diff --git a/include/cutils/sched_policy.h b/include/cutils/sched_policy.h
index eaf3993..753a08c 100644
--- a/include/cutils/sched_policy.h
+++ b/include/cutils/sched_policy.h
@@ -24,11 +24,28 @@
 typedef enum {
     SP_BACKGROUND = 0,
     SP_FOREGROUND = 1,
+    SP_CNT,
+    SP_MAX        = SP_CNT - 1,
 } SchedPolicy;
 
+/* Assign thread tid to the cgroup associated with the specified policy.
+ * If the thread is a thread group leader, that is it's gettid() == getpid(),
+ * then the other threads in the same thread group are _not_ affected.
+ * Return value: 0 for success, or -errno for error.
+ */
 extern int set_sched_policy(int tid, SchedPolicy policy);
+
+/* Return the policy associated with the cgroup of thread tid via policy pointer.
+ * Return value: 0 for success, or -1 for error and set errno.
+ */
 extern int get_sched_policy(int tid, SchedPolicy *policy);
 
+/* Return a displayable string corresponding to policy.
+ * Return value: non-NULL NUL-terminated name of unspecified length;
+ * the caller is responsible for displaying the useful part of the string.
+ */
+extern const char *get_sched_policy_name(SchedPolicy policy);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/system/audio.h b/include/system/audio.h
index b863063..0276231 100644
--- a/include/system/audio.h
+++ b/include/system/audio.h
@@ -460,18 +460,18 @@
     size_t size = 0;
 
     switch (format) {
-        case AUDIO_FORMAT_PCM_32_BIT:
-        case AUDIO_FORMAT_PCM_8_24_BIT:
-            size = sizeof(int32_t);
-            break;
-        case AUDIO_FORMAT_PCM_16_BIT:
-            size = sizeof(int16_t);
-            break;
-        case AUDIO_FORMAT_PCM_8_BIT:
-            size = sizeof(uint8_t);
-            break;
-        default:
-            break;
+    case AUDIO_FORMAT_PCM_32_BIT:
+    case AUDIO_FORMAT_PCM_8_24_BIT:
+        size = sizeof(int32_t);
+        break;
+    case AUDIO_FORMAT_PCM_16_BIT:
+        size = sizeof(int16_t);
+        break;
+    case AUDIO_FORMAT_PCM_8_BIT:
+        size = sizeof(uint8_t);
+        break;
+    default:
+        break;
     }
     return size;
 }
diff --git a/include/system/camera.h b/include/system/camera.h
index 62167cf..b8389b1 100644
--- a/include/system/camera.h
+++ b/include/system/camera.h
@@ -151,11 +151,30 @@
      * arg1 = 0 will disable, while passing arg1 = 1 will enable the callback.
      */
     CAMERA_CMD_ENABLE_FOCUS_MOVE_MSG = 8,
+
+    /**
+     * Ping camera service to see if camera hardware is released.
+     *
+     * When any camera method returns error, the client can use ping command
+     * to see if the camera has been taken away by other clients. If the result
+     * is NO_ERROR, it means the camera hardware is not released. If the result
+     * is not NO_ERROR, the camera has been released and the existing client
+     * can silently finish itself or show a dialog.
+     */
+    CAMERA_CMD_PING = 9,
 };
 
 /** camera fatal errors */
 enum {
     CAMERA_ERROR_UNKNOWN = 1,
+    /**
+     * Camera was released because another client has connected to the camera.
+     * The original client should call Camera::disconnect immediately after
+     * getting this notification. Otherwise, the camera will be released by
+     * camera service in a short time. The client should not call any method
+     * (except disconnect and sending CAMERA_CMD_PING) after getting this.
+     */
+    CAMERA_ERROR_RELEASED = 2,
     CAMERA_ERROR_SERVER_DIED = 100
 };
 
diff --git a/libcutils/Android.mk b/libcutils/Android.mk
index dcf859b..3809733 100644
--- a/libcutils/Android.mk
+++ b/libcutils/Android.mk
@@ -94,6 +94,17 @@
 include $(BUILD_HOST_STATIC_LIBRARY)
 
 
+# Static library for host, 64-bit
+# ========================================================
+include $(CLEAR_VARS)
+LOCAL_MODULE := lib64cutils
+LOCAL_SRC_FILES := $(commonSources) $(commonHostSources) dlmalloc_stubs.c
+LOCAL_LDLIBS := -lpthread
+LOCAL_STATIC_LIBRARIES := lib64log
+LOCAL_CFLAGS += $(hostSmpFlag) -m64
+include $(BUILD_HOST_STATIC_LIBRARY)
+
+
 # Shared and static library for target
 # ========================================================
 
diff --git a/libcutils/sched_policy.c b/libcutils/sched_policy.c
index f9c111e..35d362a 100644
--- a/libcutils/sched_policy.c
+++ b/libcutils/sched_policy.c
@@ -273,5 +273,17 @@
     return 0;
 }
 
+const char *get_sched_policy_name(SchedPolicy policy)
+{
+    static const char * const strings[SP_CNT] = {
+       [SP_BACKGROUND] = "bg",
+       [SP_FOREGROUND] = "fg",
+    };
+    if ((policy < SP_CNT) && (strings[policy] != NULL))
+        return strings[policy];
+    else
+        return "error";
+}
+
 #endif /* HAVE_PTHREADS */
 #endif /* HAVE_SCHED_H */
diff --git a/libcutils/str_parms.c b/libcutils/str_parms.c
index 16138f6..364695c 100644
--- a/libcutils/str_parms.c
+++ b/libcutils/str_parms.c
@@ -128,8 +128,10 @@
 
         /* if we replaced a value, free it */
         old_val = hashmapPut(str_parms->map, key, value);
-        if (old_val)
+        if (old_val) {
             free(old_val);
+            free(key);
+        }
 
         items++;
 next_pair:
@@ -167,6 +169,7 @@
 
     if (old_val) {
         free(old_val);
+        free(tmp_key);
     } else if (errno == ENOMEM) {
         free(tmp_key);
         free(tmp_val);
@@ -327,6 +330,7 @@
     test_str_parms_str("foo=bar;baz=");
     test_str_parms_str("foo=bar;baz=bat");
     test_str_parms_str("foo=bar;baz=bat;");
+    test_str_parms_str("foo=bar;baz=bat;foo=bar");
 
     return 0;
 }
diff --git a/liblog/Android.mk b/liblog/Android.mk
index bd4fed4..bd2590e 100644
--- a/liblog/Android.mk
+++ b/liblog/Android.mk
@@ -40,6 +40,7 @@
 
 liblog_host_sources := $(liblog_sources) fake_log_device.c
 
+
 # Static library for host
 # ========================================================
 LOCAL_MODULE := liblog
@@ -48,6 +49,17 @@
 LOCAL_CFLAGS := -DFAKE_LOG_DEVICE=1
 include $(BUILD_HOST_STATIC_LIBRARY)
 
+
+# Static library for host, 64-bit
+# ========================================================
+include $(CLEAR_VARS)
+LOCAL_MODULE := lib64log
+LOCAL_SRC_FILES := $(liblog_host_sources)
+LOCAL_LDLIBS := -lpthread
+LOCAL_CFLAGS := -DFAKE_LOG_DEVICE=1 -m64
+include $(BUILD_HOST_STATIC_LIBRARY)
+
+
 # Shared and static library for target
 # ========================================================
 include $(CLEAR_VARS)
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 2e8f7d2..438ac83 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -1,3 +1,9 @@
+# Copyright (C) 2012 The Android Open Source Project
+#
+# IMPORTANT: Do not create world writable files or directories.
+# This is a common source of Android security bugs.
+#
+
 import /init.${ro.hardware}.rc
 
 on early-init
@@ -163,6 +169,9 @@
     mkdir /data/misc/wifi 0770 wifi wifi
     chmod 0660 /data/misc/wifi/wpa_supplicant.conf
     mkdir /data/local 0751 root root
+
+    # For security reasons, /data/local/tmp should always be empty.
+    # Do not place files or directories in /data/local/tmp
     mkdir /data/local/tmp 0771 shell shell
     mkdir /data/data 0771 system system
     mkdir /data/app-private 0771 system system
diff --git a/toolbox/ps.c b/toolbox/ps.c
index 7c3de4a..7c35ccb 100644
--- a/toolbox/ps.c
+++ b/toolbox/ps.c
@@ -167,14 +167,8 @@
             SchedPolicy p;
             if (get_sched_policy(pid, &p) < 0)
                 printf(" un ");
-            else {
-                if (p == SP_BACKGROUND)
-                    printf(" bg ");
-                else if (p == SP_FOREGROUND)
-                    printf(" fg ");
-                else
-                    printf(" er ");
-            }
+            else
+                printf(" %.2s ", get_sched_policy_name(p));
         }
         printf(" %08x %08x %s %s", wchan, eip, state, cmdline[0] ? cmdline : name);
         if(display_flags&SHOW_TIME)
diff --git a/toolbox/top.c b/toolbox/top.c
index 999c8e1..7642522 100644
--- a/toolbox/top.c
+++ b/toolbox/top.c
@@ -48,6 +48,7 @@
 
 #define PROC_NAME_LEN 64
 #define THREAD_NAME_LEN 32
+#define POLICY_NAME_LEN 4
 
 struct proc_info {
     struct proc_info *next;
@@ -67,7 +68,7 @@
     long rss;
     int prs;
     int num_threads;
-    char policy[32];
+    char policy[POLICY_NAME_LEN];
 };
 
 struct proc_list {
@@ -381,14 +382,10 @@
 static void read_policy(int pid, struct proc_info *proc) {
     SchedPolicy p;
     if (get_sched_policy(pid, &p) < 0)
-        strcpy(proc->policy, "unk");
+        strlcpy(proc->policy, "unk", POLICY_NAME_LEN);
     else {
-        if (p == SP_BACKGROUND)
-            strcpy(proc->policy, "bg");
-        else if (p == SP_FOREGROUND)
-            strcpy(proc->policy, "fg");
-        else
-            strcpy(proc->policy, "er");
+        strlcpy(proc->policy, get_sched_policy_name(p), POLICY_NAME_LEN);
+        proc->policy[2] = '\0';
     }
 }