diff --git a/cmds/servicemanager/service_manager.c b/cmds/servicemanager/service_manager.c
index 658454b..3eaf1eb 100644
--- a/cmds/servicemanager/service_manager.c
+++ b/cmds/servicemanager/service_manager.c
@@ -28,6 +28,7 @@
     const char *name;
 } allowed[] = {
     { AID_MEDIA, "media.audio_flinger" },
+    { AID_MEDIA, "media.log" },
     { AID_MEDIA, "media.player" },
     { AID_MEDIA, "media.camera" },
     { AID_MEDIA, "media.audio_policy" },
diff --git a/include/android/keycodes.h b/include/android/keycodes.h
index 282e729..cf38d1a 100644
--- a/include/android/keycodes.h
+++ b/include/android/keycodes.h
@@ -263,6 +263,8 @@
     AKEYCODE_RO              = 217,
     AKEYCODE_KANA            = 218,
     AKEYCODE_ASSIST          = 219,
+    AKEYCODE_BRIGHTNESS_DOWN = 220,
+    AKEYCODE_BRIGHTNESS_UP   = 221,
 
     // NOTE: If you add a new keycode here you must also add it to several other files.
     //       Refer to frameworks/base/core/java/android/view/KeyEvent.java for the full list.
diff --git a/include/media/hardware/HDCPAPI.h b/include/media/hardware/HDCPAPI.h
index 23e2bdda..147448e 100644
--- a/include/media/hardware/HDCPAPI.h
+++ b/include/media/hardware/HDCPAPI.h
@@ -22,6 +22,8 @@
 
 namespace android {
 
+// Two different kinds of modules are covered under the same HDCPModule
+// structure below, a module either implements decryption or encryption.
 struct HDCPModule {
     typedef void (*ObserverFunc)(void *cookie, int msg, int ext1, int ext2);
 
@@ -32,7 +34,8 @@
         // i.e. the HDCP session is now fully setup (AKE, Locality Check,
         // SKE and any authentication with repeaters completed) or failed.
         // ext1 should be a suitable error code (status_t), ext2 is
-        // unused.
+        // unused for ENCRYPTION and in the case of HDCP_INITIALIZATION_COMPLETE
+        // holds the local TCP port the module is listening on.
         HDCP_INITIALIZATION_COMPLETE,
         HDCP_INITIALIZATION_FAILED,
 
@@ -46,6 +49,11 @@
         HDCP_REVOKED_CONNECTION,
         HDCP_TOPOLOGY_EXECEEDED,
         HDCP_UNKNOWN_ERROR,
+
+        // DECRYPTION only: Indicates that a client has successfully connected,
+        // a secure session established and the module is ready to accept
+        // future calls to "decrypt".
+        HDCP_SESSION_ESTABLISHED,
     };
 
     // Module can call the notification function to signal completion/failure
@@ -55,24 +63,48 @@
 
     virtual ~HDCPModule() {};
 
-    // Request to setup an HDCP session with the specified host listening
-    // on the specified port.
-    virtual status_t initAsync(const char *host, unsigned port) = 0;
+    // ENCRYPTION: Request to setup an HDCP session with the host specified
+    // by addr and listening on the specified port.
+    // DECRYPTION: Request to setup an HDCP session, addr is the interface
+    // address the module should bind its socket to. port will be 0.
+    // The module will pick the port to listen on itself and report its choice
+    // in the "ext2" argument of the HDCP_INITIALIZATION_COMPLETE callback.
+    virtual status_t initAsync(const char *addr, unsigned port) = 0;
 
     // Request to shutdown the active HDCP session.
     virtual status_t shutdownAsync() = 0;
 
-    // Encrypt a data according to the HDCP spec. The data is to be
-    // encrypted in-place, only size bytes of data should be read/write,
-    // even if the size is not a multiple of 128 bit (16 bytes).
+    // ENCRYPTION only:
+    // Encrypt data according to the HDCP spec. "size" bytes of data are
+    // available at "inData" (virtual address), "size" may not be a multiple
+    // of 128 bits (16 bytes). An equal number of encrypted bytes should be
+    // written to the buffer at "outData" (virtual address).
     // This operation is to be synchronous, i.e. this call does not return
     // until outData contains size bytes of encrypted data.
     // streamCTR will be assigned by the caller (to 0 for the first PES stream,
     // 1 for the second and so on)
-    // inputCTR will be maintained by the callee for each PES stream.
+    // inputCTR _will_be_maintained_by_the_callee_ for each PES stream.
     virtual status_t encrypt(
             const void *inData, size_t size, uint32_t streamCTR,
-            uint64_t *outInputCTR, void *outData) = 0;
+            uint64_t *outInputCTR, void *outData) {
+        return INVALID_OPERATION;
+    }
+
+    // DECRYPTION only:
+    // Decrypt data according to the HDCP spec.
+    // "size" bytes of encrypted data are available at "inData"
+    // (virtual address), "size" may not be a multiple of 128 bits (16 bytes).
+    // An equal number of decrypted bytes should be written to the buffer
+    // at "outData" (virtual address).
+    // This operation is to be synchronous, i.e. this call does not return
+    // until outData contains size bytes of decrypted data.
+    // Both streamCTR and inputCTR will be provided by the caller.
+    virtual status_t decrypt(
+            const void *inData, size_t size,
+            uint32_t streamCTR, uint64_t inputCTR,
+            void *outData) {
+        return INVALID_OPERATION;
+    }
 
 private:
     HDCPModule(const HDCPModule &);
@@ -81,13 +113,18 @@
 
 }  // namespace android
 
-// A shared library exporting the following method should be included to
+// A shared library exporting the following methods should be included to
 // support HDCP functionality. The shared library must be called
 // "libstagefright_hdcp.so", it will be dynamically loaded into the
 // mediaserver process.
 extern "C" {
+    // Create a module for ENCRYPTION.
     extern android::HDCPModule *createHDCPModule(
             void *cookie, android::HDCPModule::ObserverFunc);
+
+    // Create a module for DECRYPTION.
+    extern android::HDCPModule *createHDCPModuleForDecryption(
+            void *cookie, android::HDCPModule::ObserverFunc);
 }
 
 #endif  // HDCP_API_H_
diff --git a/include/media/openmax/OMX_IVCommon.h b/include/media/openmax/OMX_IVCommon.h
index effbaae..85bf00d 100644
--- a/include/media/openmax/OMX_IVCommon.h
+++ b/include/media/openmax/OMX_IVCommon.h
@@ -160,6 +160,7 @@
     OMX_TI_COLOR_FormatYUV420PackedSemiPlanar = 0x7F000100,
     OMX_QCOM_COLOR_FormatYVU420SemiPlanar = 0x7FA30C00,
     OMX_QCOM_COLOR_FormatYUV420PackedSemiPlanar64x32Tile2m8ka = 0x7FA30C03,
+    OMX_SEC_COLOR_FormatNV12Tiled = 0x7FC00002,
     OMX_COLOR_FormatMax = 0x7FFFFFFF
 } OMX_COLOR_FORMATTYPE;
 
diff --git a/libs/ui/Fence.cpp b/libs/ui/Fence.cpp
index 84f5a47..a01ac29 100644
--- a/libs/ui/Fence.cpp
+++ b/libs/ui/Fence.cpp
@@ -100,6 +100,7 @@
         return -1;
     }
     if (finfo->status != 1) {
+        sync_fence_info_free(finfo);
         return INT64_MAX;
     }
 
diff --git a/opengl/libs/EGL/eglApi.cpp b/opengl/libs/EGL/eglApi.cpp
index d1f25e0..7a84651 100644
--- a/opengl/libs/EGL/eglApi.cpp
+++ b/opengl/libs/EGL/eglApi.cpp
@@ -761,8 +761,8 @@
 
             egl_connection_t* const cnx = &gEGLImpl;
             if (cnx->dso && cnx->egl.eglGetProcAddress) {
-                found = true;
                 // Extensions are independent of the bound context
+                addr =
                 cnx->hooks[egl_connection_t::GLESv1_INDEX]->ext.extensions[slot] =
                 cnx->hooks[egl_connection_t::GLESv2_INDEX]->ext.extensions[slot] =
 #if EGL_TRACE
@@ -770,10 +770,13 @@
                 gHooksTrace.ext.extensions[slot] =
 #endif
                         cnx->egl.eglGetProcAddress(procname);
+                if (addr) found = true;
             }
 
             if (found) {
+#if USE_FAST_TLS_KEY
                 addr = gExtensionForwarders[slot];
+#endif
                 sGLExtentionMap.add(name, addr);
                 sGLExtentionSlot++;
             }
diff --git a/services/surfaceflinger/DisplayDevice.cpp b/services/surfaceflinger/DisplayDevice.cpp
index 8cf527a..19169a5 100644
--- a/services/surfaceflinger/DisplayDevice.cpp
+++ b/services/surfaceflinger/DisplayDevice.cpp
@@ -77,6 +77,7 @@
         EGLConfig config)
     : mFlinger(flinger),
       mType(type), mHwcDisplayId(-1),
+      mDisplayToken(displayToken),
       mNativeWindow(nativeWindow),
       mFramebufferSurface(framebufferSurface),
       mDisplay(EGL_NO_DISPLAY),