diff --git a/adb/file_sync_service.cpp b/adb/file_sync_service.cpp
index 1128993..f7be8f9 100644
--- a/adb/file_sync_service.cpp
+++ b/adb/file_sync_service.cpp
@@ -69,17 +69,23 @@
 }
 
 static bool secure_mkdirs(const std::string& path) {
-    uid_t uid = -1;
-    gid_t gid = -1;
-    unsigned int mode = 0775;
-    uint64_t capabilities = 0;
-
     if (path[0] != '/') return false;
 
     std::vector<std::string> path_components = android::base::Split(path, "/");
     std::string partial_path;
     for (const auto& path_component : path_components) {
-        if (partial_path.back() != OS_PATH_SEPARATOR) partial_path += OS_PATH_SEPARATOR;
+        uid_t uid = -1;
+        gid_t gid = -1;
+        unsigned int mode = 0775;
+        uint64_t capabilities = 0;
+
+        if (path_component.empty()) {
+            continue;
+        }
+
+        if (partial_path.empty() || partial_path.back() != OS_PATH_SEPARATOR) {
+            partial_path += OS_PATH_SEPARATOR;
+        }
         partial_path += path_component;
 
         if (should_use_fs_config(partial_path)) {
diff --git a/adb/test_device.py b/adb/test_device.py
index 72e1c67..552e0c3 100644
--- a/adb/test_device.py
+++ b/adb/test_device.py
@@ -868,6 +868,21 @@
             self.assertTrue('Permission denied' in output or
                             'Read-only file system' in output)
 
+    @requires_non_root
+    def test_push_directory_creation(self):
+        """Regression test for directory creation.
+
+        Bug: http://b/110953234
+        """
+        with tempfile.NamedTemporaryFile() as tmp_file:
+            tmp_file.write('\0' * 1024 * 1024)
+            tmp_file.flush()
+            remote_path = self.DEVICE_TEMP_DIR + '/test_push_directory_creation'
+            self.device.shell(['rm', '-rf', remote_path])
+
+            remote_path += '/filename'
+            self.device.push(local=tmp_file.name, remote=remote_path)
+
     def _test_pull(self, remote_file, checksum):
         tmp_write = tempfile.NamedTemporaryFile(mode='wb', delete=False)
         tmp_write.close()
diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp
index e89586f..03850a3 100644
--- a/fastboot/fastboot.cpp
+++ b/fastboot/fastboot.cpp
@@ -122,7 +122,6 @@
     { "boot",     "boot.img",         "boot.sig",     "boot",     false, false },
     { nullptr,    "boot_other.img",   "boot.sig",     "boot",     true,  true  },
     { "dtbo",     "dtbo.img",         "dtbo.sig",     "dtbo",     true,  false },
-    { "dts",      "dt.img",           "dt.sig",       "dts",      true,  false },
     { "odm",      "odm.img",          "odm.sig",      "odm",      true,  false },
     { "product",  "product.img",      "product.sig",  "product",  true,  false },
     { "recovery", "recovery.img",     "recovery.sig", "recovery", true,  false },
diff --git a/healthd/BatteryMonitor.cpp b/healthd/BatteryMonitor.cpp
index 80c5afe..82c46ec 100644
--- a/healthd/BatteryMonitor.cpp
+++ b/healthd/BatteryMonitor.cpp
@@ -576,6 +576,20 @@
                                       POWER_SUPPLY_SYSFS_PATH, name);
                     if (access(path, R_OK) == 0)
                         mHealthdConfig->batteryChargeCounterPath = path;
+                    else if (strcmp(name, "battery") == 0) {
+                        // On Qualcomm chipsets, the value might come from the
+                        // "QPNP PMIC Battery Management System driver", which
+                        // creates sysfs entries separate from the "battery"
+                        // node.
+                        path.clear();
+                        path.appendFormat("%s/bms/charge_counter",
+                            POWER_SUPPLY_SYSFS_PATH);
+                        if (access(path, R_OK) == 0) {
+                            KLOG_INFO(LOG_TAG, "Reading charge_counter from "
+                                "bms instead of the battery driver.");
+                            mHealthdConfig->batteryChargeCounterPath = path;
+                        }
+                    }
                 }
 
                 if (mHealthdConfig->batteryTemperaturePath.isEmpty()) {
diff --git a/healthd/healthd_mode_charger.cpp b/healthd/healthd_mode_charger.cpp
index 56a9f86..82547db 100644
--- a/healthd/healthd_mode_charger.cpp
+++ b/healthd/healthd_mode_charger.cpp
@@ -41,7 +41,7 @@
 #include <cutils/properties.h>
 #include <cutils/uevent.h>
 #include <sys/reboot.h>
-
+#include <cutils/android_reboot.h>
 #ifdef CHARGER_ENABLE_SUSPEND
 #include <suspend/autosuspend.h>
 #endif
@@ -142,39 +142,63 @@
 
 static animation::frame default_animation_frames[] = {
     {
-        .disp_time = 750,
+        .disp_time = 500,
+        .min_level = 0,
+        .max_level = 9,
+        .surface = NULL,
+    },
+    {
+        .disp_time = 500,
         .min_level = 0,
         .max_level = 19,
         .surface = NULL,
     },
     {
-        .disp_time = 750,
+        .disp_time = 500,
+        .min_level = 0,
+        .max_level = 29,
+        .surface = NULL,
+    },
+    {
+        .disp_time = 500,
         .min_level = 0,
         .max_level = 39,
         .surface = NULL,
     },
     {
-        .disp_time = 750,
+        .disp_time = 500,
+        .min_level = 0,
+        .max_level = 49,
+        .surface = NULL,
+    },
+    {
+        .disp_time = 500,
         .min_level = 0,
         .max_level = 59,
         .surface = NULL,
     },
     {
-        .disp_time = 750,
+        .disp_time = 500,
+        .min_level = 0,
+        .max_level = 69,
+        .surface = NULL,
+    },
+    {
+        .disp_time = 500,
         .min_level = 0,
         .max_level = 79,
         .surface = NULL,
     },
     {
-        .disp_time = 750,
-        .min_level = 80,
-        .max_level = 95,
+        .disp_time = 500,
+        .min_level = 0,
+        .max_level = 89,
         .surface = NULL,
     },
     {
-        .disp_time = 750,
+        .disp_time = 500,
         .min_level = 0,
-        .max_level = 100,
+        .max_level = 97,
         .surface = NULL,
     },
 };
@@ -475,6 +499,8 @@
 static void handle_power_supply_state(charger* charger, int64_t now) {
     if (!charger->have_battery_state) return;
 
+    healthd_board_mode_charger_battery_update(batt_prop);
+
     if (!charger->charger_connected) {
         /* Last cycle would have stopped at the extreme top of battery-icon
          * Need to show the correct level corresponding to capacity.
@@ -624,6 +650,11 @@
 
     LOGW("--------------- STARTING CHARGER MODE ---------------\n");
 
+    if(!healthd_board_mode_charger_init()) {
+        LOGE("healthd_mode_charger_init failed restarting\n");
+        android_reboot(ANDROID_RB_RESTART2, 0, 0);
+    }
+
     ret = ev_init(std::bind(&input_callback, charger, std::placeholders::_1, std::placeholders::_2));
     if (!ret) {
         epollfd = ev_get_epollfd();
diff --git a/healthd/images/battery_scale.png b/healthd/images/battery_scale.png
index 2ae8f0f..231f627 100644
--- a/healthd/images/battery_scale.png
+++ b/healthd/images/battery_scale.png
Binary files differ
diff --git a/healthd/include/healthd/healthd.h b/healthd/include/healthd/healthd.h
index c01e8d7..78cf792 100644
--- a/healthd/include/healthd/healthd.h
+++ b/healthd/include/healthd/healthd.h
@@ -124,4 +124,12 @@
 
 int healthd_board_battery_update(struct android::BatteryProperties *props);
 
+
+//This API is called to update the battery/charging status by using the user
+//noticeable method other then the animation, such as: LEDs
+void healthd_board_mode_charger_battery_update(struct android::BatteryProperties *batt_prop);
+
+//This API is used to handle some board specific charger mode initialization,
+//such as: checking the charging is enabled or not.
+int healthd_board_mode_charger_init(void);
 #endif /* _HEALTHD_H_ */
diff --git a/init/Android.bp b/init/Android.bp
index 70a4ac6..3af482b 100644
--- a/init/Android.bp
+++ b/init/Android.bp
@@ -125,6 +125,7 @@
         "ueventd_parser.cpp",
         "util.cpp",
         "watchdogd.cpp",
+        "vendor_init.cpp",
     ],
     whole_static_libs: ["libcap"],
     header_libs: ["bootimg_headers"],
diff --git a/init/Android.mk b/init/Android.mk
index c4a6a50..c89bacc 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -90,4 +90,9 @@
     ln -sf ../init $(TARGET_ROOT_OUT)/sbin/watchdogd
 
 LOCAL_SANITIZE := signed-integer-overflow
+
+ifneq ($(strip $(TARGET_INIT_VENDOR_LIB)),)
+LOCAL_WHOLE_STATIC_LIBRARIES += $(TARGET_INIT_VENDOR_LIB)
+endif
+
 include $(BUILD_EXECUTABLE)
diff --git a/init/NOTICE b/init/NOTICE
index c5b1efa..383d0f5 100644
--- a/init/NOTICE
+++ b/init/NOTICE
@@ -188,3 +188,29 @@
 
    END OF TERMS AND CONDITIONS
 
+Copyright (c) 2013, The Linux Foundation. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+    * Neither the name of The Linux Foundation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/init/property_service.cpp b/init/property_service.cpp
index 4172ba7..14b5497 100644
--- a/init/property_service.cpp
+++ b/init/property_service.cpp
@@ -62,6 +62,7 @@
 #include "selinux.h"
 #include "subcontext.h"
 #include "util.h"
+#include "vendor_init.h"
 
 using namespace std::literals;
 
@@ -761,6 +762,10 @@
     load_properties_from_file("/odm/build.prop", NULL);
     load_properties_from_file("/vendor/build.prop", NULL);
     load_properties_from_file("/factory/factory.prop", "ro.*");
+
+    // Update with vendor-specific property runtime overrides
+    vendor_load_properties();
+
     load_recovery_id_prop();
 }
 
diff --git a/init/vendor_init.cpp b/init/vendor_init.cpp
new file mode 100644
index 0000000..d3fd5ff
--- /dev/null
+++ b/init/vendor_init.cpp
@@ -0,0 +1,37 @@
+/*
+Copyright (c) 2013, The Linux Foundation. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+    * Neither the name of The Linux Foundation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "vendor_init.h"
+
+/* init vendor override stubs */
+
+__attribute__ ((weak))
+void vendor_load_properties()
+{
+}
diff --git a/init/vendor_init.h b/init/vendor_init.h
new file mode 100644
index 0000000..9afb449
--- /dev/null
+++ b/init/vendor_init.h
@@ -0,0 +1,33 @@
+/*
+Copyright (c) 2013, The Linux Foundation. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+    * Neither the name of The Linux Foundation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __INIT_VENDOR__H__
+#define __INIT_VENDOR__H__
+extern void vendor_load_properties(void);
+#endif /* __INIT_VENDOR__H__ */
diff --git a/mkbootimg/mkbootimg b/mkbootimg/mkbootimg
index fda9af0..454fb0c 100755
--- a/mkbootimg/mkbootimg
+++ b/mkbootimg/mkbootimg
@@ -73,7 +73,7 @@
         args.base + args.second_offset,                 # physical load addr
         args.base + args.tags_offset,                   # physical addr for kernel tags
         args.pagesize,                                  # flash page size we assume
-        args.header_version,                            # version of bootimage header
+        max(args.header_version, filesize(args.dt)),    # version of bootimage header or dt size in bytes
         (args.os_version << 11) | args.os_patch_level)) # os version and patch level
     args.output.write(pack('16s', args.board.encode())) # asciiz product name
     args.output.write(pack('512s', args.cmdline[:512].encode()))
@@ -82,6 +82,7 @@
     update_sha(sha, args.kernel)
     update_sha(sha, args.ramdisk)
     update_sha(sha, args.second)
+    update_sha(sha, args.dt)
 
     if args.header_version > 0:
         update_sha(sha, args.recovery_dtbo)
@@ -181,15 +182,22 @@
     parser.add_argument('--id', help='print the image ID on standard output',
                         action='store_true')
     parser.add_argument('--header_version', help='boot image header version', type=parse_int, default=0)
+    parser.add_argument('--dt', help='path to the device tree image', type=FileType('rb'))
     parser.add_argument('-o', '--output', help='output file name', type=FileType('wb'),
                         required=True)
-    return parser.parse_args()
+
+    args = parser.parse_args()
+    if args.header_version > 0 and args.dt != None:
+        raise ValueError('header_version and dt cannot be set at the same time')
+
+    return args
 
 
 def write_data(args):
     write_padded_file(args.output, args.kernel, args.pagesize)
     write_padded_file(args.output, args.ramdisk, args.pagesize)
     write_padded_file(args.output, args.second, args.pagesize)
+    write_padded_file(args.output, args.dt, args.pagesize)
 
     if args.header_version > 0:
         write_padded_file(args.output, args.recovery_dtbo, args.pagesize)
diff --git a/rootdir/init.rc b/rootdir/init.rc
index b9464e7..faab981 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -669,6 +669,10 @@
     chown system system /sys/kernel/ipv4/tcp_rmem_max
     chown root radio /proc/cmdline
 
+    # setting ro.boot.btmacaddr 00:00:00:00:00:00 as
+    # we need to bypass get_local_address fatal error
+    setprop ro.boot.btmacaddr 00:00:00:00:00:00
+
     # Define default initial receive window size in segments.
     setprop net.tcp.default_init_rwnd 60