diff --git a/camera/device/3.2/types.hal b/camera/device/3.2/types.hal
index ed6ef7d..a7ab4ab 100644
--- a/camera/device/3.2/types.hal
+++ b/camera/device/3.2/types.hal
@@ -408,7 +408,16 @@
     int32_t streamId;
 
     /**
-     * The graphics buffer handle to the buffer
+     * The graphics buffer handle to the buffer.
+     *
+     * For StreamBuffers sent to the HAL in a CaptureRequest, this must be a
+     * valid handle to a graphics buffer, with dimensions and format matching
+     * that of the stream.
+     *
+     * For StreamBuffers returned in a CaptureResult, this must be null, since
+     * the handle to the buffer is already known to the client (since the client
+     * sent it in the matching CaptureRequest), and the handle can be identified
+     * by the combination of frame number and stream ID.
      */
     handle buffer;
 
@@ -424,44 +433,34 @@
      * The acquire sync fence for this buffer. The HAL must wait on this fence
      * fd before attempting to read from or write to this buffer.
      *
-     * The framework may be set to -1 to indicate that no waiting is necessary
-     * for this buffer.
+     * In a buffer included in a CaptureRequest, the client may set this to null
+     * to indicate that no waiting is necessary for this buffer.
      *
-     * When the HAL returns an output buffer to the framework with
-     * processCaptureResult(), the acquireFence must be set to -1. If the HAL
-     * never waits on the acquireFence due to an error in filling a buffer,
-     * when calling processCaptureResult() the HAL must set the releaseFence
-     * of the buffer to be the acquireFence passed to it by the framework. This
-     * allows the framework to wait on the fence before reusing the buffer.
-     *
-     * For input buffers, the HAL must not change the acquireFence field during
-     * the processCaptureRequest() call.
-     *
-     * When the HAL returns an input buffer to the framework with
-     * processCaptureResult(), the acquireFence must be set to -1. If the HAL
-     * never waits on input buffer acquire fence due to an error, the sync
-     * fences must be handled similarly to the way they are handled for output
-     * buffers.
+     * When the HAL returns an input or output buffer to the framework with
+     * processCaptureResult(), the acquireFence must be set to null. If the HAL
+     * never waits on the acquireFence due to an error in filling or reading a
+     * buffer, when calling processCaptureResult() the HAL must set the
+     * releaseFence of the buffer to be the acquireFence passed to it by the
+     * client. This allows the client to wait on the fence before reusing the
+     * buffer.
      */
     handle acquireFence;
 
     /**
-     * The release sync fence for this buffer. The HAL must set this fence when
-     * returning buffers to the framework, or write -1 to indicate that no
-     * waiting is required for this buffer.
+     * The release sync fence for this buffer. The HAL must set this to a valid
+     * fence fd when returning the input buffer or output buffers to the client
+     * in a CaptureResult, or set it to null to indicate that no waiting is
+     * required for this buffer.
      *
-     * For the output buffers, the fences must be set in the outputBuffers
-     * array passed to processCaptureResult().
-     *
-     * For the input buffer, the fences must be set in the inputBuffer
-     * passed to processCaptureResult().
+     * The client must set this to be null for all buffers included in a
+     * processCaptureRequest call.
      *
      * After signaling the releaseFence for this buffer, the HAL
      * must not make any further attempts to access this buffer as the
-     * ownership has been fully transferred back to the framework.
+     * ownership has been fully transferred back to the client.
      *
-     * If a fence of -1 was specified then the ownership of this buffer
-     * is transferred back immediately upon the call of processCaptureResult.
+     * If this is null, then the ownership of this buffer is transferred back
+     * immediately upon the call of processCaptureResult.
      */
     handle releaseFence;
 
@@ -722,13 +721,13 @@
     /**
      * The input stream buffer to use for this request, if any.
      *
+     * An invalid inputBuffer is signified by a null inputBuffer::buffer, in
+     * which case the value of all other members of inputBuffer must be ignored.
+     *
      * If inputBuffer is invalid, then the request is for a new capture from the
      * imager. If inputBuffer is valid, the request is for reprocessing the
-     * image contained in inputBuffer.
-     *
-     * In the latter case, the HAL must set the releaseFence of the
-     * inputBuffer to a valid sync fence, or to -1 if the HAL does not support
-     * sync, before processCaptureRequest() returns.
+     * image contained in inputBuffer, and the HAL must release the inputBuffer
+     * back to the client in a subsequent processCaptureResult call.
      *
      * The HAL is required to wait on the acquire sync fence of the input buffer
      * before accessing it.
@@ -741,9 +740,8 @@
      * data from this capture/reprocess. The HAL must wait on the acquire fences
      * of each stream buffer before writing to them.
      *
-     * The HAL takes ownership of the actual buffer_handle_t entries in
-     * outputBuffers; the framework must not access them until they are
-     * returned in a CaptureResult.
+     * The HAL takes ownership of the handles in outputBuffers; the client
+     * must not access them until they are returned in a CaptureResult.
      *
      * Any or all of the buffers included here may be brand new in this
      * request (having never before seen by the HAL).
@@ -823,10 +821,15 @@
     CameraMetadata result;
 
     /**
-     * The handles for the output stream buffers for this capture. They may not
-     * yet be filled at the time the HAL calls processCaptureResult(); the
-     * framework must wait on the release sync fences provided by the HAL before
-     * reading the buffers.
+     * The completed output stream buffers for this capture.
+     *
+     * They may not yet be filled at the time the HAL calls
+     * processCaptureResult(); the framework must wait on the release sync
+     * fences provided by the HAL before reading the buffers.
+     *
+     * The StreamBuffer::buffer handle must be null for all returned buffers;
+     * the client must cache the handle and look it up via the combination of
+     * frame number and stream ID.
      *
      * The number of output buffers returned must be less than or equal to the
      * matching capture request's count. If this is less than the buffer count
@@ -836,7 +839,7 @@
      * valid result metadata or an input buffer is returned in this result.
      *
      * The HAL must set the stream buffer's release sync fence to a valid sync
-     * fd, or to -1 if the buffer has already been filled.
+     * fd, or to null if the buffer has already been filled.
      *
      * If the HAL encounters an error while processing the buffer, and the
      * buffer is not filled, the buffer's status field must be set to ERROR. If
@@ -844,7 +847,7 @@
      * the acquire fence must be copied into the release fence, to allow the
      * framework to wait on the fence before reusing the buffer.
      *
-     * The acquire fence must be set to -1 for all output buffers.
+     * The acquire fence must be set to null for all output buffers.
      *
      * This vector may be empty; if so, at least one other processCaptureResult
      * call must be made (or have been made) by the HAL to provide the filled
@@ -854,8 +857,8 @@
      * all previous frames' buffers for that corresponding stream must have been
      * already delivered (the fences need not have yet been signaled).
      *
-     * Gralloc buffers for a frame may be sent to framework before the
-     * corresponding SHUTTER-notify.
+     * Buffers for a frame may be sent to framework before the corresponding
+     * SHUTTER-notify call is made by the HAL.
      *
      * Performance considerations:
      *
@@ -867,10 +870,11 @@
     vec<StreamBuffer> outputBuffers;
 
     /**
-     * The handle for the input stream buffer for this capture. It may not
-     * yet be consumed at the time the HAL calls processCaptureResult(); the
-     * framework must wait on the release sync fence provided by the HAL before
-     * reusing the buffer.
+     * The handle for the input stream buffer for this capture, if any.
+     *
+     * It may not yet be consumed at the time the HAL calls
+     * processCaptureResult(); the framework must wait on the release sync fence
+     * provided by the HAL before reusing the buffer.
      *
      * The HAL must handle the sync fences the same way they are done for
      * outputBuffers.
diff --git a/drm/crypto/1.0/default/CryptoFactory.cpp b/drm/crypto/1.0/default/CryptoFactory.cpp
index e67a990..187d564 100644
--- a/drm/crypto/1.0/default/CryptoFactory.cpp
+++ b/drm/crypto/1.0/default/CryptoFactory.cpp
@@ -27,7 +27,7 @@
 namespace implementation {
 
     CryptoFactory::CryptoFactory() :
-        loader("/vendor/lib/mediadrm", "createCryptoFactory", "crypto") {}
+        loader("/vendor/lib/mediadrm", "createCryptoFactory") {}
 
     // Methods from ::android::hardware::drm::crypto::V1_0::ICryptoFactory follow.
     Return<bool> CryptoFactory::isCryptoSchemeSupported(
diff --git a/drm/drm/1.0/IDrmPlugin.hal b/drm/drm/1.0/IDrmPlugin.hal
index e847805..2816c8a 100644
--- a/drm/drm/1.0/IDrmPlugin.hal
+++ b/drm/drm/1.0/IDrmPlugin.hal
@@ -78,7 +78,7 @@
      * @return status the status of the call.  The status must be one of
      * ERROR_DRM_SESSION_NOT_OPENED if the session is not opened,
      * ERROR_DRM_NOT_PROVISIONED if the device requires provisioning before
-     * it can generate a key request, ERROR_DRM_CANNOT_HANDLE if keyKeyRequest
+     * it can generate a key request, ERROR_DRM_CANNOT_HANDLE if getKeyRequest
      * is not supported at the time of the call, BAD_VALUE if any parameters
      * are invalid or ERROR_DRM_INVALID_STATE if the HAL is in a state where
      * a key request cannot be generated.
diff --git a/drm/drm/1.0/default/DrmFactory.cpp b/drm/drm/1.0/default/DrmFactory.cpp
index 494ca53..7dc7ffe 100644
--- a/drm/drm/1.0/default/DrmFactory.cpp
+++ b/drm/drm/1.0/default/DrmFactory.cpp
@@ -27,7 +27,7 @@
 namespace implementation {
 
     DrmFactory::DrmFactory() :
-        loader("/vendor/lib/mediadrm", "createDrmFactory", "drm") {}
+        loader("/vendor/lib/mediadrm", "createDrmFactory") {}
 
     // Methods from ::android::hardware::drm::drm::V1_0::IDrmFactory follow.
     Return<bool> DrmFactory::isCryptoSchemeSupported (
diff --git a/drm/drm/1.0/types.hal b/drm/drm/1.0/types.hal
index 3d77911..b2f3f32 100644
--- a/drm/drm/1.0/types.hal
+++ b/drm/drm/1.0/types.hal
@@ -122,7 +122,7 @@
 enum KeyType : uint32_t {
     /**
      * Drm keys can be for offline content or for online streaming.
-     * Offline keys are persisted on the device and may be used when the device
+
      * is disconnected from the network.
      */
     OFFLINE,
diff --git a/gnss/1.0/default/Android.mk b/gnss/1.0/default/Android.mk
index 06ef331..6289491 100644
--- a/gnss/1.0/default/Android.mk
+++ b/gnss/1.0/default/Android.mk
@@ -27,3 +27,27 @@
     libhardware
 
 include $(BUILD_SHARED_LIBRARY)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_MODULE := android.hardware.gnss@1.0-service
+LOCAL_INIT_RC := android.hardware.gnss@1.0-service.rc
+LOCAL_SRC_FILES := \
+    service.cpp \
+
+LOCAL_SHARED_LIBRARIES := \
+    liblog \
+    libcutils \
+    libdl \
+    libbase \
+    libutils \
+    libhardware_legacy \
+    libhardware \
+
+LOCAL_SHARED_LIBRARIES += \
+    libhwbinder \
+    libhidlbase \
+    libhidltransport \
+    android.hardware.gnss@1.0 \
+
+include $(BUILD_EXECUTABLE)
diff --git a/gnss/1.0/default/android.hardware.gnss@1.0-service.rc b/gnss/1.0/default/android.hardware.gnss@1.0-service.rc
new file mode 100644
index 0000000..eeb2e43
--- /dev/null
+++ b/gnss/1.0/default/android.hardware.gnss@1.0-service.rc
@@ -0,0 +1,4 @@
+service gnss_service /system/bin/hw/android.hardware.gnss@1.0-service
+    class main
+    user system
+    group system
diff --git a/gnss/1.0/default/service.cpp b/gnss/1.0/default/service.cpp
new file mode 100644
index 0000000..4e040c5
--- /dev/null
+++ b/gnss/1.0/default/service.cpp
@@ -0,0 +1,12 @@
+#define LOG_TAG "android.hardware.gnss@1.0-service"
+
+#include <android/hardware/gnss/1.0/IGnss.h>
+
+#include <hidl/LegacySupport.h>
+
+using android::hardware::gnss::V1_0::IGnss;
+using android::hardware::defaultPassthroughServiceImplementation;
+
+int main() {
+    return defaultPassthroughServiceImplementation<IGnss>("gnss");
+}
diff --git a/radio/1.0/types.hal b/radio/1.0/types.hal
index 8c7f538..6475b4f 100644
--- a/radio/1.0/types.hal
+++ b/radio/1.0/types.hal
@@ -51,7 +51,6 @@
 };
 
 enum RadioError : int32_t {
-    INVALID_RESPONSE = -1,                // Response from vendor had invalid data
     NONE = 0,                             // Success
     RADIO_NOT_AVAILABLE = 1,              // If radio did not start or is resetting
     GENERIC_FAILURE = 2,
@@ -115,7 +114,8 @@
     NO_NETWORK_FOUND = 63,                // Network cannot be found
     DEVICE_IN_USE = 64,                   // Operation cannot be performed because the device
                                           // is currently in use
-    RIL_E_ABORTED = 65,                   // Operation aborted
+    ABORTED = 65,                         // Operation aborted
+    INVALID_RESPONSE = 66,                // Response from vendor had invalid data
 
     // TODO(May be moved to vendor HAL extension)
     // OEM specific error codes. To be used by OEM when they don't want to reveal
diff --git a/update-makefiles.sh b/update-makefiles.sh
index f153a84..d0cb91c 100755
--- a/update-makefiles.sh
+++ b/update-makefiles.sh
@@ -20,7 +20,9 @@
 for p in $packages; do
   echo "Updating $p";
   hidl-gen -Lmakefile -r android.hardware:hardware/interfaces -r android.hidl:system/libhidl/transport $p;
+  rc=$?; if [[ $rc != 0 ]]; then exit $rc; fi
   hidl-gen -Landroidbp -r android.hardware:hardware/interfaces -r android.hidl:system/libhidl/transport $p;
+  rc=$?; if [[ $rc != 0 ]]; then exit $rc; fi
 done
 
 # subdirectories of hardware/interfaces which contain an Android.bp file