DO NOT MERGE: Merge Oreo MR1 into master

Exempt-From-Owner-Approval: Changes already landed internally
Change-Id: I015a74d0bd64844bbecdd7849d168a69da3eacb2

33 files changed, 911 insertions, 479 deletions

diff --git a/Android.mk b/Android.mk
index a5dc6e0..5a5a078 100644
--- a/Android.mk
+++ b/Android.mk
@@ -14,9 +14,6 @@
 
 LOCAL_PATH := $(call my-dir)
 wificond_cpp_flags := -Wall -Werror -Wno-unused-parameter
-ifdef WIFI_OFFLOAD_SCANS
-wificond_cpp_flags += -DWIFI_OFFLOAD_SCANS=\"$(WIFI_OFFLOAD_SCANS)\"
-endif
 wificond_parent_dir := $(LOCAL_PATH)/../
 wificond_includes := \
     $(wificond_parent_dir)
@@ -62,10 +59,9 @@ LOCAL_SRC_FILES := \
     client_interface_impl.cpp \
     logging_utils.cpp \
     looper_backed_event_loop.cpp \
-    rtt/rtt_controller_binder.cpp \
-    rtt/rtt_controller_impl.cpp \
     scanning/channel_settings.cpp \
     scanning/hidden_network.cpp \
+    scanning/offload_scan_callback_interface_impl.cpp \
     scanning/pno_network.cpp \
     scanning/pno_settings.cpp \
     scanning/scan_result.cpp \
@@ -124,8 +120,6 @@ LOCAL_SRC_FILES := \
     aidl/android/net/wifi/IClientInterface.aidl \
     aidl/android/net/wifi/IInterfaceEventCallback.aidl \
     aidl/android/net/wifi/IPnoScanEvent.aidl \
-    aidl/android/net/wifi/IRttClient.aidl \
-    aidl/android/net/wifi/IRttController.aidl \
     aidl/android/net/wifi/IScanEvent.aidl \
     aidl/android/net/wifi/IWificond.aidl \
     aidl/android/net/wifi/IWifiScannerImpl.aidl \
@@ -175,6 +169,9 @@ LOCAL_SRC_FILES := \
     tests/mock_netlink_utils.cpp \
     tests/mock_offload.cpp \
     tests/mock_offload_callback_handlers.cpp \
+    tests/mock_offload_scan_callback_interface.cpp \
+    tests/mock_offload_scan_callback_interface_impl.cpp \
+    tests/mock_offload_scan_manager.cpp \
     tests/mock_offload_service_utils.cpp \
     tests/mock_scan_utils.cpp \
     tests/netlink_manager_unittest.cpp \
@@ -203,6 +200,7 @@ LOCAL_SHARED_LIBRARIES := \
     android.hardware.wifi.offload@1.0 \
     libbase \
     libbinder \
+    libcutils \
     libhidltransport \
     libhidlbase \
     libhwbinder \
diff --git a/aidl/android/net/wifi/IPnoScanEvent.aidl b/aidl/android/net/wifi/IPnoScanEvent.aidl
index 6488c19..50c1918 100644
--- a/aidl/android/net/wifi/IPnoScanEvent.aidl
+++ b/aidl/android/net/wifi/IPnoScanEvent.aidl
@@ -18,6 +18,15 @@ package android.net.wifi;
 
 // A callback for receiving pno scanning events.
 interface IPnoScanEvent {
+  const int PNO_SCAN_OVER_OFFLOAD_BINDER_FAILURE = 0;
+  const int PNO_SCAN_OVER_OFFLOAD_REMOTE_FAILURE = 1;
+
   oneway void OnPnoNetworkFound();
   oneway void OnPnoScanFailed();
+  // Callback notifying the framework that PNO scan is started over Offload HAL
+  // interface, this is meant for metrics collection only
+  oneway void OnPnoScanOverOffloadStarted();
+  // Callback notifying the framework that a PNO scan running over Offload HAL
+  // has failed, this is meant for metrics collection only
+  oneway void OnPnoScanOverOffloadFailed(int reason);
 }
diff --git a/aidl/android/net/wifi/IWifiScannerImpl.aidl b/aidl/android/net/wifi/IWifiScannerImpl.aidl
index da0ca2d..e83b79c 100644
--- a/aidl/android/net/wifi/IWifiScannerImpl.aidl
+++ b/aidl/android/net/wifi/IWifiScannerImpl.aidl
@@ -35,9 +35,13 @@ interface IWifiScannerImpl {
   // Returrns null on failure.
   @nullable int[] getAvailableDFSChannels();
 
-  // Get the latest scan results from kernel.
+  // Get the latest single scan results from kernel.
   NativeScanResult[] getScanResults();
 
+  // Get the latest pno scan results from the interface which has most recently
+  // completed disconnected mode PNO scans
+  NativeScanResult[] getPnoScanResults();
+
   // Request a single scan using a SingleScanSettings parcelable object.
   boolean scan(in SingleScanSettings scanSettings);
 
diff --git a/aidl/android/net/wifi/IWificond.aidl b/aidl/android/net/wifi/IWificond.aidl
index 48e2924..0b303ad 100644
--- a/aidl/android/net/wifi/IWificond.aidl
+++ b/aidl/android/net/wifi/IWificond.aidl
@@ -19,8 +19,6 @@ package android.net.wifi;
 import android.net.wifi.IApInterface;
 import android.net.wifi.IClientInterface;
 import android.net.wifi.IInterfaceEventCallback;
-import android.net.wifi.IRttClient;
-import android.net.wifi.IRttController;
 
 // Service interface that exposes primitives for controlling the WiFi
 // subsystems of a device.
@@ -57,14 +55,4 @@ interface IWificond {
     //
     // @param callback object to remove from the set of registered callbacks.
     oneway void UnregisterCallback(IInterfaceEventCallback callback);
-
-    // Obtain a reference to a IRttController that can be used to
-    // request ranging information.
-    // Results will be returned via the registered IRttClient.
-    IRttController registerRttClient(IRttClient rttClient);
-
-    // Remove an IRttClient from the set of registered IRttClient callbacks.
-    // @param rttClient object to remove from the set of registered
-    // IRttClient callbacks.
-    void unregisterRttClient(IRttClient rttClient);
 }
diff --git a/client_interface_impl.cpp b/client_interface_impl.cpp
index 974ff17..c0e3507 100644
--- a/client_interface_impl.cpp
+++ b/client_interface_impl.cpp
@@ -188,7 +188,7 @@ bool ClientInterfaceImpl::DisableSupplicant() {
 bool ClientInterfaceImpl::GetPacketCounters(vector<int32_t>* out_packet_counters) {
   StationInfo station_info;
   if (!netlink_utils_->GetStationInfo(interface_index_,
-                                      interface_mac_addr_,
+                                      bssid_,
                                       &station_info)) {
     return false;
   }
@@ -199,6 +199,11 @@ bool ClientInterfaceImpl::GetPacketCounters(vector<int32_t>* out_packet_counters
 }
 
 bool ClientInterfaceImpl::SignalPoll(vector<int32_t>* out_signal_poll_results) {
+  if (!IsAssociated()) {
+    LOG(INFO) << "Fail RSSI polling because wifi is not associated.";
+    return false;
+  }
+
   StationInfo station_info;
   if (!netlink_utils_->GetStationInfo(interface_index_,
                                       bssid_,
diff --git a/main.cpp b/main.cpp
index d2a9ba4..50e8d67 100644
--- a/main.cpp
+++ b/main.cpp
@@ -139,7 +139,9 @@ int main(int argc, char** argv) {
       &OnHwBinderReadReady)) << "Failed to watch Hw Binder FD";
 
   android::wificond::NetlinkManager netlink_manager(event_dispatcher.get());
-  CHECK(netlink_manager.Start()) << "Failed to start netlink manager";
+  if (!netlink_manager.Start()) {
+    LOG(ERROR) << "Failed to start netlink manager";
+  }
   android::wificond::NetlinkUtils netlink_utils(&netlink_manager);
   android::wificond::ScanUtils scan_utils(&netlink_manager);
 
diff --git a/rtt/rtt_controller_impl.cpp b/rtt/rtt_controller_impl.cpp
deleted file mode 100644
index 197faca..0000000
--- a/rtt/rtt_controller_impl.cpp
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "wificond/rtt/rtt_controller_impl.h"
-
-#include <android-base/logging.h>
-
-#include "wificond/rtt/rtt_controller_binder.h"
-
-using android::net::wifi::IRttClient;
-using android::net::wifi::IRttController;
-using android::sp;
-
-namespace android {
-namespace wificond {
-
-RttControllerImpl::RttControllerImpl()
-    : binder_(new RttControllerBinder(this)) {
-  // TODO(nywang): create a HAL RttController object.
-}
-
-RttControllerImpl::~RttControllerImpl() {
-  binder_->NotifyImplDead();
-}
-
-sp<IRttController> RttControllerImpl::GetBinder() const {
-  return binder_;
-}
-
-bool RttControllerImpl::RegisterRttClient(android::sp<IRttClient> client) {
-  for (auto& it : clients_) {
-    if (IRttClient::asBinder(client) == IRttClient::asBinder(it)) {
-      LOG(WARNING) << "Ignore duplicate RttClient registration";
-      return false;
-    }
-  }
-  clients_.push_back(client);
-  return true;
-
-}
-
-bool RttControllerImpl::UnregisterRttClient(android::sp<IRttClient> client) {
-  for (auto it = clients_.begin(); it != clients_.end(); it++) {
-    if (IRttClient::asBinder(client) == IRttClient::asBinder(*it)) {
-      clients_.erase(it);
-      return true;
-    }
-  }
-  LOG(WARNING) << "Failed to find registered RttClient to unregister";
-  return false;
-}
-
-size_t RttControllerImpl::GetClientCount() const {
-  return clients_.size();
-}
-
-}  // namespace wificond
-}  // namespace android
diff --git a/rtt/rtt_controller_impl.h b/rtt/rtt_controller_impl.h
deleted file mode 100644
index da650ef..0000000
--- a/rtt/rtt_controller_impl.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef WIFICOND_RTT_CONTROLLER_IMPL_H_
-#define WIFICOND_RTT_CONTROLLER_IMPL_H_
-
-#include <vector>
-
-#include <android-base/macros.h>
-
-#include "android/net/wifi/IRttController.h"
-#include "android/net/wifi/IRttClient.h"
-
-namespace android {
-namespace wificond {
-
-class RttControllerBinder;
-
-class RttControllerImpl {
- public:
-  RttControllerImpl();
-  ~RttControllerImpl();
-
-  bool RegisterRttClient(android::sp<android::net::wifi::IRttClient> client);
-  bool UnregisterRttClient(android::sp<android::net::wifi::IRttClient> client);
-  size_t GetClientCount() const;
-
-  // Get a pointer to the binder representing this RttControllerImpl.
-  android::sp<android::net::wifi::IRttController> GetBinder() const;
-
- private:
-  const android::sp<RttControllerBinder> binder_;
-  std::vector<android::sp<android::net::wifi::IRttClient>> clients_;
-
-  DISALLOW_COPY_AND_ASSIGN(RttControllerImpl);
-};
-
-}  // namespace wificond
-}  // namespace android
-
-#endif  // WIFICOND_RTT_CONTROLLER_IMPL_H_
diff --git a/scanning/offload/offload_scan_manager.cpp b/scanning/offload/offload_scan_manager.cpp
index 5e3d90d..9bcbb0f 100644
--- a/scanning/offload/offload_scan_manager.cpp
+++ b/scanning/offload/offload_scan_manager.cpp
@@ -35,11 +35,11 @@ using android::hardware::wifi::offload::V1_0::OffloadStatus;
 using android::hardware::wifi::offload::V1_0::OffloadStatusCode;
 
 using android::wificond::OffloadCallback;
-using android::wificond::OnNativeScanResultsReadyHandler;
 using ::com::android::server::wifi::wificond::NativeScanResult;
 using ::com::android::server::wifi::wificond::NativeScanStats;
 using std::vector;
 using std::weak_ptr;
+using std::shared_ptr;
 
 using namespace std::placeholders;
 
@@ -69,55 +69,77 @@ void OffloadCallbackHandlersImpl::OnErrorHandler(const OffloadStatus& status) {
   }
 }
 
-OffloadScanManager::OffloadScanManager(weak_ptr<OffloadServiceUtils> utils,
-                                       OnNativeScanResultsReadyHandler handler)
+OffloadScanManager::OffloadScanManager(
+    weak_ptr<OffloadServiceUtils> utils,
+    shared_ptr<OffloadScanCallbackInterface> callback)
     : wifi_offload_hal_(nullptr),
       wifi_offload_callback_(nullptr),
+      death_recipient_(nullptr),
       offload_status_(OffloadScanManager::kError),
-      subscription_enabled_(false),
+      service_available_(false),
+      offload_service_utils_(utils),
       offload_callback_handlers_(new OffloadCallbackHandlersImpl(this)),
-      scan_result_handler_(handler) {
-  auto offload_scan_utils = utils.lock();
-  if (scan_result_handler_ == nullptr) {
-    LOG(ERROR) << "Invalid Offload scan result handler";
-    return;
+      event_callback_(callback) {
+  if (InitService()) {
+    offload_status_ = OffloadScanManager::kNoError;
   }
-  wifi_offload_hal_ = offload_scan_utils->GetOffloadService();
+}
+
+bool OffloadScanManager::InitService() {
+  wifi_offload_hal_ = offload_service_utils_.lock()->GetOffloadService();
   if (wifi_offload_hal_ == nullptr) {
     LOG(ERROR) << "No Offload Service available";
-    return;
+    return false;
   }
 
-  death_recipient_ = offload_scan_utils->GetOffloadDeathRecipient(
+  death_recipient_ = offload_service_utils_.lock()->GetOffloadDeathRecipient(
       std::bind(&OffloadScanManager::OnObjectDeath, this, _1));
   uint64_t cookie = reinterpret_cast<uint64_t>(wifi_offload_hal_.get());
+
   auto link_to_death_status =
       wifi_offload_hal_->linkToDeath(death_recipient_, cookie);
   if (!link_to_death_status.isOk()) {
     LOG(ERROR) << "Unable to register death handler "
                << link_to_death_status.description();
-    return;
+    return false;
   }
 
-  wifi_offload_callback_ =
-      offload_scan_utils->GetOffloadCallback(offload_callback_handlers_.get());
+  wifi_offload_callback_ = offload_service_utils_.lock()->GetOffloadCallback(
+      offload_callback_handlers_.get());
   if (wifi_offload_callback_ == nullptr) {
     LOG(ERROR) << "Invalid Offload callback object";
-    return;
+    return false;
   }
-  wifi_offload_hal_->setEventCallback(wifi_offload_callback_);
-  offload_status_ = OffloadScanManager::kNoError;
+
+  auto set_callback_status =
+      wifi_offload_hal_->setEventCallback(wifi_offload_callback_);
+  if (!set_callback_status.isOk()) {
+    LOG(ERROR) << "Unable to set event callback for Offload HAL";
+    return false;
+  }
+
+  service_available_ = true;
+  return true;
+}
+
+bool OffloadScanManager::InitServiceIfNeeded() {
+  if (!service_available_) {
+    return InitService();
+  }
+  return true;
 }
 
 bool OffloadScanManager::stopScan(OffloadScanManager::ReasonCode* reason_code) {
-  if (!subscription_enabled_) {
-    LOG(VERBOSE) << "Scans are not subscribed over Offload HAL";
-    *reason_code = OffloadScanManager::kNotSubscribed;
+  if (!InitServiceIfNeeded() ||
+      (getOffloadStatus() != OffloadScanManager::kNoError)) {
+    *reason_code = OffloadScanManager::kNotAvailable;
     return false;
   }
-  if (wifi_offload_hal_ != nullptr) {
-    wifi_offload_hal_->unsubscribeScanResults();
-    subscription_enabled_ = false;
+  const auto& res = wifi_offload_hal_->unsubscribeScanResults();
+  if (!res.isOk()) {
+    *reason_code = OffloadScanManager::kTransactionFailed;
+    LOG(WARNING) << "unsubscribeScanResults() failed " << res.description();
+    return false;
   }
   *reason_code = OffloadScanManager::kNone;
   return true;
@@ -163,7 +185,8 @@ bool OffloadScanManager::startScan(
     const vector<vector<uint8_t>>& match_ssids,
     const vector<uint8_t>& match_security, const vector<uint32_t>& freqs,
     OffloadScanManager::ReasonCode* reason_code) {
-  if (getOffloadStatus() != OffloadScanManager::kNoError) {
+  if (!InitServiceIfNeeded() ||
+      getOffloadStatus() != OffloadScanManager::kNoError) {
     *reason_code = OffloadScanManager::kNotAvailable;
     LOG(WARNING) << "Offload HAL scans are not available";
     return false;
@@ -177,11 +200,10 @@ bool OffloadScanManager::startScan(
     return false;
   }
 
-  if (!subscription_enabled_ && !SubscribeScanResults(reason_code)) {
+  if (!SubscribeScanResults(reason_code)) {
     return false;
   }
 
-  subscription_enabled_ = true;
   *reason_code = OffloadScanManager::kNone;
   return true;
 }
@@ -208,13 +230,25 @@ bool OffloadScanManager::SubscribeScanResults(
 }
 
 OffloadScanManager::StatusCode OffloadScanManager::getOffloadStatus() const {
-  if (wifi_offload_hal_ == nullptr) {
+  if (!service_available_) {
     return OffloadScanManager::kNoService;
   }
   return offload_status_;
 }
 
+bool OffloadScanManager::getScanResults(
+    std::vector<NativeScanResult>* out_scan_results) {
+  for (const auto& scan_result : cached_scan_results_) {
+    out_scan_results->push_back(scan_result);
+  }
+  return true;
+}
+
 bool OffloadScanManager::getScanStats(NativeScanStats* native_scan_stats) {
+  if (!InitServiceIfNeeded()) {
+    LOG(ERROR) << "Offload HAL service unavailable";
+    return false;
+  }
   if (getOffloadStatus() != OffloadScanManager::kNoError) {
     LOG(WARNING) << "Unable to get scan stats due to Wifi Offload HAL error";
     return false;
@@ -230,11 +264,17 @@ OffloadScanManager::~OffloadScanManager() {
 
 void OffloadScanManager::ReportScanResults(
     const vector<ScanResult>& scanResult) {
-  if (scan_result_handler_ != nullptr) {
-    scan_result_handler_(
-        OffloadScanUtils::convertToNativeScanResults(scanResult));
+  cached_scan_results_.clear();
+  if (!OffloadScanUtils::convertToNativeScanResults(scanResult,
+                                                    &cached_scan_results_)) {
+    LOG(WARNING) << "Unable to convert scan results to native format";
+    return;
+  }
+  if (event_callback_ != nullptr) {
+    event_callback_->OnOffloadScanResult();
   } else {
-    LOG(ERROR) << "No scan result handler for Offload ScanManager";
+    LOG(WARNING)
+        << "No callback to report Offload HAL's scan results to wificond";
   }
 }
 
@@ -260,14 +300,29 @@ void OffloadScanManager::ReportError(const OffloadStatus& status) {
   }
   if (status_result != OffloadScanManager::kNoError) {
     LOG(WARNING) << "Offload Error reported " << status.description;
+    if (event_callback_ != nullptr) {
+      event_callback_->OnOffloadError(
+          OffloadScanCallbackInterface::REMOTE_FAILURE);
+    } else {
+      LOG(WARNING) << "No callback to report Offload HAL Errors to wificond";
+    }
   }
   offload_status_ = status_result;
 }
 
 void OffloadScanManager::OnObjectDeath(uint64_t cookie) {
   if (wifi_offload_hal_ == reinterpret_cast<IOffload*>(cookie)) {
-    wifi_offload_hal_.clear();
     LOG(ERROR) << "Death Notification for Wifi Offload HAL";
+    wifi_offload_hal_.clear();
+    if (event_callback_ != nullptr) {
+      event_callback_->OnOffloadError(
+          OffloadScanCallbackInterface::BINDER_DEATH);
+    } else {
+      LOG(WARNING)
+          << "No callback to report Offload HAL Binder death to wificond";
+    }
+    service_available_ = false;
+    death_recipient_.clear();
   }
 }
 
diff --git a/scanning/offload/offload_scan_manager.h b/scanning/offload/offload_scan_manager.h
index e2c2b0c..2c4fa96 100644
--- a/scanning/offload/offload_scan_manager.h
+++ b/scanning/offload/offload_scan_manager.h
@@ -19,7 +19,7 @@
 #include <android/hardware/wifi/offload/1.0/IOffload.h>
 #include "wificond/scanning/offload/offload_callback.h"
 #include "wificond/scanning/offload/offload_callback_handlers.h"
-#include "wificond/scanning/offload/offload_service_utils.h"
+#include "wificond/scanning/offload_scan_callback_interface_impl.h"
 
 #include <vector>
 
@@ -42,11 +42,8 @@ namespace android {
 namespace wificond {
 
 class OffloadScanManager;
-
-typedef std::function<void(
-    const std::vector<::com::android::server::wifi::wificond::NativeScanResult>
-        scanResult)>
-    OnNativeScanResultsReadyHandler;
+class OffloadDeathRecipient;
+class OffloadServiceUtils;
 
 // Provides callback interface implementation from Offload HAL
 class OffloadCallbackHandlersImpl : public OffloadCallbackHandlers {
@@ -86,38 +83,40 @@ class OffloadScanManager {
     kNone,
     /* Offload HAL scans is not available */
     kNotAvailable,
-    /* Offload HAL service is not subscribed to */
-    kNotSubscribed,
     /* Offload HAL requested operation failure */
     kOperationFailed,
     /* Binder failed to deliver message to Offload HAL*/
     kTransactionFailed,
   };
 
-  explicit OffloadScanManager(std::weak_ptr<OffloadServiceUtils> utils,
-                              OnNativeScanResultsReadyHandler handler);
+  explicit OffloadScanManager(
+      std::weak_ptr<OffloadServiceUtils> utils,
+      std::shared_ptr<OffloadScanCallbackInterface> callback);
   virtual ~OffloadScanManager();
   /* Request start of offload scans with scan parameters and scan filter
    * settings. Internally calls Offload HAL service with configureScans()
-   * and subscribeScanResults() APIs. If already subscribed, it updates
-   * the scan configuration only. Reason code is updated in failure case
+   * and subscribeScanResults() APIs. Reason code indicates failure reason.
    */
-  bool startScan(uint32_t /* interval_ms */, int32_t /* rssi_threshold */,
-                 const std::vector<std::vector<uint8_t>>& /* scan_ssids */,
-                 const std::vector<std::vector<uint8_t>>& /* match_ssids */,
-                 const std::vector<uint8_t>& /* match_security */,
-                 const std::vector<uint32_t>& /* freqs */,
-                 ReasonCode* /* failure reason */);
-  /* Request stop of offload scans, returns true if scans were subscribed
-   * to from the Offload HAL service. Otherwise, returns false. Reason code
-   * is updated in case of failure.
+  virtual bool startScan(
+      uint32_t /* interval_ms */, int32_t /* rssi_threshold */,
+      const std::vector<std::vector<uint8_t>>& /* scan_ssids */,
+      const std::vector<std::vector<uint8_t>>& /* match_ssids */,
+      const std::vector<uint8_t>& /* match_security */,
+      const std::vector<uint32_t>& /* freqs */,
+      ReasonCode* /* failure reason */);
+  /* Request stop of offload scans, returns true if the operation succeeds
+   * Otherwise, returns false. Reason code is updated in case of failure.
    */
-  bool stopScan(ReasonCode* /* failure reason */);
+  virtual bool stopScan(ReasonCode* /* failure reason */);
   /* Get statistics for scans performed by Offload HAL */
-  bool getScanStats(
+  virtual bool getScanStats(
       ::com::android::server::wifi::wificond::NativeScanStats* /* scanStats */);
   /* Otain status of the Offload HAL service */
-  StatusCode getOffloadStatus() const;
+  virtual StatusCode getOffloadStatus() const;
+  /* Returns the most recent scan result available from Offload HAL */
+  virtual bool getScanResults(
+      std::vector<::com::android::server::wifi::wificond::NativeScanResult>*
+          out_scan_results);
 
  private:
   void ReportScanResults(
@@ -131,10 +130,15 @@ class OffloadScanManager {
       OffloadScanManager::ReasonCode* reason_code);
   bool GetScanStats(
       ::com::android::server::wifi::wificond::NativeScanStats* stats);
-  bool SubscribeScanResults(OffloadScanManager::ReasonCode* reason_code);
-  bool ConfigureScans(android::hardware::wifi::offload::V1_0::ScanParam,
-                      android::hardware::wifi::offload::V1_0::ScanFilter,
-                      OffloadScanManager::ReasonCode* reason_code);
+  bool SubscribeScanResults(
+      OffloadScanManager::ReasonCode* reason_code);
+  bool ConfigureScans(
+      android::hardware::wifi::offload::V1_0::ScanParam,
+      android::hardware::wifi::offload::V1_0::ScanFilter,
+      OffloadScanManager::ReasonCode* reason_code);
+  bool InitServiceIfNeeded();
+  bool InitService();
+
   /* Handle binder death */
   void OnObjectDeath(uint64_t /* cookie */);
 
@@ -143,10 +147,13 @@ class OffloadScanManager {
   android::sp<OffloadCallback> wifi_offload_callback_;
   android::sp<OffloadDeathRecipient> death_recipient_;
   StatusCode offload_status_;
-  bool subscription_enabled_;
+  std::vector<::com::android::server::wifi::wificond::NativeScanResult>
+      cached_scan_results_;
+  bool service_available_;
 
-  const std::unique_ptr<OffloadCallbackHandlersImpl> offload_callback_handlers_;
-  OnNativeScanResultsReadyHandler scan_result_handler_;
+  const std::weak_ptr<OffloadServiceUtils> offload_service_utils_;
+  const std::shared_ptr<OffloadCallbackHandlersImpl> offload_callback_handlers_;
+  std::shared_ptr<OffloadScanCallbackInterface> event_callback_;
 
   friend class OffloadCallbackHandlersImpl;
 };
diff --git a/scanning/offload/offload_scan_utils.cpp b/scanning/offload/offload_scan_utils.cpp
index 9127632..1446f76 100644
--- a/scanning/offload/offload_scan_utils.cpp
+++ b/scanning/offload/offload_scan_utils.cpp
@@ -16,6 +16,7 @@
 #include "wificond/scanning/offload/offload_scan_utils.h"
 
 #include <android-base/logging.h>
+#include <utils/Timers.h>
 
 #include "wificond/scanning/offload/scan_stats.h"
 #include "wificond/scanning/scan_result.h"
@@ -33,23 +34,25 @@ using std::vector;
 namespace android {
 namespace wificond {
 
-vector<NativeScanResult> OffloadScanUtils::convertToNativeScanResults(
-    const vector<ScanResult>& scan_result) {
-  vector<NativeScanResult> native_scan_result;
-  native_scan_result.reserve(scan_result.size());
+bool OffloadScanUtils::convertToNativeScanResults(
+    const vector<ScanResult>& scan_result,
+    vector<NativeScanResult>* native_scan_result) {
+  if (native_scan_result == nullptr) return false;
   for (size_t i = 0; i < scan_result.size(); i++) {
     NativeScanResult single_scan_result;
-    single_scan_result.ssid = scan_result[i].networkInfo.ssid;
-    single_scan_result.bssid.assign(scan_result[i].networkInfo.ssid.begin(),
-                                    scan_result[i].networkInfo.ssid.end());
+    single_scan_result.ssid.assign(scan_result[i].networkInfo.ssid.begin(),
+                                   scan_result[i].networkInfo.ssid.end());
+    for (size_t j = 0; j < scan_result[i].bssid.elementCount(); j++) {
+      single_scan_result.bssid.push_back(scan_result[i].bssid[j]);
+    }
     single_scan_result.frequency = scan_result[i].frequency;
     single_scan_result.signal_mbm = scan_result[i].rssi;
-    single_scan_result.tsf = scan_result[i].tsf;
+    single_scan_result.tsf = systemTime(SYSTEM_TIME_MONOTONIC) / 1000;
     single_scan_result.capability = scan_result[i].capability;
     single_scan_result.associated = false;
-    native_scan_result.emplace_back(single_scan_result);
+    native_scan_result->push_back(std::move(single_scan_result));
   }
-  return native_scan_result;
+  return true;
 }
 
 ScanParam OffloadScanUtils::createScanParam(
diff --git a/scanning/offload/offload_scan_utils.h b/scanning/offload/offload_scan_utils.h
index ce4afa7..22ba8ea 100644
--- a/scanning/offload/offload_scan_utils.h
+++ b/scanning/offload/offload_scan_utils.h
@@ -42,9 +42,9 @@ namespace wificond {
 // Provides utility methods for Offload Scan Manager
 class OffloadScanUtils {
  public:
-  static std::vector<::com::android::server::wifi::wificond::NativeScanResult>
-      convertToNativeScanResults(
-          const std::vector<android::hardware::wifi::offload::V1_0::ScanResult>&);
+  static bool convertToNativeScanResults(
+      const std::vector<android::hardware::wifi::offload::V1_0::ScanResult>&,
+      std::vector<::com::android::server::wifi::wificond::NativeScanResult>*);
   static android::hardware::wifi::offload::V1_0::ScanParam createScanParam(
       const std::vector<std::vector<uint8_t>>& ssid_list,
       const std::vector<uint32_t>& frequency_list, uint32_t scan_interval_ms);
diff --git a/scanning/offload/offload_service_utils.cpp b/scanning/offload/offload_service_utils.cpp
index 2a14a32..d91f069 100644
--- a/scanning/offload/offload_service_utils.cpp
+++ b/scanning/offload/offload_service_utils.cpp
@@ -14,7 +14,12 @@
  * limitations under the License.
  */
 #include "wificond/scanning/offload/offload_service_utils.h"
+
+#include <android-base/logging.h>
+#include <cutils/properties.h>
+
 #include "wificond/scanning/offload/offload_scan_manager.h"
+#include "wificond/scanning/scanner_impl.h"
 
 using ::android::hardware::wifi::offload::V1_0::IOffload;
 
@@ -22,7 +27,7 @@ namespace android {
 namespace wificond {
 
 android::sp<IOffload> OffloadServiceUtils::GetOffloadService() {
-  return IOffload::getService();
+  return IOffload::tryGetService();
 }
 
 android::sp<OffloadCallback> OffloadServiceUtils::GetOffloadCallback(
@@ -36,12 +41,23 @@ OffloadDeathRecipient* OffloadServiceUtils::GetOffloadDeathRecipient(
 }
 
 bool OffloadServiceUtils::IsOffloadScanSupported() const {
-  bool result = false;
-#ifdef WIFI_OFFLOAD_SCANS
-  LOG(VERBOSE) << "Offload HAL supported";
-  result = true;
-#endif
-  return result;
+  if (property_get_bool("persist.wifi.offload.enable", false)) {
+    LOG(INFO) << "Offload HAL supported";
+    return true;
+  }
+  LOG(INFO) << "Offload HAL not supported ";
+  return false;
+}
+
+std::shared_ptr<OffloadScanCallbackInterfaceImpl>
+OffloadServiceUtils::GetOffloadScanCallbackInterface(ScannerImpl* parent) {
+  return std::make_shared<OffloadScanCallbackInterfaceImpl>(parent);
+}
+
+std::shared_ptr<OffloadScanManager> OffloadServiceUtils::GetOffloadScanManager(
+    std::weak_ptr<OffloadServiceUtils> service_utils,
+    std::shared_ptr<OffloadScanCallbackInterfaceImpl> callback_interface) {
+  return std::make_shared<OffloadScanManager>(service_utils, callback_interface);
 }
 
 OffloadDeathRecipient::OffloadDeathRecipient(
diff --git a/scanning/offload/offload_service_utils.h b/scanning/offload/offload_service_utils.h
index cff5575..42268de 100644
--- a/scanning/offload/offload_service_utils.h
+++ b/scanning/offload/offload_service_utils.h
@@ -19,11 +19,15 @@
 #include <android/hardware/wifi/offload/1.0/IOffload.h>
 #include "wificond/scanning/offload/offload_callback.h"
 #include "wificond/scanning/offload/offload_callback_handlers.h"
+#include "wificond/scanning/offload_scan_callback_interface_impl.h"
 
 namespace android {
 namespace wificond {
 
 typedef std::function<void(uint64_t)> OffloadDeathRecipientHandler;
+class ScannerImpl;
+class OffloadServiceUtils;
+class OffloadScanManager;
 
 class OffloadDeathRecipient : public android::hardware::hidl_death_recipient {
  public:
@@ -52,6 +56,11 @@ class OffloadServiceUtils {
       OffloadCallbackHandlers* handlers);
   virtual OffloadDeathRecipient* GetOffloadDeathRecipient(
       OffloadDeathRecipientHandler handler);
+  virtual std::shared_ptr<OffloadScanCallbackInterfaceImpl>
+  GetOffloadScanCallbackInterface(ScannerImpl* parent);
+  virtual std::shared_ptr<OffloadScanManager> GetOffloadScanManager(
+      std::weak_ptr<OffloadServiceUtils> service_utils,
+      std::shared_ptr<OffloadScanCallbackInterfaceImpl> callback_interface);
 };
 
 }  // namespace wificond
diff --git a/scanning/offload/scan_stats.cpp b/scanning/offload/scan_stats.cpp
index 4a963cb..bd5c793 100644
--- a/scanning/offload/scan_stats.cpp
+++ b/scanning/offload/scan_stats.cpp
@@ -46,6 +46,7 @@ NativeScanStats::NativeScanStats()
     : num_scans_requested_by_wifi_(0),
       num_scans_serviced_by_wifi_(0),
       subscription_duration_ms_(0),
+      scan_duration_ms_(0),
       num_channels_scanned_(0),
       time_stamp_(0) {}
 
@@ -87,6 +88,20 @@ status_t NativeScanStats::readFromParcel(const ::android::Parcel* parcel) {
   return ::android::OK;
 }
 
+void NativeScanStats::DebugLog() {
+  LOG(INFO) << "num_scans_requested_by_wifi=" << num_scans_requested_by_wifi_;
+  LOG(INFO) << "num_scans_serviced_by_wifi=" << num_scans_serviced_by_wifi_;
+  LOG(INFO) << "subscription_duration=" << subscription_duration_ms_;
+  LOG(INFO) << "scan_duration_ms_=" << scan_duration_ms_;
+  LOG(INFO) << "num_channels_scanned=" << num_channels_scanned_;
+  for (size_t i = 0; i < histogram_channels_.size(); i++) {
+    if (histogram_channels_[i] > 0) {
+      LOG(INFO) << "Channel=" << i << " ScannedTimes="
+                << static_cast<uint32_t>(histogram_channels_[i]);
+    }
+  }
+}
+
 }  // namespace wificond
 }  // namespace wifi
 }  // namespace server
diff --git a/scanning/offload/scan_stats.h b/scanning/offload/scan_stats.h
index eb1d16a..05220b9 100644
--- a/scanning/offload/scan_stats.h
+++ b/scanning/offload/scan_stats.h
@@ -40,6 +40,7 @@ class NativeScanStats : public ::android::Parcelable {
   bool operator==(const NativeScanStats&) const;
   ::android::status_t writeToParcel(::android::Parcel* parcel) const override;
   ::android::status_t readFromParcel(const ::android::Parcel* parcel) override;
+  void DebugLog();
 
   uint32_t num_scans_requested_by_wifi_;
   uint32_t num_scans_serviced_by_wifi_;
diff --git a/scanning/offload_scan_callback_interface.h b/scanning/offload_scan_callback_interface.h
new file mode 100644
index 0000000..507a69f
--- /dev/null
+++ b/scanning/offload_scan_callback_interface.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef ANDROID_WIFICOND_OFFLOAD_SCAN_CALLBACK_INTERFACE_H
+#define ANDROID_WIFICOND_OFFLOAD_SCAN_CALLBACK_INTERFACE_H
+
+#include <vector>
+
+#include "wificond/scanning/scan_result.h"
+
+namespace android {
+namespace wificond {
+
+class OffloadScanCallbackInterface {
+ public:
+  enum AsyncErrorReason {
+    BINDER_DEATH = 0,
+    REMOTE_FAILURE,
+  };
+
+  virtual ~OffloadScanCallbackInterface() {}
+
+  virtual void OnOffloadScanResult() = 0;
+  virtual void OnOffloadError(AsyncErrorReason) = 0;
+};
+
+}  // namespace wificond
+}  // namespace android
+
+#endif  // ANDROID_WIFICOND_OFFLOAD_SCAN_CALLBACK_INTERFACE_H
diff --git a/scanning/offload_scan_callback_interface_impl.cpp b/scanning/offload_scan_callback_interface_impl.cpp
new file mode 100644
index 0000000..a3e39da
--- /dev/null
+++ b/scanning/offload_scan_callback_interface_impl.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "wificond/scanning/offload_scan_callback_interface_impl.h"
+
+#include <android-base/logging.h>
+
+using com::android::server::wifi::wificond::NativeScanResult;
+
+namespace android {
+namespace wificond {
+
+OffloadScanCallbackInterfaceImpl::OffloadScanCallbackInterfaceImpl(
+    ScannerImpl* parent)
+    : scanner_impl_(parent) {}
+
+OffloadScanCallbackInterfaceImpl::~OffloadScanCallbackInterfaceImpl() {}
+
+void OffloadScanCallbackInterfaceImpl::OnOffloadScanResult() {
+  scanner_impl_->OnOffloadScanResult();
+}
+
+void OffloadScanCallbackInterfaceImpl::OnOffloadError(
+    OffloadScanCallbackInterface::AsyncErrorReason error_code) {
+  scanner_impl_->OnOffloadError(error_code);
+}
+
+}  // namespace wificond
+}  // namespace android
diff --git a/rtt/rtt_controller_binder.h b/scanning/offload_scan_callback_interface_impl.h
index ed8ce81..0f500a4 100644
--- a/rtt/rtt_controller_binder.h
+++ b/scanning/offload_scan_callback_interface_impl.h
@@ -14,36 +14,31 @@
  * limitations under the License.
  */
 
-#ifndef WIFICOND_RTT_CONTROLLER_BINDER_H_
-#define WIFICOND_RTT_CONTROLLER_BINDER_H_
+#ifndef WIFICOND_SCANNER_OFFLOAD_SCAN_CALLBACK_INTERFACE_IML_H_
+#define WIFICOND_SCANNER_OFFLOAD_SCAN_CALLBACK_INTERFACE_IML_H_
 
-#include <android-base/macros.h>
-#include <binder/Status.h>
-
-#include "android/net/wifi/BnRttController.h"
+#include "wificond/scanning/offload_scan_callback_interface.h"
+#include "wificond/scanning/scanner_impl.h"
 
 namespace android {
 namespace wificond {
 
-class RttControllerImpl;
+class ScannerImpl;
 
-class RttControllerBinder : public android::net::wifi::BnRttController {
+class OffloadScanCallbackInterfaceImpl
+    : public android::wificond::OffloadScanCallbackInterface {
  public:
-  explicit RttControllerBinder(RttControllerImpl* impl);
-  ~RttControllerBinder() override;
+  OffloadScanCallbackInterfaceImpl(ScannerImpl* parent);
+  ~OffloadScanCallbackInterfaceImpl() override;
 
-  // Called by |impl_| its destruction.
-  // This informs the binder proxy that no future manipulations of |impl_|
-  // by remote processes are possible.
-  void NotifyImplDead() { impl_ = nullptr; }
+  void OnOffloadScanResult() override;
+  void OnOffloadError(OffloadScanCallbackInterface::AsyncErrorReason) override;
 
  private:
-  RttControllerImpl* impl_;
-
-  DISALLOW_COPY_AND_ASSIGN(RttControllerBinder);
+  ScannerImpl* scanner_impl_;
 };
 
 }  // namespace wificond
 }  // namespace android
 
-#endif  // WIFICOND_RTT_CONTROLLER_BINDER_H_
+#endif  //  WIFICOND_SCANNER_OFFLOAD_SCAN_CALLBACK_INTERFACE_IML_H_
diff --git a/scanning/scanner_impl.cpp b/scanning/scanner_impl.cpp
index 9bf13b3..e09c7a1 100644
--- a/scanning/scanner_impl.cpp
+++ b/scanning/scanner_impl.cpp
@@ -22,9 +22,9 @@
 #include <android-base/logging.h>
 
 #include "wificond/client_interface_impl.h"
-#include "wificond/scanning/scan_utils.h"
-#include "wificond/scanning/offload/offload_service_utils.h"
 #include "wificond/scanning/offload/offload_scan_manager.h"
+#include "wificond/scanning/offload/offload_service_utils.h"
+#include "wificond/scanning/scan_utils.h"
 
 using android::binder::Status;
 using android::net::wifi::IPnoScanEvent;
@@ -39,24 +39,25 @@ using std::pair;
 using std::string;
 using std::vector;
 using std::weak_ptr;
+using std::shared_ptr;
 
 using namespace std::placeholders;
 
 namespace android {
 namespace wificond {
 
-ScannerImpl::ScannerImpl(uint32_t wiphy_index,
-                         uint32_t interface_index,
+ScannerImpl::ScannerImpl(uint32_t wiphy_index, uint32_t interface_index,
                          const ScanCapabilities& scan_capabilities,
                          const WiphyFeatures& wiphy_features,
                          ClientInterfaceImpl* client_interface,
-                         NetlinkUtils* netlink_utils,
-                         ScanUtils* scan_utils,
+                         NetlinkUtils* netlink_utils, ScanUtils* scan_utils,
                          weak_ptr<OffloadServiceUtils> offload_service_utils)
     : valid_(true),
       scan_started_(false),
       pno_scan_started_(false),
       offload_scan_supported_(false),
+      pno_scan_running_over_offload_(false),
+      pno_scan_results_from_offload_(false),
       wiphy_index_(wiphy_index),
       interface_index_(interface_index),
       scan_capabilities_(scan_capabilities),
@@ -70,25 +71,22 @@ ScannerImpl::ScannerImpl(uint32_t wiphy_index,
             << (int)interface_index_;
   scan_utils_->SubscribeScanResultNotification(
       interface_index_,
-      std::bind(&ScannerImpl::OnScanResultsReady,
-                this,
-                _1, _2, _3, _4));
+      std::bind(&ScannerImpl::OnScanResultsReady, this, _1, _2, _3, _4));
   // Subscribe scheduled scan result notification from kernel.
   scan_utils_->SubscribeSchedScanResultNotification(
       interface_index_,
       std::bind(&ScannerImpl::OnSchedScanResultsReady,
                 this,
                 _1, _2));
-  offload_scan_manager_.reset(
-      new OffloadScanManager(
-          offload_service_utils,
-          std::bind(&ScannerImpl::OnOffloadScanResult,
-              this, _1)));
+  std::shared_ptr<OffloadScanCallbackInterfaceImpl>
+      offload_scan_callback_interface =
+          offload_service_utils.lock()->GetOffloadScanCallbackInterface(this);
+  offload_scan_manager_ = offload_service_utils.lock()->GetOffloadScanManager(
+      offload_service_utils, offload_scan_callback_interface);
   offload_scan_supported_ = offload_service_utils.lock()->IsOffloadScanSupported();
 }
 
-ScannerImpl::~ScannerImpl() {
-}
+ScannerImpl::~ScannerImpl() {}
 
 void ScannerImpl::Invalidate() {
   LOG(INFO) << "Unsubscribe scan result for interface with index: "
@@ -111,17 +109,15 @@ Status ScannerImpl::getAvailable2gChannels(
     return Status::ok();
   }
   BandInfo band_info;
-  if (!netlink_utils_->GetWiphyInfo(wiphy_index_,
-                               &band_info,
-                               &scan_capabilities_,
-                               &wiphy_features_)) {
+  if (!netlink_utils_->GetWiphyInfo(wiphy_index_, &band_info,
+                                    &scan_capabilities_, &wiphy_features_)) {
     LOG(ERROR) << "Failed to get wiphy info from kernel";
     out_frequencies->reset(nullptr);
     return Status::ok();
   }
 
-  out_frequencies->reset(new vector<int32_t>(band_info.band_2g.begin(),
-                                             band_info.band_2g.end()));
+  out_frequencies->reset(
+      new vector<int32_t>(band_info.band_2g.begin(), band_info.band_2g.end()));
   return Status::ok();
 }
 
@@ -131,17 +127,15 @@ Status ScannerImpl::getAvailable5gNonDFSChannels(
     return Status::ok();
   }
   BandInfo band_info;
-  if (!netlink_utils_->GetWiphyInfo(wiphy_index_,
-                               &band_info,
-                               &scan_capabilities_,
-                               &wiphy_features_)) {
+  if (!netlink_utils_->GetWiphyInfo(wiphy_index_, &band_info,
+                                    &scan_capabilities_, &wiphy_features_)) {
     LOG(ERROR) << "Failed to get wiphy info from kernel";
     out_frequencies->reset(nullptr);
     return Status::ok();
   }
 
-  out_frequencies->reset(new vector<int32_t>(band_info.band_5g.begin(),
-                                             band_info.band_5g.end()));
+  out_frequencies->reset(
+      new vector<int32_t>(band_info.band_5g.begin(), band_info.band_5g.end()));
   return Status::ok();
 }
 
@@ -151,10 +145,8 @@ Status ScannerImpl::getAvailableDFSChannels(
     return Status::ok();
   }
   BandInfo band_info;
-  if (!netlink_utils_->GetWiphyInfo(wiphy_index_,
-                               &band_info,
-                               &scan_capabilities_,
-                               &wiphy_features_)) {
+  if (!netlink_utils_->GetWiphyInfo(wiphy_index_, &band_info,
+                                    &scan_capabilities_, &wiphy_features_)) {
     LOG(ERROR) << "Failed to get wiphy info from kernel";
     out_frequencies->reset(nullptr);
     return Status::ok();
@@ -175,6 +167,23 @@ Status ScannerImpl::getScanResults(vector<NativeScanResult>* out_scan_results) {
   return Status::ok();
 }
 
+Status ScannerImpl::getPnoScanResults(
+    vector<NativeScanResult>* out_scan_results) {
+  if (!CheckIsValid()) {
+    return Status::ok();
+  }
+  if (pno_scan_results_from_offload_) {
+    if (!offload_scan_manager_->getScanResults(out_scan_results)) {
+      LOG(ERROR) << "Failed to get scan results via Offload HAL";
+    }
+  } else {
+    if (!scan_utils_->GetScanResult(interface_index_, out_scan_results)) {
+      LOG(ERROR) << "Failed to get scan results via NL80211";
+    }
+  }
+  return Status::ok();
+}
+
 Status ScannerImpl::scan(const SingleScanSettings& scan_settings,
                          bool* out_success) {
   if (!CheckIsValid()) {
@@ -186,8 +195,8 @@ Status ScannerImpl::scan(const SingleScanSettings& scan_settings,
     LOG(WARNING) << "Scan already started";
   }
   // Only request MAC address randomization when station is not associated.
-  bool request_random_mac =  wiphy_features_.supports_random_mac_oneshot_scan &&
-      !client_interface_->IsAssociated();
+  bool request_random_mac = wiphy_features_.supports_random_mac_oneshot_scan &&
+                            !client_interface_->IsAssociated();
 
   // Initialize it with an empty ssid for a wild card scan.
   vector<vector<uint8_t>> ssids = {{}};
@@ -222,11 +231,14 @@ Status ScannerImpl::scan(const SingleScanSettings& scan_settings,
 
 Status ScannerImpl::startPnoScan(const PnoSettings& pno_settings,
                                  bool* out_success) {
-  if (!offload_scan_supported_ || !StartPnoScanOffload(pno_settings)) {
-    *out_success = StartPnoScanDefault(pno_settings);
-  } else {
+  pno_settings_ = pno_settings;
+  pno_scan_results_from_offload_ = false;
+  LOG(VERBOSE) << "startPnoScan";
+  if (offload_scan_supported_ && StartPnoScanOffload(pno_settings)) {
     // scanning over offload succeeded
     *out_success = true;
+  } else {
+    *out_success = StartPnoScanDefault(pno_settings);
   }
   return Status::ok();
 }
@@ -239,25 +251,27 @@ bool ScannerImpl::StartPnoScanOffload(const PnoSettings& pno_settings) {
   // Empty frequency list: scan all frequencies.
   vector<uint32_t> freqs;
 
-  ParsePnoSettings(pno_settings, &scan_ssids, &match_ssids, &freqs, &match_security);
-
-  bool success = offload_scan_manager_->startScan(
-          pno_settings.interval_ms_,
-          // TODO: honor both rssi thresholds.
-          pno_settings.min_5g_rssi_,
-          scan_ssids,
-          match_ssids,
-          match_security,
-          freqs,
-          &reason_code);
-  return success;
+  ParsePnoSettings(pno_settings, &scan_ssids, &match_ssids, &freqs,
+                   &match_security);
+  pno_scan_running_over_offload_ = offload_scan_manager_->startScan(
+      pno_settings.interval_ms_,
+      // TODO: honor both rssi thresholds.
+      pno_settings.min_5g_rssi_, scan_ssids, match_ssids, match_security, freqs,
+      &reason_code);
+  if (pno_scan_running_over_offload_) {
+    LOG(VERBOSE) << "Pno scans requested over Offload HAL";
+    if (pno_scan_event_handler_ != nullptr) {
+      pno_scan_event_handler_->OnPnoScanOverOffloadStarted();
+    }
+  }
+  return pno_scan_running_over_offload_;
 }
 
 void ScannerImpl::ParsePnoSettings(const PnoSettings& pno_settings,
-    vector<vector<uint8_t>>* scan_ssids,
-    vector<vector<uint8_t>>* match_ssids,
-    vector<uint32_t>* freqs,
-    vector<uint8_t>* match_security) {
+                                   vector<vector<uint8_t>>* scan_ssids,
+                                   vector<vector<uint8_t>>* match_ssids,
+                                   vector<uint32_t>* freqs,
+                                   vector<uint8_t>* match_security) {
   // TODO provide actionable security match parameters
   const uint8_t kNetworkFlagsDefault = 0;
   vector<vector<uint8_t>> skipped_scan_ssids;
@@ -266,7 +280,8 @@ void ScannerImpl::ParsePnoSettings(const PnoSettings& pno_settings,
     // Add hidden network ssid.
     if (network.is_hidden_) {
       // TODO remove pruning for Offload Scans
-      if (scan_ssids->size() + 1 > scan_capabilities_.max_num_sched_scan_ssids) {
+      if (scan_ssids->size() + 1 >
+          scan_capabilities_.max_num_sched_scan_ssids) {
         skipped_scan_ssids.emplace_back(network.ssid_);
         continue;
       }
@@ -287,7 +302,7 @@ void ScannerImpl::ParsePnoSettings(const PnoSettings& pno_settings,
 
 bool ScannerImpl::StartPnoScanDefault(const PnoSettings& pno_settings) {
   if (!CheckIsValid()) {
-      return false;
+    return false;
   }
   if (pno_scan_started_) {
     LOG(WARNING) << "Pno scan already started";
@@ -324,18 +339,27 @@ bool ScannerImpl::StartPnoScanDefault(const PnoSettings& pno_settings) {
 }
 
 Status ScannerImpl::stopPnoScan(bool* out_success) {
-  if (!offload_scan_supported_ || !StopPnoScanOffload()) {
-    *out_success = StopPnoScanDefault();
-  } else {
+  if (offload_scan_supported_ && StopPnoScanOffload()) {
     // Pno scans over offload stopped successfully
     *out_success = true;
+  } else {
+    // Pno scans were not requested over offload
+    *out_success = StopPnoScanDefault();
   }
   return Status::ok();
 }
 
 bool ScannerImpl::StopPnoScanOffload() {
   OffloadScanManager::ReasonCode reason_code;
-  return(offload_scan_manager_->stopScan(&reason_code));
+  if (!pno_scan_running_over_offload_) {
+    return false;
+  }
+  if (!offload_scan_manager_->stopScan(&reason_code)) {
+    LOG(WARNING) << "Unable to unsubscribe to Offload scan results";
+  }
+  pno_scan_running_over_offload_ = false;
+  LOG(VERBOSE) << "Pno scans over Offload stopped";
+  return true;
 }
 
 bool ScannerImpl::StopPnoScanDefault() {
@@ -387,7 +411,6 @@ Status ScannerImpl::unsubscribeScanEvents() {
   return Status::ok();
 }
 
-
 Status ScannerImpl::subscribePnoScanEvents(const sp<IPnoScanEvent>& handler) {
   if (!CheckIsValid()) {
     return Status::ok();
@@ -407,11 +430,9 @@ Status ScannerImpl::unsubscribePnoScanEvents() {
   return Status::ok();
 }
 
-void ScannerImpl::OnScanResultsReady(
-    uint32_t interface_index,
-    bool aborted,
-    vector<vector<uint8_t>>& ssids,
-    vector<uint32_t>& frequencies) {
+void ScannerImpl::OnScanResultsReady(uint32_t interface_index, bool aborted,
+                                     vector<vector<uint8_t>>& ssids,
+                                     vector<uint32_t>& frequencies) {
   if (!scan_started_) {
     LOG(INFO) << "Received external scan result notification from kernel.";
   }
@@ -443,6 +464,7 @@ void ScannerImpl::OnSchedScanResultsReady(uint32_t interface_index,
       pno_scan_started_ = false;
     } else {
       LOG(INFO) << "Pno scan result ready event";
+      pno_scan_results_from_offload_ = false;
       pno_scan_event_handler_->OnPnoNetworkFound();
     }
   }
@@ -476,6 +498,65 @@ SchedScanIntervalSetting ScannerImpl::GenerateIntervalSetting(
   }
 }
 
+void ScannerImpl::OnOffloadScanResult() {
+  if (!pno_scan_running_over_offload_) {
+    LOG(WARNING) << "Scan results from Offload HAL but scan not requested over "
+                    "this interface";
+    return;
+  }
+  LOG(INFO) << "Offload Scan results received";
+  pno_scan_results_from_offload_ = true;
+  if (pno_scan_event_handler_ != nullptr) {
+    pno_scan_event_handler_->OnPnoNetworkFound();
+  } else {
+    LOG(WARNING) << "No scan event handler Offload Scan result";
+  }
+}
+
+void ScannerImpl::OnOffloadError(
+    OffloadScanCallbackInterface::AsyncErrorReason error_code) {
+  if (!pno_scan_running_over_offload_) {
+    // Ignore irrelevant error notifications
+    LOG(WARNING) << "Offload HAL Async Error occured but Offload HAL is not "
+                    "subscribed to";
+    return;
+  }
+  LOG(ERROR) << "Offload Service Async Failure error_code=" << error_code;
+  switch (error_code) {
+    case OffloadScanCallbackInterface::AsyncErrorReason::BINDER_DEATH:
+      LOG(ERROR) << "Binder death";
+      if (pno_scan_event_handler_ != nullptr) {
+        pno_scan_event_handler_->OnPnoScanOverOffloadFailed(
+            net::wifi::IPnoScanEvent::PNO_SCAN_OVER_OFFLOAD_BINDER_FAILURE);
+      }
+      break;
+    case OffloadScanCallbackInterface::AsyncErrorReason::REMOTE_FAILURE:
+      LOG(ERROR) << "Remote failure";
+      if (pno_scan_event_handler_ != nullptr) {
+        pno_scan_event_handler_->OnPnoScanOverOffloadFailed(
+            net::wifi::IPnoScanEvent::PNO_SCAN_OVER_OFFLOAD_REMOTE_FAILURE);
+      }
+      break;
+    default:
+      LOG(WARNING) << "Invalid Error code";
+      break;
+  }
+  bool success = false;
+  // Stop scans over Offload HAL and request them over netlink
+  stopPnoScan(&success);
+  if (success) {
+    LOG(INFO) << "Pno scans stopped";
+  }
+  // Restart PNO scans over netlink interface
+  success = StartPnoScanDefault(pno_settings_);
+  if (success) {
+    LOG(INFO) << "Pno scans restarted";
+  } else {
+    LOG(ERROR) << "Unable to fall back to netlink pno scan";
+    pno_scan_event_handler_->OnPnoScanFailed();
+  }
+}
+
 void ScannerImpl::LogSsidList(vector<vector<uint8_t>>& ssid_list,
                               string prefix) {
   if (ssid_list.empty()) {
@@ -491,15 +572,5 @@ void ScannerImpl::LogSsidList(vector<vector<uint8_t>>& ssid_list,
   LOG(WARNING) << prefix << ": " << ssid_list_string;
 }
 
-void ScannerImpl::OnOffloadScanResult(
-    std::vector<NativeScanResult> scanResult) {
-  LOG(INFO) << "Offload Scan results received";
-  if (pno_scan_event_handler_ != nullptr) {
-    pno_scan_event_handler_->OnPnoNetworkFound();
-  } else {
-    LOG(WARNING) << "No scan event handler Offload Scan result";
-  }
-}
-
 }  // namespace wificond
 }  // namespace android
diff --git a/scanning/scanner_impl.h b/scanning/scanner_impl.h
index 2bb9262..8e1f832 100644
--- a/scanning/scanner_impl.h
+++ b/scanning/scanner_impl.h
@@ -24,7 +24,7 @@
 
 #include "android/net/wifi/BnWifiScannerImpl.h"
 #include "wificond/net/netlink_utils.h"
-#include "wificond/scanning/offload/offload_scan_manager.h"
+#include "wificond/scanning/offload_scan_callback_interface.h"
 #include "wificond/scanning/scan_utils.h"
 
 namespace android {
@@ -32,16 +32,17 @@ namespace wificond {
 
 class ClientInterfaceImpl;
 class OffloadServiceUtils;
+class ScanUtils;
+class OffloadScanCallbackInterfaceImpl;
+class OffloadScanManager;
 
 class ScannerImpl : public android::net::wifi::BnWifiScannerImpl {
  public:
-  ScannerImpl(uint32_t wiphy_index,
-              uint32_t interface_index,
+  ScannerImpl(uint32_t wiphy_index, uint32_t interface_index,
               const ScanCapabilities& scan_capabilities,
               const WiphyFeatures& wiphy_features,
               ClientInterfaceImpl* client_interface,
-              NetlinkUtils* netlink_utils,
-              ScanUtils* scan_utils,
+              NetlinkUtils* netlink_utils, ScanUtils* scan_utils,
               std::weak_ptr<OffloadServiceUtils> offload_service_utils);
   ~ScannerImpl();
   // Returns a vector of available frequencies for 2.4GHz channels.
@@ -53,10 +54,15 @@ class ScannerImpl : public android::net::wifi::BnWifiScannerImpl {
   // Returns a vector of available frequencies for DFS channels.
   ::android::binder::Status getAvailableDFSChannels(
       ::std::unique_ptr<::std::vector<int32_t>>* out_frequencies) override;
-  // Get the latest scan results from kernel.
+  // Get the latest single scan results from kernel.
   ::android::binder::Status getScanResults(
       std::vector<com::android::server::wifi::wificond::NativeScanResult>*
           out_scan_results) override;
+  // Get the latest pno scan results from the interface that most recently
+  // completed PNO scans
+  ::android::binder::Status getPnoScanResults(
+      std::vector<com::android::server::wifi::wificond::NativeScanResult>*
+          out_scan_results) override;
   ::android::binder::Status scan(
       const ::com::android::server::wifi::wificond::SingleScanSettings&
           scan_settings,
@@ -71,19 +77,19 @@ class ScannerImpl : public android::net::wifi::BnWifiScannerImpl {
       const ::android::sp<::android::net::wifi::IScanEvent>& handler) override;
   ::android::binder::Status unsubscribeScanEvents() override;
   ::android::binder::Status subscribePnoScanEvents(
-      const ::android::sp<::android::net::wifi::IPnoScanEvent>& handler) override;
+      const ::android::sp<::android::net::wifi::IPnoScanEvent>& handler)
+      override;
   ::android::binder::Status unsubscribePnoScanEvents() override;
+  void OnOffloadScanResult();
+  void OnOffloadError(
+      OffloadScanCallbackInterface::AsyncErrorReason error_code);
   void Invalidate();
 
  private:
   bool CheckIsValid();
-  void OnOffloadScanResult(
-      std::vector<::com::android::server::wifi::wificond::NativeScanResult>);
-  void OnScanResultsReady(
-      uint32_t interface_index,
-      bool aborted,
-      std::vector<std::vector<uint8_t>>& ssids,
-      std::vector<uint32_t>& frequencies);
+  void OnScanResultsReady(uint32_t interface_index, bool aborted,
+                          std::vector<std::vector<uint8_t>>& ssids,
+                          std::vector<uint32_t>& frequencies);
   void OnSchedScanResultsReady(uint32_t interface_index, bool scan_stopped);
   void LogSsidList(std::vector<std::vector<uint8_t>>& ssid_list,
                    std::string prefix);
@@ -94,11 +100,10 @@ class ScannerImpl : public android::net::wifi::BnWifiScannerImpl {
   bool StopPnoScanDefault();
   bool StopPnoScanOffload();
   void ParsePnoSettings(
-    const ::com::android::server::wifi::wificond::PnoSettings& pno_settings,
-    std::vector<std::vector<uint8_t>>* scan_ssids,
-    std::vector<std::vector<uint8_t>>* match_ssids,
-    std::vector<uint32_t>* freqs,
-    std::vector<uint8_t>* match_security);
+      const ::com::android::server::wifi::wificond::PnoSettings& pno_settings,
+      std::vector<std::vector<uint8_t>>* scan_ssids,
+      std::vector<std::vector<uint8_t>>* match_ssids,
+      std::vector<uint32_t>* freqs, std::vector<uint8_t>* match_security);
   SchedScanIntervalSetting GenerateIntervalSetting(
     const ::com::android::server::wifi::wificond::PnoSettings& pno_settings) const;
 
@@ -107,6 +112,9 @@ class ScannerImpl : public android::net::wifi::BnWifiScannerImpl {
   bool scan_started_;
   bool pno_scan_started_;
   bool offload_scan_supported_;
+  bool pno_scan_running_over_offload_;
+  bool pno_scan_results_from_offload_;
+  ::com::android::server::wifi::wificond::PnoSettings pno_settings_;
 
   const uint32_t wiphy_index_;
   const uint32_t interface_index_;
@@ -120,7 +128,7 @@ class ScannerImpl : public android::net::wifi::BnWifiScannerImpl {
   ScanUtils* const scan_utils_;
   ::android::sp<::android::net::wifi::IPnoScanEvent> pno_scan_event_handler_;
   ::android::sp<::android::net::wifi::IScanEvent> scan_event_handler_;
-  std::unique_ptr<OffloadScanManager> offload_scan_manager_;
+  std::shared_ptr<OffloadScanManager> offload_scan_manager_;
 
   DISALLOW_COPY_AND_ASSIGN(ScannerImpl);
 };
diff --git a/server.cpp b/server.cpp
index be57e89..88010fb 100644
--- a/server.cpp
+++ b/server.cpp
@@ -35,8 +35,6 @@ using android::IBinder;
 using android::net::wifi::IApInterface;
 using android::net::wifi::IClientInterface;
 using android::net::wifi::IInterfaceEventCallback;
-using android::net::wifi::IRttClient;
-using android::net::wifi::IRttController;
 using android::wifi_system::HostapdManager;
 using android::wifi_system::InterfaceTool;
 using android::wifi_system::SupplicantManager;
@@ -96,25 +94,6 @@ Status Server::UnregisterCallback(const sp<IInterfaceEventCallback>& callback) {
   return Status::ok();
 }
 
-Status Server::registerRttClient(const sp<IRttClient>& rtt_client,
-                                 sp<IRttController>* out_rtt_controller) {
-  if (rtt_controller_ == nullptr) {
-    rtt_controller_.reset(new RttControllerImpl());
-  }
-  rtt_controller_->RegisterRttClient(rtt_client);
-
-  *out_rtt_controller = rtt_controller_->GetBinder();
-  return Status::ok();
-}
-
-Status Server::unregisterRttClient(const sp<IRttClient>& rttClient) {
-  rtt_controller_->UnregisterRttClient(rttClient);
-  if (rtt_controller_->GetClientCount() == 0) {
-    rtt_controller_.reset();
-  }
-  return Status::ok();
-}
-
 Status Server::createApInterface(sp<IApInterface>* created_interface) {
   InterfaceInfo interface;
   if (!SetupInterface(&interface)) {
diff --git a/server.h b/server.h
index 8fc3d77..4c131d4 100644
--- a/server.h
+++ b/server.h
@@ -31,7 +31,6 @@
 
 #include "wificond/ap_interface_impl.h"
 #include "wificond/client_interface_impl.h"
-#include "wificond/rtt/rtt_controller_impl.h"
 
 namespace android {
 namespace wificond {
@@ -58,15 +57,6 @@ class Server : public android::net::wifi::BnWificond {
       const android::sp<android::net::wifi::IInterfaceEventCallback>&
           callback) override;
 
-  android::binder::Status registerRttClient(
-      const ::android::sp<::android::net::wifi::IRttClient>& rtt_client,
-      ::android::sp<::android::net::wifi::IRttController>*
-          out_rtt_controller) override;
-
-  android::binder::Status unregisterRttClient(
-      const ::android::sp<::android::net::wifi::IRttClient>&
-          rttClient) override;
-
   android::binder::Status createApInterface(
       android::sp<android::net::wifi::IApInterface>*
           created_interface) override;
@@ -120,8 +110,6 @@ class Server : public android::net::wifi::BnWificond {
   std::vector<android::sp<android::net::wifi::IInterfaceEventCallback>>
       interface_event_callbacks_;
 
-  std::unique_ptr<RttControllerImpl> rtt_controller_;
-
   // Cached interface list from kernel.
   std::vector<InterfaceInfo> interfaces_;
 
diff --git a/rtt/rtt_controller_binder.cpp b/tests/mock_offload_scan_callback_interface.cpp
index ba37018..cb76e45 100644
--- a/rtt/rtt_controller_binder.cpp
+++ b/tests/mock_offload_scan_callback_interface.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016 The Android Open Source Project
+ * Copyright (C) 2017 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,18 +14,12 @@
  * limitations under the License.
  */
 
-#include "wificond/rtt/rtt_controller_binder.h"
-
-#include "wificond/rtt/rtt_controller_impl.h"
+#include "wificond/tests/mock_offload_scan_callback_interface.h"
 
 namespace android {
 namespace wificond {
 
-RttControllerBinder::RttControllerBinder(RttControllerImpl* impl) : impl_{impl} {
-}
-
-RttControllerBinder::~RttControllerBinder() {
-}
+MockOffloadScanCallbackInterface::MockOffloadScanCallbackInterface() {}
 
 }  // namespace wificond
 }  // namespace android
diff --git a/tests/mock_offload_scan_callback_interface.h b/tests/mock_offload_scan_callback_interface.h
new file mode 100644
index 0000000..e4f8df9
--- /dev/null
+++ b/tests/mock_offload_scan_callback_interface.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_CALLBACK_INTERFACE_H_
+#define WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_CALLBACK_INTERFACE_H_
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "wificond/scanning/offload_scan_callback_interface.h"
+
+namespace android {
+namespace wificond {
+
+class MockOffloadScanCallbackInterface : public OffloadScanCallbackInterface {
+ public:
+  MockOffloadScanCallbackInterface();
+  ~MockOffloadScanCallbackInterface() override = default;
+
+  MOCK_METHOD0(OnOffloadScanResult, void());
+  MOCK_METHOD1(OnOffloadError,
+               void(OffloadScanCallbackInterface::AsyncErrorReason));
+};
+
+}  // namespace wificond
+}  // namespace android
+
+#endif  // WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_CALLBACK_INTERFACE_H_
diff --git a/aidl/android/net/wifi/IRttClient.aidl b/tests/mock_offload_scan_callback_interface_impl.cpp
index b58fdca..b9dffc5 100644
--- a/aidl/android/net/wifi/IRttClient.aidl
+++ b/tests/mock_offload_scan_callback_interface_impl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016 The Android Open Source Project
+ * Copyright (C) 2017 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,8 +14,15 @@
  * limitations under the License.
  */
 
-package android.net.wifi;
+#include "wificond/tests/mock_offload_scan_callback_interface_impl.h"
+#include "wificond/scanning/scanner_impl.h"
 
-interface IRttClient {
-  // TODO(nywang) add functions
-}
+namespace android {
+namespace wificond {
+
+MockOffloadScanCallbackInterfaceImpl::MockOffloadScanCallbackInterfaceImpl(
+    ScannerImpl* parent)
+    : OffloadScanCallbackInterfaceImpl(parent) {}
+
+}  // namespace wificond
+}  // namespace android
diff --git a/tests/mock_offload_scan_callback_interface_impl.h b/tests/mock_offload_scan_callback_interface_impl.h
new file mode 100644
index 0000000..8b76388
--- /dev/null
+++ b/tests/mock_offload_scan_callback_interface_impl.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_CALLBACK_INTERFACE_IMPL_H__
+#define WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_CALLBACK_INTERFACE_IMPL_H__
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "wificond/scanning/offload_scan_callback_interface_impl.h"
+
+namespace android {
+namespace wificond {
+
+class ScannerImpl;
+
+class MockOffloadScanCallbackInterfaceImpl
+    : public OffloadScanCallbackInterfaceImpl {
+ public:
+  MockOffloadScanCallbackInterfaceImpl(ScannerImpl*);
+  ~MockOffloadScanCallbackInterfaceImpl() override = default;
+
+  MOCK_METHOD0(OnOffloadScanResult, void());
+  MOCK_METHOD1(OnOffloadError,
+               void(OffloadScanCallbackInterface::AsyncErrorReason));
+};
+
+}  // namespace wificond
+}  // namespace android
+
+#endif  // WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_CALLBACK_INTERFACE_IMPL_H__
diff --git a/aidl/android/net/wifi/IRttController.aidl b/tests/mock_offload_scan_manager.cpp
index 30f8d0d..8943524 100644
--- a/aidl/android/net/wifi/IRttController.aidl
+++ b/tests/mock_offload_scan_manager.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016 The Android Open Source Project
+ * Copyright (C) 2017 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,8 +14,15 @@
  * limitations under the License.
  */
 
-package android.net.wifi;
+#include "wificond/tests/mock_offload_scan_manager.h"
 
-interface IRttController {
-  // TODO(nywang) add functions
-}
+namespace android {
+namespace wificond {
+
+MockOffloadScanManager::MockOffloadScanManager(
+    std::weak_ptr<OffloadServiceUtils> service_utils,
+    std::shared_ptr<OffloadScanCallbackInterface> callback_interface)
+    : OffloadScanManager(service_utils, callback_interface) {}
+
+}  // namespace wificond
+}  // namespace android
diff --git a/tests/mock_offload_scan_manager.h b/tests/mock_offload_scan_manager.h
new file mode 100644
index 0000000..71d5e79
--- /dev/null
+++ b/tests/mock_offload_scan_manager.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_MANAGER_H_
+#define WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_MANAGER_H_
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "wificond/scanning/offload/offload_scan_manager.h"
+
+namespace android {
+namespace wificond {
+
+class MockOffloadScanManager : public OffloadScanManager {
+ public:
+  MockOffloadScanManager(
+      std::weak_ptr<OffloadServiceUtils> service_utils,
+      std::shared_ptr<OffloadScanCallbackInterface> callback_interface);
+  ~MockOffloadScanManager() override = default;
+
+  MOCK_METHOD7(startScan,
+               bool(uint32_t interval_ms, int32_t rssi_threshold,
+                    const std::vector<std::vector<uint8_t>>& scan_ssids,
+                    const std::vector<std::vector<uint8_t>>& match_ssids,
+                    const std::vector<uint8_t>& match_security,
+                    const std::vector<uint32_t>& frequencies,
+                    OffloadScanManager::ReasonCode* reason_code));
+  MOCK_METHOD1(stopScan, bool(OffloadScanManager::ReasonCode* reason_code));
+  MOCK_METHOD1(getScanStats,
+               bool(::com::android::server::wifi::wificond::NativeScanStats*
+                        scan_stats));
+  MOCK_CONST_METHOD0(getOffloadStatus, OffloadScanManager::StatusCode());
+  MOCK_METHOD1(
+      getScanResults,
+      bool(std::vector<
+           ::com::android::server::wifi::wificond::NativeScanResult>*));
+};
+
+}  // namespace wificond
+}  // namespace android
+
+#endif  // WIFICOND_TESTS_MOCK_OFFLOAD_SCAN_MANAGER_H_
diff --git a/tests/mock_offload_service_utils.h b/tests/mock_offload_service_utils.h
index fd9fd34..76d022d 100644
--- a/tests/mock_offload_service_utils.h
+++ b/tests/mock_offload_service_utils.h
@@ -24,6 +24,7 @@
 #include "wificond/scanning/offload/offload_callback.h"
 #include "wificond/scanning/offload/offload_callback_handlers.h"
 #include "wificond/scanning/offload/offload_service_utils.h"
+#include "wificond/scanning/offload_scan_callback_interface_impl.h"
 
 namespace android {
 namespace wificond {
@@ -40,6 +41,14 @@ class MockOffloadServiceUtils : public OffloadServiceUtils {
   MOCK_METHOD1(GetOffloadDeathRecipient,
                android::wificond::OffloadDeathRecipient*(
                    OffloadDeathRecipientHandler handler));
+  MOCK_METHOD1(
+      GetOffloadScanCallbackInterface,
+      std::shared_ptr<OffloadScanCallbackInterfaceImpl>(ScannerImpl* scanner));
+  MOCK_METHOD2(GetOffloadScanManager,
+               std::shared_ptr<OffloadScanManager>(
+                   std::weak_ptr<OffloadServiceUtils> service_utils,
+                   std::shared_ptr<OffloadScanCallbackInterfaceImpl>
+                       callback_interface));
 };
 
 }  // namespace wificond
diff --git a/tests/offload_scan_manager_test.cpp b/tests/offload_scan_manager_test.cpp
index 2dbf953..9e586cb 100644
--- a/tests/offload_scan_manager_test.cpp
+++ b/tests/offload_scan_manager_test.cpp
@@ -23,6 +23,7 @@
 #include <gtest/gtest.h>
 
 #include "wificond/tests/mock_offload.h"
+#include "wificond/tests/mock_offload_scan_callback_interface.h"
 #include "wificond/tests/mock_offload_service_utils.h"
 #include "wificond/tests/offload_hal_test_constants.h"
 #include "wificond/tests/offload_test_utils.h"
@@ -112,6 +113,9 @@ class OffloadScanManagerTest : public ::testing::Test {
   sp<OffloadDeathRecipient> death_recipient_;
   shared_ptr<NiceMock<MockOffloadServiceUtils>> mock_offload_service_utils_{
       new NiceMock<MockOffloadServiceUtils>()};
+  shared_ptr<NiceMock<MockOffloadScanCallbackInterface>>
+      mock_offload_scan_callback_interface_{
+          new NiceMock<MockOffloadScanCallbackInterface>()};
   unique_ptr<OffloadScanManager> offload_scan_manager_;
   OffloadStatus status;
   vector<vector<uint8_t>> scan_ssids{kSsid1, kSsid2};
@@ -131,8 +135,8 @@ TEST_F(OffloadScanManagerTest, BinderDeathRegisteredCookieAndService) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
+  EXPECT_CALL(*mock_offload_scan_callback_interface_, OnOffloadError(_));
   death_recipient_->serviceDied(cookie_, mock_offload_);
   EXPECT_EQ(OffloadScanManager::kNoService,
             offload_scan_manager_->getOffloadStatus());
@@ -147,8 +151,7 @@ TEST_F(OffloadScanManagerTest, BinderDeathUnregisteredCookie) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   death_recipient_->serviceDied(kDeathCode, mock_offload_);
   EXPECT_FALSE(OffloadScanManager::kNoService ==
                offload_scan_manager_->getOffloadStatus());
@@ -163,8 +166,7 @@ TEST_F(OffloadScanManagerTest, ServiceNotAvailableTest) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(nullptr));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   EXPECT_EQ(OffloadScanManager::kNoService,
             offload_scan_manager_->getOffloadStatus());
 }
@@ -180,8 +182,7 @@ TEST_F(OffloadScanManagerTest, ServiceAvailableTest) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   EXPECT_EQ(OffloadScanManager::kNoError,
             offload_scan_manager_->getOffloadStatus());
 }
@@ -192,21 +193,17 @@ TEST_F(OffloadScanManagerTest, ServiceAvailableTest) {
  * scan results are available
  */
 TEST_F(OffloadScanManagerTest, CallbackInvokedTest) {
-  bool callback_invoked = false;
   EXPECT_CALL(*mock_offload_service_utils_, GetOffloadService());
   EXPECT_CALL(*mock_offload_service_utils_, GetOffloadCallback(_));
   EXPECT_CALL(*mock_offload_service_utils_, GetOffloadDeathRecipient(_));
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
+  EXPECT_CALL(*mock_offload_scan_callback_interface_, OnOffloadScanResult());
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [&callback_invoked](vector<NativeScanResult> scanResult) -> void {
-        callback_invoked = true;
-      }));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   vector<ScanResult> dummy_scan_results_ =
       OffloadTestUtils::createOffloadScanResults();
   offload_callback_->onScanResult(dummy_scan_results_);
-  EXPECT_EQ(true, callback_invoked);
 }
 
 /**
@@ -220,10 +217,10 @@ TEST_F(OffloadScanManagerTest, ErrorCallbackInvokedTest) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   OffloadStatus status =
       OffloadTestUtils::createOffloadStatus(OffloadStatusCode::ERROR);
+  EXPECT_CALL(*mock_offload_scan_callback_interface_, OnOffloadError(_));
   offload_callback_->onError(status);
   EXPECT_EQ(offload_scan_manager_->getOffloadStatus(),
             OffloadScanManager::kError);
@@ -240,8 +237,7 @@ TEST_F(OffloadScanManagerTest, StartScanTestWhenServiceIsOk) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   EXPECT_CALL(*mock_offload_, subscribeScanResults(_, _));
   EXPECT_CALL(*mock_offload_, configureScans(_, _, _));
   OffloadScanManager::ReasonCode reason_code = OffloadScanManager::kNone;
@@ -256,12 +252,11 @@ TEST_F(OffloadScanManagerTest, StartScanTestWhenServiceIsOk) {
  * Offload HAL when service is not available
  */
 TEST_F(OffloadScanManagerTest, StartScanTestWhenServiceIsNotAvailable) {
-  EXPECT_CALL(*mock_offload_service_utils_, GetOffloadService());
+  EXPECT_CALL(*mock_offload_service_utils_, GetOffloadService()).Times(2);
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(nullptr));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   OffloadScanManager::ReasonCode reason_code = OffloadScanManager::kNone;
   bool result = offload_scan_manager_->startScan(
       kDisconnectedModeScanIntervalMs, kRssiThreshold, scan_ssids, match_ssids,
@@ -281,8 +276,7 @@ TEST_F(OffloadScanManagerTest, StartScanTestWhenServiceIsNotConnected) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   OffloadStatus status =
       OffloadTestUtils::createOffloadStatus(OffloadStatusCode::NO_CONNECTION);
   offload_callback_->onError(status);
@@ -305,9 +299,8 @@ TEST_F(OffloadScanManagerTest, StartScanTwiceTestWhenServiceIsOk) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
-  EXPECT_CALL(*mock_offload_, subscribeScanResults(_, _)).Times(1);
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
+  EXPECT_CALL(*mock_offload_, subscribeScanResults(_, _)).Times(2);
   EXPECT_CALL(*mock_offload_, configureScans(_, _, _)).Times(2);
   OffloadScanManager::ReasonCode reason_code = OffloadScanManager::kNone;
   bool result = offload_scan_manager_->startScan(
@@ -331,8 +324,7 @@ TEST_F(OffloadScanManagerTest, StopScanTestWhenServiceIsOk) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   EXPECT_CALL(*mock_offload_, subscribeScanResults(_, _));
   EXPECT_CALL(*mock_offload_, configureScans(_, _, _));
   EXPECT_CALL(*mock_offload_, unsubscribeScanResults());
@@ -347,26 +339,7 @@ TEST_F(OffloadScanManagerTest, StopScanTestWhenServiceIsOk) {
 
 /**
  * Testing OffloadScanManager for unsubscribing to the scan results from
- * Offload HAL without first subscribing
- */
-TEST_F(OffloadScanManagerTest, StopScanTestWithoutStartWhenServiceIsOk) {
-  EXPECT_CALL(*mock_offload_service_utils_, GetOffloadService());
-  EXPECT_CALL(*mock_offload_service_utils_, GetOffloadCallback(_));
-  EXPECT_CALL(*mock_offload_service_utils_, GetOffloadDeathRecipient(_));
-  ON_CALL(*mock_offload_service_utils_, GetOffloadService())
-      .WillByDefault(testing::Return(mock_offload_));
-  offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
-  OffloadScanManager::ReasonCode reason_code = OffloadScanManager::kNone;
-  bool result = offload_scan_manager_->stopScan(&reason_code);
-  EXPECT_EQ(result, false);
-  EXPECT_EQ(reason_code, OffloadScanManager::kNotSubscribed);
-}
-
-/**
- * Testing OffloadScanManager for unsubscribing to the scan results from
- * Offload HAL without first subscribing when service is not working correctly
+ * when service is not connected to the hardware
  */
 TEST_F(OffloadScanManagerTest, StopScanTestWhenServiceIsNotConnectedAnymore) {
   EXPECT_CALL(*mock_offload_service_utils_, GetOffloadService());
@@ -374,11 +347,9 @@ TEST_F(OffloadScanManagerTest, StopScanTestWhenServiceIsNotConnectedAnymore) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   EXPECT_CALL(*mock_offload_, subscribeScanResults(_, _));
   EXPECT_CALL(*mock_offload_, configureScans(_, _, _));
-  EXPECT_CALL(*mock_offload_, unsubscribeScanResults());
   OffloadScanManager::ReasonCode reason_code = OffloadScanManager::kNone;
   bool result = offload_scan_manager_->startScan(
       kDisconnectedModeScanIntervalMs, kRssiThreshold, scan_ssids, match_ssids,
@@ -388,7 +359,7 @@ TEST_F(OffloadScanManagerTest, StopScanTestWhenServiceIsNotConnectedAnymore) {
       OffloadTestUtils::createOffloadStatus(OffloadStatusCode::NO_CONNECTION);
   offload_callback_->onError(status);
   result = offload_scan_manager_->stopScan(&reason_code);
-  EXPECT_EQ(result, true);
+  EXPECT_EQ(result, false);
 }
 
 /**
@@ -402,8 +373,7 @@ TEST_F(OffloadScanManagerTest, getScanStatsTestWhenServiceIsOk) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   EXPECT_CALL(*mock_offload_, getScanStats(_));
   NativeScanStats stats;
   bool result = offload_scan_manager_->getScanStats(&stats);
@@ -421,8 +391,7 @@ TEST_F(OffloadScanManagerTest, getScanStatsTestWhenServiceIsNotOk) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   OffloadStatus status =
       OffloadTestUtils::createOffloadStatus(OffloadStatusCode::NO_CONNECTION);
   offload_callback_->onError(status);
@@ -443,8 +412,7 @@ TEST_F(OffloadScanManagerTest, StartScanFailedTest) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   EXPECT_CALL(*mock_offload_, subscribeScanResults(_, _)).Times(0);
   EXPECT_CALL(*mock_offload_, configureScans(_, _, _)).Times(1);
   status = OffloadTestUtils::createOffloadStatus(OffloadStatusCode::ERROR);
@@ -467,8 +435,7 @@ TEST_F(OffloadScanManagerTest, getScanStatsFailedTest) {
   ON_CALL(*mock_offload_service_utils_, GetOffloadService())
       .WillByDefault(testing::Return(mock_offload_));
   offload_scan_manager_.reset(new OffloadScanManager(
-      mock_offload_service_utils_,
-      [](vector<NativeScanResult> scanResult) -> void {}));
+      mock_offload_service_utils_, mock_offload_scan_callback_interface_));
   status = OffloadTestUtils::createOffloadStatus(OffloadStatusCode::TIMEOUT);
   EXPECT_CALL(*mock_offload_, getScanStats(_));
   NativeScanStats stats;
diff --git a/tests/offload_scan_utils_test.cpp b/tests/offload_scan_utils_test.cpp
index d75143a..15c7e86 100644
--- a/tests/offload_scan_utils_test.cpp
+++ b/tests/offload_scan_utils_test.cpp
@@ -50,13 +50,13 @@ class OffloadScanUtilsTest : public ::testing::Test {
 };
 
 TEST_F(OffloadScanUtilsTest, verifyConversion) {
-  vector<NativeScanResult> native_scan_results =
-      OffloadScanUtils::convertToNativeScanResults(dummy_scan_results_);
+  vector<NativeScanResult> native_scan_results;
+  EXPECT_TRUE(OffloadScanUtils::convertToNativeScanResults(
+      dummy_scan_results_, &native_scan_results));
   EXPECT_EQ(native_scan_results.size(), dummy_scan_results_.size());
   for (size_t i = 0; i < native_scan_results.size(); i++) {
     EXPECT_EQ(native_scan_results[i].frequency,
               dummy_scan_results_[i].frequency);
-    EXPECT_EQ(native_scan_results[i].tsf, dummy_scan_results_[i].tsf);
     EXPECT_EQ(native_scan_results[i].signal_mbm, dummy_scan_results_[i].rssi);
     EXPECT_EQ(native_scan_results[i].ssid.size(),
               dummy_scan_results_[i].networkInfo.ssid.size());
diff --git a/tests/scanner_unittest.cpp b/tests/scanner_unittest.cpp
index bbaeffd..d69e8b1 100644
--- a/tests/scanner_unittest.cpp
+++ b/tests/scanner_unittest.cpp
@@ -21,12 +21,16 @@
 #include <wifi_system_test/mock_interface_tool.h>
 #include <wifi_system_test/mock_supplicant_manager.h>
 
+#include "wificond/scanning/offload/offload_scan_utils.h"
 #include "wificond/scanning/scanner_impl.h"
 #include "wificond/tests/mock_client_interface_impl.h"
 #include "wificond/tests/mock_netlink_manager.h"
 #include "wificond/tests/mock_netlink_utils.h"
+#include "wificond/tests/mock_offload_scan_callback_interface_impl.h"
+#include "wificond/tests/mock_offload_scan_manager.h"
 #include "wificond/tests/mock_offload_service_utils.h"
 #include "wificond/tests/mock_scan_utils.h"
+#include "wificond/tests/offload_test_utils.h"
 
 using ::android::binder::Status;
 using ::android::wifi_system::MockInterfaceTool;
@@ -34,6 +38,7 @@ using ::android::wifi_system::MockSupplicantManager;
 using ::com::android::server::wifi::wificond::SingleScanSettings;
 using ::com::android::server::wifi::wificond::PnoSettings;
 using ::com::android::server::wifi::wificond::NativeScanResult;
+using android::hardware::wifi::offload::V1_0::ScanResult;
 using ::testing::Invoke;
 using ::testing::NiceMock;
 using ::testing::Return;
@@ -84,21 +89,36 @@ bool CaptureSchedScanIntervalSetting(
   return true;
 }
 
+bool ReturnOffloadScanResults(
+    std::vector<NativeScanResult>* native_scan_results_,
+    const std::vector<ScanResult>& offload_scan_results) {
+  return OffloadScanUtils::convertToNativeScanResults(offload_scan_results,
+                                                      native_scan_results_);
+}
+
+bool ReturnNetlinkScanResults(
+    uint32_t interface_index,
+    std::vector<NativeScanResult>* native_scan_results_,
+    const std::vector<ScanResult>& offload_scan_results) {
+  return OffloadScanUtils::convertToNativeScanResults(offload_scan_results,
+                                                      native_scan_results_);
+}
+
 }  // namespace
 
 class ScannerTest : public ::testing::Test {
  protected:
   void SetUp() override {
-   ON_CALL(*offload_service_utils_, IsOffloadScanSupported()).WillByDefault(
-      Return(false));
-   netlink_scanner_.reset(new ScannerImpl(
-       kFakeWiphyIndex, kFakeInterfaceIndex,
-       scan_capabilities_, wiphy_features_,
-       &client_interface_impl_,
-       &netlink_utils_, &scan_utils_, offload_service_utils_));
+    ON_CALL(*offload_service_utils_, GetOffloadScanManager(_, _))
+        .WillByDefault(Return(offload_scan_manager_));
+    ON_CALL(*offload_service_utils_, GetOffloadScanCallbackInterface(_))
+        .WillByDefault(Return(offload_scan_callback_interface_));
+    dummy_scan_results_ = OffloadTestUtils::createOffloadScanResults();
   }
 
-  unique_ptr<ScannerImpl> netlink_scanner_;
+  void TearDown() override { dummy_scan_results_.clear(); }
+
+  unique_ptr<ScannerImpl> scanner_impl_;
   NiceMock<MockNetlinkManager> netlink_manager_;
   NiceMock<MockNetlinkUtils> netlink_utils_{&netlink_manager_};
   NiceMock<MockScanUtils> scan_utils_{&netlink_manager_};
@@ -108,18 +128,34 @@ class ScannerTest : public ::testing::Test {
       &if_tool_, &supplicant_manager_, &netlink_utils_, &scan_utils_};
   shared_ptr<NiceMock<MockOffloadServiceUtils>> offload_service_utils_{
       new NiceMock<MockOffloadServiceUtils>()};
+  shared_ptr<NiceMock<MockOffloadScanCallbackInterfaceImpl>>
+      offload_scan_callback_interface_{
+          new NiceMock<MockOffloadScanCallbackInterfaceImpl>(
+              scanner_impl_.get())};
+  std::shared_ptr<NiceMock<MockOffloadScanManager>> offload_scan_manager_{
+      new NiceMock<MockOffloadScanManager>(offload_service_utils_,
+                                           offload_scan_callback_interface_)};
   ScanCapabilities scan_capabilities_;
   WiphyFeatures wiphy_features_;
+  std::vector<ScanResult> dummy_scan_results_;
 };
 
 TEST_F(ScannerTest, TestSingleScan) {
   EXPECT_CALL(scan_utils_, Scan(_, _, _, _, _)).WillOnce(Return(true));
   bool success = false;
-  EXPECT_TRUE(netlink_scanner_->scan(SingleScanSettings(), &success).isOk());
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
+  EXPECT_TRUE(scanner_impl_->scan(SingleScanSettings(), &success).isOk());
   EXPECT_TRUE(success);
 }
 
 TEST_F(ScannerTest, TestSingleScanFailure) {
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
   EXPECT_CALL(
       scan_utils_,
       Scan(_, _, _, _, _)).
@@ -127,11 +163,15 @@ TEST_F(ScannerTest, TestSingleScanFailure) {
               ReturnErrorCodeForScanRequest, EBUSY, _1, _2, _3, _4, _5)));
 
   bool success = false;
-  EXPECT_TRUE(netlink_scanner_->scan(SingleScanSettings(), &success).isOk());
+  EXPECT_TRUE(scanner_impl_->scan(SingleScanSettings(), &success).isOk());
   EXPECT_FALSE(success);
 }
 
 TEST_F(ScannerTest, TestProcessAbortsOnScanReturningNoDeviceError) {
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
   ON_CALL(
       scan_utils_,
       Scan(_, _, _, _, _)).
@@ -139,47 +179,202 @@ TEST_F(ScannerTest, TestProcessAbortsOnScanReturningNoDeviceError) {
               ReturnErrorCodeForScanRequest, ENODEV, _1, _2, _3, _4, _5)));
 
   bool success_ignored;
-  EXPECT_DEATH(
-      netlink_scanner_->scan(SingleScanSettings(), &success_ignored),
-      "Driver is in a bad state*");
+  EXPECT_DEATH(scanner_impl_->scan(SingleScanSettings(), &success_ignored),
+               "Driver is in a bad state*");
 }
 
 TEST_F(ScannerTest, TestAbortScan) {
   bool single_scan_success = false;
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
   EXPECT_CALL(scan_utils_, Scan(_, _, _, _, _)).WillOnce(Return(true));
-  EXPECT_TRUE(netlink_scanner_->scan(SingleScanSettings(),
-                            &single_scan_success).isOk());
+  EXPECT_TRUE(
+      scanner_impl_->scan(SingleScanSettings(), &single_scan_success).isOk());
   EXPECT_TRUE(single_scan_success);
 
   EXPECT_CALL(scan_utils_, AbortScan(_));
-  EXPECT_TRUE(netlink_scanner_->abortScan().isOk());
+  EXPECT_TRUE(scanner_impl_->abortScan().isOk());
 }
 
 TEST_F(ScannerTest, TestAbortScanNotIssuedIfNoOngoingScan) {
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
   EXPECT_CALL(scan_utils_, AbortScan(_)).Times(0);
-  EXPECT_TRUE(netlink_scanner_->abortScan().isOk());
+  EXPECT_TRUE(scanner_impl_->abortScan().isOk());
 }
 
 TEST_F(ScannerTest, TestGetScanResults) {
   vector<NativeScanResult> scan_results;
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
   EXPECT_CALL(scan_utils_, GetScanResult(_, _)).WillOnce(Return(true));
-  EXPECT_TRUE(netlink_scanner_->getScanResults(&scan_results).isOk());
+  EXPECT_TRUE(scanner_impl_->getScanResults(&scan_results).isOk());
 }
 
 TEST_F(ScannerTest, TestStartPnoScanViaNetlink) {
   bool success = false;
+  EXPECT_CALL(*offload_service_utils_, IsOffloadScanSupported())
+      .Times(1)
+      .WillRepeatedly(Return(false));
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
   EXPECT_CALL(scan_utils_, StartScheduledScan(_, _, _, _, _, _, _, _)).
               WillOnce(Return(true));
-  EXPECT_TRUE(netlink_scanner_->startPnoScan(PnoSettings(), &success).isOk());
+  EXPECT_TRUE(scanner_impl_->startPnoScan(PnoSettings(), &success).isOk());
   EXPECT_TRUE(success);
 }
 
 TEST_F(ScannerTest, TestStopPnoScanViaNetlink) {
   bool success = false;
+  EXPECT_CALL(*offload_service_utils_, IsOffloadScanSupported())
+      .Times(1)
+      .WillRepeatedly(Return(false));
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
   // StopScheduledScan() will be called no matter if there is an ongoing
   // scheduled scan or not. This is for making the system more robust.
   EXPECT_CALL(scan_utils_, StopScheduledScan(_)).WillOnce(Return(true));
-  EXPECT_TRUE(netlink_scanner_->stopPnoScan(&success).isOk());
+  EXPECT_TRUE(scanner_impl_->stopPnoScan(&success).isOk());
+  EXPECT_TRUE(success);
+}
+
+TEST_F(ScannerTest, TestStartScanOverOffload) {
+  bool success = false;
+  EXPECT_CALL(*offload_service_utils_, IsOffloadScanSupported())
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, startScan(_, _, _, _, _, _, _))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, stopScan(_))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
+  scanner_impl_->startPnoScan(PnoSettings(), &success);
+  EXPECT_TRUE(success);
+  scanner_impl_->stopPnoScan(&success);
+  EXPECT_TRUE(success);
+}
+
+TEST_F(ScannerTest, TestStartScanOverNetlinkFallback) {
+  bool success = false;
+  ON_CALL(*offload_service_utils_, IsOffloadScanSupported())
+      .WillByDefault(Return(true));
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
+  EXPECT_CALL(*offload_scan_manager_, startScan(_, _, _, _, _, _, _))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*offload_scan_manager_, stopScan(_)).Times(0);
+  EXPECT_CALL(scan_utils_, StartScheduledScan(_, _, _, _, _, _, _, _))
+      .WillOnce(Return(true));
+  EXPECT_CALL(scan_utils_, StopScheduledScan(_)).WillOnce(Return(true));
+  EXPECT_TRUE(scanner_impl_->startPnoScan(PnoSettings(), &success).isOk());
+  EXPECT_TRUE(success == true);
+  scanner_impl_->stopPnoScan(&success);
+  EXPECT_TRUE(success);
+}
+
+TEST_F(ScannerTest, TestAsyncErrorOverOffload) {
+  bool success = false;
+  EXPECT_CALL(*offload_service_utils_, IsOffloadScanSupported())
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, startScan(_, _, _, _, _, _, _))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, stopScan(_))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
+  EXPECT_CALL(scan_utils_, StartScheduledScan(_, _, _, _, _, _, _, _))
+      .WillOnce(Return(true));
+  EXPECT_CALL(scan_utils_, StopScheduledScan(_)).WillOnce(Return(true));
+  scanner_impl_->startPnoScan(PnoSettings(), &success);
+  EXPECT_TRUE(success);
+  scanner_impl_->OnOffloadError(
+      OffloadScanCallbackInterface::AsyncErrorReason::REMOTE_FAILURE);
+  scanner_impl_->stopPnoScan(&success);
+  EXPECT_TRUE(success);
+}
+
+TEST_F(ScannerTest, TestGetScanResultsFromOffload) {
+  bool success = false;
+  EXPECT_CALL(*offload_service_utils_, IsOffloadScanSupported())
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, startScan(_, _, _, _, _, _, _))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, getScanResults(_))
+      .Times(1)
+      .WillOnce(
+          Invoke(bind(ReturnOffloadScanResults, _1, dummy_scan_results_)));
+  EXPECT_CALL(*offload_scan_manager_, stopScan(_))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
+  scanner_impl_->startPnoScan(PnoSettings(), &success);
+  EXPECT_TRUE(success);
+  scanner_impl_->OnOffloadScanResult();
+  std::vector<NativeScanResult> scan_results;
+  EXPECT_TRUE(scanner_impl_->getPnoScanResults(&scan_results).isOk());
+  EXPECT_FALSE(scan_results.empty());
+  scanner_impl_->stopPnoScan(&success);
+  EXPECT_TRUE(success);
+}
+
+TEST_F(ScannerTest, TestGetScanResultsWhenOffloadFails) {
+  bool success = false;
+  EXPECT_CALL(*offload_service_utils_, IsOffloadScanSupported())
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, startScan(_, _, _, _, _, _, _))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, stopScan(_))
+      .Times(1)
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*offload_scan_manager_, getScanResults(_)).Times(0);
+  EXPECT_CALL(scan_utils_, GetScanResult(_, _))
+      .Times(1)
+      .WillOnce(
+          Invoke(bind(ReturnNetlinkScanResults, _1, _2, dummy_scan_results_)));
+  scanner_impl_.reset(new ScannerImpl(kFakeWiphyIndex, kFakeInterfaceIndex,
+                                      scan_capabilities_, wiphy_features_,
+                                      &client_interface_impl_, &netlink_utils_,
+                                      &scan_utils_, offload_service_utils_));
+  EXPECT_CALL(scan_utils_, StartScheduledScan(_, _, _, _, _, _, _, _))
+      .WillOnce(Return(true));
+  EXPECT_CALL(scan_utils_, StopScheduledScan(_)).WillOnce(Return(true));
+  EXPECT_TRUE(scanner_impl_->startPnoScan(PnoSettings(), &success).isOk());
+  EXPECT_TRUE(success);
+  scanner_impl_->OnOffloadError(
+      OffloadScanCallbackInterface::AsyncErrorReason::REMOTE_FAILURE);
+  std::vector<NativeScanResult> scan_results;
+  EXPECT_TRUE(scanner_impl_->getPnoScanResults(&scan_results).isOk());
+  EXPECT_FALSE(scan_results.empty());
+  scanner_impl_->stopPnoScan(&success);
   EXPECT_TRUE(success);
 }