diff --git a/wifi/supplicant/1.0/ISupplicantStaIface.hal b/wifi/supplicant/1.0/ISupplicantStaIface.hal
index a68e961..868758e 100644
--- a/wifi/supplicant/1.0/ISupplicantStaIface.hal
+++ b/wifi/supplicant/1.0/ISupplicantStaIface.hal
@@ -25,6 +25,30 @@
  */
 interface ISupplicantStaIface extends ISupplicantIface {
   /**
+   * Access Network Query Protocol info ID elements
+   * for IEEE Std 802.11u-2011.
+   */
+  enum AnqpInfoId : uint32_t {
+    VENUE_NAME = 258,
+    ROAMING_CONSORTIUM = 261,
+    IP_ADDR_TYPE_AVAILABILITY = 262,
+    NAI_REALM = 263,
+    ANQP_3GPP_CELLULAR_NETWORK = 264,
+    DOMAIN_NAME = 268
+  };
+
+  /**
+   * Access Network Query Protocol subtype elements
+   * for Hotspot 2.0.
+   */
+  enum Hs20AnqpSubtypes : uint32_t {
+    OPERATOR_FRIENDLY_NAME = 2,
+    WAN_METRICS = 4,
+    CONNECTION_CAPABILITY = 5,
+    OSU_PROVIDERS_LIST = 8,
+  };
+
+  /**
    * Register for callbacks from this interface.
    *
    * These callbacks are invoked for events that are specific to this interface.
@@ -133,4 +157,40 @@
    */
   initiateTdlsTeardown(MacAddress macAddress)
       generates (SupplicantStatus status);
+
+  /**
+   * Initiate ANQP (for IEEE 802.11u Interworking/Hotspot 2.0) queries with the
+   * specified access point.
+   * The ANQP data fetched must be returned in the
+   * |ISupplicantStaIfaceCallback.onAnqpQueryDone| callback.
+   *
+   * @param macAddress MAC address of the access point.
+   * @param infoElements List of information elements to query for.
+   * @param subtypes List of HS20 subtypes to query for.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+   *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+   */
+  initiateAnqpQuery(MacAddress macAddress,
+                    vec<AnqpInfoId> infoElements,
+                    vec<Hs20AnqpSubtypes> subTypes)
+      generates (SupplicantStatus status);
+
+  /**
+   * Initiate the Hotspot 2.0 icon query with the specified accesss point.
+   * The icon data fetched must be returned in the
+   * |ISupplicantStaIfaceCallback.onHs20IconQueryDone| callback.
+   *
+   * @param macAddress MAC address of the access point.
+   * @param fileName Name of the file to request from the access point.
+   * @return status Status of the operation.
+   *         Possible status codes:
+   *         |SupplicantStatusCode.SUCCESS|,
+   *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+   *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+   */
+  initiateHs20IconQuery(MacAddress macAddress, string fileName)
+      generates (SupplicantStatus status);
 };
diff --git a/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal b/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal
index 77423ed..4717441 100644
--- a/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal
+++ b/wifi/supplicant/1.0/ISupplicantStaIfaceCallback.hal
@@ -105,6 +105,40 @@
   };
 
   /**
+   * OSU Method. Refer to section 4.8.1.3 of the Hotspot 2.0 spec.
+   */
+  enum OsuMethod : uint8_t {
+    OMA_DM = 0,
+    SOAP_XML_SPP = 1
+  };
+
+  /**
+   * ANQP data for IEEE Std 802.11u-2011.
+   * The format of the data within these elements follows the IEEE
+   * Std 802.11u-2011 standard.
+   */
+  struct AnqpData {
+    vec<uint8_t> venueName;
+    vec<uint8_t> roamingConsortium;
+    vec<uint8_t> ipAddrTypeAvailability;
+    vec<uint8_t> naiRealm;
+    vec<uint8_t> anqp3gppCellularNetwork;
+    vec<uint8_t> domainName;
+  };
+
+  /**
+   * ANQP data for Hotspot 2.0.
+   * The format of the data within these elements follows the Hotspot 2.0
+   * standard.
+   */
+  struct Hs20AnqpData {
+    vec<uint8_t> operatorFriendlyName;
+    vec<uint8_t> wanMetrics;
+    vec<uint8_t> connectionCapability;
+    vec<uint8_t> osuProvidersList;
+  };
+
+  /**
    * Used to indicate that a new network has been added.
    *
    * @param id Network ID allocated to the corresponding network.
@@ -138,4 +172,49 @@
    */
   oneway onStateChanged(
       State newState, Bssid bssid, SupplicantNetworkId id, Ssid ssid);
+
+  /**
+   * Used to indicate the result of ANQP (either for IEEE 802.11u Interworking
+   * or Hotspot 2.0) query.
+   *
+   * @param macAddress MAC address of the access point.
+   * @param data ANQP data fetched from the access point.
+   *        All the fields in this struct must be empty if the query failed.
+   * @param hs20Data ANQP data fetched from the Hotspot 2.0 access point.
+   *        All the fields in this struct must be empty if the query failed.
+   */
+  oneway onAnqpQueryDone(MacAddress macAddress,
+                         AnqpData data,
+                         Hs20AnqpData hs20Data);
+
+  /**
+   * Used to indicate the result of Hotspot 2.0 Icon query.
+   *
+   * @param macAddress MAC address of the access point.
+   * @param fileName Name of the file that was requested.
+   * @param data Icon data fetched from the access point.
+   *        Must be empty if the query failed.
+   */
+  oneway onHs20IconQueryDone(MacAddress macAddress,
+                             string fileName,
+                             vec<uint8_t> data);
+
+  /**
+   * Used to indicate a Hotspot 2.0 subscription remediation event.
+   *
+   * @param osuMethod OSU method.
+   * @param url URL of the server.
+   */
+  oneway onHs20SubscriptionRemediation(OsuMethod osuMethod, string url);
+
+  /**
+   * Used to indicate a Hotspot 2.0 imminent deauth notice.
+   * @param code Code to indicate the deauth reason.
+   *        Refer to section 3.2.1.2 of the Hotspot 2.0 spec.
+   * @param reAuthDelayInSec Delay before reauthenticating.
+   * @param url URL of the server.
+   */
+  oneway onHs20DeauthImminentNotice(uint32_t code,
+                                    uint32_t reAuthDelayInSec,
+                                    string url);
 };