diff --git a/adb/services.c b/adb/services.c
index 2875ce0..e61371a 100644
--- a/adb/services.c
+++ b/adb/services.c
@@ -206,7 +206,6 @@
     fprintf(stderr, "error: create_subproc_pty not implemented on Win32 (%s %s %s)\n", cmd, arg0, arg1);
     return -1;
 #else /* !HAVE_WIN32_PROC */
-    char *devname;
     int ptm;
 
     ptm = unix_open("/dev/ptmx", O_RDWR | O_CLOEXEC); // | O_NOCTTY);
@@ -215,8 +214,8 @@
         return -1;
     }
 
-    if(grantpt(ptm) || unlockpt(ptm) ||
-       ((devname = (char*) ptsname(ptm)) == 0)){
+    char devname[64];
+    if(grantpt(ptm) || unlockpt(ptm) || ptsname_r(ptm, devname, sizeof(devname)) != 0) {
         printf("[ trouble with /dev/ptmx - %s ]\n", strerror(errno));
         adb_close(ptm);
         return -1;
diff --git a/debuggerd/tombstone.cpp b/debuggerd/tombstone.cpp
index e447190..df982a9 100644
--- a/debuggerd/tombstone.cpp
+++ b/debuggerd/tombstone.cpp
@@ -210,6 +210,12 @@
       }
     }
   }
+  // Blacklist logd, logd.reader, logd.writer, logd.auditd, logd.control ...
+  static const char logd[] = "logd";
+  if (!strncmp(threadname, logd, sizeof(logd) - 1)
+      && (!threadname[sizeof(logd) - 1] || (threadname[sizeof(logd) - 1] == '.'))) {
+    log->should_retrieve_logcat = false;
+  }
 
   char procnamebuf[1024];
   char* procname = NULL;
@@ -450,6 +456,10 @@
   bool first = true;
   struct logger_list* logger_list;
 
+  if (!log->should_retrieve_logcat) {
+    return;
+  }
+
   logger_list = android_logger_list_open(
       android_name_to_log_id(filename), O_RDONLY | O_NONBLOCK, tail, pid);
 
diff --git a/debuggerd/utility.cpp b/debuggerd/utility.cpp
index a163344..9a30fe3 100644
--- a/debuggerd/utility.cpp
+++ b/debuggerd/utility.cpp
@@ -59,6 +59,8 @@
 void _LOG(log_t* log, enum logtype ltype, const char* fmt, ...) {
   bool write_to_tombstone = (log->tfd != -1);
   bool write_to_logcat = is_allowed_in_logcat(ltype)
+                      && log->crashed_tid != -1
+                      && log->current_tid != -1
                       && (log->crashed_tid == log->current_tid);
   bool write_to_activitymanager = (log->amfd != -1);
 
diff --git a/debuggerd/utility.h b/debuggerd/utility.h
index 518305d..82413b8 100644
--- a/debuggerd/utility.h
+++ b/debuggerd/utility.h
@@ -37,7 +37,7 @@
 #endif
 
 
-typedef struct {
+struct log_t{
     /* tombstone file descriptor */
     int tfd;
     /* Activity Manager socket file descriptor */
@@ -46,7 +46,12 @@
     pid_t crashed_tid;
     // The tid of the thread we are currently working with.
     pid_t current_tid;
-} log_t;
+    // logd daemon crash, can block asking for logcat data, allow suppression.
+    bool should_retrieve_logcat;
+
+    log_t()
+        : tfd(-1), amfd(-1), crashed_tid(-1), current_tid(-1), should_retrieve_logcat(true) {}
+};
 
 // List of types of logs to simplify the logging decision in _LOG
 enum logtype {
diff --git a/include/system/audio.h b/include/system/audio.h
index bf3dee7..719a7c4 100644
--- a/include/system/audio.h
+++ b/include/system/audio.h
@@ -20,6 +20,7 @@
 
 #include <stdbool.h>
 #include <stdint.h>
+#include <stdio.h>
 #include <sys/cdefs.h>
 #include <sys/types.h>
 
@@ -109,6 +110,7 @@
     AUDIO_FLAG_AUDIBILITY_ENFORCED = 0x1,
     AUDIO_FLAG_SECURE              = 0x2,
     AUDIO_FLAG_SCO                 = 0x4,
+    AUDIO_FLAG_BEACON              = 0x8
 };
 
 /* Do not change these values without updating their counterparts
@@ -171,6 +173,11 @@
     AUDIO_SESSION_ALLOCATE = 0,
 } audio_session_t;
 
+/* a unique ID allocated by AudioFlinger for use as a audio_io_handle_t or audio_session_t */
+typedef int audio_unique_id_t;
+
+#define AUDIO_UNIQUE_ID_ALLOCATE AUDIO_SESSION_ALLOCATE
+
 /* Audio sub formats (see enum audio_format). */
 
 /* PCM sub formats */
@@ -739,6 +746,38 @@
     is_streaming: false
 };
 
+/* common audio stream configuration parameters
+ * You should memset() the entire structure to zero before use to
+ * ensure forward compatibility
+ */
+struct audio_config {
+    uint32_t sample_rate;
+    audio_channel_mask_t channel_mask;
+    audio_format_t  format;
+    audio_offload_info_t offload_info;
+    size_t frame_count;
+};
+typedef struct audio_config audio_config_t;
+
+static const audio_config_t AUDIO_CONFIG_INITIALIZER = {
+    sample_rate: 0,
+    channel_mask: AUDIO_CHANNEL_NONE,
+    format: AUDIO_FORMAT_DEFAULT,
+    offload_info: {
+        version: AUDIO_OFFLOAD_INFO_VERSION_CURRENT,
+        size: sizeof(audio_offload_info_t),
+        sample_rate: 0,
+        channel_mask: 0,
+        format: AUDIO_FORMAT_DEFAULT,
+        stream_type: AUDIO_STREAM_VOICE_CALL,
+        bit_rate: 0,
+        duration_us: 0,
+        has_video: false,
+        is_streaming: false
+    },
+    frame_count: 0,
+};
+
 
 /* audio hw module handle functions or structures referencing a module */
 typedef int audio_module_handle_t;
@@ -1292,6 +1331,23 @@
     return size;
 }
 
+/* converts device address to string sent to audio HAL via set_parameters */
+static char *audio_device_address_to_parameter(audio_devices_t device, const char *address)
+{
+    const size_t kSize = AUDIO_DEVICE_MAX_ADDRESS_LEN + sizeof("a2dp_sink_address=");
+    char param[kSize];
+
+    if (device & AUDIO_DEVICE_OUT_ALL_A2DP)
+        snprintf(param, kSize, "%s=%s", "a2dp_sink_address", address);
+    else if (device & AUDIO_DEVICE_OUT_REMOTE_SUBMIX)
+        snprintf(param, kSize, "%s=%s", "mix", address);
+    else
+        snprintf(param, kSize, "%s", address);
+
+    return strdup(param);
+}
+
+
 __END_DECLS
 
 #endif  // ANDROID_AUDIO_CORE_H
diff --git a/include/system/graphics.h b/include/system/graphics.h
index 74d790f..c3fca97 100644
--- a/include/system/graphics.h
+++ b/include/system/graphics.h
@@ -202,15 +202,16 @@
      *
      * This format is exposed outside of the camera HAL to applications.
      *
-     * RAW10 is a single-channel, 10-bit per pixel, densely packed, unprocessed
-     * format, representing raw Bayer-pattern images coming from an image sensor.
+     * RAW10 is a single-channel, 10-bit per pixel, densely packed in each row,
+     * unprocessed format, usually representing raw Bayer-pattern images coming from
+     * an image sensor.
      *
-     * In an image buffer with this format, starting from the first pixel, each 4
-     * consecutive pixels are packed into 5 bytes (40 bits). Each one of the first
-     * 4 bytes contains the top 8 bits of each pixel, The fifth byte contains the
-     * 2 least significant bits of the 4 pixels, the exact layout data for each 4
-     * consecutive pixels is illustrated below (Pi[j] stands for the jth bit of
-     * the ith pixel):
+     * In an image buffer with this format, starting from the first pixel of each
+     * row, each 4 consecutive pixels are packed into 5 bytes (40 bits). Each one
+     * of the first 4 bytes contains the top 8 bits of each pixel, The fifth byte
+     * contains the 2 least significant bits of the 4 pixels, the exact layout data
+     * for each 4 consecutive pixels is illustrated below (Pi[j] stands for the jth
+     * bit of the ith pixel):
      *
      *          bit 7                                     bit 0
      *          =====|=====|=====|=====|=====|=====|=====|=====|
@@ -228,11 +229,15 @@
      * This format assumes
      * - a width multiple of 4 pixels
      * - an even height
-     * - a horizontal stride equal to the width
      * - a vertical stride equal to the height
-     * - strides are specified in pixels, not in bytes
+     * - strides are specified in bytes, not in pixels
      *
-     *   size = stride * height * 10 / 8
+     *   size = stride * height
+     *
+     * When stride is equal to width * (10 / 8), there will be no padding bytes at
+     * the end of each row, the entire image data is densely packed. When stride is
+     * larger than width * (10 / 8), padding bytes will be present at the end of each
+     * row (including the last row).
      *
      * This format must be accepted by the gralloc module when used with the
      * following usage flags:
diff --git a/init/readme.txt b/init/readme.txt
index 613a9e9..26be536 100644
--- a/init/readme.txt
+++ b/init/readme.txt
@@ -257,9 +257,9 @@
   or the timeout has been reached. If timeout is not specified it
   currently defaults to five seconds.
 
-write <path> <string> [ <string> ]*
-   Open the file at <path> and write one or more strings
-   to it with write(2)
+write <path> <string>
+   Open the file at <path> and write a string to it with write(2)
+   without appending.
 
 
 Properties
diff --git a/libutils/BlobCache.cpp b/libutils/BlobCache.cpp
index f00bf14..8edb401 100644
--- a/libutils/BlobCache.cpp
+++ b/libutils/BlobCache.cpp
@@ -213,7 +213,14 @@
         memcpy(eheader->mData, keyBlob->getData(), keySize);
         memcpy(eheader->mData + keySize, valueBlob->getData(), valueSize);
 
-        byteOffset += align4(entrySize);
+        size_t totalSize = align4(entrySize);
+        if (totalSize > entrySize) {
+            // We have padding bytes. Those will get written to storage, and contribute to the CRC,
+            // so make sure we zero-them to have reproducible results.
+            memset(eheader->mData + keySize + valueSize, 0, totalSize - entrySize);
+        }
+
+        byteOffset += totalSize;
     }
 
     return OK;
diff --git a/libziparchive/zip_archive.cc b/libziparchive/zip_archive.cc
index 128bad4..6ec8f0d 100644
--- a/libziparchive/zip_archive.cc
+++ b/libziparchive/zip_archive.cc
@@ -287,7 +287,7 @@
  */
 struct ZipArchive {
   /* open Zip archive */
-  int fd;
+  const int fd;
 
   /* mapped central directory area */
   off64_t directory_offset;
@@ -304,6 +304,25 @@
    */
   uint32_t hash_table_size;
   ZipEntryName* hash_table;
+
+  ZipArchive(const int fd) :
+      fd(fd),
+      directory_offset(0),
+      directory_map(NULL),
+      num_entries(0),
+      hash_table_size(0),
+      hash_table(NULL) {}
+
+  ~ZipArchive() {
+    if (fd >= 0) {
+      close(fd);
+    }
+
+    if (directory_map != NULL) {
+      directory_map->release();
+    }
+    free(hash_table);
+  }
 };
 
 // Returns 0 on success and negative values on failure.
@@ -661,28 +680,20 @@
 
 int32_t OpenArchiveFd(int fd, const char* debug_file_name,
                       ZipArchiveHandle* handle) {
-  ZipArchive* archive = (ZipArchive*) malloc(sizeof(ZipArchive));
-  memset(archive, 0, sizeof(*archive));
+  ZipArchive* archive = new ZipArchive(fd);
   *handle = archive;
-
-  archive->fd = fd;
-
   return OpenArchiveInternal(archive, debug_file_name);
 }
 
 int32_t OpenArchive(const char* fileName, ZipArchiveHandle* handle) {
-  ZipArchive* archive = (ZipArchive*) malloc(sizeof(ZipArchive));
-  memset(archive, 0, sizeof(*archive));
+  const int fd = open(fileName, O_RDONLY | O_BINARY, 0);
+  ZipArchive* archive = new ZipArchive(fd);
   *handle = archive;
 
-  const int fd = open(fileName, O_RDONLY | O_BINARY, 0);
   if (fd < 0) {
     ALOGW("Unable to open '%s': %s", fileName, strerror(errno));
     return kIoError;
-  } else {
-    archive->fd = fd;
   }
-
   return OpenArchiveInternal(archive, fileName);
 }
 
@@ -692,16 +703,7 @@
 void CloseArchive(ZipArchiveHandle handle) {
   ZipArchive* archive = (ZipArchive*) handle;
   ALOGV("Closing archive %p", archive);
-
-  if (archive->fd >= 0) {
-    close(archive->fd);
-  }
-
-  if (archive->directory_map != NULL) {
-    archive->directory_map->release();
-  }
-  free(archive->hash_table);
-  free(archive);
+  delete archive;
 }
 
 static int32_t UpdateEntryFromDataDescriptor(int fd,
diff --git a/libziparchive/zip_archive_test.cc b/libziparchive/zip_archive_test.cc
index 875b6de..813a87f 100644
--- a/libziparchive/zip_archive_test.cc
+++ b/libziparchive/zip_archive_test.cc
@@ -26,6 +26,7 @@
 
 static std::string test_data_dir;
 
+static const std::string kMissingZip = "missing.zip";
 static const std::string kValidZip = "valid.zip";
 
 static const uint8_t kATxtContents[] = {
@@ -58,6 +59,14 @@
   CloseArchive(handle);
 }
 
+TEST(ziparchive, OpenMissing) {
+  ZipArchiveHandle handle;
+  ASSERT_NE(0, OpenArchiveWrapper(kMissingZip, &handle));
+
+  // Confirm the file descriptor is not going to be mistaken for a valid one.
+  ASSERT_EQ(-1, GetFileDescriptor(handle));
+}
+
 TEST(ziparchive, Iteration) {
   ZipArchiveHandle handle;
   ASSERT_EQ(0, OpenArchiveWrapper(kValidZip, &handle));
diff --git a/logwrapper/logwrap.c b/logwrapper/logwrap.c
index d47c9b5..3a6276e 100644
--- a/logwrapper/logwrap.c
+++ b/logwrapper/logwrap.c
@@ -477,7 +477,6 @@
     pid_t pid;
     int parent_ptty;
     int child_ptty;
-    char *child_devname = NULL;
     struct sigaction intact;
     struct sigaction quitact;
     sigset_t blockset;
@@ -498,8 +497,9 @@
         goto err_open;
     }
 
+    char child_devname[64];
     if (grantpt(parent_ptty) || unlockpt(parent_ptty) ||
-            ((child_devname = (char*)ptsname(parent_ptty)) == 0)) {
+            ptsname_r(parent_ptty, child_devname, sizeof(child_devname)) != 0) {
         ERROR("Problem with /dev/ptmx\n");
         rc = -1;
         goto err_ptty;