Merge tag 'android-7.1.1_r26' into aosp-7.1.1

Android 7.1.1 release 26
diff --git a/include/hardware/audio.h b/include/hardware/audio.h
index ec7fd4b..e5c20b7 100644
--- a/include/hardware/audio.h
+++ b/include/hardware/audio.h
@@ -28,6 +28,9 @@
 #include <hardware/hardware.h>
 #include <system/audio.h>
 #include <hardware/audio_effect.h>
+#ifdef AUDIO_LISTEN_ENABLED
+#include <listen_types.h>
+#endif
 
 __BEGIN_DECLS
 
@@ -112,6 +115,10 @@
 /* Bluetooth SCO wideband */
 #define AUDIO_PARAMETER_KEY_BT_SCO_WB "bt_wbs"
 
+
+/* Device state*/
+#define AUDIO_PARAMETER_KEY_DEV_SHUTDOWN "dev_shutdown"
+
 /* Get a new HW synchronization source identifier.
  * Return a valid source (positive integer) or AUDIO_HW_SYNC_INVALID if an error occurs
  * or no HW sync is available. */
@@ -670,6 +677,28 @@
     int (*set_audio_port_config)(struct audio_hw_device *dev,
                          const struct audio_port_config *config);
 
+#ifdef AUDIO_LISTEN_ENABLED
+    /** This method creates the listen session and returns handle */
+    int (*open_listen_session)(struct audio_hw_device *dev,
+                              listen_open_params_t *params,
+                              struct listen_session** handle);
+
+    /** This method closes the listen session  */
+    int (*close_listen_session)(struct audio_hw_device *dev,
+                                struct listen_session* handle);
+
+    /** This method sets the mad observer callback  */
+    int (*set_mad_observer)(struct audio_hw_device *dev,
+                            listen_callback_t cb_func);
+
+    /**
+     *   This method is used for setting listen hal specfic parameters.
+     *  If multiple paramets are set in one call and setting any one of them
+     *  fails it will return failure.
+     */
+    int (*listen_set_parameters)(struct audio_hw_device *dev,
+                                 const char *kv_pairs);
+#endif
 };
 typedef struct audio_hw_device audio_hw_device_t;
 
diff --git a/include/hardware/audio_amplifier.h b/include/hardware/audio_amplifier.h
new file mode 100644
index 0000000..e3477d5
--- /dev/null
+++ b/include/hardware/audio_amplifier.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2015, The CyanogenMod Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef CM_AUDIO_AMPLIFIER_INTERFACE_H
+#define CM_AUDIO_AMPLIFIER_INTERFACE_H
+
+#include <stdint.h>
+#include <sys/cdefs.h>
+#include <sys/types.h>
+
+#include <hardware/audio.h>
+#include <hardware/hardware.h>
+
+#include <system/audio.h>
+
+__BEGIN_DECLS
+
+#define AMPLIFIER_HARDWARE_MODULE_ID "audio_amplifier"
+
+#define AMPLIFIER_HARDWARE_INTERFACE "audio_amplifier_hw_if"
+
+#define AMPLIFIER_MODULE_API_VERSION_0_1 HARDWARE_MODULE_API_VERSION(0, 1)
+
+#define AMPLIFIER_DEVICE_API_VERSION_1_0 HARDWARE_DEVICE_API_VERSION(1, 0)
+#define AMPLIFIER_DEVICE_API_VERSION_2_0 HARDWARE_DEVICE_API_VERSION(2, 0)
+#define AMPLIFIER_DEVICE_API_VERSION_CURRENT AMPLIFIER_DEVICE_API_VERSION_2_0
+
+struct str_parms;
+
+typedef struct amplifier_device {
+    /**
+     * Common methods of the amplifier device. This *must* be the first member
+     * of amplifier_device as users of this structure will cast a hw_device_t
+     * to amplifier_device pointer in contexts where it's known
+     * the hw_device_t references a amplifier_device.
+     */
+    struct hw_device_t common;
+
+    /**
+     * Notify amplifier device of current input devices
+     *
+     * This function should handle only input devices.
+     */
+    int (*set_input_devices)(struct amplifier_device *device, uint32_t devices);
+
+    /**
+     * Notify amplifier device of current output devices
+     *
+     * This function should handle only output devices.
+     */
+    int (*set_output_devices)(struct amplifier_device *device, uint32_t devices);
+
+    /**
+     * Notify amplifier device of output device enable/disable
+     *
+     * This function should handle only output devices.
+     */
+    int (*enable_output_devices)(struct amplifier_device *device,
+            uint32_t devices, bool enable);
+
+    /**
+     * Notify amplifier device of input device enable/disable
+     *
+     * This function should handle only input devices.
+     */
+    int (*enable_input_devices)(struct amplifier_device *device,
+            uint32_t devices, bool enable);
+
+    /**
+     * Notify amplifier device about current audio mode
+     */
+    int (*set_mode)(struct amplifier_device *device, audio_mode_t mode);
+
+    /**
+     * Notify amplifier device that an output stream has started
+     */
+    int (*output_stream_start)(struct amplifier_device *device,
+            struct audio_stream_out *stream, bool offload);
+
+    /**
+     * Notify amplifier device that an input stream has started
+     */
+    int (*input_stream_start)(struct amplifier_device *device,
+            struct audio_stream_in *stream);
+
+    /**
+     * Notify amplifier device that an output stream has stopped
+     */
+    int (*output_stream_standby)(struct amplifier_device *device,
+            struct audio_stream_out *stream);
+
+    /**
+     * Notify amplifier device that an input stream has stopped
+     */
+    int (*input_stream_standby)(struct amplifier_device *device,
+            struct audio_stream_in *stream);
+
+    /**
+     * set/get output audio device parameters.
+     */
+    int (*set_parameters)(struct amplifier_device *device,
+        struct str_parms *parms);
+} amplifier_device_t;
+
+typedef struct amplifier_module {
+    /**
+     * Common methods of the amplifier module. This *must* be the first member
+     * of amplifier_module as users of this structure will cast a hw_module_t
+     * to amplifier_module pointer in contexts where it's known
+     * the hw_module_t references a amplifier_module.
+     */
+    struct hw_module_t common;
+} amplifier_module_t;
+
+/** convenience API for opening and closing a supported device */
+
+static inline int amplifier_device_open(const struct hw_module_t *module,
+        struct amplifier_device **device)
+{
+    return module->methods->open(module, AMPLIFIER_HARDWARE_INTERFACE,
+            (struct hw_device_t **) device);
+}
+
+static inline int amplifier_device_close(struct amplifier_device *device)
+{
+    return device->common.close(&device->common);
+}
+
+__END_DECLS
+
+#endif  // CM_AUDIO_AMPLIFIER_INTERFACE_H
diff --git a/include/hardware/bluetooth.h b/include/hardware/bluetooth.h
index b9b3b12..5a03cf8 100644
--- a/include/hardware/bluetooth.h
+++ b/include/hardware/bluetooth.h
@@ -376,6 +376,10 @@
 /* Receive any HCI event from controller. Must be in DUT Mode for this callback to be received */
 typedef void (*dut_mode_recv_callback)(uint16_t opcode, uint8_t *buf, uint8_t len);
 
+/** Bluetooth HCI event Callback */
+/* Receive any HCI event from controller for raw commands */
+typedef void (*hci_event_recv_callback)(uint8_t event_code, uint8_t *buf, uint8_t len);
+
 /* LE Test mode callbacks
 * This callback shall be invoked whenever the le_tx_test, le_rx_test or le_test_end is invoked
 * The num_packets is valid only for le_test_end command */
@@ -413,6 +417,7 @@
     dut_mode_recv_callback dut_mode_recv_cb;
     le_test_mode_callback le_test_mode_cb;
     energy_info_callback energy_info_cb;
+    hci_event_recv_callback hci_event_recv_cb;
 } bt_callbacks_t;
 
 typedef void (*alarm_cb)(void *data);
@@ -549,6 +554,10 @@
 
     /* Send any test HCI (vendor-specific) command to the controller. Must be in DUT Mode */
     int (*dut_mode_send)(uint16_t opcode, uint8_t *buf, uint8_t len);
+
+    /* Send any test HCI command to the controller. */
+    int (*hci_cmd_send)(uint16_t opcode, uint8_t *buf, uint8_t len);
+
     /** BLE Test Mode APIs */
     /* opcode MUST be one of: LE_Receiver_Test, LE_Transmitter_Test, LE_Test_End */
     int (*le_test_mode)(uint16_t opcode, uint8_t *buf, uint8_t len);
@@ -590,6 +599,8 @@
      * NOTE: |feature| has to match an item defined in interop_feature_t (interop.h).
      */
     void (*interop_database_add)(uint16_t feature, const bt_bdaddr_t *addr, size_t len);
+    /** BT stack Test interface */
+    const void* (*get_testapp_interface)(int test_app_profile);
 } bt_interface_t;
 
 /** TODO: Need to add APIs for Service Discovery, Service authorization and
diff --git a/include/hardware/bt_av.h b/include/hardware/bt_av.h
index 9b32216..5b72eb1 100644
--- a/include/hardware/bt_av.h
+++ b/include/hardware/bt_av.h
@@ -1,4 +1,7 @@
 /*
+ * Copyright (C) 2013-2014, The Linux Foundation. All rights reserved.
+ * Not a Contribution.
+ *
  * Copyright (C) 2012 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -47,6 +50,11 @@
 typedef void (* btav_audio_state_callback)(btav_audio_state_t state,
                                                bt_bdaddr_t *bd_addr);
 
+/** Callback for connection priority of device for incoming connection
+ * btav_connection_priority_t
+ */
+typedef void (* btav_connection_priority_callback)(bt_bdaddr_t *bd_addr);
+
 /** Callback for audio configuration change.
  *  Used only for the A2DP sink interface.
  *  state will have one of the values from btav_audio_state_t
@@ -57,6 +65,15 @@
                                                 uint32_t sample_rate,
                                                 uint8_t channel_count);
 
+/** Callback for updating apps for A2dp multicast state.
+ */
+
+typedef void (* btav_is_multicast_enabled_callback)(int state);
+
+/** Callback to notify reconfig a2dp when A2dp Soft Handoff is triggered
+*/
+typedef void(* btav_reconfig_a2dp_trigger_callback)(int reason, bt_bdaddr_t *bd_addr);
+
 /** BT-AV callback structure. */
 typedef struct {
     /** set to sizeof(btav_callbacks_t) */
@@ -64,6 +81,9 @@
     btav_connection_state_callback  connection_state_cb;
     btav_audio_state_callback audio_state_cb;
     btav_audio_config_callback audio_config_cb;
+    btav_connection_priority_callback connection_priority_cb;
+    btav_is_multicast_enabled_callback multicast_state_cb;
+    btav_reconfig_a2dp_trigger_callback reconfig_a2dp_trigger_cb;
 } btav_callbacks_t;
 
 /**
@@ -86,7 +106,8 @@
     /**
      * Register the BtAv callbacks
      */
-    bt_status_t (*init)( btav_callbacks_t* callbacks );
+    bt_status_t (*init)( btav_callbacks_t* callbacks , int max_a2dp_connections,
+                        int a2dp_multicast_state, const char *offload_cap);
 
     /** connect to headset */
     bt_status_t (*connect)( bt_bdaddr_t *bd_addr );
@@ -102,6 +123,9 @@
 
     /** Sets the audio track gain. */
     void  (*set_audio_track_gain)( float gain );
+
+    /** Send priority of device to stack*/
+    void (*allow_connection)( int is_valid , bt_bdaddr_t *bd_addr);
 } btav_interface_t;
 
 __END_DECLS
diff --git a/include/hardware/bt_hf.h b/include/hardware/bt_hf.h
index 0a77675..9d257b0 100644
--- a/include/hardware/bt_hf.h
+++ b/include/hardware/bt_hf.h
@@ -65,6 +65,15 @@
    BTHF_WBS_YES
 }bthf_wbs_config_t;
 
+/* BIND type*/
+typedef enum
+{
+   BTHF_BIND_SET,
+   BTHF_BIND_READ,
+   BTHF_BIND_TEST
+}bthf_bind_type_t;
+
+
 /* CHLD - Call held handling */
 typedef enum
 {
@@ -74,20 +83,6 @@
     BTHF_CHLD_TYPE_ADDHELDTOCONF,            // Add all held calls to a conference
 } bthf_chld_type_t;
 
-
-/* HF Indicators HFP 1.7 */
-typedef enum
-{
-    BTHF_HF_IND_ENHANCED_DRIVER_SAFETY = 1,
-    BTHF_HF_IND_BATTERY_LEVEL_STATUS = 2,
-} bthf_hf_ind_type_t;
-
-typedef enum
-{
-    BTHF_HF_IND_DISABLED = 0,
-    BTHF_HF_IND_ENABLED,
-} bthf_hf_ind_status_t;
-
 /** Callback for connection state change.
  *  state will have one of the values from BtHfConnectionState
  */
@@ -166,14 +161,13 @@
  */
 typedef void (* bthf_key_pressed_cmd_callback)(bt_bdaddr_t *bd_addr);
 
-/** Callback for BIND. Pass the remote HF Indicators supported.
+/** Callback for HF indicators (BIND)
  */
-typedef void (* bthf_bind_cmd_callback)(char *at_string, bt_bdaddr_t *bd_addr);
+typedef void (* bthf_bind_cmd_callback)(char* hf_ind, bthf_bind_type_t type, bt_bdaddr_t *bd_addr);
 
-/** Callback for BIEV. Pass the change in the Remote HF indicator values
+/** Callback for HF indicator value (BIEV)
  */
-typedef void (* bthf_biev_cmd_callback)(bthf_hf_ind_type_t ind_id, int ind_value,
-                                        bt_bdaddr_t *bd_addr);
+typedef void (* bthf_biev_cmd_callback)(char* hf_ind_val, bt_bdaddr_t *bd_addr);
 
 /** BT-HF callback structure. */
 typedef struct {
@@ -195,9 +189,9 @@
     bthf_cops_cmd_callback          cops_cmd_cb;
     bthf_clcc_cmd_callback          clcc_cmd_cb;
     bthf_unknown_at_cmd_callback    unknown_at_cmd_cb;
-    bthf_bind_cmd_callback          bind_cb;
-    bthf_biev_cmd_callback          biev_cb;
     bthf_key_pressed_cmd_callback   key_pressed_cmd_cb;
+    bthf_bind_cmd_callback          bind_cmd_cb;
+    bthf_biev_cmd_callback          biev_cmd_cb;
 } bthf_callbacks_t;
 
 /** Network Status */
@@ -241,9 +235,25 @@
 } bthf_call_mpty_type_t;
 
 typedef enum {
+    BTHF_HF_INDICATOR_STATE_DISABLED = 0,
+    BTHF_HF_INDICATOR_STATE_ENABLED
+} bthf_hf_indicator_status_t;
+
+typedef enum {
     BTHF_CALL_ADDRTYPE_UNKNOWN = 0x81,
     BTHF_CALL_ADDRTYPE_INTERNATIONAL = 0x91
 } bthf_call_addrtype_t;
+
+typedef enum {
+    BTHF_VOIP_CALL_NETWORK_TYPE_MOBILE = 0,
+    BTHF_VOIP_CALL_NETWORK_TYPE_WIFI
+} bthf_voip_call_network_type_t;
+
+typedef enum {
+    BTHF_VOIP_STATE_STOPPED = 0,
+    BTHF_VOIP_STATE_STARTED
+} bthf_voip_state_t;
+
 /** Represents the standard BT-HF interface. */
 typedef struct {
 
@@ -320,9 +330,16 @@
     /** configureation for the SCO codec */
     bt_status_t (*configure_wbs)( bt_bdaddr_t *bd_addr ,bthf_wbs_config_t config );
 
-    /** Response for HF Indicator change (+BIND) */
-    bt_status_t (*bind_response)(bthf_hf_ind_type_t ind_id, bthf_hf_ind_status_t ind_status,
-                                 bt_bdaddr_t *bd_addr);
+    /** Response for BIND READ command and activation/deactivation of  HF indicator */
+    bt_status_t (*bind_response) (int anum, bthf_hf_indicator_status_t status,
+                                  bt_bdaddr_t *bd_addr);
+
+    /** Response for BIND TEST command */
+    bt_status_t (*bind_string_response) (const char* result, bt_bdaddr_t *bd_addr);
+
+    /** Sends connectivity network type used by Voip currently to stack */
+    bt_status_t (*voip_network_type_wifi) (bthf_voip_state_t is_voip_started,
+                                           bthf_voip_call_network_type_t is_network_wifi);
 } bthf_interface_t;
 
 __END_DECLS
diff --git a/include/hardware/bt_hf_client.h b/include/hardware/bt_hf_client.h
index 8acf1b2..0577e97 100644
--- a/include/hardware/bt_hf_client.h
+++ b/include/hardware/bt_hf_client.h
@@ -266,6 +266,16 @@
  */
 typedef void (* bthf_client_ring_indication_callback) (void);
 
+/**
+ * Callback for sending cgmi indication to app
+ */
+typedef void (* bthf_client_cgmi_indication_callback) (const char *str);
+
+/**
+ * Callback for sending cgmm indication to app
+ */
+typedef void (* bthf_client_cgmm_indication_callback) (const char *str);
+
 /** BT-HF callback structure. */
 typedef struct {
     /** set to sizeof(BtHfClientCallbacks) */
@@ -291,6 +301,8 @@
     bthf_client_in_band_ring_tone_callback in_band_ring_tone_cb;
     bthf_client_last_voice_tag_number_callback last_voice_tag_number_callback;
     bthf_client_ring_indication_callback   ring_indication_cb;
+    bthf_client_cgmi_indication_callback   cgmi_cb;
+    bthf_client_cgmm_indication_callback   cgmm_cb;
 } bthf_client_callbacks_t;
 
 /** Represents the standard BT-HF interface. */
diff --git a/include/hardware/bt_hh.h b/include/hardware/bt_hh.h
index dad9586..ece3c11 100644
--- a/include/hardware/bt_hh.h
+++ b/include/hardware/bt_hh.h
@@ -165,6 +165,12 @@
     /** Set the HID proto mode. */
     bt_status_t (*set_protocol)(bt_bdaddr_t *bd_addr, bthh_protocol_mode_t protocolMode);
 
+    /** Get the HID Idle Time */
+    bt_status_t (*get_idle_time)(bt_bdaddr_t *bd_addr);
+
+    /** Set the HID Idle Time */
+    bt_status_t (*set_idle_time)(bt_bdaddr_t *bd_addr, uint8_t idleTime);
+
     /** Send a GET_REPORT to HID device. */
     bt_status_t (*get_report)(bt_bdaddr_t *bd_addr, bthh_report_type_t reportType, uint8_t reportId, int bufferSize);
 
@@ -174,7 +180,7 @@
     /** Send data to HID device. */
     bt_status_t (*send_data)(bt_bdaddr_t *bd_addr, char* data);
 
-	/** Closes the interface. */
+    /** Closes the interface. */
     void  (*cleanup)( void );
 
 } bthh_interface_t;
diff --git a/include/hardware/bt_rc.h b/include/hardware/bt_rc.h
index 1e2c293..d0cf9c8 100644
--- a/include/hardware/bt_rc.h
+++ b/include/hardware/bt_rc.h
@@ -1,4 +1,7 @@
 /*
+ * Copyright (C) 2013-2015, The Linux Foundation. All rights reserved.
+ * Not a Contribution.
+ *
  * Copyright (C) 2012 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -25,7 +28,14 @@
 #define BTRC_MAX_APP_SETTINGS       8
 #define BTRC_MAX_FOLDER_DEPTH       4
 #define BTRC_MAX_APP_ATTR_SIZE      16
-#define BTRC_MAX_ELEM_ATTR_SIZE     7
+#define BTRC_MAX_ELEM_ATTR_SIZE     8
+#define BTRC_CHARSET_UTF8           0x006A
+#define BTRC_BROWSE_PDU_HEADER      3
+#define BTRC_AVCTP_HEADER           3
+#define BTRC_BROWSE_PKT_3TO7OCT_LEN 5
+#define BTRC_FOLDER_ITEM_HEADER     14
+#define BTRC_ITEM_ATTRIBUTE_HEADER  8
+#define BTRC_ITEM_TYPE_N_LEN_OCT    3
 
 typedef uint8_t btrc_uid_t[BTRC_UID_SIZE];
 
@@ -52,11 +62,24 @@
     BTRC_EVT_TRACK_REACHED_START = 0x04,
     BTRC_EVT_PLAY_POS_CHANGED = 0x05,
     BTRC_EVT_APP_SETTINGS_CHANGED = 0x08,
+    BTRC_EVT_NOW_PLAYING_CONTENT_CHANGED = 0x09,
+    BTRC_EVT_AVAILABLE_PLAYERS_CHANGED = 0x0a,
+    BTRC_EVT_ADDRESSED_PLAYER_CHANGED = 0x0b,
 } btrc_event_id_t;
 
+//used for Scope
+typedef enum {
+    BTRC_EVT_MEDIA_PLAYLIST = 0,
+    BTRC_EVT_MEDIA_VIRTUALFILESYST = 1,
+    BTRC_EVT_SEARCH = 2,
+    BTRC_EVT_NOWPLAYING = 3,
+    BTRC_EVT_MAX_BROWSE = 4,
+} btrc_browse_folderitem_t;
+
 typedef enum {
     BTRC_NOTIFICATION_TYPE_INTERIM = 0,
     BTRC_NOTIFICATION_TYPE_CHANGED = 1,
+    BTRC_NOTIFICATION_TYPE_REJECT = 2,
 } btrc_notification_type_t;
 
 typedef enum {
@@ -74,6 +97,7 @@
     BTRC_MEDIA_ATTR_NUM_TRACKS = 0x05,
     BTRC_MEDIA_ATTR_GENRE = 0x06,
     BTRC_MEDIA_ATTR_PLAYING_TIME = 0x07,
+    BTRC_MEDIA_ATTR_COVER_ART = 0x08,
 } btrc_media_attr_t;
 
 typedef enum {
@@ -97,6 +121,12 @@
     BTRC_STS_NO_ERROR       = 0x04  /* Operation Success */
 } btrc_status_t;
 
+typedef enum {
+    BTRC_TYPE_MEDIA_PLAYER = 0x01,
+    BTRC_TYPE_FOLDER = 0x02,
+    BTRC_TYPE_MEDIA_ELEMENT = 0x03
+} btrc_folder_list_item_type_t;
+
 typedef struct {
     uint8_t num_attr;
     uint8_t attr_ids[BTRC_MAX_APP_SETTINGS];
@@ -139,6 +169,7 @@
     btrc_uid_t track; /* queue position in NowPlaying */
     uint32_t song_pos;
     btrc_player_settings_t player_setting;
+    uint16_t player_id;
 } btrc_register_notification_t;
 
 typedef struct {
@@ -154,54 +185,158 @@
 /** Callback for the controller's supported feautres */
 typedef void (* btrc_remote_features_callback)(bt_bdaddr_t *bd_addr,
                                                       btrc_remote_features_t features);
+#define BTRC_FEATURE_MASK_SIZE 16
+
+typedef uint8_t btrc_feature_mask_t[BTRC_FEATURE_MASK_SIZE];
+
+typedef struct {
+    uint16_t              charset_id;
+    uint16_t              str_len;
+    uint8_t               *p_str;
+} btrc_player_full_name_t;
+
+typedef struct
+{
+    uint32_t              sub_type;
+    uint16_t              player_id;
+    uint8_t               major_type;
+    uint8_t               play_status;
+    btrc_feature_mask_t   features;       /* Supported feature bit mask*/
+    btrc_player_full_name_t     name;           /* The player name, name length and character set id.*/
+} btrc_folder_list_item_player_t;
+
+typedef struct
+{
+    uint64_t                    uid;
+    uint8_t                     type;
+    uint8_t                     playable;
+    btrc_player_full_name_t     name;
+} btrc_folder_list_item_folder_t;
+
+typedef struct
+{
+    uint32_t                    attr_id;
+    btrc_player_full_name_t     name;
+} btrc_attr_entry_t;
+
+typedef struct
+{
+    uint64_t                    uid;
+    uint8_t                     type;
+    uint8_t                     attr_count;
+    btrc_player_full_name_t     name;
+    btrc_attr_entry_t*          p_attr_list;
+} btrc_folder_list_item_media_t;
+
+typedef struct {
+    uint16_t              str_len;
+    uint8_t               *p_str;
+} btrc_name_t;
+
+/* SetBrowsedPlayer */
+typedef struct
+{
+    uint32_t              num_items;
+    uint16_t              uid_counter;
+    uint16_t              charset_id;
+    uint8_t               status;
+    uint8_t               folder_depth;
+    btrc_name_t           *p_folders;
+} btrc_set_browsed_player_rsp_t;
+
+typedef struct
+{
+    uint8_t                          item_type;
+    union
+    {
+        btrc_folder_list_item_player_t   player;
+        btrc_folder_list_item_folder_t   folder;
+        btrc_folder_list_item_media_t    media;
+    } u;
+} btrc_folder_list_item_t;
+
+/* GetFolderItems */
+typedef struct
+{
+    uint16_t                  uid_counter;
+    uint16_t                  item_count;
+    uint8_t                   status;
+    btrc_folder_list_item_t   *p_item_list;
+} btrc_folder_list_entries_t;
 
 /** Callback for play status request */
-typedef void (* btrc_get_play_status_callback)();
+typedef void (* btrc_get_play_status_callback)(bt_bdaddr_t *bd_addr);
 
 /** Callback for list player application attributes (Shuffle, Repeat,...) */
-typedef void (* btrc_list_player_app_attr_callback)();
+typedef void (* btrc_list_player_app_attr_callback)(bt_bdaddr_t *bd_addr);
 
 /** Callback for list player application attributes (Shuffle, Repeat,...) */
-typedef void (* btrc_list_player_app_values_callback)(btrc_player_attr_t attr_id);
+typedef void (* btrc_list_player_app_values_callback)(btrc_player_attr_t attr_id,
+        bt_bdaddr_t *bd_addr);
 
 /** Callback for getting the current player application settings value
 **  num_attr: specifies the number of attribute ids contained in p_attrs
 */
-typedef void (* btrc_get_player_app_value_callback) (uint8_t num_attr, btrc_player_attr_t *p_attrs);
+typedef void (* btrc_get_player_app_value_callback) (uint8_t num_attr, btrc_player_attr_t *p_attrs,
+        bt_bdaddr_t *bd_addr);
 
 /** Callback for getting the player application settings attributes' text
 **  num_attr: specifies the number of attribute ids contained in p_attrs
 */
-typedef void (* btrc_get_player_app_attrs_text_callback) (uint8_t num_attr, btrc_player_attr_t *p_attrs);
+typedef void (* btrc_get_player_app_attrs_text_callback) (uint8_t num_attr,
+        btrc_player_attr_t *p_attrs, bt_bdaddr_t *bd_addr);
 
 /** Callback for getting the player application settings values' text
 **  num_attr: specifies the number of value ids contained in p_vals
 */
-typedef void (* btrc_get_player_app_values_text_callback) (uint8_t attr_id, uint8_t num_val, uint8_t *p_vals);
+typedef void (* btrc_get_player_app_values_text_callback) (uint8_t attr_id,
+         uint8_t num_val, uint8_t *p_vals, bt_bdaddr_t *bd_addr);
 
 /** Callback for setting the player application settings values */
-typedef void (* btrc_set_player_app_value_callback) (btrc_player_settings_t *p_vals);
+typedef void (* btrc_set_player_app_value_callback) (btrc_player_settings_t *p_vals,
+        bt_bdaddr_t *bd_addr);
 
 /** Callback to fetch the get element attributes of the current song
 **  num_attr: specifies the number of attributes requested in p_attrs
 */
-typedef void (* btrc_get_element_attr_callback) (uint8_t num_attr, btrc_media_attr_t *p_attrs);
+typedef void (* btrc_get_element_attr_callback) (uint8_t num_attr, btrc_media_attr_t *p_attrs,
+        bt_bdaddr_t *bd_addr);
 
 /** Callback for register notification (Play state change/track change/...)
 **  param: Is only valid if event_id is BTRC_EVT_PLAY_POS_CHANGED
 */
-typedef void (* btrc_register_notification_callback) (btrc_event_id_t event_id, uint32_t param);
+typedef void (* btrc_register_notification_callback) (btrc_event_id_t event_id, uint32_t param,
+        bt_bdaddr_t *bd_addr);
 
 /* AVRCP 1.4 Enhancements */
 /** Callback for volume change on CT
 **  volume: Current volume setting on the CT (0-127)
 */
-typedef void (* btrc_volume_change_callback) (uint8_t volume, uint8_t ctype);
+typedef void (* btrc_volume_change_callback) (uint8_t volume, uint8_t ctype, bt_bdaddr_t *bd_addr);
 
 /** Callback for passthrough commands */
-typedef void (* btrc_passthrough_cmd_callback) (int id, int key_state);
+typedef void (* btrc_passthrough_cmd_callback) (int id, int key_state, bt_bdaddr_t *bd_addr);
 
 /** BT-RC Target callback structure. */
+
+typedef void (* btrc_get_folder_items_callback) (btrc_browse_folderitem_t id,
+                  btrc_getfolderitem_t *param, bt_bdaddr_t *bd_addr);
+
+typedef void (* btrc_set_addressed_player_callback) (uint32_t player_id, bt_bdaddr_t *bd_addr);
+
+typedef void (* btrc_set_browsed_player_callback) (uint32_t player_id, bt_bdaddr_t *bd_addr);
+
+typedef void (* btrc_change_path_callback) (uint8_t direction, uint64_t uid, bt_bdaddr_t *bd_addr);
+
+typedef void (* btrc_play_item_callback) (uint8_t scope, uint64_t uid, bt_bdaddr_t *bd_addr);
+
+typedef void (* btrc_get_item_attr_callback) (uint8_t scope, uint64_t uid,
+        uint8_t num_attr, btrc_media_attr_t *p_attrs, uint32_t size, bt_bdaddr_t *bd_addr);
+
+typedef void (* btrc_connection_state_callback) (bool state, bt_bdaddr_t *bd_addr);
+
+typedef void (* btrc_get_total_item_callback) (uint8_t scope, bt_bdaddr_t *bd_addr);
+
 typedef struct {
     /** set to sizeof(BtRcCallbacks) */
     size_t      size;
@@ -217,6 +352,14 @@
     btrc_register_notification_callback         register_notification_cb;
     btrc_volume_change_callback                 volume_change_cb;
     btrc_passthrough_cmd_callback               passthrough_cmd_cb;
+    btrc_get_folder_items_callback              get_folderitems_cb;
+    btrc_set_addressed_player_callback          set_addrplayer_cb;
+    btrc_set_browsed_player_callback            set_browsed_player_cb;
+    btrc_change_path_callback                   change_path_cb;
+    btrc_play_item_callback                     play_item_cb;
+    btrc_get_item_attr_callback                 get_item_attr_cb;
+    btrc_connection_state_callback              connection_state_cb;
+    btrc_get_total_item_callback                get_tot_item_cb;
 } btrc_callbacks_t;
 
 /** Represents the standard BT-RC AVRCP Target interface. */
@@ -227,47 +370,54 @@
     /**
      * Register the BtRc callbacks
      */
-    bt_status_t (*init)( btrc_callbacks_t* callbacks );
+    bt_status_t (*init)( btrc_callbacks_t* callbacks , int max_avrcp_connections);
 
     /** Respose to GetPlayStatus request. Contains the current
     **  1. Play status
     **  2. Song duration/length
     **  3. Song position
     */
-    bt_status_t (*get_play_status_rsp)( btrc_play_status_t play_status, uint32_t song_len, uint32_t song_pos);
+    bt_status_t (*get_play_status_rsp)( btrc_play_status_t play_status, uint32_t song_len,
+                 uint32_t song_pos, bt_bdaddr_t *bd_addr);
 
     /** Lists the support player application attributes (Shuffle/Repeat/...)
     **  num_attr: Specifies the number of attributes contained in the pointer p_attrs
     */
-    bt_status_t (*list_player_app_attr_rsp)( int num_attr, btrc_player_attr_t *p_attrs);
+    bt_status_t (*list_player_app_attr_rsp)( uint8_t num_attr, btrc_player_attr_t *p_attrs,
+            bt_bdaddr_t *bd_addr);
 
     /** Lists the support player application attributes (Shuffle Off/On/Group)
     **  num_val: Specifies the number of values contained in the pointer p_vals
     */
-    bt_status_t (*list_player_app_value_rsp)( int num_val, uint8_t *p_vals);
+    bt_status_t (*list_player_app_value_rsp)( uint8_t num_val, uint8_t *p_vals,
+            bt_bdaddr_t *bd_addr);
 
     /** Returns the current application attribute values for each of the specified attr_id */
-    bt_status_t (*get_player_app_value_rsp)( btrc_player_settings_t *p_vals);
+    bt_status_t (*get_player_app_value_rsp)( btrc_player_settings_t *p_vals,
+            bt_bdaddr_t *bd_addr);
 
     /** Returns the application attributes text ("Shuffle"/"Repeat"/...)
     **  num_attr: Specifies the number of attributes' text contained in the pointer p_attrs
     */
-    bt_status_t (*get_player_app_attr_text_rsp)( int num_attr, btrc_player_setting_text_t *p_attrs);
+    bt_status_t (*get_player_app_attr_text_rsp)( int num_attr, btrc_player_setting_text_t *p_attrs,
+            bt_bdaddr_t *bd_addr);
 
     /** Returns the application attributes text ("Shuffle"/"Repeat"/...)
     **  num_attr: Specifies the number of attribute values' text contained in the pointer p_vals
     */
-    bt_status_t (*get_player_app_value_text_rsp)( int num_val, btrc_player_setting_text_t *p_vals);
+    bt_status_t (*get_player_app_value_text_rsp)( int num_val, btrc_player_setting_text_t *p_vals,
+            bt_bdaddr_t *bd_addr);
 
     /** Returns the current songs' element attributes text ("Title"/"Album"/"Artist")
     **  num_attr: Specifies the number of attributes' text contained in the pointer p_attrs
     */
-    bt_status_t (*get_element_attr_rsp)( uint8_t num_attr, btrc_element_attr_val_t *p_attrs);
+    bt_status_t (*get_element_attr_rsp)( uint8_t num_attr, btrc_element_attr_val_t *p_attrs,
+            bt_bdaddr_t *bd_addr);
 
     /** Response to set player attribute request ("Shuffle"/"Repeat")
     **  rsp_status: Status of setting the player attributes for the current media player
     */
-    bt_status_t (*set_player_app_value_rsp)(btrc_status_t rsp_status);
+    bt_status_t (*set_player_app_value_rsp)(btrc_status_t rsp_status, bt_bdaddr_t *bd_addr);
 
     /* Response to the register notification request (Play state change/track change/...).
     ** event_id: Refers to the event_id this notification change corresponds too
@@ -276,7 +426,8 @@
     */
     bt_status_t (*register_notification_rsp)(btrc_event_id_t event_id,
                                              btrc_notification_type_t type,
-                                             btrc_register_notification_t *p_param);
+                                             btrc_register_notification_t *p_param,
+                                             bt_bdaddr_t *bd_addr);
 
     /* AVRCP 1.4 enhancements */
 
@@ -285,7 +436,20 @@
     ** With RelateVolume, we will send VOLUME_UP/VOLUME_DOWN opposed to absolute volume level
     ** volume: Should be in the range 0-127. bit7 is reseved and cannot be set
     */
-    bt_status_t (*set_volume)(uint8_t volume);
+    bt_status_t (*set_volume)(uint8_t volume, bt_bdaddr_t *bd_addr);
+    bt_status_t (*get_folder_items_rsp) (btrc_folder_list_entries_t *p_param, bt_bdaddr_t *bd_addr);
+
+    bt_status_t (*set_addressed_player_rsp) (btrc_status_t status_code, bt_bdaddr_t *bd_addr);
+    bt_status_t (*set_browsed_player_rsp) (btrc_set_browsed_player_rsp_t *p_param,
+            bt_bdaddr_t *bd_addr);
+    bt_status_t (*change_path_rsp) (uint8_t status_code, uint32_t item_count,
+            bt_bdaddr_t *bd_addr);
+    bt_status_t (*play_item_rsp) (uint8_t status_code, bt_bdaddr_t *bd_addr);
+    bt_status_t (*get_item_attr_rsp)( uint8_t num_attr, btrc_element_attr_val_t *p_attrs,
+            bt_bdaddr_t *bd_addr);
+    bt_status_t (*is_device_active_in_handoff) (bt_bdaddr_t *bd_addr);
+    bt_status_t (*get_total_items_rsp) (uint8_t status_code, uint32_t item_count,
+            uint16_t uid_counter, bt_bdaddr_t *bd_addr);
 
     /** Closes the interface. */
     void  (*cleanup)( void );
@@ -320,7 +484,7 @@
                                                      btrc_element_attr_val_t *p_attrs);
 
 typedef void (* btrc_ctrl_play_position_changed_callback)(bt_bdaddr_t *bd_addr,
-                                                              uint32_t song_len, uint32_t song_pos);
+                                                              uint32_t song_len, uint32_t song_pos, btrc_play_status_t play_status);
 
 typedef void (* btrc_ctrl_play_status_changed_callback)(bt_bdaddr_t *bd_addr,
                                                             btrc_play_status_t play_status);
diff --git a/include/hardware/bt_sock.h b/include/hardware/bt_sock.h
index 8d1a9e0..386dff7 100644
--- a/include/hardware/bt_sock.h
+++ b/include/hardware/bt_sock.h
@@ -30,6 +30,12 @@
     BTSOCK_L2CAP = 3
 } btsock_type_t;
 
+typedef enum {
+    BTSOCK_OPT_GET_MODEM_BITS = 1,
+    BTSOCK_OPT_SET_MODEM_BITS = 2,
+    BTSOCK_OPT_CLR_MODEM_BITS = 3,
+} btsock_option_type_t;
+
 /** Represents the standard BT SOCKET interface. */
 typedef struct {
     short size;
@@ -70,6 +76,19 @@
      */
     bt_status_t (*connect)(const bt_bdaddr_t *bd_addr, btsock_type_t type, const uint8_t* uuid,
             int channel, int* sock_fd, int flags, int callingUid);
+
+    /*
+     * get socket option of rfcomm channel socket.
+     */
+    bt_status_t (*get_sock_opt)(btsock_type_t type, int channel, btsock_option_type_t option_name,
+            void *option_value, int *option_len);
+    /*
+
+     * set socket option of rfcomm channel socket.
+     */
+    bt_status_t (*set_sock_opt)(btsock_type_t type, int channel, btsock_option_type_t option_name,
+            void *option_value, int option_len);
+
 } btsock_interface_t;
 
 __END_DECLS
diff --git a/include/hardware/display_defs.h b/include/hardware/display_defs.h
new file mode 100644
index 0000000..0ec356f
--- /dev/null
+++ b/include/hardware/display_defs.h
@@ -0,0 +1,79 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ANDROID_INCLUDE_DISPLAY_DEFS_H
+#define ANDROID_INCLUDE_DISPLAY_DEFS_H
+
+#include <stdint.h>
+#include <sys/cdefs.h>
+
+#include <hardware/hwcomposer.h>
+
+__BEGIN_DECLS
+
+/* Will need to update below enums if hwcomposer_defs.h is updated */
+
+/* Extended events for hwc_methods::eventControl() */
+enum {
+    HWC_EVENT_ORIENTATION             = HWC_EVENT_VSYNC + 1
+};
+
+
+/* Extended hwc_layer_t::compositionType values */
+enum {
+    /* this layer will be handled in the HWC, using a blit engine */
+    HWC_BLIT                          = 0xFF
+};
+
+/* Extended hwc_layer_t::flags values
+ * Flags are set by SurfaceFlinger and read by the HAL
+ */
+enum {
+    /*
+     * HWC_SCREENSHOT_ANIMATOR_LAYER is set by surfaceflinger to indicate
+     * that this layer is a screenshot animating layer. HWC uses this
+     * info to disable rotation animation on External Display
+     */
+    HWC_SCREENSHOT_ANIMATOR_LAYER     = 0x00000004
+};
+
+/* This enum represents different types of 3D mode supported. This definition
+ * is maintained by HWC and exposed to its clients.
+ */
+enum {
+    HWC_S3DMODE_NONE = 0,
+    HWC_S3DMODE_LR,
+    HWC_S3DMODE_RL,
+    HWC_S3DMODE_TB,
+    HWC_S3DMODE_FP,
+    HWC_S3DMODE_MAX,
+};
+
+__END_DECLS
+
+#endif /* ANDROID_INCLUDE_DISPLAY_DEFS_H*/
diff --git a/include/hardware/gralloc.h b/include/hardware/gralloc.h
index 779915c..0c87fb0 100644
--- a/include/hardware/gralloc.h
+++ b/include/hardware/gralloc.h
@@ -143,6 +143,19 @@
     GRALLOC_USAGE_PRIVATE_2             = 0x40000000,
     GRALLOC_USAGE_PRIVATE_3             = 0x80000000,
     GRALLOC_USAGE_PRIVATE_MASK          = 0xF0000000,
+
+#ifdef EXYNOS4_ENHANCEMENTS
+    /* SAMSUNG */
+    GRALLOC_USAGE_PRIVATE_NONECACHE     = 0x00800000,
+
+    GRALLOC_USAGE_HW_FIMC1              = 0x01000000,
+    GRALLOC_USAGE_HW_ION                = 0x02000000,
+    GRALLOC_USAGE_YUV_ADDR              = 0x04000000,
+    GRALLOC_USAGE_CAMERA                = 0x08000000,
+
+    /* SEC Private usage , for Overlay path at HWC */
+    GRALLOC_USAGE_HWC_HWOVERLAY         = 0x20000000,
+#endif
 };
 
 /*****************************************************************************/
@@ -237,6 +250,10 @@
     int (*unlock)(struct gralloc_module_t const* module,
             buffer_handle_t handle);
 
+#ifdef EXYNOS4_ENHANCEMENTS
+    int (*getphys) (struct gralloc_module_t const* module,
+            buffer_handle_t handle, void** paddr);
+#endif
 
     /* reserved for future use */
     int (*perform)(struct gralloc_module_t const* module,
diff --git a/include/hardware/gralloc1.h b/include/hardware/gralloc1.h
index 58c0e33..82345e9 100644
--- a/include/hardware/gralloc1.h
+++ b/include/hardware/gralloc1.h
@@ -141,7 +141,12 @@
     GRALLOC1_FUNCTION_LOCK = 18,
     GRALLOC1_FUNCTION_LOCK_FLEX = 19,
     GRALLOC1_FUNCTION_UNLOCK = 20,
+#ifdef EXYNOS4_ENHANCEMENTS
+    GRALLOC1_FUNCTION_GETPHYS = 21,
+    GRALLOC1_LAST_FUNCTION = 21,
+#else
     GRALLOC1_LAST_FUNCTION = 20,
+#endif
 } gralloc1_function_descriptor_t;
 
 typedef enum {
@@ -882,6 +887,12 @@
         gralloc1_device_t* device, buffer_handle_t buffer,
         int32_t* outReleaseFence);
 
+#ifdef EXYNOS4_ENHANCEMENTS
+typedef int32_t /*gralloc1_error_t*/ (*GRALLOC1_PFN_GETPHYS)(
+        gralloc1_device_t* device, buffer_handle_t buffer,
+        void **paddr);
+#endif
+
 __END_DECLS
 
 #endif
diff --git a/include/hardware/hwcomposer.h b/include/hardware/hwcomposer.h
index 61218bb..28877e1 100644
--- a/include/hardware/hwcomposer.h
+++ b/include/hardware/hwcomposer.h
@@ -286,6 +286,11 @@
              * their origin is the top-left corner.
              */
             hwc_region_t surfaceDamage;
+
+#ifdef QTI_BSP
+            /* Color for Dim Layer */
+            hwc_color_t color;
+#endif
         };
     };
 
diff --git a/include/hardware/hwcomposer_defs.h b/include/hardware/hwcomposer_defs.h
index 18b30bc..dc1eceb 100644
--- a/include/hardware/hwcomposer_defs.h
+++ b/include/hardware/hwcomposer_defs.h
@@ -254,15 +254,26 @@
 enum {
     HWC_DISPLAY_PRIMARY     = 0,
     HWC_DISPLAY_EXTERNAL    = 1,    // HDMI, DP, etc.
+#ifdef QTI_BSP
+    HWC_DISPLAY_TERTIARY    = 2,
+    HWC_DISPLAY_VIRTUAL     = 3,
+
+    HWC_NUM_PHYSICAL_DISPLAY_TYPES = 3,
+    HWC_NUM_DISPLAY_TYPES          = 4,
+#else
     HWC_DISPLAY_VIRTUAL     = 2,
 
     HWC_NUM_PHYSICAL_DISPLAY_TYPES = 2,
     HWC_NUM_DISPLAY_TYPES          = 3,
+#endif
 };
 
 enum {
     HWC_DISPLAY_PRIMARY_BIT     = 1 << HWC_DISPLAY_PRIMARY,
     HWC_DISPLAY_EXTERNAL_BIT    = 1 << HWC_DISPLAY_EXTERNAL,
+#ifdef QTI_BSP
+    HWC_DISPLAY_TERTIARY_BIT    = 1 << HWC_DISPLAY_TERTIARY,
+#endif
     HWC_DISPLAY_VIRTUAL_BIT     = 1 << HWC_DISPLAY_VIRTUAL,
 };
 
diff --git a/include/hardware/keymaster1.h b/include/hardware/keymaster1.h
index afd202c..079e5a0 100644
--- a/include/hardware/keymaster1.h
+++ b/include/hardware/keymaster1.h
@@ -530,6 +530,55 @@
      */
     keymaster_error_t (*abort)(const struct keymaster1_device* dev,
                                keymaster_operation_handle_t operation_handle);
+
+    /**
+     * Generates a pair of ATTK defined in SOTER. Save the private key into RPMB.
+     * Note that the ATTK generated will never be touched outside the keymaster.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[in] copy_num The number of copies that will be saved in the RPMB.
+     */
+     keymaster_error_t (*generate_attk_key_pair)(const struct keymaster1_device* dev,
+                                                 const uint8_t copy_num);
+
+    /**
+     * Verify the existance ATTK defined in SOTER.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * Returns: 0 if the ATTK exists.
+     */
+     keymaster_error_t (*verify_attk_key_pair)(const struct keymaster1_device* dev);
+
+    /**
+     * Export the public key of ATTK in PEM format.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[out] pub_key_data The public key data in X.509v3 format PEM encoded
+     *
+     * \param[out] pub_key_data_length The length of the public key data.
+     */
+     keymaster_error_t (*export_attk_public_key)(const struct keymaster1_device* dev,
+                                                 const uint8_t* pub_key_data,
+                                                 const size_t pub_key_data_length);
+
+    /**
+     * Get Unique device ID.
+     *
+     * \param[in] dev The keymaster device structure.
+     *
+     * \param[out] device_id The unique id for each device, format as below:
+     * 1.bytes 0-3: Identify each silicon provider id.
+     * 2.bytes 4-7: SoC model ID, defined by each silicon provider
+     * 3.bytes 8-15: Public Chip Serial *Number of SoC, defined by each silicon provider
+     *
+     * \param[out] device_id_length The length of the device id.
+     */
+     keymaster_error_t (*get_device_id)(const struct keymaster1_device* dev,
+                                        const uint8_t* device_id,
+                                        const size_t device_id_length);
 };
 typedef struct keymaster1_device keymaster1_device_t;
 
diff --git a/include/hardware/keymaster_defs.h b/include/hardware/keymaster_defs.h
index b45e785..365fc4d 100644
--- a/include/hardware/keymaster_defs.h
+++ b/include/hardware/keymaster_defs.h
@@ -148,6 +148,15 @@
     KM_TAG_RESET_SINCE_ID_ROTATION = KM_BOOL | 1004, /* Whether the device has beeen factory reset
                                                         since the last unique ID rotation.  Used for
                                                         key attestation. */
+    KM_TAG_SOTER_IS_FROM_SOTER = KM_BOOL | 11000,
+    KM_TAG_SOTER_IS_AUTO_SIGNED_WITH_ATTK_WHEN_GET_PUBLIC_KEY = KM_BOOL | 11001,
+    KM_TAG_SOTER_IS_AUTO_SIGNED_WITH_COMMON_KEY_WHEN_GET_PUBLIC_KEY = KM_BOOL| 11002,
+    KM_TAG_SOTER_AUTO_SIGNED_COMMON_KEY_WHEN_GET_PUBLIC_KEY = KM_BYTES | 11003,
+    KM_TAG_SOTER_AUTO_ADD_COUNTER_WHEN_GET_PUBLIC_KEY = KM_BOOL | 11004,
+    KM_TAG_SOTER_IS_SECMSG_FID_COUNTER_SIGNED_WHEN_SIGN = KM_BOOL | 11005,
+    KM_TAG_SOTER_USE_NEXT_ATTK = KM_BOOL | 11006,
+    KM_TAG_SOTER_UID = KM_UINT | 11007,
+    KM_TAG_SOTER_AUTO_SIGNED_COMMON_KEY_WHEN_GET_PUBLIC_KEY_BLOB = KM_BYTES | 11008,
 } keymaster_tag_t;
 
 /**
@@ -432,6 +441,8 @@
     KM_ERROR_VERSION_MISMATCH = -101,
 
     KM_ERROR_UNKNOWN_ERROR = -1000,
+
+    KM_ERROR_SOTER_ERROR = -10000,
 } keymaster_error_t;
 
 /* Convenience functions for manipulating keymaster tag types */
diff --git a/include/hardware/lights.h b/include/hardware/lights.h
index b3d28b0..29d5e3c 100644
--- a/include/hardware/lights.h
+++ b/include/hardware/lights.h
@@ -73,6 +73,12 @@
 #define LIGHT_ID_BLUETOOTH          "bluetooth"
 #define LIGHT_ID_WIFI               "wifi"
 
+/*
+ * Additional hardware-specific lights
+ */
+#define LIGHT_ID_CAPS               "caps"
+#define LIGHT_ID_FUNC               "func"
+
 /* ************************************************************************
  * Flash modes for the flashMode field of light_state_t.
  */
@@ -137,6 +143,11 @@
 #define BRIGHTNESS_MODE_LOW_PERSISTENCE 2
 
 /**
+ * Light mode allows multiple LEDs
+ */
+#define LIGHT_MODE_MULTIPLE_LEDS    0x01
+
+/**
  * The parameters that can be set for a given light.
  *
  * Not all lights must support all parameters.  If you
@@ -156,6 +167,9 @@
      *
      * The high byte should be ignored.  Callers will set it to 0xff (which
      * would correspond to 255 alpha).
+     *
+     * CyanogenMod: The high byte value can be implemented to control the LEDs
+     * Brightness from the Lights settings. The value goes from 0x01 to 0xFF.
      */
     unsigned int color;
 
@@ -171,6 +185,12 @@
      * Currently the values are BRIGHTNESS_MODE_USER and BRIGHTNESS_MODE_SENSOR.
      */
     int brightnessMode;
+
+    /**
+     * Define the LEDs modes (multiple, ...).
+     * See the LIGHTS_MODE_* mask constants.
+     */
+    unsigned int ledsModes;
 };
 
 struct light_device_t {
diff --git a/include/hardware/nfc.h b/include/hardware/nfc.h
index 58d33d9..6002e34 100644
--- a/include/hardware/nfc.h
+++ b/include/hardware/nfc.h
@@ -54,6 +54,7 @@
  */
 #define NFC_NCI_HARDWARE_MODULE_ID "nfc_nci"
 #define NFC_NCI_BCM2079X_HARDWARE_MODULE_ID "nfc_nci.bcm2079x"
+#define NFC_NCI_NXP_PN54X_HARDWARE_MODULE_ID "nfc_nci.pn54x"
 #define NFC_NCI_CONTROLLER "nci"
 
 /*
diff --git a/include/hardware/power.h b/include/hardware/power.h
index bd8216e..70bc745 100644
--- a/include/hardware/power.h
+++ b/include/hardware/power.h
@@ -65,11 +65,17 @@
     POWER_HINT_SUSTAINED_PERFORMANCE = 0x00000006,
     POWER_HINT_VR_MODE = 0x00000007,
     POWER_HINT_LAUNCH = 0x00000008,
-    POWER_HINT_DISABLE_TOUCH = 0x00000009
+    POWER_HINT_DISABLE_TOUCH = 0x00000009,
+
+    // CM hints
+    POWER_HINT_CPU_BOOST    = 0x00000110,
+    POWER_HINT_LAUNCH_BOOST = 0x00000111,
+    POWER_HINT_SET_PROFILE  = 0x00000112,
 } power_hint_t;
 
 typedef enum {
-    POWER_FEATURE_DOUBLE_TAP_TO_WAKE = 0x00000001
+    POWER_FEATURE_DOUBLE_TAP_TO_WAKE = 0x00000001,
+    POWER_FEATURE_SUPPORTED_PROFILES = 0x00001000
 } feature_t;
 
 /*
@@ -158,6 +164,15 @@
 } power_state_platform_sleep_state_t;
 
 /**
+ * Process info, passed as an opaque handle when
+ * using POWER_HINT_LAUNCH_BOOST.
+ */
+typedef struct launch_boost_info {
+    pid_t pid;
+    const char* packageName;
+} launch_boost_info_t;
+
+/**
  * Every hardware module must have a data structure named HAL_MODULE_INFO_SYM
  * and the fields of this data structure must begin with hw_module_t
  * followed by module specific information.
@@ -257,6 +272,12 @@
      *     The data parameter is non-zero when touch could be disabled, and zero
      *     when touch needs to be re-enabled.
      *
+     * POWER_HINT_CPU_BOOST
+     *
+     *     An operation is happening where it would be ideal for the CPU to
+     *     be boosted for a specific duration. The data parameter is an
+     *     integer value of the boost duration in microseconds.
+     *
      * A particular platform may choose to ignore any hint.
      *
      * availability: version 0.2
@@ -280,6 +301,12 @@
     void (*setFeature)(struct power_module *module, feature_t feature, int state);
 
     /*
+     * (*getFeature) is called to get the current value of a particular
+     * feature or capability from the hardware or PowerHAL
+     */
+    int (*getFeature)(struct power_module *module, feature_t feature);
+
+    /*
      * Platform-level sleep state stats:
      * Report cumulative info on the statistics on platform-level sleep states since boot.
      *
@@ -337,7 +364,6 @@
 
 } power_module_t;
 
-
 __END_DECLS
 
 #endif  // ANDROID_INCLUDE_HARDWARE_POWER_H
diff --git a/modules/audio/Android.mk b/modules/audio/Android.mk
index ef4b8f5..8dfda57 100644
--- a/modules/audio/Android.mk
+++ b/modules/audio/Android.mk
@@ -60,3 +60,16 @@
 LOCAL_CFLAGS := -Wno-unused-parameter
 
 include $(BUILD_SHARED_LIBRARY)
+
+# The stub audio amplifier HAL module that can be used as a skeleton for
+# new implementations.
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := audio_amplifier.default
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_SRC_FILES := audio_amplifier.c
+LOCAL_SHARED_LIBRARIES := liblog libcutils
+LOCAL_MODULE_TAGS := optional
+LOCAL_CFLAGS := -Wno-unused-parameter
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/modules/audio/audio_amplifier.c b/modules/audio/audio_amplifier.c
new file mode 100644
index 0000000..9b92356
--- /dev/null
+++ b/modules/audio/audio_amplifier.c
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2015 The CyanogenMod Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "amplifier_default"
+//#define LOG_NDEBUG 0
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <sys/types.h>
+
+#include <cutils/log.h>
+#include <cutils/str_parms.h>
+
+#include <hardware/audio_amplifier.h>
+#include <hardware/hardware.h>
+
+static int amp_set_input_devices(amplifier_device_t *device, uint32_t devices)
+{
+    return 0;
+}
+
+static int amp_set_output_devices(amplifier_device_t *device, uint32_t devices)
+{
+    return 0;
+}
+
+static int amp_enable_output_devices(amplifier_device_t *device,
+        uint32_t devices, bool enable)
+{
+    return 0;
+}
+
+static int amp_enable_input_devices(amplifier_device_t *device,
+        uint32_t devices, bool enable)
+{
+    return 0;
+}
+
+static int amp_set_mode(amplifier_device_t *device, audio_mode_t mode)
+{
+    return 0;
+}
+
+static int amp_output_stream_start(amplifier_device_t *device,
+        struct audio_stream_out *stream, bool offload)
+{
+    return 0;
+}
+
+static int amp_input_stream_start(amplifier_device_t *device,
+        struct audio_stream_in *stream)
+{
+    return 0;
+}
+
+static int amp_output_stream_standby(amplifier_device_t *device,
+        struct audio_stream_out *stream)
+{
+    return 0;
+}
+
+static int amp_input_stream_standby(amplifier_device_t *device,
+        struct audio_stream_in *stream)
+{
+    return 0;
+}
+
+static int amp_set_parameters(struct amplifier_device *device,
+        struct str_parms *parms)
+{
+    return 0;
+}
+
+static int amp_dev_close(hw_device_t *device)
+{
+    if (device)
+        free(device);
+
+    return 0;
+}
+
+static int amp_module_open(const hw_module_t *module, const char *name,
+        hw_device_t **device)
+{
+    if (strcmp(name, AMPLIFIER_HARDWARE_INTERFACE)) {
+        ALOGE("%s:%d: %s does not match amplifier hardware interface name\n",
+                __func__, __LINE__, name);
+        return -ENODEV;
+    }
+
+    amplifier_device_t *amp_dev = calloc(1, sizeof(amplifier_device_t));
+    if (!amp_dev) {
+        ALOGE("%s:%d: Unable to allocate memory for amplifier device\n",
+                __func__, __LINE__);
+        return -ENOMEM;
+    }
+
+    amp_dev->common.tag = HARDWARE_DEVICE_TAG;
+    amp_dev->common.module = (hw_module_t *) module;
+    amp_dev->common.version = HARDWARE_DEVICE_API_VERSION(1, 0);
+    amp_dev->common.close = amp_dev_close;
+
+    amp_dev->set_input_devices = amp_set_input_devices;
+    amp_dev->set_output_devices = amp_set_output_devices;
+    amp_dev->enable_output_devices = amp_enable_output_devices;
+    amp_dev->enable_input_devices = amp_enable_input_devices;
+    amp_dev->set_mode = amp_set_mode;
+    amp_dev->output_stream_start = amp_output_stream_start;
+    amp_dev->input_stream_start = amp_input_stream_start;
+    amp_dev->output_stream_standby = amp_output_stream_standby;
+    amp_dev->input_stream_standby = amp_input_stream_standby;
+    amp_dev->set_parameters = amp_set_parameters;
+
+    *device = (hw_device_t *) amp_dev;
+
+    return 0;
+}
+
+static struct hw_module_methods_t hal_module_methods = {
+    .open = amp_module_open,
+};
+
+amplifier_module_t HAL_MODULE_INFO_SYM = {
+    .common = {
+        .tag = HARDWARE_MODULE_TAG,
+        .module_api_version = AMPLIFIER_MODULE_API_VERSION_0_1,
+        .hal_api_version = HARDWARE_HAL_API_VERSION,
+        .id = AMPLIFIER_HARDWARE_MODULE_ID,
+        .name = "Default audio amplifier HAL",
+        .author = "The CyanogenMod Open Source Project",
+        .methods = &hal_module_methods,
+    },
+};
diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index d47cfba..53613e7 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -159,11 +159,11 @@
     // destroyed if both and input and output streams are destroyed.
     struct submix_stream_out *output;
     struct submix_stream_in *input;
-#if ENABLE_RESAMPLING
-    // Buffer used as temporary storage for resampled data prior to returning data to the output
+#if (ENABLE_RESAMPLING || ENABLE_CHANNEL_CONVERSION)
+    // Buffer used as temporary storage for audio data prior to returning data to the output
     // stream.
-    int16_t resampler_buffer[DEFAULT_PIPE_SIZE_IN_FRAMES];
-#endif // ENABLE_RESAMPLING
+    int16_t processor_buffer[DEFAULT_PIPE_SIZE_IN_FRAMES];
+#endif
 } route_config_t;
 
 struct submix_audio_device {
@@ -474,8 +474,8 @@
         rsxadev->routes[route_idx].rsxSource = 0;
     }
     memset(rsxadev->routes[route_idx].address, 0, AUDIO_DEVICE_MAX_ADDRESS_LEN);
-#ifdef ENABLE_RESAMPLING
-    memset(rsxadev->routes[route_idx].resampler_buffer, 0,
+#if (ENABLE_RESAMPLING || ENABLE_CHANNEL_CONVERSION)
+    memset(rsxadev->routes[route_idx].processor_buffer, 0,
             sizeof(int16_t) * DEFAULT_PIPE_SIZE_IN_FRAMES);
 #endif
 }
@@ -1147,13 +1147,14 @@
         }
 #endif // ENABLE_CHANNEL_CONVERSION
 
+#if (ENABLE_RESAMPLING || ENABLE_CHANNEL_CONVERSION)
+        const size_t processor_buffer_size_frames =
+                sizeof(rsxadev->routes[in->route_handle].processor_buffer) / frame_size;
+#endif
 #if ENABLE_RESAMPLING
         const uint32_t input_sample_rate = in_get_sample_rate(&stream->common);
         const uint32_t output_sample_rate =
                 rsxadev->routes[in->route_handle].config.output_sample_rate;
-        const size_t resampler_buffer_size_frames =
-            sizeof(rsxadev->routes[in->route_handle].resampler_buffer) /
-                sizeof(rsxadev->routes[in->route_handle].resampler_buffer[0]);
         float resampler_ratio = 1.0f;
         // Determine whether resampling is required.
         if (input_sample_rate != output_sample_rate) {
@@ -1170,16 +1171,18 @@
         while ((remaining_frames > 0) && (attempts < MAX_READ_ATTEMPTS)) {
             ssize_t frames_read = -1977;
             size_t read_frames = remaining_frames;
-#if ENABLE_RESAMPLING
+#if (ENABLE_RESAMPLING || ENABLE_CHANNEL_CONVERSION)
             char* const saved_buff = buff;
+#endif
+#if ENABLE_RESAMPLING
             if (resampler_ratio != 1.0f) {
                 // Calculate the number of frames from the pipe that need to be read to generate
                 // the data for the input stream read.
                 const size_t frames_required_for_resampler = (size_t)(
                     (float)read_frames * (float)resampler_ratio);
-                read_frames = min(frames_required_for_resampler, resampler_buffer_size_frames);
+                read_frames = min(frames_required_for_resampler, processor_buffer_size_frames);
                 // Read into the resampler buffer.
-                buff = (char*)rsxadev->routes[in->route_handle].resampler_buffer;
+                buff = (char*)rsxadev->routes[in->route_handle].processor_buffer;
             }
 #endif // ENABLE_RESAMPLING
 #if ENABLE_CHANNEL_CONVERSION
@@ -1187,6 +1190,13 @@
                 // Need to read half the requested frames since the converted output
                 // data will take twice the space (mono->stereo).
                 read_frames /= 2;
+            } else if (output_channels == 2 && input_channels == 1) {
+                // If the resampler is active, we already swapped for the processor_buffer
+                if (resampler_ratio == 1.0f) {
+                    buff = (char*)rsxadev->routes[in->route_handle].processor_buffer;
+                }
+
+                read_frames = min(read_frames, processor_buffer_size_frames/2);
             }
 #endif // ENABLE_CHANNEL_CONVERSION
 
@@ -1205,11 +1215,17 @@
                 if (output_channels == 2 && input_channels == 1) {
                     // Offset into the output stream data in samples.
                     ssize_t output_stream_offset = 0;
+                    // If resampler is active, continue writing to the temporary buffer
+                    int16_t *mixed_buffer =
+                        (resampler_ratio == 1.0f) ? (int16_t*)saved_buff : (int16_t*)buff;
                     for (ssize_t input_stream_frame = 0; input_stream_frame < frames_read;
                          input_stream_frame++, output_stream_offset += 2) {
                         // Average the content from both channels.
-                        data[input_stream_frame] = ((int32_t)data[output_stream_offset] +
-                                                    (int32_t)data[output_stream_offset + 1]) / 2;
+                        mixed_buffer[input_stream_frame] = ((int32_t)data[output_stream_offset] +
+                                                            (int32_t)data[output_stream_offset + 1]) / 2;
+                    }
+                    if (resampler_ratio == 1.0f) {
+                        buff = saved_buff;
                     }
                 } else if (output_channels == 1 && input_channels == 2) {
                     // Offset into the input stream data in samples.
@@ -1233,13 +1249,20 @@
                 // sampled at a different rate this will result in very nasty aliasing.
                 const float output_stream_frames = (float)frames_read;
                 size_t input_stream_frame = 0;
+                size_t input_buf_offset = 0, output_buf_offset = 0;
                 for (float output_stream_frame = 0.0f;
                      output_stream_frame < output_stream_frames &&
                      input_stream_frame < remaining_frames;
                      output_stream_frame += resampler_ratio, input_stream_frame++) {
-                    resampled_buffer[input_stream_frame] = data[(size_t)output_stream_frame];
+                    input_buf_offset = input_stream_frame * input_channels;
+                    output_buf_offset = (size_t)output_stream_frame * input_channels;
+                    resampled_buffer[input_buf_offset] = data[output_buf_offset];
+                    if (input_channels == 2) {
+                        // copy second channel in the frame
+                        resampled_buffer[input_buf_offset + 1] = data[output_buf_offset + 1];
+                    }
                 }
-                ALOG_ASSERT(input_stream_frame <= (ssize_t)resampler_buffer_size_frames);
+                ALOG_ASSERT(input_stream_frame <= (ssize_t)processor_buffer_size_frames);
                 SUBMIX_ALOGV("in_read(): resampler produced %zd frames", input_stream_frame);
                 frames_read = input_stream_frame;
                 buff = saved_buff;
diff --git a/modules/sensors/Android.mk b/modules/sensors/Android.mk
index 534e6e9..bf377c9 100644
--- a/modules/sensors/Android.mk
+++ b/modules/sensors/Android.mk
@@ -20,7 +20,7 @@
 
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := sensors.$(TARGET_DEVICE)
+LOCAL_MODULE := sensors.$(TARGET_BOARD_PLATFORM)
 
 LOCAL_MODULE_RELATIVE_PATH := hw
 
diff --git a/modules/sensors/multihal.cpp b/modules/sensors/multihal.cpp
index 0edbc2d..21a7c96 100644
--- a/modules/sensors/multihal.cpp
+++ b/modules/sensors/multihal.cpp
@@ -490,14 +490,14 @@
         pthread_mutex_unlock(&init_modules_mutex);
         return;
     }
-    std::vector<std::string> *so_paths = new std::vector<std::string>();
-    get_so_paths(so_paths);
+    std::vector<std::string> so_paths;
+    get_so_paths(&so_paths);
 
     // dlopen the module files and cache their module symbols in sub_hw_modules
     sub_hw_modules = new std::vector<hw_module_t *>();
     dlerror(); // clear any old errors
     const char* sym = HAL_MODULE_INFO_SYM_AS_STR;
-    for (std::vector<std::string>::iterator it = so_paths->begin(); it != so_paths->end(); it++) {
+    for (std::vector<std::string>::iterator it = so_paths.begin(); it != so_paths.end(); it++) {
         const char* path = it->c_str();
         void* lib_handle = dlopen(path, RTLD_LAZY);
         if (lib_handle == NULL) {