diff --git a/include/hardware/audio_policy.h b/include/hardware/audio_policy.h
index 4e75e02..cbaa31d 100644
--- a/include/hardware/audio_policy.h
+++ b/include/hardware/audio_policy.h
@@ -332,10 +332,9 @@
                              audio_io_handle_t output,
                              int delay_ms);
 
-    /* reroute a given stream type to the specified output */
-    int (*set_stream_output)(void *service,
-                             audio_stream_type_t stream,
-                             audio_io_handle_t output);
+    /* invalidate a stream type, causing a reroute to an unspecified new output */
+    int (*invalidate_stream)(void *service,
+                             audio_stream_type_t stream);
 
     /* function enabling to send proprietary informations directly from audio
      * policy manager to audio hardware interface. */
diff --git a/include/hardware/bt_hh.h b/include/hardware/bt_hh.h
index 09f547b..dad9586 100644
--- a/include/hardware/bt_hh.h
+++ b/include/hardware/bt_hh.h
@@ -99,10 +99,10 @@
  */
 typedef void (* bthh_hid_info_callback)(bt_bdaddr_t *bd_addr, bthh_hid_info_t hid_info);
 
-/** Callback for get/set protocal api.
+/** Callback for get protocol api.
  *  the protocol mode is one of the value from bthh_protocol_mode_t
  */
-typedef void (* bthh_protocol_mode_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status,bthh_protocol_mode_t mode);
+typedef void (* bthh_protocol_mode_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status, bthh_protocol_mode_t mode);
 
 /** Callback for get/set_idle_time api.
  */
@@ -114,6 +114,11 @@
  */
 typedef void (* bthh_get_report_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status, uint8_t* rpt_data, int rpt_size);
 
+/** Callback for set_report/set_protocol api and if error
+ *  occurs for get_report/get_protocol api.
+ */
+typedef void (* bthh_handshake_callback)(bt_bdaddr_t *bd_addr, bthh_status_t hh_status);
+
 
 /** BT-HH callback structure. */
 typedef struct {
@@ -125,6 +130,7 @@
     bthh_idle_time_callback         idle_time_cb;
     bthh_get_report_callback        get_report_cb;
     bthh_virtual_unplug_callback    virtual_unplug_cb;
+    bthh_handshake_callback         handshake_cb;
 
 } bthh_callbacks_t;
 
diff --git a/include/hardware/bt_pan.h b/include/hardware/bt_pan.h
index c8b36b4..83e7949 100644
--- a/include/hardware/bt_pan.h
+++ b/include/hardware/bt_pan.h
@@ -40,8 +40,8 @@
 */
 typedef void (*btpan_connection_state_callback)(btpan_connection_state_t state, bt_status_t error,
                                                 const bt_bdaddr_t *bd_addr, int local_role, int remote_role);
-typedef void (*btpan_control_state_callback)(btpan_control_state_t state, bt_status_t error,
-                                            int local_role, const char* ifname);
+typedef void (*btpan_control_state_callback)(btpan_control_state_t state, int local_role,
+                                            bt_status_t error, const char* ifname);
 
 typedef struct {
     size_t size;
diff --git a/include/hardware/hdmi_cec.h b/include/hardware/hdmi_cec.h
index 938e9dc..a697334 100644
--- a/include/hardware/hdmi_cec.h
+++ b/include/hardware/hdmi_cec.h
@@ -194,7 +194,7 @@
  * Callback function type that will be called by HAL implementation.
  * Services can not close/open the device in the callback.
  */
-typedef void (*event_callback_t)(const hdmi_event_t* event);
+typedef void (*event_callback_t)(const hdmi_event_t* event, void* arg);
 
 typedef struct hdmi_cec_module {
     struct hw_module_t common;
@@ -214,12 +214,26 @@
      * is not successful the addr will be set to CEC_ADDR_UNREGISTERED.
      *
      * Returns 0 on success or -errno on error.
-     *
      */
     int (*allocate_logical_address)(const struct hdmi_cec_device* dev,
             int device_type, cec_logical_address_t* addr);
 
     /*
+     * (*get_logical_address)() returns the logical address already allocated
+     * for the device of the given type. It is necessary to call this function
+     * when HAL implementation, without being triggered by service, updated
+     * the address by itself. Such situation happens when an event like
+     * hotplug occurs, since it is possible the HDMI network topology or
+     * the port which the device was connected to might have changed while it
+     * was unplugged. In response to such events, the service is required to
+     * call this function to get the updated address. The address is written
+     * to addr.
+     *
+     * Returns 0 on success or -errno on error.
+     */
+    int (*get_logical_address)(const struct hdmi_cec_device* dev,
+            int device_type, cec_logical_address_t* addr);
+    /*
      * (*get_physical_address)() returns the CEC physical address. The
      * address is written to addr.
      *
@@ -238,14 +252,17 @@
      * Returns 0 on success or -errno on error.
      */
     int (*send_message)(const struct hdmi_cec_device* dev,
-            const cec_message_t *);
+            const cec_message_t*);
 
     /*
      * (*register_event_callback)() registers a callback that HDMI-CEC HAL
      * can later use for incoming CEC messages or internal HDMI events.
+     * When calling from C++, use the argument arg to pass the calling object.
+     * It will be passed back when the callback is invoked so that the context
+     * can be retrieved.
      */
     void (*register_event_callback)(const struct hdmi_cec_device* dev,
-            event_callback_t callback);
+            event_callback_t callback, void* arg);
 
     /*
      * (*get_version)() returns the CEC version supported by underlying
@@ -262,7 +279,7 @@
     void (*get_vendor_id)(const struct hdmi_cec_device* dev, uint32_t* vendor_id);
 
     /* Reserved for future use to maximum 16 functions. Must be NULL. */
-    void* reserved[16 - 6];
+    void* reserved[16 - 7];
 } hdmi_cec_device_t;
 
 /** convenience API for opening and closing a device */
diff --git a/include/hardware/hwcomposer.h b/include/hardware/hwcomposer.h
index 82e7671..afb4e99 100644
--- a/include/hardware/hwcomposer.h
+++ b/include/hardware/hwcomposer.h
@@ -121,6 +121,26 @@
      *   that the layer will be handled by the HWC (ie: it must not be
      *   composited with OpenGL ES).
      *
+     *
+     * HWC_SIDEBAND
+     *   Set by the caller before calling (*prepare)(), this value indicates
+     *   the contents of this layer come from a sideband video stream.
+     *
+     *   The h/w composer is responsible for receiving new image buffers from
+     *   the stream at the appropriate time (e.g. synchronized to a separate
+     *   audio stream), compositing them with the current contents of other
+     *   layers, and displaying the resulting image. This happens
+     *   independently of the normal prepare/set cycle. The prepare/set calls
+     *   only happen when other layers change, or when properties of the
+     *   sideband layer such as position or size change.
+     *
+     *   If the h/w composer can't handle the layer as a sideband stream for
+     *   some reason (e.g. unsupported scaling/blending/rotation, or too many
+     *   sideband layers) it can set compositionType to HWC_FRAMEBUFFER in
+     *   (*prepare)(). However, doing so will result in the layer being shown
+     *   as a solid color since the platform is not currently able to composite
+     *   sideband layers with the GPU. This may be improved in future
+     *   versions of the platform.
      */
     int32_t compositionType;
 
@@ -141,13 +161,21 @@
         hwc_color_t backgroundColor;
 
         struct {
-            /* handle of buffer to compose. This handle is guaranteed to have been
-             * allocated from gralloc using the GRALLOC_USAGE_HW_COMPOSER usage flag. If
-             * the layer's handle is unchanged across two consecutive prepare calls and
-             * the HWC_GEOMETRY_CHANGED flag is not set for the second call then the
-             * HWComposer implementation may assume that the contents of the buffer have
-             * not changed. */
-            buffer_handle_t handle;
+            union {
+                /* When compositionType is HWC_FRAMEBUFFER, HWC_OVERLAY,
+                 * HWC_FRAMEBUFFER_TARGET, this is the handle of the buffer to
+                 * compose. This handle is guaranteed to have been allocated
+                 * from gralloc using the GRALLOC_USAGE_HW_COMPOSER usage flag.
+                 * If the layer's handle is unchanged across two consecutive
+                 * prepare calls and the HWC_GEOMETRY_CHANGED flag is not set
+                 * for the second call then the HWComposer implementation may
+                 * assume that the contents of the buffer have not changed. */
+                buffer_handle_t handle;
+
+                /* When compositionType is HWC_SIDEBAND, this is the handle
+                 * of the sideband video stream to compose. */
+                const native_handle_t* sidebandStream;
+            };
 
             /* transformation to apply to the buffer during composition */
             uint32_t transform;
@@ -191,6 +219,10 @@
              * reads from them are complete before the framebuffer is ready for
              * display.
              *
+             * HWC_SIDEBAND layers will never have an acquire fence, since
+             * synchronization is handled through implementation-defined
+             * sideband mechanisms.
+             *
              * The HWC takes ownership of the acquireFenceFd and is responsible
              * for closing it when no longer needed.
              */
@@ -214,6 +246,10 @@
              * produce a release fence for them. The releaseFenceFd will be -1
              * for these layers when set() is called.
              *
+             * Since HWC_SIDEBAND buffers don't pass through the HWC client,
+             * the HWC shouldn't produce a release fence for them. The
+             * releaseFenceFd will be -1 for these layers when set() is called.
+             *
              * The HWC client taks ownership of the releaseFenceFd and is
              * responsible for closing it when no longer needed.
              */
@@ -262,7 +298,7 @@
     };
 
     /* Allow for expansion w/o breaking binary compatibility.
-     * Pad layer to 96 bytes.
+     * Pad layer to 96 bytes, assuming 32-bit pointers.
      */
     int32_t reserved[24 - 19];
 
diff --git a/include/hardware/hwcomposer_defs.h b/include/hardware/hwcomposer_defs.h
index c69a4bc..242e3f6 100644
--- a/include/hardware/hwcomposer_defs.h
+++ b/include/hardware/hwcomposer_defs.h
@@ -36,6 +36,7 @@
 #define HWC_DEVICE_API_VERSION_1_1  HARDWARE_DEVICE_API_VERSION_2(1, 1, HWC_HEADER_VERSION)
 #define HWC_DEVICE_API_VERSION_1_2  HARDWARE_DEVICE_API_VERSION_2(1, 2, HWC_HEADER_VERSION)
 #define HWC_DEVICE_API_VERSION_1_3  HARDWARE_DEVICE_API_VERSION_2(1, 3, HWC_HEADER_VERSION)
+#define HWC_DEVICE_API_VERSION_1_4  HARDWARE_DEVICE_API_VERSION_2(1, 4, HWC_HEADER_VERSION)
 
 enum {
     /* hwc_composer_device_t::set failed in EGL */
@@ -95,6 +96,10 @@
     /* this layer holds the result of compositing the HWC_FRAMEBUFFER layers.
      * Added in HWC_DEVICE_API_VERSION_1_1. */
     HWC_FRAMEBUFFER_TARGET = 3,
+
+    /* this layer's contents are taken from a sideband buffer stream.
+     * Added in HWC_DEVICE_API_VERSION_1_4. */
+    HWC_SIDEBAND = 4,
 };
 
 /*
diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index 9df17b6..6b14aa5 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -566,7 +566,8 @@
     // initialize pipe
     {
         ALOGV("  initializing pipe");
-        const NBAIO_Format format = Format_from_SR_C(config->sample_rate, 2);
+        const NBAIO_Format format = Format_from_SR_C(config->sample_rate,
+                popcount(config->channel_mask), config->format);
         const NBAIO_Format offers[1] = {format};
         size_t numCounterOffers = 0;
         // creating a MonoPipe with optional blocking set to true.
diff --git a/modules/gralloc/framebuffer.cpp b/modules/gralloc/framebuffer.cpp
index 326f2ae..9d8513a 100644
--- a/modules/gralloc/framebuffer.cpp
+++ b/modules/gralloc/framebuffer.cpp
@@ -330,7 +330,7 @@
         if (status >= 0) {
             int stride = m->finfo.line_length / (m->info.bits_per_pixel >> 3);
             int format = (m->info.bits_per_pixel == 32)
-                         ? HAL_PIXEL_FORMAT_RGBX_8888
+                         ? (m->info.red.offset ? HAL_PIXEL_FORMAT_BGRA_8888 : HAL_PIXEL_FORMAT_RGBX_8888)
                          : HAL_PIXEL_FORMAT_RGB_565;
             const_cast<uint32_t&>(dev->device.flags) = 0;
             const_cast<uint32_t&>(dev->device.width) = m->info.xres;
diff --git a/modules/gralloc/gr.h b/modules/gralloc/gr.h
index 3a43aa7..732b6bc 100644
--- a/modules/gralloc/gr.h
+++ b/modules/gralloc/gr.h
@@ -18,11 +18,7 @@
 #define GR_H_
 
 #include <stdint.h>
-#ifdef HAVE_ANDROID_OS      // just want PAGE_SIZE define
-# include <asm/page.h>
-#else
-# include <sys/user.h>
-#endif
+#include <sys/user.h>
 #include <limits.h>
 #include <sys/cdefs.h>
 #include <hardware/gralloc.h>
diff --git a/modules/gralloc/gralloc_priv.h b/modules/gralloc/gralloc_priv.h
index 22a5715..2cd1007 100644
--- a/modules/gralloc/gralloc_priv.h
+++ b/modules/gralloc/gralloc_priv.h
@@ -75,7 +75,7 @@
     int     offset;
 
     // FIXME: the attributes below should be out-of-line
-    uintptr_t base;
+    uint64_t base __attribute__((aligned(8)));
     int     pid;
 
 #ifdef __cplusplus