system_core.patch

diff --git a/fs_mgr/fs_mgr.c b/fs_mgr/fs_mgr.c
index 387f70859..0ad35c411 100644
--- a/fs_mgr/fs_mgr.c
+++ b/fs_mgr/fs_mgr.c
@@ -60,6 +60,7 @@
 #define FSCK_LOG_FILE   "/dev/fscklogs/log"
 
 #define ZRAM_CONF_DEV   "/sys/block/zram0/disksize"
+#define ZRAM_STREAMS    "/sys/block/zram0/max_comp_streams"
 
 #define ARRAY_SIZE(a) (sizeof(a) / sizeof(*(a)))
 
@@ -812,6 +813,14 @@ int fs_mgr_swapon_all(struct fstab *fstab)
              */
             FILE *zram_fp;
 
+            /* The stream count parameter is only available on new kernels.
+             * It must be set before the disk size. */
+            zram_fp = fopen(ZRAM_STREAMS, "r+");
+            if (zram_fp) {
+                fprintf(zram_fp, "%d\n", fstab->recs[i].zram_streams);
+                fclose(zram_fp);
+            }
+
             zram_fp = fopen(ZRAM_CONF_DEV, "r+");
             if (zram_fp == NULL) {
                 ERROR("Unable to open zram conf device %s\n", ZRAM_CONF_DEV);
diff --git a/fs_mgr/fs_mgr_fstab.c b/fs_mgr/fs_mgr_fstab.c
index 9225d349f..44367ed2b 100644
--- a/fs_mgr/fs_mgr_fstab.c
+++ b/fs_mgr/fs_mgr_fstab.c
@@ -32,6 +32,7 @@ struct fs_mgr_flag_values {
     int partnum;
     int swap_prio;
     unsigned int zram_size;
+    unsigned int zram_streams;
     unsigned int file_encryption_mode;
 };
 
@@ -80,6 +81,7 @@ static struct flag_list fs_mgr_flags[] = {
     { "slotselect",  MF_SLOTSELECT },
     { "nofail",      MF_NOFAIL },
     { "latemount",   MF_LATEMOUNT },
+    { "zramstreams=",MF_ZRAMSTREAMS },
     { "defaults",    0 },
     { 0,             0 },
 };
@@ -121,6 +123,7 @@ static int parse_flags(char *flags, struct flag_list *fl,
         memset(flag_vals, 0, sizeof(*flag_vals));
         flag_vals->partnum = -1;
         flag_vals->swap_prio = -1; /* negative means it wasn't specified. */
+        flag_vals->zram_streams = 1;
     }
 
     /* initialize fs_options to the null string */
@@ -213,6 +216,8 @@ static int parse_flags(char *flags, struct flag_list *fl,
                         flag_vals->zram_size = calculate_zram_size(val);
                     else
                         flag_vals->zram_size = val;
+                } else if ((fl[i].flag == MF_ZRAMSTREAMS) && flag_vals) {
+                    flag_vals->zram_streams = strtoll(strchr(p, '=') + 1, NULL, 0);
                 }
                 break;
             }
@@ -364,6 +369,7 @@ struct fstab *fs_mgr_read_fstab(const char *fstab_path)
         fstab->recs[cnt].partnum = flag_vals.partnum;
         fstab->recs[cnt].swap_prio = flag_vals.swap_prio;
         fstab->recs[cnt].zram_size = flag_vals.zram_size;
+        fstab->recs[cnt].zram_streams = flag_vals.zram_streams;
         fstab->recs[cnt].file_encryption_mode = flag_vals.file_encryption_mode;
         cnt++;
     }
diff --git a/fs_mgr/fs_mgr_priv.h b/fs_mgr/fs_mgr_priv.h
index 120ec5a68..21233b788 100644
--- a/fs_mgr/fs_mgr_priv.h
+++ b/fs_mgr/fs_mgr_priv.h
@@ -86,6 +86,7 @@ __BEGIN_DECLS
 #define MF_LATEMOUNT    0x20000
 #define MF_NOFAIL       0x40000
 #define MF_VERIFYATBOOT 0x80000
+#define MF_ZRAMSTREAMS  0x100000
 
 #define DM_BUF_SIZE 4096
 
diff --git a/fs_mgr/include/fs_mgr.h b/fs_mgr/include/fs_mgr.h
index 756596598..e796bdd50 100644
--- a/fs_mgr/include/fs_mgr.h
+++ b/fs_mgr/include/fs_mgr.h
@@ -72,6 +72,7 @@ struct fstab_rec {
     int partnum;
     int swap_prio;
     unsigned int zram_size;
+    unsigned int zram_streams;
     unsigned int file_encryption_mode;
 };
 
diff --git a/include/cutils/iosched_policy.h b/include/cutils/iosched_policy.h
index 07c5d1fca..25b87bac0 100644
--- a/include/cutils/iosched_policy.h
+++ b/include/cutils/iosched_policy.h
@@ -31,6 +31,8 @@ typedef enum {
 extern int android_set_ioprio(int pid, IoSchedClass clazz, int ioprio);
 extern int android_get_ioprio(int pid, IoSchedClass *clazz, int *ioprio);
 
+extern int android_set_rt_ioprio(int pid, int rt);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/private/android_filesystem_config.h b/include/private/android_filesystem_config.h
index 5ccd80e7a..ed8ae3578 100644
--- a/include/private/android_filesystem_config.h
+++ b/include/private/android_filesystem_config.h
@@ -121,6 +121,8 @@
 /* The range 5000-5999 is also reserved for OEM, and must never be used here. */
 #define AID_OEM_RESERVED_2_START 5000
 #define AID_OEM_RESERVED_2_END   5999
+#define AID_SENSORS       3011 /* access to /dev/socket/sensor_ctl_socket & QCCI/QCSI */
+
 
 #define AID_EVERYBODY     9997  /* shared between all apps in the same profile */
 #define AID_MISC          9998  /* access to misc storage */
@@ -222,6 +224,7 @@ static const struct android_id_info android_ids[] = {
     { "net_bt_stack",  AID_NET_BT_STACK, },
     { "readproc",      AID_READPROC, },
     { "wakelock",      AID_WAKELOCK, },
+    { "sensors",       AID_SENSORS, },
 
     { "everybody",     AID_EVERYBODY, },
     { "misc",          AID_MISC, },
diff --git a/include/system/camera.h b/include/system/camera.h
index 5d0873ac4..e4c0a47a8 100644
--- a/include/system/camera.h
+++ b/include/system/camera.h
@@ -88,9 +88,20 @@ enum {
     // Notify on autofocus start and stop. This is useful in continuous
     // autofocus - FOCUS_MODE_CONTINUOUS_VIDEO and FOCUS_MODE_CONTINUOUS_PICTURE.
     CAMERA_MSG_FOCUS_MOVE = 0x0800,       // notifyCallback
+	CAMERA_MSG_VENDOR_START = 0x1000,
+    CAMERA_MSG_STATS_DATA = CAMERA_MSG_VENDOR_START,
+    CAMERA_MSG_META_DATA = 0x2000,
+    CAMERA_MSG_VENDOR_END = 0x8000,	
     CAMERA_MSG_ALL_MSGS = 0xFFFF
 };
 
+/** meta data type in CameraMetaDataCallback */
+enum {
+	CAMERA_META_DATA_ASD = 0x001,    //ASD data
+	CAMERA_META_DATA_FD = 0x002,     //FD/FP data
+	CAMERA_META_DATA_HDR = 0x003,    //Auto HDR data
+};
+	
 /** cmdType in sendCommand functions */
 enum {
     CAMERA_CMD_START_SMOOTH_ZOOM = 1,
@@ -189,7 +200,41 @@ enum {
      * IMPLEMENTATION_DEFINED, then HALv3 devices will use gralloc usage flags
      * of SW_READ_OFTEN.
      */
-    CAMERA_CMD_SET_VIDEO_FORMAT = 11
+#ifndef CAMERA_VENDOR_L_COMPAT
+    CAMERA_CMD_SET_VIDEO_FORMAT = 11,
+
+    CAMERA_CMD_VENDOR_START = 20,
+    /**
+     * Commands to enable/disable preview histogram
+     *
+     * Based on user's input to enable/disable histogram from the camera
+     * UI, send the appropriate command to the HAL to turn on/off the histogram
+     * stats and start sending the data to the application.
+     */
+    CAMERA_CMD_HISTOGRAM_ON = CAMERA_CMD_VENDOR_START,
+    CAMERA_CMD_HISTOGRAM_OFF = CAMERA_CMD_VENDOR_START + 1,
+    CAMERA_CMD_HISTOGRAM_SEND_DATA  = CAMERA_CMD_VENDOR_START + 2,
+    CAMERA_CMD_LONGSHOT_ON = CAMERA_CMD_VENDOR_START + 3,
+    CAMERA_CMD_LONGSHOT_OFF = CAMERA_CMD_VENDOR_START + 4,
+    CAMERA_CMD_STOP_LONGSHOT = CAMERA_CMD_VENDOR_START + 5,
+    CAMERA_CMD_METADATA_ON = CAMERA_CMD_VENDOR_START + 6,
+    CAMERA_CMD_METADATA_OFF = CAMERA_CMD_VENDOR_START + 7,
+    CAMERA_CMD_VENDOR_END = 200,
+#else
+
+    /**
+     * Values used by older HALs, provided as an option for compatibility
+     */
+    CAMERA_CMD_HISTOGRAM_ON     = 11,
+    CAMERA_CMD_HISTOGRAM_OFF     = 12,
+    CAMERA_CMD_HISTOGRAM_SEND_DATA  = 13,
+    CAMERA_CMD_LONGSHOT_ON = 14,
+    CAMERA_CMD_LONGSHOT_OFF = 15,
+    CAMERA_CMD_STOP_LONGSHOT = 16,
+    CAMERA_CMD_METADATA_ON = 100,
+    CAMERA_CMD_METADATA_OFF = 101,
+    CAMERA_CMD_SET_VIDEO_FORMAT = 102,
+#endif
 };
 
 /** camera fatal errors */
@@ -275,9 +320,31 @@ typedef struct camera_face {
      * -2000, -2000 if this is not supported.
      */
     int32_t mouth[2];
+	int32_t smile_degree;
+    int32_t smile_score;
+    int32_t blink_detected;
+    int32_t face_recognised;
+    int32_t gaze_angle;
+    int32_t updown_dir;
+    int32_t leftright_dir;
+    int32_t roll_dir;
+    int32_t left_right_gaze;
+    int32_t top_bottom_gaze;
+    int32_t leye_blink;
+    int32_t reye_blink;
 
 } camera_face_t;
 
+/**
+ * The information of a data type received in a camera frame.
+ */
+typedef enum {
+    /** Data buffer */
+    CAMERA_FRAME_DATA_BUF = 0x000,
+    /** File descriptor */
+    CAMERA_FRAME_DATA_FD = 0x100
+} camera_frame_data_type_t;
+
 /**
  * The metadata of the frame data.
  */
diff --git a/include/utils/Unicode.h b/include/utils/Unicode.h
index cddbab497..b152579c7 100644
--- a/include/utils/Unicode.h
+++ b/include/utils/Unicode.h
@@ -22,6 +22,10 @@
 
 extern "C" {
 
+#ifndef SSIZE_MAX
+#define SSIZE_MAX ((size_t)SIZE_MAX/2)
+#endif
+
 // Standard string functions on char16_t strings.
 int strcmp16(const char16_t *, const char16_t *);
 int strncmp16(const char16_t *s1, const char16_t *s2, size_t n);
diff --git a/init/Android.mk b/init/Android.mk
index 67541b81b..ff343e968 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -10,7 +10,7 @@ else
 init_options += -DALLOW_LOCAL_PROP_OVERRIDE=0 -DALLOW_PERMISSIVE_SELINUX=0
 endif
 
-init_options += -DLOG_UEVENTS=0
+init_options += -DLOG_UEVENTS=0 -D__BRILLO__
 
 init_cflags += \
     $(init_options) \
diff --git a/init/init.cpp b/init/init.cpp
index cd2d2e6ab..6f901a64d 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -141,19 +141,60 @@ static void restart_processes()
             });
 }
 
-void handle_control_message(const std::string& msg, const std::string& name) {
+static void msg_start(const std::string& name)
+{
+    Service* svc = nullptr;
+    std::vector<std::string> vargs;
+
+    size_t colon_pos = name.find(':');
+    if (colon_pos == std::string::npos) {
+        svc = ServiceManager::GetInstance().FindServiceByName(name);
+    } else {
+        std::string service_name(name.substr(0, colon_pos));
+        std::string args(name.substr(colon_pos + 1));
+        vargs = android::base::Split(args, " ");
+
+        svc = ServiceManager::GetInstance().FindServiceByName(service_name);
+    }
+
+    if (svc) {
+        svc->Start();
+    } else {
+        ERROR("no such service '%s'\n", name.c_str());
+    }
+}
+
+static void msg_stop(const std::string& name)
+{
     Service* svc = ServiceManager::GetInstance().FindServiceByName(name);
-    if (svc == nullptr) {
+
+    if (svc) {
+        svc->Stop();
+    } else {
         ERROR("no such service '%s'\n", name.c_str());
-        return;
     }
+}
 
+static void msg_restart(const std::string& name)
+{
+    Service* svc = ServiceManager::GetInstance().FindServiceByName(name);
+
+    if (svc) {
+        svc->Restart();
+    } else {
+        ERROR("no such service '%s'\n", name.c_str());
+    }
+}
+
+void handle_control_message(const std::string& msg, const std::string& arg)
+{
     if (msg == "start") {
-        svc->Start();
+        msg_start(arg);
     } else if (msg == "stop") {
-        svc->Stop();
+    } else if (msg == "stop") {
+        msg_stop(arg);
     } else if (msg == "restart") {
-        svc->Restart();
+        msg_restart(arg);
     } else {
         ERROR("unknown control msg '%s'\n", msg.c_str());
     }
@@ -296,55 +337,6 @@ static bool __attribute__((unused)) set_mmap_rnd_bits_min(int start, int min, bo
     return (start >= min);
 }
 
-/*
- * Set /proc/sys/vm/mmap_rnd_bits and potentially
- * /proc/sys/vm/mmap_rnd_compat_bits to the maximum supported values.
- * Returns -1 if unable to set these to an acceptable value.  Apply
- * upstream patch-sets https://lkml.org/lkml/2015/12/21/337 and
- * https://lkml.org/lkml/2016/2/4/831 to enable this.
- */
-static int set_mmap_rnd_bits_action(const std::vector<std::string>& args)
-{
-    int ret = -1;
-
-    /* values are arch-dependent */
-#if defined(__aarch64__)
-    /* arm64 supports 18 - 33 bits depending on pagesize and VA_SIZE */
-    if (set_mmap_rnd_bits_min(33, 24, false)
-            && set_mmap_rnd_bits_min(16, 16, true)) {
-        ret = 0;
-    }
-#elif defined(__x86_64__)
-    /* x86_64 supports 28 - 32 bits */
-    if (set_mmap_rnd_bits_min(32, 32, false)
-            && set_mmap_rnd_bits_min(16, 16, true)) {
-        ret = 0;
-    }
-#elif defined(__arm__) || defined(__i386__)
-    /* check to see if we're running on 64-bit kernel */
-    bool h64 = !access(MMAP_RND_COMPAT_PATH, F_OK);
-    /* supported 32-bit architecture must have 16 bits set */
-    if (set_mmap_rnd_bits_min(16, 16, h64)) {
-        ret = 0;
-    }
-#elif defined(__mips__) || defined(__mips64__)
-    // TODO: add mips support b/27788820
-    ret = 0;
-#else
-    ERROR("Unknown architecture\n");
-#endif
-
-#ifdef __BRILLO__
-    // TODO: b/27794137
-    ret = 0;
-#endif
-    if (ret == -1) {
-        ERROR("Unable to set adequate mmap entropy value!\n");
-        security_failure();
-    }
-    return ret;
-}
-
 static int keychord_init_action(const std::vector<std::string>& args)
 {
     keychord_init();
@@ -478,17 +470,11 @@ static void process_kernel_cmdline() {
     if (qemu[0]) import_kernel_cmdline(true, import_kernel_nv);
 }
 
-static int property_enable_triggers_action(const std::vector<std::string>& args)
-{
-    /* Enable property triggers. */
-    property_triggers_enabled = 1;
-    return 0;
-}
-
 static int queue_property_triggers_action(const std::vector<std::string>& args)
 {
-    ActionManager::GetInstance().QueueBuiltinAction(property_enable_triggers_action, "enable_property_trigger");
     ActionManager::GetInstance().QueueAllPropertyTriggers();
+    /* enable property triggers */
+    property_triggers_enabled = 1;
     return 0;
 }
 
@@ -701,7 +687,7 @@ int main(int argc, char** argv) {
     am.QueueBuiltinAction(wait_for_coldboot_done_action, "wait_for_coldboot_done");
     // ... so that we can start queuing up actions that require stuff from /dev.
     am.QueueBuiltinAction(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");
-    am.QueueBuiltinAction(set_mmap_rnd_bits_action, "set_mmap_rnd_bits");
+    // am.QueueBuiltinAction(set_mmap_rnd_bits_action, "set_mmap_rnd_bits");
     am.QueueBuiltinAction(keychord_init_action, "keychord_init");
     am.QueueBuiltinAction(console_init_action, "console_init");
 
diff --git a/libcutils/iosched_policy.c b/libcutils/iosched_policy.c
index 71bc94b25..8a21b8bd7 100644
--- a/libcutils/iosched_policy.c
+++ b/libcutils/iosched_policy.c
@@ -1,9 +1,10 @@
 /*
-** Copyright 2007, The Android Open Source Project
+** Copyright 2007-2014, The Android Open Source Project
+** Copyright 2015, The CyanogenMod Project
 **
-** Licensed under the Apache License, Version 2.0 (the "License"); 
-** you may not use this file except in compliance with the License. 
-** You may obtain a copy of the License at 
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
 **
 **     http://www.apache.org/licenses/LICENSE-2.0 
 **
@@ -20,28 +21,30 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <pthread.h>
 
 #include <cutils/iosched_policy.h>
+#define LOG_TAG "iosched_policy"
+#include <cutils/log.h>
+
+#define __android_unused __attribute__((__unused__))
 
 #if defined(__ANDROID__)
 #include <linux/ioprio.h>
 #include <sys/syscall.h>
-#define __android_unused
-#else
-#define __android_unused __attribute__((__unused__))
-#endif
+#include <sys/stat.h>
+
+static int __rtio_cgroup_supported = -1;
+static pthread_once_t __rtio_init_once = PTHREAD_ONCE_INIT;
 
 int android_set_ioprio(int pid __android_unused, IoSchedClass clazz __android_unused, int ioprio __android_unused) {
-#if defined(__ANDROID__)
     if (syscall(SYS_ioprio_set, IOPRIO_WHO_PROCESS, pid, ioprio | (clazz << IOPRIO_CLASS_SHIFT))) {
         return -1;
     }
-#endif
     return 0;
 }
 
 int android_get_ioprio(int pid __android_unused, IoSchedClass *clazz, int *ioprio) {
-#if defined(__ANDROID__)
     int rc;
 
     if ((rc = syscall(SYS_ioprio_get, IOPRIO_WHO_PROCESS, pid)) < 0) {
@@ -50,9 +53,84 @@ int android_get_ioprio(int pid __android_unused, IoSchedClass *clazz, int *iopri
 
     *clazz = (rc >> IOPRIO_CLASS_SHIFT);
     *ioprio = (rc & 0xff);
+    return 0;
+}
+
+static void __initialize_rtio(void) {
+    if (!access("/dev/bfqio/tasks", W_OK) ||
+        !access("/dev/bfqio/rt-display/tasks", W_OK)) {
+        __rtio_cgroup_supported = 1;
+    } else {
+        __rtio_cgroup_supported = 0;
+    }
+}
+
+int android_set_rt_ioprio(int tid, int rt) {
+    int fd = -1, rc = -1;
+
+    pthread_once(&__rtio_init_once, __initialize_rtio);
+    if (__rtio_cgroup_supported != 1) {
+        return -1;
+    }
+
+    if (rt) {
+        fd = open("/dev/bfqio/rt-display/tasks", O_WRONLY | O_CLOEXEC);
+    } else {
+        fd = open("/dev/bfqio/tasks", O_WRONLY | O_CLOEXEC);
+    }
+
+    if (fd < 0) {
+        return -1;
+    }
+
+#ifdef HAVE_GETTID
+    if (tid == 0) {
+        tid = gettid();
+    }
+#endif
+
+    // specialized itoa -- works for tid > 0
+    char text[22];
+    char *end = text + sizeof(text) - 1;
+    char *ptr = end;
+    *ptr = '\0';
+    while (tid > 0) {
+        *--ptr = '0' + (tid % 10);
+        tid = tid / 10;
+    }
+
+    rc = write(fd, ptr, end - ptr);
+    if (rc < 0) {
+        /*
+         * If the thread is in the process of exiting,
+         * don't flag an error
+         */
+        if (errno == ESRCH) {
+            rc = 0;
+        } else {
+            SLOGV("android_set_rt_ioprio failed to write '%s' (%s); fd=%d\n",
+                  ptr, strerror(errno), fd);
+        }
+    }
+
+    close(fd);
+    return rc;
+}
+
 #else
+int android_set_ioprio(int pid __android_unused, IoSchedClass clazz __android_unused, int ioprio __android_unused) {
+    return 0;
+}
+
+int android_get_ioprio(int pid __android_unused, IoSchedClass *clazz, int *ioprio) {
     *clazz = IoSchedClass_NONE;
     *ioprio = 0;
-#endif
     return 0;
 }
+
+int android_set_rt_ioprio(int tid __android_unused, int rt __android_unused)
+{
+    return 0;
+}
+#endif
+
diff --git a/libnetutils/packet.c b/libnetutils/packet.c
index cd26d058a..bfc5f4d4e 100644
--- a/libnetutils/packet.c
+++ b/libnetutils/packet.c
@@ -219,6 +219,20 @@ int receive_packet(int s, struct dhcp_msg *msg)
      * to construct the pseudo header used in the checksum calculation.
      */
     dhcp_size = ntohs(packet.udp.len) - sizeof(packet.udp);
+    /*
+     * check validity of dhcp_size.
+     * 1) cannot be negative or zero.
+     * 2) src buffer contains enough bytes to copy
+     * 3) cannot exceed destination buffer
+     */
+    if ((dhcp_size <= 0) ||
+        ((int)(nread - sizeof(struct iphdr) - sizeof(struct udphdr)) < dhcp_size) ||
+        ((int)sizeof(struct dhcp_msg) < dhcp_size)) {
+#if VERBOSE
+        ALOGD("Malformed Packet");
+#endif
+        return -1;
+    }
     saddr = packet.ip.saddr;
     daddr = packet.ip.daddr;
     nread = ntohs(packet.ip.tot_len);
diff --git a/libsuspend/autosuspend_autosleep.c b/libsuspend/autosuspend_autosleep.c
index 7262cc7e8..2160ba655 100644
--- a/libsuspend/autosuspend_autosleep.c
+++ b/libsuspend/autosuspend_autosleep.c
@@ -17,6 +17,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <stddef.h>
+#include <stdbool.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
diff --git a/libsuspend/autosuspend_earlysuspend.c b/libsuspend/autosuspend_earlysuspend.c
index 3793a699e..1bb09371f 100644
--- a/libsuspend/autosuspend_earlysuspend.c
+++ b/libsuspend/autosuspend_earlysuspend.c
@@ -14,18 +14,19 @@
  * limitations under the License.
  */
 
+#define LOG_TAG "libsuspend"
+
 #include <errno.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <stdbool.h>
 #include <stddef.h>
 #include <string.h>
-#include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
-#define LOG_TAG "libsuspend"
-#include <cutils/log.h>
+#include <log/log.h>
 
 #include "autosuspend_ops.h"
 
@@ -36,6 +37,7 @@
 static int sPowerStatefd;
 static const char *pwr_state_mem = "mem";
 static const char *pwr_state_on = "on";
+static void (*wakeup_func)(bool success) = NULL;
 static pthread_t earlysuspend_thread;
 static pthread_mutex_t earlysuspend_mutex = PTHREAD_MUTEX_INITIALIZER;
 static pthread_cond_t earlysuspend_cond = PTHREAD_COND_INITIALIZER;
@@ -107,6 +109,10 @@ static int autosuspend_earlysuspend_enable(void)
         goto err;
     }
 
+    if (wakeup_func != NULL) {
+        (*wakeup_func)(true);
+    }
+
     if (wait_for_earlysuspend) {
         pthread_mutex_lock(&earlysuspend_mutex);
         while (earlysuspend_state != EARLYSUSPEND_MEM) {
@@ -153,9 +159,27 @@ err:
     return ret;
 }
 
+static int autosuspend_force_suspend(int timeout_ms) {
+    ALOGV("force_suspend called with timeout: %d\n", timeout_ms);
+
+    int ret = write(sPowerStatefd, pwr_state_mem, strlen(pwr_state_mem));
+
+    return ret < 0 ? ret : 0;
+}
+
+static void autosuspend_set_wakeup_callback(void (*func)(bool success)) {
+    if (wakeup_func != NULL) {
+        ALOGE("duplicate wakeup callback applied, keeping original\n");
+        return;
+    }
+    wakeup_func = func;
+}
+
 struct autosuspend_ops autosuspend_earlysuspend_ops = {
         .enable = autosuspend_earlysuspend_enable,
         .disable = autosuspend_earlysuspend_disable,
+        .force_suspend = autosuspend_force_suspend,
+        .set_wakeup_callback = autosuspend_set_wakeup_callback,
 };
 
 void start_earlysuspend_thread(void)
diff --git a/libsuspend/autosuspend_ops.h b/libsuspend/autosuspend_ops.h
index 698e25be8..51b0bd5de 100644
--- a/libsuspend/autosuspend_ops.h
+++ b/libsuspend/autosuspend_ops.h
@@ -20,9 +20,10 @@
 struct autosuspend_ops {
     int (*enable)(void);
     int (*disable)(void);
+    int (*force_suspend)(int timeout_ms);
+    void (*set_wakeup_callback)(void (*func)(bool success));
 };
 
-struct autosuspend_ops *autosuspend_autosleep_init(void);
 struct autosuspend_ops *autosuspend_earlysuspend_init(void);
 struct autosuspend_ops *autosuspend_wakeup_count_init(void);
 
diff --git a/libutils/String16.cpp b/libutils/String16.cpp
index 65396caca..32e026bac 100644
--- a/libutils/String16.cpp
+++ b/libutils/String16.cpp
@@ -84,6 +84,24 @@ static char16_t* allocFromUTF8(const char* u8str, size_t u8len)
     return getEmptyString();
 }
 
+static char16_t* allocFromUTF16(const char16_t* u16str, size_t u16len) {
+    if (u16len >= SIZE_MAX / sizeof(char16_t)) {
+        android_errorWriteLog(0x534e4554, "73826242");
+        abort();
+    }
+
+    SharedBuffer* buf = SharedBuffer::alloc((u16len + 1) * sizeof(char16_t));
+    ALOG_ASSERT(buf, "Unable to allocate shared buffer");
+    if (buf) {
+        char16_t* str = (char16_t*)buf->data();
+        memcpy(str, u16str, u16len * sizeof(char16_t));
+        str[u16len] = 0;
+        return str;
+    }
+    return getEmptyString();
+}
+
+
 // ---------------------------------------------------------------------------
 
 String16::String16()
@@ -116,35 +134,9 @@ String16::String16(const String16& o, size_t len, size_t begin)
     setTo(o, len, begin);
 }
 
-String16::String16(const char16_t* o)
-{
-    size_t len = strlen16(o);
-    SharedBuffer* buf = SharedBuffer::alloc((len+1)*sizeof(char16_t));
-    ALOG_ASSERT(buf, "Unable to allocate shared buffer");
-    if (buf) {
-        char16_t* str = (char16_t*)buf->data();
-        strcpy16(str, o);
-        mString = str;
-        return;
-    }
-    
-    mString = getEmptyString();
-}
+String16::String16(const char16_t* o) : mString(allocFromUTF16(o, strlen16(o))) {}
 
-String16::String16(const char16_t* o, size_t len)
-{
-    SharedBuffer* buf = SharedBuffer::alloc((len+1)*sizeof(char16_t));
-    ALOG_ASSERT(buf, "Unable to allocate shared buffer");
-    if (buf) {
-        char16_t* str = (char16_t*)buf->data();
-        memcpy(str, o, len*sizeof(char16_t));
-        str[len] = 0;
-        mString = str;
-        return;
-    }
-    
-    mString = getEmptyString();
-}
+String16::String16(const char16_t* o, size_t len) : mString(allocFromUTF16(o, len)) {}
 
 String16::String16(const String8& o)
     : mString(allocFromUTF8(o.string(), o.size()))
@@ -206,6 +198,11 @@ status_t String16::setTo(const char16_t* other)
 
 status_t String16::setTo(const char16_t* other, size_t len)
 {
+    if (len >= SIZE_MAX / sizeof(char16_t)) {
+        android_errorWriteLog(0x534e4554, "73826242");
+        abort();
+    }
+
     SharedBuffer* buf = SharedBuffer::bufferFromData(mString)
         ->editResize((len+1)*sizeof(char16_t));
     if (buf) {
@@ -228,7 +225,12 @@ status_t String16::append(const String16& other)
     } else if (otherLen == 0) {
         return NO_ERROR;
     }
-    
+
+    if (myLen >= SIZE_MAX / sizeof(char16_t) - otherLen) {
+        android_errorWriteLog(0x534e4554, "73826242");
+        abort();
+    }
+
     SharedBuffer* buf = SharedBuffer::bufferFromData(mString)
         ->editResize((myLen+otherLen+1)*sizeof(char16_t));
     if (buf) {
@@ -249,7 +251,12 @@ status_t String16::append(const char16_t* chrs, size_t otherLen)
     } else if (otherLen == 0) {
         return NO_ERROR;
     }
-    
+
+    if (myLen >= SIZE_MAX / sizeof(char16_t) - otherLen) {
+        android_errorWriteLog(0x534e4554, "73826242");
+        abort();
+    }
+
     SharedBuffer* buf = SharedBuffer::bufferFromData(mString)
         ->editResize((myLen+otherLen+1)*sizeof(char16_t));
     if (buf) {
diff --git a/libutils/Unicode.cpp b/libutils/Unicode.cpp
index ba084f6ce..bfacf1ed7 100644
--- a/libutils/Unicode.cpp
+++ b/libutils/Unicode.cpp
@@ -18,6 +18,7 @@
 #include <utils/Unicode.h>
 
 #include <stddef.h>
+#include <limits.h>
 
 #if defined(_WIN32)
 # undef  nhtol
@@ -178,7 +179,15 @@ ssize_t utf32_to_utf8_length(const char32_t *src, size_t src_len)
     size_t ret = 0;
     const char32_t *end = src + src_len;
     while (src < end) {
-        ret += utf32_codepoint_utf8_length(*src++);
+        size_t char_len = utf32_codepoint_utf8_length(*src++);
+        if (SSIZE_MAX - char_len < ret) {
+            // If this happens, we would overflow the ssize_t type when
+            // returning from this function, so we cannot express how
+            // long this string is in an ssize_t.
+            android_errorWriteLog(0x534e4554, "37723026");
+            return -1;
+        }
+        ret += char_len;
     }
     return ret;
 }
@@ -438,14 +447,23 @@ ssize_t utf16_to_utf8_length(const char16_t *src, size_t src_len)
     size_t ret = 0;
     const char16_t* const end = src + src_len;
     while (src < end) {
+        size_t char_len;
         if ((*src & 0xFC00) == 0xD800 && (src + 1) < end
                 && (*(src + 1) & 0xFC00) == 0xDC00) {
             // surrogate pairs are always 4 bytes.
-            ret += 4;
+            char_len = 4;
             src += 2;
         } else {
-            ret += utf32_codepoint_utf8_length((char32_t) *src++);
+            char_len = utf32_codepoint_utf8_length((char32_t)*src++);
+        }
+        if (SSIZE_MAX - char_len < ret) {
+            // If this happens, we would overflow the ssize_t type when
+            // returning from this function, so we cannot express how
+            // long this string is in an ssize_t.
+            android_errorWriteLog(0x534e4554, "37723026");
+            return -1;
         }
+        ret += char_len;
     }
     return ret;
 }
diff --git a/libziparchive/zip_archive.cc b/libziparchive/zip_archive.cc
index 49097ce9b..89cfe77bc 100644
--- a/libziparchive/zip_archive.cc
+++ b/libziparchive/zip_archive.cc
@@ -358,6 +358,8 @@ static int32_t MapCentralDirectory(int fd, const char* debug_file_name,
   return result;
 }
 
+static inline bool ReadAtOffset(int fd, uint8_t* buf, size_t len, off64_t off);
+
 /*
  * Parses the Zip archive's Central Directory.  Allocates and populates the
  * hash table.
@@ -436,6 +438,22 @@ static int32_t ParseZipArchive(ZipArchive* archive) {
       return -1;
     }
   }
+
+  uint32_t lfh_start_bytes;
+  if (!ReadAtOffset(archive->fd, reinterpret_cast<uint8_t*>(&lfh_start_bytes),
+                    sizeof(uint32_t), 0)) {
+    ALOGW("Zip: Unable to read header for entry at offset == 0.");
+    return -1;
+  }
+
+  if (lfh_start_bytes != LocalFileHeader::kSignature) {
+    ALOGW("Zip: Entry at offset zero has invalid LFH signature %" PRIx32, lfh_start_bytes);
+#if defined(__ANDROID__)
+    android_errorWriteLog(0x534e4554, "64211847");
+#endif
+    return -1;
+  }
+
   ALOGV("+++ zip good scan %" PRIu16 " entries", num_entries);
 
   return 0;
diff --git a/libziparchive/zip_archive_test.cc b/libziparchive/zip_archive_test.cc
index 6aee1bbdf..b8db6a4d3 100644
--- a/libziparchive/zip_archive_test.cc
+++ b/libziparchive/zip_archive_test.cc
@@ -603,6 +603,55 @@ TEST(ziparchive, StreamUncompressedBadCrc) {
   CloseArchive(handle);
 }
 
+// A zip file whose local file header at offset zero is corrupted.
+//
+// ---------------
+// cat foo > a.txt
+// zip a.zip a.txt
+// cat a.zip | xxd -i
+//
+// Manual changes :
+// [2] = 0xff  // Corrupt the LFH signature of entry 0.
+// [3] = 0xff  // Corrupt the LFH signature of entry 0.
+static const std::vector<uint8_t> kZipFileWithBrokenLfhSignature{
+    //[lfh-sig-----------], [lfh contents---------------------------------
+    0x50, 0x4b, 0xff, 0xff, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x80,
+    //--------------------------------------------------------------------
+    0x09, 0x4b, 0xa8, 0x65, 0x32, 0x7e, 0x04, 0x00, 0x00, 0x00, 0x04, 0x00,
+    //-------------------------------]  [file-name-----------------], [---
+    0x00, 0x00, 0x05, 0x00, 0x1c, 0x00, 0x61, 0x2e, 0x74, 0x78, 0x74, 0x55,
+    // entry-contents------------------------------------------------------
+    0x54, 0x09, 0x00, 0x03, 0x51, 0x24, 0x8b, 0x59, 0x51, 0x24, 0x8b, 0x59,
+    //--------------------------------------------------------------------
+    0x75, 0x78, 0x0b, 0x00, 0x01, 0x04, 0x89, 0x42, 0x00, 0x00, 0x04, 0x88,
+    //-------------------------------------], [cd-record-sig-------], [---
+    0x13, 0x00, 0x00, 0x66, 0x6f, 0x6f, 0x0a, 0x50, 0x4b, 0x01, 0x02, 0x1e,
+    // cd-record-----------------------------------------------------------
+    0x03, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x80, 0x09, 0x4b, 0xa8,
+    //--------------------------------------------------------------------
+    0x65, 0x32, 0x7e, 0x04, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x05,
+    //--------------------------------------------------------------------
+    0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xa0,
+    //-]  [lfh-file-header-off-], [file-name-----------------], [extra----
+    0x81, 0x00, 0x00, 0x00, 0x00, 0x61, 0x2e, 0x74, 0x78, 0x74, 0x55, 0x54,
+    //--------------------------------------------------------------------
+    0x05, 0x00, 0x03, 0x51, 0x24, 0x8b, 0x59, 0x75, 0x78, 0x0b, 0x00, 0x01,
+    //-------------------------------------------------------], [eocd-sig-
+    0x04, 0x89, 0x42, 0x00, 0x00, 0x04, 0x88, 0x13, 0x00, 0x00, 0x50, 0x4b,
+    //-------], [---------------------------------------------------------
+    0x05, 0x06, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x4b, 0x00,
+    //-------------------------------------------]
+    0x00, 0x00, 0x43, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+TEST(ziparchive, BrokenLfhSignature) {
+  TemporaryFile tmp_file;
+  ASSERT_NE(-1, tmp_file.fd);
+  ASSERT_TRUE(android::base::WriteFully(tmp_file.fd, &kZipFileWithBrokenLfhSignature[0],
+                                        kZipFileWithBrokenLfhSignature.size()));
+  ZipArchiveHandle handle;
+  ASSERT_EQ(-1, OpenArchiveFd(tmp_file.fd, "LeadingNonZipBytes", &handle));
+}
+
 int main(int argc, char** argv) {
   ::testing::InitGoogleTest(&argc, argv);
 
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 7dc9e5509..0fe1cb7fa 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -136,6 +136,9 @@ on init
     write /proc/sys/net/ipv4/conf/all/accept_redirects 0
     write /proc/sys/net/ipv6/conf/all/accept_redirects 0
 
+    # /proc/net/fib_trie leaks interface IP addresses
+    chmod 0400 /proc/net/fib_trie
+
     # Create cgroup mount points for process groups
     mkdir /dev/cpuctl
     mount cgroup none /dev/cpuctl cpu
@@ -659,3 +662,4 @@ on property:ro.debuggable=1
 service flash_recovery /system/bin/install-recovery.sh
     class main
     oneshot
+    disabled