diff --git a/init/builtins.c b/init/builtins.c
index cc7c9d1..1e7cb4e 100644
--- a/init/builtins.c
+++ b/init/builtins.c
@@ -131,6 +131,18 @@
     }
 }
 
+int do_chdir(int nargs, char **args)
+{
+    chdir(args[1]);
+    return 0;
+}
+
+int do_chroot(int nargs, char **args)
+{
+    chroot(args[1]);
+    return 0;
+}
+
 int do_class_start(int nargs, char **args)
 {
         /* Starting a class does not start services
@@ -206,7 +218,7 @@
 
 int do_import(int nargs, char **args)
 {
-    return -1;
+    return parse_config_file(args[1]);
 }
 
 int do_mkdir(int nargs, char **args)
@@ -400,6 +412,8 @@
 
 int do_trigger(int nargs, char **args)
 {
+    action_for_each_trigger(args[1], action_add_queue_tail);
+    drain_action_queue();
     return 0;
 }
 
diff --git a/init/devices.c b/init/devices.c
index c2c9353..8f2f4ef 100644
--- a/init/devices.c
+++ b/init/devices.c
@@ -125,6 +125,7 @@
     { "/dev/pmem_camera",   0660,   AID_SYSTEM,     AID_CAMERA,     1 },
     { "/dev/oncrpc/",       0660,   AID_ROOT,       AID_SYSTEM,     1 },
     { "/dev/adsp/",         0660,   AID_SYSTEM,     AID_AUDIO,      1 },
+    { "/dev/snd/",          0660,   AID_SYSTEM,     AID_AUDIO,      1 },
     { "/dev/mt9t013",       0660,   AID_SYSTEM,     AID_SYSTEM,     0 },
     { "/dev/msm_camera/",   0660,   AID_SYSTEM,     AID_SYSTEM,     1 },
     { "/dev/akm8976_daemon",0640,   AID_COMPASS,    AID_SYSTEM,     0 },
@@ -312,7 +313,7 @@
     chown(path, uid, gid);
 }
 
-#ifdef LOG_UEVENTS
+#if LOG_UEVENTS
 
 static inline suseconds_t get_usecs(void)
 {
diff --git a/init/init.c b/init/init.c
old mode 100644
new mode 100755
index 8c2a058..f76eb36
--- a/init/init.c
+++ b/init/init.c
@@ -65,8 +65,6 @@
 static int keychords_count = 0;
 static int keychords_length = 0;
 
-static void drain_action_queue(void);
-
 static void notify_service_state(const char *name, const char *state)
 {
     char pname[PROP_NAME_MAX];
@@ -391,12 +389,13 @@
         }
     }
 
+    svc->flags |= SVC_RESTARTING;
+
     /* Execute all onrestart commands for this service. */
     list_for_each(node, &svc->onrestart.commands) {
         cmd = node_to_item(node, struct command, clist);
         cmd->func(cmd->nargs, cmd->args);
     }
-    svc->flags |= SVC_RESTARTING;
     notify_service_state(svc->name, "restarting");
     return 0;
 }
@@ -667,7 +666,7 @@
     }
 }
 
-static void drain_action_queue(void)
+void drain_action_queue(void)
 {
     struct listnode *node;
     struct command *cmd;
diff --git a/init/init.h b/init/init.h
index f306b7b..60c3055 100644
--- a/init/init.h
+++ b/init/init.h
@@ -165,6 +165,7 @@
 void service_start(struct service *svc, const char *dynamic_args);
 void property_changed(const char *name, const char *value);
 
+void drain_action_queue(void);
 struct action *action_remove_queue_head(void);
 void action_add_queue_tail(struct action *act);
 void action_for_each_trigger(const char *trigger,
diff --git a/init/keywords.h b/init/keywords.h
index 641426c..308118e 100644
--- a/init/keywords.h
+++ b/init/keywords.h
@@ -1,5 +1,7 @@
 
 #ifndef KEYWORD
+int do_chroot(int nargs, char **args);
+int do_chdir(int nargs, char **args);
 int do_class_start(int nargs, char **args);
 int do_class_stop(int nargs, char **args);
 int do_domainname(int nargs, char **args);
@@ -32,6 +34,8 @@
     K_UNKNOWN,
 #endif
     KEYWORD(capability,  OPTION,  0, 0)
+    KEYWORD(chdir,       COMMAND, 1, do_chdir)
+    KEYWORD(chroot,      COMMAND, 1, do_chroot)
     KEYWORD(class,       OPTION,  0, 0)
     KEYWORD(class_start, COMMAND, 1, do_class_start)
     KEYWORD(class_stop,  COMMAND, 1, do_class_stop)
diff --git a/init/parser.c b/init/parser.c
index affc80c..54622cc 100644
--- a/init/parser.c
+++ b/init/parser.c
@@ -129,6 +129,8 @@
     case 'c':
 	if (!strcmp(s, "opy")) return K_copy;
         if (!strcmp(s, "apability")) return K_capability;
+        if (!strcmp(s, "hdir")) return K_chdir;
+        if (!strcmp(s, "hroot")) return K_chroot;
         if (!strcmp(s, "lass")) return K_class;
         if (!strcmp(s, "lass_start")) return K_class_start;
         if (!strcmp(s, "lass_stop")) return K_class_stop;
diff --git a/init/readme.txt b/init/readme.txt
index 665090b..a185790 100644
--- a/init/readme.txt
+++ b/init/readme.txt
@@ -145,12 +145,18 @@
 hostname <name>
    Set the host name.
 
+chdir <directory>
+   Change working directory.
+
 chmod <octal-mode> <path>
    Change file access permissions.
 
 chown <owner> <group> <path>
    Change file owner and group.
 
+chroot <directory>
+  Change process root directory.
+
 class_start <serviceclass>
    Start all services of the specified class if they are
    not already running.
diff --git a/libcutils/atomic-android-arm.S b/libcutils/atomic-android-arm.S
index f4299fd..4da6195 100644
--- a/libcutils/atomic-android-arm.S
+++ b/libcutils/atomic-android-arm.S
@@ -17,8 +17,7 @@
 #include <machine/cpu-features.h>
 
 /*
- * NOTE: these atomic operations are SMP safe on all architectures, 
- * except swap(), see below.
+ * NOTE: these atomic operations are SMP safe on all architectures. 
  */
 
 	.text
@@ -213,11 +212,18 @@
  * output: r0 = old value
  */
 
-/* FIXME: this is not safe on SMP systems 
- * a general way to do it is to use kernel_cmpxchg */
-
+/* replaced swp instruction with ldrex/strex for ARMv6 & ARMv7 */
 android_atomic_swap:
+#if defined (_ARM_HAVE_LDREX_STREX)
+1:  ldrex   r2, [r1]
+    strex   r3, r0, [r1]
+    teq     r3, #0
+    bne     1b
+    mov     r0, r2
+    mcr     p15, 0, r0, c7, c10, 5 /* or, use dmb */
+#else
     swp     r0, r0, [r1]
+#endif
     bx      lr
 
 /*
diff --git a/rootdir/etc/init.goldfish.sh b/rootdir/etc/init.goldfish.sh
index f1b801d..5ff0a3a 100755
--- a/rootdir/etc/init.goldfish.sh
+++ b/rootdir/etc/init.goldfish.sh
@@ -3,16 +3,20 @@
 ifconfig eth0 10.0.2.15 netmask 255.255.255.0 up
 route add default gw 10.0.2.2 dev eth0
 
-qemud=`getprop.ro.kernel.android.qemud`
-if test -z "$qemud"; then
+qemud=`getprop ro.kernel.android.qemud`
+case "$qemud" in
+    "")
     radio_ril=`getprop ro.kernel.android.ril`
-    if test -z "$radio_ril"; then
+    case "$radio_ril" in
+        "")
         # no need for the radio interface daemon
         # telephony is entirely emulated in Java
         setprop ro.radio.noril yes
         stop ril-daemon
-    fi
-fi
+        ;;
+    esac
+    ;;
+esac
 
 num_dns=`getprop ro.kernel.android.ndns`
 case "$num_dns" in
diff --git a/vold/blkdev.c b/vold/blkdev.c
index e10eafc..2c5681a 100644
--- a/vold/blkdev.c
+++ b/vold/blkdev.c
@@ -112,7 +112,7 @@
             goto out;
         }
 
-        for (i = 0; i < 4; i++) {
+        for (i = 0; i < NDOSPART; i++) {
             struct dos_partition part;
 
             dos_partition_dec(block + DOSPARTOFF + i * sizeof(struct dos_partition), &part);
@@ -134,7 +134,7 @@
         struct dos_partition part;
         int part_no = blk->minor -1;
 
-        if (part_no < 4) {
+        if (part_no < NDOSPART) {
             dos_partition_dec(block + DOSPARTOFF + part_no * sizeof(struct dos_partition), &part);
             blk->part_type = part.dp_typ;
         } else {
diff --git a/vold/mmc.c b/vold/mmc.c
index b321c80..d90845d 100644
--- a/vold/mmc.c
+++ b/vold/mmc.c
@@ -25,6 +25,7 @@
 #include "vold.h"
 #include "mmc.h"
 #include "media.h"
+#include "diskmbr.h" /* for NDOSPART */
 
 #define DEBUG_BOOTSTRAP 0
 
@@ -157,6 +158,10 @@
 
     sprintf(filename, "/sys%s/name", devpath);
     p = read_file(filename, &sz);
+    if (!p) {
+        LOGE("Unable to read MMC name: %s", filename);
+        return -errno;
+    }
     p[strlen(p) - 1] = '\0';
     sprintf(tmp, "MMC_NAME=%s", p);
     free(p);
@@ -233,7 +238,7 @@
          *mmcblk_devname != '/'; mmcblk_devname--);
     mmcblk_devname++;
 
-    for (part_no = 0; part_no < 4; part_no++) {
+    for (part_no = 1; part_no <= NDOSPART; part_no++) {
         char part_file[255];
         sprintf(part_file, "/sys%s/%sp%d", devpath, mmcblk_devname, part_no);
         if (!access(part_file, F_OK)) {