diff --git a/adb/usb_vendors.c b/adb/usb_vendors.c
index 2effb12..141b32a 100644
--- a/adb/usb_vendors.c
+++ b/adb/usb_vendors.c
@@ -99,6 +99,8 @@
 #define VENDOR_ID_T_AND_A       0x1BBB
 // Lenovo's USB Vendor ID
 #define VENDOR_ID_LENOVO        0x2006
+// Vizio's USB Vendor ID
+#define VENDOR_ID_VIZIO         0xE040
 
 
 /** built-in vendor list */
@@ -135,6 +137,7 @@
     VENDOR_ID_COMPAL,
     VENDOR_ID_T_AND_A,
     VENDOR_ID_LENOVO,
+    VENDOR_ID_VIZIO,
 };
 
 #define BUILT_IN_VENDOR_COUNT    (sizeof(builtInVendorIds)/sizeof(builtInVendorIds[0]))
diff --git a/include/system/camera.h b/include/system/camera.h
index a3da52e..c404203 100644
--- a/include/system/camera.h
+++ b/include/system/camera.h
@@ -70,17 +70,20 @@
 
 /** msgType in notifyCallback and dataCallback functions */
 enum {
-    CAMERA_MSG_ERROR = 0x0001,
-    CAMERA_MSG_SHUTTER = 0x0002,
-    CAMERA_MSG_FOCUS = 0x0004,
-    CAMERA_MSG_ZOOM = 0x0008,
-    CAMERA_MSG_PREVIEW_FRAME = 0x0010,
-    CAMERA_MSG_VIDEO_FRAME = 0x0020,
-    CAMERA_MSG_POSTVIEW_FRAME = 0x0040,
-    CAMERA_MSG_RAW_IMAGE = 0x0080,
-    CAMERA_MSG_COMPRESSED_IMAGE = 0x0100,
-    CAMERA_MSG_RAW_IMAGE_NOTIFY = 0x0200,
-    CAMERA_MSG_FACE = 0x0400,
+    CAMERA_MSG_ERROR = 0x0001,            // notifyCallback
+    CAMERA_MSG_SHUTTER = 0x0002,          // notifyCallback
+    CAMERA_MSG_FOCUS = 0x0004,            // notifyCallback
+    CAMERA_MSG_ZOOM = 0x0008,             // notifyCallback
+    CAMERA_MSG_PREVIEW_FRAME = 0x0010,    // dataCallback
+    CAMERA_MSG_VIDEO_FRAME = 0x0020,      // data_timestamp_callback
+    CAMERA_MSG_POSTVIEW_FRAME = 0x0040,   // dataCallback
+    CAMERA_MSG_RAW_IMAGE = 0x0080,        // dataCallback
+    CAMERA_MSG_COMPRESSED_IMAGE = 0x0100, // dataCallback
+    CAMERA_MSG_RAW_IMAGE_NOTIFY = 0x0200, // dataCallback
+    // Face metadata. This can be combined with CAMERA_MSG_PREVIEW_FRAME in
+    // dataCallback. For example, the apps can request PREVIEW_FRAME and FACE.
+    // Or the apps can request only PREVIEW_FRAME or only FACE.
+    CAMERA_MSG_METADATA_FACE = 0x0400,    // dataCallback
     CAMERA_MSG_ALL_MSGS = 0xFFFF
 };
 
@@ -163,6 +166,72 @@
     CAMERA_FACE_DETECTION_SW = 1
 };
 
+/**
+ * The information of a face from camera face detection.
+ */
+typedef struct camera_face {
+    /**
+     * Bounds of the face [left, top, right, bottom]. (-1000, -1000) represents
+     * the top-left of the camera field of view, and (1000, 1000) represents the
+     * bottom-right of the field of view. The width and height cannot be 0 or
+     * negative. This is supported by both hardware and software face detection.
+     *
+     * The direction is relative to the sensor orientation, that is, what the
+     * sensor sees. The direction is not affected by the rotation or mirroring
+     * of CAMERA_CMD_SET_DISPLAY_ORIENTATION.
+     */
+    int rect[4];
+
+    /**
+     * The confidence level of the face. The range is 1 to 100. 100 is the
+     * highest confidence. This is supported by both hardware and software
+     * face detection.
+     */
+    int score;
+
+    /**
+     * An unique id per face while the face is visible to the tracker. If
+     * the face leaves the field-of-view and comes back, it will get a new
+     * id. If the value is 0, id is not supported.
+     */
+    int id;
+
+    /**
+     * The coordinates of the center of the left eye. The range is -1000 to
+     * 1000. -2000, -2000 if this is not supported.
+     */
+    int left_eye[2];
+
+    /**
+     * The coordinates of the center of the right eye. The range is -1000 to
+     * 1000. -2000, -2000 if this is not supported.
+     */
+    int right_eye[2];
+
+    /**
+     * The coordinates of the center of the mouth. The range is -1000 to 1000.
+     * -2000, -2000 if this is not supported.
+     */
+    int mouth[2];
+
+} camera_face_t;
+
+/**
+ * The metadata of the frame data.
+ */
+typedef struct camera_frame_metadata {
+    /**
+     * The number of detected faces in the frame.
+     */
+    int number_of_faces;
+
+    /**
+     * An array of the detected faces. The length is number_of_faces. The list
+     * is sorted by the score. The highest score is the first element.
+     */
+    camera_face_t *faces;
+} camera_frame_metadata_t;
+
 __END_DECLS
 
 #endif /* SYSTEM_CORE_INCLUDE_ANDROID_CAMERA_H */
diff --git a/init/property_service.c b/init/property_service.c
index 77aa5e9..dd61b1b 100644
--- a/init/property_service.c
+++ b/init/property_service.c
@@ -63,6 +63,7 @@
     { "net.ppp",          AID_RADIO,    0 },
     { "net.qmi",          AID_RADIO,    0 },
     { "net.lte",          AID_RADIO,    0 },
+    { "net.cdma",         AID_RADIO,    0 },
     { "ril.",             AID_RADIO,    0 },
     { "gsm.",             AID_RADIO,    0 },
     { "persist.radio",    AID_RADIO,    0 },
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 0d476d4..f843824 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -320,6 +320,25 @@
     class_reset late_start
     class_reset main
 
+# Used to disable USB when switching states
+on property:sys.usb.config=none
+    stop adbd
+    write /sys/class/android_usb/android0/enable 0
+    write /sys/class/android_usb/android0/bDeviceClass 0
+    setprop sys.usb.state $sys.usb.config
+
+# adb only USB configuration
+# This should only be used during device bringup
+# and as a fallback if the USB manager fails to set a standard configuration
+on property:sys.usb.config=adb
+    write /sys/class/android_usb/android0/enable 0
+    write /sys/class/android_usb/android0/idVendor 18d1
+    write /sys/class/android_usb/android0/idProduct D002
+    write /sys/class/android_usb/android0/functions $sys.usb.config
+    write /sys/class/android_usb/android0/enable 1
+    start adbd
+    setprop sys.usb.state $sys.usb.config
+
 # USB accessory configuration
 on property:sys.usb.config=accessory
     write /sys/class/android_usb/android0/enable 0
@@ -339,6 +358,8 @@
     start adbd
     setprop sys.usb.state $sys.usb.config
 
+# Used to set USB configuration at boot and to switch the configuration
+# when changing the default configuration
 on property:persist.sys.usb.config=*
     setprop sys.usb.config $persist.sys.usb.config
 
@@ -429,8 +450,7 @@
 service media /system/bin/mediaserver
     class main
     user media
-    # STOPSHIP: remove system from mediaserver groups
-    group audio camera inet net_bt net_bt_admin system
+    group audio camera inet net_bt net_bt_admin
     ioprio rt 4
 
 service bootanim /system/bin/bootanimation