diff --git a/include/hardware/bluetooth.h b/include/hardware/bluetooth.h
index c00a8f7..19c3410 100644
--- a/include/hardware/bluetooth.h
+++ b/include/hardware/bluetooth.h
@@ -17,6 +17,7 @@
 #ifndef ANDROID_INCLUDE_BLUETOOTH_H
 #define ANDROID_INCLUDE_BLUETOOTH_H
 
+#include <stdbool.h>
 #include <stdint.h>
 #include <sys/cdefs.h>
 #include <sys/types.h>
@@ -37,7 +38,9 @@
 /* Bluetooth profile interface IDs */
 
 #define BT_PROFILE_HANDSFREE_ID "handsfree"
+#define BT_PROFILE_HANDSFREE_CLIENT_ID "handsfree_client"
 #define BT_PROFILE_ADVANCED_AUDIO_ID "a2dp"
+#define BT_PROFILE_ADVANCED_AUDIO_SINK_ID "a2dp_sink"
 #define BT_PROFILE_HEALTH_ID "health"
 #define BT_PROFILE_SOCKETS_ID "socket"
 #define BT_PROFILE_HIDHOST_ID "hidhost"
@@ -45,6 +48,7 @@
 
 #define BT_PROFILE_GATT_ID "gatt"
 #define BT_PROFILE_AV_RC_ID "avrcp"
+#define BT_PROFILE_AV_RC_CTRL_ID "avrcp_ctrl"
 
 /** Bluetooth Address */
 typedef struct {
@@ -126,6 +130,16 @@
    int manufacturer;
 } bt_remote_version_t;
 
+typedef struct
+{
+    uint8_t local_privacy_enabled;
+    uint8_t max_adv_instance;
+    uint8_t rpa_offload_supported;
+    uint8_t max_irk_list_size;
+    uint8_t max_adv_filter_supported;
+    uint8_t scan_result_storage_size;
+}bt_local_le_features_t;
+
 /* Bluetooth Adapter and Remote Device property types */
 typedef enum {
     /* Properties common to both adapter and remote device */
@@ -208,6 +222,13 @@
 
     BT_PROPERTY_REMOTE_VERSION_INFO,
 
+    /**
+     * Description - Local LE features
+     * Access mode - GET.
+     * Data type   - bt_local_le_features_t.
+     */
+    BT_PROPERTY_LOCAL_LE_FEATURES,
+
     BT_PROPERTY_REMOTE_DEVICE_TIMESTAMP = 0xFF,
 } bt_property_type_t;
 
@@ -219,6 +240,7 @@
     void *val;
 } bt_property_t;
 
+
 /** Bluetooth Device Type */
 typedef enum {
     BT_DEVICE_DEVTYPE_BREDR = 0x1,
@@ -342,6 +364,24 @@
     le_test_mode_callback le_test_mode_cb;
 } bt_callbacks_t;
 
+typedef void (*alarm_cb)(void *data);
+typedef bool (*set_wake_alarm_callout)(uint64_t delay_millis, bool should_wake, alarm_cb cb, void *data);
+typedef int (*acquire_wake_lock_callout)(const char *lock_name);
+typedef int (*release_wake_lock_callout)(const char *lock_name);
+
+/** The set of functions required by bluedroid to set wake alarms and
+  * grab wake locks. This struct is passed into the stack through the
+  * |set_os_callouts| function on |bt_interface_t|.
+  */
+typedef struct {
+  /* set to sizeof(bt_os_callouts_t) */
+  size_t size;
+
+  set_wake_alarm_callout set_wake_alarm;
+  acquire_wake_lock_callout acquire_wake_lock;
+  release_wake_lock_callout release_wake_lock;
+} bt_os_callouts_t;
+
 /** NOTE: By default, no profiles are initialized at the time of init/enable.
  *  Whenever the application invokes the 'init' API of a profile, then one of
  *  the following shall occur:
@@ -453,6 +493,11 @@
 
     /* enable or disable bluetooth HCI snoop log */
     int (*config_hci_snoop_log)(uint8_t enable);
+
+    /** Sets the OS call-out functions that bluedroid needs for alarms and wake locks.
+      * This should be called immediately after a successful |init|.
+      */
+    int (*set_os_callouts)(bt_os_callouts_t *callouts);
 } bt_interface_t;
 
 /** TODO: Need to add APIs for Service Discovery, Service authorization and
diff --git a/include/hardware/bt_av.h b/include/hardware/bt_av.h
index 2ec00c3..5252a17 100644
--- a/include/hardware/bt_av.h
+++ b/include/hardware/bt_av.h
@@ -47,12 +47,23 @@
 typedef void (* btav_audio_state_callback)(btav_audio_state_t state, 
                                                bt_bdaddr_t *bd_addr);
 
+/** Callback for audio configuration change.
+ *  Used only for the A2DP sink interface.
+ *  state will have one of the values from btav_audio_state_t
+ *  sample_rate: sample rate in Hz
+ *  channel_count: number of channels (1 for mono, 2 for stereo)
+ */
+typedef void (* btav_audio_config_callback)(bt_bdaddr_t *bd_addr,
+                                                uint32_t sample_rate,
+                                                uint8_t channel_count);
+
 /** BT-AV callback structure. */
 typedef struct {
     /** set to sizeof(btav_callbacks_t) */
     size_t      size;
     btav_connection_state_callback  connection_state_cb;
     btav_audio_state_callback audio_state_cb;
+    btav_audio_config_callback audio_config_cb;
 } btav_callbacks_t;
 
 /** 
@@ -65,7 +76,9 @@
  *    android_audio_hw library and the Bluetooth stack.
  * 
  */
-/** Represents the standard BT-AV interface. */
+/** Represents the standard BT-AV interface.
+ *  Used for both the A2DP source and sink interfaces.
+ */
 typedef struct {
 
     /** set to sizeof(btav_interface_t) */
diff --git a/include/hardware/bt_hf_client.h b/include/hardware/bt_hf_client.h
new file mode 100644
index 0000000..8acf1b2
--- /dev/null
+++ b/include/hardware/bt_hf_client.h
@@ -0,0 +1,363 @@
+/*
+ * Copyright (C) 2012-2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_INCLUDE_BT_HF_CLIENT_H
+#define ANDROID_INCLUDE_BT_HF_CLIENT_H
+
+__BEGIN_DECLS
+
+typedef enum {
+    BTHF_CLIENT_CONNECTION_STATE_DISCONNECTED = 0,
+    BTHF_CLIENT_CONNECTION_STATE_CONNECTING,
+    BTHF_CLIENT_CONNECTION_STATE_CONNECTED,
+    BTHF_CLIENT_CONNECTION_STATE_SLC_CONNECTED,
+    BTHF_CLIENT_CONNECTION_STATE_DISCONNECTING
+} bthf_client_connection_state_t;
+
+typedef enum {
+    BTHF_CLIENT_AUDIO_STATE_DISCONNECTED = 0,
+    BTHF_CLIENT_AUDIO_STATE_CONNECTING,
+    BTHF_CLIENT_AUDIO_STATE_CONNECTED,
+    BTHF_CLIENT_AUDIO_STATE_CONNECTED_MSBC,
+} bthf_client_audio_state_t;
+
+typedef enum {
+    BTHF_CLIENT_VR_STATE_STOPPED = 0,
+    BTHF_CLIENT_VR_STATE_STARTED
+} bthf_client_vr_state_t;
+
+typedef enum {
+    BTHF_CLIENT_VOLUME_TYPE_SPK = 0,
+    BTHF_CLIENT_VOLUME_TYPE_MIC
+} bthf_client_volume_type_t;
+
+typedef enum
+{
+    BTHF_CLIENT_NETWORK_STATE_NOT_AVAILABLE = 0,
+    BTHF_CLIENT_NETWORK_STATE_AVAILABLE
+} bthf_client_network_state_t;
+
+typedef enum
+{
+    BTHF_CLIENT_SERVICE_TYPE_HOME = 0,
+    BTHF_CLIENT_SERVICE_TYPE_ROAMING
+} bthf_client_service_type_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_STATE_ACTIVE = 0,
+    BTHF_CLIENT_CALL_STATE_HELD,
+    BTHF_CLIENT_CALL_STATE_DIALING,
+    BTHF_CLIENT_CALL_STATE_ALERTING,
+    BTHF_CLIENT_CALL_STATE_INCOMING,
+    BTHF_CLIENT_CALL_STATE_WAITING,
+    BTHF_CLIENT_CALL_STATE_HELD_BY_RESP_HOLD,
+} bthf_client_call_state_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_NO_CALLS_IN_PROGRESS = 0,
+    BTHF_CLIENT_CALL_CALLS_IN_PROGRESS
+} bthf_client_call_t;
+
+typedef enum {
+    BTHF_CLIENT_CALLSETUP_NONE = 0,
+    BTHF_CLIENT_CALLSETUP_INCOMING,
+    BTHF_CLIENT_CALLSETUP_OUTGOING,
+    BTHF_CLIENT_CALLSETUP_ALERTING
+
+} bthf_client_callsetup_t;
+
+typedef enum {
+    BTHF_CLIENT_CALLHELD_NONE = 0,
+    BTHF_CLIENT_CALLHELD_HOLD_AND_ACTIVE,
+    BTHF_CLIENT_CALLHELD_HOLD,
+} bthf_client_callheld_t;
+
+typedef enum {
+    BTHF_CLIENT_RESP_AND_HOLD_HELD = 0,
+    BTRH_CLIENT_RESP_AND_HOLD_ACCEPT,
+    BTRH_CLIENT_RESP_AND_HOLD_REJECT,
+} bthf_client_resp_and_hold_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_DIRECTION_OUTGOING = 0,
+    BTHF_CLIENT_CALL_DIRECTION_INCOMING
+} bthf_client_call_direction_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_MPTY_TYPE_SINGLE = 0,
+    BTHF_CLIENT_CALL_MPTY_TYPE_MULTI
+} bthf_client_call_mpty_type_t;
+
+typedef enum {
+    BTHF_CLIENT_CMD_COMPLETE_OK = 0,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_NO_CARRIER,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_BUSY,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_NO_ANSWER,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_DELAYED,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_BLACKLISTED,
+    BTHF_CLIENT_CMD_COMPLETE_ERROR_CME
+} bthf_client_cmd_complete_t;
+
+typedef enum {
+    BTHF_CLIENT_CALL_ACTION_CHLD_0 = 0,
+    BTHF_CLIENT_CALL_ACTION_CHLD_1,
+    BTHF_CLIENT_CALL_ACTION_CHLD_2,
+    BTHF_CLIENT_CALL_ACTION_CHLD_3,
+    BTHF_CLIENT_CALL_ACTION_CHLD_4,
+    BTHF_CLIENT_CALL_ACTION_CHLD_1x,
+    BTHF_CLIENT_CALL_ACTION_CHLD_2x,
+    BTHF_CLIENT_CALL_ACTION_ATA,
+    BTHF_CLIENT_CALL_ACTION_CHUP,
+    BTHF_CLIENT_CALL_ACTION_BTRH_0,
+    BTHF_CLIENT_CALL_ACTION_BTRH_1,
+    BTHF_CLIENT_CALL_ACTION_BTRH_2,
+} bthf_client_call_action_t;
+
+typedef enum {
+    BTHF_CLIENT_SERVICE_UNKNOWN = 0,
+    BTHF_CLIENT_SERVICE_VOICE,
+    BTHF_CLIENT_SERVICE_FAX
+} bthf_client_subscriber_service_type_t;
+
+typedef enum {
+    BTHF_CLIENT_IN_BAND_RINGTONE_NOT_PROVIDED = 0,
+    BTHF_CLIENT_IN_BAND_RINGTONE_PROVIDED,
+} bthf_client_in_band_ring_state_t;
+
+/* Peer features masks */
+#define BTHF_CLIENT_PEER_FEAT_3WAY   0x00000001  /* Three-way calling */
+#define BTHF_CLIENT_PEER_FEAT_ECNR   0x00000002  /* Echo cancellation and/or noise reduction */
+#define BTHF_CLIENT_PEER_FEAT_VREC   0x00000004  /* Voice recognition */
+#define BTHF_CLIENT_PEER_FEAT_INBAND 0x00000008  /* In-band ring tone */
+#define BTHF_CLIENT_PEER_FEAT_VTAG   0x00000010  /* Attach a phone number to a voice tag */
+#define BTHF_CLIENT_PEER_FEAT_REJECT 0x00000020  /* Ability to reject incoming call */
+#define BTHF_CLIENT_PEER_FEAT_ECS    0x00000040  /* Enhanced Call Status */
+#define BTHF_CLIENT_PEER_FEAT_ECC    0x00000080  /* Enhanced Call Control */
+#define BTHF_CLIENT_PEER_FEAT_EXTERR 0x00000100  /* Extended error codes */
+#define BTHF_CLIENT_PEER_FEAT_CODEC  0x00000200  /* Codec Negotiation */
+
+/* Peer call handling features masks */
+#define BTHF_CLIENT_CHLD_FEAT_REL           0x00000001  /* 0  Release waiting call or held calls */
+#define BTHF_CLIENT_CHLD_FEAT_REL_ACC       0x00000002  /* 1  Release active calls and accept other
+                                                              (waiting or held) cal */
+#define BTHF_CLIENT_CHLD_FEAT_REL_X         0x00000004  /* 1x Release specified active call only */
+#define BTHF_CLIENT_CHLD_FEAT_HOLD_ACC      0x00000008  /* 2  Active calls on hold and accept other
+                                                              (waiting or held) call */
+#define BTHF_CLIENT_CHLD_FEAT_PRIV_X        0x00000010  /* 2x Request private mode with specified
+                                                              call (put the rest on hold) */
+#define BTHF_CLIENT_CHLD_FEAT_MERGE         0x00000020  /* 3  Add held call to multiparty */
+#define BTHF_CLIENT_CHLD_FEAT_MERGE_DETACH  0x00000040  /* 4  Connect two calls and leave
+                                                              (disconnect from) multiparty */
+
+/** Callback for connection state change.
+ *  state will have one of the values from BtHfConnectionState
+ *  peer/chld_features are valid only for BTHF_CLIENT_CONNECTION_STATE_SLC_CONNECTED state
+ */
+typedef void (* bthf_client_connection_state_callback)(bthf_client_connection_state_t state,
+                                                       unsigned int peer_feat,
+                                                       unsigned int chld_feat,
+                                                       bt_bdaddr_t *bd_addr);
+
+/** Callback for audio connection state change.
+ *  state will have one of the values from BtHfAudioState
+ */
+typedef void (* bthf_client_audio_state_callback)(bthf_client_audio_state_t state,
+                                                  bt_bdaddr_t *bd_addr);
+
+/** Callback for VR connection state change.
+ *  state will have one of the values from BtHfVRState
+ */
+typedef void (* bthf_client_vr_cmd_callback)(bthf_client_vr_state_t state);
+
+/** Callback for network state change
+ */
+typedef void (* bthf_client_network_state_callback) (bthf_client_network_state_t state);
+
+/** Callback for network roaming status change
+ */
+typedef void (* bthf_client_network_roaming_callback) (bthf_client_service_type_t type);
+
+/** Callback for signal strength indication
+ */
+typedef void (* bthf_client_network_signal_callback) (int signal_strength);
+
+/** Callback for battery level indication
+ */
+typedef void (* bthf_client_battery_level_callback) (int battery_level);
+
+/** Callback for current operator name
+ */
+typedef void (* bthf_client_current_operator_callback) (const char *name);
+
+/** Callback for call indicator
+ */
+typedef void (* bthf_client_call_callback) (bthf_client_call_t call);
+
+/** Callback for callsetup indicator
+ */
+typedef void (* bthf_client_callsetup_callback) (bthf_client_callsetup_t callsetup);
+
+/** Callback for callheld indicator
+ */
+typedef void (* bthf_client_callheld_callback) (bthf_client_callheld_t callheld);
+
+/** Callback for response and hold
+ */
+typedef void (* bthf_client_resp_and_hold_callback) (bthf_client_resp_and_hold_t resp_and_hold);
+
+/** Callback for Calling Line Identification notification
+ *  Will be called only when there is an incoming call and number is provided.
+ */
+typedef void (* bthf_client_clip_callback) (const char *number);
+
+/**
+ * Callback for Call Waiting notification
+ */
+typedef void (* bthf_client_call_waiting_callback) (const char *number);
+
+/**
+ *  Callback for listing current calls. Can be called multiple time.
+ *  If number is unknown NULL is passed.
+ */
+typedef void (*bthf_client_current_calls) (int index, bthf_client_call_direction_t dir,
+                                           bthf_client_call_state_t state,
+                                           bthf_client_call_mpty_type_t mpty,
+                                           const char *number);
+
+/** Callback for audio volume change
+ */
+typedef void (*bthf_client_volume_change_callback) (bthf_client_volume_type_t type, int volume);
+
+/** Callback for command complete event
+ *  cme is valid only for BTHF_CLIENT_CMD_COMPLETE_ERROR_CME type
+ */
+typedef void (*bthf_client_cmd_complete_callback) (bthf_client_cmd_complete_t type, int cme);
+
+/** Callback for subscriber information
+ */
+typedef void (* bthf_client_subscriber_info_callback) (const char *name,
+                                                       bthf_client_subscriber_service_type_t type);
+
+/** Callback for in-band ring tone settings
+ */
+typedef void (* bthf_client_in_band_ring_tone_callback) (bthf_client_in_band_ring_state_t state);
+
+/**
+ * Callback for requested number from AG
+ */
+typedef void (* bthf_client_last_voice_tag_number_callback) (const char *number);
+
+/**
+ * Callback for sending ring indication to app
+ */
+typedef void (* bthf_client_ring_indication_callback) (void);
+
+/** BT-HF callback structure. */
+typedef struct {
+    /** set to sizeof(BtHfClientCallbacks) */
+    size_t      size;
+    bthf_client_connection_state_callback  connection_state_cb;
+    bthf_client_audio_state_callback       audio_state_cb;
+    bthf_client_vr_cmd_callback            vr_cmd_cb;
+    bthf_client_network_state_callback     network_state_cb;
+    bthf_client_network_roaming_callback   network_roaming_cb;
+    bthf_client_network_signal_callback    network_signal_cb;
+    bthf_client_battery_level_callback     battery_level_cb;
+    bthf_client_current_operator_callback  current_operator_cb;
+    bthf_client_call_callback              call_cb;
+    bthf_client_callsetup_callback         callsetup_cb;
+    bthf_client_callheld_callback          callheld_cb;
+    bthf_client_resp_and_hold_callback     resp_and_hold_cb;
+    bthf_client_clip_callback              clip_cb;
+    bthf_client_call_waiting_callback      call_waiting_cb;
+    bthf_client_current_calls              current_calls_cb;
+    bthf_client_volume_change_callback     volume_change_cb;
+    bthf_client_cmd_complete_callback      cmd_complete_cb;
+    bthf_client_subscriber_info_callback   subscriber_info_cb;
+    bthf_client_in_band_ring_tone_callback in_band_ring_tone_cb;
+    bthf_client_last_voice_tag_number_callback last_voice_tag_number_callback;
+    bthf_client_ring_indication_callback   ring_indication_cb;
+} bthf_client_callbacks_t;
+
+/** Represents the standard BT-HF interface. */
+typedef struct {
+
+    /** set to sizeof(BtHfClientInterface) */
+    size_t size;
+    /**
+     * Register the BtHf callbacks
+     */
+    bt_status_t (*init)(bthf_client_callbacks_t* callbacks);
+
+    /** connect to audio gateway */
+    bt_status_t (*connect)(bt_bdaddr_t *bd_addr);
+
+    /** disconnect from audio gateway */
+    bt_status_t (*disconnect)(bt_bdaddr_t *bd_addr);
+
+    /** create an audio connection */
+    bt_status_t (*connect_audio)(bt_bdaddr_t *bd_addr);
+
+    /** close the audio connection */
+    bt_status_t (*disconnect_audio)(bt_bdaddr_t *bd_addr);
+
+    /** start voice recognition */
+    bt_status_t (*start_voice_recognition)(void);
+
+    /** stop voice recognition */
+    bt_status_t (*stop_voice_recognition)(void);
+
+    /** volume control */
+    bt_status_t (*volume_control) (bthf_client_volume_type_t type, int volume);
+
+    /** place a call with number a number
+     * if number is NULL last called number is called (aka re-dial)*/
+    bt_status_t (*dial) (const char *number);
+
+    /** place a call with number specified by location (speed dial) */
+    bt_status_t (*dial_memory) (int location);
+
+    /** perform specified call related action
+     * idx is limited only for enhanced call control related action
+     */
+    bt_status_t (*handle_call_action) (bthf_client_call_action_t action, int idx);
+
+    /** query list of current calls */
+    bt_status_t (*query_current_calls) (void);
+
+    /** query name of current selected operator */
+    bt_status_t (*query_current_operator_name) (void);
+
+    /** Retrieve subscriber information */
+    bt_status_t (*retrieve_subscriber_info) (void);
+
+    /** Send DTMF code*/
+    bt_status_t (*send_dtmf) (char code);
+
+    /** Request a phone number from AG corresponding to last voice tag recorded */
+    bt_status_t (*request_last_voice_tag_number) (void);
+
+    /** Closes the interface. */
+    void (*cleanup)(void);
+
+    /** Send AT Command. */
+    bt_status_t (*send_at_cmd) (int cmd, int val1, int val2, const char *arg);
+} bthf_client_interface_t;
+
+__END_DECLS
+
+#endif /* ANDROID_INCLUDE_BT_HF_CLIENT_H */
diff --git a/include/hardware/bt_rc.h b/include/hardware/bt_rc.h
index d455543..c565c48 100644
--- a/include/hardware/bt_rc.h
+++ b/include/hardware/bt_rc.h
@@ -171,7 +171,7 @@
 /** Callback for passthrough commands */
 typedef void (* btrc_passthrough_cmd_callback) (int id, int key_state);
 
-/** BT-RC callback structure. */
+/** BT-RC Target callback structure. */
 typedef struct {
     /** set to sizeof(BtRcCallbacks) */
     size_t      size;
@@ -189,7 +189,7 @@
     btrc_passthrough_cmd_callback               passthrough_cmd_cb;
 } btrc_callbacks_t;
 
-/** Represents the standard BT-RC interface. */
+/** Represents the standard BT-RC AVRCP Target interface. */
 typedef struct {
 
     /** set to sizeof(BtRcInterface) */
@@ -261,6 +261,36 @@
     void  (*cleanup)( void );
 } btrc_interface_t;
 
+
+typedef void (* btrc_passthrough_rsp_callback) (int id, int key_state);
+
+typedef void (* btrc_connection_state_callback) (bool state, bt_bdaddr_t *bd_addr);
+
+/** BT-RC Controller callback structure. */
+typedef struct {
+    /** set to sizeof(BtRcCallbacks) */
+    size_t      size;
+    btrc_passthrough_rsp_callback               passthrough_rsp_cb;
+    btrc_connection_state_callback              connection_state_cb;
+} btrc_ctrl_callbacks_t;
+
+/** Represents the standard BT-RC AVRCP Controller interface. */
+typedef struct {
+
+    /** set to sizeof(BtRcInterface) */
+    size_t          size;
+    /**
+     * Register the BtRc callbacks
+     */
+    bt_status_t (*init)( btrc_ctrl_callbacks_t* callbacks );
+
+    /** send pass through command to target */
+    bt_status_t (*send_pass_through_cmd) ( bt_bdaddr_t *bd_addr, uint8_t key_code, uint8_t key_state );
+
+    /** Closes the interface. */
+    void  (*cleanup)( void );
+} btrc_ctrl_interface_t;
+
 __END_DECLS
 
 #endif /* ANDROID_INCLUDE_BT_RC_H */
diff --git a/include/hardware/camera_common.h b/include/hardware/camera_common.h
index 15b3b19..0ee929e 100644
--- a/include/hardware/camera_common.h
+++ b/include/hardware/camera_common.h
@@ -75,6 +75,16 @@
  *   This camera module version adds vendor tag support from the module, and
  *   deprecates the old vendor_tag_query_ops that were previously only
  *   accessible with a device open.
+ *
+ *******************************************************************************
+ * Version: 2.3 [CAMERA_MODULE_API_VERSION_2_3]
+ *
+ *   This camera module version adds open legacy camera HAL device support.
+ *   Framework can use it to open the camera device as lower device HAL version
+ *   HAL device if the same device can support multiple device API versions.
+ *   The standard hardware module open call (common.methods->open) continues
+ *   to open the camera device with the latest supported version, which is
+ *   also the version listed in camera_info_t.device_version.
  */
 
 /**
@@ -89,8 +99,9 @@
 #define CAMERA_MODULE_API_VERSION_2_0 HARDWARE_MODULE_API_VERSION(2, 0)
 #define CAMERA_MODULE_API_VERSION_2_1 HARDWARE_MODULE_API_VERSION(2, 1)
 #define CAMERA_MODULE_API_VERSION_2_2 HARDWARE_MODULE_API_VERSION(2, 2)
+#define CAMERA_MODULE_API_VERSION_2_3 HARDWARE_MODULE_API_VERSION(2, 3)
 
-#define CAMERA_MODULE_API_VERSION_CURRENT CAMERA_MODULE_API_VERSION_2_2
+#define CAMERA_MODULE_API_VERSION_CURRENT CAMERA_MODULE_API_VERSION_2_3
 
 /**
  * All device versions <= HARDWARE_DEVICE_API_VERSION(1, 0xFF) must be treated
@@ -327,8 +338,55 @@
      */
     void (*get_vendor_tag_ops)(vendor_tag_ops_t* ops);
 
+    /**
+     * open_legacy:
+     *
+     * Open a specific legacy camera HAL device if multiple device HAL API
+     * versions are supported by this camera HAL module. For example, if the
+     * camera module supports both CAMERA_DEVICE_API_VERSION_1_0 and
+     * CAMERA_DEVICE_API_VERSION_3_2 device API for the same camera id,
+     * framework can call this function to open the camera device as
+     * CAMERA_DEVICE_API_VERSION_1_0 device.
+     *
+     * This is an optional method. A Camera HAL module does not need to support
+     * more than one device HAL version per device, and such modules may return
+     * -ENOSYS for all calls to this method. For all older HAL device API
+     * versions that are not supported, it may return -EOPNOTSUPP. When above
+     * cases occur, The normal open() method (common.methods->open) will be
+     * used by the framework instead.
+     *
+     * Version information (based on camera_module_t.common.module_api_version):
+     *
+     *  CAMERA_MODULE_API_VERSION_1_x/2_0/2_1/2_2:
+     *    Not provided by HAL module. Framework will not call this function.
+     *
+     *  CAMERA_MODULE_API_VERSION_2_3:
+     *    Valid to be called by the framework.
+     *
+     * Return values:
+     *
+     * 0:           On a successful open of the camera device.
+     *
+     * -ENOSYS      This method is not supported.
+     *
+     * -EOPNOTSUPP: The requested HAL version is not supported by this method.
+     *
+     * -EINVAL:     The input arguments are invalid, i.e. the id is invalid,
+     *              and/or the module is invalid.
+     *
+     * -EBUSY:      The camera device was already opened for this camera id
+     *              (by using this method or common.methods->open method),
+     *              regardless of the device HAL version it was opened as.
+     *
+     * -EUSERS:     The maximal number of camera devices that can be
+     *              opened concurrently were opened already, either by
+     *              this method or common.methods->open method.
+     */
+    int (*open_legacy)(const struct hw_module_t* module, const char* id,
+            uint32_t halVersion, struct hw_device_t** device);
+
     /* reserved for future use */
-    void* reserved[8];
+    void* reserved[7];
 } camera_module_t;
 
 __END_DECLS
diff --git a/include/hardware/fingerprint.h b/include/hardware/fingerprint.h
index 7f6fa28..91ba45b 100644
--- a/include/hardware/fingerprint.h
+++ b/include/hardware/fingerprint.h
@@ -22,18 +22,28 @@
 
 typedef enum fingerprint_msg_type {
     FINGERPRINT_ERROR = -1,
-    FINGERPRINT_SCANNED = 1,
-    FINGERPRINT_TEMPLATE_ENROLLING = 2,
+    FINGERPRINT_ACQUIRED = 1,
+    FINGERPRINT_PROCESSED = 2,
+    FINGERPRINT_TEMPLATE_ENROLLING = 3,
     FINGERPRINT_TEMPLATE_REMOVED = 4
 } fingerprint_msg_type_t;
 
 typedef enum fingerprint_error {
     FINGERPRINT_ERROR_HW_UNAVAILABLE = 1,
-    FINGERPRINT_ERROR_BAD_CAPTURE = 2,
+    FINGERPRINT_ERROR_UNABLE_TO_PROCESS = 2,
     FINGERPRINT_ERROR_TIMEOUT = 3,
     FINGERPRINT_ERROR_NO_SPACE = 4  /* No space available to store a template */
 } fingerprint_error_t;
 
+typedef enum fingerprint_scan_info {
+    FINGERPRINT_SCAN_GOOD = 0,
+    FINGERPRINT_SCAN_PARTIAL = 1,
+    FINGERPRINT_SCAN_INSUFFICIENT = 2,
+    FINGERPRINT_SCAN_IMAGER_DIRTY = 4,
+    FINGERPRINT_SCAN_TOO_SLOW = 8,
+    FINGERPRINT_SCAN_TOO_FAST = 16
+} fingerprint_scan_info_t;
+
 typedef struct fingerprint_enroll {
     uint32_t id;
     /* samples_remaining goes from N (no data collected, but N scans needed)
@@ -61,9 +71,13 @@
     uint32_t id;
 } fingerprint_removed_t;
 
-typedef struct fingerprint_scanned {
+typedef struct fingerprint_acquired {
+    fingerprint_scan_info_t scan_info; /* information about the image */
+} fingerprint_acquired_t;
+
+typedef struct fingerprint_processed {
     uint32_t id; /* 0 is a special id and means no match */
-} fingerprint_scanned_t;
+} fingerprint_processed_t;
 
 typedef struct fingerprint_msg {
     fingerprint_msg_type_t type;
@@ -72,7 +86,8 @@
         fingerprint_error_t error;
         fingerprint_enroll_t enroll;
         fingerprint_removed_t removed;
-        fingerprint_scanned_t scan;
+        fingerprint_acquired_t acquired;
+        fingerprint_processed_t processed;
     } data;
 } fingerprint_msg_t;
 
@@ -82,10 +97,10 @@
 /* Synchronous operation */
 typedef struct fingerprint_device {
     /**
-     * Common methods of the fingerprint device.  This *must* be the first member of
-     * fingerprint_device as users of this structure will cast a hw_device_t to
-     * fingerprint_device pointer in contexts where it's known the hw_device_t references a
-     * fingerprint_device.
+     * Common methods of the fingerprint device. This *must* be the first member
+     * of fingerprint_device as users of this structure will cast a hw_device_t
+     * to fingerprint_device pointer in contexts where it's known
+     * the hw_device_t references a fingerprint_device.
      */
     struct hw_device_t common;
 
@@ -152,10 +167,10 @@
 
 typedef struct fingerprint_module {
     /**
-     * Common methods of the fingerprint module.  This *must* be the first member of
-     * fingerprint_module as users of this structure will cast a hw_module_t to
-     * fingerprint_module pointer in contexts where it's known the hw_module_t references a
-     * fingerprint_module.
+     * Common methods of the fingerprint module. This *must* be the first member
+     * of fingerprint_module as users of this structure will cast a hw_module_t
+     * to fingerprint_module pointer in contexts where it's known
+     * the hw_module_t references a fingerprint_module.
      */
     struct hw_module_t common;
 } fingerprint_module_t;
diff --git a/include/hardware/gps.h b/include/hardware/gps.h
index 4167793..7244738 100644
--- a/include/hardware/gps.h
+++ b/include/hardware/gps.h
@@ -21,6 +21,7 @@
 #include <sys/cdefs.h>
 #include <sys/types.h>
 #include <pthread.h>
+#include <sys/socket.h>
 
 #include <hardware/hardware.h>
 
@@ -135,6 +136,12 @@
 #define AGPS_SETID_TYPE_IMSI    1
 #define AGPS_SETID_TYPE_MSISDN  2
 
+typedef uint16_t ApnIpType;
+#define APN_IP_INVALID          0
+#define APN_IP_IPV4             1
+#define APN_IP_IPV6             2
+#define APN_IP_IPV4V6           3
+
 /**
  * String length constants
  */
@@ -481,13 +488,45 @@
 
 /** Represents the status of AGPS. */
 typedef struct {
-    /** set to sizeof(AGpsStatus) */
+    /** set to sizeof(AGpsStatus_v1) */
+    size_t          size;
+
+    AGpsType        type;
+    AGpsStatusValue status;
+} AGpsStatus_v1;
+
+/** Represents the status of AGPS augmented with a IPv4 address field. */
+typedef struct {
+    /** set to sizeof(AGpsStatus_v2) */
     size_t          size;
 
     AGpsType        type;
     AGpsStatusValue status;
     uint32_t        ipaddr;
-} AGpsStatus;
+} AGpsStatus_v2;
+
+/* Represents the status of AGPS augmented to support IPv4 and IPv6. */
+typedef struct {
+    /** set to sizeof(AGpsStatus_v3) */
+    size_t                  size;
+
+    AGpsType                type;
+    AGpsStatusValue         status;
+
+    /**
+     * Must be set to a valid IPv4 address if the field 'addr' contains an IPv4
+     * address, or set to INADDR_NONE otherwise.
+     */
+    uint32_t                ipaddr;
+
+    /**
+     * Must contain the IPv4 (AF_INET) or IPv6 (AF_INET6) address to report.
+     * Any other value of addr.ss_family will be rejected.
+     * */
+    struct sockaddr_storage addr;
+} AGpsStatus_v3;
+
+typedef AGpsStatus_v3     AGpsStatus;
 
 /** Callback with AGPS status information.
  *  Can only be called from a thread created by create_thread_cb.
@@ -503,7 +542,7 @@
 
 /** Extended interface for AGPS support. */
 typedef struct {
-    /** set to sizeof(AGpsInterface) */
+    /** set to sizeof(AGpsInterface_v1) */
     size_t          size;
 
     /**
@@ -528,7 +567,50 @@
      * Sets the hostname and port for the AGPS server.
      */
     int  (*set_server)( AGpsType type, const char* hostname, int port );
-} AGpsInterface;
+} AGpsInterface_v1;
+
+/**
+ * Extended interface for AGPS support, it is augmented to enable to pass
+ * extra APN data.
+ */
+typedef struct {
+    /** set to sizeof(AGpsInterface_v2) */
+    size_t size;
+
+    /**
+     * Opens the AGPS interface and provides the callback routines to the
+     * implementation of this interface.
+     */
+    void (*init)(AGpsCallbacks* callbacks);
+    /**
+     * Deprecated.
+     * If the HAL supports AGpsInterface_v2 this API will not be used, see
+     * data_conn_open_with_apn_ip_type for more information.
+     */
+    int (*data_conn_open)(const char* apn);
+    /**
+     * Notifies that the AGPS data connection has been closed.
+     */
+    int (*data_conn_closed)();
+    /**
+     * Notifies that a data connection is not available for AGPS.
+     */
+    int (*data_conn_failed)();
+    /**
+     * Sets the hostname and port for the AGPS server.
+     */
+    int (*set_server)(AGpsType type, const char* hostname, int port);
+
+    /**
+     * Notifies that a data connection is available and sets the name of the
+     * APN, and its IP type, to be used for SUPL connections.
+     */
+    int (*data_conn_open_with_apn_ip_type)(
+            const char* apn,
+            ApnIpType apnIpType);
+} AGpsInterface_v2;
+
+typedef AGpsInterface_v2    AGpsInterface;
 
 /** Error codes associated with certificate operations */
 #define AGPS_CERTIFICATE_OPERATION_SUCCESS               0
diff --git a/include/hardware/hwcomposer.h b/include/hardware/hwcomposer.h
index fa772d6..f647ab3 100644
--- a/include/hardware/hwcomposer.h
+++ b/include/hardware/hwcomposer.h
@@ -595,18 +595,53 @@
     int (*eventControl)(struct hwc_composer_device_1* dev, int disp,
             int event, int enabled);
 
-    /*
-     * blank(..., blank)
-     * Blanks or unblanks a display's screen.
-     *
-     * Turns the screen off when blank is nonzero, on when blank is zero.
-     * Multiple sequential calls with the same blank value must be supported.
-     * The screen state transition must be be complete when the function
-     * returns.
-     *
-     * returns 0 on success, negative on error.
-     */
-    int (*blank)(struct hwc_composer_device_1* dev, int disp, int blank);
+    union {
+        /*
+         * For HWC 1.3 and earlier, the blank() interface is used.
+         *
+         * blank(..., blank)
+         * Blanks or unblanks a display's screen.
+         *
+         * Turns the screen off when blank is nonzero, on when blank is zero.
+         * Multiple sequential calls with the same blank value must be
+         * supported.
+         * The screen state transition must be be complete when the function
+         * returns.
+         *
+         * returns 0 on success, negative on error.
+         */
+        int (*blank)(struct hwc_composer_device_1* dev, int disp, int blank);
+
+        /*
+         * For HWC 1.4 and above, setPowerMode() will be used in place of
+         * blank().
+         *
+         * setPowerMode(..., mode)
+         * Sets the display screen's power state.
+         *
+         * The expected functionality for the various modes is as follows:
+         * HWC_POWER_MODE_OFF    : Turn the display off.
+         * HWC_POWER_MODE_DOZE   : Turn on the display (if it was previously
+         *                         off) and put the display in a low power mode.
+         * HWC_POWER_MODE_NORMAL : Turn on the display (if it was previously
+         *                         off), and take it out of low power mode.
+         *
+         * The functionality is similar to the blank() command in previous
+         * versions of HWC, but with support for more power states.
+         *
+         * The display driver is expected to retain and restore the low power
+         * state of the display while entering and exiting from suspend.
+         *
+         * Multiple sequential calls with the same mode value must be supported.
+         *
+         * The screen state transition must be be complete when the function
+         * returns.
+         *
+         * returns 0 on success, negative on error.
+         */
+        int (*setPowerMode)(struct hwc_composer_device_1* dev, int disp,
+                int mode);
+    };
 
     /*
      * Used to retrieve information about the h/w composer
diff --git a/include/hardware/hwcomposer_defs.h b/include/hardware/hwcomposer_defs.h
index 242e3f6..bd6e1e6 100644
--- a/include/hardware/hwcomposer_defs.h
+++ b/include/hardware/hwcomposer_defs.h
@@ -199,6 +199,13 @@
     HWC_DISPLAY_VIRTUAL_BIT     = 1 << HWC_DISPLAY_VIRTUAL,
 };
 
+/* Display power modes */
+enum {
+    HWC_POWER_MODE_OFF      = 0,
+    HWC_POWER_MODE_DOZE     = 1,
+    HWC_POWER_MODE_NORMAL   = 2,
+};
+
 /*****************************************************************************/
 
 __END_DECLS
diff --git a/include/hardware/sensors.h b/include/hardware/sensors.h
index 91aa111..5ba5ef7 100644
--- a/include/hardware/sensors.h
+++ b/include/hardware/sensors.h
@@ -100,10 +100,25 @@
     /*
      * Whether this sensor wakes up the AP from suspend mode when data is available.
      */
-    SENSOR_FLAG_WAKE_UP = 1U << 0
+    SENSOR_FLAG_WAKE_UP = 1U << 0,
+    /*
+     * Reporting modes for various sensors. Each sensor will have exactly one of these modes set.
+     * The least significant 2nd, 3rd and 4th bits are used to represent four possible reporting
+     * modes.
+     */
+    SENSOR_FLAG_CONTINUOUS_MODE        = 0,    // 0000
+    SENSOR_FLAG_ON_CHANGE_MODE         = 0x2,  // 0010
+    SENSOR_FLAG_ONE_SHOT_MODE          = 0x4,  // 0100
+    SENSOR_FLAG_SPECIAL_REPORTING_MODE = 0x6   // 0110
 };
 
 /*
+ * Mask and shift for reporting mode sensor flags defined above.
+ */
+#define REPORTING_MODE_MASK              (0xE)
+#define REPORTING_MODE_SHIFT             (1)
+
+/*
  * Sensor type
  *
  * Each sensor has a type which defines what this sensor measures and how
@@ -158,7 +173,7 @@
 
 /*
  * SENSOR_TYPE_META_DATA
- * trigger-mode: n/a
+ * reporting-mode: n/a
  * wake-up sensor: n/a
  *
  * NO SENSOR OF THAT TYPE MUST BE RETURNED (*get_sensors_list)()
@@ -191,7 +206,7 @@
 
 /*
  * SENSOR_TYPE_ACCELEROMETER
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  *  All values are in SI units (m/s^2) and measure the acceleration of the
@@ -203,7 +218,7 @@
 
 /*
  * SENSOR_TYPE_GEOMAGNETIC_FIELD
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  *  All values are in micro-Tesla (uT) and measure the geomagnetic
@@ -216,7 +231,7 @@
 
 /*
  * SENSOR_TYPE_ORIENTATION
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  * All values are angles in degrees.
@@ -229,7 +244,7 @@
 
 /*
  * SENSOR_TYPE_GYROSCOPE
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  *  All values are in radians/second and measure the rate of rotation
@@ -240,7 +255,7 @@
 
 /*
  * SENSOR_TYPE_LIGHT
- * trigger-mode: on-change
+ * reporting-mode: on-change
  * wake-up sensor: no
  *
  * The light sensor value is returned in SI lux units.
@@ -250,7 +265,7 @@
 
 /*
  * SENSOR_TYPE_PRESSURE
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  * The pressure sensor return the athmospheric pressure in hectopascal (hPa)
@@ -264,7 +279,7 @@
 
 /*
  * SENSOR_TYPE_PROXIMITY
- * trigger-mode: on-change
+ * reporting-mode: on-change
  * wake-up sensor: yes (set SENSOR_FLAG_WAKE_UP flag)
  *
  * The value corresponds to the distance to the nearest object in centimeters.
@@ -274,7 +289,7 @@
 
 /*
  * SENSOR_TYPE_GRAVITY
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  * A gravity output indicates the direction of and magnitude of gravity in
@@ -285,7 +300,7 @@
 
 /*
  * SENSOR_TYPE_LINEAR_ACCELERATION
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  * Indicates the linear acceleration of the device in device coordinates,
@@ -297,7 +312,7 @@
 
 /*
  * SENSOR_TYPE_ROTATION_VECTOR
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  * The rotation vector symbolizes the orientation of the device relative to the
@@ -308,7 +323,7 @@
 
 /*
  * SENSOR_TYPE_RELATIVE_HUMIDITY
- * trigger-mode: on-change
+ * reporting-mode: on-change
  * wake-up sensor: no
  *
  * A relative humidity sensor measures relative ambient air humidity and
@@ -319,7 +334,7 @@
 
 /*
  * SENSOR_TYPE_AMBIENT_TEMPERATURE
- * trigger-mode: on-change
+ * reporting-mode: on-change
  * wake-up sensor: no
  *
  * The ambient (room) temperature in degree Celsius.
@@ -329,7 +344,7 @@
 
 /*
  * SENSOR_TYPE_MAGNETIC_FIELD_UNCALIBRATED
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  *  Similar to SENSOR_TYPE_MAGNETIC_FIELD, but the hard iron calibration is
@@ -340,7 +355,7 @@
 
 /*
  * SENSOR_TYPE_GAME_ROTATION_VECTOR
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  *  Similar to SENSOR_TYPE_ROTATION_VECTOR, but not using the geomagnetic
@@ -351,7 +366,7 @@
 
 /*
  * SENSOR_TYPE_GYROSCOPE_UNCALIBRATED
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  *  All values are in radians/second and measure the rate of rotation
@@ -362,7 +377,7 @@
 
 /*
  * SENSOR_TYPE_SIGNIFICANT_MOTION
- * trigger-mode: one-shot
+ * reporting-mode: one-shot
  * wake-up sensor: yes (set SENSOR_FLAG_WAKE_UP flag)
  *
  * A sensor of this type triggers an event each time significant motion
@@ -375,7 +390,7 @@
 
 /*
  * SENSOR_TYPE_STEP_DETECTOR
- * trigger-mode: special
+ * reporting-mode: special
  * wake-up sensor: no
  *
  * A sensor of this type triggers an event each time a step is taken
@@ -389,7 +404,7 @@
 
 /*
  * SENSOR_TYPE_STEP_COUNTER
- * trigger-mode: on-change
+ * reporting-mode: on-change
  * wake-up sensor: no
  *
  * A sensor of this type returns the number of steps taken by the user since
@@ -402,7 +417,7 @@
 
 /*
  * SENSOR_TYPE_GEOMAGNETIC_ROTATION_VECTOR
- * trigger-mode: continuous
+ * reporting-mode: continuous
  * wake-up sensor: no
  *
  *  Similar to SENSOR_TYPE_ROTATION_VECTOR, but using a magnetometer instead
@@ -413,7 +428,7 @@
 
 /*
  * SENSOR_TYPE_HEART_RATE
- * trigger-mode: on-change
+ * reporting-mode: on-change
  * wake-up sensor: no
  *
  *  A sensor of this type returns the current heart rate.
@@ -424,7 +439,7 @@
  *  Because this sensor is on-change, events must be generated when and only
  *  when heart_rate.bpm or heart_rate.status have changed since the last
  *  event. The event should be generated no faster than every period_ns passed
- *  to setDelay() or to batch(). See the definition of the on-change trigger
+ *  to setDelay() or to batch(). See the definition of the on-change reporting
  *  mode for more information.
  *
  *  sensor_t.requiredPermission must be set to SENSOR_PERMISSION_BODY_SENSORS.
@@ -516,7 +531,7 @@
 
 /*
  * SENSOR_TYPE_WAKE_UP_TILT_DETECTOR
- * trigger-mode: special (setDelay has no impact)
+ * reporting-mode: special (setDelay has no impact)
  * wake-up sensor: yes (set SENSOR_FLAG_WAKE_UP flag)
  *
  * A sensor of this type generates an event each time a tilt event is detected. A tilt event
@@ -543,7 +558,7 @@
 
 /*
  * SENSOR_TYPE_WAKE_GESTURE
- * trigger-mode: one-shot
+ * reporting-mode: one-shot
  * wake-up sensor: yes (set SENSOR_FLAG_WAKE_UP flag)
  *
  * A sensor enabling waking up the device based on a device specific motion.
@@ -781,7 +796,7 @@
     /* rough estimate of this sensor's power consumption in mA */
     float           power;
 
-    /* this value depends on the trigger mode:
+    /* this value depends on the reporting mode:
      *
      *   continuous: minimum sample period allowed in microseconds
      *   on-change : 0
@@ -827,9 +842,12 @@
      * lower frequencies are requested through batch()/setDelay() the events will be generated
      * at this frequency instead. It can be used by the framework or applications to estimate
      * when the batch FIFO may be full.
-     * NOTE: period_ns is in nanoseconds where as maxDelay/minDelay are in microseconds.
-     *     continuous: maximum sampling period allowed in microseconds.
-     *     on-change, one-shot, special : -1
+     *
+     * NOTE: 1) period_ns is in nanoseconds where as maxDelay/minDelay are in microseconds.
+     *              continuous: maximum sampling period allowed in microseconds.
+     *              on-change, one-shot, special : 0
+     *   2) maxDelay should always fit within a 32 bit signed integer. It is declared as 64 bit
+     *      on 64 bit architectures only for binary compatibility reasons.
      * Availability: SENSORS_DEVICE_API_VERSION_1_3
      */
     #ifdef __LP64__
@@ -838,7 +856,10 @@
        int32_t maxDelay;
     #endif
 
-    /* Flags for sensor. See SENSOR_FLAG_* above. */
+    /* Flags for sensor. See SENSOR_FLAG_* above. Only the least significant 32 bits are used here.
+     * It is declared as 64 bit on 64 bit architectures only for binary compatibility reasons.
+     * Availability: SENSORS_DEVICE_API_VERSION_1_3
+     */
     #ifdef __LP64__
        uint64_t flags;
     #else
@@ -918,7 +939,9 @@
     /*
      * Flush adds a META_DATA_FLUSH_COMPLETE event (sensors_event_meta_data_t)
      * to the end of the "batch mode" FIFO for the specified sensor and flushes
-     * the FIFO.
+     * the FIFO. If the FIFO is empty or if the sensor doesn't support batching (FIFO size zero),
+     * it should return SUCCESS along with a trivial META_DATA_FLUSH_COMPLETE event added to the
+     * event stream. This applies to all sensors other than ONE_SHOT sensors.
      */
     int (*flush)(struct sensors_poll_device_1* dev, int handle);
 
diff --git a/include/hardware/tv_input.h b/include/hardware/tv_input.h
index 75aafce..e721caa 100644
--- a/include/hardware/tv_input.h
+++ b/include/hardware/tv_input.h
@@ -62,7 +62,7 @@
 
 /*****************************************************************************/
 
-typedef enum tv_input_type {
+enum {
     /* HDMI */
     TV_INPUT_TYPE_HDMI = 1,
 
@@ -71,7 +71,8 @@
 
     /* Passthrough */
     TV_INPUT_TYPE_PASSTHROUGH = 3,
-} tv_input_type_t;
+};
+typedef uint32_t tv_input_type_t;
 
 typedef struct tv_input_device_info {
     /* Device ID */
@@ -80,10 +81,16 @@
     /* Type of physical TV input. */
     tv_input_type_t type;
 
-    /*
-     * TODO: A union of type specific information. For example, HDMI port
-     * identifier that HDMI hardware understands.
-     */
+    union {
+        struct {
+            /* HDMI port ID number */
+            uint32_t port_id;
+        } hdmi;
+
+        /* TODO: add other type specific information. */
+
+        int32_t type_info_reserved[16];
+    };
 
     /* TODO: Add capability if necessary. */
 
@@ -93,10 +100,12 @@
      * audio_type == AUDIO_DEVICE_NONE if this input has no audio.
      */
     audio_devices_t audio_type;
-    char audio_address[AUDIO_DEVICE_MAX_ADDRESS_LEN];
+    const char* audio_address;
+
+    int32_t reserved[16];
 } tv_input_device_info_t;
 
-typedef enum {
+enum {
     /*
      * Hardware notifies the framework that a device is available.
      */
@@ -121,7 +130,8 @@
      * canceled the request. Client can assume ownership of the buffer again.
      */
     TV_INPUT_EVENT_CAPTURE_FAILED = 5,
-} tv_input_event_type_t;
+};
+typedef uint32_t tv_input_event_type_t;
 
 typedef struct tv_input_capture_result {
     /* Device ID */
@@ -179,10 +189,11 @@
             tv_input_event_t* event, void* data);
 } tv_input_callback_ops_t;
 
-typedef enum {
+enum {
     TV_STREAM_TYPE_INDEPENDENT_VIDEO_SOURCE = 1,
     TV_STREAM_TYPE_BUFFER_PRODUCER = 2,
-} tv_stream_type_t;
+};
+typedef uint32_t tv_stream_type_t;
 
 typedef struct tv_stream_config {
     /*
diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index f11b207..51a5a29 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -388,8 +388,17 @@
     // If a pipe isn't associated with the device, create one.
     if (rsxadev->rsxSink == NULL || rsxadev->rsxSource == NULL) {
         struct submix_config * const device_config = &rsxadev->config;
-        const NBAIO_Format format = Format_from_SR_C(config->sample_rate,
-                 get_channel_count_from_mask(config->channel_mask), config->format);
+        const uint32_t channel_count = get_channel_count_from_mask(config->channel_mask);
+#if ENABLE_CHANNEL_CONVERSION
+        // If channel conversion is enabled, allocate enough space for the maximum number of
+        // possible channels stored in the pipe for the situation when the number of channels in
+        // the output stream don't match the number in the input stream.
+        const uint32_t pipe_channel_count = max(channel_count, 2);
+#else
+        const uint32_t pipe_channel_count = channel_count;
+#endif // ENABLE_CHANNEL_CONVERSION
+        const NBAIO_Format format = Format_from_SR_C(config->sample_rate, pipe_channel_count,
+            config->format);
         const NBAIO_Format offers[1] = {format};
         size_t numCounterOffers = 0;
         // Create a MonoPipe with optional blocking set to true.
@@ -417,6 +426,11 @@
                 buffer_period_count;
         if (in) device_config->pipe_frame_size = audio_stream_frame_size(&in->stream.common);
         if (out) device_config->pipe_frame_size = audio_stream_frame_size(&out->stream.common);
+#if ENABLE_CHANNEL_CONVERSION
+        // Calculate the pipe frame size based upon the number of channels.
+        device_config->pipe_frame_size = (device_config->pipe_frame_size * pipe_channel_count) /
+                channel_count;
+#endif // ENABLE_CHANNEL_CONVERSION
         SUBMIX_ALOGV("submix_audio_device_create_pipe(): pipe frame size %zd, pipe size %zd, "
                      "period size %zd", device_config->pipe_frame_size,
                      device_config->buffer_size_frames, device_config->buffer_period_size_frames);
@@ -669,15 +683,10 @@
     const struct submix_config * const config = &out->dev->config;
     const size_t buffer_size_frames = calculate_stream_pipe_size_in_frames(
             &stream->common, config, config->buffer_size_frames);
-#if ENABLE_RESAMPLING
-    // Sample rate conversion occurs when data is read from the input so data in the buffer is
-    // at output_sample_rate Hz.
-    const uint32_t latency_ms = (buffer_size_frames * 1000) / config->output_sample_rate;
-#else
-    const uint32_t latency_ms = (buffer_size_frames * 1000) / config->common.sample_rate;
-#endif // ENABLE_RESAMPLING
+    const uint32_t sample_rate = out_get_sample_rate(&stream->common);
+    const uint32_t latency_ms = (buffer_size_frames * 1000) / sample_rate;
     SUBMIX_ALOGV("out_get_latency() returns %u ms, size in frames %zu, sample rate %u",
-                 latency_ms, buffer_size_frames, config->common.sample_rate);
+                 latency_ms, buffer_size_frames, sample_rate);
     return latency_ms;
 }
 
@@ -1114,7 +1123,7 @@
 
     if (remaining_frames > 0) {
         const size_t remaining_bytes = remaining_frames * frame_size;
-        SUBMIX_ALOGV("  remaining_frames = %zu", remaining_frames);
+        SUBMIX_ALOGV("  clearing remaining_frames = %zu", remaining_frames);
         memset(((char*)buffer)+ bytes - remaining_bytes, 0, remaining_bytes);
     }
 
@@ -1186,6 +1195,7 @@
     struct submix_audio_device * const rsxadev = audio_hw_device_get_submix_audio_device(dev);
     ALOGV("adev_open_output_stream()");
     struct submix_stream_out *out;
+    bool force_pipe_creation = false;
     (void)handle;
     (void)devices;
     (void)flags;
@@ -1221,9 +1231,16 @@
     out->stream.get_render_position = out_get_render_position;
     out->stream.get_next_write_timestamp = out_get_next_write_timestamp;
 
-    // If the sink has been shutdown, delete the pipe so that it's recreated.
+#if ENABLE_RESAMPLING
+    // Recreate the pipe with the correct sample rate so that MonoPipe.write() rate limits
+    // writes correctly.
+    force_pipe_creation = rsxadev->config.common.sample_rate != config->sample_rate;
+#endif // ENABLE_RESAMPLING
+
+    // If the sink has been shutdown or pipe recreation is forced (see above), delete the pipe so
+    // that it's recreated.
     pthread_mutex_lock(&rsxadev->lock);
-    if (rsxadev->rsxSink != NULL && rsxadev->rsxSink->isShutdown()) {
+    if ((rsxadev->rsxSink != NULL && rsxadev->rsxSink->isShutdown()) || force_pipe_creation) {
         submix_audio_device_release_pipe(rsxadev);
     }
     pthread_mutex_unlock(&rsxadev->lock);
@@ -1347,7 +1364,7 @@
         const size_t frame_size_in_bytes = get_channel_count_from_mask(config->channel_mask) *
                 audio_bytes_per_sample(config->format);
         const size_t buffer_size = buffer_period_size_frames * frame_size_in_bytes;
-        SUBMIX_ALOGV("out_get_buffer_size() returns %zu bytes, %zu frames",
+        SUBMIX_ALOGV("adev_get_input_buffer_size() returns %zu bytes, %zu frames",
                  buffer_size, buffer_period_size_frames);
         return buffer_size;
     }
diff --git a/modules/camera/CameraHAL.cpp b/modules/camera/CameraHAL.cpp
index b04cf0c..6f64a0d 100644
--- a/modules/camera/CameraHAL.cpp
+++ b/modules/camera/CameraHAL.cpp
@@ -184,6 +184,7 @@
     get_camera_info       : get_camera_info,
     set_callbacks         : set_callbacks,
     get_vendor_tag_ops    : get_vendor_tag_ops,
+    open_legacy           : NULL,
     reserved              : {0},
 };
 } // extern "C"
diff --git a/modules/sensors/multihal.cpp b/modules/sensors/multihal.cpp
index 5fd500a..76ec161 100644
--- a/modules/sensors/multihal.cpp
+++ b/modules/sensors/multihal.cpp
@@ -299,10 +299,11 @@
 int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) {
     ALOGV("poll");
     int empties = 0;
-    int queueCount = (int)this->queues.size();
+    int queueCount = 0;
     int eventsRead = 0;
 
     pthread_mutex_lock(&queue_mutex);
+    queueCount = (int)this->queues.size();
     while (eventsRead == 0) {
         while (empties < queueCount && eventsRead < maxReads) {
             SensorEventQueue* queue = this->queues.at(this->nextReadIndex);
@@ -311,7 +312,13 @@
                 empties++;
             } else {
                 empties = 0;
-                this->copy_event_remap_handle(&data[eventsRead++], event, nextReadIndex);
+                this->copy_event_remap_handle(&data[eventsRead], event, nextReadIndex);
+                if (data[eventsRead].sensor == -1) {
+                    // Bad handle, do not pass corrupted event upstream !
+                    ALOGW("Dropping bad local handle event packet on the floor");
+                } else {
+                    eventsRead++;
+                }
                 queue->dequeue();
             }
             this->nextReadIndex = (this->nextReadIndex + 1) % queueCount;
diff --git a/tests/hardware/struct-offset.cpp b/tests/hardware/struct-offset.cpp
index 6abe360..8e5aa40 100644
--- a/tests/hardware/struct-offset.cpp
+++ b/tests/hardware/struct-offset.cpp
@@ -208,7 +208,8 @@
     CHECK_MEMBER_AT(camera_module_t, get_camera_info, 132, 256);
     CHECK_MEMBER_AT(camera_module_t, set_callbacks, 136, 264);
     CHECK_MEMBER_AT(camera_module_t, get_vendor_tag_ops, 140, 272);
-    CHECK_MEMBER_AT(camera_module_t, reserved, 144, 280);
+    CHECK_MEMBER_AT(camera_module_t, open_legacy, 144, 280);
+    CHECK_MEMBER_AT(camera_module_t, reserved, 148, 288);
 
     //Types defined in camera3.h
     CHECK_MEMBER_AT(camera3_device_ops_t, initialize, 0, 0);