DO NOT MERGE ANYWHERE Add new interface for sensor physical data am: d4db70a7b8  -s ours am: 37f1300ffc  -s ours
am: e51ffd15e9  -s ours

* commit 'e51ffd15e918543edf255d96822a0d371895feda':
  DO NOT MERGE ANYWHERE Add new interface for sensor physical data
diff --git a/cmds/atrace/Android.mk b/cmds/atrace/Android.mk
index 028ca8f..a787e95 100644
--- a/cmds/atrace/Android.mk
+++ b/cmds/atrace/Android.mk
@@ -17,4 +17,6 @@
     libutils \
     libz \
 
+LOCAL_INIT_RC := atrace.rc
+
 include $(BUILD_EXECUTABLE)
diff --git a/cmds/atrace/atrace.cpp b/cmds/atrace/atrace.cpp
index 26c5b4a..5a66bc3 100644
--- a/cmds/atrace/atrace.cpp
+++ b/cmds/atrace/atrace.cpp
@@ -26,6 +26,7 @@
 #include <string.h>
 #include <sys/sendfile.h>
 #include <time.h>
+#include <unistd.h>
 #include <zlib.h>
 
 #include <binder/IBinder.h>
@@ -36,6 +37,7 @@
 
 #include <utils/String8.h>
 #include <utils/Timers.h>
+#include <utils/Tokenizer.h>
 #include <utils/Trace.h>
 
 using namespace android;
@@ -90,12 +92,16 @@
     { "rs",         "RenderScript",     ATRACE_TAG_RS, { } },
     { "bionic",     "Bionic C Library", ATRACE_TAG_BIONIC, { } },
     { "power",      "Power Management", ATRACE_TAG_POWER, { } },
+    { "pm",         "Package Manager",  ATRACE_TAG_PACKAGE_MANAGER, { } },
+    { "ss",         "System Server",    ATRACE_TAG_SYSTEM_SERVER, { } },
     { "sched",      "CPU Scheduling",   0, {
         { REQ,      "/sys/kernel/debug/tracing/events/sched/sched_switch/enable" },
         { REQ,      "/sys/kernel/debug/tracing/events/sched/sched_wakeup/enable" },
+        { OPT,      "/sys/kernel/debug/tracing/events/sched/sched_blocked_reason/enable" },
     } },
     { "irq",        "IRQ Events",   0, {
         { REQ,      "/sys/kernel/debug/tracing/events/irq/enable" },
+        { OPT,      "/sys/kernel/debug/tracing/events/ipi/enable" },
     } },
     { "freq",       "CPU Frequency",    0, {
         { REQ,      "/sys/kernel/debug/tracing/events/power/cpu_frequency/enable" },
@@ -140,6 +146,15 @@
     { "regulators",  "Voltage and Current Regulators", 0, {
         { REQ,      "/sys/kernel/debug/tracing/events/regulator/enable" },
     } },
+    { "binder_driver", "Binder Kernel driver", 0, {
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_transaction/enable" },
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_transaction_received/enable" },
+    } },
+    { "binder_lock", "Binder global lock trace", 0, {
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_lock/enable" },
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_locked/enable" },
+        { REQ,      "/sys/kernel/debug/tracing/events/binder/binder_unlock/enable" },
+    } },
 };
 
 /* Command line options */
@@ -149,6 +164,7 @@
 static bool g_compress = false;
 static bool g_nohup = false;
 static int g_initialSleepSecs = 0;
+static const char* g_categoriesFile = NULL;
 static const char* g_kernelTraceFuncs = NULL;
 static const char* g_debugAppCmdLine = "";
 
@@ -196,6 +212,9 @@
 static const char* k_tracePath =
     "/sys/kernel/debug/tracing/trace";
 
+static const char* k_traceStreamPath =
+    "/sys/kernel/debug/tracing/trace_pipe";
+
 static const char* k_traceMarkerPath =
     "/sys/kernel/debug/tracing/trace_marker";
 
@@ -584,6 +603,52 @@
     return ok;
 }
 
+static bool setCategoryEnable(const char* name, bool enable)
+{
+    for (int i = 0; i < NELEM(k_categories); i++) {
+        const TracingCategory& c = k_categories[i];
+        if (strcmp(name, c.name) == 0) {
+            if (isCategorySupported(c)) {
+                g_categoryEnables[i] = enable;
+                return true;
+            } else {
+                if (isCategorySupportedForRoot(c)) {
+                    fprintf(stderr, "error: category \"%s\" requires root "
+                            "privileges.\n", name);
+                } else {
+                    fprintf(stderr, "error: category \"%s\" is not supported "
+                            "on this device.\n", name);
+                }
+                return false;
+            }
+        }
+    }
+    fprintf(stderr, "error: unknown tracing category \"%s\"\n", name);
+    return false;
+}
+
+static bool setCategoriesEnableFromFile(const char* categories_file)
+{
+    if (!categories_file) {
+        return true;
+    }
+    Tokenizer* tokenizer = NULL;
+    if (Tokenizer::open(String8(categories_file), &tokenizer) != NO_ERROR) {
+        return false;
+    }
+    bool ok = true;
+    while (!tokenizer->isEol()) {
+        String8 token = tokenizer->nextToken(" ");
+        if (token.isEmpty()) {
+            tokenizer->skipDelimiters(" ");
+            continue;
+        }
+        ok &= setCategoryEnable(token.string(), true);
+    }
+    delete tokenizer;
+    return ok;
+}
+
 // Set all the kernel tracing settings to the desired state for this trace
 // capture.
 static bool setUpTrace()
@@ -591,6 +656,7 @@
     bool ok = true;
 
     // Set up the tracing options.
+    ok &= setCategoriesEnableFromFile(g_categoriesFile);
     ok &= setTraceOverwriteEnable(g_traceOverwrite);
     ok &= setTraceBufferSizeKB(g_traceBufferSizeKB);
     ok &= setGlobalClockEnable(true);
@@ -667,6 +733,31 @@
     setTracingEnabled(false);
 }
 
+// Read data from the tracing pipe and forward to stdout
+static void streamTrace()
+{
+    char trace_data[4096];
+    int traceFD = open(k_traceStreamPath, O_RDWR);
+    if (traceFD == -1) {
+        fprintf(stderr, "error opening %s: %s (%d)\n", k_traceStreamPath,
+                strerror(errno), errno);
+        return;
+    }
+    while (!g_traceAborted) {
+        ssize_t bytes_read = read(traceFD, trace_data, 4096);
+        if (bytes_read > 0) {
+            write(STDOUT_FILENO, trace_data, bytes_read);
+            fflush(stdout);
+        } else {
+            if (!g_traceAborted) {
+                fprintf(stderr, "read returned %zd bytes err %d (%s)\n",
+                        bytes_read, errno, strerror(errno));
+            }
+            break;
+        }
+    }
+}
+
 // Read the current kernel trace and write it to stdout.
 static void dumpTrace()
 {
@@ -783,30 +874,6 @@
     sigaction(SIGTERM, &sa, NULL);
 }
 
-static bool setCategoryEnable(const char* name, bool enable)
-{
-    for (int i = 0; i < NELEM(k_categories); i++) {
-        const TracingCategory& c = k_categories[i];
-        if (strcmp(name, c.name) == 0) {
-            if (isCategorySupported(c)) {
-                g_categoryEnables[i] = enable;
-                return true;
-            } else {
-                if (isCategorySupportedForRoot(c)) {
-                    fprintf(stderr, "error: category \"%s\" requires root "
-                            "privileges.\n", name);
-                } else {
-                    fprintf(stderr, "error: category \"%s\" is not supported "
-                            "on this device.\n", name);
-                }
-                return false;
-            }
-        }
-    }
-    fprintf(stderr, "error: unknown tracing category \"%s\"\n", name);
-    return false;
-}
-
 static void listSupportedCategories()
 {
     for (int i = 0; i < NELEM(k_categories); i++) {
@@ -826,6 +893,8 @@
                         "separated list of cmdlines\n"
                     "  -b N            use a trace buffer size of N KB\n"
                     "  -c              trace into a circular buffer\n"
+                    "  -f filename     use the categories written in a file as space-separated\n"
+                    "                    values in a line\n"
                     "  -k fname,...    trace the listed kernel functions\n"
                     "  -n              ignore signals\n"
                     "  -s N            sleep for N seconds before tracing [default 0]\n"
@@ -835,6 +904,10 @@
                     "  --async_dump    dump the current contents of circular trace buffer\n"
                     "  --async_stop    stop tracing and dump the current contents of circular\n"
                     "                    trace buffer\n"
+                    "  --stream        stream trace to stdout as it enters the trace buffer\n"
+                    "                    Note: this can take significant CPU time, and is best\n"
+                    "                    used for measuring things that are not affected by\n"
+                    "                    CPU performance, like pagecache usage.\n"
                     "  --list_categories\n"
                     "                  list the available tracing categories\n"
             );
@@ -846,6 +919,7 @@
     bool traceStart = true;
     bool traceStop = true;
     bool traceDump = true;
+    bool traceStream = false;
 
     if (argc == 2 && 0 == strcmp(argv[1], "--help")) {
         showHelp(argv[0]);
@@ -860,10 +934,11 @@
             {"async_stop",      no_argument, 0,  0 },
             {"async_dump",      no_argument, 0,  0 },
             {"list_categories", no_argument, 0,  0 },
+            {"stream",          no_argument, 0,  0 },
             {           0,                0, 0,  0 }
         };
 
-        ret = getopt_long(argc, argv, "a:b:ck:ns:t:z",
+        ret = getopt_long(argc, argv, "a:b:cf:k:ns:t:z",
                           long_options, &option_index);
 
         if (ret < 0) {
@@ -889,6 +964,10 @@
                 g_traceOverwrite = true;
             break;
 
+            case 'f':
+                g_categoriesFile = optarg;
+            break;
+
             case 'k':
                 g_kernelTraceFuncs = optarg;
             break;
@@ -922,6 +1001,9 @@
                     async = true;
                     traceStart = false;
                     traceStop = false;
+                } else if (!strcmp(long_options[option_index].name, "stream")) {
+                    traceStream = true;
+                    traceDump = false;
                 } else if (!strcmp(long_options[option_index].name, "list_categories")) {
                     listSupportedCategories();
                     exit(0);
@@ -947,8 +1029,10 @@
     ok &= startTrace();
 
     if (ok && traceStart) {
-        printf("capturing trace...");
-        fflush(stdout);
+        if (!traceStream) {
+            printf("capturing trace...");
+            fflush(stdout);
+        }
 
         // We clear the trace after starting it because tracing gets enabled for
         // each CPU individually in the kernel. Having the beginning of the trace
@@ -958,7 +1042,7 @@
         ok = clearTrace();
 
         writeClockSyncMarker();
-        if (ok && !async) {
+        if (ok && !async && !traceStream) {
             // Sleep to allow the trace to be captured.
             struct timespec timeLeft;
             timeLeft.tv_sec = g_traceDurationSeconds;
@@ -969,6 +1053,10 @@
                 }
             } while (nanosleep(&timeLeft, &timeLeft) == -1 && errno == EINTR);
         }
+
+        if (traceStream) {
+            streamTrace();
+        }
     }
 
     // Stop the trace and restore the default settings.
diff --git a/cmds/atrace/atrace.rc b/cmds/atrace/atrace.rc
new file mode 100644
index 0000000..3373192
--- /dev/null
+++ b/cmds/atrace/atrace.rc
@@ -0,0 +1,64 @@
+## Permissions to allow system-wide tracing to the kernel trace buffer.
+##
+on boot
+
+# Allow writing to the kernel trace log.
+    chmod 0222 /sys/kernel/debug/tracing/trace_marker
+
+# Allow the shell group to enable (some) kernel tracing.
+    chown root shell /sys/kernel/debug/tracing/trace_clock
+    chown root shell /sys/kernel/debug/tracing/buffer_size_kb
+    chown root shell /sys/kernel/debug/tracing/options/overwrite
+    chown root shell /sys/kernel/debug/tracing/options/print-tgid
+    chown root shell /sys/kernel/debug/tracing/events/sched/sched_switch/enable
+    chown root shell /sys/kernel/debug/tracing/events/sched/sched_wakeup/enable
+    chown root shell /sys/kernel/debug/tracing/events/sched/sched_blocked_reason/enable
+    chown root shell /sys/kernel/debug/tracing/events/power/cpu_frequency/enable
+    chown root shell /sys/kernel/debug/tracing/events/power/cpu_idle/enable
+    chown root shell /sys/kernel/debug/tracing/events/power/clock_set_rate/enable
+    chown root shell /sys/kernel/debug/tracing/events/cpufreq_interactive/enable
+    chown root shell /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/enable
+    chown root shell /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_direct_reclaim_end/enable
+    chown root shell /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_kswapd_wake/enable
+    chown root shell /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_kswapd_sleep/enable
+    chown root shell /sys/kernel/debug/tracing/events/binder/binder_transaction/enable
+    chown root shell /sys/kernel/debug/tracing/events/binder/binder_transaction_received/enable
+    chown root shell /sys/kernel/debug/tracing/events/binder/binder_lock/enable
+    chown root shell /sys/kernel/debug/tracing/events/binder/binder_locked/enable
+    chown root shell /sys/kernel/debug/tracing/events/binder/binder_unlock/enable
+
+    chown root shell /sys/kernel/debug/tracing/tracing_on
+
+    chmod 0664 /sys/kernel/debug/tracing/trace_clock
+    chmod 0664 /sys/kernel/debug/tracing/buffer_size_kb
+    chmod 0664 /sys/kernel/debug/tracing/options/overwrite
+    chmod 0664 /sys/kernel/debug/tracing/options/print-tgid
+    chmod 0664 /sys/kernel/debug/tracing/events/sched/sched_switch/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/sched/sched_wakeup/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/sched/sched_blocked_reason/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/power/cpu_frequency/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/power/cpu_idle/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/power/clock_set_rate/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/cpufreq_interactive/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_direct_reclaim_end/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_kswapd_wake/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/vmscan/mm_vmscan_kswapd_sleep/enable
+    chmod 0664 /sys/kernel/debug/tracing/tracing_on
+    chmod 0664 /sys/kernel/debug/tracing/events/binder/binder_transaction/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/binder/binder_transaction_received/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/binder/binder_lock/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/binder/binder_locked/enable
+    chmod 0664 /sys/kernel/debug/tracing/events/binder/binder_unlock/enable
+
+# Allow only the shell group to read and truncate the kernel trace.
+    chown root shell /sys/kernel/debug/tracing/trace
+    chmod 0660 /sys/kernel/debug/tracing/trace
+
+on property:persist.debug.atrace.boottrace=1
+    start boottrace
+
+# Run atrace with the categories written in a file
+service boottrace /system/bin/atrace --async_start -f /data/misc/boottrace/categories
+    disabled
+    oneshot
diff --git a/cmds/dumpstate/Android.mk b/cmds/dumpstate/Android.mk
index 9065ee1..8c7c4a8 100644
--- a/cmds/dumpstate/Android.mk
+++ b/cmds/dumpstate/Android.mk
@@ -17,5 +17,6 @@
 LOCAL_SHARED_LIBRARIES := libcutils liblog libselinux
 LOCAL_HAL_STATIC_LIBRARIES := libdumpstate
 LOCAL_CFLAGS += -Wall -Wno-unused-parameter -std=gnu99
+LOCAL_INIT_RC := dumpstate.rc
 
 include $(BUILD_EXECUTABLE)
diff --git a/cmds/dumpstate/dumpstate.c b/cmds/dumpstate/dumpstate.c
index 6093e08..66115c3 100644
--- a/cmds/dumpstate/dumpstate.c
+++ b/cmds/dumpstate/dumpstate.c
@@ -299,8 +299,8 @@
     run_command("UPTIME", 10, "uptime", NULL);
     dump_files("UPTIME MMC PERF", mmcblk0, skip_not_stat, dump_stat_from_fd);
     dump_file("MEMORY INFO", "/proc/meminfo");
-    run_command("CPU INFO", 10, "top", "-n", "1", "-d", "1", "-m", "30", "-t", NULL);
-    run_command("PROCRANK", 20, "procrank", NULL);
+    run_command("CPU INFO", 10, "top", "-n", "1", "-d", "1", "-m", "30", "-H", NULL);
+    run_command("PROCRANK", 20, SU_PATH, "root", "procrank", NULL);
     dump_file("VIRTUAL MEMORY STATS", "/proc/vmstat");
     dump_file("VMALLOC INFO", "/proc/vmallocinfo");
     dump_file("SLAB INFO", "/proc/slabinfo");
@@ -314,9 +314,7 @@
     dump_file("KERNEL CPUFREQ", "/sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state");
     dump_file("KERNEL SYNC", "/d/sync");
 
-    run_command("PROCESSES", 10, "ps", "-P", NULL);
-    run_command("PROCESSES AND THREADS", 10, "ps", "-t", "-p", "-P", NULL);
-    run_command("PROCESSES (SELINUX LABELS)", 10, "ps", "-Z", NULL);
+    run_command("PROCESSES AND THREADS", 10, "ps", "-Z", "-t", "-p", "-P", NULL);
     run_command("LIBRANK", 10, "librank", NULL);
 
     do_dmesg();
@@ -695,7 +693,7 @@
 
     /* switch to non-root user and group */
     gid_t groups[] = { AID_LOG, AID_SDCARD_R, AID_SDCARD_RW,
-            AID_MOUNT, AID_INET, AID_NET_BW_STATS };
+            AID_MOUNT, AID_INET, AID_NET_BW_STATS, AID_READPROC };
     if (setgroups(sizeof(groups)/sizeof(groups[0]), groups) != 0) {
         ALOGE("Unable to setgroups, aborting: %s\n", strerror(errno));
         return -1;
diff --git a/cmds/dumpstate/dumpstate.rc b/cmds/dumpstate/dumpstate.rc
new file mode 100644
index 0000000..cd5d6c4
--- /dev/null
+++ b/cmds/dumpstate/dumpstate.rc
@@ -0,0 +1,5 @@
+service dumpstate /system/bin/dumpstate -s
+    class main
+    socket dumpstate stream 0660 shell log
+    disabled
+    oneshot
diff --git a/cmds/dumpstate/utils.c b/cmds/dumpstate/utils.c
index d679787..0dd0c21 100644
--- a/cmds/dumpstate/utils.c
+++ b/cmds/dumpstate/utils.c
@@ -626,24 +626,6 @@
         return NULL;  // Can't rename old traces.txt -- no permission? -- leave it alone instead
     }
 
-    /* make the directory if necessary */
-    char anr_traces_dir[PATH_MAX];
-    strlcpy(anr_traces_dir, traces_path, sizeof(anr_traces_dir));
-    char *slash = strrchr(anr_traces_dir, '/');
-    if (slash != NULL) {
-        *slash = '\0';
-        if (!mkdir(anr_traces_dir, 0775)) {
-            chown(anr_traces_dir, AID_SYSTEM, AID_SYSTEM);
-            chmod(anr_traces_dir, 0775);
-            if (selinux_android_restorecon(anr_traces_dir, 0) == -1) {
-                fprintf(stderr, "restorecon failed for %s: %s\n", anr_traces_dir, strerror(errno));
-            }
-        } else if (errno != EEXIST) {
-            fprintf(stderr, "mkdir(%s): %s\n", anr_traces_dir, strerror(errno));
-            return NULL;
-        }
-    }
-
     /* create a new, empty traces.txt file to receive stack dumps */
     int fd = TEMP_FAILURE_RETRY(open(traces_path, O_CREAT | O_WRONLY | O_TRUNC | O_NOFOLLOW | O_CLOEXEC,
                                      0666));  /* -rw-rw-rw- */
diff --git a/cmds/installd/Android.mk b/cmds/installd/Android.mk
index 6dec7f6..eaeeb22 100644
--- a/cmds/installd/Android.mk
+++ b/cmds/installd/Android.mk
@@ -38,5 +38,6 @@
 
 LOCAL_STATIC_LIBRARIES := libdiskusage
 LOCAL_ADDITIONAL_DEPENDENCIES += $(LOCAL_PATH)/Android.mk
+LOCAL_INIT_RC := installd.rc
 LOCAL_CLANG := true
 include $(BUILD_EXECUTABLE)
diff --git a/cmds/installd/commands.cpp b/cmds/installd/commands.cpp
index fac8ddd..757290f 100644
--- a/cmds/installd/commands.cpp
+++ b/cmds/installd/commands.cpp
@@ -83,8 +83,6 @@
     std::string _pkgdir(create_data_user_package_path(uuid, userid, pkgname));
     const char* pkgdir = _pkgdir.c_str();
 
-    remove_profile_file(pkgname);
-
     /* delete contents AND directory, no exceptions */
     return delete_dir_contents(pkgdir, 1, NULL);
 }
@@ -745,7 +743,7 @@
 }
 
 static void run_dex2oat(int zip_fd, int oat_fd, const char* input_file_name,
-    const char* output_file_name, int swap_fd, const char *pkgname, const char *instruction_set,
+    const char* output_file_name, int swap_fd, const char *instruction_set,
     bool vm_safe_mode, bool debuggable, bool post_bootcomplete, bool use_jit)
 {
     static const unsigned int MAX_INSTRUCTION_SET_LEN = 7;
@@ -756,9 +754,6 @@
         return;
     }
 
-    char prop_buf[PROPERTY_VALUE_MAX];
-    bool profiler = (property_get("dalvik.vm.profiler", prop_buf, "0") > 0) && (prop_buf[0] == '1');
-
     char dex2oat_Xms_flag[PROPERTY_VALUE_MAX];
     bool have_dex2oat_Xms_flag = property_get("dalvik.vm.dex2oat-Xms", dex2oat_Xms_flag, NULL) > 0;
 
@@ -822,8 +817,6 @@
     char instruction_set_arg[strlen("--instruction-set=") + MAX_INSTRUCTION_SET_LEN];
     char instruction_set_variant_arg[strlen("--instruction-set-variant=") + PROPERTY_VALUE_MAX];
     char instruction_set_features_arg[strlen("--instruction-set-features=") + PROPERTY_VALUE_MAX];
-    char profile_file_arg[strlen("--profile-file=") + PKG_PATH_MAX];
-    char top_k_profile_threshold_arg[strlen("--top-k-profile-threshold=") + PROPERTY_VALUE_MAX];
     char dex2oat_Xms_arg[strlen("-Xms") + PROPERTY_VALUE_MAX];
     char dex2oat_Xmx_arg[strlen("-Xmx") + PROPERTY_VALUE_MAX];
     char dex2oat_compiler_filter_arg[strlen("--compiler-filter=") + PROPERTY_VALUE_MAX];
@@ -842,24 +835,6 @@
         sprintf(dex2oat_swap_fd, "--swap-fd=%d", swap_fd);
     }
 
-    bool have_profile_file = false;
-    bool have_top_k_profile_threshold = false;
-    if (profiler && (strcmp(pkgname, "*") != 0)) {
-        char profile_file[PKG_PATH_MAX];
-        snprintf(profile_file, sizeof(profile_file), "%s/%s",
-                 DALVIK_CACHE_PREFIX "profiles", pkgname);
-        struct stat st;
-        if ((stat(profile_file, &st) == 0) && (st.st_size > 0)) {
-            sprintf(profile_file_arg, "--profile-file=%s", profile_file);
-            have_profile_file = true;
-            if (property_get("dalvik.vm.profile.top-k-thr", prop_buf, NULL) > 0) {
-                snprintf(top_k_profile_threshold_arg, sizeof(top_k_profile_threshold_arg),
-                         "--top-k-profile-threshold=%s", prop_buf);
-                have_top_k_profile_threshold = true;
-            }
-        }
-    }
-
     // use the JIT if either it's specified as a dexopt flag or if the property is set
     use_jit = use_jit || check_boolean_property("debug.usejit");
     if (have_dex2oat_Xms_flag) {
@@ -884,6 +859,7 @@
 
     // Check whether all apps should be compiled debuggable.
     if (!debuggable) {
+        char prop_buf[PROPERTY_VALUE_MAX];
         debuggable =
                 (property_get("dalvik.vm.always_debuggable", prop_buf, "0") > 0) &&
                 (prop_buf[0] == '1');
@@ -894,8 +870,6 @@
     const char* argv[7  // program name, mandatory arguments and the final NULL
                      + (have_dex2oat_isa_variant ? 1 : 0)
                      + (have_dex2oat_isa_features ? 1 : 0)
-                     + (have_profile_file ? 1 : 0)
-                     + (have_top_k_profile_threshold ? 1 : 0)
                      + (have_dex2oat_Xms_flag ? 2 : 0)
                      + (have_dex2oat_Xmx_flag ? 2 : 0)
                      + (have_dex2oat_compiler_filter_flag ? 1 : 0)
@@ -918,12 +892,6 @@
     if (have_dex2oat_isa_features) {
         argv[i++] = instruction_set_features_arg;
     }
-    if (have_profile_file) {
-        argv[i++] = profile_file_arg;
-    }
-    if (have_top_k_profile_threshold) {
-        argv[i++] = top_k_profile_threshold_arg;
-    }
     if (have_dex2oat_Xms_flag) {
         argv[i++] = RUNTIME_ARG;
         argv[i++] = dex2oat_Xms_arg;
@@ -1171,11 +1139,6 @@
         goto fail;
     }
 
-    // Create profile file if there is a package name present.
-    if (strcmp(pkgname, "*") != 0) {
-        create_profile_file(pkgname, uid);
-    }
-
     // Create a swap file if necessary.
     if (ShouldUseSwapFileForDexopt()) {
         // Make sure there really is enough space.
@@ -1239,7 +1202,7 @@
             } else {
                 input_file_name++;
             }
-            run_dex2oat(input_fd, out_fd, input_file_name, out_path, swap_fd, pkgname,
+            run_dex2oat(input_fd, out_fd, input_file_name, out_path, swap_fd,
                         instruction_set, vm_safe_mode, debuggable, boot_complete, use_jit);
         } else {
             ALOGE("Invalid dexopt needed: %d\n", dexopt_needed);
diff --git a/cmds/installd/installd.h b/cmds/installd/installd.h
index df13fe4..8c48b88 100644
--- a/cmds/installd/installd.h
+++ b/cmds/installd/installd.h
@@ -2,16 +2,16 @@
 **
 ** Copyright 2008, The Android Open Source Project
 **
-** Licensed under the Apache License, Version 2.0 (the "License"); 
-** you may not use this file except in compliance with the License. 
-** You may obtain a copy of the License at 
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
 **
-**     http://www.apache.org/licenses/LICENSE-2.0 
+**     http://www.apache.org/licenses/LICENSE-2.0
 **
-** Unless required by applicable law or agreed to in writing, software 
-** distributed under the License is distributed on an "AS IS" BASIS, 
-** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
-** See the License for the specific language governing permissions and 
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
 ** limitations under the License.
 */
 
@@ -231,8 +231,6 @@
 int ensure_dir(const char* path, mode_t mode, uid_t uid, gid_t gid);
 int ensure_media_user_dirs(const char* uuid, userid_t userid);
 int ensure_config_user_dirs(userid_t userid);
-int create_profile_file(const char *pkgname, gid_t gid);
-void remove_profile_file(const char *pkgname);
 
 /* commands.c */
 
diff --git a/cmds/installd/installd.rc b/cmds/installd/installd.rc
new file mode 100644
index 0000000..5e4c925
--- /dev/null
+++ b/cmds/installd/installd.rc
@@ -0,0 +1,3 @@
+service installd /system/bin/installd
+    class main
+    socket installd stream 600 system system
diff --git a/cmds/installd/utils.cpp b/cmds/installd/utils.cpp
index 7db3fb9..abbd021 100644
--- a/cmds/installd/utils.cpp
+++ b/cmds/installd/utils.cpp
@@ -256,7 +256,7 @@
                 if ((name[1] == '.') && (name[2] == 0)) continue;
             }
 
-            subfd = openat(dfd, name, O_RDONLY | O_DIRECTORY);
+            subfd = openat(dfd, name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
             if (subfd < 0) {
                 ALOGE("Couldn't openat %s: %s\n", name, strerror(errno));
                 result = -1;
@@ -316,7 +316,7 @@
     int fd, res;
     DIR *d;
 
-    fd = openat(dfd, name, O_RDONLY | O_DIRECTORY);
+    fd = openat(dfd, name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
     if (fd < 0) {
         ALOGE("Couldn't openat %s: %s\n", name, strerror(errno));
         return -1;
@@ -656,7 +656,7 @@
                 if ((name[1] == '.') && (name[2] == 0)) continue;
             }
 
-            subfd = openat(dfd, name, O_RDONLY | O_DIRECTORY);
+            subfd = openat(dfd, name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
             if (subfd < 0) {
                 ALOGE("Couldn't openat %s: %s\n", name, strerror(errno));
                 continue;
@@ -1143,42 +1143,3 @@
 
    return 0;
 }
-
-int create_profile_file(const char *pkgname, gid_t gid) {
-    const char *profile_dir = DALVIK_CACHE_PREFIX "profiles";
-    char profile_file[PKG_PATH_MAX];
-
-    snprintf(profile_file, sizeof(profile_file), "%s/%s", profile_dir, pkgname);
-
-    // The 'system' user needs to be able to read the profile to determine if dex2oat
-    // needs to be run.  This is done in dalvik.system.DexFile.isDexOptNeededInternal().  So
-    // we assign ownership to AID_SYSTEM and ensure it's not world-readable.
-
-    int fd = open(profile_file, O_WRONLY | O_CREAT | O_NOFOLLOW | O_CLOEXEC, 0660);
-
-    // Always set the uid/gid/permissions. The file could have been previously created
-    // with different permissions.
-    if (fd >= 0) {
-        if (fchown(fd, AID_SYSTEM, gid) < 0) {
-            ALOGE("cannot chown profile file '%s': %s\n", profile_file, strerror(errno));
-            close(fd);
-            unlink(profile_file);
-            return -1;
-        }
-
-        if (fchmod(fd, 0660) < 0) {
-            ALOGE("cannot chmod profile file '%s': %s\n", profile_file, strerror(errno));
-            close(fd);
-            unlink(profile_file);
-            return -1;
-        }
-        close(fd);
-    }
-    return 0;
-}
-
-void remove_profile_file(const char *pkgname) {
-    char profile_file[PKG_PATH_MAX];
-    snprintf(profile_file, sizeof(profile_file), "%s/%s", DALVIK_CACHE_PREFIX "profiles", pkgname);
-    unlink(profile_file);
-}
diff --git a/cmds/servicemanager/Android.mk b/cmds/servicemanager/Android.mk
index 155cfc5..7ee0dd1 100644
--- a/cmds/servicemanager/Android.mk
+++ b/cmds/servicemanager/Android.mk
@@ -22,4 +22,5 @@
 LOCAL_SRC_FILES := service_manager.c binder.c
 LOCAL_CFLAGS += $(svc_c_flags)
 LOCAL_MODULE := servicemanager
+LOCAL_INIT_RC := servicemanager.rc
 include $(BUILD_EXECUTABLE)
diff --git a/cmds/servicemanager/service_manager.c b/cmds/servicemanager/service_manager.c
index 7fa9a39..8596f96 100644
--- a/cmds/servicemanager/service_manager.c
+++ b/cmds/servicemanager/service_manager.c
@@ -23,6 +23,12 @@
 #include <cutils/log.h>
 #endif
 
+struct audit_data {
+    pid_t pid;
+    uid_t uid;
+    const char *name;
+};
+
 const char *str8(const uint16_t *x, size_t x_len)
 {
     static char buf[128];
@@ -56,34 +62,39 @@
 static char *service_manager_context;
 static struct selabel_handle* sehandle;
 
-static bool check_mac_perms(pid_t spid, const char *tctx, const char *perm, const char *name)
+static bool check_mac_perms(pid_t spid, uid_t uid, const char *tctx, const char *perm, const char *name)
 {
     char *sctx = NULL;
     const char *class = "service_manager";
     bool allowed;
+    struct audit_data ad;
 
     if (getpidcon(spid, &sctx) < 0) {
         ALOGE("SELinux: getpidcon(pid=%d) failed to retrieve pid context.\n", spid);
         return false;
     }
 
-    int result = selinux_check_access(sctx, tctx, class, perm, (void *) name);
+    ad.pid = spid;
+    ad.uid = uid;
+    ad.name = name;
+
+    int result = selinux_check_access(sctx, tctx, class, perm, (void *) &ad);
     allowed = (result == 0);
 
     freecon(sctx);
     return allowed;
 }
 
-static bool check_mac_perms_from_getcon(pid_t spid, const char *perm)
+static bool check_mac_perms_from_getcon(pid_t spid, uid_t uid, const char *perm)
 {
     if (selinux_enabled <= 0) {
         return true;
     }
 
-    return check_mac_perms(spid, service_manager_context, perm, NULL);
+    return check_mac_perms(spid, uid, service_manager_context, perm, NULL);
 }
 
-static bool check_mac_perms_from_lookup(pid_t spid, const char *perm, const char *name)
+static bool check_mac_perms_from_lookup(pid_t spid, uid_t uid, const char *perm, const char *name)
 {
     bool allowed;
     char *tctx = NULL;
@@ -102,27 +113,27 @@
         return false;
     }
 
-    allowed = check_mac_perms(spid, tctx, perm, name);
+    allowed = check_mac_perms(spid, uid, tctx, perm, name);
     freecon(tctx);
     return allowed;
 }
 
-static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid)
+static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid)
 {
     const char *perm = "add";
-    return check_mac_perms_from_lookup(spid, perm, str8(name, name_len)) ? 1 : 0;
+    return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0;
 }
 
-static int svc_can_list(pid_t spid)
+static int svc_can_list(pid_t spid, uid_t uid)
 {
     const char *perm = "list";
-    return check_mac_perms_from_getcon(spid, perm) ? 1 : 0;
+    return check_mac_perms_from_getcon(spid, uid, perm) ? 1 : 0;
 }
 
-static int svc_can_find(const uint16_t *name, size_t name_len, pid_t spid)
+static int svc_can_find(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid)
 {
     const char *perm = "find";
-    return check_mac_perms_from_lookup(spid, perm, str8(name, name_len)) ? 1 : 0;
+    return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0;
 }
 
 struct svcinfo
@@ -184,7 +195,7 @@
         }
     }
 
-    if (!svc_can_find(s, len, spid)) {
+    if (!svc_can_find(s, len, spid, uid)) {
         return 0;
     }
 
@@ -204,7 +215,7 @@
     if (!handle || (len == 0) || (len > 127))
         return -1;
 
-    if (!svc_can_register(s, len, spid)) {
+    if (!svc_can_register(s, len, spid, uid)) {
         ALOGE("add_service('%s',%x) uid=%d - PERMISSION DENIED\n",
              str8(s, len), handle, uid);
         return -1;
@@ -314,7 +325,7 @@
     case SVC_MGR_LIST_SERVICES: {
         uint32_t n = bio_get_uint32(msg);
 
-        if (!svc_can_list(txn->sender_pid)) {
+        if (!svc_can_list(txn->sender_pid, txn->sender_euid)) {
             ALOGE("list_service() uid=%d - PERMISSION DENIED\n",
                     txn->sender_euid);
             return -1;
@@ -340,7 +351,14 @@
 
 static int audit_callback(void *data, security_class_t cls, char *buf, size_t len)
 {
-    snprintf(buf, len, "service=%s", !data ? "NULL" : (char *)data);
+    struct audit_data *ad = (struct audit_data *)data;
+
+    if (!ad || !ad->name) {
+        ALOGE("No service manager audit data");
+        return 0;
+    }
+
+    snprintf(buf, len, "service=%s pid=%d uid=%d", ad->name, ad->pid, ad->uid);
     return 0;
 }
 
diff --git a/cmds/servicemanager/servicemanager.rc b/cmds/servicemanager/servicemanager.rc
new file mode 100644
index 0000000..b70fda7
--- /dev/null
+++ b/cmds/servicemanager/servicemanager.rc
@@ -0,0 +1,10 @@
+service servicemanager /system/bin/servicemanager
+    class core
+    user system
+    group system readproc
+    critical
+    onrestart restart healthd
+    onrestart restart zygote
+    onrestart restart media
+    onrestart restart surfaceflinger
+    onrestart restart drm
diff --git a/include/android/sensor.h b/include/android/sensor.h
index 73928ea..9472ad6 100644
--- a/include/android/sensor.h
+++ b/include/android/sensor.h
@@ -59,7 +59,7 @@
 
 /**
  * Sensor types.
- * (keep in sync with hardware/sensor.h)
+ * (keep in sync with hardware/sensors.h)
  */
 enum {
     /**
@@ -69,7 +69,7 @@
      *  All values are in SI units (m/s^2) and measure the acceleration of the
      *  device minus the force of gravity.
      */
-    ASENSOR_TYPE_ACCELEROMETER      = 1,
+    ASENSOR_TYPE_ACCELEROMETER       = 1,
     /**
      * {@link ASENSOR_TYPE_MAGNETIC_FIELD}
      * reporting-mode: continuous
@@ -77,7 +77,7 @@
      *  All values are in micro-Tesla (uT) and measure the geomagnetic
      *  field in the X, Y and Z axis.
      */
-    ASENSOR_TYPE_MAGNETIC_FIELD     = 2,
+    ASENSOR_TYPE_MAGNETIC_FIELD      = 2,
     /**
      * {@link ASENSOR_TYPE_GYROSCOPE}
      * reporting-mode: continuous
@@ -85,14 +85,14 @@
      *  All values are in radians/second and measure the rate of rotation
      *  around the X, Y and Z axis.
      */
-    ASENSOR_TYPE_GYROSCOPE          = 4,
+    ASENSOR_TYPE_GYROSCOPE           = 4,
     /**
      * {@link ASENSOR_TYPE_LIGHT}
      * reporting-mode: on-change
      *
      * The light sensor value is returned in SI lux units.
      */
-    ASENSOR_TYPE_LIGHT              = 5,
+    ASENSOR_TYPE_LIGHT               = 5,
     /**
      * {@link ASENSOR_TYPE_PROXIMITY}
      * reporting-mode: on-change
@@ -103,7 +103,15 @@
      * SENSOR_FLAG_WAKE_UP.
      * The value corresponds to the distance to the nearest object in centimeters.
      */
-    ASENSOR_TYPE_PROXIMITY          = 8
+    ASENSOR_TYPE_PROXIMITY           = 8,
+    /**
+     * {@link ASENSOR_TYPE_LINEAR_ACCELERATION}
+     * reporting-mode: continuous
+     *
+     *  All values are in SI units (m/s^2) and measure the acceleration of the
+     *  device not including the force of gravity.
+     */
+    ASENSOR_TYPE_LINEAR_ACCELERATION = 10
 };
 
 /**
diff --git a/include/batteryservice/BatteryService.h b/include/batteryservice/BatteryService.h
index 12d15ba..912dcf6 100644
--- a/include/batteryservice/BatteryService.h
+++ b/include/batteryservice/BatteryService.h
@@ -65,6 +65,9 @@
     int batteryLevel;
     int batteryVoltage;
     int batteryTemperature;
+    int batteryCurrent;
+    int batteryCycleCount;
+    int batteryFullCharge;
     String8 batteryTechnology;
 
     status_t writeToParcel(Parcel* parcel) const;
diff --git a/include/binder/IServiceManager.h b/include/binder/IServiceManager.h
index 2c297d6..7ccd9fe 100644
--- a/include/binder/IServiceManager.h
+++ b/include/binder/IServiceManager.h
@@ -81,20 +81,6 @@
                             int32_t* outPid, int32_t* outUid);
 bool checkPermission(const String16& permission, pid_t pid, uid_t uid);
 
-
-// ----------------------------------------------------------------------
-
-class BnServiceManager : public BnInterface<IServiceManager>
-{
-public:
-    virtual status_t    onTransact( uint32_t code,
-                                    const Parcel& data,
-                                    Parcel* reply,
-                                    uint32_t flags = 0);
-};
-
-// ----------------------------------------------------------------------
-
 }; // namespace android
 
 #endif // ANDROID_ISERVICE_MANAGER_H
diff --git a/include/binder/Parcel.h b/include/binder/Parcel.h
index 430c3ff..16a4790 100644
--- a/include/binder/Parcel.h
+++ b/include/binder/Parcel.h
@@ -20,6 +20,7 @@
 #include <vector>
 
 #include <cutils/native_handle.h>
+#include <nativehelper/ScopedFd.h>
 #include <utils/Errors.h>
 #include <utils/RefBase.h>
 #include <utils/String16.h>
@@ -28,6 +29,7 @@
 #include <linux/binder.h>
 
 #include <binder/IInterface.h>
+#include <binder/Parcelable.h>
 
 // ---------------------------------------------------------------------------
 namespace android {
@@ -128,6 +130,10 @@
     status_t            writeStrongBinderVector(const std::vector<sp<IBinder>>& val);
 
     template<typename T>
+    status_t            writeParcelableVector(const std::vector<T>& val);
+    status_t            writeParcelable(const Parcelable& parcelable);
+
+    template<typename T>
     status_t            write(const Flattenable<T>& val);
 
     template<typename T>
@@ -149,6 +155,17 @@
     // will be closed once the parcel is destroyed.
     status_t            writeDupFileDescriptor(int fd);
 
+    // Place a file descriptor into the parcel.  This will not affect the
+    // semantics of the smart file descriptor. A new descriptor will be
+    // created, and will be closed when the parcel is destroyed.
+    status_t            writeUniqueFileDescriptor(
+                            const ScopedFd& fd);
+
+    // Place a vector of file desciptors into the parcel. Each descriptor is
+    // dup'd as in writeDupFileDescriptor
+    status_t            writeUniqueFileDescriptorVector(
+                            const std::vector<ScopedFd>& val);
+
     // Writes a blob to the parcel.
     // If the blob is small, then it is stored in-place, otherwise it is
     // transferred by way of an anonymous shared memory region.  Prefer sending
@@ -204,6 +221,10 @@
     wp<IBinder>         readWeakBinder() const;
 
     template<typename T>
+    status_t            readParcelableVector(std::vector<T>* val) const;
+    status_t            readParcelable(Parcelable* parcelable) const;
+
+    template<typename T>
     status_t            readStrongBinder(sp<T>* val) const;
 
     status_t            readStrongBinderVector(std::vector<sp<IBinder>>* val) const;
@@ -241,6 +262,15 @@
     // in the parcel, which you do not own -- use dup() to get your own copy.
     int                 readFileDescriptor() const;
 
+    // Retrieve a smart file descriptor from the parcel.
+    status_t            readUniqueFileDescriptor(
+                            ScopedFd* val) const;
+
+
+    // Retrieve a vector of smart file descriptors from the parcel.
+    status_t            readUniqueFileDescriptorVector(
+                            std::vector<ScopedFd>* val) const;
+
     // Reads a blob from the parcel.
     // The caller should call release() on the blob after reading its contents.
     status_t            readBlob(size_t len, ReadableBlob* outBlob) const;
@@ -296,6 +326,22 @@
     template<class T>
     status_t            writeAligned(T val);
 
+    template<typename T, typename U>
+    status_t            unsafeReadTypedVector(std::vector<T>* val,
+                                              status_t(Parcel::*read_func)(U*) const) const;
+    template<typename T>
+    status_t            readTypedVector(std::vector<T>* val,
+                                        status_t(Parcel::*read_func)(T*) const) const;
+    template<typename T, typename U>
+    status_t            unsafeWriteTypedVector(const std::vector<T>& val,
+                                               status_t(Parcel::*write_func)(U));
+    template<typename T>
+    status_t            writeTypedVector(const std::vector<T>& val,
+                                         status_t(Parcel::*write_func)(const T&));
+    template<typename T>
+    status_t            writeTypedVector(const std::vector<T>& val,
+                                         status_t(Parcel::*write_func)(T));
+
     status_t            mError;
     uint8_t*            mData;
     size_t              mDataSize;
@@ -458,6 +504,87 @@
     return ret;
 }
 
+template<typename T, typename U>
+status_t Parcel::unsafeReadTypedVector(
+        std::vector<T>* val, status_t(Parcel::*read_func)(U*) const) const {
+    val->clear();
+
+    int32_t size;
+    status_t status = this->readInt32(&size);
+
+    if (status != OK) {
+        return status;
+    }
+
+    if (size < 0) {
+        return UNEXPECTED_NULL;
+    }
+
+    val->resize(size);
+
+    for (auto& v: *val) {
+        status = (this->*read_func)(&v);
+
+        if (status != OK) {
+            return status;
+        }
+    }
+
+    return OK;
+}
+
+template<typename T>
+status_t Parcel::readTypedVector(std::vector<T>* val,
+                                 status_t(Parcel::*read_func)(T*) const) const {
+    return unsafeReadTypedVector(val, read_func);
+}
+
+template<typename T, typename U>
+status_t Parcel::unsafeWriteTypedVector(const std::vector<T>& val,
+                                        status_t(Parcel::*write_func)(U)) {
+    if (val.size() > std::numeric_limits<int32_t>::max()) {
+        return BAD_VALUE;
+    }
+
+    status_t status = this->writeInt32(val.size());
+
+    if (status != OK) {
+        return status;
+    }
+
+    for (const auto& item : val) {
+        status = (this->*write_func)(item);
+
+        if (status != OK) {
+            return status;
+        }
+    }
+
+    return OK;
+}
+
+template<typename T>
+status_t Parcel::writeTypedVector(const std::vector<T>& val,
+                          status_t(Parcel::*write_func)(const T&)) {
+    return unsafeWriteTypedVector(val, write_func);
+}
+
+template<typename T>
+status_t Parcel::writeTypedVector(const std::vector<T>& val,
+                          status_t(Parcel::*write_func)(T)) {
+    return unsafeWriteTypedVector(val, write_func);
+}
+
+template<typename T>
+status_t Parcel::readParcelableVector(std::vector<T>* val) const {
+    return unsafeReadTypedVector(val, &Parcel::readParcelable);
+}
+
+template<typename T>
+status_t Parcel::writeParcelableVector(const std::vector<T>& val) {
+    return unsafeWriteTypedVector(val, &Parcel::writeParcelable);
+}
+
 // ---------------------------------------------------------------------------
 
 inline TextOutput& operator<<(TextOutput& to, const Parcel& parcel)
diff --git a/include/binder/Parcelable.h b/include/binder/Parcelable.h
new file mode 100644
index 0000000..faf0d34
--- /dev/null
+++ b/include/binder/Parcelable.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_PARCELABLE_H
+#define ANDROID_PARCELABLE_H
+
+#include <vector>
+
+#include <utils/Errors.h>
+#include <utils/String16.h>
+
+namespace android {
+
+class Parcel;
+
+// Abstract interface of all parcelables.
+class Parcelable {
+public:
+    virtual ~Parcelable() = default;
+
+    // Write |this| parcelable to the given |parcel|.  Keep in mind that
+    // implementations of writeToParcel must be manually kept in sync
+    // with readFromParcel and the Java equivalent versions of these methods.
+    //
+    // Returns android::OK on success and an appropriate error otherwise.
+    virtual status_t writeToParcel(Parcel* parcel) const = 0;
+
+    // Read data from the given |parcel| into |this|.  After readFromParcel
+    // completes, |this| should have equivalent state to the object that
+    // wrote itself to the parcel.
+    //
+    // Returns android::OK on success and an appropriate error otherwise.
+    virtual status_t readFromParcel(const Parcel* parcel) = 0;
+};  // class Parcelable
+
+}  // namespace android
+
+#endif // ANDROID_PARCELABLE_H
diff --git a/include/input/Input.h b/include/input/Input.h
index 617175b..3b1c86b 100644
--- a/include/input/Input.h
+++ b/include/input/Input.h
@@ -140,7 +140,7 @@
 
 namespace android {
 
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
 class Parcel;
 #endif
 
@@ -235,7 +235,7 @@
         return getAxisValue(AMOTION_EVENT_AXIS_Y);
     }
 
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
     status_t readFromParcel(Parcel* parcel);
     status_t writeToParcel(Parcel* parcel) const;
 #endif
@@ -573,7 +573,7 @@
     // Matrix is in row-major form and compatible with SkMatrix.
     void transform(const float matrix[9]);
 
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
     status_t readFromParcel(Parcel* parcel);
     status_t writeToParcel(Parcel* parcel) const;
 #endif
diff --git a/include/input/KeyCharacterMap.h b/include/input/KeyCharacterMap.h
index 3f0914b..eb5840e 100644
--- a/include/input/KeyCharacterMap.h
+++ b/include/input/KeyCharacterMap.h
@@ -19,7 +19,7 @@
 
 #include <stdint.h>
 
-#if HAVE_ANDROID_OS
+#ifdef __ANDROID__
 #include <binder/IBinder.h>
 #endif
 
@@ -129,7 +129,7 @@
     void tryRemapKey(int32_t scanCode, int32_t metaState,
             int32_t* outKeyCode, int32_t* outMetaState) const;
 
-#if HAVE_ANDROID_OS
+#ifdef __ANDROID__
     /* Reads a key map from a parcel. */
     static sp<KeyCharacterMap> readFromParcel(Parcel* parcel);
 
diff --git a/include/powermanager/IPowerManager.h b/include/powermanager/IPowerManager.h
index 91ecc5a..461fad7 100644
--- a/include/powermanager/IPowerManager.h
+++ b/include/powermanager/IPowerManager.h
@@ -25,12 +25,35 @@
 
 // ----------------------------------------------------------------------------
 
-// must be kept in sync with interface defined in IPowerManager.aidl
 class IPowerManager : public IInterface
 {
 public:
+    // These transaction IDs must be kept in sync with the method order from
+    // IPowerManager.aidl.
+    enum {
+        ACQUIRE_WAKE_LOCK            = IBinder::FIRST_CALL_TRANSACTION,
+        ACQUIRE_WAKE_LOCK_UID        = IBinder::FIRST_CALL_TRANSACTION + 1,
+        RELEASE_WAKE_LOCK            = IBinder::FIRST_CALL_TRANSACTION + 2,
+        UPDATE_WAKE_LOCK_UIDS        = IBinder::FIRST_CALL_TRANSACTION + 3,
+        POWER_HINT                   = IBinder::FIRST_CALL_TRANSACTION + 4,
+        UPDATE_WAKE_LOCK_SOURCE      = IBinder::FIRST_CALL_TRANSACTION + 5,
+        IS_WAKE_LOCK_LEVEL_SUPPORTED = IBinder::FIRST_CALL_TRANSACTION + 6,
+        USER_ACTIVITY                = IBinder::FIRST_CALL_TRANSACTION + 7,
+        WAKE_UP                      = IBinder::FIRST_CALL_TRANSACTION + 8,
+        GO_TO_SLEEP                  = IBinder::FIRST_CALL_TRANSACTION + 9,
+        NAP                          = IBinder::FIRST_CALL_TRANSACTION + 10,
+        IS_INTERACTIVE               = IBinder::FIRST_CALL_TRANSACTION + 11,
+        IS_POWER_SAVE_MODE           = IBinder::FIRST_CALL_TRANSACTION + 12,
+        SET_POWER_SAVE_MODE          = IBinder::FIRST_CALL_TRANSACTION + 13,
+        REBOOT                       = IBinder::FIRST_CALL_TRANSACTION + 14,
+        SHUTDOWN                     = IBinder::FIRST_CALL_TRANSACTION + 15,
+        CRASH                        = IBinder::FIRST_CALL_TRANSACTION + 16,
+    };
+
     DECLARE_META_INTERFACE(PowerManager);
 
+    // The parcels created by these methods must be kept in sync with the
+    // corresponding methods from IPowerManager.aidl.
     // FIXME remove the bool isOneWay parameters as they are not oneway in the .aidl
     virtual status_t acquireWakeLock(int flags, const sp<IBinder>& lock, const String16& tag,
             const String16& packageName, bool isOneWay = false) = 0;
@@ -39,8 +62,11 @@
     virtual status_t releaseWakeLock(const sp<IBinder>& lock, int flags, bool isOneWay = false) = 0;
     virtual status_t updateWakeLockUids(const sp<IBinder>& lock, int len, const int *uids,
             bool isOneWay = false) = 0;
-    // oneway in the .aidl
     virtual status_t powerHint(int hintId, int data) = 0;
+    virtual status_t goToSleep(int64_t event_time_ms, int reason, int flags) = 0;
+    virtual status_t reboot(bool confirm, const String16& reason, bool wait) = 0;
+    virtual status_t shutdown(bool confirm, const String16& reason, bool wait) = 0;
+    virtual status_t crash(const String16& message) = 0;
 };
 
 // ----------------------------------------------------------------------------
diff --git a/include/ui/Region.h b/include/ui/Region.h
index 2a14918..810f098 100644
--- a/include/ui/Region.h
+++ b/include/ui/Region.h
@@ -28,7 +28,6 @@
 namespace android {
 // ---------------------------------------------------------------------------
 
-class SharedBuffer;
 class String8;
 
 // ---------------------------------------------------------------------------
@@ -130,11 +129,6 @@
     // Region object.
     Rect const* getArray(size_t* count) const;
 
-    // returns a SharedBuffer as well as the number of rects.
-    // ownership is transfered to the caller.
-    // the caller must call SharedBuffer::release() to free the memory.
-    SharedBuffer const* getSharedBuffer(size_t* count) const;
-
     /* no user serviceable parts here... */
 
             // add a rectangle to the internal list. This rectangle must
diff --git a/libs/binder/Android.mk b/libs/binder/Android.mk
index bd432f3..bd11177 100644
--- a/libs/binder/Android.mk
+++ b/libs/binder/Android.mk
@@ -44,6 +44,9 @@
 include $(CLEAR_VARS)
 LOCAL_MODULE := libbinder
 LOCAL_SHARED_LIBRARIES := liblog libcutils libutils
+
+LOCAL_CLANG := true
+LOCAL_SANITIZE := integer
 LOCAL_SRC_FILES := $(sources)
 ifneq ($(TARGET_USES_64_BIT_BINDER),true)
 ifneq ($(TARGET_IS_64_BIT),true)
diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp
index ef88181..a237684 100644
--- a/libs/binder/IPCThreadState.cpp
+++ b/libs/binder/IPCThreadState.cpp
@@ -852,7 +852,7 @@
         IF_LOG_COMMANDS() {
             alog << "About to read/write, write size = " << mOut.dataSize() << endl;
         }
-#if defined(HAVE_ANDROID_OS)
+#if defined(__ANDROID__)
         if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
             err = NO_ERROR;
         else
@@ -1158,7 +1158,7 @@
         IPCThreadState* const self = static_cast<IPCThreadState*>(st);
         if (self) {
                 self->flushCommands();
-#if defined(HAVE_ANDROID_OS)
+#if defined(__ANDROID__)
         if (self->mProcess->mDriverFD > 0) {
             ioctl(self->mProcess->mDriverFD, BINDER_THREAD_EXIT, 0);
         }
diff --git a/libs/binder/IServiceManager.cpp b/libs/binder/IServiceManager.cpp
index 3c716df..61f24d6 100644
--- a/libs/binder/IServiceManager.cpp
+++ b/libs/binder/IServiceManager.cpp
@@ -33,7 +33,7 @@
 sp<IServiceManager> defaultServiceManager()
 {
     if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
-    
+
     {
         AutoMutex _l(gDefaultServiceManagerLock);
         while (gDefaultServiceManager == NULL) {
@@ -43,7 +43,7 @@
                 sleep(1);
         }
     }
-    
+
     return gDefaultServiceManager;
 }
 
@@ -67,11 +67,16 @@
 
 bool checkPermission(const String16& permission, pid_t pid, uid_t uid)
 {
+#ifdef __BRILLO__
+    // Brillo doesn't currently run ActivityManager or support framework permissions.
+    return true;
+#endif
+
     sp<IPermissionController> pc;
     gDefaultServiceManagerLock.lock();
     pc = gPermissionController;
     gDefaultServiceManagerLock.unlock();
-    
+
     int64_t startTime = 0;
 
     while (true) {
@@ -85,14 +90,14 @@
                 }
                 return res;
             }
-            
+
             // Is this a permission failure, or did the controller go away?
             if (IInterface::asBinder(pc)->isBinderAlive()) {
                 ALOGW("Permission failure: %s from uid=%d pid=%d",
                         String8(permission).string(), uid, pid);
                 return false;
             }
-            
+
             // Object is dead!
             gDefaultServiceManagerLock.lock();
             if (gPermissionController == pc) {
@@ -100,7 +105,7 @@
             }
             gDefaultServiceManagerLock.unlock();
         }
-    
+
         // Need to retrieve the permission controller.
         sp<IBinder> binder = defaultServiceManager()->checkService(_permission);
         if (binder == NULL) {
@@ -113,7 +118,7 @@
             sleep(1);
         } else {
             pc = interface_cast<IPermissionController>(binder);
-            // Install the new permission controller, and try again.        
+            // Install the new permission controller, and try again.
             gDefaultServiceManagerLock.lock();
             gPermissionController = pc;
             gDefaultServiceManagerLock.unlock();
@@ -184,48 +189,4 @@
 
 IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager");
 
-// ----------------------------------------------------------------------
-
-status_t BnServiceManager::onTransact(
-    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
-{
-    //printf("ServiceManager received: "); data.print();
-    switch(code) {
-        case GET_SERVICE_TRANSACTION: {
-            CHECK_INTERFACE(IServiceManager, data, reply);
-            String16 which = data.readString16();
-            sp<IBinder> b = const_cast<BnServiceManager*>(this)->getService(which);
-            reply->writeStrongBinder(b);
-            return NO_ERROR;
-        } break;
-        case CHECK_SERVICE_TRANSACTION: {
-            CHECK_INTERFACE(IServiceManager, data, reply);
-            String16 which = data.readString16();
-            sp<IBinder> b = const_cast<BnServiceManager*>(this)->checkService(which);
-            reply->writeStrongBinder(b);
-            return NO_ERROR;
-        } break;
-        case ADD_SERVICE_TRANSACTION: {
-            CHECK_INTERFACE(IServiceManager, data, reply);
-            String16 which = data.readString16();
-            sp<IBinder> b = data.readStrongBinder();
-            status_t err = addService(which, b);
-            reply->writeInt32(err);
-            return NO_ERROR;
-        } break;
-        case LIST_SERVICES_TRANSACTION: {
-            CHECK_INTERFACE(IServiceManager, data, reply);
-            Vector<String16> list = listServices();
-            const size_t N = list.size();
-            reply->writeInt32(N);
-            for (size_t i=0; i<N; i++) {
-                reply->writeString16(list[i]);
-            }
-            return NO_ERROR;
-        } break;
-        default:
-            return BBinder::onTransact(code, data, reply, flags);
-    }
-}
-
 }; // namespace android
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 1d6ec9e..13ecc87 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -336,39 +336,6 @@
     return BAD_TYPE;
 }
 
-namespace {
-
-template<typename T>
-status_t readTypedVector(std::vector<T>* val, const Parcel* p,
-                         status_t(Parcel::*read_func)(T*) const) {
-    val->clear();
-
-    int32_t size;
-    status_t status = p->readInt32(&size);
-
-    if (status != OK) {
-        return status;
-    }
-
-    if (size < 0) {
-        return UNEXPECTED_NULL;
-    }
-
-    val->resize(size);
-
-    for (auto& v: *val) {
-        status = (p->*read_func)(&v);
-
-        if (status != OK) {
-            return status;
-        }
-    }
-
-    return OK;
-}
-
-}  // namespace
-
 // ---------------------------------------------------------------------------
 
 Parcel::Parcel()
@@ -774,46 +741,6 @@
     return NULL;
 }
 
-namespace {
-
-template<typename T, typename U>
-status_t unsafeWriteTypedVector(const std::vector<T>& val, Parcel* p,
-                                status_t(Parcel::*write_func)(U)) {
-    if (val.size() > std::numeric_limits<int32_t>::max()) {
-        return BAD_VALUE;
-    }
-
-    status_t status = p->writeInt32(val.size());
-
-    if (status != OK) {
-        return status;
-    }
-
-    for (const auto& item : val) {
-        status = (p->*write_func)(item);
-
-        if (status != OK) {
-            return status;
-        }
-    }
-
-    return OK;
-}
-
-template<typename T>
-status_t writeTypedVector(const std::vector<T>& val, Parcel* p,
-                          status_t(Parcel::*write_func)(const T&)) {
-    return unsafeWriteTypedVector(val, p, write_func);
-}
-
-template<typename T>
-status_t writeTypedVector(const std::vector<T>& val, Parcel* p,
-                          status_t(Parcel::*write_func)(T)) {
-    return unsafeWriteTypedVector(val, p, write_func);
-}
-
-}  // namespace
-
 status_t Parcel::writeByteVector(const std::vector<int8_t>& val)
 {
     status_t status;
@@ -839,37 +766,37 @@
 
 status_t Parcel::writeInt32Vector(const std::vector<int32_t>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeInt32);
+    return writeTypedVector(val, &Parcel::writeInt32);
 }
 
 status_t Parcel::writeInt64Vector(const std::vector<int64_t>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeInt64);
+    return writeTypedVector(val, &Parcel::writeInt64);
 }
 
 status_t Parcel::writeFloatVector(const std::vector<float>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeFloat);
+    return writeTypedVector(val, &Parcel::writeFloat);
 }
 
 status_t Parcel::writeDoubleVector(const std::vector<double>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeDouble);
+    return writeTypedVector(val, &Parcel::writeDouble);
 }
 
 status_t Parcel::writeBoolVector(const std::vector<bool>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeBool);
+    return writeTypedVector(val, &Parcel::writeBool);
 }
 
 status_t Parcel::writeCharVector(const std::vector<char16_t>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeChar);
+    return writeTypedVector(val, &Parcel::writeChar);
 }
 
 status_t Parcel::writeString16Vector(const std::vector<String16>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeString16);
+    return writeTypedVector(val, &Parcel::writeString16);
 }
 
 status_t Parcel::writeInt32(int32_t val)
@@ -1018,11 +945,11 @@
 
 status_t Parcel::writeStrongBinderVector(const std::vector<sp<IBinder>>& val)
 {
-    return writeTypedVector(val, this, &Parcel::writeStrongBinder);
+    return writeTypedVector(val, &Parcel::writeStrongBinder);
 }
 
 status_t Parcel::readStrongBinderVector(std::vector<sp<IBinder>>* val) const {
-    return readTypedVector(val, this, &Parcel::readStrongBinder);
+    return readTypedVector(val, &Parcel::readStrongBinder);
 }
 
 status_t Parcel::writeWeakBinder(const wp<IBinder>& val)
@@ -1030,6 +957,14 @@
     return flatten_binder(ProcessState::self(), val, this);
 }
 
+status_t Parcel::writeParcelable(const Parcelable& parcelable) {
+    status_t status = writeInt32(1);  // parcelable is not null.
+    if (status != OK) {
+        return status;
+    }
+    return parcelable.writeToParcel(this);
+}
+
 status_t Parcel::writeNativeHandle(const native_handle* handle)
 {
     if (!handle || handle->version != sizeof(native_handle))
@@ -1071,12 +1006,20 @@
         return -errno;
     }
     status_t err = writeFileDescriptor(dupFd, true /*takeOwnership*/);
-    if (err) {
+    if (err != OK) {
         close(dupFd);
     }
     return err;
 }
 
+status_t Parcel::writeUniqueFileDescriptor(const ScopedFd& fd) {
+    return writeDupFileDescriptor(fd.get());
+}
+
+status_t Parcel::writeUniqueFileDescriptorVector(const std::vector<ScopedFd>& val) {
+    return writeTypedVector(val, &Parcel::writeUniqueFileDescriptor);
+}
+
 status_t Parcel::writeBlob(size_t len, bool mutableCopy, WritableBlob* outBlob)
 {
     if (len > INT32_MAX) {
@@ -1343,19 +1286,19 @@
 }
 
 status_t Parcel::readInt32Vector(std::vector<int32_t>* val) const {
-    return readTypedVector(val, this, &Parcel::readInt32);
+    return readTypedVector(val, &Parcel::readInt32);
 }
 
 status_t Parcel::readInt64Vector(std::vector<int64_t>* val) const {
-    return readTypedVector(val, this, &Parcel::readInt64);
+    return readTypedVector(val, &Parcel::readInt64);
 }
 
 status_t Parcel::readFloatVector(std::vector<float>* val) const {
-    return readTypedVector(val, this, &Parcel::readFloat);
+    return readTypedVector(val, &Parcel::readFloat);
 }
 
 status_t Parcel::readDoubleVector(std::vector<double>* val) const {
-    return readTypedVector(val, this, &Parcel::readDouble);
+    return readTypedVector(val, &Parcel::readDouble);
 }
 
 status_t Parcel::readBoolVector(std::vector<bool>* val) const {
@@ -1391,11 +1334,11 @@
 }
 
 status_t Parcel::readCharVector(std::vector<char16_t>* val) const {
-    return readTypedVector(val, this, &Parcel::readChar);
+    return readTypedVector(val, &Parcel::readChar);
 }
 
 status_t Parcel::readString16Vector(std::vector<String16>* val) const {
-    return readTypedVector(val, this, &Parcel::readString16);
+    return readTypedVector(val, &Parcel::readString16);
 }
 
 
@@ -1640,6 +1583,18 @@
     return val;
 }
 
+status_t Parcel::readParcelable(Parcelable* parcelable) const {
+    int32_t have_parcelable = 0;
+    status_t status = readInt32(&have_parcelable);
+    if (status != OK) {
+        return status;
+    }
+    if (!have_parcelable) {
+        return UNEXPECTED_NULL;
+    }
+    return parcelable->readFromParcel(this);
+}
+
 int32_t Parcel::readExceptionCode() const
 {
     binder::Status status;
@@ -1678,16 +1633,36 @@
 int Parcel::readFileDescriptor() const
 {
     const flat_binder_object* flat = readObject(true);
-    if (flat) {
-        switch (flat->type) {
-            case BINDER_TYPE_FD:
-                //ALOGI("Returning file descriptor %ld from parcel %p", flat->handle, this);
-                return flat->handle;
-        }
+
+    if (flat && flat->type == BINDER_TYPE_FD) {
+        return flat->handle;
     }
+
     return BAD_TYPE;
 }
 
+status_t Parcel::readUniqueFileDescriptor(ScopedFd* val) const
+{
+    int got = readFileDescriptor();
+
+    if (got == BAD_TYPE) {
+        return BAD_TYPE;
+    }
+
+    val->reset(dup(got));
+
+    if (val->get() < 0) {
+        return BAD_VALUE;
+    }
+
+    return OK;
+}
+
+
+status_t Parcel::readUniqueFileDescriptorVector(std::vector<ScopedFd>* val) const {
+    return readTypedVector(val, &Parcel::readUniqueFileDescriptor);
+}
+
 status_t Parcel::readBlob(size_t len, ReadableBlob* outBlob) const
 {
     int32_t blobType;
diff --git a/libs/binder/ProcessState.cpp b/libs/binder/ProcessState.cpp
index 016d3c5..821ab6c 100644
--- a/libs/binder/ProcessState.cpp
+++ b/libs/binder/ProcessState.cpp
@@ -350,10 +350,6 @@
     , mThreadPoolSeq(1)
 {
     if (mDriverFD >= 0) {
-        // XXX Ideally, there should be a specific define for whether we
-        // have mmap (or whether we could possibly have the kernel module
-        // availabla).
-#if !defined(HAVE_WIN32_IPC)
         // mmap the binder, providing a chunk of virtual address space to receive transactions.
         mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
         if (mVMStart == MAP_FAILED) {
@@ -362,9 +358,6 @@
             close(mDriverFD);
             mDriverFD = -1;
         }
-#else
-        mDriverFD = -1;
-#endif
     }
 
     LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver could not be opened.  Terminating.");
diff --git a/libs/binder/tests/Android.mk b/libs/binder/tests/Android.mk
index 3668729..a40523d 100644
--- a/libs/binder/tests/Android.mk
+++ b/libs/binder/tests/Android.mk
@@ -32,3 +32,11 @@
 LOCAL_SRC_FILES := binderLibTest.cpp
 LOCAL_SHARED_LIBRARIES := libbinder libutils
 include $(BUILD_NATIVE_TEST)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := binderThroughputTest
+LOCAL_SRC_FILES := binderThroughputTest.cpp
+LOCAL_SHARED_LIBRARIES := libbinder libutils
+LOCAL_CLANG := true
+LOCAL_CFLAGS += -g -Wall -Werror -std=c++11 -Wno-missing-field-initializers -Wno-sign-compare -O3
+include $(BUILD_NATIVE_TEST)
diff --git a/libs/binder/tests/binderThroughputTest.cpp b/libs/binder/tests/binderThroughputTest.cpp
new file mode 100644
index 0000000..71b96d4
--- /dev/null
+++ b/libs/binder/tests/binderThroughputTest.cpp
@@ -0,0 +1,317 @@
+#include <binder/Binder.h>
+#include <binder/IBinder.h>
+#include <binder/IPCThreadState.h>
+#include <binder/IServiceManager.h>
+#include <string>
+#include <cstring>
+#include <cstdlib>
+#include <cstdio>
+
+#include <iostream>
+#include <vector>
+#include <tuple>
+
+#include <unistd.h>
+#include <sys/wait.h>
+
+using namespace std;
+using namespace android;
+
+enum BinderWorkerServiceCode {
+    BINDER_NOP = IBinder::FIRST_CALL_TRANSACTION,
+};
+
+#define ASSERT_TRUE(cond) \
+do { \
+    if (!(cond)) {\
+       cerr << __func__ << ":" << __LINE__ << " condition:" << #cond << " failed\n" << endl; \
+       exit(EXIT_FAILURE); \
+    } \
+} while (0)
+
+class BinderWorkerService : public BBinder
+{
+public:
+    BinderWorkerService() {}
+    ~BinderWorkerService() {}
+    virtual status_t onTransact(uint32_t code,
+                                const Parcel& data, Parcel* reply,
+                                uint32_t flags = 0) {
+        (void)flags;
+        (void)data;
+        (void)reply;
+        switch (code) {
+        case BINDER_NOP:
+            return NO_ERROR;
+        default:
+            return UNKNOWN_TRANSACTION;
+        };
+    }
+};
+
+class Pipe {
+    int m_readFd;
+    int m_writeFd;
+    Pipe(int readFd, int writeFd) : m_readFd{readFd}, m_writeFd{writeFd} {}
+    Pipe(const Pipe &) = delete;
+    Pipe& operator=(const Pipe &) = delete;
+    Pipe& operator=(const Pipe &&) = delete;
+public:
+    Pipe(Pipe&& rval) noexcept {
+        m_readFd = rval.m_readFd;
+        m_writeFd = rval.m_writeFd;
+        rval.m_readFd = 0;
+        rval.m_writeFd = 0;
+    }
+    ~Pipe() {
+        if (m_readFd)
+            close(m_readFd);
+        if (m_writeFd)
+            close(m_writeFd);
+    }
+    void signal() {
+        bool val = true;
+        int error = write(m_writeFd, &val, sizeof(val));
+        ASSERT_TRUE(error >= 0);
+    };
+    void wait() {
+        bool val = false;
+        int error = read(m_readFd, &val, sizeof(val));
+        ASSERT_TRUE(error >= 0);
+    }
+    template <typename T> void send(const T& v) {
+        int error = write(m_writeFd, &v, sizeof(T));
+        ASSERT_TRUE(error >= 0);
+    }
+    template <typename T> void recv(T& v) {
+        int error = read(m_readFd, &v, sizeof(T));
+        ASSERT_TRUE(error >= 0);
+    }
+    static tuple<Pipe, Pipe> createPipePair() {
+        int a[2];
+        int b[2];
+
+        int error1 = pipe(a);
+        int error2 = pipe(b);
+        ASSERT_TRUE(error1 >= 0);
+        ASSERT_TRUE(error2 >= 0);
+
+        return make_tuple(Pipe(a[0], b[1]), Pipe(b[0], a[1]));
+    }
+};
+
+static const uint32_t num_buckets = 128;
+static const uint64_t max_time_bucket = 50ull * 1000000;
+static const uint64_t time_per_bucket = max_time_bucket / num_buckets;
+static constexpr float time_per_bucket_ms = time_per_bucket / 1.0E6;
+
+struct ProcResults {
+    uint64_t m_best = max_time_bucket;
+    uint64_t m_worst = 0;
+    uint32_t m_buckets[num_buckets] = {0};
+    uint64_t m_transactions = 0;
+    uint64_t m_total_time = 0;
+
+    void add_time(uint64_t time) {
+        m_buckets[min(time, max_time_bucket-1) / time_per_bucket] += 1;
+        m_best = min(time, m_best);
+        m_worst = max(time, m_worst);
+        m_transactions += 1;
+        m_total_time += time;
+    }
+    static ProcResults combine(const ProcResults& a, const ProcResults& b) {
+        ProcResults ret;
+        for (int i = 0; i < num_buckets; i++) {
+            ret.m_buckets[i] = a.m_buckets[i] + b.m_buckets[i];
+        }
+        ret.m_worst = max(a.m_worst, b.m_worst);
+        ret.m_best = min(a.m_best, b.m_best);
+        ret.m_transactions = a.m_transactions + b.m_transactions;
+        ret.m_total_time = a.m_total_time + b.m_total_time;
+        return ret;
+    }
+    void dump() {
+        double best = (double)m_best / 1.0E6;
+        double worst = (double)m_worst / 1.0E6;
+        double average = (double)m_total_time / m_transactions / 1.0E6;
+        cout << "average:" << average << "ms worst:" << worst << "ms best:" << best << "ms" << endl;
+
+        uint64_t cur_total = 0;
+        for (int i = 0; i < num_buckets; i++) {
+            float cur_time = time_per_bucket_ms * i + 0.5f * time_per_bucket_ms;
+            if ((cur_total < 0.5f * m_transactions) && (cur_total + m_buckets[i] >= 0.5f * m_transactions)) {
+                cout << "50%: " << cur_time << " ";
+            }
+            if ((cur_total < 0.9f * m_transactions) && (cur_total + m_buckets[i] >= 0.9f * m_transactions)) {
+                cout << "90%: " << cur_time << " ";
+            }
+            if ((cur_total < 0.95f * m_transactions) && (cur_total + m_buckets[i] >= 0.95f * m_transactions)) {
+                cout << "95%: " << cur_time << " ";
+            }
+            if ((cur_total < 0.99f * m_transactions) && (cur_total + m_buckets[i] >= 0.99f * m_transactions)) {
+                cout << "99%: " << cur_time << " ";
+            }
+            cur_total += m_buckets[i];
+        }
+        cout << endl;
+
+    }
+};
+
+String16 generateServiceName(int num)
+{
+    char num_str[32];
+    snprintf(num_str, sizeof(num_str), "%d", num);
+    String16 serviceName = String16("binderWorker") + String16(num_str);
+    return serviceName;
+}
+
+void worker_fx(
+    int num,
+    int worker_count,
+    int iterations,
+    Pipe p)
+{
+    // Create BinderWorkerService and for go.
+    ProcessState::self()->startThreadPool();
+    sp<IServiceManager> serviceMgr = defaultServiceManager();
+    sp<BinderWorkerService> service = new BinderWorkerService;
+    serviceMgr->addService(generateServiceName(num), service);
+
+    srand(num);
+    p.signal();
+    p.wait();
+
+    // Get references to other binder services.
+    cout << "Created BinderWorker" << num << endl;
+    (void)worker_count;
+    vector<sp<IBinder> > workers;
+    for (int i = 0; i < worker_count; i++) {
+        if (num == i)
+            continue;
+        workers.push_back(serviceMgr->getService(generateServiceName(i)));
+    }
+
+    // Run the benchmark.
+    ProcResults results;
+    chrono::time_point<chrono::high_resolution_clock> start, end;
+    for (int i = 0; i < iterations; i++) {
+        int target = rand() % workers.size();
+        Parcel data, reply;
+        start = chrono::high_resolution_clock::now();
+        status_t ret = workers[target]->transact(BINDER_NOP, data, &reply);
+        end = chrono::high_resolution_clock::now();
+
+        uint64_t cur_time = uint64_t(chrono::duration_cast<chrono::nanoseconds>(end - start).count());
+        results.add_time(cur_time);
+
+        if (ret != NO_ERROR) {
+           cout << "thread " << num << " failed " << ret << "i : " << i << endl;
+           exit(EXIT_FAILURE);
+        }
+    }
+    // Signal completion to master and wait.
+    p.signal();
+    p.wait();
+
+    // Send results to master and wait for go to exit.
+    p.send(results);
+    p.wait();
+
+    exit(EXIT_SUCCESS);
+}
+
+Pipe make_worker(int num, int iterations, int worker_count)
+{
+    auto pipe_pair = Pipe::createPipePair();
+    pid_t pid = fork();
+    if (pid) {
+        /* parent */
+        return move(get<0>(pipe_pair));
+    } else {
+        /* child */
+        worker_fx(num, worker_count, iterations, move(get<1>(pipe_pair)));
+        /* never get here */
+        return move(get<0>(pipe_pair));
+    }
+
+}
+
+void wait_all(vector<Pipe>& v)
+{
+    for (int i = 0; i < v.size(); i++) {
+        v[i].wait();
+    }
+}
+
+void signal_all(vector<Pipe>& v)
+{
+    for (int i = 0; i < v.size(); i++) {
+        v[i].signal();
+    }
+}
+
+int main(int argc, char *argv[])
+{
+    int workers = 2;
+    int iterations = 10000;
+    (void)argc;
+    (void)argv;
+    vector<Pipe> pipes;
+
+    // Parse arguments.
+    for (int i = 1; i < argc; i++) {
+        if (string(argv[i]) == "-w") {
+            workers = atoi(argv[i+1]);
+            i++;
+            continue;
+        }
+        if (string(argv[i]) == "-i") {
+            iterations = atoi(argv[i+1]);
+            i++;
+            continue;
+        }
+    }
+
+    // Create all the workers and wait for them to spawn.
+    for (int i = 0; i < workers; i++) {
+        pipes.push_back(make_worker(i, iterations, workers));
+    }
+    wait_all(pipes);
+
+
+    // Run the workers and wait for completion.
+    chrono::time_point<chrono::high_resolution_clock> start, end;
+    cout << "waiting for workers to complete" << endl;
+    start = chrono::high_resolution_clock::now();
+    signal_all(pipes);
+    wait_all(pipes);
+    end = chrono::high_resolution_clock::now();
+
+    // Calculate overall throughput.
+    double iterations_per_sec = double(iterations * workers) / (chrono::duration_cast<chrono::nanoseconds>(end - start).count() / 1.0E9);
+    cout << "iterations per sec: " << iterations_per_sec << endl;
+
+    // Collect all results from the workers.
+    cout << "collecting results" << endl;
+    signal_all(pipes);
+    ProcResults tot_results;
+    for (int i = 0; i < workers; i++) {
+        ProcResults tmp_results;
+        pipes[i].recv(tmp_results);
+        tot_results = ProcResults::combine(tot_results, tmp_results);
+    }
+    tot_results.dump();
+
+    // Kill all the workers.
+    cout << "killing workers" << endl;
+    signal_all(pipes);
+    for (int i = 0; i < workers; i++) {
+        int status;
+        wait(&status);
+        if (status != 0) {
+            cout << "nonzero child status" << status << endl;
+        }
+    }
+    return 0;
+}
diff --git a/libs/input/Android.mk b/libs/input/Android.mk
index 944ac7f..746de66 100644
--- a/libs/input/Android.mk
+++ b/libs/input/Android.mk
@@ -56,6 +56,9 @@
 
 LOCAL_SRC_FILES:= $(deviceSources)
 
+LOCAL_CLANG := true
+LOCAL_SANITIZE := integer
+
 LOCAL_SHARED_LIBRARIES := \
 	liblog \
 	libcutils \
diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp
index b64cb2c..a624663 100644
--- a/libs/input/Input.cpp
+++ b/libs/input/Input.cpp
@@ -23,7 +23,7 @@
 #include <input/Input.h>
 #include <input/InputEventLabels.h>
 
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
 #include <binder/Parcel.h>
 #endif
 
@@ -144,7 +144,7 @@
     setAxisValue(AMOTION_EVENT_AXIS_Y, getY() + yOffset);
 }
 
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
 status_t PointerCoords::readFromParcel(Parcel* parcel) {
     bits = parcel->readInt64();
 
@@ -420,7 +420,7 @@
     }
 }
 
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
 status_t MotionEvent::readFromParcel(Parcel* parcel) {
     size_t pointerCount = parcel->readInt32();
     size_t sampleCount = parcel->readInt32();
@@ -457,7 +457,8 @@
         properties.toolType = parcel->readInt32();
     }
 
-    while (sampleCount-- > 0) {
+    while (sampleCount > 0) {
+        sampleCount--;
         mSampleEventTimes.push(parcel->readInt64());
         for (size_t i = 0; i < pointerCount; i++) {
             mSamplePointerCoords.push();
diff --git a/libs/input/InputTransport.cpp b/libs/input/InputTransport.cpp
index 7f83da5..2dff4e0 100644
--- a/libs/input/InputTransport.cpp
+++ b/libs/input/InputTransport.cpp
@@ -516,7 +516,8 @@
 status_t InputConsumer::consumeBatch(InputEventFactoryInterface* factory,
         nsecs_t frameTime, uint32_t* outSeq, InputEvent** outEvent) {
     status_t result;
-    for (size_t i = mBatches.size(); i-- > 0; ) {
+    for (size_t i = mBatches.size(); i > 0; ) {
+        i--;
         Batch& batch = mBatches.editItemAt(i);
         if (frameTime < 0) {
             result = consumeSamples(factory, batch, batch.samples.size(),
@@ -826,7 +827,8 @@
         uint32_t currentSeq = seq;
         uint32_t chainSeqs[seqChainCount];
         size_t chainIndex = 0;
-        for (size_t i = seqChainCount; i-- > 0; ) {
+        for (size_t i = seqChainCount; i > 0; ) {
+             i--;
              const SeqChain& seqChain = mSeqChains.itemAt(i);
              if (seqChain.seq == currentSeq) {
                  currentSeq = seqChain.chain;
@@ -835,7 +837,8 @@
              }
         }
         status_t status = OK;
-        while (!status && chainIndex-- > 0) {
+        while (!status && chainIndex > 0) {
+            chainIndex--;
             status = sendUnchainedFinishedSignal(chainSeqs[chainIndex], handled);
         }
         if (status) {
@@ -845,7 +848,10 @@
                 seqChain.seq = chainIndex != 0 ? chainSeqs[chainIndex - 1] : seq;
                 seqChain.chain = chainSeqs[chainIndex];
                 mSeqChains.push(seqChain);
-            } while (chainIndex-- > 0);
+                if (chainIndex != 0) {
+                    chainIndex--;
+                }
+            } while (chainIndex > 0);
             return status;
         }
     }
diff --git a/libs/input/KeyCharacterMap.cpp b/libs/input/KeyCharacterMap.cpp
index df3f0dd..dd01a93 100644
--- a/libs/input/KeyCharacterMap.cpp
+++ b/libs/input/KeyCharacterMap.cpp
@@ -19,7 +19,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#if HAVE_ANDROID_OS
+#ifdef __ANDROID__
 #include <binder/Parcel.h>
 #endif
 
@@ -599,7 +599,7 @@
     }
 }
 
-#if HAVE_ANDROID_OS
+#ifdef __ANDROID__
 sp<KeyCharacterMap> KeyCharacterMap::readFromParcel(Parcel* parcel) {
     sp<KeyCharacterMap> map = new KeyCharacterMap();
     map->mType = parcel->readInt32();
diff --git a/libs/input/VelocityTracker.cpp b/libs/input/VelocityTracker.cpp
index 6c70c3c..7f6b157 100644
--- a/libs/input/VelocityTracker.cpp
+++ b/libs/input/VelocityTracker.cpp
@@ -46,7 +46,8 @@
 
 static float vectorDot(const float* a, const float* b, uint32_t m) {
     float r = 0;
-    while (m--) {
+    while (m) {
+        m--;
         r += *(a++) * *(b++);
     }
     return r;
@@ -54,7 +55,8 @@
 
 static float vectorNorm(const float* a, uint32_t m) {
     float r = 0;
-    while (m--) {
+    while (m) {
+        m--;
         float t = *(a++);
         r += t * t;
     }
@@ -511,7 +513,8 @@
     for (uint32_t h = 0; h < m; h++) {
         wy[h] = y[h] * w[h];
     }
-    for (uint32_t i = n; i-- != 0; ) {
+    for (uint32_t i = n; i != 0; ) {
+        i--;
         outB[i] = vectorDot(&q[i][0], wy, m);
         for (uint32_t j = n - 1; j > i; j--) {
             outB[i] -= r[i][j] * outB[j];
diff --git a/libs/ui/Android.mk b/libs/ui/Android.mk
index 1ce8626..54ff741 100644
--- a/libs/ui/Android.mk
+++ b/libs/ui/Android.mk
@@ -17,6 +17,7 @@
 
 LOCAL_CLANG := true
 LOCAL_CPPFLAGS := -std=c++1y -Weverything -Werror
+LOCAL_SANITIZE := integer
 
 # The static constructors and destructors in this library have not been noted to
 # introduce significant overheads
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index 3810da4..a3558bd 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -835,18 +835,6 @@
     return begin();
 }
 
-SharedBuffer const* Region::getSharedBuffer(size_t* count) const {
-    // We can get to the SharedBuffer of a Vector<Rect> because Rect has
-    // a trivial destructor.
-    SharedBuffer const* sb = SharedBuffer::bufferFromData(mStorage.array());
-    if (count) {
-        size_t numRects = isRect() ? 1 : mStorage.size() - 1;
-        count[0] = numRects;
-    }
-    sb->acquire();
-    return sb;
-}
-
 // ----------------------------------------------------------------------------
 
 void Region::dump(String8& out, const char* what, uint32_t /* flags */) const
diff --git a/opengl/libagl/context.h b/opengl/libagl/context.h
index c599a55..d23f435 100644
--- a/opengl/libagl/context.h
+++ b/opengl/libagl/context.h
@@ -21,7 +21,7 @@
 #include <stddef.h>
 #include <sys/types.h>
 #include <pthread.h>
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
 #include <bionic_tls.h>
 #endif
 
@@ -579,7 +579,7 @@
 // state
 // ----------------------------------------------------------------------------
 
-#ifdef HAVE_ANDROID_OS
+#ifdef __ANDROID__
     // We have a dedicated TLS slot in bionic
     inline void setGlThreadSpecific(ogles_context_t *value) {
         __get_tls()[TLS_SLOT_OPENGL] = value;
diff --git a/opengl/libagl/egl.cpp b/opengl/libagl/egl.cpp
index 593d0c2..7560d8f 100644
--- a/opengl/libagl/egl.cpp
+++ b/opengl/libagl/egl.cpp
@@ -64,7 +64,7 @@
 static pthread_mutex_t gInitMutex = PTHREAD_MUTEX_INITIALIZER;
 static pthread_mutex_t gErrorKeyMutex = PTHREAD_MUTEX_INITIALIZER;
 static pthread_key_t gEGLErrorKey = -1;
-#ifndef HAVE_ANDROID_OS
+#ifndef __ANDROID__
 namespace gl {
 pthread_key_t gGLKey = -1;
 }; // namespace gl
@@ -1373,7 +1373,7 @@
 
     int32_t w = 0;
     int32_t h = 0;
-    while (attrib_list[0]) {
+    while (attrib_list[0] != EGL_NONE) {
         if (attrib_list[0] == EGL_WIDTH)  w = attrib_list[1];
         if (attrib_list[0] == EGL_HEIGHT) h = attrib_list[1];
         attrib_list+=2;
@@ -1403,7 +1403,7 @@
 
 EGLDisplay eglGetDisplay(NativeDisplayType display)
 {
-#ifndef HAVE_ANDROID_OS
+#ifndef __ANDROID__
     // this just needs to be done once
     if (gGLKey == -1) {
         pthread_mutex_lock(&gInitMutex);
diff --git a/opengl/libs/Android.mk b/opengl/libs/Android.mk
index 18ad300..7fb0f77 100644
--- a/opengl/libs/Android.mk
+++ b/opengl/libs/Android.mk
@@ -59,6 +59,11 @@
   LOCAL_CFLAGS += -DMAX_EGL_CACHE_SIZE=$(MAX_EGL_CACHE_SIZE)
 endif
 
+ifneq ($(filter address,$(SANITIZE_TARGET)),)
+  LOCAL_CFLAGS_32 += -DEGL_WRAPPER_DIR=\"/$(TARGET_COPY_OUT_DATA)/lib\"
+  LOCAL_CFLAGS_64 += -DEGL_WRAPPER_DIR=\"/$(TARGET_COPY_OUT_DATA)/lib64\"
+endif
+
 LOCAL_REQUIRED_MODULES := $(egl.cfg_config_module)
 egl.cfg_config_module :=
 
@@ -139,6 +144,7 @@
 #
 
 LOCAL_MODULE:= libETC1
+LOCAL_MODULE_HOST_OS := darwin linux windows
 
 include $(BUILD_HOST_STATIC_LIBRARY)
 
diff --git a/opengl/libs/EGL/Loader.cpp b/opengl/libs/EGL/Loader.cpp
index 1fcc048..8df9af3 100644
--- a/opengl/libs/EGL/Loader.cpp
+++ b/opengl/libs/EGL/Loader.cpp
@@ -167,6 +167,14 @@
     return so;
 }
 
+#ifndef EGL_WRAPPER_DIR
+#if defined(__LP64__)
+#define EGL_WRAPPER_DIR "/system/lib64"
+#else
+#define EGL_WRAPPER_DIR "/system/lib"
+#endif
+#endif
+
 void* Loader::open(egl_connection_t* cnx)
 {
     void* dso;
@@ -187,15 +195,10 @@
 
     LOG_ALWAYS_FATAL_IF(!hnd, "couldn't find an OpenGL ES implementation");
 
-#if defined(__LP64__)
-    cnx->libEgl   = load_wrapper("/system/lib64/libEGL.so");
-    cnx->libGles2 = load_wrapper("/system/lib64/libGLESv2.so");
-    cnx->libGles1 = load_wrapper("/system/lib64/libGLESv1_CM.so");
-#else
-    cnx->libEgl   = load_wrapper("/system/lib/libEGL.so");
-    cnx->libGles2 = load_wrapper("/system/lib/libGLESv2.so");
-    cnx->libGles1 = load_wrapper("/system/lib/libGLESv1_CM.so");
-#endif
+    cnx->libEgl   = load_wrapper(EGL_WRAPPER_DIR "/libEGL.so");
+    cnx->libGles2 = load_wrapper(EGL_WRAPPER_DIR "/libGLESv2.so");
+    cnx->libGles1 = load_wrapper(EGL_WRAPPER_DIR "/libGLESv1_CM.so");
+
     LOG_ALWAYS_FATAL_IF(!cnx->libEgl,
             "couldn't load system EGL wrapper libraries");
 
diff --git a/opengl/tests/gl_perfapp/jni/gl_code.cpp b/opengl/tests/gl_perfapp/jni/gl_code.cpp
index 2f04183..378c8e8 100644
--- a/opengl/tests/gl_perfapp/jni/gl_code.cpp
+++ b/opengl/tests/gl_perfapp/jni/gl_code.cpp
@@ -26,8 +26,6 @@
 // The stateClock starts at zero and increments by 1 every time we draw a frame. It is used to control which phase of the test we are in.
 
 int stateClock;
-const int doLoopStates = 2;
-const int doSingleTestStates = 2;
 bool done;
 
 // Saves the parameters of the test (so we can print them out when we finish the timing.)
diff --git a/opengl/tools/glgen/src/JniCodeEmitter.java b/opengl/tools/glgen/src/JniCodeEmitter.java
index 1bed05b..5a412bf 100644
--- a/opengl/tools/glgen/src/JniCodeEmitter.java
+++ b/opengl/tools/glgen/src/JniCodeEmitter.java
@@ -673,7 +673,7 @@
                         "\";");
         cStream.println();
 
-        cStream.println("static JNINativeMethod methods[] = {");
+        cStream.println("static const JNINativeMethod methods[] = {");
 
         cStream.println("{\"_nativeClassInit\", \"()V\", (void*)nativeClassInit },");
 
diff --git a/services/powermanager/Android.mk b/services/powermanager/Android.mk
index 7b24c65..4deb115 100644
--- a/services/powermanager/Android.mk
+++ b/services/powermanager/Android.mk
@@ -14,4 +14,6 @@
 
 LOCAL_CFLAGS += -Wall -Werror -Wunused -Wunreachable-code
 
+LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/../../include
+
 include $(BUILD_SHARED_LIBRARY)
diff --git a/services/powermanager/IPowerManager.cpp b/services/powermanager/IPowerManager.cpp
index ec864ee..bff8719 100644
--- a/services/powermanager/IPowerManager.cpp
+++ b/services/powermanager/IPowerManager.cpp
@@ -27,15 +27,6 @@
 
 namespace android {
 
-// must be kept in sync with IPowerManager.aidl
-enum {
-    ACQUIRE_WAKE_LOCK = IBinder::FIRST_CALL_TRANSACTION,
-    ACQUIRE_WAKE_LOCK_UID = IBinder::FIRST_CALL_TRANSACTION + 1,
-    RELEASE_WAKE_LOCK = IBinder::FIRST_CALL_TRANSACTION + 2,
-    UPDATE_WAKE_LOCK_UIDS = IBinder::FIRST_CALL_TRANSACTION + 3,
-    POWER_HINT = IBinder::FIRST_CALL_TRANSACTION + 4,
-};
-
 class BpPowerManager : public BpInterface<IPowerManager>
 {
 public:
@@ -104,6 +95,44 @@
         // This FLAG_ONEWAY is in the .aidl, so there is no way to disable it
         return remote()->transact(POWER_HINT, data, &reply, IBinder::FLAG_ONEWAY);
     }
+
+    virtual status_t goToSleep(int64_t event_time_ms, int reason, int flags)
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(IPowerManager::getInterfaceDescriptor());
+        data.writeInt64(event_time_ms);
+        data.writeInt32(reason);
+        data.writeInt32(flags);
+        return remote()->transact(GO_TO_SLEEP, data, &reply, 0);
+    }
+
+    virtual status_t reboot(bool confirm, const String16& reason, bool wait)
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(IPowerManager::getInterfaceDescriptor());
+        data.writeInt32(confirm);
+        data.writeString16(reason);
+        data.writeInt32(wait);
+        return remote()->transact(REBOOT, data, &reply, 0);
+    }
+
+    virtual status_t shutdown(bool confirm, const String16& reason, bool wait)
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(IPowerManager::getInterfaceDescriptor());
+        data.writeInt32(confirm);
+        data.writeString16(reason);
+        data.writeInt32(wait);
+        return remote()->transact(SHUTDOWN, data, &reply, 0);
+    }
+
+    virtual status_t crash(const String16& message)
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(IPowerManager::getInterfaceDescriptor());
+        data.writeString16(message);
+        return remote()->transact(CRASH, data, &reply, 0);
+    }
 };
 
 IMPLEMENT_META_INTERFACE(PowerManager, "android.os.IPowerManager");
diff --git a/services/sensorservice/BatteryService.cpp b/services/sensorservice/BatteryService.cpp
index cb962a6..81f32cd 100644
--- a/services/sensorservice/BatteryService.cpp
+++ b/services/sensorservice/BatteryService.cpp
@@ -83,7 +83,7 @@
     if (mBatteryStatService != 0) {
         Mutex::Autolock _l(mActivationsLock);
         int64_t identity = IPCThreadState::self()->clearCallingIdentity();
-        for (ssize_t i=0 ; i<mActivations.size() ; i++) {
+        for (size_t i=0 ; i<mActivations.size() ; i++) {
             const Info& info(mActivations[i]);
             if (info.uid == uid) {
                 mBatteryStatService->noteStopSensor(info.uid, info.handle);
diff --git a/services/sensorservice/GravitySensor.cpp b/services/sensorservice/GravitySensor.cpp
index 3cb3745..61118bc 100644
--- a/services/sensorservice/GravitySensor.cpp
+++ b/services/sensorservice/GravitySensor.cpp
@@ -44,7 +44,6 @@
 bool GravitySensor::process(sensors_event_t* outEvent,
         const sensors_event_t& event)
 {
-    const static double NS2S = 1.0 / 1000000000.0;
     if (event.type == SENSOR_TYPE_ACCELEROMETER) {
         vec3_t g;
         if (!mSensorFusion.hasEstimate())
diff --git a/services/sensorservice/SensorDevice.cpp b/services/sensorservice/SensorDevice.cpp
index dd1bccf..40d596f 100644
--- a/services/sensorservice/SensorDevice.cpp
+++ b/services/sensorservice/SensorDevice.cpp
@@ -388,7 +388,7 @@
 
 status_t SensorDevice::injectSensorData(const sensors_event_t *injected_sensor_event) {
       ALOGD_IF(DEBUG_CONNECTIONS,
-              "sensor_event handle=%d ts=%lld data=%.2f, %.2f, %.2f %.2f %.2f %.2f",
+              "sensor_event handle=%d ts=%" PRId64 " data=%.2f, %.2f, %.2f %.2f %.2f %.2f",
                injected_sensor_event->sensor,
                injected_sensor_event->timestamp, injected_sensor_event->data[0],
                injected_sensor_event->data[1], injected_sensor_event->data[2],
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index fd72b23..db4a4db 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -118,7 +118,7 @@
             // it's safe to instantiate the SensorFusion object here
             // (it wants to be instantiated after h/w sensors have been
             // registered)
-            const SensorFusion& fusion(SensorFusion::getInstance());
+            SensorFusion::getInstance();
 
             // build the sensor list returned to users
             mUserSensorList = mSensorList;
@@ -381,7 +381,7 @@
                         mActiveSensors.valueAt(i)->getNumConnections());
             }
 
-            result.appendFormat("Socket Buffer size = %d events\n",
+            result.appendFormat("Socket Buffer size = %zd events\n",
                                 mSocketBufferSize/sizeof(sensors_event_t));
             result.appendFormat("WakeLock Status: %s \n", mWakeLockAcquired ? "acquired" :
                     "not held");
@@ -1109,7 +1109,7 @@
         AppOpsManager appOps;
         if (appOps.noteOp(opCode, IPCThreadState::self()->getCallingUid(), opPackageName)
                         != AppOpsManager::MODE_ALLOWED) {
-            ALOGE("%s a sensor (%s) without enabled required app op: %D",
+            ALOGE("%s a sensor (%s) without enabled required app op: %d",
                     operation, sensor.getName().string(), opCode);
             return false;
         }
@@ -1312,13 +1312,13 @@
         }
         result.appendFormat("%d) ", eventNum++);
         if (mSensorType == SENSOR_TYPE_STEP_COUNTER) {
-            result.appendFormat("%llu,", mTrimmedSensorEventArr[i]->mStepCounter);
+            result.appendFormat("%" PRIu64 ",", mTrimmedSensorEventArr[i]->mStepCounter);
         } else {
             for (int j = 0; j < numData; ++j) {
                 result.appendFormat("%5.1f,", mTrimmedSensorEventArr[i]->mData[j]);
             }
         }
-        result.appendFormat("%lld %02d:%02d:%02d ", mTrimmedSensorEventArr[i]->mTimestamp,
+        result.appendFormat("%" PRId64 " %02d:%02d:%02d ", mTrimmedSensorEventArr[i]->mTimestamp,
                 mTrimmedSensorEventArr[i]->mHour, mTrimmedSensorEventArr[i]->mMin,
                 mTrimmedSensorEventArr[i]->mSec);
         i = (i + 1) % mBufSize;
diff --git a/services/sensorservice/main_sensorservice.cpp b/services/sensorservice/main_sensorservice.cpp
index 0a96f42..01bb0e7 100644
--- a/services/sensorservice/main_sensorservice.cpp
+++ b/services/sensorservice/main_sensorservice.cpp
@@ -20,6 +20,7 @@
 using namespace android;
 
 int main(int /*argc*/, char** /*argv*/) {
+    signal(SIGPIPE, SIG_IGN);
     SensorService::publishAndJoinThreadPool();
     return 0;
 }
diff --git a/services/sensorservice/vec.h b/services/sensorservice/vec.h
index 24f30ff..a142bad 100644
--- a/services/sensorservice/vec.h
+++ b/services/sensorservice/vec.h
@@ -37,7 +37,7 @@
 class vec;
 
 template <typename TYPE, size_t SIZE>
-class vbase;
+struct vbase;
 
 namespace helpers {
 
diff --git a/services/surfaceflinger/Android.mk b/services/surfaceflinger/Android.mk
index 1901ef9..17ca10e 100644
--- a/services/surfaceflinger/Android.mk
+++ b/services/surfaceflinger/Android.mk
@@ -122,9 +122,7 @@
 LOCAL_CFLAGS := -DLOG_TAG=\"SurfaceFlinger\"
 LOCAL_CPPFLAGS := -std=c++11
 
-ifneq ($(ENABLE_CPUSETS),)
-    LOCAL_CFLAGS += -DENABLE_CPUSETS
-endif
+LOCAL_INIT_RC := surfaceflinger.rc
 
 LOCAL_SRC_FILES := \
     main_surfaceflinger.cpp
diff --git a/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
index 6ef3295..70af656 100644
--- a/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
+++ b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
@@ -67,6 +67,7 @@
     mConsumer->setDefaultBufferFormat(mHwc.getFormat(disp));
     mConsumer->setDefaultBufferSize(mHwc.getWidth(disp),  mHwc.getHeight(disp));
     mConsumer->setDefaultMaxBufferCount(NUM_FRAMEBUFFER_SURFACE_BUFFERS);
+    mConsumer->setMaxAcquiredBufferCount(NUM_FRAMEBUFFER_SURFACE_BUFFERS - 1);
 }
 
 status_t FramebufferSurface::beginFrame(bool /*mustRecompose*/) {
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.cpp b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
index 0859149..d37fcb2 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
@@ -1036,12 +1036,10 @@
         }
     }
     virtual void setVisibleRegionScreen(const Region& reg) {
-        // Region::getSharedBuffer creates a reference to the underlying
-        // SharedBuffer of this Region, this reference is freed
-        // in onDisplayed()
         hwc_region_t& visibleRegion = getLayer()->visibleRegionScreen;
-        SharedBuffer const* sb = reg.getSharedBuffer(&visibleRegion.numRects);
-        visibleRegion.rects = reinterpret_cast<hwc_rect_t const *>(sb->data());
+        mVisibleRegion = reg;
+        visibleRegion.rects = reinterpret_cast<hwc_rect_t const *>(
+                mVisibleRegion.getArray(&visibleRegion.numRects));
     }
     virtual void setSurfaceDamage(const Region& reg) {
         if (!hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_5)) {
@@ -1055,8 +1053,9 @@
             surfaceDamage.rects = NULL;
             return;
         }
-        SharedBuffer const* sb = reg.getSharedBuffer(&surfaceDamage.numRects);
-        surfaceDamage.rects = reinterpret_cast<hwc_rect_t const *>(sb->data());
+        mSurfaceDamage = reg;
+        surfaceDamage.rects = reinterpret_cast<hwc_rect_t const *>(
+                mSurfaceDamage.getArray(&surfaceDamage.numRects));
     }
     virtual void setSidebandStream(const sp<NativeHandle>& stream) {
         ALOG_ASSERT(stream->handle() != NULL);
@@ -1078,29 +1077,15 @@
         }
     }
     virtual void onDisplayed() {
-        hwc_region_t& visibleRegion = getLayer()->visibleRegionScreen;
-        SharedBuffer const* sb = SharedBuffer::bufferFromData(visibleRegion.rects);
-        if (sb) {
-            sb->release();
-            // not technically needed but safer
-            visibleRegion.numRects = 0;
-            visibleRegion.rects = NULL;
-        }
-
         getLayer()->acquireFenceFd = -1;
-
-        if (!hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_5)) {
-            return;
-        }
-
-        hwc_region_t& surfaceDamage = getLayer()->surfaceDamage;
-        sb = SharedBuffer::bufferFromData(surfaceDamage.rects);
-        if (sb) {
-            sb->release();
-            surfaceDamage.numRects = 0;
-            surfaceDamage.rects = NULL;
-        }
     }
+
+protected:
+    // We need to hold "copies" of these for memory management purposes. The
+    // actual hwc_layer_1_t holds pointers to the memory within. Vector<>
+    // internally doesn't copy the memory unless one of the copies is modified.
+    Region mVisibleRegion;
+    Region mSurfaceDamage;
 };
 
 /*
diff --git a/services/surfaceflinger/main_surfaceflinger.cpp b/services/surfaceflinger/main_surfaceflinger.cpp
index 6fa8b53..ca81aaa 100644
--- a/services/surfaceflinger/main_surfaceflinger.cpp
+++ b/services/surfaceflinger/main_surfaceflinger.cpp
@@ -26,6 +26,7 @@
 using namespace android;
 
 int main(int, char**) {
+    signal(SIGPIPE, SIG_IGN);
     // When SF is launched in its own process, limit the number of
     // binder threads to 4.
     ProcessState::self()->setThreadPoolMaxThreadCount(4);
@@ -41,13 +42,6 @@
 
     set_sched_policy(0, SP_FOREGROUND);
 
-#ifdef ENABLE_CPUSETS
-    // Put most SurfaceFlinger threads in the system-background cpuset
-    // Keeps us from unnecessarily using big cores
-    // Do this after the binder thread pool init
-    set_cpuset_policy(0, SP_SYSTEM);
-#endif
-
     // initialize before clients can connect
     flinger->init();
 
diff --git a/services/surfaceflinger/surfaceflinger.rc b/services/surfaceflinger/surfaceflinger.rc
new file mode 100644
index 0000000..1d6e20f
--- /dev/null
+++ b/services/surfaceflinger/surfaceflinger.rc
@@ -0,0 +1,6 @@
+service surfaceflinger /system/bin/surfaceflinger
+    class core
+    user system
+    group graphics drmrpc readproc
+    onrestart restart zygote
+    writepid /dev/cpuset/system-background/tasks /sys/fs/cgroup/stune/foreground/tasks