diff --git a/agcc/agcc b/agcc/agcc
index 0bcc915..3d48cdd 100755
--- a/agcc/agcc
+++ b/agcc/agcc
@@ -35,11 +35,11 @@ use strict;
 my $GCC = `which arm-eabi-gcc`;
 $GCC = qx(cd `dirname $GCC`; /bin/pwd);
 chomp $GCC;
-die "bad arm-eabi-gcc path" if $GCC !~ /(.*)\/prebuilt\//;
+die "bad arm-eabi-gcc path" if $GCC !~ /(.*)\/prebuilts\//;
 my $DROID = $1;
 
-my $ALIB = "$DROID/out/target/product/generic/obj/lib";
-my $TOOLCHAIN = "$DROID/prebuilt/linux-x86/toolchain/arm-eabi-4.2.1";
+my $ALIB = "$DROID/out/target/product/crespo/obj/lib";
+my $TOOLCHAIN = "$DROID/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3";
 
 my @include_paths = (
     "-I$DROID/system/core/include",
@@ -47,8 +47,9 @@ my @include_paths = (
     "-I$DROID/hardware/ril/include",
     "-I$DROID/dalvik/libnativehelper/include",
     "-I$DROID/frameworks/base/include",
+    "-I$DROID/frameworks/wilhelm/include",
     "-I$DROID/external/skia/include",
-    "-I$DROID/out/target/product/generic/obj/include",
+    "-I$DROID/out/target/product/crespo/obj/include",
     "-I$DROID/bionic/libc/arch-arm/include",
     "-I$DROID/bionic/libc/include",
     "-I$DROID/bionic/libstdc++/include",
@@ -59,7 +60,7 @@ my @include_paths = (
     "-I$DROID/bionic/libthread_db/include",
     "-I$DROID/bionic/libm/arm",
     "-I$DROID/bionic/libm",
-    "-I$DROID/out/target/product/generic/obj/SHARED_LIBRARIES/libm_intermediates");
+    "-I$DROID/out/target/product/crespo/obj/SHARED_LIBRARIES/libm_intermediates");
 
 my @preprocess_args = (
     "-D__ARM_ARCH_5__",
@@ -104,7 +105,8 @@ my @optimize_args = (
 
 my @link_args = (
     "-Bdynamic",
-    "-Wl,-T,$DROID/build/core/armelf.x",
+#    "-Wl,-T,$DROID/build/core/armelf.x",
+    "-Wl,-T,$TOOLCHAIN/arm-eabi/lib/ldscripts/armelf.x",
     "-Wl,-dynamic-linker,/system/bin/linker",
     "-Wl,--gc-sections",
     "-Wl,-z,nocopyreloc",
@@ -114,7 +116,7 @@ my @link_args = (
     "-nostdlib",
     "$ALIB/crtend_android.o",
     "$ALIB/crtbegin_dynamic.o",
-    "$TOOLCHAIN/lib/gcc/arm-eabi/4.2.1/interwork/libgcc.a",
+    "$TOOLCHAIN/lib/gcc/arm-eabi/4.4.3/android/libgcc.a",
     "-lc",
     "-lm");
     
@@ -129,7 +131,7 @@ my @shared_args = (
     "-lc",
     "-lm",
     "-Wl,--no-undefined",
-    "$TOOLCHAIN/lib/gcc/arm-eabi/4.2.1/interwork/libgcc.a",
+    "$TOOLCHAIN/lib/gcc/arm-eabi/4.4.3/android/libgcc.a",
     "-Wl,--whole-archive"); # .a, .o input files go *after* here
 
 # Now implement a quick parser for a gcc-like command line
@@ -185,7 +187,7 @@ if($need_compile){
 }
 if($need_link) { @cmd = (@cmd, @link_args); }
 if($need_shlink) { @cmd = (@cmd, @shared_args); }
-@cmd = (@cmd, @args, "$TOOLCHAIN/lib/gcc/arm-eabi/4.2.1/interwork/libgcc.a");
+@cmd = (@cmd, @args, "$TOOLCHAIN/lib/gcc/arm-eabi/4.4.3/android/libgcc.a");
 
 #print join(" ", @cmd), "\n"; # Spit it out if you're curious
 exec(@cmd);
diff --git a/android-tools/inferno.sh b/android-tools/inferno.sh
index 2632225..b07dc1c 100755
--- a/android-tools/inferno.sh
+++ b/android-tools/inferno.sh
@@ -1,2 +1,2 @@
-#! /system/xbin/bash
+#! /system/bin/sh
 echo "wm/wm" | /data/inferno/Android/arm/bin/emu-g
diff --git a/android-tools/init.rc b/android-tools/init.rc
index 407be2a..5e29995 100755
--- a/android-tools/init.rc
+++ b/android-tools/init.rc
@@ -1,6 +1,22 @@
+# Copyright (C) 2012 The Android Open Source Project
+#
+# IMPORTANT: Do not create world writable files or directories.
+# This is a common source of Android security bugs.
+#
+
+import /init.${ro.hardware}.rc
+import /init.usb.rc
+import /init.trace.rc
+
 on early-init
+    # Set init and its forked children's oom_adj.
+    write /proc/1/oom_adj -16
+
     start ueventd
 
+# create mountpoints
+    mkdir /mnt 0775 root system
+
 on init
 
 sysclktz 0
@@ -11,16 +27,12 @@ loglevel 3
     export PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
     export LD_LIBRARY_PATH /vendor/lib:/system/lib
     export ANDROID_BOOTLOGO 1
-    export ANDROID_CACHE /cache
     export ANDROID_ROOT /system
     export ANDROID_ASSETS /system/app
     export ANDROID_DATA /data
-    export DOWNLOAD_CACHE /cache/download
-    export EXTERNAL_STORAGE /mnt/sdcard
     export ASEC_MOUNTPOINT /mnt/asec
     export LOOP_MOUNTPOINT /mnt/obb
-    export SD_EXT_DIRECTORY /sd-ext
-    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/core-junit.jar
+    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
 
 # Backward compatibility
     symlink /system/etc /etc
@@ -30,21 +42,14 @@ loglevel 3
 # but someday that may change.
     symlink /system/vendor /vendor
 
-# create mountpoints
-    mkdir /mnt 0775 root system
-    mkdir /mnt/sdcard 0000 system system
-
 # Create cgroup mount point for cpu accounting
     mkdir /acct
     mount cgroup none /acct cpuacct
     mkdir /acct/uid
 
-# Backwards Compat - XXX: Going away in G*
-    symlink /mnt/sdcard /sdcard
-
     mkdir /system
     mkdir /data 0771 system system
-    mkdir /cache 0771 system cache
+    mkdir /cache 0770 system cache
     mkdir /config 0500 root root
 
     # Directory for putting things only root should see.
@@ -65,8 +70,6 @@ loglevel 3
     mkdir /mnt/obb 0700 root system
     mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
 
-    mkdir /sd-ext 0771 system system
-
     write /proc/sys/kernel/panic_on_oops 1
     write /proc/sys/kernel/hung_task_timeout_secs 0
     write /proc/cpu/alignment 4
@@ -74,25 +77,41 @@ loglevel 3
     write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
     write /proc/sys/kernel/sched_compat_yield 1
     write /proc/sys/kernel/sched_child_runs_first 0
+    write /proc/sys/kernel/randomize_va_space 2
+    write /proc/sys/kernel/kptr_restrict 2
+    write /proc/sys/kernel/dmesg_restrict 1
+    write /proc/sys/vm/mmap_min_addr 32768
+    write /proc/sys/kernel/sched_rt_runtime_us 950000
+    write /proc/sys/kernel/sched_rt_period_us 1000000
 
 # Create cgroup mount points for process groups
     mkdir /dev/cpuctl
     mount cgroup none /dev/cpuctl cpu
     chown system system /dev/cpuctl
     chown system system /dev/cpuctl/tasks
-    chmod 0777 /dev/cpuctl/tasks
+    chmod 0660 /dev/cpuctl/tasks
     write /dev/cpuctl/cpu.shares 1024
-
-    mkdir /dev/cpuctl/fg_boost
-    chown system system /dev/cpuctl/fg_boost/tasks
-    chmod 0777 /dev/cpuctl/fg_boost/tasks
-    write /dev/cpuctl/fg_boost/cpu.shares 1024
-
-    mkdir /dev/cpuctl/bg_non_interactive
-    chown system system /dev/cpuctl/bg_non_interactive/tasks
-    chmod 0777 /dev/cpuctl/bg_non_interactive/tasks
+    write /dev/cpuctl/cpu.rt_runtime_us 950000
+    write /dev/cpuctl/cpu.rt_period_us 1000000
+
+    mkdir /dev/cpuctl/apps
+    chown system system /dev/cpuctl/apps/tasks
+    chmod 0666 /dev/cpuctl/apps/tasks
+    write /dev/cpuctl/apps/cpu.shares 1024
+    write /dev/cpuctl/apps/cpu.rt_runtime_us 800000
+    write /dev/cpuctl/apps/cpu.rt_period_us 1000000
+
+    mkdir /dev/cpuctl/apps/bg_non_interactive
+    chown system system /dev/cpuctl/apps/bg_non_interactive/tasks
+    chmod 0666 /dev/cpuctl/apps/bg_non_interactive/tasks
     # 5.0 %
-    write /dev/cpuctl/bg_non_interactive/cpu.shares 52
+    write /dev/cpuctl/apps/bg_non_interactive/cpu.shares 52
+    write /dev/cpuctl/apps/bg_non_interactive/cpu.rt_runtime_us 700000
+    write /dev/cpuctl/apps/bg_non_interactive/cpu.rt_period_us 1000000
+
+# Allow everybody to read the xt_qtaguid resource tracking misc dev.
+# This is needed by any process that uses socket tagging.
+    chmod 0644 /dev/xt_qtaguid
 
 on fs
 # mount mtd partitions
@@ -106,21 +125,36 @@ on post-fs
     # once everything is setup, no need to modify /
     mount rootfs rootfs / ro remount
 
+    # We chown/chmod /cache again so because mount is run as root + defaults
+    chown system cache /cache
+    chmod 0770 /cache
+
+    # This may have been created by the recovery system with odd permissions
+    chown system cache /cache/recovery
+    chmod 0770 /cache/recovery
+
+    #change permissions on vmallocinfo so we can grab it from bugreports
+    chown root log /proc/vmallocinfo
+    chmod 0440 /proc/vmallocinfo
+
+    #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
+    chown root system /proc/kmsg
+    chmod 0440 /proc/kmsg
+    chown root system /proc/sysrq-trigger
+    chmod 0220 /proc/sysrq-trigger
+
+    # create the lost+found directories, so as to enforce our permissions
+    mkdir /cache/lost+found 0770 root root
+
+on post-fs-data
     # We chown/chmod /data again so because mount is run as root + defaults
     chown system system /data
     chmod 0771 /data
 
-    # Mount compressed filesystems
-    mount squashfs loop@/system/lib/modules/modules.sqf /system/lib/modules ro
-    mount squashfs loop@/system/xbin/xbin.sqf /system/xbin ro
-
     # Create dump dir and collect dumps.
     # Do this before we mount cache so eventually we can use cache for
     # storing dumps on platforms which do not have a dedicated dump partition.
-   
-    mkdir /data/dontpanic
-    chown root log /data/dontpanic
-    chmod 0750 /data/dontpanic
+    mkdir /data/dontpanic 0750 root log
 
     # Collect apanic data, free resources and re-arm trigger
     copy /proc/apanic_console /data/dontpanic/apanic_console
@@ -133,76 +167,50 @@ on post-fs
 
     write /proc/apanic_console 1
 
-    # Same reason as /data above
-    chown system cache /cache
-    chmod 0771 /cache
-
-    # This may have been created by the recovery system with odd permissions
-    chown system cache /cache/recovery
-    chmod 0770 /cache/recovery
-
-    #change permissions on vmallocinfo so we can grab it from bugreports
-    chown root log /proc/vmallocinfo
-    chmod 0440 /proc/vmallocinfo
-
-    #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
-    chown root system /proc/kmsg
-    chmod 0440 /proc/kmsg
-    chown root system /proc/sysrq-trigger
-    chmod 0220 /proc/sysrq-trigger
-
-# create basic filesystem structure
+    # create basic filesystem structure
     mkdir /data/misc 01771 system misc
     mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
     mkdir /data/misc/bluetooth 0770 system system
     mkdir /data/misc/keystore 0700 keystore keystore
-    mkdir /data/misc/vpn 0770 system system
+    mkdir /data/misc/keychain 0771 system system
+    mkdir /data/misc/vpn 0770 system vpn
     mkdir /data/misc/systemkeys 0700 system system
-    mkdir /data/misc/vpn/profiles 0770 system system
     # give system access to wpa_supplicant.conf for backup and restore
     mkdir /data/misc/wifi 0770 wifi wifi
-    chmod 0770 /data/misc/wifi
     chmod 0660 /data/misc/wifi/wpa_supplicant.conf
-    mkdir /data/local 0771 shell shell
+    mkdir /data/local 0751 root root
+
+    # For security reasons, /data/local/tmp should always be empty.
+    # Do not place files or directories in /data/local/tmp
     mkdir /data/local/tmp 0771 shell shell
-    mkdir /data/local/download 0771 system cache
     mkdir /data/data 0771 system system
     mkdir /data/app-private 0771 system system
+    mkdir /data/app-asec 0700 root root
     mkdir /data/app 0771 system system
     mkdir /data/property 0700 root root
+    mkdir /data/ssh 0750 root shell
+    mkdir /data/ssh/empty 0700 root root
 
-    mkdir /cache/download 0771 system cache
-
-    # create dalvik-cache and double-check the perms
+    # create dalvik-cache, so as to enforce our permissions
     mkdir /data/dalvik-cache 0771 system system
-    chown system system /data/dalvik-cache
-    chmod 0771 /data/dalvik-cache
 
-    mkdir /cache/dalvik-cache 0771 system system
-    chown system system /cache/dalvik-cache
-    chmod 0771 /cache/dalvik-cache
+    # create resource-cache and double-check the perms
+    mkdir /data/resource-cache 0771 system system
+    chown system system /data/resource-cache
+    chmod 0771 /data/resource-cache
 
     # create the lost+found directories, so as to enforce our permissions
-    mkdir /data/lost+found 0770
-    mkdir /cache/lost+found 0770
-
-    # double check the perms, in case lost+found already exists, and set owner
-    chown root root /data/lost+found
-    chmod 0770 /data/lost+found
-    chown root root /cache/lost+found
-    chmod 0770 /cache/lost+found
-
-    # allow net_raw to have access to /dev/socket directory
-    chown root net_raw /dev/socket
-    chmod 0775 /dev/socket
-
-    # allow system to modify cpufreq control files
-    chown root system /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
-    chmod 0664 /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
-    chown root system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
-    chmod 0664 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
-    chown root system /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
-    chmod 0664 /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
+    mkdir /data/lost+found 0770 root root
+
+    # create directory for DRM plug-ins - give drm the read/write access to
+    # the following directory.
+    mkdir /data/drm 0770 drm drm
+
+    # If there is no fs-post-data action in the init.<device>.rc file, you
+    # must uncomment this line, otherwise encrypted filesystems
+    # won't work.
+    # Set indication (checked by vold) that we have finished this action
+    #setprop vold.post_fs_data_done 1
 
 on boot
 # basic network init
@@ -213,42 +221,15 @@ on boot
 # set RLIMIT_NICE to allow priorities from 19 to -20
     setrlimit 13 40 40
 
-# Define the oom_adj values for the classes of processes that can be
-# killed by the kernel.  These are used in ActivityManagerService.
-    setprop ro.FOREGROUND_APP_ADJ 0
-    setprop ro.VISIBLE_APP_ADJ 1
-    setprop ro.PERCEPTIBLE_APP_ADJ 2
-    setprop ro.HEAVY_WEIGHT_APP_ADJ 3
-    setprop ro.SECONDARY_SERVER_ADJ 4
-    setprop ro.BACKUP_APP_ADJ 5
-    setprop ro.HOME_APP_ADJ 6
-    setprop ro.HIDDEN_APP_MIN_ADJ 7
-    setprop ro.EMPTY_APP_ADJ 15
-
-# Define the memory thresholds at which the above process classes will
-# be killed.  These numbers are in pages (4k).
-    setprop ro.FOREGROUND_APP_MEM 2048
-    setprop ro.VISIBLE_APP_MEM 3072
-    setprop ro.PERCEPTIBLE_APP_MEM 4096
-    setprop ro.HEAVY_WEIGHT_APP_MEM 4096
-    setprop ro.SECONDARY_SERVER_MEM 6144
-    setprop ro.BACKUP_APP_MEM 6144
-    setprop ro.HOME_APP_MEM 6144
-    setprop ro.HIDDEN_APP_MEM 7168
-    setprop ro.EMPTY_APP_MEM 8192
-
-# Write value must be consistent with the above properties.
-# Note that the driver only supports 6 slots, so we have combined some of
-# the classes into the same memory level; the associated processes of higher
-# classes will still be killed first.
-    write /sys/module/lowmemorykiller/parameters/adj 0,1,2,4,7,15
-
+# Memory management.  Basic kernel parameters, and allow the high
+# level system server to be able to adjust the kernel OOM driver
+# parameters to match how it is managing things.
     write /proc/sys/vm/overcommit_memory 1
     write /proc/sys/vm/min_free_order_shift 4
-    write /sys/module/lowmemorykiller/parameters/minfree 2048,3072,4096,6144,7168,8192
-
-    # Set init its forked children's oom_adj.
-    write /proc/1/oom_adj -16
+    chown root system /sys/module/lowmemorykiller/parameters/adj
+    chmod 0664 /sys/module/lowmemorykiller/parameters/adj
+    chown root system /sys/module/lowmemorykiller/parameters/minfree
+    chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
 
     # Tweak background writeout
     write /proc/sys/vm/dirty_expire_centisecs 200
@@ -260,12 +241,34 @@ on boot
     chown radio system /sys/android_power/acquire_full_wake_lock
     chown radio system /sys/android_power/acquire_partial_wake_lock
     chown radio system /sys/android_power/release_wake_lock
-    chown radio system /sys/power/state
+    chown system system /sys/power/state
+    chown system system /sys/power/wakeup_count
     chown radio system /sys/power/wake_lock
     chown radio system /sys/power/wake_unlock
     chmod 0660 /sys/power/state
     chmod 0660 /sys/power/wake_lock
     chmod 0660 /sys/power/wake_unlock
+
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
+    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
+    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
+    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
+    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
+    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
+    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
+    chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
+    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
+
+    # Assume SMP uses shared cpufreq policy for all CPUs
+    chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
+    chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
+
     chown system system /sys/class/timed_output/vibrator/enable
     chown system system /sys/class/leds/keyboard-backlight/brightness
     chown system system /sys/class/leds/lcd-backlight/brightness
@@ -296,103 +299,141 @@ on boot
 # Define TCP buffer sizes for various networks
 #   ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
     setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
-    setprop net.tcp.buffersize.wifi    4095,87380,110208,4096,16384,110208
+    setprop net.tcp.buffersize.wifi    524288,1048576,2097152,262144,524288,1048576
+    setprop net.tcp.buffersize.lte     524288,1048576,2097152,262144,524288,1048576
     setprop net.tcp.buffersize.umts    4094,87380,110208,4096,16384,110208
+    setprop net.tcp.buffersize.hspa    4094,87380,262144,4096,16384,262144
     setprop net.tcp.buffersize.edge    4093,26280,35040,4096,16384,35040
     setprop net.tcp.buffersize.gprs    4092,8760,11680,4096,8760,11680
 
-# Include extra init file
-    import /system/etc/init.local.rc
+# Set this property so surfaceflinger is not started by system_init
+    setprop system_init.startsurfaceflinger 0
+
+    class_start core
+    class_start main
+
+on nonencrypted
+    class_start late_start
+
+on charger
+    class_start charger
 
-# Run the boot picker to choose which OS you want
-    exec /data/picker
+on property:vold.decrypt=trigger_reset_main
+    class_reset main
 
-# Run sysinit
-    exec /system/bin/sysinit
+on property:vold.decrypt=trigger_load_persist_props
+    load_persist_props
 
-    class_start default
+on property:vold.decrypt=trigger_post_fs_data
+    trigger post-fs-data
+
+on property:vold.decrypt=trigger_restart_min_framework
+    class_start main
+
+on property:vold.decrypt=trigger_restart_framework
+    class_start main
+    class_start late_start
+
+on property:vold.decrypt=trigger_shutdown_framework
+    class_reset late_start
+    class_reset main
 
 ## Daemon processes to be run by init.
 ##
 service ueventd /sbin/ueventd
+    class core
     critical
 
 service console /system/bin/sh
+    class core
     console
     disabled
     user shell
     group log
 
-on property:ro.secure=0
+on property:ro.debuggable=1
     start console
 
-# adbd is controlled by the persist.service.adb.enable system property
+# adbd is controlled via property triggers in init.<platform>.usb.rc
 service adbd /sbin/adbd
+    class core
     disabled
 
 # adbd on at boot in emulator
 on property:ro.kernel.qemu=1
     start adbd
 
-on property:persist.service.adb.enable=1
-    start adbd
-
-on property:persist.service.adb.enable=0
-    stop adbd
-
 service servicemanager /system/bin/servicemanager
+    class core
     user system
+    group system
     critical
     onrestart restart zygote
     onrestart restart media
+    onrestart restart surfaceflinger
+    onrestart restart drm
 
 service vold /system/bin/vold
+    class core
     socket vold stream 0660 root mount
     ioprio be 2
 
 service netd /system/bin/netd
+    class main
     socket netd stream 0660 root system
+    socket dnsproxyd stream 0660 root inet
+    socket mdns stream 0660 root system
 
 service debuggerd /system/bin/debuggerd
+    class main
 
 service ril-daemon /system/bin/rild
+    class main
     socket rild stream 660 root radio
     socket rild-debug stream 660 radio system
     user root
-    group radio cache inet misc audio sdcard_rw net_admin net_raw
+    group radio cache inet misc audio sdcard_r sdcard_rw log
+
+service surfaceflinger /system/bin/surfaceflinger
+    class main
+    user system
+    group graphics
+    onrestart restart zygote
 
 service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
-    disabled
-    socket zygote stream 666
+    class main
+    socket zygote stream 660 root system
     onrestart write /sys/android_power/request_state wake
     onrestart write /sys/power/state on
     onrestart restart media
     onrestart restart netd
 
-service media /system/bin/mediaserver
-    disabled
-    user media
-    group system audio camera graphics inet net_bt net_bt_admin net_raw
-    ioprio rt 4
+service drm /system/bin/drmserver
+    class main
+    user drm
+    group drm system inet drmrpc sdcard_r
 
-service media-inferno /system/bin/mediaserver-inferno
-    disabled
+service media /system/bin/mediaserver
+    class main
     user media
-    group system audio camera graphics inet net_bt net_bt_admin net_raw
+    group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc
     ioprio rt 4
 
 service bootanim /system/bin/bootanimation
+    class main
     user graphics
     group graphics
     disabled
     oneshot
 
 service dbus /system/bin/dbus-daemon --system --nofork
+    class main
     socket dbus stream 660 bluetooth bluetooth
     user bluetooth
     group bluetooth net_bt_admin
 
 service bluetoothd /system/bin/bluetoothd -n
+    class main
     socket bluetooth stream 660 bluetooth bluetooth
     socket dbus_bluetooth stream 660 bluetooth bluetooth
     # init.rc does not yet support applying capabilities, so run as root and
@@ -400,65 +441,68 @@ service bluetoothd /system/bin/bluetoothd -n
     group bluetooth net_bt_admin misc
     disabled
 
-service hfag /system/bin/sdptool add --channel=10 HFAG
-    user bluetooth
-    group bluetooth net_bt_admin
-    disabled
-    oneshot
-
-service hsag /system/bin/sdptool add --channel=11 HSAG
-    user bluetooth
-    group bluetooth net_bt_admin
-    disabled
-    oneshot
-
-service opush /system/bin/sdptool add --channel=12 OPUSH
-    user bluetooth
-    group bluetooth net_bt_admin
-    disabled
-    oneshot
-
-service pbap /system/bin/sdptool add --channel=19 PBAP
-    user bluetooth
-    group bluetooth net_bt_admin
-    disabled
-    oneshot
-
 service installd /system/bin/installd
+    class main
     socket installd stream 600 system system
 
+service flash_recovery /system/etc/install-recovery.sh
+    class main
+    oneshot
+
 service racoon /system/bin/racoon
+    class main
     socket racoon stream 600 system system
-    # racoon will setuid to vpn after getting necessary resources.
-    group net_admin
+    # IKE uses UDP port 500. Racoon will setuid to vpn after binding the port.
+    group vpn net_admin inet
     disabled
     oneshot
 
 service mtpd /system/bin/mtpd
+    class main
     socket mtpd stream 600 system system
     user vpn
-    group vpn net_admin net_raw
+    group vpn net_admin inet net_raw
     disabled
     oneshot
 
 service keystore /system/bin/keystore /data/misc/keystore
+    class main
     user keystore
-    group keystore
+    group keystore drmrpc
     socket keystore stream 666
 
 service dumpstate /system/bin/dumpstate -s
+    class main
     socket dumpstate stream 0660 shell log
     disabled
     oneshot
 
-# start inferno
-service inferno /system/bin/inferno.sh
-	disabled
+service sshd /system/bin/start-ssh
+    class main
+    disabled
+
+service mdnsd /system/bin/mdnsd
+    class main
+    user mdnsr
+    group inet net_raw
+    socket mdnsd stream 0660 mdnsr inet
+    disabled
+    oneshot
+
+service inferno /system/bin/sh -c "echo wm/wm |/data/inferno/Android/arm/bin/emu-g"
+    class main
+    disabled
 
 on property:inferno.enabled=0
+    stop inferno
     start media
+    start surfaceflinger
+    start bootanim
     start zygote
+
 on property:inferno.enabled=1
+    stop surfaceflinger
+    stop bootanim
+    stop zygote
     start media-inferno
     start inferno
-
diff --git a/dis/startzygote b/dis/startzygote
index 3f795f6..cf5bac4 100644
--- a/dis/startzygote
+++ b/dis/startzygote
@@ -1,8 +1,12 @@
 #!/dis/sh
 load std
 
-os /system/bin/stop inferno
-os /system/bin/stop media-inferno
-os /system/bin/start media
-os /system/bin/start zygote
-os /system/xbin/killall emu-g
+#os /system/bin/stop inferno
+#os /system/bin/stop media-inferno
+#os /system/bin/start media
+#os /system/bin/start surfaceflinger
+#os /system/bin/start bootanim
+#os /system/bin/start zygote
+#os /system/xbin/killall emu-g
+os /system/bin/setprop inferno.enabled 0
+shutdown -h
diff --git a/emu/Android/audio-android.c b/emu/Android/audio-android.c
index fb28c45..f3d7621 100644
--- a/emu/Android/audio-android.c
+++ b/emu/Android/audio-android.c
@@ -78,6 +78,7 @@ getaudiodev(void)
 void 
 audio_file_init(void)
 {
+#if 0
 	/* Let's try this SLES junk */
 	SLresult result;
 
@@ -109,12 +110,14 @@ audio_file_init(void)
 			&outputMixVolume);
 
 	audio_info_init(&av);
+#endif
 }
 
 
 void
 audio_file_open(Chan *c, int omode)
 {
+#if 0
 	SLresult result;
 
 //	DPRINT("opened mode %o\n", omode);
@@ -188,11 +191,13 @@ audio_file_open(Chan *c, int omode)
 				&recorderBufferQueue);
 		assert(SL_RESULT_SUCCESS == result);
 	}
+#endif
 }
 
 void    
 audio_file_close(Chan *c)
 {
+#if 0
 	// Destroy the buffer queue object
 	if (bqPlayerObject != NULL) {
 		(*bqPlayerObject)->Destroy(bqPlayerObject);
@@ -201,11 +206,13 @@ audio_file_close(Chan *c)
 		bqPlayerBufferQueue = NULL;
 		//bqPlayerEffectSend = NULL;
 	}
+#endif
 }
 
 long
 audio_file_read(Chan *c, void *va, long count, vlong offset)
 {
+#if 0
 	SLresult result;
 	SLBufferQueueState state;
 
@@ -285,11 +292,14 @@ audio_file_read(Chan *c, void *va, long count, vlong offset)
 //	qunlock(&inlock);
 //	
 //	return count;
+#endif
+  return -1;
 }
 
 long                                            
 audio_file_write(Chan *c, void *va, long count, vlong offset)
 {
+#if 0
 	SLresult result;
 	SLBufferQueueState state;
 
@@ -351,11 +361,14 @@ audio_file_write(Chan *c, void *va, long count, vlong offset)
 //	qunlock(&outlock);
 //
 //	return count;	
+#endif
+  return -1;
 }
 
 long
 audio_ctl_write(Chan *c, void *va, long count, vlong offset)
 {
+#if 0
 	Audio_t tmpav = av;
 	int tfd;
 
@@ -413,6 +426,8 @@ audio_ctl_write(Chan *c, void *va, long count, vlong offset)
 	poperror();
 	qunlock(&inlock);
 	return count;
+#endif
+  return -1;
 }
 
 /* Linux/OSS specific stuff */
diff --git a/emu/Android/devphone.c b/emu/Android/devphone.c
index 3f6832d..471b034 100644
--- a/emu/Android/devphone.c
+++ b/emu/Android/devphone.c
@@ -33,6 +33,7 @@
 #define RESPONSE_UNSOLICITED 1
 #define POWER_ON 2000
 #define POWER_OFF 2001
+#define RIL_REQUEST_REGISTRATION_STATE 20
 
 // Inferno-related globals
 
@@ -136,6 +137,7 @@ status_ready(void *unused)
 void
 phoneinit(void)
 {
+#if 0
 	af_handle = dlopen("libinfernoaudio.so", RTLD_NOW);
 	if(af_handle == NULL) {
 		fprintf(stderr, "opening libinfernoaudio.so failed: %s\n",
@@ -151,7 +153,7 @@ phoneinit(void)
 	}
 
 	af_setMode(MODE_NORMAL);
-
+#endif
 	calls.cs = NULL;
 	calls.num = 0;
 	calls.ready = 0;
@@ -388,6 +390,7 @@ phonewrite(Chan *c, void *va, long n, vlong offset)
 			set_mute(0);
 		} else if(strcmp(cmd->f[0], "route") == 0) {
 			if(cmd->nf >= 2) {
+#if 0
 				if(strcmp(cmd->f[1], "earpiece") == 0) {
 					af_setParameters("routing=1");
 				} else if(strcmp(cmd->f[1], "speaker") == 0) {
@@ -395,9 +398,11 @@ phonewrite(Chan *c, void *va, long n, vlong offset)
 				} else if(strcmp(cmd->f[1], "headphone") == 0) {
 					af_setParameters("routing=3");
 				}
+#endif
 			}
 		} else if(strcmp(cmd->f[0], "volume") == 0) {
 			if(cmd->nf >= 2) {
+#if 0
 				switch(strtol(cmd->f[1], NULL, 10)) {
 				case 0: af_setVoiceVolume(0.0); break;
 				case 1: af_setVoiceVolume(0.2); break;
@@ -407,6 +412,7 @@ phonewrite(Chan *c, void *va, long n, vlong offset)
 				case 5: af_setVoiceVolume(1.0); break;
 				default: af_setVoiceVolume(1.0); break;
 				}
+#endif
 			}
 		}
 		break;
@@ -594,7 +600,9 @@ handle_sol_response(struct parcel *p)
 		break;
 	case POWER_OFF:
 		power_state = 0;
+#if 0
 		af_setMode(MODE_NORMAL);
+#endif
 		break;
 	case RIL_REQUEST_REGISTRATION_STATE:
 		if(!parcel_data_avail(p)) return;
@@ -814,10 +822,11 @@ dial(char *number)
 	struct parcel p;
 	struct mixer *mixer;
 	struct mixer_ctl *ctl;
-
+#if 0
 	af_setMode(MODE_IN_CALL); // tell audioflinger we want to start a call
 	af_setParameters("routing=1"); // tell AF where to route sound
 	af_setVoiceVolume(1.0f);
+#endif
 	set_mute(0);
 
 	parcel_init(&p);
diff --git a/emu/Android/devwifi.c b/emu/Android/devwifi.c
index cf71b89..f2e2e63 100644
--- a/emu/Android/devwifi.c
+++ b/emu/Android/devwifi.c
@@ -57,7 +57,9 @@ wifiinit(void)
 
 	if (pid == 0) {
 		chdir("/data/misc/wifi");
-		execl("/system/bin/wpa_supplicant", "wpa_supplicant", "-D", "wext", "-i", "eth0", "-c", "/data/misc/wifi/wpa_supplicant.conf", NULL);
+		//		execl("/system/bin/wpa_supplicant", "wpa_supplicant", "-D", "wext", "-i", "eth0", "-c", "/data/misc/wifi/wpa_supplicant.conf", NULL);
+		execl("/system/bin/start", "start", "wpa_supplicant", NULL);
+		//		execl("/system/bin/netcfg", "netcfg", "wlan0", "dhcp", NULL);
 	}
 //	kproc("phone", loop_for_data, 0, 0);
 }
diff --git a/emu/Android/screen.c b/emu/Android/screen.c
index 4ebbc9c..dcd528e 100644
--- a/emu/Android/screen.c
+++ b/emu/Android/screen.c
@@ -186,14 +186,14 @@ touchscreens(struct input_event* ev, int count)
 			break;
 		case 0x36:		// ABS_MT_POSITION_X
 			if(!rotation_opt) {
-				if ((ev[i].value * 800 / 1024) > lowy)
-					y = (ev[i].value * 800 /1024) - yadjust;
+				if ((ev[i].value * 800 / 950) > lowy)
+					y = (ev[i].value * 800 /950) - yadjust;
 				else
 					y = ymin;
 				break;
 			} else {
-				if ((ev[i].value * 800 / 1024) > lowx)
-					x = (ev[i].value * 800 / 1024) - xadjust;
+				if ((ev[i].value * 800 / 950) > lowx)
+					x = (ev[i].value * 800 / 950) - xadjust;
 				else
 					x = xmin;
 				break;
@@ -219,6 +219,7 @@ touchscreens(struct input_event* ev, int count)
 	    break;
 	case EV_SYN:
 		mousetrack(b, x, y, 0);
+                b = 0;
 		return;
 	}
     }
@@ -254,7 +255,7 @@ readbutton(void* v)
 		}
 
 		for (i = 0; i < rd / size; i++) {
-			//print("ev[%d]: type = 0x%x, code = 0x%x, value = 0x%x\n", i, ev[i].type, ev[i].code, ev[i].value);
+		  //printf("ev[%d]: type = 0x%x, code = 0x%x, value = 0x%x\n", i, ev[i].type, ev[i].code, ev[i].value);
 			if (ev[i].code == 0x74) {
 				if (ev[i].value == 1) {
 					powerbuttonpress = 1;
diff --git a/emu/port/main.c b/emu/port/main.c
index b1f0572..44f04e0 100644
--- a/emu/port/main.c
+++ b/emu/port/main.c
@@ -287,18 +287,17 @@ main(int argc, char *argv[])
 	} else if (!strncmp(device, "crespo", 6)) {
 		type = 's';
 		system("cp /data/inferno/etc/buttonserver-nexus-s.cfg /data/inferno/etc/buttonserver.cfg");
-		eventfiles = malloc(7*sizeof(char *));
-		eventfiles[0] = "/dev/input/event0";
-		eventfiles[1] = "/dev/input/event1";
-		eventfiles[2] = "/dev/input/event2";
-		eventfiles[3] = "/dev/input/event3";
-		eventfiles[4] = "/dev/input/event4";
-		eventfiles[5] = "/dev/input/event5";
-		eventfiles[6] = NULL;
+		eventfiles = malloc(6*sizeof(char *));
+		eventfiles[0] = "/dev/input/event0"; // mxt224_ts_imput
+		eventfiles[1] = "/dev/input/event1"; // gyro
+		eventfiles[2] = "/dev/input/event2"; // herring-keypad (72,73,84)
+		eventfiles[3] = "/dev/input/event3"; // proximity
+		eventfiles[4] = "/dev/input/event4"; // lightsensor-level
+		eventfiles[5] = NULL;
 		displaydepth = 32;
 		geom("480x800");
 		mousefile = "/dev/input/event0";
-		homedevice = "/dev/input/event5";
+		homedevice = "/dev/input/event2";
 		voldevice = "/dev/input/event2";
 		maineventnum = 2;
 		system("echo \"on\" > /sys/power/state");
diff --git a/etc/buttonserver-nexus-s.cfg b/etc/buttonserver-nexus-s.cfg
index efe2332..bc6ec5b 100644
--- a/etc/buttonserver-nexus-s.cfg
+++ b/etc/buttonserver-nexus-s.cfg
@@ -1,14 +1,16 @@
 # Nexus S
-"5 1 217 1"="search press"
-"5 1 217 0"="search release"
-"5 1 102 1"="home press"
-"5 1 102 0"="home release"
-"5 1 139 1"="menu press"
-"5 1 139 0"="menu release"
-"5 1 158 1"="back press"
-"5 1 158 0"="back release"
-"2 1 114 1"="volume down press"
-"2 1 114 0"="volume down release"
+"2 1 217 1"="search press"
+"2 1 217 0"="search release"
+"2 1 102 1"="home press"
+"2 1 102 0"="home release"
+"2 1 139 1"="menu press"
+"2 1 139 0"="menu release"
+"2 1 158 1"="back press"
+"2 1 158 0"="back release"
+#"2 1 114 1"="volume down press"
+#"2 1 114 0"="volume down release"
+"2 1 114 1"="menu press"
+"2 1 114 0"="menu release"
 "2 1 115 1"="volume up press"
 "2 1 115 0"="volume up release"
 "2 1 116 1"="power press"
diff --git a/etc/buttonserver.cfg b/etc/buttonserver.cfg
index efe2332..bc6ec5b 100644
--- a/etc/buttonserver.cfg
+++ b/etc/buttonserver.cfg
@@ -1,14 +1,16 @@
 # Nexus S
-"5 1 217 1"="search press"
-"5 1 217 0"="search release"
-"5 1 102 1"="home press"
-"5 1 102 0"="home release"
-"5 1 139 1"="menu press"
-"5 1 139 0"="menu release"
-"5 1 158 1"="back press"
-"5 1 158 0"="back release"
-"2 1 114 1"="volume down press"
-"2 1 114 0"="volume down release"
+"2 1 217 1"="search press"
+"2 1 217 0"="search release"
+"2 1 102 1"="home press"
+"2 1 102 0"="home release"
+"2 1 139 1"="menu press"
+"2 1 139 0"="menu release"
+"2 1 158 1"="back press"
+"2 1 158 0"="back release"
+#"2 1 114 1"="volume down press"
+#"2 1 114 0"="volume down release"
+"2 1 114 1"="menu press"
+"2 1 114 0"="menu release"
 "2 1 115 1"="volume up press"
 "2 1 115 0"="volume up release"
 "2 1 116 1"="power press"
diff --git a/parallel-push.sh b/parallel-push.sh
index c37dd22..2241db7 100755
--- a/parallel-push.sh
+++ b/parallel-push.sh
@@ -4,4 +4,6 @@ for i in `ls`
 do
 	adb push $i /data/inferno/$i &
 done
+adb shell 777 /data/inferno/dis/startzygote
+adb shell 777 /data/inferno/dis/shutdown
 
