diff --git a/apns-full-conf.xml b/apns-full-conf.xml
index 8b61cc0..39a14a7 100644
--- a/apns-full-conf.xml
+++ b/apns-full-conf.xml
@@ -731,12 +731,41 @@
       type="mms"
   />
 
+  <apn carrier="Euskaltel Internet"
+      mcc="214"
+      mnc="03"
+      apn="internet.euskaltel.mobi"
+      user="CLIENTE"
+      password="EUSKALTEL"
+      authtype="1"
+      type="default,supl"
+      mvno_type="imsi"
+      mvno_match_data="2140359"
+  />
+
+  <apn carrier="Euskaltel MMS"
+      mcc="214"
+      mnc="03"
+      apn="euskaltelmms.euskaltel.mobi"
+      user="MMS"
+      password="EUSKALTEL"
+      authtype="1"
+      mmsc="http://mms.euskaltel.mobi"
+      mmsproxy="172.16.18.74"
+      mmsport="8080"
+      type="mms"
+      mvno_type="imsi"
+      mvno_match_data="2140359"
+  />
+
   <apn carrier="Carrefour"
       mcc="214"
       mnc="03"
       apn="CARREFOURINTERNET"
       authtype="1"
       type="default,supl"
+      mvno_type="imsi"
+      mvno_match_data="2140352"
   />
 
   <apn carrier="Carrefour MMS"
@@ -749,6 +778,8 @@
       mmsproxy="172.22.188.25"
       mmsport="8080"
       authtype="1"
+      mvno_type="imsi"
+      mvno_match_data="2140352"
       type="mms"
   />
 
@@ -819,6 +850,7 @@
       mcc="214"
       mnc="06"
       apn="internet.mundo-r.com"
+      authtype="1"
       type="default,supl"
       mvno_match_data="2140612"
       mvno_type="imsi"
@@ -827,10 +859,11 @@
   <apn carrier="MMS R"
       mcc="214"
       mnc="06"
-      apn="euskaltelmms.euskaltel.mobi"
+      apn="mms.mundo-r.com"
       mmsc="http://mms.mundo-r.com"
       mmsproxy="10.0.157.169"
       mmsport="8080"
+      authtype="1"
       type="mms"
       mvno_match_data="2140612"
       mvno_type="imsi"
@@ -886,18 +919,6 @@
       mvno_type="imsi"
   />
 
-  <apn carrier="Movistar MMS"
-      mcc="214"
-      mnc="07"
-      apn="telefonica.es"
-      user="telefonica"
-      password="telefonica"
-      mmsc="http://mms.movistar.com"
-      mmsproxy="10.138.255.5"
-      mmsport="8080"
-      type="mms"
-  />
-
   <apn carrier="Movistar"
       mcc="214"
       mnc="07"
@@ -906,7 +927,11 @@
       password="telefonica"
       proxy="10.138.255.133"
       port="8080"
-      type="default,supl"
+      mmsc="http://mms.movistar.com"
+      mmsproxy="10.138.255.5"
+      mmsport="8080"
+      authtype="1"
+      type="default,supl,mms"
   />
 
   <apn carrier="Jazztel Internet"
@@ -1853,10 +1878,10 @@
       type="mms"
   />
 
-  <apn carrier="YESSS! GPRS"
+  <apn carrier="Internet"
       mcc="232"
       mnc="12"
-      apn="web.yesss.at"
+      apn="webapn.at"
       type="default,supl"
   />
 
@@ -2376,6 +2401,27 @@
       type="default,supl"
   />
 
+  <apn carrier="Internet"
+      mcc="240"
+      mnc="01"
+      apn="halebop.telia.se"
+      type="default,supl"
+      mvno_match_data="240017"
+      mvno_type="imsi"
+  />
+
+  <apn carrier="MMS"
+      mcc="240"
+      mnc="01"
+      apn="mms.telia.se"
+      mmsc="http://mmss"
+      mmsproxy="193.209.134.132"
+      mmsport="80"
+      type="mms"
+      mvno_match_data="240017"
+      mvno_type="imsi"
+  />
+
   <apn carrier="Halebop Internet"
       mcc="240"
       mnc="017"
@@ -2436,14 +2482,25 @@
       type="default,supl"
   />
 
-  <apn carrier="Tele2"
+  <apn carrier="Tele2 Internet"
+      mcc="240"
+      mnc="07"
+      apn="internet.tele2.se"
+      type="default,supl"
+      mvno_match_data="Tele2"
+      mvno_type="spn"
+  />
+
+  <apn carrier="Tele2 MMS"
       mcc="240"
       mnc="07"
       apn="internet.tele2.se"
       mmsc="http://mmsc.tele2.se"
       mmsproxy="130.244.202.30"
       mmsport="8080"
-      type="default,supl,mms"
+      type="mms"
+      mvno_match_data="Tele2"
+      mvno_type="spn"
   />
 
   <apn carrier="Tele2 Internet"
@@ -2835,10 +2892,6 @@
       mcc="246"
       mnc="03"
       apn="internet.tele2.lt"
-      user="wap"
-      password="wap"
-      proxy="130.244.196.90"
-      port="8080"
       mmsc="http://mmsc.tele2.lt/"
       mmsproxy="193.12.40.29"
       mmsport="8080"
@@ -2963,16 +3016,14 @@
       type="default,supl"
   />
 
-  <apn carrier="Tele2 Internet"
+  <apn carrier="TELE2 Internet"
       mcc="248"
       mnc="03"
       apn="internet.tele2.ee"
       type="default,supl"
-      mvno_match_data="24803005x"
-      mvno_type="imsi"
   />
 
-  <apn carrier="Tele2 MMS"
+  <apn carrier="TELE2 MMS"
       mcc="248"
       mnc="03"
       apn="mms.tele2.ee"
@@ -2980,8 +3031,6 @@
       mmsproxy="193.12.40.6"
       mmsport="8080"
       type="mms"
-      mvno_match_data="24803005x"
-      mvno_type="imsi"
   />
 
   <apn carrier="Smart/Ultra MMS"
@@ -2992,29 +3041,6 @@
       mmsproxy="193.12.40.6"
       mmsport="8080"
       type="mms"
-      mvno_match_data="24803005x"
-      mvno_type="imsi"
-  />
-
-  <apn carrier="Tele2 Internet"
-      mcc="248"
-      mnc="03"
-      apn="internet.tele2.ee"
-      type="default,supl"
-      mvno_match_data="24803000x"
-      mvno_type="imsi"
-  />
-
-  <apn carrier="Smart/Ultra MMS"
-      mcc="248"
-      mnc="03"
-      apn="internet.tele2.ee"
-      mmsc="http://mmsc.tele2.ee"
-      mmsproxy="193.12.40.6"
-      mmsport="8080"
-      type="mms"
-      mvno_match_data="24803000x"
-      mvno_type="imsi"
   />
 
   <apn carrier="MTS Internet"
@@ -3883,6 +3909,39 @@
       type="mms"
   />
 
+  <apn carrier="T-2"
+      mcc="293"
+      mnc="64"
+      apn="internet.t-2.net"
+      mmsc="http://www.mms.t-2.net:8002"
+      mmsproxy="172.20.18.137"
+      mmsport="8080"
+      type="default,supl,mms"
+  />
+
+  <apn carrier="Tusmobil Internet"
+      mcc="293"
+      mnc="70"
+      apn="internet.tusmobil.si"
+      user="tusmobil"
+      password="internet"
+      authtype="1"
+      type="default,supl"
+  />
+
+  <apn carrier="Tusmobil MMS"
+      mcc="293"
+      mnc="70"
+      apn="mms.tusmobil.si"
+      user="tusmobil"
+      password="mms"
+      authtype="1"
+      mmsc="http://mms.tusmobil.si:8002"
+      mmsproxy="91.185.221.85"
+      mmsport="8080"
+      type="mms"
+  />
+
   <apn carrier="T-Mobile MK Internet"
       mcc="294"
       mnc="01"
@@ -5749,6 +5808,13 @@
       type="mms"
   />
 
+  <apn carrier="ALTEL INTERNET"
+      mcc="401"
+      mnc="07"
+      apn="Internet"
+      type="default"
+  />
+
   <apn carrier="Tele2 Internet"
       mcc="401"
       mnc="77"
@@ -5766,6 +5832,13 @@
       type="mms"
   />
 
+  <apn carrier="ALTEL INTERNET"
+      mcc="401"
+      mnc="07"
+      apn="Internet"
+      type="default"
+  />
+
   <apn carrier="B-Mobile"
       mcc="402"
       mnc="11"
@@ -12531,6 +12604,23 @@
       type="default,supl,mms"
   />
 
+  <apn carrier="Home Cellular Internet"
+      mcc="425"
+      mnc="15"
+      apn="hcminternet"
+      type="default,supl"
+  />
+
+  <apn carrier="Home Cellular MMS"
+      mcc="425"
+      mnc="15"
+      apn="hcmMMS"
+      mmsc="http://82.166.164.229:9000/mmsc"
+      mmsproxy="82.166.164.229"
+      mmsport="8898"
+      type="mms"
+  />
+
   <apn carrier="Rami Levi 3G"
       mcc="425"
       mnc="16"
@@ -14610,6 +14700,46 @@
       type="mms"
   />
 
+  <apn carrier="TRUE-H INTERNET"
+      mcc="520"
+      mnc="04"
+      apn="internet"
+      user="true"
+      password="true"
+      authtype="1"
+      type="default,supl"
+  />
+
+  <apn carrier="TRUE-H MMS"
+      mcc="520"
+      mnc="04"
+      apn="hmms"
+      user="true"
+      password="true"
+      authtype="1"
+      mmsc="http://mms.trueh.com:8002/"
+      mmsproxy="10.4.7.39"
+      mmsport="8080"
+      type="mms"
+  />
+
+  <apn carrier="dtac Internet"
+      mcc="520"
+      mnc="05"
+      apn="www.dtac.co.th"
+      type="default,supl"
+  />
+
+  <apn carrier="dtac MMS"
+      mcc="520"
+      mnc="05"
+      apn="mms"
+      mmsc="http://mms2.dtac.co.th:8002/"
+      mmsproxy="10.10.10.10"
+      mmsport="8080"
+      type="mms"
+  />
+
   <apn carrier="TOT 3G Internet"
       mcc="520"
       mnc="15"
@@ -17507,7 +17637,7 @@
       type="mms"
   />
 
-  <apn carrier="TIM Connect"
+  <apn carrier="TIM CONNECT"
       mcc="724"
       mnc="02"
       apn="timbrasil.br"
@@ -17517,10 +17647,10 @@
       mmsproxy="200.179.66.242"
       mmsport="8080"
       authtype="1"
-      type="default,supl,mms"
+      type="default,mms"
   />
 
-  <apn carrier="TIM Connect"
+  <apn carrier="TIM CONNECT"
       mcc="724"
       mnc="03"
       apn="timbrasil.br"
@@ -17530,10 +17660,10 @@
       mmsproxy="200.179.66.242"
       mmsport="8080"
       authtype="1"
-      type="default,supl,mms"
+      type="default,mms"
   />
 
-  <apn carrier="TIM Connect"
+  <apn carrier="TIM CONNECT"
       mcc="724"
       mnc="04"
       apn="timbrasil.br"
@@ -17543,7 +17673,7 @@
       mmsproxy="200.179.66.242"
       mmsport="8080"
       authtype="1"
-      type="default,supl,mms"
+      type="default,mms"
   />
 
   <apn carrier="Java Session"
@@ -17552,8 +17682,8 @@
       apn="java.claro.com.br"
       user="claro"
       password="claro"
-      authtype="1"
-      type="default,supl"
+      authtype="0"
+      type="default"
   />
 
   <apn carrier="Claro Foto"
@@ -17579,6 +17709,7 @@
       mmsproxy="200.142.130.104"
       mmsport="80"
       authtype="1"
+      protocol="IPV4V6"
       type="mms"
   />
 
@@ -17589,7 +17720,8 @@
       user="vivo"
       password="vivo"
       authtype="1"
-      type="default,supl"
+      protocol="IPV4V6"
+      type="default"
   />
 
   <apn carrier="SCTL MMS"
@@ -17620,7 +17752,9 @@
       apn="zap.vivo.com.br"
       user="vivo"
       password="vivo"
-      type="default,supl"
+      authtype="1"
+      protocol="IPV4V6"
+      type="default"
   />
 
   <apn carrier="Vivo MMS"
@@ -17633,6 +17767,7 @@
       mmsproxy="200.142.130.104"
       mmsport="80"
       authtype="1"
+      protocol="IPV4V6"
       type="mms"
   />
 
@@ -17646,6 +17781,7 @@
       mmsproxy="200.142.130.104"
       mmsport="80"
       authtype="1"
+      protocol="IPV4V6"
       type="mms"
   />
 
@@ -17656,7 +17792,8 @@
       user="vivo"
       password="vivo"
       authtype="1"
-      type="default,supl"
+      protocol="IPV4V6"
+      type="default"
   />
 
 
@@ -17683,6 +17820,29 @@
       type="mms"
   />
 
+  <apn carrier="Oi GPRS Internet"
+      mcc="724"
+      mnc="16"
+      apn="gprs.oi.com.br"
+      protocol="IPV4V6"
+      authtype="0"
+      type="default"
+  />
+
+  <apn carrier="MMS GPRS"
+      mcc="724"
+      mnc="16"
+      apn="mmsgprs.oi.com.br"
+      user="oimms"
+      password="oioioi"
+      mmsc="http://200.222.42.204:8002"
+      mmsproxy="192.168.10.50"
+      mmsport="3128"
+      authtype="1"
+      protocol="IPV4V6"
+      type="mms"
+  />
+
   <apn carrier="TelemigC GPRS"
       mcc="724"
       mnc="19"
@@ -17711,10 +17871,10 @@
       user="vivo"
       password="vivo"
       authtype="1"
-      type="default,supl"
+      protocol="IPV4V6"
+      type="default"
   />
 
-
   <apn carrier="Vivo MMS"
       mcc="724"
       mnc="23"
@@ -17725,6 +17885,7 @@
       mmsproxy="200.142.130.104"
       mmsport="80"
       authtype="1"
+      protocol="IPV4V6"
       type="mms"
   />
 
@@ -17751,27 +17912,61 @@
       type="mms"
   />
 
-  <apn carrier="OI GPRS"
+  <apn carrier="Oi GPRS Internet"
       mcc="724"
       mnc="31"
       apn="gprs.oi.com.br"
-      authtype="1"
-      type="default,supl"
+      protocol="IPV4V6"
+      authtype="0"
+      type="default"
   />
 
-  <apn carrier="OI MMS"
+  <apn carrier="MMS GPRS"
       mcc="724"
       mnc="31"
       apn="mmsgprs.oi.com.br"
       user="oimms"
-      password="oimms"
+      password="oioioi"
       mmsc="http://200.222.42.204:8002"
       mmsproxy="192.168.10.50"
       mmsport="3128"
       authtype="1"
+      protocol="IPV4V6"
       type="mms"
   />
 
+  <apn carrier='Nextel GPS'
+      mcc='724'
+      mnc='39'
+      apn='gps.nextel3g.net.br'
+      server='http://supl.nextel3g.net.br'
+      authtype='0'
+      type='supl'
+      protocol='IPV4V6'
+      roaming_protocol='IPV4V6'
+  />
+
+  <apn carrier='Nextel MMS'
+      mcc='724'
+      mnc='39'
+      apn='mms.nextel3g.net.br'
+      authtype='0'
+      mmsc='http://3gmms.nextel3g.net.br'
+      mmsproxy='129.192.129.104'
+      mmsport='8080'
+      type='mms'
+  />
+
+  <apn carrier='Nextel WAP'
+      mcc='724'
+      mnc='39'
+      apn='wap.nextel3g.net.br'
+      authtype='0'
+      type='default'
+      protocol='IPV4V6'
+      roaming_protocol='IPV4V6'
+  />
+
   <apn carrier="Internet Movil"
       mcc="730"
       mnc="01"
diff --git a/camera/QCameraHWI.cpp b/camera/QCameraHWI.cpp
index f3608f8..a26811e 100755
--- a/camera/QCameraHWI.cpp
+++ b/camera/QCameraHWI.cpp
@@ -1,5 +1,5 @@
 /*
-** Copyright (c) 2011-2012 The Linux Foundation. All rights reserved.
+** Copyright (c) 2011-2012,2015 The Linux Foundation. All rights reserved.
 **
 ** Licensed under the Apache License, Version 2.0 (the "License");
 ** you may not use this file except in compliance with the License.
@@ -176,7 +176,6 @@
                     mSnapshotFormat(0),
                     mStartRecording(0),
                     mZslInterval(1),
-                    mNoDisplayMode(0),
                     mBrightness(0),
                     mContrast(0),
                     mEffects(0),
@@ -1031,7 +1030,7 @@
         ALOGV("%s:  HAL::startPreview begin", __func__);
 
         if(QCAMERA_HAL_PREVIEW_START == mPreviewState &&
-           (mPreviewWindow || isNoDisplayMode())) {
+           (mPreviewWindow)) {
             ALOGD("%s:  start preview now", __func__);
             retVal = startPreview2();
             if(retVal == NO_ERROR)
@@ -2677,11 +2676,6 @@
     ALOGV("%s: X", __func__);
 }
 
-bool QCameraHardwareInterface::isNoDisplayMode()
-{
-  return (mNoDisplayMode != 0);
-}
-
 void QCameraHardwareInterface::pausePreviewForZSL()
 {
     ALOGV("%s: mRestartPreview %d", __func__, mRestartPreview);
diff --git a/camera/QCameraHWI.h b/camera/QCameraHWI.h
index f7e58ef..1a1604c 100755
--- a/camera/QCameraHWI.h
+++ b/camera/QCameraHWI.h
@@ -1,5 +1,5 @@
 /*
-** Copyright (c) 2011-2012 The Linux Foundation. All rights reserved.
+** Copyright (c) 2011-2012, 2015, The Linux Foundation. All rights reserved.
 **
 ** Licensed under the Apache License, Version 2.0 (the "License");
 ** you may not use this file except in compliance with the License.
@@ -453,7 +453,6 @@
     void processEvent(mm_camera_event_t *);
     int  getJpegQuality() const;
     int  getNumOfSnapshots(void) const;
-    int  getNumOfSnapshots(const QCameraParameters& params);
     int  getThumbSizesFromAspectRatio(uint32_t aspect_ratio,
                                      int *picture_width,
                                      int *picture_height);
@@ -493,7 +492,6 @@
       char* ext, int index);
     preview_format_info_t getPreviewFormatInfo( );
     bool isCameraReady();
-    bool isNoDisplayMode();
 
 private:
     int16_t  zoomRatios[MAX_ZOOM_RATIOS];
@@ -579,7 +577,7 @@
     status_t setVideoSize(const QCameraParameters& params);
     status_t setPictureSize(const QCameraParameters& params);
     status_t setJpegQuality(const QCameraParameters& params);
-    status_t setNumOfSnapshot(const QCameraParameters& params);
+    status_t setNumOfSnapshot();
     status_t setJpegRotation(int isZSL);
     int getJpegRotation(void);
     int getISOSpeedValue();
diff --git a/camera/QCameraHWI_Parm.cpp b/camera/QCameraHWI_Parm.cpp
index 72baa33..4eb8ca3 100644
--- a/camera/QCameraHWI_Parm.cpp
+++ b/camera/QCameraHWI_Parm.cpp
@@ -1,5 +1,5 @@
 /*
-** Copyright (c) 2011-2012 The Linux Foundation. All rights reserved.
+** Copyright (c) 2011-2012, 2015, The Linux Foundation. All rights reserved.
 **
 ** Licensed under the Apache License, Version 2.0 (the "License");
 ** you may not use this file except in compliance with the License.
@@ -1411,13 +1411,12 @@
     } else {
       mParameters.set("capture-burst-exposures", str_val);
     }
-    mParameters.set("num-snaps-per-shutter", params.get("num-snaps-per-shutter"));
 
     if ((rc = setAEBracket(params)))              final_rc = rc;
     //    if ((rc = setDenoise(params)))                final_rc = rc;
     if ((rc = setPreviewFpsRange(params)))              final_rc = rc;
     if((rc = setRecordingHint(params)))                 final_rc = rc;
-    if ((rc = setNumOfSnapshot(params)))                final_rc = rc;
+    if ((rc = setNumOfSnapshot()))                      final_rc = rc;
     if ((rc = setAecAwbLock(params)))                   final_rc = rc;
     if ((rc = setWhiteBalance(params)))                 final_rc = rc;
     const char *str = params.get(QCameraParameters::KEY_SCENE_MODE);
@@ -2167,6 +2166,14 @@
             if(strcmp(str,oldstr)) {
                 ALOGV("%s: valued changed from %s to %s",__func__,oldstr, str);
 
+                if (!strcmp(str, "hdr")) {
+                    ALOGV("%s: setting num-snaps-per-shutter to 2", __func__);
+                    mParameters.set("num-snaps-per-shutter", 2);
+                } else {
+                    ALOGV("%s: setting num-snaps-per-shutter to 1", __func__);
+                    mParameters.set("num-snaps-per-shutter", 1);
+                }
+
                 /* Check if we are either transitioning to/from HDR state
                    if yes preview needs restart*/
                 if(!strcmp(str, "hdr") || !strcmp(oldstr, "hdr") ) {
@@ -2180,8 +2187,10 @@
                         pausePreviewForZSL();
                     }
                 }
+
             }
 
+
             mParameters.set(QCameraParameters::KEY_SCENE_MODE, str);
             bool ret = native_set_parms(MM_CAMERA_PARM_BESTSHOT_MODE, sizeof(value),
                                        (void *)&value);
@@ -2849,16 +2858,10 @@
 }
 
 status_t QCameraHardwareInterface::
-setNumOfSnapshot(const QCameraParameters& params) {
+setNumOfSnapshot() {
     status_t rc = NO_ERROR;
 
-    int num_of_snapshot = getNumOfSnapshots(params);
-
-    if (num_of_snapshot <= 0) {
-        num_of_snapshot = 1;
-    }
-    ALOGV("number of snapshots = %d", num_of_snapshot);
-    mParameters.set("num-snaps-per-shutter", num_of_snapshot);
+    int num_of_snapshot = getNumOfSnapshots();
 
     bool result = native_set_parms(MM_CAMERA_PARM_SNAPSHOT_BURST_NUM,
                                    sizeof(int),
@@ -3188,7 +3191,7 @@
     if(!strcmp(str2, "hdr")) {
         str="HDR";
     }   else {
-        str = params.get(QCameraParameters::KEY_AE_BRACKET_HDR);
+        str=QCameraParameters::AE_BRACKET_HDR_OFF;
     }
 
     if (str != NULL) {
@@ -3571,22 +3574,6 @@
     }
 }
 
-int QCameraHardwareInterface::getNumOfSnapshots(const QCameraParameters& params)
-{
-    char prop[PROPERTY_VALUE_MAX];
-    memset(prop, 0, sizeof(prop));
-    property_get("persist.camera.snapshot.number", prop, "0");
-    ALOGV("%s: prop enable/disable = %d", __func__, atoi(prop));
-    if (atoi(prop)) {
-        ALOGV("%s: Reading maximum no of snapshots = %d"
-             "from properties", __func__, atoi(prop));
-        return atoi(prop);
-    } else {
-        return params.getInt("num-snaps-per-shutter");
-    }
-
-}
-
 int QCameraHardwareInterface::
 getThumbSizesFromAspectRatio(uint32_t aspect_ratio,
                              int *picture_width,
diff --git a/camera/QCameraHWI_Preview.cpp b/camera/QCameraHWI_Preview.cpp
index 658bd84..30927c5 100644
--- a/camera/QCameraHWI_Preview.cpp
+++ b/camera/QCameraHWI_Preview.cpp
@@ -1,5 +1,5 @@
 /*
-** Copyright (c) 2011-2012 The Linux Foundation. All rights reserved.
+** Copyright (c) 2011-2012,2015 The Linux Foundation. All rights reserved.
 **
 ** Licensed under the Apache License, Version 2.0 (the "License");
 ** you may not use this file except in compliance with the License.
@@ -315,96 +315,6 @@
     return NO_ERROR;
 }
 
-
-status_t  QCameraStream_preview::getBufferNoDisplay( )
-{
-  int err = 0;
-  status_t ret = NO_ERROR;
-  int i, num_planes, frame_len, y_off, cbcr_off;
-  cam_ctrl_dimension_t dim;
-  uint32_t planes[VIDEO_MAX_PLANES];
-
-  ALOGV("%s : E ", __FUNCTION__);
-
-
-  ret = cam_config_get_parm(mCameraId, MM_CAMERA_PARM_DIMENSION, &dim);
-  if(ret != NO_ERROR) {
-      ALOGE("%s: display format %d is not supported", __func__, dim.prev_format);
-    goto end;
-  }
-  mHalCamCtrl->mPreviewMemoryLock.lock();
-  mHalCamCtrl->mNoDispPreviewMemory.buffer_count = kPreviewBufferCount;
-  if(mHalCamCtrl->isZSLMode()) {
-    if(mHalCamCtrl->getZSLQueueDepth() > kPreviewBufferCount - 3)
-      mHalCamCtrl->mNoDispPreviewMemory.buffer_count =
-      mHalCamCtrl->getZSLQueueDepth() + 3;
-  }
-
-  num_planes = dim.display_frame_offset.num_planes;
-  for ( i = 0; i < num_planes; i++) {
-    planes[i] = dim.display_frame_offset.mp[i].len;
-  }
-
-  frame_len = dim.picture_frame_offset.frame_len;
-  y_off = dim.picture_frame_offset.mp[0].offset;
-  cbcr_off = dim.picture_frame_offset.mp[1].offset;
-  ALOGV("%s: main image: rotation = %d, yoff = %d, cbcroff = %d, size = %d, width = %d, height = %d",
-       __func__, dim.rotation, y_off, cbcr_off, frame_len,
-       dim.display_width, dim.display_height);
-  if (mHalCamCtrl->initHeapMem(&mHalCamCtrl->mNoDispPreviewMemory,
-     mHalCamCtrl->mNoDispPreviewMemory.buffer_count,
-     frame_len, y_off, cbcr_off, MSM_PMEM_MAINIMG,
-     NULL,NULL, num_planes, planes) < 0) {
-              ret = NO_MEMORY;
-              goto end;
-  };
-
-  memset(&mHalCamCtrl->mMetadata, 0, sizeof(mHalCamCtrl->mMetadata));
-  memset(mHalCamCtrl->mFace, 0, sizeof(mHalCamCtrl->mFace));
-
-  ALOGV(" %s : X ",__FUNCTION__);
-end:
-  //mDisplayLock.unlock();
-  mHalCamCtrl->mPreviewMemoryLock.unlock();
-
-  return NO_ERROR;
-}
-
-status_t   QCameraStream_preview::freeBufferNoDisplay()
-{
-  int err = 0;
-  status_t ret = NO_ERROR;
-
-  ALOGV(" %s : E ", __FUNCTION__);
-
-  //mDisplayLock.lock();
-  mHalCamCtrl->mPreviewMemoryLock.lock();
-  for (int cnt = 0; cnt < mHalCamCtrl->mNoDispPreviewMemory.buffer_count; cnt++) {
-      if (cnt < mHalCamCtrl->mNoDispPreviewMemory.buffer_count) {
-          if (NO_ERROR != mHalCamCtrl->sendUnMappingBuf(MSM_V4L2_EXT_CAPTURE_MODE_PREVIEW,
-                       cnt, mCameraId, CAM_SOCK_MSG_TYPE_FD_UNMAPPING)) {
-              ALOGE("%s: sending data Msg Failed", __func__);
-          }
-          if(mHalCamCtrl->isZSLMode()) {
-              if (NO_ERROR != mHalCamCtrl->sendUnMappingBuf(MSM_V4L2_EXT_CAPTURE_MODE_THUMBNAIL, cnt, mCameraId,
-                                                            CAM_SOCK_MSG_TYPE_FD_UNMAPPING)) {
-                  ALOGE("%s: Send socket msg to Unmap Failed", __func__);
-              }
-          }
-      }
-  }
-  mHalCamCtrl->releaseHeapMem(&mHalCamCtrl->mNoDispPreviewMemory);
-  memset(&mHalCamCtrl->mNoDispPreviewMemory, 0, sizeof(mHalCamCtrl->mNoDispPreviewMemory));
-  if (mDisplayBuf.preview.buf.mp != NULL) {
-      delete[] mDisplayBuf.preview.buf.mp;
-      mDisplayBuf.preview.buf.mp = NULL;
-  }
-
-  mHalCamCtrl->mPreviewMemoryLock.unlock();
-  ALOGV(" %s : X ",__FUNCTION__);
-  return NO_ERROR;
-}
-
 void QCameraStream_preview::notifyROIEvent(fd_roi_t roi)
 {
     camera_memory_t *data = mHalCamCtrl->mGetMemory(-1, 1, 1, NULL);
@@ -547,7 +457,6 @@
   mHalCamCtrl->mPreviewMemoryLock.lock();
   memset(&mHalCamCtrl->mPreviewMemory, 0, sizeof(mHalCamCtrl->mPreviewMemory));
   mHalCamCtrl->mPreviewMemoryLock.unlock();
-  memset(&mNotifyBuffer, 0, sizeof(mNotifyBuffer));
 
 /* get preview size, by qury mm_camera*/
   memset(&dim, 0, sizeof(cam_ctrl_dimension_t));
@@ -593,14 +502,14 @@
 
   /*allocate memory for the buffers*/
   for(int i = 0; i < mDisplayStreamBuf.num; i++){
-	  if (mHalCamCtrl->mPreviewMemory.private_buffer_handle[i] == NULL)
-		  continue;
+      if (mHalCamCtrl->mPreviewMemory.private_buffer_handle[i] == NULL)
+          continue;
       mDisplayStreamBuf.frame[i].fd = mHalCamCtrl->mPreviewMemory.private_buffer_handle[i]->fd;
       mDisplayStreamBuf.frame[i].cbcr_off = planes[0];
       mDisplayStreamBuf.frame[i].y_off = 0;
       mDisplayStreamBuf.frame[i].path = OUTPUT_TYPE_P;
-	  mHalCamCtrl->mPreviewMemory.addr_offset[i] =
-	      mHalCamCtrl->mPreviewMemory.private_buffer_handle[i]->offset;
+      mHalCamCtrl->mPreviewMemory.addr_offset[i] =
+              mHalCamCtrl->mPreviewMemory.private_buffer_handle[i]->offset;
       mDisplayStreamBuf.frame[i].buffer =
           (long unsigned int)mHalCamCtrl->mPreviewMemory.camera_memory[i]->data;
       mDisplayStreamBuf.frame[i].ion_alloc.len = mHalCamCtrl->mPreviewMemory.private_buffer_handle[i]->size;
@@ -658,6 +567,11 @@
         mDisplayBuf.preview.buf.mp[i].planes[j-1].length;
     }
 
+    if (mHalCamCtrl->mPreviewMemory.local_flag[i] == BUFFER_NOT_OWNED) {
+      mDisplayBuf.preview.no_enqueue_flag[i] = 1;
+    } else {
+      mDisplayBuf.preview.no_enqueue_flag[i] = 0;
+    }
     for (int j = 0; j < num_planes; j++)
       ALOGV("Planes: %d length: %d userptr: %lu offset: %d\n", j,
         mDisplayBuf.preview.buf.mp[i].planes[j].length,
@@ -680,151 +594,6 @@
     return ret;
 }
 
-status_t QCameraStream_preview::initPreviewOnlyBuffers()
-{
-  status_t ret = NO_ERROR;
-  int width = 0;  /* width of channel  */
-  int height = 0; /* height of channel */
-  uint32_t frame_len = 0; /* frame planner length */
-  int buffer_num = 4; /* number of buffers for display */
-  const char *pmem_region;
-  uint8_t num_planes = 0;
-  uint32_t planes[VIDEO_MAX_PLANES];
-
-  cam_ctrl_dimension_t dim;
-
-  ALOGV("%s:BEGIN",__func__);
-  memset(&mHalCamCtrl->mMetadata, 0, sizeof(camera_frame_metadata_t));
-  mHalCamCtrl->mPreviewMemoryLock.lock();
-  memset(&mHalCamCtrl->mNoDispPreviewMemory, 0, sizeof(mHalCamCtrl->mNoDispPreviewMemory));
-  mHalCamCtrl->mPreviewMemoryLock.unlock();
-  memset(&mNotifyBuffer, 0, sizeof(mNotifyBuffer));
-
-/* get preview size, by qury mm_camera*/
-  memset(&dim, 0, sizeof(cam_ctrl_dimension_t));
-  ret = cam_config_get_parm(mCameraId, MM_CAMERA_PARM_DIMENSION, &dim);
-  if (MM_CAMERA_OK != ret) {
-    ALOGE("%s: error - can't get camera dimension!", __func__);
-    ALOGV("%s: X", __func__);
-    return BAD_VALUE;
-  }else {
-    width =  dim.display_width;
-    height = dim.display_height;
-  }
-
-  ret = getBufferNoDisplay( );
-  if(ret != NO_ERROR) {
-    ALOGE("%s: cannot get memory from surface texture client, ret = %d", __func__, ret);
-    return ret;
-  }
-
-  /* set 4 buffers for display */
-  memset(&mDisplayStreamBuf, 0, sizeof(mDisplayStreamBuf));
-  mHalCamCtrl->mPreviewMemoryLock.lock();
-  this->mDisplayStreamBuf.num = mHalCamCtrl->mNoDispPreviewMemory.buffer_count;
-  this->myMode=myMode; /*Need to assign this in constructor after translating from mask*/
-  num_planes = dim.display_frame_offset.num_planes;
-  for (int i = 0; i < num_planes; i++) {
-    planes[i] = dim.display_frame_offset.mp[i].len;
-  }
-  this->mDisplayStreamBuf.frame_len = dim.display_frame_offset.frame_len;
-
-  memset(&mDisplayBuf, 0, sizeof(mDisplayBuf));
-  mDisplayBuf.preview.buf.mp = new mm_camera_mp_buf_t[mDisplayStreamBuf.num];
-  if (!mDisplayBuf.preview.buf.mp) {
-    ALOGE("%s Error allocating memory for mplanar struct ", __func__);
-  }
-  memset(mDisplayBuf.preview.buf.mp, 0,
-    mDisplayStreamBuf.num * sizeof(mm_camera_mp_buf_t));
-
-  /*allocate memory for the buffers*/
-  void *vaddr = NULL;
-  for(int i = 0; i < mDisplayStreamBuf.num; i++){
-	  if (mHalCamCtrl->mNoDispPreviewMemory.camera_memory[i] == NULL)
-		  continue;
-      mDisplayStreamBuf.frame[i].fd = mHalCamCtrl->mNoDispPreviewMemory.fd[i];
-      mDisplayStreamBuf.frame[i].cbcr_off = planes[0];
-      mDisplayStreamBuf.frame[i].y_off = 0;
-      mDisplayStreamBuf.frame[i].path = OUTPUT_TYPE_P;
-      mDisplayStreamBuf.frame[i].buffer =
-          (long unsigned int)mHalCamCtrl->mNoDispPreviewMemory.camera_memory[i]->data;
-      mDisplayStreamBuf.frame[i].ion_dev_fd = mHalCamCtrl->mNoDispPreviewMemory.main_ion_fd[i];
-      mDisplayStreamBuf.frame[i].fd_data = mHalCamCtrl->mNoDispPreviewMemory.ion_info_fd[i];
-
-    ALOGV("%s: idx = %d, fd = %d, size = %d, cbcr_offset = %d, y_offset = %d, "
-      "vaddr = 0x%x", __func__, i, mDisplayStreamBuf.frame[i].fd,
-      frame_len,
-      mDisplayStreamBuf.frame[i].cbcr_off, mDisplayStreamBuf.frame[i].y_off,
-      (uint32_t)mDisplayStreamBuf.frame[i].buffer);
-
-    if (NO_ERROR != mHalCamCtrl->sendMappingBuf(
-                        MSM_V4L2_EXT_CAPTURE_MODE_PREVIEW,
-                        i,
-                        mDisplayStreamBuf.frame[i].fd,
-                        mHalCamCtrl->mNoDispPreviewMemory.size,
-                        mCameraId, CAM_SOCK_MSG_TYPE_FD_MAPPING)) {
-      ALOGE("%s: sending mapping data Msg Failed", __func__);
-    }
-
-    if(mHalCamCtrl->isZSLMode()) {
-        if (NO_ERROR != mHalCamCtrl->sendMappingBuf(
-                    MSM_V4L2_EXT_CAPTURE_MODE_THUMBNAIL,
-                    i,
-                    mDisplayStreamBuf.frame[i].fd,
-                    mHalCamCtrl->mNoDispPreviewMemory.size,
-                    mCameraId, CAM_SOCK_MSG_TYPE_FD_MAPPING)) {
-            ALOGE("%s: sending mapping data Msg Failed", __func__);
-        }
-    }
-    mDisplayBuf.preview.buf.mp[i].frame = mDisplayStreamBuf.frame[i];
-    mDisplayBuf.preview.buf.mp[i].frame_offset = mDisplayStreamBuf.frame[i].y_off;
-    mDisplayBuf.preview.buf.mp[i].num_planes = num_planes;
-
-    /* Plane 0 needs to be set seperately. Set other planes
-     * in a loop. */
-    mDisplayBuf.preview.buf.mp[i].planes[0].length = planes[0];
-    mDisplayBuf.preview.buf.mp[i].planes[0].m.userptr = mDisplayStreamBuf.frame[i].fd;
-    mDisplayBuf.preview.buf.mp[i].planes[0].data_offset = 0;
-    mDisplayBuf.preview.buf.mp[i].planes[0].reserved[0] =
-      mDisplayBuf.preview.buf.mp[i].frame_offset;
-    for (int j = 1; j < num_planes; j++) {
-      mDisplayBuf.preview.buf.mp[i].planes[j].length = planes[j];
-      mDisplayBuf.preview.buf.mp[i].planes[j].m.userptr =
-        mDisplayStreamBuf.frame[i].fd;
-      mDisplayBuf.preview.buf.mp[i].planes[j].data_offset = 0;
-      mDisplayBuf.preview.buf.mp[i].planes[j].reserved[0] =
-        mDisplayBuf.preview.buf.mp[i].planes[j-1].reserved[0] +
-        mDisplayBuf.preview.buf.mp[i].planes[j-1].length;
-    }
-
-    for (int j = 0; j < num_planes; j++)
-      ALOGV("Planes: %d length: %d userptr: %lu offset: %d\n", j,
-        mDisplayBuf.preview.buf.mp[i].planes[j].length,
-        mDisplayBuf.preview.buf.mp[i].planes[j].m.userptr,
-        mDisplayBuf.preview.buf.mp[i].planes[j].reserved[0]);
-  }/*end of for loop*/
-
- /* register the streaming buffers for the channel*/
-  mDisplayBuf.ch_type = MM_CAMERA_CH_PREVIEW;
-  mDisplayBuf.preview.num = mDisplayStreamBuf.num;
-  mHalCamCtrl->mPreviewMemoryLock.unlock();
-  ALOGV("%s:END",__func__);
-  return NO_ERROR;
-
-end:
-  if (MM_CAMERA_OK == ret ) {
-    ALOGV("%s: X - NO_ERROR ", __func__);
-    return NO_ERROR;
-  }
-
-    ALOGV("%s: out of memory clean up", __func__);
-  /* release the allocated memory */
-
-  ALOGV("%s: X - BAD_VALUE ", __func__);
-  return BAD_VALUE;
-}
-
-
 void QCameraStream_preview::dumpFrameToFile(struct msm_frame* newFrame)
 {
 #if 0
@@ -909,10 +678,9 @@
   mHalCamCtrl->dumpFrameToFile(frame->def.frame, HAL_DUMP_FRM_PREVIEW);
 
   mHalCamCtrl->mPreviewMemoryLock.lock();
-  mNotifyBuffer[frame->def.idx] = *frame;
 
-  ALOGV("Enqueue buf handle %p\n",
-  mHalCamCtrl->mPreviewMemory.buffer_handle[frame->def.idx]);
+  ALOGV("Enqueue buf handle %p, index %d\n",
+  mHalCamCtrl->mPreviewMemory.buffer_handle[frame->def.idx], frame->def.idx);
   ALOGV("%s: camera call genlock_unlock", __FUNCTION__);
 
     if (BUFFER_LOCKED == mHalCamCtrl->mPreviewMemory.local_flag[frame->def.idx]) {
@@ -989,10 +757,10 @@
               &buffer_handle, &tmp_stride);
   if (err == NO_ERROR && buffer_handle != NULL) {
 
-    ALOGV("%s: dequed buf hdl =%p", __func__, *buffer_handle);
     for(i = 0; i < mHalCamCtrl->mPreviewMemory.buffer_count; i++) {
         if(mHalCamCtrl->mPreviewMemory.buffer_handle[i] == buffer_handle) {
           mHalCamCtrl->mPreviewMemory.local_flag[i] = BUFFER_UNLOCKED;
+          ALOGV("%s: dequed buf hdl =%p, index = %d", __func__, *buffer_handle, i);
           break;
         }
     }
@@ -1006,9 +774,14 @@
            // return -EINVAL;
       } else  {
         mHalCamCtrl->mPreviewMemory.local_flag[i] = BUFFER_LOCKED;
-
-        if(MM_CAMERA_OK != cam_evt_buf_done(mCameraId, &mNotifyBuffer[i])) {
-            ALOGE("BUF DONE FAILED");
+        mm_camera_ch_data_buf_t notify;
+        memset(&notify, 0, sizeof(mm_camera_ch_data_buf_t));
+        notify.type = MM_CAMERA_CH_PREVIEW;
+        notify.def.idx = i;
+        notify.def.frame = &mDisplayStreamBuf.frame[i];
+        ALOGV("%s: queueing buffer idx is %d", __func__, i);
+        if(MM_CAMERA_OK != cam_evt_buf_done(mCameraId, &notify)) {
+            ALOGE("%s: BUF DONE FAILED");
         }
       }
      }
@@ -1126,126 +899,10 @@
   return NO_ERROR;
 }
 
-
-status_t QCameraStream_preview::processPreviewFrameWithOutDisplay(
-  mm_camera_ch_data_buf_t *frame)
-{
-  ALOGV("%s",__func__);
-  int err = 0;
-  int msgType = 0;
-  int i;
-  camera_memory_t *data = NULL;
-  camera_frame_metadata_t *metadata = NULL;
-
-  Mutex::Autolock lock(mStopCallbackLock);
-  if(!mActive) {
-    ALOGV("Preview Stopped. Returning callback");
-    return NO_ERROR;
-  }
-  if(mHalCamCtrl==NULL) {
-    ALOGE("%s: X: HAL control object not set",__func__);
-    /*Call buf done*/
-    return BAD_VALUE;
-  }
-
-  if (UNLIKELY(mHalCamCtrl->mDebugFps)) {
-      mHalCamCtrl->debugShowPreviewFPS();
-  }
-  //dumpFrameToFile(frame->def.frame);
-  mHalCamCtrl->dumpFrameToFile(frame->def.frame, HAL_DUMP_FRM_PREVIEW);
-
-  mHalCamCtrl->mPreviewMemoryLock.lock();
-  mNotifyBuffer[frame->def.idx] = *frame;
-
-  /* Save the last displayed frame. We'll be using it to fill the gap between
-     when preview stops and postview start during snapshot.*/
-  mLastQueuedFrame = &(mDisplayStreamBuf.frame[frame->def.idx]);
-  mHalCamCtrl->mPreviewMemoryLock.unlock();
-
-  mHalCamCtrl->mCallbackLock.lock();
-  camera_data_callback pcb = mHalCamCtrl->mDataCb;
-  mHalCamCtrl->mCallbackLock.unlock();
-  ALOGV("Message enabled = 0x%x", mHalCamCtrl->mMsgEnabled);
-
-  camera_memory_t *previewMem = NULL;
-  int previewWidth, previewHeight;
-  mHalCamCtrl->mParameters.getPreviewSize(&previewWidth, &previewHeight);
-
-#ifdef USE_ION
-  struct ion_flush_data cache_inv_data;
-  int ion_fd;
-  ion_fd = frame->def.frame->ion_dev_fd;
-  cache_inv_data.vaddr = (void *)frame->def.frame->buffer;
-  cache_inv_data.fd = frame->def.frame->fd;
-  cache_inv_data.handle = frame->def.frame->fd_data.handle;
-  cache_inv_data.length = frame->def.frame->ion_alloc.len;
-
-  if (mHalCamCtrl->cache_ops(ion_fd, &cache_inv_data,
-                                ION_IOC_CLEAN_INV_CACHES) < 0)
-    ALOGE("%s: Cache clean for Preview buffer %p fd = %d failed", __func__,
-      cache_inv_data.vaddr, cache_inv_data.fd);
-#endif
-
-  if (pcb != NULL) {
-      //Sending preview callback if corresponding Msgs are enabled
-      if(mHalCamCtrl->mMsgEnabled & CAMERA_MSG_PREVIEW_FRAME) {
-          msgType |=  CAMERA_MSG_PREVIEW_FRAME;
-          int previewBufSize;
-          /* For CTS : Forcing preview memory buffer lenth to be
-             'previewWidth * previewHeight * 3/2'.
-              Needed when gralloc allocated extra memory.*/
-          //Can add this check for other formats as well.
-          if( mHalCamCtrl->mPreviewFormat == CAMERA_YUV_420_NV21) {
-              previewBufSize = previewWidth * previewHeight * 3/2;
-              if(previewBufSize != mHalCamCtrl->mPreviewMemory.private_buffer_handle[frame->def.idx]->size) {
-                  previewMem = mHalCamCtrl->mGetMemory(mHalCamCtrl->mPreviewMemory.private_buffer_handle[frame->def.idx]->fd,
-                  previewBufSize, 1, mHalCamCtrl->mCallbackCookie);
-                  if (!previewMem || !previewMem->data) {
-                      ALOGE("%s: mGetMemory failed.\n", __func__);
-                  } else {
-                      data = previewMem;
-                  }
-              } else
-                    data = mHalCamCtrl->mPreviewMemory.camera_memory[frame->def.idx];//mPreviewHeap->mBuffers[frame->def.idx];
-          } else
-                data = mHalCamCtrl->mPreviewMemory.camera_memory[frame->def.idx];//mPreviewHeap->mBuffers[frame->def.idx];
-      } else {
-          data = NULL;
-      }
-
-      if(mHalCamCtrl->mMsgEnabled & CAMERA_MSG_PREVIEW_METADATA){
-          msgType  |= CAMERA_MSG_PREVIEW_METADATA;
-          metadata = &mHalCamCtrl->mMetadata;
-      } else {
-          metadata = NULL;
-      }
-      if(msgType) {
-          mStopCallbackLock.unlock();
-          if(mActive)
-            pcb(msgType, data, 0, metadata, mHalCamCtrl->mCallbackCookie);
-          if (previewMem)
-              previewMem->release(previewMem);
-          mStopCallbackLock.lock();
-      }
-
-      if(MM_CAMERA_OK != cam_evt_buf_done(mCameraId, &mNotifyBuffer[frame->def.idx])) {
-          ALOGE("BUF DONE FAILED");
-      }
-
-      ALOGV("end of cb");
-  }
-
-  return NO_ERROR;
-}
-
 status_t QCameraStream_preview::processPreviewFrame (
   mm_camera_ch_data_buf_t *frame)
 {
-  if (mHalCamCtrl->isNoDisplayMode()) {
-    return processPreviewFrameWithOutDisplay(frame);
-  } else {
-    return processPreviewFrameWithDisplay(frame);
-  }
+  return processPreviewFrameWithDisplay(frame);
 }
 
 // ---------------------------------------------------------------------------
@@ -1322,14 +979,8 @@
     previewFmt = mHalCamCtrl->getPreviewFormat();
     setFormat(MM_CAMERA_CH_PREVIEW_MASK, previewFmt);
 
-    if (mHalCamCtrl->isNoDisplayMode()) {
-        if(NO_ERROR!=initPreviewOnlyBuffers()){
-            return BAD_VALUE;
-        }
-    } else {
-        if(NO_ERROR!=initDisplayBuffers()){
-            return BAD_VALUE;
-        }
+    if(NO_ERROR!=initDisplayBuffers()){
+        return BAD_VALUE;
     }
     ALOGV("Debug : %s : initDisplayBuffers",__func__);
 
@@ -1427,11 +1078,7 @@
     /* In case of a clean stop, we need to clean all buffers*/
     ALOGV("Debug : %s : Buffer Unprepared",__func__);
     /*free camera_memory handles and return buffer back to surface*/
-    if (! mHalCamCtrl->isNoDisplayMode() ) {
-      putBufferToSurface();
-    } else {
-      freeBufferNoDisplay( );
-    }
+    putBufferToSurface();
 
     ALOGV("%s: X", __func__);
 
diff --git a/camera/QCameraHWI_Record.cpp b/camera/QCameraHWI_Record.cpp
index f9da650..b1fc886 100644
--- a/camera/QCameraHWI_Record.cpp
+++ b/camera/QCameraHWI_Record.cpp
@@ -1,5 +1,5 @@
 /*
-** Copyright (c) 2011 The Linux Foundation. All rights reserved.
+** Copyright (c) 2011,2015 The Linux Foundation. All rights reserved.
 **
 ** Licensed under the Apache License, Version 2.0 (the "License");
 ** you may not use this file except in compliance with the License.
@@ -506,6 +506,8 @@
           mRecordBuf.video.video.buf.mp[cnt].planes[j-1].reserved[0] +
           mRecordBuf.video.video.buf.mp[cnt].planes[j-1].length;
       }
+
+      mRecordBuf.video.video.no_enqueue_flag[cnt] = 0;
     }
 
     //memset(&mRecordBuf, 0, sizeof(mRecordBuf));
diff --git a/camera/QCameraHWI_Still.cpp b/camera/QCameraHWI_Still.cpp
index 34d8765..d3fe706 100755
--- a/camera/QCameraHWI_Still.cpp
+++ b/camera/QCameraHWI_Still.cpp
@@ -2092,12 +2092,10 @@
 
         if(mHalCamCtrl->mHdrMode == HDR_MODE) {
             if ((hdrRawCount % 3) != 2) {
+                hdrRawCount++;
                 mStopCallbackLock.unlock();
                 return NO_ERROR;
             }
-            else {
-                hdrRawCount++;
-            }
         }
 
         if (rc != NO_ERROR)
diff --git a/camera/QCameraStream.h b/camera/QCameraStream.h
index 5724dbb..d9b0de3 100755
--- a/camera/QCameraStream.h
+++ b/camera/QCameraStream.h
@@ -1,6 +1,6 @@
 /*
 ** Copyright 2008, Google Inc.
-** Copyright (c) 2009-2012, The Linux Foundation. All rights reserved.
+** Copyright (c) 2009-2012,2015, The Linux Foundation. All rights reserved.
 **
 ** Licensed under the Apache License, Version 2.0 (the "License");
 ** you may not use this file except in compliance with the License.
@@ -218,15 +218,11 @@
     void *getLastQueuedFrame(void);
     /*init preview buffers with display case*/
     status_t initDisplayBuffers();
-    /*init preview buffers without display case*/
-    status_t initPreviewOnlyBuffers();
 
     status_t processPreviewFrame(mm_camera_ch_data_buf_t *frame);
 
     /*init preview buffers with display case*/
     status_t processPreviewFrameWithDisplay(mm_camera_ch_data_buf_t *frame);
-    /*init preview buffers without display case*/
-    status_t processPreviewFrameWithOutDisplay(mm_camera_ch_data_buf_t *frame);
 
     int setPreviewWindow(preview_stream_ops_t* window);
     void notifyROIEvent(fd_roi_t roi);
@@ -238,10 +234,6 @@
     status_t                 getBufferFromSurface();
     status_t                 putBufferToSurface();
 
-    /*allocate and free buffers without display case*/
-    status_t                 getBufferNoDisplay();
-    status_t                 freeBufferNoDisplay();
-
     void                     dumpFrameToFile(struct msm_frame* newFrame);
     bool                     mFirstFrameRcvd;
 
@@ -254,7 +246,6 @@
     Mutex                   mDisplayLock;
     preview_stream_ops_t   *mPreviewWindow;
     static const int        kPreviewBufferCount = PREVIEW_BUFFER_COUNT;
-    mm_camera_ch_data_buf_t mNotifyBuffer[16];
     int8_t                  mNumFDRcvd;
     int                     mVFEOutputs;
     int                     mHFRFrameCnt;
diff --git a/camera/mm-camera-interface/mm_camera.c b/camera/mm-camera-interface/mm_camera.c
index 512930b..ff50d58 100644
--- a/camera/mm-camera-interface/mm_camera.c
+++ b/camera/mm-camera-interface/mm_camera.c
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+Copyright (c) 2011-2012,2015, The Linux Foundation. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -690,14 +690,6 @@
     return rc;
 }
 
-int32_t mm_camera_enqueue_buf(mm_camera_obj_t * my_obj, mm_camera_reg_buf_t *buf)
-{
-    int32_t rc = -MM_CAMERA_E_GENERAL;
-    rc = mm_camera_ch_fn(my_obj,    buf->ch_type,
-                    MM_CAMERA_STATE_EVT_ENQUEUE_BUF, (void *)&buf->preview);
-    return rc;
-}
-
 int32_t mm_camera_prepare_buf(mm_camera_obj_t * my_obj, mm_camera_reg_buf_t *buf)
 {
     int32_t rc = -MM_CAMERA_E_GENERAL;
diff --git a/camera/mm-camera-interface/mm_camera.h b/camera/mm-camera-interface/mm_camera.h
index 0d62fbe..57c229b 100644
--- a/camera/mm-camera-interface/mm_camera.h
+++ b/camera/mm-camera-interface/mm_camera.h
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+Copyright (c) 2011-2012,2015, The Linux Foundation. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -58,7 +58,6 @@
     MM_CAMERA_STATE_EVT_GET_CROP,
     MM_CAMERA_STATE_EVT_DISPATCH_BUFFERED_FRAME,
     MM_CAMERA_STATE_EVT_REQUEST_BUF, // request amount of buffers to kernel only
-    MM_CAMERA_STATE_EVT_ENQUEUE_BUF, // enqueue some of buffers to kernel only
     MM_CAMERA_STATE_EVT_MAX
 } mm_camera_state_evt_type_t;
 
@@ -114,7 +113,7 @@
     mm_camera_frame_queue_t readyq;
     int32_t num_frame;
     uint32_t frame_len;
-    int8_t reg_flag;
+    int8_t reg_flag[MM_CAMERA_MAX_NUM_FRAMES];
     uint32_t frame_offset[MM_CAMERA_MAX_NUM_FRAMES];
     mm_camera_frame_t frame[MM_CAMERA_MAX_NUM_FRAMES];
     int8_t ref_count[MM_CAMERA_MAX_NUM_FRAMES];
@@ -302,7 +301,6 @@
 extern int32_t mm_camera_set_parm(mm_camera_obj_t * my_obj,
                                             mm_camera_parm_t *parm);
 extern int32_t mm_camera_request_buf(mm_camera_obj_t * my_obj, mm_camera_reg_buf_t *buf);
-extern int32_t mm_camera_enqueue_buf(mm_camera_obj_t * my_obj, mm_camera_reg_buf_t *buf);
 extern int32_t mm_camera_prepare_buf(mm_camera_obj_t * my_obj, mm_camera_reg_buf_t *buf);
 extern int32_t mm_camera_unprepare_buf(mm_camera_obj_t * my_obj, mm_camera_channel_type_t ch_type);
 extern int mm_camera_poll_thread_launch(mm_camera_obj_t * my_obj, int ch_type);
diff --git a/camera/mm-camera-interface/mm_camera_channel.c b/camera/mm-camera-interface/mm_camera_channel.c
index 40f3fb0..51b0f2c 100755
--- a/camera/mm-camera-interface/mm_camera_channel.c
+++ b/camera/mm-camera-interface/mm_camera_channel.c
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+Copyright (c) 2011-2012,2015, The Linux Foundation. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -721,7 +721,6 @@
         break;
     case MM_CAMERA_STATE_EVT_REG_BUF:
     case MM_CAMERA_STATE_EVT_REQUEST_BUF:
-    case MM_CAMERA_STATE_EVT_ENQUEUE_BUF:
         rc = mm_camera_ch_util_reg_buf(my_obj, ch_type, evt, val);
         break;
     case MM_CAMERA_STATE_EVT_UNREG_BUF:
diff --git a/camera/mm-camera-interface/mm_camera_interface2.c b/camera/mm-camera-interface/mm_camera_interface2.c
index f6ccca9..0d46afb 100755
--- a/camera/mm-camera-interface/mm_camera_interface2.c
+++ b/camera/mm-camera-interface/mm_camera_interface2.c
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+Copyright (c) 2011-2012,2015, The Linux Foundation. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -181,24 +181,6 @@
     return rc;
 }
 
-static int32_t mm_camera_cfg_enqueue_buf(mm_camera_t * camera,
-                                         mm_camera_reg_buf_t *buf)
-{
-    int32_t rc = -MM_CAMERA_E_GENERAL;
-    uint32_t tmp;
-    mm_camera_obj_t * my_obj = NULL;
-
-    pthread_mutex_lock(&g_mutex);
-    my_obj = g_cam_ctrl.cam_obj[camera->camera_info.camera_id];
-    pthread_mutex_unlock(&g_mutex);
-    if(my_obj) {
-        pthread_mutex_lock(&my_obj->mutex);
-        rc =  mm_camera_enqueue_buf(my_obj, buf);
-        pthread_mutex_unlock(&my_obj->mutex);
-    }
-    return rc;
-}
-
 static int32_t mm_camera_cfg_prepare_buf(mm_camera_t * camera,
                                          mm_camera_reg_buf_t *buf)
 {
@@ -240,7 +222,6 @@
   .set_parm = mm_camera_cfg_set_parm,
   .get_parm = mm_camera_cfg_get_parm,
   .request_buf = mm_camera_cfg_request_buf,
-  .enqueue_buf = mm_camera_cfg_enqueue_buf,
   .prepare_buf = mm_camera_cfg_prepare_buf,
   .unprepare_buf = mm_camera_cfg_unprepare_buf
 };
@@ -799,17 +780,6 @@
   return rc;
 }
 
-int32_t cam_config_enqueue_buf(int cam_id, mm_camera_reg_buf_t *buf)
-{
-
-  int32_t rc = -1;
-  mm_camera_t * mm_cam = get_camera_by_id(cam_id);
-  if (mm_cam) {
-    rc = mm_cam->cfg->enqueue_buf(mm_cam, buf);
-  }
-  return rc;
-}
-
 int32_t cam_config_prepare_buf(int cam_id, mm_camera_reg_buf_t *buf)
 {
 
diff --git a/camera/mm-camera-interface/mm_camera_interface2.h b/camera/mm-camera-interface/mm_camera_interface2.h
index ba4dcd5..20153e4 100755
--- a/camera/mm-camera-interface/mm_camera_interface2.h
+++ b/camera/mm-camera-interface/mm_camera_interface2.h
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+Copyright (c) 2011-2012,2015, The Linux Foundation. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -177,6 +177,7 @@
 
 typedef struct {
   int8_t num;
+  int8_t no_enqueue_flag[MM_CAMERA_MAX_NUM_FRAMES];
   union {
       mm_camera_sp_buf_t sp;
       mm_camera_mp_buf_t *mp;
@@ -463,7 +464,6 @@
   mm_camera_parm_type_t parm_type,
   void* p_value);
 int32_t cam_config_request_buf(int cam_id, mm_camera_reg_buf_t *buf);
-int32_t cam_config_enqueue_buf(int cam_id, mm_camera_reg_buf_t *buf);
 int32_t cam_config_prepare_buf(int cam_id, mm_camera_reg_buf_t *buf);
 int32_t cam_config_unprepare_buf(int cam_id, mm_camera_channel_type_t ch_type);
 
diff --git a/camera/mm-camera-interface/mm_camera_stream.c b/camera/mm-camera-interface/mm_camera_stream.c
index e7ee4b1..ba60bcd 100644
--- a/camera/mm-camera-interface/mm_camera_stream.c
+++ b/camera/mm-camera-interface/mm_camera_stream.c
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+Copyright (c) 2011-2012,2015, The Linux Foundation. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -220,6 +220,10 @@
     stream->frame.frame[idx].frame.frame_id = vb.sequence;
     stream->frame.frame[idx].frame.ts.tv_sec  = vb.timestamp.tv_sec;
     stream->frame.frame[idx].frame.ts.tv_nsec = vb.timestamp.tv_usec * 1000;
+
+    CDBG("%s:type=%d,frame idx=%d, frame_id %d\n", __func__,
+      stream->stream_type, idx, vb.sequence);
+
     return idx;
 }
 
@@ -400,7 +404,7 @@
 
   rc = ioctl(stream->fd, VIDIOC_QBUF, &buffer);
   if (rc < 0) {
-      CDBG_ERROR("%s: VIDIOC_QBUF error = %d, stream type=%d\n", __func__, rc, stream->stream_type);
+      CDBG_ERROR("%s: VIDIOC_QBUF error = %d, stream type=%d, errno = %d\n", __func__, rc, stream->stream_type, errno);
       return rc;
   }
   CDBG("%s: X idx: %d, stream_type:%d", __func__, idx, stream->stream_type);
@@ -439,40 +443,6 @@
     return rc;
 }
 
-/* This function enqueue existing buffers (not first time allocated buffers from Surface) to kernel */
-static int mm_camera_stream_util_enqueue_buf(mm_camera_obj_t * my_obj,
-                      mm_camera_stream_t *stream,
-                      mm_camera_buf_def_t *vbuf)
-{
-    int32_t i, rc = MM_CAMERA_OK, j;
-
-    if(vbuf->num > MM_CAMERA_MAX_NUM_FRAMES) {
-        rc = -MM_CAMERA_E_GENERAL;
-        CDBG("%s: buf num %d > max limit %d\n",
-                 __func__, vbuf->num, MM_CAMERA_MAX_NUM_FRAMES);
-        goto end;
-    }
-
-    for(i = 0; i < vbuf->num; i++){
-        int idx = vbuf->buf.mp[i].idx;
-        ALOGV("%s: enqueue buf index = %d\n",__func__, idx);
-        if(idx < MM_CAMERA_MAX_NUM_FRAMES) {
-            ALOGV("%s: stream_fd = %d, frame_fd = %d, frame ID = %d, offset = %d\n",
-                     __func__, stream->fd, stream->frame.frame[i].frame.fd,
-                     idx, stream->frame.frame_offset[idx]);
-            rc = mm_camera_stream_qbuf(my_obj, stream, stream->frame.frame[idx].idx);
-            if (rc < 0) {
-                CDBG("%s: VIDIOC_QBUF rc = %d\n", __func__, rc);
-                goto end;
-            }
-            stream->frame.ref_count[idx] = 0;
-        }
-    }
-    stream->frame.qbuf = 1;
-end:
-    return rc;
-}
-
 static int mm_camera_stream_util_reg_buf(mm_camera_obj_t * my_obj,
                       mm_camera_stream_t *stream,
                       mm_camera_buf_def_t *vbuf)
@@ -548,15 +518,20 @@
             stream->frame.frame_offset[i] = 0;
         }
 
-        rc = mm_camera_stream_qbuf(my_obj, stream, stream->frame.frame[i].idx);
-        if (rc < 0) {
-            CDBG_ERROR("%s: VIDIOC_QBUF rc = %d\n", __func__, rc);
-            goto end;
+        if (!vbuf->no_enqueue_flag[i]) {
+            rc = mm_camera_stream_qbuf(my_obj, stream, stream->frame.frame[i].idx);
+            if (rc < 0) {
+                CDBG_ERROR("%s: VIDIOC_QBUF rc = %d\n", __func__, rc);
+                goto end;
+            }
+            stream->frame.ref_count[i] = 0;
+        } else {
+            stream->frame.ref_count[i] = 1;
         }
-        stream->frame.ref_count[i] = 0;
-        CDBG("%s: stream_fd = %d, frame_fd = %d, frame ID = %d, offset = %d\n",
+        stream->frame.reg_flag[i] = vbuf->no_enqueue_flag[i];
+        CDBG("%s: stream_fd = %d, frame_fd = %d, frame ID = %d, offset = %d, reg_flag = %d, ref_cnt = %d\n",
           __func__, stream->fd, stream->frame.frame[i].frame.fd,
-          i, stream->frame.frame_offset[i]);
+          i, stream->frame.frame_offset[i], stream->frame.reg_flag[i], stream->frame.ref_count[i]);
     }
     stream->frame.qbuf = 1;
 end:
@@ -707,10 +682,6 @@
     case MM_CAMERA_STATE_EVT_REQUEST_BUF:
         rc = mm_camera_stream_util_request_buf(my_obj, stream, ((mm_camera_buf_def_t *)val)->num);
         break;
-    case MM_CAMERA_STATE_EVT_ENQUEUE_BUF:
-        rc = mm_camera_stream_util_enqueue_buf(my_obj, stream, (mm_camera_buf_def_t *)val);
-        if(!rc) mm_camera_stream_util_set_state(stream, MM_CAMERA_STREAM_STATE_REG);
-        break;
     default:
         CDBG_ERROR("%s: Invalid evt=%d, stream_state=%d", __func__, evt,
           stream->state);
@@ -796,13 +767,16 @@
             int i = 0;
             mm_camera_frame_t *frame;
             if(stream->frame.qbuf == 0) {
+                CDBG("%s: queueing buffers during stream on", __func__);
                 for(i = 0; i < stream->frame.num_frame; i++) {
-                    rc = mm_camera_stream_qbuf(my_obj, stream,
-                             stream->frame.frame[i].idx);
-                    if (rc < 0) {
-                        CDBG_ERROR("%s: ioctl VIDIOC_QBUF error=%d, stream->type=%d\n",
-                           __func__, rc, stream->stream_type);
-                        return rc;
+                    if (!stream->frame.reg_flag[i]) {
+                        rc = mm_camera_stream_qbuf(my_obj, stream,
+                                 stream->frame.frame[i].idx);
+                        if (rc < 0) {
+                            CDBG_ERROR("%s: ioctl VIDIOC_QBUF error=%d, stream->type=%d\n",
+                               __func__, rc, stream->stream_type);
+                            return rc;
+                        }
                     }
                     stream->frame.ref_count[i] = 0;
                 }
@@ -820,9 +794,6 @@
                 mm_camera_stream_util_set_state(stream, MM_CAMERA_STREAM_STATE_ACTIVE);
         }
         break;
-    case MM_CAMERA_STATE_EVT_ENQUEUE_BUF:
-        rc = mm_camera_stream_util_enqueue_buf(my_obj, stream, (mm_camera_buf_def_t *)val);
-        break;
     default:
         CDBG_ERROR("%s: Invalid evt=%d, stream_state=%d", __func__, evt,
           stream->state);
@@ -862,10 +833,7 @@
             }
         }
         break;
-    case MM_CAMERA_STATE_EVT_ENQUEUE_BUF:
-        rc = mm_camera_stream_util_enqueue_buf(my_obj, stream, (mm_camera_buf_def_t *)val);
-        break;
-    default:
+   default:
         CDBG_ERROR("%s: Invalid evt=%d, stream_state=%d", __func__, evt,
           stream->state);
         return -1;
diff --git a/device.mk b/device.mk
index 1967fda..c622a80 100644
--- a/device.mk
+++ b/device.mk
@@ -57,7 +57,8 @@
 PRODUCT_COPY_FILES += \
 	device/lge/mako/WCNSS_cfg.dat:system/vendor/firmware/wlan/prima/WCNSS_cfg.dat \
 	device/lge/mako/WCNSS_qcom_cfg.ini:system/etc/wifi/WCNSS_qcom_cfg.ini \
-	device/lge/mako/WCNSS_qcom_wlan_nv.bin:system/etc/wifi/WCNSS_qcom_wlan_nv.bin
+	device/lge/mako/WCNSS_qcom_wlan_nv.bin:system/etc/wifi/WCNSS_qcom_wlan_nv.bin \
+	device/lge/mako/init.mako.wifi.sh:system/etc/init.mako.wifi.sh
 
 PRODUCT_COPY_FILES += \
 	device/lge/mako/audio_policy.conf:system/etc/audio_policy.conf
diff --git a/init.mako.rc b/init.mako.rc
index 7a2339d..40b81a1 100644
--- a/init.mako.rc
+++ b/init.mako.rc
@@ -147,16 +147,12 @@
 # to observe dnsmasq.leases file for dhcp information of soft ap.
     chown dhcp system /data/misc/dhcp
 
-    write /dev/wcnss_wlan 1
+    chown system system /dev/wcnss_wlan
     write /sys/module/wcnss_ssr_8960/parameters/enable_riva_ssr 1
 
     # Create directory used by audio subsystem
     mkdir /data/misc/audio 0770 audio audio
 
-    # Workaround for conn_init not copying the updated firmware
-    rm /data/misc/wifi/WCNSS_qcom_cfg.ini
-    rm /data/misc/wifi/WCNSS_qcom_wlan_nv.bin
-
     # Mounting of persist is moved to 'on emmc-fs' and 'on fs' sections
     # We chown/chmod /persist again so because mount is run as root + defaults
     chown system system /persist
@@ -399,10 +395,11 @@
     user camera
     group camera system inet input
 
-service conn_init /system/bin/conn_init
+service wcnss_init /system/bin/sh /system/etc/init.mako.wifi.sh
     class late_start
     user system
     group system wifi
+    seclabel u:r:conn_init:s0
     oneshot
 
 service bdAddrLoader /system/bin/bdAddrLoader -f /persist/bluetooth/.bdaddr -h -x
diff --git a/init.mako.wifi.sh b/init.mako.wifi.sh
new file mode 100644
index 0000000..e586e96
--- /dev/null
+++ b/init.mako.wifi.sh
@@ -0,0 +1,10 @@
+#!/system/bin/sh
+
+# Workaround for conn_init not copying the updated firmware
+rm /data/misc/wifi/WCNSS_qcom_cfg.ini
+rm /data/misc/wifi/WCNSS_qcom_wlan_nv.bin
+
+/system/bin/conn_init
+
+echo 1 > /dev/wcnss_wlan
+
diff --git a/overlay/frameworks/base/core/res/res/values-mcc530-mnc05/config.xml b/overlay/frameworks/base/core/res/res/values-mcc530-mnc05/config.xml
new file mode 100644
index 0000000..3dfbe0e
--- /dev/null
+++ b/overlay/frameworks/base/core/res/res/values-mcc530-mnc05/config.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+/*
+** Copyright 2014, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+-->
+
+<!-- These resources are around just to allow their values to be customized
+     for different hardware and product builds. -->
+<resources>
+    <!-- If this value is true, The mms content-disposition field is supported correctly.
+         If false, Content-disposition fragments are ignored -->
+    <bool name="config_mms_content_disposition_support">false</bool>
+</resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc724-mnc39/config.xml b/overlay/frameworks/base/core/res/res/values-mcc724-mnc39/config.xml
new file mode 100644
index 0000000..c200847
--- /dev/null
+++ b/overlay/frameworks/base/core/res/res/values-mcc724-mnc39/config.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+/*
+** Copyright 2014, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You my obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+-->
+
+<!-- These resources are around just to allow their values to be customized
+     for different hardware and product builds. -->
+<resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
+
+    <!-- Array of ConnectivityManager.TYPE_xxxx values allowable for tethering -->
+    <!-- Common options are [1, 4] for TYPE_WIFI and TYPE_MOBILE_DUN or
+    <!== [0,1,5,7] for TYPE_MOBILE, TYPE_WIFI, TYPE_MOBILE_HIPRI and TYPE_BLUETOOTH -->
+    <integer-array translatable="false" name="config_tether_upstream_types">
+      <item>1</item>
+      <item>4</item>
+      <item>7</item>
+      <item>9</item>
+    </integer-array>
+
+    <!-- String containing the apn value for tethering.  May be overriden by secure settings
+         TETHER_DUN_APN.  Value is a comma separated series of strings:
+         "name,apn,proxy,port,username,password,server,mmsc,mmsproxy,mmsport,mcc,mnc,auth,type"
+         note that empty fields can be ommitted: "name,apn,,,,,,,,,310,260,,DUN" -->
+    <string-array translatable="false" name="config_tether_apndata">
+        <item>Nextel Modem,modem.nextel3g.net.br,,,,,,,,,724,39,0,DUN</item>
+    </string-array>
+</resources>
diff --git a/sepolicy/conn_init.te b/sepolicy/conn_init.te
index 33f0cab..6491888 100644
--- a/sepolicy/conn_init.te
+++ b/sepolicy/conn_init.te
@@ -2,10 +2,11 @@
 type conn_init, domain;
 type conn_init_exec, exec_type, file_type;
 
-# Started by logwrapper in init
-domain_auto_trans(init, conn_init_exec, conn_init)
+init_daemon_domain(conn_init)
 
-allow conn_init devpts:chr_file { read write };
+# Runs init.mako.wifi.sh
+allow conn_init shell_exec:file { entrypoint read };
+allow conn_init conn_init_exec:file rx_file_perms;
 
 # Allow /persist/wifi access
 allow conn_init { persist_file persist_wifi_file }:dir search;
@@ -14,3 +15,8 @@
 # Allow /data/misc/wifi access for firmware files
 allow conn_init wifi_data_file:dir w_dir_perms;
 allow conn_init wifi_data_file:file create_file_perms;
+
+allow conn_init wlan_device:chr_file rw_file_perms;
+
+# init.mako.wifi.sh runs toolbox
+allow conn_init system_file:file execute_no_trans;
diff --git a/sepolicy/device.te b/sepolicy/device.te
index 81caeca..b6e993a 100644
--- a/sepolicy/device.te
+++ b/sepolicy/device.te
@@ -1,3 +1,5 @@
+type wlan_device, dev_type;
+
 type diag_device, dev_type;
 
 # Kickstart device used by QC qcks
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index a44c8b1..7805255 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -2,6 +2,9 @@
 /dev/kgsl-3d0       u:object_r:gpu_device:s0
 /dev/kgsl           u:object_r:gpu_device:s0
 
+# WLAN
+/dev/wcnss_wlan         u:object_r:wlan_device:s0
+
 # Image Rotator Driver
 /dev/msm_rotator    u:object_r:video_device:s0