diff --git a/adb/Android.mk b/adb/Android.mk
index fe3c9cc..cb6da62 100644
--- a/adb/Android.mk
+++ b/adb/Android.mk
@@ -346,6 +346,9 @@
     libsquashfs_utils \
     libcutils \
     libbase \
-    libcrypto_static
+    libcrypto_static \
+    libminijail \
+    libminijail_generated \
+    libcap
 
 include $(BUILD_EXECUTABLE)
diff --git a/adb/commandline.cpp b/adb/commandline.cpp
index 8575c86..a025ed7 100644
--- a/adb/commandline.cpp
+++ b/adb/commandline.cpp
@@ -204,7 +204,10 @@
         "  adb version                  - show version num\n"
         "\n"
         "scripting:\n"
-        "  adb wait-for-device          - block until device is online\n"
+        "  adb wait-for[-<transport>]-<state>\n"
+        "                               - wait for device to be in the given state:\n"
+        "                                 device, recovery, sideload, or bootloader\n"
+        "                                 Transport is: usb, local or any [default=any]\n"
         "  adb start-server             - ensure that there is a server running\n"
         "  adb kill-server              - kill the server if it is running\n"
         "  adb get-state                - prints: offline | bootloader | device\n"
@@ -1010,19 +1013,49 @@
 #endif /* !defined(_WIN32) */
 }
 
+static bool check_wait_for_device_syntax(const char* service) {
+    // TODO: when we have libc++ for Windows, use a regular expression instead.
+    // wait-for-((any|local|usb)-)?(bootloader|device|recovery|sideload)
+
+    char type[20];
+    char state[20];
+    int length = 0;
+    if (sscanf(service, "wait-for-%20[a-z]-%20[a-z]%n", type, state, &length) < 2 ||
+        length != static_cast<int>(strlen(service))) {
+        fprintf(stderr, "adb: couldn't parse 'wait-for' command: %s\n", service);
+        return false;
+    }
+
+    if (strcmp(type, "any") != 0 && strcmp(type, "local") != 0 && strcmp(type, "usb") != 0) {
+        fprintf(stderr, "adb: unknown type %s; expected 'any', 'local', or 'usb'\n", type);
+        return false;
+    }
+    if (strcmp(state, "bootloader") != 0 && strcmp(state, "device") != 0 &&
+        strcmp(state, "recovery") != 0 && strcmp(state, "sideload") != 0) {
+        fprintf(stderr, "adb: unknown state %s; "
+                        "expected 'bootloader', 'device', 'recovery', or 'sideload'\n", state);
+        return false;
+    }
+    return true;
+}
+
 static bool wait_for_device(const char* service, TransportType t, const char* serial) {
     // Was the caller vague about what they'd like us to wait for?
     // If so, check they weren't more specific in their choice of transport type.
     if (strcmp(service, "wait-for-device") == 0) {
         if (t == kTransportUsb) {
-            service = "wait-for-usb";
+            service = "wait-for-usb-device";
         } else if (t == kTransportLocal) {
-            service = "wait-for-local";
+            service = "wait-for-local-device";
         } else {
-            service = "wait-for-any";
+            service = "wait-for-any-device";
         }
     }
 
+    if (!check_wait_for_device_syntax(service)) {
+        return false;
+    }
+
     std::string cmd = format_host_command(service, t, serial);
     return adb_command(cmd);
 }
@@ -1860,8 +1893,7 @@
     adb_close(remoteFd);
 
     if (strncmp("Success", buf, 7)) {
-        fprintf(stderr, "Failed to write %s\n", file);
-        fputs(buf, stderr);
+        fprintf(stderr, "Failed to install %s: %s", file, buf);
         return 1;
     }
     fputs(buf, stderr);
diff --git a/adb/daemon/main.cpp b/adb/daemon/main.cpp
index feea7a3..78db69d 100644
--- a/adb/daemon/main.cpp
+++ b/adb/daemon/main.cpp
@@ -25,11 +25,15 @@
 #include <getopt.h>
 #include <sys/prctl.h>
 
+#include <memory>
+
 #include <android-base/logging.h>
 #include <android-base/stringprintf.h>
+#include <libminijail.h>
+
 #include "cutils/properties.h"
 #include "private/android_filesystem_config.h"
-#include "selinux/selinux.h"
+#include "selinux/android.h"
 
 #include "adb.h"
 #include "adb_auth.h"
@@ -53,12 +57,7 @@
             continue;
         }
 
-        int err = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
-
-        // Some kernels don't have file capabilities compiled in, and
-        // prctl(PR_CAPBSET_DROP) returns EINVAL. Don't automatically
-        // die when we see such misconfigured kernels.
-        if ((err < 0) && (errno != EINVAL)) {
+        if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) == -1) {
             PLOG(FATAL) << "Could not drop capabilities";
         }
     }
@@ -91,12 +90,12 @@
     bool adb_root = (strcmp(value, "1") == 0);
     bool adb_unroot = (strcmp(value, "0") == 0);
 
-    // ...except "adb root" lets you keep privileges in a debuggable build.
+    // ... except "adb root" lets you keep privileges in a debuggable build.
     if (ro_debuggable && adb_root) {
         drop = false;
     }
 
-    // ...and "adb unroot" lets you explicitly drop privileges.
+    // ... and "adb unroot" lets you explicitly drop privileges.
     if (adb_unroot) {
         drop = true;
     }
@@ -108,6 +107,9 @@
 }
 
 static void drop_privileges(int server_port) {
+    std::unique_ptr<minijail, void (*)(minijail*)> jail(minijail_new(),
+                                                        &minijail_destroy);
+
     // Add extra groups:
     // AID_ADB to access the USB driver
     // AID_LOG to read system logs (adb logcat)
@@ -121,28 +123,31 @@
     gid_t groups[] = {AID_ADB,      AID_LOG,       AID_INPUT,
                       AID_INET,     AID_NET_BT,    AID_NET_BT_ADMIN,
                       AID_SDCARD_R, AID_SDCARD_RW, AID_NET_BW_STATS,
-                      AID_READPROC };
-    if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) != 0) {
-        PLOG(FATAL) << "Could not set supplemental groups";
+                      AID_READPROC};
+    if (minijail_set_supplementary_gids(
+            jail.get(),
+            sizeof(groups) / sizeof(groups[0]),
+            groups) != 0) {
+        LOG(FATAL) << "Could not configure supplementary groups";
     }
 
-    /* don't listen on a port (default 5037) if running in secure mode */
-    /* don't run as root if we are running in secure mode */
+    // Don't listen on a port (default 5037) if running in secure mode.
+    // Don't run as root if running in secure mode.
     if (should_drop_privileges()) {
         drop_capabilities_bounding_set_if_needed();
 
-        /* then switch user and group to "shell" */
-        if (setgid(AID_SHELL) != 0) {
-            PLOG(FATAL) << "Could not setgid";
-        }
-        if (setuid(AID_SHELL) != 0) {
-            PLOG(FATAL) << "Could not setuid";
-        }
+        minijail_change_gid(jail.get(), AID_SHELL);
+        minijail_change_uid(jail.get(), AID_SHELL);
+        // minijail_enter() will abort if any priv-dropping step fails.
+        minijail_enter(jail.get());
 
         D("Local port disabled");
     } else {
+        // minijail_enter() will abort if any priv-dropping step fails.
+        minijail_enter(jail.get());
+
         if (root_seclabel != nullptr) {
-            if (setcon(root_seclabel) < 0) {
+            if (selinux_android_setcon(root_seclabel) < 0) {
                 LOG(FATAL) << "Could not set SELinux context";
             }
         }
@@ -152,7 +157,7 @@
         if (install_listener(local_name, "*smartsocket*", nullptr, 0,
                              &error)) {
             LOG(FATAL) << "Could not install *smartsocket* listener: "
-                << error;
+                       << error;
         }
     }
 }
diff --git a/adb/services.cpp b/adb/services.cpp
index 523353a..20166ce 100644
--- a/adb/services.cpp
+++ b/adb/services.cpp
@@ -356,19 +356,19 @@
 #if ADB_HOST
 struct state_info {
     TransportType transport_type;
-    char* serial;
+    std::string serial;
     ConnectionState state;
 };
 
-static void wait_for_state(int fd, void* cookie) {
-    state_info* sinfo = reinterpret_cast<state_info*>(cookie);
+static void wait_for_state(int fd, void* data) {
+    std::unique_ptr<state_info> sinfo(reinterpret_cast<state_info*>(data));
 
     D("wait_for_state %d", sinfo->state);
 
     while (true) {
         bool is_ambiguous = false;
         std::string error = "unknown error";
-        atransport* t = acquire_one_transport(sinfo->transport_type, sinfo->serial,
+        atransport* t = acquire_one_transport(sinfo->transport_type, sinfo->serial.c_str(),
                                               &is_ambiguous, &error);
         if (t != nullptr && t->connection_state == sinfo->state) {
             SendOkay(fd);
@@ -382,10 +382,6 @@
         }
     }
 
-    if (sinfo->serial) {
-        free(sinfo->serial);
-    }
-    free(sinfo);
     adb_close(fd);
     D("wait_for_state is done");
 }
@@ -491,38 +487,43 @@
 asocket* host_service_to_socket(const char* name, const char* serial) {
     if (!strcmp(name,"track-devices")) {
         return create_device_tracker();
-    } else if (!strncmp(name, "wait-for-", strlen("wait-for-"))) {
-        auto sinfo = reinterpret_cast<state_info*>(malloc(sizeof(state_info)));
-        if (sinfo == nullptr) {
-            fprintf(stderr, "couldn't allocate state_info: %s", strerror(errno));
-            return NULL;
-        }
-
-        if (serial)
-            sinfo->serial = strdup(serial);
-        else
-            sinfo->serial = NULL;
-
+    } else if (android::base::StartsWith(name, "wait-for-")) {
         name += strlen("wait-for-");
 
-        if (!strncmp(name, "local", strlen("local"))) {
-            sinfo->transport_type = kTransportLocal;
-            sinfo->state = kCsDevice;
-        } else if (!strncmp(name, "usb", strlen("usb"))) {
-            sinfo->transport_type = kTransportUsb;
-            sinfo->state = kCsDevice;
-        } else if (!strncmp(name, "any", strlen("any"))) {
-            sinfo->transport_type = kTransportAny;
-            sinfo->state = kCsDevice;
-        } else {
-            if (sinfo->serial) {
-                free(sinfo->serial);
-            }
-            free(sinfo);
-            return NULL;
+        std::unique_ptr<state_info> sinfo(new state_info);
+        if (sinfo == nullptr) {
+            fprintf(stderr, "couldn't allocate state_info: %s", strerror(errno));
+            return nullptr;
         }
 
-        int fd = create_service_thread(wait_for_state, sinfo);
+        if (serial) sinfo->serial = serial;
+
+        if (android::base::StartsWith(name, "local")) {
+            name += strlen("local");
+            sinfo->transport_type = kTransportLocal;
+        } else if (android::base::StartsWith(name, "usb")) {
+            name += strlen("usb");
+            sinfo->transport_type = kTransportUsb;
+        } else if (android::base::StartsWith(name, "any")) {
+            name += strlen("any");
+            sinfo->transport_type = kTransportAny;
+        } else {
+            return nullptr;
+        }
+
+        if (!strcmp(name, "-device")) {
+            sinfo->state = kCsDevice;
+        } else if (!strcmp(name, "-recovery")) {
+            sinfo->state = kCsRecovery;
+        } else if (!strcmp(name, "-sideload")) {
+            sinfo->state = kCsSideload;
+        } else if (!strcmp(name, "-bootloader")) {
+            sinfo->state = kCsBootloader;
+        } else {
+            return nullptr;
+        }
+
+        int fd = create_service_thread(wait_for_state, sinfo.release());
         return create_local_socket(fd);
     } else if (!strncmp(name, "connect:", 8)) {
         char* host = strdup(name + 8);
diff --git a/adb/usb_linux_client.cpp b/adb/usb_linux_client.cpp
index ceed8fa..a4f1a70 100644
--- a/adb/usb_linux_client.cpp
+++ b/adb/usb_linux_client.cpp
@@ -30,6 +30,8 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include <algorithm>
+
 #include "adb.h"
 #include "transport.h"
 
@@ -37,6 +39,13 @@
 #define MAX_PACKET_SIZE_HS	512
 #define MAX_PACKET_SIZE_SS	1024
 
+// Writes larger than 16k fail on some devices (seed with 3.10.49-g209ea2f in particular).
+#define USB_FFS_MAX_WRITE 16384
+
+// The kernel allocates a contiguous buffer for reads, which can fail for large ones due to
+// fragmentation. 16k chosen arbitrarily to match the write limit.
+#define USB_FFS_MAX_READ 16384
+
 #define cpu_to_le16(x)  htole16(x)
 #define cpu_to_le32(x)  htole32(x)
 
@@ -459,10 +468,9 @@
 static int usb_ffs_write(usb_handle* h, const void* data, int len) {
     D("about to write (fd=%d, len=%d)", h->bulk_in, len);
 
-    // Writes larger than 16k fail on some devices (seed with 3.10.49-g209ea2f in particular).
     const char* buf = static_cast<const char*>(data);
     while (len > 0) {
-        int write_len = (len > 16384) ? 16384 : len;
+        int write_len = std::min(USB_FFS_MAX_WRITE, len);
         int n = adb_write(h->bulk_in, buf, write_len);
         if (n < 0) {
             D("ERROR: fd = %d, n = %d: %s", h->bulk_in, n, strerror(errno));
@@ -481,7 +489,8 @@
 
     char* buf = static_cast<char*>(data);
     while (len > 0) {
-        int n = adb_read(h->bulk_out, buf, len);
+        int read_len = std::min(USB_FFS_MAX_READ, len);
+        int n = adb_read(h->bulk_out, buf, read_len);
         if (n < 0) {
             D("ERROR: fd = %d, n = %d: %s", h->bulk_out, n, strerror(errno));
             return -1;
diff --git a/fastboot/Android.mk b/fastboot/Android.mk
index c293b57..8cbc79b 100644
--- a/fastboot/Android.mk
+++ b/fastboot/Android.mk
@@ -33,15 +33,15 @@
 
 LOCAL_CFLAGS += -DFASTBOOT_REVISION='"$(fastboot_version)"'
 
-LOCAL_SRC_FILES_linux := usb_linux.cpp util_linux.cpp
-LOCAL_STATIC_LIBRARIES_linux := libselinux
+LOCAL_SRC_FILES_linux := socket_unix.cpp usb_linux.cpp util_linux.cpp
+LOCAL_STATIC_LIBRARIES_linux := libcutils libselinux
 
-LOCAL_SRC_FILES_darwin := usb_osx.cpp util_osx.cpp
-LOCAL_STATIC_LIBRARIES_darwin := libselinux
+LOCAL_SRC_FILES_darwin := socket_unix.cpp usb_osx.cpp util_osx.cpp
+LOCAL_STATIC_LIBRARIES_darwin := libcutils libselinux
 LOCAL_LDLIBS_darwin := -lpthread -framework CoreFoundation -framework IOKit -framework Carbon
 LOCAL_CFLAGS_darwin := -Wno-unused-parameter
 
-LOCAL_SRC_FILES_windows := usb_windows.cpp util_windows.cpp
+LOCAL_SRC_FILES_windows := socket_windows.cpp usb_windows.cpp util_windows.cpp
 LOCAL_STATIC_LIBRARIES_windows := AdbWinApi
 LOCAL_REQUIRED_MODULES_windows := AdbWinApi
 LOCAL_LDLIBS_windows := -lws2_32
@@ -89,3 +89,28 @@
 LOCAL_STATIC_LIBRARIES := libbase
 include $(BUILD_HOST_EXECUTABLE)
 endif
+
+# fastboot_test
+# =========================================================
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := fastboot_test
+LOCAL_MODULE_HOST_OS := darwin linux windows
+
+LOCAL_SRC_FILES := socket_test.cpp
+LOCAL_STATIC_LIBRARIES := libbase
+
+LOCAL_CFLAGS += -Wall -Wextra -Werror -Wunreachable-code
+
+LOCAL_SRC_FILES_linux := socket_unix.cpp
+LOCAL_STATIC_LIBRARIES_linux := libcutils
+
+LOCAL_SRC_FILES_darwin := socket_unix.cpp
+LOCAL_LDLIBS_darwin := -lpthread -framework CoreFoundation -framework IOKit -framework Carbon
+LOCAL_CFLAGS_darwin := -Wno-unused-parameter
+LOCAL_STATIC_LIBRARIES_darwin := libcutils
+
+LOCAL_SRC_FILES_windows := socket_windows.cpp
+LOCAL_LDLIBS_windows := -lws2_32
+
+include $(BUILD_HOST_NATIVE_TEST)
diff --git a/fastboot/socket.h b/fastboot/socket.h
new file mode 100644
index 0000000..888b530
--- /dev/null
+++ b/fastboot/socket.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+// This file provides a class interface for cross-platform UDP functionality. The main fastboot
+// engine should not be using this interface directly, but instead should use a higher-level
+// interface that enforces the fastboot UDP protocol.
+
+#ifndef SOCKET_H_
+#define SOCKET_H_
+
+#include "android-base/macros.h"
+
+#include <memory>
+#include <string>
+
+// UdpSocket interface to be implemented for each platform.
+class UdpSocket {
+  public:
+    // Creates a new client connection. Clients are connected to a specific hostname/port and can
+    // only send to that destination.
+    // On failure, |error| is filled (if non-null) and nullptr is returned.
+    static std::unique_ptr<UdpSocket> NewUdpClient(const std::string& hostname, int port,
+                                                   std::string* error);
+
+    // Creates a new server bound to local |port|. This is only meant for testing, during normal
+    // fastboot operation the device acts as the server.
+    // The server saves sender addresses in Receive(), and uses the most recent address during
+    // calls to Send().
+    static std::unique_ptr<UdpSocket> NewUdpServer(int port);
+
+    virtual ~UdpSocket() = default;
+
+    // Sends |length| bytes of |data|. Returns the number of bytes actually sent or -1 on error.
+    virtual ssize_t Send(const void* data, size_t length) = 0;
+
+    // Waits up to |timeout_ms| to receive up to |length| bytes of data. |timout_ms| of 0 will
+    // block forever. Returns the number of bytes received or -1 on error/timeout. On timeout
+    // errno will be set to EAGAIN or EWOULDBLOCK.
+    virtual ssize_t Receive(void* data, size_t length, int timeout_ms) = 0;
+
+    // Closes the socket. Returns 0 on success, -1 on error.
+    virtual int Close() = 0;
+
+  protected:
+    // Protected constructor to force factory function use.
+    UdpSocket() = default;
+
+    DISALLOW_COPY_AND_ASSIGN(UdpSocket);
+};
+
+#endif  // SOCKET_H_
diff --git a/fastboot/socket_test.cpp b/fastboot/socket_test.cpp
new file mode 100644
index 0000000..6ada964
--- /dev/null
+++ b/fastboot/socket_test.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Tests UDP functionality using loopback connections. Requires that kDefaultPort is available
+// for loopback communication on the host. These tests also assume that no UDP packets are lost,
+// which should be the case for loopback communication, but is not guaranteed.
+
+#include "socket.h"
+
+#include <errno.h>
+#include <time.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include <gtest/gtest.h>
+
+enum {
+    // This port must be available for loopback communication.
+    kDefaultPort = 54321,
+
+    // Don't wait forever in a unit test.
+    kDefaultTimeoutMs = 3000,
+};
+
+static const char kReceiveStringError[] = "Error receiving string";
+
+// Test fixture to provide some helper functions. Makes each test a little simpler since we can
+// just check a bool for socket creation and don't have to pass hostname or port information.
+class SocketTest : public ::testing::Test {
+  protected:
+    bool StartServer(int port = kDefaultPort) {
+        server_ = UdpSocket::NewUdpServer(port);
+        return server_ != nullptr;
+    }
+
+    bool StartClient(const std::string hostname = "localhost", int port = kDefaultPort) {
+        client_ = UdpSocket::NewUdpClient(hostname, port, nullptr);
+        return client_ != nullptr;
+    }
+
+    bool StartClient2(const std::string hostname = "localhost", int port = kDefaultPort) {
+        client2_ = UdpSocket::NewUdpClient(hostname, port, nullptr);
+        return client2_ != nullptr;
+    }
+
+    std::unique_ptr<UdpSocket> server_, client_, client2_;
+};
+
+// Sends a string over a UdpSocket. Returns true if the full string (without terminating char)
+// was sent.
+static bool SendString(UdpSocket* udp, const std::string& message) {
+    return udp->Send(message.c_str(), message.length()) == static_cast<ssize_t>(message.length());
+}
+
+// Receives a string from a UdpSocket. Returns the string, or kReceiveStringError on failure.
+static std::string ReceiveString(UdpSocket* udp, size_t receive_size = 128) {
+    std::vector<char> buffer(receive_size);
+
+    ssize_t result = udp->Receive(buffer.data(), buffer.size(), kDefaultTimeoutMs);
+    if (result >= 0) {
+        return std::string(buffer.data(), result);
+    }
+    return kReceiveStringError;
+}
+
+// Calls Receive() on the UdpSocket with the given timeout. Returns true if the call timed out.
+static bool ReceiveTimeout(UdpSocket* udp, int timeout_ms) {
+    char buffer[1];
+
+    errno = 0;
+    return udp->Receive(buffer, 1, timeout_ms) == -1 && (errno == EAGAIN || errno == EWOULDBLOCK);
+}
+
+// Tests sending packets client -> server, then server -> client.
+TEST_F(SocketTest, SendAndReceive) {
+    ASSERT_TRUE(StartServer());
+    ASSERT_TRUE(StartClient());
+
+    EXPECT_TRUE(SendString(client_.get(), "foo"));
+    EXPECT_EQ("foo", ReceiveString(server_.get()));
+
+    EXPECT_TRUE(SendString(server_.get(), "bar baz"));
+    EXPECT_EQ("bar baz", ReceiveString(client_.get()));
+}
+
+// Tests sending and receiving large packets.
+TEST_F(SocketTest, LargePackets) {
+    std::string message(512, '\0');
+
+    ASSERT_TRUE(StartServer());
+    ASSERT_TRUE(StartClient());
+
+    // Run through the test a few times.
+    for (int i = 0; i < 10; ++i) {
+        // Use a different message each iteration to prevent false positives.
+        for (size_t j = 0; j < message.length(); ++j) {
+            message[j] = static_cast<char>(i + j);
+        }
+
+        EXPECT_TRUE(SendString(client_.get(), message));
+        EXPECT_EQ(message, ReceiveString(server_.get(), message.length()));
+    }
+}
+
+// Tests IPv4 client/server.
+TEST_F(SocketTest, IPv4) {
+    ASSERT_TRUE(StartServer());
+    ASSERT_TRUE(StartClient("127.0.0.1"));
+
+    EXPECT_TRUE(SendString(client_.get(), "foo"));
+    EXPECT_EQ("foo", ReceiveString(server_.get()));
+
+    EXPECT_TRUE(SendString(server_.get(), "bar"));
+    EXPECT_EQ("bar", ReceiveString(client_.get()));
+}
+
+// Tests IPv6 client/server.
+TEST_F(SocketTest, IPv6) {
+    ASSERT_TRUE(StartServer());
+    ASSERT_TRUE(StartClient("::1"));
+
+    EXPECT_TRUE(SendString(client_.get(), "foo"));
+    EXPECT_EQ("foo", ReceiveString(server_.get()));
+
+    EXPECT_TRUE(SendString(server_.get(), "bar"));
+    EXPECT_EQ("bar", ReceiveString(client_.get()));
+}
+
+// Tests receive timeout. The timing verification logic must be very coarse to make sure different
+// systems running different loads can all pass these tests.
+TEST_F(SocketTest, ReceiveTimeout) {
+    time_t start_time;
+
+    ASSERT_TRUE(StartServer());
+
+    // Make sure a 20ms timeout completes in 1 second or less.
+    start_time = time(nullptr);
+    EXPECT_TRUE(ReceiveTimeout(server_.get(), 20));
+    EXPECT_LE(difftime(time(nullptr), start_time), 1.0);
+
+    // Make sure a 1250ms timeout takes 1 second or more.
+    start_time = time(nullptr);
+    EXPECT_TRUE(ReceiveTimeout(server_.get(), 1250));
+    EXPECT_LE(1.0, difftime(time(nullptr), start_time));
+}
+
+// Tests receive overflow (the UDP packet is larger than the receive buffer).
+TEST_F(SocketTest, ReceiveOverflow) {
+    ASSERT_TRUE(StartServer());
+    ASSERT_TRUE(StartClient());
+
+    EXPECT_TRUE(SendString(client_.get(), "1234567890"));
+
+    // This behaves differently on different systems; some give us a truncated UDP packet, others
+    // will error out and not return anything at all.
+    std::string rx_string = ReceiveString(server_.get(), 5);
+
+    // If we didn't get an error then the packet should have been truncated.
+    if (rx_string != kReceiveStringError) {
+        EXPECT_EQ("12345", rx_string);
+    }
+}
+
+// Tests multiple clients sending to the same server.
+TEST_F(SocketTest, MultipleClients) {
+    ASSERT_TRUE(StartServer());
+    ASSERT_TRUE(StartClient());
+    ASSERT_TRUE(StartClient2());
+
+    EXPECT_TRUE(SendString(client_.get(), "client"));
+    EXPECT_TRUE(SendString(client2_.get(), "client2"));
+
+    // Receive the packets and send a response for each (note that packets may be received
+    // out-of-order).
+    for (int i = 0; i < 2; ++i) {
+        std::string received = ReceiveString(server_.get());
+        EXPECT_TRUE(SendString(server_.get(), received + " response"));
+    }
+
+    EXPECT_EQ("client response", ReceiveString(client_.get()));
+    EXPECT_EQ("client2 response", ReceiveString(client2_.get()));
+}
diff --git a/fastboot/socket_unix.cpp b/fastboot/socket_unix.cpp
new file mode 100644
index 0000000..462256a
--- /dev/null
+++ b/fastboot/socket_unix.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "socket.h"
+
+#include <errno.h>
+#include <netdb.h>
+
+#include <android-base/stringprintf.h>
+#include <cutils/sockets.h>
+
+class UnixUdpSocket : public UdpSocket {
+  public:
+    enum class Type { kClient, kServer };
+
+    UnixUdpSocket(int fd, Type type);
+    ~UnixUdpSocket() override;
+
+    ssize_t Send(const void* data, size_t length) override;
+    ssize_t Receive(void* data, size_t length, int timeout_ms) override;
+    int Close() override;
+
+  private:
+    int fd_;
+    int receive_timeout_ms_ = 0;
+    std::unique_ptr<sockaddr_storage> addr_;
+    socklen_t addr_size_ = 0;
+
+    DISALLOW_COPY_AND_ASSIGN(UnixUdpSocket);
+};
+
+UnixUdpSocket::UnixUdpSocket(int fd, Type type) : fd_(fd) {
+    // Only servers need to remember addresses; clients are connected to a server in NewUdpClient()
+    // so will send to that server without needing to specify the address again.
+    if (type == Type::kServer) {
+        addr_.reset(new sockaddr_storage);
+        addr_size_ = sizeof(*addr_);
+        memset(addr_.get(), 0, addr_size_);
+    }
+}
+
+UnixUdpSocket::~UnixUdpSocket() {
+    Close();
+}
+
+ssize_t UnixUdpSocket::Send(const void* data, size_t length) {
+    return TEMP_FAILURE_RETRY(
+            sendto(fd_, data, length, 0, reinterpret_cast<sockaddr*>(addr_.get()), addr_size_));
+}
+
+ssize_t UnixUdpSocket::Receive(void* data, size_t length, int timeout_ms) {
+    // Only set socket timeout if it's changed.
+    if (receive_timeout_ms_ != timeout_ms) {
+        timeval tv;
+        tv.tv_sec = timeout_ms / 1000;
+        tv.tv_usec = (timeout_ms % 1000) * 1000;
+        if (setsockopt(fd_, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) < 0) {
+            return -1;
+        }
+        receive_timeout_ms_ = timeout_ms;
+    }
+
+    socklen_t* addr_size_ptr = nullptr;
+    if (addr_ != nullptr) {
+        // Reset addr_size as it may have been modified by previous recvfrom() calls.
+        addr_size_ = sizeof(*addr_);
+        addr_size_ptr = &addr_size_;
+    }
+    return TEMP_FAILURE_RETRY(recvfrom(fd_, data, length, 0,
+                                       reinterpret_cast<sockaddr*>(addr_.get()), addr_size_ptr));
+}
+
+int UnixUdpSocket::Close() {
+    int result = 0;
+    if (fd_ != -1) {
+        result = close(fd_);
+        fd_ = -1;
+    }
+    return result;
+}
+
+std::unique_ptr<UdpSocket> UdpSocket::NewUdpClient(const std::string& host, int port,
+                                                   std::string* error) {
+    int getaddrinfo_error = 0;
+    int fd = socket_network_client_timeout(host.c_str(), port, SOCK_DGRAM, 0, &getaddrinfo_error);
+    if (fd == -1) {
+        if (error) {
+            *error = android::base::StringPrintf(
+                    "Failed to connect to %s:%d: %s", host.c_str(), port,
+                    getaddrinfo_error ? gai_strerror(getaddrinfo_error) : strerror(errno));
+        }
+        return nullptr;
+    }
+
+    return std::unique_ptr<UdpSocket>(new UnixUdpSocket(fd, UnixUdpSocket::Type::kClient));
+}
+
+std::unique_ptr<UdpSocket> UdpSocket::NewUdpServer(int port) {
+    int fd = socket_inaddr_any_server(port, SOCK_DGRAM);
+    if (fd == -1) {
+        // This is just used in testing, no need for an error message.
+        return nullptr;
+    }
+
+    return std::unique_ptr<UdpSocket>(new UnixUdpSocket(fd, UnixUdpSocket::Type::kServer));
+}
diff --git a/fastboot/socket_windows.cpp b/fastboot/socket_windows.cpp
new file mode 100644
index 0000000..4ad379f
--- /dev/null
+++ b/fastboot/socket_windows.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "socket.h"
+
+#include <winsock2.h>
+#include <ws2tcpip.h>
+
+#include <memory>
+
+#include <android-base/stringprintf.h>
+
+// Windows UDP socket functionality.
+class WindowsUdpSocket : public UdpSocket {
+  public:
+    enum class Type { kClient, kServer };
+
+    WindowsUdpSocket(SOCKET sock, Type type);
+    ~WindowsUdpSocket() override;
+
+    ssize_t Send(const void* data, size_t len) override;
+    ssize_t Receive(void* data, size_t len, int timeout_ms) override;
+    int Close() override;
+
+  private:
+    SOCKET sock_;
+    int receive_timeout_ms_ = 0;
+    std::unique_ptr<sockaddr_storage> addr_;
+    int addr_size_ = 0;
+
+    DISALLOW_COPY_AND_ASSIGN(WindowsUdpSocket);
+};
+
+WindowsUdpSocket::WindowsUdpSocket(SOCKET sock, Type type) : sock_(sock) {
+    // Only servers need to remember addresses; clients are connected to a server in NewUdpClient()
+    // so will send to that server without needing to specify the address again.
+    if (type == Type::kServer) {
+        addr_.reset(new sockaddr_storage);
+        addr_size_ = sizeof(*addr_);
+        memset(addr_.get(), 0, addr_size_);
+    }
+}
+
+WindowsUdpSocket::~WindowsUdpSocket() {
+    Close();
+}
+
+ssize_t WindowsUdpSocket::Send(const void* data, size_t len) {
+    return sendto(sock_, reinterpret_cast<const char*>(data), len, 0,
+                  reinterpret_cast<sockaddr*>(addr_.get()), addr_size_);
+}
+
+ssize_t WindowsUdpSocket::Receive(void* data, size_t len, int timeout_ms) {
+    // Only set socket timeout if it's changed.
+    if (receive_timeout_ms_ != timeout_ms) {
+        if (setsockopt(sock_, SOL_SOCKET, SO_RCVTIMEO, reinterpret_cast<const char*>(&timeout_ms),
+                       sizeof(timeout_ms)) < 0) {
+            return -1;
+        }
+        receive_timeout_ms_ = timeout_ms;
+    }
+
+    int* addr_size_ptr = nullptr;
+    if (addr_ != nullptr) {
+        // Reset addr_size as it may have been modified by previous recvfrom() calls.
+        addr_size_ = sizeof(*addr_);
+        addr_size_ptr = &addr_size_;
+    }
+    int result = recvfrom(sock_, reinterpret_cast<char*>(data), len, 0,
+                          reinterpret_cast<sockaddr*>(addr_.get()), addr_size_ptr);
+    if (result < 0 && WSAGetLastError() == WSAETIMEDOUT) {
+        errno = EAGAIN;
+    }
+    return result;
+}
+
+int WindowsUdpSocket::Close() {
+    int result = 0;
+    if (sock_ != INVALID_SOCKET) {
+        result = closesocket(sock_);
+        sock_ = INVALID_SOCKET;
+    }
+    return result;
+}
+
+static int GetProtocol(int sock_type) {
+    switch (sock_type) {
+        case SOCK_DGRAM:
+            return IPPROTO_UDP;
+        case SOCK_STREAM:
+            return IPPROTO_TCP;
+        default:
+            // 0 lets the system decide which protocol to use.
+            return 0;
+    }
+}
+
+// Windows implementation of this libcutils function. This function does not make any calls to
+// WSAStartup() or WSACleanup() so that must be handled by the caller.
+// TODO(dpursell): share this code with adb.
+static SOCKET socket_network_client(const std::string& host, int port, int type) {
+    // First resolve the host and port parameters into a usable network address.
+    addrinfo hints;
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_socktype = type;
+    hints.ai_protocol = GetProtocol(type);
+
+    addrinfo* address = nullptr;
+    getaddrinfo(host.c_str(), android::base::StringPrintf("%d", port).c_str(), &hints, &address);
+    if (address == nullptr) {
+        return INVALID_SOCKET;
+    }
+
+    // Now create and connect the socket.
+    SOCKET sock = socket(address->ai_family, address->ai_socktype, address->ai_protocol);
+    if (sock == INVALID_SOCKET) {
+        freeaddrinfo(address);
+        return INVALID_SOCKET;
+    }
+
+    if (connect(sock, address->ai_addr, address->ai_addrlen) == SOCKET_ERROR) {
+        closesocket(sock);
+        freeaddrinfo(address);
+        return INVALID_SOCKET;
+    }
+
+    freeaddrinfo(address);
+    return sock;
+}
+
+// Windows implementation of this libcutils function. This implementation creates a dual-stack
+// server socket that can accept incoming IPv4 or IPv6 packets. This function does not make any
+// calls to WSAStartup() or WSACleanup() so that must be handled by the caller.
+// TODO(dpursell): share this code with adb.
+static SOCKET socket_inaddr_any_server(int port, int type) {
+    SOCKET sock = socket(AF_INET6, type, GetProtocol(type));
+    if (sock == INVALID_SOCKET) {
+        return INVALID_SOCKET;
+    }
+
+    // Enforce exclusive addresses (1), and enable dual-stack so both IPv4 and IPv6 work (2).
+    // (1) https://msdn.microsoft.com/en-us/library/windows/desktop/ms740621(v=vs.85).aspx.
+    // (2) https://msdn.microsoft.com/en-us/library/windows/desktop/bb513665(v=vs.85).aspx.
+    int exclusive = 1;
+    DWORD v6_only = 0;
+    if (setsockopt(sock, SOL_SOCKET, SO_EXCLUSIVEADDRUSE, reinterpret_cast<const char*>(&exclusive),
+                   sizeof(exclusive)) == SOCKET_ERROR ||
+        setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, reinterpret_cast<const char*>(&v6_only),
+                   sizeof(v6_only)) == SOCKET_ERROR) {
+        closesocket(sock);
+        return INVALID_SOCKET;
+    }
+
+    // Bind the socket to our local port.
+    sockaddr_in6 addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sin6_family = AF_INET6;
+    addr.sin6_port = htons(port);
+    addr.sin6_addr = in6addr_any;
+    if (bind(sock, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) == SOCKET_ERROR) {
+        closesocket(sock);
+        return INVALID_SOCKET;
+    }
+
+    return sock;
+}
+
+// Documentation at https://msdn.microsoft.com/en-us/library/windows/desktop/ms741549(v=vs.85).aspx
+// claims WSACleanup() should be called before program exit, but general consensus seems to be that
+// it hasn't actually been necessary for a long time, possibly since Windows 3.1.
+//
+// Both adb (1) and Chrome (2) purposefully avoid WSACleanup(), and since no adverse affects have
+// been found we may as well do the same here to keep this code simpler.
+// (1) https://android.googlesource.com/platform/system/core.git/+/master/adb/sysdeps_win32.cpp#816
+// (2) https://code.google.com/p/chromium/codesearch#chromium/src/net/base/winsock_init.cc&l=35
+static bool InitWinsock() {
+    static bool init_success = false;
+
+    if (!init_success) {
+        WSADATA wsaData;
+        init_success = (WSAStartup(MAKEWORD(2, 2), &wsaData) == 0);
+    }
+
+    return init_success;
+}
+
+std::unique_ptr<UdpSocket> UdpSocket::NewUdpClient(const std::string& host, int port,
+                                                   std::string* error) {
+    if (!InitWinsock()) {
+        if (error) {
+            *error = android::base::StringPrintf("Failed to initialize Winsock (error %d)",
+                                                 WSAGetLastError());
+        }
+        return nullptr;
+    }
+
+    SOCKET sock = socket_network_client(host, port, SOCK_DGRAM);
+    if (sock == INVALID_SOCKET) {
+        if (error) {
+            *error = android::base::StringPrintf("Failed to connect to %s:%d (error %d)",
+                                                 host.c_str(), port, WSAGetLastError());
+        }
+        return nullptr;
+    }
+
+    return std::unique_ptr<UdpSocket>(new WindowsUdpSocket(sock, WindowsUdpSocket::Type::kClient));
+}
+
+// This functionality is currently only used by tests so we don't need any error messages.
+std::unique_ptr<UdpSocket> UdpSocket::NewUdpServer(int port) {
+    if (!InitWinsock()) {
+        return nullptr;
+    }
+
+    SOCKET sock = socket_inaddr_any_server(port, SOCK_DGRAM);
+    if (sock == INVALID_SOCKET) {
+        return nullptr;
+    }
+
+    return std::unique_ptr<UdpSocket>(new WindowsUdpSocket(sock, WindowsUdpSocket::Type::kServer));
+}
diff --git a/libcutils/ashmem-host.c b/libcutils/ashmem-host.c
index abc4f94..15dd43e 100644
--- a/libcutils/ashmem-host.c
+++ b/libcutils/ashmem-host.c
@@ -43,11 +43,16 @@
     char template[PATH_MAX];
     snprintf(template, sizeof(template), "/tmp/android-ashmem-%d-XXXXXXXXX", getpid());
     int fd = mkstemp(template);
-    if (fd != -1 && TEMP_FAILURE_RETRY(ftruncate(fd, size)) != -1 && unlink(template) != -1) {
-        return fd;
+    if (fd == -1) return -1;
+
+    unlink(template);
+
+    if (TEMP_FAILURE_RETRY(ftruncate(fd, size)) == -1) {
+      close(fd);
+      return -1;
     }
-    close(fd);
-    return -1;
+
+    return fd;
 }
 
 int ashmem_set_prot_region(int fd __unused, int prot __unused)
diff --git a/libcutils/trace-dev.c b/libcutils/trace-dev.c
index a06987e..f025256 100644
--- a/libcutils/trace-dev.c
+++ b/libcutils/trace-dev.c
@@ -104,7 +104,7 @@
 
     if (sys_debuggable || atrace_is_debuggable) {
         // Check whether tracing is enabled for this process.
-        FILE * file = fopen("/proc/self/cmdline", "r");
+        FILE * file = fopen("/proc/self/cmdline", "re");
         if (file) {
             char cmdline[4096];
             if (fgets(cmdline, sizeof(cmdline), file)) {
@@ -173,7 +173,7 @@
 
 static void atrace_init_once()
 {
-    atrace_marker_fd = open("/sys/kernel/debug/tracing/trace_marker", O_WRONLY);
+    atrace_marker_fd = open("/sys/kernel/debug/tracing/trace_marker", O_WRONLY | O_CLOEXEC);
     if (atrace_marker_fd == -1) {
         ALOGE("Error opening trace file: %s (%d)", strerror(errno), errno);
         atrace_enabled_tags = 0;
diff --git a/libpixelflinger/codeflinger/MIPS64Assembler.cpp b/libpixelflinger/codeflinger/MIPS64Assembler.cpp
index a5305cc..672040b 100644
--- a/libpixelflinger/codeflinger/MIPS64Assembler.cpp
+++ b/libpixelflinger/codeflinger/MIPS64Assembler.cpp
@@ -1304,9 +1304,8 @@
 
 MIPS64Assembler::MIPS64Assembler(void* assembly, ArmToMips64Assembler *parent)
     : mParent(parent),
-    MIPSAssembler::MIPSAssembler(NULL, NULL)
+    MIPSAssembler::MIPSAssembler(assembly)
 {
-    mBase = mPC = (uint32_t *)assembly;
 }
 
 MIPS64Assembler::~MIPS64Assembler()
diff --git a/libpixelflinger/codeflinger/MIPSAssembler.cpp b/libpixelflinger/codeflinger/MIPSAssembler.cpp
index daa231f..5497fae 100644
--- a/libpixelflinger/codeflinger/MIPSAssembler.cpp
+++ b/libpixelflinger/codeflinger/MIPSAssembler.cpp
@@ -1256,6 +1256,12 @@
     mDuration = ggl_system_time();
 }
 
+MIPSAssembler::MIPSAssembler(void* assembly)
+    : mParent(NULL), mAssembly(NULL)
+{
+    mBase = mPC = (uint32_t *)assembly;
+}
+
 MIPSAssembler::~MIPSAssembler()
 {
 }
diff --git a/libpixelflinger/codeflinger/MIPSAssembler.h b/libpixelflinger/codeflinger/MIPSAssembler.h
index 06cb0d0..b53fefb 100644
--- a/libpixelflinger/codeflinger/MIPSAssembler.h
+++ b/libpixelflinger/codeflinger/MIPSAssembler.h
@@ -242,6 +242,7 @@
 {
 public:
                 MIPSAssembler(const sp<Assembly>& assembly, ArmToMipsAssembler *parent);
+                MIPSAssembler(void* assembly);
     virtual     ~MIPSAssembler();
 
     virtual uint32_t*   base() const;
diff --git a/logcat/tests/logcat_test.cpp b/logcat/tests/logcat_test.cpp
index 61b020c..4f517bb 100644
--- a/logcat/tests/logcat_test.cpp
+++ b/logcat/tests/logcat_test.cpp
@@ -605,7 +605,7 @@
                 char c;
 
                 if ((2 == sscanf(buffer, "%d log.tx%c", &num, &c)) &&
-                        (num <= 24)) {
+                        (num <= 40)) {
                     ++count;
                 } else if (strncmp(buffer, total, sizeof(total) - 1)) {
                     fprintf(stderr, "WARNING: Parse error: %s", buffer);
diff --git a/logd/LogBuffer.cpp b/logd/LogBuffer.cpp
index 1e4f3b0..5922f16 100644
--- a/logd/LogBuffer.cpp
+++ b/logd/LogBuffer.cpp
@@ -100,6 +100,11 @@
     unsigned long default_size = property_get_size(global_tuneable);
     if (!default_size) {
         default_size = property_get_size(global_default);
+        if (!default_size) {
+            default_size = property_get_bool("ro.config.low_ram", false) ?
+                LOG_BUFFER_MIN_SIZE : // 64K
+                LOG_BUFFER_SIZE;      // 256K
+        }
     }
 
     log_id_for_each(i) {
diff --git a/logd/LogUtils.h b/logd/LogUtils.h
index b591f28..fccba61 100644
--- a/logd/LogUtils.h
+++ b/logd/LogUtils.h
@@ -43,6 +43,9 @@
 bool clientHasLogCredentials(uid_t uid, gid_t gid, pid_t pid);
 bool clientHasLogCredentials(SocketClient *cli);
 
+// Furnished in main.cpp
+bool property_get_bool(const char *key, bool def);
+
 static inline bool worstUidEnabledForLogid(log_id_t id) {
     return (id == LOG_ID_MAIN) || (id == LOG_ID_SYSTEM) || (id == LOG_ID_RADIO);
 }
diff --git a/logd/main.cpp b/logd/main.cpp
index 0f55d60..2fcabdc 100644
--- a/logd/main.cpp
+++ b/logd/main.cpp
@@ -143,7 +143,7 @@
 }
 
 // Property helper
-static bool property_get_bool(const char *key, bool def) {
+bool property_get_bool(const char *key, bool def) {
     char property[PROPERTY_VALUE_MAX];
     property_get(key, property, "");
 
diff --git a/logd/tests/logd_test.cpp b/logd/tests/logd_test.cpp
index 4472c1d..7d0dd44 100644
--- a/logd/tests/logd_test.cpp
+++ b/logd/tests/logd_test.cpp
@@ -26,8 +26,6 @@
 #include "log/log.h"
 #include "log/logger.h"
 
-#define __unused __attribute__((__unused__))
-
 /*
  * returns statistics
  */
@@ -196,7 +194,7 @@
     delete [] buf;
 }
 
-static void caught_signal(int signum __unused) { }
+static void caught_signal(int /* signum */) { }
 
 static void dump_log_msg(const char *prefix,
                          log_msg *msg, unsigned int version, int lid) {
diff --git a/metricsd/etc/weaved/traits/metrics.json b/metricsd/etc/weaved/traits/metrics.json
index 7d17c77..7583270 100644
--- a/metricsd/etc/weaved/traits/metrics.json
+++ b/metricsd/etc/weaved/traits/metrics.json
@@ -1,15 +1,17 @@
 {
   "_metrics": {
     "commands": {
-      "_enableAnalyticsReporting": {
-        "minimalRole": "manager"
+      "enableAnalyticsReporting": {
+        "minimalRole": "manager",
+        "parameters": {}
       },
-      "_disableAnalyticsReporting": {
-        "minimalRole": "manager"
+      "disableAnalyticsReporting": {
+        "minimalRole": "manager",
+        "parameters": {}
       }
     },
     "state": {
-      "_AnalyticsReportingState": {
+      "analyticsReportingState": {
         "type": "string",
         "enum": [ "enabled", "disabled" ]
       }
diff --git a/metricsd/metrics_collector.cc b/metricsd/metrics_collector.cc
index b5c2289..e9edf2e 100644
--- a/metricsd/metrics_collector.cc
+++ b/metricsd/metrics_collector.cc
@@ -229,11 +229,11 @@
   device_->AddComponent(kWeaveComponent, {"_metrics"});
   device_->AddCommandHandler(
       kWeaveComponent,
-      "_metrics._enableAnalyticsReporting",
+      "_metrics.enableAnalyticsReporting",
       base::Bind(&MetricsCollector::OnEnableMetrics, base::Unretained(this)));
   device_->AddCommandHandler(
       kWeaveComponent,
-      "_metrics._disableAnalyticsReporting",
+      "_metrics.disableAnalyticsReporting",
       base::Bind(&MetricsCollector::OnDisableMetrics, base::Unretained(this)));
 
   latest_cpu_use_microseconds_ = cpu_usage_collector_->GetCumulativeCpuUse();
@@ -294,7 +294,7 @@
       metrics_lib_->AreMetricsEnabled() ? "enabled" : "disabled";
 
   if (!device_->SetStateProperty(kWeaveComponent,
-                                 "_metrics._AnalyticsReportingState",
+                                 "_metrics.analyticsReportingState",
                                  enabled,
                                  nullptr)) {
     LOG(ERROR) << "failed to update weave's state";
diff --git a/sdcard/sdcard.c b/sdcard/sdcard.c
index b6bbe7e..45efe36 100644
--- a/sdcard/sdcard.c
+++ b/sdcard/sdcard.c
@@ -507,6 +507,16 @@
     }
 }
 
+static void derive_permissions_recursive_locked(struct fuse* fuse, struct node *parent) {
+    struct node *node;
+    for (node = parent->child; node; node = node->next) {
+        derive_permissions_locked(fuse, parent, node);
+        if (node->child) {
+            derive_permissions_recursive_locked(fuse, node);
+        }
+    }
+}
+
 /* Kernel has already enforced everything we returned through
  * derive_permissions_locked(), so this is used to lock down access
  * even further, such as enforcing that apps hold sdcard_rw. */
@@ -1145,6 +1155,8 @@
     res = rename_node_locked(child_node, new_name, new_actual_name);
     if (!res) {
         remove_node_from_parent_locked(child_node);
+        derive_permissions_locked(fuse, new_parent_node, child_node);
+        derive_permissions_recursive_locked(fuse, child_node);
         add_node_to_parent_locked(child_node, new_parent_node);
     }
     goto done;
@@ -1654,6 +1666,9 @@
     TRACE("read_package_list: found %zu packages\n",
             hashmapSize(global->package_to_appid));
 
+    /* Regenerate ownership details using newly loaded mapping */
+    derive_permissions_recursive_locked(global->fuse_default, &global->root);
+
     pthread_mutex_unlock(&global->lock);
 
     return rc;