diff --git a/include/private/android_filesystem_config.h b/include/private/android_filesystem_config.h
index 9c35aa4..4d19f17 100644
--- a/include/private/android_filesystem_config.h
+++ b/include/private/android_filesystem_config.h
@@ -55,7 +55,10 @@
 #define AID_DRM           1019  /* DRM server */
 #define AID_DRMIO         1020  /* DRM IO server */
 #define AID_GPS           1021  /* GPS daemon */
-#define AID_NFC           1022  /* nfc subsystem */
+#define AID_UNUSED1       1022  /* deprecated, DO NOT USE */
+#define AID_RFU1          1023  /* RFU */
+#define AID_RFU2          1024  /* RFU */
+#define AID_NFC           1025  /* nfc subsystem */
 
 #define AID_SHELL         2000  /* adb and debug shell user */
 #define AID_CACHE         2001  /* cache access */
diff --git a/libnetutils/dhcp_utils.c b/libnetutils/dhcp_utils.c
index cb0960f..064eb0c 100644
--- a/libnetutils/dhcp_utils.c
+++ b/libnetutils/dhcp_utils.c
@@ -28,6 +28,7 @@
 static const char DAEMON_PROP_NAME[]   = "init.svc.dhcpcd";
 static const char HOSTNAME_PROP_NAME[] = "net.hostname";
 static const char DHCP_PROP_NAME_PREFIX[]  = "dhcp";
+static const char DAEMON_NAME_RENEW[]  = "iprenew";
 static const int  NAP_TIME = 1;   /* wait for 1 second at a time */
                                   /* when polling for property values */
 static char errmsg[100];
@@ -137,6 +138,7 @@
                     uint32_t  *lease)
 {
     char result_prop_name[PROPERTY_KEY_MAX];
+    char daemon_prop_name[PROPERTY_KEY_MAX];
     char prop_value[PROPERTY_VALUE_MAX] = {'\0'};
     char daemon_cmd[PROPERTY_VALUE_MAX * 2];
     const char *ctrl_prop = "ctl.start";
@@ -145,18 +147,23 @@
     snprintf(result_prop_name, sizeof(result_prop_name), "%s.%s.result",
             DHCP_PROP_NAME_PREFIX,
             interface);
+
+    snprintf(daemon_prop_name, sizeof(daemon_prop_name), "%s_%s",
+            DAEMON_PROP_NAME,
+            interface);
+
     /* Erase any previous setting of the dhcp result property */
     property_set(result_prop_name, "");
 
     /* Start the daemon and wait until it's ready */
     if (property_get(HOSTNAME_PROP_NAME, prop_value, NULL) && (prop_value[0] != '\0'))
-        snprintf(daemon_cmd, sizeof(daemon_cmd), "%s:-h %s %s", DAEMON_NAME,
+        snprintf(daemon_cmd, sizeof(daemon_cmd), "%s_%s:-h %s %s", DAEMON_NAME, interface,
                  prop_value, interface);
     else
-        snprintf(daemon_cmd, sizeof(daemon_cmd), "%s:%s", DAEMON_NAME, interface);
+        snprintf(daemon_cmd, sizeof(daemon_cmd), "%s_%s:%s", DAEMON_NAME, interface, interface);
     memset(prop_value, '\0', PROPERTY_VALUE_MAX);
     property_set(ctrl_prop, daemon_cmd);
-    if (wait_for_property(DAEMON_PROP_NAME, desired_status, 10) < 0) {
+    if (wait_for_property(daemon_prop_name, desired_status, 10) < 0) {
         snprintf(errmsg, sizeof(errmsg), "%s", "Timed out waiting for dhcpcd to start");
         return -1;
     }
@@ -193,15 +200,24 @@
 int dhcp_stop(const char *interface)
 {
     char result_prop_name[PROPERTY_KEY_MAX];
+    char daemon_prop_name[PROPERTY_KEY_MAX];
+    char daemon_cmd[PROPERTY_VALUE_MAX * 2];
     const char *ctrl_prop = "ctl.stop";
     const char *desired_status = "stopped";
 
     snprintf(result_prop_name, sizeof(result_prop_name), "%s.%s.result",
             DHCP_PROP_NAME_PREFIX,
             interface);
+
+    snprintf(daemon_prop_name, sizeof(daemon_prop_name), "%s_%s",
+            DAEMON_PROP_NAME,
+            interface);
+
+    snprintf(daemon_cmd, sizeof(daemon_cmd), "%s_%s", DAEMON_NAME, interface);
+
     /* Stop the daemon and wait until it's reported to be stopped */
-    property_set(ctrl_prop, DAEMON_NAME);
-    if (wait_for_property(DAEMON_PROP_NAME, desired_status, 5) < 0) {
+    property_set(ctrl_prop, daemon_cmd);
+    if (wait_for_property(daemon_prop_name, desired_status, 5) < 0) {
         return -1;
     }
     property_set(result_prop_name, "failed");
@@ -213,12 +229,20 @@
  */
 int dhcp_release_lease(const char *interface)
 {
+    char daemon_prop_name[PROPERTY_KEY_MAX];
+    char daemon_cmd[PROPERTY_VALUE_MAX * 2];
     const char *ctrl_prop = "ctl.stop";
     const char *desired_status = "stopped";
 
+    snprintf(daemon_prop_name, sizeof(daemon_prop_name), "%s_%s",
+            DAEMON_PROP_NAME,
+            interface);
+
+    snprintf(daemon_cmd, sizeof(daemon_cmd), "%s_%s", DAEMON_NAME, interface);
+
     /* Stop the daemon and wait until it's reported to be stopped */
-    property_set(ctrl_prop, DAEMON_NAME);
-    if (wait_for_property(DAEMON_PROP_NAME, desired_status, 5) < 0) {
+    property_set(ctrl_prop, daemon_cmd);
+    if (wait_for_property(daemon_prop_name, desired_status, 5) < 0) {
         return -1;
     }
     return 0;
@@ -227,3 +251,53 @@
 char *dhcp_get_errmsg() {
     return errmsg;
 }
+
+/**
+ * Run WiMAX dhcp renew service.
+ * "wimax_renew" service shoud be included in init.rc.
+ */
+int dhcp_do_request_renew(const char *interface,
+                    in_addr_t *ipaddr,
+                    in_addr_t *gateway,
+                    in_addr_t *mask,
+                    in_addr_t *dns1,
+                    in_addr_t *dns2,
+                    in_addr_t *server,
+                    uint32_t  *lease)
+{
+    char result_prop_name[PROPERTY_KEY_MAX];
+    char prop_value[PROPERTY_VALUE_MAX] = {'\0'};
+    char daemon_cmd[PROPERTY_VALUE_MAX * 2];
+    const char *ctrl_prop = "ctl.start";
+
+    snprintf(result_prop_name, sizeof(result_prop_name), "%s.%s.result",
+            DHCP_PROP_NAME_PREFIX,
+            interface);
+
+    /* Erase any previous setting of the dhcp result property */
+    property_set(result_prop_name, "");
+
+    /* Start the renew daemon and wait until it's ready */
+    snprintf(daemon_cmd, sizeof(daemon_cmd), "%s_%s:%s", DAEMON_NAME_RENEW, interface, interface);
+    memset(prop_value, '\0', PROPERTY_VALUE_MAX);
+    property_set(ctrl_prop, daemon_cmd);
+
+    /* Wait for the daemon to return a result */
+    if (wait_for_property(result_prop_name, NULL, 30) < 0) {
+        snprintf(errmsg, sizeof(errmsg), "%s", "Timed out waiting for DHCP Renew to finish");
+        return -1;
+    }
+
+    if (!property_get(result_prop_name, prop_value, NULL)) {
+        /* shouldn't ever happen, given the success of wait_for_property() */
+        snprintf(errmsg, sizeof(errmsg), "%s", "DHCP Renew result property was not set");
+        return -1;
+    }
+    if (strcmp(prop_value, "ok") == 0) {
+        fill_ip_info(interface, ipaddr, gateway, mask, dns1, dns2, server, lease);
+        return 0;
+    } else {
+        snprintf(errmsg, sizeof(errmsg), "DHCP Renew result was %s", prop_value);
+        return -1;
+    }
+}
diff --git a/libsysutils/src/NetlinkListener.cpp b/libsysutils/src/NetlinkListener.cpp
index e2a354e..fb088e1 100644
--- a/libsysutils/src/NetlinkListener.cpp
+++ b/libsysutils/src/NetlinkListener.cpp
@@ -17,6 +17,7 @@
 
 #include <sys/types.h>
 #include <sys/socket.h>
+#include <linux/netlink.h>
 #include <string.h>
 
 #define LOG_TAG "NetlinkListener"
@@ -32,10 +33,32 @@
 bool NetlinkListener::onDataAvailable(SocketClient *cli)
 {
     int socket = cli->getSocket();
-    int count;
+    ssize_t count;
+    char cred_msg[CMSG_SPACE(sizeof(struct ucred))];
+    struct sockaddr_nl snl;
+    struct iovec iov = {mBuffer, sizeof(mBuffer)};
+    struct msghdr hdr = {&snl, sizeof(snl), &iov, 1, cred_msg, sizeof(cred_msg), 0};
 
-    if ((count = recv(socket, mBuffer, sizeof(mBuffer), 0)) < 0) {
-        SLOGE("recv failed (%s)", strerror(errno));
+    if ((count = recvmsg(socket, &hdr, 0)) < 0) {
+        SLOGE("recvmsg failed (%s)", strerror(errno));
+        return false;
+    }
+
+    if ((snl.nl_groups != 1) || (snl.nl_pid != 0)) {
+        SLOGE("ignoring non-kernel netlink multicast message");
+        return false;
+    }
+
+    struct cmsghdr * cmsg = CMSG_FIRSTHDR(&hdr);
+
+    if (cmsg == NULL || cmsg->cmsg_type != SCM_CREDENTIALS) {
+        SLOGE("ignoring message with no sender credentials");
+        return false;
+    }
+
+    struct ucred * cred = (struct ucred *)CMSG_DATA(cmsg);
+    if (cred->uid != 0) {
+        SLOGE("ignoring message from non-root UID %d", cred->uid);
         return false;
     }
 
diff --git a/rootdir/ueventd.rc b/rootdir/ueventd.rc
index 616566e..b534669 100644
--- a/rootdir/ueventd.rc
+++ b/rootdir/ueventd.rc
@@ -70,6 +70,7 @@
 /dev/qmi1                 0640   radio      radio
 /dev/qmi2                 0640   radio      radio
 /dev/bus/usb/*            0660   root       usb
+/dev/usb_accessory        0660   root       usb
 
 # CDMA radio interface MUX
 /dev/ts0710mux*           0640   radio      radio
@@ -79,4 +80,4 @@
 # sysfs properties
 /sys/devices/virtual/input/input*   enable      0660  root   input
 /sys/devices/virtual/input/input*   poll_delay  0660  root   input
-
+/sys/devices/virtual/usb_composite/*   enable      0664  root   system