diff --git a/cmds/atrace/atrace.cpp b/cmds/atrace/atrace.cpp
index 26c5b4a..9a5a81e 100644
--- a/cmds/atrace/atrace.cpp
+++ b/cmds/atrace/atrace.cpp
@@ -140,6 +140,15 @@
     { "regulators",  "Voltage and Current Regulators", 0, {
         { REQ,      "/sys/kernel/debug/tracing/events/regulator/enable" },
     } },
+    { "binder_driver", "Binder Kernel driver", 0, {
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_transaction/enable" },
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_transaction_received/enable" },
+    } },
+    { "binder_lock", "Binder global lock trace", 0, {
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_lock/enable" },
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_locked/enable" },
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_unlock/enable" },
+    } },
 };
 
 /* Command line options */
diff --git a/cmds/dumpstate/dumpstate.c b/cmds/dumpstate/dumpstate.c
index 792f015..b88b605 100644
--- a/cmds/dumpstate/dumpstate.c
+++ b/cmds/dumpstate/dumpstate.c
@@ -47,6 +47,7 @@
 
 #define PSTORE_LAST_KMSG "/sys/fs/pstore/console-ramoops"
 
+#define RAFT_DIR "/data/misc/raft/"
 #define TOMBSTONE_DIR "/data/tombstones"
 #define TOMBSTONE_FILE_PREFIX TOMBSTONE_DIR "/tombstone_"
 /* Can accomodate a tombstone number up to 9999. */
@@ -350,6 +351,8 @@
 
     run_command("LOG STATISTICS", 10, "logcat", "-b", "all", "-S", NULL);
 
+    run_command("RAFT LOGS", 600, SU_PATH, "root", "logcompressor", "-r", RAFT_DIR, NULL);
+
     /* show the traces we collected in main(), if that was done */
     if (dump_traces_path != NULL) {
         dump_file("VM TRACES JUST NOW", dump_traces_path);
diff --git a/cmds/installd/commands.cpp b/cmds/installd/commands.cpp
index d4aa7d3..c05a3d3 100644
--- a/cmds/installd/commands.cpp
+++ b/cmds/installd/commands.cpp
@@ -770,24 +770,11 @@
                                                           dex2oat_compiler_filter_flag, NULL) > 0;
 
     char dex2oat_threads_buf[PROPERTY_VALUE_MAX];
-    bool have_dex2oat_threads_flag = false;
-    if (!post_bootcomplete) {
-        have_dex2oat_threads_flag = property_get("dalvik.vm.boot-dex2oat-threads",
-                                                 dex2oat_threads_buf,
-                                                 NULL) > 0;
-        // If there's no boot property, fall back to the image property.
-        if (!have_dex2oat_threads_flag) {
-            have_dex2oat_threads_flag = property_get("dalvik.vm.image-dex2oat-threads",
-                                                     dex2oat_threads_buf,
-                                                     NULL) > 0;
-        }
-        // If there's neither, fall back to the default property.
-    }
-    if (!have_dex2oat_threads_flag) {
-        have_dex2oat_threads_flag = property_get("dalvik.vm.dex2oat-threads",
-                                                 dex2oat_threads_buf,
-                                                 NULL) > 0;
-    }
+    bool have_dex2oat_threads_flag = property_get(post_bootcomplete
+                                                      ? "dalvik.vm.dex2oat-threads"
+                                                      : "dalvik.vm.boot-dex2oat-threads",
+                                                  dex2oat_threads_buf,
+                                                  NULL) > 0;
     char dex2oat_threads_arg[PROPERTY_VALUE_MAX + 2];
     if (have_dex2oat_threads_flag) {
         sprintf(dex2oat_threads_arg, "-j%s", dex2oat_threads_buf);
diff --git a/include/android/keycodes.h b/include/android/keycodes.h
index 15bb786..421abe5 100644
--- a/include/android/keycodes.h
+++ b/include/android/keycodes.h
@@ -722,7 +722,22 @@
     AKEYCODE_NAVIGATE_PREVIOUS = 260,
     AKEYCODE_NAVIGATE_NEXT   = 261,
     AKEYCODE_NAVIGATE_IN     = 262,
-    AKEYCODE_NAVIGATE_OUT    = 263
+    AKEYCODE_NAVIGATE_OUT    = 263,
+    /** Primary stem key for Wear
+     * Main power/reset button on watch. */
+    AKEYCODE_STEM_PRIMARY = 264,
+    /** Generic stem key 1 for Wear */
+    AKEYCODE_STEM_1 = 265,
+    /** Generic stem key 2 for Wear */
+    AKEYCODE_STEM_2 = 266,
+    /** Generic stem key 3 for Wear */
+    AKEYCODE_STEM_3 = 267,
+    AKEYCODE_MEDIA_SKIP_FORWARD = 272,
+    AKEYCODE_MEDIA_SKIP_BACKWARD = 273,
+    AKEYCODE_MEDIA_STEP_FORWARD = 274,
+    AKEYCODE_MEDIA_STEP_BACKWARD = 275,
+    /** Put device to sleep unless a wakelock is held. */
+    AKEYCODE_SOFT_SLEEP = 276
 
     // NOTE: If you add a new keycode here you must also add it to several other files.
     //       Refer to frameworks/base/core/java/android/view/KeyEvent.java for the full list.
diff --git a/include/gui/SensorManager.h b/include/gui/SensorManager.h
index 0cff46c..f039caf 100644
--- a/include/gui/SensorManager.h
+++ b/include/gui/SensorManager.h
@@ -22,9 +22,11 @@
 #include <stdint.h>
 #include <sys/types.h>
 
+#include <binder/BinderService.h>
 #include <binder/IBinder.h>
 #include <binder/IPCThreadState.h>
 #include <binder/IServiceManager.h>
+#include <binder/PermissionCache.h>
 
 #include <utils/Errors.h>
 #include <utils/RefBase.h>
@@ -54,7 +56,8 @@
     static SensorManager& getInstanceForPackage(const String16& packageName);
     ~SensorManager();
 
-    ssize_t getSensorList(Sensor const* const** list) const;
+    ssize_t getSensorList(Sensor const* const** list);
+    ssize_t getAvailableSensorList(Sensor const* const** list);
     Sensor const* getDefaultSensor(int type);
     sp<SensorEventQueue> createEventQueue(String8 packageName = String8(""), int mode = 0);
     bool isDataInjectionEnabled();
@@ -64,18 +67,27 @@
     void sensorManagerDied();
 
     SensorManager(const String16& opPackageName);
-    status_t assertStateLocked() const;
+    status_t assertStateLocked();
+    void updateAvailableSensorList();
 
 private:
     static Mutex sLock;
     static std::map<String16, SensorManager*> sPackageInstances;
 
-    mutable Mutex mLock;
-    mutable sp<ISensorServer> mSensorServer;
-    mutable Sensor const** mSensorList;
-    mutable Vector<Sensor> mSensors;
-    mutable sp<IBinder::DeathRecipient> mDeathObserver;
+    Mutex mLock;
+    sp<ISensorServer> mSensorServer;
+
+    // for Java API
+    Sensor const** mSensorList;
+
+    // for NDK API
+    Sensor const** mAvailableSensorList;
+    ssize_t mNumAvailableSensor;
+
+    Vector<Sensor> mSensors;
+    sp<IBinder::DeathRecipient> mDeathObserver;
     const String16 mOpPackageName;
+    bool mBodyPermission;
 };
 
 // ----------------------------------------------------------------------------
diff --git a/include/input/InputEventLabels.h b/include/input/InputEventLabels.h
index 3962001..f0a6238 100644
--- a/include/input/InputEventLabels.h
+++ b/include/input/InputEventLabels.h
@@ -303,6 +303,15 @@
     DEFINE_KEYCODE(NAVIGATE_NEXT),
     DEFINE_KEYCODE(NAVIGATE_IN),
     DEFINE_KEYCODE(NAVIGATE_OUT),
+    DEFINE_KEYCODE(STEM_PRIMARY),
+    DEFINE_KEYCODE(STEM_1),
+    DEFINE_KEYCODE(STEM_2),
+    DEFINE_KEYCODE(STEM_3),
+    DEFINE_KEYCODE(MEDIA_SKIP_FORWARD),
+    DEFINE_KEYCODE(MEDIA_SKIP_BACKWARD),
+    DEFINE_KEYCODE(MEDIA_STEP_FORWARD),
+    DEFINE_KEYCODE(MEDIA_STEP_BACKWARD),
+    DEFINE_KEYCODE(SOFT_SLEEP),
 
     { NULL, 0 }
 };
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 22d7ef3..1429a5c 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -17,40 +17,42 @@
 #define LOG_TAG "Parcel"
 //#define LOG_NDEBUG 0
 
-#include <binder/Parcel.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
 
-#include <binder/IPCThreadState.h>
 #include <binder/Binder.h>
 #include <binder/BpBinder.h>
+#include <binder/IPCThreadState.h>
+#include <binder/Parcel.h>
 #include <binder/ProcessState.h>
 #include <binder/TextOutput.h>
 
-#include <errno.h>
+#include <cutils/ashmem.h>
 #include <utils/Debug.h>
+#include <utils/Flattenable.h>
 #include <utils/Log.h>
+#include <utils/misc.h>
 #include <utils/String8.h>
 #include <utils/String16.h>
-#include <utils/misc.h>
-#include <utils/Flattenable.h>
-#include <cutils/ashmem.h>
 
 #include <private/binder/binder_module.h>
 #include <private/binder/Static.h>
 
-#include <inttypes.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <sys/mman.h>
-
 #ifndef INT32_MAX
 #define INT32_MAX ((int32_t)(2147483647))
 #endif
 
 #define LOG_REFS(...)
-//#define LOG_REFS(...) ALOG(LOG_DEBUG, "Parcel", __VA_ARGS__)
+//#define LOG_REFS(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
 #define LOG_ALLOC(...)
-//#define LOG_ALLOC(...) ALOG(LOG_DEBUG, "Parcel", __VA_ARGS__)
+//#define LOG_ALLOC(...) ALOG(LOG_DEBUG, LOG_TAG, __VA_ARGS__)
 
 // ---------------------------------------------------------------------------
 
@@ -123,8 +125,10 @@
             return;
         }
         case BINDER_TYPE_FD: {
-            if (obj.cookie != 0) {
-                if (outAshmemSize != NULL) {
+            if ((obj.cookie != 0) && (outAshmemSize != NULL)) {
+                struct stat st;
+                int ret = fstat(obj.handle, &st);
+                if (!ret && S_ISCHR(st.st_mode)) {
                     // If we own an ashmem fd, keep track of how much memory it refers to.
                     int size = ashmem_get_size_region(obj.handle);
                     if (size > 0) {
@@ -173,15 +177,19 @@
             return;
         }
         case BINDER_TYPE_FD: {
-            if (outAshmemSize != NULL) {
-                if (obj.cookie != 0) {
-                    int size = ashmem_get_size_region(obj.handle);
-                    if (size > 0) {
-                        *outAshmemSize -= size;
+            if (obj.cookie != 0) { // owned
+                if (outAshmemSize != NULL) {
+                    struct stat st;
+                    int ret = fstat(obj.handle, &st);
+                    if (!ret && S_ISCHR(st.st_mode)) {
+                        int size = ashmem_get_size_region(obj.handle);
+                        if (size > 0) {
+                            *outAshmemSize -= size;
+                        }
                     }
-
-                    close(obj.handle);
                 }
+
+                close(obj.handle);
             }
             return;
         }
diff --git a/libs/gui/SensorManager.cpp b/libs/gui/SensorManager.cpp
index 33608b5..4277032 100644
--- a/libs/gui/SensorManager.cpp
+++ b/libs/gui/SensorManager.cpp
@@ -89,7 +89,8 @@
 }
 
 SensorManager::SensorManager(const String16& opPackageName)
-    : mSensorList(0), mOpPackageName(opPackageName)
+    : mSensorList(NULL), mAvailableSensorList(NULL), mNumAvailableSensor(0),
+      mOpPackageName(opPackageName), mBodyPermission(false)
 {
     // okay we're not locked here, but it's not needed during construction
     assertStateLocked();
@@ -98,6 +99,9 @@
 SensorManager::~SensorManager()
 {
     free(mSensorList);
+    if (mAvailableSensorList) {
+        free(mAvailableSensorList);
+    }
 }
 
 void SensorManager::sensorManagerDied()
@@ -106,10 +110,14 @@
     mSensorServer.clear();
     free(mSensorList);
     mSensorList = NULL;
+    if (mAvailableSensorList) {
+        free(mAvailableSensorList);
+        mAvailableSensorList = NULL;
+    }
     mSensors.clear();
 }
 
-status_t SensorManager::assertStateLocked() const {
+status_t SensorManager::assertStateLocked() {
     bool initSensorManager = false;
     if (mSensorServer == NULL) {
         initSensorManager = true;
@@ -159,13 +167,14 @@
         for (size_t i=0 ; i<count ; i++) {
             mSensorList[i] = mSensors.array() + i;
         }
+
+        updateAvailableSensorList();
     }
 
     return NO_ERROR;
 }
 
-ssize_t SensorManager::getSensorList(Sensor const* const** list) const
-{
+ssize_t SensorManager::getSensorList(Sensor const* const** list) {
     Mutex::Autolock _l(mLock);
     status_t err = assertStateLocked();
     if (err < 0) {
@@ -175,10 +184,76 @@
     return static_cast<ssize_t>(mSensors.size());
 }
 
-Sensor const* SensorManager::getDefaultSensor(int type)
-{
+void SensorManager::updateAvailableSensorList() {
+    const int uid = static_cast<int>(IPCThreadState::self()->getCallingUid());
+    const int pid = static_cast<int>(IPCThreadState::self()->getCallingPid());
+    const String16 BODY_SENSOR_PERMISSION("android.permission.BODY_SENSORS");
+    const String8 BODY_SENSOR_PERMISSION8("android.permission.BODY_SENSORS");
+
+    bool bodySensorPermission = false;
+
+    sp<IBinder> binder = defaultServiceManager()->getService(String16("permission"));
+    if (binder != NULL) {
+        bodySensorPermission = interface_cast<IPermissionController>(binder)->
+                checkPermission(BODY_SENSOR_PERMISSION, pid, uid);
+    }
+
+    // only update if app got BODY_SENSORS permission after last call or the sensor list has not
+    // been populated.
+    //
+    // it is not possible for the reverse transition, as the app will be killed when permission is
+    // revoked.
+    if ( (bodySensorPermission && !mBodyPermission) || mAvailableSensorList == NULL) {
+
+        // allocate only when necessary
+        if (mAvailableSensorList == NULL) {
+            // allocate a list big enough to fit all sensors (including those requires permission
+            // that the app do not have;
+            mAvailableSensorList =
+                    static_cast<Sensor const**>(malloc(mSensors.size() * sizeof(Sensor*)));
+
+            // first populate all sensors that do not need body sensor permission
+            ssize_t& n = mNumAvailableSensor;
+            for (size_t i = 0; i < mSensors.size() ; i++) {
+                if (mSensors[i].getRequiredPermission() != BODY_SENSOR_PERMISSION8) {
+                    mAvailableSensorList[n++] = mSensors.array() + i;
+                }
+            }
+        }
+
+        if (bodySensorPermission) {
+            // if the app just got the sensor permission back, fill the sensor at the end of list
+            ssize_t& n = mNumAvailableSensor;
+            for (size_t i = 0; i < mSensors.size() ; i++) {
+                if (mSensors[i].getRequiredPermission() == BODY_SENSOR_PERMISSION8) {
+                    mAvailableSensorList[n++] = mSensors.array() + i;
+                }
+            }
+        }
+
+        mBodyPermission = bodySensorPermission;
+    }
+}
+
+ssize_t SensorManager::getAvailableSensorList(Sensor const* const** list) {
+    Mutex::Autolock _l(mLock);
+    status_t err = assertStateLocked();
+    if (err < 0) {
+        return static_cast<ssize_t>(err);
+    }
+
+    updateAvailableSensorList();
+
+    *list = mAvailableSensorList;
+    return mNumAvailableSensor;
+}
+
+Sensor const* SensorManager::getDefaultSensor(int type) {
     Mutex::Autolock _l(mLock);
     if (assertStateLocked() == NO_ERROR) {
+
+        updateAvailableSensorList();
+
         bool wakeUpSensor = false;
         // For the following sensor types, return a wake-up sensor. These types are by default
         // defined as wake-up sensors. For the rest of the sensor types defined in sensors.h return
@@ -192,9 +267,9 @@
         // in the future it will make sense to let the SensorService make
         // that decision.
         for (size_t i=0 ; i<mSensors.size() ; i++) {
-            if (mSensorList[i]->getType() == type &&
-                mSensorList[i]->isWakeUpSensor() == wakeUpSensor) {
-                return mSensorList[i];
+            if (mAvailableSensorList[i]->getType() == type &&
+                mAvailableSensorList[i]->isWakeUpSensor() == wakeUpSensor) {
+                return mAvailableSensorList[i];
             }
         }
     }
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index fd72b23..fc54383 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -723,14 +723,7 @@
     Vector<Sensor> accessibleSensorList;
     for (size_t i = 0; i < initialSensorList.size(); i++) {
         Sensor sensor = initialSensorList[i];
-        if (canAccessSensor(sensor, "getSensorList", opPackageName)) {
-            accessibleSensorList.add(sensor);
-        } else {
-            ALOGI("Skipped sensor %s because it requires permission %s and app op %d",
-                  sensor.getName().string(),
-                  sensor.getRequiredPermission().string(),
-                  sensor.getRequiredAppOp());
-        }
+        accessibleSensorList.add(sensor);
     }
     return accessibleSensorList;
 }
@@ -1166,6 +1159,9 @@
 }
 
 int SensorService::getNumEventsForSensorType(int sensor_event_type) {
+    if (sensor_event_type >= SENSOR_TYPE_DEVICE_PRIVATE_BASE) {
+        return 16;
+    }
     switch (sensor_event_type) {
         case SENSOR_TYPE_ROTATION_VECTOR:
         case SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR: