diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 36bc9f6..48be7d8 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -1297,6 +1297,7 @@
             <intent-filter>
                 <action android:name="android.bluetooth.device.action.PAIRING_REQUEST" />
                 <action android:name="android.bluetooth.device.action.PAIRING_CANCEL" />
+                <action android:name="android.bluetooth.device.action.BOND_STATE_CHANGED" />
             </intent-filter>
         </receiver>
 
diff --git a/src/com/android/settings/DevelopmentSettings.java b/src/com/android/settings/DevelopmentSettings.java
index f3a22ca..d971bd2 100644
--- a/src/com/android/settings/DevelopmentSettings.java
+++ b/src/com/android/settings/DevelopmentSettings.java
@@ -94,7 +94,7 @@
     private static final String KEEP_SCREEN_ON = "keep_screen_on";
     private static final String BT_HCI_SNOOP_LOG = "bt_hci_snoop_log";
     private static final String SELECT_RUNTIME_KEY = "select_runtime";
-    private static final String SELECT_RUNTIME_PROPERTY = "persist.sys.dalvik.vm.lib";
+    private static final String SELECT_RUNTIME_PROPERTY = "persist.sys.dalvik.vm.lib.1";
     private static final String ALLOW_MOCK_LOCATION = "allow_mock_location";
     private static final String HDCP_CHECKING_KEY = "hdcp_checking";
     private static final String HDCP_CHECKING_PROPERTY = "persist.sys.hdcp_checking";
diff --git a/src/com/android/settings/applications/InstalledAppDetails.java b/src/com/android/settings/applications/InstalledAppDetails.java
old mode 100644
new mode 100755
index 1b3938c..6729ea9
--- a/src/com/android/settings/applications/InstalledAppDetails.java
+++ b/src/com/android/settings/applications/InstalledAppDetails.java
@@ -576,6 +576,12 @@
     }
 
     @Override
+    public void onDestroyView() {
+        super.onDestroyView();
+        mSession.release();
+    }
+
+    @Override
     public void onAllSizesComputed() {
     }
 
diff --git a/src/com/android/settings/applications/ManageApplications.java b/src/com/android/settings/applications/ManageApplications.java
index 0a1dcb1..8b4be01 100644
--- a/src/com/android/settings/applications/ManageApplications.java
+++ b/src/com/android/settings/applications/ManageApplications.java
@@ -321,6 +321,12 @@
             }
         }
 
+        public void release() {
+            if (mApplications != null) {
+                mApplications.release();
+            }
+        }
+
         void updateStorageUsage() {
             // Make sure a callback didn't come at an inopportune time.
             if (mOwner.getActivity() == null) return;
@@ -593,6 +599,10 @@
             }
         }
 
+        public void release() {
+            mSession.release();
+        }
+
         public void rebuild(int sort) {
             if (sort == mLastSortMode) {
                 return;
@@ -990,6 +1000,7 @@
         // are no longer attached to their view hierarchy.
         for (int i=0; i<mTabs.size(); i++) {
             mTabs.get(i).detachView();
+            mTabs.get(i).release();
         }
     }
 
diff --git a/src/com/android/settings/bluetooth/BluetoothPairingDialog.java b/src/com/android/settings/bluetooth/BluetoothPairingDialog.java
index 9b2a3e8..d6f27ef 100755
--- a/src/com/android/settings/bluetooth/BluetoothPairingDialog.java
+++ b/src/com/android/settings/bluetooth/BluetoothPairingDialog.java
@@ -207,8 +207,8 @@
                 return null;
         }
 
-        // Format the message string, then parse HTML style tags
-        String messageText = getString(messageId1, deviceName);
+        // HTML escape deviceName, Format the message string, then parse HTML style tags
+        String messageText = getString(messageId1, Html.escapeHtml(deviceName));
         messageView.setText(Html.fromHtml(messageText));
         messageView2.setText(messageId2);
         mPairingView.setInputType(InputType.TYPE_CLASS_NUMBER);
@@ -220,7 +220,8 @@
 
     private View createView(CachedBluetoothDeviceManager deviceManager) {
         View view = getLayoutInflater().inflate(R.layout.bluetooth_pin_confirm, null);
-        String name = deviceManager.getName(mDevice);
+	// Escape device name to avoid HTML injection.
+        String name = Html.escapeHtml(deviceManager.getName(mDevice));
         TextView messageView = (TextView) view.findViewById(R.id.message);
 
         String messageText; // formatted string containing HTML style tags
diff --git a/src/com/android/settings/bluetooth/BluetoothPairingRequest.java b/src/com/android/settings/bluetooth/BluetoothPairingRequest.java
index 838e7b1..ea36fee 100644
--- a/src/com/android/settings/bluetooth/BluetoothPairingRequest.java
+++ b/src/com/android/settings/bluetooth/BluetoothPairingRequest.java
@@ -103,6 +103,19 @@
             NotificationManager manager = (NotificationManager) context
                     .getSystemService(Context.NOTIFICATION_SERVICE);
             manager.cancel(NOTIFICATION_ID);
+
+        } else if (BluetoothDevice.ACTION_BOND_STATE_CHANGED.equals(action)) {
+            int bondState = intent.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE,
+                    BluetoothDevice.ERROR);
+            int oldState = intent.getIntExtra(BluetoothDevice.EXTRA_PREVIOUS_BOND_STATE,
+                    BluetoothDevice.ERROR);
+            if((oldState == BluetoothDevice.BOND_BONDING) &&
+                    (bondState == BluetoothDevice.BOND_NONE)) {
+                // Remove the notification
+                NotificationManager manager = (NotificationManager) context
+                    .getSystemService(Context.NOTIFICATION_SERVICE);
+                manager.cancel(NOTIFICATION_ID);
+            }
         }
     }
 }
diff --git a/src/com/android/settings/deviceinfo/StorageVolumePreferenceCategory.java b/src/com/android/settings/deviceinfo/StorageVolumePreferenceCategory.java
index 29b1e92..d1ea094 100644
--- a/src/com/android/settings/deviceinfo/StorageVolumePreferenceCategory.java
+++ b/src/com/android/settings/deviceinfo/StorageVolumePreferenceCategory.java
@@ -252,6 +252,9 @@
             mMountTogglePreference.setEnabled(true);
             mMountTogglePreference.setTitle(mResources.getString(R.string.sd_eject));
             mMountTogglePreference.setSummary(mResources.getString(R.string.sd_eject_summary));
+            addPreference(mUsageBarPreference);
+            addPreference(mItemTotal);
+            addPreference(mItemAvailable);
         } else {
             if (Environment.MEDIA_UNMOUNTED.equals(state) || Environment.MEDIA_NOFS.equals(state)
                     || Environment.MEDIA_UNMOUNTABLE.equals(state)) {