diff --git a/include/hardware/bt_gatt_client.h b/include/hardware/bt_gatt_client.h
index d6b0cb4..cf4fabe 100644
--- a/include/hardware/bt_gatt_client.h
+++ b/include/hardware/bt_gatt_client.h
@@ -278,7 +278,9 @@
     /** Set the advertising data or scan response data */
     bt_status_t (*set_adv_data)(int server_if, bool set_scan_rsp, bool include_name,
                     bool include_txpower, int min_interval, int max_interval, int appearance,
-                    uint16_t manufacturer_len, char* manufacturer_data);
+                    uint16_t manufacturer_len, char* manufacturer_data,
+                    uint16_t service_data_len, char* service_data,
+                    uint16_t service_uuid_len, char* service_uuid);
 
     /** Test mode interface */
     bt_status_t (*test_command)( int command, btgatt_test_params_t* params);
diff --git a/include/hardware/bt_pan.h b/include/hardware/bt_pan.h
index c8b36b4..83e7949 100644
--- a/include/hardware/bt_pan.h
+++ b/include/hardware/bt_pan.h
@@ -40,8 +40,8 @@
 */
 typedef void (*btpan_connection_state_callback)(btpan_connection_state_t state, bt_status_t error,
                                                 const bt_bdaddr_t *bd_addr, int local_role, int remote_role);
-typedef void (*btpan_control_state_callback)(btpan_control_state_t state, bt_status_t error,
-                                            int local_role, const char* ifname);
+typedef void (*btpan_control_state_callback)(btpan_control_state_t state, int local_role,
+                                            bt_status_t error, const char* ifname);
 
 typedef struct {
     size_t size;
diff --git a/include/hardware/gralloc.h b/include/hardware/gralloc.h
index 0dbebcf..e7d0103 100644
--- a/include/hardware/gralloc.h
+++ b/include/hardware/gralloc.h
@@ -44,10 +44,14 @@
  *
  * GRALLOC_MODULE_API_VERSION_0_2:
  * Add support for flexible YCbCr format with (*lock_ycbcr)() method.
+ *
+ * GRALLOC_MODULE_API_VERSION_0_3:
+ * Add support for fence passing to/from lock/unlock.
  */
 
 #define GRALLOC_MODULE_API_VERSION_0_1  HARDWARE_MODULE_API_VERSION(0, 1)
 #define GRALLOC_MODULE_API_VERSION_0_2  HARDWARE_MODULE_API_VERSION(0, 2)
+#define GRALLOC_MODULE_API_VERSION_0_3  HARDWARE_MODULE_API_VERSION(0, 3)
 
 #define GRALLOC_DEVICE_API_VERSION_0_1  HARDWARE_DEVICE_API_VERSION(0, 1)
 
@@ -241,8 +245,53 @@
             int l, int t, int w, int h,
             struct android_ycbcr *ycbcr);
 
+    /*
+     * The (*lockAsync)() method is like the (*lock)() method except
+     * that the buffer's sync fence object is passed into the lock
+     * call instead of requiring the caller to wait for completion.
+     *
+     * The gralloc implementation takes ownership of the fenceFd and
+     * is responsible for closing it when no longer needed.
+     *
+     * Added in GRALLOC_MODULE_API_VERSION_0_3.
+     */
+    int (*lockAsync)(struct gralloc_module_t const* module,
+            buffer_handle_t handle, int usage,
+            int l, int t, int w, int h,
+            void** vaddr, int fenceFd);
+
+    /*
+     * The (*unlockAsync)() method is like the (*unlock)() method
+     * except that a buffer sync fence object is returned from the
+     * lock call, representing the completion of any pending work
+     * performed by the gralloc implementation.
+     *
+     * The caller takes ownership of the fenceFd and is responsible
+     * for closing it when no longer needed.
+     *
+     * Added in GRALLOC_MODULE_API_VERSION_0_3.
+     */
+    int (*unlockAsync)(struct gralloc_module_t const* module,
+            buffer_handle_t handle, int* fenceFd);
+
+    /*
+     * The (*lockAsync_ycbcr)() method is like the (*lock_ycbcr)()
+     * method except that the buffer's sync fence object is passed
+     * into the lock call instead of requiring the caller to wait for
+     * completion.
+     *
+     * The gralloc implementation takes ownership of the fenceFd and
+     * is responsible for closing it when no longer needed.
+     *
+     * Added in GRALLOC_MODULE_API_VERSION_0_3.
+     */
+    int (*lockAsync_ycbcr)(struct gralloc_module_t const* module,
+            buffer_handle_t handle, int usage,
+            int l, int t, int w, int h,
+            struct android_ycbcr *ycbcr, int fenceFd);
+
     /* reserved for future use */
-    void* reserved_proc[6];
+    void* reserved_proc[3];
 } gralloc_module_t;
 
 /*****************************************************************************/
diff --git a/include/hardware/keymaster.h b/include/hardware/keymaster.h
index 6752146..12158bf 100644
--- a/include/hardware/keymaster.h
+++ b/include/hardware/keymaster.h
@@ -36,11 +36,14 @@
  * Settings for "module_api_version" and "hal_api_version"
  * fields in the keymaster_module initialization.
  */
-#define KEYMASTER_HEADER_VERSION 2
+#define KEYMASTER_HEADER_VERSION 3
 
 #define KEYMASTER_MODULE_API_VERSION_0_2  HARDWARE_MODULE_API_VERSION(0, 2)
 #define KEYMASTER_DEVICE_API_VERSION_0_2  HARDWARE_DEVICE_API_VERSION_2(0, 2, KEYMASTER_HEADER_VERSION)
 
+#define KEYMASTER_MODULE_API_VERSION_0_3  HARDWARE_MODULE_API_VERSION(0, 3)
+#define KEYMASTER_DEVICE_API_VERSION_0_3  HARDWARE_DEVICE_API_VERSION_2(0, 3, KEYMASTER_HEADER_VERSION)
+
 /**
  * Flags for keymaster_device::flags
  */
@@ -52,7 +55,31 @@
      * This should not be implemented on anything other than the default
      * implementation.
      */
-    KEYMASTER_SOFTWARE_ONLY = 0x00000001,
+    KEYMASTER_SOFTWARE_ONLY = 1 << 0,
+
+    /*
+     * This indicates that the key blobs returned via all the primitives
+     * are sufficient to operate on their own without the trusted OS
+     * querying userspace to retrieve some other data. Key blobs of
+     * this type are normally returned encrypted with a
+     * Key Encryption Key (KEK).
+     *
+     * This is currently used by "vold" to know whether the whole disk
+     * encryption secret can be unwrapped without having some external
+     * service started up beforehand since the "/data" partition will
+     * be unavailable at that point.
+     */
+    KEYMASTER_BLOBS_ARE_STANDALONE = 1 << 1,
+
+    /*
+     * Indicates that the keymaster module supports DSA keys.
+     */
+    KEYMASTER_SUPPORTS_DSA = 1 << 2,
+
+    /*
+     * Indicates that the keymaster module supports EC keys.
+     */
+    KEYMASTER_SUPPORTS_EC = 1 << 3,
 };
 
 struct keystore_module {
diff --git a/modules/audio/Android.mk b/modules/audio/Android.mk
index 49ed312..a31c85f 100644
--- a/modules/audio/Android.mk
+++ b/modules/audio/Android.mk
@@ -27,6 +27,7 @@
 LOCAL_SRC_FILES := audio_hw.c
 LOCAL_SHARED_LIBRARIES := liblog libcutils
 LOCAL_MODULE_TAGS := optional
+LOCAL_CFLAGS := -Wno-unused-parameter
 
 include $(BUILD_SHARED_LIBRARY)
 
@@ -39,5 +40,6 @@
 LOCAL_SRC_FILES := audio_policy.c
 LOCAL_SHARED_LIBRARIES := liblog libcutils
 LOCAL_MODULE_TAGS := optional
+LOCAL_CFLAGS := -Wno-unused-parameter
 
 include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/audio_remote_submix/Android.mk b/modules/audio_remote_submix/Android.mk
index 50c8cb2..90da396 100644
--- a/modules/audio_remote_submix/Android.mk
+++ b/modules/audio_remote_submix/Android.mk
@@ -26,5 +26,7 @@
 LOCAL_SHARED_LIBRARIES := liblog libcutils libutils libnbaio
 LOCAL_STATIC_LIBRARIES := libmedia_helper
 LOCAL_MODULE_TAGS := optional
+LOCAL_CFLAGS := -Wno-unused-parameter
+
 include $(BUILD_SHARED_LIBRARY)
 
diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index 9df17b6..433ef6c 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -271,7 +271,7 @@
             return 0;
         } else {
             // write() returned UNDERRUN or WOULD_BLOCK, retry
-            ALOGE("out_write() write to pipe returned unexpected %d", written_frames);
+            ALOGE("out_write() write to pipe returned unexpected %zd", written_frames);
             written_frames = sink->write(buffer, frames);
         }
     }
@@ -281,10 +281,10 @@
     pthread_mutex_unlock(&out->dev->lock);
 
     if (written_frames < 0) {
-        ALOGE("out_write() failed writing to pipe with %d", written_frames);
+        ALOGE("out_write() failed writing to pipe with %zd", written_frames);
         return 0;
     } else {
-        ALOGV("out_write() wrote %lu bytes)", written_frames * frame_size);
+        ALOGV("out_write() wrote %zu bytes)", written_frames * frame_size);
         return written_frames * frame_size;
     }
 }
@@ -327,7 +327,7 @@
 static size_t in_get_buffer_size(const struct audio_stream *stream)
 {
     const struct submix_stream_in *in = reinterpret_cast<const struct submix_stream_in *>(stream);
-    ALOGV("in_get_buffer_size() returns %u",
+    ALOGV("in_get_buffer_size() returns %zu",
             in->dev->config.period_size * audio_stream_frame_size(stream));
     return in->dev->config.period_size * audio_stream_frame_size(stream);
 }
@@ -449,7 +449,7 @@
     }
 
     if (remaining_frames > 0) {
-        ALOGV("  remaining_frames = %d", remaining_frames);
+        ALOGV("  remaining_frames = %zu", remaining_frames);
         memset(((char*)buffer)+ bytes - (remaining_frames * frame_size), 0,
                 remaining_frames * frame_size);
     }
@@ -488,7 +488,7 @@
     }
 
 
-    ALOGV("in_read returns %d", bytes);
+    ALOGV("in_read returns %zu", bytes);
     return bytes;
 
 }
diff --git a/modules/gralloc/gr.h b/modules/gralloc/gr.h
index 3a43aa7..732b6bc 100644
--- a/modules/gralloc/gr.h
+++ b/modules/gralloc/gr.h
@@ -18,11 +18,7 @@
 #define GR_H_
 
 #include <stdint.h>
-#ifdef HAVE_ANDROID_OS      // just want PAGE_SIZE define
-# include <asm/page.h>
-#else
-# include <sys/user.h>
-#endif
+#include <sys/user.h>
 #include <limits.h>
 #include <sys/cdefs.h>
 #include <hardware/gralloc.h>
diff --git a/modules/gralloc/gralloc_priv.h b/modules/gralloc/gralloc_priv.h
index 22a5715..2cd1007 100644
--- a/modules/gralloc/gralloc_priv.h
+++ b/modules/gralloc/gralloc_priv.h
@@ -75,7 +75,7 @@
     int     offset;
 
     // FIXME: the attributes below should be out-of-line
-    uintptr_t base;
+    uint64_t base __attribute__((aligned(8)));
     int     pid;
 
 #ifdef __cplusplus
diff --git a/modules/usbaudio/Android.mk b/modules/usbaudio/Android.mk
index 199eb09..2af7897 100644
--- a/modules/usbaudio/Android.mk
+++ b/modules/usbaudio/Android.mk
@@ -24,6 +24,7 @@
 	external/tinyalsa/include
 LOCAL_SHARED_LIBRARIES := liblog libcutils libtinyalsa
 LOCAL_MODULE_TAGS := optional
+LOCAL_CFLAGS := -Wno-unused-parameter
 
 include $(BUILD_SHARED_LIBRARY)
 
diff --git a/modules/usbaudio/audio_hw.c b/modules/usbaudio/audio_hw.c
index f33c343..24a2d63 100644
--- a/modules/usbaudio/audio_hw.c
+++ b/modules/usbaudio/audio_hw.c
@@ -212,7 +212,7 @@
 
 err:
     pthread_mutex_unlock(&out->lock);
-
+    pthread_mutex_unlock(&out->dev->lock);
     if (ret != 0) {
         usleep(bytes * 1000000 / audio_stream_frame_size(&stream->common) /
                out_get_sample_rate(&stream->common));
diff --git a/tests/camera2/CameraMultiStreamTests.cpp b/tests/camera2/CameraMultiStreamTests.cpp
index de1cfd6..a78950c 100644
--- a/tests/camera2/CameraMultiStreamTests.cpp
+++ b/tests/camera2/CameraMultiStreamTests.cpp
@@ -35,7 +35,10 @@
 #define CAMERA_MULTI_STREAM_DEBUGGING  0
 #define CAMERA_FRAME_TIMEOUT    1000000000LL // nsecs (1 secs)
 #define PREVIEW_RENDERING_TIME_INTERVAL 200000 // in unit of us, 200ms
-#define TOLERANCE_MARGIN 0.01 // 1% tolerance margin for exposure sanity check.
+// 1% tolerance margin for exposure sanity check against metadata
+#define TOLERANCE_MARGIN_METADATA 0.01
+// 5% tolerance margin for exposure sanity check against capture times
+#define TOLERANCE_MARGIN_CAPTURE 0.05
 /* constants for display */
 #define DISPLAY_BUFFER_HEIGHT 1024
 #define DISPLAY_BUFFER_WIDTH 1024
@@ -399,10 +402,10 @@
             // TODO: Need revisit it to figure out an accurate margin.
             int64_t resultExposure = GetExposureValue(frameMetadata);
             int32_t resultSensitivity = GetSensitivity(frameMetadata);
-            EXPECT_LE(sensitivities[i] * (1.0 - TOLERANCE_MARGIN), resultSensitivity);
-            EXPECT_GE(sensitivities[i] * (1.0 + TOLERANCE_MARGIN), resultSensitivity);
-            EXPECT_LE(exposures[i] * (1.0 - TOLERANCE_MARGIN), resultExposure);
-            EXPECT_GE(exposures[i] * (1.0 + TOLERANCE_MARGIN), resultExposure);
+            EXPECT_LE(sensitivities[i] * (1.0 - TOLERANCE_MARGIN_METADATA), resultSensitivity);
+            EXPECT_GE(sensitivities[i] * (1.0 + TOLERANCE_MARGIN_METADATA), resultSensitivity);
+            EXPECT_LE(exposures[i] * (1.0 - TOLERANCE_MARGIN_METADATA), resultExposure);
+            EXPECT_GE(exposures[i] * (1.0 + TOLERANCE_MARGIN_METADATA), resultExposure);
 
             ASSERT_EQ(OK, listener->waitForFrame(waitLimit));
             captureBurstTimes.push_back(systemTime());
@@ -422,7 +425,7 @@
             if (i > 0) {
                 nsecs_t timeDelta =
                         captureBurstTimes[i] - captureBurstTimes[i-1];
-                EXPECT_GE(timeDelta, exposures[i]);
+                EXPECT_GE(timeDelta * ( 1 + TOLERANCE_MARGIN_CAPTURE), exposures[i]);
             }
         }
     }