer, UINT32 type)
 {
-    int i,j;
-    int nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
-    UINT8 * data = (UINT8*) p_buf;
-    int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+    if(pTitle && *pTitle)
+        PRINT(pTitle);
+    dumpbin((char*) p, len, layer, type);
+    return p;
+}
 
-    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
-        return;
 
-    if (nBytes > sizeof(log_line))
+void dumpbin(const char* data, int size, UINT32 trace_layer, UINT32 trace_type)
+{
+    char line_buff[256];
+    char *line;
+    int i, j, addr;
+    const int width = 16;
+    if(size <= 0)
         return;
-
-    for(i = 0, j = 0; i < data_len && j < sizeof(log_line)-3; i++)
+    for(i = 0; i < size / width; i++)
     {
-        log_line[j++] = sTable[(*data >> 4) & 0xf];
-        log_line[j++] = sTable[*data & 0xf];
-        data++;
+        line = line_buff;
+        //write address:
+        addr = i*width;
+        word2hex((const char*)&addr, &line);
+        *line++ = ':'; *line++ = ' ';
+        //write hex of data
+        for(j = 0; j < width; j++)
+        {
+            byte2hex(&data[j], &line);
+            *line++ = ' ';
+        }
+        //write char of data
+        for(j = 0; j < width; j++)
+            byte2char(data++, &line);
+        //wirte the end of line
+        *line = 0;
+        //output the line
+        PRINT(line_buff);
+    }
+    //last line of left over if any
+    int leftover = size % width;
+    if(leftover > 0)
+    {
+        line = line_buff;
+        //write address:
+        addr = i*width;
+        word2hex((const char*)&addr, &line);
+        *line++ = ':'; *line++ = ' ';
+        //write hex of data
+        for(j = 0; j < leftover; j++)
+        {
+            byte2hex(&data[j], &line);
+            *line++ = ' ';
+        }
+        //write hex padding
+        for(; j < width; j++)
+        {
+            *line++ = ' ';
+            *line++ = ' ';
+            *line++ = ' ';
+        }
+        //write char of data
+        for(j = 0; j < leftover; j++)
+            byte2char(data++, &line);
+        //write the end of line
+        *line = 0;
+        //output the line
+        PRINT(line_buff);
     }
-    log_line[j] = '\0';
+}
+
 
-    __android_log_write(ANDROID_LOG_DEBUG, "BrcmHciX", log_line);
+inline void word2hex (const char* data, char** hex)
+{
+    byte2hex(&data[1], hex);
+    byte2hex(&data[0], hex);
 }
 
 
-void DispHciEvt (BT_HDR *p_buf)
+inline void byte2char (const char* data, char** str)
 {
-    int i,j;
-    int nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
-    UINT8 * data = (UINT8*) p_buf;
-    int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+    **str = *data < ' ' ? '.' : *data > '~' ? '.' : *data;
+    ++(*str);
+}
 
-    if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
-        return;
 
-    if (nBytes > sizeof(log_line))
-        return;
+inline void byte2hex (const char* data, char** str)
+{
+    **str = sTable[(*data >> 4) & 0xf];
+    ++*str;
+    **str = sTable[*data & 0xf];
+    ++*str;
+}
+
 
-    for(i = 0, j = 0; i < data_len && j < sizeof(log_line)-3; i++)
+    //Decode a few Bluetooth HCI packets into hex numbers.
+    void DispHciCmd (BT_HDR *p_buf)
     {
-        log_line[j++] = sTable[(*data >> 4) & 0xf];
-        log_line[j++] = sTable[*data & 0xf];
-        data++;
+        UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
+        UINT8* data = (UINT8*) p_buf;
+        int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, data_len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, "BrcmHciX", log_line);
     }
-    log_line[j] = '\0';
 
-    __android_log_write(ANDROID_LOG_DEBUG, "BrcmHciR", log_line);
+
+    //Decode a few Bluetooth HCI packets into hex numbers.
+    void DispHciEvt (BT_HDR *p_buf)
+    {
+        UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
+        UINT8* data = (UINT8*) p_buf;
+        int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, data_len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, "BrcmHciR", log_line);
+    }
+
+
+    /*******************************************************************************
+    **
+    ** Function         DispLLCP
+    **
+    ** Description      Log LLCP packet as hex-ascii bytes.
+    **
+    ** Returns          None.
+    **
+    *******************************************************************************/
+    void DispLLCP (BT_HDR *p_buf, BOOLEAN is_recv)
+    {
+        UINT32 nBytes = ((BT_HDR_SIZE + p_buf->offset + p_buf->len)*2)+1;
+        UINT8 * data = (UINT8*) p_buf;
+        int data_len = BT_HDR_SIZE + p_buf->offset + p_buf->len;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, data_len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, (is_recv) ? "BrcmLlcpR": "BrcmLlcpX", log_line);
+    }
+
+
+    /*******************************************************************************
+    **
+    ** Function         DispHcp
+    **
+    ** Description      Log raw HCP packet as hex-ascii bytes
+    **
+    ** Returns          None.
+    **
+    *******************************************************************************/
+    void DispHcp (UINT8 *data, UINT16 len, BOOLEAN is_recv)
+    {
+        UINT32 nBytes = (len*2)+1;
+
+        if (appl_trace_level < BT_TRACE_LEVEL_DEBUG)
+            return;
+
+        // Only trace HCP if we're tracing HCI as well
+        if (!(ScrProtocolTraceFlag & SCR_PROTO_TRACE_HCI_SUMMARY))
+            return;
+
+        if (nBytes > sizeof(log_line))
+            return;
+
+        ToHex (data, len, log_line, sizeof(log_line));
+        __android_log_write (ANDROID_LOG_DEBUG, (is_recv) ? "BrcmHcpR": "BrcmHcpX", log_line);
+    }
+
+
+    void DispSNEP (UINT8 local_sap, UINT8 remote_sap, BT_HDR *p_buf, BOOLEAN is_first, BOOLEAN is_rx) {}
+    void DispCHO (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_rx) {}
+    void DispT3TagMessage(BT_HDR *p_msg, BOOLEAN is_rx) {}
+    void DispRWT4Tags (BT_HDR *p_buf, BOOLEAN is_rx) {}
+    void DispCET4Tags (BT_HDR *p_buf, BOOLEAN is_rx) {}
+    void DispRWI93Tag (BT_HDR *p_buf, BOOLEAN is_rx, UINT8 command_to_respond) {}
+    void DispNDEFMsg (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_recv) {}
+
+
+/*******************************************************************************
+**
+** Function:        LogMsg
+**
+** Description:     Print messages from NFC stack.
+**
+** Returns:         None.
+**
+*******************************************************************************/
+void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...)
+{
+    static char buffer [BTE_LOG_BUF_SIZE];
+    va_list ap;
+    UINT32 trace_type = trace_set_mask & 0x07; //lower 3 bits contain trace type
+    int android_log_type = ANDROID_LOG_INFO;
+
+    va_start (ap, fmt_str);
+    vsnprintf (buffer, BTE_LOG_MAX_SIZE, fmt_str, ap);
+    va_end (ap);
+    if (trace_type == TRACE_TYPE_ERROR)
+        android_log_type = ANDROID_LOG_ERROR;
+    __android_log_write (android_log_type, LOGMSG_TAG_NAME, buffer);
+}
+
+
+void LogMsg_0 (UINT32 maskTraceSet, const char *p_str)
+{
+    LogMsg (maskTraceSet, p_str);
+}
+
+
+void LogMsg_1 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1)
+{
+    LogMsg (maskTraceSet, fmt_str, p1);
+}
+
+
+void LogMsg_2 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2);
+}
+
+
+void LogMsg_3 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3);
+}
+
+
+void LogMsg_4 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3, p4);
+}
+
+void LogMsg_5 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3, p4, p5);
+}
+
+
+void LogMsg_6 (UINT32 maskTraceSet, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5, UINT32 p6)
+{
+    LogMsg (maskTraceSet, fmt_str, p1, p2, p3, p4, p5, p6);
 }
diff --git a/halimpl/bcm2079x/adaptation/config.cpp b/halimpl/bcm2079x/adaptation/config.cpp
index 11ef297..f847389 100644
--- a/halimpl/bcm2079x/adaptation/config.cpp
+++ b/halimpl/bcm2079x/adaptation/config.cpp
@@ -24,7 +24,6 @@
 
 #define LOG_TAG "NfcNciHal"
 
-const char alternative_config_path[] = "";
 const char transport_config_path[] = "/etc/";
 
 #define config_name             "libnfc-brcm.conf"
@@ -380,16 +379,6 @@ CNfcConfig& CNfcConfig::GetInstance()
     if (theInstance.size() == 0 && theInstance.mValidFile)
     {
         string strPath;
-        if (alternative_config_path[0] != '\0')
-        {
-            strPath.assign(alternative_config_path);
-            strPath += config_name;
-            theInstance.readConfig(strPath.c_str(), true);
-            if (!theInstance.empty())
-            {
-                return theInstance;
-        }
-        }
         strPath.assign(transport_config_path);
         strPath += config_name;
         theInstance.readConfig(strPath.c_str(), true);
@@ -739,9 +728,6 @@ void readOptionalConfig(const char* extra)
 {
     string strPath;
     strPath.assign(transport_config_path);
-    if (alternative_config_path[0] != '\0')
-        strPath.assign(alternative_config_path);
-
     strPath += extra_config_base;
     strPath += extra;
     strPath += extra_config_ext;
diff --git a/halimpl/bcm2079x/adaptation/patchram.cpp b/halimpl/bcm2079x/adaptation/patchram.cpp
index 7b693ca..955be5f 100644
--- a/halimpl/bcm2079x/adaptation/patchram.cpp
+++ b/halimpl/bcm2079x/adaptation/patchram.cpp
@@ -49,6 +49,7 @@ extern UINT8 *p_nfc_hal_dm_start_up_cfg; //defined in the HAL
 static UINT8 nfa_dm_start_up_vsc_cfg[CONFIG_MAX_LEN];
 extern UINT8 *p_nfc_hal_dm_start_up_vsc_cfg; //defined in the HAL
 extern UINT8 *p_nfc_hal_dm_lptd_cfg; //defined in the HAL
+static UINT8 sDontSendLptd[] = { 0 };
 extern UINT8 *p_nfc_hal_pre_discover_cfg; //defined in the HAL
 
 extern tSNOOZE_MODE_CONFIG gSnoozeModeCfg;
@@ -307,17 +308,15 @@ void prmCallback(UINT8 event)
 ** Returns:         None
 **
 *******************************************************************************/
-static void getNfaValues()
+static void getNfaValues (UINT32 chipid)
 {
     unsigned long num = 0;
     int actualLen = 0;
 
-    p_nfc_hal_cfg->nfc_hal_prm_nvm_required = TRUE; //don't download firmware if controller cannot detect EERPOM
     sStartupConfig.initialize ();
     sLptdConfig.initialize ();
     sPreDiscoveryConfig.initialize();
 
-
     actualLen = GetStrValue (NAME_NFA_DM_START_UP_CFG, (char*)sConfig, sizeof(sConfig));
     if (actualLen)
         sStartupConfig.append (sConfig, actualLen);
@@ -347,6 +346,11 @@ static void getNfaValues()
         sLptdConfig.append (sConfig, actualLen);
         p_nfc_hal_dm_lptd_cfg = const_cast<UINT8*> (sLptdConfig.getInternalBuffer ());
     }
+    else
+    {
+        // Default to not sending any LPTD setting.
+        p_nfc_hal_dm_lptd_cfg = sDontSendLptd;
+    }
 
     mayDisableSecureElement (sStartupConfig);
     p_nfc_hal_dm_start_up_cfg = const_cast<UINT8*> (sStartupConfig.getInternalBuffer ());
@@ -358,6 +362,28 @@ static void getNfaValues()
         mayDisableSecureElement (sPreDiscoveryConfig);
         p_nfc_hal_pre_discover_cfg = const_cast<UINT8*> (sPreDiscoveryConfig.getInternalBuffer ());
     }
+
+    //configure how many secure elements are available for each type of chip
+    if (p_nfc_hal_cfg->nfc_hal_hci_uicc_support > 0)
+    {
+        if (GetNumValue(NAME_NFA_MAX_EE_SUPPORTED, &num, sizeof(num)))
+            nfc_hal_cb.max_ee = num;
+        else if ((chipid & BRCM_NFC_GEN_MASK) == BRCM_NFC_20791_GEN)
+        {
+            nfc_hal_cb.max_ee = BRCM_NFC_20791_GEN_MAX_EE;
+            p_nfc_hal_cfg->nfc_hal_hci_uicc_support = HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST;
+        }
+        else if ((chipid & BRCM_NFC_GEN_MASK) == BRCM_NFC_43341_GEN)
+        {
+            nfc_hal_cb.max_ee = BRCM_NFC_43341_GEN_MAX_EE;
+            p_nfc_hal_cfg->nfc_hal_hci_uicc_support = HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST;
+        }
+        else if ((chipid & BRCM_NFC_GEN_MASK) == BRCM_NFC_20795_GEN)
+        {
+            nfc_hal_cb.max_ee = BRCM_NFC_20795_GEN_MAX_EE;
+            p_nfc_hal_cfg->nfc_hal_hci_uicc_support = HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST | HAL_NFC_HCI_UICC2_HOST;
+        }
+    }
 }
 
 /*******************************************************************************
@@ -380,8 +406,7 @@ static void StartPatchDownload(UINT32 chipid)
 
     readOptionalConfig(chipID);     // Read optional chip specific settings
     readOptionalConfig("fime");     // Read optional FIME specific settings
-    getNfaValues();                 // Get NFA configuration values into variables
-
+    getNfaValues(chipid);                 // Get NFA configuration values into variables
 
     findPatchramFile(FW_PATCH, sPatchFn, sizeof(sPatchFn));
     findPatchramFile(FW_PRE_PATCH, sPrePatchFn, sizeof(sPatchFn));
@@ -488,16 +513,24 @@ void nfc_hal_post_reset_init (UINT32 brcm_hw_id, UINT8 nvm_type)
 {
     ALOGD("%s: brcm_hw_id=0x%lx, nvm_type=%d", __FUNCTION__, brcm_hw_id, nvm_type);
     tHAL_NFC_STATUS stat = HAL_NFC_STATUS_FAILED;
-    UINT8 max_credits = 1;
+    UINT8 max_credits = 1, allow_no_nvm=0;
+
+    p_nfc_hal_cfg->nfc_hal_prm_nvm_required = TRUE; //don't download firmware if controller cannot detect EERPOM
 
     if (nvm_type == NCI_SPD_NVM_TYPE_NONE)
     {
+        GetNumValue(NAME_ALLOW_NO_NVM, &allow_no_nvm, sizeof(allow_no_nvm));
+        if (allow_no_nvm == 0)
+        {
         ALOGD("%s: No NVM detected, FAIL the init stage to force a retry", __FUNCTION__);
         USERIAL_PowerupDevice (0);
         stat = HAL_NfcReInit ();
+            return;
+        }
+
+        p_nfc_hal_cfg->nfc_hal_prm_nvm_required = FALSE; //allow download firmware if controller cannot detect EERPOM
     }
-    else
-    {
+
         /* Start downloading the patch files */
         StartPatchDownload(brcm_hw_id);
 
@@ -507,7 +540,6 @@ void nfc_hal_post_reset_init (UINT32 brcm_hw_id, UINT8 nvm_type)
             HAL_NfcSetMaxRfDataCredits(max_credits);
         }
     }
-}
 
 
 /*******************************************************************************
@@ -536,3 +568,41 @@ void mayDisableSecureElement (StartupConfig& config)
         config.disableSecureElement ((UINT8) (bitmask & 0xC0));
     }
 }
+
+
+/*******************************************************************************
+**
+** Function:    configureCrystalFrequency
+**
+** Description: Configure controller's crystal frequency by reading values from
+**              .conf file.  If .conf file does not define any value, then use
+**              default values defined in struct nfc_post_reset_cb.
+**
+** Returns:     none
+**
+*******************************************************************************/
+void configureCrystalFrequency ()
+{
+    unsigned long num = 0;
+    UINT32 hwId = 0;
+    UINT16 xtalFreq = 0;
+    UINT8 xtalIndex = 0;
+
+    GetNumValue (NAME_XTAL_HARDWARE_ID, &num, sizeof(num));
+    hwId = num;
+
+    GetNumValue (NAME_XTAL_FREQUENCY, &num, sizeof(num));
+    xtalFreq = (UINT16) num;
+
+    GetNumValue (NAME_XTAL_FREQ_INDEX, &num, sizeof(num));
+    xtalIndex = (UINT8) num;
+
+    if ((hwId == 0) && (xtalFreq == 0) && (xtalIndex == 0))
+        return;
+
+    ALOGD ("%s: hwId=0x%lX; freq=%u; index=%u", __FUNCTION__, hwId, xtalFreq, xtalIndex);
+    nfc_post_reset_cb.dev_init_config.xtal_cfg[0].brcm_hw_id = (hwId & BRCM_NFC_GEN_MASK);
+    nfc_post_reset_cb.dev_init_config.xtal_cfg[0].xtal_freq  = xtalFreq;
+    nfc_post_reset_cb.dev_init_config.xtal_cfg[0].xtal_index = xtalIndex;
+    nfc_post_reset_cb.dev_init_config.num_xtal_cfg = 1;
+}
diff --git a/halimpl/bcm2079x/adaptation/userial_linux.c b/halimpl/bcm2079x/adaptation/userial_linux.c
index 1a474d3..5e543cf 100644
--- a/halimpl/bcm2079x/adaptation/userial_linux.c
+++ b/halimpl/bcm2079x/adaptation/userial_linux.c
@@ -48,6 +48,7 @@
 #endif
 extern UINT8 appl_trace_level;
 
+
 /* Mapping of USERIAL_PORT_x to linux */
 extern UINT32 ScrProtocolTraceFlag;
 static tUPIO_STATE current_nfc_wake_state = UPIO_OFF;
@@ -423,10 +424,16 @@ static inline int create_signal_fds(struct pollfd* set)
 *******************************************************************************/
 static inline void close_signal_fds()
 {
-    close(signal_fds[0]);
+    int stat = 0;
+
+    stat = close(signal_fds[0]);
+    if (stat == -1)
+        ALOGE ("%s, fail close index 0; errno=%d", __FUNCTION__, errno);
     signal_fds[0] = 0;
 
-    close(signal_fds[1]);
+    stat = close(signal_fds[1]);
+    if (stat == -1)
+        ALOGE ("%s, fail close index 1; errno=%d", __FUNCTION__, errno);
     signal_fds[1] = 0;
 }
 
@@ -540,13 +547,28 @@ UDRV_API void    USERIAL_Init(void * p_cfg)
 {
     ALOGI(__FUNCTION__);
 
+    //if userial_close_thread() is waiting to run; let it go first;
+    //let it finish; then continue this function
+    while (TRUE)
+    {
+        pthread_mutex_lock(&close_thread_mutex);
+        if (is_close_thread_is_waiting)
+        {
+            pthread_mutex_unlock(&close_thread_mutex);
+            ALOGI("USERIAL_Open(): wait for close-thread");
+            sleep (1);
+        }
+        else
+            break;
+    }
+
     memset(&linux_cb, 0, sizeof(linux_cb));
     linux_cb.sock = -1;
     linux_cb.ser_cb = NULL;
     linux_cb.sock_power_control = -1;
     linux_cb.client_device_address = 0;
     GKI_init_q(&Userial_in_q);
-    return;
+    pthread_mutex_unlock(&close_thread_mutex);
 }
 
 /*******************************************************************************
@@ -652,6 +674,8 @@ int my_read(int fd, uchar *pbuf, int len)
             break;
         }
     } while (count > 0);
+
+
  #if VALIDATE_PACKET
 /*
  * vallidate the packet structure
@@ -1000,7 +1024,7 @@ UDRV_API void USERIAL_Open(tUSERIAL_PORT port, tUSERIAL_OPEN_CFG *p_cfg, tUSERIA
             GKI_send_event(NFC_HAL_TASK, NFC_HAL_TASK_EVT_TERMINATE);
             goto done_open;
         }
-        ALOGD( "sock = %d\n", linux_cb.sock);
+        ALOGD( "%s sock = %d\n", __FUNCTION__, linux_cb.sock);
         if (GetStrValue ( NAME_POWER_CONTROL_DRIVER, power_control_dev, sizeof ( power_control_dev ) ) &&
             power_control_dev[0] != '\0')
         {
@@ -1450,13 +1474,13 @@ void userial_close_thread(UINT32 params)
         GKI_delay(gPostPowerOffDelay);
     }
     result = close(linux_cb.sock);
-    if (result<0)
-        ALOGD("%s: close return %d", __FUNCTION__, result);
+    if (result == -1)
+        ALOGE("%s: fail close linux_cb.sock; errno=%d", __FUNCTION__, errno);
 
     if (linux_cb.sock_power_control > 0 && linux_cb.sock_power_control != linux_cb.sock)
     result = close(linux_cb.sock_power_control);
-    if (result<0)
-        ALOGD("%s: close return %d", __FUNCTION__, result);
+    if (result == -1)
+        ALOGE("%s: fail close linux_cb.sock_power_control; errno=%d", __FUNCTION__, errno);
 
     linux_cb.sock_power_control = -1;
     linux_cb.sock = -1;
@@ -1650,7 +1674,7 @@ UDRV_API void USERIAL_PowerupDevice(tUSERIAL_PORT port)
                 resetSuccess = 1;
                 linux_cb.client_device_address = bcmi2cnfc_client_addr;
                 /* Delay long enough for address change */
-                delay = 200;
+                delay = 100;
             }
         } else {
             resetSuccess = 1;
@@ -1693,9 +1717,12 @@ static int change_client_addr(int addr)
     /* If it fails, it is likely a B3 we are talking to */
     if (ret != size) {
         ALOGD( "change_client_addr() change addr to 0x%x by setting BSP address to 0x%x\n", addr, ALIAS_CLIENT_ADDRESS);
-        /* MACO changed to support B3 with old kernel driver */
-        ret = ioctl(linux_cb.sock, BCMNFC_CHANGE_ADDR, addr);
-        return ret;
+        /* legacy kernel */
+        ioctl(linux_cb.sock, BCMNFC_CHANGE_ADDR, addr);
+        /* We'll tweak address to make it look like 0x1FA address */
+        ret = ioctl(linux_cb.sock, BCMNFC_SET_CLIENT_ADDR, ALIAS_CLIENT_ADDRESS);
+        size++;
+        ret = write(linux_cb.sock, addr_data, size);
     }
 
     if (ret == size) {
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c b/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c
index 46ef04b..ad02144 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_dm.c
@@ -73,18 +73,6 @@ const UINT8 nfc_hal_dm_get_patch_version_cmd [NCI_MSG_HDR_SIZE] =
 };
 #define NCI_PATCH_INFO_VERSION_LEN  16  /* Length of patch version string in PATCH_INFO */
 
-/* Version string for BCM20791B3 */
-const UINT8 NFC_HAL_DM_BCM20791B3_STR[]   = "20791B3";
-#define NFC_HAL_DM_BCM20791B3_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B3_STR)-1)
-
-/* Version string for BCM20791B4 */
-const UINT8 NFC_HAL_DM_BCM20791B4_STR[]   = "20791B4";
-#define NFC_HAL_DM_BCM20791B4_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B4_STR)-1)
-
-/* Version string for BCM43341B0 */
-const UINT8 NFC_HAL_DM_BCM43341B0_STR[]   = "43341B0";
-#define NFC_HAL_DM_BCM43341B0_STR_LEN     (sizeof (NFC_HAL_DM_BCM43341B0_STR)-1)
-
 /*****************************************************************************
 ** Extern function prototypes
 *****************************************************************************/
@@ -576,25 +564,7 @@ void nfc_hal_dm_proc_msg_during_init (NFC_HDR *p_msg)
 
             STREAM_TO_ARRAY (chipverstr, p, chipverlen);
 
-            if ((chipverlen == NFC_HAL_DM_BCM20791B3_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B3_STR, chipverstr, NFC_HAL_DM_BCM20791B3_STR_LEN) == 0))
-            {
-                /* BCM2079B3 FW - eSE restarted for patch download */
-                nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
-                nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = TRUE;
-            }
-            else if (  ((chipverlen == NFC_HAL_DM_BCM20791B4_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B4_STR, chipverstr, NFC_HAL_DM_BCM20791B4_STR_LEN) == 0))
-                     ||((chipverlen == NFC_HAL_DM_BCM43341B0_STR_LEN) && (memcmp (NFC_HAL_DM_BCM43341B0_STR, chipverstr, NFC_HAL_DM_BCM43341B0_STR_LEN) == 0))  )
-            {
-                /* BCM43341B0/BCM2079B4 FW - eSE restarted for patch download */
-                nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
-                nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
-            }
-            else
-            {
-                /* BCM2079B5 FW - eSE not be restarted for patch download from UICC */
-                nfc_hal_cb.hci_cb.hci_fw_workaround         = FALSE;
-                nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
-            }
+            nfc_hal_hci_handle_build_info (chipverlen, chipverstr);
 
             /* if NFCC needs to set Xtal frequency before getting patch version */
             if (nfc_hal_dm_get_xtal_index (nfc_hal_cb.dev_cb.brcm_hw_id, &xtal_freq) < NFC_HAL_XTAL_INDEX_MAX)
@@ -988,7 +958,6 @@ void nfc_hal_dm_shutting_down_nfcc (void)
     }
 
     nfc_hal_cb.ncit_cb.nci_wait_rsp = NFC_HAL_WAIT_RSP_NONE;
-    nfc_hal_cb.hci_cb.hcp_conn_id = 0;
 
     nfc_hal_cb.dev_cb.power_mode  = NFC_HAL_POWER_MODE_FULL;
     nfc_hal_cb.dev_cb.snooze_mode = NFC_HAL_LP_SNOOZE_MODE_NONE;
@@ -997,7 +966,10 @@ void nfc_hal_dm_shutting_down_nfcc (void)
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.ncit_cb.nci_wait_rsp_timer);
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.dev_cb.lp_timer);
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.prm.timer);
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    nfc_hal_cb.hci_cb.hcp_conn_id = 0;
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.hci_cb.hci_timer);
+#endif
     nfc_hal_main_stop_quick_timer (&nfc_hal_cb.timer);
 }
 
@@ -1019,7 +991,9 @@ void nfc_hal_dm_init (void)
 
     nfc_hal_cb.ncit_cb.nci_wait_rsp_timer.p_cback = nfc_hal_nci_cmd_timeout_cback;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
     nfc_hal_cb.hci_cb.hci_timer.p_cback = nfc_hal_hci_timeout_cback;
+#endif
 
     nfc_hal_cb.pre_discover_done        = FALSE;
 
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c b/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c
index defc610..420a538 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_dm_cfg.c
@@ -148,10 +148,14 @@ tNFC_HAL_CFG nfc_hal_cfg =
                                             ** then set it to short to optimize bootup time because NFCC cannot send RESET NTF.
                                             ** Otherwise, it depends on NVM type and size of patchram.
                                             */
-    (UINT16) NFC_HAL_NFCC_ENABLE_TIMEOUT,   /* max time to wait for RESET NTF after setting Xtal frequency
+    (UINT16) NFC_HAL_NFCC_ENABLE_TIMEOUT    /* max time to wait for RESET NTF after setting Xtal frequency
                                             ** It depends on NVM type and size of patchram.
                                             */
-    (HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST)  /* Set bit(s) for supported UICC(s) */
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    ,
+    TRUE,                                   /* set nfc_hal_first_boot to TRUE, if platform enables NFC for the first time after bootup */
+    (HAL_NFC_HCI_UICC0_HOST | HAL_NFC_HCI_UICC1_HOST | HAL_NFC_HCI_UICC2_HOST)  /* Set bit(s) for supported UICC(s) */
+#endif
 };
 
 tNFC_HAL_CFG *p_nfc_hal_cfg= (tNFC_HAL_CFG *) &nfc_hal_cfg;
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c b/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c
index 0a754d1..6b573d5 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_hci.c
@@ -23,13 +23,17 @@
  *
  ******************************************************************************/
 #include "gki.h"
+#include "nfc_hal_target.h"
 #include "nfc_hal_api.h"
 #include "nfc_hal_int.h"
+
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+
 #include "nfc_hal_nv_ci.h"
 #include "nfc_hal_nv_co.h"
 
 #include <string.h>
-#include "nfc_hal_nv_co.h"
+
 
 #ifndef NFC_HAL_HCI_NV_READ_TIMEOUT
 #define NFC_HAL_HCI_NV_READ_TIMEOUT    1000
@@ -46,6 +50,21 @@
 
 #define NFC_HAL_HCI_PIPE_VALID_MASK                         0x80
 
+#define NFC_HAL_HCI_FIRST_BOOT_SESSION_ID_0_VAL             0xFF
+#define NFC_HAL_HCI_NEXT_BOOT_SESSION_ID_0_VAL              0xFE
+
+/* Version string for BCM20791B3 */
+const UINT8 NFC_HAL_DM_BCM20791B3_STR[]   = "20791B3";
+#define NFC_HAL_DM_BCM20791B3_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B3_STR)-1)
+
+/* Version string for BCM20791B4 */
+const UINT8 NFC_HAL_DM_BCM20791B4_STR[]   = "20791B4";
+#define NFC_HAL_DM_BCM20791B4_STR_LEN     (sizeof (NFC_HAL_DM_BCM20791B4_STR)-1)
+
+/* Version string for BCM43341B0 */
+const UINT8 NFC_HAL_DM_BCM43341B0_STR[]   = "43341B0";
+#define NFC_HAL_DM_BCM43341B0_STR_LEN     (sizeof (NFC_HAL_DM_BCM43341B0_STR)-1)
+
 extern tNFC_HAL_CFG *p_nfc_hal_cfg;
 /****************************************************************************
 ** Internal function prototypes
@@ -72,10 +91,10 @@ void nfc_hal_hci_evt_hdlr (tNFC_HAL_HCI_EVENT_DATA *p_evt_data)
     switch (p_evt_data->hdr.event)
     {
     case NFC_HAL_HCI_RSP_NV_READ_EVT:
-        if (  (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf && (p_evt_data->nv_read.block == HC_F3_NV_BLOCK || p_evt_data->nv_read.block == HC_F4_NV_BLOCK))
+        if (  (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf && (p_evt_data->nv_read.block == HC_F3_NV_BLOCK || p_evt_data->nv_read.block == HC_F4_NV_BLOCK || p_evt_data->nv_read.block == HC_F5_NV_BLOCK))
             ||(nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf && p_evt_data->nv_read.block == HC_F2_NV_BLOCK)  )
         {
-        nfc_hal_hci_handle_nv_read (p_evt_data->nv_read.block, p_evt_data->nv_read.status, p_evt_data->nv_read.size);
+            nfc_hal_hci_handle_nv_read (p_evt_data->nv_read.block, p_evt_data->nv_read.status, p_evt_data->nv_read.size);
         }
         else
         {
@@ -131,7 +150,8 @@ void nfc_hal_hci_enable (void)
     }
 
     if (  (p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC0_HOST)
-        ||((p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC1_HOST) && ((!nfc_hal_cb.hci_cb.hci_fw_workaround) || (nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_EEPROM)))  )
+        ||((p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC1_HOST) && ((!nfc_hal_cb.hci_cb.hci_fw_workaround) || (nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_EEPROM)))
+        ||(p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC2_HOST)  )
     {
         if ((p_hci_netwk_cmd = (UINT8 *) GKI_getbuf (NCI_MSG_HDR_SIZE + NFC_HAL_HCI_NETWK_INFO_SIZE)) == NULL)
         {
@@ -165,6 +185,40 @@ void nfc_hal_hci_enable (void)
 
 /*******************************************************************************
 **
+** Function         nfc_hal_hci_handle_build_info
+**
+** Description      handle build info evt
+**
+** Returns          void
+**
+*******************************************************************************/
+void nfc_hal_hci_handle_build_info (UINT8 chipverlen, UINT8 *p_chipverstr)
+{
+    HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_build_info ()");
+
+    if ((chipverlen == NFC_HAL_DM_BCM20791B3_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B3_STR, p_chipverstr, NFC_HAL_DM_BCM20791B3_STR_LEN) == 0))
+    {
+        /* BCM2079B3 FW - eSE restarted for patch download */
+        nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
+        nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = TRUE;
+    }
+    else if (  ((chipverlen == NFC_HAL_DM_BCM20791B4_STR_LEN) && (memcmp (NFC_HAL_DM_BCM20791B4_STR, p_chipverstr, NFC_HAL_DM_BCM20791B4_STR_LEN) == 0))
+             ||((chipverlen == NFC_HAL_DM_BCM43341B0_STR_LEN) && (memcmp (NFC_HAL_DM_BCM43341B0_STR, p_chipverstr, NFC_HAL_DM_BCM43341B0_STR_LEN) == 0))  )
+    {
+        /* BCM43341B0/BCM2079B4 FW - eSE restarted for patch download */
+        nfc_hal_cb.hci_cb.hci_fw_workaround         = TRUE;
+        nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
+    }
+    else
+    {
+        /* BCM2079B5 FW - eSE not be restarted for patch download from UICC */
+        nfc_hal_cb.hci_cb.hci_fw_workaround         = FALSE;
+        nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd = FALSE;
+    }
+}
+
+/*******************************************************************************
+**
 ** Function         nfc_hal_hci_handle_hci_netwk_info
 **
 ** Description      Handler function for HCI Network Notification
@@ -176,8 +230,9 @@ void nfc_hal_hci_handle_hci_netwk_info (UINT8 *p_data)
 {
     UINT8  *p = p_data;
     UINT16 data_len;
-    UINT8  target_handle;
-    UINT8   hci_netwk_cmd[1 + NFC_HAL_HCI_SESSION_ID_LEN];
+    UINT8  target_handle = 0;
+    UINT8  hci_netwk_cmd[1 + NFC_HAL_HCI_SESSION_ID_LEN];
+    UINT8  block = 0;
 
     HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_hci_netwk_info ()");
 
@@ -188,46 +243,46 @@ void nfc_hal_hci_handle_hci_netwk_info (UINT8 *p_data)
     target_handle = *(UINT8 *) p;
 
     if (target_handle == NFC_HAL_HCI_DH_TARGET_HANDLE)
+    {
+        /* Correct the session id assigned by DH */
+        *(p+1) = nfc_hal_cb.hci_cb.dh_session_id[0];
         nfc_hal_nv_co_write (p, data_len, HC_F2_NV_BLOCK);
+        return;
+    }
 
-    else if (target_handle == NFC_HAL_HCI_UICC0_TARGET_HANDLE)
+    if (target_handle == NFC_HAL_HCI_UICC0_TARGET_HANDLE)
     {
-        if (  (!nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_B_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_BP_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_F_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)  )
-        {
-            /* HCI Network notification received for UICC 0, Update nv data */
-            nfc_hal_nv_co_write (p, data_len,HC_F3_NV_BLOCK);
-        }
-        else
-        {
-            HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Type A Card Emulation invalid, Reset nv file: 0x%02x", p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET]);
-            hci_netwk_cmd[0] = NFC_HAL_HCI_UICC0_TARGET_HANDLE;
-            memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-            nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F3_NV_BLOCK);
-        }
+        block = HC_F3_NV_BLOCK;
     }
     else if (target_handle == NFC_HAL_HCI_UICC1_TARGET_HANDLE)
     {
-        if (  (!nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_B_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_BP_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
-            ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_F_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)  )
-        {
-            /* HCI Network notification received for UICC 1, Update nv data */
-            nfc_hal_nv_co_write (p, data_len,HC_F4_NV_BLOCK);
-        }
-        else
-        {
-            HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Type A Card Emulation invalid, Reset nv file: 0x%02x", p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET]);
-            hci_netwk_cmd[0] = NFC_HAL_HCI_UICC1_TARGET_HANDLE;
-            /* Reset Session ID */
-            memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-            nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F4_NV_BLOCK);
-        }
+        block = HC_F4_NV_BLOCK;
+    }
+    else if (target_handle == NFC_HAL_HCI_UICC2_TARGET_HANDLE)
+    {
+        block = HC_F5_NV_BLOCK;
+    }
+    else
+    {
+        HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Invalid Target handle: 0x%02x", target_handle);
+        return;
+    }
+
+    if (  (!nfc_hal_cb.hci_cb.hci_fw_validate_netwk_cmd)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_B_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_BP_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)
+        ||(p[NFC_HAL_HCI_NETWK_CMD_TYPE_F_CE_PIPE_INFO_OFFSET] & NFC_HAL_HCI_PIPE_VALID_MASK)  )
+    {
+        /* HCI Network notification received for UICC0/UICC1/UICC2, Update nv data */
+        nfc_hal_nv_co_write (p, data_len, block);
+    }
+    else
+    {
+        HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hci_netwk_info(): Type A Card Emulation invalid, Reset nv file: 0x%02x", p[NFC_HAL_HCI_NETWK_CMD_TYPE_A_CE_PIPE_INFO_OFFSET]);
+        hci_netwk_cmd[0] = target_handle;
+        memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
+        nfc_hal_nv_co_write (hci_netwk_cmd, 1, block);
     }
 }
 
@@ -298,13 +353,6 @@ BOOLEAN nfc_hal_hci_handle_hcp_pkt_to_hc (UINT8 *p_data)
 
     HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_hcp_pkt_to_hc ()");
 
-    if (  (!nfc_hal_cb.hci_cb.hci_fw_workaround)
-        ||(nfc_hal_cb.nvm_cb.nvm_type != NCI_SPD_NVM_TYPE_UICC)  )
-    {
-        /* Do nothing, just forward the stack hcp packet to host controller */
-        return FALSE;
-    }
-
     chaining_bit = ((*p_data) >> 0x07) & 0x01;
     pipe = (*p_data++) & 0x7F;
 
@@ -316,21 +364,46 @@ BOOLEAN nfc_hal_hci_handle_hcp_pkt_to_hc (UINT8 *p_data)
         if (type == NFC_HAL_HCI_COMMAND_TYPE)
         {
             inst  = (*p_data++ & 0x3F);
-            if (inst == NFC_HAL_HCI_ANY_SET_PARAMETER)
+            if (inst == NFC_HAL_HCI_ANY_GET_PARAMETER)
             {
                 index = *(p_data++);
-                if (index == NFC_HAL_HCI_WHITELIST_INDEX)
+                if (index == NFC_HAL_HCI_SESSION_IDENTITY_INDEX)
                 {
-                    /* Set flag to fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd to nfc task after
-                     * response from host controller to set whitelist cmd
+                    /* Set flag to modify session id[0] on response
+                     * from host controller to set session id cmd
                      */
-                    nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1 = TRUE;
+                    nfc_hal_cb.hci_cb.update_session_id = TRUE;
+                }
+            }
+            else if (inst == NFC_HAL_HCI_ANY_SET_PARAMETER)
+            {
+                index = *(p_data++);
+                if (index == NFC_HAL_HCI_WHITELIST_INDEX)
+                {
+                    if (  (nfc_hal_cb.hci_cb.hci_fw_workaround)
+                        &&(nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_UICC)  )
+                    {
+                        /* Set flag to fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd to nfc task after
+                         * response from host controller to set whitelist cmd
+                         */
+                        nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1 = TRUE;
+                    }
+                }
+                else if (index == NFC_HAL_HCI_SESSION_IDENTITY_INDEX)
+                {
+                    nfc_hal_cb.hci_cb.dh_session_id[0] = *p_data;
+                    if (p_nfc_hal_cfg->nfc_hal_first_boot)
+                        *p_data = NFC_HAL_HCI_FIRST_BOOT_SESSION_ID_0_VAL;
+                    else
+                        *p_data = NFC_HAL_HCI_NEXT_BOOT_SESSION_ID_0_VAL;
                 }
             }
         }
         else if (type == NFC_HAL_HCI_RESPONSE_TYPE)
         {
-            if (nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)
+            if (  (nfc_hal_cb.hci_cb.hci_fw_workaround)
+                &&(nfc_hal_cb.nvm_cb.nvm_type == NCI_SPD_NVM_TYPE_UICC)
+                &&(nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)  )
             {
                 /* Got response to the fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd sent by HAL to nfc task */
                 nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1 =  FALSE;
@@ -360,12 +433,10 @@ void nfc_hal_hci_handle_hcp_pkt_from_hc (UINT8 *p_data)
     UINT8   inst;
     UINT8   hci_netwk_cmd[1 + NFC_HAL_HCI_SESSION_ID_LEN];
     UINT8   source_host;
+    UINT8   block = 0;
 
     HAL_TRACE_DEBUG0 ("nfc_hal_hci_handle_hcp_pkt_from_hc ()");
 
-    if (!nfc_hal_cb.hci_cb.hci_fw_workaround)
-        return;
-
     chaining_bit = ((*p_data) >> 0x07) & 0x01;
     pipe = (*p_data++) & 0x7F;
 
@@ -376,35 +447,54 @@ void nfc_hal_hci_handle_hcp_pkt_from_hc (UINT8 *p_data)
 
         if (type == NFC_HAL_HCI_COMMAND_TYPE)
         {
+            if (!nfc_hal_cb.hci_cb.hci_fw_workaround)
+                return;
+
             inst  = (*p_data++ & 0x3F);
 
             if (inst == NFC_HAL_HCI_ADM_NOTIFY_ALL_PIPE_CLEARED)
             {
-
                 STREAM_TO_UINT8 (source_host, p_data);
 
                 HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Received ADM_NOTIFY_ALL_PIPE_CLEARED command for UICC: 0x%02x", source_host);
                 if (source_host == NFC_HAL_HCI_HOST_ID_UICC0)
                 {
+                    block            = HC_F3_NV_BLOCK;
                     hci_netwk_cmd[0] = NFC_HAL_HCI_UICC0_TARGET_HANDLE;
-                    /* Reset Session ID */
-                    memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-                    nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F3_NV_BLOCK);
-                    HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Sent command to reset nv file for block: 0x%02x", HC_F3_NV_BLOCK);
                 }
                 else if (source_host == NFC_HAL_HCI_HOST_ID_UICC1)
                 {
+                    block            = HC_F4_NV_BLOCK;
                     hci_netwk_cmd[0] = NFC_HAL_HCI_UICC1_TARGET_HANDLE;
+                }
+                else if (source_host == NFC_HAL_HCI_HOST_ID_UICC2)
+                {
+                    block            = HC_F5_NV_BLOCK;
+                    hci_netwk_cmd[0] = NFC_HAL_HCI_UICC2_TARGET_HANDLE;
+                }
+
+                if (source_host >= NFC_HAL_HCI_HOST_ID_UICC0)
+                {
                     /* Reset Session ID */
                     memset (&hci_netwk_cmd[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
-                    nfc_hal_nv_co_write (hci_netwk_cmd, 1, HC_F4_NV_BLOCK);
-                    HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Sent command to reset nv file for block: 0x%02x", HC_F4_NV_BLOCK);
+                    nfc_hal_nv_co_write (hci_netwk_cmd, 1, block);
+                    HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_hcp_pkt_from_hc (): Sent command to reset nv file for block: 0x%02x", block);
                 }
             }
         }
         else if (type == NFC_HAL_HCI_RESPONSE_TYPE)
         {
-            if (nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)
+            if (nfc_hal_cb.hci_cb.update_session_id)
+            {
+                nfc_hal_cb.hci_cb.update_session_id = FALSE;
+                inst  = (*p_data++ & 0x3F);
+                if (inst == NFC_HAL_HCI_ANY_OK)
+                {
+                    /* Correct the session id assigned by DH */
+                    *p_data = nfc_hal_cb.hci_cb.dh_session_id[0];
+                }
+            }
+            else if (nfc_hal_cb.hci_cb.clear_all_pipes_to_uicc1)
             {
                 /* NVM Type is UICC and got response from host controller
                  * to Set whitelist command. Now fake ADM_NOTIFY_ALL_PIPE_CLEARED cmd to
@@ -439,6 +529,7 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
     {
     case HC_F3_NV_BLOCK:
     case HC_F4_NV_BLOCK:
+    case HC_F5_NV_BLOCK:
         if (  (status != HAL_NFC_STATUS_OK)
             ||(size > NFC_HAL_HCI_NETWK_INFO_SIZE)
             ||(size < NFC_HAL_HCI_MIN_NETWK_INFO_SIZE)
@@ -446,7 +537,13 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
         {
             HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_nv_read: Invalid data from nv memory, Set DEFAULT Configuration for block:0x%02x", block);
             memset (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf, 0, NFC_HAL_HCI_NETWK_INFO_SIZE);
-            nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = (block == HC_F3_NV_BLOCK) ? NFC_HAL_HCI_UICC0_TARGET_HANDLE : NFC_HAL_HCI_UICC1_TARGET_HANDLE;
+            if (block == HC_F3_NV_BLOCK)
+                nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = NFC_HAL_HCI_UICC0_TARGET_HANDLE;
+            else if (block == HC_F4_NV_BLOCK)
+                nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = NFC_HAL_HCI_UICC1_TARGET_HANDLE;
+            else
+                nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[0] = NFC_HAL_HCI_UICC2_TARGET_HANDLE;
+
             memset (&nfc_hal_cb.hci_cb.p_hci_netwk_info_buf[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
             size = NFC_HAL_HCI_NETWK_INFO_SIZE;
         }
@@ -455,15 +552,21 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
         break;
 
     case HC_F2_NV_BLOCK:
+        nfc_hal_cb.hci_cb.dh_session_id[0] = nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1];
+        if (p_nfc_hal_cfg->nfc_hal_first_boot)
+            nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1] = NFC_HAL_HCI_FIRST_BOOT_SESSION_ID_0_VAL;
+        else
+            nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1] = NFC_HAL_HCI_NEXT_BOOT_SESSION_ID_0_VAL;
 
         if (  (status != HAL_NFC_STATUS_OK)
             ||(size > NFC_HAL_HCI_DH_NETWK_INFO_SIZE)
             ||(size < NFC_HAL_HCI_MIN_DH_NETWK_INFO_SIZE)  )
         {
             HAL_TRACE_DEBUG1 ("nfc_hal_hci_handle_nv_read: Invalid data from nv memory, Set DEFAULT Configuration for block:0x%02x", block);
-            memset (nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf, 0, NFC_HAL_HCI_DH_NETWK_INFO_SIZE);
             nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[0] = NFC_HAL_HCI_DH_TARGET_HANDLE;
-            memset (&nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[1], 0xFF, NFC_HAL_HCI_SESSION_ID_LEN);
+            nfc_hal_cb.hci_cb.dh_session_id[0] = 0xFF;
+            memset (&nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf[2], 0xFF, (NFC_HAL_HCI_SESSION_ID_LEN - 1));
+            memset ((nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf + NFC_HAL_HCI_SESSION_ID_LEN + 1), 0, (NFC_HAL_HCI_DH_NETWK_INFO_SIZE - NFC_HAL_HCI_SESSION_ID_LEN - 1));
             size = NFC_HAL_HCI_DH_NETWK_INFO_SIZE;
             p_hci_netwk_info = (UINT8 *) nfc_hal_cb.hci_cb.p_hci_netwk_dh_info_buf - NCI_MSG_HDR_SIZE;
         }
@@ -486,15 +589,15 @@ void nfc_hal_hci_handle_nv_read (UINT8 block, tHAL_NFC_STATUS status, UINT16 siz
         return;
     }
 
-        p = p_hci_netwk_info;
-        /* Send HCI Network ntf command using nv data */
-        NCI_MSG_BLD_HDR0 (p, NCI_MT_CMD, NCI_GID_PROP);
-        NCI_MSG_BLD_HDR1 (p, NCI_MSG_HCI_NETWK);
-        UINT8_TO_STREAM (p, (UINT8) size);
+    p = p_hci_netwk_info;
+    /* Send HCI Network ntf command using nv data */
+    NCI_MSG_BLD_HDR0 (p, NCI_MT_CMD, NCI_GID_PROP);
+    NCI_MSG_BLD_HDR1 (p, NCI_MSG_HCI_NETWK);
+    UINT8_TO_STREAM (p, (UINT8) size);
 
-        nfc_hal_dm_send_nci_cmd (p_hci_netwk_info, (UINT16) (NCI_MSG_HDR_SIZE + size), nfc_hal_hci_vsc_cback);
+    nfc_hal_dm_send_nci_cmd (p_hci_netwk_info, (UINT16) (NCI_MSG_HDR_SIZE + size), nfc_hal_hci_vsc_cback);
 
-        nfc_hal_cb.hci_cb.hci_netwk_config_block = block;
+    nfc_hal_cb.hci_cb.hci_netwk_config_block = block;
 }
 
 /*******************************************************************************
@@ -606,6 +709,18 @@ void nfc_hal_hci_set_next_hci_netwk_config (UINT8 block)
         HAL_TRACE_DEBUG2 ("nfc_hal_hci_set_next_hci_netwk_config (): Skip send F4 HCI NETWK CMD for UICC Mask: 0x%02x & NVM Type: 0x%02x", p_nfc_hal_cfg->nfc_hal_hci_uicc_support, nfc_hal_cb.nvm_cb.nvm_type);
 
     case HC_F4_NV_BLOCK:
+        if (  (p_nfc_hal_cfg->nfc_hal_hci_uicc_support & HAL_NFC_HCI_UICC2_HOST)
+            &&(nfc_hal_cb.hci_cb.p_hci_netwk_info_buf)  )
+        {
+            /* Send command to read nvram data for 0xF5 */
+            memset (nfc_hal_cb.hci_cb.p_hci_netwk_info_buf, 0, NFC_HAL_HCI_NETWK_INFO_SIZE);
+            nfc_hal_nv_co_read ((UINT8 *) nfc_hal_cb.hci_cb.p_hci_netwk_info_buf, NFC_HAL_HCI_NETWK_INFO_SIZE, HC_F5_NV_BLOCK);
+            nfc_hal_main_start_quick_timer (&nfc_hal_cb.hci_cb.hci_timer, NFC_HAL_HCI_VSC_TIMEOUT_EVT, NFC_HAL_HCI_NV_READ_TIMEOUT);
+            break;
+        }
+        HAL_TRACE_DEBUG2 ("nfc_hal_hci_set_next_hci_netwk_config (): Skip send F5 HCI NETWK CMD for UICC Mask: 0x%02x & NVM Type: 0x%02x", p_nfc_hal_cfg->nfc_hal_hci_uicc_support, nfc_hal_cb.nvm_cb.nvm_type);
+
+    case HC_F5_NV_BLOCK:
         if ((p_hci_netwk_cmd = (UINT8 *) GKI_getbuf (NCI_MSG_HDR_SIZE + NFC_HAL_HCI_DH_NETWK_INFO_SIZE)) == NULL)
         {
             HAL_TRACE_ERROR0 ("nfc_hal_hci_set_next_hci_netwk_config: unable to allocate buffer for reading hci network info from nvram");
@@ -665,6 +780,7 @@ static void nfc_hal_hci_vsc_cback (tNFC_HAL_NCI_EVT event, UINT16 data_len, UINT
     {
     case HC_F3_NV_BLOCK:
     case HC_F4_NV_BLOCK:
+    case HC_F5_NV_BLOCK:
     case HC_F2_NV_BLOCK:
         nfc_hal_hci_set_next_hci_netwk_config (nfc_hal_cb.hci_cb.hci_netwk_config_block);
         break;
@@ -697,3 +813,5 @@ void nfc_hal_hci_timeout_cback (void *p_tle)
     }
 }
 
+#endif
+
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c b/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c
index 4ec5f5d..49236f9 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_hci_ci.c
@@ -26,6 +26,8 @@
 #include "gki.h"
 #include "nfc_hal_api.h"
 #include "nfc_hal_int.h"
+
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
 #include "nfc_hal_nv_ci.h"
 #include "nfc_hal_nv_co.h"
 
@@ -88,3 +90,4 @@ void nfc_hal_nv_ci_write (tNFC_HAL_NV_CO_STATUS status)
     }
 }
 
+#endif
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_main.c b/halimpl/bcm2079x/hal/hal/nfc_hal_main.c
index 10be44d..d7fc5d5 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_main.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_main.c
@@ -502,9 +502,12 @@ static void nfc_hal_send_credit_ntf_for_cid (UINT8 cid)
 *******************************************************************************/
 static void nfc_hal_main_send_message (NFC_HDR *p_msg)
 {
-    UINT8   *ps, *pp, cid, pbf;
-    UINT16  len = p_msg->len;
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    UINT8   cid, pbf;
     UINT16  data_len;
+#endif
+    UINT8   *ps, *pp;
+    UINT16  len = p_msg->len;
 #ifdef DISP_NCI
     UINT8   delta;
 #endif
@@ -530,6 +533,8 @@ static void nfc_hal_main_send_message (NFC_HDR *p_msg)
         delta = p_msg->len - len;
         DISP_NCI (ps + delta, (UINT16) (p_msg->len - delta), FALSE);
 #endif
+
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
         if (nfc_hal_cb.hci_cb.hcp_conn_id)
         {
             NCI_DATA_PRS_HDR(pp, pbf, cid, data_len);
@@ -545,6 +550,8 @@ static void nfc_hal_main_send_message (NFC_HDR *p_msg)
             }
 
         }
+#endif
+
         /* check low power mode state */
         if (nfc_hal_dm_power_mode_execute (NFC_HAL_LP_TX_DATA_EVT))
         {
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c b/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c
index 21d0458..f3547d3 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_nci.c
@@ -316,7 +316,8 @@ static BOOLEAN nfc_hal_nci_receive_bt_msg (tNFC_HAL_NCIT_CB *p_cb, UINT8 byte)
             p_cb->rcv_len = byte;
 
             /* Verify that buffer is big enough to fit message */
-            if ((sizeof (NFC_HDR) + HCIE_PREAMBLE_SIZE + byte) > GKI_get_buf_size (p_cb->p_rcv_msg))
+            if ((p_cb->p_rcv_msg) &&
+                ((sizeof (NFC_HDR) + HCIE_PREAMBLE_SIZE + byte) > GKI_get_buf_size (p_cb->p_rcv_msg))  )
             {
                 /* Message cannot fit into buffer */
                 GKI_freebuf (p_cb->p_rcv_msg);
@@ -523,10 +524,13 @@ BOOLEAN nfc_hal_nci_receive_msg (UINT8 byte)
 *******************************************************************************/
 BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
 {
-    UINT8 *p, *pp, cid;
+    UINT8 *p, *pp;
     UINT8 mt, pbf, gid, op_code;
     UINT8 payload_len;
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
+    UINT8  cid;
     UINT16 data_len;
+#endif
 
     HAL_TRACE_DEBUG0 ("nfc_hal_nci_preproc_rx_nci_msg()");
 
@@ -545,6 +549,7 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
         NCI_MSG_PRS_HDR1 (p, op_code);
         payload_len = *p++;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
         if (mt == NCI_MT_DATA)
         {
             if (nfc_hal_cb.hci_cb.hcp_conn_id)
@@ -568,7 +573,9 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
                 }
             }
         }
-        else if (gid == NCI_GID_RF_MANAGE)
+        else
+#endif
+        if (gid == NCI_GID_RF_MANAGE)
         {
             if (mt == NCI_MT_NTF)
             {
@@ -587,6 +594,7 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
                 }
             }
         }
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
         else if (gid == NCI_GID_CORE)
         {
             if (mt == NCI_MT_RSP)
@@ -604,6 +612,7 @@ BOOLEAN nfc_hal_nci_preproc_rx_nci_msg (NFC_HDR *p_msg)
                 }
             }
         }
+#endif
     }
 
     if (nfc_hal_cb.dev_cb.power_mode == NFC_HAL_POWER_MODE_FULL)
@@ -649,6 +658,7 @@ void nfc_hal_nci_add_nfc_pkt_type (NFC_HDR *p_msg)
     }
 }
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
 /*******************************************************************************
 **
 ** Function         nci_brcm_check_cmd_create_hcp_connection
@@ -698,6 +708,8 @@ static void nci_brcm_check_cmd_create_hcp_connection (NFC_HDR *p_msg)
     }
 }
 
+#endif
+
 /*******************************************************************************
 **
 ** Function         nfc_hal_nci_send_cmd
@@ -718,9 +730,11 @@ void nfc_hal_nci_send_cmd (NFC_HDR *p_buf)
     UINT8   nci_ctrl_size = nfc_hal_cb.ncit_cb.nci_ctrl_size;
     UINT8   delta = 0;
 
+#if (defined(NFC_HAL_HCI_INCLUDED) && (NFC_HAL_HCI_INCLUDED == TRUE))
     if (  (nfc_hal_cb.hci_cb.hcp_conn_id == 0)
         &&(nfc_hal_cb.nvm_cb.nvm_type != NCI_SPD_NVM_TYPE_NONE)  )
         nci_brcm_check_cmd_create_hcp_connection ((NFC_HDR*) p_buf);
+#endif
 
     /* check low power mode state */
     continue_to_process = nfc_hal_dm_power_mode_execute (NFC_HAL_LP_TX_DATA_EVT);
diff --git a/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c b/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c
index ee9cea7..7c22a79 100644
--- a/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c
+++ b/halimpl/bcm2079x/hal/hal/nfc_hal_prm.c
@@ -380,7 +380,7 @@ void nfc_hal_prm_spd_check_version (void)
 
         /*********************************************************************
         * Version check of patchfile against NVM
-        ********************************************************************
+        *********************************************************************/
         /* Download the patchfile if no patches in NVM */
         if ((nfc_hal_cb.nvm_cb.project_id == 0) || !(nfc_hal_cb.nvm_cb.flags & NFC_HAL_NVM_FLAGS_PATCH_PRESENT))
         {
@@ -402,7 +402,7 @@ void nfc_hal_prm_spd_check_version (void)
         /* Skip download if version of patchfile is equal to version in NVM */
         /*                  and patches of the power modes are the same as the good patches in NVM */
         else if (  (nfc_hal_cb.nvm_cb.ver_major == patchfile_ver_major)
-                 &&(nfc_hal_cb.nvm_cb.ver_minor == patchfile_ver_minor)
+            &&(nfc_hal_cb.nvm_cb.ver_minor == patchfile_ver_minor)
                  &&((nvm_patch_present_mask | patchfile_patch_present_mask) == nvm_patch_present_mask)  ) /* if the NVM patch include all the patched in file */
         {
             HAL_TRACE_DEBUG2 ("Patch download skipped. NVM patch (version %i.%i) is the same than the patchfile ",
@@ -598,15 +598,9 @@ void nfc_hal_prm_nci_command_complete_cback (tNFC_HAL_NCI_EVT event, UINT16 data
         if (nfc_hal_cb.prm.flags & NFC_HAL_PRM_FLAGS_SIGNATURE_SENT)
         {
             /* Wait for authentication complete (SECURE_PATCH_DOWNLOAD NTF), including time to commit to NVM (for BCM43341B0) */
-            int auth_delay = NFC_HAL_PRM_SPD_TOUT;
-            if (!(nfc_hal_cb.prm.flags & NFC_HAL_PRM_FLAGS_BCM20791B3))
-            {
-                /* XXX maco only wait 30 seconds for B4+ revisions to avoid watchdog timeouts */
-                auth_delay = NFC_HAL_PRM_COMMIT_DELAY;
-            }
             nfc_hal_cb.prm.state = NFC_HAL_PRM_ST_SPD_AUTHENTICATING;
             nfc_hal_main_start_quick_timer (&nfc_hal_cb.prm.timer, 0x00,
-                                            (auth_delay * QUICK_TIMER_TICKS_PER_SEC) / 1000);
+                                            (NFC_HAL_PRM_COMMIT_DELAY * QUICK_TIMER_TICKS_PER_SEC) / 1000);
             return;
         }
         /* Download next segment */
diff --git a/halimpl/bcm2079x/include/StartupConfig.h b/halimpl/bcm2079x/include/StartupConfig.h
index 137371c..e56a83c 100644
--- a/halimpl/bcm2079x/include/StartupConfig.h
+++ b/halimpl/bcm2079x/include/StartupConfig.h
@@ -65,20 +65,6 @@ public:
     ** Description:     Append new config data to internal buffer.
     **                  newContent: buffer containing new content; newContent[0] is
     **                          payload length; newContent[1..end] is payload.
-    **
-    ** Returns:         True if ok.
-    **
-    *******************************************************************************/
-    bool append (const UINT8* newContent);
-
-
-    /*******************************************************************************
-    **
-    ** Function:        append
-    **
-    ** Description:     Append new config data to internal buffer.
-    **                  newContent: buffer containing new content; newContent[0] is
-    **                          payload length; newContent[1..end] is payload.
     **                  newContentLen: total length of newContent.
     **
     ** Returns:         True if ok.
diff --git a/halimpl/bcm2079x/include/android_logmsg.h b/halimpl/bcm2079x/include/android_logmsg.h
new file mode 100644
index 0000000..9922893
--- /dev/null
+++ b/halimpl/bcm2079x/include/android_logmsg.h
@@ -0,0 +1,65 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2011-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+/******************************************************************************
+ * Decode NFC packets and print them to ADB log.
+ * If protocol decoder is not present, then decode packets into hex numbers.
+ ******************************************************************************/
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+
+#include "data_types.h"
+
+
+#define DISP_NCI    ProtoDispAdapterDisplayNciPacket
+void ProtoDispAdapterDisplayNciPacket (UINT8* nciPacket, UINT16 nciPacketLen, BOOLEAN is_recv);
+void ProtoDispAdapterUseRawOutput (BOOLEAN isUseRaw);
+void ScrLog (UINT32 trace_set_mask, const char* fmt_str, ...);
+void LogMsg (UINT32 trace_set_mask, const char *fmt_str, ...);
+void LogMsg_0 (UINT32 trace_set_mask, const char *p_str);
+void LogMsg_1 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1);
+void LogMsg_2 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2);
+void LogMsg_3 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3);
+void LogMsg_4 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4);
+void LogMsg_5 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5);
+void LogMsg_6 (UINT32 trace_set_mask, const char *fmt_str, UINT32 p1, UINT32 p2, UINT32 p3, UINT32 p4, UINT32 p5, UINT32 p6);
+UINT8* scru_dump_hex (UINT8* p, char* pTitle, UINT32 len, UINT32 layer, UINT32 type);
+void BTDISP_LOCK_LOG();
+void BTDISP_UNLOCK_LOG();
+void BTDISP_INIT_LOCK();
+void BTDISP_UNINIT_LOCK();
+void DispHciCmd (BT_HDR* p_buf);
+void DispHciEvt (BT_HDR* p_buf);
+void DispLLCP (BT_HDR *p_buf, BOOLEAN is_recv);
+void DispHcp (UINT8 *data, UINT16 len, BOOLEAN is_recv);
+void DispSNEP (UINT8 local_sap, UINT8 remote_sap, BT_HDR *p_buf, BOOLEAN is_first, BOOLEAN is_rx);
+void DispCHO (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_rx);
+void DispT3TagMessage(BT_HDR *p_msg, BOOLEAN is_rx);
+void DispRWT4Tags (BT_HDR *p_buf, BOOLEAN is_rx);
+void DispCET4Tags (BT_HDR *p_buf, BOOLEAN is_rx);
+void DispRWI93Tag (BT_HDR *p_buf, BOOLEAN is_rx, UINT8 command_to_respond);
+void DispNDEFMsg (UINT8 *pMsg, UINT32 MsgLen, BOOLEAN is_recv);
+
+
+
+#ifdef __cplusplus
+};
+#endif
diff --git a/halimpl/bcm2079x/include/buildcfg.h b/halimpl/bcm2079x/include/buildcfg.h
index c49bb60..32cf681 100644
--- a/halimpl/bcm2079x/include/buildcfg.h
+++ b/halimpl/bcm2079x/include/buildcfg.h
@@ -31,7 +31,9 @@ extern "C" {
 
 extern UINT8 *scru_dump_hex (UINT8 *p, char *p_title, UINT32 len, UINT32 trace_layer, UINT32 trace_type);
 void DispNci (UINT8 *p, UINT16 len, BOOLEAN is_recv);
-#define DISP_NCI	(DispNci)
+void ProtoDispAdapterDisplayNciPacket (UINT8* nciPacket, UINT16 nciPacketLen, BOOLEAN is_recv);
+#define DISP_NCI    ProtoDispAdapterDisplayNciPacket
+#define LOGMSG_TAG_NAME "NfcNciHal"
 
 
 #ifdef	__cplusplus
diff --git a/halimpl/bcm2079x/include/buildcfg_hal.h b/halimpl/bcm2079x/include/buildcfg_hal.h
index cd21c2c..a8136b7 100644
--- a/halimpl/bcm2079x/include/buildcfg_hal.h
+++ b/halimpl/bcm2079x/include/buildcfg_hal.h
@@ -18,7 +18,6 @@
 //override any HAL-specific macros
 #pragma once
 
-
 #include "bt_types.h"
 
 //NFC_HAL_TASK=0 is already defined in gki_hal_target.h; it executes the Broadcom HAL
diff --git a/halimpl/bcm2079x/nfc_nci.c b/halimpl/bcm2079x/nfc_nci.c
index b401a59..5c0564f 100644
--- a/halimpl/bcm2079x/nfc_nci.c
+++ b/halimpl/bcm2079x/nfc_nci.c
@@ -111,6 +111,7 @@ static int hal_get_max_nfcee (const struct nfc_nci_device *p_dev, uint8_t* maxNf
     return retval;
 }
 
+
 /*************************************
  * Generic device handling.
  *************************************/
@@ -149,8 +150,7 @@ static int nfc_open (const hw_module_t* module, const char* name, hw_device_t**
         dev->nci_device.close = hal_close;
         dev->nci_device.control_granted = hal_control_granted;
         dev->nci_device.power_cycle = hal_power_cycle;
-        // TODO maco commented out for binary HAL compatibility
-        // dev->nci_device.get_max_ee = hal_get_max_nfcee;
+        //dev->nci_device.get_max_ee = hal_get_max_nfcee;
 
 
         // Copy in