diff --git a/Android.mk b/Android.mk
index fa2f6f8..a307719 100644
--- a/Android.mk
+++ b/Android.mk
@@ -25,6 +25,7 @@
 	      liblog \
 	      libnetutils \
 	      libpixelflinger \
+	      libusbhost \
 	      libzipfile \
 	   ))
 endif
diff --git a/adb/Android.mk b/adb/Android.mk
index 0c93c1e..6fea574 100644
--- a/adb/Android.mk
+++ b/adb/Android.mk
@@ -81,6 +81,9 @@
 ifeq ($(USE_SYSDEPS_WIN32),)
 	LOCAL_STATIC_LIBRARIES += libcutils
 endif
+ifeq ($(HOST_OS),linux)
+  LOCAL_STATIC_LIBRARIES += libusbhost
+endif
 
 include $(BUILD_HOST_EXECUTABLE)
 
diff --git a/adb/adb.c b/adb/adb.c
index 04785fd..dd40eef 100644
--- a/adb/adb.c
+++ b/adb/adb.c
@@ -967,6 +967,99 @@
     return 0;
 }
 
+#if ADB_HOST
+void connect_device(char* host, char* buffer, int buffer_size)
+{
+    int port, fd;
+    char* portstr = strchr(host, ':');
+    char buf[4096];
+
+    if (!portstr) {
+        snprintf(buffer, buffer_size, "unable to parse %s as <host>:<port>", host);
+        return;
+    }
+    if (find_transport(host)) {
+        snprintf(buffer, buffer_size, "already connected to %s", host);
+        return;
+    }
+
+    // zero terminate host by overwriting the ':'
+    *portstr++ = 0;
+    if (sscanf(portstr, "%d", &port) == 0) {
+        snprintf(buffer, buffer_size, "bad port number %s", portstr);
+        return;
+    }
+
+    fd = socket_network_client(host, port, SOCK_STREAM);
+    if (fd < 0) {
+        snprintf(buffer, buffer_size, "unable to connect to %s:%d", host, port);
+        return;
+    }
+
+    D("client: connected on remote on fd %d\n", fd);
+    close_on_exec(fd);
+    disable_tcp_nagle(fd);
+    snprintf(buf, sizeof buf, "%s:%d", host, port);
+    register_socket_transport(fd, buf, port, 0);
+    snprintf(buffer, buffer_size, "connected to %s:%d", host, port);
+}
+
+void connect_emulator(char* port_spec, char* buffer, int buffer_size)
+{
+    char* port_separator = strchr(port_spec, ',');
+    if (!port_separator) {
+        snprintf(buffer, buffer_size,
+                "unable to parse '%s' as <console port>,<adb port>",
+                port_spec);
+        return;
+    }
+
+    // Zero-terminate console port and make port_separator point to 2nd port.
+    *port_separator++ = 0;
+    int console_port = strtol(port_spec, NULL, 0);
+    int adb_port = strtol(port_separator, NULL, 0);
+    if (!(console_port > 0 && adb_port > 0)) {
+        *(port_separator - 1) = ',';
+        snprintf(buffer, buffer_size,
+                "Invalid port numbers: Expected positive numbers, got '%s'",
+                port_spec);
+        return;
+    }
+
+    /* Check if the emulator is already known.
+     * Note: There's a small but harmless race condition here: An emulator not
+     * present just yet could be registered by another invocation right
+     * after doing this check here. However, local_connect protects
+     * against double-registration too. From here, a better error message
+     * can be produced. In the case of the race condition, the very specific
+     * error message won't be shown, but the data doesn't get corrupted. */
+    atransport* known_emulator = find_emulator_transport_by_adb_port(adb_port);
+    if (known_emulator != NULL) {
+        snprintf(buffer, buffer_size,
+                "Emulator on port %d already registered.", adb_port);
+        return;
+    }
+
+    /* Check if more emulators can be registered. Similar unproblematic
+     * race condition as above. */
+    int candidate_slot = get_available_local_transport_index();
+    if (candidate_slot < 0) {
+        snprintf(buffer, buffer_size, "Cannot accept more emulators.");
+        return;
+    }
+
+    /* Preconditions met, try to connect to the emulator. */
+    if (!local_connect_arbitrary_ports(console_port, adb_port)) {
+        snprintf(buffer, buffer_size,
+                "Connected to emulator on ports %d,%d", console_port, adb_port);
+    } else {
+        snprintf(buffer, buffer_size,
+                "Could not connect to emulator on ports %d,%d",
+                console_port, adb_port);
+    }
+}
+#endif
+
 int handle_host_request(char *service, transport_type ttype, char* serial, int reply_fd, asocket *s)
 {
     atransport *transport = NULL;
@@ -1024,43 +1117,16 @@
         return 0;
     }
 
-    // add a new TCP transport
+    // add a new TCP transport, device or emulator
     if (!strncmp(service, "connect:", 8)) {
         char buffer[4096];
-        int port, fd;
         char* host = service + 8;
-        char* portstr = strchr(host, ':');
-
-        if (!portstr) {
-            snprintf(buffer, sizeof(buffer), "unable to parse %s as <host>:<port>", host);
-            goto done;
+        if (!strncmp(host, "emu:", 4)) {
+            connect_emulator(host + 4, buffer, sizeof(buffer));
+        } else {
+            connect_device(host, buffer, sizeof(buffer));
         }
-        if (find_transport(host)) {
-            snprintf(buffer, sizeof(buffer), "Already connected to %s", host);
-            goto done;
-        }
-
-        // zero terminate host by overwriting the ':'
-        *portstr++ = 0;
-        if (sscanf(portstr, "%d", &port) == 0) {
-            snprintf(buffer, sizeof(buffer), "bad port number %s", portstr);
-            goto done;
-        }
-
-        fd = socket_network_client(host, port, SOCK_STREAM);
-        if (fd < 0) {
-            snprintf(buffer, sizeof(buffer), "unable to connect to %s:%d", host, port);
-            goto done;
-        }
-
-        D("client: connected on remote on fd %d\n", fd);
-        close_on_exec(fd);
-        disable_tcp_nagle(fd);
-        snprintf(buf, sizeof buf, "%s:%d", host, port);
-        register_socket_transport(fd, buf, port, 0);
-        snprintf(buffer, sizeof(buffer), "connected to %s:%d", host, port);
-
-done:
+        // Send response for emulator and device
         snprintf(buf, sizeof(buf), "OKAY%04x%s",(unsigned)strlen(buffer), buffer);
         writex(reply_fd, buf, strlen(buf));
         return 0;
diff --git a/adb/adb.h b/adb/adb.h
index a2b611e..292e415 100644
--- a/adb/adb.h
+++ b/adb/adb.h
@@ -183,6 +183,7 @@
         /* used to identify transports for clients */
     char *serial;
     char *product;
+    int adb_port; // Use for emulators (local transport)
 
         /* a list of adisconnect callbacks called when the transport is kicked */
     int          kicked;
@@ -262,6 +263,9 @@
 void   kick_transport( atransport*  t );
 
 /* initialize a transport object's func pointers and state */
+#if ADB_HOST
+int get_available_local_transport_index();
+#endif
 int  init_socket_transport(atransport *t, int s, int port, int local);
 void init_usb_transport(atransport *t, usb_handle *usb, int state);
 
@@ -280,6 +284,9 @@
 void unregister_usb_transport(usb_handle *usb);
 
 atransport *find_transport(const char *serial);
+#if ADB_HOST
+atransport* find_emulator_transport_by_adb_port(int adb_port);
+#endif
 
 int service_to_fd(const char *name);
 #if ADB_HOST
@@ -368,6 +375,7 @@
 
 void local_init(int port);
 int  local_connect(int  port);
+int  local_connect_arbitrary_ports(int console_port, int adb_port);
 
 /* usb host/client interface */
 void usb_init();
diff --git a/adb/transport_local.c b/adb/transport_local.c
index cfd3b4b..8dfc98d 100644
--- a/adb/transport_local.c
+++ b/adb/transport_local.c
@@ -41,9 +41,9 @@
 #endif
 
 #if ADB_HOST
-/* we keep a list of opened transports, transport 0 is bound to 5555,
- * transport 1 to 5557, .. transport n to 5555 + n*2. the list is used
- * to detect when we're trying to connect twice to a given local transport
+/* we keep a list of opened transports. The atransport struct knows to which
+ * local transport it is connected. The list is used to detect when we're
+ * trying to connect twice to a given local transport.
  */
 #define  ADB_LOCAL_TRANSPORT_MAX  16
 
@@ -102,7 +102,11 @@
 }
 
 
-int  local_connect(int  port)
+int local_connect(int port) {
+    return local_connect_arbitrary_ports(port-1, port);
+}
+
+int local_connect_arbitrary_ports(int console_port, int adb_port)
 {
     char buf[64];
     int  fd = -1;
@@ -110,19 +114,19 @@
 #if ADB_HOST
     const char *host = getenv("ADBHOST");
     if (host) {
-        fd = socket_network_client(host, port, SOCK_STREAM);
+        fd = socket_network_client(host, adb_port, SOCK_STREAM);
     }
 #endif
     if (fd < 0) {
-        fd = socket_loopback_client(port, SOCK_STREAM);
+        fd = socket_loopback_client(adb_port, SOCK_STREAM);
     }
 
     if (fd >= 0) {
         D("client: connected on remote on fd %d\n", fd);
         close_on_exec(fd);
         disable_tcp_nagle(fd);
-        snprintf(buf, sizeof buf, "%s%d", LOCAL_CLIENT_PREFIX, port - 1);
-        register_socket_transport(fd, buf, port, 1);
+        snprintf(buf, sizeof buf, "%s%d", LOCAL_CLIENT_PREFIX, console_port);
+        register_socket_transport(fd, buf, adb_port, 1);
         return 0;
     }
     return -1;
@@ -227,7 +231,50 @@
     adb_close(t->fd);
 }
 
-int init_socket_transport(atransport *t, int s, int port, int local)
+
+#if ADB_HOST
+/* Only call this function if you already hold local_transports_lock. */
+atransport* find_emulator_transport_by_adb_port_locked(int adb_port)
+{
+    int i;
+    for (i = 0; i < ADB_LOCAL_TRANSPORT_MAX; i++) {
+        if (local_transports[i] && local_transports[i]->adb_port == adb_port) {
+            return local_transports[i];
+        }
+    }
+    return NULL;
+}
+
+atransport* find_emulator_transport_by_adb_port(int adb_port)
+{
+    adb_mutex_lock( &local_transports_lock );
+    atransport* result = find_emulator_transport_by_adb_port_locked(adb_port);
+    adb_mutex_unlock( &local_transports_lock );
+    return result;
+}
+
+/* Only call this function if you already hold local_transports_lock. */
+int get_available_local_transport_index_locked()
+{
+    int i;
+    for (i = 0; i < ADB_LOCAL_TRANSPORT_MAX; i++) {
+        if (local_transports[i] == NULL) {
+            return i;
+        }
+    }
+    return -1;
+}
+
+int get_available_local_transport_index()
+{
+    adb_mutex_lock( &local_transports_lock );
+    int result = get_available_local_transport_index_locked();
+    adb_mutex_unlock( &local_transports_lock );
+    return result;
+}
+#endif
+
+int init_socket_transport(atransport *t, int s, int adb_port, int local)
 {
     int  fail = 0;
 
@@ -239,26 +286,30 @@
     t->sync_token = 1;
     t->connection_state = CS_OFFLINE;
     t->type = kTransportLocal;
+    t->adb_port = 0;
 
 #if ADB_HOST
     if (HOST && local) {
         adb_mutex_lock( &local_transports_lock );
         {
-            int  index = (port - DEFAULT_ADB_LOCAL_TRANSPORT_PORT)/2;
-
-            if (!(port & 1) || index < 0 || index >= ADB_LOCAL_TRANSPORT_MAX) {
-                D("bad local transport port number: %d\n", port);
-                fail = -1;
-            }
-            else if (local_transports[index] != NULL) {
+            t->adb_port = adb_port;
+            atransport* existing_transport =
+                    find_emulator_transport_by_adb_port_locked(adb_port);
+            int index = get_available_local_transport_index_locked();
+            if (existing_transport != NULL) {
                 D("local transport for port %d already registered (%p)?\n",
-                port, local_transports[index]);
+                adb_port, existing_transport);
                 fail = -1;
-            }
-            else
+            } else if (index < 0) {
+                // Too many emulators.
+                D("cannot register more emulators. Maximum is %d\n",
+                        ADB_LOCAL_TRANSPORT_MAX);
+                fail = -1;
+            } else {
                 local_transports[index] = t;
-        }
-        adb_mutex_unlock( &local_transports_lock );
+            }
+       }
+       adb_mutex_unlock( &local_transports_lock );
     }
 #endif
     return fail;
diff --git a/adb/usb_linux.c b/adb/usb_linux.c
index bb86813..7e510df 100644
--- a/adb/usb_linux.c
+++ b/adb/usb_linux.c
@@ -19,22 +19,13 @@
 #include <unistd.h>
 #include <string.h>
 
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/time.h>
-#include <dirent.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <ctype.h>
-
-#include <linux/usbdevice_fs.h>
+#include <usbhost/usbhost.h>
 #include <linux/version.h>
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20)
 #include <linux/usb/ch9.h>
 #else
 #include <linux/usb_ch9.h>
 #endif
-#include <asm/byteorder.h>
 
 #include "sysdeps.h"
 
@@ -52,28 +43,19 @@
     usb_handle *prev;
     usb_handle *next;
 
-    char fname[64];
-    int desc;
-    unsigned char ep_in;
-    unsigned char ep_out;
+    struct usb_device *device;
+    struct usb_endpoint *ep_in;
+    struct usb_endpoint *ep_out;
 
-    unsigned zero_mask;
-    unsigned writeable;
-
-    struct usbdevfs_urb urb_in;
-    struct usbdevfs_urb urb_out;
-
-    int urb_in_busy;
-    int urb_out_busy;
-    int dead;
-
-    adb_cond_t notify;
+    adb_cond_t notify_in;
+    adb_cond_t notify_out;
     adb_mutex_t lock;
 
-    // for garbage collecting disconnected devices
-    int mark;
+    int read_result, write_result;
+    int zero_mask;
+    int dead;
 
-    // ID of thread currently in REAPURB
+    // Thread ID for our reaper thread
     pthread_t reaper_thread;
 };
 
@@ -87,10 +69,8 @@
     usb_handle *usb;
 
     adb_mutex_lock(&usb_lock);
-    for(usb = handle_list.next; usb != &handle_list; usb = usb->next){
-        if(!strcmp(usb->fname, dev_name)) {
-            // set mark flag to indicate this device is still alive
-            usb->mark = 1;
+    for (usb = handle_list.next; usb != &handle_list; usb = usb->next) {
+        if (!strcmp(usb_device_get_name(usb->device), dev_name)) {
             adb_mutex_unlock(&usb_lock);
             return 1;
         }
@@ -99,185 +79,204 @@
     return 0;
 }
 
-static void kick_disconnected_devices()
+static void kick_disconnected_device(const char *devname, void *client_data)
 {
     usb_handle *usb;
 
     adb_mutex_lock(&usb_lock);
-    // kick any devices in the device list that were not found in the device scan
-    for(usb = handle_list.next; usb != &handle_list; usb = usb->next){
-        if (usb->mark == 0) {
+    /* kick the device if it is in our list */
+    for (usb = handle_list.next; usb != &handle_list; usb = usb->next) {
+        if (!strcmp(devname, usb_device_get_name(usb->device)))
             usb_kick(usb);
-        } else {
-            usb->mark = 0;
-        }
     }
     adb_mutex_unlock(&usb_lock);
 
 }
 
-static void register_device(const char *dev_name, unsigned char ep_in, unsigned char ep_out,
-                            int ifc, int serial_index, unsigned zero_mask);
-
-static inline int badname(const char *name)
+static void* reaper_thread(void* arg)
 {
-    while(*name) {
-        if(!isdigit(*name++)) return 1;
+    struct usb_handle* h = (struct usb_handle *)arg;
+    int ep_in = usb_endpoint_number(h->ep_in);
+    int ep_out = usb_endpoint_number(h->ep_out);
+    int reaped_ep, res;
+
+    while (1) {
+        D("[ reap urb - wait ]\n");
+        adb_mutex_unlock(&h->lock);
+        res = usb_endpoint_wait(h->device, &reaped_ep);
+        adb_mutex_lock(&h->lock);
+        if(h->dead) {
+            res = -1;
+            break;
+        }
+
+        D("[ reaped ep %d ret = %d ]\n", reaped_ep, res);
+
+        if (reaped_ep == ep_in) {
+            D("[ reap urb - IN complete ]\n");
+            h->read_result = res;
+            adb_cond_broadcast(&h->notify_in);
+        }
+        if (reaped_ep == ep_out) {
+            D("[ reap urb - OUT compelete ]\n");
+            h->write_result = res;
+            adb_cond_broadcast(&h->notify_out);
+        }
     }
-    return 0;
+
+    return NULL;
 }
 
-static void find_usb_device(const char *base,
-        void (*register_device_callback)
-                (const char *, unsigned char, unsigned char, int, int, unsigned))
+static void register_device(struct usb_device *device, int interface,
+        struct usb_endpoint *ep_in, struct usb_endpoint *ep_out)
 {
-    char busname[32], devname[32];
-    unsigned char local_ep_in, local_ep_out;
-    DIR *busdir , *devdir ;
-    struct dirent *de;
-    int fd ;
+    usb_handle* usb = 0;
+    int ret = 0;
+    int writeable;
+    char *serial;
+    pthread_attr_t   attr;
+    const char* dev_name = usb_device_get_name(device);
 
-    busdir = opendir(base);
-    if(busdir == 0) return;
+        /* Since Linux will not reassign the device ID (and dev_name)
+        ** as long as the device is open, we can add to the list here
+        ** once we open it and remove from the list when we're finally
+        ** closed and everything will work out fine.
+        **
+        ** If we have a usb_handle on the list 'o handles with a matching
+        ** name, we have no further work to do.
+        */
+    adb_mutex_lock(&usb_lock);
+    for (usb = handle_list.next; usb != &handle_list; usb = usb->next) {
+        if (!strcmp(usb_device_get_name(usb->device), dev_name)) {
+            adb_mutex_unlock(&usb_lock);
+            return;
+        }
+    }
+    adb_mutex_unlock(&usb_lock);
 
-    while((de = readdir(busdir)) != 0) {
-        if(badname(de->d_name)) continue;
+    usb = calloc(1, sizeof(usb_handle));
+    adb_cond_init(&usb->notify_in, 0);
+    adb_cond_init(&usb->notify_out, 0);
+    adb_mutex_init(&usb->lock, 0);
 
-        snprintf(busname, sizeof busname, "%s/%s", base, de->d_name);
-        devdir = opendir(busname);
-        if(devdir == 0) continue;
+    usb->device = device;
+    usb->ep_in = ep_in;
+    usb->ep_out = ep_out;
+    usb->zero_mask = usb_endpoint_max_packet(usb->ep_out) - 1;
 
-//        DBGX("[ scanning %s ]\n", busname);
-        while((de = readdir(devdir))) {
-            unsigned char devdesc[256];
-            unsigned char* bufptr = devdesc;
-            unsigned char* bufend;
-            struct usb_device_descriptor* device;
-            struct usb_config_descriptor* config;
-            struct usb_interface_descriptor* interface;
-            struct usb_endpoint_descriptor *ep1, *ep2;
-            unsigned zero_mask = 0;
-            unsigned vid, pid;
-            size_t desclength;
+    D("[ usb open %s ]\n", dev_name);
+    writeable = usb_device_is_writeable(device);
+    if (writeable) {
+        ret = usb_device_claim_interface(device, interface);
+        if(ret != 0) goto fail;
+    }
 
-            if(badname(de->d_name)) continue;
-            snprintf(devname, sizeof devname, "%s/%s", busname, de->d_name);
+        /* add to the end of the active handles */
+    adb_mutex_lock(&usb_lock);
+    usb->next = &handle_list;
+    usb->prev = handle_list.prev;
+    usb->prev->next = usb;
+    usb->next->prev = usb;
+    adb_mutex_unlock(&usb_lock);
 
-            if(known_device(devname)) {
-                DBGX("skipping %s\n", devname);
-                continue;
-            }
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+    pthread_create(&usb->reaper_thread, &attr, reaper_thread, usb);
 
-//            DBGX("[ scanning %s ]\n", devname);
-            if((fd = unix_open(devname, O_RDONLY)) < 0) {
-                continue;
-            }
+    serial = usb_device_get_serial(device);
+    register_usb_transport(usb, serial, writeable);
+    if (serial)
+        free(serial);
+    return;
 
-            desclength = adb_read(fd, devdesc, sizeof(devdesc));
-            bufend = bufptr + desclength;
+fail:
+    D("[ usb open %s error=%d, err_str = %s]\n",
+        dev_name,  errno, strerror(errno));
+    if (usb->ep_in)
+        usb_endpoint_close(usb->ep_in);
+    if (usb->ep_out)
+        usb_endpoint_close(usb->ep_out);
+    if(device) {
+        usb_device_close(device);
+    }
+    free(usb);
+}
 
-                // should have device and configuration descriptors, and atleast two endpoints
-            if (desclength < USB_DT_DEVICE_SIZE + USB_DT_CONFIG_SIZE) {
-                D("desclength %d is too small\n", desclength);
-                adb_close(fd);
-                continue;
-            }
+static void check_usb_device(const char *devname, void *client_data) {
+    struct usb_device *device;
+    struct usb_descriptor_iter iter;
+    struct usb_descriptor_header* header;
+    struct usb_interface_descriptor* interface;
+    struct usb_endpoint_descriptor *ep1, *ep2;
+    struct usb_endpoint *ep_in = NULL, *ep_out = NULL;
+    uint16_t vid, pid;
 
-            device = (struct usb_device_descriptor*)bufptr;
-            bufptr += USB_DT_DEVICE_SIZE;
+    if(known_device(devname)) {
+        DBGX("skipping %s\n", devname);
+        return;
+    }
 
-            if((device->bLength != USB_DT_DEVICE_SIZE) || (device->bDescriptorType != USB_DT_DEVICE)) {
-                adb_close(fd);
-                continue;
-            }
+    device = usb_device_open(devname);
+    if (!device) return;
 
-            vid = __le16_to_cpu(device->idVendor);
-            pid = __le16_to_cpu(device->idProduct);
-            pid = devdesc[10] | (devdesc[11] << 8);
-            DBGX("[ %s is V:%04x P:%04x ]\n", devname, vid, pid);
+    vid = usb_device_get_vendor_id(device);
+    pid = usb_device_get_product_id(device);
+    DBGX("[ %s is V:%04x P:%04x ]\n", devname, vid, pid);
 
-                // should have config descriptor next
-            config = (struct usb_config_descriptor *)bufptr;
-            bufptr += USB_DT_CONFIG_SIZE;
-            if (config->bLength != USB_DT_CONFIG_SIZE || config->bDescriptorType != USB_DT_CONFIG) {
-                D("usb_config_descriptor not found\n");
-                adb_close(fd);
-                continue;
-            }
+    // loop through all the descriptors and look for the ADB interface
+    usb_descriptor_iter_init(device, &iter);
 
-                // loop through all the descriptors and look for the ADB interface
-            while (bufptr < bufend) {
-                unsigned char length = bufptr[0];
-                unsigned char type = bufptr[1];
+    while ((header = usb_descriptor_iter_next(&iter)) != NULL) {
+        if (header->bDescriptorType == USB_DT_INTERFACE) {
+            interface = (struct usb_interface_descriptor *)header;
 
-                if (type == USB_DT_INTERFACE) {
-                    interface = (struct usb_interface_descriptor *)bufptr;
-                    bufptr += length;
+            DBGX("bInterfaceClass: %d,  bInterfaceSubClass: %d,"
+                 "bInterfaceProtocol: %d, bNumEndpoints: %d\n",
+                 interface->bInterfaceClass, interface->bInterfaceSubClass,
+                 interface->bInterfaceProtocol, interface->bNumEndpoints);
 
-                    if (length != USB_DT_INTERFACE_SIZE) {
-                        D("interface descriptor has wrong size\n");
-                        break;
-                    }
+            if (interface->bNumEndpoints == 2 &&
+                    is_adb_interface(vid, pid, interface->bInterfaceClass,
+                    interface->bInterfaceSubClass, interface->bInterfaceProtocol))  {
 
-                    DBGX("bInterfaceClass: %d,  bInterfaceSubClass: %d,"
-                         "bInterfaceProtocol: %d, bNumEndpoints: %d\n",
-                         interface->bInterfaceClass, interface->bInterfaceSubClass,
-                         interface->bInterfaceProtocol, interface->bNumEndpoints);
+                DBGX("looking for bulk endpoints\n");
+                    // looks like ADB...
+                ep1 = (struct usb_endpoint_descriptor *)usb_descriptor_iter_next(&iter);
+                ep2 = (struct usb_endpoint_descriptor *)usb_descriptor_iter_next(&iter);
 
-                    if (interface->bNumEndpoints == 2 &&
-                            is_adb_interface(vid, pid, interface->bInterfaceClass,
-                            interface->bInterfaceSubClass, interface->bInterfaceProtocol))  {
-
-                        DBGX("looking for bulk endpoints\n");
-                            // looks like ADB...
-                        ep1 = (struct usb_endpoint_descriptor *)bufptr;
-                        bufptr += USB_DT_ENDPOINT_SIZE;
-                        ep2 = (struct usb_endpoint_descriptor *)bufptr;
-                        bufptr += USB_DT_ENDPOINT_SIZE;
-
-                        if (bufptr > devdesc + desclength ||
-                            ep1->bLength != USB_DT_ENDPOINT_SIZE ||
-                            ep1->bDescriptorType != USB_DT_ENDPOINT ||
-                            ep2->bLength != USB_DT_ENDPOINT_SIZE ||
-                            ep2->bDescriptorType != USB_DT_ENDPOINT) {
-                            D("endpoints not found\n");
-                            break;
-                        }
-
-                            // both endpoints should be bulk
-                        if (ep1->bmAttributes != USB_ENDPOINT_XFER_BULK ||
-                            ep2->bmAttributes != USB_ENDPOINT_XFER_BULK) {
-                            D("bulk endpoints not found\n");
-                            continue;
-                        }
-                            /* aproto 01 needs 0 termination */
-                        if(interface->bInterfaceProtocol == 0x01) {
-                            zero_mask = ep1->wMaxPacketSize - 1;
-                        }
-
-                            // we have a match.  now we just need to figure out which is in and which is out.
-                        if (ep1->bEndpointAddress & USB_ENDPOINT_DIR_MASK) {
-                            local_ep_in = ep1->bEndpointAddress;
-                            local_ep_out = ep2->bEndpointAddress;
-                        } else {
-                            local_ep_in = ep2->bEndpointAddress;
-                            local_ep_out = ep1->bEndpointAddress;
-                        }
-
-                        register_device_callback(devname, local_ep_in, local_ep_out,
-                                interface->bInterfaceNumber, device->iSerialNumber, zero_mask);
-                        break;
-                    }
-                } else {
-                    bufptr += length;
+                if (!ep1 || !ep2 ||
+                    ep1->bDescriptorType != USB_DT_ENDPOINT ||
+                    ep2->bDescriptorType != USB_DT_ENDPOINT) {
+                    D("endpoints not found\n");
+                    continue;
                 }
-            } // end of while
 
-            adb_close(fd);
-        } // end of devdir while
-        closedir(devdir);
-    } //end of busdir while
-    closedir(busdir);
+                    // both endpoints should be bulk
+                if (ep1->bmAttributes != USB_ENDPOINT_XFER_BULK ||
+                    ep2->bmAttributes != USB_ENDPOINT_XFER_BULK) {
+                    D("bulk endpoints not found\n");
+                    continue;
+                }
+
+                    // we have a match.  now we just need to figure out which is in and which is out.
+                if (ep1->bEndpointAddress & USB_ENDPOINT_DIR_MASK) {
+                    ep_in = usb_endpoint_open(device, ep1);
+                    ep_out = usb_endpoint_open(device, ep2);
+                } else {
+                    ep_in = usb_endpoint_open(device, ep2);
+                    ep_out = usb_endpoint_open(device, ep1);
+                }
+
+                register_device(device, interface->bInterfaceNumber, ep_in, ep_out);
+                // so we don't free it at the bottom
+                device = NULL;
+                break;
+            }
+        }
+    } // end of while
+
+    if (device)
+        usb_device_close(device);
 }
 
 void usb_cleanup()
@@ -286,17 +285,8 @@
 
 static int usb_bulk_write(usb_handle *h, const void *data, int len)
 {
-    struct usbdevfs_urb *urb = &h->urb_out;
+    struct usb_endpoint *ep = h->ep_out;
     int res;
-    struct timeval tv;
-    struct timespec ts;
-
-    memset(urb, 0, sizeof(*urb));
-    urb->type = USBDEVFS_URB_TYPE_BULK;
-    urb->endpoint = h->ep_out;
-    urb->status = -1;
-    urb->buffer = (void*) data;
-    urb->buffer_length = len;
 
     D("++ write ++\n");
 
@@ -305,32 +295,15 @@
         res = -1;
         goto fail;
     }
-    do {
-        res = ioctl(h->desc, USBDEVFS_SUBMITURB, urb);
-    } while((res < 0) && (errno == EINTR));
-
+    res = usb_endpoint_queue(ep, (void *)data, len);
     if(res < 0) {
         goto fail;
     }
 
-    res = -1;
-    h->urb_out_busy = 1;
-    for(;;) {
-        /* time out after five seconds */
-        gettimeofday(&tv, NULL);
-        ts.tv_sec = tv.tv_sec + 5;
-        ts.tv_nsec = tv.tv_usec * 1000L;
-        res = pthread_cond_timedwait(&h->notify, &h->lock, &ts);
-        if(res < 0 || h->dead) {
-            break;
-        }
-        if(h->urb_out_busy == 0) {
-            if(urb->status == 0) {
-                res = urb->actual_length;
-            }
-            break;
-        }
-    }
+    res = pthread_cond_wait(&h->notify_out, &h->lock);
+    if (!res)
+        res = h->write_result;
+
 fail:
     adb_mutex_unlock(&h->lock);
     D("-- write --\n");
@@ -339,75 +312,27 @@
 
 static int usb_bulk_read(usb_handle *h, void *data, int len)
 {
-    struct usbdevfs_urb *urb = &h->urb_in;
-    struct usbdevfs_urb *out = NULL;
+    struct usb_endpoint *ep = h->ep_in;
     int res;
 
-    memset(urb, 0, sizeof(*urb));
-    urb->type = USBDEVFS_URB_TYPE_BULK;
-    urb->endpoint = h->ep_in;
-    urb->status = -1;
-    urb->buffer = data;
-    urb->buffer_length = len;
-
-
     adb_mutex_lock(&h->lock);
     if(h->dead) {
         res = -1;
         goto fail;
     }
-    do {
-        res = ioctl(h->desc, USBDEVFS_SUBMITURB, urb);
-    } while((res < 0) && (errno == EINTR));
-
-    if(res < 0) {
+    res = usb_endpoint_queue(ep, data, len);
+    if (res < 0) {
         goto fail;
     }
+    res = pthread_cond_wait(&h->notify_in, &h->lock);
+    if (!res)
+        res = h->read_result;
 
-    h->urb_in_busy = 1;
-    for(;;) {
-        D("[ reap urb - wait ]\n");
-        h->reaper_thread = pthread_self();
-        adb_mutex_unlock(&h->lock);
-        res = ioctl(h->desc, USBDEVFS_REAPURB, &out);
-        adb_mutex_lock(&h->lock);
-        h->reaper_thread = 0;
-        if(h->dead) {
-            res = -1;
-            break;
-        }
-        if(res < 0) {
-            if(errno == EINTR) {
-                continue;
-            }
-            D("[ reap urb - error ]\n");
-            break;
-        }
-        D("[ urb @%p status = %d, actual = %d ]\n",
-            out, out->status, out->actual_length);
-
-        if(out == &h->urb_in) {
-            D("[ reap urb - IN complete ]\n");
-            h->urb_in_busy = 0;
-            if(urb->status == 0) {
-                res = urb->actual_length;
-            } else {
-                res = -1;
-            }
-            break;
-        }
-        if(out == &h->urb_out) {
-            D("[ reap urb - OUT compelete ]\n");
-            h->urb_out_busy = 0;
-            adb_cond_broadcast(&h->notify);
-        }
-    }
 fail:
     adb_mutex_unlock(&h->lock);
     return res;
 }
 
-
 int usb_write(usb_handle *h, const void *_data, int len)
 {
     unsigned char *data = (unsigned char*) _data;
@@ -438,7 +363,7 @@
         data += xfer;
     }
 
-    if(need_zero){
+    if(need_zero) {
         n = usb_bulk_write(h, _data, 0);
         return n;
     }
@@ -455,11 +380,9 @@
     while(len > 0) {
         int xfer = (len > 4096) ? 4096 : len;
 
-        D("[ usb read %d fd = %d], fname=%s\n", xfer, h->desc, h->fname);
         n = usb_bulk_read(h, data, xfer);
-        D("[ usb read %d ] = %d, fname=%s\n", xfer, n, h->fname);
         if(n != xfer) {
-            if((errno == ETIMEDOUT) && (h->desc != -1)) {
+            if(errno == ETIMEDOUT && h->device) {
                 D("[ timeout ]\n");
                 if(n > 0){
                     data += n;
@@ -482,12 +405,12 @@
 
 void usb_kick(usb_handle *h)
 {
-    D("[ kicking %p (fd = %d) ]\n", h, h->desc);
+    D("[ kicking %p (fd = %s) ]\n", h, usb_device_get_name(h->device));
     adb_mutex_lock(&h->lock);
     if(h->dead == 0) {
         h->dead = 1;
 
-        if (h->writeable) {
+        if (usb_device_is_writeable(h->device)) {
             /* HACK ALERT!
             ** Sometimes we get stuck in ioctl(USBDEVFS_REAPURB).
             ** This is a workaround for that problem.
@@ -501,13 +424,10 @@
             ** but this ensures that a reader blocked on REAPURB
             ** will get unblocked
             */
-            ioctl(h->desc, USBDEVFS_DISCARDURB, &h->urb_in);
-            ioctl(h->desc, USBDEVFS_DISCARDURB, &h->urb_out);
-            h->urb_in.status = -ENODEV;
-            h->urb_out.status = -ENODEV;
-            h->urb_in_busy = 0;
-            h->urb_out_busy = 0;
-            adb_cond_broadcast(&h->notify);
+            usb_endpoint_cancel(h->ep_in);
+            usb_endpoint_cancel(h->ep_out);
+            adb_cond_broadcast(&h->notify_in);
+            adb_cond_broadcast(&h->notify_out);
         } else {
             unregister_usb_transport(h);
         }
@@ -524,148 +444,14 @@
     h->prev = 0;
     h->next = 0;
 
-    adb_close(h->desc);
-    D("[ usb closed %p (fd = %d) ]\n", h, h->desc);
+    usb_device_close(h->device);
+    D("[ usb closed %p ]\n", h);
     adb_mutex_unlock(&usb_lock);
 
     free(h);
     return 0;
 }
 
-static void register_device(const char *dev_name,
-                            unsigned char ep_in, unsigned char ep_out,
-                            int interface, int serial_index, unsigned zero_mask)
-{
-    usb_handle* usb = 0;
-    int n = 0;
-    char serial[256];
-
-        /* Since Linux will not reassign the device ID (and dev_name)
-        ** as long as the device is open, we can add to the list here
-        ** once we open it and remove from the list when we're finally
-        ** closed and everything will work out fine.
-        **
-        ** If we have a usb_handle on the list 'o handles with a matching
-        ** name, we have no further work to do.
-        */
-    adb_mutex_lock(&usb_lock);
-    for(usb = handle_list.next; usb != &handle_list; usb = usb->next){
-        if(!strcmp(usb->fname, dev_name)) {
-            adb_mutex_unlock(&usb_lock);
-            return;
-        }
-    }
-    adb_mutex_unlock(&usb_lock);
-
-    D("[ usb located new device %s (%d/%d/%d) ]\n",
-        dev_name, ep_in, ep_out, interface);
-    usb = calloc(1, sizeof(usb_handle));
-    strcpy(usb->fname, dev_name);
-    usb->ep_in = ep_in;
-    usb->ep_out = ep_out;
-    usb->zero_mask = zero_mask;
-    usb->writeable = 1;
-
-    adb_cond_init(&usb->notify, 0);
-    adb_mutex_init(&usb->lock, 0);
-    /* initialize mark to 1 so we don't get garbage collected after the device scan */
-    usb->mark = 1;
-    usb->reaper_thread = 0;
-
-    usb->desc = unix_open(usb->fname, O_RDWR);
-    if(usb->desc < 0) {
-        /* if we fail, see if have read-only access */
-        usb->desc = unix_open(usb->fname, O_RDONLY);
-        if(usb->desc < 0) goto fail;
-        usb->writeable = 0;
-        D("[ usb open read-only %s fd = %d]\n", usb->fname, usb->desc);
-    } else {
-        D("[ usb open %s fd = %d]\n", usb->fname, usb->desc);
-        n = ioctl(usb->desc, USBDEVFS_CLAIMINTERFACE, &interface);
-        if(n != 0) goto fail;
-    }
-
-        /* read the device's serial number */
-    serial[0] = 0;
-    memset(serial, 0, sizeof(serial));
-    if (serial_index) {
-        struct usbdevfs_ctrltransfer  ctrl;
-        __u16 buffer[128];
-        __u16 languages[128];
-        int i, result;
-        int languageCount = 0;
-
-        memset(languages, 0, sizeof(languages));
-        memset(&ctrl, 0, sizeof(ctrl));
-
-            // read list of supported languages
-        ctrl.bRequestType = USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_DEVICE;
-        ctrl.bRequest = USB_REQ_GET_DESCRIPTOR;
-        ctrl.wValue = (USB_DT_STRING << 8) | 0;
-        ctrl.wIndex = 0;
-        ctrl.wLength = sizeof(languages);
-        ctrl.data = languages;
-
-        result = ioctl(usb->desc, USBDEVFS_CONTROL, &ctrl);
-        if (result > 0)
-            languageCount = (result - 2) / 2;
-
-        for (i = 1; i <= languageCount; i++) {
-            memset(buffer, 0, sizeof(buffer));
-            memset(&ctrl, 0, sizeof(ctrl));
-
-            ctrl.bRequestType = USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_DEVICE;
-            ctrl.bRequest = USB_REQ_GET_DESCRIPTOR;
-            ctrl.wValue = (USB_DT_STRING << 8) | serial_index;
-            ctrl.wIndex = languages[i];
-            ctrl.wLength = sizeof(buffer);
-            ctrl.data = buffer;
-
-            result = ioctl(usb->desc, USBDEVFS_CONTROL, &ctrl);
-            if (result > 0) {
-                int i;
-                // skip first word, and copy the rest to the serial string, changing shorts to bytes.
-                result /= 2;
-                for (i = 1; i < result; i++)
-                    serial[i - 1] = buffer[i];
-                serial[i - 1] = 0;
-                break;
-            }
-        }
-    }
-
-        /* add to the end of the active handles */
-    adb_mutex_lock(&usb_lock);
-    usb->next = &handle_list;
-    usb->prev = handle_list.prev;
-    usb->prev->next = usb;
-    usb->next->prev = usb;
-    adb_mutex_unlock(&usb_lock);
-
-    register_usb_transport(usb, serial, usb->writeable);
-    return;
-
-fail:
-    D("[ usb open %s error=%d, err_str = %s]\n",
-        usb->fname,  errno, strerror(errno));
-    if(usb->desc >= 0) {
-        adb_close(usb->desc);
-    }
-    free(usb);
-}
-
-void* device_poll_thread(void* unused)
-{
-    D("Created device thread\n");
-    for(;;) {
-            /* XXX use inotify */
-        find_usb_device("/dev/bus/usb", register_device);
-        kick_disconnected_devices();
-        sleep(1);
-    }
-    return NULL;
-}
-
 static void sigalrm_handler(int signo)
 {
     // don't need to do anything here
@@ -673,17 +459,15 @@
 
 void usb_init()
 {
-    adb_thread_t tid;
     struct sigaction    actions;
 
+    if (usb_host_init(check_usb_device, kick_disconnected_device, NULL))
+        fatal_errno("usb_host_init failed\n");
+
     memset(&actions, 0, sizeof(actions));
     sigemptyset(&actions.sa_mask);
     actions.sa_flags = 0;
     actions.sa_handler = sigalrm_handler;
     sigaction(SIGALRM,& actions, NULL);
-
-    if(adb_thread_create(&tid, device_poll_thread, NULL)){
-        fatal_errno("cannot create input thread");
-    }
 }
 
diff --git a/fastboot/engine.c b/fastboot/engine.c
index 6d62c6e..f29cc03 100644
--- a/fastboot/engine.c
+++ b/fastboot/engine.c
@@ -271,11 +271,11 @@
     a->data = (void*) notice;
 }
 
-void fb_execute_queue(usb_handle *usb)
+int fb_execute_queue(usb_handle *usb)
 {
     Action *a;
     char resp[FB_RESPONSE_SZ+1];
-    int status;
+    int status = 0;
 
     a = action_list;
     resp[FB_RESPONSE_SZ] = 0;
@@ -307,5 +307,5 @@
     }
 
     fprintf(stderr,"finished. total time: %.3fs\n", (now() - start));
+    return status;
 }
-
diff --git a/fastboot/fastboot.c b/fastboot/fastboot.c
index f3bfbeba..63208bc 100644
--- a/fastboot/fastboot.c
+++ b/fastboot/fastboot.c
@@ -552,11 +552,12 @@
     void *data;
     unsigned sz;
     unsigned page_size = 2048;
+    int status;
 
     skip(1);
     if (argc == 0) {
         usage();
-        return 0;
+        return 1;
     }
 
     if (!strcmp(*argv, "devices")) {
@@ -688,6 +689,7 @@
             argc = do_oem_command(argc, argv);
         } else {
             usage();
+	    return 1;
         }
     }
 
@@ -703,6 +705,6 @@
 
     usb = open_device();
 
-    fb_execute_queue(usb);
-    return 0;
+    status = fb_execute_queue(usb);
+    return (status) ? 1 : 0;
 }
diff --git a/fastboot/fastboot.h b/fastboot/fastboot.h
index a36c569..a4b27a0 100644
--- a/fastboot/fastboot.h
+++ b/fastboot/fastboot.h
@@ -49,7 +49,7 @@
 void fb_queue_command(const char *cmd, const char *msg);
 void fb_queue_download(const char *name, void *data, unsigned size);
 void fb_queue_notice(const char *notice);
-void fb_execute_queue(usb_handle *usb);
+int fb_execute_queue(usb_handle *usb);
 
 /* util stuff */
 void die(const char *fmt, ...);
diff --git a/include/arch/linux-arm/AndroidConfig.h b/include/arch/linux-arm/AndroidConfig.h
index f51ddb1..81f077f 100644
--- a/include/arch/linux-arm/AndroidConfig.h
+++ b/include/arch/linux-arm/AndroidConfig.h
@@ -199,7 +199,9 @@
 /*
  * Add any extra platform-specific defines here.
  */
+#ifndef __linux__
 #define __linux__
+#endif
 
 /*
  * Define if we have <malloc.h> header
diff --git a/include/cutils/ashmem.h b/include/cutils/ashmem.h
index fd56dbe..25b233e 100644
--- a/include/cutils/ashmem.h
+++ b/include/cutils/ashmem.h
@@ -10,7 +10,7 @@
 #ifndef _CUTILS_ASHMEM_H
 #define _CUTILS_ASHMEM_H
 
-#include <stdint.h>
+#include <stddef.h>
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/include/cutils/atomic.h b/include/cutils/atomic.h
index 0200709..4979c8a 100644
--- a/include/cutils/atomic.h
+++ b/include/cutils/atomic.h
@@ -121,6 +121,7 @@
  */
 #define android_atomic_write android_atomic_release_store
 #define android_atomic_cmpxchg android_atomic_release_cas
+#define android_atomic_swap android_atomic_release_swap
 
 #ifdef __cplusplus
 } // extern "C"
diff --git a/include/cutils/mspace.h b/include/cutils/mspace.h
index e6e4047..93fe48e 100644
--- a/include/cutils/mspace.h
+++ b/include/cutils/mspace.h
@@ -87,6 +87,11 @@
     size_t max_capacity, int locked, void *base);
 
 size_t destroy_contiguous_mspace(mspace msp);
+
+/*
+   Returns the position of the "break" within the given mspace.
+*/
+void *contiguous_mspace_sbrk0(mspace msp);
 #endif
 
 /*
diff --git a/include/usbhost/usbhost.h b/include/usbhost/usbhost.h
new file mode 100644
index 0000000..d67437b
--- /dev/null
+++ b/include/usbhost/usbhost.h
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __USB_HOST_H
+#define __USB_HOST_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdint.h>
+
+struct usb_endpoint_descriptor;
+
+struct usb_descriptor_iter {
+    unsigned char*  config;
+    unsigned char*  config_end;
+    unsigned char*  curr_desc;
+};
+
+/* callback for notification when new USB devices are attached */
+typedef void (* usb_device_added_cb)(const char *dev_name, void *client_data);
+
+/* callback for notification when USB devices are removed */
+typedef void (* usb_device_removed_cb)(const char *dev_name, void *client_data);
+
+/* Call this to start monitoring the USB bus.
+ * added_cb will be called immediately for each existing USB device,
+ * and subsequently each time a new device is added.
+ * removed_cb is called when USB devices are removed from the bus.
+ */
+int usb_host_init(usb_device_added_cb added_cb,
+                  usb_device_removed_cb removed_cb,
+                  void *client_data);
+
+/* Creates a usb_device object for a USB device */
+struct usb_device *usb_device_open(const char *dev_name);
+
+/* Releases all resources associated with the USB device */
+void usb_device_close(struct usb_device *device);
+
+/* Returns the name for the USB device, which is the same as
+ * the dev_name passed to usb_device_open()
+ */
+const char* usb_device_get_name(struct usb_device *device);
+
+/* Returns a unique ID for the device.  Currently this is generated from the
+ * dev_name path.
+ */
+int usb_device_get_unique_id(struct usb_device *device);
+
+/* Returns the USB vendor ID from the device descriptor for the USB device */
+uint16_t usb_device_get_vendor_id(struct usb_device *device);
+
+/* Returns the USB product ID from the device descriptor for the USB device */
+uint16_t usb_device_get_product_id(struct usb_device *device);
+
+/* Returns a USB descriptor string for the given string ID.
+ * Used to implement usb_device_get_manufacturer_name,
+ * usb_device_get_product_name and usb_device_get_serial.
+ * Call free() to free the result when you are done with it.
+ */
+char* usb_device_get_string(struct usb_device *device, int id);
+
+/* Returns the manufacturer name for the USB device.
+ * Call free() to free the result when you are done with it.
+ */
+char* usb_device_get_manufacturer_name(struct usb_device *device);
+
+/* Returns the product name for the USB device.
+ * Call free() to free the result when you are done with it.
+ */
+char* usb_device_get_product_name(struct usb_device *device);
+
+/* Returns the USB serial number for the USB device.
+ * Call free() to free the result when you are done with it.
+ */
+char* usb_device_get_serial(struct usb_device *device);
+
+/* Returns true if we have write access to the USB device,
+ * and false if we only have access to the USB device configuration.
+ */
+int usb_device_is_writeable(struct usb_device *device);
+
+/* Initializes a usb_descriptor_iter, which can be used to iterate through all
+ * the USB descriptors for a USB device.
+ */
+void usb_descriptor_iter_init(struct usb_device *device, struct usb_descriptor_iter *iter);
+
+/* Returns the next USB descriptor for a device, or NULL if we have reached the
+ * end of the list.
+ */
+struct usb_descriptor_header *usb_descriptor_iter_next(struct usb_descriptor_iter *iter);
+
+/* Claims the specified interface of a USB device */
+int usb_device_claim_interface(struct usb_device *device, unsigned int interface);
+
+/* Releases the specified interface of a USB device */
+int usb_device_release_interface(struct usb_device *device, unsigned int interface);
+
+
+/* Creates a new usb_endpoint for the specified endpoint of a USB device.
+ * This can be used to read or write data across the endpoint.
+ */
+struct usb_endpoint *usb_endpoint_open(struct usb_device *dev,
+                const struct usb_endpoint_descriptor *desc);
+
+/* Releases all resources associated with the endpoint */
+void usb_endpoint_close(struct usb_endpoint *ep);
+
+/* Begins a read or write operation on the specified endpoint */
+int usb_endpoint_queue(struct usb_endpoint *ep, void *data, int len);
+
+ /* Waits for the results of a previous usb_endpoint_queue operation on the
+  * specified endpoint.  Returns number of bytes transferred, or a negative
+  * value for error.
+  */
+int usb_endpoint_wait(struct usb_device *device, int *out_ep_num);
+
+/* Cancels a pending usb_endpoint_queue() operation on an endpoint. */
+int usb_endpoint_cancel(struct usb_endpoint *ep);
+
+/* Returns the usb_device for the given endpoint */
+struct usb_device *usb_endpoint_get_device(struct usb_endpoint *ep);
+
+/* Returns the endpoint address for the given endpoint */
+int usb_endpoint_number(struct usb_endpoint *ep);
+
+/* Returns the maximum packet size for the given endpoint.
+ * For bulk endpoints this should be 512 for highspeed or 64 for fullspeed.
+ */
+int usb_endpoint_max_packet(struct usb_endpoint *ep);
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* __USB_HOST_H */
diff --git a/init/builtins.c b/init/builtins.c
index e0ccf9f..4326ebc 100644
--- a/init/builtins.c
+++ b/init/builtins.c
@@ -258,7 +258,6 @@
     const char *name;
     unsigned flag;
 } mount_flags[] = {
-    { "move",       MS_MOVE },
     { "noatime",    MS_NOATIME },
     { "nosuid",     MS_NOSUID },
     { "nodev",      MS_NODEV },
diff --git a/libcutils/mspace.c b/libcutils/mspace.c
index 63b199d..6d3b35c 100644
--- a/libcutils/mspace.c
+++ b/libcutils/mspace.c
@@ -271,4 +271,16 @@
   }
   return 0;
 }
+
+void *contiguous_mspace_sbrk0(mspace msp) {
+    struct mspace_contig_state *cs;
+    mstate ms;
+    const unsigned int pagesize = PAGESIZE;
+
+    ms = (mstate)msp;
+    cs = (struct mspace_contig_state *)((uintptr_t)ms & ~(pagesize-1));
+    assert(cs->magic == CONTIG_STATE_MAGIC);
+    assert(cs->m == ms);
+    return cs->brk;
+}
 #endif
diff --git a/liblinenoise/Android.mk b/liblinenoise/Android.mk
new file mode 100644
index 0000000..b32a5f1
--- /dev/null
+++ b/liblinenoise/Android.mk
@@ -0,0 +1,12 @@
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+# Static library
+# ========================================================
+
+include $(CLEAR_VARS)
+LOCAL_MODULE:= liblinenoise
+LOCAL_SRC_FILES := linenoise.c
+
+
+include $(BUILD_STATIC_LIBRARY)
diff --git a/liblinenoise/MODULE_LICENSE_BSD_LIKE b/liblinenoise/MODULE_LICENSE_BSD_LIKE
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/liblinenoise/MODULE_LICENSE_BSD_LIKE
diff --git a/liblinenoise/NOTICE b/liblinenoise/NOTICE
new file mode 100644
index 0000000..f61419e
--- /dev/null
+++ b/liblinenoise/NOTICE
@@ -0,0 +1,28 @@
+Copyright (c) 2010, Salvatore Sanfilippo <antirez at gmail dot com>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+  * Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+    
+  * Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+    
+  * Neither the name of Redis nor the names of its contributors may be used
+    to endorse or promote products derived from this software without
+    specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/liblinenoise/linenoise.c b/liblinenoise/linenoise.c
new file mode 100644
index 0000000..ab57ae6
--- /dev/null
+++ b/liblinenoise/linenoise.c
@@ -0,0 +1,435 @@
+/* linenoise.c -- guerrilla line editing library against the idea that a
+ * line editing lib needs to be 20,000 lines of C code.
+ *
+ * You can find the latest source code at:
+ * 
+ *   http://github.com/antirez/linenoise
+ *
+ * Does a number of crazy assumptions that happen to be true in 99.9999% of
+ * the 2010 UNIX computers around.
+ *
+ * Copyright (c) 2010, Salvatore Sanfilippo <antirez at gmail dot com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ * References:
+ * - http://invisible-island.net/xterm/ctlseqs/ctlseqs.html
+ * - http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
+ *
+ * Todo list:
+ * - Switch to gets() if $TERM is something we can't support.
+ * - Filter bogus Ctrl+<char> combinations.
+ * - Win32 support
+ *
+ * Bloat:
+ * - Completion?
+ * - History search like Ctrl+r in readline?
+ *
+ * List of escape sequences used by this program, we do everything just
+ * with three sequences. In order to be so cheap we may have some
+ * flickering effect with some slow terminal, but the lesser sequences
+ * the more compatible.
+ *
+ * CHA (Cursor Horizontal Absolute)
+ *    Sequence: ESC [ n G
+ *    Effect: moves cursor to column n
+ *
+ * EL (Erase Line)
+ *    Sequence: ESC [ n K
+ *    Effect: if n is 0 or missing, clear from cursor to end of line
+ *    Effect: if n is 1, clear from beginning of line to cursor
+ *    Effect: if n is 2, clear entire line
+ *
+ * CUF (CUrsor Forward)
+ *    Sequence: ESC [ n C
+ *    Effect: moves cursor forward of n chars
+ * 
+ */
+
+#include <termios.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+#define LINENOISE_MAX_LINE 4096
+static char *unsupported_term[] = {"dumb","cons25",NULL};
+
+static struct termios orig_termios; /* in order to restore at exit */
+static int rawmode = 0; /* for atexit() function to check if restore is needed*/
+static int atexit_registered = 0; /* register atexit just 1 time */
+static int history_max_len = 100;
+static int history_len = 0;
+char **history = NULL;
+
+static void linenoiseAtExit(void);
+int linenoiseHistoryAdd(const char *line);
+
+static int isUnsupportedTerm(void) {
+    char *term = getenv("TERM");
+    int j;
+
+    if (term == NULL) return 0;
+    for (j = 0; unsupported_term[j]; j++)
+        if (!strcasecmp(term,unsupported_term[j])) return 1;
+    return 0;
+}
+
+static void freeHistory(void) {
+    if (history) {
+        int j;
+
+        for (j = 0; j < history_len; j++)
+            free(history[j]);
+        free(history);
+    }
+}
+
+static int enableRawMode(int fd) {
+    struct termios raw;
+
+    if (!isatty(STDIN_FILENO)) goto fatal;
+    if (!atexit_registered) {
+        atexit(linenoiseAtExit);
+        atexit_registered = 1;
+    }
+    if (tcgetattr(fd,&orig_termios) == -1) goto fatal;
+
+    raw = orig_termios;  /* modify the original mode */
+    /* input modes: no break, no CR to NL, no parity check, no strip char,
+     * no start/stop output control. */
+    raw.c_iflag &= ~(BRKINT | ICRNL | INPCK | ISTRIP | IXON);
+    /* output modes - disable post processing */
+    raw.c_oflag &= ~(OPOST);
+    /* control modes - set 8 bit chars */
+    raw.c_cflag |= (CS8);
+    /* local modes - choing off, canonical off, no extended functions,
+     * no signal chars (^Z,^C) */
+    raw.c_lflag &= ~(ECHO | ICANON | IEXTEN | ISIG);
+    /* control chars - set return condition: min number of bytes and timer.
+     * We want read to return every single byte, without timeout. */
+    raw.c_cc[VMIN] = 1; raw.c_cc[VTIME] = 0; /* 1 byte, no timer */
+
+    /* put terminal in raw mode after flushing */
+    if (tcsetattr(fd,TCSAFLUSH,&raw) < 0) goto fatal;
+    rawmode = 1;
+    return 0;
+
+fatal:
+    errno = ENOTTY;
+    return -1;
+}
+
+static void disableRawMode(int fd) {
+    /* Don't even check the return value as it's too late. */
+    if (rawmode && tcsetattr(fd,TCSAFLUSH,&orig_termios) != -1)
+        rawmode = 0;
+}
+
+/* At exit we'll try to fix the terminal to the initial conditions. */
+static void linenoiseAtExit(void) {
+    disableRawMode(STDIN_FILENO);
+    freeHistory();
+}
+
+static int getColumns(void) {
+    struct winsize ws;
+
+    if (ioctl(1, TIOCGWINSZ, &ws) == -1) return 80;
+    if (ws.ws_col == 0) {
+        return 80;
+    }
+    return ws.ws_col;
+}
+
+static void refreshLine(int fd, const char *prompt, char *buf, size_t len, size_t pos, size_t cols) {
+    char seq[64];
+    size_t plen = strlen(prompt);
+    
+    while((plen+pos) >= cols) {
+        buf++;
+        len--;
+        pos--;
+    }
+    while (plen+len > cols) {
+        len--;
+    }
+
+    /* Cursor to left edge */
+    snprintf(seq,64,"\x1b[0G");
+    if (write(fd,seq,strlen(seq)) == -1) return;
+    /* Write the prompt and the current buffer content */
+    if (write(fd,prompt,strlen(prompt)) == -1) return;
+    if (write(fd,buf,len) == -1) return;
+    /* Erase to right */
+    snprintf(seq,64,"\x1b[0K");
+    if (write(fd,seq,strlen(seq)) == -1) return;
+    /* Move cursor to original position. */
+    snprintf(seq,64,"\x1b[0G\x1b[%dC", (int)(pos+plen));
+    if (write(fd,seq,strlen(seq)) == -1) return;
+}
+
+static int linenoisePrompt(int fd, char *buf, size_t buflen, const char *prompt) {
+    size_t plen = strlen(prompt);
+    size_t pos = 0;
+    size_t len = 0;
+    size_t cols = getColumns();
+    int history_index = 0;
+
+    buf[0] = '\0';
+    buflen--; /* Make sure there is always space for the nulterm */
+
+    /* The latest history entry is always our current buffer, that
+     * initially is just an empty string. */
+    linenoiseHistoryAdd("");
+    
+    if (write(fd,prompt,plen) == -1) return -1;
+    while(1) {
+        char c;
+        int nread;
+        char seq[2];
+
+        nread = read(fd,&c,1);
+        if (nread <= 0) return len;
+        switch(c) {
+        case 10:    /* line feed. */
+        case 13:    /* enter */
+            history_len--;
+            return len;
+        case 4:     /* ctrl-d */
+            history_len--;
+            return (len == 0) ? -1 : (int)len;
+        case 3:     /* ctrl-c */
+            errno = EAGAIN;
+            return -1;
+        case 127:   /* backspace */
+        case 8:     /* ctrl-h */
+            if (pos > 0 && len > 0) {
+                memmove(buf+pos-1,buf+pos,len-pos);
+                pos--;
+                len--;
+                buf[len] = '\0';
+                refreshLine(fd,prompt,buf,len,pos,cols);
+            }
+            break;
+        case 20:    /* ctrl-t */
+            if (pos > 0 && pos < len) {
+                int aux = buf[pos-1];
+                buf[pos-1] = buf[pos];
+                buf[pos] = aux;
+                if (pos != len-1) pos++;
+                refreshLine(fd,prompt,buf,len,pos,cols);
+            }
+            break;
+        case 2:     /* ctrl-b */
+            goto left_arrow;
+        case 6:     /* ctrl-f */
+            goto right_arrow;
+        case 16:    /* ctrl-p */
+            seq[1] = 65;
+            goto up_down_arrow;
+        case 14:    /* ctrl-n */
+            seq[1] = 66;
+            goto up_down_arrow;
+            break;
+        case 27:    /* escape sequence */
+            if (read(fd,seq,2) == -1) break;
+            if (seq[0] == 91 && seq[1] == 68) {
+left_arrow:
+                /* left arrow */
+                if (pos > 0) {
+                    pos--;
+                    refreshLine(fd,prompt,buf,len,pos,cols);
+                }
+            } else if (seq[0] == 91 && seq[1] == 67) {
+right_arrow:
+                /* right arrow */
+                if (pos != len) {
+                    pos++;
+                    refreshLine(fd,prompt,buf,len,pos,cols);
+                }
+            } else if (seq[0] == 91 && (seq[1] == 65 || seq[1] == 66)) {
+up_down_arrow:
+                /* up and down arrow: history */
+                if (history_len > 1) {
+                    /* Update the current history entry before to
+                     * overwrite it with tne next one. */
+                    free(history[history_len-1-history_index]);
+                    history[history_len-1-history_index] = strdup(buf);
+                    /* Show the new entry */
+                    history_index += (seq[1] == 65) ? 1 : -1;
+                    if (history_index < 0) {
+                        history_index = 0;
+                        break;
+                    } else if (history_index >= history_len) {
+                        history_index = history_len-1;
+                        break;
+                    }
+                    strncpy(buf,history[history_len-1-history_index],buflen);
+                    buf[buflen] = '\0';
+                    len = pos = strlen(buf);
+                    refreshLine(fd,prompt,buf,len,pos,cols);
+                }
+            }
+            break;
+        default:
+            if (len < buflen) {
+                if (len == pos) {
+                    buf[pos] = c;
+                    pos++;
+                    len++;
+                    buf[len] = '\0';
+                    if (plen+len < cols) {
+                        /* Avoid a full update of the line in the
+                         * trivial case. */
+                        if (write(fd,&c,1) == -1) return -1;
+                    } else {
+                        refreshLine(fd,prompt,buf,len,pos,cols);
+                    }
+                } else {
+                    memmove(buf+pos+1,buf+pos,len-pos);
+                    buf[pos] = c;
+                    len++;
+                    pos++;
+                    buf[len] = '\0';
+                    refreshLine(fd,prompt,buf,len,pos,cols);
+                }
+            }
+            break;
+        case 21: /* Ctrl+u, delete the whole line. */
+            buf[0] = '\0';
+            pos = len = 0;
+            refreshLine(fd,prompt,buf,len,pos,cols);
+            break;
+        case 11: /* Ctrl+k, delete from current to end of line. */
+            buf[pos] = '\0';
+            len = pos;
+            refreshLine(fd,prompt,buf,len,pos,cols);
+            break;
+        case 1: /* Ctrl+a, go to the start of the line */
+            pos = 0;
+            refreshLine(fd,prompt,buf,len,pos,cols);
+            break;
+        case 5: /* ctrl+e, go to the end of the line */
+            pos = len;
+            refreshLine(fd,prompt,buf,len,pos,cols);
+            break;
+        }
+    }
+    return len;
+}
+
+static int linenoiseRaw(char *buf, size_t buflen, const char *prompt) {
+    int fd = STDIN_FILENO;
+    int count;
+
+    if (buflen == 0) {
+        errno = EINVAL;
+        return -1;
+    }
+    if (!isatty(STDIN_FILENO)) {
+        if (fgets(buf, buflen, stdin) == NULL) return -1;
+        count = strlen(buf);
+        if (count && buf[count-1] == '\n') {
+            count--;
+            buf[count] = '\0';
+        }
+    } else {
+        if (enableRawMode(fd) == -1) return -1;
+        count = linenoisePrompt(fd, buf, buflen, prompt);        
+        disableRawMode(fd);
+    }
+    return count;
+}
+
+char *linenoise(const char *prompt) {
+    char buf[LINENOISE_MAX_LINE];
+    int count;
+
+    if (isUnsupportedTerm()) {
+        size_t len;
+
+        printf("%s",prompt);
+        fflush(stdout);
+        if (fgets(buf,LINENOISE_MAX_LINE,stdin) == NULL) return NULL;
+        len = strlen(buf);
+        while(len && (buf[len-1] == '\n' || buf[len-1] == '\r')) {
+            len--;
+            buf[len] = '\0';
+        }
+        return strdup(buf);
+    } else {
+        count = linenoiseRaw(buf,LINENOISE_MAX_LINE,prompt);
+        if (count == -1) return NULL;
+        return strdup(buf);
+    }
+}
+
+/* Using a circular buffer is smarter, but a bit more complex to handle. */
+int linenoiseHistoryAdd(const char *line) {
+    char *linecopy;
+
+    if (history_max_len == 0) return 0;
+    if (history == 0) {
+        history = malloc(sizeof(char*)*history_max_len);
+        if (history == NULL) return 0;
+        memset(history,0,(sizeof(char*)*history_max_len));
+    }
+    linecopy = strdup(line);
+    if (!linecopy) return 0;
+    if (history_len == history_max_len) {
+        memmove(history,history+1,sizeof(char*)*(history_max_len-1));
+        history_len--;
+    }
+    history[history_len] = linecopy;
+    history_len++;
+    return 1;
+}
+
+int linenoiseHistorySetMaxLen(int len) {
+    char **new;
+
+    if (len < 1) return 0;
+    if (history) {
+        int tocopy = history_len;
+
+        new = malloc(sizeof(char*)*len);
+        if (new == NULL) return 0;
+        if (len < tocopy) tocopy = len;
+        memcpy(new,history+(history_max_len-tocopy), sizeof(char*)*tocopy);
+        free(history);
+        history = new;
+    }
+    history_max_len = len;
+    if (history_len > history_max_len)
+        history_len = history_max_len;
+    return 1;
+}
diff --git a/liblinenoise/linenoise.h b/liblinenoise/linenoise.h
new file mode 100644
index 0000000..57bf9d1
--- /dev/null
+++ b/liblinenoise/linenoise.h
@@ -0,0 +1,41 @@
+/* linenoise.h -- guerrilla line editing library against the idea that a
+ * line editing lib needs to be 20,000 lines of C code.
+ *
+ * See linenoise.c for more information.
+ *
+ * Copyright (c) 2010, Salvatore Sanfilippo <antirez at gmail dot com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __LINENOISE_H
+#define __LINENOISE_H
+
+char *linenoise(const char *prompt);
+int linenoiseHistoryAdd(const char *line);
+int linenoiseHistorySetMaxLen(int len);
+
+#endif /* __LINENOISE_H */
diff --git a/liblog/fake_log_device.c b/liblog/fake_log_device.c
index ed9d699..f8b7254 100644
--- a/liblog/fake_log_device.c
+++ b/liblog/fake_log_device.c
@@ -454,7 +454,7 @@
 
     numVecs = numLines*3;  // 3 iovecs per line.
     if (numVecs > INLINE_VECS) {
-        vec = (struct iovec*)malloc(sizeof(struct iovec)*numLines);
+        vec = (struct iovec*)malloc(sizeof(struct iovec)*numVecs);
         if (vec == NULL) {
             msg = "LOG: write failed, no memory";
             numVecs = 3;
diff --git a/libusbhost/Android.mk b/libusbhost/Android.mk
new file mode 100644
index 0000000..c8c8758
--- /dev/null
+++ b/libusbhost/Android.mk
@@ -0,0 +1,41 @@
+#
+# Copyright (C) 2010 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(my-dir)
+
+# Static library for Linux host
+# ========================================================
+
+ifeq ($(HOST_OS),linux)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := libusbhost
+LOCAL_SRC_FILES := usbhost.c
+
+include $(BUILD_HOST_STATIC_LIBRARY)
+
+endif
+
+# Static library for target
+# ========================================================
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := libusbhost
+LOCAL_SRC_FILES := usbhost.c
+
+include $(BUILD_STATIC_LIBRARY)
diff --git a/libusbhost/usbhost.c b/libusbhost/usbhost.c
new file mode 100644
index 0000000..a6b0867
--- /dev/null
+++ b/libusbhost/usbhost.c
@@ -0,0 +1,471 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/inotify.h>
+#include <dirent.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <ctype.h>
+#include <pthread.h>
+
+#include <linux/usbdevice_fs.h>
+#include <linux/version.h>
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20)
+#include <linux/usb/ch9.h>
+#else
+#include <linux/usb_ch9.h>
+#endif
+#include <asm/byteorder.h>
+
+#include "usbhost/usbhost.h"
+
+#define USB_FS_DIR "/dev/bus/usb"
+#define USB_FS_ID_SCANNER   "/dev/bus/usb/%d/%d"
+
+#if 0
+#define D printf
+#else
+#define D(...)
+#endif
+
+struct usb_host_context {
+    usb_device_added_cb     added_cb;
+    usb_device_removed_cb   removed_cb;
+    void                    *client_data;
+};
+
+struct usb_device {
+    char dev_name[64];
+    unsigned char desc[256];
+    int desc_length;
+    int fd;
+    int writeable;
+};
+
+struct usb_endpoint
+{
+    struct usb_device *dev;
+    struct usb_endpoint_descriptor  desc;
+    struct usbdevfs_urb urb;
+};
+
+static inline int badname(const char *name)
+{
+    while(*name) {
+        if(!isdigit(*name++)) return 1;
+    }
+    return 0;
+}
+
+static void find_existing_devices(struct usb_host_context *context)
+{
+    char busname[32], devname[32];
+    DIR *busdir , *devdir ;
+    struct dirent *de;
+
+    busdir = opendir(USB_FS_DIR);
+    if(busdir == 0) return;
+
+    while((de = readdir(busdir)) != 0) {
+        if(badname(de->d_name)) continue;
+
+        snprintf(busname, sizeof busname, "%s/%s", USB_FS_DIR, de->d_name);
+        devdir = opendir(busname);
+        if(devdir == 0) continue;
+
+        while((de = readdir(devdir))) {
+            if(badname(de->d_name)) continue;
+
+            snprintf(devname, sizeof devname, "%s/%s", busname, de->d_name);
+            context->added_cb(devname, context->client_data);
+        } // end of devdir while
+        closedir(devdir);
+    } //end of busdir while
+    closedir(busdir);
+}
+
+static void* device_discovery_thread(void *client_data)
+{
+    struct usb_host_context *context = (struct usb_host_context *)client_data;
+    struct inotify_event* event;
+    char event_buf[512];
+    char path[100];
+    int i, fd, ret;
+    int wd, wds[10];
+    int wd_count = sizeof(wds) / sizeof(wds[0]);
+
+    D("Created device discovery thread\n");
+
+    fd = inotify_init();
+    if (fd < 0) {
+        fprintf(stderr, "inotify_init failed\n");
+        return NULL;
+    }
+
+    /* watch for files added and deleted within USB_FS_DIR */
+    memset(wds, 0, sizeof(wds));
+    /* watch the root for new subdirectories */
+    wds[0] = inotify_add_watch(fd, USB_FS_DIR, IN_CREATE | IN_DELETE);
+    if (wds[0] < 0) {
+        fprintf(stderr, "inotify_add_watch failed\n");
+        return NULL;
+    }
+
+    /* watch existing subdirectories of USB_FS_DIR */
+    for (i = 1; i < wd_count; i++) {
+        snprintf(path, sizeof(path), "%s/%03d", USB_FS_DIR, i);
+        ret = inotify_add_watch(fd, path, IN_CREATE | IN_DELETE);
+        if (ret > 0)
+            wds[i] = ret;
+    }
+
+    /* check for existing devices first, after we have inotify set up */
+    find_existing_devices(context);
+
+    while (1) {
+        ret = read(fd, event_buf, sizeof(event_buf));
+        if (ret >= (int)sizeof(struct inotify_event)) {
+            event = (struct inotify_event *)event_buf;
+            wd = event->wd;
+            if (wd == wds[0]) {
+                i = atoi(event->name);
+                snprintf(path, sizeof(path), "%s/%s", USB_FS_DIR, event->name);
+                D("new subdirectory %s: index: %d\n", path, i);
+                if (i > 0 && i < wd_count) {
+                ret = inotify_add_watch(fd, path, IN_CREATE | IN_DELETE);
+                if (ret > 0)
+                    wds[i] = ret;
+                }
+            } else {
+                for (i = 1; i < wd_count; i++) {
+                    if (wd == wds[i]) {
+                        snprintf(path, sizeof(path), "%s/%03d/%s", USB_FS_DIR, i, event->name);
+                        if (event->mask == IN_CREATE) {
+                            D("new device %s\n", path);
+                            context->added_cb(path, context->client_data);
+                        } else if (event->mask == IN_DELETE) {
+                            D("gone device %s\n", path);
+                            context->removed_cb(path, context->client_data);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return NULL;
+}
+
+int usb_host_init(usb_device_added_cb added_cb, usb_device_removed_cb removed_cb, void *client_data)
+{
+    struct usb_host_context *context;
+    pthread_t tid;
+    pthread_attr_t   attr;
+
+    if (!added_cb || !removed_cb)
+        return -EINVAL;
+
+    context = calloc(1, sizeof(struct usb_host_context));
+    context->added_cb = added_cb;
+    context->removed_cb = removed_cb;
+    context->client_data = client_data;
+
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+    return pthread_create(&tid, &attr, device_discovery_thread, context);
+}
+
+struct usb_device *usb_device_open(const char *dev_name)
+{
+    struct usb_device *device = calloc(1, sizeof(struct usb_device));
+    int fd, length, did_retry = 0;
+
+    strcpy(device->dev_name, dev_name);
+    device->writeable = 1;
+
+retry:
+    fd = open(dev_name, O_RDWR);
+    if (fd < 0) {
+        /* if we fail, see if have read-only access */
+        fd = open(dev_name, O_RDONLY);
+        if (fd < 0 && errno == EACCES && !did_retry) {
+            /* work around race condition between inotify and permissions management */
+            sleep(1);
+            did_retry = 1;
+            goto retry;
+        }
+
+        if (fd < 0) goto fail;
+        device->writeable = 0;
+        D("[ usb open read-only %s fd = %d]\n", dev_name, fd);
+    }
+
+    length = read(fd, device->desc, sizeof(device->desc));
+    if (length < 0)
+        goto fail;
+
+    device->fd = fd;
+    device->desc_length = length;
+    return device;
+fail:
+    close(fd);
+    free(device);
+    return NULL;
+}
+
+void usb_device_close(struct usb_device *device)
+{
+    close(device->fd);
+    free(device);
+}
+
+const char* usb_device_get_name(struct usb_device *device)
+{
+    return device->dev_name;
+}
+
+int usb_device_get_unique_id(struct usb_device *device)
+{
+    int bus = 0, dev = 0;
+    sscanf(device->dev_name, USB_FS_ID_SCANNER, &bus, &dev);
+    return bus * 1000 + dev;
+}
+
+uint16_t usb_device_get_vendor_id(struct usb_device *device)
+{
+    struct usb_device_descriptor* desc = (struct usb_device_descriptor*)device->desc;
+    return __le16_to_cpu(desc->idVendor);
+}
+
+uint16_t usb_device_get_product_id(struct usb_device *device)
+{
+    struct usb_device_descriptor* desc = (struct usb_device_descriptor*)device->desc;
+    return __le16_to_cpu(desc->idProduct);
+}
+
+char* usb_device_get_string(struct usb_device *device, int id)
+{
+    char string[256];
+    struct usbdevfs_ctrltransfer  ctrl;
+    __u16 buffer[128];
+    __u16 languages[128];
+    int i, result;
+    int languageCount = 0;
+
+    string[0] = 0;
+
+    // reading the string requires read/write permission
+    if (!device->writeable) {
+        int fd = open(device->dev_name, O_RDWR);
+        if (fd > 0) {
+            close(device->fd);
+            device->fd = fd;
+            device->writeable = 1;
+        } else {
+            return NULL;
+        }
+    }
+
+    memset(languages, 0, sizeof(languages));
+    memset(&ctrl, 0, sizeof(ctrl));
+
+    // read list of supported languages
+    ctrl.bRequestType = USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_DEVICE;
+    ctrl.bRequest = USB_REQ_GET_DESCRIPTOR;
+    ctrl.wValue = (USB_DT_STRING << 8) | 0;
+    ctrl.wIndex = 0;
+    ctrl.wLength = sizeof(languages);
+    ctrl.data = languages;
+
+    result = ioctl(device->fd, USBDEVFS_CONTROL, &ctrl);
+    if (result > 0)
+        languageCount = (result - 2) / 2;
+
+    for (i = 1; i <= languageCount; i++) {
+        memset(buffer, 0, sizeof(buffer));
+        memset(&ctrl, 0, sizeof(ctrl));
+
+        ctrl.bRequestType = USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_DEVICE;
+        ctrl.bRequest = USB_REQ_GET_DESCRIPTOR;
+        ctrl.wValue = (USB_DT_STRING << 8) | id;
+        ctrl.wIndex = languages[i];
+        ctrl.wLength = sizeof(buffer);
+        ctrl.data = buffer;
+
+        result = ioctl(device->fd, USBDEVFS_CONTROL, &ctrl);
+        if (result > 0) {
+            int i;
+            // skip first word, and copy the rest to the string, changing shorts to bytes.
+            result /= 2;
+            for (i = 1; i < result; i++)
+                string[i - 1] = buffer[i];
+            string[i - 1] = 0;
+            return strdup(string);
+        }
+    }
+
+    return NULL;
+}
+
+char* usb_device_get_manufacturer_name(struct usb_device *device)
+{
+    struct usb_device_descriptor *desc = (struct usb_device_descriptor *)device->desc;
+
+    if (desc->iManufacturer)
+        return usb_device_get_string(device, desc->iManufacturer);
+    else
+        return NULL;
+}
+
+char* usb_device_get_product_name(struct usb_device *device)
+{
+    struct usb_device_descriptor *desc = (struct usb_device_descriptor *)device->desc;
+
+    if (desc->iProduct)
+        return usb_device_get_string(device, desc->iProduct);
+    else
+        return NULL;
+}
+
+char* usb_device_get_serial(struct usb_device *device)
+{
+    struct usb_device_descriptor *desc = (struct usb_device_descriptor *)device->desc;
+
+    if (desc->iSerialNumber)
+        return usb_device_get_string(device, desc->iSerialNumber);
+    else
+        return NULL;
+}
+
+int usb_device_is_writeable(struct usb_device *device)
+{
+    return device->writeable;
+}
+
+void usb_descriptor_iter_init(struct usb_device *device, struct usb_descriptor_iter *iter)
+{
+    iter->config = device->desc;
+    iter->config_end = device->desc + device->desc_length;
+    iter->curr_desc = device->desc;
+}
+
+struct usb_descriptor_header *usb_descriptor_iter_next(struct usb_descriptor_iter *iter)
+{
+    struct usb_descriptor_header* next;
+    if (iter->curr_desc >= iter->config_end)
+        return NULL;
+    next = (struct usb_descriptor_header*)iter->curr_desc;
+    iter->curr_desc += next->bLength;
+    return next;
+}
+
+int usb_device_claim_interface(struct usb_device *device, unsigned int interface)
+{
+    return ioctl(device->fd, USBDEVFS_CLAIMINTERFACE, &interface);
+}
+
+int usb_device_release_interface(struct usb_device *device, unsigned int interface)
+{
+    return ioctl(device->fd, USBDEVFS_RELEASEINTERFACE, &interface);
+}
+
+struct usb_endpoint *usb_endpoint_open(struct usb_device *dev,
+        const struct usb_endpoint_descriptor *desc)
+{
+    struct usb_endpoint *ep = calloc(1, sizeof(struct usb_endpoint));
+    memcpy(&ep->desc, desc, sizeof(ep->desc));
+    ep->dev = dev;
+    return ep;
+}
+
+void usb_endpoint_close(struct usb_endpoint *ep)
+{
+    // cancel IO here?
+    free(ep);
+}
+
+int usb_endpoint_queue(struct usb_endpoint *ep, void *data, int len)
+{
+    struct usbdevfs_urb *urb = &ep->urb;
+    int res;
+
+    D("usb_endpoint_queue\n");
+    memset(urb, 0, sizeof(*urb));
+    urb->type = USBDEVFS_URB_TYPE_BULK;
+    urb->endpoint = ep->desc.bEndpointAddress;
+    urb->status = -1;
+    urb->buffer = data;
+    urb->buffer_length = len;
+
+    do {
+        res = ioctl(ep->dev->fd, USBDEVFS_SUBMITURB, urb);
+    } while((res < 0) && (errno == EINTR));
+
+    return res;
+}
+
+int usb_endpoint_wait(struct usb_device *dev, int *out_ep_num)
+{
+    struct usbdevfs_urb *out = NULL;
+    int res;
+
+    while (1) {
+        res = ioctl(dev->fd, USBDEVFS_REAPURB, &out);
+        D("USBDEVFS_REAPURB returned %d\n", res);
+        if (res < 0) {
+            if(errno == EINTR) {
+                continue;
+            }
+            D("[ reap urb - error ]\n");
+            *out_ep_num = -1;
+        } else {
+            D("[ urb @%p status = %d, actual = %d ]\n",
+                out, out->status, out->actual_length);
+            res = out->actual_length;
+            *out_ep_num = out->endpoint;
+        }
+        break;
+    }
+    return res;
+}
+
+int usb_endpoint_cancel(struct usb_endpoint *ep)
+{
+    return ioctl(ep->dev->fd, USBDEVFS_DISCARDURB, &ep->urb);
+}
+
+struct usb_device *usb_endpoint_get_device(struct usb_endpoint *ep)
+{
+    return ep->dev;
+}
+
+int usb_endpoint_number(struct usb_endpoint *ep)
+{
+    return ep->desc.bEndpointAddress;
+}
+
+int usb_endpoint_max_packet(struct usb_endpoint *ep)
+{
+    return __le16_to_cpu(ep->desc.wMaxPacketSize);
+}
+
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 8d8955b..31a9bd7 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -16,7 +16,7 @@
     export ANDROID_DATA /data
     export EXTERNAL_STORAGE /mnt/sdcard
     export ASEC_MOUNTPOINT /mnt/asec
-    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar
+    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/core-junit.jar
 
 # Backward compatibility
     symlink /system/etc /etc
diff --git a/sh/Android.mk b/sh/Android.mk
index 09bb6ac..b5e5c38 100644
--- a/sh/Android.mk
+++ b/sh/Android.mk
@@ -31,7 +31,11 @@
 
 LOCAL_MODULE:= sh
 
-LOCAL_CFLAGS += -DSHELL
+LOCAL_CFLAGS += -DSHELL -DWITH_LINENOISE
+
+LOCAL_STATIC_LIBRARIES := liblinenoise
+
+LOCAL_C_INCLUDES += system/core/liblinenoise
 
 make_ash_files: PRIVATE_SRC_FILES := $(SRC_FILES)
 make_ash_files: PRIVATE_CFLAGS := $(LOCAL_CFLAGS)
diff --git a/sh/input.c b/sh/input.c
index a81fd7b..9377bd0 100644
--- a/sh/input.c
+++ b/sh/input.c
@@ -64,6 +64,10 @@
 #include "parser.h"
 #include "myhistedit.h"
 
+#ifdef WITH_LINENOISE
+#include "linenoise.h"
+#endif
+
 #define EOF_NLEFT -99		/* value of parsenleft when EOF pushed back */
 
 MKINIT
@@ -203,6 +207,45 @@
 
 	} else
 #endif
+#ifdef WITH_LINENOISE
+    if (parsefile->fd == 0) {
+        static char *rl_start;
+        static const char *rl_cp;
+        static int el_len;
+
+        if (rl_cp == NULL) {
+            rl_cp = rl_start = linenoise(getprompt(""));
+            if (rl_cp != NULL) {
+                el_len = strlen(rl_start);
+                if (el_len != 0) {
+                    /* Add non-blank lines to history. */
+                    linenoiseHistoryAdd(rl_start);
+                }
+                out2str("\r\n");
+                /* Client expects a newline at end of input, doesn't expect null */
+                rl_start[el_len++] = '\n';
+            }
+        }
+        if (rl_cp == NULL)
+            nr = 0;
+        else {
+            nr = el_len;
+            if (nr > BUFSIZ - 8)
+                nr = BUFSIZ - 8;
+            memcpy(buf, rl_cp, nr);
+            if (nr != el_len) {
+                el_len -= nr;
+                rl_cp += nr;
+            } else {
+                rl_cp = 0;
+                if (rl_start != NULL) {
+                    free(rl_start);
+                    rl_start = NULL;
+                }
+            }
+        }
+    } else
+#endif
 		nr = read(parsefile->fd, buf, BUFSIZ - 8);
 
 
diff --git a/sh/parser.c b/sh/parser.c
index 67de58e..d956375 100644
--- a/sh/parser.c
+++ b/sh/parser.c
@@ -1628,7 +1628,10 @@
 #ifdef WITH_HISTORY
 	if (!el)
 #endif
+#ifdef WITH_LINENOISE
+#else
 		out2str(getprompt(NULL));
+#endif
 }
 
 /*
diff --git a/toolbox/mount.c b/toolbox/mount.c
index 472c952..82ecc56 100644
--- a/toolbox/mount.c
+++ b/toolbox/mount.c
@@ -222,9 +222,50 @@
     return 0;
 }
 
+static int get_mounts_dev_dir(const char *arg, char **dev, char **dir)
+{
+	FILE *f;
+	char mount_dev[256];
+	char mount_dir[256];
+	char mount_type[256];
+	char mount_opts[256];
+	int mount_freq;
+	int mount_passno;
+	int match;
+
+	f = fopen("/proc/mounts", "r");
+	if (!f) {
+		fprintf(stdout, "could not open /proc/mounts\n");
+		return -1;
+	}
+
+	do {
+		match = fscanf(f, "%255s %255s %255s %255s %d %d\n",
+					   mount_dev, mount_dir, mount_type,
+					   mount_opts, &mount_freq, &mount_passno);
+		mount_dev[255] = 0;
+		mount_dir[255] = 0;
+		mount_type[255] = 0;
+		mount_opts[255] = 0;
+		if (match == 6 &&
+			(strcmp(arg, mount_dev) == 0 ||
+			 strcmp(arg, mount_dir) == 0)) {
+			*dev = strdup(mount_dev);
+			*dir = strdup(mount_dir);
+			fclose(f);
+			return 0;
+		}
+	} while (match != EOF);
+
+	fclose(f);
+	return -1;
+}
+
 int mount_main(int argc, char *argv[])
 {
 	char *type = NULL;
+	char *dev = NULL;
+	char *dir = NULL;
 	int c;
 	int loop = 0;
 
@@ -265,12 +306,19 @@
 	if (rwflag & MS_TYPE)
 		type = "none";
 
-	if (optind + 2 != argc || type == NULL) {
+	if (optind + 2 == argc) {
+		dev = argv[optind];
+		dir = argv[optind + 1];
+	} else if (optind + 1 == argc && rwflag & MS_REMOUNT) {
+		get_mounts_dev_dir(argv[optind], &dev, &dir);
+	}
+
+	if (dev == NULL || dir == NULL || type == NULL) {
 		fprintf(stderr, "Usage: %s [-r] [-w] [-o options] [-t type] "
 			"device directory\n", progname);
 		exit(1);
 	}
 
-	return do_mount(argv[optind], argv[optind + 1], type, rwflag,
-		        extra.str, loop);
+	return do_mount(dev, dir, type, rwflag, extra.str, loop);
+	/* We leak dev and dir in some cases, but we're about to exit */
 }