diff --git a/Android.mk b/Android.mk
index a307719..7c57258 100644
--- a/Android.mk
+++ b/Android.mk
@@ -15,17 +15,4 @@
 #
 LOCAL_PATH := $(my-dir)
 
-ifneq ($(TARGET_SIMULATOR),true)
-  include $(call first-makefiles-under,$(LOCAL_PATH))
-else
-  include $(addprefix $(LOCAL_PATH)/,$(addsuffix /Android.mk, \
-	      adb \
-	      libcutils \
-	      libsysutils \
-	      liblog \
-	      libnetutils \
-	      libpixelflinger \
-	      libusbhost \
-	      libzipfile \
-	   ))
-endif
+include $(call first-makefiles-under,$(LOCAL_PATH))
diff --git a/adb/Android.mk b/adb/Android.mk
index 2ac9335..7744d2b 100644
--- a/adb/Android.mk
+++ b/adb/Android.mk
@@ -95,11 +95,7 @@
 # adbd device daemon
 # =========================================================
 
-# build adbd in all non-simulator builds
-BUILD_ADBD := false
-ifneq ($(TARGET_SIMULATOR),true)
-    BUILD_ADBD := true
-endif
+BUILD_ADBD := true
 
 # build adbd for the Linux simulator build
 # so we can use it to test the adb USB gadget driver on x86
@@ -143,21 +139,14 @@
 LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT_SBIN)
 LOCAL_UNSTRIPPED_PATH := $(TARGET_ROOT_OUT_SBIN_UNSTRIPPED)
 
-ifeq ($(TARGET_SIMULATOR),true)
-  LOCAL_STATIC_LIBRARIES := libcutils
-  LOCAL_LDLIBS += -lpthread
-  include $(BUILD_HOST_EXECUTABLE)
-else
-  LOCAL_STATIC_LIBRARIES := libcutils libc
-  include $(BUILD_EXECUTABLE)
-endif
+LOCAL_STATIC_LIBRARIES := libcutils libc
+include $(BUILD_EXECUTABLE)
 
 endif
 
 
 # adb host tool for device-as-host
 # =========================================================
-ifneq ($(TARGET_SIMULATOR),true)
 ifneq ($(SDK_ONLY),true)
 include $(CLEAR_VARS)
 
@@ -196,4 +185,3 @@
 
 include $(BUILD_EXECUTABLE)
 endif
-endif
diff --git a/include/cutils/qtaguid.h b/include/cutils/qtaguid.h
new file mode 100644
index 0000000..8aa34ea
--- /dev/null
+++ b/include/cutils/qtaguid.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CUTILS_QTAGUID_H
+#define __CUTILS_QTAGUID_H
+
+#include <stdint.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Set tags (and owning UIDs) for network sockets.
+*/
+extern int set_qtaguid(int sockfd, int tag, uid_t uid);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __CUTILS_QTAG_UID_H */
diff --git a/include/netutils/ifc.h b/include/netutils/ifc.h
index 36827ee..575e72e 100644
--- a/include/netutils/ifc.h
+++ b/include/netutils/ifc.h
@@ -34,7 +34,7 @@
 extern int ifc_enable(const char *ifname);
 extern int ifc_disable(const char *ifname);
 
-extern int ifc_reset_connections(const char *ifname);
+extern int ifc_reset_connections(const char *ifname, const int reset_mask);
 
 extern int ifc_get_addr(const char *name, in_addr_t *addr);
 extern int ifc_set_addr(const char *name, in_addr_t addr);
diff --git a/include/private/android_filesystem_config.h b/include/private/android_filesystem_config.h
index 55d9220..fc71a1e 100644
--- a/include/private/android_filesystem_config.h
+++ b/include/private/android_filesystem_config.h
@@ -53,7 +53,7 @@
 #define AID_KEYSTORE      1017  /* keystore subsystem */
 #define AID_USB           1018  /* USB devices */
 #define AID_DRM           1019  /* DRM server */
-#define AID_KEYCHAIN      1020  /* keychain service */
+#define AID_AVAILABLE     1020  /* available for use */
 #define AID_GPS           1021  /* GPS daemon */
 #define AID_UNUSED1       1022  /* deprecated, DO NOT USE */
 #define AID_MEDIA_RW      1023  /* internal media storage write access */
@@ -71,6 +71,8 @@
 #define AID_INET          3003  /* can create AF_INET and AF_INET6 sockets */
 #define AID_NET_RAW       3004  /* can create raw INET sockets */
 #define AID_NET_ADMIN     3005  /* can configure interfaces and routing tables. */
+#define AID_NET_BW_STATS  3006  /* read bandwidth statistics */
+#define AID_NET_BW_ACCT   3007  /* change bandwidth statistics accounting */
 
 #define AID_MISC          9998  /* access to misc storage */
 #define AID_NOBODY        9999
@@ -101,7 +103,7 @@
     { "install",   AID_INSTALL, },
     { "media",     AID_MEDIA, },
     { "drm",       AID_DRM, },
-    { "keychain",  AID_KEYCHAIN, },
+    { "available", AID_AVAILABLE, },
     { "nfc",       AID_NFC, },
     { "shell",     AID_SHELL, },
     { "cache",     AID_CACHE, },
@@ -118,6 +120,8 @@
     { "inet",      AID_INET, },
     { "net_raw",   AID_NET_RAW, },
     { "net_admin", AID_NET_ADMIN, },
+    { "net_bw_stats", AID_NET_BW_STATS, },
+    { "net_bw_acct", AID_NET_BW_ACCT, },
     { "misc",      AID_MISC, },
     { "nobody",    AID_NOBODY, },
 };
diff --git a/include/system/window.h b/include/system/window.h
index 5762a50..edb3002 100644
--- a/include/system/window.h
+++ b/include/system/window.h
@@ -108,8 +108,8 @@
 /* attributes queriable with query() */
 enum {
     NATIVE_WINDOW_WIDTH     = 0,
-    NATIVE_WINDOW_HEIGHT,
-    NATIVE_WINDOW_FORMAT,
+    NATIVE_WINDOW_HEIGHT    = 1,
+    NATIVE_WINDOW_FORMAT    = 2,
 
     /* The minimum number of buffers that must remain un-dequeued after a buffer
      * has been queued.  This value applies only if set_buffer_count was used to
@@ -129,7 +129,7 @@
      * 4. Cancel M buffers
      * 5. Queue, dequeue, queue, dequeue, ad infinitum
      */
-    NATIVE_WINDOW_MIN_UNDEQUEUED_BUFFERS,
+    NATIVE_WINDOW_MIN_UNDEQUEUED_BUFFERS = 3,
 
     /* Check whether queueBuffer operations on the ANativeWindow send the buffer
      * to the window compositor.  The query sets the returned 'value' argument
@@ -144,7 +144,7 @@
      * mechanism (e.g. the GRALLOC_USAGE_PROTECTED flag) should be used in
      * conjunction with this query.
      */
-    NATIVE_WINDOW_QUEUES_TO_WINDOW_COMPOSER,
+    NATIVE_WINDOW_QUEUES_TO_WINDOW_COMPOSER = 4,
 
     /* Get the concrete type of a ANativeWindow.  See below for the list of
      * possible return values.
@@ -152,24 +152,45 @@
      * This query should not be used outside the Android framework and will
      * likely be removed in the near future.
      */
-    NATIVE_WINDOW_CONCRETE_TYPE,
+    NATIVE_WINDOW_CONCRETE_TYPE = 5,
 };
 
 /* valid operations for the (*perform)() hook */
 enum {
-    NATIVE_WINDOW_SET_USAGE  = 0,
-    NATIVE_WINDOW_CONNECT,
-    NATIVE_WINDOW_DISCONNECT,
-    NATIVE_WINDOW_SET_CROP,
-    NATIVE_WINDOW_SET_BUFFER_COUNT,
-    NATIVE_WINDOW_SET_BUFFERS_GEOMETRY,
-    NATIVE_WINDOW_SET_BUFFERS_TRANSFORM,
-    NATIVE_WINDOW_SET_BUFFERS_TIMESTAMP,
+    NATIVE_WINDOW_SET_USAGE                 =  0,
+    NATIVE_WINDOW_CONNECT                   =  1,
+    NATIVE_WINDOW_DISCONNECT                =  2,
+    NATIVE_WINDOW_SET_CROP                  =  3,
+    NATIVE_WINDOW_SET_BUFFER_COUNT          =  4,
+    NATIVE_WINDOW_SET_BUFFERS_GEOMETRY      =  5,   /* deprecated */
+    NATIVE_WINDOW_SET_BUFFERS_TRANSFORM     =  6,
+    NATIVE_WINDOW_SET_BUFFERS_TIMESTAMP     =  7,
+    NATIVE_WINDOW_SET_BUFFERS_DIMENSIONS    =  8,
+    NATIVE_WINDOW_SET_BUFFERS_FORMAT        =  9,
+    NATIVE_WINDOW_SET_SCALING_MODE          = 10,
+    NATIVE_WINDOW_LOCK                      = 11,   /* private */
+    NATIVE_WINDOW_UNLOCK_AND_POST           = 12,   /* private */
 };
 
 /* parameter for NATIVE_WINDOW_[DIS]CONNECT */
 enum {
-    NATIVE_WINDOW_API_EGL = 1
+    /* Buffers will be queued by EGL via eglSwapBuffers after being filled using
+     * OpenGL ES.
+     */
+    NATIVE_WINDOW_API_EGL = 1,
+
+    /* Buffers will be queued after being filled using the CPU
+     */
+    NATIVE_WINDOW_API_CPU = 2,
+
+    /* Buffers will be queued by Stagefright after being filled by a video
+     * decoder.  The video decoder can either be a software or hardware decoder.
+     */
+    NATIVE_WINDOW_API_MEDIA = 3,
+
+    /* Buffers will be queued by the the camera HAL.
+     */
+    NATIVE_WINDOW_API_CAMERA = 4,
 };
 
 /* parameter for NATIVE_WINDOW_SET_BUFFERS_TRANSFORM */
@@ -186,11 +207,21 @@
     NATIVE_WINDOW_TRANSFORM_ROT_270 = HAL_TRANSFORM_ROT_270,
 };
 
+/* parameter for NATIVE_WINDOW_SET_SCALING_MODE */
+enum {
+    /* the window content is not updated (frozen) until a buffer of
+     * the window size is received (enqueued)
+     */
+    NATIVE_WINDOW_SCALING_MODE_FREEZE           = 0,
+    /* the buffer is scaled in both dimensions to match the window size */
+    NATIVE_WINDOW_SCALING_MODE_SCALE_TO_WINDOW  = 1,
+};
+
 /* values returned by the NATIVE_WINDOW_CONCRETE_TYPE query */
 enum {
-    NATIVE_WINDOW_FRAMEBUFFER,                  // FramebufferNativeWindow
-    NATIVE_WINDOW_SURFACE,                      // Surface
-    NATIVE_WINDOW_SURFACE_TEXTURE_CLIENT,       // SurfaceTextureClient
+    NATIVE_WINDOW_FRAMEBUFFER               = 0, /* FramebufferNativeWindow */
+    NATIVE_WINDOW_SURFACE                   = 1, /* Surface */
+    NATIVE_WINDOW_SURFACE_TEXTURE_CLIENT    = 2, /* SurfaceTextureClient */
 };
 
 /* parameter for NATIVE_WINDOW_SET_BUFFERS_TIMESTAMP
@@ -212,8 +243,8 @@
         memset(common.reserved, 0, sizeof(common.reserved));
     }
 
-    // Implement the methods that sp<ANativeWindow> expects so that it
-    // can be used to automatically refcount ANativeWindow's.
+    /* Implement the methods that sp<ANativeWindow> expects so that it
+       can be used to automatically refcount ANativeWindow's. */
     void incStrong(const void* id) const {
         common.incRef(const_cast<android_native_base_t*>(&common));
     }
@@ -303,9 +334,14 @@
      *     NATIVE_WINDOW_DISCONNECT
      *     NATIVE_WINDOW_SET_CROP
      *     NATIVE_WINDOW_SET_BUFFER_COUNT
-     *     NATIVE_WINDOW_SET_BUFFERS_GEOMETRY
+     *     NATIVE_WINDOW_SET_BUFFERS_GEOMETRY  (deprecated)
      *     NATIVE_WINDOW_SET_BUFFERS_TRANSFORM
      *     NATIVE_WINDOW_SET_BUFFERS_TIMESTAMP
+     *     NATIVE_WINDOW_SET_BUFFERS_DIMENSIONS
+     *     NATIVE_WINDOW_SET_BUFFERS_FORMAT
+     *     NATIVE_WINDOW_SET_SCALING_MODE
+     *     NATIVE_WINDOW_LOCK                   (private)
+     *     NATIVE_WINDOW_UNLOCK_AND_POST        (private)
      *
      */
 
@@ -404,16 +440,12 @@
 
 /*
  * native_window_set_buffers_geometry(..., int w, int h, int format)
- * All buffers dequeued after this call will have the geometry specified.
- * In particular, all buffers will have a fixed-size, independent form the
- * native-window size. They will be appropriately scaled to the window-size
- * upon composition.
+ * All buffers dequeued after this call will have the dimensions and format
+ * specified.  A successful call to this function has the same effect as calling
+ * native_window_set_buffers_size and native_window_set_buffers_format.
  *
- * If all parameters are 0, the normal behavior is restored. That is,
- * dequeued buffers following this call will be sized to the window's size.
- *
- * Calling this function will reset the window crop to a NULL value, which
- * disables cropping of the buffers.
+ * XXX: This function is deprecated.  The native_window_set_buffers_dimensions
+ * and native_window_set_buffers_format functions should be used instead.
  */
 static inline int native_window_set_buffers_geometry(
         struct ANativeWindow* window,
@@ -424,6 +456,40 @@
 }
 
 /*
+ * native_window_set_buffers_dimensions(..., int w, int h)
+ * All buffers dequeued after this call will have the dimensions specified.
+ * In particular, all buffers will have a fixed-size, independent form the
+ * native-window size. They will be scaled according to the scaling mode
+ * (see native_window_set_scaling_mode) upon window composition.
+ *
+ * If w and h are 0, the normal behavior is restored. That is, dequeued buffers
+ * following this call will be sized to match the window's size.
+ *
+ * Calling this function will reset the window crop to a NULL value, which
+ * disables cropping of the buffers.
+ */
+static inline int native_window_set_buffers_dimensions(
+        struct ANativeWindow* window,
+        int w, int h)
+{
+    return window->perform(window, NATIVE_WINDOW_SET_BUFFERS_DIMENSIONS,
+            w, h);
+}
+
+/*
+ * native_window_set_buffers_format(..., int format)
+ * All buffers dequeued after this call will have the format specified.
+ *
+ * If the specified format is 0, the default buffer format will be used.
+ */
+static inline int native_window_set_buffers_format(
+        struct ANativeWindow* window,
+        int format)
+{
+    return window->perform(window, NATIVE_WINDOW_SET_BUFFERS_FORMAT, format);
+}
+
+/*
  * native_window_set_buffers_transform(..., int transform)
  * All buffers queued after this call will be displayed transformed according
  * to the transform parameter specified.
@@ -441,8 +507,10 @@
  * All buffers queued after this call will be associated with the timestamp
  * parameter specified. If the timestamp is set to NATIVE_WINDOW_TIMESTAMP_AUTO
  * (the default), timestamps will be generated automatically when queueBuffer is
- * called. The timestamp is measured in nanoseconds, and must be monotonically
- * increasing.
+ * called. The timestamp is measured in nanoseconds, and is normally monotonically
+ * increasing. The timestamp should be unaffected by time-of-day adjustments,
+ * and for a camera should be strictly monotonic but for a media player may be
+ * reset when the position is set.
  */
 static inline int native_window_set_buffers_timestamp(
         struct ANativeWindow* window,
@@ -452,6 +520,19 @@
             timestamp);
 }
 
+/*
+ * native_window_set_scaling_mode(..., int mode)
+ * All buffers queued after this call will be associated with the scaling mode
+ * specified.
+ */
+static inline int native_window_set_scaling_mode(
+        struct ANativeWindow* window,
+        int mode)
+{
+    return window->perform(window, NATIVE_WINDOW_SET_SCALING_MODE,
+            mode);
+}
+
 __END_DECLS
 
 #endif /* SYSTEM_CORE_INCLUDE_ANDROID_WINDOW_H */
diff --git a/init/builtins.c b/init/builtins.c
index bfdd654..06ef96d 100644
--- a/init/builtins.c
+++ b/init/builtins.c
@@ -229,6 +229,7 @@
 int do_mkdir(int nargs, char **args)
 {
     mode_t mode = 0755;
+    int ret;
 
     /* mkdir <path> [mode] [owner] [group] */
 
@@ -236,7 +237,12 @@
         mode = strtoul(args[2], 0, 8);
     }
 
-    if (mkdir(args[1], mode)) {
+    ret = mkdir(args[1], mode);
+    /* chmod in case the directory already exists */
+    if (ret == -1 && errno == EEXIST) {
+        ret = chmod(args[1], mode);
+    }
+    if (ret == -1) {
         return -errno;
     }
 
diff --git a/init/property_service.c b/init/property_service.c
index c8d6c09..046b120 100644
--- a/init/property_service.c
+++ b/init/property_service.c
@@ -75,8 +75,6 @@
     { "wlan.",            AID_SYSTEM,   0 },
     { "dhcp.",            AID_SYSTEM,   0 },
     { "dhcp.",            AID_DHCP,     0 },
-    { "vpn.",             AID_SYSTEM,   0 },
-    { "vpn.",             AID_VPN,      0 },
     { "debug.",           AID_SHELL,    0 },
     { "log.",             AID_SHELL,    0 },
     { "service.adb.root", AID_SHELL,    0 },
@@ -374,11 +372,11 @@
         return;
     }
 
-    r = recv(s, &msg, sizeof(msg), 0);
+    r = TEMP_FAILURE_RETRY(recv(s, &msg, sizeof(msg), 0));
     if(r != sizeof(prop_msg)) {
+        ERROR("sys_prop: mis-match msg size recieved: %d expected: %d errno: %d\n",
+              r, sizeof(prop_msg), errno);
         close(s);
-        ERROR("sys_prop: mis-match msg size recieved: %d expected: %d\n",
-              r, sizeof(prop_msg));
         return;
     }
 
diff --git a/libcutils/Android.mk b/libcutils/Android.mk
index 29864b2..0c4e235 100644
--- a/libcutils/Android.mk
+++ b/libcutils/Android.mk
@@ -93,25 +93,11 @@
 include $(BUILD_HOST_STATIC_LIBRARY)
 
 
-ifeq ($(TARGET_SIMULATOR),true)
-
-# Shared library for simulator
-# ========================================================
-include $(CLEAR_VARS)
-LOCAL_MODULE := libcutils
-LOCAL_SRC_FILES := $(commonSources) $(commonHostSources) memory.c dlmalloc_stubs.c
-LOCAL_LDLIBS := -lpthread
-LOCAL_SHARED_LIBRARIES := liblog
-LOCAL_CFLAGS += $(targetSmpFlag)
-include $(BUILD_SHARED_LIBRARY)
-
-else #!sim
-
 # Shared and static library for target
 # ========================================================
 include $(CLEAR_VARS)
 LOCAL_MODULE := libcutils
-LOCAL_SRC_FILES := $(commonSources) ashmem-dev.c mq.c android_reboot.c partition_utils.c uevent.c
+LOCAL_SRC_FILES := $(commonSources) ashmem-dev.c mq.c android_reboot.c partition_utils.c uevent.c qtaguid.c
 
 ifeq ($(TARGET_ARCH),arm)
 LOCAL_SRC_FILES += arch-arm/memset32.S
@@ -147,5 +133,3 @@
 LOCAL_SHARED_LIBRARIES := liblog
 LOCAL_MODULE_TAGS := optional
 include $(BUILD_EXECUTABLE)
-
-endif #!sim
diff --git a/libcutils/qtaguid.c b/libcutils/qtaguid.c
new file mode 100644
index 0000000..517e784
--- /dev/null
+++ b/libcutils/qtaguid.c
@@ -0,0 +1,44 @@
+/* libcutils/qtaguid.c
+**
+** Copyright 2011, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+**     http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+#define LOG_TAG "qtaguid"
+
+#include <cutils/qtaguid.h>
+#include <cutils/log.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+extern int set_qtaguid(int sockfd, int tag, uid_t uid) {
+    char lineBuf[128];
+    int fd, cnt = 0;
+    uint64_t kTag = (uint64_t)tag << 32;
+    snprintf(lineBuf, sizeof(lineBuf), "t %d %llu %d", sockfd, kTag, uid);
+
+    LOGV("Tagging Socket with command %s\n", lineBuf);
+    /* TODO: Enable after the kernel module is fixed.
+       fd = open("/proc/net/xt_qtaguid/ctrl", O_WRONLY);
+       if (fd < 0) {
+           return -1;
+       }
+
+       cnt = write(fd, lineBuf, strlen(lineBuf));
+       close(fd);
+    */
+    return (cnt>0?0:-1);
+}
diff --git a/libdiskconfig/Android.mk b/libdiskconfig/Android.mk
index c887955..74be2d9 100644
--- a/libdiskconfig/Android.mk
+++ b/libdiskconfig/Android.mk
@@ -1,8 +1,6 @@
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
 
-ifneq ($(TARGET_SIMULATOR),true)
-
 commonSources := \
 	diskconfig.c \
 	diskutils.c \
@@ -23,5 +21,3 @@
 LOCAL_CFLAGS := -O2 -g -W -Wall -Werror -D_LARGEFILE64_SOURCE
 include $(BUILD_HOST_STATIC_LIBRARY)
 endif # HOST_OS == linux
-
-endif  # ! TARGET_SIMULATOR
diff --git a/liblog/Android.mk b/liblog/Android.mk
index 0eec87f..bd4fed4 100644
--- a/liblog/Android.mk
+++ b/liblog/Android.mk
@@ -48,25 +48,14 @@
 LOCAL_CFLAGS := -DFAKE_LOG_DEVICE=1
 include $(BUILD_HOST_STATIC_LIBRARY)
 
-ifeq ($(TARGET_SIMULATOR),true)
-  # Shared library for simulator
-  # ========================================================
-  include $(CLEAR_VARS)
-  LOCAL_MODULE := liblog
-  LOCAL_SRC_FILES := $(liblog_host_sources)
-  LOCAL_LDLIBS := -lpthread
-  LOCAL_CFLAGS := -DFAKE_LOG_DEVICE=1
-  include $(BUILD_SHARED_LIBRARY)
-else # !sim
-  # Shared and static library for target
-  # ========================================================
-  include $(CLEAR_VARS)
-  LOCAL_MODULE := liblog
-  LOCAL_SRC_FILES := $(liblog_sources)
-  include $(BUILD_STATIC_LIBRARY)
+# Shared and static library for target
+# ========================================================
+include $(CLEAR_VARS)
+LOCAL_MODULE := liblog
+LOCAL_SRC_FILES := $(liblog_sources)
+include $(BUILD_STATIC_LIBRARY)
 
-  include $(CLEAR_VARS)
-  LOCAL_MODULE := liblog
-  LOCAL_WHOLE_STATIC_LIBRARIES := liblog
-  include $(BUILD_SHARED_LIBRARY)
-endif # !sim
+include $(CLEAR_VARS)
+LOCAL_MODULE := liblog
+LOCAL_WHOLE_STATIC_LIBRARIES := liblog
+include $(BUILD_SHARED_LIBRARY)
diff --git a/libnetutils/Android.mk b/libnetutils/Android.mk
index 46102d5..1ef7da9 100644
--- a/libnetutils/Android.mk
+++ b/libnetutils/Android.mk
@@ -11,13 +11,6 @@
 LOCAL_SHARED_LIBRARIES := \
 	libcutils
 
-# need "-lrt" on Linux simulator to pick up clock_gettime
-ifeq ($(TARGET_SIMULATOR),true)
-	ifeq ($(HOST_OS),linux)
-		LOCAL_LDLIBS += -lrt -lpthread
-	endif
-endif
-
 LOCAL_MODULE:= libnetutils
 
 include $(BUILD_SHARED_LIBRARY)
diff --git a/libnetutils/ifc_utils.c b/libnetutils/ifc_utils.c
index 208402c..04b0dfa 100644
--- a/libnetutils/ifc_utils.c
+++ b/libnetutils/ifc_utils.c
@@ -394,7 +394,11 @@
     return result;
 }
 
-int ifc_reset_connections(const char *ifname)
+#define RESET_IPV4_ADDRESSES 0x01
+#define RESET_IPV6_ADDRESSES 0x02
+#define RESET_ALL_ADDRESSES  (RESET_IPV4_ADDRESSES | RESET_IPV6_ADDRESSES)
+
+int ifc_reset_connections(const char *ifname, const int reset_mask)
 {
 #ifdef HAVE_ANDROID_OS
     int result, success;
@@ -402,28 +406,34 @@
     struct ifreq ifr;
     struct in6_ifreq ifr6;
 
-    /* IPv4. Clear connections on the IP address. */
-    ifc_init();
-    ifc_get_info(ifname, &myaddr, NULL, NULL);
-    ifc_init_ifr(ifname, &ifr);
-    init_sockaddr_in(&ifr.ifr_addr, myaddr);
-    result = ioctl(ifc_ctl_sock, SIOCKILLADDR,  &ifr);
-    ifc_close();
-
-    /*
-     * IPv6. On Linux, when an interface goes down it loses all its IPv6
-     * addresses, so we don't know which connections belonged to that interface
-     * So we clear all unused IPv6 connections on the device by specifying an
-     * empty IPv6 address.
-     */
-    ifc_init6();
-    // This implicitly specifies an address of ::, i.e., kill all IPv6 sockets.
-    memset(&ifr6, 0, sizeof(ifr6));
-    success = ioctl(ifc_ctl_sock6, SIOCKILLADDR,  &ifr6);
-    if (result == 0) {
-        result = success;
+    if (reset_mask & RESET_IPV4_ADDRESSES) {
+        /* IPv4. Clear connections on the IP address. */
+        ifc_init();
+        ifc_get_info(ifname, &myaddr, NULL, NULL);
+        ifc_init_ifr(ifname, &ifr);
+        init_sockaddr_in(&ifr.ifr_addr, myaddr);
+        result = ioctl(ifc_ctl_sock, SIOCKILLADDR,  &ifr);
+        ifc_close();
+    } else {
+        result = 0;
     }
-    ifc_close6();
+
+    if (reset_mask & RESET_IPV6_ADDRESSES) {
+        /*
+         * IPv6. On Linux, when an interface goes down it loses all its IPv6
+         * addresses, so we don't know which connections belonged to that interface
+         * So we clear all unused IPv6 connections on the device by specifying an
+         * empty IPv6 address.
+         */
+        ifc_init6();
+        // This implicitly specifies an address of ::, i.e., kill all IPv6 sockets.
+        memset(&ifr6, 0, sizeof(ifr6));
+        success = ioctl(ifc_ctl_sock6, SIOCKILLADDR,  &ifr6);
+        if (result == 0) {
+            result = success;
+        }
+        ifc_close6();
+    }
 
     return result;
 #else
diff --git a/libnl_2/attr.c b/libnl_2/attr.c
index 11e8ae5..9467668 100644
--- a/libnl_2/attr.c
+++ b/libnl_2/attr.c
@@ -154,10 +154,12 @@
 
 	/* Reserve space and init nla header */
 	nla = nla_reserve(msg, attrtype, datalen);
-	if (nla)
+	if (nla) {
 		memcpy(nla_data(nla), data, datalen);
+		return 0;
+	}
 
-	return -errno;
+	return -EINVAL;
 
 }
 
diff --git a/libnl_2/socket.c b/libnl_2/socket.c
index 1a2255e..3bcf210 100644
--- a/libnl_2/socket.c
+++ b/libnl_2/socket.c
@@ -33,12 +33,14 @@
 /* Allocate new netlink socket. */
 struct nl_sock *nl_socket_alloc(void)
 {
-	struct nl_sock *sk = (struct nl_sock *) malloc(sizeof(struct nl_sock));
+	struct nl_sock *sk;
 	struct timeval tv;
 	struct nl_cb *cb;
 
+	sk = (struct nl_sock *) malloc(sizeof(struct nl_sock));
 	if (!sk)
 		goto fail;
+	memset(sk, 0, sizeof(*sk));
 
 	/* Get current time */
 
@@ -49,7 +51,7 @@
 
 	/* Create local socket */
 	sk->s_local.nl_family = AF_NETLINK;
-	sk->s_local.nl_pid = getpid();
+	sk->s_local.nl_pid = 0; /* Kernel fills in pid */
 	sk->s_local.nl_groups = 0; /* No groups */
 
 	/* Create peer socket */
@@ -76,14 +78,13 @@
 {
 	struct nl_sock *sk = nl_socket_alloc();
 	if (!sk)
-		goto fail;
+		return NULL;
 
 	sk->s_cb = cb;
 	nl_cb_get(cb);
 
 	return sk;
-fail:
-	return NULL;
+
 }
 
 /* Free a netlink socket. */
diff --git a/libsysutils/Android.mk b/libsysutils/Android.mk
index 3b1f618..cccf484 100644
--- a/libsysutils/Android.mk
+++ b/libsysutils/Android.mk
@@ -1,10 +1,4 @@
 ifneq ($(BUILD_TINY_ANDROID),true)
-BUILD_LIBSYSUTILS := false
-ifneq ($(TARGET_SIMULATOR),true)
-    BUILD_LIBSYSUTILS := true
-endif
-
-ifeq ($(BUILD_LIBSYSUTILS),true)
 
 LOCAL_PATH:= $(call my-dir)
 
@@ -27,11 +21,6 @@
 
 LOCAL_SHARED_LIBRARIES := libcutils
 
-ifeq ($(TARGET_SIMULATOR),true)
-  LOCAL_LDLIBS += -lpthread
-endif
-
 include $(BUILD_SHARED_LIBRARY)
 
 endif
-endif
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 26c3acb..8dd858f 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -19,7 +19,7 @@
     export ANDROID_DATA /data
     export ASEC_MOUNTPOINT /mnt/asec
     export LOOP_MOUNTPOINT /mnt/obb
-    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
+    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar:/system/framework/filterfw.jar
 
 # Backward compatibility
     symlink /system/etc /etc
@@ -115,11 +115,7 @@
     chmod 0220 /proc/sysrq-trigger
 
     # create the lost+found directories, so as to enforce our permissions
-    mkdir /cache/lost+found 0770
-
-    # double check the perms, in case lost+found already exists, and set owner
-    chown root root /cache/lost+found
-    chmod 0770 /cache/lost+found
+    mkdir /cache/lost+found 0770 root root
 
 on post-fs-data
     # We chown/chmod /data again so because mount is run as root + defaults
@@ -129,10 +125,7 @@
     # Create dump dir and collect dumps.
     # Do this before we mount cache so eventually we can use cache for
     # storing dumps on platforms which do not have a dedicated dump partition.
-   
-    mkdir /data/dontpanic
-    chown root log /data/dontpanic
-    chmod 0750 /data/dontpanic
+    mkdir /data/dontpanic 0750 root log
 
     # Collect apanic data, free resources and re-arm trigger
     copy /proc/apanic_console /data/dontpanic/apanic_console
@@ -150,13 +143,11 @@
     mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
     mkdir /data/misc/bluetooth 0770 system system
     mkdir /data/misc/keystore 0700 keystore keystore
-    mkdir /data/misc/keychain 0771 keychain keychain
-    mkdir /data/misc/vpn 0770 system system
+    mkdir /data/misc/keychain 0771 system system
+    mkdir /data/misc/vpn 0770 system vpn
     mkdir /data/misc/systemkeys 0700 system system
-    mkdir /data/misc/vpn/profiles 0770 system system
     # give system access to wpa_supplicant.conf for backup and restore
     mkdir /data/misc/wifi 0770 wifi wifi
-    chmod 0770 /data/misc/wifi
     chmod 0660 /data/misc/wifi/wpa_supplicant.conf
     mkdir /data/local 0771 shell shell
     mkdir /data/local/tmp 0771 shell shell
@@ -165,17 +156,11 @@
     mkdir /data/app 0771 system system
     mkdir /data/property 0700 root root
 
-    # create dalvik-cache and double-check the perms
+    # create dalvik-cache, so as to enforce our permissions
     mkdir /data/dalvik-cache 0771 system system
-    chown system system /data/dalvik-cache
-    chmod 0771 /data/dalvik-cache
 
     # create the lost+found directories, so as to enforce our permissions
-    mkdir /data/lost+found 0770
-
-    # double check the perms, in case lost+found already exists, and set owner
-    chown root root /data/lost+found
-    chmod 0770 /data/lost+found
+    mkdir /data/lost+found 0770 root root
 
     # create directory for DRM plug-ins
     mkdir /data/drm 0774 drm drm
@@ -188,6 +173,8 @@
 
     chown system system /sys/class/android_usb/android0/f_mass_storage/lun/file
     chmod 0660 /sys/class/android_usb/android0/f_mass_storage/lun/file
+    chown system system /sys/class/android_usb/android0/f_rndis/ethaddr
+    chmod 0660 /sys/class/android_usb/android0/f_rndis/ethaddr
 
 on boot
 # basic network init
@@ -426,7 +413,6 @@
     socket zygote stream 666
     onrestart write /sys/android_power/request_state wake
     onrestart write /sys/power/state on
-    onrestart restart surfaceflinger
     onrestart restart media
     onrestart restart netd
 
@@ -438,7 +424,8 @@
 service media /system/bin/mediaserver
     class main
     user media
-    group audio camera inet net_bt net_bt_admin
+    # STOPSHIP: remove system from mediaserver groups
+    group audio camera inet net_bt net_bt_admin system
     ioprio rt 4
 
 service bootanim /system/bin/bootanimation
@@ -474,8 +461,8 @@
 service racoon /system/bin/racoon
     class main
     socket racoon stream 600 system system
-    # racoon will setuid to vpn after getting necessary resources.
-    group net_admin
+    # IKE uses UDP port 500. Racoon will setuid to vpn after binding the port.
+    group vpn net_admin
     disabled
     oneshot
 
diff --git a/toolbox/getevent.c b/toolbox/getevent.c
index f0a6c24..c0ac94a 100644
--- a/toolbox/getevent.c
+++ b/toolbox/getevent.c
@@ -82,7 +82,7 @@
     const char *bit_label;
 
     printf("  events:\n");
-    for(i = 0; i <= EV_MAX; i++) {
+    for(i = EV_KEY; i <= EV_MAX; i++) { // skip EV_SYN since we cannot query its available codes
         int count = 0;
         while(1) {
             res = ioctl(fd, EVIOCGBIT(i, bits_size), bits);
@@ -97,10 +97,6 @@
         }
         res2 = 0;
         switch(i) {
-            case EV_SYN:
-                label = "SYN";
-                bit_labels = syn_labels;
-                break;
             case EV_KEY:
                 res2 = ioctl(fd, EVIOCGKEY(res), bits + bits_size);
                 label = "KEY";
@@ -252,7 +248,7 @@
         if (value_label)
             printf(" %-20.20s", value_label);
         else
-            printf(" %08x            ", code);
+            printf(" %08x            ", value);
     } else {
         printf("%04x %04x %08x", type, code, value);
     }
diff --git a/toolbox/lsof.c b/toolbox/lsof.c
index c55384b..4e2f77a 100644
--- a/toolbox/lsof.c
+++ b/toolbox/lsof.c
@@ -37,11 +37,16 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+#include <pwd.h>
+#include <sys/stat.h>
+
 #define BUF_MAX 1024
-#define CMD_DISPLAY_MAX 10
+#define CMD_DISPLAY_MAX (9 + 1)
+#define USER_DISPLAY_MAX (10 + 1)
 
 struct pid_info_t {
     pid_t pid;
+    char user[USER_DISPLAY_MAX];
 
     char cmdline[CMD_DISPLAY_MAX];
 
@@ -82,7 +87,8 @@
     if (!strcmp(link_dest, "/"))
         goto out;
 
-    printf("%-9s %5d %10s %4s %9s %18s %9s %10s %s\n", info->cmdline, info->pid, "???", type,
+    printf("%-9s %5d %10s %4s %9s %18s %9s %10s %s\n",
+            info->cmdline, info->pid, info->user, type,
             "???", "???", "???", "???", link_dest);
 
 out:
@@ -113,7 +119,8 @@
         if (inode == 0 || !strcmp(device, "00:00"))
             continue;
 
-        printf("%-9s %5d %10s %4s %9s %18s %9zd %10ld %s\n", info->cmdline, info->pid, "???", "mem",
+        printf("%-9s %5d %10s %4s %9s %18s %9zd %10ld %s\n",
+                info->cmdline, info->pid, info->user, "mem",
                 "???", device, offset, inode, file);
     }
 
@@ -136,7 +143,8 @@
     if (dir == NULL) {
         char msg[BUF_MAX];
         snprintf(msg, sizeof(msg), "%s (opendir: %s)", info->path, strerror(errno));
-        printf("%-9s %5d %10s %4s %9s %18s %9s %10s %s\n", info->cmdline, info->pid, "???", "FDS",
+        printf("%-9s %5d %10s %4s %9s %18s %9s %10s %s\n",
+                info->cmdline, info->pid, info->user, "FDS",
                 "", "", "", "", msg);
         goto out;
     }
@@ -159,12 +167,26 @@
 {
     int fd;
     struct pid_info_t info;
+    struct stat pidstat;
+    struct passwd *pw;
+
     info.pid = pid;
-
     snprintf(info.path, sizeof(info.path), "/proc/%d/", pid);
-
     info.parent_length = strlen(info.path);
 
+    // Get the UID by calling stat on the proc/pid directory.
+    if (!stat(info.path, &pidstat)) {
+        pw = getpwuid(pidstat.st_uid);
+        if (pw) {
+            strncpy(info.user, pw->pw_name, USER_DISPLAY_MAX - 1);
+            info.user[USER_DISPLAY_MAX - 1] = '\0';
+        } else {
+            snprintf(info.user, USER_DISPLAY_MAX, "%d", (int)pidstat.st_uid);
+        }
+    } else {
+        strcpy(info.user, "???");
+    }
+
     // Read the command line information; each argument is terminated with NULL.
     strncat(info.path, "cmdline", sizeof(info.path));
     fd = open(info.path, O_RDONLY);
@@ -219,7 +241,7 @@
                 continue;
 
             // Only inspect directories that are PID numbers
-                pid = strtol(de->d_name, &endptr, 10);
+            pid = strtol(de->d_name, &endptr, 10);
             if (*endptr != '\0')
                 continue;