diff --git a/apns-full-conf.xml b/apns-full-conf.xml
index 19f5317..ae71b05 100644
--- a/apns-full-conf.xml
+++ b/apns-full-conf.xml
@@ -9473,7 +9473,7 @@
       protocol="IPV6"
       roaming_protocol="IPV6"
       mtu="1440"
-      bearer_bitmask="18"
+      bearer="18"
   />
 
   <apn carrier="T-Mobile MMS"
@@ -9495,7 +9495,7 @@
        type="mms"
        protocol="IPV6"
        roaming_protocol="IPV6"
-       bearer_bitmask="18"
+       bearer="18"
   />
 
   <apn carrier="Project Fi - T"
diff --git a/camera/QCamera2/HAL3/QCamera3HWI.cpp b/camera/QCamera2/HAL3/QCamera3HWI.cpp
index 680850d..26c9acd 100644
--- a/camera/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/camera/QCamera2/HAL3/QCamera3HWI.cpp
@@ -50,6 +50,7 @@
 #include "QCamera3Channel.h"
 #include "QCamera3PostProc.h"
 #include "QCamera3VendorTags.h"
+#include "cam_cond.h"
 
 using namespace android;
 
@@ -364,7 +365,8 @@
     // TODO: hardcode for now until mctl add support for min_num_pp_bufs
     //TBD - To see if this hardcoding is needed. Check by printing if this is filled by mctl to 3
     gCamCapability[cameraId]->min_num_pp_bufs = 3;
-    pthread_cond_init(&mRequestCond, NULL);
+
+    PTHREAD_COND_INIT(&mRequestCond);
     mPendingLiveRequest = 0;
     mCurrentRequestId = -1;
     pthread_mutex_init(&mMutex, NULL);
@@ -2580,17 +2582,22 @@
                 i++;
                 continue;
             } else {
-                ALOGE("%s: Fatal: Missing metadata buffer for frame number %d", __func__, i->frame_number);
-                if (free_and_bufdone_meta_buf) {
-                    mMetadataChannel->bufDone(metadata_buf);
-                    free(metadata_buf);
-                }
+                ALOGE("%s: Missing metadata buffer for frame number %d, reporting CAMERA3_MSG_ERROR_RESULT",
+                     __func__, i->frame_number);
+
+                mPendingLiveRequest--;
+
+                CameraMetadata dummyMetadata;
+                dummyMetadata.update(ANDROID_REQUEST_ID, &(i->request_id), 1);
+                result.result = dummyMetadata.release();
+
                 camera3_notify_msg_t notify_msg;
                 memset(&notify_msg, 0, sizeof(notify_msg));
                 notify_msg.type = CAMERA3_MSG_ERROR;
-                notify_msg.message.error.error_code = CAMERA3_MSG_ERROR_DEVICE;
+                notify_msg.message.error.error_code = CAMERA3_MSG_ERROR_RESULT;
+                notify_msg.message.error.error_stream = NULL;
+                notify_msg.message.error.frame_number = i->frame_number;
                 mCallbackOps->notify(mCallbackOps, &notify_msg);
-                goto done_metadata;
             }
         } else {
             i->partial_result_cnt++;
@@ -3821,7 +3828,7 @@
     // Added a timed condition wait
     struct timespec ts;
     uint8_t isValidTimeout = 1;
-    rc = clock_gettime(CLOCK_REALTIME, &ts);
+    rc = clock_gettime(CLOCK_MONOTONIC, &ts);
     if (rc < 0) {
       isValidTimeout = 0;
       ALOGE("%s: Error reading the real time clock!!", __func__);
@@ -9478,7 +9485,9 @@
     for (List<stream_info_t *>::iterator it = mStreamInfo.begin();
         it != mStreamInfo.end(); it++) {
         QCamera3Channel *channel = (QCamera3Channel *)(*it)->stream->priv;
-        channel->stop();
+        if (channel != nullptr) {
+            channel->stop();
+        }
         (*it)->status = INVALID;
     }
 
diff --git a/camera/QCamera2/stack/common/cam_cond.h b/camera/QCamera2/stack/common/cam_cond.h
new file mode 100644
index 0000000..52a6d71
--- /dev/null
+++ b/camera/QCamera2/stack/common/cam_cond.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef CAM_COND_H
+#define CAM_COND_H
+
+#define PTHREAD_COND_INIT(cond) \
+  ({                                   \
+    int rc = 0;                       \
+    pthread_condattr_t cond_attr;     \
+    rc = pthread_condattr_init(&cond_attr);   \
+    if (rc == 0) {                            \
+      rc = pthread_condattr_setclock(&cond_attr, CLOCK_MONOTONIC);  \
+      if (rc == 0) {                                 \
+        rc = pthread_cond_init(cond, &cond_attr);  \
+      } \
+    } \
+    rc; \
+  })
+
+#endif // CAM_COND_H
diff --git a/camera/QCamera2/stack/common/cam_semaphore.h b/camera/QCamera2/stack/common/cam_semaphore.h
index a52f907..f4260c2 100644
--- a/camera/QCamera2/stack/common/cam_semaphore.h
+++ b/camera/QCamera2/stack/common/cam_semaphore.h
@@ -30,6 +30,11 @@
 #ifndef __QCAMERA_SEMAPHORE_H__
 #define __QCAMERA_SEMAPHORE_H__
 
+// System dependencies
+#include <pthread.h>
+#include <errno.h>
+#include "cam_cond.h"
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -48,7 +53,7 @@
 static inline void cam_sem_init(cam_semaphore_t *s, int n)
 {
     pthread_mutex_init(&(s->mutex), NULL);
-    pthread_cond_init(&(s->cond), NULL);
+    PTHREAD_COND_INIT(&(s->cond));
     s->val = n;
 }
 
@@ -71,6 +76,27 @@
     return rc;
 }
 
+static inline int cam_sem_timedwait(cam_semaphore_t *s, const struct timespec *abs_timeout)
+{
+    int rc = 0;
+    pthread_mutex_lock(&(s->mutex));
+    while (s->val == 0 && rc != ETIMEDOUT)
+        rc = pthread_cond_timedwait(&(s->cond), &(s->mutex), abs_timeout);
+
+    if (s->val > 0)
+        s->val--;
+
+    pthread_mutex_unlock(&(s->mutex));
+
+    /* sem_timedwait returns -1 for failure case, and failure code is in errno
+     */
+    if (rc != 0) {
+        errno = rc;
+        rc = -1;
+    }
+    return rc;
+}
+
 static inline void cam_sem_destroy(cam_semaphore_t *s)
 {
     pthread_mutex_destroy(&(s->mutex));
diff --git a/camera/QCamera2/stack/mm-camera-interface/Android.mk b/camera/QCamera2/stack/mm-camera-interface/Android.mk
index ff71773..cef137d 100644
--- a/camera/QCamera2/stack/mm-camera-interface/Android.mk
+++ b/camera/QCamera2/stack/mm-camera-interface/Android.mk
@@ -27,6 +27,8 @@
 LOCAL_COPY_HEADERS_TO := mm-camera-interface
 LOCAL_COPY_HEADERS += ../common/cam_intf.h
 LOCAL_COPY_HEADERS += ../common/cam_types.h
+LOCAL_COPY_HEADERS += ../common/cam_cond.h
+LOCAL_COPY_HEADERS += ../common/cam_semaphore.h
 
 LOCAL_C_INCLUDES := \
     $(LOCAL_PATH)/inc \
diff --git a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c
index 1cf357f..9e6f30f 100644
--- a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c
+++ b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c
@@ -43,6 +43,7 @@
 #include "mm_camera_sock.h"
 #include "mm_camera_interface.h"
 #include "mm_camera.h"
+#include "cam_cond.h"
 
 #define SET_PARM_BIT32(parm, parm_arr) \
     (parm_arr[parm/32] |= (1<<(parm%32)))
@@ -340,7 +341,7 @@
 
     pthread_mutex_init(&my_obj->cb_lock, NULL);
     pthread_mutex_init(&my_obj->evt_lock, NULL);
-    pthread_cond_init(&my_obj->evt_cond, NULL);
+    PTHREAD_COND_INIT(&my_obj->evt_cond);
 
     CDBG("%s : Launch evt Thread in Cam Open",__func__);
     snprintf(my_obj->evt_thread.threadName, THREAD_NAME_SIZE, "CAM_Dispatch");
@@ -1713,7 +1714,7 @@
 
     pthread_mutex_lock(&my_obj->evt_lock);
     while (!(my_obj->evt_rcvd.server_event_type & evt_mask)) {
-        clock_gettime(CLOCK_REALTIME, &ts);
+        clock_gettime(CLOCK_MONOTONIC, &ts);
         ts.tv_sec += WAIT_TIMEOUT;
         rc = pthread_cond_timedwait(&my_obj->evt_cond, &my_obj->evt_lock, &ts);
         if (rc == ETIMEDOUT) {
diff --git a/camera/QCamera2/stack/mm-camera-test/Android.mk b/camera/QCamera2/stack/mm-camera-test/Android.mk
index fbe05d0..62fe7ce 100644
--- a/camera/QCamera2/stack/mm-camera-test/Android.mk
+++ b/camera/QCamera2/stack/mm-camera-test/Android.mk
@@ -222,3 +222,19 @@
 
 LOCAL_MODULE:= libmm-qcamera
 include $(BUILD_SHARED_LIBRARY)
+
+# Build cam_semaphore_tests
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES := src/cam_semaphore_tests.cpp
+
+LOCAL_C_INCLUDES += $(LOCAL_PATH)/../common
+
+LOCAL_CFLAGS := -Wall -Wextra -Werror
+
+LOCAL_MODULE := cam_semaphore_tests
+LOCAL_MODULE_TAGS := tests
+
+include $(BUILD_NATIVE_TEST)
+
+LOCAL_PATH := $(OLD_LOCAL_PATH)
diff --git a/camera/QCamera2/stack/mm-camera-test/src/cam_semaphore_tests.cpp b/camera/QCamera2/stack/mm-camera-test/src/cam_semaphore_tests.cpp
new file mode 100644
index 0000000..98ec45b
--- /dev/null
+++ b/camera/QCamera2/stack/mm-camera-test/src/cam_semaphore_tests.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "cam_semaphore_tests"
+#include <utils/Log.h>
+
+#include <gtest/gtest.h>
+
+#include "cam_semaphore.h"
+
+#define NS_PER_S 1000000000
+
+//10 ms is about standard timer resolution for most non-RTOS.
+#define TIME_THRESHOLD_IN_NS  10000000
+
+static inline void timespec_add_ms(timespec& ts, size_t ms) {
+    ts.tv_sec  += ms / 1000;
+    ts.tv_nsec += (ms % 1000) * 1000000;
+    if (ts.tv_nsec >= NS_PER_S) {
+        ts.tv_sec++;
+        ts.tv_nsec -= NS_PER_S;
+    }
+}
+
+static inline int64_t time_diff(timespec& ts_start, timespec& ts_end) {
+    if (ts_start.tv_sec == ts_end.tv_sec) {
+        return (int64_t)ts_end.tv_nsec - ts_start.tv_nsec;
+    } else {
+        return (int64_t)(ts_end.tv_sec - 1 - ts_start.tv_sec) * NS_PER_S +
+                ts_end.tv_nsec + NS_PER_S - ts_start.tv_nsec;
+    }
+}
+
+// Test cam_semaphore_timedwait
+TEST(cam_semaphore_tests, cam_semaphore_timedwait) {
+
+    cam_semaphore_t sem;
+    cam_sem_init(&sem, 0);
+
+    // Test timeout
+    timespec ts;
+    ASSERT_EQ(0, clock_gettime(CLOCK_MONOTONIC, &ts));
+    timespec_add_ms(ts, 100);
+
+    errno = 0;
+    ASSERT_EQ(-1, cam_sem_timedwait(&sem, &ts));
+    timespec ts_end;
+    clock_gettime(CLOCK_MONOTONIC, &ts_end);
+
+    ASSERT_EQ(ETIMEDOUT, errno);
+    // Check time after timeout ~= time before call + timeout
+    ASSERT_GE(time_diff(ts, ts_end), 0);
+    ASSERT_LT(time_diff(ts, ts_end), TIME_THRESHOLD_IN_NS);
+
+    // Test successful wait
+    ASSERT_EQ(0, clock_gettime(CLOCK_MONOTONIC, &ts));
+    timespec_add_ms(ts, 100);
+
+    errno = 0;
+    cam_sem_post(&sem);
+    ASSERT_EQ(0, cam_sem_timedwait(&sem, &ts));
+    ASSERT_EQ(0, errno);
+}
diff --git a/device.mk b/device.mk
index 5da4bb3..fe00866 100644
--- a/device.mk
+++ b/device.mk
@@ -36,6 +36,7 @@
     device/lge/bullhead/init.bullhead.usb.rc:root/init.bullhead.usb.rc \
     device/lge/bullhead/fstab.bullhead:root/fstab.bullhead \
     device/lge/bullhead/ueventd.bullhead.rc:root/ueventd.bullhead.rc \
+    device/lge/bullhead/init.recovery.bullhead.rc:root/init.recovery.bullhead.rc \
     device/lge/bullhead/init.bullhead.ramdump.rc:root/init.bullhead.ramdump.rc \
     device/lge/bullhead/init.bullhead.fp.rc:root/init.bullhead.fp.rc
 
@@ -494,6 +495,10 @@
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
     ro.oem_unlock_supported=1
 
+# ro.product.first_api_level indicates the first api level the device has commercially launched on.
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.product.first_api_level=23
+
 # In userdebug, add minidebug info the the boot image and the system server to support
 # diagnosing native crashes.
 ifneq (,$(filter userdebug, $(TARGET_BUILD_VARIANT)))
@@ -510,3 +515,4 @@
 
 $(call inherit-product-if-exists, hardware/qcom/msm8994/msm8992.mk)
 $(call inherit-product-if-exists, vendor/qcom/gpu/msm8994/msm8994-gpu-vendor.mk)
+$(call inherit-product-if-exists, vendor/lge/bullhead/fingerprint/device/device.mk)
diff --git a/gps.conf b/gps.conf
index 6ad636b..a73bcdd 100644
--- a/gps.conf
+++ b/gps.conf
@@ -3,11 +3,20 @@
 # below will be ignored, and instead the servers will
 # be queried from the modem.
 XTRA_SERVER_QUERY=0
+
+# URLs from which to download XTRA data
 # XTRA_SERVERs below are used only if XTRA_SERVER_QUERY
 # is off.
-XTRA_SERVER_1=http://xtrapath1.izatcloud.net/xtra2.bin
-XTRA_SERVER_2=http://xtrapath2.izatcloud.net/xtra2.bin
-XTRA_SERVER_3=http://xtrapath3.izatcloud.net/xtra2.bin
+XTRA_SERVER_1=https://xtrapath1.izatcloud.net/xtra3grc.bin
+XTRA_SERVER_2=https://xtrapath2.izatcloud.net/xtra3grc.bin
+XTRA_SERVER_3=https://xtrapath3.izatcloud.net/xtra3grc.bin
+
+#Version check for XTRA
+#DISABLE = 0
+#AUTO    = 1
+#XTRA2   = 2
+#XTRA3   = 3
+XTRA_VERSION_CHECK=1
 
 # Error Estimate
 # _SET = 1
diff --git a/init.recovery.bullhead.rc b/init.recovery.bullhead.rc
new file mode 100644
index 0000000..74ba632
--- /dev/null
+++ b/init.recovery.bullhead.rc
@@ -0,0 +1,7 @@
+on boot
+    write /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq 960000
+    write /sys/devices/system/cpu/cpu1/cpufreq/scaling_max_freq 960000
+    write /sys/devices/system/cpu/cpu2/cpufreq/scaling_max_freq 960000
+    write /sys/devices/system/cpu/cpu3/cpufreq/scaling_max_freq 960000
+    write /sys/devices/system/cpu/cpu4/cpufreq/scaling_max_freq 960000
+    write /sys/devices/system/cpu/cpu5/cpufreq/scaling_max_freq 960000
diff --git a/overlay/frameworks/base/core/res/res/values-mcc302-mnc610/config.xml b/overlay/frameworks/base/core/res/res/values-mcc302-mnc610/config.xml
index 95a52c0..016060e 100644
--- a/overlay/frameworks/base/core/res/res/values-mcc302-mnc610/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc302-mnc610/config.xml
@@ -21,9 +21,6 @@
      for different hardware and product builds. -->
 <resources>
 
-    <!-- Set to true to add links to Cell Broadcast app from Settings and MMS app. -->
-    <bool name="config_cellBroadcastAppLinks">false</bool>
-
     <!-- MMS user agent prolfile url -->
     <string name="config_mms_user_agent_profile_url" translatable="false">http://gsm.lge.com/html/gsm/QFZXRNH8Kuw6XiXp/Nexus5X-M6.xml</string>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml
index ecece92..a6945ff 100644
--- a/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/overlay/frameworks/base/core/res/res/values/config.xml
@@ -183,6 +183,9 @@
          and the screen off animation has been performed. -->
     <bool name="config_dozeAfterScreenOff">true</bool>
 
+    <!-- Doze: should the TYPE_PICK_UP_GESTURE sensor be used as a pulse signal. -->
+    <bool name="config_dozePulsePickup">true</bool>
+
     <!-- Specifies whether to decouple the interactive state of the device from the display on/off state. -->
     <bool name="config_powerDecoupleInteractiveModeFromDisplay">true</bool>
 
@@ -369,4 +372,7 @@
         <item>"/system/framework/arm64/boot-core-libart.oat"</item>
    </string-array>
 
+   <!-- Enable system navigation keys. -->
+   <bool name="config_supportSystemNavigationKeys">true</bool>
+
 </resources>
diff --git a/overlay/frameworks/base/packages/SystemUI/res/values/config.xml b/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
index 03e35e1..d2dbefb 100644
--- a/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
+++ b/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
@@ -27,9 +27,6 @@
     <!-- Doze: does this device support STATE_DOZE and STATE_DOZE_SUSPEND?  -->
     <bool name="doze_display_state_supported">true</bool>
 
-    <!-- Doze: should the pickup sensor be used as a pulse signal? -->
-    <bool name="doze_pulse_on_pick_up">true</bool>
-
     <!-- Control whether status bar should distinguish HSPA data icon form UMTS
         data icon on devices -->
     <bool name="config_hspa_data_distinguishable">true</bool>
diff --git a/self-extractors/lge/staging/BoardConfigPartial.mk b/self-extractors/lge/staging/BoardConfigPartial.mk
index cbb9830..78214ba 100644
--- a/self-extractors/lge/staging/BoardConfigPartial.mk
+++ b/self-extractors/lge/staging/BoardConfigPartial.mk
@@ -11,3 +11,5 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
+BOARD_PREBUILT_VENDORIMAGE := vendor/lge/bullhead/proprietary/vendor.img
diff --git a/self-extractors/lge/staging/device-partial.mk b/self-extractors/lge/staging/device-partial.mk
index 5579074..2987710 100644
--- a/self-extractors/lge/staging/device-partial.mk
+++ b/self-extractors/lge/staging/device-partial.mk
@@ -11,8 +11,3 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
-# Vendor blob(s) necessary for Bullhead hardware
-PRODUCT_COPY_FILES := \
-    vendor/lge/bullhead/proprietary/vendor.img:vendor.img:lge \
-
diff --git a/sepolicy/fingerprintd.te b/sepolicy/fingerprintd.te
index 8d04f52..825bdff 100644
--- a/sepolicy/fingerprintd.te
+++ b/sepolicy/fingerprintd.te
@@ -7,6 +7,10 @@
 allow fingerprintd input_device:dir r_dir_perms;
 allow fingerprintd input_device:chr_file r_file_perms;
 
+# for SW20.6
+allow fingerprintd uhid_device:chr_file rw_file_perms;
+allow fingerprintd fingerprintd_data_file:sock_file create_file_perms;
+
 # read clk_enable and wakeup_enable in /sys/devices/soc.0/f9966000.spi_fpc/
 allow fingerprintd sysfs_devices_fingerprint:dir r_dir_perms;
 allow fingerprintd sysfs_devices_fingerprint:file rw_file_perms;