diff --git a/include/hardware/bluetooth.h b/include/hardware/bluetooth.h
index ef21361..68cbd1e 100644
--- a/include/hardware/bluetooth.h
+++ b/include/hardware/bluetooth.h
@@ -548,6 +548,17 @@
      */
     int (*config_clear)(void);
 
+    /**
+     * Clear (reset) the dynamic portion of the device interoperability database.
+     */
+    void (*interop_database_clear)(void);
+
+    /**
+     * Add a new device interoperability workaround for a remote device whose
+     * first |len| bytes of the its device address match |addr|.
+     * NOTE: |feature| has to match an item defined in interop_feature_t (interop.h).
+     */
+    void (*interop_database_add)(uint16_t feature, const bt_bdaddr_t *addr, size_t len);
 } bt_interface_t;
 
 /** TODO: Need to add APIs for Service Discovery, Service authorization and
diff --git a/include/hardware/hwcomposer_defs.h b/include/hardware/hwcomposer_defs.h
index e650bd2..a19a26c 100644
--- a/include/hardware/hwcomposer_defs.h
+++ b/include/hardware/hwcomposer_defs.h
@@ -192,6 +192,10 @@
      */
     HWC_DISPLAY_DPI_X                       = 4,
     HWC_DISPLAY_DPI_Y                       = 5,
+
+    /* Indicates which of the vendor-defined color transforms is provided by
+     * this configuration. */
+    HWC_DISPLAY_COLOR_TRANSFORM             = 6,
 };
 
 /* Allowed events for hwc_methods::eventControl() */
diff --git a/include/hardware/power.h b/include/hardware/power.h
index af7799e..10612f3 100644
--- a/include/hardware/power.h
+++ b/include/hardware/power.h
@@ -116,7 +116,8 @@
      *     User is interacting with the device, for example, touchscreen
      *     events are incoming.  CPU and GPU load may be expected soon,
      *     and it may be appropriate to raise speeds of CPU, memory bus,
-     *     etc.  The data parameter is unused.
+     *     etc.  The data parameter is the estimated length of the interaction
+     *     in milliseconds, or 0 if unknown.
      *
      * POWER_HINT_LOW_POWER
      *
diff --git a/include/hardware/sensors.h b/include/hardware/sensors.h
index b368ee6..51bffe1 100644
--- a/include/hardware/sensors.h
+++ b/include/hardware/sensors.h
@@ -147,7 +147,7 @@
      * Counter sensors can be set with this flag and SensorService will inject accelerometer data
      * and read the corresponding step counts.
      */
-    SENSOR_FLAG_SUPPORTS_DATA_INJECTION = 0x8  // 1000
+    SENSOR_FLAG_SUPPORTS_DATA_INJECTION = 0x10  // 1 0000
 };
 
 /*
diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index 20c0fab..ed3d311 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -179,7 +179,8 @@
     struct submix_audio_device *dev;
     int route_handle;
     bool output_standby;
-    uint64_t write_counter_frames;
+    uint64_t frames_written;
+    uint64_t frames_written_since_standby;
 #if LOG_STREAMS_TO_FILES
     int log_fd;
 #endif // LOG_STREAMS_TO_FILES
@@ -700,7 +701,7 @@
     pthread_mutex_lock(&rsxadev->lock);
 
     out->output_standby = true;
-    out->write_counter_frames = 0;
+    out->frames_written_since_standby = 0;
 
     pthread_mutex_unlock(&rsxadev->lock);
 
@@ -855,7 +856,8 @@
     pthread_mutex_lock(&rsxadev->lock);
     sink.clear();
     if (written_frames > 0) {
-        out->write_counter_frames += written_frames;
+        out->frames_written_since_standby += written_frames;
+        out->frames_written += written_frames;
     }
     pthread_mutex_unlock(&rsxadev->lock);
 
@@ -871,30 +873,31 @@
 static int out_get_presentation_position(const struct audio_stream_out *stream,
                                    uint64_t *frames, struct timespec *timestamp)
 {
-    const submix_stream_out * out = reinterpret_cast<const struct submix_stream_out *>
-            (reinterpret_cast<const uint8_t *>(stream) -
-                    offsetof(struct submix_stream_out, stream));
-    struct submix_audio_device * const rsxadev = out->dev;
-    int ret = 0;
-
-    pthread_mutex_lock(&rsxadev->lock);
-
-    if (frames) {
-        const ssize_t frames_in_pipe =
-                rsxadev->routes[out->route_handle].rsxSource->availableToRead();
-        if (CC_UNLIKELY(frames_in_pipe < 0)) {
-            *frames = out->write_counter_frames;
-        } else {
-            *frames = out->write_counter_frames > (uint64_t) frames_in_pipe ?
-                    out->write_counter_frames - frames_in_pipe : 0;
-        }
+    if (stream == NULL || frames == NULL || timestamp == NULL) {
+        return -EINVAL;
     }
-    if (timestamp) {
+
+    const submix_stream_out *out = audio_stream_out_get_submix_stream_out(
+            const_cast<struct audio_stream_out *>(stream));
+    struct submix_audio_device * const rsxadev = out->dev;
+
+    int ret = -EWOULDBLOCK;
+    pthread_mutex_lock(&rsxadev->lock);
+    const ssize_t frames_in_pipe =
+            rsxadev->routes[out->route_handle].rsxSource->availableToRead();
+    if (CC_UNLIKELY(frames_in_pipe < 0)) {
+        *frames = out->frames_written;
+        ret = 0;
+    } else if (out->frames_written >= (uint64_t)frames_in_pipe) {
+        *frames = out->frames_written - frames_in_pipe;
+        ret = 0;
+    }
+    pthread_mutex_unlock(&rsxadev->lock);
+
+    if (ret == 0) {
         clock_gettime(CLOCK_MONOTONIC, timestamp);
     }
 
-    pthread_mutex_unlock(&rsxadev->lock);
-
     SUBMIX_ALOGV("out_get_presentation_position() got frames=%llu timestamp sec=%llu",
             frames ? *frames : -1, timestamp ? timestamp->tv_sec : -1);
 
@@ -904,15 +907,26 @@
 static int out_get_render_position(const struct audio_stream_out *stream,
                                    uint32_t *dsp_frames)
 {
-    if (!dsp_frames) {
+    if (stream == NULL || dsp_frames == NULL) {
         return -EINVAL;
     }
-    uint64_t frames = 0;
-    int ret = out_get_presentation_position(stream, &frames, NULL);
-    if ((ret == 0) && dsp_frames) {
-        *dsp_frames = (uint32_t) frames;
+
+    const submix_stream_out *out = audio_stream_out_get_submix_stream_out(
+            const_cast<struct audio_stream_out *>(stream));
+    struct submix_audio_device * const rsxadev = out->dev;
+
+    pthread_mutex_lock(&rsxadev->lock);
+    const ssize_t frames_in_pipe =
+            rsxadev->routes[out->route_handle].rsxSource->availableToRead();
+    if (CC_UNLIKELY(frames_in_pipe < 0)) {
+        *dsp_frames = (uint32_t)out->frames_written_since_standby;
+    } else {
+        *dsp_frames = out->frames_written_since_standby > (uint64_t) frames_in_pipe ?
+                (uint32_t)(out->frames_written_since_standby - frames_in_pipe) : 0;
     }
-    return ret;
+    pthread_mutex_unlock(&rsxadev->lock);
+
+    return 0;
 }
 
 static int out_add_audio_effect(const struct audio_stream *stream, effect_handle_t effect)
@@ -1381,8 +1395,6 @@
     out->stream.get_next_write_timestamp = out_get_next_write_timestamp;
     out->stream.get_presentation_position = out_get_presentation_position;
 
-    out->write_counter_frames = 0;
-
 #if ENABLE_RESAMPLING
     // Recreate the pipe with the correct sample rate so that MonoPipe.write() rate limits
     // writes correctly.