diff --git a/cmds/dumpstate/dumpstate.cpp b/cmds/dumpstate/dumpstate.cpp
index 258a99f..513e295 100644
--- a/cmds/dumpstate/dumpstate.cpp
+++ b/cmds/dumpstate/dumpstate.cpp
@@ -357,6 +357,8 @@
 
 /* adds a new entry to the existing zip file. */
 static bool add_zip_entry_from_fd(const std::string& entry_name, int fd) {
+    DurationReporter duration_reporter(("ADD ZIP ENTRY " + entry_name).c_str());
+    ALOGD("Adding zip entry %s", entry_name.c_str());
     int32_t err = zip_writer->StartEntryWithTime(entry_name.c_str(),
             ZipWriter::kCompress, get_mtime(fd, now));
     if (err) {
@@ -364,8 +366,8 @@
         return false;
     }
 
+    std::vector<uint8_t> buffer(65536);
     while (1) {
-        std::vector<uint8_t> buffer(65536);
         ssize_t bytes_read = TEMP_FAILURE_RETRY(read(fd, buffer.data(), sizeof(buffer)));
         if (bytes_read == 0) {
             break;
@@ -413,7 +415,7 @@
 }
 
 static void dumpstate(const std::string& screenshot_path) {
-    std::unique_ptr<DurationReporter> duration_reporter(new DurationReporter("DUMPSTATE"));
+    DurationReporter duration_reporter("DUMPSTATE");
     unsigned long timeout;
 
     dump_dev_files("TRUSTY VERSION", "/sys/bus/platform/drivers/trusty", "trusty_version");
@@ -466,12 +468,11 @@
                                                         "-v", "printable",
                                                         "-d",
                                                         "*:v", NULL);
-    timeout = logcat_timeout("events") + logcat_timeout("security");
+    timeout = logcat_timeout("events");
     if (timeout < 20000) {
         timeout = 20000;
     }
     run_command("EVENT LOG", timeout / 1000, "logcat", "-b", "events",
-                                                       "-b", "security",
                                                        "-v", "threadtime",
                                                        "-v", "printable",
                                                        "-d",
@@ -951,6 +952,13 @@
         }
     }
 
+    /* read /proc/cmdline before dropping root */
+    FILE *cmdline = fopen("/proc/cmdline", "re");
+    if (cmdline) {
+        fgets(cmdline_buf, sizeof(cmdline_buf), cmdline);
+        fclose(cmdline);
+    }
+
     print_header();
 
     /* open the vibrator before dropping root */
@@ -983,13 +991,6 @@
         }
     }
 
-    /* read /proc/cmdline before dropping root */
-    FILE *cmdline = fopen("/proc/cmdline", "re");
-    if (cmdline) {
-        fgets(cmdline_buf, sizeof(cmdline_buf), cmdline);
-        fclose(cmdline);
-    }
-
     /* collect stack traces from Dalvik and native processes (needs root) */
     dump_traces_path = dump_traces();
 
diff --git a/cmds/dumpstate/utils.cpp b/cmds/dumpstate/utils.cpp
index e49d766..c043adc 100644
--- a/cmds/dumpstate/utils.cpp
+++ b/cmds/dumpstate/utils.cpp
@@ -566,7 +566,6 @@
     } else if (WIFEXITED(status) && WEXITSTATUS(status) > 0) {
         printf("*** %s: Exit code %d\n", command, WEXITSTATUS(status));
     }
-    if (title) printf("[%s: %.3fs elapsed]\n\n", command, (float)elapsed / NANOS_PER_SEC);
 
     if (weight > 0) {
         update_progress(weight);
diff --git a/include/android/choreographer.h b/include/android/choreographer.h
index 0239e2f..02c83dc 100644
--- a/include/android/choreographer.h
+++ b/include/android/choreographer.h
@@ -26,6 +26,8 @@
 #ifndef ANDROID_CHOREOGRAPHER_H
 #define ANDROID_CHOREOGRAPHER_H
 
+#include <sys/cdefs.h>
+
 __BEGIN_DECLS
 
 struct AChoreographer;
diff --git a/include/hardware_properties/HardwarePropertiesManager.h b/include/hardware_properties/HardwarePropertiesManager.h
new file mode 100644
index 0000000..13f2b99
--- /dev/null
+++ b/include/hardware_properties/HardwarePropertiesManager.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWAREPROPERTIESMANAGER_H
+#define ANDROID_HARDWAREPROPERTIESMANAGER_H
+
+namespace android {
+
+// must be kept in sync with definitions in HardwarePropertiesManager.java
+enum {
+    DEVICE_TEMPERATURE_CPU = 0,
+    DEVICE_TEMPERATURE_GPU = 1,
+    DEVICE_TEMPERATURE_BATTERY = 2,
+};
+
+}; // namespace android
+
+#endif // ANDROID_HARDWAREPROPERTIESMANAGER_H
diff --git a/include/media/openmax/OMX_VideoExt.h b/include/media/openmax/OMX_VideoExt.h
index 3971bc5..be27381 100644
--- a/include/media/openmax/OMX_VideoExt.h
+++ b/include/media/openmax/OMX_VideoExt.h
@@ -75,6 +75,36 @@
     OMX_VIDEO_VP8LevelMax = 0x7FFFFFFF
 } OMX_VIDEO_VP8LEVELTYPE;
 
+/** VP9 profiles */
+typedef enum OMX_VIDEO_VP9PROFILETYPE {
+    OMX_VIDEO_VP9Profile0 = 0x0,
+    OMX_VIDEO_VP9Profile1 = 0x1,
+    OMX_VIDEO_VP9Profile2 = 0x2,
+    OMX_VIDEO_VP9Profile3 = 0x3,
+    OMX_VIDEO_VP9ProfileUnknown = 0x6EFFFFFF,
+    OMX_VIDEO_VP9ProfileMax = 0x7FFFFFFF
+} OMX_VIDEO_VP9PROFILETYPE;
+
+/** VP9 levels */
+typedef enum OMX_VIDEO_VP9LEVELTYPE {
+    OMX_VIDEO_VP9Level1  = 0x0,
+    OMX_VIDEO_VP9Level11 = 0x1,
+    OMX_VIDEO_VP9Level2  = 0x2,
+    OMX_VIDEO_VP9Level21 = 0x4,
+    OMX_VIDEO_VP9Level3  = 0x8,
+    OMX_VIDEO_VP9Level31 = 0x10,
+    OMX_VIDEO_VP9Level4  = 0x20,
+    OMX_VIDEO_VP9Level41 = 0x40,
+    OMX_VIDEO_VP9Level5  = 0x80,
+    OMX_VIDEO_VP9Level51 = 0x100,
+    OMX_VIDEO_VP9Level52 = 0x200,
+    OMX_VIDEO_VP9Level6  = 0x400,
+    OMX_VIDEO_VP9Level61 = 0x800,
+    OMX_VIDEO_VP9Level62 = 0x1000,
+    OMX_VIDEO_VP9LevelUnknown = 0x6EFFFFFF,
+    OMX_VIDEO_VP9LevelMax = 0x7FFFFFFF
+} OMX_VIDEO_VP9LEVELTYPE;
+
 /** VP8 Param */
 typedef struct OMX_VIDEO_PARAM_VP8TYPE {
     OMX_U32 nSize;
@@ -185,13 +215,14 @@
     OMX_VIDEO_HEVCHighTiermax     = 0x7FFFFFFF
 } OMX_VIDEO_HEVCLEVELTYPE;
 
-/** Structure for controlling HEVC video encoding and decoding */
+/** Structure for controlling HEVC video encoding */
 typedef struct OMX_VIDEO_PARAM_HEVCTYPE {
     OMX_U32 nSize;
     OMX_VERSIONTYPE nVersion;
     OMX_U32 nPortIndex;
     OMX_VIDEO_HEVCPROFILETYPE eProfile;
     OMX_VIDEO_HEVCLEVELTYPE eLevel;
+    OMX_U32 nKeyFrameInterval;
 } OMX_VIDEO_PARAM_HEVCTYPE;
 
 /** Structure to define if dependent slice segments should be used */
diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index 56f1a09..5b1aaa0 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -629,7 +629,7 @@
     }
 
     if (mCore->mSingleBufferMode) {
-        BQ_LOGE("attachBuffer: cannot atach a buffer in single buffer mode");
+        BQ_LOGE("attachBuffer: cannot attach a buffer in single buffer mode");
         return BAD_VALUE;
     }
 
diff --git a/opengl/include/EGL/eglext.h b/opengl/include/EGL/eglext.h
index b2abdb1..267f8af 100644
--- a/opengl/include/EGL/eglext.h
+++ b/opengl/include/EGL/eglext.h
@@ -598,6 +598,19 @@
 #endif
 #endif
 
+#ifndef EGL_ANDROID_create_native_client_buffer
+#define EGL_ANDROID_create_native_client_buffer 1
+#define EGL_NATIVE_BUFFER_USAGE_ANDROID   0x3143
+#define EGL_NATIVE_BUFFER_USAGE_PROTECTED_BIT_ANDROID   0x00000001
+#define EGL_NATIVE_BUFFER_USAGE_RENDERBUFFER_ANDROID   0x00000002
+#define EGL_NATIVE_BUFFER_USAGE_TEXTURE_ANDROID   0x00000004
+#ifdef EGL_EGLEXT_PROTOTYPES
+EGLAPI EGLClientBuffer eglCreateNativeClientBufferANDROID (const EGLint *attrib_list);
+#else
+typedef EGLAPI EGLClientBuffer (EGLAPIENTRYP PFNEGLCREATENATIVECLIENTBUFFERANDROID) (const EGLint *attrib_list);
+#endif
+#endif
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/opengl/libs/Android.mk b/opengl/libs/Android.mk
index 3f9e332..eb86860 100644
--- a/opengl/libs/Android.mk
+++ b/opengl/libs/Android.mk
@@ -31,7 +31,7 @@
 	EGL/Loader.cpp 	       \
 #
 
-LOCAL_SHARED_LIBRARIES += libcutils libutils liblog
+LOCAL_SHARED_LIBRARIES += libcutils libutils liblog libui
 LOCAL_MODULE:= libEGL
 LOCAL_LDFLAGS += -Wl,--exclude-libs=ALL
 LOCAL_SHARED_LIBRARIES += libdl
diff --git a/opengl/libs/EGL/eglApi.cpp b/opengl/libs/EGL/eglApi.cpp
index 5bd7464..c7e2afb 100644
--- a/opengl/libs/EGL/eglApi.cpp
+++ b/opengl/libs/EGL/eglApi.cpp
@@ -33,6 +33,8 @@
 #include <cutils/properties.h>
 #include <cutils/memory.h>
 
+#include <ui/GraphicBuffer.h>
+
 #include <utils/KeyedVector.h>
 #include <utils/SortedVector.h>
 #include <utils/String8.h>
@@ -80,6 +82,7 @@
         "EGL_KHR_get_all_proc_addresses "
         "EGL_ANDROID_presentation_time "
         "EGL_KHR_swap_buffers_with_damage "
+        "EGL_ANDROID_create_native_client_buffer "
         ;
 extern char const * const gExtensionString  =
         "EGL_KHR_image "                        // mandatory
@@ -168,6 +171,10 @@
     { "eglSwapBuffersWithDamageKHR",
             (__eglMustCastToProperFunctionPointerType)&eglSwapBuffersWithDamageKHR },
 
+    // EGL_ANDROID_native_client_buffer
+    { "eglCreateNativeClientBufferANDROID",
+            (__eglMustCastToProperFunctionPointerType)&eglCreateNativeClientBufferANDROID },
+
     // EGL_KHR_partial_update
     { "eglSetDamageRegionKHR",
             (__eglMustCastToProperFunctionPointerType)&eglSetDamageRegionKHR },
@@ -1770,6 +1777,97 @@
     return EGL_TRUE;
 }
 
+EGLClientBuffer eglCreateNativeClientBufferANDROID(const EGLint *attrib_list)
+{
+    clearError();
+
+    int usage = 0;
+    uint32_t width = 0;
+    uint32_t height = 0;
+    uint32_t format = 0;
+    uint32_t red_size = 0;
+    uint32_t green_size = 0;
+    uint32_t blue_size = 0;
+    uint32_t alpha_size = 0;
+
+#define GET_POSITIVE_VALUE(case_name, target) \
+    case case_name: \
+        if (value > 0) { \
+            target = value; \
+        } else { \
+            return setError(EGL_BAD_PARAMETER, (EGLClientBuffer)0); \
+        } \
+        break
+
+    if (attrib_list) {
+        while (*attrib_list != EGL_NONE) {
+            GLint attr = *attrib_list++;
+            GLint value = *attrib_list++;
+            switch (attr) {
+                GET_POSITIVE_VALUE(EGL_WIDTH, width);
+                GET_POSITIVE_VALUE(EGL_HEIGHT, height);
+                GET_POSITIVE_VALUE(EGL_RED_SIZE, red_size);
+                GET_POSITIVE_VALUE(EGL_GREEN_SIZE, green_size);
+                GET_POSITIVE_VALUE(EGL_BLUE_SIZE, blue_size);
+                GET_POSITIVE_VALUE(EGL_ALPHA_SIZE, alpha_size);
+                case EGL_NATIVE_BUFFER_USAGE_ANDROID:
+                    if (value & EGL_NATIVE_BUFFER_USAGE_PROTECTED_BIT_ANDROID) {
+                        usage |= GRALLOC_USAGE_PROTECTED;
+                        // If we are using QCOM then add in extra bits.  This
+                        // should be removed before launch. These correspond to:
+                        // USAGE_PRIVATE_MM_HEAP | USAGE_PRIVATE_UNCACHED
+                        usage |= 0x82000000;
+                    }
+                    if (value & EGL_NATIVE_BUFFER_USAGE_RENDERBUFFER_ANDROID) {
+                        usage |= GRALLOC_USAGE_HW_RENDER;
+                    }
+                    if (value & EGL_NATIVE_BUFFER_USAGE_TEXTURE_ANDROID) {
+                        usage |= GRALLOC_USAGE_HW_TEXTURE;
+                    }
+                    // The buffer must be used for either a texture or a
+                    // renderbuffer.
+                    if ((value & EGL_NATIVE_BUFFER_USAGE_RENDERBUFFER_ANDROID) &&
+                        (value & EGL_NATIVE_BUFFER_USAGE_TEXTURE_ANDROID)) {
+                        return setError(EGL_BAD_PARAMETER, (EGLClientBuffer)0);
+                    }
+                    break;
+                default:
+                    return setError(EGL_BAD_PARAMETER, (EGLClientBuffer)0);
+            }
+        }
+    }
+#undef GET_POSITIVE_VALUE
+
+    // Validate format.
+    if (red_size == 8 && green_size == 8 && blue_size == 8) {
+        if (alpha_size == 8) {
+            format = HAL_PIXEL_FORMAT_RGBA_8888;
+        } else {
+            format = HAL_PIXEL_FORMAT_RGB_888;
+        }
+    } else if (red_size == 5 && green_size == 6 && blue_size == 5 &&
+               alpha_size == 0) {
+        format == HAL_PIXEL_FORMAT_RGB_565;
+    } else {
+        ALOGE("Invalid native pixel format { r=%d, g=%d, b=%d, a=%d }",
+                red_size, green_size, blue_size, alpha_size);
+        return setError(EGL_BAD_PARAMETER, (EGLClientBuffer)0);
+    }
+
+    GraphicBuffer* gBuffer = new GraphicBuffer(width, height, format, usage);
+    const status_t err = gBuffer->initCheck();
+    if (err != NO_ERROR) {
+        ALOGE("Unable to create native buffer { w=%d, h=%d, f=%d, u=%#x }: %#x",
+                width, height, format, usage, err);
+        // Destroy the buffer.
+        sp<GraphicBuffer> holder(gBuffer);
+        return setError(EGL_BAD_ALLOC, (EGLClientBuffer)0);
+    }
+    ALOGD("Created new native buffer %p { w=%d, h=%d, f=%d, u=%#x }",
+            gBuffer, width, height, format, usage);
+    return static_cast<EGLClientBuffer>(gBuffer->getNativeBuffer());
+}
+
 // ----------------------------------------------------------------------------
 // NVIDIA extensions
 // ----------------------------------------------------------------------------
diff --git a/opengl/libs/EGL/egl_entries.in b/opengl/libs/EGL/egl_entries.in
index 498b2fc..2b56718 100644
--- a/opengl/libs/EGL/egl_entries.in
+++ b/opengl/libs/EGL/egl_entries.in
@@ -80,6 +80,7 @@
 EGL_ENTRY(EGLBoolean, eglSetSwapRectangleANDROID, EGLDisplay, EGLSurface, EGLint, EGLint, EGLint, EGLint)
 EGL_ENTRY(EGLClientBuffer, eglGetRenderBufferANDROID, EGLDisplay, EGLSurface)
 EGL_ENTRY(EGLint, eglDupNativeFenceFDANDROID, EGLDisplay, EGLSyncKHR)
+EGL_ENTRY(EGLClientBuffer, eglCreateNativeClientBufferANDROID, const EGLint *)
 
 /* NVIDIA extensions */