diff --git a/CleanSpec.mk b/CleanSpec.mk
index f0a819d..e1b0ca0 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -73,13 +73,40 @@
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/vndk-sp/libz.so)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib64/vndk-sp/libz.so)
 
+# Remove init.recovery.*.rc file in root directory (only needed in recovery root).
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/init.recovery.marlin.rc)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/init.recovery.sailfish.rc)
+
 # Remove /system/lib[64]/vndk-sp/android.hardware.graphics.allocator@2.0.so
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/vndk-sp/android.hardware.graphics.allocator@2.0.so)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib64/vndk-sp/android.hardware.graphics.allocator@2.0.so)
 
+# Remove /vendor/lib[64]/hw/android.hardware.contexthub@1.0-impl.so
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/lib/hw/android.hardware.contexthub@1.0-impl.so)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/lib64/hw/android.hardware.contexthub@1.0-impl.so)
+
 # Remove /system/lib[64]/vndk-sp/libz.so
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/vndk-sp/libz.so)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib64/vndk-sp/libz.so)
 
+# Remove all HALs (actual bitness now being specified)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/lib/hw/*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/lib64/hw/*)
+
+# Remove Clearkey HAL 1.0
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.drm@1.0-service.clearkey.rc)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.drm@1.0-service.clearkey)
+
+# Remove Widevine HAL 1.0
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.drm@1.0-service.widevine.rc)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.drm@1.0-service.widevine)
+
+# Health HAL 2.0
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.health@2.0-service)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.health@2.0-service.rc)
+
+# Remove android.hardware.audio*@2.0 implementation
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/lib/hw/android.hardware.audio*@2.0-impl.so)
+
 # Migrate to versioned VNDK directory layout
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/vndk-sp)
diff --git a/WCNSS_qcom_cfg.ini b/WCNSS_qcom_cfg.ini
index c848470..5a5818b 100644
--- a/WCNSS_qcom_cfg.ini
+++ b/WCNSS_qcom_cfg.ini
@@ -214,14 +214,6 @@
 
 gPNOScanSupport=1
 
-# Perform PNO fast scan this many number of times
-gPNOScanTimerRepeatValue=6
-
-# PNO slow scan period = gPNOSlowScanMultiplier times PNO fast scan period
-# Example: fast scan period is passed from framework (default = 10 sec), then
-# PNO slow scan period = 60 sec.
-gPNOSlowScanMultiplier=6
-
 # Enable or Disable Extended Scan (GScan)
 # 1=Enable (default), 0=Disable
 gExtScanEnable=1
diff --git a/aosp_marlin.mk b/aosp_marlin.mk
index 3194b81..96cc5e9 100644
--- a/aosp_marlin.mk
+++ b/aosp_marlin.mk
@@ -25,7 +25,7 @@
 PRODUCT_DEVICE := marlin
 PRODUCT_BRAND := Android
 PRODUCT_MODEL := AOSP on msm8996
-PRODUCT_MANUFACTURER := google
+PRODUCT_MANUFACTURER := Google
 PRODUCT_RESTRICT_VENDOR_FILES := true
 
 PRODUCT_COPY_FILES += device/google/marlin/fstab.common:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.marlin
@@ -34,6 +34,6 @@
 $(call inherit-product-if-exists, vendor/google_devices/marlin/device-vendor-marlin.mk)
 
 PRODUCT_PACKAGES += \
-    Launcher3 \
+    Launcher3QuickStep \
     WallpaperPicker
 
diff --git a/aosp_marlin_svelte.mk b/aosp_marlin_svelte.mk
index 5660552..a5a4405 100644
--- a/aosp_marlin_svelte.mk
+++ b/aosp_marlin_svelte.mk
@@ -26,7 +26,7 @@
 PRODUCT_DEVICE := marlin
 PRODUCT_BRAND := Android
 PRODUCT_MODEL := AOSP svelte on msm8996
-PRODUCT_MANUFACTURER := google
+PRODUCT_MANUFACTURER := Google
 PRODUCT_RESTRICT_VENDOR_FILES := true
 
 TARGET_PREBUILT_KERNEL := device/google/marlin-kernel/Image.gz-dtb.svelte
diff --git a/aosp_sailfish.mk b/aosp_sailfish.mk
index c27fef5..b6e6427 100644
--- a/aosp_sailfish.mk
+++ b/aosp_sailfish.mk
@@ -25,7 +25,7 @@
 PRODUCT_DEVICE := sailfish
 PRODUCT_BRAND := Android
 PRODUCT_MODEL := AOSP on msm8996
-PRODUCT_MANUFACTURER := google
+PRODUCT_MANUFACTURER := Google
 PRODUCT_RESTRICT_VENDOR_FILES := true
 
 PRODUCT_COPY_FILES += device/google/marlin/fstab.common:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.sailfish
@@ -34,6 +34,6 @@
 $(call inherit-product-if-exists, vendor/google_devices/marlin/device-vendor-sailfish.mk)
 
 PRODUCT_PACKAGES += \
-    Launcher3 \
+    Launcher3QuickStep \
     WallpaperPicker
 
diff --git a/audio_effects.xml b/audio_effects.xml
index 454dcca..acbc2ab 100644
--- a/audio_effects.xml
+++ b/audio_effects.xml
@@ -6,6 +6,7 @@
         <library name="visualizer_sw" path="libvisualizer.so"/>
         <library name="visualizer_hw" path="libqcomvisualizer.so"/>
         <library name="downmix" path="libdownmix.so"/>
+        <library name="dynamics_processing" path="libdynproc.so"/>
         <library name="loudness_enhancer" path="libldnhncr.so"/>
         <library name="proxy" path="libeffectproxy.so"/>
         <library name="offload_bundle" path="libqcompostprocbundle.so"/>
@@ -55,6 +56,7 @@
         <effect name="alarm_helper" library="volume_listener" uuid="09f303e2-0590-11e5-8fdb-0025b32654a0"/>
         <effect name="voice_helper" library="volume_listener" uuid="0ace5c08-0590-11e5-ae9e-0025b32654a0"/>
         <effect name="notification_helper" library="volume_listener" uuid="0b776dde-0590-11e5-81ba-0025b32654a0"/>
+        <effect name="dynamics_processing" library="dynamics_processing" uuid="e0e6539b-1781-7261-676f-6d7573696340"/>
     </effects>
     <postprocess>
         <stream type="music">
diff --git a/audio_platform_info.xml b/audio_platform_info.xml
index 987a9e9..1d8f505 100644
--- a/audio_platform_info.xml
+++ b/audio_platform_info.xml
@@ -88,6 +88,7 @@
        <usecase name="USECASE_AUDIO_PLAYBACK_ULL" type="out" id="19" />
        <usecase name="USECASE_AUDIO_RECORD_MMAP" type="in" id="18" />
        <usecase name="USECASE_AUDIO_PLAYBACK_MMAP" type="out" id="18" />
+       <usecase name="USECASE_INCALL_MUSIC_UPLINK" type="out" id="32" />
      </pcm_ids>
 </audio_platform_info>
 
diff --git a/audio_platform_info_tasha_marlin.xml b/audio_platform_info_tasha_marlin.xml
new file mode 100644
index 0000000..c0538be
--- /dev/null
+++ b/audio_platform_info_tasha_marlin.xml
@@ -0,0 +1,148 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!-- Copyright (c) 2014, The Linux Foundation. All rights reserved.         -->
+<!--                                                                        -->
+<!-- Redistribution and use in source and binary forms, with or without     -->
+<!-- modification, are permitted provided that the following conditions are -->
+<!-- met:                                                                   -->
+<!--     * Redistributions of source code must retain the above copyright   -->
+<!--       notice, this list of conditions and the following disclaimer.    -->
+<!--     * Redistributions in binary form must reproduce the above          -->
+<!--       copyright notice, this list of conditions and the following      -->
+<!--       disclaimer in the documentation and/or other materials provided  -->
+<!--       with the distribution.                                           -->
+<!--     * Neither the name of The Linux Foundation nor the names of its    -->
+<!--       contributors may be used to endorse or promote products derived  -->
+<!--       from this software without specific prior written permission.    -->
+<!--                                                                        -->
+<!-- THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED           -->
+<!-- WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF   -->
+<!-- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT -->
+<!-- ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS -->
+<!-- BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR -->
+<!-- CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF   -->
+<!-- SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR        -->
+<!-- BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,  -->
+<!-- OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN -->
+<!-- IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.                          -->
+<audio_platform_info>
+    <acdb_ids>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER" acdb_id="14"/>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER_HFP" acdb_id="14"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_MIC" acdb_id="41"/>
+        <device name="SND_DEVICE_OUT_VOICE_HAC_HANDSET" acdb_id="201"/>
+        <device name="SND_DEVICE_IN_VOICE_SPEAKER_DMIC" acdb_id="19"/>
+        <device name="SND_DEVICE_OUT_VOICE_TTY_HCO_HANDSET" acdb_id="14"/>
+        <device name="SND_DEVICE_IN_VOICE_TTY_VCO_HANDSET_MIC" acdb_id="19"/>
+        <device name="SND_DEVICE_IN_HEADSET_MIC" acdb_id="4"/>
+        <device name="SND_DEVICE_OUT_HEADPHONES" acdb_id="9"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_HEADPHONES" acdb_id="603"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_SAFE_AND_HEADPHONES" acdb_id="603"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_DMIC_STEREO" acdb_id="505"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_MIC_AEC_NS" acdb_id="114"/>
+        <device name="SND_DEVICE_IN_HEADSET_MIC_AEC" acdb_id="130"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_MIC" acdb_id="143"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_STEREO_MIC" acdb_id="144"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_THREE_MIC" acdb_id="145"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_QUAD_MIC" acdb_id="146"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_HEADSET_MIC" acdb_id="65"/>
+        <device name="SND_DEVICE_IN_BT_SCO_MIC_NREC" acdb_id="122"/>
+        <device name="SND_DEVICE_IN_BT_SCO_MIC_WB_NREC" acdb_id="123"/>
+    </acdb_ids>
+    <backend_names>
+        <device name="SND_DEVICE_OUT_SPEAKER" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_REVERSE" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_SAFE" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_PROTECTED" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER_HFP" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_HEADPHONES" backend="speaker-and-headphones" interface="QUAT_MI2S_RX-and-SLIMBUS_0_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_SAFE_AND_HEADPHONES" backend="speaker-and-headphones" interface="QUAT_MI2S_RX-and-SLIMBUS_0_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_LINE" backend="speaker-and-headphones" interface="QUAT_MI2S_RX-and-SLIMBUS_0_RX"/>
+        <device name="SND_DEVICE_OUT_VOICE_TTY_HCO_HANDSET" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_BT_SCO" backend="speaker-and-bt-sco" interface="QUAT_MI2S_RX-and-AUX_PCM_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_BT_SCO_WB" backend="speaker-and-bt-sco-wb" interface="QUAT_MI2S_RX-and-AUX_PCM_RX"/>
+    </backend_names>
+    <config_params>
+        <param key="input_mic_max_count" value="3"/>
+        <param key="snd_card_name" value="msm8996-tasha"/>
+    </config_params>
+    <gain_db_to_level_mapping>
+        <gain_level_map db="-62.4" level="15"/>
+        <gain_level_map db="-42.4" level="14"/>
+        <gain_level_map db="-41.4" level="13"/>
+        <gain_level_map db="-40.4" level="12"/>
+        <gain_level_map db="-39.1" level="11"/>
+        <gain_level_map db="-28.9" level="10"/>
+        <gain_level_map db="-27.4" level="9"/>
+        <gain_level_map db="-25.5" level="8"/>
+        <gain_level_map db="-23" level="7"/>
+        <gain_level_map db="-20" level="6"/>
+        <gain_level_map db="-17" level="5"/>
+        <gain_level_map db="-14.5" level="4"/>
+        <gain_level_map db="-12" level="3"/>
+        <gain_level_map db="-8.7" level="2"/>
+        <gain_level_map db="0" level="1"/>
+    </gain_db_to_level_mapping>
+    <pcm_ids>
+       <usecase name="USECASE_AUDIO_RECORD_LOW_LATENCY" type="in" id="19" />
+       <usecase name="USECASE_AUDIO_PLAYBACK_ULL" type="out" id="19" />
+       <usecase name="USECASE_AUDIO_RECORD_MMAP" type="in" id="18" />
+       <usecase name="USECASE_AUDIO_PLAYBACK_MMAP" type="out" id="18" />
+       <usecase name="USECASE_INCALL_MUSIC_UPLINK" type="out" id="32" />
+    </pcm_ids>
+    <microphone_characteristics>
+        <microphone valid_mask="31" device_id="builtin_mic_1" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="bottom" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+            group="0" index_in_the_group="0" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="93"
+            frequencies="97.16 102.92 109.02 115.48 122.32 129.57 137.25 145.38 153.99 163.12 172.78 183.02 193.87 205.35 217.52 230.41 244.06 258.52 273.84 290.07 307.26 325.46 344.75 365.17 386.81 409.73 434.01 459.73 486.97 515.82 546.39 578.76 613.06 649.38 687.86 728.62 771.79 817.52 865.96 917.28 971.63 1029.20 1090.18 1154.78 1223.21 1295.69 1372.46 1453.78 1539.93 1631.17 1727.83 1830.21 1938.65 2053.53 2175.20 2304.09 2440.62 2585.23 2738.42 2900.68 3072.56 3254.62 3447.47 3651.74 3868.12 4097.32 4340.10 4597.27 4869.68 5158.22 5463.87 5787.62 6130.56 6493.82 6878.60 7286.18 7717.92 8175.23 8659.64 9172.76 9716.28 10292.01 10901.84 11547.82 12232.07 12956.87 13724.61 14537.84 15399.27 16311.73 17278.26 18302.06 19386.53"
+            responses="-0.40 -0.40 -0.60 -0.70 -0.40 -0.40 -0.30 -0.30 -0.30 -0.30 -0.20 -0.60 -0.90 -0.90 -1.00 -0.70 -0.80 -0.70 -0.70 -0.90 -0.70 -0.20 0.60 1.40 1.70 0.80 -0.80 -2.10 -2.30 -1.70 -0.90 0.50 1.30 1.20 0.80 0.10 0.20 0.40 2.30 2.40 0.00 -0.40 -0.10 0.70 -0.40 1.00 0.50 1.40 2.40 2.00 2.50 2.70 1.70 1.40 1.70 -1.90 -3.60 1.70 2.30 0.00 0.80 -0.30 0.60 1.90 1.40 -1.90 0.30 1.70 -0.60 0.40 2.20 3.60 -4.20 2.50 3.60 8.10 -4.30 5.70 7.30 9.60 7.80 10.20 16.40 18.60 20.10 22.50 23.50 17.60 17.90 18.80 17.70 15.10 14.70"
+            sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 -1.0 0.0" geometric_location="0.0513 0.0 0.0038" />
+        <microphone valid_mask="31" device_id="builtin_mic_2" type="AUDIO_DEVICE_IN_BACK_MIC" address="back" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+            group="0" index_in_the_group="1" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="93"
+            frequencies="97.16 102.92 109.02 115.48 122.32 129.57 137.25 145.38 153.99 163.12 172.78 183.02 193.87 205.35 217.52 230.41 244.06 258.52 273.84 290.07 307.26 325.46 344.75 365.17 386.81 409.73 434.01 459.73 486.97 515.82 546.39 578.76 613.06 649.38 687.86 728.62 771.79 817.52 865.96 917.28 971.63 1029.20 1090.18 1154.78 1223.21 1295.69 1372.46 1453.78 1539.93 1631.17 1727.83 1830.21 1938.65 2053.53 2175.20 2304.09 2440.62 2585.23 2738.42 2900.68 3072.56 3254.62 3447.47 3651.74 3868.12 4097.32 4340.10 4597.27 4869.68 5158.22 5463.87 5787.62 6130.56 6493.82 6878.60 7286.18 7717.92 8175.23 8659.64 9172.76 9716.28 10292.01 10901.84 11547.82 12232.07 12956.87 13724.61 14537.84 15399.27 16311.73 17278.26 18302.06 19386.53"
+            responses="-1.20 -1.20 -1.40 -1.50 -1.10 -1.10 -1.10 -1.20 -1.20 -1.20 -1.10 -1.50 -1.60 -1.60 -1.60 -1.20 -1.20 -1.00 -0.70 -0.70 -0.50 -0.40 -0.40 -0.60 -1.30 -2.30 -2.10 -1.10 -0.30 -0.10 -0.10 -0.60 -1.00 -1.60 -1.60 -0.90 -1.00 -1.10 -1.80 -0.10 0.00 -0.20 -0.50 -0.50 -0.20 0.20 0.40 1.60 1.90 1.10 1.40 2.20 2.90 2.40 1.80 3.90 6.00 6.30 2.80 4.80 5.10 5.90 7.00 8.00 7.10 4.10 6.60 6.50 6.80 8.90 6.20 6.20 9.60 7.30 6.50 9.30 6.90 9.20 6.60 9.50 9.80 9.60 11.80 11.00 12.80 11.50 11.90 12.60 11.30 10.10 10.90 12.70 13.9"
+            sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 0.0 -1.0" geometric_location="0.0347 0.1451 0.0" />
+        <microphone valid_mask="31" device_id="builtin_mic_3" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="top" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+            group="0" index_in_the_group="2" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="93"
+            frequencies="97.16 102.92 109.02 115.48 122.32 129.57 137.25 145.38 153.99 163.12 172.78 183.02 193.87 205.35 217.52 230.41 244.06 258.52 273.84 290.07 307.26 325.46 344.75 365.17 386.81 409.73 434.01 459.73 486.97 515.82 546.39 578.76 613.06 649.38 687.86 728.62 771.79 817.52 865.96 917.28 971.63 1029.20 1090.18 1154.78 1223.21 1295.69 1372.46 1453.78 1539.93 1631.17 1727.83 1830.21 1938.65 2053.53 2175.20 2304.09 2440.62 2585.23 2738.42 2900.68 3072.56 3254.62 3447.47 3651.74 3868.12 4097.32 4340.10 4597.27 4869.68 5158.22 5463.87 5787.62 6130.56 6493.82 6878.60 7286.18 7717.92 8175.23 8659.64 9172.76 9716.28 10292.01 10901.84 11547.82 12232.07 12956.87 13724.61 14537.84 15399.27 16311.73 17278.26 18302.06 19386.53"
+            responses="0.30 0.30 0.30 0.30 0.20 0.10 0.50 0.40 0.40 0.40 0.30 0.30 0.40 0.00 -0.20 -0.10 -0.20 0.10 0.10 0.30 0.60 0.70 1.00 1.10 1.30 1.40 1.10 -0.10 -1.20 -0.90 0.10 0.90 1.30 1.10 0.90 0.00 -1.10 -0.20 0.10 0.70 0.00 0.30 1.40 1.20 0.40 -0.30 1.10 0.70 2.40 2.20 3.10 2.60 1.80 3.60 4.80 2.90 3.20 4.90 7.20 6.70 5.40 4.80 6.50 7.00 8.40 9.20 8.20 4.80 7.40 7.80 7.00 10.10 6.70 6.70 10.10 7.90 6.50 9.10 6.30 8.50 5.50 8.80 8.70 8.40 10.70 9.40 11.10 10.30 11.30 12.80 12.40 11.70 14.30"
+            sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 0.0 1.0" geometric_location="0.0349 0.1471 0.0073" />
+    </microphone_characteristics>
+    <!-- TODO: Fake channel mapping data, need to populate with actual data -->
+    <snd_devices>
+        <input_snd_device>
+            <input_snd_device_mic_mapping>
+                <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_MIC">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_AEC_NS">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_2"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_DMIC_TMUS">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_3"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                    <mic_info mic_device_id="builtin_mic_3"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_THREE_MIC">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_2"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_3"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                </snd_dev>
+            </input_snd_device_mic_mapping>
+        </input_snd_device>
+    </snd_devices>
+</audio_platform_info>
+
diff --git a/audio_platform_info_tasha_sailfish.xml b/audio_platform_info_tasha_sailfish.xml
new file mode 100644
index 0000000..a45e3b6
--- /dev/null
+++ b/audio_platform_info_tasha_sailfish.xml
@@ -0,0 +1,149 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!-- Copyright (c) 2014, The Linux Foundation. All rights reserved.         -->
+<!--                                                                        -->
+<!-- Redistribution and use in source and binary forms, with or without     -->
+<!-- modification, are permitted provided that the following conditions are -->
+<!-- met:                                                                   -->
+<!--     * Redistributions of source code must retain the above copyright   -->
+<!--       notice, this list of conditions and the following disclaimer.    -->
+<!--     * Redistributions in binary form must reproduce the above          -->
+<!--       copyright notice, this list of conditions and the following      -->
+<!--       disclaimer in the documentation and/or other materials provided  -->
+<!--       with the distribution.                                           -->
+<!--     * Neither the name of The Linux Foundation nor the names of its    -->
+<!--       contributors may be used to endorse or promote products derived  -->
+<!--       from this software without specific prior written permission.    -->
+<!--                                                                        -->
+<!-- THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED           -->
+<!-- WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF   -->
+<!-- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT -->
+<!-- ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS -->
+<!-- BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR -->
+<!-- CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF   -->
+<!-- SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR        -->
+<!-- BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,  -->
+<!-- OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN -->
+<!-- IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.                          -->
+<audio_platform_info>
+    <acdb_ids>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER" acdb_id="14"/>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER_HFP" acdb_id="14"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_MIC" acdb_id="41"/>
+        <device name="SND_DEVICE_OUT_VOICE_HAC_HANDSET" acdb_id="201"/>
+        <device name="SND_DEVICE_IN_VOICE_SPEAKER_DMIC" acdb_id="19"/>
+        <device name="SND_DEVICE_OUT_VOICE_TTY_HCO_HANDSET" acdb_id="14"/>
+        <device name="SND_DEVICE_IN_VOICE_TTY_VCO_HANDSET_MIC" acdb_id="19"/>
+        <device name="SND_DEVICE_IN_HEADSET_MIC" acdb_id="4"/>
+        <device name="SND_DEVICE_OUT_HEADPHONES" acdb_id="9"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_HEADPHONES" acdb_id="603"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_SAFE_AND_HEADPHONES" acdb_id="603"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_DMIC_STEREO" acdb_id="505"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_MIC_AEC_NS" acdb_id="114"/>
+        <device name="SND_DEVICE_IN_HEADSET_MIC_AEC" acdb_id="130"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_MIC" acdb_id="143"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_STEREO_MIC" acdb_id="144"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_THREE_MIC" acdb_id="145"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_QUAD_MIC" acdb_id="146"/>
+        <device name="SND_DEVICE_IN_UNPROCESSED_HEADSET_MIC" acdb_id="65"/>
+        <device name="SND_DEVICE_IN_BT_SCO_MIC_NREC" acdb_id="122"/>
+        <device name="SND_DEVICE_IN_BT_SCO_MIC_WB_NREC" acdb_id="123"/>
+    </acdb_ids>
+    <backend_names>
+        <device name="SND_DEVICE_OUT_SPEAKER" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_REVERSE" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_SAFE" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_PROTECTED" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_VOICE_SPEAKER_HFP" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_HEADPHONES" backend="speaker-and-headphones" interface="QUAT_MI2S_RX-and-SLIMBUS_0_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_SAFE_AND_HEADPHONES" backend="speaker-and-headphones" interface="QUAT_MI2S_RX-and-SLIMBUS_0_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_LINE" backend="speaker-and-headphones" interface="QUAT_MI2S_RX-and-SLIMBUS_0_RX"/>
+        <device name="SND_DEVICE_OUT_VOICE_TTY_HCO_HANDSET" backend="speaker" interface="QUAT_MI2S_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_BT_SCO" backend="speaker-and-bt-sco" interface="QUAT_MI2S_RX-and-AUX_PCM_RX"/>
+        <device name="SND_DEVICE_OUT_SPEAKER_AND_BT_SCO_WB" backend="speaker-and-bt-sco-wb" interface="QUAT_MI2S_RX-and-AUX_PCM_RX"/>
+    </backend_names>
+    <config_params>
+        <param key="input_mic_max_count" value="3"/>
+        <param key="snd_card_name" value="msm8996-tasha"/>
+    </config_params>
+    <gain_db_to_level_mapping>
+        <gain_level_map db="-62.4" level="15"/>
+        <gain_level_map db="-42.4" level="14"/>
+        <gain_level_map db="-41.4" level="13"/>
+        <gain_level_map db="-40.4" level="12"/>
+        <gain_level_map db="-39.1" level="11"/>
+        <gain_level_map db="-28.9" level="10"/>
+        <gain_level_map db="-27.4" level="9"/>
+        <gain_level_map db="-25.5" level="8"/>
+        <gain_level_map db="-23" level="7"/>
+        <gain_level_map db="-20" level="6"/>
+        <gain_level_map db="-17" level="5"/>
+        <gain_level_map db="-14.5" level="4"/>
+        <gain_level_map db="-12" level="3"/>
+        <gain_level_map db="-8.7" level="2"/>
+        <gain_level_map db="0" level="1"/>
+    </gain_db_to_level_mapping>
+    <pcm_ids>
+       <usecase name="USECASE_AUDIO_RECORD_LOW_LATENCY" type="in" id="19" />
+       <usecase name="USECASE_AUDIO_PLAYBACK_ULL" type="out" id="19" />
+       <usecase name="USECASE_AUDIO_RECORD_MMAP" type="in" id="18" />
+       <usecase name="USECASE_AUDIO_PLAYBACK_MMAP" type="out" id="18" />
+       <usecase name="USECASE_INCALL_MUSIC_UPLINK" type="out" id="32" />
+    </pcm_ids>
+    <microphone_characteristics>
+        <microphone valid_mask="31" device_id="builtin_mic_1" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="bottom" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+            group="0" index_in_the_group="0" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="93"
+            frequencies="97.16 102.92 109.02 115.48 122.32 129.57 137.25 145.38 153.99 163.12 172.78 183.02 193.87 205.35 217.52 230.41 244.06 258.52 273.84 290.07 307.26 325.46 344.75 365.17 386.81 409.73 434.01 459.73 486.97 515.82 546.39 578.76 613.06 649.38 687.86 728.62 771.79 817.52 865.96 917.28 971.63 1029.20 1090.18 1154.78 1223.21 1295.69 1372.46 1453.78 1539.93 1631.17 1727.83 1830.21 1938.65 2053.53 2175.20 2304.09 2440.62 2585.23 2738.42 2900.68 3072.56 3254.62 3447.47 3651.74 3868.12 4097.32 4340.10 4597.27 4869.68 5158.22 5463.87 5787.62 6130.56 6493.82 6878.60 7286.18 7717.92 8175.23 8659.64 9172.76 9716.28 10292.01 10901.84 11547.82 12232.07 12956.87 13724.61 14537.84 15399.27 16311.73 17278.26 18302.06 19386.53"
+            responses="-0.80 -0.80 -1.00 -1.10 -0.80 -0.80 -0.70 -0.70 -0.70 -0.70 -0.60 -0.90 -1.10 -1.10 -1.20 -1.00 -1.30 -1.30 -1.40 -1.40 -1.20 -0.70 -0.10 0.80 1.20 0.50 -0.80 -2.00 -2.60 -2.70 -1.90 -0.40 0.70 0.60 0.20 -0.10 0.30 0.20 1.90 1.50 0.00 -0.60 -0.90 -0.10 -0.50 0.90 -0.20 1.00 1.30 1.30 2.90 1.90 1.40 3.10 1.10 -7.00 -0.20 1.00 2.10 -1.60 0.90 -1.70 1.40 0.80 -0.50 -0.40 0.50 1.20 0.40 -0.50 3.80 4.70 -2.20 -0.60 3.40 5.60 -2.50 3.30 6.30 8.80 6.30 11.20 15.20 16.80 19.40 22.30 24.30 18.00 18.00 18.60 17.30 15.20 15.70"
+            sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 -1.0 0.0" geometric_location="0.0485 0.0 0.0038" />
+        <microphone valid_mask="31" device_id="builtin_mic_2" type="AUDIO_DEVICE_IN_BACK_MIC" address="back" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+            group="0" index_in_the_group="1" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="93"
+            frequencies="97.16 102.92 109.02 115.48 122.32 129.57 137.25 145.38 153.99 163.12 172.78 183.02 193.87 205.35 217.52 230.41 244.06 258.52 273.84 290.07 307.26 325.46 344.75 365.17 386.81 409.73 434.01 459.73 486.97 515.82 546.39 578.76 613.06 649.38 687.86 728.62 771.79 817.52 865.96 917.28 971.63 1029.20 1090.18 1154.78 1223.21 1295.69 1372.46 1453.78 1539.93 1631.17 1727.83 1830.21 1938.65 2053.53 2175.20 2304.09 2440.62 2585.23 2738.42 2900.68 3072.56 3254.62 3447.47 3651.74 3868.12 4097.32 4340.10 4597.27 4869.68 5158.22 5463.87 5787.62 6130.56 6493.82 6878.60 7286.18 7717.92 8175.23 8659.64 9172.76 9716.28 10292.01 10901.84 11547.82 12232.07 12956.87 13724.61 14537.84 15399.27 16311.73 17278.26 18302.06 19386.53"
+            responses="-1.30 -1.30 -1.40 -1.50 -1.10 -1.10 -1.20 -1.30 -1.30 -1.30 -1.20 -1.50 -1.60 -1.40 -1.30 -0.90 -0.80 -0.60 -0.40 -0.40 -0.40 -0.60 -0.90 -1.50 -1.80 -1.80 -0.70 -0.20 -0.10 -0.60 -1.20 -1.40 -0.80 -0.90 -1.30 -1.30 -1.80 -1.30 -1.00 0.00 0.00 -0.30 -1.00 -0.60 0.10 0.10 1.10 2.20 1.90 0.80 2.20 2.60 3.00 2.50 1.70 5.40 5.60 6.40 5.00 3.50 6.00 6.40 7.70 8.50 7.60 4.30 7.10 7.10 7.00 9.60 6.60 6.40 10.00 8.10 6.90 9.30 6.80 9.30 6.40 9.70 9.90 9.70 12.00 10.90 13.10 12.60 13.20 13.50 12.00 9.90 11.70 13.90 15.90"
+            sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 0.0 -1.0" geometric_location="0.0347 0.135 0.0" />
+        <microphone valid_mask="31" device_id="builtin_mic_3" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="top" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+            group="0" index_in_the_group="2" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="93"
+            frequencies="97.16 102.92 109.02 115.48 122.32 129.57 137.25 145.38 153.99 163.12 172.78 183.02 193.87 205.35 217.52 230.41 244.06 258.52 273.84 290.07 307.26 325.46 344.75 365.17 386.81 409.73 434.01 459.73 486.97 515.82 546.39 578.76 613.06 649.38 687.86 728.62 771.79 817.52 865.96 917.28 971.63 1029.20 1090.18 1154.78 1223.21 1295.69 1372.46 1453.78 1539.93 1631.17 1727.83 1830.21 1938.65 2053.53 2175.20 2304.09 2440.62 2585.23 2738.42 2900.68 3072.56 3254.62 3447.47 3651.74 3868.12 4097.32 4340.10 4597.27 4869.68 5158.22 5463.87 5787.62 6130.56 6493.82 6878.60 7286.18 7717.92 8175.23 8659.64 9172.76 9716.28 10292.01 10901.84 11547.82 12232.07 12956.87 13724.61 14537.84 15399.27 16311.73 17278.26 18302.06 19386.53"
+            responses="0.50 0.50 0.50 0.50 0.40 0.30 0.70 0.60 0.60 0.60 0.50 0.50 0.60 0.30 0.10 0.20 0.20 0.60 0.70 0.90 1.10 1.20 1.30 1.30 1.30 0.90 0.10 -0.80 -0.10 0.90 1.60 1.70 1.60 0.90 0.50 0.20 0.20 0.50 0.40 -0.20 0.00 1.70 1.70 1.40 0.70 0.40 1.60 0.80 2.40 3.20 2.90 1.80 3.00 2.90 4.50 3.90 2.20 6.00 7.80 6.70 5.40 5.00 6.90 7.00 7.70 9.50 8.30 5.10 7.40 7.40 7.40 9.50 6.60 6.60 10.30 7.90 6.70 9.70 6.90 8.80 6.50 9.40 9.10 9.00 10.70 9.60 11.00 9.90 11.30 13.60 13.20 12.40 15.40"
+            sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 0.0 1.0" geometric_location="0.0314 0.1362 0.0073" />
+    </microphone_characteristics>
+    <!-- TODO: Fake channel mapping data, need to populate with actual data -->
+    <snd_devices>
+        <input_snd_device>
+            <input_snd_device_mic_mapping>
+                <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_MIC">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_AEC_NS">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_2"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_DMIC_TMUS">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_3"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                    <mic_info mic_device_id="builtin_mic_3"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                </snd_dev>
+                <snd_dev in_snd_device="SND_DEVICE_IN_THREE_MIC">
+                    <mic_info mic_device_id="builtin_mic_1"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_2"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                    <mic_info mic_device_id="builtin_mic_3"
+                        channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                </snd_dev>
+            </input_snd_device_mic_mapping>
+        </input_snd_device>
+    </snd_devices>
+
+</audio_platform_info>
+
diff --git a/audio_policy_configuration.xml b/audio_policy_configuration.xml
index a823de3..7766036 100644
--- a/audio_policy_configuration.xml
+++ b/audio_policy_configuration.xml
@@ -66,6 +66,12 @@
                     <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                              samplingRates="8000,16000,48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                 </mixPort>
+                <mixPort name="incall_music_uplink" role="source"
+                        flags="AUDIO_OUTPUT_FLAG_INCALL_MUSIC">
+                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
+                             samplingRates="8000,16000,48000"
+                             channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
+                </mixPort>
                 <mixPort name="primary input" role="sink">
                     <profile name="" format="AUDIO_FORMAT_PCM_8_24_BIT"
                              samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
@@ -136,7 +142,7 @@
                 <route type="mix" sink="BT SCO Car Kit"
                        sources="primary output,raw,deep_buffer"/>
                 <route type="mix" sink="Telephony Tx"
-                       sources="voice_tx"/>
+                       sources="voice_tx,incall_music_uplink"/>
                 <route type="mix" sink="primary input"
                        sources="Built-In Mic,Built-In Back Mic,Wired Headset Mic,BT SCO Headset Mic"/>
                 <route type="mix" sink="fast input"
@@ -158,6 +164,9 @@
         <!-- Remote Submix Audio HAL -->
         <xi:include href="r_submix_audio_policy_configuration.xml"/>
 
+        <!-- Hearing aid Audio HAL -->
+        <xi:include href="hearing_aid_audio_policy_configuration.xml"/>
+
     </modules>
 
     <!-- Volume section -->
diff --git a/audio_policy_volumes_drc.xml b/audio_policy_volumes_drc.xml
index 84fb350..044bcc6 100644
--- a/audio_policy_volumes_drc.xml
+++ b/audio_policy_volumes_drc.xml
@@ -96,9 +96,9 @@
     <volume stream="AUDIO_STREAM_MUSIC" deviceCategory="DEVICE_CATEGORY_EXT_MEDIA"
                                         ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_ALARM" deviceCategory="DEVICE_CATEGORY_HEADSET"
-                                        ref="DEFAULT_DEVICE_CATEGORY_HEADSET_VOLUME_CURVE"/>
+                                        ref="DEFAULT_NON_MUTABLE_HEADSET_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_ALARM" deviceCategory="DEVICE_CATEGORY_SPEAKER">
-        <point>1,-4500</point>
+        <point>0,-4500</point>
         <point>14,-4000</point>
         <point>28,-3000</point>
         <point>42,-2690</point>
@@ -108,9 +108,9 @@
         <point>100,-1000</point>
     </volume>
     <volume stream="AUDIO_STREAM_ALARM" deviceCategory="DEVICE_CATEGORY_EARPIECE"
-                                        ref="DEFAULT_DEVICE_CATEGORY_EARPIECE_VOLUME_CURVE"/>
+                                        ref="DEFAULT_NON_MUTABLE_EARPIECE_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_ALARM" deviceCategory="DEVICE_CATEGORY_EXT_MEDIA"
-                                        ref="DEFAULT_DEVICE_CATEGORY_EXT_MEDIA_VOLUME_CURVE"/>
+                                        ref="DEFAULT_NON_MUTABLE_EXT_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_NOTIFICATION" deviceCategory="DEVICE_CATEGORY_HEADSET"
                                                ref="DEFAULT_DEVICE_CATEGORY_HEADSET_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_NOTIFICATION" deviceCategory="DEVICE_CATEGORY_SPEAKER">
@@ -184,18 +184,18 @@
     <volume stream="AUDIO_STREAM_TTS" deviceCategory="DEVICE_CATEGORY_EXT_MEDIA"
                                       ref="SILENT_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_ACCESSIBILITY" deviceCategory="DEVICE_CATEGORY_HEADSET"
-                                                ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
+                                                ref="DEFAULT_NON_MUTABLE_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_ACCESSIBILITY" deviceCategory="DEVICE_CATEGORY_SPEAKER">
-        <point>1,-5900</point>
+        <point>0,-5900</point>
         <point>51,-3150</point>
         <point>93,-1000</point>
         <point>100,0</point>
     </volume>
 
     <volume stream="AUDIO_STREAM_ACCESSIBILITY" deviceCategory="DEVICE_CATEGORY_EARPIECE"
-                                                ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
+                                                ref="DEFAULT_NON_MUTABLE_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_ACCESSIBILITY" deviceCategory="DEVICE_CATEGORY_EXT_MEDIA"
-                                                ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
+                                                ref="DEFAULT_NON_MUTABLE_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_REROUTING" deviceCategory="DEVICE_CATEGORY_HEADSET"
                                             ref="FULL_SCALE_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_REROUTING" deviceCategory="DEVICE_CATEGORY_SPEAKER"
diff --git a/camera/QCamera2/Android.mk b/camera/QCamera2/Android.mk
index 672b60b..172b10b 100644
--- a/camera/QCamera2/Android.mk
+++ b/camera/QCamera2/Android.mk
@@ -7,7 +7,6 @@
 LOCAL_SRC_FILES := \
         util/QCameraBufferMaps.cpp \
         util/QCameraCmdThread.cpp \
-        util/QCameraDisplay.cpp \
         util/QCameraFlash.cpp \
         util/QCameraPerf.cpp \
         util/QCameraQueue.cpp \
@@ -101,11 +100,11 @@
         $(TARGET_OUT_HEADERS)/qcom/display
 LOCAL_C_INCLUDES += \
         hardware/qcom/display/msm8996/libqservice
-LOCAL_SHARED_LIBRARIES := liblog libhardware libutils libcutils libdl libsync libgui
+LOCAL_SHARED_LIBRARIES := liblog libhardware libutils libcutils libdl libsync
 LOCAL_SHARED_LIBRARIES += libmmcamera_interface libmmjpeg_interface libui libcamera_metadata
 LOCAL_SHARED_LIBRARIES += libqdMetaData libqservice libbinder
 LOCAL_SHARED_LIBRARIES += libcutils libdl
-LOCAL_HEADER_LIBRARIES := OmxCore_headers gralloc_headers
+LOCAL_HEADER_LIBRARIES := OmxCore_headers gralloc_headers media_plugin_headers
 LOCAL_SHARED_LIBRARIES += libhidlbase libhwbinder libutils android.hardware.power@1.1
 ifeq ($(TARGET_TS_MAKEUP),true)
 LOCAL_SHARED_LIBRARIES += libts_face_beautify_hal libts_detected_face_hal
diff --git a/camera/QCamera2/HAL/QCamera2HWI.h b/camera/QCamera2/HAL/QCamera2HWI.h
index 9ab198c..25a29e7 100644
--- a/camera/QCamera2/HAL/QCamera2HWI.h
+++ b/camera/QCamera2/HAL/QCamera2HWI.h
@@ -39,7 +39,9 @@
 #include "QCameraAllocator.h"
 #include "QCameraChannel.h"
 #include "QCameraCmdThread.h"
+#if 0 // Temporary removing the dependency on libgui
 #include "QCameraDisplay.h"
+#endif
 #include "QCameraMem.h"
 #include "QCameraParameters.h"
 #include "QCameraParametersIntf.h"
@@ -775,7 +777,9 @@
     uint32_t mSurfaceStridePadding;
 
     //QCamera Display Object
+#if 0 // Temporary removing the dependency on libgui
     QCameraDisplay mCameraDisplay;
+#endif
 
     bool m_bNeedRestart;
     Mutex mMapLock;
diff --git a/camera/QCamera2/HAL/QCamera2HWICallbacks.cpp b/camera/QCamera2/HAL/QCamera2HWICallbacks.cpp
index dc24364..d641710 100644
--- a/camera/QCamera2/HAL/QCamera2HWICallbacks.cpp
+++ b/camera/QCamera2/HAL/QCamera2HWICallbacks.cpp
@@ -729,7 +729,9 @@
 
     frameTime = nsecs_t(frame->ts.tv_sec) * 1000000000LL + frame->ts.tv_nsec;
     // Calculate the future presentation time stamp for displaying frames at regular interval
+#if 0 // Temporary removing the dependency on libgui
     mPreviewTimestamp = pme->mCameraDisplay.computePresentationTimeStamp(frameTime);
+#endif
     stream->mStreamTimestamp = frameTime;
     memory = (QCameraGrallocMemory *)super_frame->bufs[0]->mem_info;
 
diff --git a/camera/QCamera2/HAL3/QCamera3HWI.cpp b/camera/QCamera2/HAL3/QCamera3HWI.cpp
index c8b5d45..2f6fcf3 100644
--- a/camera/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/camera/QCamera2/HAL3/QCamera3HWI.cpp
@@ -363,7 +363,7 @@
       mMetaFrameCount(0U),
       mUpdateDebugLevel(false),
       mCallbacks(callbacks),
-      mCaptureIntent(0),
+      mCaptureIntent(ANDROID_CONTROL_CAPTURE_INTENT_PREVIEW),
       mCacMode(0),
       mHybridAeEnable(0),
       /* DevCamDebug metadata internal m control*/
@@ -392,7 +392,7 @@
     m_perfLock.lock_init();
     mCommon.init(gCamCapability[cameraId]);
     mCameraDevice.common.tag = HARDWARE_DEVICE_TAG;
-    mCameraDevice.common.version = CAMERA_DEVICE_API_VERSION_3_4;
+    mCameraDevice.common.version = CAMERA_DEVICE_API_VERSION_3_5;
     mCameraDevice.common.close = close_camera_device;
     mCameraDevice.ops = &mCameraOps;
     mCameraDevice.priv = this;
@@ -2175,6 +2175,7 @@
                         if (!m_bIsVideo && (streamList->operation_mode ==
                                 CAMERA3_STREAM_CONFIGURATION_CONSTRAINED_HIGH_SPEED_MODE)) {
                             mDummyBatchStream = *newStream;
+                            mDummyBatchStream.usage = GRALLOC_USAGE_HW_VIDEO_ENCODER;
                         }
                         channel = new QCamera3RegularChannel(mCameraHandle->camera_handle,
                                 mChannelHandle, mCameraHandle->ops, captureResultCb,
@@ -2471,8 +2472,261 @@
     // Update state
     mState = CONFIGURED;
 
+    if (streamList->session_parameters != nullptr) {
+        CameraMetadata meta;
+        meta = streamList->session_parameters;
+
+        // send an unconfigure to the backend so that the isp
+        // resources are deallocated
+        if (!mFirstConfiguration) {
+            cam_stream_size_info_t stream_config_info;
+            int32_t hal_version = CAM_HAL_V3;
+            memset(&stream_config_info, 0, sizeof(cam_stream_size_info_t));
+            stream_config_info.buffer_info.min_buffers =
+                    MIN_INFLIGHT_REQUESTS;
+            stream_config_info.buffer_info.max_buffers =
+                    m_bIs4KVideo ? 0 : MAX_INFLIGHT_REQUESTS;
+            clear_metadata_buffer(mParameters);
+            ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
+                    CAM_INTF_PARM_HAL_VERSION, hal_version);
+            ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
+                    CAM_INTF_META_STREAM_INFO, stream_config_info);
+            rc = mCameraHandle->ops->set_parms(mCameraHandle->camera_handle,
+                    mParameters);
+            if (rc < 0) {
+                LOGE("set_parms for unconfigure failed");
+                pthread_mutex_unlock(&mMutex);
+                return rc;
+            }
+        }
+        /* get eis information for stream configuration */
+        cam_is_type_t is_type;
+        char is_type_value[PROPERTY_VALUE_MAX];
+        property_get("persist.camera.is_type", is_type_value, "0");
+        is_type = static_cast<cam_is_type_t>(atoi(is_type_value));
+
+        int32_t hal_version = CAM_HAL_V3;
+        clear_metadata_buffer(mParameters);
+        ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_PARM_HAL_VERSION, hal_version);
+        ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_META_CAPTURE_INTENT, mCaptureIntent);
+
+        uint8_t fwkVideoStabMode=0;
+        if (meta.exists(ANDROID_CONTROL_VIDEO_STABILIZATION_MODE)) {
+            fwkVideoStabMode = meta.find(ANDROID_CONTROL_VIDEO_STABILIZATION_MODE).data.u8[0];
+        }
+        //If EIS is enabled, turn it on for video
+        bool setEis = m_bEisEnable && (m_bIsVideo || fwkVideoStabMode) && m_bEisSupportedSize &&
+                !meta.exists(QCAMERA3_USE_AV_TIMER);
+        int32_t vsMode;
+        vsMode = (setEis)? DIS_ENABLE: DIS_DISABLE;
+        if (ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_PARM_DIS_ENABLE, vsMode)) {
+            rc = BAD_VALUE;
+        }
+
+        //IS type will be 0 unless EIS is supported. If EIS is supported
+        //it could either be 1 or 4 depending on the stream and video size
+        if (setEis) {
+            if (!m_bEisSupportedSize) {
+                is_type = IS_TYPE_DIS;
+            } else {
+                is_type = IS_TYPE_EIS_2_0;
+            }
+            mStreamConfigInfo.is_type = is_type;
+        } else {
+            mStreamConfigInfo.is_type = IS_TYPE_NONE;
+        }
+
+        ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
+                CAM_INTF_META_STREAM_INFO, mStreamConfigInfo);
+        int32_t tintless_value = 1;
+        ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
+                CAM_INTF_PARM_TINTLESS, tintless_value);
+        //Disable CDS for HFR mode or if DIS/EIS is on.
+        //CDS is a session parameter in the backend/ISP, so need to be set/reset
+        //after every configure_stream
+        if((CAMERA3_STREAM_CONFIGURATION_CONSTRAINED_HIGH_SPEED_MODE == mOpMode) ||
+                (m_bIsVideo)) {
+            int32_t cds = CAM_CDS_MODE_OFF;
+            if (ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
+                    CAM_INTF_PARM_CDS_MODE, cds))
+                LOGE("Failed to disable CDS for HFR mode");
+
+        }
+
+        if (m_debug_avtimer || meta.exists(QCAMERA3_USE_AV_TIMER)) {
+            uint8_t* use_av_timer = NULL;
+
+            if (m_debug_avtimer){
+                use_av_timer = &m_debug_avtimer;
+            }
+            else{
+                use_av_timer =
+                    meta.find(QCAMERA3_USE_AV_TIMER).data.u8;
+            }
+
+            if (ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_META_USE_AV_TIMER, *use_av_timer)) {
+                rc = BAD_VALUE;
+            }
+        }
+
+        setMobicat();
+
+        /* Set fps and hfr mode while sending meta stream info so that sensor
+         * can configure appropriate streaming mode */
+        mHFRVideoFps = DEFAULT_VIDEO_FPS;
+        mMinInFlightRequests = MIN_INFLIGHT_REQUESTS;
+        mMaxInFlightRequests = MAX_INFLIGHT_REQUESTS;
+        if (meta.exists(ANDROID_CONTROL_AE_TARGET_FPS_RANGE)) {
+            rc = setHalFpsRange(meta, mParameters);
+            if (rc == NO_ERROR) {
+                int32_t max_fps =
+                    (int32_t) meta.find(ANDROID_CONTROL_AE_TARGET_FPS_RANGE).data.i32[1];
+                if (mBatchSize) {
+                    /* For HFR, more buffers are dequeued upfront to improve the performance */
+                    mMinInFlightRequests = MIN_INFLIGHT_HFR_REQUESTS;
+                    mMaxInFlightRequests = MAX_INFLIGHT_HFR_REQUESTS;
+                } else if (max_fps == 60) {
+                    /* for 60 fps usecas increase inflight requests */
+                    mMinInFlightRequests = MIN_INFLIGHT_60FPS_REQUESTS;
+                    mMaxInFlightRequests = MAX_INFLIGHT_60FPS_REQUESTS;
+                } else if (mCaptureIntent == ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_RECORD) {
+                    /* for non 60 fps video use cases, set min = max inflight requests to
+                    avoid frame drops due to degraded system performance */
+                    mMinInFlightRequests = MAX_INFLIGHT_REQUESTS;
+                }
+            }
+            else {
+                LOGE("setHalFpsRange failed");
+            }
+        }
+        memset(&mBatchedStreamsArray, 0, sizeof(cam_stream_ID_t));
+
+
+        //TODO: validate the arguments, HSV scenemode should have only the
+        //advertised fps ranges
+
+        /*set the capture intent, hal version, tintless, stream info,
+         *and disenable parameters to the backend*/
+        LOGD("set_parms META_STREAM_INFO " );
+        for (uint32_t i = 0; i < mStreamConfigInfo.num_streams; i++) {
+            LOGI("STREAM INFO : type %d, wxh: %d x %d, pp_mask: 0x%x "
+                    "Format:%d",
+                    mStreamConfigInfo.type[i],
+                    mStreamConfigInfo.stream_sizes[i].width,
+                    mStreamConfigInfo.stream_sizes[i].height,
+                    mStreamConfigInfo.postprocess_mask[i],
+                    mStreamConfigInfo.format[i]);
+        }
+
+        rc = mCameraHandle->ops->set_parms(mCameraHandle->camera_handle,
+                    mParameters);
+        if (rc < 0) {
+            LOGE("set_parms failed for hal version, stream info");
+        }
+
+        cam_dimension_t sensor_dim;
+        memset(&sensor_dim, 0, sizeof(sensor_dim));
+        rc = getSensorOutputSize(sensor_dim);
+        if (rc != NO_ERROR) {
+            LOGE("Failed to get sensor output size");
+            pthread_mutex_unlock(&mMutex);
+            goto error_exit;
+        }
+
+        mCropRegionMapper.update(gCamCapability[mCameraId]->active_array_size.width,
+                gCamCapability[mCameraId]->active_array_size.height,
+                sensor_dim.width, sensor_dim.height);
+
+        /* Set batchmode before initializing channel. Since registerBuffer
+         * internally initializes some of the channels, better set batchmode
+         * even before first register buffer */
+        for (List<stream_info_t *>::iterator it = mStreamInfo.begin();
+            it != mStreamInfo.end(); it++) {
+            QCamera3Channel *channel = (QCamera3Channel *)(*it)->stream->priv;
+            if (((1U << CAM_STREAM_TYPE_VIDEO) == channel->getStreamTypeMask())
+                    && mBatchSize) {
+                rc = channel->setBatchSize(mBatchSize);
+                //Disable per frame map unmap for HFR/batchmode case
+                rc |= channel->setPerFrameMapUnmap(false);
+                if (NO_ERROR != rc) {
+                    LOGE("Channel init failed %d", rc);
+                    pthread_mutex_unlock(&mMutex);
+                    goto error_exit;
+                }
+            }
+        }
+
+        //First initialize all streams
+        for (List<stream_info_t *>::iterator it = mStreamInfo.begin();
+            it != mStreamInfo.end(); it++) {
+            QCamera3Channel *channel = (QCamera3Channel *)(*it)->stream->priv;
+            if ((((1U << CAM_STREAM_TYPE_VIDEO) == channel->getStreamTypeMask()) ||
+               ((1U << CAM_STREAM_TYPE_PREVIEW) == channel->getStreamTypeMask())) &&
+               setEis)
+                rc = channel->initialize(is_type);
+            else {
+                rc = channel->initialize(IS_TYPE_NONE);
+            }
+            if (NO_ERROR != rc) {
+                LOGE("Channel initialization failed %d", rc);
+                pthread_mutex_unlock(&mMutex);
+                goto error_exit;
+            }
+        }
+
+        if (mRawDumpChannel) {
+            rc = mRawDumpChannel->initialize(IS_TYPE_NONE);
+            if (rc != NO_ERROR) {
+                LOGE("Error: Raw Dump Channel init failed");
+                pthread_mutex_unlock(&mMutex);
+                goto error_exit;
+            }
+        }
+        if (mSupportChannel) {
+            rc = mSupportChannel->initialize(IS_TYPE_NONE);
+            if (rc < 0) {
+                LOGE("Support channel initialization failed");
+                pthread_mutex_unlock(&mMutex);
+                goto error_exit;
+            }
+        }
+        if (mAnalysisChannel) {
+            rc = mAnalysisChannel->initialize(IS_TYPE_NONE);
+            if (rc < 0) {
+                LOGE("Analysis channel initialization failed");
+                pthread_mutex_unlock(&mMutex);
+                goto error_exit;
+            }
+        }
+        if (mDummyBatchChannel) {
+            rc = mDummyBatchChannel->setBatchSize(mBatchSize);
+            if (rc < 0) {
+                LOGE("mDummyBatchChannel setBatchSize failed");
+                pthread_mutex_unlock(&mMutex);
+                goto error_exit;
+            }
+            rc = mDummyBatchChannel->initialize(is_type);
+            if (rc < 0) {
+                LOGE("mDummyBatchChannel initialization failed");
+                pthread_mutex_unlock(&mMutex);
+                goto error_exit;
+            }
+        }
+
+        // Set bundle info
+        rc = setBundleInfo();
+        if (rc < 0) {
+            LOGE("setBundleInfo failed %d", rc);
+            pthread_mutex_unlock(&mMutex);
+            goto error_exit;
+        }
+
+    }
+
     pthread_mutex_unlock(&mMutex);
 
+error_exit:
+
     return rc;
 }
 
@@ -3673,264 +3927,7 @@
     // For first capture request, send capture intent, and
     // stream on all streams
     if (mState == CONFIGURED) {
-        // send an unconfigure to the backend so that the isp
-        // resources are deallocated
-        if (!mFirstConfiguration) {
-            cam_stream_size_info_t stream_config_info;
-            int32_t hal_version = CAM_HAL_V3;
-            memset(&stream_config_info, 0, sizeof(cam_stream_size_info_t));
-            stream_config_info.buffer_info.min_buffers =
-                    MIN_INFLIGHT_REQUESTS;
-            stream_config_info.buffer_info.max_buffers =
-                    m_bIs4KVideo ? 0 : MAX_INFLIGHT_REQUESTS;
-            clear_metadata_buffer(mParameters);
-            ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
-                    CAM_INTF_PARM_HAL_VERSION, hal_version);
-            ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
-                    CAM_INTF_META_STREAM_INFO, stream_config_info);
-            rc = mCameraHandle->ops->set_parms(mCameraHandle->camera_handle,
-                    mParameters);
-            if (rc < 0) {
-                LOGE("set_parms for unconfigure failed");
-                pthread_mutex_unlock(&mMutex);
-                return rc;
-            }
-        }
         m_perfLock.lock_acq();
-        /* get eis information for stream configuration */
-        cam_is_type_t is_type;
-        char is_type_value[PROPERTY_VALUE_MAX];
-        property_get("persist.camera.is_type", is_type_value, "0");
-        is_type = static_cast<cam_is_type_t>(atoi(is_type_value));
-
-        if (meta.exists(ANDROID_CONTROL_CAPTURE_INTENT)) {
-            int32_t hal_version = CAM_HAL_V3;
-            uint8_t captureIntent =
-                meta.find(ANDROID_CONTROL_CAPTURE_INTENT).data.u8[0];
-            mCaptureIntent = captureIntent;
-            clear_metadata_buffer(mParameters);
-            ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_PARM_HAL_VERSION, hal_version);
-            ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_META_CAPTURE_INTENT, captureIntent);
-        }
-
-        uint8_t fwkVideoStabMode=0;
-        if (meta.exists(ANDROID_CONTROL_VIDEO_STABILIZATION_MODE)) {
-            fwkVideoStabMode = meta.find(ANDROID_CONTROL_VIDEO_STABILIZATION_MODE).data.u8[0];
-        }
-        //If EIS is enabled, turn it on for video
-        bool setEis = m_bEisEnable && (m_bIsVideo || fwkVideoStabMode) && m_bEisSupportedSize &&
-                !meta.exists(QCAMERA3_USE_AV_TIMER);
-        int32_t vsMode;
-        vsMode = (setEis)? DIS_ENABLE: DIS_DISABLE;
-        if (ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_PARM_DIS_ENABLE, vsMode)) {
-            rc = BAD_VALUE;
-        }
-
-        //IS type will be 0 unless EIS is supported. If EIS is supported
-        //it could either be 1 or 4 depending on the stream and video size
-        if (setEis) {
-            if (!m_bEisSupportedSize) {
-                is_type = IS_TYPE_DIS;
-            } else {
-                is_type = IS_TYPE_EIS_2_0;
-            }
-            mStreamConfigInfo.is_type = is_type;
-        } else {
-            mStreamConfigInfo.is_type = IS_TYPE_NONE;
-        }
-
-        ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
-                CAM_INTF_META_STREAM_INFO, mStreamConfigInfo);
-        int32_t tintless_value = 1;
-        ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
-                CAM_INTF_PARM_TINTLESS, tintless_value);
-        //Disable CDS for HFR mode or if DIS/EIS is on.
-        //CDS is a session parameter in the backend/ISP, so need to be set/reset
-        //after every configure_stream
-        if((CAMERA3_STREAM_CONFIGURATION_CONSTRAINED_HIGH_SPEED_MODE == mOpMode) ||
-                (m_bIsVideo)) {
-            int32_t cds = CAM_CDS_MODE_OFF;
-            if (ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters,
-                    CAM_INTF_PARM_CDS_MODE, cds))
-                LOGE("Failed to disable CDS for HFR mode");
-
-        }
-
-        if (m_debug_avtimer || meta.exists(QCAMERA3_USE_AV_TIMER)) {
-            uint8_t* use_av_timer = NULL;
-
-            if (m_debug_avtimer){
-                use_av_timer = &m_debug_avtimer;
-            }
-            else{
-                use_av_timer =
-                    meta.find(QCAMERA3_USE_AV_TIMER).data.u8;
-            }
-
-            if (ADD_SET_PARAM_ENTRY_TO_BATCH(mParameters, CAM_INTF_META_USE_AV_TIMER, *use_av_timer)) {
-                rc = BAD_VALUE;
-            }
-        }
-
-        setMobicat();
-
-        /* Set fps and hfr mode while sending meta stream info so that sensor
-         * can configure appropriate streaming mode */
-        mHFRVideoFps = DEFAULT_VIDEO_FPS;
-        mMinInFlightRequests = MIN_INFLIGHT_REQUESTS;
-        mMaxInFlightRequests = MAX_INFLIGHT_REQUESTS;
-        if (meta.exists(ANDROID_CONTROL_AE_TARGET_FPS_RANGE)) {
-            rc = setHalFpsRange(meta, mParameters);
-            if (rc == NO_ERROR) {
-                int32_t max_fps =
-                    (int32_t) meta.find(ANDROID_CONTROL_AE_TARGET_FPS_RANGE).data.i32[1];
-                if (mBatchSize) {
-                    /* For HFR, more buffers are dequeued upfront to improve the performance */
-                    mMinInFlightRequests = MIN_INFLIGHT_HFR_REQUESTS;
-                    mMaxInFlightRequests = MAX_INFLIGHT_HFR_REQUESTS;
-                } else if (max_fps == 60) {
-                    /* for 60 fps usecas increase inflight requests */
-                    mMinInFlightRequests = MIN_INFLIGHT_60FPS_REQUESTS;
-                    mMaxInFlightRequests = MAX_INFLIGHT_60FPS_REQUESTS;
-                } else if (mCaptureIntent == ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_RECORD) {
-                    /* for non 60 fps video use cases, set min = max inflight requests to
-                    avoid frame drops due to degraded system performance */
-                    mMinInFlightRequests = MAX_INFLIGHT_REQUESTS;
-                }
-            }
-            else {
-                LOGE("setHalFpsRange failed");
-            }
-        }
-        if (meta.exists(ANDROID_CONTROL_MODE)) {
-            uint8_t metaMode = meta.find(ANDROID_CONTROL_MODE).data.u8[0];
-            rc = extractSceneMode(meta, metaMode, mParameters);
-            if (rc != NO_ERROR) {
-                LOGE("extractSceneMode failed");
-            }
-        }
-        memset(&mBatchedStreamsArray, 0, sizeof(cam_stream_ID_t));
-
-
-        //TODO: validate the arguments, HSV scenemode should have only the
-        //advertised fps ranges
-
-        /*set the capture intent, hal version, tintless, stream info,
-         *and disenable parameters to the backend*/
-        LOGD("set_parms META_STREAM_INFO " );
-        for (uint32_t i = 0; i < mStreamConfigInfo.num_streams; i++) {
-            LOGI("STREAM INFO : type %d, wxh: %d x %d, pp_mask: 0x%x "
-                    "Format:%d",
-                    mStreamConfigInfo.type[i],
-                    mStreamConfigInfo.stream_sizes[i].width,
-                    mStreamConfigInfo.stream_sizes[i].height,
-                    mStreamConfigInfo.postprocess_mask[i],
-                    mStreamConfigInfo.format[i]);
-        }
-
-        rc = mCameraHandle->ops->set_parms(mCameraHandle->camera_handle,
-                    mParameters);
-        if (rc < 0) {
-            LOGE("set_parms failed for hal version, stream info");
-        }
-
-        cam_dimension_t sensor_dim;
-        memset(&sensor_dim, 0, sizeof(sensor_dim));
-        rc = getSensorOutputSize(sensor_dim);
-        if (rc != NO_ERROR) {
-            LOGE("Failed to get sensor output size");
-            pthread_mutex_unlock(&mMutex);
-            goto error_exit;
-        }
-
-        mCropRegionMapper.update(gCamCapability[mCameraId]->active_array_size.width,
-                gCamCapability[mCameraId]->active_array_size.height,
-                sensor_dim.width, sensor_dim.height);
-
-        /* Set batchmode before initializing channel. Since registerBuffer
-         * internally initializes some of the channels, better set batchmode
-         * even before first register buffer */
-        for (List<stream_info_t *>::iterator it = mStreamInfo.begin();
-            it != mStreamInfo.end(); it++) {
-            QCamera3Channel *channel = (QCamera3Channel *)(*it)->stream->priv;
-            if (((1U << CAM_STREAM_TYPE_VIDEO) == channel->getStreamTypeMask())
-                    && mBatchSize) {
-                rc = channel->setBatchSize(mBatchSize);
-                //Disable per frame map unmap for HFR/batchmode case
-                rc |= channel->setPerFrameMapUnmap(false);
-                if (NO_ERROR != rc) {
-                    LOGE("Channel init failed %d", rc);
-                    pthread_mutex_unlock(&mMutex);
-                    goto error_exit;
-                }
-            }
-        }
-
-        //First initialize all streams
-        for (List<stream_info_t *>::iterator it = mStreamInfo.begin();
-            it != mStreamInfo.end(); it++) {
-            QCamera3Channel *channel = (QCamera3Channel *)(*it)->stream->priv;
-            if ((((1U << CAM_STREAM_TYPE_VIDEO) == channel->getStreamTypeMask()) ||
-               ((1U << CAM_STREAM_TYPE_PREVIEW) == channel->getStreamTypeMask())) &&
-               setEis)
-                rc = channel->initialize(is_type);
-            else {
-                rc = channel->initialize(IS_TYPE_NONE);
-            }
-            if (NO_ERROR != rc) {
-                LOGE("Channel initialization failed %d", rc);
-                pthread_mutex_unlock(&mMutex);
-                goto error_exit;
-            }
-        }
-
-        if (mRawDumpChannel) {
-            rc = mRawDumpChannel->initialize(IS_TYPE_NONE);
-            if (rc != NO_ERROR) {
-                LOGE("Error: Raw Dump Channel init failed");
-                pthread_mutex_unlock(&mMutex);
-                goto error_exit;
-            }
-        }
-        if (mSupportChannel) {
-            rc = mSupportChannel->initialize(IS_TYPE_NONE);
-            if (rc < 0) {
-                LOGE("Support channel initialization failed");
-                pthread_mutex_unlock(&mMutex);
-                goto error_exit;
-            }
-        }
-        if (mAnalysisChannel) {
-            rc = mAnalysisChannel->initialize(IS_TYPE_NONE);
-            if (rc < 0) {
-                LOGE("Analysis channel initialization failed");
-                pthread_mutex_unlock(&mMutex);
-                goto error_exit;
-            }
-        }
-        if (mDummyBatchChannel) {
-            rc = mDummyBatchChannel->setBatchSize(mBatchSize);
-            if (rc < 0) {
-                LOGE("mDummyBatchChannel setBatchSize failed");
-                pthread_mutex_unlock(&mMutex);
-                goto error_exit;
-            }
-            rc = mDummyBatchChannel->initialize(is_type);
-            if (rc < 0) {
-                LOGE("mDummyBatchChannel initialization failed");
-                pthread_mutex_unlock(&mMutex);
-                goto error_exit;
-            }
-        }
-
-        // Set bundle info
-        rc = setBundleInfo();
-        if (rc < 0) {
-            LOGE("setBundleInfo failed %d", rc);
-            pthread_mutex_unlock(&mMutex);
-            goto error_exit;
-        }
-
         //update settings from app here
         if (meta.exists(QCAMERA3_DUALCAM_LINK_ENABLE)) {
             mIsDeviceLinked = meta.find(QCAMERA3_DUALCAM_LINK_ENABLE).data.u8[0];
@@ -5994,10 +5991,6 @@
          camMetadata.update(ANDROID_CONTROL_MODE, &fwk_mode, 1);
     }
 
-    /* Constant metadata values to be update*/
-    uint8_t hotPixelModeFast = ANDROID_HOT_PIXEL_MODE_FAST;
-    camMetadata.update(ANDROID_HOT_PIXEL_MODE, &hotPixelModeFast, 1);
-
     uint8_t hotPixelMapMode = ANDROID_STATISTICS_HOT_PIXEL_MAP_MODE_OFF;
     camMetadata.update(ANDROID_STATISTICS_HOT_PIXEL_MAP_MODE, &hotPixelMapMode, 1);
 
@@ -6155,6 +6148,7 @@
     // AF scene change
     IF_META_AVAILABLE(uint8_t, afSceneChange, CAM_INTF_META_AF_SCENE_CHANGE, metadata) {
         camMetadata.update(NEXUS_EXPERIMENTAL_2016_AF_SCENE_CHANGE, afSceneChange, 1);
+        camMetadata.update(ANDROID_CONTROL_AF_SCENE_CHANGE, afSceneChange, 1);
     }
 
     resultMetadata = camMetadata.release();
@@ -7417,11 +7411,6 @@
 
     staticInfo.update(ANDROID_SCALER_AVAILABLE_STREAM_CONFIGURATIONS,
                       available_stream_configs.array(), available_stream_configs.size());
-    static const uint8_t hotpixelMode = ANDROID_HOT_PIXEL_MODE_FAST;
-    staticInfo.update(ANDROID_HOT_PIXEL_MODE, &hotpixelMode, 1);
-
-    static const uint8_t hotPixelMapMode = ANDROID_STATISTICS_HOT_PIXEL_MAP_MODE_OFF;
-    staticInfo.update(ANDROID_STATISTICS_HOT_PIXEL_MAP_MODE, &hotPixelMapMode, 1);
 
     /* android.scaler.availableMinFrameDurations */
     Vector<int64_t> available_min_durations;
@@ -7916,6 +7905,12 @@
             (void *)gCamCapability[cameraId]->calibration_transform2,
             CAL_TRANSFORM_COLS * CAL_TRANSFORM_ROWS);
 
+    int32_t session_keys[] = {ANDROID_CONTROL_VIDEO_STABILIZATION_MODE, QCAMERA3_USE_AV_TIMER,
+        ANDROID_CONTROL_AE_TARGET_FPS_RANGE};
+
+    staticInfo.update(ANDROID_REQUEST_AVAILABLE_SESSION_KEYS, session_keys,
+            sizeof(session_keys) / sizeof(session_keys[0]));
+
     int32_t request_keys_basic[] = {ANDROID_COLOR_CORRECTION_MODE,
        ANDROID_COLOR_CORRECTION_TRANSFORM, ANDROID_COLOR_CORRECTION_GAINS,
        ANDROID_COLOR_CORRECTION_ABERRATION_MODE,
@@ -7971,7 +7966,7 @@
     int32_t result_keys_basic[] = {ANDROID_COLOR_CORRECTION_TRANSFORM,
        ANDROID_COLOR_CORRECTION_GAINS, ANDROID_CONTROL_AE_MODE, ANDROID_CONTROL_AE_REGIONS,
        ANDROID_CONTROL_AE_STATE, ANDROID_CONTROL_AF_MODE,
-       ANDROID_CONTROL_AF_STATE, ANDROID_CONTROL_AWB_MODE,
+       ANDROID_CONTROL_AF_STATE, ANDROID_CONTROL_AF_SCENE_CHANGE, ANDROID_CONTROL_AWB_MODE,
        ANDROID_CONTROL_AWB_STATE, ANDROID_CONTROL_MODE, ANDROID_EDGE_MODE,
        ANDROID_FLASH_FIRING_POWER, ANDROID_FLASH_FIRING_TIME, ANDROID_FLASH_MODE,
        ANDROID_FLASH_STATE, ANDROID_JPEG_GPS_COORDINATES, ANDROID_JPEG_GPS_PROCESSING_METHOD,
@@ -8510,7 +8505,7 @@
 
 
     info->orientation = (int)gCamCapability[cameraId]->sensor_mount_angle;
-    info->device_version = CAMERA_DEVICE_API_VERSION_3_4;
+    info->device_version = CAMERA_DEVICE_API_VERSION_3_5;
     info->static_camera_characteristics = gStaticMetadata[cameraId];
 
     //For now assume both cameras can operate independently.
@@ -8576,27 +8571,12 @@
     property_get("persist.camera.ois.video", videoOisProp, "1");
     uint8_t forceVideoOis = (uint8_t)atoi(videoOisProp);
 
-    // EIS enable/disable
-    char eis_prop[PROPERTY_VALUE_MAX];
-    memset(eis_prop, 0, sizeof(eis_prop));
-    property_get("persist.camera.eis.enable", eis_prop, "0");
-    const uint8_t eis_prop_set = (uint8_t)atoi(eis_prop);
-
     // Hybrid AE enable/disable
     char hybrid_ae_prop[PROPERTY_VALUE_MAX];
     memset(hybrid_ae_prop, 0, sizeof(hybrid_ae_prop));
     property_get("persist.camera.hybrid_ae.enable", hybrid_ae_prop, "0");
     const uint8_t hybrid_ae = (uint8_t)atoi(hybrid_ae_prop);
 
-    const bool facingBack = gCamCapability[mCameraId]->position == CAM_POSITION_BACK;
-    // This is a bit hacky. EIS is enabled only when the above setprop
-    // is set to non-zero value and on back camera (for 2015 Nexus).
-    // Ideally, we should rely on m_bEisEnable, but we cannot guarantee
-    // configureStream is called before this function. In other words,
-    // we cannot guarantee the app will call configureStream before
-    // calling createDefaultRequest.
-    const bool eisEnabled = facingBack && eis_prop_set;
-
     uint8_t controlIntent = 0;
     uint8_t focusMode;
     uint8_t vsMode;
@@ -8604,6 +8584,8 @@
     uint8_t cacMode;
     uint8_t edge_mode;
     uint8_t noise_red_mode;
+    uint8_t shading_mode;
+    uint8_t hot_pixel_mode;
     uint8_t tonemap_mode;
     bool highQualityModeEntryAvailable = FALSE;
     bool fastModeEntryAvailable = FALSE;
@@ -8619,6 +8601,8 @@
         cacMode = ANDROID_COLOR_CORRECTION_ABERRATION_MODE_FAST;
         edge_mode = ANDROID_EDGE_MODE_FAST;
         noise_red_mode = ANDROID_NOISE_REDUCTION_MODE_FAST;
+        shading_mode = ANDROID_SHADING_MODE_FAST;
+        hot_pixel_mode = ANDROID_HOT_PIXEL_MODE_FAST;
         tonemap_mode = ANDROID_TONEMAP_MODE_FAST;
         break;
       case CAMERA3_TEMPLATE_STILL_CAPTURE:
@@ -8627,6 +8611,8 @@
         optStabMode = ANDROID_LENS_OPTICAL_STABILIZATION_MODE_ON;
         edge_mode = ANDROID_EDGE_MODE_HIGH_QUALITY;
         noise_red_mode = ANDROID_NOISE_REDUCTION_MODE_HIGH_QUALITY;
+        shading_mode = ANDROID_SHADING_MODE_HIGH_QUALITY;
+        hot_pixel_mode = ANDROID_HOT_PIXEL_MODE_HIGH_QUALITY;
         tonemap_mode = ANDROID_TONEMAP_MODE_HIGH_QUALITY;
         cacMode = ANDROID_COLOR_CORRECTION_ABERRATION_MODE_OFF;
         // Order of priority for default CAC is HIGH Quality -> FAST -> OFF
@@ -8652,12 +8638,11 @@
         controlIntent = ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_RECORD;
         focusMode = ANDROID_CONTROL_AF_MODE_CONTINUOUS_VIDEO;
         optStabMode = ANDROID_LENS_OPTICAL_STABILIZATION_MODE_OFF;
-        if (eisEnabled) {
-            vsMode = ANDROID_CONTROL_VIDEO_STABILIZATION_MODE_ON;
-        }
         cacMode = ANDROID_COLOR_CORRECTION_ABERRATION_MODE_FAST;
         edge_mode = ANDROID_EDGE_MODE_FAST;
         noise_red_mode = ANDROID_NOISE_REDUCTION_MODE_FAST;
+        shading_mode = ANDROID_SHADING_MODE_FAST;
+        hot_pixel_mode = ANDROID_HOT_PIXEL_MODE_FAST;
         tonemap_mode = ANDROID_TONEMAP_MODE_FAST;
         if (forceVideoOis)
             optStabMode = ANDROID_LENS_OPTICAL_STABILIZATION_MODE_ON;
@@ -8666,12 +8651,11 @@
         controlIntent = ANDROID_CONTROL_CAPTURE_INTENT_VIDEO_SNAPSHOT;
         focusMode = ANDROID_CONTROL_AF_MODE_CONTINUOUS_VIDEO;
         optStabMode = ANDROID_LENS_OPTICAL_STABILIZATION_MODE_OFF;
-        if (eisEnabled) {
-            vsMode = ANDROID_CONTROL_VIDEO_STABILIZATION_MODE_ON;
-        }
         cacMode = ANDROID_COLOR_CORRECTION_ABERRATION_MODE_FAST;
         edge_mode = ANDROID_EDGE_MODE_FAST;
         noise_red_mode = ANDROID_NOISE_REDUCTION_MODE_FAST;
+        shading_mode = ANDROID_SHADING_MODE_FAST;
+        hot_pixel_mode = ANDROID_HOT_PIXEL_MODE_FAST;
         tonemap_mode = ANDROID_TONEMAP_MODE_FAST;
         if (forceVideoOis)
             optStabMode = ANDROID_LENS_OPTICAL_STABILIZATION_MODE_ON;
@@ -8683,11 +8667,15 @@
         cacMode = ANDROID_COLOR_CORRECTION_ABERRATION_MODE_FAST;
         edge_mode = ANDROID_EDGE_MODE_ZERO_SHUTTER_LAG;
         noise_red_mode = ANDROID_NOISE_REDUCTION_MODE_ZERO_SHUTTER_LAG;
+        shading_mode = ANDROID_SHADING_MODE_FAST;
+        hot_pixel_mode = ANDROID_HOT_PIXEL_MODE_FAST;
         tonemap_mode = ANDROID_TONEMAP_MODE_FAST;
         break;
       case CAMERA3_TEMPLATE_MANUAL:
         edge_mode = ANDROID_EDGE_MODE_FAST;
         noise_red_mode = ANDROID_NOISE_REDUCTION_MODE_FAST;
+        shading_mode = ANDROID_SHADING_MODE_FAST;
+        hot_pixel_mode = ANDROID_HOT_PIXEL_MODE_FAST;
         tonemap_mode = ANDROID_TONEMAP_MODE_FAST;
         cacMode = ANDROID_COLOR_CORRECTION_ABERRATION_MODE_FAST;
         controlIntent = ANDROID_CONTROL_CAPTURE_INTENT_MANUAL;
@@ -8697,6 +8685,8 @@
       default:
         edge_mode = ANDROID_EDGE_MODE_FAST;
         noise_red_mode = ANDROID_NOISE_REDUCTION_MODE_FAST;
+        shading_mode = ANDROID_SHADING_MODE_FAST;
+        hot_pixel_mode = ANDROID_HOT_PIXEL_MODE_FAST;
         tonemap_mode = ANDROID_TONEMAP_MODE_FAST;
         cacMode = ANDROID_COLOR_CORRECTION_ABERRATION_MODE_FAST;
         controlIntent = ANDROID_CONTROL_CAPTURE_INTENT_CUSTOM;
@@ -8819,6 +8809,12 @@
     /*noise reduction mode*/
     settings.update(ANDROID_NOISE_REDUCTION_MODE, &noise_red_mode, 1);
 
+    /*shading mode*/
+    settings.update(ANDROID_SHADING_MODE, &shading_mode, 1);
+
+    /*hot pixel mode*/
+    settings.update(ANDROID_HOT_PIXEL_MODE, &hot_pixel_mode, 1);
+
     /*color correction mode*/
     static const uint8_t color_correct_mode = ANDROID_COLOR_CORRECTION_MODE_FAST;
     settings.update(ANDROID_COLOR_CORRECTION_MODE, &color_correct_mode, 1);
diff --git a/camera/QCamera2/HAL3/QCamera3Stream.cpp b/camera/QCamera2/HAL3/QCamera3Stream.cpp
index 249fa9d..4726694 100644
--- a/camera/QCamera2/HAL3/QCamera3Stream.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Stream.cpp
@@ -1478,6 +1478,10 @@
         delete mStreamBatchBufs;
         mStreamBatchBufs = NULL;
     }
+    // Flush any free batch buffers in the queue. The dummy batch stream doesn't
+    // get started, stop will not be able to trigger the flush call making it possible
+    // to free the buffer definitions twice.
+    flushFreeBatchBufQ();
     // mm-camera-interface frees bufDefs even though bufDefs are allocated by
     // QCamera3Stream. Don't free here
     mBatchBufDefs = NULL;
diff --git a/camera/QCamera2/stack/mm-camera-interface/Android.mk b/camera/QCamera2/stack/mm-camera-interface/Android.mk
index 171d357..b0d7a05 100644
--- a/camera/QCamera2/stack/mm-camera-interface/Android.mk
+++ b/camera/QCamera2/stack/mm-camera-interface/Android.mk
@@ -57,6 +57,7 @@
 LOCAL_MODULE           := libmmcamera_interface
 LOCAL_PRELINK_MODULE   := false
 LOCAL_SHARED_LIBRARIES := libdl libcutils liblog
+LOCAL_HEADER_LIBRARIES := libsystem_headers libhardware_headers
 LOCAL_MODULE_TAGS := optional
 LOCAL_PROPRIETARY_MODULE := true
 
diff --git a/camera/QCamera2/stack/mm-camera-interface/inc/mm_camera_dbg.h b/camera/QCamera2/stack/mm-camera-interface/inc/mm_camera_dbg.h
index 8298c78..682cf95 100644
--- a/camera/QCamera2/stack/mm-camera-interface/inc/mm_camera_dbg.h
+++ b/camera/QCamera2/stack/mm-camera-interface/inc/mm_camera_dbg.h
@@ -31,7 +31,7 @@
 #define __MM_CAMERA_DBG_H__
 
 // System dependencies
-#include <utils/Log.h>
+#include <log/log.h>
 
 #ifdef QCAMERA_REDEFINE_LOG
 
diff --git a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c
index be7573d..c029810 100644
--- a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c
+++ b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera.c
@@ -36,6 +36,7 @@
 #include <fcntl.h>
 #include <stdlib.h>
 #include <dlfcn.h>
+#include <unistd.h> // for usleep, close
 #define IOCTL_H <SYSTEM_HEADER_PREFIX/ioctl.h>
 #include IOCTL_H
 
diff --git a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_interface.c b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_interface.c
index d2b6b99..d8add22 100644
--- a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_interface.c
+++ b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_interface.c
@@ -38,6 +38,7 @@
 #include <linux/media.h>
 #include <media/msm_cam_sensor.h>
 #include <dlfcn.h>
+#include <unistd.h> // for close()
 
 #define IOCTL_H <SYSTEM_HEADER_PREFIX/ioctl.h>
 #include IOCTL_H
diff --git a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_sock.c b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_sock.c
index 85a5d3b..fdb286f 100644
--- a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_sock.c
+++ b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_sock.c
@@ -32,6 +32,7 @@
 #include <stdlib.h>
 #include <errno.h>
 #include <string.h>
+#include <unistd.h> // for close()
 
 // Camera dependencies
 #include "mm_camera_dbg.h"
diff --git a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_thread.c b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_thread.c
index 0c740b4..07de447 100644
--- a/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_thread.c
+++ b/camera/QCamera2/stack/mm-camera-interface/src/mm_camera_thread.c
@@ -36,6 +36,7 @@
 #include <sys/prctl.h>
 #include <fcntl.h>
 #include <poll.h>
+#include <unistd.h> // for write, read, usleep, pipe, ...
 #include <cam_semaphore.h>
 
 #include "mm_camera_dbg.h"
diff --git a/camera/QCamera2/stack/mm-camera-test/Android.mk b/camera/QCamera2/stack/mm-camera-test/Android.mk
index f3f3a90..b5367fb 100644
--- a/camera/QCamera2/stack/mm-camera-test/Android.mk
+++ b/camera/QCamera2/stack/mm-camera-test/Android.mk
@@ -93,6 +93,7 @@
 LOCAL_32_BIT_ONLY := $(BOARD_QTI_CAMERA_32BIT_ONLY)
 
 LOCAL_MODULE:= mm-qcamera-app
+LOCAL_PROPRIETARY_MODULE := true
 
 include $(BUILD_EXECUTABLE)
 
diff --git a/camera/QCamera2/stack/mm-jpeg-interface/test/Android.mk b/camera/QCamera2/stack/mm-jpeg-interface/test/Android.mk
index e870f08..d8e5568 100644
--- a/camera/QCamera2/stack/mm-jpeg-interface/test/Android.mk
+++ b/camera/QCamera2/stack/mm-jpeg-interface/test/Android.mk
@@ -40,6 +40,7 @@
 LOCAL_MODULE           := mm-jpeg-interface-test
 LOCAL_PRELINK_MODULE   := false
 LOCAL_SHARED_LIBRARIES := liblog libcutils libdl libmmjpeg_interface
+LOCAL_PROPRIETARY_MODULE := true
 
 include $(BUILD_EXECUTABLE)
 
@@ -83,6 +84,7 @@
 LOCAL_MODULE           := mm-jpegdec-interface-test
 LOCAL_PRELINK_MODULE   := false
 LOCAL_SHARED_LIBRARIES := liblog libcutils libdl libmmjpeg_interface
+LOCAL_PROPRIETARY_MODULE := true
 
 include $(BUILD_EXECUTABLE)
 
diff --git a/camera/mm-image-codec/qomx_core/qomx_core.c b/camera/mm-image-codec/qomx_core/qomx_core.c
index ef2685d..25b211a 100644
--- a/camera/mm-image-codec/qomx_core/qomx_core.c
+++ b/camera/mm-image-codec/qomx_core/qomx_core.c
@@ -33,7 +33,7 @@
 #include <dlfcn.h>
 #include <malloc.h>
 #include <string.h>
-#include <utils/Log.h>
+#include <log/log.h>
 
 // OpenMAX dependencies
 #include "qomx_core.h"
diff --git a/common/base.mk b/common/base.mk
index 176418d..b7cd3c9 100644
--- a/common/base.mk
+++ b/common/base.mk
@@ -89,6 +89,7 @@
 AUDIO_HARDWARE += audio.a2dp.default
 AUDIO_HARDWARE += audio.usb.default
 AUDIO_HARDWARE += audio.r_submix.default
+AUDIO_HARDWARE += audio.hearing_aid.default
 AUDIO_HARDWARE += audio.primary.mpq8092
 AUDIO_HARDWARE += audio.primary.msm8916
 AUDIO_HARDWARE += audio.primary.msm8909
@@ -794,6 +795,7 @@
     frameworks/native/data/etc/android.hardware.wifi.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.xml \
     frameworks/native/data/etc/android.hardware.wifi.direct.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.direct.xml \
     frameworks/native/data/etc/android.hardware.wifi.passpoint.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.passpoint.xml \
+    frameworks/native/data/etc/android.hardware.wifi.rtt.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.rtt.xml \
     frameworks/native/data/etc/android.software.sip.voip.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.sip.voip.xml \
     frameworks/native/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml \
     frameworks/native/data/etc/android.hardware.sensor.proximity.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.proximity.xml \
diff --git a/default-permissions.xml b/default-permissions.xml
index 3f20f74..dcc9c0a 100644
--- a/default-permissions.xml
+++ b/default-permissions.xml
@@ -64,6 +64,23 @@
         <!-- Contacts -->
         <permission name="android.permission.READ_CONTACTS" fixed="false"/>
         <permission name="android.permission.WRITE_CONTACTS" fixed="false"/>
+        <!-- Call logs -->
+        <permission name="android.permission.READ_CALL_LOG" fixed="false"/>
+        <permission name="android.permission.WRITE_CALL_LOG" fixed="false"/>
+        <!-- SMS -->
+        <permission name="android.permission.RECEIVE_SMS" fixed="false"/>
+        <permission name="android.permission.READ_PHONE_NUMBERS" fixed="false"/>
+    </exception>
+
+    <exception
+            package="com.google.android.apps.restore"
+            sha256-cert-digest="56:BE:13:2B:78:06:56:FE:24:44:CD:34:32:6E:B5:D7:AA:C9:1D:20:96:AB:F0:FE:67:3A:99:27:06:22:EC:87">
+        <!-- External storage -->
+        <permission name="android.permission.READ_EXTERNAL_STORAGE" fixed="false"/>
+        <permission name="android.permission.WRITE_EXTERNAL_STORAGE" fixed="false"/>
+        <!-- Contacts -->
+        <permission name="android.permission.READ_CONTACTS" fixed="false"/>
+        <permission name="android.permission.WRITE_CONTACTS" fixed="false"/>
     </exception>
 
     <exception
@@ -78,4 +95,11 @@
         <permission name="android.permission.WRITE_EXTERNAL_STORAGE" fixed="false"/>
     </exception>
 
+    <exception package="com.google.android.settings.intelligence">
+        <!-- Calendar -->
+        <permission name="android.permission.READ_CALENDAR" fixed="true"/>
+        <!-- Location -->
+        <permission name="android.permission.ACCESS_FINE_LOCATION" fixed="true"/>
+    </exception>
+
 </exceptions>
diff --git a/device-common.mk b/device-common.mk
index 103e792..a38ad9e 100644
--- a/device-common.mk
+++ b/device-common.mk
@@ -27,7 +27,8 @@
 PRODUCT_SHIPPING_API_LEVEL := 25
 
 PRODUCT_COPY_FILES += \
-    $(LOCAL_KERNEL):kernel
+    $(LOCAL_KERNEL):kernel \
+    frameworks/native/data/etc/android.software.verified_boot.xml:system/etc/permissions/android.software.verified_boot.xml
 
 DEVICE_PACKAGE_OVERLAYS += device/google/marlin/overlay
 
@@ -47,8 +48,15 @@
 # copy customized media_profiles and media_codecs xmls for msm8996
 PRODUCT_COPY_FILES += \
     device/google/marlin/media_profiles_V1_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_profiles_V1_0.xml \
-    device/google/marlin/media_codecs.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs.xml \
+    device/google/marlin/media_codecs.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs.xml
+
+ifneq ($(findstring marlin_svelte, $(TARGET_PRODUCT)),)
+PRODUCT_COPY_FILES += \
+    device/google/marlin/media_codecs_performance_svelte.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_performance.xml
+else
+PRODUCT_COPY_FILES += \
     device/google/marlin/media_codecs_performance.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_performance.xml
+endif
 
 # Override heap growth limit due to high display density on device
 PRODUCT_PROPERTY_OVERRIDES += \
@@ -62,14 +70,14 @@
 PRODUCT_PACKAGES += libGLES_android
 PRODUCT_PACKAGES += SSRestartDetector
 
-ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
-PRODUCT_PACKAGES += TelephonyMonitor
-endif
-
 # graphics
 PRODUCT_PROPERTY_OVERRIDES += \
     ro.opengles.version=196610
 
+# b/73640835
+PRODUCT_PROPERTY_OVERRIDES += \
+    sdm.debug.rotator_downscale=1
+
 # HWUI common settings
 PRODUCT_PROPERTY_OVERRIDES += \
     ro.hwui.gradient_cache_size=1 \
@@ -96,17 +104,17 @@
     device/google/marlin/sound_trigger_mixer_paths.xml:$(TARGET_COPY_OUT_VENDOR)/etc/sound_trigger_mixer_paths.xml \
     device/google/marlin/sound_trigger_mixer_paths_tasha_t50.xml:$(TARGET_COPY_OUT_VENDOR)/etc/sound_trigger_mixer_paths_tasha_t50.xml \
     device/google/marlin/sound_trigger_platform_info.xml:$(TARGET_COPY_OUT_VENDOR)/etc/sound_trigger_platform_info.xml \
-    device/google/marlin/audio_platform_info.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_platform_info.xml \
     device/google/marlin/audio_platform_info_tasha_t50.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_platform_info_tasha_t50.xml \
     device/google/marlin/audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_configuration.xml \
     device/google/marlin/audio_policy_volumes_drc.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_volumes_drc.xml \
     frameworks/av/services/audiopolicy/config/a2dp_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/a2dp_audio_policy_configuration.xml \
+    frameworks/av/services/audiopolicy/config/hearing_aid_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/hearing_aid_audio_policy_configuration.xml \
     frameworks/av/services/audiopolicy/config/r_submix_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/r_submix_audio_policy_configuration.xml \
     frameworks/av/services/audiopolicy/config/usb_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/usb_audio_policy_configuration.xml \
     frameworks/av/services/audiopolicy/config/default_volume_tables.xml:$(TARGET_COPY_OUT_VENDOR)/etc/default_volume_tables.xml \
     frameworks/native/data/etc/android.hardware.vulkan.compute-0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.compute.xml \
     frameworks/native/data/etc/android.hardware.vulkan.level-0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.level.xml \
-    frameworks/native/data/etc/android.hardware.vulkan.version-1_0_3.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.version.xml
+    frameworks/native/data/etc/android.hardware.vulkan.version-1_1.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.version.xml
 
 # Enable AAudio MMAP/NOIRQ data path.
 # 2 is AAUDIO_POLICY_AUTO so it will try MMAP then fallback to Legacy path.
@@ -124,7 +132,6 @@
 PRODUCT_FULL_TREBLE_OVERRIDE := true
 PRODUCT_PACKAGES += \
     android.hardware.audio@2.0-service \
-    android.hardware.bluetooth@1.0-service \
     android.hardware.contexthub@1.0-service \
     android.hardware.gnss@1.0-service \
     android.hardware.drm@1.0-service \
@@ -142,11 +149,11 @@
 
 # Light HAL
 PRODUCT_PACKAGES += \
-    android.hardware.light@2.0-impl
+    android.hardware.light@2.0-impl:64
 
 # Keymaster HAL
 PRODUCT_PACKAGES += \
-    android.hardware.keymaster@3.0-impl \
+    android.hardware.keymaster@3.0-impl:64 \
     android.hardware.keymaster@3.0-service
 
 # Usb HAL
@@ -168,12 +175,12 @@
     sound_trigger.primary.msm8996
 
 PRODUCT_PACKAGES += \
-    android.hardware.audio@2.0-impl \
-    android.hardware.audio.effect@2.0-impl \
-    android.hardware.soundtrigger@2.0-impl
+    android.hardware.audio@4.0-impl:32 \
+    android.hardware.audio.effect@4.0-impl:32 \
+    android.hardware.soundtrigger@2.1-impl:32
 
 PRODUCT_PACKAGES += \
-    android.hardware.drm@1.0-impl
+    android.hardware.drm@1.0-impl:32
 
 PRODUCT_PACKAGES += \
     netutils-wrapper-1.0
@@ -252,7 +259,7 @@
 
 # new gatekeeper HAL
 PRODUCT_PACKAGES += \
-    android.hardware.gatekeeper@1.0-impl \
+    android.hardware.gatekeeper@1.0-impl:64 \
     android.hardware.gatekeeper@1.0-service
 
 # Common sensor packages
@@ -263,9 +270,8 @@
 NANOHUB_SENSORHAL_DYNAMIC_SENSOR_EXT_ENABLED := true
 
 PRODUCT_PACKAGES += \
-    context_hub.default \
-    android.hardware.sensors@1.0-impl \
-    android.hardware.contexthub@1.0-impl \
+    android.hardware.sensors@1.0-impl:64 \
+    android.hardware.contexthub@1.0-impl.nanohub:64 \
 
 PRODUCT_PACKAGES += \
     nanoapp_cmd
@@ -317,16 +323,17 @@
 $(error "you must decide whether to write manufacturer and model information into created media files for this device. ONLY ENABLE IT FOR PUBLIC DEVICE.")
 endif  #TARGET_PRODUCT
 
+# By default, enable zram; experiment can toggle the flag,
+# which takes effect on boot
+PRODUCT_PROPERTY_OVERRIDES += \
+    persist.sys.zram_enabled=1
+
 PRODUCT_PROPERTY_OVERRIDES += \
     persist.camera.gyro.android=4 \
     persist.camera.tof.direct=1 \
     persist.camera.tnr.preview=1 \
     persist.camera.tnr.video=1
 
-# Set bluetooth soc to rome
-PRODUCT_PROPERTY_OVERRIDES += \
-    qcom.bluetooth.soc=rome
-
 PRODUCT_PROPERTY_OVERRIDES += \
     persist.cne.feature=1 \
     persist.radio.data_ltd_sys_ind=1 \
@@ -409,10 +416,6 @@
 $(call inherit-product-if-exists, hardware/qcom/msm8996/msm8996.mk)
 $(call inherit-product-if-exists, vendor/qcom/gpu/msm8996/msm8996-gpu-vendor.mk)
 
-#Property of the BDA module path for loading BDA
-PRODUCT_PROPERTY_OVERRIDES += \
-    ro.bt.bdaddr_path=/sys/module/bdaddress/parameters/bdaddress
-
 # Needed for encryption
 PRODUCT_PACKAGES += \
     keystore.msm8996 \
@@ -457,8 +460,22 @@
 
 # Bluetooth HAL
 PRODUCT_PACKAGES += \
-    libbt-vendor \
-    android.hardware.bluetooth@1.0-impl
+    android.hardware.bluetooth@1.0-impl-qti:64 \
+    android.hardware.bluetooth@1.0-service-qti \
+    android.hardware.bluetooth@1.0-service-qti.rc
+
+# Bluetooth SoC
+PRODUCT_PROPERTY_OVERRIDES += \
+    vendor.qcom.bluetooth.soc=rome
+
+# Property for loading BDA from bdaddress module in kernel
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.vendor.bt.bdaddr_path=/sys/module/bdaddress/parameters/bdaddress
+
+# Bluetooth WiPower
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.vendor.bluetooth.emb_wp_mode=true \
+    ro.vendor.bluetooth.wipower=true
 
 # NFC packages
 PRODUCT_PACKAGES += \
@@ -472,7 +489,7 @@
 
 #GNSS HAL
 PRODUCT_PACKAGES += \
-    android.hardware.gnss@1.0-impl
+    android.hardware.gnss@1.0-impl:64
 
 # Vibrator
 PRODUCT_PACKAGES += \
@@ -480,22 +497,22 @@
 
 # VR
 PRODUCT_PACKAGES += \
-    android.hardware.vr@1.0-impl
+    android.hardware.vr@1.0-impl:64
 
 # Gralloc
 PRODUCT_PACKAGES += \
-    android.hardware.graphics.allocator@2.0-impl \
+    android.hardware.graphics.allocator@2.0-impl:64 \
     android.hardware.graphics.allocator@2.0-service \
     android.hardware.graphics.mapper@2.0-impl
 
 # HW Composer
 PRODUCT_PACKAGES += \
-    android.hardware.graphics.composer@2.1-impl \
+    android.hardware.graphics.composer@2.1-impl:64 \
     android.hardware.graphics.composer@2.1-service
 
 # Boot control
 PRODUCT_PACKAGES += \
-    android.hardware.boot@1.0-impl \
+    android.hardware.boot@1.0-impl:64 \
     android.hardware.boot@1.0-service
 
 # Library used for VTS tests  (only for userdebug and eng builds)
@@ -606,9 +623,21 @@
 PRODUCT_COPY_FILES += \
     device/google/marlin/qti_whitelist.xml:system/etc/sysconfig/qti_whitelist.xml
 
+# Privileged permissions whitelist
+PRODUCT_COPY_FILES += \
+    device/google/marlin/permissions/privapp-permissions-marlin.xml:system/etc/permissions/privapp-permissions-marlin.xml
+
 PRODUCT_PACKAGES += \
     vndk-sp
 
+# Marlin/Sailfish kernel doesn't have HEH filename encryption
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.crypto.volume.filenames_mode=aes-256-cts
+
 # Enable Perfetto traced
 PRODUCT_PROPERTY_OVERRIDES += \
     persist.traced.enable=1
+
+# health HAL
+PRODUCT_PACKAGES += \
+    android.hardware.health@2.0-service.marlin
diff --git a/device-marlin.mk b/device-marlin.mk
index 9826610..6307ddc 100644
--- a/device-marlin.mk
+++ b/device-marlin.mk
@@ -44,7 +44,8 @@
 
 PRODUCT_COPY_FILES += \
     device/google/marlin/fstab.common:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.marlin \
-    device/google/marlin/init.recovery.common.rc:root/init.recovery.marlin.rc
+    device/google/marlin/audio_platform_info_tasha_marlin.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_platform_info_tasha.xml \
+    device/google/marlin/init.recovery.common.rc:recovery/root/init.recovery.marlin.rc
 
 # Sensor packages
 PRODUCT_PACKAGES += \
@@ -65,3 +66,12 @@
 # Fingerprint
 PRODUCT_PACKAGES += \
     fingerprint.marlin
+
+$(call add-product-sanitizer-module-config,wpa_supplicant,never)
+$(call add-product-sanitizer-module-config,toybox_vendor,never)
+$(call add-product-sanitizer-module-config,thermal-engine,never)
+$(call add-product-sanitizer-module-config,netmgrd,never)
+$(call add-product-sanitizer-module-config,mm-camera,never)
+$(call add-product-sanitizer-module-config,myftm,never)
+$(call add-product-sanitizer-module-config,libqcril,never)
+$(call add-product-sanitizer-module-config,hostapd,never)
diff --git a/device-sailfish.mk b/device-sailfish.mk
index b6190ad..ad84334 100644
--- a/device-sailfish.mk
+++ b/device-sailfish.mk
@@ -44,7 +44,8 @@
 
 PRODUCT_COPY_FILES += \
     device/google/marlin/fstab.common:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.sailfish \
-    device/google/marlin/init.recovery.common.rc:root/init.recovery.sailfish.rc
+    device/google/marlin/audio_platform_info_tasha_sailfish.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_platform_info_tasha.xml \
+    device/google/marlin/init.recovery.common.rc:recovery/root/init.recovery.sailfish.rc
 
 # Sensor packages
 PRODUCT_PACKAGES += \
@@ -65,3 +66,12 @@
 # Fingerprint
 PRODUCT_PACKAGES += \
     fingerprint.sailfish
+
+$(call add-product-sanitizer-module-config,wpa_supplicant,never)
+$(call add-product-sanitizer-module-config,toybox_vendor,never)
+$(call add-product-sanitizer-module-config,thermal-engine,never)
+$(call add-product-sanitizer-module-config,netmgrd,never)
+$(call add-product-sanitizer-module-config,mm-camera,never)
+$(call add-product-sanitizer-module-config,myftm,never)
+$(call add-product-sanitizer-module-config,libqcril,never)
+$(call add-product-sanitizer-module-config,hostapd,never)
diff --git a/device_framework_matrix.xml b/device_framework_matrix.xml
new file mode 100644
index 0000000..6863271
--- /dev/null
+++ b/device_framework_matrix.xml
@@ -0,0 +1,18 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="hidl" optional="true">
+        <name>vendor.qti.atcmdfwd</name>
+        <version>1.0</version>
+        <interface>
+            <name>IAtCmdFwd</name>
+            <instance>AtCmdFwdService</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
+        <name>vendor.qti.qcril.am</name>
+        <version>1.0</version>
+        <interface>
+            <name>IQcRilAudio</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/dumpstate/DumpstateDevice.cpp b/dumpstate/DumpstateDevice.cpp
index 01db23f..5174e79 100755
--- a/dumpstate/DumpstateDevice.cpp
+++ b/dumpstate/DumpstateDevice.cpp
@@ -134,6 +134,7 @@
         dumpModem(fd, fdModem);
     }
 
+    RunCommandToFd(fd, "VENDOR PROPERTIES", {"/vendor/bin/getprop"});
     DumpFileToFd(fd, "CPU present", "/sys/devices/system/cpu/present");
     DumpFileToFd(fd, "CPU online", "/sys/devices/system/cpu/online");
     DumpFileToFd(fd, "INTERRUPTS", "/proc/interrupts");
@@ -141,7 +142,7 @@
     DumpFileToFd(fd, "UFS model", "/sys/block/sda/device/model");
     DumpFileToFd(fd, "UFS rev", "/sys/block/sda/device/rev");
     DumpFileToFd(fd, "UFS size", "/sys/block/sda/size");
-    DumpFileToFd(fd, "UFS heath", "/sys/devices/soc/624000.ufshc/health");
+    DumpFileToFd(fd, "UFS health", "/sys/devices/soc/624000.ufshc/health");
     RunCommandToFd(fd, "UFS dump", {"/vendor/bin/sh", "-c", "for f in $(find /sys/kernel/debug/ufshcd0 -type f); do if [[ -r $f && -f $f ]]; then echo --- $f; cat $f; fi; done"});
 
     DumpFileToFd(fd, "RPM Stats", "/d/rpm_stats");
@@ -153,20 +154,24 @@
     DumpFileToFd(fd, "SMD Log", "/d/ipc_logging/smd/log");
     RunCommandToFd(fd, "ION HEAPS", {"/vendor/bin/sh", "-c", "for d in $(ls -d /d/ion/*); do for f in $(ls $d); do echo --- $d/$f; cat $d/$f; done; done"});
     DumpFileToFd(fd, "dmabuf info", "/d/dma_buf/bufinfo");
-    RunCommandToFd(fd, "Temperatures", {"/vendor/bin/sh", "-c", "for f in `ls /sys/class/thermal` ; do type=`cat /sys/class/thermal/$f/type` ; temp=`cat /sys/class/thermal/$f/temp` ; echo \"$type: $temp\" ; done"});
-    DumpFileToFd(fd, "cpu0-1 time-in-state", "/sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state");
-    RunCommandToFd(fd, "cpu0-1 cpuidle", {"/vendor/bin/sh", "-c", "for d in $(ls -d /sys/devices/system/cpu/cpu0/cpuidle/state*); do echo \"$d: `cat $d/name` `cat $d/desc` `cat $d/time` `cat $d/usage`\"; done"});
-    DumpFileToFd(fd, "cpu2-3 time-in-state", "/sys/devices/system/cpu/cpu2/cpufreq/stats/time_in_state");
-    RunCommandToFd(fd, "cpu2-3 cpuidle", {"/vendor/bin/sh", "-c", "for d in $(ls -d /sys/devices/system/cpu/cpu2/cpuidle/state*); do echo \"$d: `cat $d/name` `cat $d/desc` `cat $d/time` `cat $d/usage`\"; done"});
     DumpFileToFd(fd, "MDP xlogs", "/d/mdp/xlog/dump");
     DumpFileToFd(fd, "TCPM logs", "/d/tcpm/9-0022");
+    RunCommandToFd(fd, "Temperatures", {"/vendor/bin/sh", "-c", "for f in /sys/class/thermal/thermal* ; do type=`cat $f/type` ; temp=`cat $f/temp` ; echo \"$type: $temp\" ; done"});
+    RunCommandToFd(fd, "CPU time-in-state", {"/vendor/bin/sh", "-c", "for cpu in /sys/devices/system/cpu/cpu*; do f=$cpu/cpufreq/stats/time_in_state; if [ ! -f $f ]; then continue; fi; echo $f:; cat $f; done"});
+    RunCommandToFd(fd, "CPU cpuidle", {"/vendor/bin/sh", "-c", "for cpu in /sys/devices/system/cpu/cpu*; do for d in $cpu/cpuidle/state*; do if [ ! -d $d ]; then continue; fi; echo \"$d: `cat $d/name` `cat $d/desc` `cat $d/time` `cat $d/usage`\"; done; done"});
     DumpFileToFd(fd, "FUSB302 logs", "/d/ipc_logging/fusb302/log");
 
+    RunCommandToFd(fd, "Power supply properties", {"/vendor/bin/sh", "-c", "for f in /sys/class/power_supply/*/uevent ; do echo \"\n------ $f\" ; cat $f ; done"});
+    DumpFileToFd(fd, "Battery cycle count", "/sys/class/power_supply/bms/device/cycle_counts_bins");
+    RunCommandToFd(fd, "QCOM FG SRAM", {"/vendor/bin/sh", "-c", "echo 0x400 > /d/fg_memif/address ; echo 0x200 > /d/fg_memif/count ; cat /d/fg_memif/data"});
+
     /* Check if qsee_logger tool exists */
     if (!access("/vendor/bin/qsee_logger", X_OK)) {
       RunCommandToFd(fd, "FP LOGS", {"qsee_logger", "-d"});
     }
 
+    DumpFileToFd(fd, "WLAN FW Log Symbol Table", "/vendor/firmware/Data.msc");
+
     return Void();
 };
 
diff --git a/dumpstate/android.hardware.dumpstate@1.0-service.marlin.rc b/dumpstate/android.hardware.dumpstate@1.0-service.marlin.rc
index 7ef863e..4ae80be 100644
--- a/dumpstate/android.hardware.dumpstate@1.0-service.marlin.rc
+++ b/dumpstate/android.hardware.dumpstate@1.0-service.marlin.rc
@@ -1,4 +1,5 @@
-service dumpstate-1-0 /vendor/bin/hw/android.hardware.dumpstate@1.0-service.marlin
+service vendor.dumpstate-1-0 /vendor/bin/hw/android.hardware.dumpstate@1.0-service.marlin
     class hal
     user system
     group system
+    interface android.hardware.dumpstate@1.0::IDumpstateDevice default
diff --git a/fstab.common b/fstab.common
index 269598e..7b3ef56 100755
--- a/fstab.common
+++ b/fstab.common
@@ -8,7 +8,7 @@
 #<src>                                                  <mnt_point>         <type>  <mnt_flags and options>     <fs_mgr_flags>
 /dev/block/platform/soc/624000.ufshc/by-name/system     /                   ext4    ro,barrier=1                wait,slotselect,verify
 /dev/block/platform/soc/624000.ufshc/by-name/modem      /firmware/radio     vfat    ro,shortname=lower,uid=1000,gid=0,dmask=227,fmask=337,context=u:object_r:firmware_file:s0   wait,slotselect
-/dev/block/platform/soc/624000.ufshc/by-name/userdata   /data               ext4    errors=panic,noatime,nosuid,nodev,barrier=1,noauto_da_alloc  latemount,wait,check,formattable,fileencryption=ice,quota
+/dev/block/platform/soc/624000.ufshc/by-name/userdata   /data               ext4    errors=panic,noatime,nosuid,nodev,barrier=1,noauto_da_alloc  latemount,wait,check,formattable,fileencryption=ice,quota,reservedsize=128M
 /dev/block/zram0                                        none                swap    defaults                    zramsize=536870912,max_comp_streams=4
 /dev/block/platform/soc/624000.ufshc/by-name/misc       /misc               emmc    defaults                    defaults
 /devices/*/xhci-hcd.0.auto/usb*                         auto                vfat    defaults                    voldmanaged=usb:auto
diff --git a/health/Android.bp b/health/Android.bp
new file mode 100644
index 0000000..2a6c4b5
--- /dev/null
+++ b/health/Android.bp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+cc_binary {
+    name: "android.hardware.health@2.0-service.marlin",
+    init_rc: ["android.hardware.health@2.0-service.marlin.rc"],
+    proprietary: true,
+    relative_install_path: "hw",
+    srcs: [
+        "HealthService.cpp",
+        "CycleCountBackupRestore.cpp",
+        "LearnedCapacityBackupRestore.cpp",
+    ],
+
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+
+    static_libs: [
+        "android.hardware.health@2.0-impl",
+        "android.hardware.health@1.0-convert",
+        "libhealthservice",
+        "libbatterymonitor",
+    ],
+
+    shared_libs: [
+        "libbase",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hardware.health@2.0",
+    ],
+
+    header_libs: ["libhealthd_headers"],
+}
diff --git a/health/CycleCountBackupRestore.cpp b/health/CycleCountBackupRestore.cpp
new file mode 100644
index 0000000..581dfed
--- /dev/null
+++ b/health/CycleCountBackupRestore.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "CycleCountBackupRestore.h"
+
+namespace device {
+namespace google {
+namespace marlin {
+namespace health {
+
+static constexpr char kCycCntFile[] = "sys/class/power_supply/bms/device/cycle_counts_bins";
+static constexpr char kSysPersistFile[] = "/persist/battery/qcom_cycle_counts_bins";
+static constexpr int kBuffSize = 256;
+
+CycleCountBackupRestore::CycleCountBackupRestore() { }
+
+void CycleCountBackupRestore::Restore()
+{
+    ReadFromStorage();
+    ReadFromSRAM();
+    UpdateAndSave();
+}
+
+void CycleCountBackupRestore::Backup()
+{
+    ReadFromSRAM();
+    UpdateAndSave();
+}
+
+void CycleCountBackupRestore::ReadFromStorage()
+{
+    std::string buffer;
+
+    if (!android::base::ReadFileToString(std::string(kSysPersistFile), &buffer)) {
+        LOG(ERROR) << "Cannot read the storage file";
+        return;
+    }
+
+    if (sscanf(buffer.c_str(), "%d %d %d %d %d %d %d %d",
+               &sw_bins_[0], &sw_bins_[1], &sw_bins_[2], &sw_bins_[3],
+               &sw_bins_[4], &sw_bins_[5], &sw_bins_[6], &sw_bins_[7])
+        != kBucketCount)
+        LOG(ERROR) << "data format is wrong in the storage file: " << buffer;
+    else
+        LOG(INFO) << "Storage data: " << buffer;
+}
+
+void CycleCountBackupRestore::SaveToStorage()
+{
+    char strData[kBuffSize];
+
+    snprintf(strData, kBuffSize, "%d %d %d %d %d %d %d %d",
+             sw_bins_[0], sw_bins_[1], sw_bins_[2], sw_bins_[3],
+             sw_bins_[4], sw_bins_[5], sw_bins_[6], sw_bins_[7]);
+
+    LOG(INFO) << "Save to Storage: " << strData;
+
+    if (!android::base::WriteStringToFile(strData, std::string(kSysPersistFile)))
+        LOG(ERROR) << "Write file error: " << strerror(errno);
+}
+
+void CycleCountBackupRestore::ReadFromSRAM()
+{
+    std::string buffer;
+
+    if (!android::base::ReadFileToString(std::string(kCycCntFile), &buffer)) {
+        LOG(ERROR) << "Read cycle counter error: " << strerror(errno);
+        return;
+    }
+
+    buffer = android::base::Trim(buffer);
+
+    if (sscanf(buffer.c_str(), "%d %d %d %d %d %d %d %d",
+               &hw_bins_[0], &hw_bins_[1], &hw_bins_[2], &hw_bins_[3],
+               &hw_bins_[4], &hw_bins_[5], &hw_bins_[6], &hw_bins_[7])
+        != kBucketCount)
+        LOG(ERROR) << "Failed to parse SRAM bins: " << buffer;
+    else
+        LOG(INFO) << "SRAM data: " << buffer;
+}
+
+void CycleCountBackupRestore::SaveToSRAM()
+{
+    char strData[kBuffSize];
+
+    snprintf(strData, kBuffSize, "%d %d %d %d %d %d %d %d",
+             hw_bins_[0], hw_bins_[1], hw_bins_[2], hw_bins_[3],
+             hw_bins_[4], hw_bins_[5], hw_bins_[6], hw_bins_[7]);
+
+    LOG(INFO) << "Save to SRAM: "  << strData ;
+
+    if (!android::base::WriteStringToFile(strData, std::string(kCycCntFile)))
+        LOG(ERROR) << "Write data error: " << strerror(errno);
+}
+
+
+void CycleCountBackupRestore::UpdateAndSave()
+{
+    bool backup = false;
+    bool restore = false;
+    for (int i = 0; i < kBucketCount; i++) {
+        if (hw_bins_[i] < sw_bins_[i]) {
+            hw_bins_[i] = sw_bins_[i];
+            restore = true;
+        } else if (hw_bins_[i] > sw_bins_[i]) {
+            sw_bins_[i] = hw_bins_[i];
+            backup = true;
+        }
+    }
+    if (restore)
+        SaveToSRAM();
+    if (backup)
+        SaveToStorage();
+}
+
+} // namespace health
+} // namespace marlin
+} // namespace google
+} // namespace device
diff --git a/health/CycleCountBackupRestore.h b/health/CycleCountBackupRestore.h
new file mode 100644
index 0000000..6e3628d
--- /dev/null
+++ b/health/CycleCountBackupRestore.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef DEVICE_GOOGLE_MARLIN_HEALTH_CYCLECOUNTBACKUPRESTORE_H
+#define DEVICE_GOOGLE_MARLIN_HEALTH_CYCLECOUNTBACKUPRESTORE_H
+
+#include <string>
+#include <android-base/file.h>
+#include <android-base/strings.h>
+#include <android-base/logging.h>
+
+namespace device {
+namespace google {
+namespace marlin {
+namespace health {
+
+static constexpr int kBucketCount = 8;
+
+class CycleCountBackupRestore {
+public:
+    CycleCountBackupRestore();
+    void Restore();
+    void Backup();
+
+private:
+    int sw_bins_[kBucketCount];
+    int hw_bins_[kBucketCount];
+
+    void ReadFromStorage();
+    void SaveToStorage();
+    void ReadFromSRAM();
+    void SaveToSRAM();
+    void UpdateAndSave();
+};
+
+} // namespace health
+} // namespace marlin
+} // namespace google
+} // namespace device
+
+#endif // #ifndef DEVICE_GOOGLE_MARLIN_HEALTH_CYCLECOUNTBACKUPRESTORE_H
diff --git a/health/HealthService.cpp b/health/HealthService.cpp
new file mode 100644
index 0000000..b26efe2
--- /dev/null
+++ b/health/HealthService.cpp
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "android.hardware.health@2.0-service.marlin"
+#include <android-base/logging.h>
+
+#include <healthd/healthd.h>
+#include <health2/Health.h>
+#include <health2/service.h>
+#include <hidl/HidlTransportSupport.h>
+
+#include <android-base/file.h>
+#include <android-base/strings.h>
+
+#include <vector>
+#include <string>
+
+#include <sys/stat.h>
+
+#include "CycleCountBackupRestore.h"
+#include "LearnedCapacityBackupRestore.h"
+
+using android::hardware::health::V2_0::StorageInfo;
+using android::hardware::health::V2_0::DiskStats;
+using ::device::google::marlin::health::CycleCountBackupRestore;
+using ::device::google::marlin::health::LearnedCapacityBackupRestore;
+
+static constexpr int kBackupTrigger = 20;
+static constexpr size_t kDiskStatsSize = 11;
+static constexpr char kUFSHealthFile[] = "/sys/devices/soc/624000.ufshc/health";
+static constexpr char kUFSHealthVersionFile[] = "/sys/kernel/debug/ufshcd0/show_hba";
+static constexpr char kUFSName[] = "UFS0";
+static constexpr char kDiskStatsFile[] = "/sys/block/sda/stat";
+
+static CycleCountBackupRestore ccBackupRestore;
+static LearnedCapacityBackupRestore lcBackupRestore;
+
+int cycle_count_backup(int battery_level)
+{
+    static int saved_soc = 0;
+    static int soc_inc = 0;
+    static bool is_first = true;
+
+    if (is_first) {
+        is_first = false;
+        saved_soc = battery_level;
+        return 0;
+    }
+
+    if (battery_level > saved_soc) {
+        soc_inc += battery_level - saved_soc;
+    }
+
+    saved_soc = battery_level;
+
+    if (soc_inc >= kBackupTrigger) {
+        ccBackupRestore.Backup();
+        soc_inc = 0;
+    }
+    return 0;
+}
+
+// See : hardware/interfaces/health/2.0/README
+
+void healthd_board_init(struct healthd_config*)
+{
+    ccBackupRestore.Restore();
+    lcBackupRestore.Restore();
+}
+
+int healthd_board_battery_update(struct android::BatteryProperties *props)
+{
+    cycle_count_backup(props->batteryLevel);
+    lcBackupRestore.Backup();
+    return 0;
+}
+
+void get_storage_info(std::vector<StorageInfo>& vec_storage_info) {
+    StorageInfo storage_info = {};
+    std::string buffer, version;
+
+    storage_info.attr.isInternal = true;
+    storage_info.attr.isBootDevice = true;
+    storage_info.attr.name = std::string(kUFSName);
+
+    if (!android::base::ReadFileToString(std::string(kUFSHealthVersionFile), &version)) {
+        return;
+    }
+
+    std::vector<std::string> lines = android::base::Split(version, "\n");
+    if (lines.empty()) {
+        return;
+    }
+
+    char rev[8];
+    if (sscanf(lines[6].c_str(), "ufs version: 0x%7s\n", rev) < 1) {
+        return;
+    }
+
+    storage_info.version = "ufs " + std::string(rev);
+
+    if (!android::base::ReadFileToString(std::string(kUFSHealthFile), &buffer)) {
+        return;
+    }
+
+    lines = android::base::Split(buffer, "\n");
+    if (lines.empty()) {
+        return;
+    }
+
+    for (const auto& line : lines) {
+        char token[32];
+        uint16_t val;
+        int ret;
+        if ((ret = sscanf(line.c_str(),
+                   "Health Descriptor[Byte offset 0x%*d]: %31s = 0x%hx",
+                   token, &val)) < 2) {
+            continue;
+        }
+
+        if (std::string(token) == "bPreEOLInfo") {
+            storage_info.eol = val;
+        } else if (std::string(token) == "bDeviceLifeTimeEstA") {
+            storage_info.lifetimeA = val;
+        } else if (std::string(token) == "bDeviceLifeTimeEstB") {
+            storage_info.lifetimeB = val;
+        }
+    }
+
+    vec_storage_info.resize(1);
+    vec_storage_info[0] = storage_info;
+    return;
+}
+
+
+void get_disk_stats(std::vector<DiskStats>& vec_stats) {
+    DiskStats stats = {};
+
+    stats.attr.isInternal = true;
+    stats.attr.isBootDevice = true;
+    stats.attr.name = std::string(kUFSName);
+
+    std::string buffer;
+    if (!android::base::ReadFileToString(std::string(kDiskStatsFile), &buffer)) {
+        LOG(ERROR) << kDiskStatsFile << ": ReadFileToString failed.";
+        return;
+    }
+
+    // Regular diskstats entries
+    std::stringstream ss(buffer);
+    for (uint i = 0; i < kDiskStatsSize; i++) {
+        ss >> *(reinterpret_cast<uint64_t*>(&stats) + i);
+    }
+    vec_stats.resize(1);
+    vec_stats[0] = stats;
+
+    return;
+}
+
+int main(void) {
+    return health_service_main();
+}
diff --git a/health/LearnedCapacityBackupRestore.cpp b/health/LearnedCapacityBackupRestore.cpp
new file mode 100644
index 0000000..f34b909
--- /dev/null
+++ b/health/LearnedCapacityBackupRestore.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "LearnedCapacityBackupRestore.h"
+
+namespace device {
+namespace google {
+namespace marlin {
+namespace health {
+
+static constexpr char kChgFullFile[] = "sys/class/power_supply/bms/charge_full";
+static constexpr char kSysCFPersistFile[] = "/persist/battery/qcom_charge_full";
+static constexpr int kBuffSize = 256;
+
+LearnedCapacityBackupRestore::LearnedCapacityBackupRestore() {}
+
+void LearnedCapacityBackupRestore::Restore() {
+    ReadFromStorage();
+    ReadFromSRAM();
+    UpdateAndSave();
+}
+
+void LearnedCapacityBackupRestore::Backup() {
+    ReadFromSRAM();
+    UpdateAndSave();
+}
+
+void LearnedCapacityBackupRestore::ReadFromStorage() {
+    std::string buffer;
+
+    if (!android::base::ReadFileToString(std::string(kSysCFPersistFile), &buffer)) {
+        LOG(ERROR) << "Cannot read the storage file";
+        return;
+    }
+
+    if (sscanf(buffer.c_str(), "%d", &sw_cap_) < 1)
+        LOG(ERROR) << "data format is wrong in the storage file: " << buffer;
+    else
+        LOG(INFO) << "Storage data: " << buffer;
+}
+
+void LearnedCapacityBackupRestore::SaveToStorage() {
+    char strData[kBuffSize];
+
+    snprintf(strData, kBuffSize, "%d", sw_cap_);
+
+    LOG(INFO) << "Save to Storage: " << strData;
+
+    if (!android::base::WriteStringToFile(strData, std::string(kSysCFPersistFile)))
+        LOG(ERROR) << "Write file error: " << strerror(errno);
+}
+
+void LearnedCapacityBackupRestore::ReadFromSRAM() {
+    std::string buffer;
+
+    if (!android::base::ReadFileToString(std::string(kChgFullFile), &buffer)) {
+        LOG(ERROR) << "Read cycle counter error: " << strerror(errno);
+        return;
+    }
+
+    buffer = android::base::Trim(buffer);
+
+    if (sscanf(buffer.c_str(), "%d", &hw_cap_) < 1)
+        LOG(ERROR) << "Failed to parse SRAM bins: " << buffer;
+    else
+        LOG(INFO) << "SRAM data: " << buffer;
+}
+
+void LearnedCapacityBackupRestore::SaveToSRAM() {
+    char strData[kBuffSize];
+
+    snprintf(strData, kBuffSize, "%d", hw_cap_);
+
+    LOG(INFO) << "Save to SRAM: " << strData;
+
+    if (!android::base::WriteStringToFile(strData, std::string(kChgFullFile)))
+        LOG(ERROR) << "Write data error: " << strerror(errno);
+}
+
+void LearnedCapacityBackupRestore::UpdateAndSave() {
+    bool backup = false;
+    bool restore = false;
+    if (hw_cap_) {
+        if ((hw_cap_ < sw_cap_) || (sw_cap_ == 0)) {
+            sw_cap_ = hw_cap_;
+            backup = true;
+        } else if (hw_cap_ > sw_cap_) {
+            hw_cap_ = sw_cap_;
+            restore = true;
+        }
+    }
+    if (restore)
+        SaveToSRAM();
+    if (backup)
+        SaveToStorage();
+}
+
+}  // namespace health
+}  // namespace marlin
+}  // namespace google
+}  // namespace device
diff --git a/health/LearnedCapacityBackupRestore.h b/health/LearnedCapacityBackupRestore.h
new file mode 100644
index 0000000..4e40ab5
--- /dev/null
+++ b/health/LearnedCapacityBackupRestore.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef DEVICE_GOOGLE_MARLIN_HEALTH_LEARNEDCAPACITYBACKUPRESTORE_H
+#define DEVICE_GOOGLE_MARLIN_HEALTH_LEARNEDCAPACITYBACKUPRESTORE_H
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/strings.h>
+#include <string>
+
+namespace device {
+namespace google {
+namespace marlin {
+namespace health {
+
+class LearnedCapacityBackupRestore {
+  public:
+    LearnedCapacityBackupRestore();
+    void Restore();
+    void Backup();
+
+  private:
+    int sw_cap_;
+    int hw_cap_;
+
+    void ReadFromStorage();
+    void SaveToStorage();
+    void ReadFromSRAM();
+    void SaveToSRAM();
+    void UpdateAndSave();
+};
+
+}  // namespace health
+}  // namespace marlin
+}  // namespace google
+}  // namespace device
+
+#endif  // #ifndef DEVICE_GOOGLE_MARLIN_HEALTH_LEARNEDCAPACITYBACKUPRESTORE_H
diff --git a/health/android.hardware.health@2.0-service.marlin.rc b/health/android.hardware.health@2.0-service.marlin.rc
new file mode 100644
index 0000000..398a24e
--- /dev/null
+++ b/health/android.hardware.health@2.0-service.marlin.rc
@@ -0,0 +1,4 @@
+service vendor.health-hal-2-0 /vendor/bin/hw/android.hardware.health@2.0-service.marlin
+    class hal
+    user system
+    group system
diff --git a/init.common.diag.rc.userdebug b/init.common.diag.rc.userdebug
index 03533e7..e9184af 100644
--- a/init.common.diag.rc.userdebug
+++ b/init.common.diag.rc.userdebug
@@ -4,6 +4,8 @@
     # Modem logging collection
     mkdir /data/vendor/radio 0775 radio radio
     mkdir /data/vendor/radio/diag_logs 0777 system system
+    chmod 777 /data/vendor/radio/diag_logs/cfg
+    chmod 777 /data/vendor/radio/diag_logs/custom_cfg
     # WLAN logging collection
     mkdir /data/vendor/wifi 0777 system system
     mkdir /data/vendor/wifi/cnss_diag 0777 system system
@@ -96,40 +98,47 @@
     setprop sys.usb.state ${sys.usb.config}
 
 on property:persist.sys.cnss.diag_qxdm=true
-    start cnss_diag
+    start vendor.cnss_diag
 
 on property:persist.sys.cnss.diag_qxdm=false
-    stop cnss_diag
+    stop vendor.cnss_diag
 
 on property:persist.sys.cnss.diag_txt=true
-    start cnss_diag_txt
+    start vendor.cnss_diag_txt
 
 on property:persist.sys.cnss.diag_txt=false
-    stop cnss_diag_txt
+    stop vendor.cnss_diag_txt
 
-service cnss_diag /vendor/bin/cnss_diag -q -u
+service vendor.cnss_diag /vendor/bin/cnss_diag -q -u
     class late_start
     user system
     group system
     oneshot
 
-service cnss_diag_txt /vendor/bin/cnss_diag -s -f -m /data/vendor/wifi/cnss_diag/cnss_diag.conf
+service vendor.cnss_diag_txt /vendor/bin/cnss_diag -s -f -m /data/vendor/wifi/cnss_diag/cnss_diag.conf
     class late_start
     user system
     group system
     disabled
     oneshot
 
-on property:persist.sys.crash_rcu=true
+on property:persist.vendor.sys.crash_rcu=true
     write /proc/sys/kernel/panic_on_rcu_stall 1
 
-on property:persist.sys.crash_rcu=false
+on property:persist.vendor.sys.crash_rcu=false
     write /proc/sys/kernel/panic_on_rcu_stall 0
 
+
 on property:sys.logger.bluetooth=true
-   setprop persist.service.bdroid.snooplog true
-   setprop persist.service.bdroid.fwsnoop true
+   setprop persist.vendor.service.bdroid.snooplog true
+   setprop persist.vendor.service.bdroid.fwsnoop true
 
 on property:sys.logger.bluetooth=false
-   setprop persist.service.bdroid.snooplog false
-   setprop persist.service.bdroid.fwsnoop false
+   setprop persist.vendor.service.bdroid.snooplog false
+   setprop persist.vendor.service.bdroid.fwsnoop false
+
+on property:persist.bluetooth.btsnoopenable=true
+   setprop persist.vendor.service.bdroid.soclog true
+
+on property:persist.bluetooth.btsnoopenable=false
+   setprop persist.vendor.service.bdroid.soclog false
diff --git a/init.common.nanohub.rc b/init.common.nanohub.rc
index c7adc20..e8df42e 100644
--- a/init.common.nanohub.rc
+++ b/init.common.nanohub.rc
@@ -2,20 +2,20 @@
     ## ensure correct calibration file permissions
     chown root system /persist/sensorcal.json
     chmod 0640 /persist/sensorcal.json
-    start flash-nanohub-fw
+    start vendor.flash-nanohub-fw
 
 on post-fs-data
     mkdir /data/vendor/sensor
     chown root system /data/vendor/sensor
     chmod 0770 /data/vendor/sensor
 
-service flash-nanohub-fw /vendor/bin/nanoapp_cmd download
+service vendor.flash-nanohub-fw /vendor/bin/nanoapp_cmd download
     oneshot
     disabled
     user root
     group system
 
-service nanohub_slpi /vendor/bin/nanohub_slpi
+service vendor.nanohub_slpi /vendor/bin/nanohub_slpi
     class late_start
     user root
     group system
diff --git a/init.common.rc b/init.common.rc
index b7eda71..4d60550 100644
--- a/init.common.rc
+++ b/init.common.rc
@@ -9,7 +9,7 @@
     write /sys/devices/soc/624000.ufshc/624000.ufshc:ufs_variant/pm_qos_enable 1
     write /sys/module/lpm_levels/parameters/sleep_disabled N
 
-service charger /charger
+service vendor.charger /charger
     class charger
     seclabel u:r:charger:s0
 
@@ -31,7 +31,7 @@
     # We have vendor/ as early mount so we can start qseecomd earlier
     # early mount partions e.g. vendor/ will be mounted in init first stage
     # see b/27805372
-    start qseecomd
+    start vendor.qseecomd
 
     # Support legacy paths
     symlink /sdcard /mnt/sdcard
@@ -102,6 +102,8 @@
     write /proc/sys/vm/page-cluster 0
 
 on fs
+    # Start HW service manager early
+    start hwservicemanager
     mount_all /vendor/etc/fstab.${ro.hardware} --early
 
     # Keeping following partitions outside fstab file. As user may not have
@@ -114,8 +116,8 @@
     restorecon_recursive /persist
     mkdir /persist/data 0700 system system
 
-    # Start HW service manager early
-    start hwservicemanager
+    # for android.hardware.health@2.0-service.marlin cycle count backup
+    mkdir /persist/battery 0700 system system
 
 on post-fs
     symlink /dev/block/platform/soc.0/f9824900.sdhci /dev/block/bootdevice
@@ -124,15 +126,19 @@
 
 on late-fs
     # Start devices by sysfs trigger
-    start devstart_sh
+    start vendor.devstart_sh
 
     # Start services for bootanim
     start surfaceflinger
     start bootanim
-    start hwcomposer-2-1
-    start configstore-hal-1-0
-    start gralloc-2-0
+    start vendor.hwcomposer-2-1
+    start vendor.configstore-hal
+    start vendor.gralloc-2-0
 
+    # Wait for hwservicemanager ready since fsck might be triggered in mount_all --late
+    # In such case, init won't responce the property_set from hwservicemanager and then
+    # cause services for bootanim not running.
+    wait_for_prop hwservicemanager.ready true
     # Mount RW partitions which need run fsck
     mount_all /vendor/etc/fstab.${ro.hardware} --late
 
@@ -146,13 +152,13 @@
     write /sys/block/dm-1/queue/read_ahead_kb 2048
 
     # Start time daemon early so that the system time can be set early
-    start time_daemon
+    start vendor.time_daemon
 
 on post-fs-data
     # We can start netd here before in is launched in common init.rc on zygote-start
     start netd
     # Set sku property
-    start mid_sh
+    start vendor.mid_sh
     # Wait until the system time is set
     wait_for_prop sys.time.set true
 
@@ -195,8 +201,10 @@
 
     # Create the directories used by the Wireless subsystem
     mkdir /data/misc/wifi 0770 wifi wifi
-    mkdir /data/misc/wifi/sockets 0770 wifi wifi
     mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
+    mkdir /data/vendor/wifi 0771 wifi wifi
+    mkdir /data/vendor/wifi/wpa 0770 wifi wifi
+    mkdir /data/vendor/wifi/wpa/sockets 0770 wifi wifi
     mkdir /data/misc/dhcp 0770 dhcp dhcp
     chown dhcp dhcp /data/misc/dhcp
 
@@ -367,6 +375,16 @@
     # wait for devices
     wait_for_prop sys.qcom.devup 1
 
+    # vendor.health-hal needs to be able to RW
+    chown system system /sys/devices/soc/qpnp-fg-17/cycle_counts_bins
+    # HardwareInfo needs to be able to read CC bins
+    chmod 644 /sys/devices/soc/qpnp-fg-17/cycle_counts_bins
+
+    # dumpstate needs to read, vendor.health-hal needs to be able to RW
+    chown system system /sys/devices/soc/qpnp-fg-17/power_supply/bms/charge_full
+    # HardwareInfo needs to be able to read charge_full
+    chmod 644 /sys/devices/soc/qpnp-fg-17/power_supply/bms/charge_full
+
 on boot
     # from init.power.sh
     # disable thermal hotplug to switch governor
@@ -400,7 +418,7 @@
     write /proc/sys/kernel/sched_init_task_load 100
 
     # Exec init.foreground.sh in background
-    start foreground_sh
+    start vendor.foreground_sh
     # add a cpuset for the camera daemon
     # we want all cores for camera
     mkdir /dev/cpuset/camera-daemon
@@ -518,37 +536,42 @@
     # Wifi firmware reload path
     chown wifi wifi /sys/module/wlan/parameters/fwpath
 
+    # QCOM FG SRAM dump for dumpstate
+    chown system system /d/fg_memif/data
+    chown system system /d/fg_memif/count
+    chown system system /d/fg_memif/address
+
 on property:wc_transport.start_hci=true
-    start start_hci_filter
+    start vendor.start_hci_filter
 
 on property:wc_transport.start_hci=false
-    stop start_hci_filter
+    stop vendor.start_hci_filter
 
-service start_hci_filter /vendor/bin/wcnss_filter
+service vendor.start_hci_filter /vendor/bin/wcnss_filter
     class late_start
     user bluetooth
     group bluetooth diag
     disabled
 
 on property:wc_transport.start_root=true
-    start hci_filter_root
+    start vendor.hci_filter_root
 
 on property:wc_transport.start_root=false
-    stop hci_filter_root
+    stop vendor.hci_filter_root
 
-service hci_filter_root /vendor/bin/wcnss_filter
+service vendor.hci_filter_root /vendor/bin/wcnss_filter
     class late_start
     user bluetooth
     group bluetooth diag system
     disabled
 
-service per_mgr /vendor/bin/pm-service
+service vendor.per_mgr /vendor/bin/pm-service
     class core
     user system
     group system
     ioprio rt 4
 
-service per_proxy /vendor/bin/pm-proxy
+service vendor.per_proxy /vendor/bin/pm-proxy
     class core
     user system
     group system
@@ -557,8 +580,8 @@
 on property:ro.build.type=userdebug
    write /sys/class/uio/uio1/device/rtel/rtel 1
 
-on property:init.svc.per_mgr=running
-    start per_proxy
+on property:init.svc.vendor.per_mgr=running
+    start vendor.per_proxy
 
 on property:sys.uidcpupower=*
    write /proc/uid_cpupower/enable 1
@@ -567,40 +590,40 @@
    write /proc/uid_cpupower/enable 0
 
 on property:sys.shutdown.requested=*
-    stop per_proxy
+    stop vendor.per_proxy
     # Disable subsystem restart
     write /sys/module/subsystem_restart/parameters/disable_restart_work 0x9889deed
 
-service qseecomd /vendor/bin/qseecomd
+service vendor.qseecomd /vendor/bin/qseecomd
    class core
    user root
    group root
 
-service thermal-engine /vendor/bin/thermal-engine -c ${sys.qcom.thermalcfg:-/vendor/etc/thermal-engine.conf}
-   class main
+service vendor.thermal-engine /vendor/bin/thermal-engine -c ${sys.qcom.thermalcfg:-/vendor/etc/thermal-engine.conf}
+   class hal
    user root
    group root system diag
    socket thermal-send-client stream 0666 system system
    socket thermal-recv-client stream 0660 system system
    socket thermal-recv-passive-client stream 0666 system system
 
-service time_daemon /vendor/bin/time_daemon
+service vendor.time_daemon /vendor/bin/time_daemon
    class core
    user root
    group root
 
-service adsprpcd /vendor/bin/adsprpcd
+service vendor.adsprpcd /vendor/bin/adsprpcd
    class main
    user media
    group media
 
-service imsqmidaemon /vendor/bin/imsqmidaemon
+service vendor.imsqmidaemon /vendor/bin/imsqmidaemon
     class main
     user system
     socket ims_qmid stream 0660 system radio
     group radio log diag
 
-service imsdatadaemon /vendor/bin/imsdatadaemon
+service vendor.imsdatadaemon /vendor/bin/imsdatadaemon
     class main
     user system
     socket ims_datad stream 0660 system radio
@@ -608,9 +631,9 @@
     disabled
 
 on property:sys.ims.QMI_DAEMON_STATUS=1
-    start imsdatadaemon
+    start vendor.imsdatadaemon
 
-service ims_rtp_daemon /vendor/bin/ims_rtp_daemon
+service vendor.ims_rtp_daemon /vendor/bin/ims_rtp_daemon
    class main
    user system
    socket ims_rtpd stream 0660 system radio
@@ -619,15 +642,15 @@
 
 
 on property:sys.ims.DATA_DAEMON_STATUS=1
-   start ims_rtp_daemon
+   start vendor.ims_rtp_daemon
 
-service ssr_setup /vendor/bin/ssr_setup
+service vendor.ssr_setup /vendor/bin/ssr_setup
     class main
     user root
     group root system
     oneshot
 
-service ss_ramdump /vendor/bin/subsystem_ramdump
+service vendor.ss_ramdump /vendor/bin/subsystem_ramdump
     class main
     user root
     group root system
@@ -637,7 +660,7 @@
     write /sys/module/subsystem_restart/parameters/enable_ramdumps 1
     mkdir /data/vendor/ramdump 761 root system
     mkdir /data/vendor/ssrdump 771 root system
-    start ss_ramdump
+    start vendor.ss_ramdump
 
 on property:persist.sys.ssr.enable_ramdumps=0
     write /sys/module/subsystem_restart/parameters/enable_ramdumps 0
@@ -648,107 +671,105 @@
     group root
     disabled
 
-service cnd /vendor/bin/cnd
+service vendor.cnd /vendor/bin/cnd
     user root
     group root inet wakelock
     class late_start
     socket cnd stream 660 root inet
 
-service irsc_util /vendor/bin/irsc_util "/vendor/etc/sec_config"
+service vendor.irsc_util /vendor/bin/irsc_util "/vendor/etc/sec_config"
     class core
     user root
     oneshot
 
-service rmt_storage /vendor/bin/rmt_storage
+service vendor.rmt_storage /vendor/bin/rmt_storage
     class core
     user root
     group root system wakelock
     ioprio rt 0
     shutdown critical
 
-service port-bridge /vendor/bin/port-bridge
+service vendor.port-bridge /vendor/bin/port-bridge
     class main
     user radio
     group radio system inet
     oneshot
 
-service qmiproxy /vendor/bin/qmiproxy
+service vendor.qmiproxy /vendor/bin/qmiproxy
     class main
     user radio
     group radio diag
     disabled
 
-service netmgrd /vendor/bin/netmgrd
+service vendor.netmgrd /vendor/bin/netmgrd
     class main
     user root
     group root wifi wakelock radio inet
 
 service wpa_supplicant /vendor/bin/hw/wpa_supplicant \
-    -ip2p0 -Dnl80211 -c/data/misc/wifi/p2p_supplicant.conf \
-    -I/vendor/etc/wifi/p2p_supplicant_overlay.conf -N \
-    -iwlan0 -Dnl80211 -c/data/misc/wifi/wpa_supplicant.conf \
-    -I/vendor/etc/wifi/wpa_supplicant_overlay.conf \
-    -O/data/misc/wifi/sockets -puse_p2p_group_interface=1 \
+    -O/data/vendor/wifi/wpa/sockets -puse_p2p_group_interface=1 \
     -g@android:wpa_wlan0
 #   we will start as root and wpa_supplicant will switch to user wifi
 #   after setting up the capabilities required for WEXT
 #   user wifi
 #   group wifi inet keystore
+    interface android.hardware.wifi.supplicant@1.0::ISupplicant default
+    interface android.hardware.wifi.supplicant@1.1::ISupplicant default
     class main
     socket wpa_wlan0 dgram 660 wifi wifi
     disabled
     oneshot
 
-service cnss-daemon /vendor/bin/cnss-daemon -n -l
+service vendor.cnss-daemon /vendor/bin/cnss-daemon -n -l
     class late_start
     user system
     group system inet wifi
 
-service loc_launcher /vendor/bin/loc_launcher
+service vendor.loc_launcher /vendor/bin/loc_launcher
     #loc_launcher will start as root and set its uid to gps
     class late_start
     group gps inet diag wifi
 
-service init-radio-sh /vendor/bin/init.radio.sh
+service vendor.init-radio-sh /vendor/bin/init.radio.sh
     class late_start
     user radio
     group root radio
     oneshot
 
-service msm_irqbalance /vendor/bin/msm_irqbalance -f /vendor/etc/msm_irqbalance.conf
+service vendor.msm_irqbalance /vendor/bin/msm_irqbalance -f /vendor/etc/msm_irqbalance.conf
     socket msm_irqbalance seqpacket 660 root system
     class core
     user root
     group root
     writepid /dev/cpuset/system-background/tasks
 
-service atfwd /vendor/bin/ATFWD-daemon
+service vendor.atfwd /vendor/bin/ATFWD-daemon
     class late_start
     user system
     group system radio
     disabled
 
-service ssr_diag /vendor/bin/ssr_diag
+service vendor.ssr_diag /vendor/bin/ssr_diag
     class late_start
     user system
     group system
     disabled
 
-service diag_mdlog_start /vendor/bin/diag_mdlog
+service vendor.diag_mdlog_start /vendor/bin/diag_mdlog
     class late_start
     user shell
     group system diag sdcard_rw sdcard_r media_rw
     disabled
     oneshot
 
-service diag_mdlog_stop /vendor/bin/diag_mdlog -k
+service vendor.diag_mdlog_stop /vendor/bin/diag_mdlog -k
     class late_start
     user shell
     group system diag sdcard_rw sdcard_r media_rw
     disabled
     oneshot
 
-service perfd /vendor/bin/perfd
+service vendor.perfd /vendor/bin/perfd
    class main
    user root
    group root system
@@ -764,10 +785,10 @@
     keycodes 114 115 116
 
 on property:sys.post_boot.parsed=1
-    start perfd
+    start vendor.perfd
 
 on property:sys.boot_completed=1
-    start power_sh
+    start vendor.power_sh
 
     # Enable UFS powersaving
     write /sys/devices/soc/624000.ufshc/clkscale_enable 1
@@ -775,14 +796,12 @@
     write /sys/devices/soc/624000.ufshc/624000.ufshc:ufs_variant/pm_qos_enable 1
     write /sys/module/lpm_levels/parameters/sleep_disabled N
 
-    # Enable ZRAM on boot_complete
-    swapon_all /vendor/etc/fstab.${ro.hardware}
-
     # update cpusets now that boot is complete and we want better load balancing
     write /dev/cpuset/top-app/cpus 0-3
     write /dev/cpuset/foreground/cpus 0-2
     write /dev/cpuset/background/cpus 0
     write /dev/cpuset/system-background/cpus 0-2
+    write /dev/cpuset/restricted/cpus 0-1
 
     # Update DVR cpusets to runtime values.
     write /dev/cpuset/kernel/cpus 0,1
@@ -802,7 +821,7 @@
 
     # UFS health
     chmod 755 /sys/kernel/debug/ufshcd0
-    chown 644 /sys/kernel/debug/ufshcd0/err_state
+    chmod 644 /sys/kernel/debug/ufshcd0/err_state
     chmod 644 /sys/kernel/debug/ufshcd0/power_mode
     chmod 644 /sys/kernel/debug/ufshcd0/host_regs
     chmod 644 /sys/kernel/debug/ufshcd0/show_hba
@@ -812,41 +831,80 @@
     chmod 644 /sys/kernel/debug/ufshcd0/stats/query_stats
     chmod 644 /sys/kernel/debug/ufshcd0/stats/err_stats
 
+    # Used immediately below
+    trigger sys-boot-completed-set
+
+# We want one opportunity per boot to enable zram, so we
+# use a trigger we fire from the above stanza. If
+# persist.sys.zram_enabled becomes true after boot,
+# we don't want to run swapon_all at that time.
+on sys-boot-completed-set && property:persist.sys.zram_enabled=1
+    swapon_all /vendor/etc/fstab.${ro.hardware}
+
 on property:sys.boot_completed=1 && property:ro.build.type=user
     write /proc/sys/kernel/modules_disabled 1
 
-# battery driver settings for the retail demo environment where
-# the device will be perpertually plugged in to a power source
+## charger driver exposes now finer grain control, map demo mode to those properties
+# demo mode can only be exit wipping data which will also reset the persist properties
 on property:sys.retaildemo.enabled=1
-    write /sys/class/power_supply/battery/full_level_dis_batt_chg 35
+    setprop persist.vendor.charge.stop.level 35
+    setprop persist.vendor.charge.start.level 30
 
+# system will not set the sys.retaildemo.enabled to 0 but this is used to set back to default charging
 on property:sys.retaildemo.enabled=0
-    write /sys/class/power_supply/battery/full_level_dis_batt_chg 100
+    setprop persist.vendor.charge.stop.level 100
+    setprop persist.vendor.charge.start.level 0
 
-service devstart_sh /vendor/bin/init.qcom.devstart.sh
+on property:persist.vendor.charge.stop.level=*
+    write /sys/module/htc_battery/parameters/charge_stop_level ${persist.vendor.charge.stop.level}
+
+on property:persist.vendor.charge.start.level=*
+    write /sys/module/htc_battery/parameters/charge_start_level ${persist.vendor.charge.start.level}
+
+service vendor.devstart_sh /vendor/bin/init.qcom.devstart.sh
     class main
     user root
     group root system
     disabled
     oneshot
 
-service foreground_sh /vendor/bin/init.foreground.sh
+service vendor.foreground_sh /vendor/bin/init.foreground.sh
     class main
     user root
     group root system readproc
     disabled
     oneshot
 
-service power_sh /vendor/bin/init.power.sh
+service vendor.power_sh /vendor/bin/init.power.sh
     class main
     user root
     group root system
     disabled
     oneshot
 
-service mid_sh /vendor/bin/init.mid.sh
+service vendor.mid_sh /vendor/bin/init.mid.sh
     class main
     user root
     group root system
     disabled
     oneshot
+
+# reset thermal-engine when framework dies in VR mode
+on property:init.svc.zygote=restarting && property:sys.qcom.thermalcfg=/vendor/etc/thermal-engine-vr.conf
+   setprop sys.qcom.thermalcfg "/vendor/etc/thermal-engine.conf"
+   restart vendor.thermal-engine
+
+# b/70518189 vDSO experiments
+on property:sys.vdso=*
+   write /sys/module/vdso/parameters/enable_32 1
+   write /sys/module/vdso/parameters/enable_64 1
+
+on property:sys.vdso=false
+   write /sys/module/vdso/parameters/enable_32 0
+   write /sys/module/vdso/parameters/enable_64 0
+
+on property:sys.vdso=64
+   write /sys/module/vdso/parameters/enable_32 0
+
+on property:sys.vdso=32
+   write /sys/module/vdso/parameters/enable_64 0
diff --git a/init.common.usb.rc b/init.common.usb.rc
index 632b649..5874391 100644
--- a/init.common.usb.rc
+++ b/init.common.usb.rc
@@ -10,20 +10,18 @@
     write /sys/class/android_usb/f_mass_storage/lun/nofua 1
 
     write /sys/class/android_usb/android0/f_rndis_qc/rndis_transports BAM2BAM_IPA
-    write /sys/module/g_android/parameters/mtp_tx_req_len 131072
-    write /sys/module/g_android/parameters/mtp_rx_req_len 131072
-    setprop sys.usb.ffs.max_write 524288
-    setprop sys.usb.ffs.max_read 524288
     setprop sys.usb.mtp.device_type 3
     setprop sys.usb.rps_mask 0
 
 on post-fs
-    write /sys/class/android_usb/android0/f_ffs/aliases adb,mtp
+    write /sys/class/android_usb/android0/f_ffs/aliases adb,mtp,ptp
     mkdir /dev/usb-ffs 0775 shell shell
     mkdir /dev/usb-ffs/adb 0770 shell shell
     mount functionfs adb /dev/usb-ffs/adb noatime uid=2000,gid=2000,no_disconnect=1
     mkdir /dev/usb-ffs/mtp 0770 mtp mtp
-    mount functionfs mtp /dev/usb-ffs/mtp noatime rmode=0770,fmode=0660,uid=1024,gid=1024,no_disconnect=1
+    mkdir /dev/usb-ffs/ptp 0770 mtp mtp
+    mount functionfs mtp /dev/usb-ffs/mtp rmode=0770,fmode=0660,uid=1024,gid=1024,no_disconnect=1
+    mount functionfs ptp /dev/usb-ffs/ptp rmode=0770,fmode=0660,uid=1024,gid=1024,no_disconnect=1
 
 on property:sys.usb.config=mtp
     stop adbd
@@ -81,7 +79,7 @@
     write /sys/class/android_usb/android0/bDeviceClass 0
     write /sys/class/android_usb/android0/bDeviceSubClass 0
     write /sys/class/android_usb/android0/bDeviceProtocol 0
-    write /sys/class/android_usb/android0/functions mtp
+    write /sys/class/android_usb/android0/functions ptp
     write /sys/class/android_usb/android0/enable 1
     setprop sys.usb.state ${sys.usb.config}
 
@@ -92,7 +90,7 @@
     write /sys/class/android_usb/android0/bDeviceClass 0
     write /sys/class/android_usb/android0/bDeviceSubClass 0
     write /sys/class/android_usb/android0/bDeviceProtocol 0
-    write /sys/class/android_usb/android0/functions mtp,adb
+    write /sys/class/android_usb/android0/functions ptp,adb
     write /sys/class/android_usb/android0/enable 1
     start adbd
     setprop sys.usb.state ${sys.usb.config}
diff --git a/liblight/Android.mk b/liblight/Android.mk
index 8054149..192a9b6 100644
--- a/liblight/Android.mk
+++ b/liblight/Android.mk
@@ -20,6 +20,7 @@
 LOCAL_SRC_FILES := lights.c
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_SHARED_LIBRARIES := libc libcutils liblog
+LOCAL_HEADER_LIBRARIES := libhardware_headers
 LOCAL_CFLAGS := $(common_flags) -DLOG_TAG=\"qdlights\" -DDEFAULT_LOW_PERSISTENCE_MODE_BRIGHTNESS=$(DEFAULT_LOW_PERSISTENCE_MODE_BRIGHTNESS)
 LOCAL_MODULE := lights.$(TARGET_DEVICE)
 LOCAL_MODULE_TAGS := optional
diff --git a/manifest.xml b/manifest.xml
index 4ee6929..fc6e671 100644
--- a/manifest.xml
+++ b/manifest.xml
@@ -2,7 +2,7 @@
     <hal format="hidl">
         <name>android.hardware.audio</name>
         <transport>hwbinder</transport>
-        <version>2.0</version>
+        <version>4.0</version>
         <interface>
             <name>IDevicesFactory</name>
             <instance>default</instance>
@@ -11,7 +11,7 @@
     <hal format="hidl">
         <name>android.hardware.audio.effect</name>
         <transport>hwbinder</transport>
-        <version>2.0</version>
+        <version>4.0</version>
         <interface>
             <name>IEffectsFactory</name>
             <instance>default</instance>
@@ -65,7 +65,7 @@
     <hal format="hidl">
         <name>android.hardware.configstore</name>
         <transport>hwbinder</transport>
-        <version>1.0</version>
+        <version>1.1</version>
         <interface>
             <name>ISurfaceFlingerConfigs</name>
             <instance>default</instance>
@@ -83,19 +83,19 @@
     <hal format="hidl">
         <name>android.hardware.drm</name>
         <transport>hwbinder</transport>
-        <version>1.1</version>
+        <version>1.0</version>
         <interface>
             <name>ICryptoFactory</name>
-            <instance>widevine</instance>
-            <instance>clearkey</instance>
             <instance>default</instance>
         </interface>
         <interface>
             <name>IDrmFactory</name>
-            <instance>widevine</instance>
-            <instance>clearkey</instance>
             <instance>default</instance>
         </interface>
+        <fqname>@1.1::ICryptoFactory/clearkey</fqname>
+        <fqname>@1.1::IDrmFactory/clearkey</fqname>
+        <fqname>@1.1::ICryptoFactory/widevine</fqname>
+        <fqname>@1.1::IDrmFactory/widevine</fqname>
     </hal>
     <hal format="hidl">
         <name>android.hardware.dumpstate</name>
@@ -150,6 +150,15 @@
             <name>IComposer</name>
             <instance>default</instance>
         </interface>
+      </hal>
+    <hal format="hidl">
+        <name>android.hardware.health</name>
+        <transport>hwbinder</transport>
+        <version>2.0</version>
+        <interface>
+            <name>IHealth</name>
+            <instance>default</instance>
+        </interface>
     </hal>
     <hal format="hidl">
         <name>android.hardware.keymaster</name>
@@ -252,7 +261,7 @@
     <hal format="hidl">
         <name>android.hardware.soundtrigger</name>
         <transport>hwbinder</transport>
-        <version>2.0</version>
+        <version>2.1</version>
         <interface>
             <name>ISoundTriggerHw</name>
             <instance>default</instance>
@@ -297,17 +306,26 @@
     <hal format="hidl">
         <name>android.hardware.wifi</name>
         <transport>hwbinder</transport>
-        <version>1.0</version>
+        <version>1.2</version>
         <interface>
             <name>IWifi</name>
             <instance>default</instance>
         </interface>
     </hal>
     <hal format="hidl">
-        <name>android.hardware.wifi.supplicant</name>
+        <name>android.hardware.wifi.hostapd</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
         <interface>
+            <name>IHostapd</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.wifi.supplicant</name>
+        <transport>hwbinder</transport>
+        <version>1.1</version>
+        <interface>
             <name>ISupplicant</name>
             <instance>default</instance>
         </interface>
diff --git a/marlin/BoardConfig.mk b/marlin/BoardConfig.mk
index 3ad6e4b..3eb1201 100644
--- a/marlin/BoardConfig.mk
+++ b/marlin/BoardConfig.mk
@@ -61,6 +61,7 @@
 BOARD_USES_WIPOWER := true
 BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR := device/google/marlin/bluetooth
 BOARD_HAVE_BLUETOOTH_QCOM := true
+BOARD_USES_SDM845_BLUETOOTH_HAL := true
 BOARD_HAS_QCA_BT_ROME := true
 WCNSS_FILTER_USES_SIBS := true
 
@@ -82,6 +83,7 @@
 TARGET_USERIMAGES_USE_EXT4 := true
 BOARD_BOOTIMAGE_PARTITION_SIZE := 0x02000000
 BOARD_SYSTEMIMAGE_PARTITION_SIZE := 2147483648
+BOARD_SYSTEMIMAGE_EXTFS_INODE_COUNT := 4096
 ifneq ($(findstring aosp_marlin_svelte, $(TARGET_PRODUCT)),)
 BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE := squashfs
 BOARD_SYSTEMIMAGE_JOURNAL_SIZE := 0
@@ -199,9 +201,12 @@
 BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true
 
 ifneq ($(findstring marlin_svelte, $(TARGET_PRODUCT)),)
-BOARD_KERNEL_CMDLINE += mem=1152M
 MALLOC_SVELTE := true
 endif
 
 DEVICE_MANIFEST_FILE := device/google/marlin/manifest.xml
 DEVICE_MATRIX_FILE   := device/google/marlin/compatibility_matrix.xml
+DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE := device/google/marlin/device_framework_matrix.xml
+
+# Exclude serif fonts for saving system.img size.
+EXCLUDE_SERIF_FONTS := true
diff --git a/marlin/overlay/frameworks/base/core/res/res/xml/power_profile.xml b/marlin/overlay/frameworks/base/core/res/res/xml/power_profile.xml
index e8613f5..222c8ad 100644
--- a/marlin/overlay/frameworks/base/core/res/res/xml/power_profile.xml
+++ b/marlin/overlay/frameworks/base/core/res/res/xml/power_profile.xml
@@ -17,10 +17,7 @@
 */
 -->
 <device name="Android">
-    <!-- All values are in mAh except as noted -->
-
-    <!-- Nothing -->
-    <item name="none">0</item>
+    <!-- All values are in mA except as noted -->
 
     <!-- This is the battery capacity in mAh -->
     <item name="battery.capacity">3450</item>
@@ -32,13 +29,24 @@
     </array>
 
     <!-- Power consumption when CPU is suspended -->
-    <item name="cpu.idle">5.734</item>
+    <item name="cpu.suspend">5.734</item>
     <!-- Additional power consumption when CPU is in a kernel idle loop -->
-    <item name="cpu.awake">1.389</item>
+    <item name="cpu.idle">1.389</item>
+
+    <!-- Additional power consumption by CPU excluding cluster and core when
+         running -->
+    <item name="cpu.active">18.760</item>
+
+    <!-- Additional power consumption by CPU cluster0 itself when running
+         excluding cores in it -->
+    <item name="cpu.cluster_power.cluster0">14.748</item>
+    <!-- Additional power consumption by CPU cluster1 itself when running
+         excluding cores in it -->
+    <item name="cpu.cluster_power.cluster1">21.155</item>
 
     <!-- Different CPU speeds as reported in
          /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_frequencies -->
-    <array name="cpu.speeds.cluster0">
+    <array name="cpu.core_speeds.cluster0">
         <value>307200</value> <!-- 307 MHz CPU speed -->
         <value>384000</value> <!-- 384 MHz CPU speed -->
         <value>460800</value> <!-- 460 MHz CPU speed -->
@@ -57,11 +65,10 @@
         <value>1440000</value> <!-- 1440 MHz CPU speed -->
         <value>1516800</value> <!-- 1516 MHz CPU speed -->
         <value>1593600</value> <!-- 1593 MHz CPU speed -->
-        <value>2188800</value> <!-- 2188 MHz CPU speed -->
     </array>
     <!-- Different CPU speeds as reported in
          /sys/devices/system/cpu/cpu2/cpufreq/scaling_available_frequencies -->
-    <array name="cpu.speeds.cluster1">
+    <array name="cpu.core_speeds.cluster1">
         <value>307200</value> <!-- 307 MHz CPU speed -->
         <value>384000</value> <!-- 384 MHz CPU speed -->
         <value>460800</value> <!-- 460 MHz CPU speed -->
@@ -87,59 +94,57 @@
         <value>1977600</value> <!-- 1977 MHz CPU speed -->
         <value>2054400</value> <!-- 2054 MHz CPU speed -->
         <value>2150400</value> <!-- 2150 MHz CPU speed -->
-        <value>2246400</value> <!-- 2246 MHz CPU speed -->
-        <value>2342400</value> <!-- 2342 MHz CPU speed -->
     </array>
-    <!-- Additional power used by a CPU from cluster 0 when running at different
-         speeds. Currently this measurement also includes cluster cost. -->
-    <array name="cpu.active.cluster0">
-        <value>84.302</value> <!-- 307 MHz CPU speed -->
-        <value>87.947</value> <!-- 384 MHz CPU speed -->
-        <value>93.165</value> <!-- 460 MHz CPU speed -->
-        <value>96.653</value> <!-- 537 MHz CPU speed -->
-        <value>101.082</value> <!-- 614 MHz CPU speed -->
-        <value>107.458</value> <!-- 691 MHz CPU speed -->
-        <value>110.659</value> <!-- 768 MHz CPU speed -->
-        <value>115.662</value> <!-- 844 MHz CPU speed -->
-        <value>117.418</value> <!-- 902 MHz CPU speed -->
-        <value>133.042</value> <!-- 979 MHz CPU speed -->
-        <value>140.037</value> <!-- 1056 MHz CPU speed -->
-        <value>153.133</value> <!-- 1132 MHz CPU speed -->
-        <value>163.144</value> <!-- 1209 MHz CPU speed -->
-        <value>178.151</value> <!-- 1286 MHz CPU speed -->
-        <value>192.194</value> <!-- 1363 MHz CPU speed -->
-        <value>199.216</value> <!-- 1440 MHz CPU speed -->
-        <value>218.015</value> <!-- 1516 MHz CPU speed -->
-        <value>238.418</value> <!-- 1593 MHz CPU speed -->
+    <!-- Additional power used by a CPU core from cluster 0 when running at
+         different speeds, excluding cluster and active cost -->
+    <array name="cpu.core_power.cluster0">
+        <value>11.272</value> <!-- 307 MHz CPU speed -->
+        <value>14.842</value> <!-- 384 MHz CPU speed -->
+        <value>18.497</value> <!-- 460 MHz CPU speed -->
+        <value>22.518</value> <!-- 537 MHz CPU speed -->
+        <value>25.967</value> <!-- 614 MHz CPU speed -->
+        <value>31.694</value> <!-- 691 MHz CPU speed -->
+        <value>37.673</value> <!-- 768 MHz CPU speed -->
+        <value>42.859</value> <!-- 844 MHz CPU speed -->
+        <value>46.872</value> <!-- 902 MHz CPU speed -->
+        <value>57.920</value> <!-- 979 MHz CPU speed -->
+        <value>67.561</value> <!-- 1056 MHz CPU speed -->
+        <value>76.303</value> <!-- 1132 MHz CPU speed -->
+        <value>87.613</value> <!-- 1209 MHz CPU speed -->
+        <value>97.045</value> <!-- 1286 MHz CPU speed -->
+        <value>109.544</value> <!-- 1363 MHz CPU speed -->
+        <value>122.054</value> <!-- 1440 MHz CPU speed -->
+        <value>136.345</value> <!-- 1516 MHz CPU speed -->
+        <value>154.435</value> <!-- 1593 MHz CPU speed -->
     </array>
-    <!-- Additional power used by a CPU from cluster 1 when running at different
-         speeds. Currently this measurement also includes cluster cost. -->
-    <array name="cpu.active.cluster1">
-        <value>86.913</value> <!-- 307 MHz CPU speed -->
-        <value>90.690</value> <!-- 384 MHz CPU speed -->
-        <value>94.997</value> <!-- 460 MHz CPU speed -->
-        <value>99.419</value> <!-- 537 MHz CPU speed -->
-        <value>103.335</value> <!-- 614 MHz CPU speed -->
-        <value>109.651</value> <!-- 691 MHz CPU speed -->
-        <value>113.080</value> <!-- 748 MHz CPU speed -->
-        <value>119.471</value> <!-- 825 MHz CPU speed -->
-        <value>123.945</value> <!-- 902 MHz CPU speed -->
-        <value>135.673</value> <!-- 979 MHz CPU speed -->
-        <value>145.747</value> <!-- 1056 MHz CPU speed -->
-        <value>158.779</value> <!-- 1132 MHz CPU speed -->
-        <value>164.459</value> <!-- 1209 MHz CPU speed -->
-        <value>177.707</value> <!-- 1286 MHz CPU speed -->
-        <value>187.637</value> <!-- 1363 MHz CPU speed -->
-        <value>203.735</value> <!-- 1440 MHz CPU speed -->
-        <value>222.029</value> <!-- 1516 MHz CPU speed -->
-        <value>233.814</value> <!-- 1593 MHz CPU speed -->
-        <value>253.472</value> <!-- 1670 MHz CPU speed -->
-        <value>268.039</value> <!-- 1747 MHz CPU speed -->
-        <value>291.519</value> <!-- 1824 MHz CPU speed -->
-        <value>304.670</value> <!-- 1900 MHz CPU speed -->
-        <value>330.694</value> <!-- 1977 MHz CPU speed -->
-        <value>357.964</value> <!-- 2054 MHz CPU speed -->
-        <value>381.248</value> <!-- 2150 MHz CPU speed -->
+    <!-- Additional power used by a CPU core from cluster 1 when running at
+         different speeds, excluding cluster and active cost -->
+    <array name="cpu.core_power.cluster1">
+        <value>7.055</value> <!-- 307 MHz CPU speed -->
+        <value>11.483</value> <!-- 384 MHz CPU speed -->
+        <value>14.979</value> <!-- 460 MHz CPU speed -->
+        <value>19.642</value> <!-- 537 MHz CPU speed -->
+        <value>23.167</value> <!-- 614 MHz CPU speed -->
+        <value>27.479</value> <!-- 691 MHz CPU speed -->
+        <value>31.632</value> <!-- 748 MHz CPU speed -->
+        <value>39.192</value> <!-- 825 MHz CPU speed -->
+        <value>47.817</value> <!-- 902 MHz CPU speed -->
+        <value>55.659</value> <!-- 979 MHz CPU speed -->
+        <value>64.908</value> <!-- 1056 MHz CPU speed -->
+        <value>73.824</value> <!-- 1132 MHz CPU speed -->
+        <value>85.299</value> <!-- 1209 MHz CPU speed -->
+        <value>96.036</value> <!-- 1286 MHz CPU speed -->
+        <value>109.233</value> <!-- 1363 MHz CPU speed -->
+        <value>118.560</value> <!-- 1440 MHz CPU speed -->
+        <value>132.959</value> <!-- 1516 MHz CPU speed -->
+        <value>143.692</value> <!-- 1593 MHz CPU speed -->
+        <value>161.378</value> <!-- 1670 MHz CPU speed -->
+        <value>180.616</value> <!-- 1747 MHz CPU speed -->
+        <value>193.897</value> <!-- 1824 MHz CPU speed -->
+        <value>214.361</value> <!-- 1900 MHz CPU speed -->
+        <value>238.338</value> <!-- 1977 MHz CPU speed -->
+        <value>265.759</value> <!-- 2054 MHz CPU speed -->
+        <value>297.918</value> <!-- 2150 MHz CPU speed -->
     </array>
 
     <!-- Additional power used when screen is turned on at minimum brightness -->
@@ -156,37 +161,51 @@
          minute. -->
     <item name="camera.avg">1152.292</item>
 
-    <!-- Additional power used when audio decoding/encoding via DSP -->
-    <item name="dsp.audio">25.00</item>
+    <!-- Additional power used when video is playing -->
+    <item name="video">50.93</item>
+    <!-- Additional power used when audio is playing -->
+    <item name="audio">75.60</item>
 
-    <!-- Additional power used when GPS is acquiring a signal -->
-    <item name="gps.on">10.23</item>
+    <!-- Idle current for wifi radio in mA.-->
+    <item name="wifi.controller.idle">2</item>
+    <!-- Rx current for wifi radio in mA.-->
+    <item name="wifi.controller.rx">107</item>
+    <!-- Tx current for wifi radio in mA-->
+    <item name="wifi.controller.tx">371</item>
+    <!-- Operating voltage for wifi radio in mV.-->
+    <item name="wifi.controller.voltage">3700</item>
 
-    <!-- Additional power used when Wi-Fi is turned on but not receiving,
-         transmitting, or scanning -->
-    <item name="wifi.on">2</item>
-    <!-- Additional power used when transmitting or receiving over Wi-Fi -->
-    <item name="wifi.active">160</item>
-    <!-- Additional power used when Wi-Fi is scanning for access points -->
-    <item name="wifi.scan">25</item>
-
-    <!-- mA. Current figures based on .0801 s/c and 75.48mA while scanning -->
-    <array name="wifi.batchedscan">
-        <value>0.0002</value> <!-- 1-8/hr -->
-        <value>0.002</value>  <!-- 9-64/hr -->
-        <value>0.02</value>   <!-- 65-512/hr -->
-        <value>0.2</value>    <!-- 513-4,096/hr -->
-        <value>2</value>    <!-- 4097-/hr -->
+    <!-- Cellular modem related values.-->
+    <item name="modem.controller.sleep">0</item>
+    <!-- Idle current for modem in mA.-->
+    <item name="modem.controller.idle">105</item>
+    <!-- Rx current for modem in mA.-->
+    <item name="modem.controller.rx">175</item>
+    <!-- Tx current for modem in mA.-->
+    <array name="modem.controller.tx"> <!-- Strength 0 to 4 -->
+        <value>176</value>
+        <value>216</value>
+        <value>300</value>
+        <value>427</value>
+        <value>604</value>
     </array>
+    <!-- Operating voltage for modem in mV.-->
+    <item name="modem.controller.voltage">3700</item>
 
-    <!-- Additional power used when cellular radio is transmitting/receiving -->
-    <item name="radio.active">300</item>
-    <!-- The current consumed by the radio when it is scanning for a signal -->
-    <item name="radio.scanning">82.2</item>
-    <!-- Current consumed by the radio at different signal strengths, when paging -->
-    <array name="radio.on"> <!-- Strength 0 to BINS-1 -->
-        <value>2.2</value>
-        <value>1.6</value>
+    <!-- GPS related values.-->
+    <array name="gps.signalqualitybased"> <!-- Strength 0 to 1 -->
+        <value>49</value>
+        <value>11</value>
     </array>
+    <item name="gps.voltage">3700</item>
+
+    <!-- Idle current for bluetooth in mA.-->
+    <item name="bluetooth.controller.idle">0.01</item>
+    <!-- Rx current for bluetooth in mA.-->
+    <item name="bluetooth.controller.rx">8</item>
+    <!-- Tx current for bluetooth in mA-->
+    <item name="bluetooth.controller.tx">7</item>
+    <!-- Operating voltage for bluetooth in mV.-->
+    <item name="bluetooth.controller.voltage">3300</item>
 
 </device>
diff --git a/media_codecs_performance.xml b/media_codecs_performance.xml
index 2ad4847..7445b5a 100644
--- a/media_codecs_performance.xml
+++ b/media_codecs_performance.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8" ?>
-<!-- Copyright 2017 The Android Open Source Project
+<!-- Copyright 2018 The Android Open Source Project
 
      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.
@@ -14,139 +14,142 @@
      limitations under the License.
 -->
 
-<!-- Generated file for marlin/sailfish using measurements between OPM1.170817.003/OPM1.170821.001 and OPM1.170911.003 -->
+<!-- Generated file for marlin/sailfish using measurements between PPR1.180405.002 and PPR1.180514.002 -->
 <MediaCodecs>
+    <!-- Measurements between PPR1.180405.004 and PPR1.180514.002 -->
     <Encoders>
         <MediaCodec name="OMX.qcom.video.encoder.h263" type="video/3gpp" update="true">
-            <!-- measured 98%:73-177 med:114/114 FLAKY(57 - 228 < mx=230.8) -->
-            <Limit name="measured-frame-rate-176x144" range="114-114" /> <!-- N=164 v98%=1.6 -->
-            <Limit name="measured-frame-rate-352x288" range="89-89" /> <!-- N=180 v98%=1.4 -->
+            <!-- measured 98%:105-256 med:146/146 FLAKY(73 - 292 < mx=293.2) -->
+            <Limit name="measured-frame-rate-176x144" range="146-146" /> <!-- N=258 v98%=1.6 -->
+            <Limit name="measured-frame-rate-352x288" range="106-106" /> <!-- N=268 v98%=1.4 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.encoder.avc" type="video/avc" update="true">
-            <!-- measured 98%:60-173 med:93/93 FLAKY(47 - 186 < mx=202.2) -->
-            <Limit name="measured-frame-rate-320x240" range="93-102" /> <!-- TWEAKED N=178 v98%=1.7 -->
-            <Limit name="measured-frame-rate-720x480" range="55-55" /> <!-- N=166 v98%=1.4 -->
-            <Limit name="measured-frame-rate-1280x720" range="34-34" /> <!-- N=164 v98%=1.2 -->
-            <Limit name="measured-frame-rate-1920x1080" range="23-23" /> <!-- N=164 v98%=1.2 -->
+            <Limit name="measured-frame-rate-320x240" range="116-116" /> <!-- N=244 v98%=1.5 -->
+            <Limit name="measured-frame-rate-720x480" range="60-60" /> <!-- N=252 v98%=1.3 -->
+            <Limit name="measured-frame-rate-1280x720" range="35-35" /> <!-- N=258 v98%=1.2 -->
+            <Limit name="measured-frame-rate-1920x1080" range="24-24" /> <!-- N=268 v98%=1.3 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.encoder.hevc" type="video/hevc" update="true">
-            <!-- measured 98%:63-168 med:96/97 FLAKY(48 - 194 < mx=204.6) -->
-            <Limit name="measured-frame-rate-320x240" range="96-103" /> <!-- TWEAKED N=178 v98%=1.6 (OPM1.170817.002-) -->
-            <Limit name="measured-frame-rate-720x480" range="56-56" /> <!-- N=164 v98%=1.2 -->
-            <Limit name="measured-frame-rate-1280x720" range="33-33" /> <!-- N=166 v98%=1.3 -->
-            <Limit name="measured-frame-rate-1920x1080" range="24-24" /> <!-- N=166 v98%=1.3 -->
-            <Limit name="measured-frame-rate-3840x2160" range="15-23" /> <!-- N=168 v98%=1.9 -->
+            <Limit name="measured-frame-rate-320x240" range="113-113" /> <!-- N=244 v98%=1.5 -->
+            <Limit name="measured-frame-rate-720x480" range="60-60" /> <!-- N=268 v98%=1.3 -->
+            <Limit name="measured-frame-rate-1280x720" range="35-35" /> <!-- N=254 v98%=1.2 -->
+            <Limit name="measured-frame-rate-1920x1080" range="25-25" /> <!-- N=254 v98%=1.3 -->
+            <Limit name="measured-frame-rate-3840x2160" range="20-25" /> <!-- N=260 v98%=1.4 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.encoder.mpeg4" type="video/mp4v-es" update="true">
-            <Limit name="measured-frame-rate-176x144" range="109-109" /> <!-- N=168 v98%=1.7 -->
-            <Limit name="measured-frame-rate-352x288" range="84-84" /> <!-- N=166 v98%=1.5 -->
-            <Limit name="measured-frame-rate-640x480" range="61-61" /> <!-- N=172 v98%=1.4 (OPM1.170817.001-) -->
+            <Limit name="measured-frame-rate-176x144" range="151-151" /> <!-- N=256 v98%=1.6 -->
+            <!-- measured 98%:69-182 med:99/99 FLAKY(50 - 198 < mx=206.1) -->
+            <Limit name="measured-frame-rate-352x288" range="99-99" /> <!-- N=260 v98%=1.6 (PPR1.180405.002-PPR1.180510.004) -->
+            <Limit name="measured-frame-rate-640x480" range="71-71" /> <!-- N=256 v98%=1.3 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.encoder.vp8" type="video/x-vnd.on2.vp8" update="true">
-            <Limit name="measured-frame-rate-320x180" range="95-95" /> <!-- N=170 v98%=1.6 -->
-            <Limit name="measured-frame-rate-640x360" range="68-68" /> <!-- N=168 v98%=1.4 -->
-            <Limit name="measured-frame-rate-1280x720" range="32-32" /> <!-- N=162 v98%=1.3 -->
-            <Limit name="measured-frame-rate-1920x1080" range="21-21" /> <!-- N=166 v98%=1.4 -->
+            <Limit name="measured-frame-rate-320x180" range="121-121" /> <!-- N=256 v98%=1.4 -->
+            <Limit name="measured-frame-rate-640x360" range="78-78" /> <!-- N=242 v98%=1.4 -->
+            <Limit name="measured-frame-rate-1280x720" range="34-34" /> <!-- N=254 v98%=1.3 -->
+            <!-- measured 98%:18-35 med:24/24 FLAKY(12 - 48 < mx=48.2) -->
+            <Limit name="measured-frame-rate-1920x1080" range="24-25" /> <!-- TWEAKED N=260 v98%=1.4 (PPR1.180405.002-PPR1.180510.004) -->
         </MediaCodec>
         <MediaCodec name="OMX.google.h263.encoder" type="video/3gpp" update="true">
-            <!-- measured 98%:71-309 med:137/135 FLAKY(mn=61.2 < 68 - 310 < mx=394.3) variance:2.1 -->
-            <Limit name="measured-frame-rate-176x144" range="135-198" /> <!-- TWEAKED N=180 -->
+            <Limit name="measured-frame-rate-176x144" range="295-295" /> <!-- N=258 v98%=1.6 -->
         </MediaCodec>
         <MediaCodec name="OMX.google.h264.encoder" type="video/avc" update="true">
-            <!-- measured 98%:163-310 med:268/266 FLAKY(mn=130.7 < 133 - 532) -->
-            <Limit name="measured-frame-rate-320x240" range="261-266" /> <!-- TWEAKED N=174 v98%=1.4 (OPM1.170817.001-) -->
-            <Limit name="measured-frame-rate-720x480" range="126-126" /> <!-- N=168 v98%=1.4 -->
-            <!-- measured 98%:35-90 med:70/72 FLAKY(mn=33.8 < 35 - 144) -->
-            <Limit name="measured-frame-rate-1280x720" range="67-72" /> <!-- TWEAKED N=162 v98%=1.6 -->
-            <!-- measured 98%:26-50 med:35/37 FLAKY(mn=17.1 < 18 - 74) -->
-            <Limit name="measured-frame-rate-1920x1080" range="35-37" /> <!-- N=164 v98%=1.4 -->
+            <!-- measured 98%:112-285 med:242/242 FLAKY(mn=57.1 < 112 - 484) -->
+            <Limit name="measured-frame-rate-320x240" range="114-242" /> <!-- TWEAKED N=260 v98%=1.6 -->
+            <Limit name="measured-frame-rate-720x480" range="111-113" /> <!-- N=256 v98%=1.2 (PPR1.180405.002-PPR1.180510.004) -->
+            <Limit name="measured-frame-rate-1280x720" range="57-65" /> <!-- N=258 v98%=1.3 -->
+            <Limit name="measured-frame-rate-1920x1080" range="31-34" /> <!-- N=268 v98%=1.4 -->
         </MediaCodec>
         <MediaCodec name="OMX.google.mpeg4.encoder" type="video/mp4v-es" update="true">
-            <!-- measured 95%:75-260 med:139/140 FLAKY(mn=60.9 < 70 - 280 < mx=386.7) -->
-            <Limit name="measured-frame-rate-176x144" range="121-140" /> <!-- TWEAKED N=166 v95%=1.9 -->
+            <!-- measured 98%:158-464 med:308/309 FLAKY(mn=143.6 < 154 - 618) -->
+            <Limit name="measured-frame-rate-176x144" range="308-309" /> <!-- N=298 v98%=1.7 -->
         </MediaCodec>
+        <!-- Measurements between PPR1.180405.004 and PPR1.180510.004 -->
         <MediaCodec name="OMX.google.vp8.encoder" type="video/x-vnd.on2.vp8" update="true">
-            <!-- measured 98%:42-145 med:84/85 FLAKY(mn=40.2 < 41 - 176) -->
-            <Limit name="measured-frame-rate-320x180" range="80-88" /> <!-- TWEAKED N=168 v98%=1.8 -->
-            <Limit name="measured-frame-rate-640x360" range="38-38" /> <!-- N=166 v98%=1.3 -->
-            <Limit name="measured-frame-rate-1280x720" range="38-38" /> <!-- N=166 v98%=1.1 -->
-            <Limit name="measured-frame-rate-1920x1080" range="21-21" /> <!-- N=168 v98%=1.2 -->
+            <!-- measured 98%:67-152 med:122/122 FLAKY(mn=50.3 < 61 - 244) -->
+            <Limit name="measured-frame-rate-320x180" range="122-122" /> <!-- N=256 v98%=1.5 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-640x360" range="57-60" /> <!-- N=256 v98%=1.4 (PPR1.180405.002-) -->
+            <Limit name="measured-frame-rate-1280x720" range="34-34" /> <!-- N=256 v98%=1.2 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-1920x1080" range="17-17" /> <!-- N=258 v98%=1.1 (PPR1.180405.002-) -->
         </MediaCodec>
+        <!-- Measurements between PPR1.180329.007 and PPR1.180501.001 -->
         <MediaCodec name="OMX.google.vp9.encoder" type="video/x-vnd.on2.vp9" update="true">
-            <Limit name="measured-frame-rate-320x180" range="142-142" /> <!-- N=166 v98%=1.1 -->
-            <Limit name="measured-frame-rate-640x360" range="52-52" /> <!-- N=164 v98%=1.1 -->
-            <Limit name="measured-frame-rate-1280x720" range="13-13" /> <!-- N=168 v98%=1.1 -->
-            <Limit name="measured-frame-rate-1920x1080" range="5-5" /> <!-- N=132 v98%=1.3 (OPR1.170207.001-OPM1.170814.001) -->
+            <!-- measured 90%:91-136 med:132/113 N=4 -->
+            <Limit name="measured-frame-rate-320x180" range="113-113" /> <!-- v90%=1.2 -->
+            <!-- measured 90%:51-57 med:55/54 N=4 -->
+            <Limit name="measured-frame-rate-640x360" range="54-54" /> <!-- v90%=1.0 -->
+            <!-- measured 90%:16-17 med:17/16 N=4 -->
+            <Limit name="measured-frame-rate-1280x720" range="16-16" /> <!-- v90%=1.0 -->
         </MediaCodec>
     </Encoders>
     <Decoders>
         <MediaCodec name="OMX.qcom.video.decoder.h263" type="video/3gpp" update="true">
-            <Limit name="measured-frame-rate-176x144" range="155-155" /> <!-- N=174 v98%=1.1 -->
-            <Limit name="measured-frame-rate-352x288" range="155-155" /> <!-- N=176 v98%=1.1 (OPM1.170822.001-) -->
+            <Limit name="measured-frame-rate-176x144" range="160-160" /> <!-- N=262 v98%=1.1 -->
+            <Limit name="measured-frame-rate-352x288" range="155-155" /> <!-- N=248 v98%=1.1 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.decoder.avc" type="video/avc" update="true">
-            <Limit name="measured-frame-rate-320x240" range="292-292" /> <!-- N=194 v98%=1.1 -->
-            <Limit name="measured-frame-rate-720x480" range="175-175" /> <!-- N=180 v98%=1.1 -->
-            <Limit name="measured-frame-rate-1280x720" range="327-328" /> <!-- N=178 v98%=1.1 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-1920x1080" range="198-198" /> <!-- N=194 v98%=1.0 -->
+            <Limit name="measured-frame-rate-320x240" range="295-295" /> <!-- N=202 v98%=1.3 -->
+            <Limit name="measured-frame-rate-720x480" range="180-180" /> <!-- N=262 v98%=1.1 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-1280x720" range="327-327" /> <!-- N=248 v98%=1.1 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-1920x1080" range="200-200" /> <!-- N=202 v98%=1.0 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.decoder.hevc" type="video/hevc" update="true">
-            <Limit name="measured-frame-rate-352x288" range="338-338" /> <!-- N=178 v98%=1.2 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-640x360" range="236-236" /> <!-- N=192 v98%=1.1 -->
-            <Limit name="measured-frame-rate-720x480" range="182-182" /> <!-- N=172 v98%=1.1 -->
-            <Limit name="measured-frame-rate-1280x720" range="82-82" /> <!-- N=176 v98%=1.0 (OPM1.170821.002-) -->
-            <Limit name="measured-frame-rate-1920x1080" range="252-252" /> <!-- N=174 v98%=1.0 -->
-            <Limit name="measured-frame-rate-3840x2160" range="69-69" /> <!-- N=190 v98%=1.0 (OPM1.170820.001-) -->
+            <Limit name="measured-frame-rate-352x288" range="342-342" /> <!-- N=232 v98%=1.2 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-640x360" range="237-237" /> <!-- N=202 v98%=1.1 -->
+            <Limit name="measured-frame-rate-720x480" range="181-181" /> <!-- N=202 v98%=1.1 -->
+            <Limit name="measured-frame-rate-1280x720" range="83-83" /> <!-- N=178 v98%=1.0 (PPR1.180327.002-) -->
+            <Limit name="measured-frame-rate-1920x1080" range="253-253" /> <!-- N=262 v98%=1.0 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-3840x2160" range="69-69" /> <!-- N=202 v98%=1.0 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.decoder.mpeg4" type="video/mp4v-es" update="true">
-            <Limit name="measured-frame-rate-176x144" range="151-151" /> <!-- N=176 v98%=1.1 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-480x360" range="149-149" /> <!-- N=174 v98%=1.1 -->
+            <Limit name="measured-frame-rate-176x144" range="151-151" /> <!-- N=247 v98%=1.1 -->
+            <Limit name="measured-frame-rate-480x360" range="152-152" /> <!-- N=262 v98%=1.1 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.decoder.vp8" type="video/x-vnd.on2.vp8" update="true">
-            <Limit name="measured-frame-rate-320x180" range="369-369" /> <!-- N=192 v98%=1.0 (OPM1.170816.001-OPM1.170911.002) -->
-            <Limit name="measured-frame-rate-640x360" range="274-274" /> <!-- N=178 v98%=1.0 -->
-            <Limit name="measured-frame-rate-1280x720" range="367-367" /> <!-- N=164 v98%=1.1 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-1920x1080" range="254-254" /> <!-- N=190 v98%=1.0 (OPM1.170820.001-) -->
+            <Limit name="measured-frame-rate-320x180" range="358-358" /> <!-- N=232 v98%=1.0 -->
+            <Limit name="measured-frame-rate-640x360" range="273-273" /> <!-- N=262 v98%=1.0 -->
+            <Limit name="measured-frame-rate-1280x720" range="356-356" /> <!-- N=248 v98%=1.1 -->
+            <Limit name="measured-frame-rate-1920x1080" range="253-253" /> <!-- N=202 v98%=1.0 (-PPR1.180510.004) -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.decoder.vp9" type="video/x-vnd.on2.vp9" update="true">
-            <Limit name="measured-frame-rate-320x180" range="286-286" /> <!-- N=176 v98%=1.0 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-640x360" range="252-252" /> <!-- N=176 v98%=1.0 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-1280x720" range="305-305" /> <!-- N=174 v98%=1.0 -->
-            <Limit name="measured-frame-rate-1920x1080" range="270-270" /> <!-- N=176 v98%=1.0 (OPM1.170821.002-) -->
-            <Limit name="measured-frame-rate-3840x2160" range="45-45" /> <!-- N=176 v98%=1.0 (OPM1.170822.001-) -->
+            <Limit name="measured-frame-rate-320x180" range="284-285" /> <!-- N=248 v98%=1.0 -->
+            <Limit name="measured-frame-rate-640x360" range="256-256" /> <!-- N=248 v98%=1.0 -->
+            <Limit name="measured-frame-rate-1280x720" range="306-306" /> <!-- N=262 v98%=1.0 -->
+            <Limit name="measured-frame-rate-1920x1080" range="271-271" /> <!-- N=180 v98%=1.0 (PPR1.180403.002-PPR1.180510.004) -->
+            <Limit name="measured-frame-rate-3840x2160" range="45-45" /> <!-- N=248 v98%=1.0 -->
         </MediaCodec>
         <MediaCodec name="OMX.google.h263.decoder" type="video/3gpp" update="true">
-            <Limit name="measured-frame-rate-176x144" range="271-271" /> <!-- N=192 v98%=1.4 -->
+            <!-- measured 98%:191-442 med:258/257 FLAKY(129 - 514 < mx=525.5) -->
+            <Limit name="measured-frame-rate-176x144" range="257-257" /> <!-- N=202 v98%=1.5 -->
         </MediaCodec>
         <MediaCodec name="OMX.google.h264.decoder" type="video/avc" update="true">
-            <!-- measured 98%:295-484 med:427/425 FLAKY(mn=209.4 < 213 - 850) -->
-            <Limit name="measured-frame-rate-320x240" range="425-425" /> <!-- N=180 v98%=1.3 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-720x480" range="194-194" /> <!-- N=162 v98%=1.3 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-1280x720" range="73-73" /> <!-- N=178 v98%=1.2 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-1920x1080" range="33-33" /> <!-- N=162 v98%=1.2 (OPM1.170822.001-) -->
+            <!-- measured 98%:292-593 med:505/505 FLAKY(mn=228.0 < 253 - 1010) -->
+            <Limit name="measured-frame-rate-320x240" range="505-505" /> <!-- N=232 v98%=1.4 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-720x480" range="205-205" /> <!-- N=178 v98%=1.3 (PPR1.180327.002-) -->
+            <Limit name="measured-frame-rate-1280x720" range="73-73" /> <!-- N=262 v98%=1.2 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-1920x1080" range="34-34" /> <!-- N=178 v98%=1.1 (PPR1.180327.002-) -->
         </MediaCodec>
         <MediaCodec name="OMX.google.hevc.decoder" type="video/hevc" update="true">
-            <Limit name="measured-frame-rate-352x288" range="484-484" /> <!-- N=172 v98%=1.1 -->
-            <Limit name="measured-frame-rate-640x360" range="294-294" /> <!-- N=190 v98%=1.1 (OPM1.170820.001-) -->
-            <Limit name="measured-frame-rate-720x480" range="258-259" /> <!-- N=178 v98%=1.2 (OPM1.170822.001-) -->
-            <!-- measured 98%:79-137 med:123/123 FLAKY(mn=53.7 < 62 - 246) -->
-            <Limit name="measured-frame-rate-1280x720" range="107-123" /> <!-- TWEAKED N=172 v98%=1.3 -->
-            <Limit name="measured-frame-rate-1920x1080" range="66-66" /> <!-- N=176 v98%=1.3 (OPM1.170822.001-) -->
+            <Limit name="measured-frame-rate-352x288" range="544-544" /> <!-- N=202 v98%=1.1 -->
+            <Limit name="measured-frame-rate-640x360" range="312-312" /> <!-- N=202 v98%=1.2 -->
+            <Limit name="measured-frame-rate-720x480" range="274-274" /> <!-- N=232 v98%=1.2 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-1280x720" range="124-124" /> <!-- N=202 v98%=1.3 -->
+            <Limit name="measured-frame-rate-1920x1080" range="68-68" /> <!-- N=248 v98%=1.2 (-PPR1.180514.002) -->
         </MediaCodec>
         <MediaCodec name="OMX.google.mpeg4.decoder" type="video/mp4v-es" update="true">
-            <Limit name="measured-frame-rate-176x144" range="337-337" /> <!-- N=192 v98%=1.3 -->
+            <Limit name="measured-frame-rate-176x144" range="314-314" /> <!-- N=202 v98%=1.4 -->
         </MediaCodec>
         <MediaCodec name="OMX.google.vp8.decoder" type="video/x-vnd.on2.vp8" update="true">
-            <Limit name="measured-frame-rate-320x180" range="890-890" /> <!-- N=176 v98%=1.1 (OPM1.170821.002-) -->
-            <Limit name="measured-frame-rate-640x360" range="339-339" /> <!-- N=176 v98%=1.2 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-1280x720" range="77-77" /> <!-- N=194 v98%=1.0 (OPM1.170816.001-OPM1.170911.002) -->
-            <Limit name="measured-frame-rate-1920x1080" range="33-33" /> <!-- N=192 v98%=1.0 (OPM1.170816.001-OPM1.170911.002) -->
+            <Limit name="measured-frame-rate-320x180" range="934-934" /> <!-- N=179 v98%=1.1 (PPR1.180403.002-) -->
+            <Limit name="measured-frame-rate-640x360" range="343-343" /> <!-- N=248 v98%=1.1 (-PPR1.180514.002) -->
+            <!-- measured 90%:76-77 med:77/76 N=2 -->
+            <Limit name="measured-frame-rate-1280x720" range="76-76" /> <!-- v90%=1.0 (PPR1.180510.003-PPR1.180510.003) -->
+            <Limit name="measured-frame-rate-1920x1080" range="34-34" /> <!-- N=232 v98%=1.0 (-PPR1.180514.002) -->
         </MediaCodec>
         <MediaCodec name="OMX.google.vp9.decoder" type="video/x-vnd.on2.vp9" update="true">
-            <Limit name="measured-frame-rate-320x180" range="621-621" /> <!-- N=176 v98%=1.2 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-640x360" range="189-189" /> <!-- N=176 v98%=1.1 (OPM1.170821.002-) -->
-            <Limit name="measured-frame-rate-1280x720" range="86-86" /> <!-- N=178 v98%=1.2 (OPM1.170822.001-) -->
-            <Limit name="measured-frame-rate-1920x1080" range="53-53" /> <!-- N=176 v98%=1.1 (OPM1.170822.001-) -->
+            <Limit name="measured-frame-rate-320x180" range="627-628" /> <!-- N=248 v98%=1.0 -->
+            <Limit name="measured-frame-rate-640x360" range="191-191" /> <!-- N=178 v98%=1.1 (PPR1.180327.002-PPR1.180510.004) -->
+            <Limit name="measured-frame-rate-1280x720" range="91-91" /> <!-- N=232 v98%=1.2 -->
+            <Limit name="measured-frame-rate-1920x1080" range="53-53" /> <!-- N=248 v98%=1.1 -->
         </MediaCodec>
     </Decoders>
 </MediaCodecs>
diff --git a/media_codecs_performance_svelte.xml b/media_codecs_performance_svelte.xml
new file mode 100644
index 0000000..468f35a
--- /dev/null
+++ b/media_codecs_performance_svelte.xml
@@ -0,0 +1,180 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!-- Copyright 2018 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<!-- Generated file for marlin_svelte using measurements between PPR1.180409.003 and PPR1.180514.002 -->
+<MediaCodecs>
+    <Encoders>
+        <!-- Measurements between PPR1.180409.003 and PPR1.180510.004 -->
+        <MediaCodec name="OMX.qcom.video.encoder.h263" type="video/3gpp" update="true">
+            <Limit name="measured-frame-rate-176x144" range="96-96" /> <!-- N=110 v98%=1.4 (-PPR1.180514.002) -->
+            <Limit name="measured-frame-rate-352x288" range="80-80" /> <!-- N=106 v98%=1.5 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.qcom.video.encoder.avc" type="video/avc" update="true">
+            <Limit name="measured-frame-rate-320x240" range="79-80" /> <!-- N=106 v98%=1.5 -->
+            <Limit name="measured-frame-rate-720x480" range="51-51" /> <!-- N=106 v98%=1.4 -->
+            <Limit name="measured-frame-rate-1280x720" range="30-30" /> <!-- N=110 v98%=1.3 -->
+            <Limit name="measured-frame-rate-1920x1080" range="18-21" /> <!-- N=106 v98%=1.4 (-PPR1.180510.004) -->
+        </MediaCodec>
+        <MediaCodec name="OMX.qcom.video.encoder.hevc" type="video/hevc" update="true">
+            <Limit name="measured-frame-rate-320x240" range="82-82" /> <!-- N=106 v98%=1.4 -->
+            <Limit name="measured-frame-rate-720x480" range="50-50" /> <!-- N=106 v98%=1.5 (-PPR1.180510.004) -->
+            <Limit name="measured-frame-rate-1280x720" range="30-30" /> <!-- N=106 v98%=1.3 -->
+            <Limit name="measured-frame-rate-1920x1080" range="18-24" /> <!-- N=106 v98%=1.5 -->
+            <Limit name="measured-frame-rate-3840x2160" range="10-22" /> <!-- N=106 v98%=2.0 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.qcom.video.encoder.mpeg4" type="video/mp4v-es" update="true">
+            <!-- measured 98%:74-158 med:98/98 FLAKY(49 - 196 < mx=220.7) -->
+            <Limit name="measured-frame-rate-176x144" range="98-98" /> <!-- N=106 v98%=1.5 -->
+            <Limit name="measured-frame-rate-352x288" range="73-74" /> <!-- N=106 v98%=1.5 -->
+            <Limit name="measured-frame-rate-640x480" range="58-58" /> <!-- N=106 v98%=1.4 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.qcom.video.encoder.vp8" type="video/x-vnd.on2.vp8" update="true">
+            <Limit name="measured-frame-rate-320x180" range="79-81" /> <!-- N=106 v98%=1.4 -->
+            <Limit name="measured-frame-rate-640x360" range="59-62" /> <!-- N=106 v98%=1.4 -->
+            <Limit name="measured-frame-rate-1280x720" range="30-30" /> <!-- N=106 v98%=1.3 -->
+            <Limit name="measured-frame-rate-1920x1080" range="17-21" /> <!-- N=106 v98%=1.4 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.google.h263.encoder" type="video/3gpp" update="true">
+            <!-- measured 98%:81-373 med:230/234 FLAKY(mn=77.0 < 79 - 468) variance:2.1 -->
+            <Limit name="measured-frame-rate-176x144" range="158-234" /> <!-- N=110 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.google.h264.encoder" type="video/avc" update="true">
+            <!-- measured 98%:94-293 med:220/218 FLAKY(mn=80.5 < 94 - 436) -->
+            <Limit name="measured-frame-rate-320x240" range="188-218" /> <!-- N=108 v98%=1.8 -->
+            <Limit name="measured-frame-rate-720x480" range="74-100" /> <!-- N=106 v98%=1.5 -->
+            <Limit name="measured-frame-rate-1280x720" range="38-64" /> <!-- N=110 v98%=1.8 -->
+            <Limit name="measured-frame-rate-1920x1080" range="16-35" /> <!-- N=106 v98%=1.8 (-PPR1.180510.004) -->
+        </MediaCodec>
+        <MediaCodec name="OMX.google.mpeg4.encoder" type="video/mp4v-es" update="true">
+            <!-- measured 98%:76-389 med:222/222 FLAKY(mn=69.3 < 72 - 446) variance:2.3 -->
+            <Limit name="measured-frame-rate-176x144" range="143-223" /> <!-- N=110 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.google.vp8.encoder" type="video/x-vnd.on2.vp8" update="true">
+            <!-- measured 98%:43-160 med:127/127 FLAKY(mn=41.4 < 43 - 254) -->
+            <Limit name="measured-frame-rate-320x180" range="86-127" /> <!-- N=106 v98%=1.9 -->
+            <Limit name="measured-frame-rate-640x360" range="62-65" /> <!-- N=106 v98%=1.5 -->
+            <Limit name="measured-frame-rate-1280x720" range="30-30" /> <!-- N=106 v98%=1.2 -->
+            <Limit name="measured-frame-rate-1920x1080" range="14-15" /> <!-- N=106 v98%=1.2 -->
+        </MediaCodec>
+    </Encoders>
+    <Decoders>
+        <MediaCodec name="OMX.qcom.video.decoder.h263" type="video/3gpp" update="true">
+            <Limit name="measured-frame-rate-176x144" range="158-158" /> <!-- N=100 v98%=1.1 -->
+            <!-- measured 98%:148-165 med:153/153 N=94 -->
+            <Limit name="measured-frame-rate-352x288" range="153-153" /> <!-- v98%=1.1 -->
+        </MediaCodec>
+        <!-- Measurements between PPR1.180409.003 and PPR1.180510.004 -->
+        <MediaCodec name="OMX.qcom.video.decoder.avc" type="video/avc" update="true">
+            <!-- measured 98%:230-300 med:293/293 N=78 -->
+            <Limit name="measured-frame-rate-320x240" range="293-293" /> <!-- v98%=1.1 -->
+            <Limit name="measured-frame-rate-720x480" range="179-179" /> <!-- N=100 v98%=1.0 (-PPR1.180514.002) -->
+            <!-- measured 98%:306-337 med:326/326 N=94 -->
+            <Limit name="measured-frame-rate-1280x720" range="326-326" /> <!-- v98%=1.0 (-PPR1.180514.002) -->
+            <!-- measured 98%:196-204 med:199/199 N=78 -->
+            <Limit name="measured-frame-rate-1920x1080" range="199-199" /> <!-- v98%=1.0 -->
+        </MediaCodec>
+        <!-- Measurements between PPR1.180409.003 and PPR1.180510.004 -->
+        <MediaCodec name="OMX.qcom.video.decoder.hevc" type="video/hevc" update="true">
+            <!-- measured 98%:335-352 med:341/341 N=98 -->
+            <Limit name="measured-frame-rate-352x288" range="341-341" /> <!-- v98%=1.0 (-PPR1.180514.002) -->
+            <!-- measured 98%:204-240 med:235/235 N=78 -->
+            <Limit name="measured-frame-rate-640x360" range="235-235" /> <!-- v98%=1.1 -->
+            <!-- measured 98%:173-184 med:178/178 N=78 -->
+            <Limit name="measured-frame-rate-720x480" range="178-178" /> <!-- v98%=1.0 -->
+            <!-- measured 98%:82-84 med:83/83 N=62 -->
+            <Limit name="measured-frame-rate-1280x720" range="83-83" /> <!-- v98%=1.0 -->
+            <Limit name="measured-frame-rate-1920x1080" range="253-253" /> <!-- N=100 v98%=1.0 (-PPR1.180514.002) -->
+            <!-- measured 98%:69-69 med:69/69 N=78 -->
+            <Limit name="measured-frame-rate-3840x2160" range="69-69" /> <!-- v98%=1.0 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.qcom.video.decoder.mpeg4" type="video/mp4v-es" update="true">
+            <!-- measured 98%:146-158 med:150/150 N=94 -->
+            <Limit name="measured-frame-rate-176x144" range="150-150" /> <!-- v98%=1.0 -->
+            <Limit name="measured-frame-rate-480x360" range="150-150" /> <!-- N=100 v98%=1.1 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.qcom.video.decoder.vp8" type="video/x-vnd.on2.vp8" update="true">
+            <!-- measured 98%:352-370 med:357/357 N=98 -->
+            <Limit name="measured-frame-rate-320x180" range="357-357" /> <!-- v98%=1.0 -->
+            <Limit name="measured-frame-rate-640x360" range="272-272" /> <!-- N=100 v98%=1.0 -->
+            <!-- measured 98%:326-377 med:357/357 N=94 -->
+            <Limit name="measured-frame-rate-1280x720" range="357-357" /> <!-- v98%=1.1 -->
+            <!-- measured 98%:246-255 med:252/252 N=78 -->
+            <Limit name="measured-frame-rate-1920x1080" range="252-252" /> <!-- v98%=1.0 (-PPR1.180510.004) -->
+        </MediaCodec>
+        <MediaCodec name="OMX.qcom.video.decoder.vp9" type="video/x-vnd.on2.vp9" update="true">
+            <!-- measured 98%:279-294 med:282/282 N=94 -->
+            <Limit name="measured-frame-rate-320x180" range="282-282" /> <!-- v98%=1.0 -->
+            <!-- measured 98%:250-263 med:256/255 N=94 -->
+            <Limit name="measured-frame-rate-640x360" range="255-255" /> <!-- v98%=1.0 -->
+            <Limit name="measured-frame-rate-1280x720" range="306-306" /> <!-- N=100 v98%=1.0 -->
+            <!-- measured 98%:269-274 med:270/270 N=62 -->
+            <Limit name="measured-frame-rate-1920x1080" range="270-270" /> <!-- v98%=1.0 (-PPR1.180510.004) -->
+            <!-- measured 98%:45-46 med:45/45 N=94 -->
+            <Limit name="measured-frame-rate-3840x2160" range="45-45" /> <!-- v98%=1.0 -->
+        </MediaCodec>
+        <!-- Measurements between PPR1.180409.003 and PPR1.180510.004 -->
+        <MediaCodec name="OMX.google.h263.decoder" type="video/3gpp" update="true">
+            <!-- measured 98%:208-343 med:254/256 N=78 -->
+            <Limit name="measured-frame-rate-176x144" range="254-256" /> <!-- v98%=1.3 -->
+        </MediaCodec>
+        <!-- Measurements between PPR1.180409.003 and PPR1.180510.004 -->
+        <MediaCodec name="OMX.google.h264.decoder" type="video/avc" update="true">
+            <!-- measured 98%:275-584 med:492/487 N=98 -->
+            <Limit name="measured-frame-rate-320x240" range="474-487" /> <!-- v98%=1.5 (-PPR1.180514.002) -->
+            <!-- measured 98%:149-234 med:191/190 N=62 -->
+            <Limit name="measured-frame-rate-720x480" range="190-190" /> <!-- v98%=1.3 -->
+            <Limit name="measured-frame-rate-1280x720" range="72-72" /> <!-- N=100 v98%=1.1 (-PPR1.180514.002) -->
+            <!-- measured 98%:28-38 med:34/34 N=62 -->
+            <Limit name="measured-frame-rate-1920x1080" range="34-34" /> <!-- v98%=1.2 -->
+        </MediaCodec>
+        <!-- Measurements between PPR1.180409.003 and PPR1.180510.004 -->
+        <MediaCodec name="OMX.google.hevc.decoder" type="video/hevc" update="true">
+            <!-- measured 98%:446-592 med:552/552 N=77 -->
+            <Limit name="measured-frame-rate-352x288" range="552-552" /> <!-- v98%=1.2 -->
+            <!-- measured 96%:232-332 med:312/313 FLAKY(mn=91.1 < 156 - 626) -->
+            <Limit name="measured-frame-rate-640x360" range="182-313" /> <!-- TWEAKED N=78 v96%=1.2 -->
+            <!-- measured 98%:197-313 med:266/267 N=98 -->
+            <Limit name="measured-frame-rate-720x480" range="266-267" /> <!-- v98%=1.3 (-PPR1.180514.002) -->
+            <!-- measured 96%:85-139 med:121/122 FLAKY(mn=31.8 < 61 - 244) -->
+            <Limit name="measured-frame-rate-1280x720" range="63-122" /> <!-- TWEAKED N=78 v96%=1.3 -->
+            <!-- measured 98%:52-74 med:67/67 N=94 -->
+            <Limit name="measured-frame-rate-1920x1080" range="67-67" /> <!-- v98%=1.2 (-PPR1.180514.002) -->
+        </MediaCodec>
+        <!-- Measurements between PPR1.180409.003 and PPR1.180510.004 -->
+        <MediaCodec name="OMX.google.mpeg4.decoder" type="video/mp4v-es" update="true">
+            <!-- measured 98%:255-505 med:312/313 N=78 FLAKY(156 - 626 < mx=885.7) -->
+            <Limit name="measured-frame-rate-176x144" range="312-443" /> <!-- TWEAKED v98%=1.4 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.google.vp8.decoder" type="video/x-vnd.on2.vp8" update="true">
+            <!-- measured 98%:884-963 med:929/928 N=62 -->
+            <Limit name="measured-frame-rate-320x180" range="928-928" /> <!-- v98%=1.0 (-PPR1.180510.004) -->
+            <!-- measured 98%:331-354 med:340/340 N=94 -->
+            <Limit name="measured-frame-rate-640x360" range="340-340" /> <!-- v98%=1.0 -->
+            <!-- measured 98%:34-35 med:34/34 N=98 -->
+            <Limit name="measured-frame-rate-1920x1080" range="34-34" /> <!-- v98%=1.0 -->
+        </MediaCodec>
+        <MediaCodec name="OMX.google.vp9.decoder" type="video/x-vnd.on2.vp9" update="true">
+            <!-- measured 98%:590-644 med:624/624 N=94 -->
+            <Limit name="measured-frame-rate-320x180" range="624-624" /> <!-- v98%=1.0 -->
+            <!-- measured 98%:176-226 med:191/191 N=62 -->
+            <Limit name="measured-frame-rate-640x360" range="191-191" /> <!-- v98%=1.1 (-PPR1.180510.004) -->
+            <!-- measured 98%:70-98 med:91/91 N=98 -->
+            <Limit name="measured-frame-rate-1280x720" range="91-91" /> <!-- v98%=1.2 -->
+            <!-- measured 98%:47-58 med:53/53 N=94 -->
+            <Limit name="measured-frame-rate-1920x1080" range="53-53" /> <!-- v98%=1.1 -->
+        </MediaCodec>
+    </Decoders>
+</MediaCodecs>
diff --git a/mixer_paths.xml b/mixer_paths.xml
index dd3ee93..4762645 100644
--- a/mixer_paths.xml
+++ b/mixer_paths.xml
@@ -83,6 +83,9 @@
     <ctl name="MultiMedia1 Mixer SLIM_0_TX" value="0" />
     <ctl name="MultiMedia1 Mixer SLIM_4_TX" value="0" />
     <ctl name="MultiMedia1 Mixer AUX_PCM_UL_TX" value="0" />
+    <ctl name="MultiMedia10 Mixer SLIM_0_TX" value="0" />
+    <ctl name="MultiMedia10 Mixer AUX_PCM_UL_TX" value="0" />
+    <ctl name="MultiMedia10 Mixer TERT_MI2S_TX" value="0" />
     <ctl name="SLIMBUS_0_RX Audio Mixer MultiMedia1" value="0" />
     <ctl name="SLIMBUS_0_RX Audio Mixer MultiMedia2" value="0" />
     <ctl name="SLIMBUS_0_RX Audio Mixer MultiMedia3" value="0" />
@@ -113,6 +116,7 @@
     <ctl name="QUAT_MI2S_RX Audio Mixer MultiMedia4" value="0" />
     <ctl name="QUAT_MI2S_RX Audio Mixer MultiMedia5" value="0" />
     <ctl name="QUAT_MI2S_RX Audio Mixer MultiMedia8" value="0" />
+    <ctl name="QUAT_MI2S_RX Audio Mixer MultiMedia10" value="0" />
     <ctl name="MultiMedia6 Mixer SLIM_0_TX" value="0" />
     <ctl name="IIR0 INP0 MUX" value="ZERO" />
     <ctl name="IIR0 INP1 MUX" value="ZERO" />
@@ -364,6 +368,17 @@
     <ctl name="RT_PROXY_1_TX SetCalMode" value="CAL_MODE_NONE" />
     <!-- RT Proxy Cal end -->
 
+    <!-- Incall Recording -->
+    <ctl name="MultiMedia1 Mixer VOC_REC_UL" value="0" />
+    <ctl name="MultiMedia1 Mixer VOC_REC_DL" value="0" />
+    <ctl name="MultiMedia8 Mixer VOC_REC_UL" value="0" />
+    <ctl name="MultiMedia8 Mixer VOC_REC_DL" value="0" />
+    <!-- Incall Recording End -->
+
+    <!-- Incall Music -->
+    <ctl name="Incall_Music Audio Mixer MultiMedia9" value="0" />
+    <!-- Incall Music End -->
+
     <!-- VoWLAN start -->
     <ctl name="SLIM_0_RX_Voice Mixer VoWLAN" value="0" />
     <ctl name="VoWLAN_Tx Mixer SLIM_0_TX_VoWLAN" value="0" />
@@ -1669,4 +1684,85 @@
     <path name="voice-tx">
     </path>
 
+    <path name="incall-rec-uplink">
+        <ctl name="MultiMedia1 Mixer VOC_REC_UL" value="1" />
+    </path>
+
+    <path name="incall-rec-uplink bt-sco">
+        <path name="incall-rec-uplink" />
+    </path>
+
+    <path name="incall-rec-uplink bt-sco-wb">
+        <path name="incall-rec-uplink" />
+    </path>
+
+    <path name="incall-rec-uplink usb-headset-mic">
+        <path name="incall-rec-uplink" />
+    </path>
+
+    <path name="incall-rec-downlink">
+        <ctl name="MultiMedia1 Mixer VOC_REC_DL"  value="1" />
+    </path>
+
+    <path name="incall-rec-downlink bt-sco">
+        <path name="incall-rec-downlink" />
+    </path>
+
+    <path name="incall-rec-downlink bt-sco-wb">
+        <path name="incall-rec-downlink" />
+    </path>
+
+    <path name="incall-rec-downlink usb-headset-mic">
+        <path name="incall-rec-downlink" />
+    </path>
+
+    <path name="incall-rec-uplink-and-downlink">
+        <path name="incall-rec-uplink" />
+        <path name="incall-rec-downlink" />
+    </path>
+
+    <path name="incall-rec-uplink-and-downlink bt-sco">
+        <path name="incall-rec-uplink-and-downlink" />
+    </path>
+
+    <path name="incall-rec-uplink-and-downlink bt-sco-wb">
+        <path name="incall-rec-uplink-and-downlink" />
+    </path>
+
+    <path name="incall-rec-uplink-and-downlink usb-headset-mic">
+        <path name="incall-rec-uplink-and-downlink" />
+    </path>
+
+    <path name="incall-music-uplink">
+        <ctl name="Incall_Music Audio Mixer MultiMedia9" value="1" />
+    </path>
+
+    <path name="incall-music-uplink speaker">
+        <path name="incall-music-uplink" />
+    </path>
+
+    <path name="incall-music-uplink speaker-and-headphones">
+        <path name="incall-music-uplink" />
+    </path>
+
+    <path name="incall-music-uplink bt-sco">
+        <path name="incall-music-uplink" />
+    </path>
+
+    <path name="incall-music-uplink bt-sco-wb">
+        <path name="incall-music-uplink" />
+    </path>
+
+    <path name="incall-music-uplink afe-proxy">
+        <path name="incall-music-uplink" />
+    </path>
+
+    <path name="incall-music-uplink speaker-and-bt-sco">
+        <path name="incall-music-uplink" />
+    </path>
+
+    <path name="incall-music-uplink speaker-and-bt-sco-wb">
+        <path name="incall-music-uplink" />
+    </path>
+
 </mixer>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc302-mnc220/config.xml b/overlay/frameworks/base/core/res/res/values-mcc302-mnc220/config.xml
index ff06869..d5e9470 100644
--- a/overlay/frameworks/base/core/res/res/values-mcc302-mnc220/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc302-mnc220/config.xml
@@ -23,7 +23,7 @@
 
     <!-- Values for TELUS GPS configuration -->
     <string-array translatable="false" name="config_gpsParameters">
-        <item>SUPL_HOST=supl.telusmobility.com</item>
+        <item>SUPL_HOST=supl.google.com</item>
         <item>SUPL_PORT=7275</item>
         <item>XTRA_SERVER_1=http://xtrapath1.izatcloud.net/xtra3grc.bin</item>
         <item>XTRA_SERVER_2=http://xtrapath2.izatcloud.net/xtra3grc.bin</item>
@@ -31,7 +31,7 @@
         <item>NTP_SERVER=north-america.pool.ntp.org</item>
         <item>SUPL_MODE=1</item>
         <item>SUPL_VER=0x20000</item>
-        <item>LPP_PROFILE=2</item>
+        <item>LPP_PROFILE=3</item>
         <item>NMEA_PROVIDER=0</item>
         <item>A_GLONASS_POS_PROTOCOL_SELECT=0</item>
         <item>ERR_ESTIMATE=0</item>
diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml
index a3eced2..7cf85ca 100755
--- a/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/overlay/frameworks/base/core/res/res/values/config.xml
@@ -61,50 +61,113 @@
 
          Must be overridden in platform specific overlays -->
     <integer-array name="config_autoBrightnessLevels">
-        <item>5</item>
+        <item>1</item>
+        <item>2</item>
+        <item>3</item>
+        <item>4</item>
+        <item>8</item>
+        <item>12</item>
         <item>20</item>
-        <item>40</item>
-        <item>100</item>
-        <item>325</item>
-        <item>600</item>
-        <item>1250</item>
-        <item>2200</item>
-        <item>4000</item>
+        <item>33</item>
+        <item>55</item>
+        <item>90</item>
+        <item>148</item>
+        <item>245</item>
+        <item>403</item>
+        <item>665</item>
+        <item>1097</item>
+        <item>1808</item>
+        <item>2981</item>
+        <item>5000</item>
     </integer-array>
 
-    <!-- Array of output values for LCD backlight corresponding to the LUX values
-         in the config_autoBrightnessLevels array.  This array should have size one greater
-         than the size of the config_autoBrightnessLevels array.
-         This must be overridden in platform specific overlays -->
-    <integer-array name="config_autoBrightnessLcdBacklightValues">
-        <item>10</item>   <!-- 0-5 -->
-        <item>33</item>   <!-- 5-20 -->
-        <item>49</item>   <!-- 20-40 -->
-        <item>68</item>   <!-- 40-100 -->
-        <item>87</item>   <!-- 100-325 -->
-        <item>108</item>  <!-- 325-600 -->
-        <item>132</item>  <!-- 600-1250 -->
-        <item>167</item>  <!-- 1250-2200 -->
-        <item>206</item>  <!-- 2200-4000 -->
-        <item>255</item>  <!-- 4000+ -->
+    <!-- Array of desired screen brightness in nits corresponding to the lux values
+         in the config_autoBrightnessLevels array. As with config_screenBrightnessMinimumNits and
+         config_screenBrightnessMaximumNits, the display brightness is defined as the measured
+         brightness of an all-white image.
+
+         If this is defined then:
+            - config_autoBrightnessLcdBacklightValues should not be defined
+            - config_screenBrightnessNits must be defined
+            - config_screenBrightnessBacklight must be defined
+
+         This array should have size one greater than the size of the config_autoBrightnessLevels
+         array. The brightness values must be non-negative and non-decreasing. This must be
+         overridden in platform specific overlays -->
+    <array name="config_autoBrightnessDisplayValuesNits">
+        <item>10.45935</item>   <!-- 0-1 -->
+        <item>29.25559</item>   <!-- 1-2 -->
+        <item>34.240692</item>  <!-- 2-3 -->
+        <item>37.514347</item>  <!-- 3-4 -->
+        <item>40.018696</item>  <!-- 4-8 -->
+        <item>46.885098</item>  <!-- 8-12 -->
+        <item>51.626434</item>  <!-- 12-20 -->
+        <item>58.610405</item>  <!-- 20-33 -->
+        <item>66.890915</item>  <!-- 33-55 -->
+        <item>77.61644</item>   <!-- 55-90 -->
+        <item>90.221886</item>  <!-- 90-148 -->
+        <item>105.80314</item>  <!-- 148-245 -->
+        <item>126.073845</item> <!-- 245-403 -->
+        <item>154.16931</item>  <!-- 403-665 -->
+        <item>191.83717</item>  <!-- 665-1097 -->
+        <item>240.74442</item>  <!-- 1097-1808 -->
+        <item>294.84857</item>  <!-- 1808-2981 -->
+        <item>348.05453</item>  <!-- 2981-5000 -->
+        <item>394.98703</item>  <!-- 5000+ -->
+    </array>
+
+    <!-- An array describing the screen's backlight values corresponding to the brightness
+         values in the config_screenBrightnessNits array.
+
+         This array should be equal in size to config_screenBrightnessBacklight. -->
+    <integer-array name="config_screenBrightnessBacklight">
+        <item>0</item>
+        <item>15</item>
+        <item>30</item>
+        <item>45</item>
+        <item>60</item>
+        <item>75</item>
+        <item>90</item>
+        <item>105</item>
+        <item>120</item>
+        <item>135</item>
+        <item>150</item>
+        <item>165</item>
+        <item>180</item>
+        <item>195</item>
+        <item>210</item>
+        <item>225</item>
+        <item>240</item>
+        <item>255</item>
     </integer-array>
 
-    <!-- Array of output values for button backlight corresponding to the LUX values
-         in the config_autoBrightnessLevels array.  This array should have size one greater
-         than the size of the config_autoBrightnessLevels array.
-         This must be overridden in platform specific overlays -->
-    <integer-array name="config_autoBrightnessButtonBacklightValues">
+    <!-- An array of floats describing the screen brightness in nits corresponding to the backlight
+         values in the config_screenBrightnessBacklight array.  On OLED displays these  values
+         should be measured with an all white image while the display is in the fully on state.
+         Note that this value should *not* reflect the maximum brightness value for any high
+         brightness modes but only the maximum brightness value obtainable in a sustainable manner.
+
+         This array should be equal in size to config_screenBrightnessBacklight -->
+    <array name="config_screenBrightnessNits">
         <item>0</item>
-        <item>0</item>
-        <item>0</item>
-        <item>0</item>
-        <item>0</item>
-        <item>0</item>
-        <item>0</item>
-        <item>0</item>
-        <item>0</item>
-        <item>0</item>
-    </integer-array>
+        <item>26.11</item>
+        <item>50.5</item>
+        <item>74.17</item>
+        <item>96.89</item>
+        <item>118.3</item>
+        <item>139.8</item>
+        <item>162.9</item>
+        <item>189.8</item>
+        <item>217.4</item>
+        <item>240.4</item>
+        <item>265.3</item>
+        <item>288.7</item>
+        <item>316</item>
+        <item>340.8</item>
+        <item>357.9</item>
+        <item>376.2</item>
+        <item>392.9</item>
+    </array>
 
     <!-- Minimum screen brightness allowed by the power manager. -->
     <integer name="config_screenBrightnessDim">6</integer>
@@ -112,6 +175,9 @@
     <!-- Screen brightness when dozing. -->
     <integer name="config_screenBrightnessDoze">13</integer>
 
+    <!-- Whether the display blanks itself when going from a doze to a non-doze state -->
+    <bool name="config_displayBlanksAfterDoze">true</bool>
+
     <!-- Default screen brightness setting.
          Must be in the range specified by minimum and maximum. -->
     <integer name="config_screenBrightnessSettingDefault">98</integer>
@@ -121,7 +187,7 @@
 
     <!-- Minimum screen brightness setting allowed by the power manager.
          The user is forbidden from setting the brightness below this level. -->
-    <integer name="config_screenBrightnessSettingMinimum">4</integer>
+    <integer name="config_screenBrightnessSettingMinimum">1</integer>
 
     <!-- If this is true, the screen will come on when you unplug usb/power/whatever. -->
     <bool name="config_unplugTurnsOnScreen">true</bool>
@@ -202,8 +268,8 @@
     <!-- Common options are [1, 4] for TYPE_WIFI and TYPE_MOBILE_DUN or
          [0,1,5,7] for TYPE_MOBILE, TYPE_WIFI, TYPE_MOBILE_HIPRI and TYPE_BLUETOOTH -->
     <integer-array translatable="false" name="config_tether_upstream_types">
-        <item>0</item>
         <item>1</item>
+        <item>0</item>
         <item>5</item>
         <item>7</item>
     </integer-array>
@@ -310,7 +376,7 @@
 
     <!-- If true, the doze component is not started until after the screen has been turned off
          and the screen off animation has been performed. -->
-    <bool name="config_dozeAfterScreenOff">true</bool>
+    <bool name="config_dozeAfterScreenOffByDefault">true</bool>
 
     <!-- Doze: should the TYPE_PICK_UP_GESTURE sensor be used as a pulse signal. -->
     <bool name="config_dozePulsePickup">true</bool>
@@ -360,18 +426,6 @@
          rmem_min,rmem_def,rmem_max,wmem_min,wmem_def,wmem_max -->
     <string name="config_wifi_tcp_buffers" translatable="false">524288,2097152,4194304,262144,524288,1048576</string>
 
-    <!-- Idle Receive current for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_idle_receive_cur_ma">1</integer>
-
-    <!-- Rx current for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_active_rx_cur_ma">100</integer>
-
-    <!-- Tx current for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_tx_cur_ma">250</integer>
-
-    <!-- Operating volatage for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_operating_voltage_mv">3800</integer>
-
     <!-- Config SoftAP 2G channel list -->
     <string  translatable="false" name="config_wifi_framework_sap_2G_channel_list">6</string>
 
@@ -423,13 +477,13 @@
     <!-- Default list of files pinned by the Pinner Service -->
     <string-array translatable="false" name="config_defaultPinnerServiceFiles">
         <item>"/system/framework/arm64/boot-framework.oat"</item>
-        <item>"/system/framework/arm64/boot-framework.vdex"</item>
+        <item>"/system/framework/boot-framework.vdex"</item>
         <item>"/system/framework/oat/arm64/services.odex"</item>
         <item>"/system/framework/oat/arm64/services.vdex"</item>
         <item>"/system/framework/arm64/boot.oat"</item>
-        <item>"/system/framework/arm64/boot.vdex"</item>
+        <item>"/system/framework/boot.vdex"</item>
         <item>"/system/framework/arm64/boot-core-libart.oat"</item>
-        <item>"/system/framework/arm64/boot-core-libart.vdex"</item>
+        <item>"/system/framework/boot-core-libart.vdex"</item>
     </string-array>
 
     <!-- Should the pinner service pin the Camera application? -->
diff --git a/overlay/packages/apps/Bluetooth/res/values/config.xml b/overlay/packages/apps/Bluetooth/res/values/config.xml
index 0e8c392..9b897f8 100644
--- a/overlay/packages/apps/Bluetooth/res/values/config.xml
+++ b/overlay/packages/apps/Bluetooth/res/values/config.xml
@@ -32,6 +32,5 @@
     <bool name="profile_supported_avrcp_controller">false</bool>
     <bool name="profile_supported_a2dp_sink">false</bool>
     <bool name="profile_supported_sap">true</bool>
-    <bool name="profile_supported_hearing_aid">true</bool>
 </resources>
 
diff --git a/overlay/packages/services/Telecomm/res/values/config.xml b/overlay/packages/services/Telecomm/res/values/config.xml
new file mode 100644
index 0000000..500a943
--- /dev/null
+++ b/overlay/packages/services/Telecomm/res/values/config.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2018 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<resources>
+    <!-- Marlin/sailfish vibration hardware does not respond well to the new vibration pattern. -->
+    <bool name="use_simple_vibration_pattern">true</bool>
+</resources>
+
diff --git a/overlay/packages/services/Telephony/res/values/config.xml b/overlay/packages/services/Telephony/res/values/config.xml
index 430d16e..5f04205 100644
--- a/overlay/packages/services/Telephony/res/values/config.xml
+++ b/overlay/packages/services/Telephony/res/values/config.xml
@@ -29,4 +29,9 @@
     <bool name="hac_enabled">true</bool>
     <!-- Allow handover from telephony calls to another ConnectionService. -->
     <bool name="config_support_handover_from">true</bool>
+    <!-- This device supports the AudioManager Telephony audio device and output onto this
+         device using {@link AudioDeviceInfo#TYPE_TELEPHONY}.
+         This is used to support carriers which generate a recording tone to the remote party
+         when a call recording app is in use. -->
+    <bool name="config_support_telephony_audio_device">true</bool>
 </resources>
diff --git a/permissions/privapp-permissions-marlin.xml b/permissions/privapp-permissions-marlin.xml
new file mode 100644
index 0000000..55675cb
--- /dev/null
+++ b/permissions/privapp-permissions-marlin.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<permissions>
+    <privapp-permissions package="com.qualcomm.qcrilmsgtunnel">
+        <permission name="android.permission.INTERACT_ACROSS_USERS"/>
+    </privapp-permissions>
+
+    <privapp-permissions package="com.quicinc.cne.CNEService">
+        <permission name="android.permission.PACKET_KEEPALIVE_OFFLOAD"/>
+    </privapp-permissions>
+
+</permissions>
\ No newline at end of file
diff --git a/power/Android.mk b/power/Android.mk
index 3168ad6..06b2a8e 100644
--- a/power/Android.mk
+++ b/power/Android.mk
@@ -39,6 +39,8 @@
     LOCAL_CFLAGS += -DEXTRA_POWERHAL_HINTS
 endif
 
+LOCAL_HEADER_LIBRARIES := libhardware_headers
+
 LOCAL_SHARED_LIBRARIES := \
     libbase \
     libcutils \
diff --git a/power/Power.cpp b/power/Power.cpp
index 82b450d..2a5534c 100644
--- a/power/Power.cpp
+++ b/power/Power.cpp
@@ -53,7 +53,7 @@
 }
 
 Return<void> Power::powerHint(PowerHint hint, int32_t data) {
-    if (android::base::GetProperty("init.svc.perfd", "") != "running") {
+    if (android::base::GetProperty("init.svc.vendor.perfd", "") != "running") {
         ALOGW("perfd is not started");
         return Void();
     }
diff --git a/power/android.hardware.power@1.1-service.marlin.rc b/power/android.hardware.power@1.1-service.marlin.rc
index 69407de..4cb3af6 100644
--- a/power/android.hardware.power@1.1-service.marlin.rc
+++ b/power/android.hardware.power@1.1-service.marlin.rc
@@ -1,4 +1,4 @@
-service power-hal-1-1 /vendor/bin/hw/android.hardware.power@1.1-service.marlin
+service vendor.power-hal-1-1 /vendor/bin/hw/android.hardware.power@1.1-service.marlin
     class hal
     user system
     group system
diff --git a/power/power-helper.c b/power/power-helper.c
index e9daaeb..07b32f3 100644
--- a/power/power-helper.c
+++ b/power/power-helper.c
@@ -32,11 +32,13 @@
 #include <errno.h>
 #include <inttypes.h>
 #include <string.h>
+#include <unistd.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <dlfcn.h>
 #include <stdlib.h>
+#include <time.h>
 
 #define LOG_TAG "QCOM PowerHAL"
 #include <utils/Log.h>
@@ -129,112 +131,6 @@
     }
 }
 
-static void process_video_decode_hint(void *metadata)
-{
-    char governor[80];
-    struct video_decode_metadata_t video_decode_metadata;
-
-    if (get_scaling_governor(governor, sizeof(governor)) == -1) {
-        ALOGE("Can't obtain scaling governor.");
-
-        return;
-    }
-
-    if (metadata) {
-        ALOGV("Processing video decode hint. Metadata: %s", (char *)metadata);
-    }
-
-    /* Initialize encode metadata struct fields. */
-    memset(&video_decode_metadata, 0, sizeof(struct video_decode_metadata_t));
-    video_decode_metadata.state = -1;
-    video_decode_metadata.hint_id = DEFAULT_VIDEO_DECODE_HINT_ID;
-
-    if (metadata) {
-        if (parse_video_decode_metadata((char *)metadata, &video_decode_metadata) ==
-            -1) {
-            ALOGE("Error occurred while parsing metadata.");
-            return;
-        }
-    } else {
-        return;
-    }
-
-    if (video_decode_metadata.state == 1) {
-        if ((strncmp(governor, ONDEMAND_GOVERNOR, strlen(ONDEMAND_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(ONDEMAND_GOVERNOR))) {
-            int resource_values[] = {THREAD_MIGRATION_SYNC_OFF};
-
-            perform_hint_action(video_decode_metadata.hint_id,
-                    resource_values, sizeof(resource_values)/sizeof(resource_values[0]));
-        } else if ((strncmp(governor, INTERACTIVE_GOVERNOR, strlen(INTERACTIVE_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(INTERACTIVE_GOVERNOR))) {
-            int resource_values[] = {TR_MS_30, HISPEED_LOAD_90, HS_FREQ_1026, THREAD_MIGRATION_SYNC_OFF};
-
-            perform_hint_action(video_decode_metadata.hint_id,
-                    resource_values, sizeof(resource_values)/sizeof(resource_values[0]));
-        }
-    } else if (video_decode_metadata.state == 0) {
-        if ((strncmp(governor, ONDEMAND_GOVERNOR, strlen(ONDEMAND_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(ONDEMAND_GOVERNOR))) {
-        } else if ((strncmp(governor, INTERACTIVE_GOVERNOR, strlen(INTERACTIVE_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(INTERACTIVE_GOVERNOR))) {
-            undo_hint_action(video_decode_metadata.hint_id);
-        }
-    }
-}
-
-static void process_video_encode_hint(void *metadata)
-{
-    char governor[80];
-    struct video_encode_metadata_t video_encode_metadata;
-
-    if (get_scaling_governor(governor, sizeof(governor)) == -1) {
-        ALOGE("Can't obtain scaling governor.");
-
-        return;
-    }
-
-    /* Initialize encode metadata struct fields. */
-    memset(&video_encode_metadata, 0, sizeof(struct video_encode_metadata_t));
-    video_encode_metadata.state = -1;
-    video_encode_metadata.hint_id = DEFAULT_VIDEO_ENCODE_HINT_ID;
-
-    if (metadata) {
-        if (parse_video_encode_metadata((char *)metadata, &video_encode_metadata) ==
-            -1) {
-            ALOGE("Error occurred while parsing metadata.");
-            return;
-        }
-    } else {
-        return;
-    }
-
-    if (video_encode_metadata.state == 1) {
-        if ((strncmp(governor, ONDEMAND_GOVERNOR, strlen(ONDEMAND_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(ONDEMAND_GOVERNOR))) {
-            int resource_values[] = {IO_BUSY_OFF, SAMPLING_DOWN_FACTOR_1, THREAD_MIGRATION_SYNC_OFF};
-
-            perform_hint_action(video_encode_metadata.hint_id,
-                resource_values, sizeof(resource_values)/sizeof(resource_values[0]));
-        } else if ((strncmp(governor, INTERACTIVE_GOVERNOR, strlen(INTERACTIVE_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(INTERACTIVE_GOVERNOR))) {
-            int resource_values[] = {TR_MS_30, HISPEED_LOAD_90, HS_FREQ_1026, THREAD_MIGRATION_SYNC_OFF,
-                INTERACTIVE_IO_BUSY_OFF};
-
-            perform_hint_action(video_encode_metadata.hint_id,
-                    resource_values, sizeof(resource_values)/sizeof(resource_values[0]));
-        }
-    } else if (video_encode_metadata.state == 0) {
-        if ((strncmp(governor, ONDEMAND_GOVERNOR, strlen(ONDEMAND_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(ONDEMAND_GOVERNOR))) {
-            undo_hint_action(video_encode_metadata.hint_id);
-        } else if ((strncmp(governor, INTERACTIVE_GOVERNOR, strlen(INTERACTIVE_GOVERNOR)) == 0) &&
-                (strlen(governor) == strlen(INTERACTIVE_GOVERNOR))) {
-            undo_hint_action(video_encode_metadata.hint_id);
-        }
-    }
-}
-
 int __attribute__ ((weak)) power_hint_override(power_hint_t UNUSED(hint),
         void * UNUSED(data))
 {
@@ -448,12 +344,6 @@
             }
         }
         break;
-        case POWER_HINT_VIDEO_ENCODE:
-            process_video_encode_hint(data);
-        break;
-        case POWER_HINT_VIDEO_DECODE:
-            process_video_decode_hint(data);
-        break;
         default:
         break;
     }
diff --git a/power/utils.c b/power/utils.c
index ce5d369..bd3f354 100644
--- a/power/utils.c
+++ b/power/utils.c
@@ -33,6 +33,7 @@
 #include <errno.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
 #include <sys/stat.h>
 
 #include "utils.h"
diff --git a/sailfish/BoardConfig.mk b/sailfish/BoardConfig.mk
index f4d835f..ed726bb 100644
--- a/sailfish/BoardConfig.mk
+++ b/sailfish/BoardConfig.mk
@@ -56,6 +56,7 @@
 BOARD_USES_WIPOWER := true
 BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR := device/google/marlin/bluetooth
 BOARD_HAVE_BLUETOOTH_QCOM := true
+BOARD_USES_SDM845_BLUETOOTH_HAL := true
 BOARD_HAS_QCA_BT_ROME := true
 WCNSS_FILTER_USES_SIBS := true
 
@@ -77,6 +78,7 @@
 TARGET_USERIMAGES_USE_EXT4 := true
 BOARD_BOOTIMAGE_PARTITION_SIZE := 0x02000000
 BOARD_SYSTEMIMAGE_PARTITION_SIZE := 2147483648
+BOARD_SYSTEMIMAGE_EXTFS_INODE_COUNT := 4096
 BOARD_USERDATAIMAGE_PARTITION_SIZE := 10737418240
 BOARD_PERSISTIMAGE_PARTITION_SIZE := 33554432
 BOARD_PERSISTIMAGE_FILE_SYSTEM_TYPE := ext4
@@ -190,3 +192,7 @@
 
 DEVICE_MANIFEST_FILE := device/google/marlin/manifest.xml
 DEVICE_MATRIX_FILE   := device/google/marlin/compatibility_matrix.xml
+DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE := device/google/marlin/device_framework_matrix.xml
+
+# Exclude serif fonts for saving system.img size.
+EXCLUDE_SERIF_FONTS := true
diff --git a/sailfish/overlay/frameworks/base/core/res/res/values/config.xml b/sailfish/overlay/frameworks/base/core/res/res/values/config.xml
index e651708..fba0517 100644
--- a/sailfish/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/sailfish/overlay/frameworks/base/core/res/res/values/config.xml
@@ -29,4 +29,70 @@
     <!-- Default screen brightness for VR setting. Default value: 0x58 => 88. -->
     <integer name="config_screenBrightnessForVrSettingDefault">88</integer>
 
+    <!-- Array of light sensor LUX values to define our levels for auto backlight brightness support.
+         The N entries of this array define N  1 zones as follows:
+
+         Zone 0:        0 <= LUX < array[0]
+         Zone 1:        array[0] <= LUX < array[1]
+         ...
+         Zone N:        array[N - 1] <= LUX < array[N]
+         Zone N + 1     array[N] <= LUX < infinity
+
+         Must be overridden in platform specific overlays -->
+    <integer-array name="config_autoBrightnessLevels">
+        <item>1</item>
+        <item>2</item>
+        <item>3</item>
+        <item>4</item>
+        <item>8</item>
+        <item>12</item>
+        <item>20</item>
+        <item>33</item>
+        <item>55</item>
+        <item>90</item>
+        <item>148</item>
+        <item>245</item>
+        <item>403</item>
+        <item>665</item>
+        <item>1097</item>
+        <item>1808</item>
+        <item>2981</item>
+        <item>5000</item>
+    </integer-array>
+
+    <!-- Array of desired screen brightness in nits corresponding to the lux values
+         in the config_autoBrightnessLevels array. As with config_screenBrightnessMinimumNits and
+         config_screenBrightnessMaximumNits, the display brightness is defined as the measured
+         brightness of an all-white image.
+
+         If this is defined then:
+            - config_autoBrightnessLcdBacklightValues should not be defined
+            - config_screenBrightnessNits must be defined
+            - config_screenBrightnessBacklight must be defined
+
+         This array should have size one greater than the size of the config_autoBrightnessLevels
+         array. The brightness values must be non-negative and non-decreasing. This must be
+         overridden in platform specific overlays -->
+    <array name="config_autoBrightnessDisplayValuesNits">
+        <item>12.13185</item>  <!-- 0-1 -->
+        <item>25.56824</item>  <!-- 1-2 -->
+        <item>30.037292</item> <!-- 2-3 -->
+        <item>33.05888</item>  <!-- 3-4 -->
+        <item>35.40135</item>  <!-- 4-8 -->
+        <item>41.798496</item> <!-- 8-12 -->
+        <item>46.034</item>    <!-- 12-20 -->
+        <item>51.96499</item>  <!-- 20-33 -->
+        <item>58.488487</item> <!-- 33-55 -->
+        <item>66.69877</item>  <!-- 55-90 -->
+        <item>76.42568</item>  <!-- 90-148 -->
+        <item>88.60913</item>  <!-- 148-245 -->
+        <item>105.12556</item> <!-- 245-403 -->
+        <item>127.29556</item> <!-- 403-665 -->
+        <item>158.43834</item> <!-- 665-1097 -->
+        <item>206.0883</item>  <!-- 1097-1808 -->
+        <item>261.9702</item>  <!-- 1808-2981 -->
+        <item>325.19897</item> <!-- 2981-5000 -->
+        <item>395.4899</item>  <!-- 5000+ -->
+    </array>
+
 </resources>
diff --git a/sailfish/overlay/frameworks/base/core/res/res/xml/power_profile.xml b/sailfish/overlay/frameworks/base/core/res/res/xml/power_profile.xml
index f2d5282..04df0f8 100644
--- a/sailfish/overlay/frameworks/base/core/res/res/xml/power_profile.xml
+++ b/sailfish/overlay/frameworks/base/core/res/res/xml/power_profile.xml
@@ -17,10 +17,7 @@
 */
 -->
 <device name="Android">
-    <!-- All values are in mAh except as noted -->
-
-    <!-- Nothing -->
-    <item name="none">0</item>
+    <!-- All values are in mA except as noted -->
 
     <!-- This is the battery capacity in mAh -->
     <item name="battery.capacity">2770</item>
@@ -32,13 +29,24 @@
     </array>
 
     <!-- Power consumption when CPU is suspended -->
-    <item name="cpu.idle">5.837</item>
+    <item name="cpu.suspend">5.837</item>
     <!-- Additional power consumption when CPU is in a kernel idle loop -->
-    <item name="cpu.awake">1.334</item>
+    <item name="cpu.idle">1.334</item>
+
+    <!-- Additional power consumption by CPU excluding cluster and core when
+         running -->
+    <item name="cpu.active">18.760</item>
+
+    <!-- Additional power consumption by CPU cluster0 itself when running
+         excluding cores in it -->
+    <item name="cpu.cluster_power.cluster0">14.748</item>
+    <!-- Additional power consumption by CPU cluster1 itself when running
+         excluding cores in it -->
+    <item name="cpu.cluster_power.cluster1">21.155</item>
 
     <!-- Different CPU speeds as reported in
          /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_frequencies -->
-    <array name="cpu.speeds.cluster0">
+    <array name="cpu.core_speeds.cluster0">
         <value>307200</value> <!-- 307 MHz CPU speed -->
         <value>384000</value> <!-- 384 MHz CPU speed -->
         <value>460800</value> <!-- 460 MHz CPU speed -->
@@ -57,11 +65,10 @@
         <value>1440000</value> <!-- 1440 MHz CPU speed -->
         <value>1516800</value> <!-- 1516 MHz CPU speed -->
         <value>1593600</value> <!-- 1593 MHz CPU speed -->
-        <value>2188800</value> <!-- 2188 MHz CPU speed -->
     </array>
     <!-- Different CPU speeds as reported in
          /sys/devices/system/cpu/cpu2/cpufreq/scaling_available_frequencies -->
-    <array name="cpu.speeds.cluster1">
+    <array name="cpu.core_speeds.cluster1">
         <value>307200</value> <!-- 307 MHz CPU speed -->
         <value>384000</value> <!-- 384 MHz CPU speed -->
         <value>460800</value> <!-- 460 MHz CPU speed -->
@@ -87,60 +94,58 @@
         <value>1977600</value> <!-- 1977 MHz CPU speed -->
         <value>2054400</value> <!-- 2054 MHz CPU speed -->
         <value>2150400</value> <!-- 2150 MHz CPU speed -->
-        <value>2246400</value> <!-- 2246 MHz CPU speed -->
-        <value>2342400</value> <!-- 2342 MHz CPU speed -->
     </array>
 
-    <!-- Additional power used by a CPU from cluster 0 when running at different
-         speeds. Currently this measurement also includes cluster cost. -->
-    <array name="cpu.active.cluster0">
-        <value>85.469</value> <!-- 307 MHz CPU speed -->
-        <value>89.077</value> <!-- 384 MHz CPU speed -->
-        <value>93.613</value> <!-- 460 MHz CPU speed -->
-        <value>99.484</value> <!-- 537 MHz CPU speed -->
-        <value>104.354</value> <!-- 614 MHz CPU speed -->
-        <value>110.456</value> <!-- 691 MHz CPU speed -->
-        <value>117.363</value> <!-- 768 MHz CPU speed -->
-        <value>124.483</value> <!-- 844 MHz CPU speed -->
-        <value>131.595</value> <!-- 902 MHz CPU speed -->
-        <value>142.148</value> <!-- 979 MHz CPU speed -->
-        <value>148.988</value> <!-- 1056 MHz CPU speed -->
-        <value>161.208</value> <!-- 1132 MHz CPU speed -->
-        <value>172.076</value> <!-- 1209 MHz CPU speed -->
-        <value>180.408</value> <!-- 1286 MHz CPU speed -->
-        <value>194.546</value> <!-- 1363 MHz CPU speed -->
-        <value>208.077</value> <!-- 1440 MHz CPU speed -->
-        <value>230.631</value> <!-- 1516 MHz CPU speed -->
-        <value>240.685</value> <!-- 1593 MHz CPU speed -->
+    <!-- Additional power used by a CPU core from cluster 0 when running at
+         different speeds, excluding cluster and active cost -->
+    <array name="cpu.core_power.cluster0">
+        <value>11.272</value> <!-- 307 MHz CPU speed -->
+        <value>14.842</value> <!-- 384 MHz CPU speed -->
+        <value>18.497</value> <!-- 460 MHz CPU speed -->
+        <value>22.518</value> <!-- 537 MHz CPU speed -->
+        <value>25.967</value> <!-- 614 MHz CPU speed -->
+        <value>31.694</value> <!-- 691 MHz CPU speed -->
+        <value>37.673</value> <!-- 768 MHz CPU speed -->
+        <value>42.859</value> <!-- 844 MHz CPU speed -->
+        <value>46.872</value> <!-- 902 MHz CPU speed -->
+        <value>57.920</value> <!-- 979 MHz CPU speed -->
+        <value>67.561</value> <!-- 1056 MHz CPU speed -->
+        <value>76.303</value> <!-- 1132 MHz CPU speed -->
+        <value>87.613</value> <!-- 1209 MHz CPU speed -->
+        <value>97.045</value> <!-- 1286 MHz CPU speed -->
+        <value>109.544</value> <!-- 1363 MHz CPU speed -->
+        <value>122.054</value> <!-- 1440 MHz CPU speed -->
+        <value>136.345</value> <!-- 1516 MHz CPU speed -->
+        <value>154.435</value> <!-- 1593 MHz CPU speed -->
     </array>
-    <!-- Additional power used by a CPU from cluster 1 when running at different
-         speeds. Currently this measurement also includes cluster cost. -->
-    <array name="cpu.active.cluster1">
-        <value>88.153</value> <!-- 307 MHz CPU speed -->
-        <value>91.961</value> <!-- 384 MHz CPU speed -->
-        <value>95.946</value> <!-- 460 MHz CPU speed -->
-        <value>100.114</value> <!-- 537 MHz CPU speed -->
-        <value>105.312</value> <!-- 614 MHz CPU speed -->
-        <value>109.813</value> <!-- 691 MHz CPU speed -->
-        <value>117.502</value> <!-- 748 MHz CPU speed -->
-        <value>123.326</value> <!-- 825 MHz CPU speed -->
-        <value>134.812</value> <!-- 902 MHz CPU speed -->
-        <value>141.443</value> <!-- 979 MHz CPU speed -->
-        <value>152.063</value> <!-- 1056 MHz CPU speed -->
-        <value>162.983</value> <!-- 1132 MHz CPU speed -->
-        <value>173.355</value> <!-- 1209 MHz CPU speed -->
-        <value>181.407</value> <!-- 1286 MHz CPU speed -->
-        <value>197.883</value> <!-- 1363 MHz CPU speed -->
-        <value>205.834</value> <!-- 1440 MHz CPU speed -->
-        <value>222.465</value> <!-- 1516 MHz CPU speed -->
-        <value>235.804</value> <!-- 1593 MHz CPU speed -->
-        <value>251.473</value> <!-- 1670 MHz CPU speed -->
-        <value>276.347</value> <!-- 1747 MHz CPU speed -->
-        <value>287.241</value> <!-- 1824 MHz CPU speed -->
-        <value>320.050</value> <!-- 1900 MHz CPU speed -->
-        <value>334.874</value> <!-- 1977 MHz CPU speed -->
-        <value>361.991</value> <!-- 2054 MHz CPU speed -->
-        <value>385.875</value> <!-- 2150 MHz CPU speed -->
+    <!-- Additional power used by a CPU core from cluster 1 when running at
+         different speeds, excluding cluster and active cost -->
+    <array name="cpu.core_power.cluster1">
+        <value>7.055</value> <!-- 307 MHz CPU speed -->
+        <value>11.483</value> <!-- 384 MHz CPU speed -->
+        <value>14.979</value> <!-- 460 MHz CPU speed -->
+        <value>19.642</value> <!-- 537 MHz CPU speed -->
+        <value>23.167</value> <!-- 614 MHz CPU speed -->
+        <value>27.479</value> <!-- 691 MHz CPU speed -->
+        <value>31.632</value> <!-- 748 MHz CPU speed -->
+        <value>39.192</value> <!-- 825 MHz CPU speed -->
+        <value>47.817</value> <!-- 902 MHz CPU speed -->
+        <value>55.659</value> <!-- 979 MHz CPU speed -->
+        <value>64.908</value> <!-- 1056 MHz CPU speed -->
+        <value>73.824</value> <!-- 1132 MHz CPU speed -->
+        <value>85.299</value> <!-- 1209 MHz CPU speed -->
+        <value>96.036</value> <!-- 1286 MHz CPU speed -->
+        <value>109.233</value> <!-- 1363 MHz CPU speed -->
+        <value>118.560</value> <!-- 1440 MHz CPU speed -->
+        <value>132.959</value> <!-- 1516 MHz CPU speed -->
+        <value>143.692</value> <!-- 1593 MHz CPU speed -->
+        <value>161.378</value> <!-- 1670 MHz CPU speed -->
+        <value>180.616</value> <!-- 1747 MHz CPU speed -->
+        <value>193.897</value> <!-- 1824 MHz CPU speed -->
+        <value>214.361</value> <!-- 1900 MHz CPU speed -->
+        <value>238.338</value> <!-- 1977 MHz CPU speed -->
+        <value>265.759</value> <!-- 2054 MHz CPU speed -->
+        <value>297.918</value> <!-- 2150 MHz CPU speed -->
     </array>
 
     <!-- Additional power used when screen is turned on at minimum brightness -->
@@ -157,37 +162,51 @@
          minute. -->
     <item name="camera.avg">987.217</item>
 
-    <!-- Additional power used when audio decoding/encoding via DSP -->
-    <item name="dsp.audio">25.000</item>
+    <!-- Additional power used when video is playing -->
+    <item name="video">50.93</item>
+    <!-- Additional power used when audio is playing -->
+    <item name="audio">75.60</item>
 
-    <!-- Additional power used when GPS is acquiring a signal -->
-    <item name="gps.on">10.23</item>
+    <!-- Idle current for wifi radio in mA.-->
+    <item name="wifi.controller.idle">2</item>
+    <!-- Rx current for wifi radio in mA.-->
+    <item name="wifi.controller.rx">107</item>
+    <!-- Tx current for wifi radio in mA-->
+    <item name="wifi.controller.tx">371</item>
+    <!-- Operating voltage for wifi radio in mV.-->
+    <item name="wifi.controller.voltage">3700</item>
 
-    <!-- Additional power used when Wi-Fi is turned on but not receiving,
-         transmitting, or scanning -->
-    <item name="wifi.on">2</item>
-    <!-- Additional power used when transmitting or receiving over Wi-Fi -->
-    <item name="wifi.active">160</item>
-    <!-- Additional power used when Wi-Fi is scanning for access points -->
-    <item name="wifi.scan">25</item>
-
-    <!-- mA. Current figures based on .0801 s/c and 75.48mA while scanning -->
-    <array name="wifi.batchedscan">
-        <value>0.0002</value> <!-- 1-8/hr -->
-        <value>0.002</value>  <!-- 9-64/hr -->
-        <value>0.02</value>   <!-- 65-512/hr -->
-        <value>0.2</value>    <!-- 513-4,096/hr -->
-        <value>2</value>    <!-- 4097-/hr -->
+    <!-- Cellular modem related values.-->
+    <item name="modem.controller.sleep">0</item>
+    <!-- Idle current for modem in mA.-->
+    <item name="modem.controller.idle">105</item>
+    <!-- Rx current for modem in mA.-->
+    <item name="modem.controller.rx">175</item>
+    <!-- Tx current for modem in mA.-->
+    <array name="modem.controller.tx"> <!-- Strength 0 to 4 -->
+        <value>176</value>
+        <value>216</value>
+        <value>300</value>
+        <value>427</value>
+        <value>604</value>
     </array>
+    <!-- Operating voltage for modem in mV.-->
+    <item name="modem.controller.voltage">3700</item>
 
-    <!-- Additional power used when cellular radio is transmitting/receiving -->
-    <item name="radio.active">300</item>
-    <!-- The current consumed by the radio when it is scanning for a signal -->
-    <item name="radio.scanning">82.2</item>
-    <!-- Current consumed by the radio at different signal strengths, when paging -->
-    <array name="radio.on"> <!-- Strength 0 to BINS-1 -->
-        <value>2.2</value>
-        <value>1.6</value>
+    <!-- GPS related values.-->
+    <array name="gps.signalqualitybased"> <!-- Strength 0 to 1 -->
+        <value>49</value>
+        <value>11</value>
     </array>
+    <item name="gps.voltage">3700</item>
+
+    <!-- Idle current for bluetooth in mA.-->
+    <item name="bluetooth.controller.idle">0.01</item>
+    <!-- Rx current for bluetooth in mA.-->
+    <item name="bluetooth.controller.rx">8</item>
+    <!-- Tx current for bluetooth in mA-->
+    <item name="bluetooth.controller.tx">7</item>
+    <!-- Operating voltage for bluetooth in mV.-->
+    <item name="bluetooth.controller.voltage">3300</item>
 
 </device>
diff --git a/self-extractors/extract-lists.txt b/self-extractors/extract-lists.txt
index fc164dc..86434df 100644
--- a/self-extractors/extract-lists.txt
+++ b/self-extractors/extract-lists.txt
@@ -10,15 +10,5 @@
             system/etc/cne/Nexus/ROW/ROW_profiles.xml \
             system/etc/cne/Nexus/VZW/VZW_profiles.xml \
             system/framework/qcrilhook.jar \
-            system/lib/libclcore_neon.bc \
-            system/lib64/libiperf.so \
-            system/lib64/libminui.so \
-            system/lib64/libbcc.so \
-            system/lib/libion.so \
-            system/lib/libiperf.so \
-            system/lib64/libLLVM_android.so \
-            system/lib/libminui.so \
-            system/xbin/iperf3 \
-            system/xbin/sanitizer-status \
             "
     ;;
diff --git a/self-extractors/qcom/staging/device-partial.mk b/self-extractors/qcom/staging/device-partial.mk
index 9d14348..f6e74f3 100644
--- a/self-extractors/qcom/staging/device-partial.mk
+++ b/self-extractors/qcom/staging/device-partial.mk
@@ -12,11 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# AOSP packages required by the blobs
-PRODUCT_PACKAGES := \
-    com.android.ims.rcsmanager.xml \
-    com.android.ims.rcsmanager
-
 #  blob(s) necessary for Marlin hardware
 PRODUCT_COPY_FILES := \
     vendor/qcom/marlin/proprietary/pktlogconf:system/bin/pktlogconf:qcom \
@@ -24,14 +19,4 @@
     vendor/qcom/marlin/proprietary/ROW_profiles.xml:system/etc/cne/Nexus/ROW/ROW_profiles.xml:qcom \
     vendor/qcom/marlin/proprietary/VZW_profiles.xml:system/etc/cne/Nexus/VZW/VZW_profiles.xml:qcom \
     vendor/qcom/marlin/proprietary/qcrilhook.jar:system/framework/qcrilhook.jar:qcom \
-    vendor/qcom/marlin/proprietary/libclcore_neon.bc:system/lib/libclcore_neon.bc:qcom \
-    vendor/qcom/marlin/proprietary/lib64/libiperf.so:system/lib64/libiperf.so:qcom \
-    vendor/qcom/marlin/proprietary/lib64/libminui.so:system/lib64/libminui.so:qcom \
-    vendor/qcom/marlin/proprietary/lib64/libbcc.so:system/lib64/libbcc.so:qcom \
-    vendor/qcom/marlin/proprietary/libion.so:system/lib/libion.so:qcom \
-    vendor/qcom/marlin/proprietary/libiperf.so:system/lib/libiperf.so:qcom \
-    vendor/qcom/marlin/proprietary/lib64/libLLVM_android.so:system/lib64/libLLVM_android.so:qcom \
-    vendor/qcom/marlin/proprietary/libminui.so:system/lib/libminui.so:qcom \
-    vendor/qcom/marlin/proprietary/iperf3:system/xbin/iperf3:qcom \
-    vendor/qcom/marlin/proprietary/sanitizer-status:system/xbin/sanitizer-status:qcom \
 
diff --git a/self-extractors_sailfish/extract-lists.txt b/self-extractors_sailfish/extract-lists.txt
index fc164dc..86434df 100644
--- a/self-extractors_sailfish/extract-lists.txt
+++ b/self-extractors_sailfish/extract-lists.txt
@@ -10,15 +10,5 @@
             system/etc/cne/Nexus/ROW/ROW_profiles.xml \
             system/etc/cne/Nexus/VZW/VZW_profiles.xml \
             system/framework/qcrilhook.jar \
-            system/lib/libclcore_neon.bc \
-            system/lib64/libiperf.so \
-            system/lib64/libminui.so \
-            system/lib64/libbcc.so \
-            system/lib/libion.so \
-            system/lib/libiperf.so \
-            system/lib64/libLLVM_android.so \
-            system/lib/libminui.so \
-            system/xbin/iperf3 \
-            system/xbin/sanitizer-status \
             "
     ;;
diff --git a/self-extractors_sailfish/qcom/staging/device-partial.mk b/self-extractors_sailfish/qcom/staging/device-partial.mk
index 98b6a72..f0fae3f 100644
--- a/self-extractors_sailfish/qcom/staging/device-partial.mk
+++ b/self-extractors_sailfish/qcom/staging/device-partial.mk
@@ -12,11 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# AOSP packages required by the blobs
-PRODUCT_PACKAGES := \
-    com.android.ims.rcsmanager.xml \
-    com.android.ims.rcsmanager
-
 #  blob(s) necessary for Sailfish hardware
 PRODUCT_COPY_FILES := \
     vendor/qcom/sailfish/proprietary/pktlogconf:system/bin/pktlogconf:qcom \
@@ -24,14 +19,4 @@
     vendor/qcom/sailfish/proprietary/ROW_profiles.xml:system/etc/cne/Nexus/ROW/ROW_profiles.xml:qcom \
     vendor/qcom/sailfish/proprietary/VZW_profiles.xml:system/etc/cne/Nexus/VZW/VZW_profiles.xml:qcom \
     vendor/qcom/sailfish/proprietary/qcrilhook.jar:system/framework/qcrilhook.jar:qcom \
-    vendor/qcom/sailfish/proprietary/libclcore_neon.bc:system/lib/libclcore_neon.bc:qcom \
-    vendor/qcom/sailfish/proprietary/lib64/libiperf.so:system/lib64/libiperf.so:qcom \
-    vendor/qcom/sailfish/proprietary/lib64/libminui.so:system/lib64/libminui.so:qcom \
-    vendor/qcom/sailfish/proprietary/lib64/libbcc.so:system/lib64/libbcc.so:qcom \
-    vendor/qcom/sailfish/proprietary/libion.so:system/lib/libion.so:qcom \
-    vendor/qcom/sailfish/proprietary/libiperf.so:system/lib/libiperf.so:qcom \
-    vendor/qcom/sailfish/proprietary/lib64/libLLVM_android.so:system/lib64/libLLVM_android.so:qcom \
-    vendor/qcom/sailfish/proprietary/libminui.so:system/lib/libminui.so:qcom \
-    vendor/qcom/sailfish/proprietary/iperf3:system/xbin/iperf3:qcom \
-    vendor/qcom/sailfish/proprietary/sanitizer-status:system/xbin/sanitizer-status:qcom \
 
diff --git a/sepolicy/certs/wfcactivation.x509.pem b/sepolicy/certs/wfcactivation.x509.pem
new file mode 100644
index 0000000..bead020
--- /dev/null
+++ b/sepolicy/certs/wfcactivation.x509.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDyTCCArGgAwIBAgIJAODrqTpclyUkMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW
+aWV3MRQwEgYDVQQKDAtHb29nbGUgSW5jLjEQMA4GA1UECwwHQW5kcm9pZDEXMBUG
+A1UEAwwOd2ZjX2FjdGl2YXRpb24wHhcNMTgwMjIxMDA1NTM4WhcNNDUwNzA5MDA1
+NTM4WjB7MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UE
+BwwNTW91bnRhaW4gVmlldzEUMBIGA1UECgwLR29vZ2xlIEluYy4xEDAOBgNVBAsM
+B0FuZHJvaWQxFzAVBgNVBAMMDndmY19hY3RpdmF0aW9uMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAruKdMaQjRrlTwLHWAhUwLXoq+1glzoQ5ibqHDg4i
+GPPlwT7qPG8xWW6UmTiLNES6YSDpvCvptqrZccecviYfYIg7/JCF/xr2cFt9Gyyo
+L0muemdUMFjGQJxKCQMi8jlqPVgfcy7ZEfVvoDWUupD7hVVA6TFkWH1nv/5GzJVK
+h7D4vBaYE6qwM1+NJjrbk1O8SMMCES7MkJhpnfbRYr8d5uxSzDWqqeqvM6CFSvKw
+cxqbCcNl0MDgSCgtnxzZZjg5AFuPECV8lgJpxFEqgEIK1fsebK5G8o4buokMW+W4
+ZT2LZtMq/qsZXl59h22KQX2w5mcI6KyV8WZOcPPOm8uf8wIDAQABo1AwTjAdBgNV
+HQ4EFgQU9jpHDUfkIqBODCp9/c5TsraA9sowHwYDVR0jBBgwFoAU9jpHDUfkIqBO
+DCp9/c5TsraA9sowDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAZMf+
+KD3oFS0cv/C0qQx28wW5BKFb/PM6RxDwTRF7yyJj4+uZU0+O8NJEqBNDgHusFJR6
+2ZXXiWDqzNb0scZxD95FP1YxiLPAcbn2oCTkGPYcCsBmT1i25RsIKTb7fR3UJ/bY
+V55CQy1FjX5H1katVpezi1bs17stqrjL0aCk8s7wZPQ9KTy7SfMF9rUfg8ltrj8s
+MD5cq21GJuJMpI2kNUV7IT+4B3CeHzpm0iy8NmbavgNezZAx1za4QIySNcKfdsSs
+7PsNYPS0R9BeZK/4u4/yrQvRV0lXzQcIJPpwr0cfuhcgcHG8sbCLaw4Ph6go9kRL
+hvY7ZX9pdBLS8ukQ4w==
+-----END CERTIFICATE-----
diff --git a/sepolicy/con_monitor.te b/sepolicy/con_monitor.te
new file mode 100644
index 0000000..2b6e38a
--- /dev/null
+++ b/sepolicy/con_monitor.te
@@ -0,0 +1,9 @@
+# ConnectivityMonitor app
+type con_monitor_app, domain;
+
+app_domain(con_monitor_app)
+
+set_prop(con_monitor_app, radio_prop)
+allow con_monitor_app app_api_service:service_manager find;
+allow con_monitor_app radio_service:service_manager find;
+allow con_monitor_app audioserver_service:service_manager find;
diff --git a/sepolicy/file.te b/sepolicy/file.te
index bdcd248..c150ab5 100644
--- a/sepolicy/file.te
+++ b/sepolicy/file.te
@@ -38,6 +38,8 @@
 type sysfs_scsi_devices_0000, sysfs_type, fs_type;
 type sysfs_scsi_devices_other, sysfs_type, fs_type;
 type sysfs_devices_block, sysfs_type, fs_type;
+# b/70518189 vDSO experiments
+type sysfs_vdso, fs_type, sysfs_type;
 
 # debugfs
 type debugfs_msm_core, debugfs_type, fs_type;
@@ -55,6 +57,7 @@
 type debugfs_runtime_pm, debugfs_type, fs_type;
 type debugfs_cnss, debugfs_type, fs_type;
 type debugfs_ufs, debugfs_type, fs_type;
+type debugfs_fg_sram, debugfs_type, fs_type;
 
 # /proc
 type proc_kernel_sched, fs_type, proc_type;
@@ -71,6 +74,7 @@
 type persist_file, file_type;
 type persist_data_file, file_type;
 type persist_display_file, file_type;
+type persist_battery_file, file_type;
 
 # msm_irqbalance
 type proc_irq, fs_type, proc_type;
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 87fc434..f104cbb 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -112,7 +112,8 @@
 /vendor/bin/nanoapp_cmd            u:object_r:nanoapp_cmd_exec:s0
 
 # files in /vendor
-/vendor/bin/hw/android\.hardware\.drm@1\.0-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
+/vendor/bin/hw/android\.hardware\.bluetooth@1\.0-service-qti          u:object_r:hal_bluetooth_default_exec:s0
+/vendor/bin/hw/android\.hardware\.drm@1\.1-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
 /vendor/bin/hw/android\.hardware\.drm@1\.1-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
 /vendor/bin/hw/android\.hardware\.dumpstate@1\.0-service\.marlin      u:object_r:hal_dumpstate_impl_exec:s0
 /vendor/bin/hw/android\.hardware\.power@1\.1-service\.marlin          u:object_r:hal_power_default_exec:s0
@@ -130,6 +131,8 @@
 /vendor/bin/init\.radio\.sh        u:object_r:init_radio_exec:s0
 /vendor/bin/init\.foreground\.sh   u:object_r:init_foreground_exec:s0
 
+/vendor/bin/hw/android\.hardware\.health@2\.0-service\.marlin          u:object_r:hal_health_default_exec:s0
+
 ###############################################
 # same-process HAL files and their dependencies
 #
@@ -154,12 +157,9 @@
 /vendor/lib(64)?/librs_adreno_sha1\.so      u:object_r:same_process_hal_file:s0
 
 /vendor/lib(64)?/libCB\.so                  u:object_r:same_process_hal_file:s0
-/vendor/lib(64)?/libllvm-qgl\.so            u:object_r:same_process_hal_file:s0
+/vendor/lib(64)?/libllvm-glnext\.so            u:object_r:same_process_hal_file:s0
 /vendor/lib(64)?/libqti-perfd-client\.so    u:object_r:same_process_hal_file:s0
 
-# libGLESv2_adreno depends on this
-/vendor/lib(64)?/libllvm-glnext\.so         u:object_r:same_process_hal_file:s0
-
 # Loaded by native loader (zygote) for all processes
 /vendor/lib(64)?/libhalide_hexagon_host\.so u:object_r:same_process_hal_file:s0
 /vendor/lib(64)?/libadsprpc\.so             u:object_r:same_process_hal_file:s0
@@ -183,7 +183,7 @@
 /data/vendor/nfc(/.*)?           u:object_r:nfc_vendor_data_file:s0
 /data/vendor/radio(/.*)?         u:object_r:radio_vendor_data_file:s0
 /data/vendor/sensor(/.*)?        u:object_r:sensor_vendor_data_file:s0
-/data/vendor/wifi(/.*)?          u:object_r:cnss_vendor_data_file:s0
+/data/vendor/wifi/cnss_diag(/.*)? u:object_r:cnss_vendor_data_file:s0
 /data/vendor/ramdump(/.*)?       u:object_r:ramdump_vendor_data_file:s0
 /data/vendor/ssrdump(/.*)?       u:object_r:ramdump_vendor_data_file:s0
 /data/vendor/camera(/.*)?        u:object_r:camera_vendor_data_file:s0
@@ -201,7 +201,11 @@
 /persist(/.*)?          u:object_r:persist_file:s0
 /persist/data(/.*)?     u:object_r:persist_data_file:s0
 /persist/display(/.*)?  u:object_r:persist_display_file:s0
+/persist/battery(/.*)?  u:object_r:persist_battery_file:s0
 /persist/sensorcal\.json  u:object_r:sensors_cal_file:s0
 
 # hidraw dynamic sensor
 /dev/hidraw[0-9]+            u:object_r:sensors_device:s0
+
+# b/70518189 vDSO experiments
+/sys/module/vdso/parameters  u:object_r:sysfs_vdso:s0
diff --git a/sepolicy/genfs_contexts b/sepolicy/genfs_contexts
index 053cc40..bf0e65b 100644
--- a/sepolicy/genfs_contexts
+++ b/sepolicy/genfs_contexts
@@ -55,7 +55,7 @@
 genfscon sysfs /devices/soc/75b5000.i2c/i2c-7/7-001d/power_supply     u:object_r:sysfs_batteryinfo:s0
 genfscon sysfs /devices/soc/msm-bcl-14/power_supply                   u:object_r:sysfs_batteryinfo:s0
 genfscon sysfs /devices/soc/soc:qcom,bcl/power_supply                 u:object_r:sysfs_batteryinfo:s0
-genfscon sysfs /devices/soc/qpnp-fg-17/power_supply                   u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/soc/qpnp-fg-17                                u:object_r:sysfs_batteryinfo:s0
 genfscon sysfs /devices/soc/qpnp-smbcharger-16/power_supply           u:object_r:sysfs_batteryinfo:s0
 genfscon sysfs /devices/virtual/timed_output/vibrator/voltage_level   u:object_r:sysfs_vibrator:s0
 genfscon sysfs /module/diagchar/parameters/timestamp_switch           u:object_r:sysfs_timestamp_switch:s0
@@ -85,6 +85,7 @@
 genfscon debugfs /ion                      u:object_r:debugfs_ion:s0
 genfscon debugfs /tcpm/9-0022              u:object_r:debugfs_usb:s0
 genfscon debugfs /ipc_logging/fusb302/log  u:object_r:debugfs_usb:s0
-genfscon debugfs /cnss_runtime_pm                     u:object_r:debugfs_runtime_pm:s0
-genfscon debugfs /cnss-prealloc/status                u:object_r:debugfs_cnss:s0
-genfscon debugfs /ufshcd0                             u:object_r:debugfs_ufs:s0
+genfscon debugfs /cnss_runtime_pm          u:object_r:debugfs_runtime_pm:s0
+genfscon debugfs /cnss-prealloc/status     u:object_r:debugfs_cnss:s0
+genfscon debugfs /ufshcd0                  u:object_r:debugfs_ufs:s0
+genfscon debugfs /fg_memif                 u:object_r:debugfs_fg_sram:s0
diff --git a/sepolicy/google_camera_app.te b/sepolicy/google_camera_app.te
index b12cfd2..127d743 100644
--- a/sepolicy/google_camera_app.te
+++ b/sepolicy/google_camera_app.te
@@ -37,4 +37,5 @@
 # Read / execute vendor code from /vendor/lib[64]/dsp for HVX for Pixel Camera
 # TODO: b/37258244, This MUST be a specific exception instead of opening up
 # /vendor for the application. The policy build MUST also catch the violations
+typeattribute google_camera_app system_executes_vendor_violators;
 r_dir_file(google_camera_app, vendor_file)
diff --git a/sepolicy/hal_bluetooth.te b/sepolicy/hal_bluetooth.te
index 414a8e2..ea2c07f 100644
--- a/sepolicy/hal_bluetooth.te
+++ b/sepolicy/hal_bluetooth.te
@@ -7,3 +7,15 @@
 # talk to system_server to set priority
 allow hal_bluetooth fwk_scheduler_hwservice:hwservice_manager find;
 allow hal_bluetooth system_server:binder call;
+
+userdebug_or_eng(`
+  allow hal_bluetooth diag_device:chr_file rw_file_perms;
+  allow hal_bluetooth ramdump_vendor_data_file:dir w_dir_perms;
+  allow hal_bluetooth ramdump_vendor_data_file:file { create w_file_perms };
+  allow hal_bluetooth sysfs_timestamp_switch:file r_file_perms;
+  r_dir_file(hal_bluetooth, debugfs_ipc)
+  r_dir_file(hal_bluetooth, sysfs_diag)
+  set_prop(hal_bluetooth, vendor_ssr_prop)
+')
+
+dontaudit hal_bluetooth diag_device:chr_file rw_file_perms;
diff --git a/sepolicy/hal_dumpstate_impl.te b/sepolicy/hal_dumpstate_impl.te
index 80e4ea5..d7c1d35 100644
--- a/sepolicy/hal_dumpstate_impl.te
+++ b/sepolicy/hal_dumpstate_impl.te
@@ -63,3 +63,11 @@
 
 # For collecting bugreports.
 allow hal_dumpstate_impl shell_data_file:file getattr;
+
+# Query and dump power supply nodes
+allow hal_dumpstate_impl sysfs_batteryinfo:dir search;
+allow hal_dumpstate_impl sysfs_batteryinfo:file r_file_perms;
+
+# Dump QCOM FG content
+allow hal_dumpstate_impl debugfs_fg_sram:dir search;
+allow hal_dumpstate_impl debugfs_fg_sram:file rw_file_perms;
diff --git a/sepolicy/hal_health_default.te b/sepolicy/hal_health_default.te
new file mode 100644
index 0000000..a5f39de
--- /dev/null
+++ b/sepolicy/hal_health_default.te
@@ -0,0 +1,13 @@
+r_dir_file(hal_health_default, sysfs_msm_subsys)
+
+allow hal_health_default debugfs_ufs:dir search;
+allow hal_health_default sysfs_scsi_devices_0000:dir search;
+allow hal_health_default debugfs_ufs:file { getattr open read };
+allow hal_health_default sysfs_scsi_devices_0000:file { getattr open read };
+
+allow hal_health_default persist_battery_file:file create_file_perms;
+allow hal_health_default persist_battery_file:dir rw_dir_perms;
+allow hal_health_default persist_file:dir search;
+allow hal_health_default kmsg_device:chr_file { open write };
+allow hal_health_default sysfs_msm_subsys:file { write };
+allow hal_health_default sysfs_batteryinfo:file rw_file_perms;
diff --git a/sepolicy/hal_wifi_hostapd.te b/sepolicy/hal_wifi_hostapd.te
new file mode 100644
index 0000000..5232050
--- /dev/null
+++ b/sepolicy/hal_wifi_hostapd.te
@@ -0,0 +1,3 @@
+allow hal_wifi_hostapd_server sysfs_pcie:dir search;
+allow hal_wifi_hostapd_server sysfs_net:dir search;
+allow hal_wifi_hostapd_server sysfs_net:file r_file_perms;
diff --git a/sepolicy/hal_wifi_supplicant_default.te b/sepolicy/hal_wifi_supplicant_default.te
index 4f13574..cab782a 100644
--- a/sepolicy/hal_wifi_supplicant_default.te
+++ b/sepolicy/hal_wifi_supplicant_default.te
@@ -4,7 +4,3 @@
 
 allow hal_wifi_supplicant_default wifi_data_file:dir create_dir_perms;
 allow hal_wifi_supplicant_default wifi_data_file:file create_file_perms;
-
-# Create a socket for receiving info from wpa
-allow hal_wifi_supplicant_default wpa_socket:dir create_dir_perms;
-allow hal_wifi_supplicant_default wpa_socket:sock_file create_file_perms;
diff --git a/sepolicy/hardware_info_app.te b/sepolicy/hardware_info_app.te
new file mode 100644
index 0000000..23d0ddd
--- /dev/null
+++ b/sepolicy/hardware_info_app.te
@@ -0,0 +1,17 @@
+type hardware_info_app, domain;
+
+app_domain(hardware_info_app)
+
+# Services
+allow hardware_info_app app_api_service:service_manager find;
+
+# SysFS
+allow hardware_info_app sysfs_batteryinfo:dir search;
+allow hardware_info_app sysfs_batteryinfo:file { getattr open read };
+allow hardware_info_app sysfs_camera:dir search;
+allow hardware_info_app sysfs_camera:file { getattr open read };
+allow hardware_info_app sysfs_msm_subsys:dir search;
+allow hardware_info_app sysfs_scsi_devices_0000:dir search;
+allow hardware_info_app sysfs_scsi_devices_0000:file { getattr open read };
+allow hardware_info_app sysfs_soc:dir search;
+allow hardware_info_app sysfs_soc:file { getattr open read };
diff --git a/sepolicy/hostapd.te b/sepolicy/hostapd.te
deleted file mode 100644
index b3ffed4..0000000
--- a/sepolicy/hostapd.te
+++ /dev/null
@@ -1,13 +0,0 @@
-allow hostapd sysfs_pcie:dir search;
-
-# TODO(b/36657258): Remove data_between_core_and_vendor_violators once
-# hostapd no longer directly accesses /data outside /data/vendor.
-typeattribute hostapd data_between_core_and_vendor_violators;
-# hostapd can read and write WiFi related data and configuration.
-allow hostapd wifi_data_file:file rw_file_perms;
-r_dir_file(hostapd, wifi_data_file)
-
-# hostapd wants to create the directory holding its control socket.
-allow hostapd hostapd_socket:dir create_dir_perms;
-# hostapd needs to create, bind to, read, and write its control socket.
-allow hostapd hostapd_socket:sock_file create_file_perms;
diff --git a/sepolicy/hrdump.te b/sepolicy/hrdump.te
index c558b5b..1ebd70c 100644
--- a/sepolicy/hrdump.te
+++ b/sepolicy/hrdump.te
@@ -9,6 +9,7 @@
 allow htc_ramdump self:capability { fowner fsetid sys_rawio };
 
 set_prop(htc_ramdump, debug_prop)
+set_prop(htc_ramdump, vendor_ramdump_prop)
 
 allow htc_ramdump rootfs:file { r_file_perms };
 allow htc_ramdump misc_block_device:blk_file { rw_file_perms };
diff --git a/sepolicy/init.te b/sepolicy/init.te
index f79516e..6399c22 100644
--- a/sepolicy/init.te
+++ b/sepolicy/init.te
@@ -12,3 +12,6 @@
 allow init userdata_block_device:blk_file { write };
 
 allow init persist_block_device:lnk_file relabelto;
+
+# b/70518189 vDSO experiments
+allow init sysfs_vdso:file w_file_perms;
diff --git a/sepolicy/ioctl_macros b/sepolicy/ioctl_macros
index 26892d6..befcb10 100644
--- a/sepolicy/ioctl_macros
+++ b/sepolicy/ioctl_macros
@@ -9,6 +9,7 @@
 IOCTL_KGSL_TIMESTAMP_EVENT
 IOCTL_KGSL_PERFCOUNTER_GET
 IOCTL_KGSL_PERFCOUNTER_PUT
+IOCTL_KGSL_PERFCOUNTER_READ
 IOCTL_KGSL_SYNCSOURCE_CREATE
 IOCTL_KGSL_SYNCSOURCE_DESTROY
 IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE
diff --git a/sepolicy/keys.conf b/sepolicy/keys.conf
index 8e5cf1f..8769e16 100644
--- a/sepolicy/keys.conf
+++ b/sepolicy/keys.conf
@@ -1,2 +1,5 @@
 [@GOOGLE]
 ALL : device/google/marlin/sepolicy/certs/app.x509.pem
+
+[@WFCACTIVATION]
+ALL : device/google/marlin/sepolicy/certs/wfcactivation.x509.pem
diff --git a/sepolicy/mac_permissions.xml b/sepolicy/mac_permissions.xml
index 361cd8a..377052f 100644
--- a/sepolicy/mac_permissions.xml
+++ b/sepolicy/mac_permissions.xml
@@ -24,4 +24,7 @@
     <signer signature="@GOOGLE" >
       <seinfo value="google" />
     </signer>
+    <signer signature="@WFCACTIVATION" >
+      <seinfo value="wfcactivation" />
+    </signer>
 </policy>
diff --git a/sepolicy/platform_app.te b/sepolicy/platform_app.te
index 448f593..355fb34 100644
--- a/sepolicy/platform_app.te
+++ b/sepolicy/platform_app.te
@@ -1,7 +1,10 @@
 allow platform_app vnd_qcril_audio_hwservice:hwservice_manager find;
 binder_call(platform_app, rild);
 
+allow platform_app qchook_service:service_manager find;
+
 userdebug_or_eng(`
    dontaudit platform_app proc_sysrq:file getattr;
    dontaudit platform_app proc_iomem:file getattr;
 ')
+
diff --git a/sepolicy/private/service_contexts b/sepolicy/private/service_contexts
index 7ae0b3d..f7b01cf 100644
--- a/sepolicy/private/service_contexts
+++ b/sepolicy/private/service_contexts
@@ -2,3 +2,4 @@
 qti.ims.connectionmanagerservice               u:object_r:imscm_service:s0
 rcs                                            u:object_r:radio_service:s0
 uce                                            u:object_r:uce_service:s0
+qchook                                         u:object_r:qchook_service:s0
diff --git a/sepolicy/property.te b/sepolicy/property.te
index 91bb598..06e8273 100644
--- a/sepolicy/property.te
+++ b/sepolicy/property.te
@@ -3,10 +3,11 @@
 type wc_prop, property_type;
 type hw_sku_prop, property_type;
 type mid_prop, property_type;
-type ssr_prop, property_type;
+type vendor_ssr_prop, property_type;
 type cnss_diag_prop, property_type;
 type thermal_prop, property_type;
-type ramdump_prop, property_type;
+type vendor_ramdump_prop, property_type;
 type sys_time_prop, property_type;
 type post_boot_prop, property_type;
 type bluetooth_log_prop, property_type;
+type vendor_charge_prop, property_type;
diff --git a/sepolicy/property_contexts b/sepolicy/property_contexts
index 68e9df4..cb0b15d 100644
--- a/sepolicy/property_contexts
+++ b/sepolicy/property_contexts
@@ -1,17 +1,19 @@
-persist.camera.            u:object_r:camera_prop:s0
-htc.camera.                u:object_r:camera_prop:s0
-sensors.                   u:object_r:sensors_prop:s0
-wc_transport.              u:object_r:wc_prop:s0
-net.r_rmnet                u:object_r:net_radio_prop:s0
-radio.                     u:object_r:radio_prop:s0
-rcs.publish.status         u:object_r:radio_prop:s0
-ro.boot.hardware.sku       u:object_r:hw_sku_prop:s0
-ro.boot.mid                u:object_r:mid_prop:s0
-debug.ssrdump              u:object_r:ssr_prop:s0
-persist.sys.cnss.          u:object_r:cnss_diag_prop:s0
-persist.sys.crash_rcu      u:object_r:ramdump_prop:s0
-sys.qcom.thermalcfg        u:object_r:thermal_prop:s0
-ctl.thermal-engine         u:object_r:thermal_prop:s0
-sys.time.set               u:object_r:sys_time_prop:s0
-sys.post_boot.parsed       u:object_r:post_boot_prop:s0
-sys.logger.bluetooth       u:object_r:bluetooth_log_prop:s0
+persist.camera.                     u:object_r:camera_prop:s0
+htc.camera.                         u:object_r:camera_prop:s0
+sensors.                            u:object_r:sensors_prop:s0
+wc_transport.                       u:object_r:wc_prop:s0
+net.r_rmnet                         u:object_r:net_radio_prop:s0
+radio.                              u:object_r:radio_prop:s0
+rcs.publish.status                  u:object_r:radio_prop:s0
+ro.boot.hardware.sku                u:object_r:hw_sku_prop:s0
+ro.boot.mid                         u:object_r:mid_prop:s0
+vendor.debug.ssrdump                u:object_r:vendor_ssr_prop:s0
+persist.sys.cnss.                   u:object_r:cnss_diag_prop:s0
+vendor.debug.ramdump.               u:object_r:vendor_ramdump_prop:s0
+persist.vendor.sys.crash_rcu        u:object_r:vendor_ramdump_prop:s0
+sys.qcom.thermalcfg                 u:object_r:thermal_prop:s0
+ctl.vendor.thermal-engine           u:object_r:thermal_prop:s0
+sys.time.set                        u:object_r:sys_time_prop:s0
+sys.post_boot.parsed                u:object_r:post_boot_prop:s0
+sys.logger.bluetooth                u:object_r:bluetooth_log_prop:s0
+persist.vendor.charge.              u:object_r:vendor_charge_prop:s0
diff --git a/sepolicy/radio.te b/sepolicy/radio.te
index 762db04..a95d620 100644
--- a/sepolicy/radio.te
+++ b/sepolicy/radio.te
@@ -40,3 +40,5 @@
 
 # read access to sys/module/diagchar/parameters/timestamp_switch
 allow radio sysfs_timestamp_switch:file r_file_perms;
+
+add_service(radio, qchook_service)
diff --git a/sepolicy/ramdump_app.te b/sepolicy/ramdump_app.te
index c76eaca..ecb5d83 100644
--- a/sepolicy/ramdump_app.te
+++ b/sepolicy/ramdump_app.te
@@ -9,5 +9,5 @@
   allow ramdump_app ramdump_vendor_data_file:file create_file_perms;
   allow ramdump_app ramdump_vendor_data_file:dir create_dir_perms;
 
-  set_prop(ramdump_app, ramdump_prop);
+  set_prop(ramdump_app, vendor_ramdump_prop);
 ')
diff --git a/sepolicy/rild.te b/sepolicy/rild.te
index db7d973..7cbe38e 100644
--- a/sepolicy/rild.te
+++ b/sepolicy/rild.te
@@ -47,3 +47,6 @@
 # TODO(b/36613472): Remove this once system_server,  mediaserver, bluetooth, and radio no longer
 # communicate with rild over sockets.
 typeattribute rild socket_between_core_and_vendor_violators;
+
+# Allow vendor native process to read the proc file of xy_qtaguid
+allow rild proc_qtaguid_stat:file r_file_perms;
diff --git a/sepolicy/seapp_contexts b/sepolicy/seapp_contexts
index 454b44b..9e00f05 100644
--- a/sepolicy/seapp_contexts
+++ b/sepolicy/seapp_contexts
@@ -1,10 +1,13 @@
 # Production default camera application for marlin/sailfish
 user=_app seinfo=google name=com.google.android.GoogleCamera domain=google_camera_app type=app_data_file levelFrom=user
 
+# Hardware info.
+user=_app seinfo=platform name=com.google.android.hardwareinfo domain=hardware_info_app type=app_data_file levelFrom=all
+
 user=system seinfo=platform name=com.quicinc.cne.CNEService domain=qcneservice type=system_app_data_file
 user=system seinfo=platform name=com.google.SSRestartDetector domain=ssr_detector type=system_app_data_file
 
-user=_app seinfo=platform name=com.android.nexuslogger domain=logger_app type=app_data_file levelFrom=all
+user=_app seinfo=platform name=com.android.pixellogger domain=logger_app type=app_data_file levelFrom=all
 user=_app seinfo=platform name=com.android.ramdump domain=ramdump_app type=app_data_file levelFrom=all
 
 # AtFwd and FastDormancy apps
@@ -12,3 +15,9 @@
 
 # TimeService app
 user=system seinfo=platform name=com.qualcomm.timeservice domain=qtimeservice type=system_app_data_file
+
+#Domain for connectivity monitor
+user=radio seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all
+
+# Domain for WfcActivation app
+user=_app seinfo=wfcactivation name=com.google.android.wfcactivation domain=wfc_activation_app levelFrom=all
diff --git a/sepolicy/service.te b/sepolicy/service.te
index a682951..c010f67 100644
--- a/sepolicy/service.te
+++ b/sepolicy/service.te
@@ -1,3 +1,4 @@
 type cne_service,                 service_manager_type;
 type imscm_service,               service_manager_type;
 type uce_service,                 service_manager_type;
+type qchook_service,              service_manager_type;
diff --git a/sepolicy/ssr_detector.te b/sepolicy/ssr_detector.te
index d3db3ee..6998b14 100644
--- a/sepolicy/ssr_detector.te
+++ b/sepolicy/ssr_detector.te
@@ -6,7 +6,7 @@
 userdebug_or_eng(`
   allow ssr_detector ramdump_vendor_data_file:dir r_dir_perms;
   allow ssr_detector ramdump_vendor_data_file:file r_file_perms;
-  get_prop(ssr_detector, ssr_prop)
+  get_prop(ssr_detector, vendor_ssr_prop)
 ')
 
 allow ssr_detector { app_api_service }:service_manager find;
diff --git a/sepolicy/subsystem_ramdump.te b/sepolicy/subsystem_ramdump.te
index 9a6e665..a780505 100644
--- a/sepolicy/subsystem_ramdump.te
+++ b/sepolicy/subsystem_ramdump.te
@@ -12,5 +12,5 @@
   allow subsystem_ramdump ramdump_vendor_data_file:dir rw_dir_perms;
   allow subsystem_ramdump ramdump_vendor_data_file:file create_file_perms;
 
-  set_prop(subsystem_ramdump, ssr_prop)
+  set_prop(subsystem_ramdump, vendor_ssr_prop)
 ')
diff --git a/sepolicy/system_app.te b/sepolicy/system_app.te
index 191a6db..0de2e7c 100644
--- a/sepolicy/system_app.te
+++ b/sepolicy/system_app.te
@@ -5,9 +5,6 @@
 # label.
 get_prop(system_app, hw_sku_prop);
 
-# Needed by Settings app's TelephonyMonitorPreferenceController, available only on a subset of
-# userdebug and eng devices
-userdebug_or_eng(`set_prop(system_app, radio_prop)')
-
 # Needed by Settings app's CameraLaserSensorPreferenceController
 set_prop(system_app, camera_prop)
+
diff --git a/sepolicy/time.te b/sepolicy/time.te
index 39126ba..243af2c 100644
--- a/sepolicy/time.te
+++ b/sepolicy/time.te
@@ -29,3 +29,4 @@
   allow time  diag_device:chr_file rw_file_perms;
 ')
 dontaudit time diag_device:chr_file rw_file_perms;
+dontaudit time unlabeled:dir search;
diff --git a/sepolicy/vendor_init.te b/sepolicy/vendor_init.te
index a4a44be..72ece20 100644
--- a/sepolicy/vendor_init.te
+++ b/sepolicy/vendor_init.te
@@ -37,6 +37,7 @@
 }:sock_file setattr;
 
 set_prop(vendor_init, thermal_prop)
+set_prop(vendor_init, vendor_charge_prop)
 
 dontaudit vendor_init unlabeled:dir getattr;
 dontaudit vendor_init unlabeled:file getattr;
diff --git a/sepolicy/wcnss_filter.te b/sepolicy/wcnss_filter.te
index a657c91..17bc2d2 100644
--- a/sepolicy/wcnss_filter.te
+++ b/sepolicy/wcnss_filter.te
@@ -20,7 +20,7 @@
   allow wcnss_filter ramdump_vendor_data_file:dir w_dir_perms;
   allow wcnss_filter ramdump_vendor_data_file:file { create w_file_perms };
   r_dir_file(wcnss_filter, debugfs_ipc)
-  set_prop(wcnss_filter, ssr_prop)
+  set_prop(wcnss_filter, vendor_ssr_prop)
 ')
 dontaudit wcnss_filter diag_device:chr_file rw_file_perms;
 
diff --git a/sepolicy/wfc_activation_app.te b/sepolicy/wfc_activation_app.te
new file mode 100644
index 0000000..cd32efc
--- /dev/null
+++ b/sepolicy/wfc_activation_app.te
@@ -0,0 +1,9 @@
+type wfc_activation_app, domain, coredomain;
+
+app_domain(wfc_activation_app)
+net_domain(wfc_activation_app)
+
+# Services
+allow wfc_activation_app app_api_service:service_manager find;
+allow wfc_activation_app qchook_service:service_manager find;
+allow wfc_activation_app radio_service:service_manager find;
diff --git a/system.prop b/system.prop
index 634e4f8..8664b0e 100644
--- a/system.prop
+++ b/system.prop
@@ -92,19 +92,6 @@
 #
 persist.fuse_sdcard=true
 
-#system prop for Bluetooth SOC type
-qcom.bluetooth.soc=rome
-
-#system prop for wipower support
-ro.bluetooth.wipower=true
-
-#Set this true as ROME which is programmed
-#as embedded wipower mode by deafult
-ro.bluetooth.emb_wp_mode=true
-
-#Property for loading BDA from bdaddress module in kernel
-ro.bt.bdaddr_path=/sys/module/bdaddress/parameters/bdaddress
-
 #
 #snapdragon value add features
 #
diff --git a/usb/Usb.cpp b/usb/Usb.cpp
index dbb98f4..6977307 100644
--- a/usb/Usb.cpp
+++ b/usb/Usb.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.usb@1.1-service.wahoo"
+#define LOG_TAG "android.hardware.usb@1.1-service"
 
 #include <android-base/logging.h>
 #include <assert.h>
diff --git a/usb/android.hardware.usb@1.1-service.marlin.rc b/usb/android.hardware.usb@1.1-service.marlin.rc
index 0363ec4..165b0bb 100644
--- a/usb/android.hardware.usb@1.1-service.marlin.rc
+++ b/usb/android.hardware.usb@1.1-service.marlin.rc
@@ -1,4 +1,4 @@
-service usb-hal-1-1 /vendor/bin/hw/android.hardware.usb@1.1-service.marlin
+service vendor.usb-hal-1-1 /vendor/bin/hw/android.hardware.usb@1.1-service.marlin
     class hal
     user system
     group system
diff --git a/vibrator/android.hardware.vibrator@1.0-service.marlin.rc b/vibrator/android.hardware.vibrator@1.0-service.marlin.rc
index a8a18e9..ccca467 100644
--- a/vibrator/android.hardware.vibrator@1.0-service.marlin.rc
+++ b/vibrator/android.hardware.vibrator@1.0-service.marlin.rc
@@ -1,4 +1,4 @@
-service vibrator-1-0 /vendor/bin/hw/android.hardware.vibrator@1.0-service.marlin
+service vendor.vibrator-1-0 /vendor/bin/hw/android.hardware.vibrator@1.0-service.marlin
     class hal
     user system
     group system
diff --git a/vndk/Android.mk b/vndk/Android.mk
index 762a8a2..9d7ee9f 100644
--- a/vndk/Android.mk
+++ b/vndk/Android.mk
@@ -13,7 +13,9 @@
 # However, some of those libs need FWK-ONLY libs, which must be listed here
 # manually.
 VNDK_SP_LIBRARIES := \
-    libdexfile
+    libdexfile \
+    libartbase \
+    libziparchive
 
 install_in_hw_dir := \
    android.hidl.memory@1.0-impl
diff --git a/voice_processing/Android.mk b/voice_processing/Android.mk
index da217e5..e5f128f 100644
--- a/voice_processing/Android.mk
+++ b/voice_processing/Android.mk
@@ -26,6 +26,8 @@
 
 LOCAL_MULTILIB := $(AUDIOSERVER_MULTILIB)
 
+LOCAL_HEADER_LIBRARIES := libhardware_headers
+
 LOCAL_MODULE := libqcomvoiceprocessingdescriptors
 
 LOCAL_MODULE_RELATIVE_PATH := soundfx
diff --git a/vr/Android.mk b/vr/Android.mk
index 5b0f20f..e271eaa 100644
--- a/vr/Android.mk
+++ b/vr/Android.mk
@@ -19,6 +19,7 @@
 LOCAL_SRC_FILES := vr.c
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_SHARED_LIBRARIES := liblog libcutils
+LOCAL_HEADER_LIBRARIES := libhardware_headers
 LOCAL_CFLAGS += -Wno-unused-parameter
 LOCAL_MODULE := vr.$(TARGET_DEVICE)
 LOCAL_MODULE_TAGS := optional
diff --git a/vr/vr.c b/vr/vr.c
index 18d4e53..238d37f 100644
--- a/vr/vr.c
+++ b/vr/vr.c
@@ -23,7 +23,7 @@
 #include <hardware/hardware.h>
 
 static void restart_thermal_engine() {
-    if (property_set("ctl.restart", "thermal-engine")) {
+    if (property_set("ctl.restart", "vendor.thermal-engine")) {
         ALOGE("%s: couldn't set a system property, "
               "ctl.restart.", __FUNCTION__);
     }