diff --git a/include/hardware/keymaster_defs.h b/include/hardware/keymaster_defs.h
index 5be956d..bf09e23 100644
--- a/include/hardware/keymaster_defs.h
+++ b/include/hardware/keymaster_defs.h
@@ -52,18 +52,22 @@
      */
 
     /* Crypto parameters */
-    KM_TAG_PURPOSE = KM_ENUM_REP | 1,     /* keymaster_purpose_t. */
-    KM_TAG_ALGORITHM = KM_ENUM | 2,       /* keymaster_algorithm_t. */
-    KM_TAG_KEY_SIZE = KM_UINT | 3,        /* Key size in bits. */
-    KM_TAG_BLOCK_MODE = KM_ENUM_REP | 4,  /* keymaster_block_mode_t. */
-    KM_TAG_DIGEST = KM_ENUM_REP | 5,      /* keymaster_digest_t. */
-    KM_TAG_PADDING = KM_ENUM_REP | 6,     /* keymaster_padding_t. */
-    KM_TAG_CALLER_NONCE = KM_BOOL | 7,    /* Allow caller to specify nonce or IV. */
-    KM_TAG_MIN_MAC_LENGTH = KM_UINT | 8,  /* Minimum length of MAC or AEAD authentication tag in
-                                           * bits. */
+    KM_TAG_PURPOSE = KM_ENUM_REP | 1,      /* keymaster_purpose_t. */
+    KM_TAG_ALGORITHM = KM_ENUM | 2,        /* keymaster_algorithm_t. */
+    KM_TAG_KEY_SIZE = KM_UINT | 3,         /* Key size in bits. */
+    KM_TAG_BLOCK_MODE = KM_ENUM_REP | 4,   /* keymaster_block_mode_t. */
+    KM_TAG_DIGEST = KM_ENUM_REP | 5,       /* keymaster_digest_t. */
+    KM_TAG_PADDING = KM_ENUM_REP | 6,      /* keymaster_padding_t. */
+    KM_TAG_CALLER_NONCE = KM_BOOL | 7,     /* Allow caller to specify nonce or IV. */
+    KM_TAG_MIN_MAC_LENGTH = KM_UINT | 8,   /* Minimum length of MAC or AEAD authentication tag in
+                                            * bits. */
+    KM_TAG_KDF = KM_ENUM | 9,              /* keymaster_kdf_t */
+    KM_TAG_EC_CURVE = KM_ENUM | 10,        /* keymaster_ec_curve_t */
 
     /* Algorithm-specific. */
     KM_TAG_RSA_PUBLIC_EXPONENT = KM_ULONG | 200,
+    KM_TAG_ECIES_SINGLE_HASH_MODE = KM_BOOL | 201, /* Whether the ephemeral public key is fed into
+                                                    *  the KDF, see 10.2 in http://goo.gl/WbmSSO */
 
     /* Other hardware-enforced. */
     KM_TAG_BLOB_USAGE_REQUIREMENTS = KM_ENUM | 301, /* keymaster_key_blob_usage_requirements_t */
@@ -187,6 +191,32 @@
     KM_DIGEST_SHA_2_512 = 6,
 } keymaster_digest_t;
 
+/*
+ * Key derivation functions, mostly used in ECIES.
+ */
+typedef enum {
+    /* HKDF defined in RFC 5869 with SHA256 */
+    KM_KDF_RFC5869_SHA256 = 0,
+    /* KDF1 defined in ISO 18033-2 with SHA1 */
+    KM_KDF_ISO18033_1_KDF2_SHA1 = 1,
+    /* KDF1 defined in ISO 18033-2 with SHA256 */
+    KM_KDF_ISO18033_1_KDF1_SHA256 = 2,
+    /* KDF2 defined in ISO 18033-2 with SHA1 */
+    KM_KDF_ISO18033_2_KDF2_SHA1 = 3,
+    /* KDF2 defined in ISO 18033-2 with SHA256 */
+    KM_KDF_ISO18033_2_KDF2_SHA256 = 4,
+} keymaster_kdf_t;
+
+/**
+ * Supported EC curves, used in ECDSA/ECIES.
+ */
+typedef enum {
+    KM_EC_CURVE_P_224 = 0,
+    KM_EC_CURVE_P_256 = 1,
+    KM_EC_CURVE_P_384 = 2,
+    KM_EC_CURVE_P_521 = 3,
+} keymaster_ec_curve_t;
+
 /**
  * The origin of a key (or pair), i.e. where it was generated.  Note that KM_TAG_ORIGIN can be found
  * in either the hardware-enforced or software-enforced list for a key, indicating whether the key
@@ -340,12 +370,12 @@
     KM_ERROR_INVALID_MAC_LENGTH = -57,
     KM_ERROR_MISSING_MIN_MAC_LENGTH = -58,
     KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH = -59,
+    KM_ERROR_UNSUPPORTED_KDF = -60,
+    KM_ERROR_UNSUPPORTED_EC_CURVE = -61,
 
     KM_ERROR_UNIMPLEMENTED = -100,
     KM_ERROR_VERSION_MISMATCH = -101,
 
-    /* Additional error codes may be added by implementations, but implementers should coordinate
-     * with Google to avoid code collision. */
     KM_ERROR_UNKNOWN_ERROR = -1000,
 } keymaster_error_t;
 
diff --git a/include/hardware/vibrator.h b/include/hardware/vibrator.h
index 92b1fd0..200adf0 100644
--- a/include/hardware/vibrator.h
+++ b/include/hardware/vibrator.h
@@ -45,8 +45,8 @@
 
     /** Turn on vibrator
      *
-     * What happens when this function is called while the the timeout of a
-     * previous call has not expired is implementation dependent.
+     * This function must only be called after the previous timeout has expired or
+     * was canceled (through vibrator_off()).
      *
      * @param timeout_ms number of milliseconds to vibrate
      *
@@ -56,8 +56,7 @@
 
     /** Turn off vibrator
      *
-     * It is not guaranteed that the vibrator will be immediately stopped: the
-     * behaviour is implementation dependent.
+     * Cancel a previously-started vibration, if any.
      *
      * @return 0 in case of success, negative errno code else
      */
diff --git a/modules/camera/Metadata.cpp b/modules/camera/Metadata.cpp
index f195534..18e5239 100644
--- a/modules/camera/Metadata.cpp
+++ b/modules/camera/Metadata.cpp
@@ -52,7 +52,7 @@
 {
     camera_metadata_t* tmp;
 
-    if (!validate_camera_metadata_structure(metadata, NULL))
+    if (validate_camera_metadata_structure(metadata, NULL))
         return -EINVAL;
 
     tmp = clone_camera_metadata(metadata);
@@ -130,16 +130,23 @@
 int Metadata::add(uint32_t tag, int count, const void *tag_data)
 {
     int res;
+    size_t entry_capacity = 0;
+    size_t data_capacity = 0;
     camera_metadata_t* tmp;
     int tag_type = get_camera_metadata_tag_type(tag);
     size_t size = calculate_camera_metadata_entry_data_size(tag_type, count);
-    size_t entry_capacity = get_camera_metadata_entry_count(mData) + 1;
-    size_t data_capacity = get_camera_metadata_data_count(mData) + size;
 
-    // Opportunistically attempt to add if metadata has room for it
-    if (!add_camera_metadata_entry(mData, tag, tag_data, count))
+    if (NULL == mData) {
+        entry_capacity = 1;
+        data_capacity = size;
+    } else {
+        entry_capacity = get_camera_metadata_entry_count(mData) + 1;
+        data_capacity = get_camera_metadata_data_count(mData) + size;
+    }
+
+    // Opportunistically attempt to add if metadata exists and has room for it
+    if (mData && !add_camera_metadata_entry(mData, tag, tag_data, count))
         return 0;
-
     // Double new dimensions to minimize future reallocations
     tmp = allocate_camera_metadata(entry_capacity * 2, data_capacity * 2);
     if (tmp == NULL) {
@@ -147,22 +154,24 @@
                 __func__, entry_capacity, data_capacity);
         return -ENOMEM;
     }
-    // Append the current metadata to the new (empty) metadata
-    res = append_camera_metadata(tmp, mData);
-    if (res) {
-        ALOGE("%s: Failed to append old metadata %p to new %p",
-                __func__, mData, tmp);
-        return res;
+    // Append the current metadata to the new (empty) metadata, if any
+    if (NULL != mData) {
+      res = append_camera_metadata(tmp, mData);
+      if (res) {
+          ALOGE("%s: Failed to append old metadata %p to new %p",
+                  __func__, mData, tmp);
+          return res;
+      }
     }
-    // Add the remaining new item
+    // Add the remaining new item to tmp and replace mData
     res = add_camera_metadata_entry(tmp, tag, tag_data, count);
     if (res) {
         ALOGE("%s: Failed to add new entry (%d, %p, %d) to metadata %p",
                 __func__, tag, tag_data, count, tmp);
         return res;
     }
-
     replace(tmp);
+
     return 0;
 }
 
diff --git a/modules/gralloc/framebuffer.cpp b/modules/gralloc/framebuffer.cpp
index 486e27a..eadcdaa 100644
--- a/modules/gralloc/framebuffer.cpp
+++ b/modules/gralloc/framebuffer.cpp
@@ -33,7 +33,7 @@
 #include <cutils/log.h>
 #include <cutils/atomic.h>
 
-#if HAVE_ANDROID_OS
+#ifdef __ANDROID__
 #include <linux/fb.h>
 #endif
 
diff --git a/modules/sensors/Android.mk b/modules/sensors/Android.mk
index 445f69e..94d100b 100644
--- a/modules/sensors/Android.mk
+++ b/modules/sensors/Android.mk
@@ -20,9 +20,9 @@
 
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := sensors.$(TARGET_DEVICE)
+LOCAL_MODULE := sensors.$(TARGET_BOARD_PLATFORM)
 
-LOCAL_MODULE_PATH := $(TARGET_OUT_SHARED_LIBRARIES)/hw
+LOCAL_MODULE_RELATIVE_PATH := hw
 
 LOCAL_CFLAGS := -DLOG_TAG=\"MultiHal\"
 
diff --git a/modules/sensors/multihal.cpp b/modules/sensors/multihal.cpp
index d26d168..8330ff3 100644
--- a/modules/sensors/multihal.cpp
+++ b/modules/sensors/multihal.cpp
@@ -27,6 +27,8 @@
 #include <cutils/log.h>
 
 #include <vector>
+#include <string>
+#include <fstream>
 #include <map>
 #include <string>
 
@@ -38,8 +40,6 @@
 #include <stdlib.h>
 
 static const char* CONFIG_FILENAME = "/system/etc/sensors/hals.conf";
-static const char* LEGAL_SUBHAL_PATH_PREFIX = "/system/lib/hw/";
-static const char* LEGAL_SUBHAL_ALTERNATE_PATH_PREFIX = "/system/vendor/lib/";
 static const int MAX_CONF_LINE_LENGTH = 1024;
 
 static pthread_mutex_t init_modules_mutex = PTHREAD_MUTEX_INITIALIZER;
@@ -465,39 +465,19 @@
  * Adds valid paths from the config file to the vector passed in.
  * The vector must not be null.
  */
-static void get_so_paths(std::vector<char*> *so_paths) {
-    FILE *conf_file = fopen(CONFIG_FILENAME, "r");
-    if (conf_file == NULL) {
+static void get_so_paths(std::vector<std::string> *so_paths) {
+    std::string line;
+    std::ifstream conf_file(CONFIG_FILENAME);
+
+    if(!conf_file) {
         ALOGW("No multihal config file found at %s", CONFIG_FILENAME);
         return;
     }
     ALOGV("Multihal config file found at %s", CONFIG_FILENAME);
-    char *line = NULL;
-    size_t len = 0;
-    int line_count = 0;
-    while (getline(&line, &len, conf_file) != -1) {
-        // overwrite trailing eoln with null char
-        char* pch = strchr(line, '\n');
-        if (pch != NULL) {
-            *pch = '\0';
-        }
-        ALOGV("config file line #%d: '%s'", ++line_count, line);
-        char *real_path = realpath(line, NULL);
-        if (starts_with(real_path, LEGAL_SUBHAL_PATH_PREFIX) ||
-		starts_with(real_path, LEGAL_SUBHAL_ALTERNATE_PATH_PREFIX)) {
-            ALOGV("accepting valid path '%s'", real_path);
-            char* compact_line = new char[strlen(real_path) + 1];
-            strcpy(compact_line, real_path);
-            so_paths->push_back(compact_line);
-        } else {
-            ALOGW("rejecting path '%s' because it does not start with '%s' or '%s'",
-                    real_path, LEGAL_SUBHAL_PATH_PREFIX, LEGAL_SUBHAL_ALTERNATE_PATH_PREFIX);
-        }
-        free(real_path);
+    while (std::getline(conf_file, line)) {
+        ALOGV("config file line: '%s'", line.c_str());
+        so_paths->push_back(line);
     }
-    free(line);
-    fclose(conf_file);
-    ALOGV("hals.conf contained %d lines", line_count);
 }
 
 /*
@@ -510,15 +490,15 @@
         pthread_mutex_unlock(&init_modules_mutex);
         return;
     }
-    std::vector<char*> *so_paths = new std::vector<char*>();
+    std::vector<std::string> *so_paths = new std::vector<std::string>();
     get_so_paths(so_paths);
 
     // dlopen the module files and cache their module symbols in sub_hw_modules
     sub_hw_modules = new std::vector<hw_module_t *>();
     dlerror(); // clear any old errors
     const char* sym = HAL_MODULE_INFO_SYM_AS_STR;
-    for (std::vector<char*>::iterator it = so_paths->begin(); it != so_paths->end(); it++) {
-        char* path = *it;
+    for (std::vector<std::string>::iterator it = so_paths->begin(); it != so_paths->end(); it++) {
+        const char* path = it->c_str();
         void* lib_handle = dlopen(path, RTLD_LAZY);
         if (lib_handle == NULL) {
             ALOGW("dlerror(): %s", dlerror());
diff --git a/tests/camera2/ForkedTests.cpp b/tests/camera2/ForkedTests.cpp
index 315233e..39599da 100644
--- a/tests/camera2/ForkedTests.cpp
+++ b/tests/camera2/ForkedTests.cpp
@@ -16,6 +16,8 @@
 
 #include <gtest/gtest.h>
 
+#include <stdlib.h>
+
 #include "TestExtensions.h"
 
 namespace android {
@@ -37,9 +39,7 @@
 // intentionally fail
 TEST_F(DISABLED_ForkedTest, FailCrash) {
     TEST_EXTENSION_FORKING_INIT;
-
-    //intentionally crash
-    *(int*)0 = 0xDEADBEEF;
+    abort();
 }
 
 TEST_F(DISABLED_ForkedTest, SucceedNormal) {