diff --git a/include/hardware/fingerprint.h b/include/hardware/fingerprint.h
index 458ca2d..69307fe 100644
--- a/include/hardware/fingerprint.h
+++ b/include/hardware/fingerprint.h
@@ -18,6 +18,7 @@
 #define ANDROID_INCLUDE_HARDWARE_FINGERPRINT_H
 
 #define FINGERPRINT_MODULE_API_VERSION_1_0 HARDWARE_MODULE_API_VERSION(1, 0)
+#define FINGERPRINT_MODULE_API_VERSION_2_0 HARDWARE_MODULE_API_VERSION(2, 0)
 #define FINGERPRINT_HARDWARE_MODULE_ID "fingerprint"
 
 typedef enum fingerprint_msg_type {
@@ -25,7 +26,8 @@
     FINGERPRINT_ACQUIRED = 1,
     FINGERPRINT_PROCESSED = 2,
     FINGERPRINT_TEMPLATE_ENROLLING = 3,
-    FINGERPRINT_TEMPLATE_REMOVED = 4
+    FINGERPRINT_TEMPLATE_REMOVED = 4,
+    FINGERPRINT_AUTHENTICATED = 5
 } fingerprint_msg_type_t;
 
 typedef enum fingerprint_error {
@@ -39,36 +41,53 @@
     FINGERPRINT_ACQUIRED_GOOD = 0,
     FINGERPRINT_ACQUIRED_PARTIAL = 1,
     FINGERPRINT_ACQUIRED_INSUFFICIENT = 2,
-    FINGERPRINT_ACQUIRED_IMAGER_DIRTY = 4,
-    FINGERPRINT_ACQUIRED_TOO_SLOW = 8,
-    FINGERPRINT_ACQUIRED_TOO_FAST = 16
+    FINGERPRINT_ACQUIRED_IMAGER_DIRTY = 3,
+    FINGERPRINT_ACQUIRED_TOO_SLOW = 4,
+    FINGERPRINT_ACQUIRED_TOO_FAST = 5,
+    FINGERPRINT_ACQUIRED_VENDOR_DEFINED = 6
 } fingerprint_acquired_info_t;
 
+typedef struct fingerprint_finger_id {
+    uint32_t gid;
+    uint32_t fid;
+} fingerprint_finger_id_t;
+
+/* The progress indication may be augmented by a bitmap encoded indication
+* of what finger area is considered as collected.
+* Bit numbers mapped to physical location:
+*
+*             distal
+*        +--+--+--+--+--+
+*        | 4| 3| 2| 1| 0|
+*        | 9| 8| 7| 6| 5|
+* medial |14|13|12|11|10| lateral
+*        |19|18|17|16|15|
+*        |24|23|22|21|20|
+*        +--+--+--+--+--+
+*            proximal
+*
+*/
+typedef uint32_t finger_map_bmp;
+
+typedef enum fingerprint_enroll_msg_type {
+    FINGERPRINT_ENROLL_MSG_NONE = 0,
+    FINGERPRINT_ENROLL_MSG_PREDEFINED = 1,  /* TODO: define standard enroll cues */
+    FINGERPRINT_ENROLL_MSG_BITMAP = 2,  /* typeof(fingerprint_enroll.msg) == *finger_map_bmp */
+    FINGERPRINT_ENROLL_MSG_VENDOR = 3
+} fingerprint_enroll_msg_type_t;
+
 typedef struct fingerprint_enroll {
-    uint32_t id;
+    fingerprint_finger_id_t finger;
+    uint32_t samples_remaining;
     /* samples_remaining goes from N (no data collected, but N scans needed)
-     * to 0 (no more data is needed to build a template).
-     * The progress indication may be augmented by a bitmap encoded indication
-     * of finger area that needs to be presented by the user.
-     * Bit numbers mapped to physical location:
-     *
-     *        distal
-     *        +-+-+-+
-     *        |2|1|0|
-     *        |5|4|3|
-     * medial |8|7|6| lateral
-     *        |b|a|9|
-     *        |e|d|c|
-     *        +-+-+-+
-     *        proximal
-     *
-     */
-    uint16_t data_collected_bmp;
-    uint16_t samples_remaining;
+     * to 0 (no more data is needed to build a template). */
+    fingerprint_enroll_msg_type_t msg_type;
+    size_t msg_size;
+    void *msg;
 } fingerprint_enroll_t;
 
 typedef struct fingerprint_removed {
-    uint32_t id;
+    fingerprint_finger_id_t finger;
 } fingerprint_removed_t;
 
 typedef struct fingerprint_acquired {
@@ -76,18 +95,29 @@
 } fingerprint_acquired_t;
 
 typedef struct fingerprint_processed {
-    uint32_t id; /* 0 is a special id and means no match */
+    fingerprint_finger_id_t finger; /* all 0s is a special case and means no match */
 } fingerprint_processed_t;
 
+typedef struct fingerprint_authenticated {
+    uint32_t user_id;
+    uint32_t auth_id;
+    uint32_t timestamp;
+    uint32_t app_id;
+    uint64_t crypto_op_id;
+    uint8_t hmac[16];  /* 128-bit */
+    uint32_t auth_token_size;
+    uint8_t *auth_token;
+} fingerprint_authenticated_t;
+
 typedef struct fingerprint_msg {
     fingerprint_msg_type_t type;
     union {
-        uint64_t raw;
         fingerprint_error_t error;
         fingerprint_enroll_t enroll;
         fingerprint_removed_t removed;
         fingerprint_acquired_t acquired;
         fingerprint_processed_t processed;
+        fingerprint_authenticated_t authenticated;
     } data;
 } fingerprint_msg_t;
 
@@ -111,12 +141,14 @@
      * (fingerprint_msg.type == FINGERPRINT_TEMPLATE_ENROLLING &&
      *  fingerprint_msg.data.enroll.samples_remaining == 0)
      * or after timeout_sec seconds.
+     * The fingerprint template will be assigned to the group gid. User has a choice
+     * to supply the gid or set it to 0 in which case a unique group id will be generated.
      *
      * Function return: 0 if enrollment process can be successfully started
      *                 -1 otherwise. A notify() function may be called
      *                    indicating the error condition.
      */
-    int (*enroll)(struct fingerprint_device *dev, uint32_t timeout_sec);
+    int (*enroll)(struct fingerprint_device *dev, uint32_t gid, uint32_t timeout_sec);
 
     /*
      * Cancel fingerprint enroll request:
@@ -133,7 +165,9 @@
     /*
      * Fingerprint remove request:
      * deletes a fingerprint template.
-     * If the fingerprint id is 0 the entire template database will be removed.
+     * If the fingerprint id is 0 and the group is 0 then the entire template
+     * database will be removed. A combinaiton of fingerprint id 0 and a valid
+     * group id deletes all fingreprints in that group.
      * notify() will be called for each template deleted with
      * fingerprint_msg.type == FINGERPRINT_TEMPLATE_REMOVED and
      * fingerprint_msg.data.removed.id indicating each template id removed.
@@ -141,7 +175,24 @@
      * Function return: 0 if fingerprint template(s) can be successfully deleted
      *                 -1 otherwise.
      */
-    int (*remove)(struct fingerprint_device *dev, uint32_t fingerprint_id);
+    int (*remove)(struct fingerprint_device *dev, fingerprint_finger_id_t finger);
+
+    /*
+     * Restricts the HAL operation to a set of fingerprints belonging to a
+     * group provided. Gid of 0 signals global operation.
+     *
+     * Function return: 0 on success
+     *                 -1 if the group does not exist.
+     */
+    int (*set_active_group)(struct fingerprint_device *dev, uint32_t gid);
+
+    /*
+     * Authenticates an operation identifed by operation_id
+     *
+     * Function return: 0 on success
+     *                 -1 if the size is out of bounds.
+     */
+    int (*authenticate)(struct fingerprint_device *dev, uint64_t operation_id);
 
     /*
      * Set notification callback:
diff --git a/include/hardware/keymaster.h b/include/hardware/keymaster.h
index 40380ad..db66a74 100644
--- a/include/hardware/keymaster.h
+++ b/include/hardware/keymaster.h
@@ -534,8 +534,8 @@
      * \param[in] params Additional parameters for the operation.  This is typically used to provide
      * client ID information, with tags KM_TAG_APPLICATION_ID and KM_TAG_APPLICATION_DATA.  If the
      * client information associated with the key is not provided, begin() will fail and return
-     * KM_ERROR_INVALID_KEY_BLOB.  Less commonly, \params can be used to provide AEAD additional
-     * data and chunk size with KM_TAG_ADDITIONAL_DATA or KM_TAG_CHUNK_SIZE respectively.
+     * KM_ERROR_INVALID_KEY_BLOB.  For operations that require a nonce or IV, this must contain a
+     * tag KM_TAG_NONCE.  For AEAD operations KM_TAG_CHUNK_SIZE is specified here.
      *
      * \param[in] params_count The number of entries in \p params.
      *
@@ -569,6 +569,11 @@
      *
      * \param[in] operation_handle The operation handle returned by begin().
      *
+     * \param[in] params Additional parameters for the operation.  For AEAD modes, this is used to
+     * specify KM_TAG_ADDITIONAL_DATA.
+     *
+     * \param[in] params_count Length of \p params.
+     *
      * \param[in] input Data to be processed, per the parameters established in the call to begin().
      * Note that update() may or may not consume all of the data provided.  See \p data_consumed.
      *
@@ -589,9 +594,10 @@
      * *output may be either NULL or zero-length (so the caller should always free() it).
      */
     keymaster_error_t (*update)(const struct keymaster_device* dev,
-                                keymaster_operation_handle_t operation_handle, const uint8_t* input,
-                                size_t input_length, size_t* input_consumed, uint8_t** output,
-                                size_t* output_length);
+                                keymaster_operation_handle_t operation_handle,
+                                const keymaster_key_param_t* params, size_t params_count,
+                                const uint8_t* input, size_t input_length, size_t* input_consumed,
+                                uint8_t** output, size_t* output_length);
 
     /**
      * Finalizes a cryptographic operation begun with begin() and invalidates operation_handle
@@ -602,6 +608,11 @@
      * \param[in] operation_handle The operation handle returned by begin().  This handle will be
      * invalidated.
      *
+     * \param[in] params Additional parameters for the operation.  For AEAD modes, this is used to
+     * specify KM_TAG_ADDITIONAL_DATA.
+     *
+     * \param[in] params_count Length of \p params.
+     *
      * \param[in] signature The signature to be verified if the purpose specified in the begin()
      * call was KM_PURPOSE_VERIFY.
      *
@@ -617,6 +628,7 @@
      */
     keymaster_error_t (*finish)(const struct keymaster_device* dev,
                                 keymaster_operation_handle_t operation_handle,
+                                const keymaster_key_param_t* params, size_t params_count,
                                 const uint8_t* signature, size_t signature_length, uint8_t** output,
                                 size_t* output_length);
 
diff --git a/include/hardware/keymaster_defs.h b/include/hardware/keymaster_defs.h
index 4649055..9c6ad9d 100644
--- a/include/hardware/keymaster_defs.h
+++ b/include/hardware/keymaster_defs.h
@@ -102,15 +102,16 @@
      */
 
     /* Crypto parameters */
-    KM_TAG_PURPOSE = KM_ENUM_REP | 1,  /* keymaster_purpose_t. */
-    KM_TAG_ALGORITHM = KM_ENUM | 2,    /* keymaster_algorithm_t. */
-    KM_TAG_KEY_SIZE = KM_INT | 3,      /* Key size in bits. */
-    KM_TAG_BLOCK_MODE = KM_ENUM | 4,   /* keymaster_block_mode_t. */
-    KM_TAG_DIGEST = KM_ENUM | 5,       /* keymaster_digest_t. */
-    KM_TAG_MAC_LENGTH = KM_INT | 6,    /* MAC length in bits. */
-    KM_TAG_PADDING = KM_ENUM | 7,      /* keymaster_padding_t. */
-    KM_TAG_CHUNK_LENGTH = KM_INT | 8,  /* AEAD mode minimum decryption chunk size, in bytes. */
-    KM_TAG_CALLER_NONCE = KM_BOOL | 9, /* Allow caller to specify nonce or IV. */
+    KM_TAG_PURPOSE = KM_ENUM_REP | 1,     /* keymaster_purpose_t. */
+    KM_TAG_ALGORITHM = KM_ENUM | 2,       /* keymaster_algorithm_t. */
+    KM_TAG_KEY_SIZE = KM_INT | 3,         /* Key size in bits. */
+    KM_TAG_BLOCK_MODE = KM_ENUM | 4,      /* keymaster_block_mode_t. */
+    KM_TAG_DIGEST = KM_ENUM | 5,          /* keymaster_digest_t. */
+    KM_TAG_MAC_LENGTH = KM_INT | 6,       /* MAC length in bits. */
+    KM_TAG_PADDING = KM_ENUM | 7,         /* keymaster_padding_t. */
+    KM_TAG_RETURN_UNAUTHED = KM_BOOL | 8, /* Allow AEAD decryption to return plaintext before it has
+                                             been authenticated.  WARNING: Not recommended. */
+    KM_TAG_CALLER_NONCE = KM_BOOL | 9,    /* Allow caller to specify nonce or IV. */
 
     /* Other hardware-enforced. */
     KM_TAG_RESCOPING_ADD = KM_ENUM_REP | 101, /* Tags authorized for addition via rescoping. */
@@ -173,9 +174,11 @@
     KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704,     /* Root of trust ID.  Empty array means usable by all
                                                   roots. */
 
-    /* Tags used only to provide data to operations */
-    KM_TAG_ADDITIONAL_DATA = KM_BYTES | 1000, /* Used to provide additional data for AEAD modes. */
+    /* Tags used only to provide data to or receive data from operations */
+    KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000, /* Used to provide associated data for AEAD modes. */
     KM_TAG_NONCE = KM_BYTES | 1001,           /* Nonce or Initialization Vector */
+    KM_TAG_CHUNK_LENGTH = KM_INT | 1002,      /* AEAD mode chunk size, in bytes.  0 means no limit,
+                                                 which requires KM_TAG_RETURN_UNAUTHED. */
 } keymaster_tag_t;
 
 /**
@@ -356,10 +359,10 @@
  * In the future this list will expand greatly to accommodate asymmetric key import/export.
  */
 typedef enum {
-    KM_KEY_FORMAT_X509,   /* for public key export, required */
-    KM_KEY_FORMAT_PKCS8,  /* for asymmetric key pair import, required */
-    KM_KEY_FORMAT_PKCS12, /* for asymmetric key pair import, not required */
-    KM_KEY_FORMAT_RAW,    /* for symmetric key import, required */
+    KM_KEY_FORMAT_X509 = 0,   /* for public key export, required */
+    KM_KEY_FORMAT_PKCS8 = 1,  /* for asymmetric key pair import, required */
+    KM_KEY_FORMAT_PKCS12 = 2, /* for asymmetric key pair import, not required */
+    KM_KEY_FORMAT_RAW = 3,    /* for symmetric key import, required */
 } keymaster_key_format_t;
 
 /**
diff --git a/modules/fingerprint/fingerprint.c b/modules/fingerprint/fingerprint.c
index 0346518..091d7ba 100644
--- a/modules/fingerprint/fingerprint.c
+++ b/modules/fingerprint/fingerprint.c
@@ -33,12 +33,27 @@
 }
 
 static int fingerprint_enroll(struct fingerprint_device __unused *dev,
+                                uint32_t __unused gid,
                                 uint32_t __unused timeout_sec) {
     return FINGERPRINT_ERROR;
 }
 
+static int fingerprint_enroll_cancel(struct fingerprint_device __unused *dev) {
+    return FINGERPRINT_ERROR;
+}
+
 static int fingerprint_remove(struct fingerprint_device __unused *dev,
-                                uint32_t __unused fingerprint_id) {
+                                fingerprint_finger_id_t __unused fingerprint_id) {
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_set_active_group(struct fingerprint_device __unused *dev,
+                                        uint32_t __unused gid) {
+    return FINGERPRINT_ERROR;
+}
+
+static int fingerprint_authenticate(struct fingerprint_device __unused *dev,
+                                    uint64_t __unused operation_id) {
     return FINGERPRINT_ERROR;
 }
 
@@ -61,12 +76,15 @@
     memset(dev, 0, sizeof(fingerprint_device_t));
 
     dev->common.tag = HARDWARE_DEVICE_TAG;
-    dev->common.version = HARDWARE_MODULE_API_VERSION(1, 0);
+    dev->common.version = FINGERPRINT_MODULE_API_VERSION_2_0;
     dev->common.module = (struct hw_module_t*) module;
     dev->common.close = fingerprint_close;
 
     dev->enroll = fingerprint_enroll;
+    dev->enroll_cancel = fingerprint_enroll_cancel;
     dev->remove = fingerprint_remove;
+    dev->set_active_group = fingerprint_set_active_group;
+    dev->authenticate = fingerprint_authenticate;
     dev->set_notify = set_notify_callback;
     dev->notify = NULL;
 
@@ -81,7 +99,7 @@
 fingerprint_module_t HAL_MODULE_INFO_SYM = {
     .common = {
         .tag                = HARDWARE_MODULE_TAG,
-        .module_api_version = FINGERPRINT_MODULE_API_VERSION_1_0,
+        .module_api_version = FINGERPRINT_MODULE_API_VERSION_2_0,
         .hal_api_version    = HARDWARE_HAL_API_VERSION,
         .id                 = FINGERPRINT_HARDWARE_MODULE_ID,
         .name               = "Demo Fingerprint HAL",
diff --git a/modules/usbaudio/audio_hal.c b/modules/usbaudio/audio_hal.c
index 2814e37..7d82b37 100644
--- a/modules/usbaudio/audio_hal.c
+++ b/modules/usbaudio/audio_hal.c
@@ -79,7 +79,7 @@
 
     struct audio_device *dev;           /* hardware information - only using this for the lock */
 
-    alsa_device_profile * profile;
+    alsa_device_profile * profile;      /* Points to the alsa_device_profile in the audio_device */
     alsa_device_proxy proxy;            /* state of the stream */
 
     unsigned hal_channel_count;         /* channel count exposed to AudioFlinger.
@@ -101,7 +101,7 @@
 
     struct audio_device *dev;           /* hardware information - only using this for the lock */
 
-    alsa_device_profile * profile;
+    alsa_device_profile * profile;      /* Points to the alsa_device_profile in the audio_device */
     alsa_device_proxy proxy;            /* state of the stream */
 
     unsigned hal_channel_count;         /* channel count exposed to AudioFlinger.
@@ -192,8 +192,9 @@
  *   device A pointer to a variable to receive the parsed-out device number.
  * NOTE: The variables pointed to by card and device return -1 (undefined) if the
  *  associated key/value pair is not found in the provided string.
+ *  Return true if the kvpairs string contain a card/device spec, false otherwise.
  */
-static void parse_card_device_params(const char *kvpairs, int *card, int *device)
+static bool parse_card_device_params(const char *kvpairs, int *card, int *device)
 {
     struct str_parms * parms = str_parms_create_str(kvpairs);
     char value[32];
@@ -214,6 +215,8 @@
     }
 
     str_parms_destroy(parms);
+
+    return *card >= 0 && *device >= 0;
 }
 
 static char * device_get_parameters(alsa_device_profile * profile, const char * keys)
@@ -254,7 +257,7 @@
     char* result_str = str_parms_to_str(result);
     str_parms_destroy(result);
 
-    ALOGV("usb:audio_hw::device_get_parameters = %s", result_str);
+    ALOGV("device_get_parameters = %s", result_str);
 
     return result_str;
 }
@@ -337,7 +340,7 @@
 
 static int out_set_parameters(struct audio_stream *stream, const char *kvpairs)
 {
-    ALOGV("usb:audio_hw::out out_set_parameters() keys:%s", kvpairs);
+    ALOGV("out_set_parameters() keys:%s", kvpairs);
 
     struct stream_out *out = (struct stream_out *)stream;
 
@@ -346,12 +349,16 @@
     int card = -1;
     int device = -1;
 
+    if (!parse_card_device_params(kvpairs, &card, &device)) {
+        // nothing to do
+        return ret_value;
+    }
+
+    /* Lock the device because that is where the profile lives */
     pthread_mutex_lock(&out->dev->lock);
     pthread_mutex_lock(&out->lock);
 
-    parse_card_device_params(kvpairs, &card, &device);
-
-    if (card >= 0 && device >= 0 && !profile_is_cached_for(out->profile, card, device)) {
+    if (!profile_is_cached_for(out->profile, card, device)) {
         /* cannot read pcm device info if playback is active */
         if (!out->standby)
             ret_value = -ENOSYS;
@@ -402,8 +409,7 @@
 /* must be called with hw device and output stream mutexes locked */
 static int start_output_stream(struct stream_out *out)
 {
-    ALOGV("usb:audio_hw::out start_output_stream(card:%d device:%d)",
-          out->profile->card, out->profile->device);
+    ALOGV("start_output_stream(card:%d device:%d)", out->profile->card, out->profile->device);
 
     return proxy_open(&out->proxy);
 }
@@ -502,8 +508,7 @@
                                    struct audio_stream_out **stream_out,
                                    const char *address /*__unused*/)
 {
-    ALOGV("usb:audio_hw::out adev_open_output_stream()"
-          "handle:0x%X, device:0x%X, flags:0x%X, addr:%s",
+    ALOGV("adev_open_output_stream() handle:0x%X, device:0x%X, flags:0x%X, addr:%s",
           handle, devices, flags, address);
 
     struct audio_device *adev = (struct audio_device *)dev;
@@ -614,8 +619,7 @@
                                      struct audio_stream_out *stream)
 {
     struct stream_out *out = (struct stream_out *)stream;
-    ALOGV("usb:audio_hw::out adev_close_output_stream(c:%d d:%d)",
-          out->profile->card, out->profile->device);
+    ALOGV("adev_close_output_stream(c:%d d:%d)", out->profile->card, out->profile->device);
 
     /* Close the pcm device */
     out_standby(&stream->common);
@@ -709,7 +713,7 @@
 
 static int in_set_parameters(struct audio_stream *stream, const char *kvpairs)
 {
-    ALOGV("usb: audio_hw::in in_set_parameters() keys:%s", kvpairs);
+    ALOGV("in_set_parameters() keys:%s", kvpairs);
 
     struct stream_in *in = (struct stream_in *)stream;
 
@@ -720,11 +724,14 @@
     int card = -1;
     int device = -1;
 
+    if (!parse_card_device_params(kvpairs, &card, &device)) {
+        // nothing to do
+        return ret_value;
+    }
+
     pthread_mutex_lock(&in->dev->lock);
     pthread_mutex_lock(&in->lock);
 
-    parse_card_device_params(kvpairs, &card, &device);
-
     if (card >= 0 && device >= 0 && !profile_is_cached_for(in->profile, card, device)) {
         /* cannot read pcm device info if playback is active */
         if (!in->standby)
@@ -781,8 +788,7 @@
 /* must be called with hw device and output stream mutexes locked */
 static int start_input_stream(struct stream_in *in)
 {
-    ALOGV("usb:audio_hw::start_input_stream(card:%d device:%d)",
-          in->profile->card, in->profile->device);
+    ALOGV("ustart_input_stream(card:%d device:%d)", in->profile->card, in->profile->device);
 
     return proxy_open(&in->proxy);
 }
@@ -911,7 +917,7 @@
                                   const char *address /*__unused*/,
                                   audio_source_t source __unused)
 {
-    ALOGV("usb: in adev_open_input_stream() rate:%" PRIu32 ", chanMask:0x%" PRIX32 ", fmt:%" PRIu8,
+    ALOGV("in adev_open_input_stream() rate:%" PRIu32 ", chanMask:0x%" PRIX32 ", fmt:%" PRIu8,
           config->sample_rate, config->channel_mask, config->format);
 
     struct stream_in *in = (struct stream_in *)calloc(1, sizeof(struct stream_in));
@@ -1022,7 +1028,7 @@
  */
 static int adev_set_parameters(struct audio_hw_device *dev, const char *kvpairs)
 {
-    ALOGV("audio_hw:usb adev_set_parameters(%s)", kvpairs);
+    ALOGV("adev_set_parameters(%s)", kvpairs);
 
     struct audio_device * adev = (struct audio_device *)dev;