Merge "init.shamu.usb.rc: Add support for USB MIDI function"
diff --git a/BoardConfig.mk b/BoardConfig.mk
index d025af7..29167cf 100644
--- a/BoardConfig.mk
+++ b/BoardConfig.mk
@@ -117,20 +117,24 @@
         atfwd.te \
         bluetooth.te \
         bluetooth_loader.te \
-        bootanim.te \
         bridge.te \
         camera.te \
+        cnd.te \
         device.te \
         domain.te \
         file.te \
+        fsck.te \
         gsiffd.te \
         ims.te \
+        init.te \
         irsc_util.te \
         mdm_helper.te \
         mediaserver.te \
+        mmi_touch_sh.te \
         mpdecision.te \
         netd.te \
         netmgrd.te \
+        wpa.te \
         platform_app.te \
         property.te \
         property_contexts \
@@ -140,7 +144,6 @@
         sensors.te \
         service.te \
         ss_ramdump.te \
-        surfaceflinger.te \
         system_app.te \
         system_server.te \
         tcmd.te \
@@ -150,7 +153,6 @@
         time.te \
         ueventd.te \
         untrusted_app.te \
-        zygote.te \
         file_contexts \
         genfs_contexts \
         service_contexts
diff --git a/camera/QCamera/HAL2/core/src/QCameraHWI_Metatags.cpp b/camera/QCamera/HAL2/core/src/QCameraHWI_Metatags.cpp
index 3d09228..8160459 100644
--- a/camera/QCamera/HAL2/core/src/QCameraHWI_Metatags.cpp
+++ b/camera/QCamera/HAL2/core/src/QCameraHWI_Metatags.cpp
@@ -33,7 +33,7 @@
 
 
 const uint32_t QCAvailableFormats[4] = {
-        HAL_PIXEL_FORMAT_RAW_SENSOR,
+        HAL_PIXEL_FORMAT_RAW16,
         HAL_PIXEL_FORMAT_BLOB,
         HAL_PIXEL_FORMAT_YV12,
         HAL_PIXEL_FORMAT_YCrCb_420_SP
diff --git a/camera/QCamera2/HAL3/QCamera3Channel.cpp b/camera/QCamera2/HAL3/QCamera3Channel.cpp
index 6b09df9..753d1c1 100644
--- a/camera/QCamera2/HAL3/QCamera3Channel.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Channel.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2014, The Linux Foundataion. All rights reserved.
+/* Copyright (c) 2012-2015, The Linux Foundataion. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -799,6 +799,11 @@
     int32_t resultFrameNumber;
     camera3_stream_buffer_t result;
 
+    if (NULL == stream) {
+        ALOGE("%s: Invalid stream", __func__);
+        return;
+    }
+
     if(!super_frame) {
          ALOGE("%s: Invalid Super buffer",__func__);
          return;
@@ -817,9 +822,7 @@
     frameIndex = (uint8_t)super_frame->bufs[0]->buf_idx;
     if(frameIndex >= mNumBufs) {
          ALOGE("%s: Error, Invalid index for buffer",__func__);
-         if(stream) {
-             stream->bufDone(frameIndex);
-         }
+         stream->bufDone(frameIndex);
          return;
     }
 
@@ -832,6 +835,17 @@
     result.status = CAMERA3_BUFFER_STATUS_OK;
     result.acquire_fence = -1;
     result.release_fence = -1;
+    int32_t rc = stream->bufRelease(frameIndex);
+    if (NO_ERROR != rc) {
+        ALOGE("%s: Error %d releasing stream buffer %d",
+                __func__, rc, frameIndex);
+    }
+
+    rc = mMemory.unregisterBuffer(frameIndex);
+    if (NO_ERROR != rc) {
+        ALOGE("%s: Error %d unregistering stream buffer %d",
+                __func__, rc, frameIndex);
+    }
 
     mChannelCB(NULL, &result, resultFrameNumber, mUserData);
     free(super_frame);
@@ -1411,6 +1425,11 @@
         ////Use below data to issue framework callback
         resultBuffer = (buffer_handle_t *)obj->mMemory.getBufferHandle(bufIdx);
         resultFrameNumber = obj->mMemory.getFrameNumber(bufIdx);
+        int32_t rc = obj->mMemory.unregisterBuffer(bufIdx);
+        if (NO_ERROR != rc) {
+            ALOGE("%s: Error %d unregistering stream buffer %d",
+                    __func__, rc, bufIdx);
+        }
 
         result.stream = obj->mCamera3Stream;
         result.buffer = resultBuffer;
diff --git a/camera/QCamera2/HAL3/QCamera3HWI.cpp b/camera/QCamera2/HAL3/QCamera3HWI.cpp
index f59e2a5..6086adb 100644
--- a/camera/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/camera/QCamera2/HAL3/QCamera3HWI.cpp
@@ -54,8 +54,6 @@
 
 namespace qcamera {
 
-#define MAX(a, b) ((a) > (b) ? (a) : (b))
-
 #define DATA_PTR(MEM_OBJ,INDEX) MEM_OBJ->getPtr( INDEX )
 
 #define EMPTY_PIPELINE_DELAY 2
diff --git a/camera/QCamera2/HAL3/QCamera3HWI.h b/camera/QCamera2/HAL3/QCamera3HWI.h
index ed8c558..c2ac724 100644
--- a/camera/QCamera2/HAL3/QCamera3HWI.h
+++ b/camera/QCamera2/HAL3/QCamera3HWI.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2013, The Linux Foundataion. All rights reserved.
+/* Copyright (c) 2012-2015, The Linux Foundataion. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -66,6 +66,9 @@
 #define FALSE 0
 #endif
 
+#define MAX(a, b) ((a) > (b) ? (a) : (b))
+#define MIN(a, b) ((a) < (b) ? (a) : (b))
+
 /* Time related macros */
 typedef int64_t nsecs_t;
 #define NSEC_PER_SEC 1000000000LL
diff --git a/camera/QCamera2/HAL3/QCamera3Mem.cpp b/camera/QCamera2/HAL3/QCamera3Mem.cpp
index 9ec6f79..d4416ef 100644
--- a/camera/QCamera2/HAL3/QCamera3Mem.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Mem.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2014, The Linux Foundataion. All rights reserved.
+/* Copyright (c) 2012-2015, The Linux Foundataion. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -97,12 +97,20 @@
  *==========================================================================*/
 int QCamera3Memory::cacheOpsInternal(int index, unsigned int cmd, void *vaddr)
 {
+    Mutex::Autolock lock(mLock);
+
     struct ion_flush_data cache_inv_data;
     struct ion_custom_data custom_data;
     int ret = OK;
 
-    if (index >= mBufferCount) {
-        ALOGE("%s: index %d out of bound [0, %d)", __func__, index, mBufferCount);
+    if (MM_CAMERA_MAX_NUM_FRAMES <= index) {
+        ALOGE("%s: index %d out of bound [0, %d)",
+                __func__, index, MM_CAMERA_MAX_NUM_FRAMES);
+        return BAD_INDEX;
+    }
+
+    if (0 == mMemInfo[index].handle) {
+        ALOGE("%s: Buffer at %d not registered", __func__, index);
         return BAD_INDEX;
     }
 
@@ -136,10 +144,17 @@
  *
  * RETURN     : file descriptor
  *==========================================================================*/
-int QCamera3Memory::getFd(int index) const
+int QCamera3Memory::getFd(int index)
 {
-    if (index >= mBufferCount)
+    Mutex::Autolock lock(mLock);
+
+    if (MM_CAMERA_MAX_NUM_FRAMES <= index) {
         return BAD_INDEX;
+    }
+
+    if (0 == mMemInfo[index].handle) {
+        return BAD_INDEX;
+    }
 
     return mMemInfo[index].fd;
 }
@@ -154,10 +169,17 @@
  *
  * RETURN     : buffer size
  *==========================================================================*/
-int QCamera3Memory::getSize(int index) const
+int QCamera3Memory::getSize(int index)
 {
-    if (index >= mBufferCount)
+    Mutex::Autolock lock(mLock);
+
+    if (MM_CAMERA_MAX_NUM_FRAMES <= index) {
         return BAD_INDEX;
+    }
+
+    if (0 == mMemInfo[index].handle) {
+        return BAD_INDEX;
+    }
 
     return (int)mMemInfo[index].size;
 }
@@ -171,8 +193,10 @@
  *
  * RETURN     : number of buffers allocated
  *==========================================================================*/
-int QCamera3Memory::getCnt() const
+int QCamera3Memory::getCnt()
 {
+    Mutex::Autolock lock(mLock);
+
     return mBufferCount;
 }
 
@@ -191,8 +215,10 @@
  *              none-zero failure code
  *==========================================================================*/
 int32_t QCamera3Memory::getBufDef(const cam_frame_len_offset_t &offset,
-        mm_camera_buf_def_t &bufDef, int index) const
+        mm_camera_buf_def_t &bufDef, int index)
 {
+    Mutex::Autolock lock(mLock);
+
     if (!mBufferCount) {
         ALOGE("Memory not allocated");
         return NO_INIT;
@@ -202,7 +228,7 @@
     bufDef.frame_len = mMemInfo[index].size;
     bufDef.mem_info = (void *)this;
     bufDef.num_planes = offset.num_planes;
-    bufDef.buffer = getPtr(index);
+    bufDef.buffer = getPtrLocked(index);
     bufDef.buf_idx = index;
 
     /* Plane 0 needs to be set separately. Set other planes in a loop */
@@ -401,16 +427,16 @@
 }
 
 /*===========================================================================
- * FUNCTION   : getPtr
+ * FUNCTION   : getPtrLocked
  *
- * DESCRIPTION: return buffer pointer
+ * DESCRIPTION: Return buffer pointer.
  *
  * PARAMETERS :
  *   @index   : index of the buffer
  *
  * RETURN     : buffer ptr
  *==========================================================================*/
-void *QCamera3HeapMemory::getPtr(int index) const
+void *QCamera3HeapMemory::getPtrLocked(int index)
 {
     if (index >= mBufferCount) {
         ALOGE("index out of bound");
@@ -420,6 +446,21 @@
 }
 
 /*===========================================================================
+ * FUNCTION   : getPtr
+ *
+ * DESCRIPTION: Return buffer pointer
+ *
+ * PARAMETERS :
+ *   @index   : index of the buffer
+ *
+ * RETURN     : buffer ptr
+ *==========================================================================*/
+void *QCamera3HeapMemory::getPtr(int index)
+{
+    return getPtrLocked(index);
+}
+
+/*===========================================================================
  * FUNCTION   : allocate
  *
  * DESCRIPTION: allocate requested number of buffers of certain size
@@ -513,7 +554,7 @@
  *              NO_ERROR  -- success
  *              none-zero failure code
  *==========================================================================*/
-int QCamera3HeapMemory::getRegFlags(uint8_t * regFlags) const
+int QCamera3HeapMemory::getRegFlags(uint8_t * regFlags)
 {
     int i;
     for (i = 0; i < mBufferCount; i ++)
@@ -607,61 +648,69 @@
     status_t ret = NO_ERROR;
     struct ion_fd_data ion_info_fd;
     void *vaddr = NULL;
+
+    int32_t idx = -1;
+
     CDBG(" %s : E ", __FUNCTION__);
 
     memset(&ion_info_fd, 0, sizeof(ion_info_fd));
 
-    if (mBufferCount >= (MM_CAMERA_MAX_NUM_FRAMES - 1)) {
-        ALOGE("%s: Number of buffers %d greater than what's supported %d",
-            __func__, mBufferCount, MM_CAMERA_MAX_NUM_FRAMES);
-        return -EINVAL;
-    }
-
     if (0 <= getMatchBufIndex((void *) buffer)) {
         ALOGV("%s: Buffer already registered", __func__);
         return ALREADY_EXISTS;
     }
 
-    mBufferHandle[mBufferCount] = buffer;
-    mPrivateHandle[mBufferCount] =
-        (struct private_handle_t *)(*mBufferHandle[mBufferCount]);
+    Mutex::Autolock lock(mLock);
+    if (mBufferCount >= (MM_CAMERA_MAX_NUM_FRAMES - 1)) {
+        ALOGE("%s: Number of buffers %d greater than what's supported %d",
+                __func__, mBufferCount, MM_CAMERA_MAX_NUM_FRAMES);
+        return BAD_INDEX;
+    }
 
-    setMetaData(mPrivateHandle[mBufferCount], UPDATE_COLOR_SPACE, &mColorSpace);
+    idx = getFreeIndexLocked();
+    if (0 > idx) {
+        ALOGE("%s: No available memory slots", __func__);
+        return BAD_INDEX;
+    }
 
-    mMemInfo[mBufferCount].main_ion_fd = open("/dev/ion", O_RDONLY);
-    if (mMemInfo[mBufferCount].main_ion_fd < 0) {
+    mBufferHandle[idx] = buffer;
+    mPrivateHandle[idx] = (struct private_handle_t *)(*mBufferHandle[idx]);
+
+    setMetaData(mPrivateHandle[idx], UPDATE_COLOR_SPACE, &mColorSpace);
+
+    mMemInfo[idx].main_ion_fd = open("/dev/ion", O_RDONLY);
+    if (mMemInfo[idx].main_ion_fd < 0) {
         ALOGE("%s: failed: could not open ion device", __func__);
         ret = NO_MEMORY;
         goto end;
     } else {
-        ion_info_fd.fd = mPrivateHandle[mBufferCount]->fd;
-        if (ioctl(mMemInfo[mBufferCount].main_ion_fd,
+        ion_info_fd.fd = mPrivateHandle[idx]->fd;
+        if (ioctl(mMemInfo[idx].main_ion_fd,
                   ION_IOC_IMPORT, &ion_info_fd) < 0) {
             ALOGE("%s: ION import failed\n", __func__);
-            close(mMemInfo[mBufferCount].main_ion_fd);
+            close(mMemInfo[idx].main_ion_fd);
             ret = NO_MEMORY;
             goto end;
         }
     }
     ALOGV("%s: idx = %d, fd = %d, size = %d, offset = %d",
-            __func__, mBufferCount, mPrivateHandle[mBufferCount]->fd,
-            mPrivateHandle[mBufferCount]->size,
-            mPrivateHandle[mBufferCount]->offset);
-    mMemInfo[mBufferCount].fd =
-            mPrivateHandle[mBufferCount]->fd;
-    mMemInfo[mBufferCount].size =
-            mPrivateHandle[mBufferCount]->size;
-    mMemInfo[mBufferCount].handle = ion_info_fd.handle;
+            __func__, idx, mPrivateHandle[idx]->fd,
+            mPrivateHandle[idx]->size,
+            mPrivateHandle[idx]->offset);
+    mMemInfo[idx].fd = mPrivateHandle[idx]->fd;
+    mMemInfo[idx].size = mPrivateHandle[idx]->size;
+    mMemInfo[idx].handle = ion_info_fd.handle;
 
     vaddr = mmap(NULL,
-            mMemInfo[mBufferCount].size,
+            mMemInfo[idx].size,
             PROT_READ | PROT_WRITE,
             MAP_SHARED,
-            mMemInfo[mBufferCount].fd, 0);
+            mMemInfo[idx].fd, 0);
     if (vaddr == MAP_FAILED) {
+        mMemInfo[idx].handle = 0;
         ret = NO_MEMORY;
     } else {
-        mPtr[mBufferCount] = vaddr;
+        mPtr[idx] = vaddr;
         mBufferCount++;
     }
 
@@ -671,6 +720,77 @@
 }
 
 /*===========================================================================
+ * FUNCTION   : unregisterBufferLocked
+ *
+ * DESCRIPTION: Unregister buffer. Please note that this method has to be
+ *              called with 'mLock' acquired.
+ *
+ * PARAMETERS :
+ *   @idx     : unregister buffer at index 'idx'
+ *
+ * RETURN     : int32_t type of status
+ *              NO_ERROR  -- success
+ *              none-zero failure code
+ *==========================================================================*/
+int32_t QCamera3GrallocMemory::unregisterBufferLocked(size_t idx)
+{
+    munmap(mPtr[idx], mMemInfo[idx].size);
+    mPtr[idx] = NULL;
+
+    struct ion_handle_data ion_handle;
+    memset(&ion_handle, 0, sizeof(ion_handle));
+    ion_handle.handle = mMemInfo[idx].handle;
+    if (ioctl(mMemInfo[idx].main_ion_fd, ION_IOC_FREE, &ion_handle) < 0) {
+        ALOGE("ion free failed");
+    }
+    close(mMemInfo[idx].main_ion_fd);
+    memset(&mMemInfo[idx], 0, sizeof(struct QCamera3MemInfo));
+    mBufferHandle[idx] = NULL;
+    mPrivateHandle[idx] = NULL;
+    mBufferCount--;
+
+    return NO_ERROR;
+}
+
+/*===========================================================================
+ * FUNCTION   : unregisterBuffer
+ *
+ * DESCRIPTION: unregister buffer
+ *
+ * PARAMETERS :
+ *   @idx     : unregister buffer at index 'idx'
+ *
+ * RETURN     : int32_t type of status
+ *              NO_ERROR  -- success
+ *              none-zero failure code
+ *==========================================================================*/
+int32_t QCamera3GrallocMemory::unregisterBuffer(size_t idx)
+{
+    int32_t rc = NO_ERROR;
+    Mutex::Autolock lock(mLock);
+
+    CDBG("%s: E ", __FUNCTION__);
+
+    if (MM_CAMERA_MAX_NUM_FRAMES <= idx) {
+        ALOGE("%s: Buffer index %d greater than what is supported %d",
+                __func__, idx, MM_CAMERA_MAX_NUM_FRAMES);
+        return BAD_VALUE;
+    }
+
+    if (0 == mMemInfo[idx].handle) {
+        ALOGE("%s: Trying to unregister buffer at %d which still not registered",
+                __func__, idx);
+        return BAD_VALUE;
+    }
+
+    rc = unregisterBufferLocked(idx);
+
+    CDBG(" %s : X ",__FUNCTION__);
+
+    return rc;
+}
+
+/*===========================================================================
  * FUNCTION   : unregisterBuffers
  *
  * DESCRIPTION: unregister buffers
@@ -681,20 +801,20 @@
  *==========================================================================*/
 void QCamera3GrallocMemory::unregisterBuffers()
 {
+    int err = NO_ERROR;
+    Mutex::Autolock lock(mLock);
+
     CDBG("%s: E ", __FUNCTION__);
 
-    for (int cnt = 0; cnt < mBufferCount; cnt++) {
-        munmap(mPtr[cnt], mMemInfo[cnt].size);
-        mPtr[cnt] = NULL;
-
-        struct ion_handle_data ion_handle;
-        memset(&ion_handle, 0, sizeof(ion_handle));
-        ion_handle.handle = mMemInfo[cnt].handle;
-        if (ioctl(mMemInfo[cnt].main_ion_fd, ION_IOC_FREE, &ion_handle) < 0) {
-            ALOGE("ion free failed");
+    for (size_t cnt = 0; cnt < MM_CAMERA_MAX_NUM_FRAMES; cnt++) {
+        if (0 == mMemInfo[cnt].handle) {
+            continue;
         }
-        close(mMemInfo[cnt].main_ion_fd);
-        CDBG_HIGH("put buffer %d successfully", cnt);
+        err = unregisterBufferLocked(cnt);
+        if (NO_ERROR != err) {
+            ALOGE("%s: Error unregistering buffer %d error %d",
+                    __func__, cnt, err);
+        }
     }
     mBufferCount = 0;
     CDBG(" %s : X ",__FUNCTION__);
@@ -718,10 +838,18 @@
  *==========================================================================*/
 int32_t QCamera3GrallocMemory::markFrameNumber(int index, uint32_t frameNumber)
 {
-    if(index >= mBufferCount || index >= MM_CAMERA_MAX_NUM_FRAMES) {
+    Mutex::Autolock lock(mLock);
+
+    if (index >= MM_CAMERA_MAX_NUM_FRAMES) {
         ALOGE("%s: Index out of bounds",__func__);
         return BAD_INDEX;
     }
+
+    if (0 == mMemInfo[index].handle) {
+        ALOGE("%s: Buffer at %d not registered",__func__, index);
+        return BAD_INDEX;
+    }
+
     mCurrentFrameNumbers[index] = frameNumber;
     return NO_ERROR;
 }
@@ -737,16 +865,23 @@
  *   @index   : index of the buffer
  *
  * RETURN     : int32_t frameNumber
- *              postive/zero  -- success
- *              negetive failure
+ *              positive/zero  -- success
+ *              negative failure
  *==========================================================================*/
 int32_t QCamera3GrallocMemory::getFrameNumber(int index)
 {
-    if(index >= mBufferCount || index >= MM_CAMERA_MAX_NUM_FRAMES) {
+    Mutex::Autolock lock(mLock);
+
+    if (index >= MM_CAMERA_MAX_NUM_FRAMES) {
         ALOGE("%s: Index out of bounds",__func__);
         return -1;
     }
 
+    if (0 == mMemInfo[index].handle) {
+        ALOGE("%s: Buffer at %d not registered",__func__, index);
+        return -1;
+    }
+
     return mCurrentFrameNumbers[index];
 }
 
@@ -765,8 +900,6 @@
  *==========================================================================*/
 int QCamera3GrallocMemory::cacheOps(int index, unsigned int cmd)
 {
-    if (index >= mBufferCount)
-        return BAD_INDEX;
     return cacheOpsInternal(index, cmd, mPtr[index]);
 }
 
@@ -782,11 +915,14 @@
  *              NO_ERROR  -- success
  *              none-zero failure code
  *==========================================================================*/
-int QCamera3GrallocMemory::getRegFlags(uint8_t *regFlags) const
+int QCamera3GrallocMemory::getRegFlags(uint8_t *regFlags)
 {
+    Mutex::Autolock lock(mLock);
+
     int i;
     for (i = 0; i < mBufferCount; i ++)
         regFlags[i] = 0;
+
     return NO_ERROR;
 }
 
@@ -803,40 +939,98 @@
  *==========================================================================*/
 int QCamera3GrallocMemory::getMatchBufIndex(void *object)
 {
+    Mutex::Autolock lock(mLock);
+
     int index = -1;
     buffer_handle_t *key = (buffer_handle_t*) object;
     if (!key) {
         return BAD_VALUE;
     }
-    for (int i = 0; i < mBufferCount; i++) {
+    for (int i = 0; i < MM_CAMERA_MAX_NUM_FRAMES; i++) {
         if (mBufferHandle[i] == key) {
             index = i;
             break;
         }
     }
+
     return index;
 }
 
 /*===========================================================================
- * FUNCTION   : getPtr
+ * FUNCTION   : getFreeIndexLocked
  *
- * DESCRIPTION: return buffer pointer
+ * DESCRIPTION: Find free index slot. Note 'mLock' needs to be acquired
+ *              before calling this method.
+ *
+ * PARAMETERS : None
+ *
+ * RETURN     : free buffer index if found,
+ *              -1 if failed
+ *==========================================================================*/
+int QCamera3GrallocMemory::getFreeIndexLocked()
+{
+    int index = -1;
+
+    if (mBufferCount >= (MM_CAMERA_MAX_NUM_FRAMES - 1)) {
+        ALOGE("%s: Number of buffers %d greater than what's supported %d",
+            __func__, mBufferCount, MM_CAMERA_MAX_NUM_FRAMES);
+        return index;
+    }
+
+    for (size_t i = 0; i < MM_CAMERA_MAX_NUM_FRAMES; i++) {
+        if (0 == mMemInfo[i].handle) {
+            index = i;
+            break;
+        }
+    }
+
+    return index;
+}
+
+/*===========================================================================
+ * FUNCTION   : getPtrLocked
+ *
+ * DESCRIPTION: Return buffer pointer. Please note 'mLock' must be acquired
+ *              before calling this method.
  *
  * PARAMETERS :
  *   @index   : index of the buffer
  *
  * RETURN     : buffer ptr
  *==========================================================================*/
-void *QCamera3GrallocMemory::getPtr(int index) const
+void *QCamera3GrallocMemory::getPtrLocked(int index)
 {
-    if (index >= mBufferCount) {
-        ALOGE("index out of bound");
-        return (void *)BAD_INDEX;
+    if (MM_CAMERA_MAX_NUM_FRAMES <= index) {
+        ALOGE("%s: index %d out of bound [0, %d)",
+                __func__, index, MM_CAMERA_MAX_NUM_FRAMES);
+        return NULL;
     }
+
+    if (0 == mMemInfo[index].handle) {
+        ALOGE("%s: Buffer at %d not registered", __func__, index);
+        return NULL;
+    }
+
     return mPtr[index];
 }
 
 /*===========================================================================
+ * FUNCTION   : getPtr
+ *
+ * DESCRIPTION: Return buffer pointer.
+ *
+ * PARAMETERS :
+ *   @index   : index of the buffer
+ *
+ * RETURN     : buffer ptr
+ *==========================================================================*/
+void *QCamera3GrallocMemory::getPtr(int index)
+{
+    Mutex::Autolock lock(mLock);
+    return getPtrLocked(index);
+}
+
+/*===========================================================================
  * FUNCTION   : getBufferHandle
  *
  * DESCRIPTION: return framework pointer
@@ -849,10 +1043,19 @@
  *==========================================================================*/
 void *QCamera3GrallocMemory::getBufferHandle(int index)
 {
-    if (index >= mBufferCount) {
-        ALOGE("index out of bound");
+    Mutex::Autolock lock(mLock);
+
+    if (MM_CAMERA_MAX_NUM_FRAMES <= index) {
+        ALOGE("%s: index %d out of bound [0, %d)",
+                __func__, index, MM_CAMERA_MAX_NUM_FRAMES);
         return NULL;
     }
+
+    if (0 == mMemInfo[index].handle) {
+        ALOGE("%s: Buffer at %d not registered", __func__, index);
+        return NULL;
+    }
+
     return mBufferHandle[index];
 }
 
diff --git a/camera/QCamera2/HAL3/QCamera3Mem.h b/camera/QCamera2/HAL3/QCamera3Mem.h
index a9af447..08dfcb2 100644
--- a/camera/QCamera2/HAL3/QCamera3Mem.h
+++ b/camera/QCamera2/HAL3/QCamera3Mem.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2013, The Linux Foundataion. All rights reserved.
+/* Copyright (c) 2012-2015, The Linux Foundataion. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -39,6 +39,8 @@
 #include <mm_camera_interface.h>
 }
 
+using namespace android;
+
 namespace qcamera {
 
 // Base class for all memory types. Abstract.
@@ -48,20 +50,20 @@
     int cleanCache(int index) {return cacheOps(index, ION_IOC_CLEAN_CACHES);}
     int invalidateCache(int index) {return cacheOps(index, ION_IOC_INV_CACHES);}
     int cleanInvalidateCache(int index) {return cacheOps(index, ION_IOC_CLEAN_INV_CACHES);}
-    int getFd(int index) const;
-    int getSize(int index) const;
-    int getCnt() const;
+    int getFd(int index);
+    int getSize(int index);
+    int getCnt();
 
     virtual int cacheOps(int index, unsigned int cmd) = 0;
-    virtual int getRegFlags(uint8_t *regFlags) const = 0;
+    virtual int getRegFlags(uint8_t *regFlags) = 0;
     virtual int getMatchBufIndex(void *object) = 0;
-    virtual void *getPtr(int index) const= 0;
+    virtual void *getPtr(int index) = 0;
 
     QCamera3Memory();
     virtual ~QCamera3Memory();
 
     int32_t getBufDef(const cam_frame_len_offset_t &offset,
-                mm_camera_buf_def_t &bufDef, int index) const;
+                mm_camera_buf_def_t &bufDef, int index);
 
 protected:
     struct QCamera3MemInfo {
@@ -72,10 +74,12 @@
     };
 
     int cacheOpsInternal(int index, unsigned int cmd, void *vaddr);
+    virtual void *getPtrLocked(int index) = 0;
 
     int mBufferCount;
     struct QCamera3MemInfo mMemInfo[MM_CAMERA_MAX_NUM_FRAMES];
     void *mPtr[MM_CAMERA_MAX_NUM_FRAMES];
+    Mutex mLock;
 };
 
 // Internal heap memory is used for memories used internally
@@ -90,9 +94,11 @@
     void deallocate();
 
     virtual int cacheOps(int index, unsigned int cmd);
-    virtual int getRegFlags(uint8_t *regFlags) const;
+    virtual int getRegFlags(uint8_t *regFlags);
     virtual int getMatchBufIndex(void *object);
-    virtual void *getPtr(int index) const;
+    virtual void *getPtr(int index);
+protected:
+    virtual void *getPtrLocked(int index);
 private:
     int alloc(int count, int size, int heap_id);
     void dealloc();
@@ -109,16 +115,21 @@
     virtual ~QCamera3GrallocMemory();
 
     int registerBuffer(buffer_handle_t *buffer);
+    int32_t unregisterBuffer(size_t idx);
     void unregisterBuffers();
     virtual int cacheOps(int index, unsigned int cmd);
-    virtual int getRegFlags(uint8_t *regFlags) const;
+    virtual int getRegFlags(uint8_t *regFlags);
     virtual int getMatchBufIndex(void *object);
-    virtual void *getPtr(int index) const;
+    virtual void *getPtr(int index);
     int32_t markFrameNumber(int index, uint32_t frameNumber);
     int32_t getFrameNumber(int index);
     void *getBufferHandle(int index);
     int32_t setColorSpace(uint8_t intent);
+protected:
+    virtual void *getPtrLocked(int index);
 private:
+    int32_t unregisterBufferLocked(size_t idx);
+    int32_t getFreeIndexLocked();
     buffer_handle_t *mBufferHandle[MM_CAMERA_MAX_NUM_FRAMES];
     struct private_handle_t *mPrivateHandle[MM_CAMERA_MAX_NUM_FRAMES];
     uint32_t mCurrentFrameNumbers[MM_CAMERA_MAX_NUM_FRAMES];
diff --git a/camera/QCamera2/HAL3/QCamera3PostProc.cpp b/camera/QCamera2/HAL3/QCamera3PostProc.cpp
index 272757a..9fada4a 100644
--- a/camera/QCamera2/HAL3/QCamera3PostProc.cpp
+++ b/camera/QCamera2/HAL3/QCamera3PostProc.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2014, The Linux Foundataion. All rights reserved.
+/* Copyright (c) 2012-2015, The Linux Foundataion. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -384,7 +384,7 @@
         ret = BAD_VALUE;
         goto on_error;
     }
-    encode_parm.num_src_bufs = pStreamMem->getCnt();
+    encode_parm.num_src_bufs = MIN(pStreamMem->getCnt(), MM_JPEG_MAX_BUF);
     for (uint32_t i = 0; i < encode_parm.num_src_bufs; i++) {
         if (pStreamMem != NULL) {
             encode_parm.src_main_buf[i].index = i;
@@ -408,8 +408,8 @@
         cam_frame_len_offset_t thumb_offset;
         memset(&thumb_offset, 0, sizeof(cam_frame_len_offset_t));
         main_stream->getFrameOffset(thumb_offset);
-        encode_parm.num_tmb_bufs = pStreamMem->getCnt();
-        for (int i = 0; i < pStreamMem->getCnt(); i++) {
+        encode_parm.num_tmb_bufs = MIN(pStreamMem->getCnt(), MM_JPEG_MAX_BUF);
+        for (size_t i = 0; i < encode_parm.num_tmb_bufs; i++) {
             if (pStreamMem != NULL) {
                 encode_parm.src_thumb_buf[i].index = i;
                 encode_parm.src_thumb_buf[i].buf_size = pStreamMem->getSize(i);
diff --git a/camera/QCamera2/HAL3/QCamera3Stream.cpp b/camera/QCamera2/HAL3/QCamera3Stream.cpp
index 638bac8..04242d8 100644
--- a/camera/QCamera2/HAL3/QCamera3Stream.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Stream.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2014, The Linux Foundataion. All rights reserved.
+/* Copyright (c) 2012-2015, The Linux Foundataion. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -203,7 +203,7 @@
         int rc = mCamOps->unmap_stream_buf(mCamHandle,
                     mChannelHandle, mHandle, CAM_MAPPING_BUF_TYPE_STREAM_INFO, 0, -1);
         if (rc < 0) {
-            ALOGE("Failed to map stream info buffer");
+            ALOGE("Failed to un-map stream info buffer");
         }
         mStreamInfoBuf->deallocate();
         delete mStreamInfoBuf;
@@ -496,36 +496,6 @@
 }
 
 /*===========================================================================
- * FUNCTION   : getInternalFormatBuffer
- *
- * DESCRIPTION: return buffer in the internal format structure
- *
- * PARAMETERS :
- *   @index   : index of buffer to be returned
- *
- * RETURN     : int32_t type of status
- *              NO_ERROR  -- success
- *              none-zero failure code
- *==========================================================================*/
-mm_camera_buf_def_t* QCamera3Stream::getInternalFormatBuffer(int index)
-{
-    mm_camera_buf_def_t *rc = NULL;
-    if ((index >= mNumBufs) || (mBufDefs == NULL) ||
-            (NULL == mBufDefs[index].mem_info)) {
-        ALOGE("%s:Index out of range/no internal buffers yet", __func__);
-        return NULL;
-    }
-
-    rc = (mm_camera_buf_def_t*)malloc(sizeof(mm_camera_buf_def_t));
-    if(rc) {
-        memcpy(rc, &mBufDefs[index], sizeof(mm_camera_buf_def_t));
-    } else {
-        ALOGE("%s: Failed to allocate memory",__func__);
-    }
-    return rc;
-}
-
-/*===========================================================================
  * FUNCTION   : bufDone
  *
  * DESCRIPTION: return stream buffer to kernel
@@ -540,9 +510,11 @@
 int32_t QCamera3Stream::bufDone(int index)
 {
     int32_t rc = NO_ERROR;
+    Mutex::Autolock lock(mLock);
 
-    if (index >= mNumBufs || mBufDefs == NULL)
+    if ((index >= mNumBufs) || (mBufDefs == NULL)) {
         return BAD_INDEX;
+    }
 
     if( NULL == mBufDefs[index].mem_info) {
         if (NULL == mMemOps) {
@@ -566,8 +538,51 @@
     }
 
     rc = mCamOps->qbuf(mCamHandle, mChannelHandle, &mBufDefs[index]);
-    if (rc < 0)
+    if (rc < 0) {
         return FAILED_TRANSACTION;
+    }
+
+    return rc;
+}
+
+/*===========================================================================
+ * FUNCTION   : bufRelease
+ *
+ * DESCRIPTION: release all resources associated with this buffer
+ *
+ * PARAMETERS :
+ *   @index   : index of buffer to be released
+ *
+ * RETURN     : int32_t type of status
+ *              NO_ERROR  -- success
+ *              none-zero failure code
+ *==========================================================================*/
+int32_t QCamera3Stream::bufRelease(int32_t index)
+{
+    int32_t rc = NO_ERROR;
+    Mutex::Autolock lock(mLock);
+
+    if ((index >= mNumBufs) || (mBufDefs == NULL)) {
+        return BAD_INDEX;
+    }
+
+    if (NULL != mBufDefs[index].mem_info) {
+        if (NULL == mMemOps) {
+            ALOGE("%s: Camera operations not initialized", __func__);
+            return NO_INIT;
+        }
+
+        rc = mMemOps->unmap_ops(index, -1, mMemOps->userdata);
+        if (rc < 0) {
+            ALOGE("%s: Failed to un-map camera buffer %d", __func__, index);
+            return rc;
+        }
+
+        mBufDefs[index].mem_info = NULL;
+    } else {
+        ALOGE("%s: Buffer at index %d not registered", __func__);
+        return BAD_INDEX;
+    }
 
     return rc;
 }
@@ -597,6 +612,7 @@
 {
     int rc = NO_ERROR;
     uint8_t *regFlags;
+    Mutex::Autolock lock(mLock);
 
     if (!ops_tbl) {
         ALOGE("%s: ops_tbl is NULL", __func__);
@@ -685,11 +701,13 @@
 int32_t QCamera3Stream::putBufs(mm_camera_map_unmap_ops_tbl_t *ops_tbl)
 {
     int rc = NO_ERROR;
+    Mutex::Autolock lock(mLock);
+
     for (int i = 0; i < mNumBufs; i++) {
         if (NULL != mBufDefs[i].mem_info) {
             rc = ops_tbl->unmap_ops(i, -1, ops_tbl->userdata);
             if (rc < 0) {
-                ALOGE("%s: map_stream_buf failed: %d", __func__, rc);
+                ALOGE("%s: un-map stream buf failed: %d", __func__, rc);
             }
         }
     }
diff --git a/camera/QCamera2/HAL3/QCamera3Stream.h b/camera/QCamera2/HAL3/QCamera3Stream.h
index c06cb12..0a6a917 100644
--- a/camera/QCamera2/HAL3/QCamera3Stream.h
+++ b/camera/QCamera2/HAL3/QCamera3Stream.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2014, The Linux Foundataion. All rights reserved.
+/* Copyright (c) 2012-2015, The Linux Foundataion. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,6 +31,7 @@
 #define __QCAMERA3_STREAM_H__
 
 #include <hardware/camera3.h>
+#include "utils/Mutex.h"
 #include "QCameraCmdThread.h"
 #include "QCamera3Mem.h"
 
@@ -66,6 +67,7 @@
                          hal3_stream_cb_routine stream_cb,
                          void *userdata);
     virtual int32_t bufDone(int index);
+    virtual int32_t bufRelease(int32_t index);
     virtual int32_t processDataNotify(mm_camera_super_buf_t *bufs);
     virtual int32_t start();
     virtual int32_t stop();
@@ -77,7 +79,6 @@
     int32_t getFrameOffset(cam_frame_len_offset_t &offset);
     int32_t getFrameDimension(cam_dimension_t &dim);
     int32_t getFormat(cam_format_t &fmt);
-    mm_camera_buf_def_t* getInternalFormatBuffer(int index);
     QCamera3Memory *getStreamBufs() {return mStreamBufs;};
     uint32_t getMyServerID();
 
@@ -109,6 +110,7 @@
     cam_frame_len_offset_t mFrameLenOffset;
     cam_padding_info_t mPaddingInfo;
     QCamera3Channel *mChannel;
+    Mutex mLock;    //Lock controlling access to 'mBufDefs'
 
     static int32_t get_bufs(
                      cam_frame_len_offset_t *offset,
diff --git a/camera/QCamera2/stack/common/cam_queue.h b/camera/QCamera2/stack/common/cam_queue.h
index a23c622..b6a3c3f 100644
--- a/camera/QCamera2/stack/common/cam_queue.h
+++ b/camera/QCamera2/stack/common/cam_queue.h
@@ -29,6 +29,8 @@
 
 #include "cam_list.h"
 
+#include <stdlib.h>
+
 typedef struct {
     struct cam_list list;
     void *data;
diff --git a/camera/QCamera2/util/QCameraCmdThread.cpp b/camera/QCamera2/util/QCameraCmdThread.cpp
index c5be4ad..4b24649 100644
--- a/camera/QCamera2/util/QCameraCmdThread.cpp
+++ b/camera/QCamera2/util/QCameraCmdThread.cpp
@@ -29,6 +29,7 @@
 
 #include <utils/Errors.h>
 #include <utils/Log.h>
+#include <malloc.h>
 #include <sys/prctl.h>
 #include "QCameraCmdThread.h"
 
diff --git a/camera/QCamera2/util/QCameraQueue.cpp b/camera/QCamera2/util/QCameraQueue.cpp
index cd9105e..31996fb 100644
--- a/camera/QCamera2/util/QCameraQueue.cpp
+++ b/camera/QCamera2/util/QCameraQueue.cpp
@@ -29,6 +29,8 @@
 
 #include <utils/Errors.h>
 #include <utils/Log.h>
+#include <malloc.h>
+#include <string.h>
 #include "QCameraQueue.h"
 
 namespace qcamera {
diff --git a/device.mk b/device.mk
index ea1fa7b..360c1d8 100644
--- a/device.mk
+++ b/device.mk
@@ -83,7 +83,6 @@
     frameworks/native/data/etc/android.hardware.audio.low_latency.xml:system/etc/permissions/android.hardware.audio.low_latency.xml \
     frameworks/native/data/etc/android.hardware.bluetooth_le.xml:system/etc/permissions/android.hardware.bluetooth_le.xml \
     frameworks/native/data/etc/android.hardware.telephony.cdma.xml:system/etc/permissions/android.hardware.telephony.cdma.xml \
-    frameworks/native/data/etc/android.hardware.ethernet.xml:system/etc/permissions/android.hardware.ethernet.xml \
     frameworks/native/data/etc/android.hardware.opengles.aep.xml:system/etc/permissions/android.hardware.opengles.aep.xml
 
 # For GPS
@@ -92,7 +91,7 @@
 
 # Touch firmware updater
 PRODUCT_COPY_FILES += \
-    $(LOCAL_PATH)/init.mmi.touch.sh:root/init.mmi.touch.sh
+    $(LOCAL_PATH)/init.mmi.touch.sh:system/bin/init.mmi.touch.sh
 
 # Add WiFi Firmware
 $(call inherit-product-if-exists, hardware/broadcom/wlan/bcmdhd/firmware/bcm4356/device-bcm.mk)
@@ -351,3 +350,7 @@
     ro.config.wallpaper_component \
     ro.oem.* \
     oem.*
+
+# Copy the qcril.db file from qcril to system. Useful to get the radio tech family for the camped operator
+PRODUCT_COPY_FILES += \
+    device/moto/shamu/qcril.db:system/etc/ril/qcril.db
diff --git a/init.shamu.rc b/init.shamu.rc
index f2a060b..303e5c3 100644
--- a/init.shamu.rc
+++ b/init.shamu.rc
@@ -73,7 +73,6 @@
     setprop persist.data.df.agg.dl_size 4096
 
 on post-fs-data
-    mkdir /data/tombstones 0771 system system
     mkdir /tombstones/modem 0771 system system
     mkdir /tombstones/lpass 0771 system system
     mkdir /tombstones/wcnss 0771 system system
@@ -381,6 +380,22 @@
     class main
     group radio
 
+service imsqmidaemon /system/bin/imsqmidaemon
+    class main
+    user system
+    socket ims_qmid stream 0660 system radio
+    group radio log
+
+service imsdatadaemon /system/bin/imsdatadaemon
+    class main
+    user root
+    socket ims_datad stream 0660 system radio
+    group system wifi radio inet log
+    disabled
+
+on property:sys.ims.QMI_DAEMON_STATUS=1
+    start imsdatadaemon
+
 service sensors /system/bin/sensors.qcom
     class core
     user root
@@ -571,7 +586,7 @@
 on property:init.svc.surfaceflinger=stopped
     stop ppd
 
-service mmi-touch-sh /system/bin/sh /init.mmi.touch.sh atmel
+service mmi-touch-sh /system/bin/init.mmi.touch.sh atmel
     class main
     user root
     oneshot
@@ -605,3 +620,7 @@
     class late_start
     user system
     group system radio
+
+service cnd /system/bin/cnd
+    class late_start
+    socket cnd stream 660 root inet
diff --git a/mixer_paths.xml b/mixer_paths.xml
index 408f268..c2439f2 100644
--- a/mixer_paths.xml
+++ b/mixer_paths.xml
@@ -975,6 +975,8 @@
 
 	<path name="voice-tty-hco-handset">
 		<ctl name="TTY Mode" value="HCO" />
+	    <!-- Port mixer is common bit for all voice verbs -->
+		<ctl name="QUAT_MI2S_RX Port Mixer SLIM_1_TX" value="1" />
 		<path name="voice-handset" />
 	</path>
 
diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml
index ab0a689..a3232c8 100644
--- a/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/overlay/frameworks/base/core/res/res/values/config.xml
@@ -273,6 +273,9 @@
     <!-- Flag specifying whether VoLTE is availasble on device -->
     <bool name="config_device_volte_available">true</bool>
 
+    <!-- Flag specifying whether WFC over IMS is availasble on device -->
+    <bool name="config_device_wfc_ims_available">true</bool>
+
     <!-- Configure mobile tcp buffer sizes in the form:
          rat-name:rmem_min,rmem_def,rmem_max,wmem_min,wmem_def,wmem_max
          If no value is found for the rat-name in use, the system default will be applied.
diff --git a/overlay/packages/services/Telephony/res/values-mcc310-mnc120/config.xml b/overlay/packages/services/Telephony/res/values-mcc310-mnc120/config.xml
index 06c9ae5..d29eb83 100644
--- a/overlay/packages/services/Telephony/res/values-mcc310-mnc120/config.xml
+++ b/overlay/packages/services/Telephony/res/values-mcc310-mnc120/config.xml
@@ -33,6 +33,8 @@
     <bool name="config_use_hfa_for_provisioning" translatable="false">true</bool>
     <!-- Display carrier settings -->
     <bool name="config_carrier_settings_enable">true</bool>
+    <!-- Don't display swap button after merging calls into Cdma conference. -->
+    <bool name="support_swap_after_merge">false</bool>
     <!-- carrier settings menu -->
     <string name="carrier_settings" translatable="false">com.android.sdm.plugins.sprintdm</string>
     <string name="carrier_settings_menu" translatable="false">com.android.sdm.plugins.sprintdm.SprintCarrierSettingsActivity</string>
diff --git a/proprietary-blobs.txt b/proprietary-blobs.txt
index b758510..4f4bbcd 100644
--- a/proprietary-blobs.txt
+++ b/proprietary-blobs.txt
@@ -110,6 +110,7 @@
 /system/lib/soundfx/libqcomvisualizer.so
 /system/lib/soundfx/libqcomvoiceprocessing.so
 /system/lib/soundfx/libspeakerbundle.so
+/system/priv-app/BuaContactAdapter/BuaContactAdapter.apk
 /system/vendor/firmware/a420_pfp.fw
 /system/vendor/firmware/a420_pm4.fw
 /system/vendor/firmware/acdb.mbn
diff --git a/qcril.db b/qcril.db
new file mode 100755
index 0000000..0db7ba7
--- /dev/null
+++ b/qcril.db
Binary files differ
diff --git a/self-extractors/extract-lists.txt b/self-extractors/extract-lists.txt
index bbc0eeb..0bdadec 100644
--- a/self-extractors/extract-lists.txt
+++ b/self-extractors/extract-lists.txt
@@ -42,6 +42,7 @@
             system/lib/libadspd.so \
             system/lib/librecoglib.so \
             system/lib/libsupermodel.so \
+            system/priv-app/BuaContactAdapter/BuaContactAdapter.apk \
             system/vendor/firmware/acdb.mbn \
             system/vendor/firmware/atmel-a432-*-shamu-p1.tdat \
             system/vendor/firmware/atmel-a432-*-shamu.tdat \
diff --git a/self-extractors/root/device-vendor.mk b/self-extractors/root/device-vendor.mk
index a82c29a..2739ddc 100644
--- a/self-extractors/root/device-vendor.mk
+++ b/self-extractors/root/device-vendor.mk
@@ -12,6 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+PRODUCT_PACKAGES += \
+    BuaContactAdapter
+
 LOCAL_STEM := shamu/device-partial.mk
 
 $(call inherit-product-if-exists, vendor/broadcom/$(LOCAL_STEM))
diff --git a/sepolicy/adspd.te b/sepolicy/adspd.te
index bc955c7..0c684dc 100644
--- a/sepolicy/adspd.te
+++ b/sepolicy/adspd.te
@@ -17,3 +17,6 @@
 # For now, allow writes to all of /sys.
 # TODO: scope down this access.
 allow adspd sysfs:file write;
+
+allow adspd sysfs_mmi_touch:dir search;
+allow adspd sysfs_mmi_touch:file r_file_perms;
diff --git a/sepolicy/bootanim.te b/sepolicy/bootanim.te
deleted file mode 100644
index 3b17145..0000000
--- a/sepolicy/bootanim.te
+++ /dev/null
@@ -1,2 +0,0 @@
-#TODO - identify cause of this
-allow bootanim shell_data_file:dir search;
diff --git a/sepolicy/camera.te b/sepolicy/camera.te
index d0fd639..40e9c39 100644
--- a/sepolicy/camera.te
+++ b/sepolicy/camera.te
@@ -26,6 +26,3 @@
 allow camera camera_socket:sock_file { create unlink };
 allow camera system_data_file:dir w_dir_perms;
 allow camera system_data_file:sock_file unlink;
-
-# TODO b/17015082
-allow camera shell_data_file:dir search;
diff --git a/sepolicy/cnd.te b/sepolicy/cnd.te
new file mode 100644
index 0000000..ed498f9
--- /dev/null
+++ b/sepolicy/cnd.te
@@ -0,0 +1,13 @@
+#permissive cnd;
+type cnd, domain;
+type cnd_exec, exec_type, file_type;
+
+# cnd is started by init, type transit from init domain to cnd domain
+init_daemon_domain(cnd)
+# associate netdomain as an attribute of cnd domain
+net_domain(cnd)
+
+allow cnd self:capability { net_raw setuid setgid };
+
+allow cnd netmgrd:dir search;
+allow cnd netmgrd:file r_file_perms;
diff --git a/sepolicy/device.te b/sepolicy/device.te
index b3210f9..26c8c1c 100644
--- a/sepolicy/device.te
+++ b/sepolicy/device.te
@@ -4,14 +4,12 @@
 # eMMC rpmb - necessarily drm?
 type drm_block_device, dev_type;
 
-# STOPSHIP b/16455932
-type fingerprint_device, dev_type;
-
 type efs_block_device, dev_type;
 type mdm_helper_device, dev_type;
 type ramdump_device, dev_type;
 type modem_hob_block_device, dev_type;
 type cid_block_device, dev_type;
+type persist_block_device, dev_type;
 
 # Real Time Clock
 type rtc, dev_type;
diff --git a/sepolicy/file.te b/sepolicy/file.te
index 197e9b5..a0c0351 100644
--- a/sepolicy/file.te
+++ b/sepolicy/file.te
@@ -2,6 +2,8 @@
 type firmware_file, fs_type, contextmount_type;
 type fsg_file, fs_type, contextmount_type;
 
+type cnd_socket, file_type;
+
 type adspd_socket, file_type;
 type camera_socket, file_type;
 type mpdecision_socket, file_type;
@@ -24,6 +26,7 @@
 type sysfs_smdcntl_open_timeout, fs_type, sysfs_type;
 type sysfs_xhci_msm_hsic, fs_type, sysfs_type;
 type sysfs_msm_hsic_host, fs_type, sysfs_type;
+type sysfs_mmi_touch, fs_type, sysfs_type;
 
 type persist_file, file_type;
 type persist_data_file, file_type;
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 99411c3..55189de 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -19,10 +19,7 @@
 /dev/ttyHS3                    u:object_r:adspd_device:s0
 
 #Serial console
-/dev/ttyHSL0                   u:object_r:tty_device:s0
-
-# STOPSHIP b/16455932
-/dev/vfsspi                    u:object_r:fingerprint_device:s0
+/dev/ttyHSL0                   u:object_r:console_device:s0
 
 # GPU device
 /dev/kgsl-3d0                  u:object_r:gpu_device:s0
@@ -35,6 +32,9 @@
 # factory reset protection partition
 /dev/block/platform/msm_sdcc\.1/by-name/frp           u:object_r:frp_block_device:s0
 
+# /persist
+/dev/block/platform/msm_sdcc\.1/by-name/persist   u:object_r:persist_block_device:s0
+
 # mdm1hob, mdm1dhob
 /dev/block/platform/msm_sdcc.1/by-name/mdm1hob   u:object_r:modem_hob_block_device:s0
 /dev/block/platform/msm_sdcc.1/by-name/mdm1dhob  u:object_r:modem_hob_block_device:s0
@@ -47,6 +47,7 @@
 
 /dev/block/platform/msm_sdcc\.1/by-name/system       u:object_r:system_block_device:s0
 /dev/block/platform/msm_sdcc\.1/by-name/recovery     u:object_r:recovery_block_device:s0
+/dev/block/platform/msm_sdcc\.1/by-name/boot         u:object_r:boot_block_device:s0
 /dev/block/platform/msm_sdcc\.1/by-name/userdata     u:object_r:userdata_block_device:s0
 /dev/block/platform/msm_sdcc\.1/by-name/metadata     u:object_r:metadata_block_device:s0
 /dev/block/platform/msm_sdcc\.1/by-name/cache        u:object_r:cache_block_device:s0
@@ -124,6 +125,7 @@
 /system/bin/bdAddrLoader        u:object_r:bluetooth_loader_exec:s0
 /system/bin/bridgemgrd          u:object_r:bridge_exec:s0
 /system/vendor/bin/gsiff_daemon u:object_r:gsiffd_exec:s0
+/system/bin/init\.mmi\.touch\.sh u:object_r:mmi_touch_sh_exec:s0
 /system/bin/irsc_util           u:object_r:irsc_util_exec:s0
 /system/bin/ks                  u:object_r:mdm_helper_exec:s0
 /system/bin/mdm_helper          u:object_r:mdm_helper_exec:s0
@@ -150,6 +152,9 @@
 # Sysfs files used by qmuxd
 /sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout u:object_r:sysfs_smdcntl_open_timeout:s0
 
+# mmi_touch related /sys files
+/sys/devices/f9966000\.i2c/i2c-1/1-004a(/.*)?            u:object_r:sysfs_mmi_touch:s0
+
 # Context for mpdecision
 /sys/module/msm_thermal/core_control/cpus_offlined              u:object_r:sysfs_mpdecision:s0
 /sys/devices/system/cpu/cpu0/rq-stats(/.*)?                     u:object_r:sysfs_rqstats:s0
@@ -163,3 +168,6 @@
 
 /system/bin/imsdatadaemon                       u:object_r:ims_exec:s0
 /system/bin/imsqmidaemon                        u:object_r:ims_exec:s0
+
+/dev/socket/cnd  u:object_r:cnd_socket:s0
+/system/bin/cnd  u:object_r:cnd_exec:s0
diff --git a/sepolicy/fsck.te b/sepolicy/fsck.te
new file mode 100644
index 0000000..1500b5f
--- /dev/null
+++ b/sepolicy/fsck.te
@@ -0,0 +1 @@
+allow fsck persist_block_device:blk_file rw_file_perms;
diff --git a/sepolicy/ims.te b/sepolicy/ims.te
index 06464ed..a9f4a35 100644
--- a/sepolicy/ims.te
+++ b/sepolicy/ims.te
@@ -43,3 +43,10 @@
 
 # Allow ims to tell init to start the ims data service via property=sys.ims.QMI_DAEMON_STATUS
 allow ims qcom_ims_prop:property_service set;
+
+allow ims wpa_socket:sock_file create_file_perms;
+allow ims wpa_socket:dir rw_dir_perms;
+
+allow ims wifi_data_file:dir r_dir_perms;
+
+unix_socket_send(ims, wpa, wpa)
diff --git a/sepolicy/init.te b/sepolicy/init.te
new file mode 100644
index 0000000..14f1b92
--- /dev/null
+++ b/sepolicy/init.te
@@ -0,0 +1 @@
+allow init diag_device:chr_file unlink;
diff --git a/sepolicy/mediaserver.te b/sepolicy/mediaserver.te
index cd0a5e7..2eccb3c 100644
--- a/sepolicy/mediaserver.te
+++ b/sepolicy/mediaserver.te
@@ -14,6 +14,3 @@
 unix_socket_connect(mediaserver, adspd, adspd)
 allow mediaserver audio_cutback_data_file:dir search;
 allow mediaserver audio_cutback_data_file:sock_file write;
-
-# TODO b/17015082
-allow mediaserver shell_data_file:dir search;
diff --git a/sepolicy/mmi_touch_sh.te b/sepolicy/mmi_touch_sh.te
new file mode 100644
index 0000000..d6bd05b
--- /dev/null
+++ b/sepolicy/mmi_touch_sh.te
@@ -0,0 +1,16 @@
+type mmi_touch_sh, domain;
+type mmi_touch_sh_exec, exec_type, file_type;
+
+# Started by init
+init_daemon_domain(mmi_touch_sh)
+
+# shell scripts need to execute /system/bin/sh
+allow mmi_touch_sh shell_exec:file rx_file_perms;
+
+# Logs to /dev/kmsg
+allow mmi_touch_sh kmsg_device:chr_file w_file_perms;
+
+# Write to /sys/path/to/firmware/forcereflash
+# Read from /sys/path/to/firmware/poweron (and others)
+allow mmi_touch_sh sysfs_mmi_touch:file rw_file_perms;
+allow mmi_touch_sh sysfs_mmi_touch:dir search;
diff --git a/sepolicy/netmgrd.te b/sepolicy/netmgrd.te
index 943941f..506ada9 100644
--- a/sepolicy/netmgrd.te
+++ b/sepolicy/netmgrd.te
@@ -26,12 +26,17 @@
 # Runs /system/bin/toolbox
 allow netmgrd system_file:file rx_file_perms;
 
+#Allow operations on different types of sockets
 allow netmgrd self:netlink_socket create_socket_perms;
+allow netmgrd self:rawip_socket create_socket_perms;
 allow netmgrd self:netlink_route_socket nlmsg_write;
-allow netmgrd self:netlink_xfrm_socket create_socket_perms;
+allow netmgrd self:netlink_xfrm_socket { create_socket_perms nlmsg_write nlmsg_read };
 
 # b/17065650
-allow netmgrd self:socket {create ioctl read};
+allow netmgrd self:socket create_socket_perms;
+
+#Allow communication with cnd
+unix_socket_connect(netmgrd, cnd, cnd)
 
 # CONFIG_MODULES not set in shamu_defconfig
 dontaudit netmgrd self:capability sys_module;
@@ -40,9 +45,12 @@
 unix_socket_connect(netmgrd, property, init)
 allow netmgrd net_radio_prop:property_service set;
 
+#Set netmgrd properties
+allow netmgrd qcom_netmgrd_prop:property_service set;
+
 # Permission to run netd commands
 allow netmgrd netd_socket:sock_file write;
 
 #Allow access to files associated with netd
+allow netmgrd net_data_file:file r_file_perms;
 allow netmgrd net_data_file:dir r_dir_perms;
-
diff --git a/sepolicy/property.te b/sepolicy/property.te
index 201d6b7..07b30c7 100644
--- a/sepolicy/property.te
+++ b/sepolicy/property.te
@@ -1 +1,2 @@
  type qcom_ims_prop, property_type;
+ type qcom_netmgrd_prop, property_type;
diff --git a/sepolicy/property_contexts b/sepolicy/property_contexts
index 74da243..d7d0d0f 100644
--- a/sepolicy/property_contexts
+++ b/sepolicy/property_contexts
@@ -1 +1,2 @@
 sys.ims.        u:object_r:qcom_ims_prop:s0
+net.r_rmnet     u:object_r:qcom_netmgrd_prop:s0
diff --git a/sepolicy/sensors.te b/sepolicy/sensors.te
index bac2d54..000b31d 100644
--- a/sepolicy/sensors.te
+++ b/sepolicy/sensors.te
@@ -8,6 +8,13 @@
 # drop privileges
 allow sensors self:capability { dac_override sys_nice chown setuid setgid net_bind_service};
 
+# b/18417109
+# The kernel code does a permission check of both net_bind_service and
+# net_raw, and allows access if either one returns true.
+# It does the net_raw check first, triggering an SELinux denial.
+# No need to audit
+dontaudit sensors self:capability net_raw;
+
 allow sensors persist_sensors_file:dir setattr;
 
 allow sensors shared_log_device:chr_file rw_file_perms;
diff --git a/sepolicy/service.te b/sepolicy/service.te
index 612d43d..a454fb7 100644
--- a/sepolicy/service.te
+++ b/sepolicy/service.te
@@ -1 +1,2 @@
 type atfwd_service,             service_manager_type;
+type cne_service,               service_manager_type;
diff --git a/sepolicy/service_contexts b/sepolicy/service_contexts
index 2c7dfc7..28b6ce1 100644
--- a/sepolicy/service_contexts
+++ b/sepolicy/service_contexts
@@ -1,2 +1,3 @@
 rcs                                       u:object_r:radio_service:s0
 AtCmdFwd                                  u:object_r:atfwd_service:s0
+cneservice                                u:object_r:cne_service:s0
diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te
deleted file mode 100644
index 75b0677..0000000
--- a/sepolicy/surfaceflinger.te
+++ /dev/null
@@ -1,2 +0,0 @@
-# TODO - identify cause of this
-allow surfaceflinger shell_data_file:dir search;
diff --git a/sepolicy/system_app.te b/sepolicy/system_app.te
index 64304d0..f66aaa5 100644
--- a/sepolicy/system_app.te
+++ b/sepolicy/system_app.te
@@ -1,6 +1,7 @@
-# TODO b/17015082
-allow system_app shell_data_file:dir search;
-
 allow system_app time:unix_stream_socket connectto;
 
 allow system_app atfwd_service:service_manager add;
+
+allow system_app cne_service:service_manager add;
+
+unix_socket_connect(system_app, cnd, cnd)
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index a3f2cc4..713f3e4 100644
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -2,7 +2,6 @@
 # (e.g., LocationManager)
 qmux_socket(system_server)
 
-allow system_server fingerprint_device:chr_file rw_file_perms;
 allow system_server mpdecision_socket:dir r_dir_perms;
 unix_socket_send(system_server, mpdecision, mpdecision)
 
diff --git a/sepolicy/ueventd.te b/sepolicy/ueventd.te
index 156e035..f58b051 100644
--- a/sepolicy/ueventd.te
+++ b/sepolicy/ueventd.te
@@ -1,2 +1,4 @@
 allow ueventd { firmware_file }:dir r_dir_perms;
 allow ueventd { firmware_file }:file r_file_perms;
+allow ueventd sysfs_mmi_touch:file w_file_perms;
+allow ueventd sysfs_mmi_touch:dir search;
diff --git a/sepolicy/wpa.te b/sepolicy/wpa.te
new file mode 100644
index 0000000..8e17353
--- /dev/null
+++ b/sepolicy/wpa.te
@@ -0,0 +1,2 @@
+# permission for wpa socket which IMS use to communicate
+allow wpa ims:unix_dgram_socket sendto;
diff --git a/sepolicy/zygote.te b/sepolicy/zygote.te
deleted file mode 100644
index db4a0c3..0000000
--- a/sepolicy/zygote.te
+++ /dev/null
@@ -1,2 +0,0 @@
-# TODO - identify cause of this
-allow zygote shell_data_file:dir search;
diff --git a/vendor_owner_info.txt b/vendor_owner_info.txt
index f187356..b844c4c 100644
--- a/vendor_owner_info.txt
+++ b/vendor_owner_info.txt
@@ -94,6 +94,7 @@
 system/lib/soundfx/libqcomvisualizer.so:qcom
 system/lib/soundfx/libqcomvoiceprocessing.so:qcom
 system/lib/soundfx/libspeakerbundle.so:qcom
+system/priv-app/BuaContactAdapter/BuaContactAdapter.apk:moto
 system/vendor/firmware/a420_pfp.fw:qcom
 system/vendor/firmware/a420_pm4.fw:qcom
 system/vendor/firmware/acdb.mbn:moto