am 35edc538: Merge "Prepare to remove libhardware_legacy from global include dirs"

* commit '35edc53853877e6998e117357902579147f3e7e4':
  Prepare to remove libhardware_legacy from global include dirs
diff --git a/include/hardware_legacy/driver_nl80211.h b/include/hardware_legacy/driver_nl80211.h
deleted file mode 100644
index 0b8b200..0000000
--- a/include/hardware_legacy/driver_nl80211.h
+++ /dev/null
@@ -1,225 +0,0 @@
-/*
- * Driver interaction with Linux nl80211/cfg80211
- * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
- * Copyright (c) 2003-2004, Instant802 Networks, Inc.
- * Copyright (c) 2005-2006, Devicescape Software, Inc.
- * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
- * Copyright (c) 2009-2010, Atheros Communications
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#ifndef _DRIVER_NL80211_H_
-#define _DRIVER_NL80211_H_
-
-#include "includes.h"
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <net/if.h>
-#include <netlink/genl/genl.h>
-#include <netlink/genl/family.h>
-#include <netlink/genl/ctrl.h>
-#ifdef CONFIG_LIBNL3_ROUTE
-#include <netlink/route/neighbour.h>
-#endif /* CONFIG_LIBNL3_ROUTE */
-#include <linux/rtnetlink.h>
-#include <netpacket/packet.h>
-#include <linux/filter.h>
-#include <linux/errqueue.h>
-#include "nl80211_copy.h"
-
-#include "common.h"
-#include "eloop.h"
-#include "utils/list.h"
-#include "common/qca-vendor.h"
-#include "common/qca-vendor-attr.h"
-#include "common/ieee802_11_defs.h"
-#include "common/ieee802_11_common.h"
-#include "l2_packet/l2_packet.h"
-#include "netlink.h"
-#include "linux_ioctl.h"
-#include "radiotap.h"
-#include "radiotap_iter.h"
-#include "rfkill.h"
-#include "driver.h"
-
-#ifdef CONFIG_LIBNL20
-/* libnl 2.0 compatibility code */
-#define nl_handle nl_sock
-#define nl80211_handle_alloc nl_socket_alloc_cb
-#define nl80211_handle_destroy nl_socket_free
-#endif /* CONFIG_LIBNL20 */
-
-#ifndef IFF_LOWER_UP
-#define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
-#endif
-#ifndef IFF_DORMANT
-#define IFF_DORMANT    0x20000         /* driver signals dormant       */
-#endif
-
-#ifndef IF_OPER_DORMANT
-#define IF_OPER_DORMANT 5
-#endif
-#ifndef IF_OPER_UP
-#define IF_OPER_UP 6
-#endif
-
-struct nl80211_global {
-	struct dl_list interfaces;
-	int if_add_ifindex;
-	u64 if_add_wdevid;
-	int if_add_wdevid_set;
-	struct netlink_data *netlink;
-	struct nl_cb *nl_cb;
-	struct nl_handle *nl;
-	int nl80211_id;
-	int ioctl_sock; /* socket for ioctl() use */
-
-	struct nl_handle *nl_event;
-};
-
-struct nl80211_wiphy_data {
-	struct dl_list list;
-	struct dl_list bsss;
-	struct dl_list drvs;
-
-	struct nl_handle *nl_beacons;
-	struct nl_cb *nl_cb;
-
-	int wiphy_idx;
-};
-
-struct i802_bss {
-	struct wpa_driver_nl80211_data *drv;
-	struct i802_bss *next;
-	int ifindex;
-	u64 wdev_id;
-	char ifname[IFNAMSIZ + 1];
-	char brname[IFNAMSIZ];
-	unsigned int beacon_set:1;
-	unsigned int added_if_into_bridge:1;
-	unsigned int added_bridge:1;
-	unsigned int in_deinit:1;
-	unsigned int wdev_id_set:1;
-	unsigned int added_if:1;
-	unsigned int static_ap:1;
-
-	u8 addr[ETH_ALEN];
-
-	int freq;
-	int bandwidth;
-	int if_dynamic;
-
-	void *ctx;
-	struct nl_handle *nl_preq, *nl_mgmt;
-	struct nl_cb *nl_cb;
-
-	struct nl80211_wiphy_data *wiphy_data;
-	struct dl_list wiphy_list;
-};
-
-struct wpa_driver_nl80211_data {
-	struct nl80211_global *global;
-	struct dl_list list;
-	struct dl_list wiphy_list;
-	char phyname[32];
-	u8 perm_addr[ETH_ALEN];
-	void *ctx;
-	int ifindex;
-	int if_removed;
-	int if_disabled;
-	int ignore_if_down_event;
-	struct rfkill_data *rfkill;
-	struct wpa_driver_capa capa;
-	u8 *extended_capa, *extended_capa_mask;
-	unsigned int extended_capa_len;
-	int has_capability;
-
-	int operstate;
-
-	int scan_complete_events;
-	enum scan_states {
-		NO_SCAN, SCAN_REQUESTED, SCAN_STARTED, SCAN_COMPLETED,
-		SCAN_ABORTED, SCHED_SCAN_STARTED, SCHED_SCAN_STOPPED,
-		SCHED_SCAN_RESULTS
-	} scan_state;
-
-	struct nl_cb *nl_cb;
-
-	u8 auth_bssid[ETH_ALEN];
-	u8 auth_attempt_bssid[ETH_ALEN];
-	u8 bssid[ETH_ALEN];
-	u8 prev_bssid[ETH_ALEN];
-	int associated;
-	u8 ssid[32];
-	size_t ssid_len;
-	enum nl80211_iftype nlmode;
-	enum nl80211_iftype ap_scan_as_station;
-	unsigned int assoc_freq;
-
-	int monitor_sock;
-	int monitor_ifidx;
-	int monitor_refcount;
-
-	unsigned int disabled_11b_rates:1;
-	unsigned int pending_remain_on_chan:1;
-	unsigned int in_interface_list:1;
-	unsigned int device_ap_sme:1;
-	unsigned int poll_command_supported:1;
-	unsigned int data_tx_status:1;
-	unsigned int scan_for_auth:1;
-	unsigned int retry_auth:1;
-	unsigned int use_monitor:1;
-	unsigned int ignore_next_local_disconnect:1;
-	unsigned int ignore_next_local_deauth:1;
-	unsigned int allow_p2p_device:1;
-	unsigned int hostapd:1;
-	unsigned int start_mode_ap:1;
-	unsigned int start_iface_up:1;
-	unsigned int test_use_roc_tx:1;
-	unsigned int ignore_deauth_event:1;
-	unsigned int roaming_vendor_cmd_avail:1;
-	unsigned int dfs_vendor_cmd_avail:1;
-	unsigned int have_low_prio_scan:1;
-	unsigned int force_connect_cmd:1;
-	unsigned int addr_changed:1;
-
-	u64 remain_on_chan_cookie;
-	u64 send_action_cookie;
-
-	unsigned int last_mgmt_freq;
-
-	struct wpa_driver_scan_filter *filter_ssids;
-	size_t num_filter_ssids;
-
-	struct i802_bss *first_bss;
-
-	int eapol_tx_sock;
-
-	int eapol_sock; /* socket for EAPOL frames */
-
-	struct nl_handle *rtnl_sk; /* nl_sock for NETLINK_ROUTE */
-
-	int default_if_indices[16];
-	int *if_indices;
-	int num_if_indices;
-
-	/* From failed authentication command */
-	int auth_freq;
-	u8 auth_bssid_[ETH_ALEN];
-	u8 auth_ssid[32];
-	size_t auth_ssid_len;
-	int auth_alg;
-	u8 *auth_ie;
-	size_t auth_ie_len;
-	u8 auth_wep_key[4][16];
-	size_t auth_wep_key_len[4];
-	int auth_wep_tx_keyidx;
-	int auth_local_state_change;
-	int auth_p2p;
-};
-
-#endif
diff --git a/include/hardware_legacy/gscan.h b/include/hardware_legacy/gscan.h
index 5163e01..69e4159 100644
--- a/include/hardware_legacy/gscan.h
+++ b/include/hardware_legacy/gscan.h
@@ -20,6 +20,10 @@
 const unsigned MAX_BUCKETS                 = 16;
 const unsigned MAX_HOTLIST_APS             = 128;
 const unsigned MAX_SIGNIFICANT_CHANGE_APS  = 64;
+const unsigned MAX_PNO_SSID                = 64;
+const unsigned MAX_HOTLIST_SSID            = 8;
+const unsigned MAX_BLACKLIST_BSSID         = 16;
+const unsigned MAX_AP_CACHE_PER_SCAN       = 32;
 
 wifi_error wifi_get_valid_channels(wifi_interface_handle handle,
         int band, int max_channels, wifi_channel *channels, int *num_channels);
@@ -31,10 +35,16 @@
     int max_rssi_sample_size;                // number of RSSI samples used for averaging RSSI
     int max_scan_reporting_threshold;        // max possible report_threshold as described
                                              // in wifi_scan_cmd_params
-    int max_hotlist_aps;                     // maximum number of entries for hotlist APs
+    int max_hotlist_bssids;                  // maximum number of entries for hotlist BSSIDs
+    int max_hotlist_ssids;                   // maximum number of entries for hotlist SSIDs
     int max_significant_wifi_change_aps;     // maximum number of entries for
                                              // significant wifi change APs
     int max_bssid_history_entries;           // number of BSSID/RSSI entries that device can hold
+    int max_number_epno_networks;            // max number of epno entries
+    int max_number_epno_networks_by_ssid;    // max number of epno entries if ssid is specified,
+                                             // that is, epno entries for which an exact match is
+                                             // required, or entries corresponding to hidden ssids
+    int max_number_of_white_listed_ssid;     // max number of white listed SSIDs, M target is 2 to 4
 } wifi_gscan_capabilities;
 
 wifi_error wifi_get_gscan_capabilities(wifi_interface_handle handle,
@@ -91,30 +101,49 @@
     /* Add channel class */
 } wifi_scan_channel_spec;
 
+#define REPORT_EVENTS_BUFFER_FULL      0
+#define REPORT_EVENTS_EACH_SCAN        1
+#define REPORT_EVENTS_FULL_RESULTS     2
+#define REPORT_EVENTS_NO_BATCH         4
 
 typedef struct {
     int bucket;                         // bucket index, 0 based
     wifi_band band;                     // when UNSPECIFIED, use channel list
     int period;                         // desired period, in millisecond; if this is too
                                         // low, the firmware should choose to generate results as
-                                        // fast as it can instead of failing the command
+                                        // fast as it can instead of failing the command.
+                                        // for exponential backoff bucket this is the min_period
     /* report_events semantics -
-     *  0 => report only when scan history is % full
-     *  1 => same as 0 + report a scan completion event after scanning this bucket
-     *  2 => same as 1 + forward scan results (beacons/probe responses + IEs) in real time to HAL
-     *  3 => same as 2 + forward scan results (beacons/probe responses + IEs) in real time to
-             supplicant as well (optional) . */
+     *  This is a bit field; which defines following bits -
+     *  REPORT_EVENTS_BUFFER_FULL  => report only when scan history is % full
+     *  REPORT_EVENTS_EACH_SCAN    => report a scan completion event after scan
+     *  REPORT_EVENTS_FULL_RESULTS => forward scan results (beacons/probe responses + IEs)
+     *                                 in real time to HAL, in addition to completion events
+     *                                 Note: To keep backward compatibility, fire completion
+     *                                 events regardless of REPORT_EVENTS_EACH_SCAN.
+     *  REPORT_EVENTS_NO_BATCH     => controls batching, 0 => batching, 1 => no batching
+     */
     byte report_events;
+    int max_period; // if max_period is non zero or different than period, then this bucket is
+                    // an exponential backoff bucket and the scan period will grow exponentially
+                    // as per formula: actual_period(N) = period ^ (N/(step_count+1))
+                    // to a maximum period of max_period
+    int exponent;   // for exponential back off bucket: multiplier: new_period=old_period*exponent
+    int step_count; // for exponential back off bucket, number of scans performed at a given
+                    // period and until the exponent is applied
 
     int num_channels;
-    wifi_scan_channel_spec channels[MAX_CHANNELS];  // channels to scan; these may include DFS channels
+    // channels to scan; these may include DFS channels
+    // Note that a given channel may appear in multiple buckets
+    wifi_scan_channel_spec channels[MAX_CHANNELS];
 } wifi_scan_bucket_spec;
 
 typedef struct {
     int base_period;                    // base timer period in ms
-    int max_ap_per_scan;                // number of APs to store in each scan in the
+    int max_ap_per_scan;                // number of APs to store in each scan ientryn the
                                         // BSSID/RSSI history buffer (keep the highest RSSI APs)
-    int report_threshold;               // in %, when scan buffer is this much full, wake up AP
+    int report_threshold_percent;       // in %, when scan buffer is this much full, wake up AP
+    int report_threshold_num_scans;     // in number of scans, wake up AP after these many scans
     int num_buckets;
     wifi_scan_bucket_spec buckets[MAX_BUCKETS];
 } wifi_scan_cmd_params;
@@ -126,9 +155,22 @@
 /* Stop periodic GSCAN */
 wifi_error wifi_stop_gscan(wifi_request_id id, wifi_interface_handle iface);
 
+typedef enum {
+    WIFI_SCAN_FLAG_INTERRUPTED = 1      // Indicates that scan results are not complete because
+                                        // probes were not sent on some channels
+} wifi_scan_flags;
+
 /* Get the GSCAN cached scan results */
+typedef struct {
+    int scan_id;                                     // a unique identifier for the scan unit
+    int flags;                                       // a bitmask with additional 
+                                                     // information about scan
+    int num_results;                                 // number of bssids retrieved by the scan
+    wifi_scan_result results[MAX_AP_CACHE_PER_SCAN]; // scan results - one for each bssid
+} wifi_cached_scan_results;
+
 wifi_error wifi_get_cached_gscan_results(wifi_interface_handle iface, byte flush,
-        int max, wifi_scan_result *results, int *num);
+        int max, wifi_cached_scan_results *results, int *num);
 
 /* BSSID Hotlist */
 typedef struct {
@@ -142,12 +184,11 @@
     mac_addr  bssid;                    // AP BSSID
     wifi_rssi low;                      // low threshold
     wifi_rssi high;                     // high threshold
-    wifi_channel channel;               // channel hint
 } ap_threshold_param;
 
 typedef struct {
     int lost_ap_sample_size;
-    int num_ap;                                 // number of hotlist APs
+    int num_bssid;                                 // number of hotlist APs
     ap_threshold_param ap[MAX_HOTLIST_APS];     // hotlist APs
 } wifi_bssid_hotlist_params;
 
@@ -158,7 +199,48 @@
 /* Clear the BSSID Hotlist */
 wifi_error wifi_reset_bssid_hotlist(wifi_request_id id, wifi_interface_handle iface);
 
-/* Significant wifi change*/
+/* SSID Hotlist */
+typedef struct {
+    void (*on_hotlist_ssid_found)(wifi_request_id id,
+            unsigned num_results, wifi_scan_result *results);
+    void (*on_hotlist_ssid_lost)(wifi_request_id id,
+            unsigned num_results, wifi_scan_result *results);
+} wifi_hotlist_ssid_handler;
+
+typedef struct {
+    char  ssid[32+1];                   // SSID
+    wifi_band band;                     // band for this set of threshold params
+    wifi_rssi low;                      // low threshold
+    wifi_rssi high;                     // high threshold
+} ssid_threshold_param;
+
+typedef struct {
+    int lost_ssid_sample_size;
+    int num_ssid;                                   // number of hotlist SSIDs
+    ssid_threshold_param ssid[MAX_HOTLIST_SSID];    // hotlist SSIDs
+} wifi_ssid_hotlist_params;
+
+
+/* Set the SSID Hotlist */
+wifi_error wifi_set_ssid_hotlist(wifi_request_id id, wifi_interface_handle iface,
+        wifi_ssid_hotlist_params params, wifi_hotlist_ssid_handler handler);
+
+/* Clear the SSID Hotlist */
+wifi_error wifi_reset_ssid_hotlist(wifi_request_id id, wifi_interface_handle iface);
+
+
+/* BSSID blacklist */
+typedef struct {
+    int num_bssid;                           // number of blacklisted BSSIDs
+    mac_addr bssids[MAX_BLACKLIST_BSSID];    // blacklisted BSSIDs
+} wifi_bssid_params;
+
+/* Set the BSSID blacklist */
+wifi_error wifi_set_bssid_blacklist(wifi_request_id id, wifi_interface_handle iface,
+        wifi_bssid_params params);
+
+
+/* Significant wifi change */
 typedef struct {
     mac_addr bssid;                     // BSSID
     wifi_channel channel;               // channel frequency in MHz
@@ -171,11 +253,16 @@
             unsigned num_results, wifi_significant_change_result **results);
 } wifi_significant_change_handler;
 
+// The sample size parameters in the wifi_significant_change_params structure
+// represent the number of occurence of a g-scan where the BSSID was seen and RSSI was
+// collected for that BSSID, or, the BSSID was expected to be seen and didn't.
+// for instance: lost_ap_sample_size : number of time a g-scan was performed on the
+// channel the BSSID was seen last, and the BSSID was not seen during those g-scans
 typedef struct {
     int rssi_sample_size;               // number of samples for averaging RSSI
     int lost_ap_sample_size;            // number of samples to confirm AP loss
     int min_breaching;                  // number of APs breaching threshold
-    int num_ap;                         // max 64
+    int num_bssid;                         // max 64
     ap_threshold_param ap[MAX_SIGNIFICANT_CHANGE_APS];
 } wifi_significant_change_params;
 
@@ -189,5 +276,186 @@
 /* Random MAC OUI for PNO */
 wifi_error wifi_set_scanning_mac_oui(wifi_interface_handle handle, oui scan_oui);
 
+// Whether directed scan needs to be performed (for hidden SSIDs)
+#define WIFI_PNO_FLAG_DIRECTED_SCAN = 1
+// Whether PNO event shall be triggered if the network is found on A band
+#define WIFI_PNO_FLAG_A_BAND = 2
+// Whether PNO event shall be triggered if the network is found on G band
+#define WIFI_PNO_FLAG_G_BAND = 4
+// Whether strict matching is required (i.e. firmware shall not match on the entire SSID)
+#define WIFI_PNO_FLAG_STRICT_MATCH = 8
+
+// Code for matching the beacon AUTH IE - additional codes TBD
+#define WIFI_PNO_AUTH_CODE_OPEN  1 // open
+#define WIFI_PNO_AUTH_CODE_PSK   2 // WPA_PSK or WPA2PSK
+#define WIFI_PNO_AUTH_CODE_EAPOL 4 // any EAPOL
+
+// Enhanced PNO:
+// Enhanced PNO feature is expected to be enabled all of the time (e.g. screen lit) and may thus
+// requires firmware to store a large number of networks, covering the whole list of known network.
+// Therefore, it is acceptable for firmware to store a crc24, crc32 or other short hash of the SSID,
+// such that a low but non-zero probability of collision exist. With that scheme it should be
+// possible for firmware to keep an entry as small as 4 bytes for each pno network.
+// For instance, a firmware pn0 entry can be implemented in the form of:
+//          PNO ENTRY = crc24(3 bytes) | RSSI_THRESHOLD>>3 (5 bits) | auth flags(3 bits)
+//
+// A PNO network shall be reported once, that is, once a network is reported by firmware
+// its entry shall be marked as "done" until framework calls wifi_set_epno_list again.
+// Calling wifi_set_epno_list shall reset the "done" status of pno networks in firmware.
+typedef struct {
+    char ssid[32+1];
+    byte rssi_threshold; // threshold for considering this SSID as found, required granularity for
+                         // this threshold is 4dBm to 8dBm
+    byte flags;          //  WIFI_PNO_FLAG_XXX
+    byte auth_bit_field; // auth bit field for matching WPA IE
+} wifi_epno_network;
+
+/* PNO list */
+typedef struct {
+    int num_networks;                 // number of SSIDs
+    wifi_epno_network networks[];     // PNO networks
+} wifi_epno_params;
+
+typedef struct {
+    // on results
+    void (*on_network_found)(wifi_request_id id,
+            unsigned num_results, wifi_scan_result *results);
+} wifi_epno_handler;
+
+
+/* Set the PNO list */
+wifi_error wifi_set_epno_list(wifi_request_id id, wifi_interface_handle iface,
+        int num_networks, wifi_epno_network *networks, wifi_epno_handler handler);
+
+
+/* SSID white list */
+/* Note that this feature requires firmware to be able to indicate to kernel sme and wpa_supplicant
+ * that the SSID of the network has changed
+ * and thus requires further changed in cfg80211 stack, for instance,
+ * the below function would change:
+
+ void __cfg80211_roamed(struct wireless_dev *wdev,
+ 		       struct cfg80211_bss *bss,
+ 		       const u8 *req_ie, size_t req_ie_len,
+ 		       const u8 *resp_ie, size_t resp_ie_len)
+ * when firmware roam to a new SSID the corresponding link layer stats info need to be updated:
+     struct wifi_interface_link_layer_info;
+ */
+typedef struct {
+    char ssid[32+1]; // null terminated
+} wifi_ssid;
+
+wifi_error wifi_set_ssid_white_list(wifi_request_id id, wifi_interface_handle iface,
+        int num_networks, wifi_ssid *ssids);
+
+/* Set G-SCAN roam parameters */
+/**
+ * Firmware roaming is implemented with two modes:
+ *   1- "Alert" mode roaming, (Note: alert roaming is the pre-L roaming, whereas firmware is
+ *      "urgently" hunting for another BSSID because the RSSI is low, or because many successive
+ *      beacons have been lost or other bad link conditions).
+ *   2- "Lazy" mode, where firmware is hunting for a better BSSID or white listed SSID even though
+ *      the RSSI of the link is good.
+ *      Lazy mode is configured thru G-scan, that is, the results of G-scans are compared to the
+ *      current RSSI and fed thru the roaming engine.
+ *      Lazy scan will be enabled (and or throttled down by reducing the number of G-scans) by
+ *      framework only in certain conditions, such as:
+ *          - no real time (VO/VI) traffic at the interface
+ *          - low packet rate for BE/BK packets a the interface
+ *          - system conditions (screen lit/dark) etc...
+ *
+ * For consistency, the roam parameters will always be configured by framework such that:
+ *
+ * condition 1- A_band_boost_threshold >= (alert_roam_rssi_trigger + 10)
+ * This condition ensures that Lazy roam doesn't cause the device to roam to a 5GHz BSSID whose RSSI
+ * is lower than the alert threshold, which would consequently trigger a roam to a low RSSI BSSID,
+ * hence triggering alert mode roaming.
+ * In other words, in alert mode, the A_band parameters may safely be ignored by WiFi chipset.
+ *
+ * condition 2- A_band_boost_threshold > A_band_penalty_factor
+ *
+ */
+
+/**
+ * Example:
+ * A_band_boost_threshold = -65
+ * A_band_penalty_threshold = -75
+ * A_band_boost_factor = 4
+ * A_band_penalty_factor = 2
+ * A_band_max_boost = 50
+ *
+ * a 5GHz RSSI value is transformed as below:
+ * -20 -> -20+ 50 = 30
+ * -60 -> -60 + 4 * (-60 - A_band_boost_threshold) = -60 + 16 = -44
+ * -70 -> -70
+ * -80 -> -80 - 2 * (A_band_penalty_threshold - (-80)) = -80 - 10 = -90
+ */
+
+typedef struct {
+    // Lazy roam parameters
+    // A_band_XX parameters are applied to 5GHz BSSIDs when comparing with a 2.4GHz BSSID
+    // they may not be applied when comparing two 5GHz BSSIDs
+    int A_band_boost_threshold;     // RSSI threshold above which 5GHz RSSI is favored
+    int A_band_penalty_threshold;   // RSSI threshold below which 5GHz RSSI is penalized
+    int A_band_boost_factor;        // factor by which 5GHz RSSI is boosted
+                               // boost=RSSI_measured-5GHz_boost_threshold)*5GHz_boost_factor
+    int A_band_penalty_factor;      // factor by which 5GHz RSSI is penalized
+                               // penalty=(5GHz_penalty_factor-RSSI_measured)*5GHz_penalty_factor
+    int A_band_max_boost;           // maximum boost that can be applied to a 5GHz RSSI
+
+    // Hysteresis: ensuring the currently associated BSSID is favored
+    // so as to prevent ping-pong situations
+    int lazy_roam_hysteresis;       // boost applied to current BSSID
+
+    // Alert mode enable, i.e. configuring when firmware enters alert mode
+    int alert_roam_rssi_trigger;    // RSSI below which "Alert" roam is enabled
+} wifi_roam_params;
+
+wifi_error wifi_set_gscan_roam_params(wifi_request_id id, wifi_interface_handle iface,
+                                        wifi_roam_params * params);
+
+/**
+ * Enable/Disable "Lazy" roam
+ */
+wifi_error wifi_enable_lazy_roam(wifi_request_id id, wifi_interface_handle iface, int enable);
+
+/**
+ * Per BSSID preference
+ */
+typedef struct {
+    mac_addr bssid;
+    int rssi_modifier;  // modifier applied to the RSSI of the BSSID for the purpose of comparing
+                        // it with other roam candidate
+} wifi_bssid_preference;
+
+wifi_error wifi_set_bssid_preference(wifi_request_id id, wifi_interface_handle iface,
+                                    int num_bssid, wifi_bssid_preference *prefs);
+
+typedef struct {
+    int  id;                            // identifier of this network block, report this in event
+    char realm[256];                    // null terminated UTF8 encoded realm, 0 if unspecified
+    int64_t roamingConsortiumIds[16];   // roaming consortium ids to match, 0s if unspecified
+    byte plmn[3];                       // mcc/mnc combination as per rules, 0s if unspecified
+} wifi_passpoint_network;
+
+typedef struct {
+    void (*on_passpoint_network_found)(
+            wifi_request_id id,
+            int net_id,                        // network block identifier for the matched network
+            wifi_scan_result *result,          // scan result, with channel and beacon information
+            int anqp_len,                      // length of ANQP blob
+            byte *anqp                         // ANQP data, in the information_element format
+            );
+} wifi_passpoint_event_handler;
+
+/* Sets a list for passpoint networks for PNO purposes; it should be matched
+ * against any passpoint networks (designated by Interworking element) found
+ * during regular PNO scan. */
+wifi_error wifi_set_passpoint_list(wifi_request_id id, wifi_interface_handle iface, int num,
+        wifi_passpoint_network *networks, wifi_passpoint_event_handler handler);
+
+/* Reset passpoint network list - no Passpoint networks should be matched after this */
+wifi_error wifi_reset_passpoint_list(wifi_request_id id, wifi_interface_handle iface);
+
 #endif
 
diff --git a/include/hardware_legacy/link_layer_stats.h b/include/hardware_legacy/link_layer_stats.h
index e9ea97b..c6202ad 100644
--- a/include/hardware_legacy/link_layer_stats.h
+++ b/include/hardware_legacy/link_layer_stats.h
@@ -12,21 +12,6 @@
 #define STATS_MINOR_VERSION      0

 #define STATS_MICRO_VERSION      0

 

-typedef int wifi_radio;

-typedef int wifi_channel;

-

-/* channel operating width */

-typedef enum {

-   WIFI_CHAN_WIDTH_20    = 0,

-   WIFI_CHAN_WIDTH_40    = 1,

-   WIFI_CHAN_WIDTH_80    = 2,

-   WIFI_CHAN_WIDTH_160   = 3,

-   WIFI_CHAN_WIDTH_80P80 = 4,

-   WIFI_CHAN_WIDTH_5     = 5,

-   WIFI_CHAN_WIDTH_10    = 6,

-   WIFI_CHAN_WIDTH_INVALID = -1

-} wifi_channel_width;

-

 typedef enum {

     WIFI_DISCONNECTED = 0,

     WIFI_AUTHENTICATING = 1,

@@ -113,6 +98,27 @@
    wifi_channel_stat channels[];   // channel statistics

 } wifi_radio_stat;

 

+/**

+ * Packet statistics reporting by firmware is performed on MPDU basi (i.e. counters increase by 1 for each MPDU)

+ * As well, "data packet" in associated comments, shall be interpreted as 802.11 data packet,

+ * that is, 802.11 frame control subtype == 2 and excluding management and control frames.

+ *

+ * As an example, in the case of transmission of an MSDU fragmented in 16 MPDUs which are transmitted

+ * OTA in a 16 units long a-mpdu, for which a block ack is received with 5 bits set:

+ *          tx_mpdu : shall increase by 5

+ *          retries : shall increase by 16

+ *          tx_ampdu : shall increase by 1

+ * data packet counters shall not increase regardless of the number of BAR potentially sent by device for this a-mpdu

+ * data packet counters shall not increase regardless of the number of BA received by device for this a-mpdu

+ *

+ * For each subsequent retransmission of the 11 remaining non ACK'ed mpdus

+ * (regardless of the fact that they are transmitted in a-mpdu or not)

+ *          retries : shall increase by 1

+ *

+ * If no subsequent BA or ACK are received from AP, until packet lifetime expires for those 11 packet that were not ACK'ed

+ *          mpdu_lost : shall increase by 11

+ */

+

 /* per rate statistics */

 typedef struct {

    wifi_rate rate;     // rate information

@@ -154,16 +160,16 @@
    wifi_rate_stat rate_stats[];   // per rate statistics, number of entries  = num_rate

 } wifi_peer_info;

 

-/* per access category statistics */

+/* Per access category statistics */

 typedef struct {

    wifi_traffic_ac ac;             // access category (VI, VO, BE, BK)

    u32 tx_mpdu;                    // number of successfully transmitted unicast data pkts (ACK rcvd)

-   u32 rx_mpdu;                    // number of received unicast mpdus

+   u32 rx_mpdu;                    // number of received unicast data packets

    u32 tx_mcast;                   // number of succesfully transmitted multicast data packets

                                    // STA case: implies ACK received from AP for the unicast packet in which mcast pkt was sent

    u32 rx_mcast;                   // number of received multicast data packets

-   u32 rx_ampdu;                   // number of received unicast a-mpdus

-   u32 tx_ampdu;                   // number of transmitted unicast a-mpdus

+   u32 rx_ampdu;                   // number of received unicast a-mpdus; support of this counter is optional

+   u32 tx_ampdu;                   // number of transmitted unicast a-mpdus; support of this counter is optional

    u32 mpdu_lost;                  // number of data pkt losses (no ACK)

    u32 retries;                    // total number of data pkt retries

    u32 retries_short;              // number of short data pkt retries

@@ -179,6 +185,15 @@
    wifi_interface_handle iface;          // wifi interface

    wifi_interface_link_layer_info info;  // current state of the interface

    u32 beacon_rx;                        // access point beacon received count from connected AP

+   u64 average_tsf_offset;               // average beacon offset encountered (beacon_TSF - TBTT)

+                                         // The average_tsf_offset field is used so as to calculate the

+                                         // typical beacon contention time on the channel as well may be

+                                         // used to debug beacon synchronization and related power consumption issue

+   u32 leaky_ap_detected;                // indicate that this AP typically leaks packets beyond the driver guard time.

+   u32 leaky_ap_avg_num_frames_leaked;  // average number of frame leaked by AP after frame with PM bit set was ACK'ed by AP

+   u32 leaky_ap_guard_time;              // guard time currently in force (when implementing IEEE power management based on

+                                         // frame control PM bit), How long driver waits before shutting down the radio and

+                                         // after receiving an ACK for a data frame with PM bit set)

    u32 mgmt_rx;                          // access point mgmt frames received count from connected AP (including Beacon)

    u32 mgmt_action_rx;                   // action frames received count

    u32 mgmt_action_tx;                   // action frames transmit count

diff --git a/include/hardware_legacy/rtt.h b/include/hardware_legacy/rtt.h
index 343f554..2808723 100644
--- a/include/hardware_legacy/rtt.h
+++ b/include/hardware_legacy/rtt.h
@@ -1,69 +1,153 @@
 
 #include "wifi_hal.h"
+#include "gscan.h"
 
 #ifndef __WIFI_HAL_RTT_H__
 #define __WIFI_HAL_RTT_H__
 
-/* channel operating width */
-
 /* Ranging status */
 typedef enum {
-    RTT_STATUS_SUCCESS,
-    RTT_STATUS_FAILURE,
-    RTT_STATUS_FAIL_NO_RSP,
-    RTT_STATUS_FAIL_REJECTED,
-    RTT_STATUS_FAIL_NOT_SCHEDULED_YET,
-    RTT_STATUS_FAIL_TM_TIMEOUT,
-    RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL,
-    RTT_STATUS_FAIL_NO_CAPABILITY,
-    RTT_STATUS_ABORTED
+    RTT_STATUS_SUCCESS       = 0,
+    RTT_STATUS_FAILURE       = 1,           // general failure status
+    RTT_STATUS_FAIL_NO_RSP   = 2,           // target STA does not respond to request
+    RTT_STATUS_FAIL_REJECTED = 3,           // request rejected. Applies to 2-sided RTT only
+    RTT_STATUS_FAIL_NOT_SCHEDULED_YET  = 4,
+    RTT_STATUS_FAIL_TM_TIMEOUT         = 5, // timing measurement times out
+    RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6, // Target on different channel, cannot range
+    RTT_STATUS_FAIL_NO_CAPABILITY  = 7,     // ranging not supported
+    RTT_STATUS_ABORTED             = 8,     // request aborted for unknown reason
+    RTT_STATUS_FAIL_INVALID_TS     = 9,     // Invalid T1-T4 timestamp
+    RTT_STATUS_FAIL_PROTOCOL       = 10,    // 11mc protocol failed
+    RTT_STATUS_FAIL_SCHEDULE       = 11,    // request could not be scheduled
+    RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,    // responder cannot collaborate at time of request
+    RTT_STATUS_INVALID_REQ         = 13,    // bad request args
+    RTT_STATUS_NO_WIFI             = 14,    // WiFi not enabled
+    RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE = 15 // Responder overrides param info, cannot range with new params
 } wifi_rtt_status;
 
+/* RTT peer type */
+typedef enum {
+    RTT_PEER_AP         = 0x1,
+    RTT_PEER_STA        = 0x2,
+    RTT_PEER_P2P_GO     = 0x3,
+    RTT_PEER_P2P_CLIENT = 0x4,
+    RTT_PEER_NAN        = 0x5
+} rtt_peer_type;
+
+/* RTT Measurement Bandwidth */
+typedef enum {
+    WIFI_RTT_BW_5   = 0x01,
+    WIFI_RTT_BW_10  = 0x02,
+    WIFI_RTT_BW_20  = 0x04,
+    WIFI_RTT_BW_40  = 0x08,
+    WIFI_RTT_BW_80  = 0x10,
+    WIFI_RTT_BW_160 = 0x20
+} wifi_rtt_bw;
+
+/* RTT Measurement Preamble */
+typedef enum {
+    WIFI_RTT_PREAMBLE_LEGACY = 0x1,
+    WIFI_RTT_PREAMBLE_HT     = 0x2,
+    WIFI_RTT_PREAMBLE_VHT    = 0x4
+} wifi_rtt_preamble;
 
 /* RTT Type */
 typedef enum {
-    RTT_TYPE_INVALID,
-    RTT_TYPE_1_SIDED,
-    RTT_TYPE_2_SIDED,
-    RTT_TYPE_AUTO,              // Two sided if remote supports; one sided otherwise
+    RTT_TYPE_1_SIDED = 0x1,
+    RTT_TYPE_2_SIDED = 0x2,
 } wifi_rtt_type;
 
 /* RTT configuration */
 typedef struct {
-    mac_addr addr;                     // peer device mac address
-    wifi_rtt_type type;                // optional - rtt type hint. RTT_TYPE_INVALID implies best effort
-    wifi_peer_type peer;               // optional - peer device hint (STA, P2P, AP)
-    wifi_channel_info channel;         // Required for STA-AP mode, optional for P2P, NBD etc.
-    byte continuous;                   // 0 = single shot or 1 = continuous ranging
-    unsigned interval;                 // interval of RTT measurement (unit ms) when continuous = true
-    unsigned num_measurements;         // total number of RTT measurements when continuous = true
-    unsigned num_samples_per_measurement; // num of packets in each RTT measurement
-    unsigned num_retries_per_measurement; // num of retries if sampling fails
+    mac_addr addr;                 // peer device mac address
+    wifi_rtt_type type;            // 1-sided or 2-sided RTT
+    rtt_peer_type peer;            // optional - peer device hint (STA, P2P, AP)
+    wifi_channel_info channel;     // Required for STA-AP mode, optional for P2P, NBD etc.
+    unsigned burst_period;         // Time interval between bursts (units: 100 ms).
+                                   // Applies to 1-sided and 2-sided RTT multi-burst requests.
+                                   // Range: 0-31, 0: no preference by initiator (2-sided RTT)
+    unsigned num_burst;            // Total number of RTT bursts to be executed. It will be
+                                   // specified in the same way as the parameter "Number of
+                                   // Burst Exponent" found in the FTM frame format. It
+                                   // applies to both: 1-sided RTT and 2-sided RTT. Valid
+                                   // values are 0 to 15 as defined in 802.11mc std.
+                                   // 0 means single shot
+                                   // The implication of this parameter on the maximum
+                                   // number of RTT results is the following:
+                                   // for 1-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst)
+                                   // for 2-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst - 1)
+    unsigned num_frames_per_burst; // num of frames per burst.
+                                   // Minimum value = 1, Maximum value = 31
+                                   // For 2-sided this equals the number of FTM frames
+                                   // to be attempted in a single burst. This also
+                                   // equals the number of FTM frames that the
+                                   // initiator will request that the responder send
+                                   // in a single frame.
+    unsigned num_retries_per_rtt_frame; // number of retries for a failed RTT frame. Applies
+                                        // to 1-sided RTT only. Minimum value = 0, Maximum value = 3
+
+    //following fields are only valid for 2-side RTT
+    unsigned num_retries_per_ftmr; // Maximum number of retries that the initiator can
+                                   // retry an FTMR frame.
+                                   // Minimum value = 0, Maximum value = 3
+    byte LCI_request;              // 1: request LCI, 0: do not request LCI
+    byte LCR_request;              // 1: request LCR, 0: do not request LCR
+    unsigned burst_duration;       // Applies to 1-sided and 2-sided RTT. Valid values will
+                                   // be 2-11 and 15 as specified by the 802.11mc std for
+                                   // the FTM parameter burst duration. In a multi-burst
+                                   // request, if responder overrides with larger value,
+                                   // the initiator will return failure. In a single-burst
+                                   // request if responder overrides with larger value,
+                                   // the initiator will sent TMR_STOP to terminate RTT
+                                   // at the end of the burst_duration it requested.
+    wifi_rtt_preamble preamble;    // RTT preamble to be used in the RTT frames
+    wifi_rtt_bw bw;                // RTT BW to be used in the RTT frames
 } wifi_rtt_config;
 
 /* RTT results */
 typedef struct {
-    mac_addr addr;               // device mac address
-    unsigned measurement_num;    // measurement number in case of continuous ranging
-    wifi_rtt_status status;      // ranging status
-    wifi_rtt_type type;          // RTT type
-    wifi_peer_type peer;         // peer device type (P2P, AP)
-    wifi_channel_info channel;   // channel information
-    wifi_rssi rssi;              // rssi in 0.5 dB steps e.g. 143 implies -71.5 dB
-    wifi_rssi rssi_spread;       // rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
-    wifi_rate tx_rate;           // TX rate
-    wifi_timespan rtt;           // round trip time in nanoseconds
-    wifi_timespan rtt_sd;        // rtt standard deviation in nanoseconds
-    wifi_timespan rtt_spread;    // difference between max and min rtt times recorded
-    int distance;                // distance in cm (optional)
-    int distance_sd;             // standard deviation in cm (optional)
-    int distance_spread;         // difference between max and min distance recorded (optional)
-    wifi_timestamp ts;           // time of the measurement (in microseconds since boot)
+    mac_addr addr;                // device mac address
+    unsigned burst_num;           // burst number in a multi-burst request
+    unsigned measurement_number;  // Total RTT measurement frames attempted
+    unsigned success_number;      // Total successful RTT measurement frames
+    byte  number_per_burst_peer;  // Maximum number of "FTM frames per burst" supported by
+                                  // the responder STA. Applies to 2-sided RTT only.
+                                  // If reponder overrides with larger value:
+                                  // - for single-burst request initiator will truncate the
+                                  // larger value and send a TMR_STOP after receiving as
+                                  // many frames as originally requested.
+                                  // - for multi-burst request, initiator will return
+                                  // failure right away.
+    wifi_rtt_status status;       // ranging status
+    byte retry_after_duration;    // When status == RTT_STATUS_FAIL_BUSY_TRY_LATER,
+                                  // this will be the time provided by the responder as to
+                                  // when the request can be tried again. Applies to 2-sided
+                                  // RTT only. In sec, 1-31sec.
+    wifi_rtt_type type;           // RTT type
+    wifi_rssi rssi;               // average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB
+    wifi_rssi rssi_spread;        // rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional)
+    wifi_rate tx_rate;            // 1-sided RTT: TX rate of RTT frame.
+                                  // 2-sided RTT: TX rate of initiator's Ack in response to FTM frame.
+    wifi_rate rx_rate;            // 1-sided RTT: TX rate of Ack from other side.
+                                  // 2-sided RTT: TX rate of FTM frame coming from responder.
+    wifi_timespan rtt;            // round trip time in 0.1 nanoseconds
+    wifi_timespan rtt_sd;         // rtt standard deviation in 0.1 nanoseconds
+    wifi_timespan rtt_spread;     // difference between max and min rtt times recorded
+    int distance;                 // distance in cm (optional)
+    int distance_sd;              // standard deviation in cm (optional)
+    int distance_spread;          // difference between max and min distance recorded (optional)
+    wifi_timestamp ts;            // time of the measurement (in microseconds since boot)
+    int burst_duration;           // in ms, actual time taken by the FW to finish one burst
+                                  // measurement. Applies to 1-sided and 2-sided RTT.
+    int negotiated_burst_num;  // Number of bursts allowed by the responder. Applies
+                                   // to 2-sided RTT only.
+    wifi_information_element *LCI; // for 11mc only
+    wifi_information_element *LCR; // for 11mc only
 } wifi_rtt_result;
 
 /* RTT result callback */
 typedef struct {
-    void (*on_rtt_results) (wifi_request_id id, unsigned num_results, wifi_rtt_result rtt_result[]);
+    void (*on_rtt_results) (wifi_request_id id, unsigned num_results, wifi_rtt_result *rtt_result[]);
 } wifi_rtt_event_handler;
 
 /* API to request RTT measurement */
@@ -76,9 +160,9 @@
 
 /* NBD ranging channel map */
 typedef struct {
-    wifi_channel availablity[32];           // specifies the channel map for each of the 16 TU windows
-                                            // frequency of 0 => unspecified; which means firmware is
-                                            // free to do whatever it wants in this window.
+    wifi_channel availablity[32]; // specifies the channel map for each of the 16 TU windows
+    // frequency of 0 => unspecified; which means firmware is
+    // free to do whatever it wants in this window.
 } wifi_channel_map;
 
 /* API to start publishing the channel map on responder device in a NBD cluster.
@@ -94,15 +178,97 @@
    DW interval and will also stop broadcasting NBD ranging attribute in SDF */
 wifi_error wifi_rtt_channel_map_clear(wifi_request_id id,  wifi_interface_handle iface);
 
+// Preamble definition for bit mask used in wifi_rtt_capabilities
+#define PREAMBLE_LEGACY 0x1
+#define PREAMBLE_HT     0x2
+#define PREAMBLE_VHT    0x4
+
+// BW definition for bit mask used in wifi_rtt_capabilities
+#define BW_5_SUPPORT   0x1
+#define BW_10_SUPPORT  0x2
+#define BW_20_SUPPORT  0x4
+#define BW_40_SUPPORT  0x8
+#define BW_80_SUPPORT  0x10
+#define BW_160_SUPPORT 0x20
+
 /* RTT Capabilities */
 typedef struct {
-   byte rtt_one_sided_supported;  // if 1-sided rtt data collection is supported
-   byte rtt_11v_supported;        // if 11v rtt data collection is supported
-   byte rtt_ftm_supported;        // if ftm rtt data collection is supported
+    byte rtt_one_sided_supported;  // if 1-sided rtt data collection is supported
+    byte rtt_ftm_supported;        // if ftm rtt data collection is supported
+    byte lci_support;              // if initiator supports LCI request. Applies to 2-sided RTT
+    byte lcr_support;              // if initiator supports LCR request. Applies to 2-sided RTT
+    byte preamble_support;         // bit mask indicates what preamble is supported by initiator
+    byte bw_support;               // bit mask indicates what BW is supported by initiator
 } wifi_rtt_capabilities;
 
 /*  RTT capabilities of the device */
 wifi_error wifi_get_rtt_capabilities(wifi_interface_handle iface, wifi_rtt_capabilities *capabilities);
 
+/* debugging definitions */
+enum {
+    RTT_DEBUG_DISABLE,
+    RTT_DEBUG_LOG,
+    RTT_DEBUG_PROTO,
+    RTT_DEBUG_BURST,
+    RTT_DEBUG_ACCURACY,
+    RTT_DEBUG_LOGDETAIL
+};  //rtt debug type
+
+enum {
+    RTT_DEBUG_FORMAT_TXT,
+    RTT_DEBUG_FORMAT_BINARY
+}; //rtt debug format
+
+typedef struct rtt_debug {
+    unsigned version;
+    unsigned len; // total length of after len field
+    unsigned type;  // rtt debug type
+    unsigned format; //rtt debug format
+    char dbuf[0]; // debug content
+} rtt_debug_t;
+
+/* set configuration for debug */
+wifi_error wifi_rtt_debug_cfg(wifi_interface_handle h, unsigned rtt_dbg_type, char *cfgbuf, unsigned cfg_buf_size);
+/* get the debug information */
+wifi_error wifi_rtt_debug_get(wifi_interface_handle h, rtt_debug_t **debugbuf);
+/* free the debug buffer */
+wifi_error wifi_rtt_debug_free(wifi_interface_handle h, rtt_debug_t *debugbuf);
+
+/* API for setting LCI/LCR information to be provided to a requestor */
+typedef enum {
+    WIFI_MOTION_NOT_EXPECTED = 0, // Not expected to change location
+    WIFI_MOTION_EXPECTED = 1,     // Expected to change location
+    WIFI_MOTION_UNKNOWN  = 2,     // Movement pattern unknown
+} wifi_motion_pattern;
+
+typedef struct {
+    long latitude;              // latitude in degrees * 2^25 , 2's complement
+    long longitude;             // latitude in degrees * 2^25 , 2's complement
+    int  altitude;              // Altitude in units of 1/256 m
+    byte latitude_unc;          // As defined in Section 2.3.2 of IETF RFC 6225
+    byte longitude_unc;         // As defined in Section 2.3.2 of IETF RFC 6225
+    byte altitude_unc;          // As defined in Section 2.4.5 from IETF RFC 6225:
+
+    //Following element for configuring the Z subelement
+    wifi_motion_pattern motion_pattern;
+    int  floor;                 // floor in units of 1/16th of floor. 0x80000000 if unknown.
+    int  height_above_floor;    // in units of 1/64 m
+    int  height_unc;            // in units of 1/64 m. 0 if unknown
+} wifi_lci_information;
+
+typedef struct {
+    char country_code[2];       // country code
+    int  length;                // length of the info field
+    char civic_info[256];       // Civic info to be copied in FTM frame
+} wifi_lcr_information;
+
+// API to configure the LCI. Used in RTT Responder mode only
+wifi_error wifi_set_lci(wifi_request_id id, wifi_interface_handle iface,
+                        wifi_lci_information *lci);
+
+// API to configure the LCR. Used in RTT Responder mode only.
+wifi_error wifi_set_lcr(wifi_request_id id, wifi_interface_handle iface,
+                        wifi_lcr_information *lcr);
+
 #endif
 
diff --git a/include/hardware_legacy/tdls.h b/include/hardware_legacy/tdls.h
index c1cd33e..9ac225a 100644
--- a/include/hardware_legacy/tdls.h
+++ b/include/hardware_legacy/tdls.h
@@ -5,13 +5,14 @@
 #define _TDLS_H_
 
 typedef enum {
-    WIFI_TDLS_DISABLED,                 /* TDLS is not enabled, or is disabled now */
-    WIFI_TDLS_ENABLED,                  /* TDLS is enabled, but not yet tried */
-    WIFI_TDLS_TRYING,                   /* Direct link is being attempted (optional) */
-    WIFI_TDLS_ESTABLISHED,              /* Direct link is established */
-    WIFI_TDLS_ESTABLISHED_OFF_CHANNEL,  /* Direct link is established using MCC */
-    WIFI_TDLS_DROPPED,                  /* Direct link was established, but is now dropped */
-    WIFI_TDLS_FAILED                    /* Direct link failed */
+    WIFI_TDLS_DISABLED = 1,                 /* TDLS is not enabled, default status for all STAs */
+    WIFI_TDLS_ENABLED,                      /* TDLS is enabled, but not yet tried */
+    WIFI_TDLS_ESTABLISHED,                  /* Direct link is established */
+    WIFI_TDLS_ESTABLISHED_OFF_CHANNEL,      /* Direct link is established using MCC */
+    WIFI_TDLS_DROPPED,                      /* Direct link was established,
+                                             * but is temporarily dropped now */
+    WIFI_TDLS_FAILED                        /* TDLS permanent failed. Inform error to upper layer
+                                             * and go back to WIFI_TDLS_DISABLED */
 } wifi_tdls_state;
 
 typedef enum {
@@ -38,7 +39,15 @@
 } wifi_tdls_status;
 
 typedef struct {
-    /* on_tdls_state_changed - reports state to TDLS link
+    int max_concurrent_tdls_session_num;      /* Maximum TDLS session number can be supported by the
+                                              * Firmware and hardware*/
+    int is_global_tdls_supported;            /* 1 -- support,  0 -- not support */
+    int is_per_mac_tdls_supported;           /* 1 -- support,  0 -- not support */
+    int is_off_channel_tdls_supported;       /* 1 -- support,  0 -- not support */
+} wifi_tdls_capabilities;
+
+typedef struct {
+    /* on_tdls_state_changed - reports state of TDLS link to framework
      * Report this event when the state of TDLS link changes */
     void (*on_tdls_state_changed)(mac_addr addr, wifi_tdls_status status);
 } wifi_tdls_handler;
@@ -49,12 +58,12 @@
  * params specifies hints, which provide more information about
  * why TDLS is being sought. The firmware should do its best to
  * honor the hints before downgrading regular AP link
+ * If upper layer has no specific values, this should be NULL
  *
- * On successful completion, must fire on_tdls_state_changed event
- * to indicate the status of TDLS operation.
+ * handler is used to inform the upper layer about the status change and the corresponding reason
  */
 wifi_error wifi_enable_tdls(wifi_interface_handle iface, mac_addr addr,
-        wifi_tdls_params params, wifi_tdls_handler handler);
+        wifi_tdls_params *params, wifi_tdls_handler handler);
 
 /* wifi_disable_tdls - disables TDLS-auto mode for a specific route
  *
@@ -70,4 +79,7 @@
 wifi_error wifi_get_tdls_status(wifi_interface_handle iface, mac_addr addr,
         wifi_tdls_status *status);
 
-#endif
\ No newline at end of file
+/* return the current HW + Firmware combination's TDLS capabilities */
+wifi_error wifi_get_tdls_capabilities(wifi_interface_handle iface,
+        wifi_tdls_capabilities *capabilities);
+#endif
diff --git a/include/hardware_legacy/wifi.h b/include/hardware_legacy/wifi.h
index 7a64d52..93f0383 100644
--- a/include/hardware_legacy/wifi.h
+++ b/include/hardware_legacy/wifi.h
@@ -37,7 +37,8 @@
 
 /**
  * Check if the Wi-Fi driver is loaded.
- *
+ * Check if the Wi-Fi driver is loaded.
+
  * @return 0 on success, < 0 on failure.
  */
 int is_wifi_driver_loaded();
diff --git a/include/hardware_legacy/wifi_config.h b/include/hardware_legacy/wifi_config.h
new file mode 100644
index 0000000..8ad14f4
--- /dev/null
+++ b/include/hardware_legacy/wifi_config.h
@@ -0,0 +1,47 @@
+#include "wifi_hal.h"

+

+#ifndef __WIFI_HAL_CONFIG_H

+#define __WIFI_HAL_CONFIG_H

+

+#ifdef __cplusplus

+extern "C"

+{

+#endif /* __cplusplus */

+

+#define CONFIG_MAJOR_VERSION      1

+#define CONFIG_MINOR_VERSION      0

+#define CONFIG_MICRO_VERSION      0

+

+typedef int wifi_radio;

+

+// whether the wifi chipset wakes at every dtim beacon or a multiple of the dtim period

+// if extended_dtim is set to 3, the STA shall wake up every 3 DTIM beacons

+wifi_error wifi_extended_dtim_config_set(wifi_request_id id,

+        wifi_interface_handle iface, int extended_dtim);

+

+//set the country code to driver

+wifi_error wifi_set_country_code(wifi_interface_handle iface, const char* country_code);

+

+//set the wifi_iface stats averaging factor used to calculate

+// statistics like average the TSF offset or average number of frame leaked

+// For instance, upon beacon reception:

+//    current_avg = ((beacon_TSF - TBTT) * factor + previous_avg * (0x10000 - factor) ) / 0x10000

+// For instance, when evaluating leaky APs:

+//    current_avg = ((num frame received within guard time) * factor + previous_avg * (0x10000 - factor)) / 0x10000

+

+wifi_error wifi_set_beacon_wifi_iface_stats_averaging_factor(wifi_request_id id, wifi_interface_handle iface,

+        u16 factor);

+

+// configure guard time, i.e. when implementing IEEE power management based on

+// frame control PM bit, how long driver waits before shutting down the radio and

+// after receiving an ACK for a data frame with PM bit set

+wifi_error wifi_set_guard_time(wifi_request_id id, wifi_interface_handle iface,

+        u32 guard_time);

+

+#ifdef __cplusplus

+}

+

+#endif /* __cplusplus */

+

+#endif /*__WIFI_HAL_STATS_ */

+

diff --git a/include/hardware_legacy/wifi_hal.h b/include/hardware_legacy/wifi_hal.h
index c970fc0..9795315 100644
--- a/include/hardware_legacy/wifi_hal.h
+++ b/include/hardware_legacy/wifi_hal.h
@@ -17,8 +17,35 @@
 #ifndef __WIFI_HAL_H__
 #define __WIFI_HAL_H__
 
+#ifdef __cplusplus
+extern "C"
+{
+#endif
 #include <stdint.h>
 
+/* WiFi Common definitions */
+/* channel operating width */
+typedef enum {
+    WIFI_CHAN_WIDTH_20    = 0,
+    WIFI_CHAN_WIDTH_40    = 1,
+    WIFI_CHAN_WIDTH_80    = 2,
+    WIFI_CHAN_WIDTH_160   = 3,
+    WIFI_CHAN_WIDTH_80P80 = 4,
+    WIFI_CHAN_WIDTH_5     = 5,
+    WIFI_CHAN_WIDTH_10    = 6,
+    WIFI_CHAN_WIDTH_INVALID = -1
+} wifi_channel_width;
+
+typedef int wifi_radio;
+typedef int wifi_channel;
+
+typedef struct {
+    wifi_channel_width width;
+    int center_frequency0;
+    int center_frequency1;
+    int primary_frequency;
+} wifi_channel_spec;
+
 typedef enum {
     WIFI_SUCCESS = 0,
     WIFI_ERROR_NONE = 0,
@@ -38,7 +65,9 @@
 typedef signed char s8;
 typedef uint16_t u16;
 typedef uint32_t u32;
+typedef int32_t s32;
 typedef uint64_t u64;
+typedef int64_t s64;
 typedef int wifi_request_id;
 typedef int wifi_channel;                       // indicates channel frequency in MHz
 typedef int wifi_rssi;
@@ -47,10 +76,8 @@
 typedef int64_t wifi_timestamp;                 // In microseconds (us)
 typedef int64_t wifi_timespan;                  // In nanoseconds  (ns)
 
-struct wifi_info;
-typedef wifi_info *wifi_handle;
-struct wifi_interface_info;
-typedef wifi_interface_info *wifi_interface_handle;
+typedef struct wifi_info *wifi_handle;
+typedef struct wifi_interface_info *wifi_interface_handle;
 
 /* Initialize/Cleanup */
 
@@ -80,8 +107,14 @@
 #define WIFI_FEATURE_EPR                0x4000      // Enhanced power reporting
 #define WIFI_FEATURE_AP_STA             0x8000      // Support for AP STA Concurrency
 #define WIFI_FEATURE_LINK_LAYER_STATS  0x10000      // Link layer stats collection
+#define WIFI_FEATURE_LOGGER            0x20000      // WiFi Logger
+#define WIFI_FEATURE_HAL_EPNO          0x40000      // WiFi PNO enhanced
+#define WIFI_FEATURE_RSSI_MONITOR      0x80000      // RSSI Monitor
+#define WIFI_FEATURE_MKEEP_ALIVE      0x100000      // WiFi mkeep_alive
+
 // Add more features here
 
+
 typedef int feature_set;
 
 #define IS_MASK_SET(mask, flags)        ((flags & mask) == mask)
@@ -98,7 +131,7 @@
  * all other combinations are invalid!
  */
 wifi_error wifi_get_concurrency_matrix(wifi_interface_handle handle, int set_size_max,
-       feature_set set[], int *set_size);
+        feature_set set[], int *set_size);
 
 /* multiple interface support */
 
@@ -113,6 +146,10 @@
     // More event handlers
 } wifi_event_handler;
 
+typedef struct {
+        void (*on_rssi_threshold_breached)(wifi_request_id id, u8 *cur_bssid, s8 cur_rssi);
+} wifi_rssi_event_handler;
+
 wifi_error wifi_set_iface_event_handler(wifi_request_id id, wifi_interface_handle iface, wifi_event_handler eh);
 wifi_error wifi_reset_iface_event_handler(wifi_request_id id, wifi_interface_handle iface);
 
@@ -124,6 +161,107 @@
 #include "link_layer_stats.h"
 #include "rtt.h"
 #include "tdls.h"
+#include "wifi_logger.h"
+#include "wifi_config.h"
+#include "wifi_nan.h"
+#include "wifi_offload.h"
+
+//wifi HAL function pointer table
+typedef struct {
+    wifi_error (* wifi_initialize) (wifi_handle *);
+    void (* wifi_cleanup) (wifi_handle, wifi_cleaned_up_handler);
+    void (*wifi_event_loop)(wifi_handle);
+    void (* wifi_get_error_info) (wifi_error , const char **);
+    wifi_error (* wifi_get_supported_feature_set) (wifi_interface_handle, feature_set *);
+    wifi_error (* wifi_get_concurrency_matrix) (wifi_interface_handle, int, feature_set *, int *);
+    wifi_error (* wifi_set_scanning_mac_oui) (wifi_interface_handle, unsigned char *);
+    wifi_error (* wifi_get_supported_channels)(wifi_handle, int *, wifi_channel *);
+    wifi_error (* wifi_is_epr_supported)(wifi_handle);
+    wifi_error (* wifi_get_ifaces) (wifi_handle , int *, wifi_interface_handle **);
+    wifi_error (* wifi_get_iface_name) (wifi_interface_handle, char *name, size_t);
+    wifi_error (* wifi_set_iface_event_handler) (wifi_request_id,wifi_interface_handle ,
+            wifi_event_handler);
+    wifi_error (* wifi_reset_iface_event_handler) (wifi_request_id, wifi_interface_handle);
+    wifi_error (* wifi_start_gscan) (wifi_request_id, wifi_interface_handle, wifi_scan_cmd_params,
+            wifi_scan_result_handler);
+    wifi_error (* wifi_stop_gscan)(wifi_request_id, wifi_interface_handle);
+    wifi_error (* wifi_get_cached_gscan_results)(wifi_interface_handle, byte, int,
+            wifi_cached_scan_results *, int *);
+    wifi_error (* wifi_set_bssid_hotlist)(wifi_request_id, wifi_interface_handle,
+            wifi_bssid_hotlist_params, wifi_hotlist_ap_found_handler);
+    wifi_error (* wifi_reset_bssid_hotlist)(wifi_request_id, wifi_interface_handle);
+    wifi_error (* wifi_set_significant_change_handler)(wifi_request_id, wifi_interface_handle,
+            wifi_significant_change_params, wifi_significant_change_handler);
+    wifi_error (* wifi_reset_significant_change_handler)(wifi_request_id, wifi_interface_handle);
+    wifi_error (* wifi_get_gscan_capabilities)(wifi_interface_handle, wifi_gscan_capabilities *);
+    wifi_error (* wifi_set_link_stats) (wifi_interface_handle, wifi_link_layer_params);
+    wifi_error (* wifi_get_link_stats) (wifi_request_id,wifi_interface_handle,
+            wifi_stats_result_handler);
+    wifi_error (* wifi_clear_link_stats)(wifi_interface_handle,u32, u32 *, u8, u8 *);
+    wifi_error (* wifi_get_valid_channels)(wifi_interface_handle,int, int, wifi_channel *, int *);
+    wifi_error (* wifi_rtt_range_request)(wifi_request_id, wifi_interface_handle, unsigned,
+            wifi_rtt_config[], wifi_rtt_event_handler);
+    wifi_error (* wifi_rtt_range_cancel)(wifi_request_id,  wifi_interface_handle, unsigned,
+            mac_addr[]);
+    wifi_error (* wifi_get_rtt_capabilities)(wifi_interface_handle, wifi_rtt_capabilities *);
+    wifi_error (* wifi_set_nodfs_flag)(wifi_interface_handle, u32);
+    wifi_error (* wifi_start_logging)(wifi_interface_handle, u32, u32, u32, u32, char *);
+    wifi_error (* wifi_set_epno_list)(int, wifi_interface_info *, int, wifi_epno_network *,
+            wifi_epno_handler);
+    wifi_error (* wifi_set_country_code)(wifi_interface_handle, const char *);
+    wifi_error (* wifi_get_firmware_memory_dump)( wifi_interface_handle iface,
+            wifi_firmware_memory_dump_handler handler);
+    wifi_error (* wifi_set_log_handler)(wifi_request_id id, wifi_interface_handle iface,
+        wifi_ring_buffer_data_handler handler);
+    wifi_error (* wifi_reset_log_handler)(wifi_request_id id, wifi_interface_handle iface);
+    wifi_error (* wifi_set_alert_handler)(wifi_request_id id, wifi_interface_handle iface,
+        wifi_alert_handler handler);
+    wifi_error (* wifi_reset_alert_handler)(wifi_request_id id, wifi_interface_handle iface);
+    wifi_error (* wifi_get_firmware_version)(wifi_interface_handle iface, char *buffer,
+            int buffer_size);
+    wifi_error (* wifi_get_ring_buffers_status)(wifi_interface_handle iface,
+            u32 *num_rings, wifi_ring_buffer_status *status);
+    wifi_error (* wifi_get_logger_supported_feature_set)(wifi_interface_handle iface,
+            unsigned int *support);
+    wifi_error (* wifi_get_ring_data)(wifi_interface_handle iface, char *ring_name);
+    wifi_error (* wifi_enable_tdls)(wifi_interface_handle, mac_addr, wifi_tdls_params *,
+            wifi_tdls_handler);
+    wifi_error (* wifi_disable_tdls)(wifi_interface_handle, mac_addr);
+    wifi_error (*wifi_get_tdls_status) (wifi_interface_handle, mac_addr, wifi_tdls_status *);
+    wifi_error (*wifi_get_tdls_capabilities)(wifi_interface_handle iface,
+            wifi_tdls_capabilities *capabilities);
+    wifi_error (* wifi_get_driver_version)(wifi_interface_handle iface, char *buffer,
+            int buffer_size);
+    wifi_error (* wifi_set_passpoint_list)(wifi_request_id id, wifi_interface_handle iface,
+            int num, wifi_passpoint_network *networks, wifi_passpoint_event_handler handler);
+    wifi_error (* wifi_reset_passpoint_list)(wifi_request_id id, wifi_interface_handle iface);
+    wifi_error (*wifi_set_bssid_blacklist)(wifi_request_id id, wifi_interface_handle iface,
+                  wifi_bssid_params params);
+    wifi_error (*wifi_enable_lazy_roam)(wifi_request_id id,
+                wifi_interface_handle iface, int enable);
+    wifi_error (*wifi_set_bssid_preference)(wifi_request_id id, wifi_interface_handle iface,
+                                            int num_bssid, wifi_bssid_preference *prefs);
+    wifi_error (*wifi_set_gscan_roam_params)(wifi_request_id id, wifi_interface_handle iface,
+                                                wifi_roam_params * params);
+    wifi_error (*wifi_set_ssid_white_list)(wifi_request_id id, wifi_interface_handle iface,
+                               int num_networks, wifi_ssid *ssids);
+    wifi_error (*wifi_set_lci) (wifi_request_id id, wifi_interface_handle iface,
+	                             wifi_lci_information *lci);
+    wifi_error (*wifi_set_lcr) (wifi_request_id id, wifi_interface_handle iface,
+	                             wifi_lcr_information *lcr);
+    wifi_error (*wifi_start_sending_offloaded_packet)(wifi_request_id id,
+                                wifi_interface_handle iface, u8 *ip_packet, u16 ip_packet_len,
+                                u8 *src_mac_addr, u8 *dst_mac_addr, u32 period_msec);
+    wifi_error (*wifi_stop_sending_offloaded_packet)(wifi_request_id id,
+                                wifi_interface_handle iface);
+    wifi_error (*wifi_start_rssi_monitoring)(wifi_request_id id, wifi_interface_handle
+                        iface, s8 max_rssi, s8 min_rssi, wifi_rssi_event_handler eh);
+    wifi_error (*wifi_stop_rssi_monitoring)(wifi_request_id id, wifi_interface_handle iface);
+} wifi_hal_fn;
+wifi_error init_wifi_vendor_hal_func_table(wifi_hal_fn *fn);
+#ifdef __cplusplus
+}
+#endif
 
 #endif
 
diff --git a/include/hardware_legacy/wifi_logger.h b/include/hardware_legacy/wifi_logger.h
new file mode 100644
index 0000000..9823aa3
--- /dev/null
+++ b/include/hardware_legacy/wifi_logger.h
@@ -0,0 +1,413 @@
+#include "wifi_hal.h"
+
+#ifndef __WIFI_HAL_LOGGER_H
+#define __WIFI_HAL_LOGGER_H
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif /* __cplusplus */
+
+#define LOGGER_MAJOR_VERSION    1
+#define LOGGER_MINOR_VERSION    0
+#define LOGGER_MICRO_VERSION    0
+
+
+
+/**
+ * WiFi logger life cycle is as follow:
+ *
+ * - At initialization time, framework will call wifi_get_ring_buffers_status
+ *   so as to obtain the names and list of supported buffers.
+ * - When WiFi operation start framework will call wifi_start_logging
+ *   so as to trigger log collection.
+ * - Developper UI will provide an option to the user, so as it can set the verbose level
+ *   of individual buffer as reported by wifi_get_ring_buffers_status.
+ * - During wifi operations, driver will periodically report per ring data to framework
+ *   by invoking the on_ring_buffer_data call back.
+ * - when capturing a bug report, framework will indicate to driver that all the data
+ *   has to be uploaded, urgently, by calling wifi_get_ring_data.
+ *
+ * The data uploaded by driver will be stored by framework in separate files, with one stream
+ *   of file per ring.
+ * Framework will store the files in pcapng format, allowing for easy merging and parsing
+ *   with network analyzer tools.
+ */
+
+
+typedef int wifi_radio;
+typedef int wifi_ring_buffer_id;
+
+#define PER_PACKET_ENTRY_FLAGS_DIRECTION_TX  1    // 0: TX, 1: RX
+#define PER_PACKET_ENTRY_FLAGS_TX_SUCCESS    2    // whether packet was transmitted or
+                                                  // received/decrypted successfully
+#define PER_PACKET_ENTRY_FLAGS_80211_HEADER  4    // has full 802.11 header, else has 802.3 header
+#define PER_PACKET_ENTRY_FLAGS_PROTECTED     8    // whether packet was encrypted
+
+typedef struct {
+    u8 flags;
+    u8 tid;     // transmit or received tid
+    u16 MCS;    // modulation and bandwidth
+    u8 rssi;    // TX: RSSI of ACK for that packet
+                // RX: RSSI of packet
+    u8 num_retries;                   // number of attempted retries
+    u16 last_transmit_rate;           // last transmit rate in .5 mbps
+    u16 link_layer_transmit_sequence; // transmit/reeive sequence for that MPDU packet
+    u64 firmware_entry_timestamp;     // TX: firmware timestamp (us) when packet is queued within
+                                      // firmware buffer for SDIO/HSIC or into PCIe buffer
+                                      // RX: firmware receive timestamp
+    u64 start_contention_timestamp; // firmware timestamp (us) when packet start contending for the
+                                    // medium for the first time, at head of its AC queue,
+                                    // or as part of an MPDU or A-MPDU. This timestamp is
+                                    // not updated for each retry, only the first transmit attempt.
+    u64 transmit_success_timestamp; // fimrware timestamp (us) when packet is successfully
+                                    // transmitted or aborted because it has exhausted
+                                    // its maximum number of retries.
+    u8 data[0]; // packet data. The length of packet data is determined by the entry_size field of
+                // the wifi_ring_buffer_entry structure. It is expected that first bytes of the
+                // packet, or packet headers only (up to TCP or RTP/UDP headers)
+                // will be copied into the ring
+} __attribute__((packed)) wifi_ring_per_packet_status_entry;
+
+
+/* Below events refer to the wifi_connectivity_event ring and shall be supported */
+#define WIFI_EVENT_ASSOCIATION_REQUESTED    0  // driver receives association command from kernel
+#define WIFI_EVENT_AUTH_COMPLETE            1
+#define WIFI_EVENT_ASSOC_COMPLETE           2
+#define WIFI_EVENT_FW_AUTH_STARTED          3  // fw event indicating auth frames are sent
+#define WIFI_EVENT_FW_ASSOC_STARTED         4  // fw event indicating assoc frames are sent
+#define WIFI_EVENT_FW_RE_ASSOC_STARTED      5  // fw event indicating reassoc frames are sent
+#define WIFI_EVENT_DRIVER_SCAN_REQUESTED    6
+#define WIFI_EVENT_DRIVER_SCAN_RESULT_FOUND 7
+#define WIFI_EVENT_DRIVER_SCAN_COMPLETE     8
+#define WIFI_EVENT_G_SCAN_STARTED           9
+#define WIFI_EVENT_G_SCAN_COMPLETE          10
+#define WIFI_EVENT_DISASSOCIATION_REQUESTED 11
+#define WIFI_EVENT_RE_ASSOCIATION_REQUESTED 12
+#define WIFI_EVENT_ROAM_REQUESTED           13
+#define WIFI_EVENT_BEACON_RECEIVED          14  // received beacon from AP (event enabled
+                                                // only in verbose mode)
+#define WIFI_EVENT_ROAM_SCAN_STARTED        15  // firmware has triggered a roam scan (not g-scan)
+#define WIFI_EVENT_ROAM_SCAN_COMPLETE       16  // firmware has completed a roam scan (not g-scan)
+#define WIFI_EVENT_ROAM_SEARCH_STARTED      17  // firmware has started searching for roam
+                                                // candidates (with reason =xx)
+#define WIFI_EVENT_ROAM_SEARCH_STOPPED      18  // firmware has stopped searching for roam
+                                                // candidates (with reason =xx)
+#define WIFI_EVENT_CHANNEL_SWITCH_ANOUNCEMENT     20 // received channel switch anouncement from AP
+#define WIFI_EVENT_FW_EAPOL_FRAME_TRANSMIT_START  21 // fw start transmit eapol frame, with
+                                                     // EAPOL index 1-4
+#define WIFI_EVENT_FW_EAPOL_FRAME_TRANSMIT_STOP   22 // fw gives up eapol frame, with rate,
+                                                     // success/failure and number retries
+#define WIFI_EVENT_DRIVER_EAPOL_FRAME_TRANSMIT_REQUESTED 23 // kernel queue EAPOL for transmission
+                                                            // in driver with EAPOL index 1-4
+#define WIFI_EVENT_FW_EAPOL_FRAME_RECEIVED        24 // with rate, regardless of the fact that
+                                                     // EAPOL frame is accepted or rejected by fw
+#define WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED    26 // with rate, and eapol index, driver has
+                                                     // received EAPOL frame and will queue it up
+                                                     // to wpa_supplicant
+#define WIFI_EVENT_BLOCK_ACK_NEGOTIATION_COMPLETE 27 // with success/failure, parameters
+#define WIFI_EVENT_BT_COEX_BT_SCO_START     28
+#define WIFI_EVENT_BT_COEX_BT_SCO_STOP      29
+#define WIFI_EVENT_BT_COEX_BT_SCAN_START    30  // for paging/scan etc., when BT starts transmiting
+                                                // twice per BT slot
+#define WIFI_EVENT_BT_COEX_BT_SCAN_STOP     31
+#define WIFI_EVENT_BT_COEX_BT_HID_START     32
+#define WIFI_EVENT_BT_COEX_BT_HID_STOP      33
+#define WIFI_EVENT_ROAM_AUTH_STARTED        34  // fw sends auth frame in roaming to next candidate
+#define WIFI_EVENT_ROAM_AUTH_COMPLETE       35  // fw receive auth confirm from ap
+#define WIFI_EVENT_ROAM_ASSOC_STARTED       36  // firmware sends assoc/reassoc frame in
+                                                // roaming to next candidate
+#define WIFI_EVENT_ROAM_ASSOC_COMPLETE      37  // firmware receive assoc/reassoc confirm from ap
+#define WIFI_EVENT_G_SCAN_STOP              38  // firmware sends stop G_SCAN
+#define WIFI_EVENT_G_SCAN_CYCLE_STARTED     39  // firmware indicates G_SCAN scan cycle started
+#define WIFI_EVENT_G_SCAN_CYCLE_COMPLETED   40  // firmware indicates G_SCAN scan cycle completed
+#define WIFI_EVENT_G_SCAN_BUCKET_STARTED    41  // firmware indicates G_SCAN scan start
+                                                // for a particular bucket
+#define WIFI_EVENT_G_SCAN_BUCKET_COMPLETED  42  // firmware indicates G_SCAN scan completed for
+                                                // for a particular bucket
+#define WIFI_EVENT_G_SCAN_RESULTS_AVAILABLE 43  // Event received from firmware about G_SCAN scan
+                                                // results being available
+#define WIFI_EVENT_G_SCAN_CAPABILITIES      44  // Event received from firmware with G_SCAN
+                                                // capabilities
+#define WIFI_EVENT_ROAM_CANDIDATE_FOUND     45  // Event received from firmware when eligible
+                                                // candidate is found
+#define WIFI_EVENT_ROAM_SCAN_CONFIG         46  // Event received from firmware when roam scan
+                                                // configuration gets enabled or disabled
+
+/**
+ * Parameters of wifi logger events are TLVs
+ * Event parameters tags are defined as:
+ */
+#define WIFI_TAG_VENDOR_SPECIFIC    0   // take a byte stream as parameter
+#define WIFI_TAG_BSSID              1   // takes a 6 bytes MAC address as parameter
+#define WIFI_TAG_ADDR               2   // takes a 6 bytes MAC address as parameter
+#define WIFI_TAG_SSID               3   // takes a 32 bytes SSID address as parameter
+#define WIFI_TAG_STATUS             4   // takes an integer as parameter
+#define WIFI_TAG_CHANNEL_SPEC       5   // takes one or more wifi_channel_spec as parameter
+#define WIFI_TAG_WAKE_LOCK_EVENT    6   // takes a wake_lock_event struct as parameter
+#define WIFI_TAG_ADDR1              7   // takes a 6 bytes MAC address as parameter
+#define WIFI_TAG_ADDR2              8   // takes a 6 bytes MAC address as parameter
+#define WIFI_TAG_ADDR3              9   // takes a 6 bytes MAC address as parameter
+#define WIFI_TAG_ADDR4              10  // takes a 6 bytes MAC address as parameter
+#define WIFI_TAG_TSF                11  // take a 64 bits TSF value as parameter
+#define WIFI_TAG_IE                 12  // take one or more specific 802.11 IEs parameter,
+                                        // IEs are in turn indicated in TLV format as per 
+                                        // 802.11 spec
+#define WIFI_TAG_INTERFACE          13  // take interface name as parameter
+#define WIFI_TAG_REASON_CODE        14  // take a reason code as per 802.11 as parameter
+#define WIFI_TAG_RATE_MBPS          15  // take a wifi rate in 0.5 mbps
+#define WIFI_TAG_REQUEST_ID         16  // take an integer as parameter
+#define WIFI_TAG_BUCKET_ID          17  // take an integer as parameter
+#define WIFI_TAG_GSCAN_PARAMS       18  // takes a wifi_scan_cmd_params struct as parameter
+#define WIFI_TAG_GSCAN_CAPABILITIES 19  // takes a wifi_gscan_capabilities struct as parameter
+#define WIFI_TAG_SCAN_ID            20  // take an integer as parameter
+#define WIFI_TAG_RSSI               21  // take an integer as parameter
+#define WIFI_TAG_CHANNEL            22  // take an integer as parameter
+#define WIFI_TAG_LINK_ID            23  // take an integer as parameter
+#define WIFI_TAG_LINK_ROLE          24  // take an integer as parameter
+#define WIFI_TAG_LINK_STATE         25  // take an integer as parameter
+#define WIFI_TAG_LINK_TYPE          26  // take an integer as parameter
+#define WIFI_TAG_TSCO               27  // take an integer as parameter
+#define WIFI_TAG_RSCO               28  // take an integer as parameter
+#define WIFI_TAG_EAPOL_MESSAGE_TYPE 29  // take an integer as parameter
+                                        // M1-1, M2-2, M3-3, M4-4
+
+typedef struct {
+    u16 tag;
+    u16 length; // length of value
+    u8 value[0];
+} __attribute__((packed)) tlv_log;
+
+typedef struct {
+    u16 event;
+    tlv_log tlvs[0];   // separate parameter structure per event to be provided and optional data
+                       // the event_data is expected to include an official android part, with some
+                       // parameter as transmit rate, num retries, num scan result found etc...
+                       // as well, event_data can include a vendor proprietary part which is
+                       // understood by the developer only.
+} __attribute__((packed)) wifi_ring_buffer_driver_connectivity_event;
+
+
+/**
+ * Ring buffer name for power events ring. note that power event are extremely frequents
+ * and thus should be stored in their own ring/file so as not to clobber connectivity events.
+ */
+typedef struct {
+    int status;      // 0 taken, 1 released
+    int reason;      // reason why this wake lock is taken
+    char name[0];    // null terminated
+} __attribute__((packed)) wake_lock_event;
+
+typedef struct {
+    u16 event;
+    tlv_log tlvs[0];
+} __attribute__((packed)) wifi_power_event;
+
+
+/**
+ * This structure represent a logger entry within a ring buffer.
+ * Wifi driver are responsible to manage the ring buffer and write the debug
+ * information into those rings.
+ *
+ * In general, the debug entries can be used to store meaningful 802.11 information (SME, MLME,
+ * connection and packet statistics) as well as vendor proprietary data that is specific to a
+ * specific driver or chipset.
+ * Binary entries can be used so as to store packet data or vendor specific information and
+ * will be treated as blobs of data by android.
+ *
+ * A user land process will be started by framework so as to periodically retrieve the
+ * data logged by drivers into their ring buffer, store the data into log files and include
+ * the logs into android bugreports.
+ */
+enum {
+    RING_BUFFER_ENTRY_FLAGS_HAS_BINARY = (1 << (0)),    // set for binary entries
+    RING_BUFFER_ENTRY_FLAGS_HAS_TIMESTAMP = (1 << (1))  // set if 64 bits timestamp is present
+};
+
+enum {
+    ENTRY_TYPE_CONNECT_EVENT = 1,
+    ENTRY_TYPE_PKT,
+    ENTRY_TYPE_WAKE_LOCK,
+    ENTRY_TYPE_POWER_EVENT,
+    ENTRY_TYPE_DATA
+};
+
+typedef struct {
+    u16 entry_size; // the size of payload excluding the header.
+    u8 flags;
+    u8 type;        // entry type
+    u64 timestamp;  // present if has_timestamp bit is set.
+} __attribute__((packed)) wifi_ring_buffer_entry;
+
+#define WIFI_RING_BUFFER_FLAG_HAS_BINARY_ENTRIES 0x00000001   // set if binary entries are present
+#define WIFI_RING_BUFFER_FLAG_HAS_ASCII_ENTRIES  0x00000002   // set if ascii entries are present
+
+
+/* ring buffer params */
+/**
+ * written_bytes and read_bytes implement a producer consumer API
+ *     hence written_bytes >= read_bytes
+ * a modulo arithmetic of the buffer size has to be applied to those counters:
+ * actual offset into ring buffer = written_bytes % ring_buffer_byte_size
+ *
+ */
+typedef struct {
+    u8 name[32];
+    u32 flags;
+    wifi_ring_buffer_id ring_id; // unique integer representing the ring
+    u32 ring_buffer_byte_size;   // total memory size allocated for the buffer
+    u32 verbose_level;           // verbose level for ring buffer
+    u32 written_bytes;           // number of bytes that was written to the buffer by driver,
+                                 // monotonously increasing integer
+    u32 read_bytes;              // number of bytes that was read from the buffer by user land,
+                                 // monotonously increasing integer
+    u32 written_records;         // number of records that was written to the buffer by driver,
+                                 // monotonously increasing integer
+} wifi_ring_buffer_status;
+
+
+/**
+ * Callback for reporting ring data
+ *
+ * The ring buffer data collection is event based:
+ *   - Driver calls on_ring_buffer_data when new records are available, the wifi_ring_buffer_status
+ *     passed up to framework in the call back indicates to framework if more data is available in
+ *     the ring buffer. It is not expected that driver will necessarily always empty the ring
+ *     immediately as data is available, instead driver will report data every X seconds or if
+ *     N bytes are available.
+ *   - In the case where a bug report has to be captured, framework will require driver to upload
+ *     all data immediately. This is indicated to driver when framework calls wifi_get_ringdata.
+ *     When framework calls wifi_get_ring_data, driver will start sending all available data in the
+ *     indicated ring by repeatedly invoking the on_ring_buffer_data callback.
+ *
+ * The callback is called by log handler whenever ring data comes in driver.
+ */
+typedef struct {
+  void (*on_ring_buffer_data) (char *ring_name, char *buffer, int buffer_size,
+        wifi_ring_buffer_status *status);
+} wifi_ring_buffer_data_handler;
+
+/**
+ * API to set the log handler for getting ring data
+ *  - Only a single instance of log handler can be instantiated for each ring buffer.
+ */
+wifi_error wifi_set_log_handler(wifi_request_id id, wifi_interface_handle iface,
+    wifi_ring_buffer_data_handler handler);
+
+/* API to reset the log handler */
+wifi_error wifi_reset_log_handler(wifi_request_id id, wifi_interface_handle iface);
+
+
+/**
+ * Callback for reporting FW dump
+ *
+ * The buffer data collection is event based such as FW health check or FW dump.
+ * The callback is called by alert handler.
+ */
+typedef struct {
+   void (*on_alert) (wifi_request_id id, char *buffer, int buffer_size, int err_code);
+} wifi_alert_handler;
+
+/*
+ * API to set the alert handler for the alert case in Wi-Fi Chip
+ *  - Only a single instance of alert handler can be instantiated.
+ */
+wifi_error wifi_set_alert_handler(wifi_request_id id, wifi_interface_handle iface,
+    wifi_alert_handler handler);
+
+/* API to reset the alert handler */
+wifi_error wifi_reset_alert_handler(wifi_request_id id, wifi_interface_handle iface);
+
+/* API for framework to indicate driver has to upload and drain all data of a given ring */
+wifi_error wifi_get_ring_data(wifi_interface_handle iface, char *ring_name);
+
+
+/**
+ * API to trigger the debug collection.
+ *  Unless his API is invoked - logging is not triggered.
+ *  - Verbose_level 0 corresponds to no collection,
+ *    and it makes log handler stop by no more events from driver.
+ *  - Verbose_level 1 correspond to normal log level, with minimal user impact.
+ *    This is the default value.
+ *  - Verbose_level 2 are enabled when user is lazily trying to reproduce a problem,
+ *    wifi performances and power can be impacted but device should not otherwise be
+ *    significantly impacted.
+ *  - Verbose_level 3+ are used when trying to actively debug a problem.
+ *
+ * ring_name represent the name of the ring for which data collection shall start.
+ *
+ * flags: TBD parameter used to enable/disable specific events on a ring
+ * max_interval: maximum interval in seconds for driver to invoke on_ring_buffer_data,
+ *               ignore if zero
+ * min_data_size: minimum data size in buffer for driver to invoke on_ring_buffer_data,
+ *                ignore if zero
+ */
+wifi_error wifi_start_logging(wifi_interface_handle iface, u32 verbose_level, u32 flags,
+    u32 max_interval_sec, u32 min_data_size, char *ring_name);
+
+/**
+ * API to get the status of all ring buffers supported by driver.
+ *  - Caller is responsible to allocate / free ring buffer status.
+ *  - Maximum no of ring buffer would be 10.
+ */
+wifi_error wifi_get_ring_buffers_status(wifi_interface_handle iface, u32 *num_rings,
+    wifi_ring_buffer_status *status);
+
+/**
+ * Synchronous memory dump by user request.
+ *  - Caller is responsible to store memory dump data into a local,
+ *      e.g., /data/misc/wifi/memdump.bin
+ */
+typedef struct {
+    void (*on_firmware_memory_dump) (char *buffer, int buffer_size);
+} wifi_firmware_memory_dump_handler;
+
+/**
+ * API to collect a firmware memory dump for a given iface by async memdump event.
+ *  - Triggered by Alerthandler, esp. when FW problem or FW health check happens
+ *  - Caller is responsible to store fw dump data into a local,
+ *      e.g., /data/misc/wifi/alertdump-1.bin
+ */
+wifi_error wifi_get_firmware_memory_dump(wifi_interface_handle iface,
+    wifi_firmware_memory_dump_handler handler);
+
+/**
+ * API to collect a firmware version string.
+ *  - Caller is responsible to allocate / free a buffer to retrieve firmware verion info.
+ *  - Max string will be at most 256 bytes.
+ */
+wifi_error wifi_get_firmware_version(wifi_interface_handle iface, char *buffer, int buffer_size);
+
+/**
+ * API to collect a driver version string.
+ *  - Caller is responsible to allocate / free a buffer to retrieve driver verion info.
+ *  - Max string will be at most 256 bytes.
+ */
+wifi_error wifi_get_driver_version(wifi_interface_handle iface, char *buffer, int buffer_size);
+
+
+/* Feature set */
+enum {
+    WIFI_LOGGER_MEMORY_DUMP_SUPPORTED = (1 << (0)),             // Memory dump of FW
+    WIFI_LOGGER_PER_PACKET_TX_RX_STATUS_SUPPORTED = (1 << (1)), // PKT status
+    WIFI_LOGGER_CONNECT_EVENT_SUPPORTED = (1 << (2)),           // Connectivity event
+    WIFI_LOGGER_POWER_EVENT_SUPPORTED = (1 << (3)),             // POWER of Driver
+    WIFI_LOGGER_WAKE_LOCK_SUPPORTED = (1 << (4)),               // WAKE LOCK of Driver
+    WIFI_LOGGER_VERBOSE_SUPPORTED = (1 << (5)),                 // verbose log of FW
+    WIFI_LOGGER_WATCHDOG_TIMER_SUPPORTED = (1 << (6))           // monitor the health of FW
+};
+
+/**
+ * API to retrieve the current supportive features.
+ *  - An integer variable is enough to have bit mapping info by caller.
+ */
+wifi_error wifi_get_logger_supported_feature_set(wifi_interface_handle iface,
+    unsigned int *support);
+
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /*__WIFI_HAL_STATS_ */
+
diff --git a/include/hardware_legacy/wifi_nan.h b/include/hardware_legacy/wifi_nan.h
new file mode 100755
index 0000000..70e97f1
--- /dev/null
+++ b/include/hardware_legacy/wifi_nan.h
@@ -0,0 +1,877 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __NAN_H__
+#define __NAN_H__
+
+#include "wifi_hal.h"
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif /* __cplusplus */
+
+/*****************************************************************************
+ * NAN Discovery Service Structures and Functions
+ *****************************************************************************/
+
+/*
+  Definitions
+  All multi-byte fields within all NAN protocol stack messages are assumed to be in Little Endian order.
+*/
+
+typedef int NanVersion;
+
+#define NAN_MAC_ADDR_LEN                6
+#define NAN_COUNTRY_STRING_LEN          3
+#define NAN_MAJOR_VERSION               1
+#define NAN_MINOR_VERSION               0
+#define NAN_MICRO_VERSION               0
+
+/* NAN Maximum Lengths */
+#define NAN_MAX_SERVICE_NAME_LEN                255
+#define NAN_MAX_MATCH_FILTER_LEN                255
+#define NAN_MAX_SERVICE_SPECIFIC_INFO_LEN       1024
+
+/*
+  Definition of various NanRequestType
+*/
+typedef enum {
+    NAN_REQUEST_ENABLE                  =0,
+    NAN_REQUEST_DISABLE                 =1,
+    NAN_REQUEST_PUBLISH                 =2,
+    NAN_REQUEST_PUBLISH_CANCEL          =3,
+    NAN_REQUEST_TRANSMIT_FOLLOWUP       =4,
+    NAN_REQUEST_SUBSCRIBE               =5,
+    NAN_REQUEST_SUBSCRIBE_CANCEL        =6,
+    NAN_REQUEST_STATS                   =7,
+    NAN_REQUEST_CONFIG                  =8,
+    NAN_REQUEST_TCA                     =9,
+    NAN_REQUEST_LAST                    =0xFFFF
+} NanRequestType;
+
+/*
+  Definition of various NanResponseType
+*/
+typedef enum {
+    NAN_RESPONSE_ENABLED                =0,
+    NAN_RESPONSE_DISABLED               =1,
+    NAN_RESPONSE_PUBLISH                =2,
+    NAN_RESPONSE_PUBLISH_CANCEL         =3,
+    NAN_RESPONSE_TRANSMIT_FOLLOWUP      =4,
+    NAN_RESPONSE_SUBSCRIBE              =5,
+    NAN_RESPONSE_SUBSCRIBE_CANCEL       =6,
+    NAN_RESPONSE_STATS                  =7,
+    NAN_RESPONSE_CONFIG                 =8,
+    NAN_RESPONSE_TCA                    =9,
+    NAN_RESPONSE_ERROR                  =10,
+    NAN_RESPONSE_UNKNOWN                =0xFFFF
+} NanResponseType;
+
+/*
+  Definition of various NanIndication(events)
+*/
+typedef enum {
+    NAN_INDICATION_PUBLISH_REPLIED         =0,
+    NAN_INDICATION_PUBLISH_TERMINATED      =1,
+    NAN_INDICATION_SUBSCRIBE_MATCH         =2,
+    NAN_INDICATION_SUBSCRIBE_UNMATCH       =3,
+    NAN_INDICATION_SUBSCRIBE_TERMINATED    =4,
+    NAN_INDICATION_DE_EVENT                =5,
+    NAN_INDICATION_FOLLOWUP                =6,
+    NAN_INDICATION_DISABLED                =7,
+    NAN_INDICATION_TCA                     =8,
+    NAN_INDICATION_UNKNOWN                 =0xFFFF
+} NanIndicationType;
+
+
+/* NAN Publish Types */
+typedef enum {
+    NAN_PUBLISH_TYPE_UNSOLICITED = 0,
+    NAN_PUBLISH_TYPE_SOLICITED,
+    NAN_PUBLISH_TYPE_UNSOLICITED_SOLICITED,
+    NAN_PUBLISH_TYPE_LAST,
+} NanPublishType;
+
+/* NAN Transmit Priorities */
+typedef enum {
+    NAN_TX_PRIORITY_LOW = 0,
+    NAN_TX_PRIORITY_NORMAL,
+    NAN_TX_PRIORITY_HIGH,
+    NAN_TX_PRIORITY_LAST
+} NanTxPriority;
+
+/* NAN Statistics Request ID Codes */
+typedef enum
+{
+    NAN_STATS_ID_FIRST = 0,
+    NAN_STATS_ID_DE_PUBLISH = NAN_STATS_ID_FIRST,
+    NAN_STATS_ID_DE_SUBSCRIBE,
+    NAN_STATS_ID_DE_MAC,
+    NAN_STATS_ID_DE_TIMING_SYNC,
+    NAN_STATS_ID_DE_DW,
+    NAN_STATS_ID_DE,
+    NAN_STATS_ID_LAST
+} NanStatsId;
+
+/* NAN Protocol Event ID Codes */
+typedef enum
+{
+    NAN_EVENT_ID_FIRST = 0,
+    NAN_EVENT_ID_SELF_STA_MAC_ADDR = NAN_EVENT_ID_FIRST,
+    NAN_EVENT_ID_STARTED_CLUSTER,
+    NAN_EVENT_ID_JOINED_CLUSTER,
+    NAN_EVENT_ID_LAST
+} NanEventId;
+
+/* TCA IDs */
+typedef enum
+{
+    NAN_TCA_ID_FIRST = 0,
+    NAN_TCA_ID_CLUSTER_SIZE = NAN_TCA_ID_FIRST,
+    NAN_TCA_ID_LAST
+} NanTcaId;
+
+/*
+  Various NAN Protocol Response code
+*/
+typedef enum
+{
+    /* NAN Protocol Response Codes */
+    NAN_STATUS_SUCCESS = 0,
+    NAN_STATUS_TIMEOUT,
+    NAN_STATUS_DE_FAILURE,
+    NAN_STATUS_INVALID_MSG_VERSION,
+    NAN_STATUS_INVALID_MSG_LEN,
+    NAN_STATUS_INVALID_MSG_ID,
+    NAN_STATUS_INVALID_HANDLE,
+    NAN_STATUS_NO_SPACE_AVAILABLE,
+    NAN_STATUS_INVALID_PUBLISH_TYPE,
+    NAN_STATUS_INVALID_TX_TYPE,
+    NAN_STATUS_INVALID_MATCH_ALGORITHM,
+    NAN_STATUS_DISABLE_IN_PROGRESS,
+    NAN_STATUS_INVALID_TLV_LEN,
+    NAN_STATUS_INVALID_TLV_TYPE,
+    NAN_STATUS_MISSING_TLV_TYPE,
+    NAN_STATUS_INVALID_TOTAL_TLVS_LEN,
+    NAN_STATUS_INVALID_MATCH_HANDLE,
+    NAN_STATUS_INVALID_TLV_VALUE,
+    NAN_STATUS_INVALID_TX_PRIORITY,
+    NAN_STATUS_INVALID_TCA_ID,
+    NAN_STATUS_INVALID_STATS_ID,
+
+    /* NAN Configuration Response codes */
+    NAN_STATUS_INVALID_RSSI_CLOSE_VALUE = 128,
+    NAN_STATUS_INVALID_RSSI_MEDIUM_VALUE,
+    NAN_STATUS_INVALID_HOP_COUNT_LIMIT,
+    NAN_STATUS_INVALID_CLUSTER_JOIN_COUNT,
+    NAN_STATUS_INVALID_MIN_WAKE_DW_DURATION_VALUE,
+    NAN_STATUS_INVALID_OFDM_DATA_RATE_VALUE,
+    NAN_STATUS_INVALID_RANDOM_FACTOR_UPDATE_TIME_VALUE,
+    NAN_STATUS_INVALID_MASTER_PREFERENCE_VALUE,
+    NAN_STATUS_INVALID_EARLY_DW_WAKE_INTERVAL_VALUE,
+    NAN_STATUS_INVALID_LOW_CLUSTER_ID_VALUE,
+    NAN_STATUS_INVALID_HIGH_CLUSTER_ID_VALUE,
+    NAN_STATUS_INVALID_INITIAL_SCAN_PERIOD,
+    NAN_STATUS_INVALID_ONGOING_SCAN_PERIOD,
+    NAN_STATUS_INVALID_RSSI_PROXIMITY_VALUE
+} NanStatusType;
+
+/*
+  Various NAN Terminated Indication Code
+*/
+typedef enum
+{
+    NAN_TERMINATED_REASON_INVALID = 0,
+    NAN_TERMINATED_REASON_TIMEOUT,
+    NAN_TERMINATED_REASON_USER_REQUEST,
+    NAN_TERMINATED_REASON_FAILURE,
+    NAN_TERMINATED_REASON_COUNT_REACHED,
+    NAN_TERMINATED_REASON_DE_SHUTDOWN,
+    NAN_TERMINATED_REASON_DISABLE_IN_PROGRESS
+} NanTerminatedStatus;
+
+/* NAN Transmit Types */
+typedef enum
+{
+    NAN_TX_TYPE_BROADCAST = 0,
+    NAN_TX_TYPE_UNICAST,
+    NAN_TX_TYPE_LAST
+} NanTxType;
+
+/* NAN Subscribe Type Bit */
+#define NAN_SUBSCRIBE_TYPE_PASSIVE  0
+#define NAN_SUBSCRIBE_TYPE_ACTIVE   1
+
+/* NAN Service Response Filter Attribute Bit */
+#define NAN_SRF_ATTR_BLOOM_FILTER       0
+#define NAN_SRF_ATTR_PARTIAL_MAC_ADDR   1
+
+/* NAN Service Response Filter Include Bit */
+#define NAN_SRF_INCLUDE_DO_NOT_RESPOND  0
+#define NAN_SRF_INCLUDE_RESPOND         1
+
+/* NAN Match Algorithms */
+typedef enum
+{
+    NAN_MATCH_ALG_FIRST = 0,
+    NAN_MATCH_ALG_MATCH_ONCE = NAN_MATCH_ALG_FIRST,
+    NAN_MATCH_ALG_MATCH_CONTINUOUS,
+    NAN_MATCH_ALG_LAST
+} NanMatchAlg;
+
+/* NAN Header */
+typedef struct {
+    /*
+    16-bit quantity which is allocated by the FW.
+    Pass the Handle as 0xFFFF if the Host would like to set up a new
+    Publish/Subscribe and the FW will pass back a valid handle in response msg.
+    To update an already opened Publish/Subscribe Host can pass a Handle
+    which has already been allocated by the FW.
+    */
+    u16 handle;
+
+    /*
+    16-bit quantity which is allocated in 2 contexts.  For all Request
+    messages the TransactionId is allocated by the Service Layer and
+    passed down to the DE.  In all Indication messages the TransactionId
+    field is allocated by the DE.  There is no correlation between the
+    TransactionIds allocated by the Service Layer and those allocated by the DE
+    */
+    u16 transaction_id;
+} NanHeader;
+
+/*
+  Enable Request Message Structure
+  The NanEnableReq message instructs the Discovery Engine to enter an operational state
+*/
+typedef struct {
+    NanHeader header;
+    u8 support_5g; /* default = 0 */
+    u16 cluster_low; /* default = 0 */
+    u16 cluster_high; /* default = 0 */
+    u8 sid_beacon; /* default = 0x80 */
+    u8 sync_disc_5g; /* default  = 1 i.e 5G Discovery frames only*/
+    u8 rssi_close; /* default = 60 (-60 dBm) */
+    u8 rssi_middle; /* default = 70 (-70 dBm) */
+    u8 rssi_proximity; /* default = 70 (-70 dBm) */
+    u8 hop_count_limit; /* default = 2 */
+    u8 random_time; /* default  = 120 (DWs) */
+    u8 master_pref; /* default = 0 */
+    u8 periodic_scan_interval; /* default = 20 seconds */
+    /* TBD: Google specific IE */
+}NanEnableRequest;
+
+/*
+  Disable Request Message Structure
+  The NanDisableReq message instructs the Discovery Engine to exit an operational state.
+*/
+typedef struct {
+    NanHeader header;
+}NanDisableRequest;
+
+/*
+  Publish Msg Structure
+  Message is used to request the DE to publish the Service Name
+  using the parameters passed into the Discovery Window
+*/
+typedef struct {
+    NanHeader header;
+    u16 ttl; /* how many seconds to run for. 0 means forever until canceled */
+    u16 period; /* periodicity of OTA unsolicited publish. Specified in increments of 500 ms */
+    u8 replied_event_flag; /* 1= RepliedEventInd needed, 0 = Not needed */
+    NanPublishType publish_type;/* 0= unsolicited, solicited = 1, 2= both */
+    NanTxType tx_type; /* 0 = broadcast, 1= unicast  if solicited publish */
+    u8 publish_count; /* number of OTA Publish, 0 means forever until canceled */
+    u16 service_name_len; /* length of service name */
+    u8 service_name[NAN_MAX_SERVICE_NAME_LEN];/* UTF-8 encoded string identifying the service */
+
+    /* Sequence of values which should be conveyed to the Discovery Engine of a
+    NAN Device that has invoked a Subscribe method corresponding to this Publish method
+    */
+    u16 service_specific_info_len;
+    u8 service_specific_info[NAN_MAX_SERVICE_SPECIFIC_INFO_LEN];
+
+    /* Ordered sequence of <length, value> pairs which specify further response conditions
+    beyond the service name used to filter subscribe messages to respond to.
+    This is only needed when the PT is set to NAN_SOLICITED or NAN_SOLICITED_UNSOLICITED.
+    */
+    u16 rx_match_filter_len;
+    u8 rx_match_filter[NAN_MAX_MATCH_FILTER_LEN];
+
+    /* Ordered sequence of <length, value> pairs to be included in the Discovery Frame.
+    If present it is always sent in a Discovery Frame
+    */
+    u16 tx_match_filter_len;
+    u8 tx_match_filter[NAN_MAX_MATCH_FILTER_LEN];
+}NanPublishRequest;
+
+/*
+  Publish Cancel Msg Structure
+  The PublishServiceCancelReq Message is used to request the DE to stop publishing
+  the Service Name identified by the handle in the message.
+*/
+typedef struct {
+    NanHeader header;
+}NanPublishCancelRequest;
+
+/*
+  NAN Subscribe Structure
+  The SubscribeServiceReq message is sent to the Discovery Engine
+  whenever the Upper layers would like to listen for a Service Name
+*/
+typedef struct {
+    NanHeader header;
+    u16 ttl; /* how many seconds to run for. 0 means forever until canceled */
+    u16 period;/* periodicity of OTA Active Subscribe. Units in increments of 500 ms , 0 = attempt every DW*/
+
+    /* Flag which specifies how the Subscribe request shall be processed. */
+    u8 subscribe_type; /* 0 - PASSIVE , 1- ACTIVE */
+
+    /* Flag which specifies on Active Subscribes how the Service Response Filter attribute is populated.*/
+    u8 serviceResponseFilter; /* 0 - Bloom Filter, 1 - MAC Addr */
+
+    /* Flag which specifies how the Service Response Filter Include bit is populated.*/
+    u8 serviceResponseInclude; /* 0=Do not respond if in the Address Set, 1= Respond */
+
+    /* Flag which specifies if the Service Response Filter should be used when creating Subscribes.*/
+    u8 useServiceResponseFilter; /* 0=Do not send the Service Response Filter,1= send */
+
+    /* Flag which specifies if the Service Specific Info is needed in the Publish message before creating the MatchIndication*/
+    u8 ssiRequiredForMatchIndication; /* 0=Not needed, 1= Required */
+
+    /* Field which allows the matching behavior to be controlled.  */
+    NanMatchAlg subscribe_match; /* 0 - Match Once, 1 - Match continuous */
+
+    /* The number of Subscribe Matches which should occur before the Subscribe request is automatically terminated.*/
+    u8 subscribe_count; /* If this value is 0 this field is not used by the DE.*/
+
+    u16 service_name_len;/* length of service name */
+    u8 service_name[NAN_MAX_SERVICE_NAME_LEN]; /* UTF-8 encoded string identifying the service */
+
+    /* Sequence of values which further specify the published service beyond the service name*/
+    u16 service_specific_info_len;
+    u8 service_specific_info[NAN_MAX_SERVICE_SPECIFIC_INFO_LEN];
+
+    /* Ordered sequence of <length, value> pairs used to filter out received publish discovery messages.
+    This can be sent both for a Passive or an Active Subscribe
+    */
+    u16 rx_match_filter_len;
+    u8 rx_match_filter[NAN_MAX_MATCH_FILTER_LEN];
+
+    /* Ordered sequence of <length, value> pairs  included in the Discovery Frame when an Active Subscribe is used.*/
+    u16 tx_match_filter_len;
+    u8 tx_match_filter[NAN_MAX_MATCH_FILTER_LEN];
+}NanSubscribeRequest;
+
+
+/*
+  NAN Subscribe Cancel Structure
+  The SubscribeCancelReq Message is used to request the DE to stop looking for the Service Name.
+*/
+typedef struct {
+    NanHeader header;
+}NanSubscribeCancelRequest;
+
+
+/*
+  Transmit follow up Structure
+  The TransmitFollowupReq message is sent to the DE to allow the sending of the Service_Specific_Info
+  to a particular MAC address.
+*/
+typedef struct {
+    NanHeader header;
+    u8 addr[NAN_MAC_ADDR_LEN]; /* Can be a broadcast/multicast or unicast address */
+    NanTxPriority priority; /* priority of the request 0 = low, 1=normal, 2=high */
+    u8 dw_or_faw; /* 0= send in a DW, 1=send in FAW */
+
+    /* Sequence of values which further specify the published service beyond the service name
+    Treated as service specific info in case dw_or_faw is set to 0
+    Treated as extended service specific info in case dw_or_faw is set to non-zero*/
+    u16 service_specific_info_len;
+    u8 service_specific_info[NAN_MAX_SERVICE_SPECIFIC_INFO_LEN];
+}NanTransmitFollowupRequest;
+
+/*
+  Stats Request structure
+  The Discovery Engine can be queried at runtime by the Host processor for statistics
+  concerning various parts of the Discovery Engine.
+*/
+typedef struct {
+    NanHeader header;
+    NanStatsId stats_id; /* NAN Statistics Request ID Codes */
+    u8 clear; /* 0= Do not clear the stats and return the current contents , 1= Clear the associated stats  */
+}NanStatsRequest;
+
+/*
+  Config Structure
+  The NanConfigurationReq message is sent by the Host to the
+  Discovery Engine in order to configure the Discovery Engine during runtime.
+*/
+typedef struct {
+    NanHeader header;
+    u8 sid_beacon; /* default = 0x80 */
+    u8 sync_disc_5g; /* default  = 1 i.e 5G Discovery frames only*/
+    u8 rssi_proximity; /* default = 70 (-70 dBm) */
+    u8 random_time; /* default  = 120 (DWs) */
+    u8 master_pref; /* default = 0 */
+    u8 periodic_scan_interval; /* default = 20 seconds */
+    /* The number of Additional Discovery Window slots in
+       increments of 16 ms.  Since each DW is 512 TUs apart
+       and the DW takes up 1 slot, the maximum number of additional
+       slots which can be specified is 31.  This is a hint to the
+       scheduler and there is no guarantee that all 31 slots will
+       be available because of MCC and BT Coexistence channel usage
+    */
+    u8 additional_disc_window_slots; /* default = 0.*/
+}NanConfigRequest;
+
+/*
+  TCA Structure
+  The Discovery Engine can be configured to send up Events whenever a configured
+  Threshold Crossing Alert (TCA) Id crosses an integral threshold in a particular direction.
+*/
+typedef struct {
+    NanHeader header;
+    NanTcaId tca_id; /* Nan Protocol Threshold Crossing Alert (TCA) Codes */
+
+    /* flag which control whether or not an event is generated for the Rising direction */
+    u8 rising_direction_evt_flag; /* 0 - no event, 1 - event */
+
+    /* flag which control whether or not an event is generated for the Falling direction */
+    u8 falling_direction_evt_flag;/* 0 - no event, 1 - event */
+
+    /* flag which requests a previous TCA request to be cleared from the DE */
+    u8 clear;/*0= Do not clear the TCA, 1=Clear the TCA */
+
+    /* 32 bit value which represents the threshold to be used.*/
+    u32 threshold;
+}NanTCARequest;
+
+/* Publish statistics. */
+typedef struct
+{
+    u32 validPublishServiceReqMsgs;
+    u32 validPublishServiceRspMsgs;
+    u32 validPublishServiceCancelReqMsgs;
+    u32 validPublishServiceCancelRspMsgs;
+    u32 validPublishRepliedIndMsgs;
+    u32 validPublishTerminatedIndMsgs;
+    u32 validActiveSubscribes;
+    u32 validMatches;
+    u32 validFollowups;
+    u32 invalidPublishServiceReqMsgs;
+    u32 invalidPublishServiceCancelReqMsgs;
+    u32 invalidActiveSubscribes;
+    u32 invalidMatches;
+    u32 invalidFollowups;
+    u32 publishCount;
+} NanPublishStats;
+
+/* Subscribe statistics. */
+typedef struct
+{
+    u32 validSubscribeServiceReqMsgs;
+    u32 validSubscribeServiceRspMsgs;
+    u32 validSubscribeServiceCancelReqMsgs;
+    u32 validSubscribeServiceCancelRspMsgs;
+    u32 validSubscribeTerminatedIndMsgs;
+    u32 validSubscribeMatchIndMsgs;
+    u32 validSubscribeUnmatchIndMsgs;
+    u32 validSolicitedPublishes;
+    u32 validMatches;
+    u32 validFollowups;
+    u32 invalidSubscribeServiceReqMsgs;
+    u32 invalidSubscribeServiceCancelReqMsgs;
+    u32 invalidSubscribeFollowupReqMsgs;
+    u32 invalidSolicitedPublishes;
+    u32 invalidMatches;
+    u32 invalidFollowups;
+    u32 subscribeCount;
+    u32 bloomFilterIndex;
+} NanSubscribeStats;
+
+/* NAN MAC Statistics. Used for MAC and DW statistics. */
+typedef struct
+{
+    /* RX stats */
+    u32 validFrames;
+    u32 validActionFrames;
+    u32 validBeaconFrames;
+    u32 ignoredActionFrames;
+    u32 ignoredBeaconFrames;
+    u32 invalidFrames;
+    u32 invalidActionFrames;
+    u32 invalidBeaconFrames;
+    u32 invalidMacHeaders;
+    u32 invalidPafHeaders;
+    u32 nonNanBeaconFrames;
+
+    u32 earlyActionFrames;
+    u32 inDwActionFrames;
+    u32 lateActionFrames;
+
+    /* TX stats */
+    u32 framesQueued;
+    u32 totalTRSpUpdates;
+    u32 completeByTRSp;
+    u32 completeByTp75DW;
+    u32 completeByTendDW;
+    u32 lateActionFramesTx;
+
+    /* Misc stats - ignored for DW. */
+    u32 twIncreases;
+    u32 twDecreases;
+    u32 twChanges;
+    u32 twHighwater;
+    u32 bloomFilterIndex;
+} NanMacStats;
+
+/* NAN Sync Statistics*/
+typedef struct
+{
+    u64 currTsf;
+    u64 myRank;
+    u64 currAmRank;
+    u64 lastAmRank;
+    u32 currAmBTT;
+    u32 lastAmBTT;
+    u8  currAmHopCount;
+    u8  currRole;
+    u16 currClusterId;
+
+    u64 timeSpentInCurrRole;
+    u64 totalTimeSpentAsMaster;
+    u64 totalTimeSpentAsNonMasterSync;
+    u64 totalTimeSpentAsNonMasterNonSync;
+    u32 transitionsToAnchorMaster;
+    u32 transitionsToMaster;
+    u32 transitionsToNonMasterSync;
+    u32 transitionsToNonMasterNonSync;
+    u32 amrUpdateCount;
+    u32 amrUpdateRankChangedCount;
+    u32 amrUpdateBTTChangedCount;
+    u32 amrUpdateHcChangedCount;
+    u32 amrUpdateNewDeviceCount;
+    u32 amrExpireCount;
+    u32 mergeCount;
+    u32 beaconsAboveHcLimit;
+    u32 beaconsBelowRssiThresh;
+    u32 beaconsIgnoredNoSpace;
+    u32 beaconsForOurCluster;
+    u32 beaconsForOtherCluster;
+    u32 beaconCancelRequests;
+    u32 beaconCancelFailures;
+    u32 beaconUpdateRequests;
+    u32 beaconUpdateFailures;
+    u32 syncBeaconTxAttempts;
+    u32 discBeaconTxAttempts;
+} NanSyncStats;
+
+/* NAN Misc DE Statistics */
+typedef struct
+{
+    u32 validErrorRspMsgs;
+    u32 validTransmitFollowupReqMsgs;
+    u32 validTransmitFollowupRspMsgs;
+    u32 validFollowupIndMsgs;
+    u32 validConfigurationReqMsgs;
+    u32 validConfigurationRspMsgs;
+    u32 validStatsReqMsgs;
+    u32 validStatsRspMsgs;
+    u32 validEnableReqMsgs;
+    u32 validEnableRspMsgs;
+    u32 validDisableReqMsgs;
+    u32 validDisableRspMsgs;
+    u32 validDisableIndMsgs;
+    u32 validEventIndMsgs;
+    u32 validTcaReqMsgs;
+    u32 validTcaRspMsgs;
+    u32 validTcaIndMsgs;
+    u32 invalidTransmitFollowupReqMsgs;
+    u32 invalidConfigurationReqMsgs;
+    u32 invalidStatsReqMsgs;
+    u32 invalidEnableReqMsgs;
+    u32 invalidDisableReqMsgs;
+    u32 invalidTcaReqMsgs;
+} NanDeStats;
+
+/*
+  Stats Response Message structure
+  The Discovery Engine response to a request by the Host for statistics.
+*/
+typedef struct {
+    NanStatsId stats_id;
+    union {
+        NanPublishStats publish_stats;
+        NanSubscribeStats subscribe_stats;
+        NanMacStats mac_stats;
+        NanSyncStats sync_stats;
+        NanDeStats de_stats;
+    }data;
+}NanStatsResponse;
+
+/*
+  NAN Response messages
+*/
+typedef struct {
+    NanHeader header;
+    u16 status; /* contains the result code */
+    u16 value; /* For error returns the value is returned which was in error */
+    NanResponseType response_type; /* NanResponseType Definitions */
+    union {
+        NanStatsResponse stats_response;
+    }body;
+}NanResponseMsg;
+
+
+/*
+  Publish Replied Indication
+  The PublishRepliedInd Message is sent by the DE when an Active Subscribe is
+  received over the air and it matches a Solicited PublishServiceReq which had
+  been created with the replied_event_flag set.
+*/
+typedef struct {
+    NanHeader header;
+    u8 addr[NAN_MAC_ADDR_LEN];
+}NanPublishRepliedInd;
+
+/*
+  Publish Terminated
+  The PublishTerminatedInd message is sent by the DE whenever a Publish
+  terminates from a user-specified timeout or a unrecoverable error in the DE.
+*/
+typedef struct {
+    NanHeader header;
+    NanTerminatedStatus reason;
+}NanPublishTerminatedInd;
+
+/*
+  Subscribe Match Indication
+  The SubscribeMatchInd message is sent once per responding MAC address whenever
+  the Discovery Engine detects a match for a previous SubscribeServiceReq.
+*/
+typedef struct {
+    NanHeader header;
+
+    /* a 16 bit Handle which is sent to the Application.  This handle will be sent in any subsequent
+    UnmatchInd messages rather than resending the Match_Filter/Service_Specific_Info TLVs
+    The Match_Handle is a DE resource and it is of limited quantity.  In the event that the DE
+    runs out of Match_Handles the DE will still send the SubscribeMatchInd message but will
+    set the Match_Handle to MATCH_HANDLE_MATCH_POOL_EXHAUSTED=0xFFFF
+    */
+    u16 match_handle;
+    u8 addr[NAN_MAC_ADDR_LEN];
+
+    /* Sequence of octets which were received in a Discovery Frame matching this
+    Subscribe Request.*/
+    u16 service_specific_info_len;
+    u8 service_specific_info[NAN_MAX_SERVICE_NAME_LEN];
+
+    /* Ordered sequence of <length, value> pairs received in the Discovery Frame
+    matching this Subscribe Request.*/
+    u16 sdf_match_filter_len;
+    u8 sdf_match_filter[NAN_MAX_MATCH_FILTER_LEN];
+}NanSubscribeMatchInd;
+
+/*
+  Subscribe UnMatch
+  The SubscribeUnmatchInd message is sent whenever the Discovery Engine detects that
+  a previously Matched Subscribed Service Name has been gone for too long.
+  If the previous SubscribeMatchInd message contained a Match_Handle equal to
+  MATCH_HANDLE_MATCH_POOL_EXHAUSTED then this message will not be sent to the Host.
+*/
+typedef struct {
+    NanHeader header;
+    /* 16 bit value sent by the DE in a previous SubscribeMatchInd to the application. */
+    u16 match_handle;
+}NanSubscribeUnmatchInd;
+
+/*
+  Subscribe Terminated
+  The SubscribeTerminatedInd message is sent by the DE whenever a
+  Subscribe terminates from a user-specified timeout or a unrecoverable error in the DE.
+*/
+typedef struct {
+    NanHeader header;
+    NanTerminatedStatus reason;
+}NanSubscribeTerminatedInd;
+
+/*
+  Followup Indication Message
+  The FollowupInd message is sent by the DE to the Host whenever it receives a
+  Followup message from another peer.
+*/
+typedef struct {
+    NanHeader header;
+    u8 addr[NAN_MAC_ADDR_LEN];
+
+    /* Flag which the DE uses to decide if received in a DW or a FAW*/
+    u8 dw_or_faw; /* 0=Received  in a DW, 1 = Received in a FAW*/
+
+    /* Sequence of values which further specify the published service beyond the service name
+    Service specific info in case dw_or_faw is set to 0
+    Extended service specific info in case dw_or_faw is set to non-zero*/
+    u16 service_specific_info_len;
+    u8 service_specific_info[NAN_MAX_SERVICE_SPECIFIC_INFO_LEN];
+}NanFollowupInd;
+
+/* Selfstaevent data*/
+typedef struct {
+    u8 addr[NAN_MAC_ADDR_LEN];
+}NanSelfStaEvent;
+
+/* joined or Started cluster data*/
+typedef struct {
+    u8 addr[NAN_MAC_ADDR_LEN];
+}NanClusterEventData;
+
+/*
+  Discovery Engine Event Indication
+  The Discovery Engine can inform the Host when significant events occur
+  The data following the EventId is dependent upon the EventId type.
+  In other words, each new event defined will carry a different
+  structure of information back to the host.
+*/
+typedef struct {
+    NanHeader header;
+    NanEventId event_id; /* NAN Protocol Event Codes */
+    union {
+        /* SelfStaEvent which will have 6 byte mac address
+           of the Discovery engine.*/
+        NanSelfStaEvent self_sta;
+        /* Cluster Event Data which will be obtained when the
+           device starts a new cluster or joins a cluster.
+           The event data will have 6 byte octet string of the
+           cluster started or joined.*/
+        NanClusterEventData cluster;
+    }data;
+}NanDiscEngEventInd;
+
+/* Cluster size TCA data*/
+typedef struct {
+    u16 cluster_size;
+}NanTcaClusterData;
+
+/*
+  NAN TCA Indication
+  The Discovery Engine can inform the Host when significant events occur.
+  The data following the TcaId is dependent upon the TcaId type.
+  In other words, each new event defined will carry a different structure
+  of information back to the host.
+*/
+typedef struct {
+    NanHeader header;
+    NanTcaId tca_id;
+    union {
+        /* This event in obtained when the cluser size threshold
+           is crossed. Event will have the cluster size */
+        NanTcaClusterData cluster;
+    }data;
+}NanTCAInd;
+
+/*
+  NAN Disabled Indication
+  The NanDisableInd message indicates to the upper layers that the Discovery
+  Engine has flushed all state and has been shutdown.  When this message is received
+  the DE is guaranteed to have left the NAN cluster it was part of and will have terminated
+  any in progress Publishes or Subscribes.
+*/
+typedef struct {
+    NanHeader header;
+    NanStatusType reason;
+}NanDisabledInd;
+
+/* Response and Event Callbacks */
+typedef struct {
+    /* NotifyResponse invoked to notify the status of the Request */
+    void (*NotifyResponse)(NanResponseMsg* rsp_data);
+    /* Various Events Callback */
+    void (*EventPublishReplied)(NanPublishRepliedInd* event);
+    void (*EventPublishTerminated)(NanPublishTerminatedInd* event);
+    void (*EventSubscribeMatch) (NanSubscribeMatchInd* event);
+    void (*EventSubscribeUnMatch) (NanSubscribeUnmatchInd* event);
+    void (*EventSubscribeTerminated) (NanSubscribeTerminatedInd* event);
+    void (*EventFollowup) (NanFollowupInd* event);
+    void (*EventDiscEngEvent) (NanDiscEngEventInd* event);
+    void (*EventDisabled) (NanDisabledInd* event);
+    void (*EventTca) (NanTCAInd* event);
+} NanCallbackHandler;
+
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_enable_request(wifi_request_id id,
+                              wifi_handle handle,
+                              NanEnableRequest* msg);
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_disable_request(wifi_request_id id,
+                               wifi_handle handle,
+                               NanDisableRequest* msg);
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_publish_request(wifi_request_id id,
+                               wifi_handle handle,
+                               NanPublishRequest* msg);
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_publish_cancel_request(wifi_request_id id,
+                                      wifi_handle handle,
+                                      NanPublishCancelRequest* msg);
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_subscribe_request(wifi_request_id id,
+                                 wifi_handle handle,
+                                 NanSubscribeRequest* msg);
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_subscribe_cancel_request(wifi_request_id id,
+                                        wifi_handle handle,
+                                        NanSubscribeCancelRequest* msg);
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_transmit_followup_request(wifi_request_id id,
+                                         wifi_handle handle,
+                                         NanTransmitFollowupRequest* msg);
+
+/*  Function to send NAN statistics request to the wifi driver.*/
+wifi_error nan_stats_request(wifi_request_id id,
+                             wifi_handle handle,
+                             NanStatsRequest* msg);
+
+/*  Function to send NAN configuration request to the wifi driver.*/
+wifi_error nan_config_request(wifi_request_id id,
+                              wifi_handle handle,
+                              NanConfigRequest* msg);
+
+/*  Function to send NAN request to the wifi driver.*/
+wifi_error nan_tca_request(wifi_request_id id,
+                           wifi_handle handle,
+                           NanTCARequest* msg);
+
+/*  Function to register NAN callback */
+wifi_error nan_register_handler(wifi_handle handle,
+                                NanCallbackHandler handlers);
+
+/*  Function to get version of the NAN HAL */
+wifi_error nan_get_version(wifi_handle handle,
+                           NanVersion* version);
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* __NAN_H__ */
diff --git a/include/hardware_legacy/wifi_offload.h b/include/hardware_legacy/wifi_offload.h
new file mode 100644
index 0000000..f0326f1
--- /dev/null
+++ b/include/hardware_legacy/wifi_offload.h
@@ -0,0 +1,31 @@
+#include "wifi_hal.h"
+
+#ifndef __WIFI_HAL_OFFLOAD_H
+#define __WIFI_HAL_OFFLOAD_H
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif /* __cplusplus */
+
+#define ETHER_ADDR_LEN		6	// Ethernet frame address length
+#define N_AVAIL_ID		3	// available mkeep_alive IDs from 1 to 3
+#define MKEEP_ALIVE_IP_PKT_MAX	256     // max size of IP packet for keep alive
+
+/**
+ * Send specified keep alive packet periodically.
+ */
+wifi_error wifi_start_sending_offloaded_packet(wifi_request_id id, wifi_interface_handle iface,
+        u8 *ip_packet, u16 ip_packet_len, u8 *src_mac_addr, u8 *dst_mac_addr, u32 period_msec);
+
+/**
+ * Stop sending keep alive packet.
+ */
+wifi_error wifi_stop_sending_offloaded_packet(wifi_request_id id, wifi_interface_handle iface);
+
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /*__WIFI_HAL_OFFLOAD_H */
diff --git a/wifi/Android.mk b/wifi/Android.mk
index 99a4b0e..ed59b40 100644
--- a/wifi/Android.mk
+++ b/wifi/Android.mk
@@ -25,6 +25,16 @@
 LOCAL_CFLAGS += -DWIFI_DRIVER_FW_PATH_PARAM=\"$(WIFI_DRIVER_FW_PATH_PARAM)\"
 endif
 
+ifdef WIFI_DRIVER_STATE_CTRL_PARAM
+LOCAL_CFLAGS += -DWIFI_DRIVER_STATE_CTRL_PARAM=\"$(WIFI_DRIVER_STATE_CTRL_PARAM)\"
+endif
+ifdef WIFI_DRIVER_STATE_ON
+LOCAL_CFLAGS += -DWIFI_DRIVER_STATE_ON=\"$(WIFI_DRIVER_STATE_ON)\"
+endif
+ifdef WIFI_DRIVER_STATE_OFF
+LOCAL_CFLAGS += -DWIFI_DRIVER_STATE_OFF=\"$(WIFI_DRIVER_STATE_OFF)\"
+endif
+
 LOCAL_SRC_FILES += wifi/wifi.c
 
 ifdef WPA_SUPPLICANT_VERSION
diff --git a/wifi/wifi.c b/wifi/wifi.c
index 5f24343..880f6fc 100644
--- a/wifi/wifi.c
+++ b/wifi/wifi.c
@@ -190,6 +190,30 @@
     return dhcp_lasterror();
 }
 
+#ifdef WIFI_DRIVER_STATE_CTRL_PARAM
+int wifi_change_driver_state(const char *state)
+{
+    int len;
+    int fd;
+    int ret = 0;
+
+    if (!state)
+        return -1;
+    fd = TEMP_FAILURE_RETRY(open(WIFI_DRIVER_STATE_CTRL_PARAM, O_WRONLY));
+    if (fd < 0) {
+        ALOGE("Failed to open driver state control param (%s)", strerror(errno));
+        return -1;
+    }
+    len = strlen(state) + 1;
+    if (TEMP_FAILURE_RETRY(write(fd, state, len)) != len) {
+        ALOGE("Failed to write driver state control param (%s)", strerror(errno));
+        ret = -1;
+    }
+    close(fd);
+    return ret;
+}
+#endif
+
 int is_wifi_driver_loaded() {
     char driver_status[PROPERTY_VALUE_MAX];
 #ifdef WIFI_DRIVER_MODULE_PATH
@@ -252,7 +276,7 @@
         if (property_get(DRIVER_PROP_NAME, driver_status, NULL)) {
             if (strcmp(driver_status, "ok") == 0)
                 return 0;
-            else if (strcmp(DRIVER_PROP_NAME, "failed") == 0) {
+            else if (strcmp(driver_status, "failed") == 0) {
                 wifi_unload_driver();
                 return -1;
             }
@@ -263,6 +287,14 @@
     wifi_unload_driver();
     return -1;
 #else
+#ifdef WIFI_DRIVER_STATE_CTRL_PARAM
+    if (is_wifi_driver_loaded()) {
+        return 0;
+    }
+
+    if (wifi_change_driver_state(WIFI_DRIVER_STATE_ON) < 0)
+        return -1;
+#endif
     property_set(DRIVER_PROP_NAME, "ok");
     return 0;
 #endif
@@ -287,6 +319,12 @@
     } else
         return -1;
 #else
+#ifdef WIFI_DRIVER_STATE_CTRL_PARAM
+    if (is_wifi_driver_loaded()) {
+        if (wifi_change_driver_state(WIFI_DRIVER_STATE_OFF) < 0)
+            return -1;
+    }
+#endif
     property_set(DRIVER_PROP_NAME, "unloaded");
     return 0;
 #endif