am 03363a27: (-s ours) am 554d902e: Merge "Memory leak and NULL pointer check fixes"

* commit '03363a273bf594a475696512505ae0229fce59de':
diff --git a/halimpl/pn54x/hal/phNxpNciHal.c b/halimpl/pn54x/hal/phNxpNciHal.c
index aa70d79..c32f33e 100644
--- a/halimpl/pn54x/hal/phNxpNciHal.c
+++ b/halimpl/pn54x/hal/phNxpNciHal.c
@@ -30,6 +30,7 @@
 #define PN547C2_CLOCK_SETTING
 #undef  PN547C2_FACTORY_RESET_DEBUG
 #define CORE_RES_STATUS_BYTE 3
+
 /* Processing of ISO 15693 EOF */
 extern uint8_t icode_send_eof;
 static uint8_t cmd_icode_eof[] = { 0x00, 0x00, 0x00 };
@@ -55,6 +56,7 @@
 extern int kovio_detected;
 extern int disable_kovio;
 static uint8_t Rx_data[NCI_MAX_DATA_LEN];
+extern bool_t rf_deactive_cmd;
 
 uint32_t timeoutTimerId = 0;
 phNxpNciHal_Sem_t config_data;
@@ -63,6 +65,8 @@
 
 phNxpNciRfSetting_t phNxpNciRfSet={0,};
 
+phNxpNciMwEepromArea_t phNxpNciMwEepromArea = {0};
+
 /**************** local methods used in this file only ************************/
 static NFCSTATUS phNxpNciHal_fw_download(void);
 static void phNxpNciHal_open_complete(NFCSTATUS status);
@@ -80,9 +84,12 @@
 static void phNxpNciHal_print_res_status( uint8_t *p_rx_data, uint16_t *p_len);
 static NFCSTATUS phNxpNciHal_CheckValidFwVersion(void);
 static void phNxpNciHal_enable_i2c_fragmentation();
+static NFCSTATUS phNxpNciHal_get_mw_eeprom (void);
+static NFCSTATUS phNxpNciHal_set_mw_eeprom (void);
 NFCSTATUS phNxpNciHal_check_clock_config(void);
 NFCSTATUS phNxpNciHal_china_tianjin_rf_setting(void);
 int  check_config_parameter();
+
 /******************************************************************************
  * Function         phNxpNciHal_client_thread
  *
@@ -665,11 +672,14 @@
     /* Specific logic to block RF disable when Kovio detection logic is active */
     if (p_data[0] == 0x21&&
         p_data[1] == 0x06 &&
-        p_data[2] == 0x01 &&
-        kovio_detected == TRUE)
+        p_data[2] == 0x01)
     {
-        NXPLOG_NCIHAL_D ("Kovio detection logic is active: Set Flag to disable it.");
-        disable_kovio=0x01;
+        rf_deactive_cmd = TRUE;
+        if (kovio_detected == TRUE)
+        {
+            NXPLOG_NCIHAL_D ("Kovio detection logic is active: Set Flag to disable it.");
+            disable_kovio = 0x01;
+        }
     }
 
     /* Check for NXP ext before sending write */
@@ -1030,6 +1040,15 @@
         }
     }
 
+    // Check if firmware download success
+    status = phNxpNciHal_get_mw_eeprom ();
+    if (status != NFCSTATUS_SUCCESS)
+    {
+        NXPLOG_NCIHAL_E ("NXP GET MW EEPROM AREA Proprietary Ext failed");
+        retry_core_init_cnt++;
+        goto retry_core_init;
+    }
+
     //
     status = phNxpNciHal_check_clock_config();
     if (status != NFCSTATUS_SUCCESS) {
@@ -1310,6 +1329,12 @@
             return NFCSTATUS_FAILED;
         }
 #endif
+        // Update eeprom value
+        status = phNxpNciHal_set_mw_eeprom ();
+        if (status != NFCSTATUS_SUCCESS)
+        {
+            NXPLOG_NCIHAL_E ("NXP Update MW EEPROM Proprietary Ext failed");
+        }
     }
 
     retlen = 0;
@@ -1877,6 +1902,80 @@
 }
 
 /******************************************************************************
+ * Function         phNxpNciHal_get_mw_eeprom
+ *
+ * Description      This function is called to retreive data in mw eeprom area
+ *
+ * Returns          NFCSTATUS.
+ *
+ ******************************************************************************/
+static NFCSTATUS phNxpNciHal_get_mw_eeprom (void)
+{
+    NFCSTATUS status = NFCSTATUS_SUCCESS;
+    uint8_t retry_cnt = 0;
+    static uint8_t get_mw_eeprom_cmd[] = { 0x20, 0x03,0x03, 0x01, 0xA0, 0x0F };
+    uint8_t bConfig;
+
+retry_send_ext:
+    if (retry_cnt > 3)
+    {
+        return NFCSTATUS_FAILED;
+    }
+
+    phNxpNciMwEepromArea.isGetEepromArea = TRUE;
+    status = phNxpNciHal_send_ext_cmd (sizeof(get_mw_eeprom_cmd), get_mw_eeprom_cmd);
+    if (status != NFCSTATUS_SUCCESS)
+    {
+        NXPLOG_NCIHAL_E ("unable to get the mw eeprom data");
+        phNxpNciMwEepromArea.isGetEepromArea = FALSE;
+        retry_cnt++;
+        goto retry_send_ext;
+    }
+    phNxpNciMwEepromArea.isGetEepromArea = FALSE;
+
+    if (phNxpNciMwEepromArea.p_rx_data[12])
+    {
+        fw_download_success = 1;
+    }
+    return status;
+}
+
+/******************************************************************************
+ * Function         phNxpNciHal_set_mw_eeprom
+ *
+ * Description      This function is called to update data in mw eeprom area
+ *
+ * Returns          void.
+ *
+ ******************************************************************************/
+static NFCSTATUS phNxpNciHal_set_mw_eeprom (void)
+{
+    NFCSTATUS status = NFCSTATUS_SUCCESS;
+    uint8_t retry_cnt = 0;
+    uint8_t set_mw_eeprom_cmd[39] = {0};
+    uint8_t cmd_header[] = { 0x20, 0x02,0x24, 0x01, 0xA0, 0x0F, 0x20 };
+
+    memcpy (set_mw_eeprom_cmd, cmd_header, sizeof(cmd_header));
+    phNxpNciMwEepromArea.p_rx_data[12] = 0;
+    memcpy (set_mw_eeprom_cmd + sizeof(cmd_header), phNxpNciMwEepromArea.p_rx_data, sizeof(phNxpNciMwEepromArea.p_rx_data));
+
+retry_send_ext:
+    if (retry_cnt > 3)
+    {
+        return NFCSTATUS_FAILED;
+    }
+
+    status = phNxpNciHal_send_ext_cmd (sizeof(set_mw_eeprom_cmd), set_mw_eeprom_cmd);
+    if (status != NFCSTATUS_SUCCESS)
+    {
+        NXPLOG_NCIHAL_E ("unable to update the mw eeprom data");
+        retry_cnt++;
+        goto retry_send_ext;
+    }
+    return status;
+}
+
+/******************************************************************************
  * Function         phNxpNciHal_set_clock
  *
  * Description      This function is called after successfull download
@@ -2317,7 +2416,7 @@
             }
         }
 
-        if(phNxpNciRfSet.isGetRfSetting)
+        else if(phNxpNciRfSet.isGetRfSetting)
         {
             int i;
             for(i=0; i<* p_len; i++)
@@ -2325,16 +2424,23 @@
                 phNxpNciRfSet.p_rx_data[i] = p_rx_data[i];
                 //NXPLOG_NCIHAL_D("%s: response status =0x%x",__FUNCTION__,p_rx_data[i]);
             }
-
+        }
+        else if (phNxpNciMwEepromArea.isGetEepromArea)
+        {
+            int i;
+            for (i = 8; i < *p_len; i++)
+            {
+                phNxpNciMwEepromArea.p_rx_data[i - 8] = p_rx_data[i];
+            }
         }
     }
 
-if((p_rx_data[2])&&(config_access == TRUE))
+    if (p_rx_data[2] && (config_access == TRUE))
     {
-        if(p_rx_data[3]!=NFCSTATUS_SUCCESS)
+        if (p_rx_data[3] != NFCSTATUS_SUCCESS)
         {
-            NXPLOG_NCIHAL_W("Invalid Data from config file . Aborting..");
-            phNxpNciHal_close();
+            NXPLOG_NCIHAL_W ("Invalid Data from config file . Aborting..");
+            phNxpNciHal_close ();
         }
     }
 }
diff --git a/halimpl/pn54x/hal/phNxpNciHal.h b/halimpl/pn54x/hal/phNxpNciHal.h
index fa7b637..6c97cd2 100644
--- a/halimpl/pn54x/hal/phNxpNciHal.h
+++ b/halimpl/pn54x/hal/phNxpNciHal.h
@@ -94,6 +94,10 @@
     uint8_t  p_rx_data[20];
 }phNxpNciRfSetting_t;
 
+typedef struct phNxpNciMwEepromArea {
+    bool_t  isGetEepromArea;
+    uint8_t p_rx_data[32];
+} phNxpNciMwEepromArea_t;
 
 typedef enum {
     NFC_FORUM_PROFILE,
diff --git a/halimpl/pn54x/hal/phNxpNciHal_Kovio.c b/halimpl/pn54x/hal/phNxpNciHal_Kovio.c
index 3489b8f..200a88a 100644
--- a/halimpl/pn54x/hal/phNxpNciHal_Kovio.c
+++ b/halimpl/pn54x/hal/phNxpNciHal_Kovio.c
@@ -30,6 +30,7 @@
 int kovio_detected = 0x00;
 int send_to_upper_kovio = 0x01;
 int disable_kovio=0x00;
+bool_t rf_deactive_cmd = FALSE;
 static uint8_t rf_deactivate_cmd[]   = { 0x21, 0x06, 0x01, 0x03 }; /* discovery */
 static uint8_t rf_deactivated_ntf[]  = { 0x61, 0x06, 0x02, 0x03, 0x01 };
 static uint8_t reset_ntf[] = {0x60, 0x00, 0x06, 0xA0, 0x00, 0xC7, 0xD4, 0x00, 0x00};
@@ -119,6 +120,7 @@
         {
             NXPLOG_NCIHAL_D("Send the Core Reset NTF to upper layer, which will trigger the recovery\n");
             //Send the Core Reset NTF to upper layer, which will trigger the recovery.
+            send_to_upper_kovio = 0;
             nxpncihal_ctrl.rx_data_len = sizeof(reset_ntf);
             memcpy(nxpncihal_ctrl.p_rx_data, reset_ntf, sizeof(reset_ntf));
             (*nxpncihal_ctrl.p_nfc_stack_data_cback)(nxpncihal_ctrl.rx_data_len, nxpncihal_ctrl.p_rx_data);
@@ -179,8 +181,18 @@
             {
                 send_to_upper_kovio = 0;
             }
-            NXPLOG_NCIHAL_D("Send RF deactivate command to NFCC");
-            status = phNxpNciHal_rf_deactivate();
+
+            if (!rf_deactive_cmd)
+            {
+                NXPLOG_NCIHAL_D ("Send RF deactivate command to NFCC");
+                status = phNxpNciHal_rf_deactivate ();
+            }
+            else
+            {
+                NXPLOG_NCIHAL_D ("RF deactivate command is already sent to NFCC");
+                disable_kovio = TRUE;
+                send_to_upper_kovio = 0;
+            }
             status = phOsalNfc_Timer_Start(kovio_timer,
                     KOVIO_TIMEOUT,
                     &kovio_timer_handler,
@@ -204,8 +216,9 @@
             }
         }
     }
-    else if((p_ntf[0]==0x41)&&(p_ntf[1]==0x06)&&(p_ntf[2]==0x01)&&(p_ntf[3]==0x00))
+    else if((p_ntf[0]==0x41)&&(p_ntf[1]==0x06)&&(p_ntf[2]==0x01))
     {
+        rf_deactive_cmd = FALSE;
         if(kovio_detected == 1)
             send_to_upper_kovio = 0;
         if((kovio_detected == 1)&&(disable_kovio==0x01))
diff --git a/halimpl/pn54x/hal/phNxpNciHal_ext.c b/halimpl/pn54x/hal/phNxpNciHal_ext.c
index d8f5bf6..def2b2d 100644
--- a/halimpl/pn54x/hal/phNxpNciHal_ext.c
+++ b/halimpl/pn54x/hal/phNxpNciHal_ext.c
@@ -56,6 +56,7 @@
 extern uint32_t timeoutTimerId;
 
 extern NFCSTATUS read_retry();
+
 /************** HAL extension functions ***************************************/
 static void hal_extns_write_rsp_timeout_cb(uint32_t TimerId, void *pContext);
 
@@ -303,6 +304,10 @@
             p_ntf[2]--;
             (*p_len)--;
         }
+        else
+        {
+            p_ntf[p_ntf[2]+ 2] |= 0x01;
+        }
     }
     else if (p_ntf[2] == 0x02 &&
             p_ntf[1] == 0x00 && icode_detected == 1)
@@ -373,7 +378,6 @@
             return status;
 
         }
-
     }
     else if(p_ntf[0] == 0x41 && p_ntf[1] == 0x04 && cleanup_timer!=0)
     {
@@ -398,6 +402,58 @@
         }
     }
 #endif
+    else if (*p_len == 4 &&
+                p_ntf[0] == 0x4F &&
+                p_ntf[1] == 0x11 &&
+                p_ntf[2] == 0x01 )
+    {
+        if (p_ntf[3] == 0x00)
+        {
+            NXPLOG_NCIHAL_D (">  Workaround for ISO-DEP Presence Check, ignore response and wait for notification");
+            p_ntf[0] = 0x60;
+            p_ntf[1] = 0x06;
+            p_ntf[2] = 0x03;
+            p_ntf[3] = 0x01;
+            p_ntf[4] = 0x00;
+            p_ntf[5] = 0x01;
+            *p_len = 6;
+        }
+        else
+        {
+            NXPLOG_NCIHAL_D (">  Workaround for ISO-DEP Presence Check, presence check return failed");
+            p_ntf[0] = 0x60;
+            p_ntf[1] = 0x08;
+            p_ntf[2] = 0x02;
+            p_ntf[3] = 0xB2;
+            p_ntf[4] = 0x00;
+            *p_len = 5;
+
+        }
+    }
+    else if (*p_len == 4 &&
+                p_ntf[0] == 0x6F &&
+                p_ntf[1] == 0x11 &&
+                p_ntf[2] == 0x01 )
+    {
+        if (p_ntf[3] == 0x01)
+        {
+            NXPLOG_NCIHAL_D (">  Workaround for ISO-DEP Presence Check - Card still in field");
+            p_ntf[0] = 0x00;
+            p_ntf[1] = 0x00;
+            p_ntf[2] = 0x01;
+            p_ntf[3] = 0x7E;
+        }
+        else
+        {
+            NXPLOG_NCIHAL_D (">  Workaround for ISO-DEP Presence Check - Card not in field");
+            p_ntf[0] = 0x60;
+            p_ntf[1] = 0x08;
+            p_ntf[2] = 0x02;
+            p_ntf[3] = 0xB2;
+            p_ntf[4] = 0x00;
+            *p_len = 5;
+        }
+    }
     /*
     else if(p_ntf[0] == 0x61 && p_ntf[1] == 0x05 && p_ntf[4] == 0x01 && p_ntf[5] == 0x00 && p_ntf[6] == 0x01)
     {
@@ -743,6 +799,18 @@
 //        status = NFCSTATUS_FAILED;
         NXPLOG_NCIHAL_D ("> Going through workaround - Dirty Set Config - End ");
     }
+    else if (*cmd_len == 3 &&
+             p_cmd_data[0] == 0x00 &&
+             p_cmd_data[1] == 0x00 &&
+             p_cmd_data[2] == 0x00 )
+    {
+        NXPLOG_NCIHAL_D ("> Going through workaround - ISO-DEP Presence Check ");
+        p_cmd_data[0] = 0x2F;
+        p_cmd_data[1] = 0x11;
+        p_cmd_data[2] = 0x00;
+        status = NFCSTATUS_SUCCESS;
+        NXPLOG_NCIHAL_D ("> Going through workaround - ISO-DEP Presence Check - End");
+    }
 
 #if 0
     else if ( (p_cmd_data[0] == 0x20 && p_cmd_data[1] == 0x02 ) &&
diff --git a/halimpl/pn54x/libnfc-brcm.conf b/halimpl/pn54x/libnfc-brcm.conf
index 22dffb5..7df047b 100644
--- a/halimpl/pn54x/libnfc-brcm.conf
+++ b/halimpl/pn54x/libnfc-brcm.conf
@@ -383,3 +383,16 @@
 # UICC              0x02
 
 NXP_PRFD_TECH_SE=0x01
+
+###############################################################################
+# Vendor Specific Proprietary Protocol & Discovery Configuration
+# Set to 0xFF if unsupported
+#  byte[0] NCI_PROTOCOL_18092_ACTIVE
+#  byte[1] NCI_PROTOCOL_B_PRIME
+#  byte[2] NCI_PROTOCOL_DUAL
+#  byte[3] NCI_PROTOCOL_15693
+#  byte[4] NCI_PROTOCOL_KOVIO
+#  byte[5] NCI_DISCOVERY_TYPE_POLL_KOVIO
+#  byte[6] NCI_DISCOVERY_TYPE_POLL_B_PRIME
+#  byte[7] NCI_DISCOVERY_TYPE_LISTEN_B_PRIME
+NFA_PROPRIETARY_CFG={05:FF:FF:06:81:70:FF:FF}
diff --git a/halimpl/pn54x/utils/phNxpNciHal_utils.c b/halimpl/pn54x/utils/phNxpNciHal_utils.c
index 65ec89d..57dcc88 100644
--- a/halimpl/pn54x/utils/phNxpNciHal_utils.c
+++ b/halimpl/pn54x/utils/phNxpNciHal_utils.c
@@ -502,5 +502,5 @@
 void phNxpNciHal_emergency_recovery(void)
 {
     NXPLOG_NCIHAL_E("%s: abort()", __FUNCTION__);
-    //    abort();
+    abort();
 }
diff --git a/src/adaptation/NfcAdaptation.cpp b/src/adaptation/NfcAdaptation.cpp
index 1a9e191..841c04a 100644
--- a/src/adaptation/NfcAdaptation.cpp
+++ b/src/adaptation/NfcAdaptation.cpp
@@ -22,6 +22,7 @@
     #include "gki.h"
     #include "nfa_api.h"
     #include "nfc_int.h"
+    #include "vendor_cfg.h"
 }
 #include "config.h"
 #include "android_logmsg.h"
@@ -47,13 +48,16 @@
 char nci_hal_module[64];
 
 static UINT8 nfa_dm_cfg[sizeof ( tNFA_DM_CFG ) ];
+static UINT8 nfa_proprietary_cfg[sizeof ( tNFA_PROPRIETARY_CFG )];
 extern tNFA_DM_CFG *p_nfa_dm_cfg;
+extern tNFA_PROPRIETARY_CFG *p_nfa_proprietary_cfg;
 extern UINT8 nfa_ee_max_ee_cfg;
 extern const UINT8  nfca_version_string [];
 extern const UINT8  nfa_version_string [];
 static UINT8 deviceHostWhiteList [NFA_HCI_MAX_HOST_IN_NETWORK];
 static tNFA_HCI_CFG jni_nfa_hci_cfg;
 extern tNFA_HCI_CFG *p_nfa_hci_cfg;
+extern BOOLEAN nfa_poll_bail_out_mode;
 
 /*******************************************************************************
 **
@@ -141,6 +145,16 @@
         nfa_ee_max_ee_cfg = num;
         ALOGD("%s: Overriding NFA_EE_MAX_EE_SUPPORTED to use %d", func, nfa_ee_max_ee_cfg);
     }
+    if ( GetNumValue ( NAME_NFA_POLL_BAIL_OUT_MODE, &num, sizeof ( num ) ) )
+    {
+        nfa_poll_bail_out_mode = num;
+        ALOGD("%s: Overriding NFA_POLL_BAIL_OUT_MODE to use %d", func, nfa_poll_bail_out_mode);
+    }
+
+    if ( GetStrValue ( NAME_NFA_PROPRIETARY_CFG, (char*)nfa_proprietary_cfg, sizeof ( tNFA_PROPRIETARY_CFG ) ) )
+    {
+        p_nfa_proprietary_cfg = (tNFA_PROPRIETARY_CFG*) &nfa_proprietary_cfg[0];
+    }
 
     //configure device host whitelist of HCI host ID's; see specification ETSI TS 102 622 V11.1.10
     //(2012-10), section 6.1.3.1
diff --git a/src/hal/include/nci_defs.h b/src/hal/include/nci_defs.h
index 2ff50a7..027dd21 100644
--- a/src/hal/include/nci_defs.h
+++ b/src/hal/include/nci_defs.h
@@ -377,25 +377,6 @@
 #define NCI_PROTOCOL_T3T                0x03
 #define NCI_PROTOCOL_ISO_DEP            0x04
 #define NCI_PROTOCOL_NFC_DEP            0x05
-/**********************************************
- * Proprietary Protocols
- **********************************************/
-#ifndef NCI_PROTOCOL_18092_ACTIVE
-#define NCI_PROTOCOL_18092_ACTIVE       0x80
-#endif
-#ifndef NCI_PROTOCOL_B_PRIME
-#define NCI_PROTOCOL_B_PRIME            0x81
-#endif
-#ifndef NCI_PROTOCOL_DUAL
-#define NCI_PROTOCOL_DUAL               0x82
-#endif
-#ifndef NCI_PROTOCOL_15693
-#define NCI_PROTOCOL_15693              0x83
-#endif
-#ifndef NCI_PROTOCOL_KOVIO
-#define NCI_PROTOCOL_KOVIO              0x8a
-#endif
-
 
 /* Discovery Types/Detected Technology and Mode */
 #define NCI_DISCOVERY_TYPE_POLL_A               0x00
@@ -403,14 +384,11 @@
 #define NCI_DISCOVERY_TYPE_POLL_F               0x02
 #define NCI_DISCOVERY_TYPE_POLL_A_ACTIVE        0x03
 #define NCI_DISCOVERY_TYPE_POLL_F_ACTIVE        0x05
-#define NCI_DISCOVERY_TYPE_POLL_B_PRIME         0x74
-#define NCI_DISCOVERY_TYPE_POLL_KOVIO           0x77
 #define NCI_DISCOVERY_TYPE_LISTEN_A             0x80
 #define NCI_DISCOVERY_TYPE_LISTEN_B             0x81
 #define NCI_DISCOVERY_TYPE_LISTEN_F             0x82
 #define NCI_DISCOVERY_TYPE_LISTEN_A_ACTIVE      0x83
 #define NCI_DISCOVERY_TYPE_LISTEN_F_ACTIVE      0x85
-#define NCI_DISCOVERY_TYPE_LISTEN_B_PRIME       0xF4
 #define NCI_DISCOVERY_TYPE_POLL_ISO15693        0x06
 #define NCI_DISCOVERY_TYPE_LISTEN_ISO15693      0x86
 #define NCI_DISCOVERY_TYPE_MAX  NCI_DISCOVERY_TYPE_LISTEN_ISO15693
diff --git a/src/include/config.h b/src/include/config.h
index 7f978aa..b41023b 100644
--- a/src/include/config.h
+++ b/src/include/config.h
@@ -88,6 +88,8 @@
 #define NAME_POWER_OFF_MODE             "POWER_OFF_MODE"
 #define NAME_GLOBAL_RESET               "DO_GLOBAL_RESET"
 #define NAME_NCI_HAL_MODULE             "NCI_HAL_MODULE"
+#define NAME_NFA_POLL_BAIL_OUT_MODE     "NFA_POLL_BAIL_OUT_MODE"
+#define NAME_NFA_PROPRIETARY_CFG        "NFA_PROPRIETARY_CFG"
 
 #define                     LPTD_PARAM_LEN (40)
 
diff --git a/src/include/vendor_cfg.h b/src/include/vendor_cfg.h
new file mode 100644
index 0000000..8d30325
--- /dev/null
+++ b/src/include/vendor_cfg.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/******************************************************************************
+ *
+ *  This file contains compile-time configurable constants for vendor specific proprietary protocols
+ *
+ ******************************************************************************/
+#ifndef __NFC_VENDOR_CFG_H__
+#define __NFC_VENDOR_CFG_H__
+
+/* compile-time configuration structure for proprietary protocol and discovery value */
+typedef struct
+{
+    UINT8 pro_protocol_18092_active;
+    UINT8 pro_protocol_b_prime;
+    UINT8 pro_protocol_dual;
+    UINT8 pro_protocol_15693;
+    UINT8 pro_protocol_kovio;
+
+    UINT8 pro_discovery_kovio_poll;
+    UINT8 pro_discovery_b_prime_poll;
+    UINT8 pro_discovery_b_prime_listen;
+} tNFA_PROPRIETARY_CFG;
+
+
+extern tNFA_PROPRIETARY_CFG *p_nfa_proprietary_cfg;
+
+ /**********************************************
+ * Proprietary Protocols
+ **********************************************/
+#ifndef NCI_PROTOCOL_18092_ACTIVE
+#define NCI_PROTOCOL_18092_ACTIVE       (p_nfa_proprietary_cfg->pro_protocol_18092_active)
+#endif
+#ifndef NCI_PROTOCOL_B_PRIME
+#define NCI_PROTOCOL_B_PRIME            (p_nfa_proprietary_cfg->pro_protocol_b_prime)
+#endif
+#ifndef NCI_PROTOCOL_DUAL
+#define NCI_PROTOCOL_DUAL               (p_nfa_proprietary_cfg->pro_protocol_dual)
+#endif
+#ifndef NCI_PROTOCOL_15693
+#define NCI_PROTOCOL_15693              (p_nfa_proprietary_cfg->pro_protocol_15693)
+#endif
+#ifndef NCI_PROTOCOL_KOVIO
+#define NCI_PROTOCOL_KOVIO              (p_nfa_proprietary_cfg->pro_protocol_kovio)
+#endif
+
+ /**********************************************
+ * Proprietary Discovery technology and mode
+ **********************************************/
+#ifndef NCI_DISCOVERY_TYPE_POLL_KOVIO
+#define NCI_DISCOVERY_TYPE_POLL_KOVIO           (p_nfa_proprietary_cfg->pro_discovery_kovio_poll)
+#endif
+
+#ifndef NCI_DISCOVERY_TYPE_POLL_B_PRIME
+#define NCI_DISCOVERY_TYPE_POLL_B_PRIME         (p_nfa_proprietary_cfg->pro_discovery_b_prime_poll)
+#endif
+
+#ifndef NCI_DISCOVERY_TYPE_LISTEN_B_PRIME
+#define NCI_DISCOVERY_TYPE_LISTEN_B_PRIME       (p_nfa_proprietary_cfg->pro_discovery_b_prime_listen)
+#endif
+
+#endif /* __NFC_VENDOR_CFG_H__ */
diff --git a/src/nfa/dm/nfa_dm_act.c b/src/nfa/dm/nfa_dm_act.c
index 58ebfab..942e301 100644
--- a/src/nfa/dm/nfa_dm_act.c
+++ b/src/nfa/dm/nfa_dm_act.c
@@ -1329,6 +1329,19 @@
 
 /*******************************************************************************
 **
+** Function         nfa_dm_act_get_rf_disc_duration
+**
+** Description      Get duration for RF discovery
+**
+** Returns          UINT16
+**
+*******************************************************************************/
+UINT16 nfa_dm_act_get_rf_disc_duration ( )
+{
+    return (nfa_dm_cb.disc_cb.disc_duration);
+}
+/*******************************************************************************
+**
 ** Function         nfa_dm_act_select
 **
 ** Description      Process RF select command
@@ -1775,8 +1788,18 @@
         /* get length of NFCID and location */
         if (p_tech_params->mode == NFC_DISCOVERY_TYPE_POLL_A)
         {
-            nfcid_len = p_tech_params->param.pa.nfcid1_len;
-            p_nfcid   = p_tech_params->param.pa.nfcid1;
+            if ((p_tech_params->param.pa.nfcid1_len == 0) && (p_params != NULL))
+            {
+                nfcid_len = sizeof(p_params->t1t.uid);
+                p_nfcid   = p_params->t1t.uid;
+                evt_data.activated.activate_ntf.rf_tech_param.param.pa.nfcid1_len = nfcid_len;
+                memcpy (evt_data.activated.activate_ntf.rf_tech_param.param.pa.nfcid1, p_nfcid, nfcid_len);
+            }
+            else
+            {
+                nfcid_len = p_tech_params->param.pa.nfcid1_len;
+                p_nfcid   = p_tech_params->param.pa.nfcid1;
+            }
         }
         else if (p_tech_params->mode == NFC_DISCOVERY_TYPE_POLL_B)
         {
diff --git a/src/nfa/dm/nfa_dm_cfg.c b/src/nfa/dm/nfa_dm_cfg.c
index 202e213..a6d3173 100644
--- a/src/nfa/dm/nfa_dm_cfg.c
+++ b/src/nfa/dm/nfa_dm_cfg.c
@@ -121,3 +121,18 @@
 };
 
 tNFA_HCI_CFG *p_nfa_hci_cfg = (tNFA_HCI_CFG *) &nfa_hci_cfg;
+
+BOOLEAN nfa_poll_bail_out_mode = FALSE;
+const tNFA_PROPRIETARY_CFG nfa_proprietary_cfg =
+{
+    0x80, /* NCI_PROTOCOL_18092_ACTIVE */
+    0x81, /* NCI_PROTOCOL_B_PRIME */
+    0x82, /* NCI_PROTOCOL_DUAL */
+    0x83, /* NCI_PROTOCOL_15693 */
+    0x8A, /* NCI_PROTOCOL_KOVIO */
+    0x77, /* NCI_DISCOVERY_TYPE_POLL_KOVIO */
+    0x74, /* NCI_DISCOVERY_TYPE_POLL_B_PRIME */
+    0xF4, /* NCI_DISCOVERY_TYPE_LISTEN_B_PRIME */
+};
+
+tNFA_PROPRIETARY_CFG *p_nfa_proprietary_cfg = (tNFA_PROPRIETARY_CFG *) &nfa_proprietary_cfg;
diff --git a/src/nfa/dm/nfa_dm_discover.c b/src/nfa/dm/nfa_dm_discover.c
index f9e179f..d0c4fe0 100644
--- a/src/nfa/dm/nfa_dm_discover.c
+++ b/src/nfa/dm/nfa_dm_discover.c
@@ -29,12 +29,14 @@
 #include "nfa_dm_int.h"
 #include "nfa_p2p_int.h"
 #include "nfa_sys_int.h"
+#include "nci_hmsgs.h"
 #if (NFC_NFCEE_INCLUDED == TRUE)
 #include "nfa_ee_api.h"
 #include "nfa_ee_int.h"
 #endif
 #include "nfa_rw_int.h"
 
+#include "nfc_int.h"
 /*
 **  static functions
 */
@@ -58,6 +60,15 @@
 static char *nfa_dm_disc_event_2_str (UINT8 event);
 #endif
 
+typedef struct nfa_dm_p2p_prio_logic
+{
+    BOOLEAN          isodep_detected; /* flag to check if ISO-DEP is detected */
+    BOOLEAN          timer_expired;   /* flag to check whether timer is expired */
+    TIMER_LIST_ENT   timer_list; /*timer structure pointer */
+    UINT8            first_tech_mode;
+}nfa_dm_p2p_prio_logic_t;
+
+static nfa_dm_p2p_prio_logic_t p2p_prio_logic_data;
 
 /*******************************************************************************
 **
@@ -644,9 +655,8 @@
     /* Set initial disc_mask to legacy poll or listen */
     tNFA_DM_DISC_TECH_PROTO_MASK disc_mask = ((tech_n_mode & 0x80) ? NFA_DM_DISC_MASK_L_LEGACY : NFA_DM_DISC_MASK_P_LEGACY);
 
-    switch (tech_n_mode)
+    if (NFC_DISCOVERY_TYPE_POLL_A == tech_n_mode)
     {
-    case NFC_DISCOVERY_TYPE_POLL_A:
         switch (protocol)
         {
         case NFC_PROTOCOL_T1T:
@@ -662,34 +672,41 @@
             disc_mask = NFA_DM_DISC_MASK_PA_NFC_DEP;
             break;
         }
-        break;
-    case NFC_DISCOVERY_TYPE_POLL_B:
+    }
+    else if (NFC_DISCOVERY_TYPE_POLL_B == tech_n_mode)
+    {
         if (protocol == NFC_PROTOCOL_ISO_DEP)
             disc_mask = NFA_DM_DISC_MASK_PB_ISO_DEP;
-        break;
-    case NFC_DISCOVERY_TYPE_POLL_F:
+    }
+    else if (NFC_DISCOVERY_TYPE_POLL_F == tech_n_mode)
+    {
         if (protocol == NFC_PROTOCOL_T3T)
             disc_mask = NFA_DM_DISC_MASK_PF_T3T;
         else if (protocol == NFC_PROTOCOL_NFC_DEP)
             disc_mask = NFA_DM_DISC_MASK_PF_NFC_DEP;
-        break;
-    case NFC_DISCOVERY_TYPE_POLL_ISO15693:
+    }
+    else if (NFC_DISCOVERY_TYPE_POLL_ISO15693 == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_P_ISO15693;
-        break;
-    case NFC_DISCOVERY_TYPE_POLL_B_PRIME:
+    }
+    else if (NFC_DISCOVERY_TYPE_POLL_B_PRIME == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_P_B_PRIME;
-        break;
-    case NFC_DISCOVERY_TYPE_POLL_KOVIO:
+    }
+    else if (NFC_DISCOVERY_TYPE_POLL_KOVIO == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_P_KOVIO;
-        break;
-    case NFC_DISCOVERY_TYPE_POLL_A_ACTIVE:
+    }
+    else if (NFC_DISCOVERY_TYPE_POLL_A_ACTIVE == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_PAA_NFC_DEP;
-        break;
-    case NFC_DISCOVERY_TYPE_POLL_F_ACTIVE:
+    }
+    else if (NFC_DISCOVERY_TYPE_POLL_F_ACTIVE == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_PFA_NFC_DEP;
-        break;
-
-    case NFC_DISCOVERY_TYPE_LISTEN_A:
+    }
+    else if (NFC_DISCOVERY_TYPE_LISTEN_A == tech_n_mode)
+    {
         switch (protocol)
         {
         case NFC_PROTOCOL_T1T:
@@ -705,29 +722,34 @@
             disc_mask = NFA_DM_DISC_MASK_LA_NFC_DEP;
             break;
         }
-        break;
-    case NFC_DISCOVERY_TYPE_LISTEN_B:
+    }
+    else if (NFC_DISCOVERY_TYPE_LISTEN_B == tech_n_mode)
+    {
         if (protocol == NFC_PROTOCOL_ISO_DEP)
             disc_mask = NFA_DM_DISC_MASK_LB_ISO_DEP;
-        break;
-    case NFC_DISCOVERY_TYPE_LISTEN_F:
+    }
+    else if (NFC_DISCOVERY_TYPE_LISTEN_F == tech_n_mode)
+    {
         if (protocol == NFC_PROTOCOL_T3T)
             disc_mask = NFA_DM_DISC_MASK_LF_T3T;
         else if (protocol == NFC_PROTOCOL_NFC_DEP)
             disc_mask = NFA_DM_DISC_MASK_LF_NFC_DEP;
-        break;
-    case NFC_DISCOVERY_TYPE_LISTEN_ISO15693:
+    }
+    else if (NFC_DISCOVERY_TYPE_LISTEN_ISO15693 == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_L_ISO15693;
-        break;
-    case NFC_DISCOVERY_TYPE_LISTEN_B_PRIME:
+    }
+    else if (NFC_DISCOVERY_TYPE_LISTEN_B_PRIME == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_L_B_PRIME;
-        break;
-    case NFC_DISCOVERY_TYPE_LISTEN_A_ACTIVE:
+    }
+    else if (NFC_DISCOVERY_TYPE_LISTEN_A_ACTIVE == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_LAA_NFC_DEP;
-        break;
-    case NFC_DISCOVERY_TYPE_LISTEN_F_ACTIVE:
+    }
+    else if (NFC_DISCOVERY_TYPE_LISTEN_F_ACTIVE == tech_n_mode)
+    {
         disc_mask = NFA_DM_DISC_MASK_LFA_NFC_DEP;
-        break;
     }
 
     NFA_TRACE_DEBUG3 ("nfa_dm_disc_get_disc_mask (): tech_n_mode:0x%X, protocol:0x%X, disc_mask:0x%X",
@@ -2962,3 +2984,190 @@
     return "Unknown";
 }
 #endif /* BT_TRACE_VERBOSE */
+
+/*******************************************************************************
+**
+** Function         P2P_Prio_Logic
+**
+** Description      Implements algorithm for NFC-DEP protocol priority over
+**                  ISO-DEP protocol.
+**
+** Returns          True if success
+**
+*******************************************************************************/
+BOOLEAN nfa_dm_p2p_prio_logic (UINT8 event, UINT8 *p, UINT8 event_type)
+{
+    if (!nfa_poll_bail_out_mode)
+    {
+        NFA_TRACE_DEBUG0 ("p2p priority is running under bail out mode ONLY.");
+        return TRUE;
+    }
+
+    if ((nfa_dm_cb.flags & NFA_DM_FLAGS_P2P_PAUSED) &&
+       (nfa_dm_cb.flags & NFA_DM_FLAGS_LISTEN_DISABLED))
+    {
+        NFA_TRACE_DEBUG0 ("returning from nfa_dm_p2p_prio_logic  Disable p2p_prio_logic");
+        return TRUE;
+    }
+
+    if (event == NCI_MSG_RF_DISCOVER && p2p_prio_logic_data.timer_expired == TRUE && event_type == NFA_DM_P2P_PRIO_RSP)
+    {
+        NFA_TRACE_DEBUG0 ("nfa_dm_p2p_prio_logic starting a timer for next rf intf activated ntf");
+        nfc_start_quick_timer (&p2p_prio_logic_data.timer_list,
+                        NFC_TTYPE_P2P_PRIO_LOGIC_CLEANUP,
+                        ((UINT32) nfa_dm_act_get_rf_disc_duration() * QUICK_TIMER_TICKS_PER_SEC) / 1000);
+        return TRUE;
+    }
+
+    if (event == NCI_MSG_RF_INTF_ACTIVATED && p2p_prio_logic_data.timer_expired == TRUE)
+    {
+        NFA_TRACE_DEBUG0 ("nfa_dm_p2p_prio_logic stopping a timer for next rf intf activated ntf");
+        nfc_stop_quick_timer (&p2p_prio_logic_data.timer_list);
+    }
+
+    if (nfa_dm_cb.disc_cb.disc_state == NFA_DM_RFST_DISCOVERY)
+    {
+        UINT8 rf_disc_id = 0xFF;
+        UINT8 type = 0xFF;
+        UINT8 protocol = 0xFF;
+        UINT8 tech_mode = 0xFF;
+
+        NFA_TRACE_DEBUG0 ("P2P_Prio_Logic");
+
+        if (event == NCI_MSG_RF_INTF_ACTIVATED )
+        {
+            rf_disc_id    = *p++;
+            type          = *p++;
+            protocol      = *p++;
+            tech_mode     = *p++;
+        }
+        NFA_TRACE_DEBUG1 ("nfa_dm_p2p_prio_logic event_type = 0x%x", event_type);
+
+        if (event == NCI_MSG_RF_INTF_ACTIVATED && tech_mode >= 0x80)
+        {
+            NFA_TRACE_DEBUG0 ("nfa_dm_p2p_prio_logic listen mode activated reset all the nfa_dm_p2p_prio_logic variables ");
+            nfa_dm_p2p_prio_logic_cleanup ();
+        }
+
+        if ((tech_mode < 0x80) &&
+            event == NCI_MSG_RF_INTF_ACTIVATED &&
+            protocol == NCI_PROTOCOL_ISO_DEP &&
+            p2p_prio_logic_data.isodep_detected == FALSE)
+        {
+            nfa_dm_p2p_prio_logic_cleanup ();
+            p2p_prio_logic_data.isodep_detected = TRUE;
+            p2p_prio_logic_data.first_tech_mode = tech_mode;
+            NFA_TRACE_DEBUG0 ("ISO-DEP Detected First Time  Resume the Polling Loop");
+            nci_snd_deactivate_cmd (NFA_DEACTIVATE_TYPE_DISCOVERY);
+            return FALSE;
+        }
+
+        else if (event == NCI_MSG_RF_INTF_ACTIVATED &&
+                protocol == NCI_PROTOCOL_ISO_DEP &&
+                p2p_prio_logic_data.isodep_detected == TRUE &&
+                p2p_prio_logic_data.first_tech_mode != tech_mode)
+        {
+            p2p_prio_logic_data.isodep_detected = TRUE;
+            p2p_prio_logic_data.timer_expired = FALSE;
+            NFA_TRACE_DEBUG0 ("ISO-DEP Detected Second Time Other Techmode  Resume the Polling Loop");
+            nfc_stop_quick_timer (&p2p_prio_logic_data.timer_list);
+            nci_snd_deactivate_cmd (NFA_DEACTIVATE_TYPE_DISCOVERY);
+            return FALSE;
+        }
+
+        else if (event == NCI_MSG_RF_INTF_ACTIVATED &&
+                 protocol == NCI_PROTOCOL_ISO_DEP &&
+                 p2p_prio_logic_data.isodep_detected == TRUE &&
+                 p2p_prio_logic_data.timer_expired == TRUE)
+        {
+            NFA_TRACE_DEBUG0 ("ISO-DEP Detected TimerExpired, Final Notifying the Event");
+            nfc_stop_quick_timer (&p2p_prio_logic_data.timer_list);
+            nfa_dm_p2p_prio_logic_cleanup ();
+        }
+
+        else if (event == NCI_MSG_RF_INTF_ACTIVATED &&
+                 protocol == NCI_PROTOCOL_ISO_DEP &&
+                 p2p_prio_logic_data.isodep_detected == TRUE &&
+                 p2p_prio_logic_data.first_tech_mode == tech_mode)
+        {
+            NFA_TRACE_DEBUG0 ("ISO-DEP Detected Same Techmode, Final Notifying the Event");
+            nfc_stop_quick_timer (&p2p_prio_logic_data.timer_list);
+            NFA_TRACE_DEBUG0 ("P2P_Stop_Timer");
+            nfa_dm_p2p_prio_logic_cleanup ();
+        }
+
+        else if (event == NCI_MSG_RF_INTF_ACTIVATED &&
+                 protocol != NCI_PROTOCOL_ISO_DEP &&
+                 p2p_prio_logic_data.isodep_detected == TRUE)
+        {
+            NFA_TRACE_DEBUG0 ("ISO-DEP Not Detected  Giving Priority for other Technology");
+            nfc_stop_quick_timer (&p2p_prio_logic_data.timer_list);
+            NFA_TRACE_DEBUG0 ("P2P_Stop_Timer");
+            nfa_dm_p2p_prio_logic_cleanup ();
+        }
+
+        else if (event == NCI_MSG_RF_DEACTIVATE &&
+                 p2p_prio_logic_data.isodep_detected == TRUE &&
+                 p2p_prio_logic_data.timer_expired == FALSE &&
+                 event_type == NFA_DM_P2P_PRIO_RSP)
+        {
+            NFA_TRACE_DEBUG0 ("NFA_DM_RF_DEACTIVATE_RSP");
+            return FALSE;
+        }
+
+        else if (event == NCI_MSG_RF_DEACTIVATE &&
+                 p2p_prio_logic_data.isodep_detected == TRUE &&
+                 p2p_prio_logic_data.timer_expired == FALSE &&
+                 event_type == NFA_DM_P2P_PRIO_NTF)
+        {
+            NFA_TRACE_DEBUG0 ("NFA_DM_RF_DEACTIVATE_NTF");
+
+            nfc_start_quick_timer (&p2p_prio_logic_data.timer_list,
+                                   NFC_TTYPE_P2P_PRIO_RESPONSE,
+                                   ((UINT32) 160 * QUICK_TIMER_TICKS_PER_SEC) / 1000 );
+
+            NFA_TRACE_DEBUG0 ("P2P_Start_Timer");
+
+            return FALSE;
+        }
+    }
+
+    NFA_TRACE_DEBUG0 ("returning TRUE");
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         p2p_prio_logic_timeout
+**
+** Description      Callback function for p2p timer
+**
+** Returns          void
+**
+*******************************************************************************/
+void nfa_dm_p2p_timer_event ()
+{
+    NFA_TRACE_DEBUG0 ("P2P_Timer_timeout NFC-DEP Not Discovered!!");
+
+    p2p_prio_logic_data.timer_expired = TRUE;
+
+    if (p2p_prio_logic_data.isodep_detected == TRUE)
+    {
+        NFA_TRACE_DEBUG0 ("Deactivate and Restart RF discovery");
+        nci_snd_deactivate_cmd (NFC_DEACTIVATE_TYPE_IDLE);
+    }
+}
+
+/*******************************************************************************
+**
+** Function         nfa_dm_p2p_prio_logic_cleanup
+**
+** Description      Callback function for p2p prio logic cleanup timer
+**
+** Returns          void
+**
+*******************************************************************************/
+void nfa_dm_p2p_prio_logic_cleanup ()
+{
+    memset (&p2p_prio_logic_data, 0x00, sizeof(nfa_dm_p2p_prio_logic_t));
+}
diff --git a/src/nfa/ee/nfa_ee_act.c b/src/nfa/ee/nfa_ee_act.c
index 8858e7b..c474eea 100644
--- a/src/nfa/ee/nfa_ee_act.c
+++ b/src/nfa/ee/nfa_ee_act.c
@@ -537,6 +537,16 @@
     tNFA_TECHNOLOGY_MASK    old_tech_battery_off = p_cb->tech_battery_off;
     UINT8                   old_size_mask        = p_cb->size_mask;
 
+    if (   (p_cb->tech_switch_on == p_data->set_tech.technologies_switch_on)
+        && (p_cb->tech_switch_off == p_data->set_tech.technologies_switch_off)
+        && (p_cb->tech_battery_off == p_data->set_tech.technologies_battery_off))
+    {
+        /* nothing to change */
+        evt_data.status = NFA_STATUS_OK;
+        nfa_ee_report_event (p_cb->p_ee_cback, NFA_EE_SET_TECH_CFG_EVT, &evt_data);
+        return;
+    }
+
     p_cb->tech_switch_on   = p_data->set_tech.technologies_switch_on;
     p_cb->tech_switch_off  = p_data->set_tech.technologies_switch_off;
     p_cb->tech_battery_off = p_data->set_tech.technologies_battery_off;
@@ -583,6 +593,16 @@
     tNFA_PROTOCOL_MASK    old_proto_battery_off = p_cb->proto_battery_off;
     UINT8                   old_size_mask        = p_cb->size_mask;
 
+    if (   (p_cb->proto_switch_on == p_data->set_proto.protocols_switch_on)
+        && (p_cb->proto_switch_off == p_data->set_proto.protocols_switch_off)
+        && (p_cb->proto_battery_off == p_data->set_proto.protocols_battery_off)  )
+    {
+        /* nothing to change */
+        evt_data.status = NFA_STATUS_OK;
+        nfa_ee_report_event (p_cb->p_ee_cback, NFA_EE_SET_PROTO_CFG_EVT, &evt_data);
+        return;
+    }
+
     p_cb->proto_switch_on       = p_data->set_proto.protocols_switch_on;
     p_cb->proto_switch_off      = p_data->set_proto.protocols_switch_off;
     p_cb->proto_battery_off     = p_data->set_proto.protocols_battery_off;
diff --git a/src/nfa/int/nfa_dm_int.h b/src/nfa/int/nfa_dm_int.h
index fc9b906..cadd18b 100644
--- a/src/nfa/int/nfa_dm_int.h
+++ b/src/nfa/int/nfa_dm_int.h
@@ -539,6 +539,7 @@
 extern UINT8 nfa_ee_max_ee_cfg;
 extern tNCI_DISCOVER_MAPS *p_nfa_dm_interface_mapping;
 extern UINT8 nfa_dm_num_dm_interface_mapping;
+extern BOOLEAN nfa_poll_bail_out_mode;
 
 /* NFA device manager control block */
 #if NFA_DYNAMIC_MEMORY == FALSE
@@ -597,6 +598,7 @@
 BOOLEAN nfa_dm_tout (tNFA_DM_MSG *p_data);
 BOOLEAN nfa_dm_act_reg_vsc (tNFA_DM_MSG *p_data);
 BOOLEAN nfa_dm_act_send_vsc (tNFA_DM_MSG *p_data);
+UINT16 nfa_dm_act_get_rf_disc_duration ();
 BOOLEAN nfa_dm_act_disable_timeout (tNFA_DM_MSG *p_data);
 BOOLEAN nfa_dm_act_nfc_cback_data (tNFA_DM_MSG *p_data);
 
diff --git a/src/nfa/rw/nfa_rw_act.c b/src/nfa/rw/nfa_rw_act.c
index 8ef1b31..5a1091d 100644
--- a/src/nfa/rw/nfa_rw_act.c
+++ b/src/nfa/rw/nfa_rw_act.c
@@ -284,6 +284,7 @@
                 conn_evt_data.ndef_detect.cur_size = 0;
                 conn_evt_data.ndef_detect.max_size = 0;
                 conn_evt_data.ndef_detect.flags    = RW_NDEF_FL_UNKNOWN;
+                conn_evt_data.ndef_detect.status   = NFA_STATUS_TIMEOUT;
             }
             else
             {
@@ -557,11 +558,41 @@
 static void nfa_rw_handle_t1t_evt (tRW_EVENT event, tRW_DATA *p_rw_data)
 {
     tNFA_CONN_EVT_DATA conn_evt_data;
+    tNFA_TAG_PARAMS tag_params;
+    UINT8 *p_rid_rsp;
+    tNFA_STATUS activation_status;
 
     conn_evt_data.status = p_rw_data->data.status;
     switch (event)
     {
     case RW_T1T_RID_EVT:
+        if (p_rw_data->data.p_data != NULL)
+        {
+            /* Assume the data is just the response byte sequence */
+            p_rid_rsp = (UINT8 *)(p_rw_data->data.p_data + 1) + p_rw_data->data.p_data->offset;
+            /* Fetch HR from RID response message */
+            STREAM_TO_ARRAY (tag_params.t1t.hr, p_rid_rsp, T1T_HR_LEN);
+            /* Fetch UID0-3 from RID response message */
+            STREAM_TO_ARRAY (tag_params.t1t.uid, p_rid_rsp, T1T_CMD_UID_LEN);
+            GKI_freebuf (p_rw_data->data.p_data);
+            p_rw_data->data.p_data = NULL;
+        }
+
+        /* Command complete - perform cleanup, notify the app */
+        nfa_rw_command_complete();
+
+        if (p_rw_data->status == NFC_STATUS_TIMEOUT)
+        {
+            activation_status = NFA_STATUS_TIMEOUT;
+        }
+        else
+        {
+            activation_status = NFA_STATUS_OK;
+        }
+
+        nfa_dm_notify_activation_status (activation_status, &tag_params);
+        break;
+
     case RW_T1T_RALL_CPLT_EVT:
     case RW_T1T_READ_CPLT_EVT:
     case RW_T1T_RSEG_CPLT_EVT:
@@ -1005,6 +1036,17 @@
         nfa_rw_handle_ndef_detect(event, p_rw_data);
         break;
 
+    case RW_T4T_NDEF_FORMAT_CPLT_EVT:
+        /* Command complete - perform cleanup, notify the app */
+        nfa_rw_command_complete ();
+        nfa_rw_cb.cur_op = NFA_RW_OP_MAX;
+        nfa_rw_cb.ndef_cur_size = p_rw_data->ndef.cur_size;
+        nfa_rw_cb.ndef_max_size = p_rw_data->ndef.max_size;
+        conn_evt_data.status = (p_rw_data->status == NFC_STATUS_OK) ? NFA_STATUS_OK : NFA_STATUS_FAILED;
+
+        nfa_dm_act_conn_cback_notify (NFA_FORMAT_CPLT_EVT, &conn_evt_data);
+        break;
+
     case RW_T4T_NDEF_READ_EVT:              /* Segment of data received from type 4 tag */
         if (nfa_rw_cb.cur_op == NFA_RW_OP_READ_NDEF)
         {
@@ -1456,33 +1498,33 @@
     tNFC_PROTOCOL protocol = nfa_rw_cb.protocol;
     tNFC_STATUS status = NFC_STATUS_FAILED;
 
-    switch (protocol)
+    if (NFC_PROTOCOL_T1T == protocol)
     {
-    case NFC_PROTOCOL_T1T:    /* Type1Tag    - NFC-A */
+        /* Type1Tag    - NFC-A */
         status = RW_T1tDetectNDef();
-        break;
-
-    case NFC_PROTOCOL_T2T:   /* Type2Tag    - NFC-A */
+    }
+    else if (NFC_PROTOCOL_T2T == protocol)
+    {
+        /* Type2Tag    - NFC-A */
         if (nfa_rw_cb.pa_sel_res == NFC_SEL_RES_NFC_FORUM_T2T)
         {
             status = RW_T2tDetectNDef(nfa_rw_cb.skip_dyn_locks);
         }
-        break;
-
-    case NFC_PROTOCOL_T3T:   /* Type3Tag    - NFC-F */
+    }
+    else if (NFC_PROTOCOL_T3T == protocol)
+    {
+        /* Type3Tag    - NFC-F */
         status = RW_T3tDetectNDef();
-        break;
-
-    case NFC_PROTOCOL_ISO_DEP:     /* ISODEP/4A,4B- NFC-A or NFC-B */
+    }
+    else if (NFC_PROTOCOL_ISO_DEP == protocol)
+    {
+        /* ISODEP/4A,4B- NFC-A or NFC-B */
         status = RW_T4tDetectNDef();
-        break;
-
-    case NFC_PROTOCOL_15693:       /* ISO 15693 */
+    }
+    else if (NFC_PROTOCOL_15693 == protocol)
+    {
+        /* ISO 15693 */
         status = RW_I93DetectNDef();
-        break;
-
-    default:
-        break;
     }
 
     return(status);
@@ -1532,34 +1574,35 @@
     }
     nfa_rw_cb.ndef_rd_offset = 0;
 
-    switch (protocol)
+    if (NFC_PROTOCOL_T1T == protocol)
     {
-    case NFC_PROTOCOL_T1T:    /* Type1Tag    - NFC-A */
+        /* Type1Tag    - NFC-A */
         status = RW_T1tReadNDef(nfa_rw_cb.p_ndef_buf,(UINT16)nfa_rw_cb.ndef_cur_size);
-        break;
-
-    case NFC_PROTOCOL_T2T:   /* Type2Tag    - NFC-A */
+    }
+    else if (NFC_PROTOCOL_T2T == protocol)
+    {
+        /* Type2Tag    - NFC-A */
         if (nfa_rw_cb.pa_sel_res == NFC_SEL_RES_NFC_FORUM_T2T)
         {
             status = RW_T2tReadNDef(nfa_rw_cb.p_ndef_buf,(UINT16)nfa_rw_cb.ndef_cur_size);
         }
-        break;
-
-    case NFC_PROTOCOL_T3T:   /* Type3Tag    - NFC-F */
-        status = RW_T3tCheckNDef();
-        break;
-
-    case NFC_PROTOCOL_ISO_DEP:     /* ISODEP/4A,4B- NFC-A or NFC-B */
-        status = RW_T4tReadNDef();
-        break;
-
-    case NFC_PROTOCOL_15693:       /* ISO 15693 */
-        status = RW_I93ReadNDef();
-        break;
-
-    default:
-        break;
     }
+    else if (NFC_PROTOCOL_T3T == protocol)
+    {
+        /* Type3Tag    - NFC-F */
+        status = RW_T3tCheckNDef();
+    }
+    else if (NFC_PROTOCOL_ISO_DEP == protocol)
+    {
+        /* ISODEP/4A,4B- NFC-A or NFC-B */
+        status = RW_T4tReadNDef();
+    }
+    else if (NFC_PROTOCOL_15693 == protocol)
+    {
+        /* ISO 15693 */
+        status = RW_I93ReadNDef();
+    }
+
     return(status);
 }
 
@@ -1618,34 +1661,33 @@
     }
     else
     {
-        switch (protocol)
+        if (NFC_PROTOCOL_T1T == protocol)
         {
-        case NFC_PROTOCOL_T1T:    /* Type1Tag    - NFC-A */
+            /* Type1Tag    - NFC-A */
             status = RW_T1tWriteNDef((UINT16)nfa_rw_cb.ndef_wr_len, nfa_rw_cb.p_ndef_wr_buf);
-            break;
-
-        case NFC_PROTOCOL_T2T:   /* Type2Tag    - NFC-A */
-
+        }
+        else if (NFC_PROTOCOL_T2T == protocol)
+        {
+            /* Type2Tag    - NFC-A */
             if (nfa_rw_cb.pa_sel_res == NFC_SEL_RES_NFC_FORUM_T2T)
             {
                 status = RW_T2tWriteNDef((UINT16)nfa_rw_cb.ndef_wr_len, nfa_rw_cb.p_ndef_wr_buf);
             }
-            break;
-
-        case NFC_PROTOCOL_T3T:   /* Type3Tag    - NFC-F */
+        }
+        else if (NFC_PROTOCOL_T3T == protocol)
+        {
+            /* Type3Tag    - NFC-F */
             status = RW_T3tUpdateNDef(nfa_rw_cb.ndef_wr_len, nfa_rw_cb.p_ndef_wr_buf);
-            break;
-
-        case NFC_PROTOCOL_ISO_DEP:     /* ISODEP/4A,4B- NFC-A or NFC-B */
+        }
+        else if (NFC_PROTOCOL_ISO_DEP == protocol)
+        {
+            /* ISODEP/4A,4B- NFC-A or NFC-B */
             status = RW_T4tUpdateNDef((UINT16)nfa_rw_cb.ndef_wr_len, nfa_rw_cb.p_ndef_wr_buf);
-            break;
-
-        case NFC_PROTOCOL_15693:       /* ISO 15693 */
+        }
+        else if (NFC_PROTOCOL_15693 == protocol)
+        {
+            /* ISO 15693 */
             status = RW_I93UpdateNDef((UINT16)nfa_rw_cb.ndef_wr_len, nfa_rw_cb.p_ndef_wr_buf);
-            break;
-
-        default:
-            break;
         }
     }
 
@@ -1786,17 +1828,33 @@
     UINT8               option = NFA_RW_OPTION_INVALID;
     tNFA_RW_PRES_CHK_OPTION op_param = NFA_RW_PRES_CHK_DEFAULT;
 
-    switch (protocol)
+    if (NFC_PROTOCOL_T1T == protocol)
     {
-    case NFC_PROTOCOL_T1T:    /* Type1Tag    - NFC-A */
+        /* Type1Tag    - NFC-A */
         status = RW_T1tPresenceCheck();
-        break;
-
-    case NFC_PROTOCOL_T3T:   /* Type3Tag    - NFC-F */
+    }
+    else if (NFC_PROTOCOL_T2T == protocol)
+    {
+        /* If T2T NFC-Forum, then let RW handle presence check */
+        if (sel_res == NFC_SEL_RES_NFC_FORUM_T2T)
+        {
+            /* Type 2 tag have not sent NACK after activation */
+            status = RW_T2tPresenceCheck();
+        }
+        else
+        {
+            /* Will fall back to deactivate/reactivate */
+            unsupported = TRUE;
+        }
+    }
+    else if (NFC_PROTOCOL_T3T == protocol)
+    {
+        /* Type3Tag    - NFC-F */
         status = RW_T3tPresenceCheck();
-        break;
-
-    case NFC_PROTOCOL_ISO_DEP:     /* ISODEP/4A,4B- NFC-A or NFC-B */
+    }
+    else if (NFC_PROTOCOL_ISO_DEP == protocol)
+    {
+        /* ISODEP/4A,4B- NFC-A or NFC-B */
         if (p_data)
         {
             op_param    = p_data->op_req.params.option;
@@ -1861,27 +1919,16 @@
             /* use sleep/wake for presence check */
             unsupported = TRUE;
         }
-
-
-        break;
-
-    case NFC_PROTOCOL_15693:       /* ISO 15693 */
+    }
+    else if (NFC_PROTOCOL_15693 == protocol)
+    {
+        /* ISO 15693 */
         status = RW_I93PresenceCheck();
-        break;
-
-    case NFC_PROTOCOL_T2T:   /* Type2Tag    - NFC-A */
-        /* If T2T NFC-Forum, then let RW handle presence check; otherwise fall through */
-        if (sel_res == NFC_SEL_RES_NFC_FORUM_T2T)
-        {
-            /* Type 2 tag have not sent NACK after activation */
-            status = RW_T2tPresenceCheck();
-            break;
-        }
-
-    default:
+    }
+    else
+    {
         /* Protocol unsupported by RW module... */
         unsupported = TRUE;
-        break;
     }
 
     if (unsupported)
@@ -1977,6 +2024,10 @@
     {
         status = RW_I93FormatNDef();
     }
+    else if (protocol == NFC_PROTOCOL_ISO_DEP)
+    {
+        status = RW_T4tFormatNDef ();
+    }
 
     /* If unable to format NDEF, notify the app */
     if (status != NFC_STATUS_OK)
@@ -2034,9 +2085,9 @@
 
     NFA_TRACE_DEBUG0 ("nfa_rw_config_tag_ro ()");
 
-    switch (protocol)
+    if (NFC_PROTOCOL_T1T == protocol)
     {
-    case NFC_PROTOCOL_T1T:
+        /* Type1Tag    - NFC-A */
         if(  (nfa_rw_cb.tlv_st == NFA_RW_TLV_DETECT_ST_OP_NOT_STARTED)
            ||(nfa_rw_cb.tlv_st == NFA_RW_TLV_DETECT_ST_MEM_TLV_OP_COMPLETE) )
         {
@@ -2047,30 +2098,29 @@
         {
             status = RW_T1tSetTagReadOnly(b_hard_lock);
         }
-        break;
-
-    case NFC_PROTOCOL_T2T:
+    }
+    else if (NFC_PROTOCOL_T2T == protocol)
+    {
+        /* Type2Tag    - NFC-A */
         if (nfa_rw_cb.pa_sel_res == NFC_SEL_RES_NFC_FORUM_T2T)
         {
             status = RW_T2tSetTagReadOnly(b_hard_lock);
         }
-        break;
-
-    case NFC_PROTOCOL_T3T:
+    }
+    else if (NFC_PROTOCOL_T3T == protocol)
+    {
+        /* Type3Tag    - NFC-F */
         status = RW_T3tSetReadOnly(b_hard_lock);
-        break;
-
-    case NFC_PROTOCOL_ISO_DEP:
+    }
+    else if (NFC_PROTOCOL_ISO_DEP == protocol)
+    {
+        /* ISODEP/4A,4B- NFC-A or NFC-B */
         status = RW_T4tSetNDefReadOnly();
-        break;
-
-    case NFC_PROTOCOL_15693:
+    }
+    else if (NFC_PROTOCOL_15693 == protocol)
+    {
+        /* ISO 15693 */
         status = RW_I93SetTagReadOnly();
-        break;
-
-    default:
-        break;
-
     }
 
     if (status == NFC_STATUS_OK)
@@ -2669,27 +2719,29 @@
     }
 
     /* Perform protocol-specific actions */
-    switch (nfa_rw_cb.protocol)
+    if (NFC_PROTOCOL_T1T == nfa_rw_cb.protocol)
     {
-    case NFC_PROTOCOL_T1T:
         /* Retrieve HR and UID fields from activation notification */
         memcpy (tag_params.t1t.hr, p_activate_params->intf_param.intf_param.frame.param, NFA_T1T_HR_LEN);
         memcpy (tag_params.t1t.uid, p_activate_params->rf_tech_param.param.pa.nfcid1, p_activate_params->rf_tech_param.param.pa.nfcid1_len);
-        break;
-
-    case NFC_PROTOCOL_T2T:
+        msg.op = NFA_RW_OP_T1T_RID;
+        nfa_rw_handle_op_req ((tNFA_RW_MSG *)&msg);
+        activate_notify = FALSE;                    /* Delay notifying upper layer of NFA_ACTIVATED_EVT until HR0/HR1 is received */
+    }
+    else if (NFC_PROTOCOL_T2T == nfa_rw_cb.protocol)
+    {
         /* Retrieve UID fields from activation notification */
         memcpy (tag_params.t2t.uid, p_activate_params->rf_tech_param.param.pa.nfcid1, p_activate_params->rf_tech_param.param.pa.nfcid1_len);
-        break;
-
-    case NFC_PROTOCOL_T3T:
+    }
+    else if (NFC_PROTOCOL_T3T == nfa_rw_cb.protocol)
+    {
         /* Issue command to get Felica system codes */
         activate_notify = FALSE;                    /* Delay notifying upper layer of NFA_ACTIVATED_EVT until system codes are retrieved */
         msg.op = NFA_RW_OP_T3T_GET_SYSTEM_CODES;
         nfa_rw_handle_op_req((tNFA_RW_MSG *)&msg);
-        break;
-
-    case NFC_PROTOCOL_15693:
+    }
+    else if (NFC_PROTOCOL_15693 == nfa_rw_cb.protocol)
+    {
         /* Delay notifying upper layer of NFA_ACTIVATED_EVT to retrieve additional tag infomation */
         nfa_rw_cb.flags |= NFA_RW_FL_ACTIVATION_NTF_PENDING;
         activate_notify = FALSE;
@@ -2756,12 +2808,6 @@
                 nfa_rw_cb.i93_num_block  = 0;
             }
         }
-        break;
-
-
-    default:
-        /* No action needed for other protocols */
-        break;
     }
 
     /* Notify upper layer of NFA_ACTIVATED_EVT if needed, and start presence check timer */
diff --git a/src/nfc/include/nfc_api.h b/src/nfc/include/nfc_api.h
index cfd0c79..f9cc864 100644
--- a/src/nfc/include/nfc_api.h
+++ b/src/nfc/include/nfc_api.h
@@ -32,6 +32,8 @@
 #include "nfc_hal_api.h"
 #include "gki.h"
 
+#include "vendor_cfg.h"
+
 /* NFC application return status codes */
 #define NFC_STATUS_OK                   NCI_STATUS_OK                   /* Command succeeded    */
 #define NFC_STATUS_REJECTED             NCI_STATUS_REJECTED             /* Command is rejected. */
diff --git a/src/nfc/include/rw_api.h b/src/nfc/include/rw_api.h
index 6522417..879e9b7 100644
--- a/src/nfc/include/rw_api.h
+++ b/src/nfc/include/rw_api.h
@@ -102,6 +102,7 @@
     RW_T4T_PRESENCE_CHECK_EVT,                  /* Response to RW_T4tPresenceCheck          */
     RW_T4T_RAW_FRAME_EVT,                       /* Response of raw frame sent               */
     RW_T4T_INTF_ERROR_EVT,                      /* RF Interface error event                 */
+    RW_T4T_NDEF_FORMAT_CPLT_EVT,                /* Format operation completed               */
     RW_T4T_MAX_EVT,
 
     /* ISO 15693 tag events for tRW_CBACK */
@@ -840,6 +841,22 @@
 *****************************************************************************/
 NFC_API extern tNFC_STATUS RW_T3tGetSystemCodes (void);
 
+/*****************************************************************************
+**
+** Function         RW_T4tFormatNDef
+**
+** Description
+**      Format a type-4 tag for NDEF.
+**
+**      Only Desifire tags are supported by this API. The
+**      RW_T4T_FORMAT_CPLT_EVT is used to notify the status of the operation.
+**
+** Returns
+**      NFC_STATUS_OK: if success
+**      NFC_STATUS_FAILED: other error
+*****************************************************************************/
+NFC_API extern tNFC_STATUS RW_T4tFormatNDef (void);
+
 /*******************************************************************************
 **
 ** Function         RW_T4tDetectNDef
diff --git a/src/nfc/include/tags_defs.h b/src/nfc/include/tags_defs.h
index 1ef48be..14d2859 100644
--- a/src/nfc/include/tags_defs.h
+++ b/src/nfc/include/tags_defs.h
@@ -335,6 +335,12 @@
 #define T4T_CMD_INS_SELECT              0xA4
 #define T4T_CMD_INS_READ_BINARY         0xB0
 #define T4T_CMD_INS_UPDATE_BINARY       0xD6
+#define T4T_CMD_DES_CLASS               0x90
+#define T4T_CMD_INS_GET_HW_VERSION      0x60
+#define T4T_CMD_CREATE_AID              0xCA
+#define T4T_CMD_SELECT_APP              0x5A
+#define T4T_CMD_CREATE_DATAFILE         0xCD
+#define T4T_CMD_DES_WRITE               0x3D
 #define T4T_CMD_P1_SELECT_BY_NAME       0x04
 #define T4T_CMD_P1_SELECT_BY_FILE_ID    0x00
 #define T4T_CMD_P2_FIRST_OR_ONLY_00H    0x00
@@ -377,6 +383,16 @@
 #define T4T_FC_NO_WRITE_ACCESS          0xFF    /* no write access granted at all (read-only) */
 
 #define T4T_FILE_LENGTH_SIZE            0x02
+#define T4T_ADDI_FRAME_RESP             0xAFU
+#define T4T_SIZE_IDENTIFIER_2K          0x16U
+#define T4T_SIZE_IDENTIFIER_4K          0x18U
+#define T4T_SIZE_IDENTIFIER_8K          0x1AU
+#define T4T_DESEV1_MAJOR_VERSION        0x01U
+#define T4T_TYPE_DESFIRE_EV1            0x01U
+#define T4T_DESEV0_MAJOR_VERSION        0x00U
+#define T4T_DESEV0_MINOR_VERSION        0x06U
+#define T4T_DES_EV1_NFC_APP_ID          0x010000
+#define T4T_DES_EV0_NFC_APP_ID          0x10EEEE
 
 /*
 **
diff --git a/src/nfc/int/nfc_int.h b/src/nfc/int/nfc_int.h
index 7845c69..5a45072 100644
--- a/src/nfc/int/nfc_int.h
+++ b/src/nfc/int/nfc_int.h
@@ -62,6 +62,8 @@
 #define NFC_TTYPE_RW_T4T_RESPONSE           107
 #define NFC_TTYPE_RW_I93_RESPONSE           108
 #define NFC_TTYPE_CE_T4T_UPDATE             109
+#define NFC_TTYPE_P2P_PRIO_RESPONSE         110  /* added for p2p prio logic timer */
+#define NFC_TTYPE_P2P_PRIO_LOGIC_CLEANUP    111  /* added for p2p prio logic clenaup */
 #define NFC_TTYPE_VS_BASE                   200
 
 
@@ -81,6 +83,13 @@
 };
 typedef UINT8 tNFC_STATE;
 
+/* DM P2P Priority event type */
+enum
+{
+    NFA_DM_P2P_PRIO_RSP = 0x01,         /* P2P priority event from RSP   */
+    NFA_DM_P2P_PRIO_NTF          /* P2P priority event from NTF   */
+};
+
 /* NFC control block flags */
 #define NFC_FL_DEACTIVATING             0x0001  /* NFC_Deactivate () is called and the NCI cmd is not sent   */
 #define NFC_FL_RESTARTING               0x0002  /* restarting NFCC after PowerOffSleep          */
@@ -249,6 +258,9 @@
 NFC_API extern void nfc_ncif_proc_init_rsp (BT_HDR *p_msg);
 NFC_API extern void nfc_ncif_proc_get_config_rsp (BT_HDR *p_msg);
 NFC_API extern void nfc_ncif_proc_data (BT_HDR *p_msg);
+NFC_API extern BOOLEAN nfa_dm_p2p_prio_logic(UINT8 event, UINT8 *p, UINT8 ntf_rsp);
+NFC_API extern void nfa_dm_p2p_timer_event ();
+NFC_API extern void nfa_dm_p2p_prio_logic_cleanup ();
 
 #if (NFC_RW_ONLY == FALSE)
 NFC_API extern void nfc_ncif_proc_rf_field_ntf (UINT8 rf_status);
diff --git a/src/nfc/int/rw_int.h b/src/nfc/int/rw_int.h
index 879f7a1..908fd09 100644
--- a/src/nfc/int/rw_int.h
+++ b/src/nfc/int/rw_int.h
@@ -465,6 +465,8 @@
 
     UINT16              max_read_size;      /* max reading size per a command   */
     UINT16              max_update_size;    /* max updating size per a command  */
+    UINT16              card_size;
+    UINT8               card_type;
 } tRW_T4T_CB;
 
 /* RW retransmission statistics */
diff --git a/src/nfc/nci/nci_hrcv.c b/src/nfc/nci/nci_hrcv.c
index 0248212..e2a6384 100644
--- a/src/nfc/nci/nci_hrcv.c
+++ b/src/nfc/nci/nci_hrcv.c
@@ -169,6 +169,7 @@
     switch (op_code)
     {
     case NCI_MSG_RF_DISCOVER:
+        nfa_dm_p2p_prio_logic (op_code, pp, NFA_DM_P2P_PRIO_RSP);
         nfc_ncif_rf_management_status (NFC_START_DEVT, *pp);
         break;
 
@@ -184,6 +185,10 @@
         break;
 
     case NCI_MSG_RF_DEACTIVATE:
+        if (FALSE == nfa_dm_p2p_prio_logic (op_code, pp, NFA_DM_P2P_PRIO_RSP))
+        {
+            return;
+        }
         nfc_ncif_proc_deactivate (*pp, *p_old, FALSE);
         break;
 
@@ -238,10 +243,18 @@
         break;
 
     case NCI_MSG_RF_DEACTIVATE:
+        if (FALSE == nfa_dm_p2p_prio_logic (op_code, pp, NFA_DM_P2P_PRIO_NTF))
+        {
+            return;
+        }
         nfc_ncif_proc_deactivate (NFC_STATUS_OK, *pp, TRUE);
         break;
 
     case NCI_MSG_RF_INTF_ACTIVATED:
+        if (FALSE == nfa_dm_p2p_prio_logic (op_code, pp, NFA_DM_P2P_PRIO_NTF))
+        {
+            return;
+        }
         nfc_ncif_proc_activate (pp, len);
         break;
 
diff --git a/src/nfc/nfc/nfc_ncif.c b/src/nfc/nfc/nfc_ncif.c
index 4316807..1b0fb15 100644
--- a/src/nfc/nfc/nfc_ncif.c
+++ b/src/nfc/nfc/nfc_ncif.c
@@ -624,10 +624,10 @@
     len             = *p++;
     p_start         = p;
     memset ( &p_param->param, 0, sizeof (tNFC_RF_TECH_PARAMU));
-    switch (p_param->mode)
+
+    if (  NCI_DISCOVERY_TYPE_POLL_A == p_param->mode
+       || NCI_DISCOVERY_TYPE_POLL_A_ACTIVE == p_param->mode  )
     {
-    case NCI_DISCOVERY_TYPE_POLL_A:
-    case NCI_DISCOVERY_TYPE_POLL_A_ACTIVE:
         p_pa        = &p_param->param.pa;
         /*
 SENS_RES Response   2 bytes Defined in [DIGPROT] Available after Technology Detection
@@ -654,9 +654,9 @@
                 p_pa->hr[1]  = *p;
             }
         }
-        break;
-
-    case NCI_DISCOVERY_TYPE_POLL_B:
+    }
+    else if (NCI_DISCOVERY_TYPE_POLL_B == p_param->mode)
+    {
         /*
 SENSB_RES Response length (n)   1 byte  Length of SENSB_RES Response (Byte 2 - Byte 12 or 13)Available after Technology Detection
 SENSB_RES Response Byte 2 - Byte 12 or 13   11 or 12 bytes  Defined in [DIGPROT] Available after Technology Detection
@@ -667,10 +667,10 @@
             p_pb->sensb_res_len = NCI_MAX_SENSB_RES_LEN;
         STREAM_TO_ARRAY (p_pb->sensb_res, p, p_pb->sensb_res_len);
         memcpy (p_pb->nfcid0, p_pb->sensb_res, NFC_NFCID0_MAX_LEN);
-        break;
-
-    case NCI_DISCOVERY_TYPE_POLL_F:
-    case NCI_DISCOVERY_TYPE_POLL_F_ACTIVE:
+    }
+    else if (  NCI_DISCOVERY_TYPE_POLL_F == p_param->mode
+            || NCI_DISCOVERY_TYPE_POLL_F_ACTIVE == p_param->mode  )
+    {
         /*
 Bit Rate    1 byte  1   212 kbps/2   424 kbps/0 and 3 to 255  RFU
 SENSF_RES Response length.(n) 1 byte  Length of SENSF_RES (Byte 2 - Byte 17 or 19).Available after Technology Detection
@@ -685,26 +685,26 @@
         memcpy (p_pf->nfcid2, p_pf->sensf_res, NCI_NFCID2_LEN);
         p_pf->mrti_check    = p_pf->sensf_res[NCI_MRTI_CHECK_INDEX];
         p_pf->mrti_update   = p_pf->sensf_res[NCI_MRTI_UPDATE_INDEX];
-        break;
-
-    case NCI_DISCOVERY_TYPE_LISTEN_F:
-    case NCI_DISCOVERY_TYPE_LISTEN_F_ACTIVE:
+    }
+    else if (  NCI_DISCOVERY_TYPE_LISTEN_F == p_param->mode
+            || NCI_DISCOVERY_TYPE_LISTEN_F_ACTIVE == p_param->mode  )
+    {
         p_lf                = &p_param->param.lf;
         u8                  = *p++;
         if (u8)
         {
             STREAM_TO_ARRAY (p_lf->nfcid2, p, NCI_NFCID2_LEN);
         }
-        break;
-
-    case NCI_DISCOVERY_TYPE_POLL_ISO15693:
+    }
+    else if (NCI_DISCOVERY_TYPE_POLL_ISO15693 == p_param->mode)
+    {
         p_i93               = &p_param->param.pi93;
         p_i93->flag         = *p++;
         p_i93->dsfid        = *p++;
         STREAM_TO_ARRAY (p_i93->uid, p, NFC_ISO15693_UID_LEN);
-        break;
-
-    case NCI_DISCOVERY_TYPE_POLL_KOVIO:
+    }
+    else if (NCI_DISCOVERY_TYPE_POLL_KOVIO == p_param->mode)
+    {
         p_param->param.pk.uid_len = *p++;
         if (p_param->param.pk.uid_len > NFC_KOVIO_MAX_LEN)
         {
@@ -712,7 +712,6 @@
             p_param->param.pk.uid_len = NFC_KOVIO_MAX_LEN;
         }
         STREAM_TO_ARRAY (p_param->param.pk.uid, p, p_param->param.pk.uid_len);
-        break;
     }
 
     return (p_start + len);
@@ -742,7 +741,8 @@
         evt_data.result.rf_tech_param.mode  = *p++;
         p = nfc_ncif_decode_rf_params (&evt_data.result.rf_tech_param, p);
 
-        evt_data.result.more            = *p++;
+        evt_data.result.more = (*p == NCI_DISCOVER_NTF_MORE) ? TRUE : FALSE;
+        p++;
         (*nfc_cb.p_discv_cback) (NFC_RESULT_DEVT, &evt_data);
     }
 }
diff --git a/src/nfc/nfc/nfc_task.c b/src/nfc/nfc/nfc_task.c
index 9d9b74a..1ead9b2 100644
--- a/src/nfc/nfc/nfc_task.c
+++ b/src/nfc/nfc/nfc_task.c
@@ -278,6 +278,12 @@
         case NFC_TTYPE_RW_I93_RESPONSE:
             rw_i93_process_timeout (p_tle);
             break;
+        case NFC_TTYPE_P2P_PRIO_RESPONSE:
+            nfa_dm_p2p_timer_event ();
+            break;
+        case NFC_TTYPE_P2P_PRIO_LOGIC_CLEANUP:
+            nfa_dm_p2p_prio_logic_cleanup ();
+            break;
 #if (NFC_RW_ONLY == FALSE)
         case NFC_TTYPE_CE_T4T_UPDATE:
             ce_t4t_process_timeout (p_tle);
diff --git a/src/nfc/tags/rw_main.c b/src/nfc/tags/rw_main.c
index c11f592..d9fe097 100644
--- a/src/nfc/tags/rw_main.c
+++ b/src/nfc/tags/rw_main.c
@@ -227,51 +227,55 @@
 #endif  /* RW_STATS_INCLUDED */
 
     rw_cb.p_cback = p_cback;
-    switch (p_activate_params->protocol)
-    {
     /* not a tag NFC_PROTOCOL_NFCIP1:   NFCDEP/LLCP - NFC-A or NFC-F */
-    case NFC_PROTOCOL_T1T:    /* Type1Tag    - NFC-A */
+    if (NFC_PROTOCOL_T1T == p_activate_params->protocol)
+    {
+        /* Type1Tag    - NFC-A */
         if (p_activate_params->rf_tech_param.mode == NFC_DISCOVERY_TYPE_POLL_A)
         {
             status = rw_t1t_select (p_activate_params->rf_tech_param.param.pa.hr,
                                     p_activate_params->rf_tech_param.param.pa.nfcid1);
         }
-        break;
-
-    case NFC_PROTOCOL_T2T:   /* Type2Tag    - NFC-A */
+    }
+    else if (NFC_PROTOCOL_T2T == p_activate_params->protocol)
+    {
+        /* Type2Tag    - NFC-A */
         if (p_activate_params->rf_tech_param.mode == NFC_DISCOVERY_TYPE_POLL_A)
         {
             if (p_activate_params->rf_tech_param.param.pa.sel_rsp == NFC_SEL_RES_NFC_FORUM_T2T)
                 status      = rw_t2t_select ();
         }
-        break;
-
-    case NFC_PROTOCOL_T3T:   /* Type3Tag    - NFC-F */
+    }
+    else if (NFC_PROTOCOL_T3T == p_activate_params->protocol)
+    {
+        /* Type3Tag    - NFC-F */
         if (p_activate_params->rf_tech_param.mode == NFC_DISCOVERY_TYPE_POLL_F)
         {
             status = rw_t3t_select (p_activate_params->rf_tech_param.param.pf.nfcid2,
                                     p_activate_params->rf_tech_param.param.pf.mrti_check,
                                     p_activate_params->rf_tech_param.param.pf.mrti_update);
         }
-        break;
-
-    case NFC_PROTOCOL_ISO_DEP:     /* ISODEP/4A,4B- NFC-A or NFC-B */
+    }
+    else if (NFC_PROTOCOL_ISO_DEP == p_activate_params->protocol)
+    {
+        /* ISODEP/4A,4B- NFC-A or NFC-B */
         if (  (p_activate_params->rf_tech_param.mode == NFC_DISCOVERY_TYPE_POLL_B)
             ||(p_activate_params->rf_tech_param.mode == NFC_DISCOVERY_TYPE_POLL_A)  )
         {
             status          = rw_t4t_select ();
         }
-        break;
-
-    case NFC_PROTOCOL_15693:     /* ISO 15693 */
+    }
+    else if (NFC_PROTOCOL_15693 == p_activate_params->protocol)
+    {
+        /* ISO 15693 */
         if (p_activate_params->rf_tech_param.mode == NFC_DISCOVERY_TYPE_POLL_ISO15693)
         {
             status          = rw_i93_select (p_activate_params->rf_tech_param.param.pi93.uid);
         }
-        break;
+    }
     /* TODO set up callback for proprietary protocol */
-
-    default:
+    else
+    {
         RW_TRACE_ERROR0 ("RW_SetActivatedTagType Invalid protocol");
     }
 
diff --git a/src/nfc/tags/rw_t1t_ndef.c b/src/nfc/tags/rw_t1t_ndef.c
index 29aff77..a6a25b6 100644
--- a/src/nfc/tags/rw_t1t_ndef.c
+++ b/src/nfc/tags/rw_t1t_ndef.c
@@ -2200,7 +2200,7 @@
                     {
                         /* Set/clear lock_attr byte bits based on whether a particular lock bit is set or not
                          * each bit in lock_attr represents one byte in Tag read only attribute */
-                        if (p_t1t->lockbyte[num_dynamic_lock_bytes].lock_byte & rw_t1t_mask_bits[xx])
+                        if ((p_t1t->lockbyte[num_dynamic_lock_bytes].lock_byte & rw_t1t_mask_bits[xx]) && (block_count < T1T_BLOCKS_PER_SEGMENT))
                         {
                             p_t1t->lock_attr[block_count] |= 0x01 << bits_covered;
                         }
diff --git a/src/nfc/tags/rw_t4t.c b/src/nfc/tags/rw_t4t.c
index 6e2b4ad..c634591 100644
--- a/src/nfc/tags/rw_t4t.c
+++ b/src/nfc/tags/rw_t4t.c
@@ -46,6 +46,8 @@
 #define RW_T4T_STATE_PRESENCE_CHECK             0x05    /* checking presence of tag             */
 #define RW_T4T_STATE_SET_READ_ONLY              0x06    /* convert tag to read only             */
 
+#define RW_T4T_STATE_NDEF_FORMAT                0x07    /* performing NDEF format               */
+
 /* sub state */
 #define RW_T4T_SUBSTATE_WAIT_SELECT_APP         0x00    /* waiting for response of selecting AID    */
 #define RW_T4T_SUBSTATE_WAIT_SELECT_CC          0x01    /* waiting for response of selecting CC     */
@@ -57,6 +59,15 @@
 #define RW_T4T_SUBSTATE_WAIT_UPDATE_NLEN        0x07    /* waiting for response of updating NLEN    */
 #define RW_T4T_SUBSTATE_WAIT_UPDATE_CC          0x08    /* waiting for response of updating CC      */
 
+#define RW_T4T_SUBSTATE_WAIT_GET_HW_VERSION     0x09
+#define RW_T4T_SUBSTATE_WAIT_GET_SW_VERSION     0x0A
+#define RW_T4T_SUBSTATE_WAIT_GET_UID            0x0B
+#define RW_T4T_SUBSTATE_WAIT_CREATE_APP         0x0C
+#define RW_T4T_SUBSTATE_WAIT_CREATE_CC          0x0D
+#define RW_T4T_SUBSTATE_WAIT_CREATE_NDEF        0x0E
+#define RW_T4T_SUBSTATE_WAIT_WRITE_CC           0x0F
+#define RW_T4T_SUBSTATE_WAIT_WRITE_NDEF         0x10
+
 #if (BT_TRACE_VERBOSE == TRUE)
 static char *rw_t4t_get_state_name (UINT8 state);
 static char *rw_t4t_get_sub_state_name (UINT8 sub_state);
@@ -70,12 +81,22 @@
 static BOOLEAN rw_t4t_update_cc_to_readonly (void);
 static BOOLEAN rw_t4t_select_application (UINT8 version);
 static BOOLEAN rw_t4t_validate_cc_file (void);
+
+static BOOLEAN rw_t4t_get_hw_version (void);
+static BOOLEAN rw_t4t_get_sw_version (void);
+static BOOLEAN rw_t4t_create_app (void);
+static BOOLEAN rw_t4t_select_app (void);
+static BOOLEAN rw_t4t_create_ccfile (void);
+static BOOLEAN rw_t4t_create_ndef (void);
+static BOOLEAN rw_t4t_write_cc (void);
+static BOOLEAN rw_t4t_write_ndef (void);
 static void rw_t4t_handle_error (tNFC_STATUS status, UINT8 sw1, UINT8 sw2);
 static void rw_t4t_sm_detect_ndef (BT_HDR *p_r_apdu);
 static void rw_t4t_sm_read_ndef (BT_HDR *p_r_apdu);
 static void rw_t4t_sm_update_ndef (BT_HDR  *p_r_apdu);
 static void rw_t4t_sm_set_readonly (BT_HDR  *p_r_apdu);
 static void rw_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_data);
+static void rw_t4t_sm_ndef_format (BT_HDR  *p_r_apdu);
 
 /*******************************************************************************
 **
@@ -99,7 +120,510 @@
     }
 
     nfc_start_quick_timer (&rw_cb.tcb.t4t.timer, NFC_TTYPE_RW_T4T_RESPONSE,
-                           (RW_T4T_TOUT_RESP * QUICK_TIMER_TICKS_PER_SEC) / 1000);
+            (RW_T4T_TOUT_RESP * QUICK_TIMER_TICKS_PER_SEC) / 1000);
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_get_hw_version
+**
+** Description      Send get hw version cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_get_hw_version (void)
+{
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_get_hw_version (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_CMD_INS_GET_HW_VERSION);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    UINT8_TO_BE_FIELD (p, 0x00);
+
+    p_c_apdu->len = T4T_CMD_MAX_HDR_SIZE;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_get_sw_version
+**
+** Description      Send get sw version cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_get_sw_version (void)
+{
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_get_sw_version (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_ADDI_FRAME_RESP);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    UINT8_TO_BE_FIELD (p, 0x00);
+
+    p_c_apdu->len = T4T_CMD_MAX_HDR_SIZE;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_update_version_details
+**
+** Description      Updates the size of the card
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_update_version_details (BT_HDR *p_r_apdu)
+{
+    tRW_T4T_CB      *p_t4t = &rw_cb.tcb.t4t;
+    UINT8           *p;
+    UINT16          major_version, minor_version;
+
+    p = (UINT8 *) (p_r_apdu + 1) + p_r_apdu->offset;
+    major_version = *(p + 3);
+    minor_version = *(p + 4);
+
+    if ((T4T_DESEV0_MAJOR_VERSION == major_version) &&
+        (T4T_DESEV0_MINOR_VERSION == minor_version))
+    {
+        p_t4t->card_size = 0xEDE;
+    }
+    else if (major_version >= T4T_DESEV1_MAJOR_VERSION)
+    {
+        p_t4t->card_type = T4T_TYPE_DESFIRE_EV1;
+        switch (*(p + 5))
+        {
+        case T4T_SIZE_IDENTIFIER_2K:
+            p_t4t->card_size = 2048;
+            break;
+        case T4T_SIZE_IDENTIFIER_4K:
+            p_t4t->card_size = 4096;
+            break;
+        case T4T_SIZE_IDENTIFIER_8K:
+            p_t4t->card_size = 7680;
+            break;
+        default:
+            return FALSE;
+        }
+    }
+    else
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_get_uid_details
+**
+** Description      Send get uid cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_get_uid_details (void)
+{
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_get_uid_details (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_ADDI_FRAME_RESP);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    UINT8_TO_BE_FIELD (p, 0x00);
+
+    p_c_apdu->len = T4T_CMD_MAX_HDR_SIZE;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_create_app
+**
+** Description      Send create application cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_create_app (void)
+{
+    tRW_T4T_CB  *p_t4t = &rw_cb.tcb.t4t;
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+    UINT8       df_name[] = {0xD2, 0x76, 0x00, 0x00, 0x85, 0x01, 0x01};
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_create_app (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_CMD_CREATE_AID);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    if (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1)
+    {
+        UINT8_TO_BE_STREAM (p, (T4T_CMD_MAX_HDR_SIZE + sizeof(df_name) + 2));
+        UINT24_TO_BE_STREAM (p, T4T_DES_EV1_NFC_APP_ID);
+        UINT16_TO_BE_STREAM (p, 0x0F21);                  /*Key settings and no.of keys */
+        UINT16_TO_BE_STREAM (p, 0x05E1);                  /* ISO file ID */
+        ARRAY_TO_BE_STREAM (p, df_name, sizeof(df_name));   /*DF file name */
+        UINT8_TO_BE_STREAM (p, 0x00);                      /* Le */
+        p_c_apdu->len = 20;
+    }
+    else
+    {
+        UINT8_TO_BE_STREAM (p, T4T_CMD_MAX_HDR_SIZE);
+        UINT24_TO_BE_STREAM (p, T4T_DES_EV0_NFC_APP_ID);
+        UINT16_TO_BE_STREAM (p, 0x0F01);                  /*Key settings and no.of keys */
+        UINT8_TO_BE_STREAM (p, 0x00);                      /* Le */
+        p_c_apdu->len = 11;
+    }
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_select_app
+**
+** Description      Select application cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_select_app (void)
+{
+    tRW_T4T_CB  *p_t4t = &rw_cb.tcb.t4t;
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_select_app (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_CMD_SELECT_APP);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    UINT8_TO_BE_STREAM (p, 0x03);                      /* Lc: length of wrapped data */
+    if (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1)
+    {
+        UINT24_TO_BE_STREAM (p, T4T_DES_EV1_NFC_APP_ID);
+    }
+    else
+    {
+        UINT24_TO_BE_STREAM(p, T4T_DES_EV0_NFC_APP_ID);
+    }
+
+    UINT8_TO_BE_STREAM (p, 0x00);                      /* Le */
+
+    p_c_apdu->len = 9;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_create_ccfile
+**
+** Description      create capability container file cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_create_ccfile (void)
+{
+    tRW_T4T_CB  *p_t4t = &rw_cb.tcb.t4t;
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_create_ccfile (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_CMD_CREATE_DATAFILE);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    if (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1)
+    {
+        UINT8_TO_BE_STREAM (p, 0x09);                    /* Lc: length of wrapped data */
+        UINT8_TO_BE_STREAM (p, 0x01);                    /* EV1 CC file id             */
+        UINT16_TO_BE_STREAM (p, 0x03E1);                 /* ISO file id                */
+    }
+    else
+    {
+        UINT8_TO_BE_STREAM (p, 0x07);               /* Lc: length of wrapped data */
+        UINT8_TO_BE_STREAM (p, 0x03);               /* DESFire CC file id         */
+    }
+
+    UINT8_TO_BE_STREAM (p, 0x00);                   /* COMM settings              */
+    UINT16_TO_BE_STREAM (p, 0xEEEE);                /* Access rights              */
+    UINT24_TO_BE_STREAM (p, 0x0F0000);              /* Set file size              */
+    UINT8_TO_BE_STREAM (p, 0x00);                   /* Le                         */
+
+    p_c_apdu->len = (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1) ? 15 : 13;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_create_ndef
+**
+** Description      creates an ndef file cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_create_ndef (void)
+{
+    tRW_T4T_CB  *p_t4t = &rw_cb.tcb.t4t;
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_create_ndef (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_CMD_CREATE_DATAFILE);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    if (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1)
+    {
+        UINT8_TO_BE_STREAM (p, 0x09);                   /* Lc: length of wrapped data */
+        UINT8_TO_BE_STREAM (p, 0x02);                   /* DESFEv1 NDEF file id       */
+        UINT16_TO_BE_STREAM (p, 0x04E1);                /* ISO file id                */
+    }
+    else
+    {
+        UINT8_TO_BE_STREAM (p, 0x07);
+        UINT8_TO_BE_STREAM (p, 0x04);                   /* DESF4 NDEF file id        */
+    }
+
+    UINT8_TO_BE_STREAM (p, 0x00);                       /* COMM settings              */
+    UINT16_TO_BE_STREAM (p, 0xEEEE);                    /* Access rights              */
+    UINT16_TO_STREAM (p, p_t4t->card_size);
+    UINT8_TO_BE_STREAM (p, 0x00);                       /* Set card size              */
+    UINT8_TO_BE_STREAM (p, 0x00);                       /* Le                         */
+
+    p_c_apdu->len = (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1) ? 15 : 13;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_write_cc
+**
+** Description      sends write cc file cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_write_cc (void)
+{
+    tRW_T4T_CB  *p_t4t = &rw_cb.tcb.t4t;
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+    UINT8       CCFileBytes[] = {0x00, 0x0F, 0x10, 0x00, 0x3B, 0x00, 0x34, 0x04, 0x06, 0xE1, 0x04, 0x04, 0x00, 0x00, 0x00};
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_write_cc (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_WRITE);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    UINT8_TO_BE_STREAM (p, 0x16);                    /* Lc: length of wrapped data  */
+    if (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1)
+    {
+        CCFileBytes[2]  = 0x20;
+        CCFileBytes[11] = p_t4t->card_size >> 8;
+        CCFileBytes[12] = (UINT8) p_t4t->card_size;
+        UINT8_TO_BE_STREAM (p, 0x01);               /* CC file id                  */
+    }
+    else
+    {
+        UINT8_TO_BE_STREAM (p, 0x03);
+    }
+
+    UINT24_TO_BE_STREAM (p, 0x000000);              /* Set the offset              */
+    UINT24_TO_BE_STREAM (p, 0x0F0000);              /* Set available length        */
+    ARRAY_TO_BE_STREAM (p, CCFileBytes, sizeof(CCFileBytes));
+    UINT8_TO_BE_STREAM (p, 0x00);                    /* Le                         */
+
+    p_c_apdu->len = 28;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*******************************************************************************
+**
+** Function         rw_t4t_write_ndef
+**
+** Description      sends write ndef file cmd to peer
+**
+** Returns          TRUE if success
+**
+*******************************************************************************/
+static BOOLEAN rw_t4t_write_ndef (void)
+{
+    tRW_T4T_CB  *p_t4t = &rw_cb.tcb.t4t;
+    BT_HDR      *p_c_apdu;
+    UINT8       *p;
+
+    p_c_apdu = (BT_HDR *) GKI_getpoolbuf (NFC_RW_POOL_ID);
+
+    if (!p_c_apdu)
+    {
+        RW_TRACE_ERROR0 ("rw_t4t_write_ndef (): Cannot allocate buffer");
+        return FALSE;
+    }
+
+    p_c_apdu->offset = NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE;
+    p = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_CLASS);
+    UINT8_TO_BE_STREAM (p, T4T_CMD_DES_WRITE);
+    UINT16_TO_BE_STREAM (p, 0x0000);
+    UINT8_TO_BE_STREAM (p, 0x09);                    /* Lc: length of wrapped data  */
+    if (p_t4t->card_type == T4T_TYPE_DESFIRE_EV1)
+    {
+        UINT8_TO_BE_STREAM (p, 0x02);               /* DESFEv1 Ndef file id        */
+    }
+    else
+    {
+        UINT8_TO_BE_STREAM (p, 0x04);
+    }
+
+    UINT24_TO_BE_STREAM (p, 0x000000);              /* Set the offset              */
+    UINT24_TO_BE_STREAM (p, 0x020000);              /* Set available length        */
+    UINT16_TO_BE_STREAM (p, 0x0000);                /* Ndef file bytes             */
+    UINT8_TO_BE_STREAM (p, 0x00);                    /* Le                          */
+
+    p_c_apdu->len = 15;
+
+    if (!rw_t4t_send_to_lower (p_c_apdu))
+    {
+        return FALSE;
+    }
 
     return TRUE;
 }
@@ -571,6 +1095,11 @@
             event = RW_T4T_SET_TO_RO_EVT;
             break;
 
+        case RW_T4T_STATE_NDEF_FORMAT:
+            event = RW_T4T_NDEF_FORMAT_CPLT_EVT;
+            rw_data.status = NFC_STATUS_FAILED;
+            break;
+
         default:
             event = RW_T4T_MAX_EVT;
             break;
@@ -591,6 +1120,243 @@
 
 /*******************************************************************************
 **
+** Function         rw_t4t_sm_ndef_format
+**
+** Description      State machine for NDEF format procedure
+**
+** Returns          none
+**
+*******************************************************************************/
+static void rw_t4t_sm_ndef_format (BT_HDR *p_r_apdu)
+{
+    tRW_T4T_CB  *p_t4t = &rw_cb.tcb.t4t;
+    UINT8       *p, type, length;
+    UINT16      status_words, nlen;
+    tRW_DATA    rw_data;
+
+#if (BT_TRACE_VERBOSE == TRUE)
+    RW_TRACE_DEBUG2 ("rw_t4t_sm_ndef_format (): sub_state:%s (%d)",
+                      rw_t4t_get_sub_state_name (p_t4t->sub_state), p_t4t->sub_state);
+#else
+    RW_TRACE_DEBUG1 ("rw_t4t_sm_ndef_format (): sub_state=%d", p_t4t->sub_state);
+#endif
+
+    /* get status words */
+    p = (UINT8 *) (p_r_apdu + 1) + p_r_apdu->offset;
+
+    switch (p_t4t->sub_state)
+    {
+    case RW_T4T_SUBSTATE_WAIT_GET_HW_VERSION:
+        p += (p_r_apdu->len - 1);
+        if (*(p) == T4T_ADDI_FRAME_RESP)
+        {
+            if (!rw_t4t_get_sw_version ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+            else
+            {
+                p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_GET_SW_VERSION;
+            }
+        }
+        else
+        {
+            rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_GET_SW_VERSION:
+        p += (p_r_apdu->len - 1);
+        if (*(p) == T4T_ADDI_FRAME_RESP)
+        {
+            if (!rw_t4t_update_version_details (p_r_apdu))
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+
+            if (!rw_t4t_get_uid_details ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+
+            p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_GET_UID;
+        }
+        else
+        {
+            rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_GET_UID:
+        p += (p_r_apdu->len - T4T_RSP_STATUS_WORDS_SIZE);
+        BE_STREAM_TO_UINT16 (status_words, p);
+        if (status_words != 0x9100)
+        {
+            rw_t4t_handle_error (NFC_STATUS_CMD_NOT_CMPLTD, *(p - 2), *(p - 1));
+        }
+        else
+        {
+            if (!rw_t4t_create_app ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+            else
+            {
+                p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_CREATE_APP;
+            }
+
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_CREATE_APP:
+        p += (p_r_apdu->len - T4T_RSP_STATUS_WORDS_SIZE);
+        BE_STREAM_TO_UINT16 (status_words, p);
+        if (status_words == 0x91DE) /* DUPLICATE_ERROR, file already exist*/
+        {
+            status_words = 0x9100;
+        }
+
+        if (status_words != 0x9100)
+        {
+            rw_t4t_handle_error (NFC_STATUS_CMD_NOT_CMPLTD, *(p - 2), *(p - 1));
+        }
+        else
+        {
+            if (!rw_t4t_select_app ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+            else
+            {
+                p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_SELECT_APP;
+            }
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_SELECT_APP:
+        p += (p_r_apdu->len - T4T_RSP_STATUS_WORDS_SIZE);
+        BE_STREAM_TO_UINT16 (status_words, p);
+        if (status_words != 0x9100)
+        {
+            rw_t4t_handle_error (NFC_STATUS_CMD_NOT_CMPLTD, *(p - 2), *(p - 1));
+        }
+        else
+        {
+            if (!rw_t4t_create_ccfile ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+            else
+            {
+                p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_CREATE_CC;
+            }
+
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_CREATE_CC:
+        p += (p_r_apdu->len - T4T_RSP_STATUS_WORDS_SIZE);
+        BE_STREAM_TO_UINT16 (status_words, p);
+        if (status_words == 0x91DE) /* DUPLICATE_ERROR, file already exist*/
+        {
+            status_words = 0x9100;
+        }
+
+        if (status_words != 0x9100)
+        {
+            rw_t4t_handle_error (NFC_STATUS_CMD_NOT_CMPLTD, *(p - 2), *(p - 1));
+        }
+        else
+        {
+            if (!rw_t4t_create_ndef ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+            else
+            {
+                p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_CREATE_NDEF;
+            }
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_CREATE_NDEF:
+        p += (p_r_apdu->len - T4T_RSP_STATUS_WORDS_SIZE);
+        BE_STREAM_TO_UINT16 (status_words, p);
+        if (status_words == 0x91DE) /* DUPLICATE_ERROR, file already exist*/
+        {
+            status_words = 0x9100;
+        }
+
+        if (status_words != 0x9100)
+        {
+            rw_t4t_handle_error (NFC_STATUS_CMD_NOT_CMPLTD, *(p - 2), *(p - 1));
+        }
+        else
+        {
+            if (!rw_t4t_write_cc ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+            else
+            {
+                p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_WRITE_CC;
+            }
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_WRITE_CC:
+        p += (p_r_apdu->len - T4T_RSP_STATUS_WORDS_SIZE);
+        BE_STREAM_TO_UINT16 (status_words, p);
+        if (status_words != 0x9100)
+        {
+            rw_t4t_handle_error (NFC_STATUS_CMD_NOT_CMPLTD, *(p - 2), *(p - 1));
+        }
+        else
+        {
+            if (!rw_t4t_write_ndef ())
+            {
+                rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+            }
+            else
+            {
+                p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_WRITE_NDEF;
+            }
+        }
+        break;
+
+    case RW_T4T_SUBSTATE_WAIT_WRITE_NDEF:
+        p += (p_r_apdu->len - T4T_RSP_STATUS_WORDS_SIZE);
+        BE_STREAM_TO_UINT16 (status_words, p);
+        if (status_words != 0x9100)
+        {
+            rw_t4t_handle_error (NFC_STATUS_CMD_NOT_CMPLTD, *(p - 2), *(p - 1));
+        }
+        else
+        {
+            p_t4t->state = RW_T4T_STATE_IDLE;
+            if (rw_cb.p_cback)
+            {
+                rw_data.ndef.status   = NFC_STATUS_OK;
+                rw_data.ndef.protocol = NFC_PROTOCOL_ISO_DEP;
+                rw_data.ndef.max_size = p_t4t->card_size;
+                rw_data.ndef.cur_size = 0x00;
+
+                (*(rw_cb.p_cback)) (RW_T4T_NDEF_FORMAT_CPLT_EVT, &rw_data);
+
+                RW_TRACE_DEBUG0 ("rw_t4t_ndef_format (): Sent RW_T4T_NDEF_FORMAT_CPLT_EVT");
+            }
+        }
+        break;
+
+    default:
+        RW_TRACE_ERROR1 ("rw_t4t_sm_ndef_format (): unknown sub_state=%d", p_t4t->sub_state);
+        rw_t4t_handle_error (NFC_STATUS_FAILED, 0, 0);
+        break;
+    }
+}
+
+/*******************************************************************************
+**
 ** Function         rw_t4t_sm_detect_ndef
 **
 ** Description      State machine for NDEF detection procedure
@@ -1168,14 +1934,26 @@
         return;
 
     case NFC_ERROR_CEVT:
-        rw_data.status = (tNFC_STATUS) (*(UINT8*) p_data);
-
-        if (p_t4t->state != RW_T4T_STATE_IDLE)
+        if (p_t4t->state == RW_T4T_STATE_PRESENCE_CHECK)
+        {
+            p_t4t->state   = RW_T4T_STATE_IDLE;
+            rw_data.status = NFC_STATUS_FAILED;
+            (*(rw_cb.p_cback)) (RW_T4T_PRESENCE_CHECK_EVT, &rw_data);
+        }
+        else if (p_t4t->state == RW_T4T_STATE_NDEF_FORMAT)
+        {
+            p_t4t->state   = RW_T4T_STATE_IDLE;
+            rw_data.status = NFC_STATUS_FAILED;
+            (*(rw_cb.p_cback)) (RW_T4T_NDEF_FORMAT_CPLT_EVT, &rw_data);
+        }
+        else if (p_t4t->state != RW_T4T_STATE_IDLE)
         {
             rw_t4t_handle_error (rw_data.status, 0, 0);
         }
         else
         {
+            p_t4t->state   = RW_T4T_STATE_IDLE;
+            rw_data.status = (tNFC_STATUS) (*(UINT8*) p_data);
             (*(rw_cb.p_cback)) (RW_T4T_INTF_ERROR_EVT, &rw_data);
         }
         return;
@@ -1245,6 +2023,10 @@
         rw_t4t_sm_set_readonly (p_r_apdu);
         GKI_freebuf (p_r_apdu);
         break;
+    case RW_T4T_STATE_NDEF_FORMAT:
+        rw_t4t_sm_ndef_format (p_r_apdu);
+        GKI_freebuf (p_r_apdu);
+        break;
     default:
         RW_TRACE_ERROR1 ("rw_t4t_data_cback (): invalid state=%d", p_t4t->state);
         GKI_freebuf (p_r_apdu);
@@ -1261,6 +2043,38 @@
 #endif
 }
 
+/*******************************************************************************
+**
+** Function         RW_T4tFormatNDef
+**
+** Description      format T4T tag
+**
+** Returns          NFC_STATUS_OK if success
+**
+*******************************************************************************/
+tNFC_STATUS RW_T4tFormatNDef (void)
+{
+    RW_TRACE_API0 ("RW_T4tFormatNDef ()");
+
+    if (rw_cb.tcb.t4t.state != RW_T4T_STATE_IDLE)
+    {
+        RW_TRACE_ERROR1 ("RW_T4tFormatNDef ():Unable to start command at state (0x%X)",
+                          rw_cb.tcb.t4t.state);
+        return NFC_STATUS_FAILED;
+    }
+
+    rw_cb.tcb.t4t.card_type = 0x00;
+
+    if (!rw_t4t_get_hw_version ())
+    {
+        return NFC_STATUS_FAILED;
+    }
+
+    rw_cb.tcb.t4t.state = RW_T4T_STATE_NDEF_FORMAT;
+    rw_cb.tcb.t4t.sub_state = RW_T4T_SUBSTATE_WAIT_GET_HW_VERSION;
+
+    return NFC_STATUS_OK;
+}
 
 /*******************************************************************************
 **
@@ -1663,6 +2477,22 @@
         return ("WAIT_UPDATE_RESP");
     case RW_T4T_SUBSTATE_WAIT_UPDATE_NLEN:
         return ("WAIT_UPDATE_NLEN");
+    case RW_T4T_SUBSTATE_WAIT_GET_HW_VERSION:
+        return ("WAIT_GET_HW_VERSION");
+    case RW_T4T_SUBSTATE_WAIT_GET_SW_VERSION :
+        return ("WAIT_GET_SW_VERSION");
+    case RW_T4T_SUBSTATE_WAIT_GET_UID:
+        return ("WAIT_GET_UID");
+    case RW_T4T_SUBSTATE_WAIT_CREATE_APP:
+        return ("WAIT_CREATE_APP");
+    case RW_T4T_SUBSTATE_WAIT_CREATE_CC:
+        return ("WAIT_CREATE_CC");
+    case RW_T4T_SUBSTATE_WAIT_CREATE_NDEF:
+        return ("WAIT_CREATE_NDEF");
+    case RW_T4T_SUBSTATE_WAIT_WRITE_CC :
+        return ("WAIT_WRITE_CC");
+    case RW_T4T_SUBSTATE_WAIT_WRITE_NDEF:
+        return ("WAIT_WRITE_NDEF");
     default:
         return ("???? UNKNOWN SUBSTATE");
     }
diff --git a/src/nfca_version.c b/src/nfca_version.c
index d415d6f..047cdf4 100644
--- a/src/nfca_version.c
+++ b/src/nfca_version.c
@@ -17,7 +17,7 @@
  ******************************************************************************/
 #include "bt_types.h"
 
-const UINT8 nfca_version_string[] = "NFCDROID-AOSP_L_00.01";
+const UINT8 nfca_version_string[] = "NFCDROID-AOSP_M_00.01";
 
 /*
 // The following string should be manually updated to contain the