diff --git a/gps/core/gps_extended_c.h b/gps/core/gps_extended_c.h
index 27deb44..75ee17e 100644
--- a/gps/core/gps_extended_c.h
+++ b/gps/core/gps_extended_c.h
@@ -378,6 +378,7 @@ enum loc_api_adapter_event_index {
     LOC_API_ADAPTER_GDT_UPLOAD_END_REQ,                // GDT upload end request
     LOC_API_ADAPTER_GNSS_MEASUREMENT,                  // GNSS Measurement report
     LOC_API_ADAPTER_REQUEST_TIMEZONE,                  // Timezone injection request
+    LOC_API_ADAPTER_REPORT_GENFENCE_DWELL_REPORT,      // Geofence dwell report
     LOC_API_ADAPTER_EVENT_MAX
 };
 
@@ -407,6 +408,7 @@ enum loc_api_adapter_event_index {
 #define LOC_API_ADAPTER_BIT_GDT_UPLOAD_END_REQ               (1<<LOC_API_ADAPTER_GDT_UPLOAD_END_REQ)
 #define LOC_API_ADAPTER_BIT_GNSS_MEASUREMENT                 (1<<LOC_API_ADAPTER_GNSS_MEASUREMENT)
 #define LOC_API_ADAPTER_BIT_REQUEST_TIMEZONE                 (1<<LOC_API_ADAPTER_REQUEST_TIMEZONE)
+#define LOC_API_ADAPTER_BIT_REPORT_GENFENCE_DWELL            (1<<LOC_API_ADAPTER_REPORT_GENFENCE_DWELL_REPORT)
 
 typedef unsigned int LOC_API_ADAPTER_EVENT_MASK_T;
 
@@ -416,6 +418,7 @@ typedef enum loc_api_adapter_msg_to_check_supported {
     LOC_API_ADAPTER_MESSAGE_DISTANCE_BASE_TRACKING,          // DBT 2.0
     LOC_API_ADAPTER_MESSAGE_ADAPTIVE_LOCATION_BATCHING,      // Batching 1.5
     LOC_API_ADAPTER_MESSAGE_DISTANCE_BASE_LOCATION_BATCHING, // Batching 2.0
+    LOC_API_ADAPTER_MESSAGE_UPDATE_TBF_ON_THE_FLY,           // Updating Tracking TBF On The Fly
 
     LOC_API_ADAPTER_MESSAGE_MAX
 } LocCheckingMessagesID;
diff --git a/gps/gps.conf b/gps/gps.conf
index 66d5a28..f4831c0 100644
--- a/gps/gps.conf
+++ b/gps/gps.conf
@@ -52,7 +52,7 @@ SUPL_ES=0
 USE_EMERGENCY_PDN_FOR_EMERGENCY_SUPL=1
 
 #SUPL_MODE is a bit mask set in config.xml per carrier by default.
-#If it is uncommented here, this value will over write the value from
+#If it is uncommented here, this value will overwrite the value from
 #config.xml.
 #MSA=0X2
 #MSB=0X1
@@ -98,7 +98,7 @@ CAPABILITIES=0x37
 # 1: Enable LPP_User_Plane on LTE
 # 2: Enable LPP_Control_Plane
 # 3: Enable both LPP_User_Plane and LPP_Control_Plane
-LPP_PROFILE = 0
+LPP_PROFILE = 3
 
 ################################
 # EXTRA SETTINGS
diff --git a/gps/loc_api/libloc_api_50001/LocEngAdapter.cpp b/gps/loc_api/libloc_api_50001/LocEngAdapter.cpp
index 35447d4..592662d 100644
--- a/gps/loc_api/libloc_api_50001/LocEngAdapter.cpp
+++ b/gps/loc_api/libloc_api_50001/LocEngAdapter.cpp
@@ -101,7 +101,6 @@ void LocEngAdapter::setXtraUserAgent() {
             char release[PROPERTY_VALUE_MAX];
             char manufacture[PROPERTY_VALUE_MAX];
             char model[PROPERTY_VALUE_MAX];
-            char carrier[PROPERTY_VALUE_MAX];
             char board[PROPERTY_VALUE_MAX];
             char brand[PROPERTY_VALUE_MAX];
             char chipsetsn[CHIPSET_SERIAL_NUMBER_MAX_LEN];
@@ -111,13 +110,18 @@ void LocEngAdapter::setXtraUserAgent() {
             property_get("ro.build.version.release", release,     defVal);
             property_get("ro.product.manufacturer",  manufacture, defVal);
             property_get("ro.product.model", model,   defVal);
-            property_get("ro.carrier",       carrier, defVal);
             property_get("ro.product.board", board,   defVal);
             property_get("ro.product.brand", brand,   defVal);
             getChipsetSerialNo(chipsetsn, sizeof(chipsetsn), defVal);
 
-            snprintf(userAgent, sizeof(userAgent), "A/%s/%s/%s/%s/%s/QCX3/s%u/-/%s/-/%s/-/-/-",
-                     release, manufacture, model, board, carrier,
+            encodeInPlace(release, PROPERTY_VALUE_MAX);
+            encodeInPlace(manufacture, PROPERTY_VALUE_MAX);
+            encodeInPlace(model, PROPERTY_VALUE_MAX);
+            encodeInPlace(board, PROPERTY_VALUE_MAX);
+            encodeInPlace(brand, PROPERTY_VALUE_MAX);
+
+            snprintf(userAgent, sizeof(userAgent), "A/%s/%s/%s/%s/-/QCX3/s%u/-/%s/-/%s/-/-/-",
+                     release, manufacture, model, board,
                      mContext->getIzatDevId(), chipsetsn, brand);
 
             for (int i = 0; i < sizeof(userAgent) && userAgent[i]; i++) {
@@ -199,6 +203,56 @@ void LocEngAdapter::setXtraUserAgent() {
             return;
         }
 
+        /**
+         *  encode the given string value such that all separator characters ('/','+','|','%')
+         *  in the string are repaced by their corresponding encodings (%2F","%2B","%7C", "%25")
+         */
+        static void encodeInPlace(char value[], const int size) {
+            char buffer[size];
+
+            struct ENCODE {
+                const char ch;
+                const char *code;
+            };
+
+            const ENCODE encodings[] = { {'/', "%2F"}, {'+', "%2B"}, {'|', "%7C",}, {'%', "%25"} };
+            const int nencodings = (int)sizeof(encodings) / sizeof(encodings[0]);
+
+            int inpos = 0, outpos = 0;
+            while(value[inpos] != '\0' && outpos < size - 1) {
+                // check if escaped character
+                int escchar = 0;
+                while(escchar < nencodings && encodings[escchar].ch != value[inpos]) {
+                    escchar++;
+                }
+
+                if (escchar == nencodings) {
+                    // non escaped character
+                    buffer[outpos++] = value[inpos++];
+                    continue;
+                }
+
+                // escaped character
+                int codepos = 0;
+                #define NUM_CHARS_IN_CODE 3
+
+                if (outpos + NUM_CHARS_IN_CODE >= size) {
+                    // skip last character if there is insufficient space
+                    break;
+                }
+
+                while(outpos < size - 1 && codepos < NUM_CHARS_IN_CODE) {
+                    buffer[outpos++] = encodings[escchar].code[codepos++];
+                }
+                inpos++;
+            }
+
+            // copy to ouput
+            value[outpos] = '\0';
+            while(--outpos >= 0) {
+                value[outpos] = buffer[outpos];
+            }
+        }
     };
 
     sendMsg(new LocSetXtraUserAgent(mContext));
diff --git a/gps/utils/LocSharedLock.h b/gps/utils/LocSharedLock.h
index 6b9e27f..7fe6237 100644
--- a/gps/utils/LocSharedLock.h
+++ b/gps/utils/LocSharedLock.h
@@ -30,6 +30,7 @@
 #define __LOC_SHARED_LOCK__
 
 #include <stddef.h>
+#include <cutils/atomic.h>
 #include <pthread.h>
 
 // This is a utility created for use cases such that there are more than
@@ -39,16 +40,16 @@
 // this share lock's share() method has to be called, so that the obj
 // can maintain an accurate client count.
 class LocSharedLock {
-    uint32_t mRef;
+    volatile int32_t mRef;
     pthread_mutex_t mMutex;
     inline ~LocSharedLock() { pthread_mutex_destroy(&mMutex); }
 public:
     // first client to create this LockSharedLock
     inline LocSharedLock() : mRef(1) { pthread_mutex_init(&mMutex, NULL); }
     // following client(s) are to *share()* this lock created by the first client
-    inline LocSharedLock* share() { mRef++; return this; }
+    inline LocSharedLock* share() { android_atomic_inc(&mRef); return this; }
     // whe a client no longer needs this shared lock, drop() shall be called.
-    inline void drop() { if (0 == --mRef) delete this; }
+    inline void drop() { if (1 == android_atomic_dec(&mRef)) delete this; }
     // locking the lock to enter critical section
     inline void lock() { pthread_mutex_lock(&mMutex); }
     // unlocking the lock to leave the critical section
diff --git a/gps/utils/MsgTask.cpp b/gps/utils/MsgTask.cpp
index fdb1102..6f9d0e9 100644
--- a/gps/utils/MsgTask.cpp
+++ b/gps/utils/MsgTask.cpp
@@ -83,7 +83,7 @@ void MsgTask::prerun() {
 }
 
 bool MsgTask::run() {
-    LOC_LOGD("MsgTask::loop() listening ...\n");
+    LOC_LOGV("MsgTask::loop() listening ...\n");
     LocMsg* msg;
     msq_q_err_type result = msg_q_rcv((void*)mQ, (void **)&msg);
     if (eMSG_Q_SUCCESS != result) {
diff --git a/gps/utils/linked_list.c b/gps/utils/linked_list.c
index 92617fe..2c91714 100644
--- a/gps/utils/linked_list.c
+++ b/gps/utils/linked_list.c
@@ -109,7 +109,7 @@ linked_list_err_type linked_list_destroy(void** list_data)
   ===========================================================================*/
 linked_list_err_type linked_list_add(void* list_data, void *data_obj, void (*dealloc)(void*))
 {
-   LOC_LOGD("%s: Adding to list data_obj = 0x%08X\n", __FUNCTION__, data_obj);
+   LOC_LOGV("%s: Adding to list data_obj = 0x%08X\n", __FUNCTION__, data_obj);
    if( list_data == NULL )
    {
       LOC_LOGE("%s: Invalid list parameter!\n", __FUNCTION__);
@@ -161,7 +161,7 @@ linked_list_err_type linked_list_add(void* list_data, void *data_obj, void (*dea
   ===========================================================================*/
 linked_list_err_type linked_list_remove(void* list_data, void **data_obj)
 {
-   LOC_LOGD("%s: Removing from list\n", __FUNCTION__);
+   LOC_LOGV("%s: Removing from list\n", __FUNCTION__);
    if( list_data == NULL )
    {
       LOC_LOGE("%s: Invalid list parameter!\n", __FUNCTION__);
@@ -268,7 +268,7 @@ linked_list_err_type linked_list_search(void* list_data, void **data_p,
                                         bool (*equal)(void* data_0, void* data),
                                         void* data_0, bool rm_if_found)
 {
-   LOC_LOGD("%s: Search the list\n", __FUNCTION__);
+   LOC_LOGV("%s: Search the list\n", __FUNCTION__);
    if( list_data == NULL || NULL == equal )
    {
       LOC_LOGE("%s: Invalid list parameter! list_data %p equal %p\n",
diff --git a/gps/utils/msg_q.c b/gps/utils/msg_q.c
index f82d4c0..5be8547 100644
--- a/gps/utils/msg_q.c
+++ b/gps/utils/msg_q.c
@@ -199,7 +199,7 @@ msq_q_err_type msg_q_snd(void* msg_q_data, void* msg_obj, void (*dealloc)(void*)
    msg_q* p_msg_q = (msg_q*)msg_q_data;
 
    pthread_mutex_lock(&p_msg_q->list_mutex);
-   LOC_LOGD("%s: Sending message with handle = 0x%08X\n", __FUNCTION__, msg_obj);
+   LOC_LOGV("%s: Sending message with handle = 0x%08X\n", __FUNCTION__, msg_obj);
 
    if( p_msg_q->unblocked )
    {
@@ -215,7 +215,7 @@ msq_q_err_type msg_q_snd(void* msg_q_data, void* msg_obj, void (*dealloc)(void*)
 
    pthread_mutex_unlock(&p_msg_q->list_mutex);
 
-   LOC_LOGD("%s: Finished Sending message with handle = 0x%08X\n", __FUNCTION__, msg_obj);
+   LOC_LOGV("%s: Finished Sending message with handle = 0x%08X\n", __FUNCTION__, msg_obj);
 
    return rv;
 }
@@ -242,7 +242,7 @@ msq_q_err_type msg_q_rcv(void* msg_q_data, void** msg_obj)
 
    msg_q* p_msg_q = (msg_q*)msg_q_data;
 
-   LOC_LOGD("%s: Waiting on message\n", __FUNCTION__);
+   LOC_LOGV("%s: Waiting on message\n", __FUNCTION__);
 
    pthread_mutex_lock(&p_msg_q->list_mutex);
 
@@ -263,7 +263,7 @@ msq_q_err_type msg_q_rcv(void* msg_q_data, void** msg_obj)
 
    pthread_mutex_unlock(&p_msg_q->list_mutex);
 
-   LOC_LOGD("%s: Received message 0x%08X rv = %d\n", __FUNCTION__, *msg_obj, rv);
+   LOC_LOGV("%s: Received message 0x%08X rv = %d\n", __FUNCTION__, *msg_obj, rv);
 
    return rv;
 }