diff --git a/apps/CameraITS/pymodules/its/caps.py b/apps/CameraITS/pymodules/its/caps.py
index 94b12f5..a33757d 100644
--- a/apps/CameraITS/pymodules/its/caps.py
+++ b/apps/CameraITS/pymodules/its/caps.py
@@ -47,7 +47,7 @@
     """
     return props.has_key("android.info.supportedHardwareLevel") and \
             props["android.info.supportedHardwareLevel"] != 2 and \
-            props["android.info.supportedHardwareLevel"] > 1
+            props["android.info.supportedHardwareLevel"] >= 1
 
 def level3(props):
     """Returns whether a device is a LEVEL3 capability camera2 device.
diff --git a/apps/CameraITS/pymodules/its/device.py b/apps/CameraITS/pymodules/its/device.py
index 54bd0ad..351b03c 100644
--- a/apps/CameraITS/pymodules/its/device.py
+++ b/apps/CameraITS/pymodules/its/device.py
@@ -57,7 +57,7 @@
     LOCK_PORT = CLIENT_PORT_START + MAX_NUM_PORTS
 
     # Seconds timeout on each socket operation.
-    SOCK_TIMEOUT = 10.0
+    SOCK_TIMEOUT = 20.0
     # Additional timeout in seconds when ITS service is doing more complicated
     # operations, for example: issuing warmup requests before actual capture.
     EXTRA_SOCK_TIMEOUT = 5.0
diff --git a/apps/CameraITS/tests/scene1/test_exposure.py b/apps/CameraITS/tests/scene1/test_exposure.py
index dc4a790..a70f357 100644
--- a/apps/CameraITS/tests/scene1/test_exposure.py
+++ b/apps/CameraITS/tests/scene1/test_exposure.py
@@ -35,8 +35,8 @@
     THRESHOLD_MAX_OUTLIER_DIFF = 0.1
     THRESHOLD_MIN_LEVEL = 0.1
     THRESHOLD_MAX_LEVEL = 0.9
-    THRESHOLD_MAX_LEVEL_DIFF = 0.03
-    THRESHOLD_MAX_LEVEL_DIFF_WIDE_RANGE = 0.05
+    THRESHOLD_MAX_LEVEL_DIFF = 0.045
+    THRESHOLD_MAX_LEVEL_DIFF_WIDE_RANGE = 0.06
     THRESHOLD_ROUND_DOWN_GAIN = 0.1
     THRESHOLD_ROUND_DOWN_EXP = 0.05
 
diff --git a/apps/CameraITS/tests/scene3/test_reprocess_edge_enhancement.py b/apps/CameraITS/tests/scene3/test_reprocess_edge_enhancement.py
index 8ab0c02..3bd4b34 100644
--- a/apps/CameraITS/tests/scene3/test_reprocess_edge_enhancement.py
+++ b/apps/CameraITS/tests/scene3/test_reprocess_edge_enhancement.py
@@ -90,7 +90,7 @@
     the sharpess of non-reprocess images.
     """
 
-    THRESHOLD_RELATIVE_SHARPNESS_DIFF = 0.1
+    THRESHOLD_RELATIVE_SHARPNESS_DIFF = 0.15
 
     with its.device.ItsSession() as cam:
         props = cam.get_camera_properties()
diff --git a/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py b/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py
index a5fc819..39e3c38 100644
--- a/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py
+++ b/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py
@@ -117,8 +117,11 @@
             dual_target = fmt_cmpr is not "none"
             # Get the size of "cmpr"
             if dual_target:
-                size_cmpr = its.objects.get_available_output_sizes(
-                        fmt_cmpr, props, fmt["cmpr_size"])[0]
+                sizes = its.objects.get_available_output_sizes(
+                        fmt_cmpr, props, fmt["cmpr_size"])
+                if len(sizes) == 0: # device might not support RAW
+                    continue
+                size_cmpr = sizes[0]
             for size_iter in its.objects.get_available_output_sizes(
                     fmt_iter, props, fmt["iter_max"]):
                 w_iter = size_iter[0]
diff --git a/apps/CameraITS/tests/scene5/test_lens_shading_and_color_uniformity.py b/apps/CameraITS/tests/scene5/test_lens_shading_and_color_uniformity.py
index 282b82e..8e9f740 100644
--- a/apps/CameraITS/tests/scene5/test_lens_shading_and_color_uniformity.py
+++ b/apps/CameraITS/tests/scene5/test_lens_shading_and_color_uniformity.py
@@ -43,7 +43,7 @@
     # Threshold for pass/fail
     THRES_LS_CT = 0.9    # len shading allowance for center
     THRES_LS_CN = 0.6    # len shading allowance for corner
-    THRES_LS_HIGH = 0.05 # max allowed percentage for a patch to be brighter
+    THRES_LS_HIGH = 0.2  # max allowed percentage for a patch to be brighter
                          # than center
     THRES_UFMT = 0.1     # uniformity allowance
     # Drawing color
diff --git a/apps/CtsVerifier/jni/verifier/Android.mk b/apps/CtsVerifier/jni/verifier/Android.mk
index 4840e62..2978b06 100644
--- a/apps/CtsVerifier/jni/verifier/Android.mk
+++ b/apps/CtsVerifier/jni/verifier/Android.mk
@@ -32,4 +32,6 @@
 
 LOCAL_SHARED_LIBRARIES := liblog
 
+LOCAL_CXX_STL := libstdc++
+
 include $(BUILD_SHARED_LIBRARY)
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
index 0960d89..49525b7 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
@@ -94,7 +94,7 @@
     public static final String TAG = ItsService.class.getSimpleName();
 
     // Timeouts, in seconds.
-    private static final int TIMEOUT_CALLBACK = 10;
+    private static final int TIMEOUT_CALLBACK = 20;
     private static final int TIMEOUT_3A = 10;
 
     // Time given for background requests to warm up pipeline
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/features/FeatureSummaryActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/features/FeatureSummaryActivity.java
index 5409a76..af34931 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/features/FeatureSummaryActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/features/FeatureSummaryActivity.java
@@ -244,6 +244,7 @@
             new Feature(PackageManager.FEATURE_VULKAN_HARDWARE_VERSION, false),
             new Feature(PackageManager.FEATURE_VULKAN_HARDWARE_LEVEL, false),
             new Feature(PackageManager.FEATURE_NFC_HOST_CARD_EMULATION_NFCF, false),
+            new Feature(PackageManager.FEATURE_PICTURE_IN_PICTURE, false),
     };
 
     @Override
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/nfc/hcef/HceFReaderActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/nfc/hcef/HceFReaderActivity.java
index ba31ff7..9b0d669 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/nfc/hcef/HceFReaderActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/nfc/hcef/HceFReaderActivity.java
@@ -98,6 +98,9 @@
 
         try {
             felica.connect();
+	    byte[] command =
+		    new byte[]{6, 0x00, (byte)0x40, (byte)0x01, 0x00, 0x00}; // in this case, SC of HCE-F is 4001h
+	    felica.transceive(command);
             for (int i = 0; i < 32; i++) {
                 byte[] payload = new byte[] {0x14, (byte)i};
                 byte[] echo_cmd = createEchoCommand(MyHostFelicaService.NFCID2, payload);
diff --git a/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/CompatibilityTest.java b/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/CompatibilityTest.java
index 0154909..9784220 100644
--- a/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/CompatibilityTest.java
+++ b/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/CompatibilityTest.java
@@ -417,8 +417,13 @@
         Set<IAbi> abis = new HashSet<>();
         Set<String> archAbis = AbiUtils.getAbisForArch(SuiteInfo.TARGET_ARCH);
         if (mPrimaryAbiRun) {
-            // Get the primary from the device and make it the --abi to run.
-            mAbiName = mDevice.getProperty("ro.product.cpu.abi").trim();
+            if (mAbiName == null) {
+                // Get the primary from the device and make it the --abi to run.
+                mAbiName = mDevice.getProperty("ro.product.cpu.abi").trim();
+            } else {
+                CLog.d("Option --%s supersedes the option --%s, using abi: %s", ABI_OPTION,
+                        PRIMARY_ABI_RUN, mAbiName);
+            }
         }
         for (String abi : AbiFormatter.getSupportedAbis(mDevice, "")) {
             // Only test against ABIs supported by Compatibility, and if the
diff --git a/tests/deviceadmin/uninstalltest/src/android/devicepolicy/cts/uiautomatertest/DeviceAdminUninstallTest.java b/tests/deviceadmin/uninstalltest/src/android/devicepolicy/cts/uiautomatertest/DeviceAdminUninstallTest.java
index d070cb0..a8e7cc1 100644
--- a/tests/deviceadmin/uninstalltest/src/android/devicepolicy/cts/uiautomatertest/DeviceAdminUninstallTest.java
+++ b/tests/deviceadmin/uninstalltest/src/android/devicepolicy/cts/uiautomatertest/DeviceAdminUninstallTest.java
@@ -37,7 +37,7 @@
 import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.util.List;
-
+import java.util.regex.Pattern;
 import android.support.test.InstrumentationRegistry;
 import android.support.test.runner.AndroidJUnit4;
 import android.support.test.filters.LargeTest;
@@ -58,13 +58,16 @@
     private static final String DEVICE_ADMIN_PACKAGE_NAME =
             "android.devicepolicy.cts.emptydeviceadmin";
     private static final String URI_PACKAGE_PREFIX = "package:";
+    private static final String UNINSTALL_BUTTON_TEXT_REGEX = "(?i)uninstall";
 
     private static final UiSelector DEACTIVATE_AND_UNINSTALL_BUTTON_SELECTOR = new UiSelector()
             .resourceId("com.android.settings:id/action_button");
+    // Changing the below two selectors to match the button based on text due to b/29960172
     private static final UiSelector UNINSTALL_BUTTON_SELECTOR = new UiSelector()
-            .resourceId("com.android.settings:id/left_button");
+            .clickable(true).textMatches(UNINSTALL_BUTTON_TEXT_REGEX);
     private static final BySelector UNINSTALL_BUTTON_BYSELECTOR = By
-            .res("com.android.settings", "left_button");
+            .clickable(true).text(Pattern.compile(UNINSTALL_BUTTON_TEXT_REGEX));
+
     private static final UiSelector OK_BUTTON_SELECTOR = new UiSelector()
             .resourceId("android:id/button1");
     private static final UiSelector SCROLL_VIEW_SELECTOR =
diff --git a/tests/tests/os/src/android/os/cts/SecurityPatchTest.java b/tests/tests/os/src/android/os/cts/SecurityPatchTest.java
index 4608f22..b0bd15a 100644
--- a/tests/tests/os/src/android/os/cts/SecurityPatchTest.java
+++ b/tests/tests/os/src/android/os/cts/SecurityPatchTest.java
@@ -32,7 +32,7 @@
     private static final String SECURITY_PATCH_DATE_ERROR =
             "ro.build.version.security_patch should be \"%d-%02d\" or later. Found \"%s\"";
     private static final int SECURITY_PATCH_YEAR = 2016;
-    private static final int SECURITY_PATCH_MONTH = 8;
+    private static final int SECURITY_PATCH_MONTH = 9;
 
     private boolean mSkipTests = false;
 
diff --git a/tests/tests/security/src/android/security/cts/ActivityManagerTest.java b/tests/tests/security/src/android/security/cts/ActivityManagerTest.java
new file mode 100644
index 0000000..e29ad53
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/ActivityManagerTest.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.security.cts;
+
+import android.os.IBinder;
+
+import junit.framework.TestCase;
+
+public class ActivityManagerTest extends TestCase {
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+    }
+
+    public void testActivityManager_injectInputEvents() throws ClassNotFoundException {
+        try {
+            /*
+             * Should throw NoSuchMethodException. getEnclosingActivityContainer() has been
+             * removed/renamed.
+             * Patch:  https://android.googlesource.com/platform/frameworks/base/+/aa7e3ed%5E!/
+             */
+            Class.forName("android.app.ActivityManagerNative").getMethod(
+                    "getEnclosingActivityContainer", IBinder.class);
+            fail("ActivityManagerNative.getEnclosingActivityContainer() API should not be" +
+                    "available in patched devices: Device is vulnerable to CVE-2015-1533");
+        } catch (NoSuchMethodException e) {
+            // Patched devices should throw this exception
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/tests/tv/src/android/media/tv/cts/BundledTvInputServiceTest.java b/tests/tests/tv/src/android/media/tv/cts/BundledTvInputServiceTest.java
index 601793b..9769175 100644
--- a/tests/tests/tv/src/android/media/tv/cts/BundledTvInputServiceTest.java
+++ b/tests/tests/tv/src/android/media/tv/cts/BundledTvInputServiceTest.java
@@ -32,7 +32,6 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
-import java.util.Random;
 
 /**
  * Test {@link android.media.tv.TvView}.
@@ -133,6 +132,7 @@
             return;
         }
         for (final TvInputInfo info : mPassthroughInputList) {
+            mCallback.mVideoUnavailableReasonMap.remove(info.getId());
             runTestOnUiThread(new Runnable() {
                 @Override
                 public void run() {
@@ -161,13 +161,14 @@
         // Component) and tuning should be completed within 3 seconds, which gives 15 seconds
         // for an input. Set 5 minutes of timeout for this test case and try 20 iterations.
         final int ITERATIONS = 20;
-        Random random = new Random();
         for (int i = 0; i < mPassthroughInputList.size() * ITERATIONS; ++i) {
             final TvInputInfo info =
-                    mPassthroughInputList.get(random.nextInt(mPassthroughInputList.size()));
+                    mPassthroughInputList.get(i % mPassthroughInputList.size());
+            mCallback.mVideoUnavailableReasonMap.remove(info.getId());
             runTestOnUiThread(new Runnable() {
                 @Override
                 public void run() {
+                    mTvView.reset();
                     mTvView.tune(info.getId(),
                             TvContract.buildChannelUriForPassthroughInput(info.getId()));
                 }
diff --git a/tests/tests/view/src/android/view/cts/SearchEventTest.java b/tests/tests/view/src/android/view/cts/SearchEventTest.java
index 629b3ab..d4a95d5 100644
--- a/tests/tests/view/src/android/view/cts/SearchEventTest.java
+++ b/tests/tests/view/src/android/view/cts/SearchEventTest.java
@@ -33,11 +33,25 @@
         super(SearchEventActivity.class);
     }
 
+    // Wait until mActivity has window focus, or timeout ms elapses.  Return true
+    // iff mActivity gained window focus.
+    private boolean waitForActivityToHaveFocus(long timeout) {
+        long start = System.currentTimeMillis();
+        long cur = System.currentTimeMillis();
+        try {
+            while (!mActivity.hasWindowFocus() && (cur - start) < timeout) {
+                Thread.sleep(50);
+            }
+        } catch (InterruptedException x) {}
+        return mActivity.hasWindowFocus();
+    }
+
     @Override
     protected void setUp() throws Exception {
         super.setUp();
         mInstrumentation = getInstrumentation();
         mActivity = getActivity();
+        assertTrue(waitForActivityToHaveFocus(5000 /* ms = 5s */));
     }
 
     public void testTest() throws Exception {