Merge "Break out create_contiguous_mspace_with_base This routine allows creating a contiguous mspace from raw mapped memory. In turn, this will enable preallocation of the 3 heap spaces, which will help remembered sets and zygote/app checks given pointer values."
diff --git a/adb/commandline.c b/adb/commandline.c
index b96674f..5756752 100644
--- a/adb/commandline.c
+++ b/adb/commandline.c
@@ -951,10 +951,8 @@
     }
 
     if(!strcmp(argv[0], "bugreport")) {
-        if (argc != 1) {
-            return 1;
-        }
-        do_cmd(ttype, serial, "shell", "dumpstate", "-", 0);
+        if (argc != 1) return usage();
+        do_cmd(ttype, serial, "shell", "bugreport", 0);
         return 0;
     }
 
diff --git a/adb/usb_linux.c b/adb/usb_linux.c
index 863af1d..66ee317 100644
--- a/adb/usb_linux.c
+++ b/adb/usb_linux.c
@@ -150,13 +150,13 @@
         while((de = readdir(devdir))) {
             unsigned char devdesc[256];
             unsigned char* bufptr = devdesc;
+            unsigned char* bufend;
             struct usb_device_descriptor* device;
             struct usb_config_descriptor* config;
             struct usb_interface_descriptor* interface;
             struct usb_endpoint_descriptor *ep1, *ep2;
             unsigned zero_mask = 0;
             unsigned vid, pid;
-            int i, interfaces;
             size_t desclength;
 
             if(badname(de->d_name)) continue;
@@ -173,6 +173,7 @@
             }
 
             desclength = adb_read(fd, devdesc, sizeof(devdesc));
+            bufend = bufptr + desclength;
 
                 // should have device and configuration descriptors, and atleast two endpoints
             if (desclength < USB_DT_DEVICE_SIZE + USB_DT_CONFIG_SIZE) {
@@ -203,75 +204,73 @@
                 continue;
             }
 
-                // loop through all the interfaces and look for the ADB interface
-            interfaces = config->bNumInterfaces;
-            for (i = 0; i < interfaces; i++) {
-                if (bufptr + USB_DT_ENDPOINT_SIZE > devdesc + desclength)
-                    break;
+                // loop through all the descriptors and look for the ADB interface
+            while (bufptr < bufend) {
+                unsigned char length = bufptr[0];
+                unsigned char type = bufptr[1];
 
-                interface = (struct usb_interface_descriptor *)bufptr;
-                bufptr += USB_DT_INTERFACE_SIZE;
-                if (interface->bLength != USB_DT_INTERFACE_SIZE ||
-                    interface->bDescriptorType != USB_DT_INTERFACE) {
-                    D("usb_interface_descriptor not found\n");
-                    break;
-                }
+                if (type == USB_DT_INTERFACE) {
+                    interface = (struct usb_interface_descriptor *)bufptr;
+                    bufptr += length;
 
-                DBGX("bInterfaceClass: %d,  bInterfaceSubClass: %d,"
-                     "bInterfaceProtocol: %d, bNumEndpoints: %d\n",
-                     interface->bInterfaceClass, interface->bInterfaceSubClass,
-                     interface->bInterfaceProtocol, interface->bNumEndpoints);
-
-                if (interface->bNumEndpoints == 2 &&
-                        is_adb_interface(vid, pid, interface->bInterfaceClass,
-                        interface->bInterfaceSubClass, interface->bInterfaceProtocol))  {
-
-                    DBGX("looking for bulk endpoints\n");
-                        // looks like ADB...
-                    ep1 = (struct usb_endpoint_descriptor *)bufptr;
-                    bufptr += USB_DT_ENDPOINT_SIZE;
-                    ep2 = (struct usb_endpoint_descriptor *)bufptr;
-                    bufptr += USB_DT_ENDPOINT_SIZE;
-
-                    if (bufptr > devdesc + desclength ||
-                        ep1->bLength != USB_DT_ENDPOINT_SIZE ||
-                        ep1->bDescriptorType != USB_DT_ENDPOINT ||
-                        ep2->bLength != USB_DT_ENDPOINT_SIZE ||
-                        ep2->bDescriptorType != USB_DT_ENDPOINT) {
-                        D("endpoints not found\n");
+                    if (length != USB_DT_INTERFACE_SIZE) {
+                        D("interface descriptor has wrong size\n");
                         break;
                     }
 
-                        // both endpoints should be bulk
-                    if (ep1->bmAttributes != USB_ENDPOINT_XFER_BULK ||
-                        ep2->bmAttributes != USB_ENDPOINT_XFER_BULK) {
-                        D("bulk endpoints not found\n");
-                        continue;
+                    DBGX("bInterfaceClass: %d,  bInterfaceSubClass: %d,"
+                         "bInterfaceProtocol: %d, bNumEndpoints: %d\n",
+                         interface->bInterfaceClass, interface->bInterfaceSubClass,
+                         interface->bInterfaceProtocol, interface->bNumEndpoints);
+
+                    if (interface->bNumEndpoints == 2 &&
+                            is_adb_interface(vid, pid, interface->bInterfaceClass,
+                            interface->bInterfaceSubClass, interface->bInterfaceProtocol))  {
+
+                        DBGX("looking for bulk endpoints\n");
+                            // looks like ADB...
+                        ep1 = (struct usb_endpoint_descriptor *)bufptr;
+                        bufptr += USB_DT_ENDPOINT_SIZE;
+                        ep2 = (struct usb_endpoint_descriptor *)bufptr;
+                        bufptr += USB_DT_ENDPOINT_SIZE;
+
+                        if (bufptr > devdesc + desclength ||
+                            ep1->bLength != USB_DT_ENDPOINT_SIZE ||
+                            ep1->bDescriptorType != USB_DT_ENDPOINT ||
+                            ep2->bLength != USB_DT_ENDPOINT_SIZE ||
+                            ep2->bDescriptorType != USB_DT_ENDPOINT) {
+                            D("endpoints not found\n");
+                            break;
+                        }
+
+                            // both endpoints should be bulk
+                        if (ep1->bmAttributes != USB_ENDPOINT_XFER_BULK ||
+                            ep2->bmAttributes != USB_ENDPOINT_XFER_BULK) {
+                            D("bulk endpoints not found\n");
+                            continue;
+                        }
+                            /* aproto 01 needs 0 termination */
+                        if(interface->bInterfaceProtocol == 0x01) {
+                            zero_mask = ep1->wMaxPacketSize - 1;
+                        }
+
+                            // we have a match.  now we just need to figure out which is in and which is out.
+                        if (ep1->bEndpointAddress & USB_ENDPOINT_DIR_MASK) {
+                            local_ep_in = ep1->bEndpointAddress;
+                            local_ep_out = ep2->bEndpointAddress;
+                        } else {
+                            local_ep_in = ep2->bEndpointAddress;
+                            local_ep_out = ep1->bEndpointAddress;
+                        }
+
+                        register_device_callback(devname, local_ep_in, local_ep_out,
+                                interface->bInterfaceNumber, device->iSerialNumber, zero_mask);
+                        break;
                     }
-
-                        /* aproto 01 needs 0 termination */
-                    if(interface->bInterfaceProtocol == 0x01) {
-                        zero_mask = ep1->wMaxPacketSize - 1;
-                    }
-
-                        // we have a match.  now we just need to figure out which is in and which is out.
-                    if (ep1->bEndpointAddress & USB_ENDPOINT_DIR_MASK) {
-                        local_ep_in = ep1->bEndpointAddress;
-                        local_ep_out = ep2->bEndpointAddress;
-                    } else {
-                        local_ep_in = ep2->bEndpointAddress;
-                        local_ep_out = ep1->bEndpointAddress;
-                    }
-
-                    register_device_callback(devname, local_ep_in, local_ep_out,
-                            interface->bInterfaceNumber, device->iSerialNumber, zero_mask);
-
-                    break;
                 } else {
-                    // seek next interface descriptor
-                    bufptr += (USB_DT_ENDPOINT_SIZE * interface->bNumEndpoints);
-                 }
-            } // end of for
+                    bufptr += length;
+                }
+            } // end of while
 
             adb_close(fd);
         } // end of devdir while
diff --git a/adb/usb_vendors.c b/adb/usb_vendors.c
index 63bf97a..73bf418 100644
--- a/adb/usb_vendors.c
+++ b/adb/usb_vendors.c
@@ -53,6 +53,12 @@
 #define VENDOR_ID_SONY_ERICSSON 0x0FCE
 // Foxconn's USB Vendor ID
 #define VENDOR_ID_FOXCONN       0x0489
+// Dell's USB Vendor ID
+#define VENDOR_ID_DELL          0x413c
+// Nvidia's USB Vendor ID
+#define VENDOR_ID_NVIDIA        0x0955
+// Garmin-Asus's USB Vendor ID
+#define VENDOR_ID_GARMIN_ASUS   0x091E
 
 
 /** built-in vendor list */
@@ -66,6 +72,9 @@
     VENDOR_ID_ACER,
     VENDOR_ID_SONY_ERICSSON,
     VENDOR_ID_FOXCONN,
+    VENDOR_ID_DELL,
+    VENDOR_ID_NVIDIA,
+    VENDOR_ID_GARMIN_ASUS,
 };
 
 #define BUILT_IN_VENDOR_COUNT    (sizeof(builtInVendorIds)/sizeof(builtInVendorIds[0]))
diff --git a/debuggerd/debuggerd.c b/debuggerd/debuggerd.c
index 3757cd5..7b987cf 100644
--- a/debuggerd/debuggerd.c
+++ b/debuggerd/debuggerd.c
@@ -120,7 +120,7 @@
 
 void dump_stack_and_code(int tfd, int pid, mapinfo *map,
                          int unwind_depth, unsigned int sp_list[],
-                         int frame0_pc_sane, bool at_fault)
+                         bool at_fault)
 {
     unsigned int sp, pc, p, end, data;
     struct pt_regs r;
@@ -132,19 +132,11 @@
     sp = r.ARM_sp;
     pc = r.ARM_pc;
 
-    /* Died because calling the weeds - dump
-     * the code around the PC in the next frame instead.
-     */
-    if (frame0_pc_sane == 0) {
-        pc = r.ARM_lr;
-    }
-
-    _LOG(tfd, only_in_tombstone,
-         "\ncode around %s:\n", frame0_pc_sane ? "pc" : "lr");
+    _LOG(tfd, only_in_tombstone, "\ncode around pc:\n");
 
     end = p = pc & ~3;
-    p -= 16;
-    end += 16;
+    p -= 32;
+    end += 32;
 
     /* Dump the code around PC as:
      *  addr       contents
@@ -163,12 +155,12 @@
         _LOG(tfd, only_in_tombstone, "%s\n", code_buffer);
     }
 
-    if (frame0_pc_sane) {
+    if ((unsigned) r.ARM_lr != pc) {
         _LOG(tfd, only_in_tombstone, "\ncode around lr:\n");
 
         end = p = r.ARM_lr & ~3;
-        p -= 16;
-        end += 16;
+        p -= 32;
+        end += 32;
 
         /* Dump the code around LR as:
          *  addr       contents
@@ -286,7 +278,7 @@
          " ip %08x  sp %08x  lr %08x  pc %08x  cpsr %08x\n",
          r.ARM_ip, r.ARM_sp, r.ARM_lr, r.ARM_pc, r.ARM_cpsr);
 
-#if __VFP_FP__
+#if __ARM_NEON__
     struct user_vfp vfp_regs;
     int i;
 
@@ -435,8 +427,7 @@
         dump_pc_and_lr(tfd, tid, milist, stack_depth, at_fault);
     }
 
-    dump_stack_and_code(tfd, tid, milist, stack_depth, sp_list, frame0_pc_sane,
-                        at_fault);
+    dump_stack_and_code(tfd, tid, milist, stack_depth, sp_list, at_fault);
 
     while(milist) {
         mapinfo *next = milist->next;
diff --git a/fastboot/fastboot.c b/fastboot/fastboot.c
index ca0c9ce..aedfce1 100644
--- a/fastboot/fastboot.c
+++ b/fastboot/fastboot.c
@@ -151,6 +151,8 @@
        (info->dev_vendor != 0x0451) &&
        (info->dev_vendor != 0x0502) &&
        (info->dev_vendor != 0x22b8) &&  // Motorola
+       (info->dev_vendor != 0x0955) &&  // Nvidia
+       (info->dev_vendor != 0x413c) &&  // DELL
        (info->dev_vendor != 0x0bb4))    // HTC
             return -1;
     if(info->ifc_class != 0xff) return -1;
diff --git a/include/android/bitmap.h b/include/android/bitmap.h
deleted file mode 100644
index 5078277..0000000
--- a/include/android/bitmap.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright (C) 2009 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_BITMAP_H
-#define ANDROID_BITMAP_H
-
-#include <stdint.h>
-#include <jni.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#define ANDROID_BITMAP_RESUT_SUCCESS            0
-#define ANDROID_BITMAP_RESULT_BAD_PARAMETER     -1
-#define ANDROID_BITMAP_RESULT_JNI_EXCEPTION     -2
-#define ANDROID_BITMAP_RESULT_ALLOCATION_FAILED -3
-
-enum AndroidBitmapFormat {
-    ANDROID_BITMAP_FORMAT_NONE      = 0,
-    ANDROID_BITMAP_FORMAT_RGBA_8888 = 1,
-    ANDROID_BITMAP_FORMAT_RGB_565   = 4,
-    ANDROID_BITMAP_FORMAT_RGBA_4444 = 7,
-    ANDROID_BITMAP_FORMAT_A_8       = 8,
-};
-
-typedef struct {
-    uint32_t    width;
-    uint32_t    height;
-    uint32_t    stride;
-    int32_t     format;
-    uint32_t    flags;      // 0 for now
-} AndroidBitmapInfo;
-
-/**
- * Given a java bitmap object, fill out the AndroidBitmap struct for it.
- * If the call fails, the info parameter will be ignored
- */
-int AndroidBitmap_getInfo(JNIEnv* env, jobject jbitmap,
-                          AndroidBitmapInfo* info);
-
-/**
- * Given a java bitmap object, attempt to lock the pixel address.
- * Locking will ensure that the memory for the pixels will not move
- * until the unlockPixels call, and ensure that, if the pixels had been
- * previously purged, they will have been restored.
- *
- * If this call succeeds, it must be balanced by a call to
- * AndroidBitmap_unlockPixels, after which time the address of the pixels should
- * no longer be used.
- *
- * If this succeeds, *addrPtr will be set to the pixel address. If the call
- * fails, addrPtr will be ignored.
- */
-int AndroidBitmap_lockPixels(JNIEnv* env, jobject jbitmap, void** addrPtr);
-
-/**
- * Call this to balanace a successful call to AndroidBitmap_lockPixels
- */
-int AndroidBitmap_unlockPixels(JNIEnv* env, jobject jbitmap);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/include/arch/darwin-x86/AndroidConfig.h b/include/arch/darwin-x86/AndroidConfig.h
index 20e0000..3aa0cd1 100644
--- a/include/arch/darwin-x86/AndroidConfig.h
+++ b/include/arch/darwin-x86/AndroidConfig.h
@@ -146,7 +146,7 @@
  */
 #if (defined(__ppc__) || defined(__ppc64__))
 #   define HAVE_BIG_ENDIAN
-#elif defined(__i386__)
+#elif (defined(__i386__) || defined(__x86_64__))
 #   define HAVE_LITTLE_ENDIAN
 #endif
 
@@ -219,7 +219,7 @@
  */
 #if (defined(__ppc__) || defined(__ppc64__))
 #   define ARCH_PPC
-#elif defined(__i386__)
+#elif (defined(__i386__) || defined(__x86_64__))
 #   define ARCH_X86
 #endif
 
@@ -256,6 +256,16 @@
 #define HAVE_STRLCPY 1
 
 /*
+ * Define if the open_memstream() function exists on the system.
+ */
+/* #define HAVE_OPEN_MEMSTREAM 1 */
+
+/*
+ * Define if the BSD funopen() function exists on the system.
+ */
+#define HAVE_FUNOPEN 1
+
+/*
  * Define if writev() exists
  */
 #define HAVE_WRITEV 1
diff --git a/include/arch/freebsd-x86/AndroidConfig.h b/include/arch/freebsd-x86/AndroidConfig.h
index b01a854..57d5024 100644
--- a/include/arch/freebsd-x86/AndroidConfig.h
+++ b/include/arch/freebsd-x86/AndroidConfig.h
@@ -295,6 +295,16 @@
 #define HAVE_STRLCPY 1
 
 /*
+ * Define if the open_memstream() function exists on the system.
+ */
+/* #define HAVE_OPEN_MEMSTREAM 1 */
+
+/*
+ * Define if the BSD funopen() function exists on the system.
+ */
+#define HAVE_FUNOPEN 1
+
+/*
  * Define if prctl() exists
  */
 /* #define HAVE_PRCTL 1 */
diff --git a/include/arch/linux-arm/AndroidConfig.h b/include/arch/linux-arm/AndroidConfig.h
index 26547a2..f51ddb1 100644
--- a/include/arch/linux-arm/AndroidConfig.h
+++ b/include/arch/linux-arm/AndroidConfig.h
@@ -298,6 +298,16 @@
 #define HAVE_STRLCPY 1
 
 /*
+ * Define if the open_memstream() function exists on the system.
+ */
+/* #define HAVE_OPEN_MEMSTREAM 1 */
+
+/*
+ * Define if the BSD funopen() function exists on the system.
+ */
+#define HAVE_FUNOPEN 1
+
+/*
  * Define if prctl() exists
  */
 #define HAVE_PRCTL 1
diff --git a/include/arch/linux-sh/AndroidConfig.h b/include/arch/linux-sh/AndroidConfig.h
index 67ac277..5e93990 100644
--- a/include/arch/linux-sh/AndroidConfig.h
+++ b/include/arch/linux-sh/AndroidConfig.h
@@ -303,6 +303,16 @@
 #define HAVE_STRLCPY 1
 
 /*
+ * Define if the open_memstream() function exists on the system.
+ */
+/* #define HAVE_OPEN_MEMSTREAM 1 */
+
+/*
+ * Define if the BSD funopen() function exists on the system.
+ */
+#define HAVE_FUNOPEN 1
+
+/*
  * Define if prctl() exists
  */
 #define HAVE_PRCTL 1
diff --git a/include/arch/linux-x86/AndroidConfig.h b/include/arch/linux-x86/AndroidConfig.h
index 31bdb5f..b0fe90a 100644
--- a/include/arch/linux-x86/AndroidConfig.h
+++ b/include/arch/linux-x86/AndroidConfig.h
@@ -279,6 +279,16 @@
 /* #define HAVE_STRLCPY 1 */
 
 /*
+ * Define if the open_memstream() function exists on the system.
+ */
+#define HAVE_OPEN_MEMSTREAM 1
+
+/*
+ * Define if the BSD funopen() function exists on the system.
+ */
+/* #define HAVE_FUNOPEN 1 */
+
+/*
  * Define if prctl() exists
  */
 #define HAVE_PRCTL 1
diff --git a/include/arch/target_linux-x86/AndroidConfig.h b/include/arch/target_linux-x86/AndroidConfig.h
index d89d054..4db3e72 100644
--- a/include/arch/target_linux-x86/AndroidConfig.h
+++ b/include/arch/target_linux-x86/AndroidConfig.h
@@ -289,6 +289,16 @@
 #define HAVE_STRLCPY 1
 
 /*
+ * Define if the open_memstream() function exists on the system.
+ */
+/* #define HAVE_OPEN_MEMSTREAM 1 */
+
+/*
+ * Define if the BSD funopen() function exists on the system.
+ */
+#define HAVE_FUNOPEN 1
+
+/*
  * Define if prctl() exists
  */
 #define HAVE_PRCTL 1
diff --git a/include/arch/windows/AndroidConfig.h b/include/arch/windows/AndroidConfig.h
index 0fc4955..1b6ece1 100644
--- a/include/arch/windows/AndroidConfig.h
+++ b/include/arch/windows/AndroidConfig.h
@@ -272,6 +272,16 @@
 /* #define HAVE_STRLCPY 1 */
 
 /*
+ * Define if the open_memstream() function exists on the system.
+ */
+/* #define HAVE_OPEN_MEMSTREAM 1 */
+
+/*
+ * Define if the BSD funopen() function exists on the system.
+ */
+/* #define HAVE_FUNOPEN 1 */
+
+/*
  * Define if <winsock2.h> exists.
  * Only MinGW has it.
  */
diff --git a/include/cutils/open_memstream.h b/include/cutils/open_memstream.h
new file mode 100644
index 0000000..b7998be
--- /dev/null
+++ b/include/cutils/open_memstream.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CUTILS_OPEN_MEMSTREAM_H__
+#define __CUTILS_OPEN_MEMSTREAM_H__
+
+#include <stdio.h>
+
+#ifndef HAVE_OPEN_MEMSTREAM
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+FILE* open_memstream(char** bufp, size_t* sizep);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*!HAVE_OPEN_MEMSTREAM*/
+
+#endif /*__CUTILS_OPEN_MEMSTREAM_H__*/
diff --git a/init/devices.c b/init/devices.c
index 55c5ee4..bde906b 100644
--- a/init/devices.c
+++ b/init/devices.c
@@ -138,6 +138,7 @@
     { "/dev/msm_snd",       0660,   AID_SYSTEM,     AID_AUDIO,      1 },
     { "/dev/msm_mp3",       0660,   AID_SYSTEM,     AID_AUDIO,      1 },
     { "/dev/audience_a1026", 0660,   AID_SYSTEM,     AID_AUDIO,      1 },
+    { "/dev/tpa2018d1",     0660,   AID_SYSTEM,     AID_AUDIO,      1 },
     { "/dev/msm_audpre",    0660,   AID_SYSTEM,     AID_AUDIO,      0 },
     { "/dev/msm_audio_ctl", 0660,   AID_SYSTEM,     AID_AUDIO,      0 },
     { "/dev/htc-acoustic",  0660,   AID_SYSTEM,     AID_AUDIO,      0 },
@@ -306,8 +307,15 @@
 
     mode = get_device_perm(path, &uid, &gid) | (block ? S_IFBLK : S_IFCHR);
     dev = (major << 8) | minor;
+    /* Temporarily change egid to avoid race condition setting the gid of the
+     * device node. Unforunately changing the euid would prevent creation of
+     * some device nodes, so the uid has to be set with chown() and is still
+     * racy. Fixing the gid race at least fixed the issue with system_server
+     * opening dynamic input devices under the AID_INPUT gid. */
+    setegid(gid);
     mknod(path, mode, dev);
-    chown(path, uid, gid);
+    chown(path, uid, -1);
+    setegid(AID_ROOT);
 }
 
 #if LOG_UEVENTS
diff --git a/init/init.c b/init/init.c
index f76eb36..16a3530 100755
--- a/init/init.c
+++ b/init/init.c
@@ -767,21 +767,31 @@
 void handle_keychord(int fd)
 {
     struct service *svc;
+    char* debuggable;
+    char* adb_enabled;
     int ret;
     __u16 id;
 
-    ret = read(fd, &id, sizeof(id));
-    if (ret != sizeof(id)) {
-        ERROR("could not read keychord id\n");
-        return;
-    }
+    // only handle keychords if ro.debuggable is set or adb is enabled.
+    // the logic here is that bugreports should be enabled in userdebug or eng builds
+    // and on user builds for users that are developers.
+    debuggable = property_get("ro.debuggable");
+    adb_enabled = property_get("init.svc.adbd");
+    if ((debuggable && !strcmp(debuggable, "1")) ||
+        (adb_enabled && !strcmp(adb_enabled, "running"))) {
+        ret = read(fd, &id, sizeof(id));
+        if (ret != sizeof(id)) {
+            ERROR("could not read keychord id\n");
+            return;
+        }
 
-    svc = service_find_by_keychord(id);
-    if (svc) {
-        INFO("starting service %s from keychord\n", svc->name);
-        service_start(svc, NULL);
-    } else {
-        ERROR("service for keychord %d not found\n", id);
+        svc = service_find_by_keychord(id);
+        if (svc) {
+            INFO("starting service %s from keychord\n", svc->name);
+            service_start(svc, NULL);
+        } else {
+            ERROR("service for keychord %d not found\n", id);
+        }
     }
 }
 
@@ -853,10 +863,7 @@
     property_init();
     
     // only listen for keychords if ro.debuggable is true
-    debuggable = property_get("ro.debuggable");
-    if (debuggable && !strcmp(debuggable, "1")) {
-        keychord_fd = open_keychord();
-    }
+    keychord_fd = open_keychord();
 
     if (console[0]) {
         snprintf(tmp, sizeof(tmp), "/dev/%s", console);
diff --git a/libcutils/Android.mk b/libcutils/Android.mk
index b219473..93933e2 100644
--- a/libcutils/Android.mk
+++ b/libcutils/Android.mk
@@ -31,6 +31,7 @@
 	config_utils.c \
 	cpu_info.c \
 	load_file.c \
+	open_memstream.c \
 	strdup16to8.c \
 	strdup8to16.c \
 	record_stream.c \
diff --git a/libcutils/open_memstream.c b/libcutils/open_memstream.c
new file mode 100644
index 0000000..5b4388a
--- /dev/null
+++ b/libcutils/open_memstream.c
@@ -0,0 +1,381 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef HAVE_OPEN_MEMSTREAM
+
+/*
+ * Implementation of the POSIX open_memstream() function, which Linux has
+ * but BSD lacks.
+ *
+ * Summary:
+ * - Works like a file-backed FILE* opened with fopen(name, "w"), but the
+ *   backing is a chunk of memory rather than a file.
+ * - The buffer expands as you write more data.  Seeking past the end
+ *   of the file and then writing to it zero-fills the gap.
+ * - The values at "*bufp" and "*sizep" should be considered read-only,
+ *   and are only valid immediately after an fflush() or fclose().
+ * - A '\0' is maintained just past the end of the file. This is not included
+ *   in "*sizep".  (The behavior w.r.t. fseek() is not clearly defined.
+ *   The spec says the null byte is written when a write() advances EOF,
+ *   but it looks like glibc ensures the null byte is always found at EOF,
+ *   even if you just seeked backwards.  The example on the opengroup.org
+ *   page suggests that this is the expected behavior.  The null must be
+ *   present after a no-op fflush(), which we can't see, so we have to save
+ *   and restore it.  Annoying, but allows file truncation.)
+ * - After fclose(), the caller must eventually free(*bufp).
+ *
+ * This is built out of funopen(), which BSD has but Linux lacks.  There is
+ * no flush() operator, so we need to keep the user pointers up to date
+ * after each operation.
+ *
+ * I don't think Windows has any of the above, but we don't need to use
+ * them there, so we just supply a stub.
+ */
+#include <cutils/open_memstream.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <assert.h>
+
+#if 0
+# define DBUG(x) printf x
+#else
+# define DBUG(x) ((void)0)
+#endif
+
+#ifdef HAVE_FUNOPEN
+
+/*
+ * Definition of a seekable, write-only memory stream.
+ */
+typedef struct {
+    char**      bufp;       /* pointer to buffer pointer */
+    size_t*     sizep;      /* pointer to eof */
+
+    size_t      allocSize;  /* size of buffer */
+    size_t      eof;        /* furthest point we've written to */
+    size_t      offset;     /* current write offset */
+    char        saved;      /* required by NUL handling */
+} MemStream;
+
+#define kInitialSize    1024
+
+/*
+ * Ensure that we have enough storage to write "size" bytes at the
+ * current offset.  We also have to take into account the extra '\0'
+ * that we maintain just past EOF.
+ *
+ * Returns 0 on success.
+ */
+static int ensureCapacity(MemStream* stream, int writeSize)
+{
+    DBUG(("+++ ensureCap off=%d size=%d\n", stream->offset, writeSize));
+
+    size_t neededSize = stream->offset + writeSize + 1;
+    if (neededSize <= stream->allocSize)
+        return 0;
+
+    size_t newSize;
+
+    if (stream->allocSize == 0) {
+        newSize = kInitialSize;
+    } else {
+        newSize = stream->allocSize;
+        newSize += newSize / 2;             /* expand by 3/2 */
+    }
+
+    if (newSize < neededSize)
+        newSize = neededSize;
+    DBUG(("+++ realloc %p->%p to size=%d\n",
+        stream->bufp, *stream->bufp, newSize));
+    char* newBuf = (char*) realloc(*stream->bufp, newSize);
+    if (newBuf == NULL)
+        return -1;
+
+    *stream->bufp = newBuf;
+    stream->allocSize = newSize;
+    return 0;
+}
+
+/*
+ * Write data to a memstream, expanding the buffer if necessary.
+ *
+ * If we previously seeked beyond EOF, zero-fill the gap.
+ *
+ * Returns the number of bytes written.
+ */
+static int write_memstream(void* cookie, const char* buf, int size)
+{
+    MemStream* stream = (MemStream*) cookie;
+
+    if (ensureCapacity(stream, size) < 0)
+        return -1;
+
+    /* seeked past EOF earlier? */
+    if (stream->eof < stream->offset) {
+        DBUG(("+++ zero-fill gap from %d to %d\n",
+            stream->eof, stream->offset-1));
+        memset(*stream->bufp + stream->eof, '\0',
+            stream->offset - stream->eof);
+    }
+
+    /* copy data, advance write pointer */
+    memcpy(*stream->bufp + stream->offset, buf, size);
+    stream->offset += size;
+
+    if (stream->offset > stream->eof) {
+        /* EOF has advanced, update it and append null byte */
+        DBUG(("+++ EOF advanced to %d, appending nul\n", stream->offset));
+        assert(stream->offset < stream->allocSize);
+        stream->eof = stream->offset;
+    } else {
+        /* within previously-written area; save char we're about to stomp */
+        DBUG(("+++ within written area, saving '%c' at %d\n",
+            *(*stream->bufp + stream->offset), stream->offset));
+        stream->saved = *(*stream->bufp + stream->offset);
+    }
+    *(*stream->bufp + stream->offset) = '\0';
+    *stream->sizep = stream->offset;
+
+    return size;
+}
+
+/*
+ * Seek within a memstream.
+ *
+ * Returns the new offset, or -1 on failure.
+ */
+static fpos_t seek_memstream(void* cookie, fpos_t offset, int whence)
+{
+    MemStream* stream = (MemStream*) cookie;
+    off_t newPosn = (off_t) offset;
+
+    if (whence == SEEK_CUR) {
+        newPosn += stream->offset;
+    } else if (whence == SEEK_END) {
+        newPosn += stream->eof;
+    }
+
+    if (newPosn < 0 || ((fpos_t)((size_t) newPosn)) != newPosn) {
+        /* bad offset - negative or huge */
+        DBUG(("+++ bogus seek offset %ld\n", (long) newPosn));
+        errno = EINVAL;
+        return (fpos_t) -1;
+    }
+
+    if (stream->offset < stream->eof) {
+        /*
+         * We were pointing to an area we'd already written to, which means
+         * we stomped on a character and must now restore it.
+         */
+        DBUG(("+++ restoring char '%c' at %d\n",
+            stream->saved, stream->offset));
+        *(*stream->bufp + stream->offset) = stream->saved;
+    }
+
+    stream->offset = (size_t) newPosn;
+
+    if (stream->offset < stream->eof) {
+        /*
+         * We're seeked backward into the stream.  Preserve the character
+         * at EOF and stomp it with a NUL.
+         */
+        stream->saved = *(*stream->bufp + stream->offset);
+        *(*stream->bufp + stream->offset) = '\0';
+        *stream->sizep = stream->offset;
+    } else {
+        /*
+         * We're positioned at, or possibly beyond, the EOF.  We want to
+         * publish the current EOF, not the current position.
+         */
+        *stream->sizep = stream->eof;
+    }
+
+    return newPosn;
+}
+
+/*
+ * Close the memstream.  We free everything but the data buffer.
+ */
+static int close_memstream(void* cookie)
+{
+    free(cookie);
+    return 0;
+}
+
+/*
+ * Prepare a memstream.
+ */
+FILE* open_memstream(char** bufp, size_t* sizep)
+{
+    FILE* fp;
+    MemStream* stream;
+
+    if (bufp == NULL || sizep == NULL) {
+        errno = EINVAL;
+        return NULL;
+    }
+
+    stream = (MemStream*) calloc(1, sizeof(MemStream));
+    if (stream == NULL)
+        return NULL;
+
+    fp = funopen(stream,
+        NULL, write_memstream, seek_memstream, close_memstream);
+    if (fp == NULL) {
+        free(stream);
+        return NULL;
+    }
+
+    *sizep = 0;
+    *bufp = NULL;
+    stream->bufp = bufp;
+    stream->sizep = sizep;
+
+    return fp;
+}
+
+#else /*not HAVE_FUNOPEN*/
+FILE* open_memstream(char** bufp, size_t* sizep)
+{
+    abort();
+}
+#endif /*HAVE_FUNOPEN*/
+
+
+
+#if 0
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * Simple regression test.
+ *
+ * To test on desktop Linux with valgrind, it's possible to make a simple
+ * change to open_memstream() to use fopencookie instead:
+ *
+ *  cookie_io_functions_t iofuncs =
+ *      { NULL, write_memstream, seek_memstream, close_memstream };
+ *  fp = fopencookie(stream, "w", iofuncs);
+ *
+ * (Some tweaks to seek_memstream are also required, as that takes a
+ * pointer to an offset rather than an offset, and returns 0 or -1.)
+ */
+int testMemStream(void)
+{
+    FILE *stream;
+    char *buf;
+    size_t len;
+    off_t eob;
+
+    printf("Test1\n");
+
+    /* std example */
+    stream = open_memstream(&buf, &len);
+    fprintf(stream, "hello my world");
+    fflush(stream);
+    printf("buf=%s, len=%zu\n", buf, len);
+    eob = ftello(stream);
+    fseeko(stream, 0, SEEK_SET);
+    fprintf(stream, "good-bye");
+    fseeko(stream, eob, SEEK_SET);
+    fclose(stream);
+    printf("buf=%s, len=%zu\n", buf, len);
+    free(buf);
+
+    printf("Test2\n");
+
+    /* std example without final seek-to-end */
+    stream = open_memstream(&buf, &len);
+    fprintf(stream, "hello my world");
+    fflush(stream);
+    printf("buf=%s, len=%zu\n", buf, len);
+    eob = ftello(stream);
+    fseeko(stream, 0, SEEK_SET);
+    fprintf(stream, "good-bye");
+    //fseeko(stream, eob, SEEK_SET);
+    fclose(stream);
+    printf("buf=%s, len=%zu\n", buf, len);
+    free(buf);
+
+    printf("Test3\n");
+
+    /* fancy example; should expand buffer with writes */
+    static const int kCmpLen = 1024 + 128;
+    char* cmp = malloc(kCmpLen);
+    memset(cmp, 0, 1024);
+    memset(cmp+1024, 0xff, kCmpLen-1024);
+    sprintf(cmp, "This-is-a-tes1234");
+    sprintf(cmp + 1022, "abcdef");
+
+    stream = open_memstream (&buf, &len);
+    setvbuf(stream, NULL, _IONBF, 0);   /* note: crashes in glibc with this */
+    fprintf(stream, "This-is-a-test");
+    fseek(stream, -1, SEEK_CUR);    /* broken in glibc; can use {13,SEEK_SET} */
+    fprintf(stream, "1234");
+    fseek(stream, 1022, SEEK_SET);
+    fputc('a', stream);
+    fputc('b', stream);
+    fputc('c', stream);
+    fputc('d', stream);
+    fputc('e', stream);
+    fputc('f', stream);
+    fflush(stream);
+
+    if (memcmp(buf, cmp, len+1) != 0) {
+        printf("mismatch\n");
+    } else {
+        printf("match\n");
+    }
+
+    printf("Test4\n");
+    stream = open_memstream (&buf, &len);
+    fseek(stream, 5000, SEEK_SET);
+    fseek(stream, 4096, SEEK_SET);
+    fseek(stream, -1, SEEK_SET);        /* should have no effect */
+    fputc('x', stream);
+    if (ftell(stream) == 4097)
+        printf("good\n");
+    else
+        printf("BAD: offset is %ld\n", ftell(stream));
+
+    printf("DONE\n");
+
+    return 0;
+}
+
+/* expected output:
+Test1
+buf=hello my world, len=14
+buf=good-bye world, len=14
+Test2
+buf=hello my world, len=14
+buf=good-bye, len=8
+Test3
+match
+Test4
+good
+DONE
+*/
+
+#endif
+
+#endif /*!HAVE_OPEN_MEMSTREAM*/
diff --git a/libjnigraphics/Android.mk b/libjnigraphics/Android.mk
deleted file mode 100644
index 9458f28..0000000
--- a/libjnigraphics/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-BASE_PATH := $(call my-dir)
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_PRELINK_MODULE := false
-
-# setup for skia optimizations
-#
-ifneq ($(ARCH_ARM_HAVE_VFP),true)
-	LOCAL_CFLAGS += -DSK_SOFTWARE_FLOAT
-endif
-
-ifeq ($(ARCH_ARM_HAVE_NEON),true)
-	LOCAL_CFLAGS += -D__ARM_HAVE_NEON
-endif
-
-# our source files
-#
-LOCAL_SRC_FILES:= \
-	bitmap.cpp
-
-LOCAL_SHARED_LIBRARIES := \
-    libandroid_runtime \
-    libskia
-
-LOCAL_C_INCLUDES += \
-	external/skia/include/core \
-	frameworks/base/core/jni/android/graphics \
-    dalvik/libnativehelper/include/nativehelper
-
-LOCAL_MODULE:= libjnigraphics
-
-include $(BUILD_SHARED_LIBRARY)
-
diff --git a/libjnigraphics/bitmap.cpp b/libjnigraphics/bitmap.cpp
deleted file mode 100644
index fd73430..0000000
--- a/libjnigraphics/bitmap.cpp
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (C) 2009 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <android/bitmap.h>
-#include <GraphicsJNI.h>
-
-int AndroidBitmap_getInfo(JNIEnv* env, jobject jbitmap,
-                          AndroidBitmapInfo* info) {
-    if (NULL == env || NULL == jbitmap) {
-        return ANDROID_BITMAP_RESULT_BAD_PARAMETER;
-    }
-
-    SkBitmap* bm = GraphicsJNI::getNativeBitmap(env, jbitmap);
-    if (NULL == bm) {
-        return ANDROID_BITMAP_RESULT_JNI_EXCEPTION;
-    }
-
-    if (info) {
-        info->width     = bm->width();
-        info->height    = bm->height();
-        info->stride    = bm->rowBytes();
-        info->flags     = 0;
-
-        switch (bm->config()) {
-            case SkBitmap::kARGB_8888_Config:
-                info->format = ANDROID_BITMAP_FORMAT_RGBA_8888;
-                break;
-            case SkBitmap::kRGB_565_Config:
-                info->format = ANDROID_BITMAP_FORMAT_RGB_565;
-                break;
-            case SkBitmap::kARGB_4444_Config:
-                info->format = ANDROID_BITMAP_FORMAT_RGBA_4444;
-                break;
-            case SkBitmap::kA8_Config:
-                info->format = ANDROID_BITMAP_FORMAT_A_8;
-                break;
-            default:
-                info->format = ANDROID_BITMAP_FORMAT_NONE;
-                break;
-        }
-    }
-    return ANDROID_BITMAP_RESUT_SUCCESS;
-}
-
-int AndroidBitmap_lockPixels(JNIEnv* env, jobject jbitmap, void** addrPtr) {
-    if (NULL == env || NULL == jbitmap) {
-        return ANDROID_BITMAP_RESULT_BAD_PARAMETER;
-    }
-
-    SkBitmap* bm = GraphicsJNI::getNativeBitmap(env, jbitmap);
-    if (NULL == bm) {
-        return ANDROID_BITMAP_RESULT_JNI_EXCEPTION;
-    }
-
-    bm->lockPixels();
-    void* addr = bm->getPixels();
-    if (NULL == addr) {
-        bm->unlockPixels();
-        return ANDROID_BITMAP_RESULT_ALLOCATION_FAILED;
-    }
-
-    if (addrPtr) {
-        *addrPtr = addr;
-    }
-    return ANDROID_BITMAP_RESUT_SUCCESS;
-}
-
-int AndroidBitmap_unlockPixels(JNIEnv* env, jobject jbitmap) {
-    if (NULL == env || NULL == jbitmap) {
-        return ANDROID_BITMAP_RESULT_BAD_PARAMETER;
-    }
-
-    SkBitmap* bm = GraphicsJNI::getNativeBitmap(env, jbitmap);
-    if (NULL == bm) {
-        return ANDROID_BITMAP_RESULT_JNI_EXCEPTION;
-    }
-
-    bm->unlockPixels();
-    return ANDROID_BITMAP_RESUT_SUCCESS;
-}
-
diff --git a/libmincrypt/tools/DumpPublicKey.java b/libmincrypt/tools/DumpPublicKey.java
index c9e7e4d..d2935e0 100644
--- a/libmincrypt/tools/DumpPublicKey.java
+++ b/libmincrypt/tools/DumpPublicKey.java
@@ -77,7 +77,7 @@
         // Write out modulus as little endian array of integers.
         result.append(",{");
         for (int i = 0; i < nwords; ++i) {
-            int n = N.mod(B).intValue();
+            long n = N.mod(B).longValue();
             result.append(n);
 
             if (i != nwords - 1) {
@@ -91,7 +91,7 @@
         // Write R^2 as little endian array of integers.
         result.append(",{");
         for (int i = 0; i < nwords; ++i) {
-            int rr = RR.mod(B).intValue();
+            long rr = RR.mod(B).longValue();
             result.append(rr);
 
             if (i != nwords - 1) {
diff --git a/logcat/event.logtags b/logcat/event.logtags
index 3e68efb..2459604 100644
--- a/logcat/event.logtags
+++ b/logcat/event.logtags
@@ -208,6 +208,9 @@
 # CDMA data network drop
 50111 cdma_data_drop (cid|1|5), (network_type|1|5)
 
+# GSM radio access technology switched
+50112 gsm_rat_switched (cid|1|5), (network_from|1|5), (network_to|1|5)
+
 # Do not change these names without updating tag in:
 #//device/dalvik/libcore/luni/src/main/native/org_apache_harmony_luni_platform_OSNetworkSystem.c
 51000 socket_stats (send|1|2),(recv|1|2),(ip|1|5),(port|1|5),(close|1|5)
diff --git a/rootdir/init.rc b/rootdir/init.rc
index c39af6c..3430261 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -19,14 +19,12 @@
     symlink /system/etc /etc
     symlink /sys/kernel/debug /d
 
-# create mountpoints and mount tmpfs on sqlite_stmt_journals
+# create mountpoints
     mkdir /sdcard 0000 system system
     mkdir /system
     mkdir /data 0771 system system
     mkdir /cache 0770 system cache
     mkdir /config 0500 root root
-    mkdir /sqlite_stmt_journals 01777 root root
-    mount tmpfs tmpfs /sqlite_stmt_journals size=4m
 
 # create Android Secure External Cache mount tree
     mkdir /asec  0700 system system
@@ -45,7 +43,7 @@
 # Create cgroup mount points for process groups
     mkdir /dev/cpuctl
     mount cgroup none /dev/cpuctl cpu
-    chown sytem system /dev/cpuctl
+    chown system system /dev/cpuctl
     chown system system /dev/cpuctl/tasks
     chmod 0777 /dev/cpuctl/tasks
     write /dev/cpuctl/cpu.shares 1024
@@ -267,6 +265,9 @@
 service vold /system/bin/vold
     socket vold stream 0660 root mount
 
+service netd /system/bin/netd
+    socket netd stream 0660 root system
+
 service nexus /system/bin/nexus
     socket nexus stream 0660 root system
     disabled
diff --git a/sh/miscbltin.c b/sh/miscbltin.c
index 1a8e252..d89029a 100644
--- a/sh/miscbltin.c
+++ b/sh/miscbltin.c
@@ -277,8 +277,6 @@
 	return 0;
 }
 
-typedef unsigned long rlim_t;
-
 #if 1
 /*
  * ulimit builtin
diff --git a/toolbox/newfs_msdos.c b/toolbox/newfs_msdos.c
index 49042c4..8e611c6 100644
--- a/toolbox/newfs_msdos.c
+++ b/toolbox/newfs_msdos.c
@@ -235,35 +235,6 @@
 static void usage(void);
 
 #ifdef ANDROID
-static void err(int val, const char *fmt, ...) {
-    va_list ap;
-    va_start(ap, fmt);
-    char *fmt2;
-    asprintf(&fmt2, "%s\n", fmt);
-    vfprintf(stderr, fmt2, ap);
-    free(fmt2);
-    va_end(ap);
-}
-
-static void errx(int val, const char *fmt, ...) {
-    va_list ap;
-    va_start(ap, fmt);
-    char *fmt2;
-    asprintf(&fmt2, "%s\n", fmt);
-    vfprintf(stderr, fmt2, ap);
-    free(fmt2);
-    va_end(ap);
-}
-
-static void warnx(const char *fmt, ...) {
-    va_list ap;
-    va_start(ap, fmt);
-    char *fmt2;
-    asprintf(&fmt2, "%s\n", fmt);
-    vfprintf(stderr, fmt2, ap);
-    free(fmt2);
-    va_end(ap);
-}
 #define powerof2(x)     ((((x) - 1) & (x)) == 0)
 #define howmany(x, y)   (((x) + ((y) - 1)) / (y))
 #define MAX(x,y) ((x) > (y) ? (x) : (y))